Function at 0x140001560
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x178
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor edx, edx
mov ecx, 2
mov esi, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x1400016f0
lea rbp, [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x40], 0x130
mov rdx, rbp
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1400015d3
jmp 0x140001666
mov rdx, rbp
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x140001666
cmp dword [rsp + 0x48], esi
jne 0x1400015c0
mov edx, dword [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140001480
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rax, qword [0x1400e7040]
cmp rcx, rdx
mov r8, rax
je 0x1400017ba
lea r8, [0x1400e7050]
movdqu xmm0, xmmword [rsp + 0x28]
cmp rax, r8
je 0x14000179a
test rax, rax
mov r8, qword [0x1400e7050]
mov qword [0x1400e7040], rcx
movups xmmword [0x1400e7048], xmm0
je 0x1400017a8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], 0
mov byte [rax], 0
mov rcx, qword [rsp + 0x20]
cmp rcx, rdx
je 0x140001666
mov rax, qword [rsp + 0x30]
lea rdx, [rax + 1]
call fcn.1400b5990
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x1400e7048]
lea rcx, [rdi + 0x10]
mov qword [rdi], rcx
mov rsi, qword [0x1400e7040]
cmp rbx, 0xf
mov qword [rsp + 0x20], rbx
ja 0x1400016b8
cmp rbx, 1
je 0x140001760
test rbx, rbx
jne 0x1400016d7
mov rax, rdi
mov qword [rdi + 8], rbx
mov byte [rcx + rbx], 0
add rsp, 0x178
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [rsp + 0x20]
mov rcx, rdi
xor r8d, r8d
call fcn.1400a2af0
mov rcx, rax
mov qword [rdi], rax
mov rax, qword [rsp + 0x20]
mov qword [rdi + 0x10], rax
mov r8, rbx
mov rdx, rsi
call sub.msvcrt.dll_memcpy
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rdi]
jmp 0x14000169e
mov rbx, qword [0x1400c0ea0]
mov r8d, 0x22
lea rdx, str.Failed_to_create_process_snapshot.
mov rcx, rbx
call fcn.1400b0770
mov rax, qword [rbx]
mov rax, qword [rax - 0x18]
mov rsi, qword [rax + rbx + 0xf0]
test rsi, rsi
je 0x140001895
cmp byte [rsi + 0x38], 0
je 0x140001770
movsx edx, byte [rsi + 0x43]
mov rcx, rbx
call fcn.140074f00
mov rcx, rax
call fcn.1400750e0
lea rax, [rdi + 0x10]
mov byte [rdi + 0x10], 0
mov qword [rdi], rax
mov rax, rdi
mov qword [rdi + 8], 0
add rsp, 0x178
pop rbx
pop rsi
pop rdi
pop rbp
ret
movzx eax, byte [rsi]
mov byte [rdi + 0x10], al
jmp 0x14000169e
mov rcx, rsi
call fcn.140027cc0
mov rax, qword [rsi]
mov edx, 0xa
lea rcx, [0x140028370]
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x14000172e
mov rcx, rsi
call rax
movsx edx, al
jmp 0x14000172e
mov qword [0x1400e7040], rcx
movups xmmword [0x1400e7048], xmm0
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x30]
mov rax, rdx
jmp 0x140001642
mov r9, qword [rsp + 0x28]
test r9, r9
mov r10, r9
je 0x140001800
cmp r9, 1
je 0x140001848
cmp r9d, 8
mov eax, r9d
jae 0x140001816
test r9b, 4
jne 0x140001876
test eax, eax
je 0x1400017fa
movzx ecx, byte [rdx]
test al, 2
mov byte [r8], cl
jne 0x14000185d
mov r8, qword [0x1400e7040]
mov r10, qword [rsp + 0x28]
mov r9, r10
mov rax, r8
mov qword [0x1400e7048], r9
mov byte [rax + r9], 0
mov rax, qword [rsp + 0x20]
jmp 0x140001642
mov eax, r9d
mov r9, qword [rcx + rax - 8]
mov qword [r8 + rax - 8], r9
lea eax, [r10 - 1]
cmp eax, 8
jb 0x1400017ee
and eax, 0xfffffff8
xor r9d, r9d
mov r10d, r9d
add r9d, 8
mov r11, qword [rcx + r10]
cmp r9d, eax
mov qword [r8 + r10], r11
jb 0x140001832
jmp 0x1400017ee
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov r9, qword [rsp + 0x28]
mov rax, qword [0x1400e7040]
jmp 0x140001800
movzx ecx, word [rdx + rax - 2]
mov word [r8 + rax - 2], cx
mov r8, qword [0x1400e7040]
mov r10, qword [rsp + 0x28]
jmp 0x1400017fa
mov ecx, dword [rdx]
mov dword [r8], ecx
mov ecx, dword [rdx + rax - 4]
mov dword [r8 + rax - 4], ecx
mov r8, qword [0x1400e7040]
mov r10, qword [rsp + 0x28]
jmp 0x1400017fa
call fcn.1400b6620
nop
nop dword [rax + rax]