Function at 0x14001d260
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x14054a2c0]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rbx, rcx
xor r12d, r12d
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x14001d57c
mov dword [rsp + 0x60], 0x238
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14001c920
nop
lea rdi, [rsp + 0x40]
mov r8, qword [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdi, r8
lea rcx, [rsp + 0x40]
cmova rcx, r8
mov rax, qword [rsp + 0x50]
lea rsi, [rcx + rax*2]
lea rbx, [rsp + 0x40]
cmova rbx, r8
cmp rbx, rsi
je 0x14001d31a
sub rdi, rbx
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
mov word [rdi + rbx], ax
add rbx, 2
cmp rbx, rsi
jne 0x14001d304
lea rdx, [rsp + 0x60]
mov rcx, r13
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14001d4d8
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r12
lea rax, [rbp - 0x74]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001d350
lea rdx, [rbp - 0x74]
lea rcx, [rsp + 0x20]
call fcn.14001b9c0
nop
lea rdi, [rsp + 0x20]
mov r14, qword [rsp + 0x20]
mov r15, qword [rsp + 0x38]
cmp r15, 7
cmova rdi, r14
lea rax, [rsp + 0x20]
cmova rax, r14
mov rcx, qword [rsp + 0x30]
lea rsi, [rax + rcx*2]
lea rbx, [rsp + 0x20]
cmova rbx, r14
cmp rbx, rsi
je 0x14001d3c9
sub rdi, rbx
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
mov word [rdi + rbx], ax
add rbx, 2
cmp rbx, rsi
jne 0x14001d3a4
mov r15, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x20]
lea r11, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova r11, qword [rsp + 0x40]
lea rdi, [rsp + 0x20]
cmp r15, 7
cmova rdi, r14
mov rbx, qword [rsp + 0x50]
cmp rbx, rcx
ja 0x14001d488
sub rcx, rbx
test rbx, rbx
je 0x14001d52f
lea rsi, [rcx + 1]
lea rsi, [rdi + rsi*2]
mov rax, rdi
movzx r10d, word [r11]
mov rcx, rsi
sub rcx, rax
sar rcx, 1
mov rdx, r12
je 0x14001d43a
cmp word [rax], r10w
je 0x14001d437
cmp rcx, 1
je 0x14001d43a
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x14001d424
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14001d488
mov r8, rbx
mov rdx, r11
test rbx, rbx
je 0x14001d478
mov r9, rax
sub r9, r11
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdx + r9]
cmp cx, word [rdx]
jne 0x14001d526
add rdx, 2
sub r8, 1
jne 0x14001d460
sub rax, rdi
sar rax, 1
cmp rax, 0xffffffffffffffff
jne 0x14001d52f
cmp r15, 7
jbe 0x14001d4c3
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14001d4bb
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d570
mov rcx, r14
call fcn.14015eecc
lea rdx, [rsp + 0x60]
mov rcx, r13
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14001d330
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14001d57c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d577
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d577
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
add rax, 2
jmp 0x14001d410
mov r12d, dword [rsp + 0x68]
cmp r15, 7
jbe 0x14001d4d8
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14001d563
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d570
mov rcx, r14
call fcn.14015eecc
jmp 0x14001d4d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14015eecc
mov eax, r12d
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14015f280
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret