Function at 0x14007a340
Capabilities:
Enumerate processes

Disassembly:
push r14
push r15
sub rsp, 0xab8
xor edx, edx
mov dword [rsp + 0x30], 0x238
mov r15, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rdx, r15
movzx ecx, word [rdx]
cmp cx, 0x20
je 0x14007a384
cmp cx, 9
jne 0x14007a38a
add rdx, 2
jmp 0x14007a375
mov qword [rsp + 0xad0], rbx
mov qword [rsp + 0xad8], rbp
mov qword [rsp + 0xae0], rsi
mov qword [rsp + 0xab0], rdi
test cx, cx
je 0x14007a48e
xor esi, esi
cmp cx, 0x2d
je 0x14007a4b6
movzx eax, cx
cmp cx, 0x2b
jne 0x14007a3cc
movzx eax, word [rdx + 2]
lea rdi, [rdx + 2]
cmovne rdi, rdx
cmp ax, 0x30
jne 0x14007a405
movzx eax, word [rdi + 2]
mov ecx, 0xffdf
sub ax, 0x58
test cx, ax
jne 0x14007a405
movzx ecx, word [rdi + 4]
lea rbx, [rdi + 4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isxdigit]
test eax, eax
je 0x14007a405
mov ebp, 1
jmp 0x14007a40b
mov ebp, esi
lea rbx, [rdi + 4]
test ebp, ebp
mov ecx, esi
cmove rbx, rdi
movzx edi, word [rbx]
cmp edi, 0x20
je 0x14007a470
nop dword [rax + rax]
cmp edi, 9
je 0x14007a470
test edi, edi
je 0x14007a48a
cmp edi, 0x2e
je 0x14007a4b6
test ebp, ebp
je 0x14007a454
movzx ecx, di
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswxdigit]
test eax, eax
mov ecx, esi
sete cl
test ecx, ecx
je 0x14007a45c
movzx ecx, di
call fcn.14000d150
jmp 0x14007a4b6
lea eax, [rdi - 0x30]
cmp eax, 9
ja 0x14007a44a
movzx edi, word [rbx + 2]
add rbx, 2
mov ecx, 1
cmp edi, 0x20
jne 0x14007a420
nop
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14007a47f
cmp ax, 9
jne 0x14007a485
add rbx, 2
jmp 0x14007a470
test ax, ax
jne 0x14007a4b6
test ecx, ecx
je 0x14007a4b6
mov rcx, r15
call fcn.140012eb0
mov rcx, r15
test al, al
je 0x14007a4ae
xor edx, edx
lea r8d, [rdx + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wcstoi64]
mov rsi, rax
jmp 0x14007a4b6
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi64]
mov esi, eax
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov rdi, qword [rsp + 0xab0]
mov rbp, qword [rsp + 0xad8]
mov rbx, qword [rsp + 0xad0]
test eax, eax
je 0x14007a58d
test esi, esi
je 0x14007a4f2
cmp esi, dword [rsp + 0x38]
je 0x14007a5ac
lea rax, [rsp + 0x480]
lea r9, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x690]
lea rdx, [rsp + 0x8a0]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath]
lea rax, [rsp + 0x270]
sub rax, 2
nop
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x14007a530
lea r8, [rsp + 0x480]
xor edx, edx
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x14007a550
mov rdx, r15
lea rcx, [rsp + 0x270]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, r14
test eax, eax
je 0x14007a5cb
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14007a4e4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret