Function at 0x14024b490
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2b8
mov r13, rdx
mov rax, qword [0x140ad7868]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov eax, 0x4626ace
mov esi, 0x3cd27e18
lea rbx, [rsp + 0x78]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0xfc268d3e
mov r15d, 0x7161a71e
mov r12d, 0xcc2f5c44
jmp 0x14024b500
cmp eax, 0xfc268d3e
je 0x14024b754
cmp eax, 0xac98ed
jne 0x14024b500
mov eax, 0x382257da
xor r14d, r14d
nop dword [rax + rax]
cmp eax, 0x39581e5
jle 0x14024b550
cmp eax, 0x517cfcb7
jle 0x14024b5a0
cmp eax, 0x6c016a4d
jle 0x14024b626
cmp eax, 0x7161a71d
jg 0x14024b6fc
cmp eax, 0x6c016a4e
je 0x14024b763
cmp eax, 0x6fba65ae
jne 0x14024b500
mov eax, 0x3cd27e18
jmp 0x14024b500
cmp eax, 0xd0f29286
jle 0x14024b5f0
cmp eax, 0xe17d0320
jle 0x14024b658
cmp eax, 0xfc268d3d
jg 0x14024b4e1
cmp eax, 0xe17d0321
je 0x14024b777
cmp eax, 0xee1dbfce
jne 0x14024b500
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
mov dword [rsp + 0x4c], eax
mov eax, 0x87490948
jmp 0x14024b500
cmp eax, 0x2b4517af
jle 0x14024b690
cmp eax, 0x382257d9
jg 0x14024b723
cmp eax, 0x2b4517b0
je 0x14024b4f3
cmp eax, 0x2ce5f442
jne 0x14024b500
cmp dword [rsp + 0x3c], 0
mov eax, 0xd0f29287
mov ecx, 0x6906fbff
cmove eax, ecx
jmp 0x14024b500
cmp eax, 0xb657f3b6
jg 0x14024b6cc
cmp eax, 0x87490948
je 0x14024b78c
cmp eax, 0x899e9a13
je 0x14024b7b2
cmp eax, 0xa6602dc5
jne 0x14024b500
mov eax, 0x7161a71e
jmp 0x14024b500
cmp eax, 0x517cfcb8
je 0x14024b7d6
cmp eax, 0x51f67a39
je 0x14024b7ea
cmp eax, 0x6906fbff
jne 0x14024b500
mov rcx, qword [rsp + 0x30]
call rbp
mov eax, 0xe17d0321
jmp 0x14024b500
cmp eax, 0xd0f29287
je 0x14024b812
cmp eax, 0xd168b24e
je 0x14024b82d
cmp eax, 0xe0820056
jne 0x14024b500
cmp byte [rsp + 0x2d], 0
mov eax, 0xd168b24e
mov ecx, 0xd0f29287
cmovne eax, ecx
jmp 0x14024b500
cmp eax, 0x39581e6
je 0x14024b84b
cmp eax, 0x4626ace
je 0x14024b87f
cmp eax, 0x23eaed74
jne 0x14024b500
mov rdx, qword [rsp + 0x58]
mov rcx, r13
call fcn.14024bb00
mov dword [rsp + 0x3c], eax
mov eax, 0x2ce5f442
jmp 0x14024b500
cmp eax, 0xb657f3b7
je 0x14024b893
cmp eax, 0xc1a17d84
je 0x14024b8ae
cmp eax, 0xcc2f5c44
jne 0x14024b500
mov eax, 0x382257da
mov r14d, dword [rsp + 0x40]
jmp 0x14024b500
cmp eax, 0x7161a71e
je 0x14024b8c5
cmp eax, 0x79cddf33
jne 0x14024b500
mov rcx, qword [rsp + 0x30]
call rbp
mov eax, 0x2b4517b0
jmp 0x14024b500
cmp eax, 0x3cd27e18
jne 0x14024b8ed
mov eax, dword [0x140ae0868]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6fba65ae
cmove eax, edi
cmp dword [0x140ae086c], 0xa
cmovl eax, edi
jmp 0x14024b500
mov eax, 0x382257da
mov r14d, dword [rsp + 0x4c]
jmp 0x14024b500
cmp dword [rsp + 0x44], 0
setne byte [rsp + 0x2c]
mov eax, 0xc1a17d84
jmp 0x14024b500
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x40], eax
mov eax, 0x51f67a39
jmp 0x14024b500
mov eax, dword [0x140ae0868]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6fba65ae
cmove eax, esi
cmp dword [0x140ae086c], 0xa
cmovl eax, esi
jmp 0x14024b500
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
call sub.KERNEL32.dll_Process32FirstW
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x58], rax
mov eax, 0x23eaed74
jmp 0x14024b500
cmp dword [rsp + 0x48], 0
setne byte [rsp + 0x2d]
mov eax, 0xe0820056
jmp 0x14024b500
mov eax, dword [0x140ae0868]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa6602dc5
cmove eax, r15d
cmp dword [0x140ae086c], 0xa
cmovl eax, r15d
jmp 0x14024b500
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
call sub.KERNEL32.dll_Process32NextW
mov dword [rsp + 0x44], eax
mov eax, 0x6c016a4e
jmp 0x14024b500
mov rcx, qword [rsp + 0x30]
call rbp
lea rax, [rsp + 0x80]
mov qword [rsp + 0x68], rax
mov eax, 0xee1dbfce
jmp 0x14024b500
mov dword [rsp + 0x78], 0x238
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 0xffffffffffffffff
mov eax, 0x899e9a13
mov ecx, 0xac98ed
cmove eax, ecx
jmp 0x14024b500
mov qword [rsp + 0x50], rbx
mov rax, qword [rsp + 0x50]
mov eax, 0x39581e6
jmp 0x14024b500
mov rdx, qword [rsp + 0x58]
mov rcx, r13
call fcn.14024bb00
mov dword [rsp + 0x48], eax
mov eax, 0x517cfcb8
jmp 0x14024b500
cmp byte [rsp + 0x2c], 0
mov eax, 0x79cddf33
mov ecx, 0xb657f3b7
cmovne eax, ecx
jmp 0x14024b500
mov eax, dword [0x140ae0868]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa6602dc5
cmove eax, r12d
cmp dword [0x140ae086c], 0xa
cmovl eax, r12d
jmp 0x14024b500
cmp eax, 0x382257da
jne 0x14024b500
mov rax, qword [rsp + 0x50]
mov eax, 0x1e846086
mov r15d, 0x3e8afedd
mov r12d, 0xbdb3a6ca
mov edi, 0x5fbd3edd
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x3ba6ecb6
je 0x14024bad1
cmp eax, 0x1e846086
jne 0x14024b920
mov rcx, r13
call fcn.1402a0970
mov eax, dword [0x140ae0ef0]
mov r8d, dword [0x140ae0ef4]
lea r9d, [rax - 1]
imul r9d, eax
test r9b, 1
sete al
cmp r8d, 0xa
setl cl
or cl, al
mov edx, 0x177349d5
mov eax, 0x37c113c2
cmovne edx, eax
mov qword [rsp + 0x70], r13
mov ebp, 0x177349d5
cmovne ebp, r15d
mov esi, 0x87543afa
cmovne esi, r12d
mov eax, 0x89e77753
nop dword [rax + rax]
cmp eax, 0xf6e13615
je 0x14024bac7
cmp eax, 0x89e77753
jne 0x14024b990
test r9b, 1
mov rax, qword [rsp + 0x70]
sete byte [rsp + 0x2e]
cmp r8d, 0xa
setl byte [rsp + 0x2f]
mov ebx, 0x2f05dc37
jmp 0x14024b9d0
mov ebx, 0x5fbd3edd
nop word cs:[rax + rax]
nop
mov ecx, ebx
cmp ebx, 0x2f05dc36
jle 0x14024ba10
cmp ecx, 0x5fbd3edc
jg 0x14024ba40
cmp ecx, 0x2f05dc37
je 0x14024ba85
cmp ecx, 0x3e8afedd
jne 0x14024baaf
mov rcx, qword [rsp + 0x60]
mov ebx, edx
jmp 0x14024b9d0
cmp ecx, 0xbdb3a6c9
jg 0x14024ba60
cmp ecx, 0x87543afa
je 0x14024b9c0
mov ebx, ecx
cmp ecx, 0x8d620819
jne 0x14024b9d0
mov qword [rsp + 0x60], rax
mov ebx, 0x7e7229aa
jmp 0x14024b9d0
mov ebx, esi
cmp ecx, 0x5fbd3edd
je 0x14024b9d0
mov ebx, ecx
cmp ecx, 0x7e7229aa
jne 0x14024b9d0
mov ebx, ebp
jmp 0x14024b9d0
cmp ecx, 0xbdb3a6ca
je 0x14024baa5
mov ebx, ecx
cmp ecx, 0x177349d5
jne 0x14024b9d0
mov rcx, qword [rsp + 0x60]
mov ebx, 0x3e8afedd
jmp 0x14024b9d0
movzx ecx, byte [rsp + 0x2e]
cmp byte [rsp + 0x2f], 0
mov ebx, 0x5fbd3edd
jne 0x14024ba9b
mov ebx, 0x87543afa
test cl, cl
cmovne ebx, edi
jmp 0x14024b9d0
mov ebx, 0x8d620819
jmp 0x14024b9d0
mov ebx, ecx
cmp ecx, 0x37c113c2
jne 0x14024b9d0
mov eax, 0xf6e13615
jmp 0x14024b990
mov eax, 0x3ba6ecb6
jmp 0x14024b920
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140616370
mov eax, r14d
add rsp, 0x2b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret