Function at 0x140002e60
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r14
sub rsp, 0x198
mov rax, qword [0x140073180]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor edx, edx
mov r14, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140002ebe
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x140060350]
call fcn.140004470
mov rcx, rax
lea rdx, [0x140004640]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x1400030d8
mov qword [rsp + 0x1b0], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x1b8], rsi
mov rcx, rbp
mov qword [rsp + 0x1c0], rdi
mov qword [rsp + 0x190], r12
mov qword [rsp + 0x188], r13
mov qword [rsp + 0x180], r15
mov dword [rsp + 0x40], 0x130
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000309d
movabs r15, 0x7fffffffffffffff
movabs r13, 0x8000000000000000
mov r12d, reloc.WS2_32.dll_shutdown
nop word [rax + rax]
xorps xmm0, xmm0
lea rax, [rsp + 0x6c]
movups xmmword [rsp + 0x20], xmm0
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002f44
cmp rbx, r15
ja 0x14000310a
cmp rbx, 0xf
ja 0x140002f95
mov r8, rbx
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0x6c]
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x20], 0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x20]
jmp 0x14000301e
mov rdi, rbx
or rdi, 0xf
cmp rdi, r15
jbe 0x140002faa
mov rdi, r15
lea rax, [r13 + 0x27]
jmp 0x140002fcb
cmp rdi, r12
cmovb rdi, r12
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140002fea
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003104
mov rcx, rax
call fcn.140052e80
test rax, rax
je 0x1400030f3
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002ffb
test rcx, rcx
je 0x140002ff9
call fcn.140052e80
mov rsi, rax
jmp 0x140002ffb
xor esi, esi
mov r8, rbx
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x6c]
mov qword [rsp + 0x30], rbx
mov rcx, rsi
mov qword [rsp + 0x38], rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
cmp qword [r14 + 0x18], 0xf
mov rdx, r14
jbe 0x14000302b
mov rdx, qword [r14]
cmp rdi, 0xf
lea rcx, [rsp + 0x20]
cmova rcx, rsi
cmp rbx, qword [r14 + 0x10]
jne 0x14000304e
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000304e
mov bl, 1
jmp 0x140003050
xor bl, bl
cmp rdi, 0xf
jbe 0x140003083
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000307b
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030f3
mov rcx, rsi
call fcn.140052ebc
mov rcx, rbp
test bl, bl
jne 0x1400030fa
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140002f30
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov r13, qword [rsp + 0x188]
mov r12, qword [rsp + 0x190]
mov rdi, qword [rsp + 0x1c0]
mov rsi, qword [rsp + 0x1b8]
mov rbx, qword [rsp + 0x1b0]
mov r15, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140052e60
add rsp, 0x198
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1400030a8
call fcn.140001520
int3
call fcn.1400015c0
int3