Function at 0x1400405e0
Capabilities:
Enumerate processes

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x5a0
mov rax, qword [0x14010c1d0]
xor rax, rsp
mov qword [rsp + 0x590], rax
mov edi, r9d
mov dword [rsp + 0x30], r9d
mov r12, rdx
mov r13, rcx
mov qword [rsp + 0x90], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x230], xmm0
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x350]
call fcn.1400a5940
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c8], xmm0
xor r14d, r14d
mov qword [rsp + 0x1c8], r14
mov qword [rsp + 0x1d0], r14
lea ecx, [r14 + 0x48]
call fcn.1400a2ac0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x1c8], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1b8], xmm1
lea ecx, [r14 + 0x30]
call fcn.1400a2ac0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x1b8], rax
test r12, r12
jne 0x1400406f0
mov qword [r13], r14
mov qword [r13 + 8], r14
lea ecx, [r14 + 0x30]
call fcn.1400a2ac0
mov rdx, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x1b8]
mov qword [r13], rax
mov qword [rsp + 0x1b8], rdx
mov rcx, qword [r13 + 8]
mov rax, qword [rsp + 0x1c0]
mov qword [r13 + 8], rax
mov qword [rsp + 0x1c0], rcx
jmp 0x14004120b
mov edx, 1
call fcn.14003f1d0
test eax, eax
jne 0x140040749
mov qword [r13], r14
mov qword [r13 + 8], r14
lea ecx, [rax + 0x30]
call fcn.1400a2ac0
mov qword [rax], rax
mov qword [rax + 8], rax
mov rcx, qword [rsp + 0x1b8]
mov qword [r13], rcx
mov qword [rsp + 0x1b8], rax
mov rdx, qword [r13 + 8]
mov rcx, qword [rsp + 0x1c0]
mov qword [r13 + 8], rcx
mov qword [rsp + 0x1c0], rdx
mov rdx, rax
jmp 0x14004120b
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140040a12
lea rcx, [rsp + 0x170]
call fcn.140006d10
mov rdx, rax
lea rcx, [rsp + 0x2e0]
call fcn.14003f2b0
nop
cmp qword [rsp + 0x2f0], 0
je 0x140040a02
mov dword [rsp + 0x350], 0x238
lea rdx, [rsp + 0x350]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140040a02
mov r15, 0xffffffffffffffff
nop dword [rax]
lea rcx, [rsp + 0x2e0]
cmp qword [rsp + 0x2f8], 8
cmovae rcx, qword [rsp + 0x2e0]
lea rdx, [rsp + 0x37c]
call fcn.1400b3120
test eax, eax
jne 0x140040996
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rsp + 0x358]
cmp eax, ecx
je 0x140040996
mov dword [rsp + 0x68], ecx
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], r14w
lea rax, [rsp + 0x37c]
mov r8, r15
inc r8
cmp word [rax + r8*2], 0
jne 0x140040832
lea rdx, [rsp + 0x37c]
lea rcx, [rsp + 0x70]
call fcn.14003d860
nop
mov rdi, qword [rsp + 0x1c8]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], r14d
mov rcx, rdi
mov ebx, dword [rsp + 0x68]
cmp byte [rax + 0x19], 0
jne 0x14004089c
mov qword [rsp + 0x48], rax
cmp dword [rax + 0x20], ebx
jae 0x140040888
mov dword [rsp + 0x50], r14d
mov rax, qword [rax + 0x10]
jmp 0x140040896
mov dword [rsp + 0x50], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140040873
cmp byte [rcx + 0x19], 0
jne 0x1400408b4
cmp ebx, dword [rcx + 0x20]
jb 0x1400408b4
mov rbx, qword [rsp + 0x88]
jmp 0x140040959
movabs rax, 0x38e38e38e38e38e
cmp qword [rsp + 0x1d0], rax
je 0x140041321
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], r14
mov ecx, 0x48
call fcn.1400a2ac0
nop
mov dword [rax + 0x20], ebx
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rax + 0x28], xmm0
movups xmm1, xmmword [rsp + 0x80]
movups xmmword [rax + 0x38], xmm1
mov ebx, 7
mov qword [rsp + 0x88], rbx
mov word [rsp + 0x70], r14w
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov word [rax + 0x18], 0
mov qword [rsp + 0xc8], r14
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0xb0], xmm0
mov r8, rax
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x1c8]
call fcn.140038a30
nop
cmp rbx, 8
jb 0x140040996
lea rdx, [rbx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040991
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004131b
call fcn.1400a2ab0
lea rdx, [rsp + 0x350]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400407c0
mov edi, dword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x2f8]
cmp rdx, 8
jb 0x140040a19
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040a0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041315
jmp 0x140040a0b
mov r15, 0xffffffffffffffff
jmp 0x1400409b3
call fcn.1400a2ab0
jmp 0x140040a19
mov r15, 0xffffffffffffffff
mov r8d, edi
mov rdx, r12
lea rcx, [rsp + 0x210]
call fcn.14003f570
nop
cmp qword [rsp + 0x220], 0
je 0x14004127c
mov dword [rsp + 0x38], r14d
movsd xmm0, qword [rsp + 0x38]
movsd qword [rsp + 0xa0], xmm0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xa8], eax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x240]
call fcn.14003ede0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x290], xmm0
movups xmmword [rsp + 0x2a0], xmm0
movups xmmword [rsp + 0x2b0], xmm0
movups xmmword [rsp + 0x2c0], xmm0
movups xmmword [rsp + 0x2d0], xmm0
lea rax, [rsp + 0x120]
mov qword [rsp + 0x60], rax
movdqu xmmword [rsp + 0x120], xmm0
mov rcx, qword [rsp + 0x248]
test rcx, rcx
je 0x140040acb
lock inc dword [rcx + 8]
mov rcx, qword [rsp + 0x248]
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], rcx
movsd xmm0, qword [rsp + 0x250]
movsd qword [rsp + 0x130], xmm0
mov eax, dword [rsp + 0x258]
mov dword [rsp + 0x138], eax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x160], 0
cmp byte [rsp + 0x280], 0
je 0x140040b3f
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x140]
call fcn.140021ef0
mov byte [rsp + 0x160], 1
mov eax, dword [rsp + 0x288]
mov dword [rsp + 0x168], eax
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x290]
call fcn.14003e2a0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x300], xmm0
movups xmmword [rsp + 0x310], xmm0
movups xmmword [rsp + 0x320], xmm0
movups xmmword [rsp + 0x330], xmm0
movups xmmword [rsp + 0x340], xmm0
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x38], rax
movdqu xmmword [rsp + 0xd0], xmm0
mov rcx, qword [rsp + 0x248]
test rcx, rcx
je 0x140040bbd
lock inc dword [rcx + 8]
mov rcx, qword [rsp + 0x248]
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rcx
movsd xmm0, qword [rsp + 0x250]
movsd qword [rsp + 0xe0], xmm0
mov eax, dword [rsp + 0x258]
mov dword [rsp + 0xe8], eax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x110], 0
cmp byte [rsp + 0x280], 0
je 0x140040c31
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0xf0]
call fcn.140021ef0
mov byte [rsp + 0x110], 1
mov eax, dword [rsp + 0x288]
mov dword [rsp + 0x118], eax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x300], xmm0
mov dword [rsp + 0x310], r14d
mov byte [rsp + 0x340], 0
mov dword [rsp + 0x348], r14d
lea rcx, [rsp + 0xf0]
call fcn.140020150
mov rbx, qword [rsp + 0xd8]
test rbx, rbx
je 0x140040cb7
mov eax, r15d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140040cb7
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14003c22e.0]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140040cb7
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x14003c22e.0]
nop
lea rbx, str.Global_
movabs r12, 0x555555555555555
nop dword [rax + rax]
mov r11d, dword [rsp + 0x2a0]
mov r10, qword [rsp + 0x2d0]
cmp r11d, dword [rsp + 0x310]
jne 0x140040d83
cmp r10b, byte [rsp + 0x340]
jne 0x140040d83
test r10b, r10b
je 0x140040db8
lea rax, [rsp + 0x320]
cmp qword [rsp + 0x338], 8
cmovae rax, qword [rsp + 0x320]
lea r9, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 8
cmovae r9, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x2c0]
cmp rcx, qword [rsp + 0x330]
jne 0x140040d83
test rcx, rcx
je 0x140040db8
movzx edx, word [r9]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x140040d83
sub r9, rax
cmp dx, r8w
ja 0x140040d83
cmp rcx, 1
je 0x140040db8
dec rcx
add rax, 2
movzx edx, word [rax + r9]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x140040d65
test r10b, r10b
je 0x140041103
mov rdx, qword [rsp + 0x1c8]
mov rax, qword [rdx + 8]
mov rcx, rdx
cmp byte [rax + 0x19], 0
jne 0x140040ec8
cmp dword [rax + 0x20], r11d
jae 0x140040eb8
mov rax, qword [rax + 0x10]
jmp 0x140040ebe
lea rcx, [rsp + 0x320]
call fcn.140020150
mov rbx, qword [rsp + 0x308]
test rbx, rbx
je 0x140040e0c
mov eax, r15d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140040e0c
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14003c22e.0]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140040e0c
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x14003c22e.0]
nop
lea rcx, [rsp + 0x2b0]
call fcn.140020150
mov rbx, qword [rsp + 0x298]
test rbx, rbx
je 0x140040e60
mov eax, r15d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140040e60
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14003c22e.0]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140040e60
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x14003c22e.0]
nop
lea rcx, [rsp + 0x260]
call fcn.140020150
mov rbx, qword [rsp + 0x248]
test rbx, rbx
je 0x140040eb3
mov eax, r15d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140040eb3
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14003c22e.0]
lock xadd dword [rbx + 0xc], r15d
cmp r15d, 1
jne 0x140040eb3
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x14003c22e.0]
nop
jmp 0x14004116c
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140040da5
cmp byte [rcx + 0x19], 0
jne 0x140041103
cmp r11d, dword [rcx + 0x20]
jb 0x140041103
cmp rdx, rcx
je 0x140041103
lea rcx, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 8
cmovae rcx, qword [rsp + 0x2b0]
mov edx, 0x5c
call fcn.1400a4d80
test rax, rax
je 0x140041103
lea rsi, [rax + 2]
test rsi, rsi
je 0x140041103
lea rdx, [rsp + 0x230]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jne 0x140041103
mov rax, qword [rsp + 0x220]
lea rdx, [rax + rax]
lea rcx, [rsp + 0x210]
cmp qword [rsp + 0x228], 8
cmovae rcx, qword [rsp + 0x210]
mov r8, qword [rsp + 0x230]
call fcn.14003f770
cmp rax, qword [rsp + 0x238]
jne 0x140041103
lea rdx, str.Local_
test edi, edi
cmovne rdx, rbx
mov qword [rsp + 0x1f0], r14
mov qword [rsp + 0x200], r14
mov qword [rsp + 0x208], 7
mov word [rsp + 0x1f0], r14w
mov r8, r15
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x140040fb0
lea rcx, [rsp + 0x1f0]
call fcn.14003d860
nop
mov rdx, r15
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], 0
jne 0x140040fd0
mov rcx, qword [rsp + 0x200]
mov r8, qword [rsp + 0x208]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14004102d
lea rdi, [rcx + rdx]
mov qword [rsp + 0x200], rdi
lea rbx, [rsp + 0x1f0]
cmp r8, 8
cmovae rbx, qword [rsp + 0x1f0]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
mov rdx, rsi
call fcn.1400a5290
mov word [rbx + rdi*2], r14w
jmp 0x140041045
mov qword [rsp + 0x20], rdx
mov r9, rsi
xor r8d, r8d
lea rcx, [rsp + 0x1f0]
call fcn.14002db40
mov rdi, qword [rsp + 0x1b8]
cmp qword [rsp + 0x1c0], r12
je 0x140041327
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r14
mov ecx, 0x30
call fcn.1400a2ac0
mov rbx, rax
mov qword [rsp + 0x50], rax
lea rcx, [rax + 0x10]
lea rdx, [rsp + 0x1f0]
call fcn.140021ef0
nop
inc qword [rsp + 0x1c0]
mov rax, qword [rdi + 8]
mov qword [rbx], rdi
mov qword [rbx + 8], rax
mov qword [rsp + 0x50], r14
mov qword [rdi + 8], rbx
mov qword [rax], rbx
mov rdx, qword [rsp + 0x208]
cmp rdx, 8
jb 0x1400410f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400410f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041334
call fcn.1400a2ab0
lea rbx, str.Global_
mov edi, dword [rsp + 0x30]
mov qword [rsp + 0x1e0], r14
lea rax, [0x14010cdf0]
mov qword [rsp + 0x1e8], rax
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x290]
call fcn.14003efa0
mov rcx, qword [0x14010cdf8]
mov rax, qword [rsp + 0x1e8]
cmp qword [rax + 8], rcx
jne 0x140041152
cmp dword [rsp + 0x1e0], 0
jne 0x140041152
xor al, al
jmp 0x140041154
mov al, 1
test al, al
jne 0x14004133a
jmp 0x140040cd0
xor edx, edx
call fcn.14003f1d0
mov qword [r13], r14
mov qword [r13 + 8], r14
mov ecx, 0x30
call fcn.1400a2ac0
mov rdx, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x1b8]
mov qword [r13], rax
mov qword [rsp + 0x1b8], rdx
mov rcx, qword [r13 + 8]
mov rax, qword [rsp + 0x1c0]
mov qword [r13 + 8], rax
mov qword [rsp + 0x1c0], rcx
mov rax, qword [rsp + 0x228]
cmp rax, 8
jb 0x14004120b
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400411fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004130f
call fcn.1400a2ab0
mov rdx, qword [rsp + 0x1b8]
call fcn.14002e2a0
mov edx, 0x30
mov rcx, qword [rsp + 0x1b8]
call fcn.1400a2ab0
nop
mov r8, qword [rsp + 0x1c8]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0x1c8]
call fcn.140044700
mov edx, 0x48
mov rcx, qword [rsp + 0x1c8]
call fcn.1400a2ab0
mov rax, r13
mov rcx, qword [rsp + 0x590]
xor rcx, rsp
call fcn.1400a2a50
add rsp, 0x5a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [r13], r14
mov qword [r13 + 8], r14
mov ecx, 0x30
call fcn.1400a2ac0
mov rdx, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x1b8]
mov qword [r13], rax
mov qword [rsp + 0x1b8], rdx
mov rcx, qword [r13 + 8]
mov rax, qword [rsp + 0x1c0]
mov qword [r13 + 8], rax
mov qword [rsp + 0x1c0], rcx
mov rax, qword [rsp + 0x228]
cmp rax, 8
jb 0x14004120b
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400411fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400411fe
call fcn.1400a99c0
int3
call fcn.1400a99c0
nop
call fcn.1400a99c0
nop
call fcn.140001a20
nop
lea rcx, str.list_too_long
call fcn.1400463b0
nop
call fcn.1400a99c0
int3
movaps xmm0, xmmword [rsp + 0x1e0]
movdqa xmmword [rsp + 0xb0], xmm0
lea r8, str.handles_iterator::increment_failed
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x190]
call fcn.140003dd0
lea rdx, [0x140108cc0]
lea rcx, [rsp + 0x190]
call fcn.1400a51c0
int3