Function at 0x1400c3100
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1e8
mov r12, qword [0x140207460]
xor edx, edx
mov ecx, 2
mov rax, qword [r12]
mov qword [rsp + 0x1d8], rax
xor eax, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400c3203
mov rax, qword [0x140207c90]
pxor xmm0, xmm0
xor edx, edx
xor r13d, r13d
lea rbp, [rsp + 0x30]
movups xmmword [rsp + 0x40], xmm0
lea r14, [rsp + 0x70]
mov rcx, rbp
movups xmmword [rsp + 0x50], xmm0
mov rbx, r14
lea rdi, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x60], 0
call fcn.140129430
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r15d, eax
mov rdx, rdi
mov rcx, rsi
mov dword [rsp + 0xa0], 0x130
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1400c3243
mov rcx, rbp
call fcn.1401298b0
mov rax, qword [0x140207cf0]
lea r8, [0x1401e1d64]
mov edx, 0x78
lea rcx, str.compat_win32_trace2_win32_process_info.c
mov r9, qword [rax]
lea rax, str.windows_ancestry
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.14008fa60
mov rcx, rbp
call fcn.140129030
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x1d8]
sub rax, qword [r12]
jne 0x1400c32ca
add rsp, 0x1e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, rdi
mov rcx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1400c31b7
cmp r15d, dword [rsp + 0xa8]
jne 0x1400c3230
test r13d, r13d
jne 0x1400c3270
mov dword [rbx], r15d
add r13d, 1
mov r15d, dword [rsp + 0xc0]
add rbx, 4
jmp 0x1400c3199
lea rdx, [rsp + 0xcc]
mov rcx, rbp
call fcn.1401294f0
mov rax, r14
jmp 0x1400c3291
add rax, 4
cmp rax, rbx
je 0x1400c32b0
cmp dword [rax], r15d
jne 0x1400c3288
lea rdx, str._cycle_
mov rcx, rbp
call fcn.1401294f0
jmp 0x1400c31b7
cmp r13d, 0xa
jne 0x1400c3252
lea rdx, str._truncated_
mov rcx, rbp
call fcn.1401294f0
jmp 0x1400c31b7
call fcn.1401be670
nop
push rsi
push rbx
sub rsp, 0xc8
mov rsi, qword [0x140207460]
mov rax, qword [rsi]
mov qword [rsp + 0xb8], rax
xor eax, eax
mov ebx, ecx
call fcn.14008eb70
test eax, eax
je 0x1400c3340
test ebx, ebx
je 0x1400c3360
cmp ebx, 1
jne 0x1400c3511
movzx eax, byte [0x1401c4598]
test al, 1
je 0x1400c3480
mov rbx, qword [0x1401c4590]
test rbx, rbx
je 0x1400c3458
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x70]
mov r8d, 0x48
mov rcx, rax
call rbx
test eax, eax
jne 0x1400c3390
nop
mov rax, qword [rsp + 0xb8]
sub rax, qword [rsi]
jne 0x1400c350c
add rsp, 0xc8
pop rbx
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400c34d0
mov rax, qword [rsp + 0xb8]
sub rax, qword [rsi]
jne 0x1400c350c
add rsp, 0xc8
pop rbx
pop rsi
jmp 0x1400c3100
mov rax, qword [0x140207c90]
lea rbx, [rsp + 0x30]
pxor xmm0, xmm0
xor edx, edx
mov rcx, rbx
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x60], 0
call fcn.140129050
mov r8d, dword [rsp + 0x74]
mov rcx, rbx
lea rdx, str.PageFaultCount
call fcn.140129140
mov r8, qword [rsp + 0x78]
mov rcx, rbx
lea rdx, str.PeakWorkingSetSize
call fcn.140129140
mov r8, qword [rsp + 0xb0]
lea rdx, str.PeakPagefileUsage
mov rcx, rbx
call fcn.140129140
mov rcx, rbx
call fcn.1401298b0
mov rax, qword [0x140207cf0]
lea r8, [0x1401e1d64]
mov edx, 0xa8
lea rcx, str.compat_win32_trace2_win32_process_info.c
mov r9, qword [rax]
lea rax, str.windows_memory
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.14008fa60
mov rcx, rbx
call fcn.140129030
jmp 0x1400c3340
call qword [sym.imp.msvcrt.dll__errno]
mov rbx, qword [0x1401c4590]
mov dword [rax], 0x28
test rbx, rbx
je 0x1400c3340
jmp 0x1400c3324
or eax, 1
xor edx, edx
mov rcx, qword [0x1401c4580]
mov r8d, 0x800
mov byte [0x1401c4598], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test rax, rax
je 0x1400c3314
mov rdx, qword [0x1401c4588]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401c4590], rax
mov rbx, rax
jmp 0x1400c331b
mov rax, qword [0x140207cf0]
lea r8, [0x1401e1d64]
mov edx, 0x8b
lea rcx, str.compat_win32_trace2_win32_process_info.c
mov r9, qword [rax]
lea rax, str.windows_debugger_present
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call fcn.14008f990
jmp 0x1400c336e
call fcn.1401be670
mov r9d, ebx
lea r8, str.trace2_collect_process_info:_unknown_reason__d
mov edx, 0xbf
lea rcx, str.compat_win32_trace2_win32_process_info.c
call fcn.1400a0ca0
nop
nop
nop
nop