Function at 0x14002bda0
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x258]
sub rsp, 0x330
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov edx, 0x80
lea rcx, [rbp - 0x40]
call fcn.1400244d0
nop
mov edx, 0x81
lea rcx, [rbp - 0x60]
call fcn.1400244d0
nop
mov edx, 0x82
lea rcx, [rbp - 0x80]
call fcn.1400244d0
nop
mov edx, 0x83
lea rcx, [rsp + 0x60]
call fcn.1400244d0
nop
mov edx, 0x84
lea rcx, [rsp + 0x40]
call fcn.1400244d0
nop
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13, rax
xor edi, edi
cmp rax, 0xffffffffffffffff
je 0x14002c16c
mov dword [rbp - 0x10], 0x238
lea rdx, [rbp - 0x10]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x14002be59
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002c16c
or rbx, 0xffffffffffffffff
nop dword [rax]
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rdi
mov word [rsp + 0x20], di
cmp word [rbp + 0x1c], 0
jne 0x14002be7f
mov r8, rdi
jmp 0x14002be9b
lea rax, [rbp + 0x1c]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14002be90
lea rdx, [rbp + 0x1c]
lea rcx, [rsp + 0x20]
call fcn.1400237c0
nop
lea rbx, [rsp + 0x20]
mov r12, qword [rsp + 0x20]
mov r15, qword [rsp + 0x38]
cmp r15, 8
cmovae rbx, r12
lea rax, [rsp + 0x20]
cmovae rax, r12
mov r10, qword [rsp + 0x30]
lea rax, [rax + r10*2]
lea rsi, [rsp + 0x20]
cmovae rsi, r12
mov r14, rax
sub r14, rsi
inc r14
shr r14, 1
cmp rsi, rax
mov eax, 0
cmova r14, rax
test r14, r14
je 0x14002bf27
sub rsi, rbx
nop dword [rax]
movzx ecx, word [rsi + rbx]
call fcn.1400e4290
mov word [rbx], ax
lea rbx, [rbx + 2]
inc rdi
cmp rdi, r14
jne 0x14002bf00
mov r15, qword [rsp + 0x38]
mov r10, qword [rsp + 0x30]
mov r12, qword [rsp + 0x20]
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
lea rdx, [rsp + 0x20]
cmp r15, 8
cmovae rdx, r12
mov r9, qword [rbp - 0x30]
mov r8, r9
cmp r10, r9
cmovb r8, r10
test r8, r8
jmp 0x14002bf86
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14002bf6b
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x14002bf86
mov r8d, 1
movzx eax, word [rcx]
cmp word [rdx], ax
mov rbx, 0xffffffffffffffff
cmovb r8d, ebx
xor edi, edi
jmp 0x14002bf91
jne 0x14002bf55
xor edi, edi
or rbx, 0xffffffffffffffff
mov r8d, edi
test r8d, r8d
jne 0x14002bfa1
cmp r10, r9
jb 0x14002bfa1
jbe 0x14002c144
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rcx, qword [rbp - 0x60]
lea rdx, [rsp + 0x20]
cmp r15, 8
cmovae rdx, r12
mov r9, qword [rbp - 0x50]
mov r8, r9
cmp r10, r9
cmovb r8, r10
test r8, r8
jmp 0x14002bff8
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14002bfe6
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x14002bff8
mov r8d, 1
movzx eax, word [rcx]
cmp word [rdx], ax
cmovb r8d, ebx
jmp 0x14002bffd
jne 0x14002bfd0
mov r8d, edi
test r8d, r8d
jne 0x14002c00d
cmp r10, r9
jb 0x14002c00d
jbe 0x14002c144
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
lea rdx, [rsp + 0x20]
cmp r15, 8
cmovae rdx, r12
mov r9, qword [rbp - 0x70]
mov r8, r9
cmp r10, r9
cmovb r8, r10
test r8, r8
jmp 0x14002c068
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14002c056
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x14002c068
mov r8d, 1
movzx eax, word [rcx]
cmp word [rdx], ax
cmovb r8d, ebx
jmp 0x14002c06d
jne 0x14002c040
mov r8d, edi
test r8d, r8d
jne 0x14002c07d
cmp r10, r9
jb 0x14002c07d
jbe 0x14002c144
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x20]
cmp r15, 8
cmovae rdx, r12
mov r9, qword [rsp + 0x70]
mov r8, r9
cmp r10, r9
cmovb r8, r10
test r8, r8
jmp 0x14002c0d8
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14002c0c6
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x14002c0d8
mov r8d, 1
movzx eax, word [rcx]
cmp word [rdx], ax
cmovb r8d, ebx
jmp 0x14002c0dd
jne 0x14002c0b0
mov r8d, edi
test r8d, r8d
jne 0x14002c0e9
cmp r10, r9
jb 0x14002c0e9
jbe 0x14002c144
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x20]
cmp r15, 8
cmovae rcx, r12
mov r9, qword [rsp + 0x50]
mov rdx, r10
call fcn.140031890
test eax, eax
je 0x14002c144
cmp r15, 8
jb 0x14002c12f
lea r8, [r15 + 1]
mov rdx, r12
lea rcx, [rsp + 0x20]
call fcn.1400146a0
lea rdx, [rbp - 0x10]
mov rcx, r13
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x14002c15f
jmp 0x14002be60
mov bl, 1
cmp r15, 8
jb 0x14002c161
lea r8, [r15 + 1]
mov rdx, r12
lea rcx, [rsp + 0x20]
call fcn.1400146a0
jmp 0x14002c161
xor bl, bl
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002c16e
xor bl, bl
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x14002c18b
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.1400146a0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x40], di
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x14002c1bb
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400146a0
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rdi
mov word [rsp + 0x60], di
mov r8, qword [rbp - 0x68]
cmp r8, 8
jb 0x14002c1e8
inc r8
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.1400146a0
mov qword [rbp - 0x68], 7
mov qword [rbp - 0x70], rdi
mov word [rbp - 0x80], di
mov r8, qword [rbp - 0x48]
cmp r8, 8
jb 0x14002c212
inc r8
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x60]
call fcn.1400146a0
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], rdi
mov word [rbp - 0x60], di
mov r8, qword [rbp - 0x28]
cmp r8, 8
jb 0x14002c23c
inc r8
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.1400146a0
movzx eax, bl
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret