Function at 0x140010d00
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
push r14
push r15
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x140022040]
xor rax, rsp
mov qword [rbp + 0x300], rax
xor edx, edx
mov r15, rcx
xor r12d, r12d
xor sil, sil
mov qword [0x140022990], r12
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0xc0]
mov dword [rbp + 0xc0], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140010daa
nop dword [rax]
lea rdx, [rbp + 0xec]
lea rcx, str.Unturned.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
lea ecx, [rsi + 1]
test eax, eax
movzx edx, cl
movzx ecx, sil
cmovne edx, ecx
mov rcx, rbx
movzx esi, dl
lea rdx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140010d70
mov rcx, qword [0x140022990]
xor r14b, r14b
mov qword [rsp + 0x488], rdi
mov qword [rsp + 0x490], r13
test sil, sil
je 0x140010eae
lea r13, str.mono_2.0_bdwgc.dll
test rcx, rcx
jne 0x140010eb3
xor edx, edx
movzx ebx, r14b
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0xc0]
mov dword [rbp + 0xc0], 0x238
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140010e43
nop dword [rax]
lea rdx, [rbp + 0xec]
lea rcx, str.Unturned.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140010e2f
test bl, bl
je 0x140010e57
add bl, 0xff
lea rdx, [rbp + 0xc0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140010e10
mov ecx, r12d
mov rax, qword [0x140022c70]
test rax, rax
jne 0x140010e60
mov rcx, r12
jmp 0x140010e9b
movzx ecx, word [rbp + 0xc8]
jmp 0x140010e46
movsx ebx, cx
xor edx, edx
lea rcx, [rsp + 0x60]
mov dword [rax], ebx
mov r8d, 0x158
call sub.VCRUNTIME140.dll_memset
mov edx, 3
mov dword [rsp + 0x78], ebx
lea rcx, [rsp + 0x60]
mov qword [rbp + 0xa8], r13
call fcn.1400012b0
mov rcx, qword [rbp - 0x78]
test al, al
cmove rcx, r12
inc r14b
mov qword [0x140022990], rcx
cmp r14b, sil
jb 0x140010dd4
test rcx, rcx
je 0x140010eba
mov al, 1
jmp 0x140010fde
mov rcx, qword [r15]
movaps xmmword [rsp + 0x440], xmm6
movaps xmmword [rsp + 0x430], xmm7
movaps xmmword [rsp + 0x420], xmm8
movaps xmmword [rsp + 0x410], xmm9
call fcn.140001e10
movss xmm9, dword [0x14001da38]
lea rbx, str.Searching_for_Unturned.exe
movss xmm8, dword [0x14001da60]
lea rdx, [rsp + 0x40]
mov rcx, qword [r15]
xorps xmm0, xmm0
xorps xmm7, xmm7
mov qword [rsp + 0x30], rbx
unpcklps xmm0, xmm7
mov r9d, 1
movss dword [rsp + 0x28], xmm9
movq r8, xmm0
movss dword [rsp + 0x20], xmm8
call fcn.1400022e0
movaps xmm0, xmmword [0x14001dbb0]
lea r9, [rsp + 0x50]
movups xmm6, xmmword [rsp + 0x40]
mov rcx, qword [r15]
lea rdx, [rsp + 0x40]
movaps xmmword [rsp + 0x50], xmm0
xorps xmm0, xmm0
unpcklps xmm0, xmm7
movq r8, xmm0
movdqa xmmword [rsp + 0x40], xmm6
call fcn.1400032d0
movaps xmm0, xmmword [0x14001dd00]
lea rax, [rsp + 0x50]
mov rcx, qword [r15]
lea rdx, [rsp + 0x40]
movaps xmm3, xmm9
mov qword [rsp + 0x28], rbx
movaps xmm2, xmm8
movd r9d, xmm3
movd r8d, xmm2
movaps xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x20], rax
call fcn.140002d80
mov rcx, qword [0x140022c88]
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x188]
movaps xmm9, xmmword [rsp + 0x410]
xor al, al
movaps xmm8, xmmword [rsp + 0x420]
movaps xmm7, xmmword [rsp + 0x430]
movaps xmm6, xmmword [rsp + 0x440]
mov r13, qword [rsp + 0x490]
mov rdi, qword [rsp + 0x488]
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.140019cd0
mov rbx, qword [rsp + 0x498]
add rsp, 0x450
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret