Function at 0x140069ca0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rdi, rcx
xor r13d, r13d
mov r12d, r13d
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r15, rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x44]
call fcn.140137f50
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, r15
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140069e88
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], 7
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r12w
jne 0x140069d30
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.14003a5e0
lea rsi, [rsp + 0x20]
mov r8, qword [rsp + 0x20]
mov r11, qword [rsp + 0x38]
cmp r11, 8
cmovae rsi, r8
lea rax, [rsp + 0x20]
cmovae rax, r8
mov rdx, qword [rsp + 0x30]
lea r14, [rax + rdx*2]
lea rbx, [rsp + 0x20]
cmovae rbx, r8
cmp rbx, r14
je 0x140069da7
sub rsi, rbx
movzx ecx, word [rbx]
call fcn.140172bc0
mov word [rsi + rbx], ax
add rbx, 2
cmp rbx, r14
jne 0x140069d83
mov r11, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x20]
mov r9, qword [rdi + 0x18]
mov r10, qword [rdi + 0x10]
cmp r9, 8
jb 0x140069dc1
mov rbx, qword [rdi]
lea r14, [rbx + r10*2]
mov rsi, rbx
jmp 0x140069dcb
lea r14, [rdi + r10*2]
mov rbx, rdi
mov rsi, rdi
cmp rbx, r14
je 0x140069dff
sub rsi, rbx
movzx ecx, word [rbx]
call fcn.140172bc0
mov word [rbx + rsi], ax
add rbx, 2
cmp rbx, r14
jne 0x140069dd3
mov r9, qword [rdi + 0x18]
mov r10, qword [rdi + 0x10]
mov r11, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x20]
mov rcx, rdi
cmp r9, 8
jb 0x140069e0b
mov rcx, qword [rdi]
lea r9, [rsp + 0x20]
cmp r11, 8
cmovae r9, r8
cmp rdx, r10
jne 0x140069f05
test rdx, rdx
je 0x140069e48
sub r9, rcx
nop dword [rax]
movzx eax, word [rcx]
cmp word [rcx + r9], ax
jne 0x140069f05
add rcx, 2
sub rdx, 1
jne 0x140069e30
mov r12d, dword [rsp + 0x48]
cmp r11, 8
jb 0x140069e88
lea rdx, [r11*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x140069e80
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069f4e
mov rcx, r8
call fcn.140133e68
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140069ed1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140069ecc
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140069f54
mov rcx, r8
call fcn.140133e68
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 7
mov word [rdi], r13w
mov eax, r12d
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp r11, 8
jb 0x140069f3c
lea rdx, [r11*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x140069f34
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069f4e
mov rcx, r8
call fcn.140133e68
lea rdx, [rsp + 0x40]
mov rcx, r15
call sub.KERNEL32.dll_Process32NextW
jmp 0x140069d09
call fcn.1401462a8
nop
call fcn.1401462a8
int3