Function at 0x1400b3a6f
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov rsi, rcx
mov eax, dword [0x1404004f8]
mov ecx, dword [0x1404004fc]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp + 7]
cmp ecx, 0xa
setl byte [rbp + 6]
mov eax, 0x75f5bf9d
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12d, 0xbf85ecd3
cmp eax, 0xf3377cd0
jle 0x1400b3b0d
cmp eax, 0x40df8035
jg 0x1400b3b59
cmp eax, 0x23b0c74e
jg 0x1400b3bff
cmp eax, 0x65e3b03
jle 0x1400b3d08
cmp eax, 0x65e3b04
je 0x1400b3e6a
cmp eax, 0x13632e32
je 0x1400b3e7b
cmp eax, 0x1832ab82
jne 0x1400b3ab9
cmp dword [rbp - 0x24], 0
setne byte [rbp + 3]
mov eax, 0x23b0c74f
jmp 0x1400b3ab9
cmp eax, 0xc55fb8a9
jle 0x1400b3b9e
cmp eax, 0xd8831b4a
jg 0x1400b3c49
cmp eax, 0xcd4efad1
jle 0x1400b3d28
cmp eax, 0xcd4efad2
je 0x1400b3e8e
cmp eax, 0xd164cfd1
je 0x1400b3e9b
cmp eax, 0xd51fb3d1
jne 0x1400b3ab9
mov eax, 0x39fe9341
jmp 0x1400b3ab9
cmp eax, 0x69839243
jg 0x1400b3c7f
cmp eax, 0x52e9d919
jle 0x1400b3d54
cmp eax, 0x52e9d91a
je 0x1400b3ed1
cmp eax, 0x5a647b77
je 0x1400b3ede
cmp eax, 0x6077456d
jne 0x1400b3ab9
mov rax, qword [rbp - 0x10]
mov eax, 0xf3377cd1
jmp 0x1400b3ab9
cmp eax, 0xb6b13a1d
jg 0x1400b3cc9
cmp eax, 0x9dc89091
jle 0x1400b3d77
cmp eax, 0x9dc89092
je 0x1400b3efc
cmp eax, 0xa960980b
je 0x1400b3f12
cmp eax, 0xadd6494d
jne 0x1400b3ab9
mov rax, qword [rbp - 8]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
mov eax, dword [0x1404004f8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbdbb11a1
mov ecx, 0xfa794276
jmp 0x1400b41e2
cmp eax, 0x39fe9340
jle 0x1400b3d9a
cmp eax, 0x39fe9341
je 0x1400b3f2a
cmp eax, 0x3bc7b65e
je 0x1400b3f5d
cmp eax, 0x3cf9d35f
jne 0x1400b3ab9
mov eax, dword [0x1404004f8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x797ec575
mov ecx, 0xd164cfd1
jmp 0x1400b41e2
cmp eax, 0xdfbbac89
jle 0x1400b3dd2
cmp eax, 0xdfbbac8a
je 0x1400b3f73
cmp eax, 0xe2424ffe
je 0x1400b3f81
cmp eax, 0xedfacd2f
jne 0x1400b3ab9
mov eax, 0x71342b71
jmp 0x1400b3ab9
cmp eax, 0x75f5bf9c
jle 0x1400b3dfe
cmp eax, 0x7a467dea
je 0x1400b3f8b
cmp eax, 0x797ec575
je 0x1400b3f95
cmp eax, 0x75f5bf9d
jne 0x1400b3ab9
mov cl, byte [rbp + 7]
cmp byte [rbp + 6], 0
mov eax, 0xedfacd2f
mov edx, 0x71342b71
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x1400b3ab9
cmp eax, 0xc0a03f8a
jle 0x1400b3e46
cmp eax, 0xc0a03f8b
je 0x1400b3fb3
cmp eax, 0xc1f45a36
jne 0x1400b422c
mov eax, dword [0x1404004f8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7a467dea
mov ecx, 0xc787216e
jmp 0x1400b41e2
cmp eax, 0xf3377cd1
je 0x1400b3fd7
cmp eax, 0xfa794276
jne 0x1400b3ab9
mov eax, 0xd51fb3d1
jmp 0x1400b3ab9
cmp eax, 0xc55fb8aa
je 0x1400b4001
cmp eax, 0xc787216e
jne 0x1400b3ab9
cmp byte [rbp + 3], 0
mov eax, 0xa960980b
mov ecx, 0x69839244
cmovne eax, ecx
jmp 0x1400b3ab9
cmp eax, 0x40df8036
je 0x1400b400b
cmp eax, 0x47a0fec4
jne 0x1400b3ab9
mov eax, 0x65e3b04
xor r13d, r13d
jmp 0x1400b3ab9
cmp eax, 0x88afa365
je 0x1400b415f
cmp eax, 0x97a7d6e9
jne 0x1400b3ab9
mov eax, 0xc21bb307
xor r15d, r15d
jmp 0x1400b3ab9
cmp eax, 0x23b0c74f
je 0x1400b4188
cmp eax, 0x39e37e3e
jne 0x1400b3ab9
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32Next
add rsp, 0x20
mov dword [rbp - 0x24], eax
mov eax, 0x1832ab82
jmp 0x1400b3ab9
cmp eax, 0xd8831b4b
je 0x1400b41a3
cmp eax, 0xd9020b29
jne 0x1400b3ab9
cmp byte [rbp + 5], 0
mov eax, 0x3cf9d35f
mov ecx, 0x97a7d6e9
cmovne eax, ecx
jmp 0x1400b3ab9
cmp eax, 0x69839244
je 0x1400b41ad
cmp eax, 0x71342b71
jne 0x1400b3ab9
mov eax, 0x130
call fcn.1401e5ba0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 8], rax
mov eax, dword [0x1404004f8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xedfacd2f
mov ecx, 0xc55fb8aa
jmp 0x1400b41e2
cmp eax, 0xb6b13a1e
je 0x1400b41c9
cmp eax, 0xbdbb11a1
jne 0x1400b3ab9
mov rax, qword [rbp - 8]
mov eax, 0xadd6494d
jmp 0x1400b3ab9
mov rax, qword [rbp - 0x30]
mov eax, 0xcd4efad2
mov r14d, r13d
jmp 0x1400b3ab9
mov rax, qword [rbp - 0x40]
mov eax, dword [rax]
mov dword [rbp - 0x28], eax
mov eax, 0xdfbbac8a
jmp 0x1400b3ab9
mov eax, 0xc21bb307
mov r15d, r14d
jmp 0x1400b3ab9
sub rsp, 0x20
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov qword [rbp - 0x10], rax
mov eax, dword [0x1404004f8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x797ec575
mov ecx, 0xd8831b4b
jmp 0x1400b41e2
mov eax, 0xcd4efad2
xor r14d, r14d
jmp 0x1400b3ab9
mov eax, dword [0x1404004f8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6077456d
mov ecx, 0xf3377cd1
jmp 0x1400b41e2
cmp byte [rbp + 2], 0
mov eax, 0xc0a03f8b
mov ecx, 0x39e37e3e
cmovne eax, ecx
jmp 0x1400b3ab9
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call rdi
add rsp, 0x20
mov eax, 0x47a0fec4
jmp 0x1400b3ab9
mov rax, qword [rbp - 8]
mov dword [rax], 0x130
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32First
add rsp, 0x20
test eax, eax
mov eax, 0x39e37e3e
mov ecx, 0xa960980b
cmove eax, ecx
jmp 0x1400b3ab9
cmp byte [rbp + 4], 0
mov eax, 0xb6b13a1e
mov ecx, 0x52e9d91a
cmovne eax, ecx
jmp 0x1400b3ab9
mov eax, 0x65e3b04
mov r13d, dword [rbp - 0x28]
jmp 0x1400b3ab9
mov eax, 0x3bc7b65e
jmp 0x1400b3ab9
mov eax, 0xc1f45a36
jmp 0x1400b3ab9
sub rsp, 0x20
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov eax, 0xd164cfd1
jmp 0x1400b3ab9
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call rdi
add rsp, 0x20
mov rax, qword [rbp - 8]
add rax, 8
mov qword [rbp - 0x40], rax
mov eax, 0x13632e32
jmp 0x1400b3ab9
mov rax, qword [rbp - 0x10]
cmp rax, 0xffffffffffffffff
sete byte [rbp + 4]
mov eax, dword [0x1404004f8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6077456d
mov ecx, 0xe2424ffe
jmp 0x1400b41e2
mov eax, 0x40df8036
jmp 0x1400b3ab9
mov r8, rdi
mov eax, dword [0x140400500]
mov ecx, dword [0x140400504]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
sete byte [rbp + 1]
cmp ecx, 0xa
setl cl
setl byte [rbp]
or cl, al
mov edi, 0x67eb34f9
mov eax, 0x4c0d15c
cmovne edi, eax
mov ecx, 0x67eb34f9
mov eax, 0xfe60a004
cmovne ecx, eax
mov edx, 0x8a4135c7
mov eax, 0x25a32887
cmovne edx, eax
mov eax, 0x96e39619
cmp eax, 0x4c0d15b
jle 0x1400b4095
cmp eax, 0x67eb34f8
jg 0x1400b40c2
cmp eax, 0x25a32887
je 0x1400b40f4
cmp eax, 0x32b7a8ba
jne 0x1400b4121
mov rax, qword [rbp - 0x48]
add rax, 0x10
mov qword [rbp - 0x20], rax
mov eax, 0x69e3287a
jmp 0x1400b4062
cmp eax, 0xbf85ecd2
jg 0x1400b40d4
cmp eax, 0x8a4135c7
je 0x1400b40fe
cmp eax, 0x96e39619
jne 0x1400b4062
mov bl, byte [rbp + 1]
cmp byte [rbp], 0
mov eax, 0x8a4135c7
cmovne eax, r12d
test bl, bl
cmovne eax, r12d
jmp 0x1400b4062
cmp eax, 0x67eb34f9
je 0x1400b4108
cmp eax, 0x69e3287a
jne 0x1400b4062
mov eax, ecx
jmp 0x1400b4062
cmp eax, 0xbf85ecd3
je 0x1400b4116
cmp eax, 0xfe60a004
jne 0x1400b4062
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov qword [rbp - 0x18], rax
mov eax, edi
jmp 0x1400b4062
mov eax, 0x32b7a8ba
jmp 0x1400b4062
mov eax, 0xbf85ecd3
jmp 0x1400b4062
mov rax, qword [rbp - 0x20]
mov eax, 0xfe60a004
jmp 0x1400b4062
mov qword [rbp - 0x48], rsi
mov eax, edx
jmp 0x1400b4062
cmp eax, 0x4c0d15c
jne 0x1400b4062
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x18], rax
mov ecx, 0x5d200b7a
mov rdi, r8
cmp ecx, 0x82cdb7a4
je 0x1400b41f4
cmp ecx, 0x5d200b7a
jne 0x1400b413c
cmp qword [rbp - 0x18], 0
sete al
mov ecx, 0x82cdb7a4
jmp 0x1400b413c
mov rcx, qword [rbp - 8]
add rcx, 0x2c
mov rdx, qword [rbp - 0x38]
sub rsp, 0x20
call fcn.140325100
add rsp, 0x20
test eax, eax
setne byte [rbp + 2]
mov eax, 0x9dc89092
jmp 0x1400b3ab9
mov eax, dword [0x1404004f8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7a467dea
mov ecx, 0xc1f45a36
jmp 0x1400b41e2
mov eax, 0x5a647b77
jmp 0x1400b3ab9
mov eax, 0x865f0695
cmp eax, 0x865f0695
je 0x1400b41c2
cmp eax, 0x6b643ca3
jne 0x1400b41b2
jmp 0x1400b4209
mov eax, 0x6b643ca3
jmp 0x1400b41b2
mov eax, dword [0x1404004f8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbdbb11a1
mov ecx, 0xadd6494d
cmove eax, ecx
cmp dword [0x1404004fc], 0xa
cmovl eax, ecx
jmp 0x1400b3ab9
and al, 1
mov byte [rbp - 0x20], al
mov al, byte [rbp - 0x20]
mov byte [rbp + 5], al
mov eax, 0xd9020b29
jmp 0x1400b3ab9
mov qword [rbp - 0x18], rsi
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.14001af56
add rsp, 0x20
mov qword [rbp - 0x38], rax
mov eax, 0x88afa365
jmp 0x1400b3ab9
cmp eax, 0xc21bb307
jne 0x1400b3ab9
mov eax, r15d
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret