Function at 0x1400463c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
xor edi, edi
mov ebx, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rsp + 0x50], 0x130
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400464c8
nop dword [rax]
lea rdx, str.HD_Player.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
je 0x1400464a4
lea rdx, str.LdVBoxHeadless.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
je 0x1400464a4
lea rdx, str.MEmuHeadless.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
je 0x1400464a4
lea rdx, str.AndroidProcess.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
je 0x1400464a4
lea rdx, str.AndroidEmulatorEx
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
je 0x1400464a4
lea rdx, str.aow_exe.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x1400464b2
mov eax, dword [rsp + 0x6c]
cmp eax, ebx
jbe 0x1400464b2
mov edi, dword [rsp + 0x58]
mov ebx, eax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140046420
mov dword [0x1401b3b48], edi
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x220
mov eax, dword [rcx + rdi]
mov ebx, 0x7b8
add rbx, rdi
test al, 1
jne 0x140046518
or eax, 1
mov dword [rcx + rdi], eax
mov word [rbx + 9], 0x1c1
mov dword [rbx], 0x5717b54b
mov dword [rbx + 4], 0x673bdb47
mov byte [rbx + 8], 0x49
lea rcx, [0x1400efbf0]
call fcn.1400e854c
nop
cmp byte [rbx + 0xa], 0
je 0x140046539
mov edx, 0xa
movabs r8, 0xb5ff52b3b73c125
mov rcx, rbx
call fcn.140045e60
mov byte [rbx + 0xa], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x1400466cd
movdqa xmm0, xmmword [0x1401125d0]
mov dword [rsp + 0x48], 0xd045b82a
mov ecx, 0x90c
mov eax, dword [rcx + rdi]
mov ebx, 0xad8
test al, 1
jne 0x1400465c0
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rdi + rbx]
mov byte [rcx + 0x15], 1
lea rax, [rcx + 0x14]
lea rdx, [rsp + 0x4c]
cmp rcx, rdx
ja 0x1400465a5
lea rdx, [rsp + 0x38]
cmp rax, rdx
jb 0x1400465a5
movups xmmword [rcx], xmm0
mov eax, dword [rsp + 0x48]
mov dword [rcx + 0x10], eax
mov byte [rcx + 0x14], reloc.WLDAP32.dll_Ordinal_211
jmp 0x1400465b3
movups xmmword [rcx], xmm0
mov eax, dword [rsp + 0x48]
mov dword [rcx + 0x10], eax
mov byte [rcx + 0x14], reloc.WLDAP32.dll_Ordinal_211
lea rcx, [0x1400efbd0]
call fcn.1400e854c
nop
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
lea r11, [rdi + rbx]
mov rcx, r11
call fcn.140072ed0
mov rdx, r11
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401b3b68], rax
movdqa xmm0, xmmword [0x1401122e0]
mov dword [rsp + 0x30], 0xd53e2f56
mov ecx, 0x18a4
mov eax, dword [rcx + rdi]
mov ebx, 0xd48
test al, 1
jne 0x140046655
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rdi + rbx]
mov byte [rcx + 0x14], 1
lea rax, [rcx + 0x13]
lea rdx, [rsp + 0x33]
cmp rcx, rdx
ja 0x14004663e
lea rdx, [rsp + 0x20]
cmp rax, rdx
jb 0x14004663e
movups xmmword [rcx], xmm0
mov eax, dword [rsp + 0x30]
mov dword [rcx + 0x10], eax
jmp 0x140046648
movups xmmword [rcx], xmm0
mov eax, dword [rsp + 0x30]
mov dword [rcx + 0x10], eax
lea rcx, [0x1400efbb0]
call fcn.1400e854c
nop
lea r11, [rbx + rdi]
mov rcx, r11
call fcn.140072d50
mov rdx, r11
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401b3b60], rax
mov rcx, qword [0x1401b3b68]
test rcx, rcx
je 0x1400466cd
test rax, rax
je 0x1400466cd
movzx ecx, byte [rcx]
cmp cl, 0xe9
je 0x1400466cd
cmp cl, 0x90
je 0x1400466cd
cmp cl, 0xc3
je 0x1400466cd
movzx eax, byte [rax]
cmp al, 0xe9
je 0x1400466cd
cmp al, 0x90
je 0x1400466cd
cmp al, 0xc3
je 0x1400466cd
mov r8d, dword [0x1401b3b48]
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1401b3b50], rax
dec rax
cmp rax, 0xfffffffffffffffd
setbe al
jmp 0x1400466cf
xor al, al
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret