Function at 0x140006200
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x398
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x310], 0xfffffffffffffffe
nop
mov dword [rbp - 0x58], 0x238
xorps xmm0, xmm0
movaps xmmword [rbp + 0x2f0], xmm0
movaps xmmword [rbp + 0x2e0], xmm0
mov rsi, rcx
call fcn.1400441fc
mov rdi, rax
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
jae 0x1400065bb
cmp rdi, 7
ja 0x140006295
nop
mov qword [rbp + 0x2f0], rdi
mov qword [rbp + 0x2f8], 7
lea r8, [rdi + rdi]
lea rcx, [rbp + 0x2e0]
mov rdx, rsi
call fcn.14006d670
lea rax, [rdi*2 + 0x2e0]
add rax, rbp
jmp 0x140006315
nop
mov qword [rbp + 0x2f8], 7
mov rax, rdi
or rax, 7
movabs r14, 0x7ffffffffffffffe
mov rcx, 0xfffffffffffffffe
cmp rax, r14
ja 0x1400062dd
cmp rax, 0xb
mov r14d, 0xa
cmovae r14, rax
lea rcx, [r14*2 + 2]
cmp r14, 0x7ff
jb 0x1400062e4
call fcn.140005860
jmp 0x1400062e9
call fcn.14001ef3c
mov rbx, rax
nop
mov qword [rbp + 0x2e0], rax
mov qword [rbp + 0x2f0], rdi
mov qword [rbp + 0x2f8], r14
lea r8, [rdi + rdi]
mov rcx, rax
mov rdx, rsi
call fcn.14006d670
lea rax, [rbx + rdi*2]
nop
mov word [rax], 0
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov r9, qword [rbp + 0x2f0]
cmp qword [rbp + 0x2f8], 8
jb 0x140006344
mov rax, qword [rbp + 0x2e0]
jmp 0x14000634b
lea rax, [rbp + 0x2e0]
test r9, r9
je 0x1400064ef
mov rcx, 0xfffffffffffffffe
xor edx, edx
nop dword [rax]
nop
cmp word [rax + rdx*2], 0x5c
je 0x140006379
add rcx, 0xfffffffffffffffe
inc rdx
cmp r9, rdx
jne 0x140006360
jmp 0x1400064ef
test rcx, rcx
je 0x1400064ef
xorps xmm0, xmm0
movaps xmmword [rbp + 0x230], xmm0
movaps xmmword [rbp + 0x2d0], xmm0
movaps xmmword [rbp + 0x2c0], xmm0
movaps xmmword [rbp + 0x2b0], xmm0
movaps xmmword [rbp + 0x2a0], xmm0
movaps xmmword [rbp + 0x290], xmm0
movaps xmmword [rbp + 0x280], xmm0
movaps xmmword [rbp + 0x270], xmm0
movaps xmmword [rbp + 0x260], xmm0
movaps xmmword [rbp + 0x250], xmm0
movaps xmmword [rbp + 0x240], xmm0
movaps xmmword [rbp + 0x220], xmm0
movaps xmmword [rbp + 0x210], xmm0
movaps xmmword [rbp + 0x200], xmm0
movaps xmmword [rbp + 0x1f0], xmm0
movaps xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x23c], 1
lea rcx, [r9*2 - 2]
nop word cs:[rax + rax]
nop
movzx edx, word [rax + rcx]
cmp rdx, 0xff
ja 0x140006429
nop
cmp byte [rbp + rdx + 0x1e0], 0
jne 0x14000643d
test rcx, rcx
je 0x140006434
add rcx, 0xfffffffffffffffe
jmp 0x140006410
mov rcx, 0xffffffffffffffff
jmp 0x140006440
sar rcx, 1
inc ecx
movsxd r8, ecx
lea rax, [rbp + 0x30f]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x1e0]
lea rdx, [rbp + 0x2e0]
call fcn.14001ea80
nop
mov rax, qword [rbp + 0x2f8]
cmp rax, 8
jb 0x1400064b3
nop
mov rcx, qword [rbp + 0x2e0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400064ae
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400065c5
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
movups xmm0, xmmword [rbp + 0x1e0]
movups xmm1, xmmword [rbp + 0x1f0]
movaps xmmword [rbp + 0x2f0], xmm1
movaps xmmword [rbp + 0x2e0], xmm0
mov qword [rbp + 0x1f0], 0
mov qword [rbp + 0x1f8], 7
mov word [rbp + 0x1e0], 0
lea rdx, [rbp - 0x58]
mov rcx, rsi
call sub.KERNEL32.dll_Process32FirstW
xor edi, edi
cmp eax, 1
jne 0x140006555
lea rbx, [rbp - 0x2c]
lea r14, [rbp - 0x58]
lea r15, [rbp + 0x2e0]
nop word cs:[rax + rax]
mov rcx, rsi
mov rdx, r14
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x140006555
nop
cmp qword [rbp + 0x2f8], 8
mov rdx, r15
jb 0x140006545
mov rdx, qword [rbp + 0x2e0]
mov rcx, rbx
call fcn.1400440f0
test eax, eax
jne 0x140006520
nop
mov edi, dword [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x2f8]
cmp rax, 8
jb 0x1400065a9
nop
mov rcx, qword [rbp + 0x2e0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400065a4
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400065c0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
mov eax, edi
add rsp, 0x398
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call fcn.140005840
call fcn.14003f990
call fcn.14003f990
int3