Function at 0x140056760
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
xor r15d, r15d
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056806
nop dword [rax + rax]
lea rdx, [0x1400ef550]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x1400567e4
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x1400567e4
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400567c0
test edi, edi
je 0x140056806
lea rax, [0x1400ef550]
jmp 0x140056e7c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005688a
lea rdx, [0x1400ef570]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140056868
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056868
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056844
test edi, edi
je 0x14005688a
lea rax, [0x1400ef570]
jmp 0x140056e7c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056916
nop dword [rax + rax]
lea rdx, [0x1400ef588]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x1400568f4
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x1400568f4
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400568d0
test edi, edi
je 0x140056916
lea rax, [0x1400ef588]
jmp 0x140056e7c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005699a
lea rdx, [0x1400ef5a0]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140056978
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056978
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056954
test edi, edi
je 0x14005699a
lea rax, [0x1400ef5a0]
jmp 0x140056e7c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056a26
nop dword [rax + rax]
lea rdx, [0x1400ef5b8]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140056a04
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056a04
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400569e0
test edi, edi
je 0x140056a26
lea rax, [0x1400ef5b8]
jmp 0x140056e7c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056aaa
lea rdx, [0x1400ef6c8]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140056a88
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056a88
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056a64
test edi, edi
je 0x140056aaa
lea rax, [0x1400ef6c8]
jmp 0x140056e7c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056b36
nop dword [rax + rax]
lea rdx, [0x1400ef6d8]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140056b14
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056b14
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056af0
test edi, edi
je 0x140056b36
lea rax, [0x1400ef6d8]
jmp 0x140056e7c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056bba
lea rdx, [0x1400ef6e8]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140056b98
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056b98
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056b74
test edi, edi
je 0x140056bba
lea rax, [0x1400ef6e8]
jmp 0x140056e7c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056c46
nop dword [rax + rax]
lea rdx, [0x1400ef6f8]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140056c24
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056c24
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056c00
test edi, edi
je 0x140056c46
lea rax, [0x1400ef6f8]
jmp 0x140056e7c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056cca
lea rdx, [0x1400ef708]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140056ca8
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056ca8
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056c84
test edi, edi
je 0x140056cca
lea rax, [0x1400ef708]
jmp 0x140056e7c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056d56
nop dword [rax + rax]
lea rdx, [0x1400ef720]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140056d34
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056d34
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056d10
test edi, edi
je 0x140056d56
lea rax, [0x1400ef720]
jmp 0x140056e7c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056dda
lea rdx, [0x1400ef730]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140056db8
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056db8
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056d94
test edi, edi
je 0x140056dda
lea rax, [0x1400ef730]
jmp 0x140056e7c
xor edx, edx
mov qword [rsp + 0x170], r14
mov ecx, 2
mov esi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056e6d
lea rdi, [0x1400ef740]
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140056e50
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056e50
mov esi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056e30
test esi, esi
cmove r15, rdi
mov rax, r15
jmp 0x140056e74
lea rax, [0x1400ef740]
mov r14, qword [rsp + 0x170]
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret