Function at 0x14002b230
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x140232100]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov r15, rdx
mov r14, qword [0x14023a7d0]
mov qword [rbp - 0x30], r14
mov dword [rbp - 0x20], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14002b9eb
lea rdx, [rbp - 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
xor r12d, r12d
test eax, eax
je 0x14002b3a2
nop dword [rax + rax]
mov ecx, 0x18
call fcn.140138180
mov rbx, rax
mov qword [rbp - 0x28], rax
test rax, rax
je 0x14002b305
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, [rbp + 0xc]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14002ba28
jmp 0x14002b308
mov rbx, r12
mov qword [rsp + 0x40], rbx
test rbx, rbx
je 0x14002ba1d
mov rax, qword [rbx + 8]
test rax, rax
jne 0x14002b32b
mov rcx, qword [rbx]
call fcn.140139120
mov qword [rbx + 8], rax
mov rdx, r15
sub rdx, rax
movzx edi, byte [rax]
movzx ecx, byte [rax + rdx]
sub edi, ecx
jne 0x14002b343
inc rax
test ecx, ecx
jne 0x14002b331
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14002b382
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002b363
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002b375
call fcn.1401383fc
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.1401383fc
test edi, edi
jne 0x14002b38d
mov eax, dword [rbp - 0x18]
mov dword [r14 + 0x10], eax
lea rdx, [rbp - 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14002b2c0
mov r8d, dword [r14 + 0x10]
test r8d, r8d
je 0x14002b9eb
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r14 + 8], rax
mov byte [rsp + 0x58], 0x53
mov sil, 0x61
mov al, 0x62
mov cl, 0x67
mov dl, 0x64
mov r8b, 0x60
mov r9b, 0x66
movzx r10d, r8b
movzx r11d, al
mov bl, 0x6b
movzx edi, cl
xor r15d, r15d
xor sil, 0x53
mov byte [rsp + 0x59], sil
xor al, 0x53
mov byte [rsp + 0x5a], al
xor cl, 0x53
mov byte [rsp + 0x5b], cl
xor dl, 0x53
mov byte [rsp + 0x5c], dl
xor r8b, 0x53
mov byte [rsp + 0x5d], r8b
xor r9b, 0x53
mov byte [rsp + 0x5e], r9b
xor r10b, 0x53
mov byte [rsp + 0x5f], r10b
xor r11b, 0x53
mov byte [rsp + 0x60], r11b
xor bl, 0x53
mov byte [rsp + 0x61], bl
xor dil, 0x53
mov byte [rsp + 0x62], dil
mov byte [rsp + 0x63], r15b
lea r8, [rsp + 0x59]
mov r11d, 0x39
mov ecx, r11d
call fcn.14002b150
mov r9, rax
cmp sil, 0x30
jl 0x14002b480
cmp sil, r11b
ja 0x14002b480
mov ecx, 0x68b
call fcn.14002b150
imul eax, r9d
movzx r9d, sil
add eax, 0xffffffd0
add r9d, eax
inc r8
movzx esi, byte [r8]
cmp sil, 0x30
jge 0x14002b456
movsxd rax, r9d
mov ecx, dword [rax]
mov dword [r14], ecx
mov byte [rsp + 0x48], 0xe
mov r9b, 0x3f
mov al, 0x37
mov cl, 0x3e
mov dl, 0x3a
movzx r8d, r9b
xor r10d, r10d
xor r9b, 0xe
mov byte [rsp + 0x49], r9b
xor al, 0xe
mov byte [rsp + 0x4a], al
xor cl, 0xe
mov byte [rsp + 0x4b], cl
xor dl, 0xe
mov byte [rsp + 0x4c], dl
xor r8b, 0xe
mov byte [rsp + 0x4d], r8b
mov byte [rsp + 0x4e], r10b
lea r8, [rsp + 0x49]
mov rcx, r11
call fcn.14002b150
mov r10, rax
cmp r9b, 0x30
jl 0x14002b50a
nop
cmp r9b, r11b
ja 0x14002b50a
mov ecx, 0x68b
call fcn.14002b150
imul eax, r10d
movzx r10d, r9b
add eax, 0xffffffd0
add r10d, eax
inc r8
movzx r9d, byte [r8]
cmp r9b, 0x30
jge 0x14002b4e0
cmp dword [r14], r10d
jb 0x14002b9eb
mov ecx, 0x41
mov dword [rsp + 0x40], ecx
mov word [rsp + 0x70], cx
mov eax, 0x34
mov word [rsp + 0x68], ax
lea edi, [rcx - 0x14]
lea r15d, [rcx - 0x1c]
movzx esi, cx
movzx r12d, word [0x1401ca306]
xor r12w, cx
movzx r14d, word [str.____could_not_find_win32u_____p_n]
xor r14w, cx
movzx ebx, word [0x1401ca30a]
xor bx, cx
movzx r11d, word [0x1401ca30c]
xor r11w, cx
movzx r10d, word [0x1401ca30e]
xor r10w, cx
movzx r9d, word [0x1401ca310]
xor r9w, cx
movzx r8d, word [0x1401ca312]
xor r8w, cx
movzx edx, word [0x1401ca314]
xor dx, cx
movzx ecx, word [0x1401ca316]
xor cx, si
movzx eax, word [0x1401ca318]
xor ax, si
mov r13d, 0x36
xor r13w, word [rsp + 0x40]
mov word [rsp + 0x72], r13w
mov r13d, 0x28
xor r13w, word [rsp + 0x40]
mov word [rsp + 0x74], r13w
mov r13d, 0x2f
xor r13w, word [rsp + 0x40]
mov word [rsp + 0x76], r13w
mov r13d, 0x72
xor r13w, word [rsp + 0x40]
mov word [rsp + 0x78], r13w
mov r13d, 0x73
xor r13w, word [rsp + 0x40]
mov word [rsp + 0x7a], r13w
movzx r13d, word [rsp + 0x68]
xor r13w, word [rsp + 0x40]
mov word [rsp + 0x7c], r13w
mov r13d, 0x6f
xor r13w, word [rsp + 0x40]
mov word [rsp + 0x7e], r13w
mov r13d, 0x41
xor r15w, r13w
mov word [rbp - 0x80], r15w
mov r15d, edi
xor r15w, r13w
mov word [rbp - 0x7e], r15w
xor di, r13w
mov word [rbp - 0x7c], di
xor si, r13w
mov word [rbp - 0x7a], si
xor r12w, r13w
mov word [rbp - 0x78], r12w
xor r14w, r13w
mov word [rbp - 0x76], r14w
xor bx, r13w
mov word [rbp - 0x74], bx
xor r11w, r13w
mov word [rbp - 0x72], r11w
xor r10w, r13w
mov word [rbp - 0x70], r10w
xor r9w, r13w
mov word [rbp - 0x6e], r9w
xor r8w, r13w
mov word [rbp - 0x6c], r8w
xor dx, r13w
mov word [rbp - 0x6a], dx
xor cx, r13w
mov word [rbp - 0x68], cx
xor ax, r13w
mov word [rbp - 0x66], ax
xor eax, eax
mov word [rbp - 0x64], ax
lea rcx, [rsp + 0x72]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r12, rax
test rax, rax
jne 0x14002b850
mov ecx, 0x50
mov dword [rsp + 0x40], ecx
mov word [rbp - 0x60], cx
lea edi, [rax + 0x3c]
lea r15d, [r13 - 8]
movzx esi, cx
movzx r12d, word [0x1401ca306]
xor r12w, cx
movzx r14d, word [str.____could_not_find_win32u_____p_n]
xor r14w, cx
movzx ebx, word [0x1401ca30a]
xor bx, cx
movzx r11d, word [0x1401ca30c]
xor r11w, cx
movzx r10d, word [0x1401ca30e]
xor r10w, cx
movzx r9d, word [0x1401ca310]
xor r9w, cx
movzx r8d, word [0x1401ca312]
xor r8w, cx
movzx edx, word [0x1401ca314]
xor dx, cx
movzx ecx, word [0x1401ca316]
xor cx, si
movzx eax, word [0x1401ca318]
xor ax, si
mov r13d, 0x27
xor r13w, word [rsp + 0x40]
mov word [rbp - 0x5e], r13w
mov r13d, 0x50
xor r15w, r13w
mov word [rbp - 0x5c], r15w
mov r15d, 0x3e
xor r15w, r13w
mov word [rbp - 0x5a], r15w
mov r15d, 0x63
xor r15w, r13w
mov word [rbp - 0x58], r15w
mov r15d, 0x62
xor r15w, r13w
mov word [rbp - 0x56], r15w
mov r15d, 0x25
xor r15w, r13w
mov word [rbp - 0x54], r15w
mov r15d, 0x7e
xor r15w, r13w
mov word [rbp - 0x52], r15w
mov r15d, 0x34
xor r15w, r13w
mov word [rbp - 0x50], r15w
mov r15d, edi
xor r15w, r13w
mov word [rbp - 0x4e], r15w
xor di, r13w
mov word [rbp - 0x4c], di
xor si, r13w
mov word [rbp - 0x4a], si
xor r12w, r13w
mov word [rbp - 0x48], r12w
xor r14w, r13w
mov word [rbp - 0x46], r14w
xor bx, r13w
mov word [rbp - 0x44], bx
xor r11w, r13w
mov word [rbp - 0x42], r11w
xor r10w, r13w
mov word [rbp - 0x40], r10w
xor r9w, r13w
mov word [rbp - 0x3e], r9w
xor r8w, r13w
mov word [rbp - 0x3c], r8w
xor dx, r13w
mov word [rbp - 0x3a], dx
xor cx, r13w
mov word [rbp - 0x38], cx
xor ax, r13w
mov word [rbp - 0x36], ax
xor eax, eax
mov word [rbp - 0x34], ax
lea rcx, [rbp - 0x5e]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
test rax, rax
je 0x14002b9eb
mov byte [rsp + 0x50], 0x10
mov r10b, 0x21
mov al, 0x29
mov dl, 0x20
mov r8b, 0x24
movzx r9d, r10b
xor ecx, ecx
xor r10b, 0x10
mov byte [rsp + 0x51], r10b
xor al, 0x10
mov byte [rsp + 0x52], al
xor dl, 0x10
mov byte [rsp + 0x53], dl
xor r8b, 0x10
mov byte [rsp + 0x54], r8b
xor r9b, 0x10
mov byte [rsp + 0x55], r9b
mov byte [rsp + 0x56], cl
lea r8, [rsp + 0x51]
mov ecx, 0x39
call fcn.14002b150
mov r9, rax
cmp r10b, 0x30
jl 0x14002b8db
nop dword [rax]
cmp r10b, 0x39
ja 0x14002b8db
mov ecx, 0x68b
call fcn.14002b150
imul eax, r9d
movzx r9d, r10b
add eax, 0xffffffd0
add r9d, eax
inc r8
movzx r10d, byte [r8]
cmp r10b, 0x30
jge 0x14002b8b0
mov rax, qword [rbp - 0x30]
cmp dword [rax], r9d
jb 0x14002b9e7
movdqa xmm1, xmmword [0x140216500]
movdqu xmmword [rsp + 0x20], xmm1
mov cl, 0x53
mov r8b, 0x58
mov r9b, 0x40
mov r10b, 0x64
mov r11b, 0x43
mov bl, 0x56
movzx edi, r11b
mov sil, 0x5e
movzx r14d, r8b
mov r15b, 0x59
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x21], al
xor byte [rsp + 0x22], dl
xor byte [rsp + 0x23], dl
xor byte [rsp + 0x24], dl
xor byte [rsp + 0x25], dl
xor byte [rsp + 0x26], dl
xor byte [rsp + 0x27], dl
xor byte [rsp + 0x28], dl
xor byte [rsp + 0x29], dl
xor byte [rsp + 0x2a], dl
xor byte [rsp + 0x2b], dl
xor byte [rsp + 0x2c], dl
xor byte [rsp + 0x2d], dl
xor byte [rsp + 0x2e], dl
xor byte [rsp + 0x2f], dl
xor cl, dl
mov byte [rsp + 0x30], cl
xor r8b, dl
mov byte [rsp + 0x31], r8b
xor r9b, dl
mov byte [rsp + 0x32], r9b
xor r10b, dl
mov byte [rsp + 0x33], r10b
xor r11b, dl
mov byte [rsp + 0x34], r11b
xor bl, dl
mov byte [rsp + 0x35], bl
xor dil, dl
mov byte [rsp + 0x36], dil
xor sil, dl
mov byte [rsp + 0x37], sil
xor r14b, dl
mov byte [rsp + 0x38], r14b
xor r15b, dl
mov byte [rsp + 0x39], r15b
mov byte [rsp + 0x3a], 0
lea rdx, [rsp + 0x21]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14002b9eb
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_CreateWindowStationW]
test rax, rax
je 0x14002b9eb
mov qword [0x140239bf8], rbx
mov al, 1
jmp 0x14002b9ed
xor al, al
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.140138160
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140139110
nop
mov ecx, 0x8007000e
call fcn.140139110
int3