Function at 0x2e3dabf30
Capabilities:
Link many functions at runtime

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
lea rax, [0x2e3f58680]
lea rbx, [0x2e3f58940]
movq xmm0, qword [0x2e3f0a260]
movq xmm1, rax
mov edx, 0x310
lea rax, str.th32ProcessID
mov qword [0x2e3f586d8], 0
movq xmm4, rax
movdqa xmm3, xmm0
lea rax, str.th32ModuleID
mov byte [0x2e3f58d90], 1
punpcklqdq xmm3, xmm4
movq xmm5, rax
movdqa xmm4, xmm0
mov qword [0x2e3f58d98], 0
lea rax, str.dwSize
punpcklqdq xmm4, xmm5
movdqa xmm5, xmm0
movaps xmmword [0x2e3f58e00], xmm3
movq xmm2, rax
mov eax, 0x312
movaps xmmword [0x2e3f58e60], xmm4
mov r8d, 0x310
punpcklqdq xmm5, xmm2
movdqa xmm2, xmmword [0x2e3ef85c0]
mov word [0x2e3f586d0], ax
lea rax, str.cntUsage
movq xmm6, rax
lea rax, str.th32DefaultHeapID
movaps xmmword [0x2e3f58da0], xmm5
movaps xmmword [0x2e3f586c0], xmm2
movdqa xmm2, xmm0
punpcklqdq xmm2, xmm6
movq xmm6, rax
lea rax, str.cntThreads
mov byte [0x2e3f58dc0], 1
movaps xmmword [0x2e3f58dd0], xmm2
movq xmm2, rbx
punpcklqdq xmm2, xmm6
movq xmm6, rax
lea rax, str.th32ParentProcessID
mov qword [0x2e3f58dc8], 4
movaps xmmword [0x2e3f58e30], xmm2
movdqa xmm2, xmm0
punpcklqdq xmm2, xmm6
movq xmm6, rax
lea rax, str.pcPriClassBase
mov byte [0x2e3f58df0], 1
movaps xmmword [0x2e3f58e90], xmm2
movdqa xmm2, xmm0
punpcklqdq xmm2, xmm6
movq xmm6, rax
lea rax, str.dwFlags
mov qword [0x2e3f58df8], 8
movaps xmmword [0x2e3f58ec0], xmm2
movdqa xmm2, xmm0
punpcklqdq xmm2, xmm6
movq xmm6, rax
lea rax, [0x2e3f58dc0]
mov byte [0x2e3f58e20], 1
movaps xmmword [0x2e3f58ef0], xmm2
movdqa xmm2, xmm0
lea rbx, [rax - 0x30]
lea rcx, [rax + 0x30]
punpcklqdq xmm2, xmm6
movq xmm6, rax
add rax, 0x60
mov qword [0x2e3f58e28], 0x10
movaps xmmword [0x2e3f58f20], xmm2
movq xmm2, rbx
add rbx, 0xc0
punpcklqdq xmm2, xmm6
mov byte [0x2e3f58e50], 1
movq xmm6, rax
add rax, 0x60
mov qword [0x2e3f58e58], 0x18
mov byte [0x2e3f58e80], 1
mov qword [0x2e3f58e88], 0x1c
mov byte [0x2e3f58eb0], 1
mov qword [0x2e3f58eb8], 0x20
mov byte [0x2e3f58ee0], 1
mov qword [0x2e3f58ee8], 0x24
mov byte [0x2e3f58f10], 1
mov qword [0x2e3f58f18], 0x28
movaps xmmword [0x2e3f59180], xmm2
movq xmm2, rcx
add rcx, 0xc0
punpcklqdq xmm2, xmm6
movq xmm6, rax
add rax, 0x60
mov word [0x2e3f58690], dx
movaps xmmword [0x2e3f59190], xmm2
movq xmm2, rbx
add rbx, 0xc0
lea rdx, str.szExeFile
punpcklqdq xmm2, xmm6
movq xmm6, rax
add rax, 0x60
movaps xmmword [0x2e3f59010], xmm3
movaps xmmword [0x2e3f591a0], xmm2
movq xmm2, rcx
lea rcx, [0x2e3f59180]
punpcklqdq xmm2, xmm6
movq xmm6, rax
mov qword [0x2e3f58d88], rcx
lea rax, [0x2e3f58900]
movaps xmmword [0x2e3f591b0], xmm2
movq xmm2, rbx
mov ecx, 0x312
sub rbx, 0x1b0
punpcklqdq xmm2, xmm6
movq xmm6, rdx
lea rdx, str.GlblcntUsage
movaps xmmword [0x2e3f58fe0], xmm4
movaps xmmword [0x2e3f591c0], xmm2
movdqa xmm2, xmmword [0x2e3ef85d0]
movq xmm3, rdx
lea rdx, str.ProccntUsage
mov qword [0x2e3f58698], rax
movaps xmmword [0x2e3f58680], xmm2
movdqa xmm2, xmm1
punpcklqdq xmm2, xmm6
mov qword [0x2e3f586e0], rbx
movaps xmmword [0x2e3f58f50], xmm2
movdqa xmm2, xmmword [0x2e3ef85e0]
mov word [0x2e3f58650], cx
lea rcx, [0x2e3f58880]
movaps xmmword [0x2e3f58640], xmm2
movdqa xmm2, xmm0
punpcklqdq xmm2, xmm3
movq xmm3, rdx
lea rdx, str.modBaseAddr
movaps xmmword [0x2e3f58fb0], xmm5
movq xmm4, rdx
lea rdx, str.modBaseSize
movaps xmmword [0x2e3f59040], xmm2
movdqa xmm2, xmm0
movq xmm5, rdx
punpcklqdq xmm2, xmm3
mov byte [0x2e3f58f40], 1
lea rdx, str.hModule
mov byte [0x2e3f58d60], 2
punpcklqdq xmm0, xmm5
movq xmm3, rdx
mov qword [0x2e3f58f48], 0x2c
mov qword [0x2e3f58d80], 0xa
mov qword [0x2e3f58658], 0
mov byte [0x2e3f58fa0], 1
mov qword [0x2e3f58fa8], 0
mov byte [0x2e3f58fd0], 1
mov qword [0x2e3f58fd8], 4
mov byte [0x2e3f59000], 1
mov qword [0x2e3f59008], 8
mov byte [0x2e3f59030], 1
mov qword [0x2e3f59038], 0xc
mov byte [0x2e3f59060], 1
mov qword [0x2e3f59068], 0x10
mov rbx, qword [0x2e3f0a320]
movaps xmmword [0x2e3f590d0], xmm0
movq xmm0, rbx
mov qword [0x2e3f58618], rax
lea rax, [0x2e3f58600]
punpcklqdq xmm0, xmm3
movaps xmmword [0x2e3f59070], xmm2
movq xmm2, rcx
movaps xmmword [0x2e3f59100], xmm0
movdqa xmm0, xmmword [0x2e3ef85f0]
punpcklqdq xmm2, xmm4
mov qword [rsp + 0x28], rbx
movaps xmmword [0x2e3f58600], xmm0
movq xmm0, rax
lea rax, str.szModule
movq xmm4, rax
lea rax, [0x2e3f58fd0]
mov byte [0x2e3f59090], 1
punpcklqdq xmm0, xmm4
lea rcx, [rax - 0x30]
movq xmm5, rax
mov qword [0x2e3f59098], 0x18
movaps xmmword [0x2e3f59130], xmm0
movq xmm0, rcx
lea rdx, [rax + 0x30]
add rax, 0x60
punpcklqdq xmm0, xmm5
movq xmm3, rax
lea rbx, [rax + 0x30]
add rax, 0x60
movaps xmmword [0x2e3f58d00], xmm0
movq xmm0, rdx
movq xmm4, rax
add rcx, 0x120
punpcklqdq xmm0, xmm3
add rax, 0x60
add rdx, 0x120
mov byte [0x2e3f590c0], 1
movaps xmmword [0x2e3f58d10], xmm0
movq xmm0, rbx
movq xmm5, rax
add rax, 0x60
punpcklqdq xmm0, xmm4
movq xmm3, rax
lea rax, str.szExePath
mov qword [0x2e3f590c8], 0x20
movaps xmmword [0x2e3f58d20], xmm0
movq xmm0, rcx
movq xmm4, rax
lea rax, [0x2e3f58d00]
punpcklqdq xmm0, xmm5
mov qword [0x2e3f58f98], rax
punpcklqdq xmm1, xmm4
lea rax, [rdx - 0x1b0]
movaps xmmword [0x2e3f58d30], xmm0
movq xmm0, rdx
lea rcx, [0x2e3ef7bd0]
punpcklqdq xmm0, xmm3
mov byte [0x2e3f590f0], 1
mov qword [0x2e3f590f8], 0x28
mov word [0x2e3f58610], r8w
mov byte [0x2e3f59120], 1
mov qword [0x2e3f59128], 0x30
mov byte [0x2e3f59150], 1
mov qword [0x2e3f59158], 0x230
mov qword [0x2e3f58f90], 0xa
mov byte [0x2e3f58f70], 2
mov qword [0x2e3f58660], rax
movaps xmmword [0x2e3f590a0], xmm2
movaps xmmword [0x2e3f58d40], xmm0
movaps xmmword [0x2e3f59160], xmm1
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x2e3f58ce0], rax
mov r12, rax
test rax, rax
je 0x2e3dac5d0
lea r13, str.CreateToolhelp32Snapshot
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rdx, r13
call rbx
test rax, rax
je 0x2e3dac5e0
mov r12, qword [0x2e3f58ce0]
lea r13, str.Process32FirstW
mov qword [0x2e3f585e0], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x2e3dac5f0
mov r12, qword [0x2e3f58ce0]
lea r13, str.Process32NextW
mov qword [0x2e3f585d8], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x2e3dac600
mov r12, qword [0x2e3f58ce0]
lea r13, str.Module32FirstW
mov qword [0x2e3f585d0], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x2e3dac610
mov r12, qword [0x2e3f58ce0]
lea r13, str.Module32NextW
mov qword [0x2e3f585c8], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x2e3dac620
movaps xmm6, xmmword [rsp + 0x30]
mov qword [0x2e3f585c0], rax
add rsp, 0x40
pop rbx
pop r12
pop r13
ret
lea rcx, [0x2e3ef7ba0]
call fcn.2e3d87650
nop dword [rax]
mov rdx, r13
mov rcx, r12
call fcn.2e3d88140
jmp 0x2e3dac522
mov rdx, r13
mov rcx, r12
call fcn.2e3d88140
jmp 0x2e3dac548
mov rdx, r13
mov rcx, r12
call fcn.2e3d88140
jmp 0x2e3dac56e
mov rdx, r13
mov rcx, r12
call fcn.2e3d88140
jmp 0x2e3dac594
mov rdx, r13
mov rcx, r12
call fcn.2e3d88140
jmp 0x2e3dac5b6