Function at 0x4103ac10
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x2d0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rsi, rcx
test rcx, rcx
jne 0x4103ac55
xor eax, eax
jmp 0x4103af72
mov edx, 7
mov qword [rsp + 0x48], rdx
xor ebp, ebp
mov r8, rbp
mov qword [rsp + 0x40], rbp
mov word [rsp + 0x30], bp
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
movabs r13, 0x7ffffffffffffffe
cmp rcx, r13
jbe 0x4103aca5
call fcn.4120fbc0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
cmp rdx, rbx
jae 0x4103acbe
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.41022ab0
mov rdx, qword [rsp + 0x48]
jmp 0x4103acdc
test rbx, rbx
jne 0x4103acdc
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x30]
cmp rdx, 8
cmovae rax, qword [rsp + 0x30]
mov word [rax], bp
jmp 0x4103ad1c
test rbx, rbx
je 0x4103ad1c
lea rcx, [rsp + 0x30]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x30]
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
mov r8, rsi
call fcn.412118b0
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rdi + rax], bp
lea rcx, [rsp + 0x28]
call fcn.410391d0
mov dword [rsp + 0x80], ebp
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x84]
call fcn.412121c0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x4103ad6e
cmp qword [rsp + 0x48], 8
jb 0x4103ad67
mov rcx, qword [rsp + 0x30]
call fcn.41210d60
xor eax, eax
jmp 0x4103af72
mov dword [rsp + 0x80], 0x238
lea rdx, [rsp + 0x80]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4103af54
mov edx, 7
mov qword [rsp + 0x70], rdx
mov r8, rbp
mov qword [rsp + 0x68], rbp
mov word [rsp + 0x58], r8w
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xac]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
cmp rcx, r13
jbe 0x4103add7
call fcn.4120fbc0
mov rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
cmp rdx, rbx
jae 0x4103adf0
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.41022ab0
mov rdx, qword [rsp + 0x70]
jmp 0x4103ae0e
test rbx, rbx
jne 0x4103ae0e
mov qword [rsp + 0x68], rbp
lea rax, [rsp + 0x58]
cmp rdx, 8
cmovae rax, qword [rsp + 0x58]
mov word [rax], bx
jmp 0x4103ae55
test rbx, rbx
je 0x4103ae55
lea rcx, [rsp + 0x58]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x58]
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0xac]
call fcn.412118b0
mov qword [rsp + 0x68], rbx
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rax, qword [rsp + 0x58]
mov word [rdi + rax], 0
lea rcx, [rsp + 0x50]
call fcn.410391d0
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x58]
mov r11, qword [rsp + 0x58]
mov r10, qword [rsp + 0x70]
cmp r10, 8
cmovae rcx, r11
mov r8, qword [rsp + 0x40]
mov rdi, r8
mov r9, qword [rsp + 0x68]
cmp r9, r8
cmovb rdi, r9
test rdi, rdi
je 0x4103aec6
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x4103aeb8
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x4103aea0
jmp 0x4103aec6
mov edi, 1
cmp word [rcx], ax
cmovb edi, r12d
jmp 0x4103aec8
mov edi, ebp
movsxd rax, edi
test edi, edi
jne 0x4103aedc
cmp r9, r8
jb 0x4103aee0
mov eax, ebp
cmp r9, r8
setne al
test eax, eax
je 0x4103af07
cmp r10, 8
jb 0x4103aeee
mov rcx, r11
call fcn.41210d60
lea rdx, [rsp + 0x80]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x4103af54
jmp 0x4103ad91
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x88]
cmp qword [rsp + 0x70], 8
jb 0x4103af29
mov rcx, qword [rsp + 0x58]
call fcn.41210d60
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rbp
mov word [rsp + 0x58], 0
cmp qword [rsp + 0x48], 8
jb 0x4103af50
mov rcx, qword [rsp + 0x30]
call fcn.41210d60
mov eax, edi
jmp 0x4103af72
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x48], 8
jb 0x4103af70
mov rcx, qword [rsp + 0x30]
call fcn.41210d60
xor eax, eax
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.41211b80
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret