Function at 0x140007ec0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140299ac0]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor r15d, r15d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x140008199
mov dword [rbp - 0x80], 0x238
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140008199
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140008190
mov r12, qword [0x14029bfa0]
mov rax, qword [0x14029bfa8]
mov qword [rsp + 0x48], rax
cmp r12, rax
je 0x14000817b
nop dword [rax]
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.140003b00
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rsi, qword [rsp + 0x68]
sub rax, rsi
cmp rax, 4
jb 0x14000821b
lea r13, [rsp + 0x58]
mov r14, qword [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova r13, r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
lea r15, [rsi + 4]
mov ebx, 0xf
lea rdi, [rsp + 0x28]
cmp r15, rbx
jbe 0x140008051
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x140007ff5
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140008025
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14000800f
xor edi, edi
jmp 0x14000804c
cmp rcx, 0x1000
jb 0x140008044
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140008227
mov rcx, rax
call fcn.14003db14
test rax, rax
je 0x140008221
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000804c
call fcn.14003db14
mov rdi, rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], rbx
mov r8, rsi
mov rdx, r13
mov rcx, rdi
call fcn.140049380
mov dword [rdi + rsi], 0x6578652e
mov byte [rdi + r15], 0
mov edi, dword [rsp + 0x20]
or edi, 1
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x28]
mov r8, qword [rsp + 0x28]
mov r9, qword [rsp + 0x40]
cmp r9, 0xf
cmova rdx, r8
lea rax, [rbp - 0x54]
sub rdx, rax
nop
movzx ecx, byte [rax]
cmp cl, byte [rax + rdx]
jne 0x1400080b7
inc rax
test cl, cl
jne 0x1400080a0
xor r15d, r15d
mov ebx, r15d
jmp 0x1400080bf
sbb ebx, ebx
or ebx, 1
xor r15d, r15d
and edi, 0xfffffffe
mov dword [rsp + 0x20], edi
cmp r9, 0xf
jbe 0x1400080fd
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x1400080f5
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000822d
mov rcx, r8
call fcn.14003db0c
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], 0
mov rax, qword [rsp + 0x70]
test ebx, ebx
je 0x1400081cb
cmp rax, 0xf
jbe 0x140008154
lea rdx, [rax + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000814c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008215
mov rcx, r14
call fcn.14003db0c
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
add r12, 0x20
cmp r12, qword [rsp + 0x48]
jne 0x140007f70
mov rbx, qword [rsp + 0x50]
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140007f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14003dac0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp rax, 0xf
jbe 0x1400081fe
lea rdx, [rax + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400081f6
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008215
mov rcx, r14
call fcn.14003db0c
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov al, 1
jmp 0x14000819b
call fcn.14002af5c
nop
call fcn.1400027f0
int3
call fcn.14002af5c
int3
call fcn.140002730
nop
call fcn.14002af5c
int3