Function at 0x14001aea0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x240
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rbp + 8], ebx
lea r13, [rsp + 0x268]
movabs rax, 0xff00ff00ff00ff00
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], r13
mov r12, qword [r13]
xor r12, rax
mov qword [rbp + 0xb8], r12
mov qword [r13], rbx
mov dword [rbp + 0xd0], 0x130
xor edx, edx
lea ecx, [rbx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14001b073
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], bl
movups xmmword [rsi + 0x20], xmm0
mov qword [rsi + 0x30], rbx
mov qword [rsi + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsi + 0x20], bl
movups xmmword [rsi + 0x40], xmm0
mov qword [rsi + 0x50], rbx
mov qword [rsi + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsi + 0x40], bl
movups xmmword [rsi + 0x60], xmm0
mov qword [rsi + 0x70], rbx
mov qword [rsi + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsi + 0x60], bl
mov dword [rbp + 8], 1
lea rdx, [rbp + 0xd0]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x14001b1bf
nop word [rax + rax]
mov r8, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x14001afad
mov r8, qword [r14]
lea rax, [rbp + 0xfc]
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14001afd3
inc rax
test ecx, ecx
jne 0x14001afc0
test edx, edx
jne 0x14001b017
mov r8d, dword [rbp + 0xd8]
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14001b2ae
mov r8, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, rsi
mov rcx, rax
call fcn.1400198b0
movzx ebx, al
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14001b034
lea rdx, [rbp + 0xd0]
mov rcx, r15
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
jne 0x14001b1bf
jmp 0x14001afa0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
movabs rax, 0xff00ff00ff00ff00
xor r12, rax
mov qword [r13], r12
mov rax, rsi
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movabs rax, 0xf48d32c7a0642a0d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xa484f692f2fb48a3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xc32a51dfb04ab875
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x7a3ef53932fc5b0e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x4e3a76aedf993d8b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rdx, 0x78cadf131ee73740
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x80ad56a2cc0d4b4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xc1f097f7809868cc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xb05934bcdf38c855
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rcx, 0x155686495392282e
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0x4e3a76aedf993dff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqa xmm2, xmmword [rbp + 0x40]
vxorps xmm2, xmm2, xmmword [rbp + 0x80]
vmovdqa xmmword [rbp + 0x40], xmm2
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xa0]
vzeroupper
call fcn.140018ca0
lea rdx, [0x1400a16d8]
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0xefc376c6a0782408
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xa5d0f399e9fe48b8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xc0795ad5ff59bc34
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x1556f53a36f1475c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x80ad56a2cc0d4b4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xc1f097f7809868cc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xb05934bcdf38c855
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rcx, 0x155686495392282e
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xa0]
vzeroupper
call fcn.140018ca0
lea rdx, [0x1400a16d8]
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0xf48d32c7a0642a0d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xb1d0f992f0f748a3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xb05947cfba5ba727
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rcx, 0x155686495392282e
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x80ad56a2cc0d4b4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xc1f097f7809868cc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xb05934bcdf38c855
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xa0]
vzeroupper
call fcn.140018ca0
lea rdx, [0x1400a16d8]
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3