Function at 0x140001000
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov rax, qword [0x1400d7840]
xor rax, rbp
mov qword [rbp + 0x18], rax
mov ecx, dword [0x1400dac60]
mov eax, dword [0x1400dac5c]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [rbp - 0x52], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [rbp - 0x51], al
mov dword [rbp - 0x58], 0x39ec06bc
mov eax, dword [rbp - 0x58]
mov dword [rbp - 0x5c], eax
sub eax, 0x9001397b
je 0x1400019eb
jmp 0x140001070
mov eax, dword [rbp - 0x5c]
sub eax, 0x909ff75c
je 0x14000161e
jmp 0x140001083
mov eax, dword [rbp - 0x5c]
sub eax, 0x9212b519
je 0x14000184d
jmp 0x140001096
mov eax, dword [rbp - 0x5c]
sub eax, 0x93b8cb30
je 0x140001532
jmp 0x1400010a9
mov eax, dword [rbp - 0x5c]
sub eax, 0x993e716a
je 0x1400015df
jmp 0x1400010bc
mov eax, dword [rbp - 0x5c]
sub eax, 0x9e6fdcb9
je 0x140001739
jmp 0x1400010cf
mov eax, dword [rbp - 0x5c]
sub eax, 0xb9f99110
je 0x14000198a
jmp 0x1400010e2
mov eax, dword [rbp - 0x5c]
sub eax, 0xbe2122f3
je 0x140001584
jmp 0x1400010f5
mov eax, dword [rbp - 0x5c]
sub eax, 0xbf423022
je 0x1400016ee
jmp 0x140001108
mov eax, dword [rbp - 0x5c]
sub eax, 0xc499c099
je 0x14000195f
jmp 0x14000111b
mov eax, dword [rbp - 0x5c]
sub eax, 0xcf3eb229
je 0x1400016fa
jmp 0x14000112e
mov eax, dword [rbp - 0x5c]
sub eax, 0xd43f5909
je 0x14000189c
jmp 0x140001141
mov eax, dword [rbp - 0x5c]
sub eax, 0xdd75b016
je 0x140001603
jmp 0x140001154
mov eax, dword [rbp - 0x5c]
sub eax, 0xe5c8ede8
je 0x140001711
jmp 0x140001167
mov eax, dword [rbp - 0x5c]
sub eax, 0xe74f96fa
je 0x14000143b
jmp 0x14000117a
mov eax, dword [rbp - 0x5c]
sub eax, 0xe80ffcc6
je 0x14000194a
jmp 0x14000118d
mov eax, dword [rbp - 0x5c]
sub eax, 0xf245029e
je 0x140001366
jmp 0x1400011a0
mov eax, dword [rbp - 0x5c]
sub eax, 0xf48edf32
je 0x1400017fa
jmp 0x1400011b3
mov eax, dword [rbp - 0x5c]
sub eax, 0xfc3001a5
je 0x140001a29
jmp 0x1400011c6
mov eax, dword [rbp - 0x5c]
sub eax, 0xbd3209c
je 0x140001859
jmp 0x1400011d9
mov eax, dword [rbp - 0x5c]
sub eax, 0xd5f3b37
je 0x140001559
jmp 0x1400011ec
mov eax, dword [rbp - 0x5c]
sub eax, 0x10734b73
je 0x14000166d
jmp 0x1400011ff
mov eax, dword [rbp - 0x5c]
sub eax, 0x1bb7832a
je 0x140001870
jmp 0x140001212
mov eax, dword [rbp - 0x5c]
sub eax, 0x25c901ab
je 0x140001779
jmp 0x140001225
mov eax, dword [rbp - 0x5c]
sub eax, 0x3650f743
je 0x14000153e
jmp 0x140001238
mov eax, dword [rbp - 0x5c]
sub eax, 0x39ec06bc
je 0x14000130e
jmp 0x14000124b
mov eax, dword [rbp - 0x5c]
sub eax, 0x3fa06ea8
je 0x1400015b2
jmp 0x14000125e
mov eax, dword [rbp - 0x5c]
sub eax, 0x4378e13b
je 0x140001745
jmp 0x140001271
mov eax, dword [rbp - 0x5c]
sub eax, 0x5c40f817
je 0x1400015be
jmp 0x140001284
mov eax, dword [rbp - 0x5c]
sub eax, 0x5f58efc4
je 0x1400018b7
jmp 0x140001297
mov eax, dword [rbp - 0x5c]
sub eax, 0x6474bafe
je 0x14000175a
jmp 0x1400012aa
mov eax, dword [rbp - 0x5c]
sub eax, 0x6b6ccd9c
je 0x14000193e
jmp 0x1400012bd
mov eax, dword [rbp - 0x5c]
sub eax, 0x6e8133c1
je 0x140001929
jmp 0x1400012d0
mov eax, dword [rbp - 0x5c]
sub eax, 0x71ca00a2
je 0x1400013e0
jmp 0x1400012e3
mov eax, dword [rbp - 0x5c]
sub eax, 0x71caeafe
je 0x1400013ec
jmp 0x1400012f6
mov eax, dword [rbp - 0x5c]
sub eax, 0x79c0301e
je 0x14000197e
jmp 0x140001309
jmp 0x140001a39
