Function at 0x140621a56
Capabilities:
Enumerate processes

Disassembly:
push rax
pushf
mov eax, 0xa3d34abd
pushf
not eax
add eax, 0x8d46ba23
xor eax, 0x96db806b
rol eax, 0xb0
popf
pushf
not eax
add eax, 0xc500b3b4
xor eax, 0xd5f2340b
rol eax, 0x9c
popf
cmp eax, 4
jne 0x140621a93
popf
pop rax
jmp 0x140621e30
cmp eax, 0
jne 0x140621aa2
popf
pop rax
jmp 0x140621b0b
cmp eax, 3
jne 0x140621ab1
popf
pop rax
jmp 0x140621d91
cmp eax, 1
jne 0x140621ac0
popf
pop rax
jmp 0x140621c21
cmp eax, 5
jne 0x140621acf
popf
pop rax
jmp 0x140621e8e
cmp eax, 7
jne 0x140621ade
popf
pop rax
jmp 0x140621f7d
cmp eax, 6
jne 0x140621aed
popf
pop rax
jmp 0x140621ed8
cmp eax, 2
jne 0x140621afc
popf
pop rax
jmp 0x140621d12
cmp eax, 8
jne 0x140621b0b
popf
pop rax
jmp 0x140621fe0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14004b080]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor esi, esi
jmp 0x140621b32
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor edx, edx
mov ecx, 0xbbf0743e
pushf
not ecx
add ecx, 0xec2fb5ae
xor ecx, 0xca7acc94
rol ecx, 0xdf
popf
pushf
not ecx
add ecx, 0xee4826e3
xor ecx, 0xdc09980e
rol ecx, 0x91
popf
pushf
not ecx
add ecx, 0xecfd1072
xor ecx, 0xdd26b618
rol ecx, 0x22
popf
jmp 0x140621b81
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x140621bc8
push rax
pushf
mov eax, 0x12a806a9
pushf
not eax
add eax, 0xd9ac345a
xor eax, 0x9b67fd3a
rol eax, 0x69
popf
pushf
not eax
add eax, 0xbc7c4003
xor eax, 0xf4db2b5a
rol eax, 0x9c
popf
jmp 0x140621a84
push rax
pushf
mov eax, 0x550d422b
pushf
not eax
add eax, 0xc1a6761a
xor eax, 0xe1228138
rol eax, 0x9b
popf
pushf
not eax
add eax, 0xf4d8d1dc
xor eax, 0xde4f14c8
rol eax, 0x35
popf
pushf
not eax
add eax, 0xbc00bbd5
xor eax, 0xd3fcb2f7
rol eax, 0x22
popf
pushf
not eax
add eax, 0xcebf7c01
xor eax, 0xe67e6443
rol eax, 0xea
popf
jmp 0x140621a84
xor edx, edx
mov r8d, 0xff9ef63f
pushf
not r8d
add r8d, 0x9ff1c55d
xor r8d, 0xe703946e
rol r8d, 0x9f
popf
pushf
not r8d
add r8d, 0xb5e5f7ac
xor r8d, 0xd6263b3d
rol r8d, 0xf3
popf
pushf
not r8d
add r8d, 0x95bd1d8f
xor r8d, 0xff3efc3d
rol r8d, 0x82
popf
lea rcx, [rsp + 0x30]
call fcn.14002f2d0
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rbx
jmp 0x140621c8f
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140621ccc
push rax
pushf
mov eax, 0xcdd49840
pushf
not eax
add eax, 0xd0ff55eb
xor eax, 0xb9cb6ed5
rol eax, 0x57
popf
pushf
not eax
add eax, 0xa272e4ec
xor eax, 0xe2957422
rol eax, 0x9c
popf
jmp 0x140621a84
push rax
pushf
mov eax, 0xfa3d8c6a
pushf
not eax
add eax, 0x8ab06852
xor eax, 0xb8f41558
rol eax, 0xce
popf
pushf
not eax
add eax, 0xc0d9609d
xor eax, 0xa71f2337
rol eax, 0x12
popf
pushf
not eax
add eax, 0x86c65803
xor eax, 0xb193a928
rol eax, 0x98
popf
jmp 0x140621a84
cmp dword [rsp + 0x38], edi
je 0x140621d4b
push rax
pushf
mov eax, 0x2191541
pushf
not eax
add eax, 0xa4af863f
xor eax, 0xe0709857
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xf5d2ef0e
xor eax, 0xad7611fb
rol eax, 0
popf
jmp 0x140621a84
push rax
pushf
mov eax, 0x3c44a26b
pushf
not eax
add eax, 0xd2686938
xor eax, 0xc9a5269a
rol eax, 0x11
popf
pushf
not eax
add eax, 0x959e6633
xor eax, 0xacffffbb
rol eax, 0x13
popf
pushf
not eax
add eax, 0xa7243afc
xor eax, 0xe2307a8c
rol eax, 0x40
popf
jmp 0x140621a84
lea rdx, [rsp + 0x30]
mov rcx, rbx
jmp 0x140621d9a
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140621dd7
push rax
pushf
mov eax, 0x9aca19cb
pushf
not eax
add eax, 0xdf97e139
xor eax, 0xf8abc552
rol eax, 0xd7
popf
pushf
not eax
add eax, 0xa4ff8603
xor eax, 0x85215311
rol eax, 0x1e
popf
jmp 0x140621a84
push rax
pushf
mov eax, 0xf76f1852
pushf
not eax
add eax, 0xc7663b27
xor eax, 0x994199b6
rol eax, 0xb
popf
pushf
not eax
add eax, 0xf049a8bc
xor eax, 0xc326505b
rol eax, 0xb0
popf
pushf
not eax
add eax, 0xde1f871b
xor eax, 0xef399eca
rol eax, 0xed
popf
pushf
not eax
add eax, 0xe19fd263
xor eax, 0xdf3c3343
rol eax, 0x92
popf
jmp 0x140621a84
jmp 0x140621ed8
mov esi, dword [rsp + 0x50]
push rax
pushf
mov eax, 0xc1982dca
pushf
not eax
add eax, 0xb05063f4
xor eax, 0xe517b0cb
rol eax, 0x25
popf
pushf
not eax
add eax, 0x999be4ad
xor eax, 0xde32f466
rol eax, 0xca
popf
pushf
not eax
add eax, 0xcc08d4be
xor eax, 0xe4189cc6
rol eax, 0x82
popf
jmp 0x140621a84
cmp rbx, 0xffffffffffffffff
je 0x140621f24
push rax
pushf
mov eax, 0xe82d2eb2
pushf
not eax
add eax, 0xebe0cf5e
xor eax, 0x9e8a3bb3
rol eax, 0x1c
popf
pushf
not eax
add eax, 0x995eb21a
xor eax, 0xb65a2ef3
rol eax, 0xdb
popf
pushf
not eax
add eax, 0x99981529
xor eax, 0xbbc98574
rol eax, 0x77
popf
jmp 0x140621a84
push rax
pushf
mov eax, 0xbd82422d
pushf
not eax
add eax, 0xa1602d66
xor eax, 0x95ffc442
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xb9a43c12
xor eax, 0x8e9e3d57
rol eax, 0xe5
popf
pushf
not eax
add eax, 0x86c72cd6
xor eax, 0xbd7e5305
rol eax, 0x1e
popf
pushf
not eax
add eax, 0xa3c6a46c
xor eax, 0x9ac9a924
rol eax, 0x88
popf
jmp 0x140621a84
mov rcx, rbx
jmp 0x140621f81
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x9f784943
pushf
not eax
add eax, 0xdeffc4e5
xor eax, 0x85106002
rol eax, 0xc1
popf
pushf
not eax
add eax, 0x8789a73b
xor eax, 0xda11a368
rol eax, 7
popf
pushf
not eax
add eax, 0xf8da97d3
xor eax, 0xa3cf0829
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xe27b8c2c
xor eax, 0xc6048477
rol eax, 0xd9
popf
jmp 0x140621a84
mov eax, esi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14066b1de
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret