Function at 0x1400258e0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x1400bc0f8]
xor rax, rsp
mov qword [rbp + 0x230], rax
movzx r13d, r8b
mov r15, rdx
mov rbx, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
xor r12d, r12d
mov byte [rsp + 0x30], r12b
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x140025952
mov rcx, r15
call fcn.140028090
mov al, 1
jmp 0x140025e58
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
movdqa xmm1, xmmword [0x140089a40]
movdqu xmmword [rbp + 0x220], xmm1
mov byte [rbp + 0x210], 0
test eax, eax
je 0x140025e41
mov r14, 0xffffffffffffffff
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1c0], r12
mov qword [rbp + 0x1c8], 7
mov word [rbp + 0x1b0], r12w
test r13b, r13b
je 0x140025d02
movups xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x1e0], r12
mov qword [rbp + 0x1e8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1d0], 0
mov r8d, dword [rsp + 0x78]
lea rdx, [rbp + 0x1f0]
mov rcx, rbx
call fcn.1400257a0
nop
cmp qword [rax + 0x18], 0x10
jb 0x140025a0c
mov rax, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x140025a21
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14001ced0
nop
lea rdx, [rbp + 0x1d0]
lea rcx, [rsp + 0x38]
call fcn.1400155b0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140025a88
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025a83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025e8e
call fcn.14003f74c
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], 0
mov rdx, qword [rbp + 0x208]
cmp rdx, 0x10
jb 0x140025adc
inc rdx
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025ad7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025e94
call fcn.14003f74c
cmp qword [rbp + 0x1e0], 0
jbe 0x140025cc1
lea rdi, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0x10
cmovae rdi, qword [rbp + 0x1d0]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, r14d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rsi, eax
test eax, eax
je 0x140025bcf
mov eax, 2
mul rsi
cmovo rax, r14
mov rcx, rax
call fcn.14003f754
mov rbx, rax
test rax, rax
je 0x140025bcf
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x208], r12
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140025b80
mov rdx, rbx
lea rcx, [rbp + 0x1f0]
call fcn.140015a80
mov rcx, rbx
call fcn.14003f74c
movups xmm0, xmmword [rbp + 0x1f0]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rbp + 0x200]
movups xmmword [rsp + 0x48], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rdi, xmm0
movq r14, xmm1
jmp 0x140025bef
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov r14, r12
mov qword [rsp + 0x48], r12
mov edi, 7
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x38], r12w
lea r9, [rsp + 0x38]
mov rsi, qword [rsp + 0x38]
cmp rdi, 8
cmovae r9, rsi
mov r12, qword [rbp + 0x1c0]
mov rcx, qword [rbp + 0x1c8]
mov rax, rcx
sub rax, r12
cmp r14, rax
ja 0x140025c56
lea rax, [r14 + r12]
mov qword [rbp + 0x1c0], rax
lea rbx, [rbp + 0x1b0]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x1b0]
lea rcx, [rbx + r12*2]
lea r8, [r14 + r14]
mov rdx, r9
call fcn.14004c3b0
lea rax, [r14 + r12]
xor r12d, r12d
mov word [rbx + rax*2], r12w
jmp 0x140025c7a
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp + 0x1b0]
call fcn.140015f70
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x38]
xor r12d, r12d
cmp rdi, 8
jb 0x140025cb5
lea rdx, [rdi*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140025cad
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025e9a
mov rcx, rsi
call fcn.14003f74c
mov r14, 0xffffffffffffffff
mov rsi, qword [rsp + 0x58]
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0x10
jb 0x140025d02
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025cfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025e82
call fcn.14003f74c
mov edi, r12d
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
sub rax, rcx
sar rax, 5
test eax, eax
jle 0x140025d97
mov rbx, r12
nop
add rcx, rbx
cmp qword [rcx + 0x18], 8
jb 0x140025d2d
mov rcx, qword [rcx]
lea rdx, [rbp - 0x64]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140025dfa
test r13b, r13b
je 0x140025d7f
cmp qword [rbp + 0x1c0], 0
jbe 0x140025d7f
lea rdx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 8
cmovae rdx, qword [rbp + 0x1b0]
mov rcx, qword [r15]
add rcx, rbx
cmp qword [rcx + 0x18], 8
jb 0x140025d75
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140025dfa
inc edi
add rbx, 0x20
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
sub rax, rcx
sar rax, 5
cmp edi, eax
jl 0x140025d20
lea rdx, [rsp + 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
mov ebx, eax
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 8
jb 0x140025dec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025de7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025e88
call fcn.14003f74c
test ebx, ebx
je 0x140025e41
mov rbx, qword [rsp + 0x60]
jmp 0x1400259a0
mov byte [rsp + 0x30], 1
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 8
jb 0x140025e41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025e3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025e88
call fcn.14003f74c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, r15
call fcn.140028090
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.14003fb10
mov rbx, qword [rsp + 0x390]
add rsp, 0x340
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140062acc
nop
call fcn.140062acc
nop
call fcn.140062acc
nop
call fcn.140062acc
int3
call fcn.140062acc
int3