Function at 0x140002c30
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
sub rsp, 0x2f0
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400870c0]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140002c8c
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002ef3
lea rdx, [rbp + 0x40]
mov dword [rbp + 0x40], 0x238
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140002dec
xor r15d, r15d
nop dword [rax + rax]
lea rdx, [rbp + 0x6c]
lea rcx, [rbp + 0x20]
call fcn.140006330
mov r11, rax
mov r9, 0xffffffffffffffff
nop word [rax + rax]
inc r9
cmp word [rdi + r9*2], r15w
jne 0x140002cd0
cmp qword [r11 + 0x18], 7
mov rax, qword [rax + 0x10]
jbe 0x140002ce8
mov r11, qword [r11]
cmp r9, rax
ja 0x140002d75
sub rax, r9
test r9, r9
jne 0x140002d01
mov rbx, r15
jmp 0x140002d7c
movzx r10d, word [rdi]
lea rsi, [rax + 1]
lea rsi, [r11 + rsi*2]
mov rbx, r11
mov rax, rsi
mov rcx, r15
sub rax, rbx
sar rax, 1
je 0x140002d3a
cmp word [rbx], r10w
je 0x140002d37
cmp rax, 1
je 0x140002d3a
add rbx, 2
dec rax
cmp word [rbx], r10w
jne 0x140002d24
mov rcx, rbx
mov rbx, rcx
test rcx, rcx
je 0x140002d75
mov rdx, r9
mov rcx, rdi
test r9, r9
je 0x140002d67
mov r8, rbx
sub r8, rdi
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140002d6f
add rcx, 2
sub rdx, 1
jne 0x140002d53
sub rbx, r11
sar rbx, 1
jmp 0x140002d7c
add rbx, 2
jmp 0x140002d10
mov rbx, 0xffffffffffffffff
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x140002dbc
mov rcx, qword [rbp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002db7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002f21
call fcn.14006ac68
mov qword [rbp + 0x30], r15
mov rcx, r14
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r15w
cmp rbx, 0xffffffffffffffff
jne 0x140002f28
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002cb0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rdx, 0xf9da7a351f16bc
movabs rax, 0x7407a1380a469a43
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x4e1b4025ce8eeb16
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x4964f597c8271e3d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x3b4981754f10d305
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
movabs rax, 0x6e5f0e7081c8cb42
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
movabs rax, 0x4964f597c8271e07
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x290], rax
mov qword [rbp], rdx
lea rdx, [rbp + 0x20]
mov rax, qword [rbp]
mov qword [rbp + 0x298], rax
vmovdqu ymm0, ymmword [rbp + 0x280]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140006a80
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140006c50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.14006a700
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x48]
jmp 0x140002ef5