Function at 0x1400b09f4
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x680]
sub rsp, 0x780
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x670], rax
mov r14d, r8d
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x70], rcx
xor r13d, r13d
lea rcx, [rsp + 0x58]
call fcn.14011a6a4
nop
lea rdx, [rdi + 0x42a0]
or r9d, 0xffffffff
xor r8d, r8d
lea rcx, [rsp + 0x58]
call fcn.14011a8d0
mov ebx, r13d
mov dword [rsp + 0x48], ebx
call fcn.140116890
mov byte [rsp + 0x42], al
lea r15d, [r13 + 1]
cmp dword [rdi + 0x4ae8], r13d
je 0x1400b0a84
cmp dword [rdi + 0x4388], r13d
cmove ebx, r15d
mov dword [rsp + 0x48], ebx
xor edx, edx
mov r8d, 0xa0
lea rcx, [rbp + 0x470]
call fcn.14012d4b0
mov ebx, 0x28
cmp r14d, ebx
cmovbe ebx, r14d
cmp qword [rdi + 0x670], r13
je 0x1400b0ac4
cmp dword [rdi + 0x664], r13d
jne 0x1400b0ac4
cmp ebx, r15d
seta dl
mov rcx, rdi
call fcn.1400a20ec
mov r8d, dword [rdi + 0x664]
test r8d, r8d
je 0x1400b0b23
mov eax, dword [rsi]
mov dword [rbp + 0x470], eax
mov dword [rbp + 0x474], r8d
mov r15d, 2
mov dword [rsp + 0x44], r15d
lea r11d, [r15 - 1]
cmp ebx, r11d
jbe 0x1400b0b46
lea rdx, [rsi + 4]
lea r9d, [rbx - 1]
mov ecx, dword [rdx]
test ecx, ecx
je 0x1400b0b13
cmp ecx, r8d
je 0x1400b0b13
mov eax, r15d
mov dword [rbp + rax*4 + 0x470], ecx
add r15d, r11d
add rdx, 4
sub r9, r11
jne 0x1400b0afb
mov dword [rsp + 0x44], r15d
jmp 0x1400b0b46
mov r8d, ebx
shl r8, 2
mov rdx, rsi
lea rcx, [rbp + 0x470]
call fcn.14012d940
mov r15d, ebx
mov dword [rsp + 0x44], ebx
mov r11d, 1
mov r14b, r13b
mov byte [rsp + 0x40], r13b
mov sil, r13b
mov byte [rsp + 0x41], r13b
mov bl, r13b
mov rax, r13
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x78], rax
mov r12d, 0x80
test r15d, r15d
je 0x1400b0ba7
lea rax, [rbp + 0x470]
mov r8d, r15d
mov edx, r13d
mov r9d, dword [rax]
lea rcx, [rdi + 0x4598]
cmp dword [rcx], r9d
je 0x1400b0b9b
add edx, r11d
add rcx, 4
cmp edx, r12d
jb 0x1400b0b88
jmp 0x1400b0b9e
mov dword [rax], r13d
add rax, 4
sub r8, r11
jne 0x1400b0b7b
mov edx, r13d
cmp dword [rdi + 0x4590], r13d
jbe 0x1400b0bf7
mov r8d, edx
cmp dword [rdi + r8*4 + 0x4390], r13d
je 0x1400b0bec
mov ecx, r13d
test r15d, r15d
je 0x1400b0be4
mov r9d, dword [rdi + r8*4 + 0x4390]
mov eax, ecx
cmp dword [rbp + rax*4 + 0x470], r9d
je 0x1400b0bec
add ecx, r11d
cmp ecx, r15d
jb 0x1400b0bd0
mov dword [rdi + r8*4 + 0x4390], r13d
add edx, r11d
cmp edx, dword [rdi + 0x4590]
jb 0x1400b0bb3
mov r11, r13
lea r13, [rdi + 0x4370]
mov r8, qword [r13 + 8]
mov r9, qword [r13]
mov rcx, r8
sub rcx, r9
movabs rax, 0x6bca1af286bca1b
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test rdx, rdx
jle 0x1400b0c82
xor r10d, r10d
movabs rdi, 0x6bca1af286bca1b
lea r14d, [r10 + 1]
mov rax, qword [r13]
mov byte [r10 + rax + 0x13], bl
add r11, r14
lea r10, [r10 + 0x98]
mov r8, qword [r13 + 8]
mov r9, qword [r13]
mov rcx, r8
sub rcx, r9
mov rax, rdi
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r11, rdx
jl 0x1400b0c40
mov rdi, qword [rsp + 0x70]
mov r14b, bl
xor r11d, r11d
mov r10d, r11d
sub r8, r9
movabs rax, 0x6bca1af286bca1b
imul r8
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test rdx, rdx
jle 0x1400b0d1b
mov r8d, r11d
movabs rsi, 0x6bca1af286bca1b
mov eax, r11d
test r15d, r15d
je 0x1400b0cea
mov edx, eax
mov ecx, dword [rbp + rdx*4 + 0x470]
test ecx, ecx
je 0x1400b0cd3
cmp ecx, dword [r8 + r9]
je 0x1400b0cdc
inc eax
cmp eax, r15d
jae 0x1400b0cea
jmp 0x1400b0cc0
mov byte [r8 + r9 + 0x13], 1
mov dword [rbp + rdx*4 + 0x470], r11d
inc r10
add r8, 0x98
mov r9, qword [r13]
mov rcx, qword [r13 + 8]
sub rcx, r9
mov rax, rsi
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r10, rdx
jl 0x1400b0cb8
mov sil, bl
mov ecx, r11d
mov r10d, 1
test r15d, r15d
je 0x1400b0d4b
lea rax, [rbp + 0x470]
cmp dword [rax], r11d
jne 0x1400b0d43
add ecx, r10d
add rax, 4
cmp ecx, r15d
jb 0x1400b0d30
jmp 0x1400b0d4b
mov sil, r10b
mov byte [rsp + 0x41], r10b
mov r8, r11
mov r9, qword [r13]
mov rcx, qword [r13 + 8]
sub rcx, r9
movabs rax, 0x6bca1af286bca1b
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test rdx, rdx
jle 0x1400b0d95
lea rax, [r9 + 0x13]
cmp byte [rax], r11b
je 0x1400b0d92
add r8, r10
add rax, 0x98
cmp r8, rdx
jl 0x1400b0d7d
jmp 0x1400b0d95
mov bl, r10b
test sil, sil
jne 0x1400b0da2
test bl, bl
je 0x1400b113e
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
jne 0x1400b0dee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Cant_create_process_snapshot__ErrCode0x_08X
lea rcx, [rbp + 0x470]
call fcn.14000c8e8
xor r8d, r8d
lea rdx, [rbp + 0x470]
mov rcx, qword [rdi + 8]
call fcn.14001222c
jmp 0x1400b113b
xor r9d, r9d
mov rcx, qword [r13 + 8]
sub rcx, qword [r13]
movabs r10, 0x6bca1af286bca1b
mov rax, r10
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test rdx, rdx
jle 0x1400b0e5d
xor r8d, r8d
lea r14d, [r9 + 1]
mov rax, qword [r13]
mov byte [r8 + rax + 0x12], 0
add r9, r14
lea r8, [r8 + 0x98]
mov rcx, qword [r13 + 8]
sub rcx, qword [r13]
mov rax, r10
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r9, rdx
jl 0x1400b0e23
mov r14b, byte [rsp + 0x40]
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x34]
call fcn.14012d4b0
mov dword [rbp + 0x30], 0x238
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x270]
call fcn.14012d4b0
lea rdx, [rbp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
xor r11d, r11d
test eax, eax
je 0x1400b112d
lea rsi, [rdi + 0x4598]
mov r8d, dword [rbp + 0x38]
mov eax, r11d
mov rcx, rsi
mov r10d, 1
cmp dword [rcx], r8d
je 0x1400b1195
add eax, r10d
add rcx, 4
cmp eax, r12d
jb 0x1400b0eb7
test r8d, r8d
je 0x1400b10e8
cmp byte [rsp + 0x41], r11b
je 0x1400b1019
test r15d, r15d
je 0x1400b1019
lea r14, [rbp + 0x470]
mov r12d, r15d
mov rsi, qword [rsp + 0x50]
mov r15b, byte [rsp + 0x40]
mov ebx, dword [r14]
test ebx, ebx
je 0x1400b0ff1
cmp ebx, r8d
jne 0x1400b0ff1
movzx eax, r15b
test r15b, r15b
cmove eax, r10d
mov r15b, al
xor edx, edx
mov r8d, 0x90
lea rcx, [rbp - 0x68]
call fcn.14012d4b0
mov dword [rbp - 0x70], ebx
mov eax, dword [rbp + 0x50]
mov dword [rbp - 0x6c], eax
lea r8, [rbp + 0x5c]
lea rdx, [rbp - 0x70]
mov rcx, rdi
call fcn.1400b05e4
mov word [rbp - 0x5e], 0x101
xor ebx, ebx
cmp dword [rbp - 0x5c], ebx
jne 0x1400b0fcb
cmp byte [rsp + 0x42], bl
je 0x1400b0fc4
xor edx, edx
mov ecx, dword [rbp - 0x70]
call fcn.140119e1c
mov dword [rbp - 0x5c], eax
test eax, eax
jne 0x1400b0fcb
test rsi, rsi
jne 0x1400b0f9f
mov ecx, 0x830
call fcn.140113d08
mov qword [rbp - 0x80], rax
test rax, rax
je 0x1400b0f92
mov rcx, rax
call fcn.14000494c
mov rsi, rax
jmp 0x1400b0f95
mov rsi, rbx
mov qword [rsp + 0x78], rsi
test rsi, rsi
je 0x1400b0fcb
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp - 0x70]
mov rcx, rsi
call fcn.140006494
jmp 0x1400b0fcb
mov dword [rbp - 0x5c], 0x20
mov edx, 0x12c
lea rcx, [rsp + 0x58]
call fcn.14011aaf0
lea rdx, [rbp - 0x70]
mov rcx, r13
call fcn.14009f5d0
mov r8d, dword [rbp + 0x38]
xor r11d, r11d
lea r10d, [r11 + 1]
add r14, 4
sub r12, r10
jne 0x1400b0efd
mov byte [rsp + 0x40], r15b
mov qword [rsp + 0x50], rsi
lea rsi, [rdi + 0x4598]
mov r15d, dword [rsp + 0x44]
mov rbx, qword [rsp + 0x68]
mov r12, r11
mov r9, qword [r13]
mov rcx, qword [r13 + 8]
sub rcx, r9
movabs rax, 0x6bca1af286bca1b
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test rdx, rdx
jle 0x1400b10e2
mov r14, r11
mov sil, byte [rsp + 0x40]
movabs r15, 0x6bca1af286bca1b
lea rbx, [r14 + r9]
cmp dword [rbx], r8d
jne 0x1400b109e
mov byte [rbx + 0x12], r10b
cmp byte [rbx + 0x10], r11b
jne 0x1400b109a
movzx eax, sil
test sil, sil
cmove eax, r10d
mov sil, al
lea r8, [rbp + 0x5c]
mov rdx, rbx
mov rcx, rdi
call fcn.1400b05e4
mov eax, dword [rbp + 0x50]
mov dword [rbx + 4], eax
xor r11d, r11d
lea r10d, [r11 + 1]
mov r8d, dword [rbp + 0x38]
add r12, r10
add r14, 0x98
mov r9, qword [r13]
mov rcx, qword [r13 + 8]
sub rcx, r9
mov rax, r15
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r12, rdx
jl 0x1400b105d
mov byte [rsp + 0x40], sil
lea rsi, [rdi + 0x4598]
mov r15d, dword [rsp + 0x44]
mov rbx, qword [rsp + 0x68]
mov r12d, 0x80
lea rdx, [rbp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
xor r11d, r11d
test eax, eax
jne 0x1400b0ea7
lea rax, [rbp + 0x270]
sub rax, rdi
lea ecx, [r11 + 1]
cmp dword [rsi], r11d
je 0x1400b111f
cmp dword [rax + rsi - 0x4598], r11d
jne 0x1400b111f
mov dword [rsi], r11d
add rsi, 4
sub r12, rcx
jne 0x1400b110d
mov r14b, byte [rsp + 0x40]
test rbx, rbx
je 0x1400b113e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r11d, r11d
mov rsi, r11
mov r8, qword [r13]
mov rcx, qword [r13 + 8]
sub rcx, r8
movabs r15, 0x6bca1af286bca1b
mov rax, r15
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test rdx, rdx
jle 0x1400b11f8
mov rbx, r11
mov edi, 1
cmp byte [rbx + r8 + 0x12], r11b
je 0x1400b11a2
cmp byte [rbx + r8 + 0x13], r11b
je 0x1400b11a2
add rsi, rdi
add rbx, 0x98
jmp 0x1400b11cf
mov dword [rbp + rax*4 + 0x270], r10d
jmp 0x1400b10e8
movzx eax, r14b
test r14b, r14b
cmove eax, edi
mov r14b, al
mov edx, 0x12c
lea rcx, [rsp + 0x58]
call fcn.14011aaf0
mov r8, rdi
mov rdx, rsi
mov rcx, r13
call fcn.1400b8e70
xor r11d, r11d
mov r8, qword [r13]
mov rcx, qword [r13 + 8]
sub rcx, r8
mov rax, r15
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rsi, rdx
jl 0x1400b117b
mov rdi, qword [rsp + 0x70]
mov r15d, 1
mov edx, r15d
lea rcx, [rsp + 0x58]
call fcn.14011ac58
xor esi, esi
test eax, eax
je 0x1400b1233
lea rcx, [rsp + 0x58]
call fcn.14011ab98
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rdi + 0x42a0]
lea rcx, [rsp + 0x58]
call fcn.14011a8d0
lea rcx, [rsp + 0x78]
call fcn.14009f158
mov dl, r14b
mov rcx, rdi
call fcn.1400b1294
movzx ebx, sil
test al, al
cmovne ebx, r15d
cmp dword [rsp + 0x48], esi
je 0x1400b125e
mov dword [rdi + 0x4ae8], esi
lea rcx, [rsp + 0x58]
call fcn.14011a71c
mov al, bl
mov rcx, qword [rbp + 0x670]
xor rcx, rsp
call fcn.14012bda0
mov rbx, qword [rsp + 0x7d8]
add rsp, 0x780
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret