Function at 0x140027af0
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, reloc.OLEAUT32.dll_VarUI8FromDec
sub rsp, 0x290
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, rcx
xor edi, edi
mov r13d, edi
xor edx, edx
lea ecx, [rdi + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r12, rax
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x50]
call fcn.1400ad020
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, r12
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140027db4
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rdi
mov word [rsp + 0x20], di
cmp word [rsp + 0x7c], 0
jne 0x140027b8b
mov r8, rdi
jmp 0x140027b9e
lea rax, [rsp + 0x7c]
mov r8, rcx
inc r8
cmp word [rax + r8*2], 0
jne 0x140027b93
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x20]
call fcn.1400237c0
nop
lea rbx, [rsp + 0x20]
mov r9, qword [rsp + 0x20]
mov r10, qword [rsp + 0x38]
cmp r10, 8
cmovae rbx, r9
lea rax, [rsp + 0x20]
cmovae rax, r9
mov r11, qword [rsp + 0x30]
lea rax, [rax + r11*2]
lea r14, [rsp + 0x20]
cmovae r14, r9
mov r15, rax
sub r15, r14
inc r15
shr r15, 1
cmp r14, rax
mov r8d, 0
cmova r15, r8
test r15, r15
je 0x140027c2c
sub r14, rbx
movzx ecx, word [r14 + rbx]
call fcn.1400e4290
mov word [rbx], ax
lea rbx, [rbx + 2]
inc rdi
cmp rdi, r15
jne 0x140027c01
mov r10, qword [rsp + 0x38]
mov r11, qword [rsp + 0x30]
mov r9, qword [rsp + 0x20]
xor r8d, r8d
mov rcx, qword [rsi + 0x18]
cmp rcx, 8
jb 0x140027c3b
mov rbx, qword [rsi]
jmp 0x140027c3e
mov rbx, rsi
cmp rcx, 8
jb 0x140027c49
mov rdx, qword [rsi]
jmp 0x140027c4c
mov rdx, rsi
mov rax, qword [rsi + 0x10]
lea rax, [rdx + rax*2]
cmp rcx, 8
jb 0x140027c5f
mov r15, qword [rsi]
jmp 0x140027c62
mov r15, rsi
mov rdi, r8
mov r14, rax
sub r14, r15
inc r14
shr r14, 1
cmp r15, rax
cmova r14, r8
test r14, r14
je 0x140027ca8
sub r15, rbx
movzx ecx, word [r15 + rbx]
call fcn.1400e4290
mov word [rbx], ax
lea rbx, [rbx + 2]
inc rdi
cmp rdi, r14
jne 0x140027c80
mov r10, qword [rsp + 0x38]
mov r11, qword [rsp + 0x30]
mov r9, qword [rsp + 0x20]
cmp qword [rsi + 0x18], 8
jb 0x140027cb4
mov rdx, qword [rsi]
jmp 0x140027cb7
mov rdx, rsi
lea rcx, [rsp + 0x20]
cmp r10, 8
cmovae rcx, r9
mov rbx, qword [rsi + 0x10]
mov r8, rbx
cmp r11, rbx
cmovb r8, r11
test r8, r8
jmp 0x140027d05
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x140027ced
add rcx, 2
add rdx, 2
sub r8, 1
jmp 0x140027d05
mov r8d, 1
cmp word [rcx], ax
mov rax, 0xffffffffffffffff
cmovb r8d, eax
xor edi, edi
jmp 0x140027d0c
jne 0x140027cd7
xor edi, edi
mov r8d, edi
test r8d, r8d
jne 0x140027d18
cmp r11, rbx
jb 0x140027d18
jbe 0x140027d78
cmp r10, 8
jb 0x140027d66
lea rax, [r10 + 1]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140027dae
add rax, rax
cmp rax, 0x1000
jb 0x140027d5e
test byte [rsp + 0x20], 0x1f
jne 0x140027da8
mov rax, qword [r9 - 8]
cmp rax, r9
jae 0x140027da2
sub r9, rax
cmp r9, 8
jb 0x140027d9c
cmp r9, 0x27
ja 0x140027d96
mov r9, rax
mov rcx, r9
call fcn.14007b800
lea rdx, [rsp + 0x50]
mov rcx, r12
call sub.KERNEL32.dll_Process32NextW
jmp 0x140027b5f
mov r13d, dword [rsp + 0x58]
cmp r10, 8
jb 0x140027db4
lea r8, [r10 + 1]
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.1400146a0
jmp 0x140027db4
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsi + 0x18]
cmp r8, 8
jb 0x140027dd6
inc r8
mov rdx, qword [rsi]
mov rcx, rsi
call fcn.1400146a0
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rdi
cmp qword [rsi + 0x18], 8
jb 0x140027dec
mov rsi, qword [rsi]
mov word [rsi], di
mov eax, r13d
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret