Function at 0x140071b10
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov r15, rcx
xor esi, esi
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140071e13
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0x1c0], rax
lea rbx, str.c2xpbG11bA
mov rdx, rbx
lea rcx, [rbp + 0x1c0]
call fcn.140031e00
lea rdi, [rsi - 1]
test al, al
jne 0x140071b90
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140071b73
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x1c0]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140071e1e
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0x1b8], rax
lea rbx, [0x1401e3cf8]
mov rdx, rbx
lea rcx, [rbp + 0x1b8]
call fcn.140031e00
test al, al
jne 0x140071bed
mov rax, rdi
nop
inc rax
cmp word [rbx + rax*2], 0
jne 0x140071bd0
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x1b8]
call fcn.140032190
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140071d44
mov dword [rsp + 0x40], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x44]
call fcn.140185af0
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140071d3b
cmp dword [rsp + 0x48], ebx
je 0x140071c53
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140071c35
mov ebx, dword [rsp + 0x60]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x20]
call fcn.14006f7e0
test al, al
jne 0x140071d00
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x140071d3b
mov rsi, qword [rsp + 0x28]
cmp rbx, rsi
je 0x140071ca6
nop
mov rcx, rbx
call fcn.140027810
add rbx, 0x30
cmp rbx, rsi
jne 0x140071c90
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
sub rcx, rbx
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 4
mov rax, rbx
cmp rdx, 0x1000
jb 0x140071cf6
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071e0d
mov rcx, rbx
call fcn.140183144
jmp 0x140071d3b
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
cmp rdx, rax
je 0x140071d31
nop
cmp dword [rdx + 8], ebx
je 0x140071d20
add rdx, 0x30
cmp rdx, rax
jne 0x140071d10
jmp 0x140071d31
add rdx, 0x10
lea rcx, [rbp + 0x1b8]
call fcn.140024710
nop
lea rcx, [rsp + 0x20]
call fcn.140025590
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp + 0x1b8]
add rbx, 0xffffffffffffffe8
cmp dword [rbx + 8], 0
jne 0x140071dad
mov rsi, qword [rbp + 0x1c0]
lea rcx, [rsi - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rbp + 0x1c8], rax
lea rdx, [rbp + 0x1c8]
mov rcx, r15
call fcn.14004beb0
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140071d99
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lock xadd dword [rsi - 8], edi
sub edi, 1
jg 0x140071df3
mov rcx, qword [rsi - 0x18]
lea rdx, [rsi - 0x18]
jmp 0x140071ded
mov rcx, rbx
call fcn.1400318c0
add rax, 0x18
mov qword [r15], rax
mov eax, edi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140071dd5
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x1c0]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140071df3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r15
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140189c24
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
int3