Function at 0x14006e790
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
xor r15b, r15b
mov edx, 0x7d
lea rcx, [rbp + 0x100]
call fcn.1400177a0
nop
mov edx, 0x7e
lea rcx, [rbp + 0xe0]
call fcn.1400177a0
nop
mov edx, 0x7f
lea rcx, [rbp + 0xc0]
call fcn.1400177a0
nop
mov edx, 0x80
lea rcx, [rbp + 0xa0]
call fcn.1400177a0
nop
mov edx, 0x81
lea rcx, [rbp + 0x80]
call fcn.1400177a0
nop
mov edx, 0x82
lea rcx, [rbp + 0x60]
call fcn.1400177a0
nop
mov edx, 0x83
lea rcx, [rbp + 0x40]
call fcn.1400177a0
nop
mov edx, 0x84
lea rcx, [rbp + 0x20]
call fcn.1400177a0
nop
mov edx, 0x85
lea rcx, [rbp]
call fcn.1400177a0
nop
mov edx, 0x86
lea rcx, [rbp - 0x20]
call fcn.1400177a0
nop
mov edx, 0x87
lea rcx, [rbp - 0x40]
call fcn.1400177a0
nop
mov edx, 0x88
lea rcx, [rbp - 0x60]
call fcn.1400177a0
nop
mov edx, 0x89
lea rcx, [rbp - 0x80]
call fcn.1400177a0
nop
mov edx, 0x8a
lea rcx, [rsp + 0x60]
call fcn.1400177a0
nop
mov edx, Ordinal_143
lea rcx, [rsp + 0x40]
call fcn.1400177a0
nop
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
xor r12d, r12d
cmp rax, 0xffffffffffffffff
je 0x14006e8ed
mov dword [rbp + 0x120], 0x238
lea rdx, [rbp + 0x120]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x14006ee10
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r15b, r15b
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14006e932
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e92d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f469
call fcn.140133e68
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14006e988
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e983
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f475
call fcn.140133e68
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14006e9dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e9d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f47b
call fcn.140133e68
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r12w
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14006ea2d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ea28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f481
call fcn.140133e68
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14006ea7e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ea79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f487
call fcn.140133e68
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14006eacf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006eaca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f48d
call fcn.140133e68
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x14006eb20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006eb1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f493
call fcn.140133e68
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 7
mov word [rbp], r12w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x14006eb71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006eb6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f499
call fcn.140133e68
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r12w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x14006ebc2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ebbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f49f
call fcn.140133e68
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r12w
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x14006ec13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ec0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f4a5
call fcn.140133e68
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r12w
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
jb 0x14006ec6a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ec65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f4ab
call fcn.140133e68
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], r12w
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x14006ecca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ecc5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f4b1
call fcn.140133e68
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], r12w
mov rdx, qword [rbp + 0xd8]
cmp rdx, 8
jb 0x14006ed2a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ed25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f4b7
call fcn.140133e68
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r12w
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x14006ed8a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ed85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f4bd
call fcn.140133e68
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], r12w
mov rdx, qword [rbp + 0x118]
cmp rdx, 8
jb 0x14006edea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ede5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f463
call fcn.140133e68
movzx eax, r15b
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 7
lea rax, [rbp + 0x14c]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r12w
jne 0x14006ee31
lea rdx, [rbp + 0x14c]
lea rcx, [rsp + 0x20]
call fcn.14003a5e0
lea rdi, [rsp + 0x20]
mov r9, qword [rsp + 0x20]
mov r11, qword [rsp + 0x38]
cmp r11, 8
cmovae rdi, r9
lea rax, [rsp + 0x20]
cmovae rax, r9
mov rcx, qword [rsp + 0x30]
lea rsi, [rax + rcx*2]
lea rbx, [rsp + 0x20]
cmovae rbx, r9
cmp rbx, rsi
je 0x14006eeaa
sub rdi, rbx
movzx ecx, word [rbx]
call fcn.140172bc0
mov word [rdi + rbx], ax
add rbx, 2
cmp rbx, rsi
jne 0x14006ee86
mov r11, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov r9, qword [rsp + 0x20]
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rdx, qword [rbp + 0x100]
lea r10, [rsp + 0x20]
cmp r11, 8
cmovae r10, r9
mov r8, rcx
mov rbx, qword [rbp + 0x110]
cmp rbx, rcx
cmovb r8, rbx
test r8, r8
je 0x14006ef04
sub r10, rdx
nop word [rax + rax]
movzx eax, word [rdx]
cmp word [r10 + rdx], ax
jne 0x14006ef0f
add rdx, 2
sub r8, 1
jne 0x14006eef0
cmp rcx, rbx
jb 0x14006ef0f
jbe 0x14006f41b
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rdx, qword [rbp + 0xe0]
lea r10, [rsp + 0x20]
cmp r11, 8
cmovae r10, r9
mov r8, rcx
mov rbx, qword [rbp + 0xf0]
cmp rbx, rcx
cmovb r8, rbx
test r8, r8
je 0x14006ef64
sub r10, rdx
nop dword [rax]
movzx eax, word [rdx]
cmp word [r10 + rdx], ax
jne 0x14006ef6f
add rdx, 2
sub r8, 1
jne 0x14006ef50
cmp rcx, rbx
jb 0x14006ef6f
jbe 0x14006f41b
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae rdx, qword [rbp + 0xc0]
lea r10, [rsp + 0x20]
cmp r11, 8
cmovae r10, r9
mov r8, rcx
mov rbx, qword [rbp + 0xd0]
cmp rbx, rcx
cmovb r8, rbx
test r8, r8
je 0x14006efc4
sub r10, rdx
nop dword [rax]
movzx eax, word [rdx]
cmp word [r10 + rdx], ax
jne 0x14006efcf
add rdx, 2
sub r8, 1
jne 0x14006efb0
cmp rcx, rbx
jb 0x14006efcf
jbe 0x14006f41b
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rdx, qword [rbp + 0xa0]
lea r10, [rsp + 0x20]
cmp r11, 8
cmovae r10, r9
mov r8, rcx
mov rbx, qword [rbp + 0xb0]
cmp rbx, rcx
cmovb r8, rbx
test r8, r8
je 0x14006f024
sub r10, rdx
nop dword [rax]
movzx eax, word [rdx]
cmp word [r10 + rdx], ax
jne 0x14006f02f
add rdx, 2
sub r8, 1
jne 0x14006f010
cmp rcx, rbx
jb 0x14006f02f
jbe 0x14006f41b
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdx, qword [rbp + 0x80]
lea r10, [rsp + 0x20]
cmp r11, 8
cmovae r10, r9
mov r8, rcx
mov rbx, qword [rbp + 0x90]
cmp rbx, rcx
cmovb r8, rbx
test r8, r8
je 0x14006f084
sub r10, rdx
nop dword [rax]
movzx eax, word [rdx]
cmp word [r10 + rdx], ax
jne 0x14006f08f
add rdx, 2
sub r8, 1
jne 0x14006f070
cmp rcx, rbx
jb 0x14006f08f
jbe 0x14006f41b
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rdx, qword [rbp + 0x60]
lea r10, [rsp + 0x20]
cmp r11, 8
cmovae r10, r9
mov r8, rcx
mov rbx, qword [rbp + 0x70]
cmp rbx, rcx
cmovb r8, rbx
test r8, r8
je 0x14006f0d4
sub r10, rdx
movzx eax, word [rdx]
cmp word [r10 + rdx], ax
jne 0x14006f0df
add rdx, 2
sub r8, 1
jne 0x14006f0c0
cmp rcx, rbx
jb 0x14006f0df
jbe 0x14006f41b
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rdx, qword [rbp + 0x40]
lea r10, [rsp + 0x20]
cmp r11, 8
cmovae r10, r9
mov r8, rcx
mov rbx, qword [rbp + 0x50]
cmp rbx, rcx
cmovb r8, rbx
test r8, r8
je 0x14006f124
sub r10, rdx
movzx eax, word [rdx]
cmp word [r10 + rdx], ax
jne 0x14006f12f
add rdx, 2
sub r8, 1
jne 0x14006f110
cmp rcx, rbx
jb 0x14006f12f
jbe 0x14006f41b
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
lea r10, [rsp + 0x20]
cmp r11, 8
cmovae r10, r9
mov r8, rcx
mov rbx, qword [rbp + 0x30]
cmp rbx, rcx
cmovb r8, rbx
test r8, r8
je 0x14006f174
sub r10, rdx
movzx eax, word [rdx]
cmp word [r10 + rdx], ax
jne 0x14006f17f
add rdx, 2
sub r8, 1
jne 0x14006f160
cmp rcx, rbx
jb 0x14006f17f
jbe 0x14006f41b
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
lea r10, [rsp + 0x20]
cmp r11, 8
cmovae r10, r9
mov r8, rcx
mov rbx, qword [rbp + 0x10]
cmp rbx, rcx
cmovb r8, rbx
test r8, r8
je 0x14006f1c4
sub r10, rdx
movzx eax, word [rdx]
cmp word [r10 + rdx], ax
jne 0x14006f1cf
add rdx, 2
sub r8, 1
jne 0x14006f1b0
cmp rcx, rbx
jb 0x14006f1cf
jbe 0x14006f41b
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
lea r10, [rsp + 0x20]
cmp r11, 8
cmovae r10, r9
mov r8, rcx
mov rbx, qword [rbp - 0x10]
cmp rbx, rcx
cmovb r8, rbx
test r8, r8
je 0x14006f214
sub r10, rdx
movzx eax, word [rdx]
cmp word [r10 + rdx], ax
jne 0x14006f21f
add rdx, 2
sub r8, 1
jne 0x14006f200
cmp rcx, rbx
jb 0x14006f21f
jbe 0x14006f41b
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rdx, qword [rbp - 0x40]
lea r10, [rsp + 0x20]
cmp r11, 8
cmovae r10, r9
mov r8, rcx
mov rbx, qword [rbp - 0x30]
cmp rbx, rcx
cmovb r8, rbx
test r8, r8
je 0x14006f264
sub r10, rdx
movzx eax, word [rdx]
cmp word [r10 + rdx], ax
jne 0x14006f26f
add rdx, 2
sub r8, 1
jne 0x14006f250
cmp rcx, rbx
jb 0x14006f26f
jbe 0x14006f41b
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
lea r10, [rsp + 0x20]
cmp r11, 8
cmovae r10, r9
mov r8, rcx
mov rbx, qword [rbp - 0x50]
cmp rbx, rcx
cmovb r8, rbx
test r8, r8
je 0x14006f2b4
sub r10, rdx
movzx eax, word [rdx]
cmp word [r10 + rdx], ax
jne 0x14006f2bf
add rdx, 2
sub r8, 1
jne 0x14006f2a0
cmp rcx, rbx
jb 0x14006f2bf
jbe 0x14006f41b
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
lea r10, [rsp + 0x20]
cmp r11, 8
cmovae r10, r9
mov r8, rcx
mov rbx, qword [rbp - 0x70]
cmp rbx, rcx
cmovb r8, rbx
test r8, r8
je 0x14006f304
sub r10, rdx
movzx eax, word [rdx]
cmp word [r10 + rdx], ax
jne 0x14006f30f
add rdx, 2
sub r8, 1
jne 0x14006f2f0
cmp rcx, rbx
jb 0x14006f30f
jbe 0x14006f41b
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea r10, [rsp + 0x20]
cmp r11, 8
cmovae r10, r9
mov r8, rcx
mov rbx, qword [rsp + 0x70]
cmp rbx, rcx
cmovb r8, rbx
test r8, r8
je 0x14006f358
sub r10, rdx
movzx eax, word [rdx]
cmp word [r10 + rdx], ax
jne 0x14006f363
add rdx, 2
sub r8, 1
jne 0x14006f344
cmp rcx, rbx
jb 0x14006f363
jbe 0x14006f41b
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
lea r10, [rsp + 0x20]
cmp r11, 8
cmovae r10, r9
mov r8, rcx
mov rbx, qword [rsp + 0x50]
cmp rbx, rcx
cmovb r8, rbx
test r8, r8
je 0x14006f3b4
sub r10, rdx
nop dword [rax + rax]
movzx eax, word [rdx]
cmp word [r10 + rdx], ax
jne 0x14006f3bb
add rdx, 2
sub r8, 1
jne 0x14006f3a0
cmp rcx, rbx
jb 0x14006f3bb
jbe 0x14006f41b
cmp r11, 8
jb 0x14006f3f6
lea rdx, [r11*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x14006f3ee
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f46f
mov rcx, r9
call fcn.140133e68
lea rdx, [rbp + 0x120]
mov rcx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14006ee10
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14006e8f0
mov r15b, 1
cmp r11, 8
jb 0x14006f40d
lea rdx, [r11*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x14006f44d
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f46f
mov rcx, r9
call fcn.140133e68
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14006e8f0
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
int3