Function at 0x14000b440
Capabilities:
Enumerate processes

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
xor eax, eax
mov dword [rsp + 0x2b8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x2c0], eax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
mov qword [rsp + 0x2c8], rax
call fcn.14000a180
movsx ebx, al
call fcn.14000a170
movsx ecx, al
imul ebx, ecx
call fcn.14000a1b0
movsx edi, al
lea eax, [rbx + rbx*4]
lea r15d, [rdi + rax*2]
movsx eax, byte [0x140048cf1]
add eax, r15d
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
lea r13d, [rbx*8]
lea r14d, [rdi + r13]
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000b617
movsx eax, byte [0x140048cf2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x140048cf4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
xor r10d, r10d
mov eax, r10d
cmp r12, 0xffffffffffffffff
sete al
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm1, xmm0
movsd qword [rsp + 0x2b0], xmm1
movsx eax, byte [0x140048cf1]
add eax, r14d
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000b581
call fcn.14000a190
movsx edx, al
movsx eax, byte [0x14004ac58]
imul edx, eax
lea r8d, [rdx + rdx*2]
call fcn.14000a1c0
movsx ecx, al
sub r8d, ecx
call fcn.14000a1a0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x140048cf4]
add ecx, r8d
je 0x14000b581
mov esi, 8
mov dword [rsp + 0x2b0], esi
jmp 0x14000b5e2
movsx eax, byte [0x140048cf1]
add eax, r15d
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
mov esi, 8
cmp eax, ecx
je 0x14000b5e2
movsx eax, byte [0x140048cf1]
add eax, edi
lea eax, [rax + rbx*4]
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
sub eax, ecx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x2b0]
cvttsd2si eax, xmm0
mov dword [rsp + 0x2b0], eax
lea ecx, [rbx + rdi]
movsx eax, byte [0x140048cf1]
lea ecx, [rcx + rbx*4]
add eax, ecx
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
sub eax, ecx
imul eax, dword [rsp + 0x2b0]
test eax, eax
jne 0x14000ba45
jmp 0x14000b61c
mov esi, 8
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x30]
call fcn.14002d290
mov dword [rsp + 0x30], 0x238
movsx eax, byte [0x140048cf1]
add eax, edi
add eax, ebx
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000b7a5
lea rdx, [rsp + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor r10d, r10d
mov ecx, r10d
test eax, eax
sete cl
xorps xmm2, xmm2
cvtsi2sd xmm2, rcx
movsx eax, byte [0x140048cf2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x140048cf4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x2b0], xmm1
lea r14d, [rdi + r13]
movsx eax, byte [0x140048cf1]
add eax, r14d
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000b714
call fcn.14000a190
movsx edx, al
movsx eax, byte [0x14004ac58]
imul edx, eax
lea r8d, [rdx + rdx*2]
call fcn.14000a1c0
movsx ecx, al
sub r8d, ecx
call fcn.14000a1a0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x140048cf4]
add ecx, r8d
je 0x14000b714
mov dword [rsp + 0x2b0], esi
jmp 0x14000b770
movsx eax, byte [0x140048cf1]
add eax, r15d
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000b770
movsx eax, byte [0x140048cf1]
add eax, edi
lea eax, [rax + rbx*4]
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
sub eax, ecx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x2b0]
cvttsd2si eax, xmm0
mov dword [rsp + 0x2b0], eax
lea edx, [rbx + rbx*2]
movsx eax, byte [0x140048cf1]
add eax, edi
lea eax, [rax + rdx*2]
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
sub eax, ecx
imul eax, dword [rsp + 0x2b0]
test eax, eax
jne 0x14000ba45
jmp 0x14000b7a8
xor r10d, r10d
lea r13d, [rdi + rbx*2]
nop dword [rax]
movsx eax, byte [0x140048cf1]
add eax, r13d
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000b906
movsx eax, byte [0x140048cf2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x140048cf4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mov rax, r10
mov ecx, dword [rsp + 0x2c0]
cmp dword [rsp + 0x38], ecx
sete al
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm1, xmm0
movsd qword [rsp + 0x2b0], xmm1
movsx eax, byte [0x140048cf1]
add eax, r14d
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000b87e
call fcn.14000a190
movsx edx, al
movsx eax, byte [0x14004ac58]
imul edx, eax
lea r8d, [rdx + rdx*2]
call fcn.14000a1c0
movsx ecx, al
sub r8d, ecx
call fcn.14000a1a0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x140048cf4]
add ecx, r8d
je 0x14000b87e
mov dword [rsp + 0x20], esi
jmp 0x14000b8d7
movsx eax, byte [0x140048cf1]
add eax, r15d
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000b8d7
movsx eax, byte [0x140048cf1]
add eax, edi
lea eax, [rax + rbx*4]
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
sub eax, ecx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x2b0]
cvttsd2si eax, xmm0
mov dword [rsp + 0x20], eax
imul ecx, ebx, 7
movsx eax, byte [0x140048cf1]
add ecx, edi
add eax, ecx
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
sub eax, ecx
imul eax, dword [rsp + 0x20]
test eax, eax
jne 0x14000ba3a
lea rdx, [rsp + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
movd xmm2, eax
cvtdq2pd xmm2, xmm2
movsx eax, byte [0x140048cf2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x140048cf4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x2b0], xmm1
movsx eax, byte [0x140048cf1]
add eax, r14d
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000b9ad
call fcn.14000a190
movsx edx, al
movsx eax, byte [0x14004ac58]
imul edx, eax
lea r8d, [rdx + rdx*2]
call fcn.14000a1c0
movsx ecx, al
sub r8d, ecx
call fcn.14000a1a0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x140048cf4]
add ecx, r8d
je 0x14000b9ad
mov dword [rsp + 0x24], esi
jmp 0x14000ba06
movsx eax, byte [0x140048cf1]
add eax, r15d
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000ba06
movsx eax, byte [0x140048cf1]
add eax, edi
lea eax, [rax + rbx*4]
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
sub eax, ecx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x2b0]
cvttsd2si eax, xmm0
mov dword [rsp + 0x24], eax
lea ecx, [rbx + rdi]
movsx eax, byte [0x140048cf1]
lea ecx, [rcx + rbx*2]
add eax, ecx
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
sub eax, ecx
imul eax, dword [rsp + 0x24]
xor r10d, r10d
test eax, eax
je 0x14000ba45
jmp 0x14000b7b0
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x2b8], eax
call fcn.14000a180
movsx edx, al
call fcn.14000a170
movsx ecx, al
imul edx, ecx
lea r9d, [rdx + rdx*8]
call fcn.14000a1b0
movsx eax, al
add eax, r9d
movsx ecx, byte [0x140048cf1]
add eax, ecx
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000bc39
movsx eax, byte [0x140048cf2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x140048cf4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mov rax, r10
cmp r12, 0xffffffffffffffff
setne al
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm1, xmm0
movsd qword [rsp + 0x2b0], xmm1
call fcn.14000a180
movsx edx, al
call fcn.14000a170
movsx ecx, al
imul edx, ecx
lea edx, [rdx*8]
call fcn.14000a1b0
movsx ecx, al
movsx eax, byte [0x140048cf1]
add ecx, edx
add eax, ecx
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000bb52
call fcn.14000a190
movsx edx, al
movsx eax, byte [0x14004ac58]
imul edx, eax
lea r8d, [rdx + rdx*2]
call fcn.14000a1c0
movsx ecx, al
sub r8d, ecx
call fcn.14000a1a0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x140048cf4]
add ecx, r8d
je 0x14000bb52
mov r9d, esi
jmp 0x14000bbed
call fcn.14000a180
movsx edx, al
call fcn.14000a170
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000a1b0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [0x140048cf1]
add eax, ecx
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000bbe5
call fcn.14000a180
movsx edx, al
call fcn.14000a170
movsx ecx, al
imul edx, ecx
call fcn.14000a1b0
movsx ecx, al
lea eax, [rcx + rdx*4]
movsx ecx, byte [0x140048cf1]
add eax, ecx
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
sub eax, ecx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x2b0]
cvttsd2si r9d, xmm0
jmp 0x14000bbed
mov r9d, dword [rsp + 0x2b0]
call fcn.14000a180
movsx edx, al
call fcn.14000a170
movsx ecx, al
imul edx, ecx
call fcn.14000a1b0
movsx ecx, al
lea eax, [rcx + rdx*4]
movsx ecx, byte [0x140048cf1]
add eax, ecx
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
sub eax, ecx
imul eax, r9d
test eax, eax
je 0x14000bc39
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000a180
movsx r9d, al
call fcn.14000a170
movsx ecx, al
imul r9d, ecx
call fcn.14000a1b0
movsx eax, al
add eax, r9d
movsx ecx, byte [0x140048cf1]
add eax, ecx
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
sub eax, ecx
xorps xmm2, xmm2
cvtsi2sd xmm2, rax
movsx eax, byte [0x140048cf2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x140048cf4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x2b0], xmm1
call fcn.14000a180
movsx edx, al
call fcn.14000a170
movsx ecx, al
imul edx, ecx
lea edx, [rdx*8]
call fcn.14000a1b0
movsx ecx, al
movsx eax, byte [0x140048cf1]
add ecx, edx
add eax, ecx
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000bd30
call fcn.14000a190
movsx edx, al
movsx eax, byte [0x14004ac58]
imul edx, eax
lea r8d, [rdx + rdx*2]
call fcn.14000a1c0
movsx ecx, al
sub r8d, ecx
call fcn.14000a1a0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x140048cf4]
add ecx, r8d
jne 0x14000bdc9
call fcn.14000a180
movsx edx, al
call fcn.14000a170
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000a1b0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [0x140048cf1]
add eax, ecx
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000bdc2
call fcn.14000a180
movsx edx, al
call fcn.14000a170
movsx ecx, al
imul edx, ecx
call fcn.14000a1b0
movsx ecx, al
lea eax, [rcx + rdx*4]
movsx ecx, byte [0x140048cf1]
add eax, ecx
movsx ecx, byte [0x140048cf0]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
sub eax, ecx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x2b0]
cvttsd2si esi, xmm0
jmp 0x14000bdc9
mov esi, dword [rsp + 0x2b0]
xor eax, eax
cmp eax, esi
jge 0x14000bdd6
mov eax, dword [rsp + 0x2b8]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret