Function at 0x140003e3f
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x3f0
lea rbp, [rsp + 0x80]
call fcn.14000da70
call fcn.140002089
lea rax, [0x1400b9f60]
mov rcx, rax
call fcn.1400034f5
mov dword [rbp + 0x130], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x360], rax
mov dword [rbp + 0x36c], 0
lea rax, [rbp + 0x124]
lea rdx, [rbp + 0x269]
mov rcx, rax
call fcn.14000369a
lea rdx, [rbp + 0x130]
mov rax, qword [rbp + 0x360]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x140004114
jmp 0x1400040f0
lea rax, [rbp + 0x124]
mov qword [rbp + 0x350], rax
mov rax, qword [rbp + 0x350]
mov qword [rbp + 0x348], rax
mov rax, qword [rbp + 0x348]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x140003f96
mov rax, qword [rbp + 0x350]
mov rdx, qword [rbp + 0x350]
mov qword [rbp + 0x340], rdx
mov qword [rbp + 0x338], rax
mov dword [rbp + 0x334], 0
jmp 0x140003f8c
mov eax, dword [rbp + 0x334]
movsxd rdx, eax
mov rax, qword [rbp + 0x338]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x334]
movsxd rdx, eax
imul rdx, rdx, 0x4d4873ed
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x35
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x340]
mov eax, dword [rbp + 0x334]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x334], 1
cmp dword [rbp + 0x334], 0xb
jle 0x140003f2d
nop
lea rax, [rbp + 0x124]
lea rdx, [rbp + 0x130]
lea rcx, [rdx + 0x2c]
mov rdx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x1400040f0
mov eax, dword [rbp + 0x138]
mov dword [rbp + 0x36c], eax
lea rax, [rbp + 0x11]
lea rdx, [rbp + 0x26a]
mov rcx, rax
call fcn.14000370c
lea rax, [rbp + 0x11]
mov qword [rbp + 0x328], rax
mov rax, qword [rbp + 0x328]
movzx eax, byte [rax + 0xe]
test al, al
setne al
test al, al
je 0x14000408a
lea rax, [rbp + 0x11]
lea rdx, [rbp + 0x11]
mov qword [rbp + 0x320], rdx
mov qword [rbp + 0x318], rax
mov dword [rbp + 0x314], 0
jmp 0x140004080
mov eax, dword [rbp + 0x314]
movsxd rdx, eax
mov rax, qword [rbp + 0x318]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x314]
movsxd rdx, eax
imul rdx, rdx, 0x4d4873ed
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x35
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x320]
mov eax, dword [rbp + 0x314]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x314], 1
cmp dword [rbp + 0x314], 0xe
jle 0x140004021
nop
lea rax, [rbp + 0x11]
mov rdx, qword [rbp + 0x124]
mov qword [rbp - 0x50], rdx
mov edx, dword [rbp + 0x12c]
mov dword [rbp - 0x48], edx
mov ecx, dword [rbp + 0x36c]
lea rdx, [rbp - 0x50]
mov r9d, ecx
mov r8, rdx
mov rdx, rax
lea rax, [0x140411388]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x310], 0
jmp 0x1400040e4
mov eax, dword [rbp + 0x310]
cdqe
mov byte [rbp + rax + 0x11], 0
add dword [rbp + 0x310], 1
cmp dword [rbp + 0x310], 0xe
jle 0x1400040d0
nop
jmp 0x140004114
lea rdx, [rbp + 0x130]
mov rax, qword [rbp + 0x360]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
jne 0x140003ed1
mov rax, qword [rbp + 0x360]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x36c], 0
jne 0x14000425a
lea rax, [rbp - 0x40]
lea rdx, [rbp + 0x26b]
mov rcx, rax
call fcn.140003796
lea rax, [rbp - 0x40]
mov qword [rbp + 0x308], rax
mov rax, qword [rbp + 0x308]
movzx eax, byte [rax + 0x43]
test al, al
setne al
test al, al
je 0x1400041f5
lea rax, [rbp - 0x40]
lea rdx, [rbp - 0x40]
mov qword [rbp + 0x300], rdx
mov qword [rbp + 0x2f8], rax
mov dword [rbp + 0x2f4], 0
jmp 0x1400041eb
mov eax, dword [rbp + 0x2f4]
movsxd rdx, eax
mov rax, qword [rbp + 0x2f8]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x2f4]
movsxd rdx, eax
imul rdx, rdx, 0x4d4873ed
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x35
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x300]
mov eax, dword [rbp + 0x2f4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x2f4], 1
cmp dword [rbp + 0x2f4], 0x43
jle 0x14000418c
nop
lea rax, [rbp - 0x40]
mov rdx, qword [rbp + 0x124]
mov qword [rbp - 0x50], rdx
mov edx, dword [rbp + 0x12c]
mov dword [rbp - 0x48], edx
lea rdx, [rbp - 0x50]
mov r8, rdx
mov rdx, rax
lea rax, str._s_s
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x2f0], 0
jmp 0x140004246
mov eax, dword [rbp + 0x2f0]
cdqe
mov byte [rbp + rax - 0x40], 0
add dword [rbp + 0x2f0], 1
cmp dword [rbp + 0x2f0], 0x43
jle 0x140004232
nop
mov eax, 1
jmp 0x140004836
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x108], 0
mov eax, dword [rbp + 0x138]
mov ecx, eax
call fcn.1400014a4
mov qword [rbp + 0x100], rax
mov dword [rbp + 0xd0], 0x30
mov qword [rbp + 0xd8], 0
mov dword [rbp + 0xe8], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0xf8], 0
lea rcx, [rbp + 0x100]
lea rdx, [rbp + 0xd0]
lea rax, [rbp + 0x118]
mov r9, rcx
mov r8, rdx
mov edx, 0x478
mov rcx, rax
call fcn.140001d87
mov qword [rbp + 0xc8], 0
mov dword [rbp + 0xc4], 0
mov rax, qword [0x14040df38]
mov qword [rbp + 0xb8], rax
mov rax, qword [rbp + 0x118]
lea rcx, [rbp + 0xb8]
lea rdx, [rbp + 0xc8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call fcn.140001dd4
mov dword [rbp + 0x35c], eax
lea rax, [rbp + 0x90]
lea rdx, [rbp + 0x26c]
mov rcx, rax
call fcn.1400039c8
lea rax, [rbp + 0x90]
mov qword [rbp + 0x2e8], rax
mov rax, qword [rbp + 0x2e8]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x140004418
lea rax, [rbp + 0x90]
lea rdx, [rbp + 0x90]
mov qword [rbp + 0x2e0], rdx
mov qword [rbp + 0x2d8], rax
mov dword [rbp + 0x2d4], 0
jmp 0x14000440e
mov eax, dword [rbp + 0x2d4]
movsxd rdx, eax
mov rax, qword [rbp + 0x2d8]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x2d4]
movsxd rdx, eax
imul rdx, rdx, 0x4d4873ed
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x35
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x2e0]
mov eax, dword [rbp + 0x2d4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x2d4], 1
cmp dword [rbp + 0x2d4], 0x27
jle 0x1400043af
nop
lea rax, [rbp + 0x90]
mov edx, dword [rbp + 0x35c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1404110a1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x2d0], 0
jmp 0x14000445d
mov eax, dword [rbp + 0x2d0]
cdqe
mov byte [rbp + rax + 0x90], 0
add dword [rbp + 0x2d0], 1
cmp dword [rbp + 0x2d0], 0x27
jle 0x140004446
nop
lea rax, [rbp + 0x82]
lea rdx, [rbp + 0x26d]
mov rcx, rax
call fcn.140003b1a
mov r8, qword [rbp + 0xc8]
lea rax, [rbp + 0x82]
mov qword [rbp + 0x2c8], rax
mov rax, qword [rbp + 0x2c8]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x14000453b
lea rax, [rbp + 0x82]
lea rdx, [rbp + 0x82]
mov qword [rbp + 0x2c0], rdx
mov qword [rbp + 0x2b8], rax
mov dword [rbp + 0x2b4], 0
jmp 0x140004531
mov eax, dword [rbp + 0x2b4]
movsxd rdx, eax
mov rax, qword [rbp + 0x2b8]
add rax, rdx
movzx r9d, byte [rax]
mov eax, dword [rbp + 0x2b4]
movsxd rdx, eax
imul rdx, rdx, 0x4d4873ed
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x35
