Function at 0x180003334
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x8c0]
sub rsp, 0x9c0
mov rax, qword [0x180012008]
xor rax, rsp
mov qword [rbp + 0x8b0], rax
mov rsi, r8
lea rcx, [rbp + 0xb0]
mov rbx, rdx
mov r8d, 0x800
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, rbx
call fcn.180002e88
mov edx, 0x8000
mov rcx, rsi
mov r14d, eax
call fcn.180002fb4
test r14d, r14d
jle 0x1800033a2
mov edx, r14d
mov rcx, rsi
call fcn.18000304c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.1800036c8
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800033ea
lea rax, [0x18000f360]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.180003114
mov eax, 0x1f
jmp 0x1800035b2
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x130
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x180003416
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, str.CreateToolhelp32Snapshot__Process32First
jmp 0x1800033cb
mov rcx, qword [0x181774720]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov r8d, dword [rsp + 0x58]
cmp al, 6
sbb ecx, ecx
xor edx, edx
and ecx, 0xfffff400
add ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
jne 0x180003494
movzx ecx, word [0x18000f3b8]
movsd xmm0, qword [str._nd__td__ts_]
mov word [rbp + 0x88], cx
lea rcx, [rbp + 0x80]
movsd qword [rbp + 0x80], xmm0
call sub.msvcrt.dll__strrev
mov ecx, dword [rsp + 0x58]
lea r8, [rsp + 0x7c]
mov r9d, dword [rsp + 0x70]
mov rdx, rax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.18000307c
jmp 0x18000357f
lea r8, [rsp + 0x48]
mov edx, 8
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800034d3
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp + 0xb0]
mov r8d, 0x800
call fcn.180005788
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1800034da
mov byte [rbp + 0xb0], 0
mov ecx, dword [rsp + 0x58]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov ecx, dword [rsp + 0x40]
or edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov dword [rsp + 0x40], ecx
mov rcx, r15
call fcn.1800036c8
movups xmm0, xmmword [str._nd__ts__ts__td__td__ts_]
test eax, eax
lea rcx, [0x18000f358]
movzx eax, word [0x18000f3d0]
lea rbx, [0x18000f35c]
mov word [rbp + 0xa0], ax
cmove rbx, rcx
mov al, byte [0x18000f3d2]
lea rcx, [rbp + 0x90]
mov byte [rbp + 0xa2], al
movups xmmword [rbp + 0x90], xmm0
call sub.msvcrt.dll__strrev
mov r9d, dword [rsp + 0x70]
lea r8, [rsp + 0x7c]
mov rdx, rax
mov rcx, rsi
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x38], eax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x58]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
call fcn.18000307c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180003416
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
neg r14d
sbb eax, eax
and eax, 5
add eax, 0x11
mov rcx, qword [rbp + 0x8b0]
xor rcx, rsp
call fcn.18000cf30
mov rbx, qword [rsp + 0x9f0]
add rsp, 0x9c0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret