Function at 0x180003de4
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x8c0]
sub rsp, 0x9c0
mov rax, qword [0x180014008]
xor rax, rsp
mov qword [rbp + 0x8b0], rax
mov rsi, r8
lea rcx, [rbp + 0xb0]
mov rbx, rdx
mov r8d, 0x800
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, rbx
call fcn.1800038f4
mov edx, 0x8000
mov rcx, rsi
mov r14d, eax
call fcn.180003a64
test r14d, r14d
jle 0x180003e52
mov edx, r14d
mov rcx, rsi
call fcn.180003afc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.180004178
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180003e9a
lea rax, [0x1800102a0]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.180003bc4
mov eax, 0x1f
jmp 0x180004062
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x130
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x180003ec6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, str.CreateToolhelp32Snapshot__Process32First
jmp 0x180003e7b
mov rcx, qword [0x181776900]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov r8d, dword [rsp + 0x58]
cmp al, 6
sbb ecx, ecx
xor edx, edx
and ecx, 0xfffff400
add ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
jne 0x180003f44
movzx ecx, word [0x1800102f8]
movsd xmm0, qword [str._nd__td__ts_]
mov word [rbp + 0x88], cx
lea rcx, [rbp + 0x80]
movsd qword [rbp + 0x80], xmm0
call sub.msvcrt.dll__strrev
mov ecx, dword [rsp + 0x58]
lea r8, [rsp + 0x7c]
mov r9d, dword [rsp + 0x70]
mov rdx, rax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.180003b2c
jmp 0x18000402f
lea r8, [rsp + 0x48]
mov edx, 8
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180003f83
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp + 0xb0]
mov r8d, 0x800
call fcn.1800068a8
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x180003f8a
mov byte [rbp + 0xb0], 0
mov ecx, dword [rsp + 0x58]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov ecx, dword [rsp + 0x40]
or edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov dword [rsp + 0x40], ecx
mov rcx, r15
call fcn.180004178
movups xmm0, xmmword [str._nd__ts__ts__td__td__ts_]
test eax, eax
lea rcx, [0x18001027c]
movzx eax, word [0x180010310]
lea rbx, [0x18001029c]
mov word [rbp + 0xa0], ax
cmove rbx, rcx
mov al, byte [0x180010312]
lea rcx, [rbp + 0x90]
mov byte [rbp + 0xa2], al
movups xmmword [rbp + 0x90], xmm0
call sub.msvcrt.dll__strrev
mov r9d, dword [rsp + 0x70]
lea r8, [rsp + 0x7c]
mov rdx, rax
mov rcx, rsi
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x38], eax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x58]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
call fcn.180003b2c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180003ec6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
neg r14d
sbb eax, eax
and eax, 5
add eax, 0x11
mov rcx, qword [rbp + 0x8b0]
xor rcx, rsp
call fcn.18000e520
mov rbx, qword [rsp + 0x9f0]
add rsp, 0x9c0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret