Function at 0x140005384
Capabilities:
Enumerate processes
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
xor r14d, r14d
mov r15d, r14d
mov dword [rbp + 0x1e0], r14d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1400053d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140005410
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x1400053ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140005410
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x140005403
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140005410
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x1388
jae 0x14000541a
mov eax, 1
jmp 0x1400058a3
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x140023120]
movdqa xmmword [rbp], xmm1
movsd xmm0, qword [str.vmtoolsd.exe]
movsd qword [rbp - 0x10], xmm0
mov eax, dword [0x140022d80]
mov dword [rbp - 8], eax
mov byte [rbp - 4], r14b
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x140023140]
movdqa xmmword [rbp + 0x20], xmm1
movsd xmm0, qword [str.vboxservice.exe]
movsd qword [rbp + 0x10], xmm0
mov eax, dword [0x140022d90]
mov dword [rbp + 0x18], eax
movzx eax, word [0x140022d94]
mov word [rbp + 0x1c], ax
mov al, byte [0x140022d96]
mov byte [rbp + 0x1e], al
mov byte [rbp + 0x1f], r14b
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x140023130]
movdqa xmmword [rbp + 0x40], xmm1
movsd xmm0, qword [str.wireshark.exe]
movsd qword [rbp + 0x30], xmm0
mov eax, dword [0x140022da0]
mov dword [rbp + 0x38], eax
mov al, byte [0x140022da4]
mov byte [rbp + 0x3c], al
mov byte [rbp + 0x3d], r14b
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x50]
call fcn.1400059d0
nop
lea r9, [fcn.140005d58]
mov edx, 0x20
lea r8d, [rdx - 0x1d]
lea rcx, [rbp - 0x10]
call fcn.140006f98
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140005894
mov dword [rbp + 0x70], 0x130
lea rdx, [rbp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000588b
mov edi, 1
lea r13d, [rdi + 0xe]
mov rbx, qword [rbp + 0x50]
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x1e8], rax
cmp rbx, rax
je 0x140005876
mov rdx, rbx
cmp qword [rbx + 0x18], r13
jbe 0x140005567
mov rdx, qword [rbx]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x14000557a
lea rcx, [rbp - 0x30]
call fcn.140006044
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
lea rax, [rbp + 0x9c]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r14b
jne 0x1400055aa
lea rdx, [rbp + 0x9c]
lea rcx, [rsp + 0x50]
call fcn.140006044
nop
mov al, byte [0x140029c20]
mov byte [rbp + 0x1e0], al
mov rcx, qword [0x140029c68]
test rcx, rcx
je 0x1400058cf
mov rax, qword [rcx]
lea r9, [rbp + 0x1e0]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call qword [rax + 0x10]
or r15d, edi
mov rcx, qword [0x140029b18]
test rcx, rcx
je 0x1400058c9
mov rax, qword [rcx]
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
nop
mov al, byte [0x140029c20]
mov byte [rbp + 0x1e0], al
mov rcx, qword [0x140029c68]
test rcx, rcx
je 0x1400058ff
mov rax, qword [rcx]
lea r9, [rbp + 0x1e0]
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x70]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140029b18]
test rcx, rcx
je 0x1400058f9
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
call qword [rax + 0x10]
or r15d, 0xe
lea r9, [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
cmp rsi, r13
cmova r9, qword [rsp + 0x30]
lea rcx, [rsp + 0x70]
mov r14, qword [rsp + 0x70]
mov r13, qword [rbp - 0x78]
cmp r13, 0xf
cmova rcx, r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rdx, qword [rbp - 0x80]
call fcn.140005fa0
mov qword [rbp + 0x1e0], rax
cmp r13, 0xf
jbe 0x1400056ee
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400056e1
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400058d5
mov rcx, r14
call fcn.1400072a8
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
mov qword [rbp - 0x80], r14
lea r13d, [r14 + 0xf]
mov qword [rbp - 0x78], r13
mov byte [rsp + 0x70], r14b
mov rdx, qword [rbp - 0x58]
cmp rdx, r13
jbe 0x140005741
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005737
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400058db
call fcn.1400072a8
mov rsi, qword [rsp + 0x48]
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r13
mov byte [rbp - 0x70], r14b
cmp rsi, r13
jbe 0x140005788
lea rdx, [rsi + 1]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
mov esi, 0x1000
cmp rdx, rsi
jb 0x140005781
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400058e1
call fcn.1400072a8
jmp 0x14000578d
mov esi, 0x1000
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x30], r14b
mov rdx, qword [rbp - 0x38]
cmp rdx, r13
jbe 0x1400057d2
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, rsi
jb 0x1400057cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400058e7
call fcn.1400072a8
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r13
mov byte [rbp - 0x50], r14b
mov rdx, qword [rsp + 0x68]
cmp rdx, r13
jbe 0x140005816
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, rsi
jb 0x140005811
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400058ed
call fcn.1400072a8
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r13
mov byte [rsp + 0x50], r14b
mov rdx, qword [rbp - 0x18]
cmp rdx, r13
jbe 0x14000585b
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, rsi
jb 0x140005856
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400058f3
call fcn.1400072a8
cmp qword [rbp + 0x1e0], 0xffffffffffffffff
jne 0x1400058be
add rbx, 0x20
cmp rbx, qword [rbp + 0x1e8]
jne 0x14000555b
lea rdx, [rbp + 0x70]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005543
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dil, r14b
lea rcx, [rbp + 0x50]
call fcn.140005ed4
mov al, dil
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005897
call fcn.140006e58
nop
call fcn.140006e58
nop
call fcn.14000d1a0
nop
call fcn.14000d1a0
nop
call fcn.14000d1a0
nop
call fcn.14000d1a0
nop
call fcn.14000d1a0
nop
call fcn.14000d1a0
nop
call fcn.140006e58
nop
call fcn.140006e58
int3
jmp 0x140005384