Function at 0x1800059ac
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2c8]
sub rsp, 0x3c8
mov rax, qword [0x180013578]
mov rax, qword [rax]
mov qword [rbp + 0x328], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
lea ecx, [rdx + 2]
mov ebx, eax
mov dword [rbp + 0x310], eax
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x320], rax
cmp rax, 0xffffffffffffffff
je 0x180005c65
lea rdx, [rbp + 0x80]
mov rcx, rax
mov dword [rbp + 0x80], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor edi, edi
jmp 0x180005c50
cmp dword [rbp + 0x88], ebx
je 0x180005c3c
lea rdx, str.explorer.exe
lea rcx, [rbp + 0xac]
call fcn.18000cb24
test eax, eax
jne 0x180005a4d
lea r13d, [rax + 2]
jmp 0x180005aa6
lea rdx, str.chrome.exe
lea rcx, [rbp + 0xac]
call fcn.18000cb24
test eax, eax
jne 0x180005a6a
lea r13d, [rax + 3]
jmp 0x180005aa6
lea rdx, str.firefox.exe
lea rcx, [rbp + 0xac]
call fcn.18000cb24
test eax, eax
jne 0x180005a87
lea r13d, [rax + 4]
jmp 0x180005aa6
lea rdx, str.iexplore.exe
lea rcx, [rbp + 0xac]
call fcn.18000cb24
test eax, eax
jne 0x180005c3c
lea r13d, [rax + 5]
movups xmm0, xmmword [0x180011098]
lea r8, [0x180010838]
lea rcx, [rbp - 0x80]
mov edx, 0x80
movdqu xmmword [rsp + 0x70], xmm0
call fcn.18000cb8c
mov ecx, edi
cmp word [rbp - 0x80], di
je 0x180005adf
lea rax, [rbp - 0x80]
lea rax, [rax + 2]
inc ecx
cmp word [rax], di
jne 0x180005ad4
movzx r9d, byte [rsp + 0x7e]
movzx r8d, byte [rsp + 0x7f]
movzx r10d, byte [rsp + 0x7d]
movzx r11d, byte [rsp + 0x7c]
movzx ebx, byte [rsp + 0x7b]
movzx edi, byte [rsp + 0x7a]
movzx esi, byte [rsp + 0x79]
movzx r14d, byte [rsp + 0x78]
movzx r15d, word [rsp + 0x76]
movzx r12d, word [rsp + 0x74]
mov dword [rsp + 0x68], r8d
mov dword [rsp + 0x60], r9d
mov r9d, dword [rsp + 0x70]
mov dword [rsp + 0x58], r10d
mov dword [rsp + 0x50], r11d
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], edi
movsxd rax, ecx
mov dword [rsp + 0x38], esi
mov edx, 0x80
mov dword [rsp + 0x30], r14d
sub edx, ecx
lea rcx, [rbp - 0x80]
lea r8, [0x180010850]
lea rcx, [rcx + rax*2]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r12d
call fcn.18000cb8c
xor edi, edi
mov ecx, edi
cmp word [rbp - 0x80], di
je 0x180005b83
lea rax, [rbp - 0x80]
lea rax, [rax + 2]
inc ecx
cmp word [rax], di
jne 0x180005b78
mov r9d, dword [rbp + 0x88]
movsxd rax, ecx
mov edx, 0x80
sub edx, ecx
lea rcx, [rbp - 0x80]
lea r8, [0x1800108b0]
lea rcx, [rcx + rax*2]
call fcn.18000cb8c
lea r8, [rbp - 0x80]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
test rax, rax
je 0x180005bc3
mov rcx, rax
jmp 0x180005c30
mov r8d, dword [rbp + 0x88]
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180005c36
mov rcx, qword [rbp + 0x328]
lea rdx, str.IsWow64Process
mov dword [rbp + 0x318], edi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180005c0a
lea rdx, [rbp + 0x318]
mov rcx, rbx
call rax
cmp dword [rbp + 0x318], edi
mov edx, edi
sete dl
cmp r13d, 2
je 0x180005c1f
test edx, edx
jne 0x180005c2d
mov ecx, dword [rbp + 0x88]
mov r8d, r13d
call fcn.1800056b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x310]
mov rcx, qword [rbp + 0x320]
lea rdx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180005a24
mov rcx, qword [rbp + 0x320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x3c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret