Function at 0x201c2210
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x120], 0xfffffffffffffffe
mov esi, r9d
mov dword [rbp + 0x108], r8d
mov dword [rbp + 0x10c], edx
mov rdi, rcx
cmp qword [0x205b6560], 0
jne 0x201c2294
mov edx, dword [rbp + 0x10c]
xor edx, 0xaf977daf
mov r8d, dword [rbp + 0x108]
xor r8d, 0xf0373d73
mov ecx, 0x900
call fcn.2008daf0
mov qword [rbp + 0x118], rax
mov rcx, rax
call fcn.20067cf0
mov rax, qword [rbp + 0x118]
mov qword [0x205b6560], rax
mov rax, qword [0x205b6560]
mov rax, qword [rax + 0x368]
mov r8d, dword [0x20555f78]
mov ecx, esi
xor ecx, 0x3716b880
mov edx, ecx
xor edx, r8d
and ecx, r8d
lea ecx, [rdx + rcx*2]
mov edx, esi
xor edx, 0x3716b886
add edx, r8d
call qword [case.0x2010e313.0]
mov qword [rbp + 0xe0], rax
test rax, rax
je 0x201c2720
mov r14, rax
mov dword [rbp + 0x104], esi
lea rax, [rbp + 0xe0]
mov qword [rbp + 0xe8], rax
lea r15, [rbp - 0x58]
mov r8d, 0x130
mov rcx, r15
xor edx, edx
call fcn.2044feb0
mov dword [rbp - 0x58], 0x130
mov rcx, r14
mov rdx, r15
call sub.KERNEL32.dll_Process32First
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
test eax, eax
je 0x201c26cf
mov qword [rbp + 0x110], rdi
call fcn.2038d520
mov r14, rax
mov rdi, qword [rbp + 0x110]
nop word cs:[rax + rax]
mov eax, dword [rbp - 0x38]
cmp r14, rax
jne 0x201c26b0
mov rsi, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
cmp rsi, rax
je 0x201c23df
mov r12d, dword [rbp - 0x50]
mov dword [rsi], r12d
mov qword [rsi + 8], 0
cmp qword [0x205b6560], 0
jne 0x201c23a9
mov ecx, 0x900
call fcn.2042789c
mov qword [rbp + 0x118], rax
mov rcx, rax
call fcn.20067cf0
mov rax, qword [rbp + 0x118]
mov qword [0x205b6560], rax
mov rax, qword [0x205b6560]
mov rax, qword [rax + 0x390]
mov ecx, 0x1fffff
xor edx, edx
mov r8d, r12d
call qword [case.0x2010e313.0]
mov qword [rsi + 8], rax
add rsi, 0x10
mov rax, qword [rbp + 0x110]
mov qword [rax + 8], rsi
jmp 0x201c26b0
mov rdi, qword [rdi]
mov rdx, qword [0x205b38a0]
add rdx, rdi
mov r15, rsi
sub r15, rdx
movzx ecx, byte [rbp + 0x104]
xor ecx, 0xfb
add ecx, dword [0x20555f80]
sar r15, cl
lea rbx, [r15 + 1]
sub rax, rdx
sar rax, 4
mov r8, rax
shr r8, 1
movabs rdx, 0xfffffffffffffff
mov rcx, rdx
sub rcx, r8
add r8, rax
cmp r8, rbx
cmovbe r8, rbx
cmp rax, rcx
cmova r8, rdx
mov rax, r8
shr rax, 0x3c
jne 0x201c2745
mov r12, r8
shl r12, 4
cmp r8, 0x100
mov qword [rbp + 0x118], r8
jb 0x201c24a2
cmp byte [0x205b35a8], 0
jne 0x201c247a
movabs rax, 0xffffffffffffffe
cmp r8, rax
jae 0x201c274a
lea rcx, [r12 + 0x27]
call fcn.2042789c
mov rcx, rax
add rcx, 0x27
mov edx, ecx
not edx
xor rcx, 0xffffffffffffffe0
and edx, 0x1f
or rdx, rcx
not rdx
mov qword [rdx - 8], rax
jmp 0x201c24b6
test r8, r8
je 0x201c24b4
mov rcx, r12
call fcn.2042789c
mov rdx, rax
jmp 0x201c24b6
xor edx, edx
shl r15, 4
lea rax, [rdx + r15]
add rax, 0x10
mov qword [rbp + 0xd8], rax
mov r13d, dword [rbp - 0x50]
mov dword [rdx + r15], r13d
mov qword [rbp + 0xf0], rdx
mov qword [rdx + r15 + 8], 0
cmp qword [0x205b6560], 0
jne 0x201c2512
mov ecx, 0x900
call fcn.2042789c
mov qword [rbp + 0xf8], rax
mov rcx, rax
call fcn.20067cf0
mov rax, qword [rbp + 0xf8]
mov qword [0x205b6560], rax
mov rax, qword [0x205b6560]
mov rax, qword [rax + 0x390]
mov ecx, 0x1fffff
xor edx, edx
mov r8d, r13d
call qword [case.0x2010e313.0]
mov r13, qword [rbp + 0xf0]
lea rcx, [r15 + r13]
add rcx, 8
mov qword [rcx], rax
cmp rdi, rsi
je 0x201c25a3
mov rax, r13
mov r15, qword [rbp + 0x110]
jmp 0x201c256d
add rax, 0x10
add rdi, 0x10
cmp rdi, rsi
je 0x201c2596
mov qword [rax + 8], 0
cmp rax, rdi
je 0x201c2560
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov ecx, dword [rdi]
mov dword [rax], ecx
mov qword [rdi + 8], 0
mov dword [rdi], 0
jmp 0x201c2560
mov rdi, qword [r15]
test rdi, rdi
jne 0x201c25b3
jmp 0x201c268e
mov r15, qword [rbp + 0x110]
test rdi, rdi
je 0x201c268e
mov rsi, qword [r15 + 8]
jmp 0x201c25ea
mov rax, qword [rbp + 0x118]
mov qword [0x205b6560], rax
mov rax, qword [0x205b6560]
mov rax, qword [rax + 0x348]
mov rcx, qword [rdi + 8]
call qword [case.0x2010e313.0]
add rdi, 0x10
cmp rdi, rsi
je 0x201c261b
cmp qword [rdi + 8], 0
je 0x201c25e6
cmp qword [0x205b6560], 0
jne 0x201c25ce
mov ecx, 0x900
call fcn.2042789c
mov qword [rbp + 0x118], rax
mov rcx, rax
call fcn.20067cf0
jmp 0x201c25c0
mov rcx, qword [r15]
mov rdx, qword [r15 + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x201c266d
mov rax, qword [rcx - 8]
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x201c274f
mov ecx, dword [rbp + 0x104]
movabs r8, 0x359d291394e4a1d4
xor rcx, r8
add rcx, qword [0x20555f80]
mov r8, rdx
xor r8, rcx
and rcx, rdx
lea rdx, [r8 + rcx*2]
mov rcx, rax
mov r8d, dword [rbp + 0x10c]
xor r8d, 0xa07cbc48
mov r9d, dword [rbp + 0x108]
xor r9d, 0xbb5ae714
call fcn.2008bfb0
mov qword [r15], r13
shl rbx, 4
add rbx, r13
mov qword [r15 + 8], rbx
add r12, r13
mov qword [r15 + 0x10], r12
nop word cs:[rax + rax]
mov rcx, qword [rbp + 0xe0]
lea rdx, [rbp - 0x58]
call sub.KERNEL32.dll_Process32Next
test eax, eax
mov rdi, qword [rbp + 0x110]
jne 0x201c2350
cmp qword [0x205b6560], 0
jne 0x201c2700
mov ecx, 0x900
call fcn.2042789c
mov qword [rbp + 0x118], rax
mov rcx, rax
call fcn.20067cf0
mov rax, qword [rbp + 0x118]
mov qword [0x205b6560], rax
mov rax, qword [0x205b6560]
mov rax, qword [rax + 0x348]
mov rcx, qword [rbp + 0xe8]
mov rcx, qword [rcx]
call qword [case.0x2010e313.0]
jmp 0x201c272e
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov rax, rdi
add rsp, 0x1a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.20067710
call fcn.20067710
call fcn.20407a4c
int3