Function at 0x1800277a0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
sub rsp, 0x328
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x68], rcx
mov rax, qword [0x1800760a8]
xor rax, rbp
mov qword [rbp + 0x2a0], rax
mov dword [rbp - 0x58], 0xa61c6fc9
mov eax, dword [rbp - 0x58]
mov dword [rbp - 0x74], eax
sub eax, 0x82dc5a98
je 0x180027bf6
jmp 0x1800277e7
mov eax, dword [rbp - 0x74]
sub eax, 0x87407d2e
je 0x180027e3f
jmp 0x1800277fa
mov eax, dword [rbp - 0x74]
sub eax, 0x892dbfea
je 0x180027cbc
jmp 0x18002780d
mov eax, dword [rbp - 0x74]
sub eax, 0xa61c6fc9
je 0x180027aab
jmp 0x180027820
mov eax, dword [rbp - 0x74]
sub eax, 0xb76f1153
je 0x180027dfa
jmp 0x180027833
mov eax, dword [rbp - 0x74]
sub eax, 0xbde7be25
je 0x180027fc4
jmp 0x180027846
mov eax, dword [rbp - 0x74]
sub eax, 0xc4eb350d
je 0x180027b5f
jmp 0x180027859
mov eax, dword [rbp - 0x74]
sub eax, 0xc86cb3b1
je 0x180027d12
jmp 0x18002786c
mov eax, dword [rbp - 0x74]
sub eax, 0xd24b5a6c
je 0x180027b40
jmp 0x18002787f
mov eax, dword [rbp - 0x74]
sub eax, 0xdc4bd432
je 0x180027f36
jmp 0x180027892
mov eax, dword [rbp - 0x74]
sub eax, 0xe1399015
je 0x180027ca7
jmp 0x1800278a5
mov eax, dword [rbp - 0x74]
sub eax, 0xe5cdd745
je 0x180027b03
jmp 0x1800278b8
mov eax, dword [rbp - 0x74]
sub eax, 0xea39ed97
je 0x180027f79
jmp 0x1800278cb
mov eax, dword [rbp - 0x74]
sub eax, 0xf0efb0f0
je 0x180027bbd
jmp 0x1800278de
mov eax, dword [rbp - 0x74]
sub eax, 0xf1862e3a
je 0x180027e28
jmp 0x1800278f1
mov eax, dword [rbp - 0x74]
sub eax, 0xf270d22b
je 0x180027f4a
jmp 0x180027904
mov eax, dword [rbp - 0x74]
sub eax, 0xfa6f7801
je 0x180027d53
jmp 0x180027917
mov eax, dword [rbp - 0x74]
sub eax, 0xc75846
je 0x180027e53
jmp 0x18002792a
mov eax, dword [rbp - 0x74]
sub eax, 0x116595e6
je 0x180027b25
jmp 0x18002793d
mov eax, dword [rbp - 0x74]
sub eax, 0x1746f3e8
je 0x180027dd0
jmp 0x180027950
mov eax, dword [rbp - 0x74]
sub eax, 0x18c0244f
je 0x180027f2a
jmp 0x180027963
mov eax, dword [rbp - 0x74]
sub eax, 0x263a1c48
je 0x180027dee
jmp 0x180027976
mov eax, dword [rbp - 0x74]
sub eax, 0x2df6410b
je 0x180027d70
jmp 0x180027989
mov eax, dword [rbp - 0x74]
sub eax, 0x36ed534f
je 0x180027f8d
jmp 0x18002799c
mov eax, dword [rbp - 0x74]
sub eax, 0x3bfe2e58
je 0x180027e0e
jmp 0x1800279af
mov eax, dword [rbp - 0x74]
sub eax, 0x3eede308
je 0x180027ee1
jmp 0x1800279c2
mov eax, dword [rbp - 0x74]
sub eax, 0x40c51735
je 0x180027c87
jmp 0x1800279d5
mov eax, dword [rbp - 0x74]
sub eax, 0x429defad
je 0x180027c02
jmp 0x1800279e8
mov eax, dword [rbp - 0x74]
sub eax, 0x47fa4ee2
je 0x180027fb2
jmp 0x1800279fb
mov eax, dword [rbp - 0x74]
sub eax, 0x4f1103ea
je 0x180027efe
jmp 0x180027a0e
mov eax, dword [rbp - 0x74]
sub eax, 0x59d166a8
je 0x180027bd1
jmp 0x180027a21
mov eax, dword [rbp - 0x74]
sub eax, 0x5abcf103
je 0x180027b53
jmp 0x180027a34
mov eax, dword [rbp - 0x74]
sub eax, 0x5b72d4fe
je 0x180027e67
jmp 0x180027a47
mov eax, dword [rbp - 0x74]
sub eax, 0x5ef4f470
je 0x180027cd7
jmp 0x180027a5a
mov eax, dword [rbp - 0x74]
sub eax, 0x63c41bfb
je 0x180027cfd
jmp 0x180027a6d
mov eax, dword [rbp - 0x74]
sub eax, 0x65ddcb32
je 0x180027ecd
jmp 0x180027a80
mov eax, dword [rbp - 0x74]
sub eax, 0x78795cdd
je 0x180027b84
jmp 0x180027a93
mov eax, dword [rbp - 0x74]
sub eax, 0x7da45fd9
je 0x180027da5
jmp 0x180027aa6
jmp 0x180027fea
mov rcx, qword [rbp - 0x70]
mov eax, 0x10
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov rdx, rsp
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x10], rax
mov ecx, 2
xor edx, edx
sub rsp, 0x20
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp - 8], rax
mov dword [rbp - 0x58], 0xe5cdd745
jmp 0x180027fea
mov rax, qword [rbp - 8]
mov rcx, 0xffffffffffffffff
cmp rax, rcx
sete al
and al, 1
mov byte [rbp + 7], al
mov dword [rbp - 0x58], 0x116595e6
jmp 0x180027fea
mov dl, byte [rbp + 7]
mov eax, 0xc4eb350d
mov ecx, 0xd24b5a6c
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x180027fea
mov dword [rbp - 0x1c], 0xffffffff
mov dword [rbp - 0x58], 0x5abcf103
jmp 0x180027fea
mov dword [rbp - 0x58], 0x47fa4ee2
jmp 0x180027fea
lea rcx, [rbp + 0x68]
xor edx, edx
mov r8d, 0x238
sub rsp, 0x20
call sub.msvcrt.dll_memset
add rsp, 0x20
mov dword [rbp - 0x58], 0x78795cdd
jmp 0x180027fea
mov dword [rbp + 0x68], 0x238
mov rcx, qword [rbp - 0x38]
lea rdx, [rbp + 0x68]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32FirstW
add rsp, 0x20
mov r8d, eax
xor edx, edx
mov eax, 0x82dc5a98
mov ecx, 0xf0efb0f0
cmp edx, r8d
cmove eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x180027fea
mov rax, qword [rbp - 0x38]
mov qword [rbp + 8], rax
mov dword [rbp - 0x58], 0x59d166a8
jmp 0x180027fea
mov rcx, qword [rbp + 8]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov dword [rbp - 0x1c], 0xffffffff
mov dword [rbp - 0x58], 0x47fa4ee2
jmp 0x180027fea
mov dword [rbp - 0x58], 0x429defad
jmp 0x180027fea
mov rcx, qword [0x1817d7428]
mov rax, qword [rcx]
sub rsp, 0x20
call qword [rax + 0x30]
add rsp, 0x20
movzx edx, al
mov eax, 0x400
mov ecx, 0x1000
cmp edx, 6
cmovge eax, ecx
mov dword [rbp - 0x3c], eax
mov r8d, dword [rbp + 0x70]
mov ecx, dword [rbp - 0x3c]
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_OpenProcess]
add rsp, 0x20
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov dword [rbp - 0x54], 0
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call fcn.180028760
add rsp, 0x20
mov cl, al
and cl, 1
mov rax, qword [rbp - 0x18]
mov byte [rax], cl
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0x10], rax
mov dword [rbp - 0x58], 0x40c51735
jmp 0x180027fea
mov r8, qword [rbp + 0x10]
xor eax, eax
mov edx, eax
mov eax, 0xb76f1153
mov ecx, 0xe1399015
cmp rdx, r8
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x180027fea
mov rax, qword [rbp - 0x18]
mov al, byte [rax]
mov byte [rbp + 0x1e], al
mov dword [rbp - 0x58], 0x892dbfea
jmp 0x180027fea
mov dl, byte [rbp + 0x1e]
mov eax, 0x5ef4f470
mov ecx, 0xc86cb3b1
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x180027fea
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call fcn.180028950
add rsp, 0x20
and al, 1
mov byte [rbp + 0x1f], al
mov dword [rbp - 0x58], 0x63c41bfb
jmp 0x180027fea
mov rax, qword [rbp - 0x18]
mov cl, byte [rbp + 0x1f]
mov byte [rax], cl
mov dword [rbp - 0x58], 0xc86cb3b1
jmp 0x180027fea
mov edx, dword [rbp + 0x70]
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call fcn.180028d90
add rsp, 0x20
mov dword [rbp - 0x54], eax
mov ecx, 0x800
sub rsp, 0x20
call sub.msvcrt.dll_malloc
add rsp, 0x20
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x20], rax
mov dword [rbp - 0x58], 0xfa6f7801
jmp 0x180027fea
mov rdx, qword [rbp + 0x20]
mov eax, 0x1746f3e8
mov ecx, 0x2df6410b
cmp rdx, 0
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x180027fea
mov rcx, qword [rbp - 0x50]
xor edx, edx
mov r8d, 0x800
sub rsp, 0x20
call sub.msvcrt.dll_memset
add rsp, 0x20
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0x30], rax
mov dword [rbp - 0x58], 0x7da45fd9
jmp 0x180027fea
mov rcx, qword [rbp - 0x10]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
mov r9d, 0x800
sub rsp, 0x20
call fcn.180028e70
add rsp, 0x20
mov dword [rbp - 0x58], 0x1746f3e8
jmp 0x180027fea
mov rcx, qword [rbp - 0x48]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov dword [rbp - 0x58], 0x263a1c48
jmp 0x180027fea
mov dword [rbp - 0x58], 0xb76f1153
jmp 0x180027fea
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x38], rax
mov dword [rbp - 0x58], 0x3bfe2e58
jmp 0x180027fea
mov eax, 0x87407d2e
mov ecx, 0xf1862e3a
cmp qword [rbp - 0x50], 0
cmove eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x180027fea
mov dword [rbp - 0x58], 0x5b72d4fe
lea rax, [0x18006d9e8]
mov qword [rbp - 0x60], rax
jmp 0x180027fea
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x40], rax
mov dword [rbp - 0x58], 0xc75846
jmp 0x180027fea
mov dword [rbp - 0x58], 0x5b72d4fe
mov rax, qword [rbp + 0x40]
mov qword [rbp - 0x60], rax
jmp 0x180027fea
mov r10, qword [rbp - 0x60]
lea r11, [rbp + 0x68]
add r11, 0x2c
mov rax, qword [rbp - 0x18]
mov bl, byte [rax]
mov r9d, dword [rbp + 0x88]
mov r8d, dword [rbp + 0x70]
mov edx, dword [rbp - 0x54]
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x38]
and bl, 1
sub rsp, 0x40
mov byte [rsp + 0x20], bl
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r10
call rax
add rsp, 0x40
xor eax, eax
mov edx, eax
mov eax, 0x4f1103ea
mov ecx, 0x65ddcb32
cmp rdx, qword [rbp - 0x48]
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x180027fea
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x58], 0x3eede308
jmp 0x180027fea
mov rcx, qword [rbp + 0x48]
sub rsp, 0x20
call fcn.180064787
add rsp, 0x20
mov dword [rbp - 0x58], 0x4f1103ea
jmp 0x180027fea
lea rcx, [rbp + 0x68]
xor edx, edx
mov r8d, 0x238
sub rsp, 0x20
call sub.msvcrt.dll_memset
add rsp, 0x20
mov dword [rbp + 0x68], 0x238
mov dword [rbp - 0x58], 0x18c0244f
jmp 0x180027fea
mov dword [rbp - 0x58], 0xdc4bd432
jmp 0x180027fea
mov rax, qword [rbp - 0x38]
mov qword [rbp + 0x50], rax
mov dword [rbp - 0x58], 0xf270d22b
jmp 0x180027fea
mov rcx, qword [rbp + 0x50]
lea rdx, [rbp + 0x68]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32NextW
add rsp, 0x20
mov edx, eax
mov eax, 0xea39ed97
mov ecx, 0x429defad
cmp edx, 0
cmovne eax, ecx
mov dword [rbp - 0x58], eax
jmp 0x180027fea
mov rax, qword [rbp - 0x38]
mov qword [rbp + 0x58], rax
mov dword [rbp - 0x58], 0x36ed534f
jmp 0x180027fea
mov rcx, qword [rbp + 0x58]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov dword [rbp - 0x1c], 0
mov dword [rbp - 0x58], 0x47fa4ee2
jmp 0x180027fea
mov eax, dword [rbp - 0x1c]
mov dword [rbp + 0x64], eax
mov dword [rbp - 0x58], 0xbde7be25
jmp 0x180027fea
mov eax, dword [rbp + 0x64]
mov dword [rbp - 0x78], eax
mov rcx, qword [rbp + 0x2a0]
xor rcx, rbp
sub rsp, 0x20
call fcn.18006c560
mov eax, dword [rbp - 0x78]
lea rsp, [rbp + 0x2a8]
pop rbx
pop rbp
ret
jmp 0x1800277d1