Function at 0x1400699a0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
xor r15b, r15b
mov dword [rsp + 0x40], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140069c32
lea rdx, [rsp + 0x40]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x140069c29
mov edx, 0x9c
lea rcx, [rsp + 0x20]
call fcn.1400177a0
nop
cmp qword [rax + 0x18], 8
jb 0x140069a09
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x2c8]
call fcn.1400064d0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140069a5c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140069a57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140069c67
call fcn.140133e68
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r12w
lea rbp, [r12 - 1]
lea r13d, [r12 + 1]
nop dword [rax]
call fcn.14000bfcc
test rax, rax
je 0x140069c5c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x2c0], rbx
lea rax, [rsp + 0x6c]
cmp rax, 0x10000
jae 0x140069b89
lea rax, [rsp + 0x6c]
movzx edi, ax
xor edx, edx
mov ecx, edi
call fcn.14000b98c
mov rsi, rax
test rax, rax
je 0x140069bb8
mov edx, edi
shr rdx, 4
inc rdx
mov r8d, 6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140069bb8
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call fcn.14000ba40
mov rsi, rax
test rax, rax
je 0x140069bb8
movzx edi, word [rax]
mov edx, r13d
sub edx, dword [rbx - 8]
mov ecx, dword [rbx - 0xc]
sub ecx, edi
movzx eax, di
or ecx, edx
jge 0x140069b3b
mov edx, edi
lea rcx, [rsp + 0x2c0]
call fcn.14000816c
movzx eax, word [rsi]
mov rbx, qword [rsp + 0x2c0]
lea r8, [rsi + 2]
movzx r9d, ax
mov rdx, rdi
mov rcx, rbx
call fcn.140172f00
test eax, eax
je 0x140069b76
cmp eax, 0xc
je 0x140069c78
cmp eax, 0x16
je 0x140069c83
cmp eax, 0x22
je 0x140069c83
cmp eax, 0x50
jne 0x140069c6d
cmp edi, dword [rbx - 0xc]
jg 0x140069c83
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], r12w
jmp 0x140069bb8
lea rcx, [rsp + 0x6c]
mov rax, rbp
inc rax
cmp word [rcx + rax*2], 0
jne 0x140069b91
mov r8d, eax
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x2c0]
call fcn.140008250
mov rbx, qword [rsp + 0x2c0]
mov rdx, qword [rsp + 0x2c8]
test rdx, rdx
je 0x140069c51
mov rcx, rbx
call fcn.1401776c4
movzx r15d, r15b
test eax, eax
cmove r15d, r13d
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140069bf4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rdx, [rsp + 0x40]
mov rcx, r14
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x140069a80
mov rdx, qword [rsp + 0x2c8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x140069c29
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r15b
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
int3
call fcn.1401462a8
nop
mov ecx, 0x80004005
call fcn.14000c3ac
int3
mov ecx, 0x8007000e
call fcn.14000c3ac
int3
mov ecx, 0x80070057
call fcn.14000c3ac
int3