Function at 0x140003c55
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
mov rax, 0x9c
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140003c5f
sub rsp, 0x28
call fcn.14003d020
mov rcx, qword [rsp + 0x540]
call fcn.140009e50
push 0
push 2
pop rcx
pop rdx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x4d8], rax
cmp qword [rsp + 0x4d8], 0
je 0x140003ee8
lea rbp, [rsp + 0x2a0]
mov dword [rbp], 0x238
lea rax, [rsp + 0x2a0]
mov rax, rax
push rax
push qword [rsp + 0x4e0]
pop rcx
pop rdx
call sub.KERNEL32.dll_Process32FirstW
and rax, rax
je 0x140003edb
lea rax, [rsp + 0x2a0]
mov rax, rax
push rax
push qword [rsp + 0x4e0]
pop rcx
pop rdx
call sub.KERNEL32.dll_Process32NextW
and rax, rax
je 0x140003edb
lea rbp, [rsp + 0x2a0]
movsxd rax, dword [rbp + 8]
push rax
pop rax
mov dword [rsp + 0x4e0], eax
movsxd rax, dword [rsp + 0x4e0]
mov rax, rax
push rax
push 0
push 0x410
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_OpenProcess
mov qword [rsp + 0x4e8], rax
cmp qword [rsp + 0x4e8], 0
je 0x140003ed6
push gethostbyname
lea rax, [rsp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.KERNEL32.dll_RtlZeroMemory
push 0x248
lea rax, [rsp + 0x60]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.KERNEL32.dll_RtlZeroMemory
push qword [rsp + 0x4e8]
pop rcx
call fcn.14000961f
mov rax, rax
push rax
lea rbp, [rsp + 0x30]
pop rax
mov qword [rbp + 8], rax
push qword [rbp + 8]
push qword [rsp + 0x4f0]
pop rcx
pop rdx
call fcn.140009db1
mov rax, rax
push rax
lea rbp, [rsp + 0x60]
pop rax
mov qword [rbp + 0x20], rax
push rcx
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
pop rcx
push rax
movsxd rax, dword [rsp + 0x4f8]
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140036c50
add rsp, 0x28
movabs rcx, reloc.WS2_32.dll_ioctlsocket
sub rsp, 0x28
call fcn.14003cc50
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.14003cc00
add rsp, 0x20
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x20
call fcn.14003cc00
add rsp, 0x20
pop rcx
push rax
push qword [rbp + 0x20]
push qword [rsp + 0x510]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000331a
add rsp, 0x30
pop rax
lea rcx, [rsp + 0x4f8]
pop rdx
call fcn.14003ccc0
push qword [rsp + 0x4e8]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x4f0]
xor rdx, rdx
call fcn.14003cf70
or rax, rax
jne 0x140003ed4
mov rcx, qword [rsp + 0x4f8]
push rcx
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003cc50
add rsp, 0x28
mov rcx, qword [rsp + 0x4f8]
sub rsp, 0x28
call fcn.14003cc50
add rsp, 0x28
movabs rcx, reloc.WS2_32.dll_ioctlsocket
sub rsp, 0x28
call fcn.14003cc50
add rsp, 0x28
lea rcx, [rsp + 0x500]
pop rdx
call fcn.14003ccc0
jmp 0x140003ed6
jmp 0x140003edb
jmp 0x140003ce0
push qword [rsp + 0x4d8]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x4f8]
push rcx
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003cc50
add rsp, 0x28
pop rax
push rax
call fcn.14003ce90
pop rdx
add rax, rdx
jmp 0x140003f24
push rax
mov rcx, qword [rsp + 0x4f8]
sub rsp, 0x28
call fcn.14003d0c0
add rsp, 0x28
mov rcx, qword [rsp + 0x500]
sub rsp, 0x28
call fcn.14003d0c0
add rsp, 0x28
pop rax
add rsp, 0x508
pop r15
pop rbp
ret