Function at 0x140002750
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2e0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor r14d, r14d
mov r12d, r14d
mov dword [rsp + 0x20], r14d
mov dword [rbp - 0x80], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140002af1
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rcx, r15
test eax, eax
je 0x140002aeb
mov ebx, r14d
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
movabs rdx, 0x7fffffffffffffff
test eax, eax
je 0x140002989
movabs r13, 0x7ffffffffffffffe
mov ecx, 0xa
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rax, [rbp - 0x54]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp word [rax + rdi*2], r12w
jne 0x140002810
cmp rdi, r13
ja 0x140002cc1
cmp rdi, 8
jae 0x140002866
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
lea rbx, [rdi + rdi]
mov r8, rbx
lea rdx, [rbp - 0x54]
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x48], r14w
mov r14, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
jmp 0x140002901
mov r14, rdi
or r14, 7
cmp r14, r13
jbe 0x14000287b
mov r14, r13
lea rcx, [rdx + rdx]
jmp 0x14000289c
cmp r14, 0xa
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, rdx
ja 0x140002cc7
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400028c8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002cc7
mov rcx, rax
call fcn.140003ba8
test rax, rax
je 0x140002ae1
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400028d9
test rcx, rcx
je 0x1400028d7
call fcn.140003ba8
mov rsi, rax
jmp 0x1400028d9
xor esi, esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r14
lea rbx, [rdi + rdi]
mov r8, rbx
lea rdx, [rbp - 0x54]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov word [rbx + rsi], ax
lea r8, [rsp + 0x48]
cmp r14, 8
setae r9b
cmovae r8, rsi
cmp rdi, 0x14
jne 0x140002a88
mov rdx, rdi
lea rbx, str.ROBUX_ARE_A_SCAM.exe
mov rcx, rbx
sub r8, rbx
nop dword [rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140002a88
add rcx, 2
sub rdx, 1
jne 0x140002930
mov ebx, dword [rbp - 0x78]
cmp r14, 8
jb 0x140002986
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000297e
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ae1
mov rcx, rsi
call fcn.140003ba0
xor r14d, r14d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140002af1
lea rdx, str.RUNE_ON_TOP
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
je 0x140002af1
lea r13, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
movabs rdi, 0x7fffffff88ca6bff
movabs r15, 0x311cdad160000
movsd xmm6, qword [0x140005ca0]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r14w
or r12d, 1
mov dword [rsp + 0x20], r12d
mov edx, 0x19
lea rcx, [rsp + 0x28]
call fcn.1400035e0
mov qword [rsp + 0x38], r14
mov ebx, 0x19
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x84210843
imul r8d
add edx, r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x3e
sub r8d, ecx
movsxd rax, r8d
movzx r9d, word [r13 + rax*2]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
cmp rcx, rdx
jae 0x140002b28
lea rax, [rcx + 1]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x28]
cmp rdx, 8
cmovae rax, qword [rsp + 0x28]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r14w
jmp 0x140002b32
test r9b, r9b
je 0x140002abe
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140002ab6
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ae1
mov rcx, rsi
call fcn.140003ba0
lea rdx, [rbp - 0x80]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140002ae8
xor r14d, r14d
movabs rdx, 0x7fffffffffffffff
jmp 0x1400027f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140003a60
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [rsp + 0x28]
call fcn.140003760
sub rbx, 1
jne 0x140002a20
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowTextW]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140002b74
imul rax, rax, 0x64
jmp 0x140002b8f
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
lea rdi, [rax + 0x77359400]
jl 0x140002ba5
movabs rdi, 0x7fffffffffffffff
movabs r13, 0x112e0be826d694b3
nop
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140002bce
imul rbx, rax, 0x64
jmp 0x140002bea
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
cmp rbx, rdi
jge 0x140002c5e
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rdx, rax, 0x64
mov rax, rdi
sub rax, rbx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
seta r8b
test r8b, r8b
lea rcx, [rdx + r15]
jne 0x140002c1c
lea rcx, [rdx + rax]
add rax, rdx
add rdx, r15
test r8b, r8b
cmove rdx, rax
mov rax, r13
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x68], rdx
imul eax, edx, 0x3b9aca00
sub ecx, eax
mov dword [rsp + 0x70], ecx
lea rcx, [rsp + 0x68]
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x140002bb0
and r12d, 0xfffffffe
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
lea r13, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
movabs rdi, 0x7fffffff88ca6bff
jb 0x1400029e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cb0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002cba
call fcn.140003ba0
jmp 0x1400029e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001b10
int3
call fcn.140001a70
int3