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r9d
xor ecx, eax
mov rdx, qword [rbp + 0x2c0]
mov eax, dword [rbp + 0x2b4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x2b4], 1
cmp dword [rbp + 0x2b4], 0xd
jle 0x1400044d2
nop
lea rax, [rbp + 0x82]
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x2b0], 0
jmp 0x140004577
mov eax, dword [rbp + 0x2b0]
cdqe
mov byte [rbp + rax + 0x82], 0
add dword [rbp + 0x2b0], 1
cmp dword [rbp + 0x2b0], 0xd
jle 0x140004560
nop
mov r9, qword [rbp + 0xb8]
mov r8, qword [0x14043d030]
mov rdx, qword [rbp + 0xc8]
mov rax, qword [rbp + 0x118]
lea rcx, [rbp + 0x78]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001ca0
mov dword [rbp + 0x35c], eax
lea rax, [rbp + 0x50]
lea rdx, [rbp + 0x26e]
mov rcx, rax
call fcn.140003b9c
lea rax, [rbp + 0x50]
mov qword [rbp + 0x2a8], rax
mov rax, qword [rbp + 0x2a8]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x140004675
lea rax, [rbp + 0x50]
lea rdx, [rbp + 0x50]
mov qword [rbp + 0x2a0], rdx
mov qword [rbp + 0x298], rax
mov dword [rbp + 0x294], 0
jmp 0x14000466b
mov eax, dword [rbp + 0x294]
movsxd rdx, eax
mov rax, qword [rbp + 0x298]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x294]
movsxd rdx, eax
imul rdx, rdx, 0x4d4873ed
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x35
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x2a0]
mov eax, dword [rbp + 0x294]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x294], 1
cmp dword [rbp + 0x294], 0x27
jle 0x14000460c
nop
lea rax, [rbp + 0x50]
mov edx, dword [rbp + 0x35c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1404110a1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x290], 0
jmp 0x1400046b4
mov eax, dword [rbp + 0x290]
cdqe
mov byte [rbp + rax + 0x50], 0
add dword [rbp + 0x290], 1
cmp dword [rbp + 0x290], 0x27
jle 0x1400046a0
nop
mov rax, qword [rbp + 0x118]
lea r8, [rbp + 0xb8]
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0xc4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call fcn.140001c53
mov dword [rbp + 0x35c], eax
lea rax, [rbp + 0x20]
lea rdx, [rbp + 0x26f]
mov rcx, rax
call fcn.140003cee
lea rax, [rbp + 0x20]
mov qword [rbp + 0x288], rax
mov rax, qword [rbp + 0x288]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x1400047b4
lea rax, [rbp + 0x20]
lea rdx, [rbp + 0x20]
mov qword [rbp + 0x280], rdx
mov qword [rbp + 0x278], rax
mov dword [rbp + 0x274], 0
jmp 0x1400047aa
mov eax, dword [rbp + 0x274]
movsxd rdx, eax
mov rax, qword [rbp + 0x278]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x274]
movsxd rdx, eax
imul rdx, rdx, 0x4d4873ed
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x35
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x280]
mov eax, dword [rbp + 0x274]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x274], 1
cmp dword [rbp + 0x274], 0x27
jle 0x14000474b
nop
lea rax, [rbp + 0x20]
mov edx, dword [rbp + 0x35c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1404110a1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x270], 0
jmp 0x1400047f3
mov eax, dword [rbp + 0x270]
cdqe
mov byte [rbp + rax + 0x20], 0
add dword [rbp + 0x270], 1
cmp dword [rbp + 0x270], 0x27
jle 0x1400047df
nop
mov rax, qword [rbp + 0x118]
mov rcx, rax
call fcn.14000332e
mov rdx, qword [rbp + 0xc8]
mov rax, qword [rbp + 0x118]
mov rcx, rax
call fcn.140002f63
mov rax, qword [rbp + 0x118]
mov rcx, rax
call fcn.140001d3a
mov eax, 0
add rsp, 0x3f0
pop rbp
ret