Function at 0x140012c80
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
movsxd rbx, edx
mov r15, rcx
xor r12b, r12b
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140012ce6
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x140012ced
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140012f90
mov r14, rbx
xor esi, esi
call fcn.14000b6b4
mov rcx, rax
test rax, rax
je 0x140012f85
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x2b0], rbx
lea rcx, [rsp + 0x5c]
lea rax, [rsp + 0x5c]
test rax, 0xffffffffffff0000
jne 0x140012d5c
movzx edi, cx
xor edx, edx
mov ecx, edi
call fcn.14000b0cc
test rax, rax
je 0x140012e93
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x2b0]
call fcn.140008224
mov rbx, qword [rsp + 0x2b0]
jmp 0x140012e93
lea rax, [rsp + 0x5c]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140012d65
test edi, edi
jne 0x140012dcf
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140012e93
cmp dword [rdx + 0x10], 0
jge 0x140012d9f
cmp dword [rbx - 0xc], 0
jl 0x140012f3f
mov dword [rbx - 0x10], esi
mov word [rbx], si
jmp 0x140012e93
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140012db5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x2b0], rbx
jmp 0x140012e93
mov ebp, dword [rbx - 0x10]
lea rsi, [rsp + 0x5c]
sub rsi, rbx
sar rsi, 1
test edi, edi
js 0x140012f7a
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140012e0d
mov edx, edi
lea rcx, [rsp + 0x2b0]
call fcn.140007cb8
mov rbx, qword [rsp + 0x2b0]
movsxd rax, edi
cmp rsi, rbp
ja 0x140012e64
lea rdx, [rbx + rsi*2]
lea rsi, [rax + rax]
test rsi, rsi
je 0x140012e7f
test rdx, rdx
jne 0x140012e39
call fcn.140129180
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
call fcn.140128fd4
jmp 0x140012e7f
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, rsi
jae 0x140012e57
call fcn.140129180
mov dword [rax], Ordinal_35
call fcn.140128fd4
jmp 0x140012e7f
mov r8, rsi
mov rcx, rbx
call fcn.14011c9b0
jmp 0x140012e7f
lea rsi, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, rsi
lea r8, [rsp + 0x5c]
mov rcx, rbx
call fcn.1400130a0
cmp edi, dword [rbx - 0xc]
jg 0x140012f6f
mov dword [rbx - 0x10], edi
xor eax, eax
mov word [rsi + rbx], ax
xor esi, esi
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x140012f64
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or ecx, eax
jge 0x140012ec7
mov edx, edi
lea rcx, [rsp + 0x2b0]
call fcn.140007cb8
mov rbx, qword [rsp + 0x2b0]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.140155c5c
cmp edi, dword [rbx - 0xc]
jg 0x140012f59
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], si
mov rcx, rbx
call fcn.140012ff0
mov ecx, eax
mov rax, rsi
test r14, r14
jle 0x140012f0a
cmp dword [r15 + rax*4], ecx
je 0x140012f07
inc rax
cmp rax, r14
jl 0x140012ef7
jmp 0x140012f0a
mov r12b, 1
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140012f24
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test r12b, r12b
jne 0x140012f4a
lea rdx, [rsp + 0x30]
mov rcx, r13
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x140012f4a
jmp 0x140012cf2
mov ecx, 0x80070057
call fcn.14000b9ec
nop
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r12b
jmp 0x140012f90
mov ecx, 0x80070057
call fcn.14000b9ec
int3
mov ecx, 0x80070057
call fcn.14000b9ec
nop
mov ecx, 0x80070057
call fcn.14000b9ec
int3
mov ecx, 0x80070057
call fcn.14000b9ec
nop
mov ecx, 0x80004005
call fcn.14000b9ec
int3
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret