Function at 0x140377280
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2b8
mov r13, rcx
mov rax, qword [0x140b74de8]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rdi, [rsp + 0x78]
mov qword [rsp + 0x70], rdi
mov rax, qword [rsp + 0x70]
mov eax, 0x1d7da1f4
mov r12d, 0xe0b0820
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1403772fd
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x6c], eax
mov eax, dword [0x140b7e190]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x37caff69
mov ecx, 0x68578c34
nop
cmove eax, ecx
cmp dword [0x140b7e194], 0xa
cmovl eax, ecx
cmp eax, 0x1d7da1f3
jg 0x140377360
cmp eax, 0xfee3bb32
jg 0x1403773c0
cmp eax, 0x9e085a1b
jle 0x14037744a
cmp eax, 0xdd6c457d
jle 0x140377519
cmp eax, 0xdd6c457e
je 0x14037778c
cmp eax, 0xf8867787
je 0x1403777aa
cmp eax, 0xfb40f992
jne 0x1403772fd
mov rcx, qword [rsp + 0x40]
call r15
mov eax, 0x521cecc
jmp 0x1403772fd
cmp eax, 0x459b32fb
jg 0x140377410
cmp eax, 0x37caff68
jle 0x140377489
cmp eax, 0x3ed15e43
jle 0x14037754d
cmp eax, 0x3ed15e44
je 0x1403772cb
cmp eax, 0x4286f33a
je 0x140377860
cmp eax, 0x43f10ef6
jne 0x1403772fd
mov eax, 0x710bfbd2
mov r14d, dword [rsp + 0x6c]
jmp 0x1403772fd
cmp eax, 0xc7a4d77
jle 0x1403774b4
cmp eax, 0xe0b081f
jle 0x14037756d
cmp eax, 0xe0b0820
je 0x140377888
cmp eax, 0x162a3410
je 0x1403778a3
cmp eax, 0x19fae900
jne 0x1403772fd
mov rcx, qword [rsp + 0x40]
call r15
mov eax, 0x8a5e7e74
jmp 0x1403772fd
cmp eax, 0x68578c33
jle 0x1403774f3
cmp eax, 0x710bfbd1
jle 0x140377596
cmp eax, 0x7892bae0
je 0x1403778b7
cmp eax, 0x7c5f7c3c
jne 0x140377b6a
mov eax, dword [rsp + 0x54]
mov eax, 0x4286f33a
jmp 0x1403772fd
cmp eax, 0x8a5e7e73
jg 0x1403775b6
cmp eax, 0x811d20ac
je 0x1403778df
cmp eax, 0x81e04248
jne 0x1403772fd
mov eax, dword [0x140b7e190]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6b8e1ba6
mov ecx, 0x20083d2f
jmp 0x1403772f0
cmp eax, 0x20083d2e
jg 0x1403775d9
cmp eax, 0x1d7da1f4
je 0x1403778ed
cmp eax, 0x1fcddb25
jne 0x1403772fd
mov eax, 0x162a3410
jmp 0x1403772fd
cmp eax, 0x521cecb
jg 0x14037769f
cmp eax, 0xfee3bb33
je 0x14037791e
cmp eax, 0x2db38a9
jne 0x1403772fd
mov eax, dword [0x140b7e190]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x811d20ac
mov ecx, 0x7892bae0
jmp 0x1403772f0
cmp eax, 0x4e755253
jg 0x14037775f
cmp eax, 0x459b32fc
je 0x140377935
cmp eax, 0x4a029291
je 0x1403775cc
jmp 0x1403772fd
cmp eax, 0x9e085a1c
je 0x140377944
cmp eax, 0xaa9e10d0
jne 0x1403772fd
mov eax, dword [0x140b7e190]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x218edb0c
mov ecx, 0x69908c1
jmp 0x1403772f0
cmp eax, 0x37caff69
je 0x140377957
cmp eax, 0x3c45bafb
jne 0x1403772fd
mov eax, 0xfee3bb33
jmp 0x1403772fd
cmp eax, 0xc7a4d78
je 0x140377961
cmp eax, 0xce518a9
jne 0x1403772fd
cmp byte [rsp + 0x2f], 0
mov eax, 0x19fae900
cmovne eax, r12d
jmp 0x1403772fd
cmp eax, 0x68578c34
je 0x140377973
cmp eax, 0x6b8e1ba6
jne 0x1403772fd
mov eax, 0x20083d2f
jmp 0x1403772fd
cmp eax, 0x8a5e7e74
je 0x14037797d
cmp eax, 0x90247091
jne 0x1403772fd
mov eax, 0x710bfbd2
xor r14d, r14d
jmp 0x1403772fd
cmp eax, 0x20083d2f
je 0x14037799b
cmp eax, 0x218edb0c
jne 0x1403772fd
mov rbx, qword [rsp + 0x58]
mov eax, dword [0x140b854c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x140b854cc], 0xa
setl cl
or cl, al
mov ebp, 0xd3eaafc8
mov eax, 0x77672a47
cmovne ebp, eax
mov esi, 0xd3eaafc8
mov eax, 0xc26cf7b5
cmovne esi, eax
mov ecx, 0x2691b3ce
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp ecx, 0xfced66aa
jle 0x140377680
cmp ecx, 0xfced66ab
je 0x140377697
cmp ecx, 0x77672a47
je 0x1403779b9
cmp ecx, 0x2691b3ce
jne 0x140377640
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov ecx, 0xfced66ab
jmp 0x140377640
cmp ecx, 0xc26cf7b5
je 0x14037769b
cmp ecx, 0xd3eaafc8
jne 0x140377640
mov ecx, 0xc26cf7b5
jmp 0x140377640
mov ecx, esi
jmp 0x140377640
mov ecx, ebp
jmp 0x140377640
cmp eax, 0x521cecc
je 0x140377a04
cmp eax, 0x69908c1
jne 0x1403772fd
mov rbx, qword [rsp + 0x58]
mov eax, dword [0x140b854c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x140b854cc], 0xa
setl cl
or cl, al
mov ebp, 0xd3eaafc8
mov eax, 0x77672a47
cmovne ebp, eax
mov esi, 0xd3eaafc8
mov eax, 0xc26cf7b5
cmovne esi, eax
mov ecx, 0x2691b3ce
nop word [rax + rax]
cmp ecx, 0xfced66aa
jle 0x140377740
cmp ecx, 0xfced66ab
je 0x140377757
cmp ecx, 0x77672a47
je 0x140377a19
cmp ecx, 0x2691b3ce
jne 0x140377700
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov ecx, 0xfced66ab
jmp 0x140377700
cmp ecx, 0xc26cf7b5
je 0x14037775b
cmp ecx, 0xd3eaafc8
jne 0x140377700
mov ecx, 0xc26cf7b5
jmp 0x140377700
mov ecx, esi
jmp 0x140377700
mov ecx, ebp
jmp 0x140377700
cmp eax, 0x4e755254
je 0x140377a64
cmp eax, 0x56969a12
jne 0x1403772fd
mov rcx, qword [rsp + 0x40]
mov rdx, rdi
call sub.KERNEL32.dll_Process32FirstW
mov eax, 0xf8867787
jmp 0x1403772fd
mov eax, dword [0x140b7e190]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7c5f7c3c
mov ecx, 0x4286f33a
jmp 0x1403772f0
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x58]
mov eax, dword [0x140b854c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x140b854cc], 0xa
setl cl
or cl, al
mov r12d, 0xd3eaafc8
mov eax, 0x77672a47
cmovne r12d, eax
mov ebp, 0xd3eaafc8
mov eax, 0xc26cf7b5
cmovne ebp, eax
mov ecx, 0x2691b3ce
nop dword [rax + rax]
cmp ecx, 0xfced66aa
jle 0x140377840
cmp ecx, 0xfced66ab
je 0x140377857
cmp ecx, 0x77672a47
je 0x140377a7b
cmp ecx, 0x2691b3ce
jne 0x140377800
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov ecx, 0xfced66ab
jmp 0x140377800
cmp ecx, 0xc26cf7b5
je 0x14037785b
cmp ecx, 0xd3eaafc8
jne 0x140377800
mov ecx, 0xc26cf7b5
jmp 0x140377800
mov ecx, ebp
jmp 0x140377800
mov ecx, r12d
jmp 0x140377800
cmp dword [rsp + 0x54], 0
setne byte [rsp + 0x2e]
mov eax, dword [0x140b7e190]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7c5f7c3c
mov ecx, 0x3c45bafb
jmp 0x1403772f0
mov rcx, qword [rsp + 0x40]
mov rdx, rdi
call sub.KERNEL32.dll_Process32NextW
mov dword [rsp + 0x54], eax
mov eax, 0xdd6c457e
jmp 0x1403772fd
cmp dword [rsp + 0x68], 0
setne byte [rsp + 0x2f]
mov eax, 0xce518a9
jmp 0x1403772fd
cmp dword [rsp + 0x50], 0
setne byte [rsp + 0x2d]
mov eax, dword [0x140b7e190]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x811d20ac
mov ecx, 0x9e085a1c
jmp 0x1403772f0
mov eax, dword [rsp + 0x50]
mov eax, 0x7892bae0
jmp 0x1403772fd
mov dword [rsp + 0x78], 0x238
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0xffffffffffffffff
sete byte [rsp + 0x2c]
mov eax, 0x4e755254
jmp 0x1403772fd
cmp byte [rsp + 0x2e], 0
mov eax, 0xc7a4d78
mov ecx, 0xaa9e10d0
cmovne eax, ecx
jmp 0x1403772fd
mov eax, 0x710bfbd2
mov r14d, dword [rsp + 0x64]
jmp 0x1403772fd
cmp byte [rsp + 0x2d], 0
mov eax, 0xfb40f992
cmovne eax, r12d
jmp 0x1403772fd
mov eax, 0x3ed15e44
jmp 0x1403772fd
mov rcx, qword [rsp + 0x40]
call r15
mov eax, 0x4a029291
jmp 0x1403772fd
mov eax, 0x43f10ef6
jmp 0x1403772fd
mov eax, dword [0x140b7e190]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x37caff69
mov ecx, 0x3ed15e44
jmp 0x1403772f0
mov eax, dword [0x140b7e190]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6b8e1ba6
mov ecx, 0x90247091
jmp 0x1403772f0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], r13
mov ecx, 0xa07a2620
nop word cs:[rax + rax]
nop dword [rax]
cmp ecx, 0x7f2f6ec8
je 0x140377ac4
cmp ecx, 0xa07a2620
jne 0x1403779e0
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x10]
mov ecx, 0x7f2f6ec8
jmp 0x1403779e0
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x64], eax
mov eax, 0x459b32fc
jmp 0x1403772fd
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], r13
mov ecx, 0xa07a2620
nop word cs:[rax + rax]
nop dword [rax]
cmp ecx, 0x7f2f6ec8
je 0x140377af2
cmp ecx, 0xa07a2620
jne 0x140377a40
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x10]
mov ecx, 0x7f2f6ec8
jmp 0x140377a40
cmp byte [rsp + 0x2c], 0
mov eax, 0x56969a12
mov ecx, 0x81e04248
cmovne eax, ecx
jmp 0x1403772fd
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], r13
mov ecx, 0xa07a2620
mov r12d, 0xe0b0820
nop word [rax + rax]
cmp ecx, 0x7f2f6ec8
je 0x140377b38
cmp ecx, 0xa07a2620
jne 0x140377aa0
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x10]
mov ecx, 0x7f2f6ec8
jmp 0x140377aa0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
call fcn.140294ca0
mov r9, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
mov r8, rbx
call fcn.140294560
mov eax, 0x69908c1
jmp 0x1403772fd
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
call fcn.140294ca0
mov r9, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
mov r8, rbx
call fcn.140294560
mov dword [rsp + 0x68], eax
mov eax, dword [0x140b7e190]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x218edb0c
mov ecx, 0x1fcddb25
jmp 0x1403772f0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
call fcn.140294ca0
mov r9, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
mov r8, rbx
call fcn.140294560
mov dword [rsp + 0x50], eax
mov eax, 0x2db38a9
jmp 0x1403772fd
cmp eax, 0x710bfbd2
jne 0x1403772fd
mov rax, qword [rsp + 0x70]
mov eax, 0x787f037
mov ebx, 0xe7af244d
mov ebp, 0x26afba6c
nop dword [rax]
cmp eax, 0x787f036
jle 0x140377bc0
cmp eax, 0x26afba6c
je 0x140377bd0
cmp eax, 0x1ff43060
je 0x140377bfb
cmp eax, 0x787f037
jne 0x140377b90
mov rcx, r13
call fcn.14028f210
mov eax, 0x1ff43060
jmp 0x140377b90
cmp eax, 0xd0c5909b
je 0x140377c21
cmp eax, 0xe7af244d
jne 0x140377b90
jmp 0x140377c33
mov rcx, r13
call fcn.1403244e0
mov eax, dword [0x140b7e198]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd0c5909b
cmove eax, ebx
cmp dword [0x140b7e19c], 0xa
cmovl eax, ebx
jmp 0x140377b90
mov eax, dword [0x140b7e198]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd0c5909b
cmove eax, ebp
cmp dword [0x140b7e19c], 0xa
cmovl eax, ebp
jmp 0x140377b90
mov rcx, r13
call fcn.1403244e0
mov eax, 0x26afba6c
jmp 0x140377b90
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1406ad9c0
mov eax, r14d
add rsp, 0x2b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret