Function at 0x140006790
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x140028580]
xor rax, rsp
mov qword [rbp + 0x250], rax
xor esi, esi
mov dword [rsp + 0x48], esi
xor edx, edx
mov r8d, 0x130
lea rcx, [rbp - 0x10]
call fcn.14000b9b0
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], sil
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], sil
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
mov r15d, esi
mov qword [rbp - 0x38], rsi
movdqu xmmword [rbp - 0x30], xmm1
mov r13d, esi
mov qword [rbp - 0x20], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x124]
call fcn.14000b9b0
mov r14d, esi
mov dword [rbp + 0x120], 0x130
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x120]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140006890
cmp dword [rbp + 0x128], edi
je 0x140006889
lea rdx, [rbp + 0x120]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x14000686b
mov r14d, dword [rbp + 0x140]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp - 0xc]
call fcn.14000b9b0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
mov qword [rsp + 0x50], rax
lea r8, [0x140028390]
lea rdx, [0x140028380]
lea rcx, [rsp + 0x28]
call fcn.1400014c0
lea rcx, [rbp - 0x48]
cmp rcx, rax
je 0x140006902
mov rdi, qword [rax]
mov qword [rbp - 0x48], rdi
mov rbx, qword [rax + 8]
mov qword [rbp - 0x40], rbx
mov r15, qword [rax + 0x10]
mov qword [rbp - 0x38], r15
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
jmp 0x14000690a
mov rbx, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x48]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140006946
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006941
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d6a
call fcn.140009f70
sub rbx, rdi
lea r8, [rbx - 1]
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.140008430
mov qword [rbp - 0x40], rdi
lea r8, [0x140028490]
lea rdx, [0x140028480]
lea rcx, [rsp + 0x28]
call fcn.1400014c0
lea rcx, [rbp - 0x30]
cmp rcx, rax
je 0x1400069a4
mov rsi, qword [rax]
mov qword [rbp - 0x30], rsi
mov rbx, qword [rax + 8]
mov qword [rbp - 0x28], rbx
mov r13, qword [rax + 0x10]
mov qword [rbp - 0x20], r13
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
jmp 0x1400069ac
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x30]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400069e8
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d70
call fcn.140009f70
sub rbx, rsi
lea r8, [rbx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x78]
call fcn.140008430
mov qword [rbp - 0x28], rsi
mov dword [rbp - 0x10], 0x130
lea rdx, [rbp - 0x10]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140006c1d
cmp dword [rbp - 8], r14d
je 0x140006a31
lea rdx, [rbp - 0x10]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x140006a14
xor r12d, r12d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], r12b
lea rax, [rbp + 0x1c]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140006a60
lea rdx, [rbp + 0x1c]
lea rcx, [rsp + 0x28]
call fcn.140008430
nop
mov r14d, 1
mov dword [rsp + 0x48], r14d
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
setae byte [rsp + 0x22]
cmovae rdx, qword [rbp - 0x68]
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
setae byte [rsp + 0x21]
cmovae rcx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x38]
cmp r8, qword [rbp - 0x58]
jne 0x140006ad5
call fcn.14001be50
test eax, eax
jne 0x140006ad5
mov r12, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x58]
mov byte [rsp + 0x20], r14b
jmp 0x140006b57
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 0xf
lea rax, [rbp + 0x1c]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140006af0
mov r8, rbx
lea rdx, [rbp + 0x1c]
lea rcx, [rsp + 0x58]
call fcn.140008430
mov r14d, 3
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x58]
mov rbx, qword [rsp + 0x58]
mov r12, qword [rsp + 0x70]
cmp r12, 0x10
cmovae rcx, rbx
mov r8, qword [rsp + 0x68]
cmp r8, qword [rbp - 0x78]
jne 0x140006b52
call fcn.14001be50
test eax, eax
jne 0x140006b52
mov byte [rsp + 0x20], 1
jmp 0x140006b57
mov byte [rsp + 0x20], 0
test r14b, 2
je 0x140006b9a
and r14d, 0xfffffffd
cmp r12, 0x10
jb 0x140006b9a
lea rdx, [r12 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140006b91
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d76
mov rcx, rbx
call fcn.140009f70
nop
test r14b, 1
je 0x140006bde
cmp byte [rsp + 0x21], 0
je 0x140006bde
mov rdx, qword [rsp + 0x40]
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006bd9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d7c
call fcn.140009f70
cmp byte [rsp + 0x20], 0
je 0x140006c18
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp - 0x68]
cmp byte [rsp + 0x22], 0
cmovne rax, qword [rbp - 0x68]
mov byte [rax], 0
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rax, qword [rsp + 0x78]
mov ebx, 1
jmp 0x140006c49
mov r12, qword [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rax, qword [rbp - 0x68]
mov byte [rax], 0
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rax, qword [rsp + 0x78]
xor ebx, ebx
mov byte [rax], 0
test rsi, rsi
je 0x140006c85
sub r13, rsi
mov rax, rsi
cmp r13, 0x1000
jb 0x140006c79
add r13, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d82
mov rdx, r13
mov rcx, rsi
call fcn.140009f70
nop
test rdi, rdi
je 0x140006cbe
sub r15, rdi
mov rax, rdi
cmp r15, 0x1000
jb 0x140006cb2
add r15, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d88
mov rdx, r15
mov rcx, rdi
call fcn.140009f70
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140006cfb
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006cf5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d8e
call fcn.140009f70
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140006d32
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d64
call fcn.140009f70
mov eax, ebx
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.140009950
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001063c
nop
call fcn.14001063c
nop
call fcn.14001063c
nop
call fcn.14001063c
nop
call fcn.14001063c
nop
call fcn.14001063c
nop
call fcn.14001063c
nop
call fcn.14001063c
int3