Function at 0x180003d20
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x8c0]
sub rsp, 0x9c0
mov rax, qword [0x180015008]
xor rax, rsp
mov qword [rbp + 0x8b0], rax
mov rsi, r8
lea rcx, [rbp + 0xb0]
mov rbx, rdx
mov r8d, 0x800
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, rbx
call fcn.1800037d8
mov edx, 0x8000
mov rcx, rsi
mov r14d, eax
call fcn.1800039a0
test r14d, r14d
jle 0x180003d8e
mov edx, r14d
mov rcx, rsi
call fcn.180003a38
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.1800040b4
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180003dd6
lea rax, [0x1800114c0]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.180003b00
mov eax, 0x1f
jmp 0x180003f9e
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x130
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x180003e02
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, str.CreateToolhelp32Snapshot__Process32First
jmp 0x180003db7
mov rcx, qword [0x1817777c0]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov r8d, dword [rsp + 0x58]
cmp al, 6
sbb ecx, ecx
xor edx, edx
and ecx, 0xfffff400
add ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
jne 0x180003e80
movzx ecx, word [0x180011518]
movsd xmm0, qword [str._nd__td__ts_]
mov word [rbp + 0x88], cx
lea rcx, [rbp + 0x80]
movsd qword [rbp + 0x80], xmm0
call sub.msvcrt.dll__strrev
mov ecx, dword [rsp + 0x58]
lea r8, [rsp + 0x7c]
mov r9d, dword [rsp + 0x70]
mov rdx, rax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.180003a68
jmp 0x180003f6b
lea r8, [rsp + 0x48]
mov edx, 8
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180003ebf
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp + 0xb0]
mov r8d, 0x800
call fcn.18000725c
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x180003ec6
mov byte [rbp + 0xb0], 0
mov ecx, dword [rsp + 0x58]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov ecx, dword [rsp + 0x40]
or edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov dword [rsp + 0x40], ecx
mov rcx, r15
call fcn.1800040b4
movups xmm0, xmmword [str._nd__ts__ts__td__td__ts_]
test eax, eax
lea rcx, [0x1800114b8]
movzx eax, word [0x180011530]
lea rbx, [0x1800114bc]
mov word [rbp + 0xa0], ax
cmove rbx, rcx
mov al, byte [0x180011532]
lea rcx, [rbp + 0x90]
mov byte [rbp + 0xa2], al
movups xmmword [rbp + 0x90], xmm0
call sub.msvcrt.dll__strrev
mov r9d, dword [rsp + 0x70]
lea r8, [rsp + 0x7c]
mov rdx, rax
mov rcx, rsi
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x38], eax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x58]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
call fcn.180003a68
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180003e02
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
neg r14d
sbb eax, eax
and eax, 5
add eax, 0x11
mov rcx, qword [rbp + 0x8b0]
xor rcx, rsp
call fcn.18000e670
mov rbx, qword [rsp + 0x9f0]
add rsp, 0x9c0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret