Function at 0x140002647
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1f8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x170], 0xfffffffffffffffe
mov qword [rbp + 0xf8], rdx
mov qword [rbp + 0x100], rcx
push 2
pop rcx
xor esi, esi
xor edx, edx
call sub.kernel32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x1400029aa
mov rbx, rax
lea rsi, [rbp - 0x58]
mov r8d, 0x130
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi], 0x130
mov rcx, rbx
mov rdx, rsi
call sub.kernel32.dll_Process32First
cmp eax, 1
jne 0x14000299d
lea r12, [rbp + 0x120]
lea r15, [rbp + 0xd8]
mov qword [rbp + 0x148], rbx
lea rsi, [rbp - 0x2c]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rbx, rax
mov qword [rbp + 0xe8], rsi
mov qword [rbp + 0xf0], rax
mov rcx, r12
lea rdx, [rbp + 0xe8]
call fcn.14001d680
mov r13, qword [rbp + 0x120]
test r13, r13
je 0x14000278e
mov rdi, qword [rbp + 0x128]
cmp qword [rbp + 0x138], 0
je 0x140002794
test rbx, rbx
js 0x1400029e6
push 1
pop r14
je 0x14000274b
mov al, byte [0x14004715c]
xor ecx, ecx
mov rdx, rbx
call fcn.14002d4a0
test rax, rax
je 0x1400029eb
mov r14, rax
mov qword [rbp + 0x158], rbx
mov qword [rbp + 0x160], r14
and qword [rbp + 0x168], 0
cmp rdi, rbx
jbe 0x1400027aa
lea rcx, [rbp + 0x158]
xor edx, edx
mov r8, rdi
call fcn.140031da0
mov rsi, qword [rbp + 0x168]
mov rbx, qword [rbp + 0x158]
mov r14, qword [rbp + 0x160]
jmp 0x1400027ac
push 1
pop r13
xor edi, edi
movabs rax, 0x8000000000000000
mov qword [rbp + 0x150], rax
jmp 0x1400028f2
xor esi, esi
lea rcx, [r14 + rsi]
mov rdx, r13
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rdi
mov qword [rbp + 0x168], rsi
sub rbx, rsi
cmp rbx, 2
ja 0x1400027ef
lea rcx, [rbp + 0x158]
mov rdx, rsi
push 3
pop r8
call fcn.140031da0
mov r14, qword [rbp + 0x160]
mov rsi, qword [rbp + 0x168]
mov byte [r14 + rsi + 2], 0xbd
mov word [r14 + rsi], 0xbfef
add rsi, 3
mov qword [rbp + 0x168], rsi
movups xmm0, xmmword [rbp + 0xe8]
movups xmmword [rbp + 0xd8], xmm0
mov rdi, rsi
mov rcx, r12
mov rdx, r15
call fcn.14001d680
mov rsi, qword [rbp + 0x120]
test rsi, rsi
je 0x1400028dd
mov rbx, qword [rbp + 0x128]
mov r14, qword [rbp + 0x138]
mov rax, qword [rbp + 0x158]
sub rax, rdi
cmp rax, rbx
jae 0x140002869
lea rcx, [rbp + 0x158]
mov rdx, rdi
mov r8, rbx
call fcn.140031da0
mov rdi, qword [rbp + 0x168]
mov r13, qword [rbp + 0x160]
lea rcx, [rdi + r13]
mov rdx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbx
mov qword [rbp + 0x168], rdi
test r14, r14
je 0x140002818
mov rax, qword [rbp + 0x158]
sub rax, rdi
cmp rax, 2
ja 0x1400028bf
lea rcx, [rbp + 0x158]
mov rdx, rdi
push 3
pop r8
call fcn.140031da0
mov r13, qword [rbp + 0x160]
mov rdi, qword [rbp + 0x168]
mov byte [r13 + rdi + 2], 0xbd
mov word [r13 + rdi], 0xbfef
add rdi, 3
mov qword [rbp + 0x168], rdi
jmp 0x140002818
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x150], rax
mov r13, qword [rbp + 0x160]
mov qword [rbp + 0x140], r13
lea rcx, [rbp + 0x108]
mov rdx, r13
mov r8, rdi
call fcn.140008dd0
mov rcx, qword [rbp + 0x150]
mov rdx, qword [rbp + 0x140]
call fcn.1400019f9
mov rcx, r12
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0xf8]
call fcn.140008dd0
mov rsi, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x118]
mov rdi, qword [rbp + 0x128]
mov r9, qword [rbp + 0x130]
mov rcx, rsi
mov r8, rdi
call fcn.14000bb26
mov ebx, eax
mov rcx, qword [rbp + 0x120]
mov rdx, rdi
call fcn.14000a6b3
test bl, bl
jne 0x1400029ac
mov rbx, qword [rbp + 0x148]
mov rcx, rbx
lea rdx, [rbp - 0x58]
call sub.kernel32.dll_Process32Next
mov edi, eax
mov rcx, qword [rbp + 0x108]
mov rdx, rsi
call fcn.14000a6b3
cmp edi, 1
je 0x1400026d7
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
xor esi, esi
jmp 0x1400029ce
jmp 0x1400029ce
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov edi, dword [rbp - 0x50]
mov rcx, qword [rbp + 0x108]
mov rdx, rsi
call fcn.14000a6b3
push 1
pop rsi
mov eax, esi
mov edx, edi
add rsp, 0x1f8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1400086e0
push 1
pop rcx
mov rdx, rbx
call fcn.140031d60
int3