mov r11b, byte [rbp - 0x52]
mov r10b, byte [rbp - 0x51]
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x79c0301e
mov ecx, 0xf245029e
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x140001a39
mov eax, 0x10
mov qword [rbp - 0x68], rax
call fcn.1400a2340
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov rcx, rsp
mov qword [rbp - 0x50], rcx
call fcn.1400a2340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x48], rax
mov eax, dword [0x1400dac60]
mov ecx, dword [0x1400dac5c]
mov edx, eax
add edx, 0xdd752cad
sub edx, 1
sub edx, 0xdd752cad
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x79c0301e
mov ecx, 0x71ca00a2
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x140001a39
mov dword [rbp - 0x58], 0x71caeafe
jmp 0x140001a39
mov eax, dword [0x1400dac60]
mov ecx, dword [0x1400dac5c]
mov edx, eax
sub edx, 0x9434f81e
sub edx, 1
add edx, 0x9434f81e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb9f99110
mov ecx, 0xe74f96fa
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x140001a39
mov eax, 0x130
call fcn.1400a2340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
mov eax, 0x10
mov qword [rbp - 0x70], rax
call fcn.1400a2340
sub rsp, rax
mov rax, qword [rbp - 0x70]
call fcn.1400a2340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov dword [rax], 0
mov ecx, 2
xor edx, edx
sub rsp, 0x20
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x48]
mov qword [rax], rcx
mov rax, qword [rbp - 0x48]
mov rcx, 0xffffffffffffffff
cmp qword [rax], rcx
sete al
and al, 1
mov byte [rbp - 0x29], al
mov ecx, dword [0x1400dac60]
mov eax, dword [0x1400dac5c]
mov edx, ecx
add edx, 0x5b1e9a8c
sub edx, 1
sub edx, 0x5b1e9a8c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb9f99110
mov ecx, 0x93b8cb30
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x140001a39
mov dword [rbp - 0x58], 0x3650f743
jmp 0x140001a39
mov dl, byte [rbp - 0x29]
mov eax, 0x5c40f817
mov ecx, 0xd5f3b37
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x140001a39
lea rcx, [0x1400d8c30]
lea rdx, str.Error:_Unable_to_create_toolhelp_snapshot.
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x58], 0xbe2122f3
jmp 0x140001a39
mov rcx, qword [rbp - 0x28]
lea rdx, [0x140007920]
sub rsp, 0x20
call fcn.1400074a0
add rsp, 0x20
mov rax, qword [rbp - 0x50]
mov dword [rax], 1
mov dword [rbp - 0x58], 0x3fa06ea8
jmp 0x140001a39
mov dword [rbp - 0x58], 0xe80ffcc6
jmp 0x140001a39
mov rax, qword [rbp - 0x40]
mov dword [rax], 0x130
mov rax, qword [rbp - 0x48]
mov rax, qword [rax]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x58], 0x993e716a
jmp 0x140001a39
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32First
add rsp, 0x20
mov dword [rbp - 0x14], eax
mov dword [rbp - 0x58], 0xdd75b016
jmp 0x140001a39
mov edx, dword [rbp - 0x14]
mov eax, 0x909ff75c
mov ecx, 0x9e6fdcb9
cmp edx, 0
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x140001a39
mov eax, dword [0x1400dac60]
mov ecx, dword [0x1400dac5c]
mov edx, eax
add edx, 0x6f4a91d9
sub edx, 1
sub edx, 0x6f4a91d9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9001397b
mov ecx, 0x10734b73
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x140001a39
lea rcx, [0x1400d8c30]
lea rdx, str.Error:_Unable_to_retrieve_information_about_the_first_process.
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
mov rcx, rax
lea rdx, [0x140007920]
sub rsp, 0x20
call fcn.1400074a0
add rsp, 0x20
mov eax, dword [0x1400dac60]
mov ecx, dword [0x1400dac5c]
mov edx, eax
add edx, 0xc2c1ae66
sub edx, 1
sub edx, 0xc2c1ae66
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9001397b
mov ecx, 0xbf423022
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x140001a39
mov dword [rbp - 0x58], 0xcf3eb229
jmp 0x140001a39
mov rax, qword [rbp - 0x48]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x58], 0xe5c8ede8
jmp 0x140001a39
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov rax, qword [rbp - 0x50]
mov dword [rax], 1
mov dword [rbp - 0x58], 0xe80ffcc6
jmp 0x140001a39
mov dword [rbp - 0x58], 0x4378e13b
jmp 0x140001a39
mov rax, qword [rbp - 0x38]
mov eax, dword [rax]
mov dword [rbp - 8], eax
mov dword [rbp - 0x58], 0x6474bafe
jmp 0x140001a39
mov eax, dword [rbp - 8]
add eax, 0xa463276d
add eax, 1
sub eax, 0xa463276d
mov dword [rbp - 4], eax
mov dword [rbp - 0x58], 0x25c901ab
jmp 0x140001a39
mov ecx, dword [0x1400dac60]
mov eax, dword [0x1400dac5c]
mov edx, ecx
sub edx, 0x561cd313
sub edx, 1
add edx, 0x561cd313
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfc3001a5
mov ecx, 0xf48edf32
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x140001a39
mov rax, qword [rbp - 0x38]
mov ecx, dword [rbp - 4]
mov dword [rax], ecx
mov eax, dword [0x1400dac60]
mov ecx, dword [0x1400dac5c]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfc3001a5
mov ecx, 0x9212b519
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x140001a39
mov dword [rbp - 0x58], 0xbd3209c
jmp 0x140001a39
mov rax, qword [rbp - 0x48]
mov rax, qword [rax]
mov qword [rbp], rax
mov dword [rbp - 0x58], 0x1bb7832a
jmp 0x140001a39
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32Next
add rsp, 0x20
cmp eax, 0
setne al
and al, 1
mov byte [rbp + 0xf], al
mov dword [rbp - 0x58], 0xd43f5909
jmp 0x140001a39
mov dl, byte [rbp + 0xf]
mov eax, 0x5f58efc4
mov ecx, 0x4378e13b
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x140001a39
mov rax, qword [rbp - 0x48]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
lea rcx, [0x1400d8c30]
lea rdx, str.Total_number_of_running_processes:
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x38]
mov edx, dword [rax]
sub rsp, 0x20
call fcn.140007b40
add rsp, 0x20
mov rcx, rax
lea rdx, [0x140007920]
sub rsp, 0x20
call fcn.1400074a0
add rsp, 0x20
mov rax, qword [rbp - 0x38]
mov eax, dword [rax]
mov dword [rbp + 0x10], eax
mov dword [rbp - 0x58], 0x6e8133c1
jmp 0x140001a39
mov rax, qword [rbp - 0x50]
mov ecx, dword [rbp + 0x10]
mov dword [rax], ecx
mov dword [rbp - 0x58], 0x6b6ccd9c
jmp 0x140001a39
mov dword [rbp - 0x58], 0xe80ffcc6
jmp 0x140001a39
mov rax, qword [rbp - 0x50]
mov eax, dword [rax]
mov dword [rbp + 0x14], eax
mov dword [rbp - 0x58], 0xc499c099
jmp 0x140001a39
mov eax, dword [rbp + 0x14]
mov dword [rbp - 0x74], eax
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
sub rsp, 0x20
call fcn.1400a23a0
mov eax, dword [rbp - 0x74]
lea rsp, [rbp + 0x20]
pop rbp
ret
mov dword [rbp - 0x58], 0xf245029e
jmp 0x140001a39
mov eax, 0x130
call fcn.1400a2340
sub rsp, rax
mov eax, 0x10
mov qword [rbp - 0x80], rax
call fcn.1400a2340
sub rsp, rax
mov rax, qword [rbp - 0x80]
call fcn.1400a2340
sub rsp, rax
mov rax, rsp
mov dword [rax], 0
mov ecx, 2
xor edx, edx
sub rsp, 0x20
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x48]
mov qword [rax], rcx
mov rax, qword [rbp - 0x48]
mov dword [rbp - 0x58], 0xe74f96fa
jmp 0x140001a39
lea rcx, [0x1400d8c30]
lea rdx, str.Error:_Unable_to_retrieve_information_about_the_first_process.
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
mov rcx, rax
lea rdx, [0x140007920]
sub rsp, 0x20
call fcn.1400074a0
add rsp, 0x20
mov dword [rbp - 0x58], 0x10734b73
jmp 0x140001a39
mov rax, qword [rbp - 0x38]
mov ecx, dword [rbp - 4]
mov dword [rax], ecx
mov dword [rbp - 0x58], 0xf48edf32
jmp 0x14000105a