Function at 0x14000392a
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
mov rax, 0x9c
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140003934
sub rsp, 0x28
call fcn.14003d0e0
mov rcx, qword [rsp + 0x540]
call fcn.140009e84
push 0
push 2
pop rcx
pop rdx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x4d8], rax
cmp qword [rsp + 0x4d8], 0
je 0x140003bbd
lea rbp, [rsp + 0x2a0]
mov dword [rbp], 0x238
lea rax, [rsp + 0x2a0]
mov rax, rax
push rax
push qword [rsp + 0x4e0]
pop rcx
pop rdx
call sub.KERNEL32.dll_Process32FirstW
and rax, rax
je 0x140003bb0
lea rax, [rsp + 0x2a0]
mov rax, rax
push rax
push qword [rsp + 0x4e0]
pop rcx
pop rdx
call sub.KERNEL32.dll_Process32NextW
and rax, rax
je 0x140003bb0
lea rbp, [rsp + 0x2a0]
movsxd rax, dword [rbp + 8]
push rax
pop rax
mov dword [rsp + 0x4e0], eax
movsxd rax, dword [rsp + 0x4e0]
mov rax, rax
push rax
push 0
push 0x410
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_OpenProcess
mov qword [rsp + 0x4e8], rax
cmp qword [rsp + 0x4e8], 0
je 0x140003bab
push gethostbyname
lea rax, [rsp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.KERNEL32.dll_RtlZeroMemory
push 0x248
lea rax, [rsp + 0x60]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.KERNEL32.dll_RtlZeroMemory
push qword [rsp + 0x4e8]
pop rcx
call fcn.1400097c7
mov rax, rax
push rax
lea rbp, [rsp + 0x30]
pop rax
mov qword [rbp + 8], rax
push qword [rbp + 8]
push qword [rsp + 0x4f0]
pop rcx
pop rdx
call fcn.140009de6
mov rax, rax
push rax
lea rbp, [rsp + 0x60]
pop rax
mov qword [rbp + 0x20], rax
push rcx
sub rsp, 0x28
call fcn.14003ccc0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003ccc0
add rsp, 0x28
pop rcx
push rax
movsxd rax, dword [rsp + 0x4f8]
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400366f0
add rsp, 0x28
movabs rcx, reloc.WS2_32.dll_ioctlsocket
sub rsp, 0x28
call fcn.14003cd10
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.14003ccc0
add rsp, 0x20
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x20
call fcn.14003ccc0
add rsp, 0x20
pop rcx
push rax
push qword [rbp + 0x20]
push qword [rsp + 0x510]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140003019
add rsp, 0x30
pop rax
lea rcx, [rsp + 0x4f8]
pop rdx
call fcn.14003cd80
push qword [rsp + 0x4e8]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x4f0]
xor rdx, rdx
call fcn.14003d030
or rax, rax
jne 0x140003ba9
mov rcx, qword [rsp + 0x4f8]
push rcx
sub rsp, 0x28
call fcn.14003ccc0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003cd10
add rsp, 0x28
mov rcx, qword [rsp + 0x4f8]
sub rsp, 0x28
call fcn.14003cd10
add rsp, 0x28
movabs rcx, reloc.WS2_32.dll_ioctlsocket
sub rsp, 0x28
call fcn.14003cd10
add rsp, 0x28
lea rcx, [rsp + 0x500]
pop rdx
call fcn.14003cd80
jmp 0x140003bab
jmp 0x140003bb0
jmp 0x1400039b5
push qword [rsp + 0x4d8]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x4f8]
push rcx
sub rsp, 0x28
call fcn.14003ccc0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003cd10
add rsp, 0x28
pop rax
push rax
call fcn.14003cf50
pop rdx
add rax, rdx
jmp 0x140003bf9
push rax
mov rcx, qword [rsp + 0x4f8]
sub rsp, 0x28
call fcn.14003d180
add rsp, 0x28
mov rcx, qword [rsp + 0x500]
sub rsp, 0x28
call fcn.14003d180
add rsp, 0x28
pop rax
add rsp, 0x508
pop r15
pop rbp
ret