Function at 0x401550
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x3b8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x290], xmm6
movaps xmmword [rbp + 0x2a0], xmm7
movaps xmmword [rbp + 0x2b0], xmm8
movaps xmmword [rbp + 0x2c0], xmm9
movaps xmmword [rbp + 0x2d0], xmm10
movaps xmmword [rbp + 0x2e0], xmm11
movaps xmmword [rbp + 0x2f0], xmm12
movaps xmmword [rbp + 0x300], xmm13
movaps xmmword [rbp + 0x310], xmm14
movaps xmmword [rbp + 0x320], xmm15
mov qword [rbp + 0x380], rcx
lea rax, [sym.__gxx_personality_sj0]
mov qword [rbp - 0x30], rax
lea rax, [0x004080ec]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x20]
lea rbx, [rbp + 0x290]
mov qword [rax], rbx
lea rdx, [0x00401791]
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rsp
lea rax, [rbp - 0x60]
mov rcx, rax
call sym._Unwind_SjLj_Register
mov dword [rbp - 0x58], 0xffffffff
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x280], rax
cmp qword [rbp + 0x280], 0xffffffffffffffff
jne 0x401652
lea rdx, str.Failed_to_create_process_snapshot.
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x004063f0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov eax, 0
jmp 0x40178c
mov dword [rbp + 0x10], 0x238
lea rax, [rbp + 0x10]
mov rcx, qword [rbp + 0x280]
mov dword [rbp - 0x58], 0xffffffff
mov rdx, rax
call sym.Process32FirstW
test eax, eax
sete al
test al, al
je 0x4016bb
mov rax, qword [rbp + 0x280]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, str.Failed_to_retrieve_process_information.
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x004063f0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov eax, 0
jmp 0x40178c
mov dword [rbp + 0x28c], 0
lea rax, [rbp + 0x27f]
mov rcx, rax
call fcn.00401ce0
lea rcx, [rbp + 0x27f]
lea rax, [rbp + 0x10]
lea rdx, [rax + 0x2c]
lea rax, [rbp + 0x250]
mov dword [rbp - 0x58], 1
mov r8, rcx
mov rcx, rax
call dbg.std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >::basic_string(wchar_t const*, std::allocator<wchar_t> const&)
lea rax, [rbp + 0x250]
mov rdx, qword [rbp + 0x380]
mov rcx, rax
call sym._ZSteqIwEN9__gnu_cxx11__enable_ifIXsrSt9__is_charIT_E7__valueEbE6__typeERKNSt7__cxx1112basic_stringIS3_St11char_traitsIS3_ESaI
mov byte [rbp + 8], al
lea rax, [rbp + 0x250]
mov rcx, rax
call dbg.std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >::~basic_string()
lea rax, [rbp + 0x27f]
mov rcx, rax
call fcn.00401cd0
cmp byte [rbp + 8], 0
je 0x401744
mov eax, dword [rbp + 0x18]
mov dword [rbp + 0x28c], eax
jmp 0x40176c
lea rax, [rbp + 0x10]
mov rcx, qword [rbp + 0x280]
mov dword [rbp - 0x58], 0xffffffff
mov rdx, rax
call sym.Process32NextW
test eax, eax
setne al
test al, al
je 0x40176c
jmp 0x4016c5
mov rax, qword [rbp + 0x280]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp - 0x58], 0xffffffff
call rax
mov eax, dword [rbp + 0x28c]
mov dword [rbp + 8], eax
jmp 0x4017c2
lea rax, [rbp - 0x60]
mov rcx, rax
call sym._Unwind_SjLj_Unregister
mov eax, dword [rbp + 8]
movaps xmm6, xmmword [rbp + 0x290]
movaps xmm7, xmmword [rbp + 0x2a0]
movaps xmm8, xmmword [rbp + 0x2b0]
movaps xmm9, xmmword [rbp + 0x2c0]
movaps xmm10, xmmword [rbp + 0x2d0]
movaps xmm11, xmmword [rbp + 0x2e0]
movaps xmm12, xmmword [rbp + 0x2f0]
movaps xmm13, xmmword [rbp + 0x300]
movaps xmm14, xmmword [rbp + 0x310]
movaps xmm15, xmmword [rbp + 0x320]
add rsp, 0x3b8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret