Function at 0x140089210
Capabilities:
Enumerate processes

Disassembly:
push r14
push r15
sub rsp, 0xab8
xor edx, edx
mov dword [rsp + 0x30], 0x238
mov r15, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rdx, r15
movzx ecx, word [rdx]
cmp cx, 0x20
je 0x140089254
cmp cx, 9
jne 0x14008925a
add rdx, 2
jmp 0x140089245
mov qword [rsp + 0xad0], rbx
mov qword [rsp + 0xad8], rbp
mov qword [rsp + 0xae0], rsi
mov qword [rsp + 0xab0], rdi
test cx, cx
je 0x14008935e
xor esi, esi
cmp cx, 0x2d
je 0x140089386
movzx eax, cx
cmp cx, 0x2b
jne 0x14008929c
movzx eax, word [rdx + 2]
lea rdi, [rdx + 2]
cmovne rdi, rdx
cmp ax, 0x30
jne 0x1400892d5
movzx eax, word [rdi + 2]
mov ecx, 0xffdf
sub ax, 0x58
test cx, ax
jne 0x1400892d5
movzx ecx, word [rdi + 4]
lea rbx, [rdi + 4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isxdigit]
test eax, eax
je 0x1400892d5
mov ebp, 1
jmp 0x1400892db
mov ebp, esi
lea rbx, [rdi + 4]
test ebp, ebp
mov ecx, esi
cmove rbx, rdi
movzx edi, word [rbx]
cmp edi, 0x20
je 0x140089340
nop dword [rax + rax]
cmp edi, 9
je 0x140089340
test edi, edi
je 0x14008935a
cmp edi, 0x2e
je 0x140089386
test ebp, ebp
je 0x140089324
movzx ecx, di
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswxdigit]
test eax, eax
mov ecx, esi
sete cl
test ecx, ecx
je 0x14008932c
movzx ecx, di
call fcn.140016470
jmp 0x140089386
lea eax, [rdi - 0x30]
cmp eax, 9
ja 0x14008931a
movzx edi, word [rbx + 2]
add rbx, 2
mov ecx, 1
cmp edi, 0x20
jne 0x1400892f0
nop
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14008934f
cmp ax, 9
jne 0x140089355
add rbx, 2
jmp 0x140089340
test ax, ax
jne 0x140089386
test ecx, ecx
je 0x140089386
mov rcx, r15
call fcn.1400056a0
mov rcx, r15
test al, al
je 0x14008937e
xor edx, edx
lea r8d, [rdx + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wcstoi64]
mov rsi, rax
jmp 0x140089386
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi64]
mov esi, eax
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov rdi, qword [rsp + 0xab0]
mov rbp, qword [rsp + 0xad8]
mov rbx, qword [rsp + 0xad0]
test eax, eax
je 0x14008945d
test esi, esi
je 0x1400893c2
cmp esi, dword [rsp + 0x38]
je 0x14008947c
lea rax, [rsp + 0x480]
lea r9, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x690]
lea rdx, [rsp + 0x8a0]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath]
lea rax, [rsp + 0x270]
sub rax, 2
nop
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140089400
lea r8, [rsp + 0x480]
xor edx, edx
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x140089420
mov rdx, r15
lea rcx, [rsp + 0x270]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, r14
test eax, eax
je 0x14008949b
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400893b4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret