Function at 0x7ff9b9c7b580
Capabilities:
Enumerate processes

Disassembly:
mov dword [rsp + 8], ecx
push rsi
push rdi
mov eax, 0x22c8
call fcn.7ff9b9d4a4e0
sub rsp, rax
mov rax, qword [0x7ff9b9dc6200]
xor rax, rsp
mov qword [rsp + 0x22b0], rax
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x1520], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0xf0], rax
lea rdx, [rsp + 0x1520]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.kernel32.dll_Process32FirstW]
cmp eax, 1
jne 0x7ff9b9c7b637
lea rax, [rsp + 0x154c]
lea rcx, [0x7ff9b9dacea8]
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x7ff9b9c7b60d
add rax, 2
test dx, dx
jne 0x7ff9b9c7b5f7
xor eax, eax
jmp 0x7ff9b9c7b612
sbb eax, eax
or eax, 1
test eax, eax
jne 0x7ff9b9c7b61d
mov byte [rsp + 0x38], 1
jmp 0x7ff9b9c7b637
lea rdx, [rsp + 0x1520]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.kernel32.dll_Process32NextW]
test eax, eax
jne 0x7ff9b9c7b5e5
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.kernel32.dll_CloseHandle]
movzx eax, byte [rsp + 0x38]
test eax, eax
je 0x7ff9b9c7b6ba
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x3c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x80]
movzx r8d, byte [rsp + 0x3c]
movzx edx, byte [rsp + 0xd4]
lea rcx, [rsp + 0x430]
call fcn.7ff9b9c87480
mov rcx, rax
call fcn.7ff9b9c7fc10
mov r9d, 0x50010
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.user32.dll_MessageBoxA]
xor al, al
jmp 0x7ff9b9c7d075
mov byte [rsp + 0x39], 0
mov dword [rsp + 0x12e0], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0xf8], rax
lea rdx, [rsp + 0x12e0]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.kernel32.dll_Process32FirstW]
cmp eax, 1
jne 0x7ff9b9c7b74c
lea rax, [rsp + 0x130c]
lea rcx, [0x7ff9b9dacf18]
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x7ff9b9c7b722
add rax, 2
test dx, dx
jne 0x7ff9b9c7b70c
xor eax, eax
jmp 0x7ff9b9c7b727
sbb eax, eax
or eax, 1
test eax, eax
jne 0x7ff9b9c7b732
mov byte [rsp + 0x39], 1
jmp 0x7ff9b9c7b74c
lea rdx, [rsp + 0x12e0]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.kernel32.dll_Process32NextW]
test eax, eax
jne 0x7ff9b9c7b6fa
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.kernel32.dll_CloseHandle]
movzx eax, byte [rsp + 0x39]
test eax, eax
je 0x7ff9b9c7b7c9
lea rax, [rsp + 0x3d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x3e]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x3d]
movzx r8d, byte [rsp + 0x3e]
movzx edx, byte [rsp + 0xd5]
lea rcx, [rsp + 0x470]
call fcn.7ff9b9c87530
mov rcx, rax
call fcn.7ff9b9c7fc10
mov r9d, 0x50010
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.user32.dll_MessageBoxA]
xor al, al
jmp 0x7ff9b9c7d075
mov byte [rsp + 0x30], 0
mov eax, dword [rsp + 0x22e0]
mov dword [rsp + 0xa8], eax
mov eax, dword [rsp + 0xa8]
dec eax
mov dword [rsp + 0xa8], eax
cmp dword [rsp + 0xa8], 0xb
ja case.default.0x7ff9b9c7b812
mov eax, dword [rsp + 0xa8]
lea rcx, [0x7ff9b9c00000]
mov eax, dword [rcx + rax*4 + 0x7d090]
add rax, rcx
jmp rax
jmp 0x7ff9b9f6a456
jmp 0x7ff9b9fc49d0
jmp 0x7ff9b9fc49d5
jmp 0x7ff9b9efae88
jmp 0x7ff9b9efae8d
lea rax, [rsp + 0x7c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x7d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x7c]
movzx r8d, byte [rsp + 0x7d]
movzx edx, byte [rsp + 0xd2]
lea rcx, [rsp + 0x210]
call fcn.7ff9b9c881d0
mov rcx, rax
call fcn.7ff9b9c7d100
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0x7e]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x7f]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x7e]
movzx r8d, byte [rsp + 0x7f]
movzx edx, byte [rsp + 0xd3]
lea rcx, [rsp + 0x5f0]
call fcn.7ff9b9c880f0
mov rcx, rax
call fcn.7ff9b9c7d200
mov qword [rsp + 0x1b8], rax
mov r9d, 0x50010
mov r8, qword [rsp + 0x1b0]
mov rdx, qword [rsp + 0x1b8]
xor ecx, ecx
call qword [sym.imp.user32.dll_MessageBoxA]
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x22b0]
xor rcx, rsp
call fcn.7ff9b9d49770
add rsp, 0x22c8
pop rdi
pop rsi
ret