Function at 0x1400011c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov qword [rsp + 0x500], rdi
mov rbx, rdx
mov rsi, rcx
nop word [rax + rax]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400012e7
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400012de
nop dword [rax + rax]
lea rcx, [rsp + 0x5c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140001250
cmp qword [rbx + 0x18], 7
mov r8, rbx
jbe 0x140001267
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp rdx, rax
jne 0x1400012c8
lea rcx, [rsp + 0x5c]
test rdx, rdx
je 0x140001296
lea rax, [rsp + 0x5c]
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400012c8
add rcx, 2
sub rdx, 1
jne 0x140001282
mov rcx, rdi
movaps xmmword [rsp + 0x4c0], xmm6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r14d, r14d
cmp qword [rsi + 8], r14
jne 0x1400012f7
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error:_NtSetTimerResolution_is_not_available._n
call fcn.140001980
jmp 0x1400013d7
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001240
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001200
lea r8, [rsp + 0x24]
mov dword [rsp + 0x24], r14d
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x28], r14d
lea rcx, [rsp + 0x28]
mov dword [rsp + 0x20], r14d
call qword [rsi + 0x10]
mov eax, dword [rsp + 0x24]
lea rdx, str.Current_timer_resolution:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
divsd xmm6, qword [0x140004950]
call fcn.140001b60
mov rcx, rax
movaps xmm1, xmm6
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___double____ptr64]
mov rcx, rax
lea rdx, str._ms_n
call fcn.140001b60
mov ecx, dword [rsp + 0x20]
lea r8, [rsp + 0x24]
mov dl, 1
call qword [rsi + 8]
mov edi, eax
test eax, eax
jne 0x1400013aa
mov eax, dword [rsp + 0x24]
lea rdx, str.Timer_Resolution_activated_to:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
divsd xmm6, qword [0x140004950]
call fcn.140001b60
mov rcx, rax
movaps xmm1, xmm6
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___double____ptr64]
lea rdx, str._ms_n
jmp 0x1400013cf
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Error_activating_Timer_Resolution._Status_code:
call fcn.140001b60
mov rcx, rax
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x1400045d0]
mov rcx, rax
call fcn.140001b60
cmp qword [rbx + 0x18], 7
mov rdx, rbx
jbe 0x1400013e4
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001f10
lea rdx, str._is_running._Applying_Timer_Resolution._n
mov rcx, rax
call fcn.140001b60
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400014d4
lea rdx, [rbp + 0x170]
mov dword [rbp + 0x170], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400014cb
nop
lea rcx, [rbp + 0x19c]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140001450
cmp qword [rbx + 0x18], 7
mov r8, rbx
jbe 0x140001467
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp rdx, rax
jne 0x1400014b3
lea rcx, [rbp + 0x19c]
test rdx, rdx
je 0x14000149a
lea rax, [rbp + 0x19c]
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400014b3
add rcx, 2
sub rdx, 1
jne 0x140001486
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001403
lea rdx, [rbp + 0x170]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001440
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.The_process
call fcn.140001b60
cmp qword [rbx + 0x18], 7
mov rdx, rbx
mov rdi, qword [rsp + 0x500]
jbe 0x1400014fc
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140001f10
lea rdx, str._has_terminated._n
mov rcx, rax
call fcn.140001b60
mov rax, qword [rsi + 8]
test rax, rax
jne 0x140001535
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error:_NtSetTimerResolution_is_not_available._n
call fcn.140001980
jmp 0x1400015b4
mov ecx, dword [rsi]
lea r8, [rsp + 0x20]
xor edx, edx
mov dword [rsp + 0x20], r14d
call rax
mov ebx, eax
test eax, eax
jne 0x140001587
mov eax, dword [rsp + 0x20]
lea rdx, str.Timer_Resolution_deactivated__current_resolution:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
divsd xmm6, qword [0x140004950]
call fcn.140001b60
mov rcx, rax
movaps xmm1, xmm6
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___double____ptr64]
lea rdx, str._ms_n
jmp 0x1400015ac
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Error_deactivating_Timer_Resolution._Status_code:
call fcn.140001b60
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x1400045d0]
mov rcx, rax
call fcn.140001b60
movaps xmm6, xmmword [rsp + 0x4c0]
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1400022a0
mov rbx, qword [rsp + 0x508]
add rsp, 0x4d0
pop r14
pop rsi
pop rbp
ret