Function at 0x140002410
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rbp
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov rax, qword [0x14009d398]
xor rax, rbp
mov qword [rbp - 8], rax
mov dword [rbp - 0x5c], 0x2533a687
mov eax, dword [rbp - 0x5c]
mov dword [rbp - 0x60], eax
sub eax, 0x82e48cde
je 0x14000282a
jmp 0x140002445
mov eax, dword [rbp - 0x60]
sub eax, 0x913025d9
je 0x1400027e5
jmp 0x140002458
mov eax, dword [rbp - 0x60]
sub eax, 0x92ea6162
je 0x1400026b6
jmp 0x14000246b
mov eax, dword [rbp - 0x60]
sub eax, 0x98e45208
je 0x140002892
jmp 0x14000247e
mov eax, dword [rbp - 0x60]
sub eax, 0x9d902859
je 0x1400027b0
jmp 0x140002491
mov eax, dword [rbp - 0x60]
sub eax, 0xa9644a3c
je 0x14000281e
jmp 0x1400024a4
mov eax, dword [rbp - 0x60]
sub eax, 0xbf864123
je 0x140002809
jmp 0x1400024b7
mov eax, dword [rbp - 0x60]
sub eax, 0xc007c4e8
je 0x1400027d1
jmp 0x1400024ca
mov eax, dword [rbp - 0x60]
sub eax, 0xd2ba46a0
je 0x140002707
jmp 0x1400024dd
mov eax, dword [rbp - 0x60]
sub eax, 0xd6a6aed9
je 0x14000283f
jmp 0x1400024f0
mov eax, dword [rbp - 0x60]
sub eax, 0xee58efb6
je 0x140002745
jmp 0x140002503
mov eax, dword [rbp - 0x60]
sub eax, 0x50d5af0
je 0x1400026e7
jmp 0x140002516
mov eax, dword [rbp - 0x60]
sub eax, 0xb8368c9
je 0x1400027c5
jmp 0x140002529
mov eax, dword [rbp - 0x60]
sub eax, 0x177d7e01
je 0x1400026aa
jmp 0x14000253c
mov eax, dword [rbp - 0x60]
sub eax, 0x1ccf7840
je 0x140002892
jmp 0x14000254f
mov eax, dword [rbp - 0x60]
sub eax, 0x1f864459
je 0x140002666
jmp 0x140002562
mov eax, dword [rbp - 0x60]
sub eax, 0x220f71bb
je 0x140002874
jmp 0x140002575
mov eax, dword [rbp - 0x60]
sub eax, 0x2533a687
je 0x140002612
jmp 0x140002588
mov eax, dword [rbp - 0x60]
sub eax, 0x2b1c8acc
je 0x14000275f
jmp 0x14000259b
mov eax, dword [rbp - 0x60]
sub eax, 0x323adad0
je 0x14000278f
jmp 0x1400025ae
mov eax, dword [rbp - 0x60]
sub eax, 0x3ba34bfe
je 0x140002859
jmp 0x1400025c1
mov eax, dword [rbp - 0x60]
sub eax, 0x415ddf38
je 0x14000277a
jmp 0x1400025d4
mov eax, dword [rbp - 0x60]
sub eax, 0x465669c2
je 0x14000269e
jmp 0x1400025e7
mov eax, dword [rbp - 0x60]
sub eax, 0x618c428b
je 0x140002646
jmp 0x1400025fa
mov eax, dword [rbp - 0x60]
sub eax, 0x66e11e91
je 0x140002730
jmp 0x14000260d
jmp 0x1400028a8
mov eax, 0x240
call fcn.1400202d0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x50], rax
mov eax, 0x10
call fcn.1400202d0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x5c], 0x618c428b
jmp 0x1400028a8
mov eax, 0x10
call fcn.1400202d0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x5c], 0x1f864459
jmp 0x1400028a8
mov ecx, 2
xor edx, edx
sub rsp, 0x20
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov qword [rbp - 0x58], rax
mov rdx, 0xffffffffffffffff
mov eax, 0x177d7e01
mov ecx, 0x465669c2
cmp rdx, qword [rbp - 0x58]
cmove eax, ecx
mov dword [rbp - 0x5c], eax
jmp 0x1400028a8
mov dword [rbp - 0x5c], 0x98e45208
jmp 0x1400028a8
mov dword [rbp - 0x5c], 0x92ea6162
jmp 0x1400028a8
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x68], rcx
xor edx, edx
mov r8d, 0x238
sub rsp, 0x20
call fcn.140029d10
mov rax, qword [rbp - 0x68]
add rsp, 0x20
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x5c], 0x50d5af0
jmp 0x1400028a8
mov rax, qword [rbp - 0x38]
mov dword [rax], 0x238
mov rax, qword [rbp - 0x48]
mov dword [rax], 0
mov dword [rbp - 0x5c], 0xd2ba46a0
jmp 0x1400028a8
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x50]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32FirstW
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp - 0x40]
mov dword [rax], ecx
mov dword [rbp - 0x5c], 0x66e11e91
jmp 0x1400028a8
mov rax, qword [rbp - 0x40]
mov eax, dword [rax]
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x5c], 0xee58efb6
jmp 0x1400028a8
mov eax, dword [rbp - 0x30]
cmp eax, 0
setne al
and al, 1
mov byte [rbp - 0x29], al
mov dword [rbp - 0x5c], 0x2b1c8acc
jmp 0x1400028a8
mov dl, byte [rbp - 0x29]
mov eax, 0x82e48cde
mov ecx, 0x415ddf38
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x5c], eax
jmp 0x1400028a8
mov rax, qword [rbp - 0x48]
mov eax, dword [rax]
mov dword [rbp - 0x28], eax
mov dword [rbp - 0x5c], 0x323adad0
jmp 0x1400028a8
mov eax, dword [rbp - 0x28]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x5c], 0x9d902859
jmp 0x1400028a8
mov rax, qword [rbp - 0x48]
mov ecx, dword [rbp - 0x24]
mov dword [rax], ecx
mov dword [rbp - 0x5c], 0xb8368c9
jmp 0x1400028a8
mov dword [rbp - 0x5c], 0xc007c4e8
jmp 0x1400028a8
mov rax, qword [rbp - 0x58]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x5c], 0x913025d9
jmp 0x1400028a8
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32NextW
add rsp, 0x20
mov dword [rbp - 0x14], eax
mov dword [rbp - 0x5c], 0xbf864123
jmp 0x1400028a8
mov rax, qword [rbp - 0x40]
mov ecx, dword [rbp - 0x14]
mov dword [rax], ecx
mov dword [rbp - 0x5c], 0xa9644a3c
jmp 0x1400028a8
mov dword [rbp - 0x5c], 0x66e11e91
jmp 0x1400028a8
mov rax, qword [rbp - 0x48]
mov eax, dword [rax]
mov dword [rbp - 0x10], eax
mov dword [rbp - 0x5c], 0xd6a6aed9
jmp 0x1400028a8
mov eax, dword [rbp - 0x10]
cmp eax, 0x33
setle al
and al, 1
mov byte [rbp - 9], al
mov dword [rbp - 0x5c], 0x3ba34bfe
jmp 0x1400028a8
mov dl, byte [rbp - 9]
mov eax, 0x98e45208
mov ecx, 0x220f71bb
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x5c], eax
jmp 0x1400028a8
mov ecx, 1
sub rsp, 0x20
call fcn.140037280
add rsp, 0x20
mov dword [rbp - 0x5c], 0x1ccf7840
jmp 0x1400028a8
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.140020330
nop
mov rsp, rbp
pop rbp
ret
jmp 0x14000242f