Function at 0x14002f150
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x1400a0008]
xor rax, rsp
mov qword [rbp + 0x180], rax
lea rbx, str.MaxxAudioProApp.exe
xor r14b, r14b
call fcn.1400018d0
mov rcx, rax
test rax, rax
jne 0x14002f1b2
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x20], rdi
test rbx, 0xffffffffffff0000
jne 0x14002f1eb
movzx ebx, bx
mov ecx, ebx
call fcn.140010fd0
test rax, rax
je 0x14002f203
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140012dd0
jmp 0x14002f1fe
mov r8d, 0x13
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14000c890
mov rdi, qword [rsp + 0x20]
movsxd rbx, dword [rdi - 0x10]
or rsi, 0xffffffffffffffff
test ebx, ebx
je 0x14002f441
jns 0x14002f220
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x14002f242
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.14000c830
mov rdi, qword [rsp + 0x20]
lea eax, [rbx + 1]
movsxd rdx, eax
mov rcx, rdi
call fcn.140065cc8
test eax, eax
je 0x14002f289
cmp eax, 0xc
je 0x14002f27e
cmp eax, 0x16
je 0x14002f273
cmp eax, 0x22
je 0x14002f273
cmp eax, 0x50
je 0x14002f289
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
int3
cmp ebx, dword [rdi - 0xc]
jg 0x14002f436
mov dword [rdi - 0x10], ebx
mov byte [rbx + rdi], 0
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14002f441
mov dword [rsp + 0x40], 0x130
xor edx, edx
mov r8d, 0x12c
lea rcx, [rsp + 0x44]
call fcn.14005b890
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14002f42b
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x14002f40d
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x70]
call fcn.14005b890
mov dword [rsp + 0x30], 0x104
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x70]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
test eax, eax
je 0x14002f3ff
call fcn.1400018d0
mov rcx, rax
test rax, rax
je 0x14002f420
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0x70]
lea rax, [rbp + 0x70]
test rax, 0xffffffffffff0000
jne 0x14002f385
movzx ebx, cx
mov ecx, ebx
call fcn.140010fd0
test rax, rax
je 0x14002f3ab
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140012dd0
jmp 0x14002f3ab
lea rcx, [rbp + 0x70]
mov rax, rsi
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14002f390
mov r8d, eax
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.14000c890
nop
lea rcx, [rsp + 0x28]
call fcn.140022050
mov rbx, qword [rsp + 0x28]
cmp dword [rbx - 0x10], 0
jge 0x14002f3c4
mov eax, esi
jmp 0x14002f3da
mov rdx, rdi
mov rcx, rbx
call fcn.140060564
test rax, rax
jne 0x14002f3d8
mov eax, esi
jmp 0x14002f3da
sub eax, ebx
cmp eax, 0xffffffff
setne r14b
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002f3fa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x20]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14b, r14b
jne 0x14002f42b
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x14002f2d9
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002f441
mov ecx, 0x80070057
call fcn.1400015b0
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14002f459
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
movzx eax, r14b
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14003aa30
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret