Function at 0x180002b00
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov rsi, rcx
mov rax, qword [0x18000a128]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x18000a154]
mov ecx, dword [0x18000a158]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp - 1]
cmp ecx, 0xa
setl byte [rbp - 2]
mov eax, 0xb807c765
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12d, 0xdf302666
mov r13d, 0x78273c5
mov edi, 0xa1a8ac26
mov r14d, 0xce5962ae
jmp 0x180002b9d
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x80e90f99
mov ecx, 0x3348706a
nop word cs:[rax + rax]
nop
cmove eax, ecx
cmp dword [0x18000a158], 0xa
cmovl eax, ecx
cmp eax, 0x78273c4
jg 0x180002bf0
cmp eax, 0xd41c1ec5
jg 0x180002c50
cmp eax, 0xc30945f9
jg 0x180002d09
cmp eax, 0xb807c764
jg 0x180002e3f
cmp eax, 0xa1a8ac25
jg 0x18000303c
cmp eax, 0x80e90f99
je 0x180003051
cmp eax, 0xa07dc700
je 0x18000325a
jmp 0x180002b9d
cmp eax, 0x4407f86a
jg 0x180002ca0
cmp eax, 0x2226510b
jg 0x180002d53
cmp eax, 0x12472396
jg 0x180002e8c
cmp eax, 0x78273c5
je 0x18000305f
cmp eax, 0x106dc667
je 0x180003069
cmp eax, 0x11c13d55
jne 0x180002b9d
sub rsp, 0x20
lea rcx, [0x180008359]
call fcn.1800033d0
add rsp, 0x20
mov eax, 0x1a7a3de0
jmp 0x180002b9d
cmp eax, 0xea069933
jg 0x180002da9
cmp eax, 0xe4cd2cef
jg 0x180002eb2
cmp eax, 0xd41c1ec6
je 0x180003073
cmp eax, 0xd8186412
je 0x180003092
cmp eax, 0xdf302666
jne 0x180002b9d
mov eax, 0xc1efe526
jmp 0x180002b9d
cmp eax, 0x589ca86c
jg 0x180002ded
cmp eax, 0x4f15722d
jg 0x180002edd
cmp eax, 0x4407f86b
je 0x18000309c
cmp eax, 0x4a59fac9
je 0x1800030ba
cmp eax, 0x4c2ee75d
jne 0x180002b9d
sub rsp, 0x20
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, 0xffffffffffffffff
mov eax, 0xc2f510f8
mov ecx, 0x11c13d55
cmove eax, ecx
jmp 0x180002b9d
cmp eax, 0xcde35b15
jg 0x180002f42
cmp eax, 0xc30945fa
je 0x1800030c4
cmp eax, 0xc6f25f6a
je 0x1800030fd
cmp eax, 0xc9a9a54d
jne 0x180002b9d
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd41c1ec6
mov ecx, 0xc30945fa
jmp 0x180002b90
cmp eax, 0x3b6ea518
jg 0x180002f81
cmp eax, 0x2226510c
je 0x180003129
cmp eax, 0x241f81ca
je 0x180003152
cmp eax, 0x3348706a
jne 0x180002b9d
mov rax, qword [rbp - 0x10]
add rax, 0x2c
mov qword [rbp - 0x38], rax
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x80e90f99
mov ecx, 0xb550de9e
jmp 0x180002b90
cmp eax, 0xecc7a502
jg 0x180002fc0
cmp eax, 0xea069934
je 0x18000315c
cmp eax, 0xea1e33bc
je 0x180003172
cmp eax, 0xea3a190a
jne 0x180002b9d
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov eax, 0xc6f25f6a
jmp 0x180002b9d
cmp eax, 0x5dc50157
jg 0x180002ff3
cmp eax, 0x589ca86d
je 0x1800031a9
cmp eax, 0x5c42d7cb
je 0x1800031e9
cmp eax, 0x5c6fcea2
jne 0x180002b9d
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x416fe970
cmove eax, edi
cmp dword [0x18000a158], 0xa
cmovl eax, edi
jmp 0x180002b9d
cmp eax, 0xb807c765
je 0x1800031f3
cmp eax, 0xc1efe526
je 0x180003212
cmp eax, 0xc2f510f8
jne 0x180002b9d
mov rax, qword [rbp - 0x10]
mov dword [rax], 0x130
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32First
add rsp, 0x20
mov dword [rbp - 0x24], eax
mov eax, 0xea069934
jmp 0x180002b9d
cmp eax, 0x12472397
je 0x180002b6b
cmp eax, 0x1a64d2eb
je 0x180003234
cmp eax, 0x1a7a3de0
je 0x18000325a
jmp 0x180002b9d
cmp eax, 0xe4cd2cf0
je 0x18000324c
cmp eax, 0xe5d7847a
je 0x180003267
cmp eax, 0xe7905566
jne 0x180002b9d
mov eax, 0x76d52acc
jmp 0x180002b9d
cmp eax, 0x4f15722e
je 0x180003285
cmp eax, 0x54c02026
je 0x1800032aa
cmp eax, 0x5766bd97
jne 0x180002b9d
mov eax, 0x130
call fcn.180006480
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x20], rax
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x106dc667
cmove eax, r12d
cmp dword [0x18000a158], 0xa
cmovl eax, r12d
jmp 0x180002b9d
cmp eax, 0xcde35b16
je 0x1800032c8
cmp eax, 0xce5962ae
je 0x1800032e6
cmp eax, 0xd20c4374
jne 0x180002b9d
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4a59fac9
mov ecx, 0xcde35b16
jmp 0x180002b90
cmp eax, 0x3b6ea519
je 0x1800032f4
cmp eax, 0x416fe970
je 0x180003310
cmp eax, 0x41cc8c10
jne 0x180002b9d
sub rsp, 0x20
lea rcx, [0x18000834a]
call fcn.1800033d0
add rsp, 0x20
mov eax, 0xe4cd2cf0
jmp 0x180002b9d
cmp eax, 0xecc7a503
je 0x18000331a
cmp eax, 0xf0b51a36
je 0x18000333d
cmp eax, 0xf326586b
jne 0x180002b9d
mov rax, qword [rbp - 0x10]
mov r15d, dword [rax + 8]
mov eax, 0xf0b51a36
jmp 0x180002b9d
cmp eax, 0x5dc50158
je 0x180003363
cmp eax, 0x6c6c04c7
je 0x180003379
cmp eax, 0x76d52acc
jne 0x180002b9d
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe7905566
cmove eax, r14d
cmp dword [0x18000a158], 0xa
cmovl eax, r14d
jmp 0x180002b9d
cmp eax, 0xb550de9e
jne 0x18000338f
mov eax, 0x2226510c
jmp 0x180002b9d
mov rax, qword [rbp - 0x10]
mov eax, 0x3348706a
jmp 0x180002b9d
mov eax, 0x54c02026
jmp 0x180002b9d
mov eax, 0x5766bd97
jmp 0x180002b9d
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32Next
add rsp, 0x20
mov eax, 0xc30945fa
jmp 0x180002b9d
mov eax, 0x4c2ee75d
jmp 0x180002b9d
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3b6ea519
mov ecx, 0x589ca86d
jmp 0x180002b90
mov eax, 0xcde35b16
jmp 0x180002b9d
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32Next
add rsp, 0x20
test eax, eax
setne byte [rbp - 3]
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd41c1ec6
mov ecx, 0x241f81ca
jmp 0x180002b90
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xea3a190a
mov ecx, 0x5c42d7cb
jmp 0x180002b90
mov rcx, qword [rbp - 0x38]
sub rsp, 0x20
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
add rsp, 0x20
test eax, eax
mov eax, 0xc9a9a54d
mov ecx, 0x4407f86b
cmove eax, ecx
jmp 0x180002b9d
mov eax, 0x6c6c04c7
jmp 0x180002b9d
cmp dword [rbp - 0x24], 0
mov eax, 0x12472397
mov ecx, 0x41cc8c10
cmove eax, ecx
jmp 0x180002b9d
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
mov r8d, 0x130
xor edx, edx
call sub.VCRUNTIME140.dll_memset
add rsp, 0x20
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xecc7a503
mov ecx, 0xd8186412
jmp 0x180002b90
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 8]
mov dword [rbp - 0x28], eax
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3b6ea519
cmove eax, r13d
cmp dword [0x18000a158], 0xa
cmovl eax, r13d
jmp 0x180002b9d
mov eax, 0xf326586b
jmp 0x180002b9d
movzx ecx, byte [rbp - 1]
cmp byte [rbp - 2], 0
mov eax, 0x106dc667
mov edx, 0x5766bd97
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x180002b9d
mov rax, qword [rbp - 0x20]
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xecc7a503
mov ecx, 0xea1e33bc
jmp 0x180002b90
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov eax, 0xd20c4374
jmp 0x180002b9d
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov eax, 0xf0b51a36
xor r15d, r15d
jmp 0x180002b9d
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xea3a190a
mov ecx, 0xc6f25f6a
jmp 0x180002b90
mov rcx, qword [rbp - 0x38]
sub rsp, 0x20
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
add rsp, 0x20
test eax, eax
sete byte [rbp - 4]
mov eax, 0x5dc50158
jmp 0x180002b9d
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe7905566
mov ecx, 0x76d52acc
jmp 0x180002b90
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4a59fac9
mov ecx, 0xa07dc700
jmp 0x180002b90
mov eax, 0xf0b51a36
mov r15d, dword [rbp - 0x28]
jmp 0x180002b9d
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov eax, 0x589ca86d
jmp 0x180002b9d
mov eax, 0x5c6fcea2
jmp 0x180002b9d
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
mov r8d, 0x130
xor edx, edx
call sub.VCRUNTIME140.dll_memset
add rsp, 0x20
mov eax, 0xea1e33bc
jmp 0x180002b9d
mov dword [rbp - 0x2c], r15d
mov rax, qword [rbp - 0x20]
mov eax, dword [0x18000a154]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x416fe970
mov ecx, 0x5c6fcea2
jmp 0x180002b90
cmp byte [rbp - 4], 0
mov eax, 0xc9a9a54d
mov ecx, 0xe5d7847a
cmovne eax, ecx
jmp 0x180002b9d
cmp byte [rbp - 3], 0
mov eax, 0x1a64d2eb
mov ecx, 0x4f15722e
cmovne eax, ecx
jmp 0x180002b9d
cmp eax, 0xa1a8ac26
jne 0x180002b9d
mov esi, dword [rbp - 0x2c]
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.1800064e0
add rsp, 0x20
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret