Function at 0x14002bdb0
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x258]
sub rsp, 0x330
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov edx, 0x80
lea rcx, [rbp - 0x40]
call fcn.1400244d0
nop
mov edx, 0x81
lea rcx, [rbp - 0x60]
call fcn.1400244d0
nop
mov edx, 0x82
lea rcx, [rbp - 0x80]
call fcn.1400244d0
nop
mov edx, 0x83
lea rcx, [rsp + 0x60]
call fcn.1400244d0
nop
mov edx, 0x84
lea rcx, [rsp + 0x40]
call fcn.1400244d0
nop
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13, rax
xor edi, edi
cmp rax, 0xffffffffffffffff
je 0x14002c17c
mov dword [rbp - 0x10], 0x238
lea rdx, [rbp - 0x10]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x14002be69
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002c17c
or rbx, 0xffffffffffffffff
nop dword [rax]
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rdi
mov word [rsp + 0x20], di
cmp word [rbp + 0x1c], 0
jne 0x14002be8f
mov r8, rdi
jmp 0x14002beab
lea rax, [rbp + 0x1c]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14002bea0
lea rdx, [rbp + 0x1c]
lea rcx, [rsp + 0x20]
call fcn.1400237c0
nop
lea rbx, [rsp + 0x20]
mov r12, qword [rsp + 0x20]
mov r15, qword [rsp + 0x38]
cmp r15, 8
cmovae rbx, r12
lea rax, [rsp + 0x20]
cmovae rax, r12
mov r10, qword [rsp + 0x30]
lea rax, [rax + r10*2]
lea rsi, [rsp + 0x20]
cmovae rsi, r12
mov r14, rax
sub r14, rsi
inc r14
shr r14, 1
cmp rsi, rax
mov eax, 0
cmova r14, rax
test r14, r14
je 0x14002bf37
sub rsi, rbx
nop dword [rax]
movzx ecx, word [rsi + rbx]
call fcn.1400e42a0
mov word [rbx], ax
lea rbx, [rbx + 2]
inc rdi
cmp rdi, r14
jne 0x14002bf10
mov r15, qword [rsp + 0x38]
mov r10, qword [rsp + 0x30]
mov r12, qword [rsp + 0x20]
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
lea rdx, [rsp + 0x20]
cmp r15, 8
cmovae rdx, r12
mov r9, qword [rbp - 0x30]
mov r8, r9
cmp r10, r9
cmovb r8, r10
test r8, r8
jmp 0x14002bf96
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14002bf7b
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x14002bf96
mov r8d, 1
movzx eax, word [rcx]
cmp word [rdx], ax
mov rbx, 0xffffffffffffffff
cmovb r8d, ebx
xor edi, edi
jmp 0x14002bfa1
jne 0x14002bf65
xor edi, edi
or rbx, 0xffffffffffffffff
mov r8d, edi
test r8d, r8d
jne 0x14002bfb1
cmp r10, r9
jb 0x14002bfb1
jbe 0x14002c154
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rcx, qword [rbp - 0x60]
lea rdx, [rsp + 0x20]
cmp r15, 8
cmovae rdx, r12
mov r9, qword [rbp - 0x50]
mov r8, r9
cmp r10, r9
cmovb r8, r10
test r8, r8
jmp 0x14002c008
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14002bff6
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x14002c008
mov r8d, 1
movzx eax, word [rcx]
cmp word [rdx], ax
cmovb r8d, ebx
jmp 0x14002c00d
jne 0x14002bfe0
mov r8d, edi
test r8d, r8d
jne 0x14002c01d
cmp r10, r9
jb 0x14002c01d
jbe 0x14002c154
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
lea rdx, [rsp + 0x20]
cmp r15, 8
cmovae rdx, r12
mov r9, qword [rbp - 0x70]
mov r8, r9
cmp r10, r9
cmovb r8, r10
test r8, r8
jmp 0x14002c078
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14002c066
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x14002c078
mov r8d, 1
movzx eax, word [rcx]
cmp word [rdx], ax
cmovb r8d, ebx
jmp 0x14002c07d
jne 0x14002c050
mov r8d, edi
test r8d, r8d
jne 0x14002c08d
cmp r10, r9
jb 0x14002c08d
jbe 0x14002c154
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x20]
cmp r15, 8
cmovae rdx, r12
mov r9, qword [rsp + 0x70]
mov r8, r9
cmp r10, r9
cmovb r8, r10
test r8, r8
jmp 0x14002c0e8
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14002c0d6
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x14002c0e8
mov r8d, 1
movzx eax, word [rcx]
cmp word [rdx], ax
cmovb r8d, ebx
jmp 0x14002c0ed
jne 0x14002c0c0
mov r8d, edi
test r8d, r8d
jne 0x14002c0f9
cmp r10, r9
jb 0x14002c0f9
jbe 0x14002c154
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x20]
cmp r15, 8
cmovae rcx, r12
mov r9, qword [rsp + 0x50]
mov rdx, r10
call fcn.1400318a0
test eax, eax
je 0x14002c154
cmp r15, 8
jb 0x14002c13f
lea r8, [r15 + 1]
mov rdx, r12
lea rcx, [rsp + 0x20]
call fcn.1400146a0
lea rdx, [rbp - 0x10]
mov rcx, r13
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x14002c16f
jmp 0x14002be70
mov bl, 1
cmp r15, 8
jb 0x14002c171
lea r8, [r15 + 1]
mov rdx, r12
lea rcx, [rsp + 0x20]
call fcn.1400146a0
jmp 0x14002c171
xor bl, bl
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002c17e
xor bl, bl
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x14002c19b
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.1400146a0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x40], di
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x14002c1cb
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400146a0
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rdi
mov word [rsp + 0x60], di
mov r8, qword [rbp - 0x68]
cmp r8, 8
jb 0x14002c1f8
inc r8
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.1400146a0
mov qword [rbp - 0x68], 7
mov qword [rbp - 0x70], rdi
mov word [rbp - 0x80], di
mov r8, qword [rbp - 0x48]
cmp r8, 8
jb 0x14002c222
inc r8
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x60]
call fcn.1400146a0
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], rdi
mov word [rbp - 0x60], di
mov r8, qword [rbp - 0x28]
cmp r8, 8
jb 0x14002c24c
inc r8
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.1400146a0
movzx eax, bl
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret