Function at 0x1401e6330
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x288
mov r12, rcx
mov rax, qword [0x14082e958]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea r15, [rsp + 0x48]
mov qword [rsp + 0x38], r15
mov rax, qword [rsp + 0x38]
mov dword [rsp + 0x48], 0x238
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
mov ecx, 0x61b88e4e
lea r14, [rsp + 0x74]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401e63a6
mov ecx, 0x5e1b65bd
nop word cs:[rax + rax]
nop
cmp eax, 0xa
cmovl ecx, edx
cmp ecx, 0x1d82b697
jle 0x1401e6410
cmp ecx, 0x517e003e
jg 0x1401e6460
cmp ecx, 0x39565b7d
jle 0x1401e6504
cmp ecx, 0x39565b7e
je 0x1401e6605
cmp ecx, 0x4d710e5f
je 0x1401e6611
cmp ecx, 0x4fed9070
jne 0x1401e63a6
mov ecx, dword [0x140837bb8]
mov eax, dword [0x140837bbc]
lea edi, [rcx - 1]
imul edi, ecx
mov edx, 0x249e17f9
mov ecx, 0x249e17f9
test dil, 1
je 0x1401e63a0
jmp 0x1401e6390
cmp ecx, 0xca7e8cc1
jg 0x1401e64b0
cmp ecx, 0xa55ab038
jle 0x1401e6547
cmp ecx, 0xa55ab039
je 0x1401e6628
cmp ecx, 0xacc9f821
je 0x1401e6662
cmp ecx, 0xc209d65a
jne 0x1401e63a6
mov rcx, qword [rsp + 0x28]
call rbx
mov ecx, 0xa55ab039
jmp 0x1401e63a6
cmp ecx, 0x61b88e4d
jle 0x1401e659b
cmp ecx, 0x6dcbb78a
je 0x1401e6605
cmp ecx, 0x68cb75f6
je 0x1401e6673
cmp ecx, 0x61b88e4e
jne 0x1401e63a6
mov rax, qword [rsp + 0x28]
mov ecx, 0x4fed9070
cmp rax, 0xffffffffffffffff
je 0x1401e63a6
mov ecx, 0x8012676f
jmp 0x1401e63a6
cmp ecx, 0xdbac3608
jle 0x1401e65bd
cmp ecx, 0xdbac3609
je 0x1401e6688
cmp ecx, 0xebc47859
je 0x1401e66b3
cmp ecx, 0xdd47c28
jne 0x1401e63a6
mov rdx, qword [rsp + 0x40]
mov rcx, r12
call fcn.1401e6850
mov ecx, 0x68cb75f6
test eax, eax
je 0x1401e63a6
mov ecx, 0xd6855da9
jmp 0x1401e63a6
cmp ecx, 0x1e1e6731
je 0x1401e66cd
cmp ecx, 0x249e17f9
jne 0x1401e6778
mov ecx, dword [0x140837bb8]
mov eax, dword [0x140837bbc]
lea edi, [rcx - 1]
imul edi, ecx
mov edx, 0x39565b7e
mov ecx, 0x39565b7e
test dil, 1
je 0x1401e63a0
jmp 0x1401e6390
cmp ecx, 0x8012676f
je 0x1401e66db
cmp ecx, 0x96bd0a58
jne 0x1401e63a6
mov rcx, qword [rsp + 0x28]
mov rdx, r15
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne byte [rsp + 0x25]
mov ecx, dword [0x140837bb8]
mov eax, dword [0x140837bbc]
lea edi, [rcx - 1]
imul edi, ecx
mov edx, 0xebc47859
mov ecx, 0xebc47859
test dil, 1
je 0x1401e63a0
jmp 0x1401e65fb
cmp ecx, 0x517e003f
je 0x1401e6711
cmp ecx, 0x5e1b65bd
jne 0x1401e63a6
mov ecx, 0x249e17f9
jmp 0x1401e63a6
cmp ecx, 0xca7e8cc2
je 0x1401e6748
cmp ecx, 0xd6855da9
jne 0x1401e63a6
mov ecx, dword [0x140837bb8]
mov eax, dword [0x140837bbc]
lea edi, [rcx - 1]
imul edi, ecx
mov edx, 0x96bd0a58
mov ecx, 0x96bd0a58
test dil, 1
je 0x1401e63a0
mov ecx, 0x4d710e5f
jmp 0x1401e63a0
mov ecx, 0x1d82b698
xor esi, esi
jmp 0x1401e63a6
mov rcx, qword [rsp + 0x28]
mov rdx, r15
call sub.KERNEL32.dll_Process32NextW
mov ecx, 0x96bd0a58
jmp 0x1401e63a6
mov rcx, qword [rsp + 0x28]
call rbx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x34], eax
mov ecx, dword [0x140837bb8]
mov eax, dword [0x140837bbc]
lea edi, [rcx - 1]
imul edi, ecx
mov edx, 0x1e1e6731
mov ecx, 0x1e1e6731
test dil, 1
je 0x1401e63a0
jmp 0x1401e676e
mov rcx, qword [rsp + 0x28]
call rbx
mov ecx, 0x517e003f
jmp 0x1401e63a6
mov rcx, qword [rsp + 0x28]
call rbx
mov ecx, 0x1d82b698
mov esi, dword [rsp + 0x50]
jmp 0x1401e63a6
mov ecx, dword [0x140837bb8]
mov eax, dword [0x140837bbc]
lea edi, [rcx - 1]
imul edi, ecx
mov edx, 0x517e003f
mov ecx, 0x517e003f
test dil, 1
je 0x1401e63a0
jmp 0x1401e673e
cmp byte [rsp + 0x25], 0
mov ecx, 0xdd47c28
jne 0x1401e63a6
mov ecx, 0xdbac3609
jmp 0x1401e63a6
mov ecx, 0x1d82b698
mov esi, dword [rsp + 0x34]
jmp 0x1401e63a6
mov rcx, qword [rsp + 0x28]
mov rdx, r15
call sub.KERNEL32.dll_Process32FirstW
mov qword [rsp + 0x40], r14
mov rdx, qword [rsp + 0x40]
mov rcx, r12
call fcn.1401e6850
mov ecx, 0xca7e8cc2
test eax, eax
je 0x1401e63a6
mov ecx, 0xd6855da9
jmp 0x1401e63a6
mov rcx, qword [rsp + 0x28]
call rbx
mov ecx, dword [0x140837bb8]
mov eax, dword [0x140837bbc]
lea edi, [rcx - 1]
imul edi, ecx
mov edx, 0x6dcbb78a
mov ecx, 0x6dcbb78a
test dil, 1
je 0x1401e63a0
mov ecx, 0xacc9f821
jmp 0x1401e63a0
mov ecx, dword [0x140837bb8]
mov eax, dword [0x140837bbc]
lea edi, [rcx - 1]
imul edi, ecx
mov edx, 0xa55ab039
mov ecx, 0xa55ab039
test dil, 1
je 0x1401e63a0
mov ecx, 0xc209d65a
jmp 0x1401e63a0
cmp ecx, 0x1d82b698
jne 0x1401e63a6
mov rax, qword [rsp + 0x38]
mov rcx, r12
call fcn.1401ce2e0
mov eax, dword [0x14083e2c0]
mov ecx, dword [0x14083e2c4]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rsp + 0x26]
mov edx, 0xc7050c31
mov eax, 0xfdb9b9d6
cmove eax, edx
cmp ecx, 0xa
setl byte [rsp + 0x27]
cmovl eax, edx
mov edx, 0xba95f0ba
mov ecx, 0xfbfc8faf
nop dword [rax]
cmp edx, 0xfbfc8fae
jg 0x1401e67f0
cmp edx, 0xba95f0ba
je 0x1401e6807
cmp edx, 0xc7050c31
jne 0x1401e67d0
jmp 0x1401e6824
cmp edx, 0xfbfc8faf
je 0x1401e6820
cmp edx, 0xfdb9b9d6
jne 0x1401e67d0
mov edx, 0xfbfc8faf
jmp 0x1401e67d0
movzx ebx, byte [rsp + 0x26]
cmp byte [rsp + 0x27], 0
mov edx, 0xfdb9b9d6
cmovne edx, ecx
test bl, bl
cmovne edx, ecx
jmp 0x1401e67d0
mov edx, eax
jmp 0x1401e67d0
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140384540
mov eax, esi
add rsp, 0x288
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret