Function at 0x180085c00
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push r12
push r13
push r14
sub rsp, 0x450
mov qword [rsp + 0x1c8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor edx, edx
mov r14d, 2
mov ecx, r14d
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180085c66
xor eax, eax
jmp 0x180086a4f
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x204]
call fcn.180099ff0
mov dword [rsp + 0x200], 0x238
lea rdx, [rsp + 0x200]
mov rcx, rsi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x180085caa
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180086a4f
lea rcx, [rsp + 0x50]
call fcn.180083d00
mov qword [rsp + 0x58], rax
mov byte [rax + 0x41], 1
mov rax, qword [rsp + 0x58]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x58]
mov qword [rax], rax
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x10], rax
mov qword [rsp + 0x60], r12
movabs r13, 0x7ffffffffffffffe
nop
nop
nop
mov edx, 7
mov qword [rsp + 0x48], rdx
mov r8, r12
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r8w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x22c]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
cmp rcx, r13
jbe 0x180085d37
call fcn.180097730
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
cmp rdx, rbx
jae 0x180085d50
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180003d30
mov rdx, qword [rsp + 0x48]
jmp 0x180085d6e
test rbx, rbx
jne 0x180085d6e
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x30]
cmp rdx, 8
cmovae rax, qword [rsp + 0x30]
mov word [rax], bx
jmp 0x180085db5
test rbx, rbx
je 0x180085db5
lea rcx, [rsp + 0x30]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x30]
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x22c]
call fcn.180098b20
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rax + rdi], 0
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x1d0]
call fcn.180004b00
nop
cmp qword [rsp + 0x48], 8
jb 0x180085dda
mov rcx, qword [rsp + 0x30]
call fcn.180098980
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], 0
lea rcx, [rsp + 0x1d0]
call fcn.180001970
lea r8, [rsp + 0x1d0]
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x50]
call fcn.1800856c0
nop
cmp qword [rsp + 0x1f0], 8
jb 0x180085e2f
mov rcx, qword [rsp + 0x1d8]
call fcn.180098980
lea rdx, [rsp + 0x200]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x180085cf0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], r12
mov word [rsp + 0x70], 0
xor r8d, r8d
lea edx, [r8 + 0x18]
lea rcx, [rsp + 0x68]
call fcn.180003d30
lea rcx, [rsp + 0x70]
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x70]
add rdx, rdx
mov r9d, 0x30
lea r8, str.g2dJqYtJmU_BKiHLMosd6g
call fcn.180098b20
mov qword [rsp + 0x80], 0x18
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rax, qword [rsp + 0x70]
mov word [rax + 0x30], 0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x90]
call fcn.180084e80
nop
cmp qword [rax + 0x20], 8
jb 0x180085eee
mov rsi, qword [rax + 8]
jmp 0x180085ef2
lea rsi, [rax + 8]
mov edx, 7
mov qword [rsp + 0x48], rdx
mov r8, r12
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r8w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
cmp rcx, r13
jbe 0x180085f34
call fcn.180097730
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
cmp rdx, rbx
jae 0x180085f4d
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180003d30
mov rdx, qword [rsp + 0x48]
jmp 0x180085f6b
test rbx, rbx
jne 0x180085f6b
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x30]
cmp rdx, 8
cmovae rax, qword [rsp + 0x30]
mov word [rax], bx
jmp 0x180085fad
test rbx, rbx
je 0x180085fad
lea rcx, [rsp + 0x30]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x30]
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
mov r8, rsi
call fcn.180098b20
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rax + rdi], 0
mov rbx, qword [rsp + 0x58]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.180083d80
mov rdi, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x180085fde
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x180085fe3
call fcn.18009a780
cmp qword [rdi + 8], rbx
setne dil
cmp qword [rsp + 0x48], 8
jb 0x180085ffd
mov rcx, qword [rsp + 0x30]
call fcn.180098980
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], 0
cmp qword [rsp + 0xb0], 8
jb 0x18008602a
mov rcx, qword [rsp + 0x98]
call fcn.180098980
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r12
mov word [rsp + 0x98], 0
cmp qword [rsp + 0x88], 8
jb 0x18008605d
mov rcx, qword [rsp + 0x70]
call fcn.180098980
mov ebp, r12d
test dil, dil
cmovne ebp, r14d
mov qword [rsp + 0xf0], 7
mov qword [rsp + 0xe8], r12
mov word [rsp + 0xd8], 0
xor r8d, r8d
lea edx, [r8 + 0x18]
lea rcx, [rsp + 0xd0]
call fcn.180003d30
lea rcx, [rsp + 0xd8]
mov rdx, qword [rsp + 0xf0]
cmp rdx, 8
cmovae rcx, qword [rsp + 0xd8]
add rdx, rdx
mov r9d, 0x30
lea r8, str.gCRuyN7kke1mlI7007HfcA
call fcn.180098b20
mov qword [rsp + 0xe8], 0x18
lea rax, [rsp + 0xd8]
cmp qword [rsp + 0xf0], 8
cmovae rax, qword [rsp + 0xd8]
mov word [rax + 0x30], 0
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x1d0]
call fcn.180084e80
nop
mov dword [rsp + 0x20], 3
cmp qword [rax + 0x20], 8
jb 0x18008612a
mov rsi, qword [rax + 8]
jmp 0x18008612e
lea rsi, [rax + 8]
mov edx, 7
mov qword [rsp + 0x48], rdx
mov r8, r12
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r8w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
cmp rcx, r13
jbe 0x180086170
call fcn.180097730
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
cmp rdx, rbx
jae 0x180086189
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180003d30
mov rdx, qword [rsp + 0x48]
jmp 0x1800861a7
test rbx, rbx
jne 0x1800861a7
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x30]
cmp rdx, 8
cmovae rax, qword [rsp + 0x30]
mov word [rax], bx
jmp 0x1800861e9
test rbx, rbx
je 0x1800861e9
lea rcx, [rsp + 0x30]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x30]
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
mov r8, rsi
call fcn.180098b20
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rax + rdi], 0
mov ebx, 7
mov dword [rsp + 0x20], ebx
mov rsi, qword [rsp + 0x58]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.180083d80
mov rdi, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x180086223
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x180086228
call fcn.18009a780
cmp qword [rdi + 8], rsi
jne 0x180086467
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], r12
mov word [rsp + 0x70], 0
xor r8d, r8d
lea edx, [r8 + 0x18]
lea rcx, [rsp + 0x68]
call fcn.180003d30
lea rcx, [rsp + 0x70]
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x70]
add rdx, rdx
mov r9d, 0x30
lea r8, str.sjFFrtWnK15mlI7007HfcA
call fcn.180098b20
mov qword [rsp + 0x80], 0x18
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rax, qword [rsp + 0x70]
mov word [rax + 0x30], 0
mov dword [rsp + 0x20], 0xf
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x160]
call fcn.180084e80
nop
mov dword [rsp + 0x20], 0x1f
cmp qword [rax + 0x20], 8
jb 0x1800862dc
mov rdx, qword [rax + 8]
jmp 0x1800862e0
lea rdx, [rax + 8]
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r12
mov word [rsp + 0x98], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x90]
call fcn.180003980
nop
mov ebx, 0x3f
mov dword [rsp + 0x20], ebx
mov rsi, qword [rsp + 0x58]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x50]
call fcn.180083d80
mov rdi, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x18008635c
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x180086361
call fcn.18009a780
cmp qword [rdi + 8], rsi
jne 0x180086467
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], r12
mov word [rsp + 0x128], 0
mov r8d, 0x18
lea rdx, str.NIfVcoTVJMEp1gPELFqSw
lea rcx, [rsp + 0x120]
call fcn.180003980
nop
mov dword [rsp + 0x20], 0x7f
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x1a0]
call fcn.180084e80
nop
mov dword [rsp + 0x20], 0xff
cmp qword [rax + 0x20], 8
jb 0x1800863d7
mov rdx, qword [rax + 8]
jmp 0x1800863db
lea rdx, [rax + 8]
mov qword [rsp + 0x118], 7
mov qword [rsp + 0x110], r12
mov word [rsp + 0x100], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0xf8]
call fcn.180003980
nop
mov ebx, 0x1ff
mov dword [rsp + 0x20], ebx
mov rsi, qword [rsp + 0x58]
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x50]
call fcn.180083d80
mov rdi, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x180086457
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x18008645c
call fcn.18009a780
cmp qword [rdi + 8], rsi
jne 0x180086467
xor dil, dil
jmp 0x18008646a
mov dil, 1
bt ebx, 8
jae 0x1800864aa
btr ebx, 8
cmp qword [rsp + 0x118], 8
jb 0x18008648c
mov rcx, qword [rsp + 0x100]
call fcn.180098980
mov qword [rsp + 0x118], 7
mov qword [rsp + 0x110], r12
mov word [rsp + 0x100], 0
test bl, bl
jns 0x1800864e8
btr ebx, 7
cmp qword [rsp + 0x1c0], 8
jb 0x1800864ca
mov rcx, qword [rsp + 0x1a8]
call fcn.180098980
mov qword [rsp + 0x1c0], 7
mov qword [rsp + 0x1b8], r12
mov word [rsp + 0x1a8], 0
test bl, 0x40
je 0x180086526
and ebx, 0xffffffbf
cmp qword [rsp + 0x140], 8
jb 0x180086508
mov rcx, qword [rsp + 0x128]
call fcn.180098980
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], r12
mov word [rsp + 0x128], 0
test bl, 0x20
je 0x180086564
and ebx, 0xffffffdf
cmp qword [rsp + 0xb0], 8
jb 0x180086546
mov rcx, qword [rsp + 0x98]
call fcn.180098980
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r12
mov word [rsp + 0x98], 0
test bl, 0x10
je 0x1800865a2
and ebx, 0xffffffef
cmp qword [rsp + 0x180], 8
jb 0x180086584
mov rcx, qword [rsp + 0x168]
call fcn.180098980
mov qword [rsp + 0x180], 7
mov qword [rsp + 0x178], r12
mov word [rsp + 0x168], 0
test bl, 8
je 0x1800865da
and ebx, 0xfffffff7
cmp qword [rsp + 0x88], 8
jb 0x1800865bf
mov rcx, qword [rsp + 0x70]
call fcn.180098980
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], r12
mov word [rsp + 0x70], 0
test bl, 4
je 0x180086609
and ebx, 0xfffffffb
cmp qword [rsp + 0x48], 8
jb 0x1800865f4
mov rcx, qword [rsp + 0x30]
call fcn.180098980
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], 0
test bl, 2
je 0x180086647
and ebx, 0xfffffffd
cmp qword [rsp + 0x1f0], 8
jb 0x180086629
mov rcx, qword [rsp + 0x1d8]
call fcn.180098980
mov qword [rsp + 0x1f0], 7
mov qword [rsp + 0x1e8], r12
mov word [rsp + 0x1d8], 0
test bl, 1
je 0x180086667
and ebx, 0xfffffffe
cmp qword [rsp + 0xf0], 8
jb 0x180086667
mov rcx, qword [rsp + 0xd8]
call fcn.180098980
test dil, dil
je 0x18008666f
or ebp, 1
mov qword [rsp + 0xf0], 7
mov qword [rsp + 0xe8], r12
mov word [rsp + 0xd8], 0
mov r8d, 0x18
lea rdx, str.igE9GT3zhQIp1gPELFqSw
lea rcx, [rsp + 0xd0]
call fcn.180003980
nop
bts ebx, 9
mov dword [rsp + 0x20], ebx
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x160]
call fcn.180084e80
nop
bts ebx, 0xa
mov dword [rsp + 0x20], ebx
cmp qword [rax + 0x20], 8
jb 0x1800866db
mov rdx, qword [rax + 8]
jmp 0x1800866df
lea rdx, [rax + 8]
mov qword [rsp + 0x118], 7
mov qword [rsp + 0x110], r12
mov word [rsp + 0x100], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0xf8]
call fcn.180003980
nop
bts ebx, 0xb
mov dword [rsp + 0x20], ebx
mov rsi, qword [rsp + 0x58]
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x50]
call fcn.180083d80
mov rdi, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x18008675a
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x18008675f
call fcn.18009a780
cmp qword [rdi + 8], rsi
jne 0x180086864
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], r12
mov word [rsp + 0x128], 0
mov r8d, 0x18
lea rdx, str.l0PF_ifqACrATEfPeOVdg
lea rcx, [rsp + 0x120]
call fcn.180003980
nop
bts ebx, 0xc
mov dword [rsp + 0x20], ebx
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x1d0]
call fcn.180084e80
nop
bts ebx, 0xd
mov dword [rsp + 0x20], ebx
cmp qword [rax + 0x20], 8
jb 0x1800867d5
mov rdx, qword [rax + 8]
jmp 0x1800867d9
lea rdx, [rax + 8]
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r12
mov word [rsp + 0x98], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x90]
call fcn.180003980
nop
bts ebx, 0xe
mov dword [rsp + 0x20], ebx
mov rsi, qword [rsp + 0x58]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.180083d80
mov rdi, rax
mov rax, qword [rax]
test rax, rax
je 0x180086854
lea rcx, [rsp + 0x50]
cmp rax, rcx
je 0x180086859
call fcn.18009a780
cmp qword [rdi + 8], rsi
jne 0x180086864
xor dil, dil
jmp 0x180086867
mov dil, 1
bt ebx, 0xe
jae 0x1800868a7
btr ebx, 0xe
cmp qword [rsp + 0xb0], 8
jb 0x180086889
mov rcx, qword [rsp + 0x98]
call fcn.180098980
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r12
mov word [rsp + 0x98], 0
bt ebx, 0xd
jae 0x1800868e7
btr ebx, 0xd
cmp qword [rsp + 0x1f0], 8
jb 0x1800868c9
mov rcx, qword [rsp + 0x1d8]
call fcn.180098980
mov qword [rsp + 0x1f0], 7
mov qword [rsp + 0x1e8], r12
mov word [rsp + 0x1d8], 0
bt ebx, 0xc
jae 0x180086927
btr ebx, 0xc
cmp qword [rsp + 0x140], 8
jb 0x180086909
mov rcx, qword [rsp + 0x128]
call fcn.180098980
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], r12
mov word [rsp + 0x128], 0
bt ebx, 0xb
jae 0x180086967
btr ebx, 0xb
cmp qword [rsp + 0x118], 8
jb 0x180086949
mov rcx, qword [rsp + 0x100]
call fcn.180098980
mov qword [rsp + 0x118], 7
mov qword [rsp + 0x110], r12
mov word [rsp + 0x100], 0
bt ebx, 0xa
jae 0x1800869a7
btr ebx, 0xa
cmp qword [rsp + 0x180], 8
jb 0x180086989
mov rcx, qword [rsp + 0x168]
call fcn.180098980
mov qword [rsp + 0x180], 7
mov qword [rsp + 0x178], r12
mov word [rsp + 0x168], 0
bt ebx, 9
jae 0x1800869c5
cmp qword [rsp + 0xf0], 8
jb 0x1800869c5
mov rcx, qword [rsp + 0xd8]
call fcn.180098980
test dil, dil
je 0x1800869cd
or ebp, 8
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0xc8], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0xc0], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0x150], xmm0
mov rcx, qword [rcx]
mov qword [rsp + 0xc8], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0xc0], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
lea r9, [rsp + 0x150]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x50]
call fcn.1800859b0
mov rcx, qword [rsp + 0x58]
call fcn.180098980
mov eax, ebp
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180099050
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret