Function at 0x14000b2d9
Capabilities:
Enumerate processes

Disassembly:
test r8, r8
je 0x14000b6e8
mov r11, rsp
push rbx
push rbp
sub rsp, 0x328
mov rax, qword [0x140030f90]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov qword [r11 - 0x20], rdi
mov edi, dword [r8 + 0x14]
mov dword [rsp + 0x40], r9d
mov rbx, r8
mov rbp, rdx
mov qword [rsp + 0x48], rcx
test edi, edi
je 0x14000b6c7
mov eax, dword [r8 + 0x10]
or r8, 0xffffffffffffffff
lea r9, [0x1400272a8]
lea rcx, [r11 - 0x98]
lea edx, [r8 + 0x11]
mov qword [r11 - 0x18], rsi
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x20], edi
call fcn.140018170
mov r11d, dword [rbx + 0x18]
or r8, 0xffffffffffffffff
lea r9, [0x1400272a8]
lea edx, [r8 + 0x11]
lea rcx, [rsp + 0x2c0]
mov dword [rsp + 0x20], r11d
call fcn.140018170
lea rax, [0x14000b1b0]
mov ecx, 4
cmp rbp, rax
jne 0x14000b3a6
mov r8, qword [rbx]
lea rax, [rsp + 0x2c0]
lea r9, [rsp + 0x2a0]
mov edx, 0x400003ff
movzx ecx, cx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.1400025f0
mov r8d, edi
xor edx, edx
mov ecx, 0x100411
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14000b4f0
mov eax, dword [rsp + 0x40]
or r8, 0xffffffffffffffff
lea r9, [0x1400272a8]
lea edx, [r8 + 0x11]
lea rcx, [rsp + 0x2e0]
mov dword [rsp + 0x20], eax
call fcn.140018170
lea rax, [0x14000b1b0]
cmp rbp, rax
jne 0x14000b425
mov rax, qword [rbx]
mov qword [rsp + 0x28], 0
lea r9, [rsp + 0x2e0]
mov qword [rsp + 0x20], rax
mov eax, 4
lea r8, [rsp + 0x2a0]
movzx ecx, ax
mov edx, 0x40000403
call fcn.1400025f0
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
mov qword [rbx + 8], rsi
call rbp
test eax, eax
jne 0x14000b4e5
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000b45b
cmp dword [rsp + 0x50], 0x103
jne 0x14000b4e5
test byte [rbx + 0x1c], 8
je 0x14000b4a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002430
mov r9, qword [rbx]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov eax, 1
lea r8, [rsp + 0x2a0]
movzx ecx, ax
mov edx, 0xc0000404
call fcn.1400025f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000b528
mov r8, qword [rbx]
lea rax, str.AppStopMethodSkip
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
lea rax, str.NSSM
lea r9, [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
mov eax, 2
mov edx, 0x8000041d
movzx ecx, ax
call fcn.1400025f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000b528
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002430
mov r9, qword [rbx]
mov ecx, 1
lea r8, [rsp + 0x2a0]
movzx ecx, cx
mov edx, 0xc0000402
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.1400025f0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000b56e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002430
mov r8, qword [rbx]
mov edx, 0xc0000400
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], 0
movzx ecx, ax
call fcn.1400025f0
jmp 0x14000b6bf
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x238
call fcn.140018830
lea rdx, [rsp + 0x60]
mov rcx, rsi
mov dword [rsp + 0x60], 0x238
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x14000b5d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002430
mov r8, qword [rbx]
mov edx, 0xc0000401
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], 0
movzx ecx, ax
call fcn.1400025f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000b6bf
inc dword [rbx + 0x10]
lea rdx, [rsp + 0x60]
mov r8d, edi
mov rcx, rbx
call fcn.14000ab10
test eax, eax
jne 0x14000b608
mov eax, dword [rsp + 0x68]
mov r9d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov r8, rbx
mov rdx, rbp
mov dword [rbx + 0x14], eax
call fcn.14000b2d0
lea rdx, [rsp + 0x60]
mov rcx, rsi
mov dword [rbx + 0x14], edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x14000b664
nop dword [rax]
lea rdx, [rsp + 0x60]
mov r8d, edi
mov rcx, rbx
call fcn.14000ab10
test eax, eax
jne 0x14000b650
mov eax, dword [rsp + 0x68]
mov r9d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov r8, rbx
mov rdx, rbp
mov dword [rbx + 0x14], eax
call fcn.14000b2d0
lea rdx, [rsp + 0x60]
mov rcx, rsi
mov dword [rbx + 0x14], edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000b620
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x14000b681
mov eax, dword [rsp + 0x44]
mov rcx, rsi
mov dword [rbx + 0x10], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000b6bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002430
mov r8, qword [rbx]
mov edx, 0xc0000401
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], 0
movzx ecx, ax
call fcn.1400025f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x44]
mov dword [rbx + 0x10], eax
mov rsi, qword [rsp + 0x320]
mov rdi, qword [rsp + 0x318]
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.140018800
add rsp, 0x328
pop rbp
pop rbx
repz ret