Function at 0x18005c4c0
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x310
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x358], rbx
mov rax, qword [0x1801610c0]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov r15, r8
mov r12d, edx
mov r14, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x38], edx
mov qword [rsp + 0x50], r8
mov r9d, dword [rcx + 0x20]
test r9d, r9d
je 0x18005c7f8
sub r9d, 1
je 0x18005c54a
sub r9d, 1
je 0x18005c52f
cmp r9d, 1
jne 0x18005c702
jmp 0x18005c54a
call fcn.18000ae80
test rax, rax
je 0x18005c7f8
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov eax, eax
jmp 0x18005c551
mov rax, qword [rcx]
movsxd rax, dword [rax - 0x10]
test rax, rax
je 0x18005c7f8
mov rcx, r15
call fcn.18005d570
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov qword [rsp + 0x30], rax
inc rax
test rax, 0xfffffffffffffffe
je 0x18005c71d
xor esi, esi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0xc0], 0x238
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x18005c600
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18005c723
mov qword [rsp + 0x40], rsi
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.1800916f0
mov rbx, qword [rsp + 0x358]
add rsp, 0x310
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rcx, r14
call fcn.18000b370
lea rdx, [rsp + 0xec]
mov rcx, qword [rax]
call fcn.1800c30d0
test eax, eax
jne 0x18005c6a6
lea ecx, [rax + 8]
call fcn.180091eb0
mov qword [rsp + 0x60], rax
test rax, rax
je 0x18005c646
mov r8d, r12d
mov edx, dword [rsp + 0xc8]
mov rcx, rax
call fcn.18005ac60
jmp 0x18005c649
mov rax, rsi
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18005c77d
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.18005b030
nop
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x68], rdi
test rdi, rdi
je 0x18005c689
mov rcx, rdi
call fcn.18003e6e0
mov edx, 8
mov rcx, rdi
call fcn.180091f20
mov qword [rsp + 0x30], rsi
jmp 0x18005c6a6
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x18005c600
cmp qword [r15 + 0x10], 0
setne dil
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18005c6f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18005c798
mov qword [rsp + 0x40], rsi
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, dil
jmp 0x18005c5d6
xor r9d, r9d
mov r8d, 0x12b
lea rdx, str.c:dvsp4_build_sw_relgpu_drvinstaller_coreinstaller_core_vs2017incAutoString.h
mov ecx, 0xe0e00000
call fcn.18003abe0
nop
call fcn.180039260
nop
call fcn.1800391e0
mov ecx, eax
lea r9, str.WinAPI
mov r8d, 0x47
lea rdx, [0x18011ae00]
call fcn.1800391c0
lea rax, str.WinAPI_FALSE___NO_ERROR
mov qword [rsp + 0x20], rax
mov r9d, 0x47
lea r8, [0x18011ae00]
mov edx, 0x80004005
lea rcx, [rsp + 0x78]
call fcn.18003a640
lea rdx, [0x18015e3c8]
lea rcx, [rsp + 0x78]
call fcn.1800b2060
nop
xor r9d, r9d
mov r8d, 0x104
lea rdx, str.NVProcess.cpp
mov ecx, 0x80004003
call fcn.18003abe0
nop
call fcn.1800391e0
mov ecx, eax
lea r9, str.WinAPI
mov r8d, 0x47
lea rdx, [0x18011ae00]
call fcn.1800391c0
lea rax, str.WinAPI_FALSE___NO_ERROR
mov qword [rsp + 0x20], rax
mov r9d, 0x47
lea r8, [0x18011ae00]
mov edx, 0x80004005
lea rcx, [rsp + 0x98]
call fcn.18003a640
lea rdx, [0x18015e3c8]
lea rcx, [rsp + 0x98]
call fcn.1800b2060
int3
xor r9d, r9d
mov r8d, 0xe4
lea rdx, str.NVProcess.cpp
mov ecx, 0x80070057
call fcn.18003abe0
int3