Function at 0x1800094d0
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x180049170]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r15d, edx
mov rsi, rcx
mov qword [rsp + 0x30], rcx
xor r13d, r13d
call fcn.18000bdcc
mov rcx, rax
mov eax, r13d
test rcx, rcx
setne al
test eax, eax
jne 0x180009538
mov ecx, 0x80004005
call fcn.180001030
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.180002310
nop
mov rcx, qword [rsp + 0x20]
movsxd rdi, dword [rcx - 0x10]
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, edi
or eax, edx
jge 0x180009580
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.180001410
mov rcx, qword [rsp + 0x20]
lea eax, [rdi + 1]
movsxd rdx, eax
call fcn.18001fc54
test eax, eax
je 0x1800095b5
cmp eax, 0xc
je 0x1800095af
cmp eax, 0x16
je 0x1800095a9
cmp eax, 0x22
je 0x1800095a9
cmp eax, 0x50
je 0x1800095b5
call fcn.18000bbfc
int3
call fcn.18000bbfc
int3
call fcn.18000bbb4
int3
test edi, edi
js 0x180009840
mov rax, qword [rsp + 0x20]
cmp edi, dword [rax - 0xc]
jg 0x180009840
mov dword [rax - 0x10], edi
mov rax, qword [rsp + 0x20]
mov byte [rdi + rax], 0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
or r12, 0xffffffffffffffff
test rax, rax
je 0x1800097fa
mov dword [rsp + 0x40], 0x130
lea rdx, [rsp + 0x40]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1800097f0
nop
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x6c]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x18000967d
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1800096fb
cmp dword [rdx + 0x10], eax
jge 0x180009652
cmp dword [rbx - 0xc], eax
jl 0x1800097af
mov dword [rbx - 0x10], r13d
mov byte [rbx], al
jmp 0x1800096fb
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180009669
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
jmp 0x1800096fb
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0x6c]
sub rbp, rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1800096aa
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.180001410
mov rbx, qword [rsp + 0x28]
cmp rbp, rsi
ja 0x1800096c7
movsxd rsi, edi
lea r8, [rbx + rbp]
movsxd rdx, dword [rbx - 0xc]
mov r9, rsi
mov rcx, rbx
call fcn.18001cb58
jmp 0x1800096de
movsxd rsi, edi
movsxd rdx, dword [rbx - 0xc]
mov r9, rsi
lea r8, [rsp + 0x6c]
mov rcx, rbx
call fcn.18001cac0
test edi, edi
js 0x1800097e5
cmp edi, dword [rbx - 0xc]
jg 0x1800097e5
mov dword [rbx - 0x10], edi
mov byte [rsi + rbx], 0
mov rsi, qword [rsp + 0x30]
test r15d, r15d
je 0x18000978a
movsxd rdi, dword [rbx - 0x10]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x18000972a
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.180001410
mov rbx, qword [rsp + 0x28]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.18001fc54
test eax, eax
je 0x180009754
cmp eax, 0xc
je 0x1800097c6
cmp eax, 0x16
je 0x1800097c0
cmp eax, 0x22
je 0x1800097c0
cmp eax, 0x50
jne 0x1800097ba
test edi, edi
js 0x1800097d3
cmp edi, dword [rbx - 0xc]
jg 0x1800097d3
mov dword [rbx - 0x10], edi
mov byte [rdi + rbx], 0
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x180009799
cmp dword [rbx - 0x10], 0
jl 0x180009799
mov rcx, rbx
call fcn.18001e0a4
test rax, rax
je 0x180009799
sub eax, ebx
cmp eax, 0xffffffff
jne 0x1800097cc
jmp 0x180009799
mov rdx, rsi
mov rcx, rbx
call fcn.1800203d8
test eax, eax
je 0x1800097de
lea rdx, [rsp + 0x40]
mov rcx, r14
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1800097f0
jmp 0x180009610
mov ecx, 0x80070057
call fcn.180001030
int3
call fcn.18000bbfc
int3
call fcn.18000bbfc
int3
call fcn.18000bbb4
int3
mov r13d, dword [rsp + 0x48]
jmp 0x1800097f0
mov ecx, 0x80070057
call fcn.180001030
int3
mov r13d, dword [rsp + 0x48]
jmp 0x1800097f0
mov ecx, 0x80070057
call fcn.180001030
int3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000981b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x18000983b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r13d
jmp 0x18000984b
mov ecx, 0x80070057
call fcn.180001030
nop
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18001d8a0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret