Function at 0x140003ec0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4a60]
mov eax, 0x4b60
call fcn.14002b7f0
sub rsp, rax
mov rax, qword [0x14004aac0]
xor rax, rsp
mov qword [rbp + 0x4a50], rax
mov r13, rcx
mov rdi, qword [0x14004ce08]
mov rbx, qword [0x14004ce28]
lea rdx, str.__Getting_ready_to_destroy_your_service
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
call fcn.14000b6f0
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp + 0x870]
call fcn.140034b30
lea rcx, [rbp + 0x870]
call fcn.140007a60
nop
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp + 0x750]
call fcn.140034b30
lea rcx, [rbp + 0x750]
call fcn.140007a60
nop
mov rdx, rbx
lea rcx, [rbp + 0x870]
call fcn.140007810
lea rdx, str.__Opened:
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
mov rdx, rbx
call fcn.14000b160
mov rcx, rax
call fcn.14000b6f0
mov rdx, rdi
lea rcx, [rbp + 0x750]
call fcn.140007810
lea rdx, str.__Opened:
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
mov rdx, rdi
call fcn.14000b160
mov rcx, rax
call fcn.14000b6f0
lea rsi, [fcn.140008a10]
mov qword [rsp + 0x20], rsi
lea r9, [0x140008b80]
mov edx, 0x20
mov r8d, 0x1f4
lea rcx, [rbp + 0xbd0]
call fcn.14002af48
nop
xor edi, edi
mov r15d, edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x710], xmm0
mov qword [rbp + 0x720], rdi
mov qword [rbp + 0x728], 0xf
mov byte [rbp + 0x710], dil
mov r14d, edi
mov r12d, 1
mov rax, qword [rbp + 0x870]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x8b0]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x38], rcx
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0x30]
call fcn.14000b020
mov r8, qword [rax]
mov dl, 0xa
mov rcx, rax
call qword [r8 + 0x40]
movzx ebx, al
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000408f
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x14000408f
mov r8, qword [rax]
mov edx, r12d
mov rcx, rax
call qword [r8]
movzx r8d, bl
lea rdx, [rbp + 0x710]
lea rcx, [rbp + 0x870]
call fcn.14000d980
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x140004180
lea rcx, [rbp + 0x710]
cmp qword [rbp + 0x728], 0xf
cmova rcx, qword [rbp + 0x710]
call fcn.140013010
mov esi, eax
xor bl, bl
mov dword [rbp + 0x990], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
lea rdx, [rbp + 0x990]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140004141
lea rdx, [rbp + 0x990]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140004141
nop word [rax + rax]
movzx ebx, bl
cmp dword [rbp + 0x998], esi
cmove ebx, r12d
lea rdx, [rbp + 0x990]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140004120
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x1400045c8
lea rcx, [rbp + 0x710]
cmp qword [rbp + 0x728], 0xf
cmova rcx, qword [rbp + 0x710]
call fcn.140013010
mov dword [rsp + r14*4 + 0x40], eax
inc r14
jmp 0x140004032
mov rax, qword [rbp + 0x750]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x790]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x38], rcx
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0x30]
call fcn.14000b020
mov r8, qword [rax]
mov dl, 0xa
mov rcx, rax
call qword [r8 + 0x40]
movzx ebx, al
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400041dd
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x1400041dd
mov r8, qword [rax]
mov edx, r12d
mov rcx, rax
call qword [r8]
movzx r8d, bl
lea rdx, [rbp + 0x710]
lea rcx, [rbp + 0x750]
call fcn.14000d980
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x14000424a
movsxd rax, r15d
shl rax, 5
lea rcx, [rbp + 0xbd0]
add rcx, rax
lea rax, [rbp + 0x710]
cmp rcx, rax
je 0x140004242
lea rdx, [rbp + 0x710]
cmp qword [rbp + 0x728], 0xf
cmova rdx, qword [rbp + 0x710]
mov r8, qword [rbp + 0x720]
call fcn.140009ff0
inc r15d
jmp 0x140004180
xor edi, edi
test r14, r14
jle 0x140004267
mov ebx, edi
mov edx, dword [rsp + rbx*4 + 0x40]
mov rcx, r13
call fcn.140003ce0
inc rbx
cmp rbx, r14
jl 0x140004253
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
test r15d, r15d
jle 0x140004500
movsxd r12, r15d
xor r9d, r9d
mov r15d, r9d
lea r14, [rbp + 0xbd0]
mov r8d, 0xa
movabs rdx, 0x7fffffffffffffff
movabs rcx, 0x7ffffffffffffffe
cmp qword [r14 + 0x18], 0xf
jbe 0x1400042b8
mov rsi, qword [r14]
mov rbx, rsi
add rsi, qword [r14 + 0x10]
jmp 0x1400042c2
mov rsi, qword [r14 + 0x10]
add rsi, r14
mov rbx, r14
xorps xmm0, xmm0
movups xmmword [rbp + 0x730], xmm0
mov qword [rbp + 0x740], r9
cmp rbx, rsi
jne 0x1400042f1
mov eax, 7
mov qword [rbp + 0x748], rax
mov word [rbp + 0x730], r9w
jmp 0x140004407
sub rsi, rbx
mov qword [rbp + 0x748], 7
cmp rsi, rcx
ja 0x140004616
mov edi, 7
cmp rsi, rdi
jbe 0x1400043b7
mov rdi, rsi
or rdi, 7
cmp rdi, rcx
jbe 0x140004372
mov rdi, rcx
lea rcx, [rdx + rdx]
cmp rcx, 0x1000
jb 0x14000439f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000460a
mov rcx, rax
call fcn.14002abc8
mov rcx, rax
test rax, rax
je 0x140004610
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
xor r9d, r9d
mov qword [rbp + 0x730], rax
mov qword [rbp + 0x748], rdi
jmp 0x1400043be
cmp rdi, 0xa
cmovb rdi, r8
lea rcx, [rdi + 1]
cmp rcx, rdx
ja 0x14000460a
add rcx, rcx
jne 0x140004329
mov rax, r9
mov qword [rbp + 0x730], rax
mov qword [rbp + 0x748], rdi
jmp 0x1400043be
call fcn.14002abc8
xor r9d, r9d
mov qword [rbp + 0x730], rax
mov qword [rbp + 0x748], rdi
jmp 0x1400043be
mov rax, qword [rbp + 0x730]
lea r8, [rbp + 0x730]
cmp rdi, 7
cmova r8, rax
mov rcx, r8
mov rdx, rsi
test rsi, rsi
je 0x1400043f4
nop dword [rax + rax]
movsx eax, byte [rbx]
mov word [rcx], ax
lea rcx, [rcx + 2]
lea rbx, [rbx + 1]
sub rdx, 1
jne 0x1400043e0
mov qword [rbp + 0x740], rsi
mov word [r8 + rsi*2], r9w
mov rax, qword [rbp + 0x748]
lea rdi, [rbp + 0x730]
cmp rax, 7
cmova rdi, qword [rbp + 0x730]
call fcn.14000b7a0
mov rcx, rax
mov rdx, rdi
call fcn.14000bb60
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rcx, qword [rcx + rax + 0x40]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rcx]
call qword [rdx + 8]
nop
lea rcx, [rsp + 0x30]
call fcn.14000de90
mov r8, qword [rax]
mov dl, 0xa
mov rcx, rax
call qword [r8 + 0x60]
movzx esi, ax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140004485
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x140004485
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx edx, si
mov rcx, rbx
call fcn.14000d570
mov rcx, rbx
call fcn.14000abd0
mov rdx, rdi
mov rcx, r13
call fcn.140003b90
nop
mov rdx, qword [rbp + 0x748]
cmp rdx, 7
jbe 0x1400044ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x730]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004610
call fcn.14002abc0
inc r15
add r14, 0x20
cmp r15, r12
jge 0x1400044fe
xor r9d, r9d
jmp 0x14000428b
xor edi, edi
mov rdx, qword [rbp + 0x728]
cmp rdx, 0xf
jbe 0x140004541
inc rdx
mov rcx, qword [rbp + 0x710]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000453c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400045c2
call fcn.14002abc0
mov qword [rbp + 0x720], rdi
mov qword [rbp + 0x728], 0xf
mov byte [rbp + 0x710], 0
lea r9, [fcn.140008a10]
mov edx, 0x20
mov r8d, 0x1f4
lea rcx, [rbp + 0xbd0]
call fcn.14002ac04
nop
lea rcx, [rbp + 0x750]
call fcn.140005480
nop
lea rcx, [rbp + 0x870]
call fcn.140005480
mov rcx, qword [rbp + 0x4a50]
xor rcx, rsp
call fcn.14002aba0
lea r11, [rsp + 0x4b60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140013fe8
nop
lea rdx, [0x140042874]
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, [rbp + 0x710]
call fcn.14000b780
mov rcx, rax
lea rdx, str._does_not_exist__exiting...
call fcn.14000b160
mov rcx, rax
call fcn.140008940
mov ecx, r12d
call fcn.14000e4a0
int3
call fcn.1400013f0
int3
call fcn.140013fe8
int3
call fcn.140001490
int3