Function at 0x140067930
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1fd0
call fcn.1400e2af0
sub rsp, rax
mov qword [rsp + 0x1d8], 0xfffffffffffffffe
mov qword [rsp + 0x2010], rbx
mov qword [rsp + 0x2018], rsi
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x1fc0], rax
mov rsi, rdx
mov qword [rsp + 0x108], rcx
mov r14, qword [0x140183698]
mov qword [rsp + 0xd0], r14
lea r15, vtable.CLockMgr_class_CMutexWrapper_.0
mov qword [rsp + 0x178], r15
lea rdi, [r14 + 0x140]
mov qword [rsp + 0x180], rdi
mov dword [rsp + 0x188], 1
or ebx, 0xffffffff
cmp qword [rdi], 0
je 0x1400679dd
call qword [sym.imp.USER32.dll_InSendMessage]
mov ecx, 0x2710
test eax, eax
cmovne ebx, ecx
mov edx, ebx
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
test rsi, rsi
je 0x140067a61
test rsi, 0xffffffffffff0000
jne 0x140067a47
movzx edi, si
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x140067a3e
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400029f0
xor r13d, r13d
or rbx, 0xffffffffffffffff
jmp 0x140067a7c
xor eax, eax
or rbx, 0xffffffffffffffff
mov rcx, rbx
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
xor r13d, r13d
jmp 0x140067a6b
xor r13d, r13d
mov ecx, r13d
or rbx, 0xffffffffffffffff
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140002120
nop
mov byte [rsp + 0x50], 0
cmp dword [r14 + 0x188], 0
jne 0x140067ddf
lea r8, [rsp + 0x84]
mov edx, 0x1000
lea rcx, [rsp + 0x590]
call qword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x140067af1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x19c], eax
test eax, eax
jle 0x140067ac7
movzx eax, ax
or eax, 0x80070000
lea r8, str.EnumProcesses_Pids__sizeof_DWORD_1024__cbNeeded_
mov edx, eax
lea rcx, [rsp + 0x2a0]
call fcn.140058db0
lea rdx, [0x140176c18]
lea rcx, [rsp + 0x2a0]
call fcn.1400de560
mov qword [rsp + 0xb8], r13
mov ecx, dword [rsp + 0x84]
shr ecx, 2
mov dword [rsp + 0x90], ecx
mov eax, r13d
mov dword [rsp + 0x80], eax
cmp eax, ecx
jae 0x1400682c5
mov r8d, dword [rsp + rax*4 + 0x590]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov qword [rsp + 0xb8], rax
test rax, rax
jne 0x140067b86
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xf0], eax
test eax, eax
jg 0x140067b54
jmp 0x140067b5c
movzx eax, ax
or eax, 0x80070000
lea r8, str.hProcess
mov edx, eax
lea rcx, [rsp + 0x280]
call fcn.140058db0
lea rdx, [0x140176c18]
lea rcx, [rsp + 0x280]
call fcn.1400de560
lea r9, [rsp + 0x84]
mov r8d, 8
lea rdx, [rsp + 0x148]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
jne 0x140067bee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1a8], eax
test eax, eax
jg 0x140067bbc
jmp 0x140067bc4
movzx eax, ax
or eax, 0x80070000
lea r8, str.EnumProcessModules_hProcess__hModule__sizeof_hModule___cbNeeded_
mov edx, eax
lea rcx, [rsp + 0x220]
call fcn.140058db0
lea rdx, [0x140176c18]
lea rcx, [rsp + 0x220]
call fcn.1400de560
mov r9d, 0x104
lea r8, [rsp + 0x1bb0]
mov rdx, qword [rsp + 0x148]
mov rcx, rsi
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x140067c56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x100], eax
test eax, eax
jg 0x140067c24
jmp 0x140067c2c
movzx eax, ax
or eax, 0x80070000
lea r8, str.GetModuleFileNameExW_hProcess__hModule__szFileName__260_
mov edx, eax
lea rcx, [rsp + 0x240]
call fcn.140058db0
lea rdx, [0x140176c18]
lea rcx, [rsp + 0x240]
call fcn.1400de560
mov qword [rsp + 0x40], 0x100
lea rax, [rsp + 0x17a0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x100
lea rax, [rsp + 0x15a0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x100
lea r9, [rsp + 0x1dc0]
mov r8d, 3
lea rdx, [rsp + 0x1590]
lea rcx, [rsp + 0x1bb0]
call fcn.1400d567c
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
mov qword [rsp + 0x200], rax
add rax, 0x18
mov qword [rsp + 0xa8], rax
lea r9, [rsp + 0x17a0]
lea r8, [rsp + 0x15a0]
lea rdx, [0x14012ffb8]
lea rcx, [rsp + 0xa8]
call fcn.140016060
mov eax, r13d
cmp qword [rsp + 0x60], 0
setne al
mov dword [rsp + 0x1b0], eax
test eax, eax
jne 0x140067d18
mov ecx, 0x80004005
call fcn.1400022b0
mov rdx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0xa8]
mov rcx, rdi
call fcn.1400d519c
mov dword [rsp + 0x110], eax
test eax, eax
jne 0x140067d72
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rdi, 0xffffffffffffffe8
mov qword [rsp + 0x1c8], rdi
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x140067d6d
mov rdx, qword [rsp + 0x1c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
jmp 0x1400682c5
add rdi, 0xffffffffffffffe8
mov qword [rsp + 0x158], rdi
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x140067d9d
mov rdx, qword [rsp + 0x158]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
jmp 0x140067db5
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
mov ecx, dword [rsp + 0x90]
jmp 0x140067b14
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0xb0], rax
cmp rax, 0xffffffffffffffff
je 0x1400684a4
mov dword [rsp + 0x350], 0x238
lea rdx, [rsp + 0x350]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [rsp + 0x98], eax
nop
test eax, eax
je 0x1400682b7
mov r8d, dword [rsp + 0x358]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x14006828a
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
mov qword [rsp + 0x1f0], rax
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x1bb0]
lea rcx, [rsp + 0x58]
call fcn.140002ad0
nop
mov esi, r13d
mov dword [rsp + 0x9c], r13d
mov edi, r13d
mov dword [rsp + 0x68], r13d
mov rax, qword [rsp + 0x58]
nop
cmp esi, 3
jge 0x140067f09
mov ecx, dword [rax - 0x10]
mov dword [rsp + 0x1c0], ecx
test edi, edi
js 0x140067eed
cmp edi, ecx
jge 0x140067eed
mov edx, 0x5c
movsxd rcx, edi
lea rcx, [rax + rcx*2]
call fcn.1400d7e68
mov rdi, rax
mov qword [rsp + 0x210], rax
test rax, rax
mov rax, qword [rsp + 0x58]
jne 0x140067ee1
mov edi, ebx
jmp 0x140067ee7
sub rdi, rax
sar rdi, 1
mov dword [rsp + 0x68], edi
jmp 0x140067ef3
mov edi, ebx
mov dword [rsp + 0x68], ebx
inc esi
mov dword [rsp + 0x9c], esi
cmp edi, 0xffffffff
je 0x140067f09
inc edi
mov dword [rsp + 0x68], edi
jmp 0x140067ea0
mov word [rsp + 0x19a0], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x19a2]
call fcn.1400dd9f0
lea r8d, [rdi - 1]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x58]
call fcn.140014360
nop
mov r8d, 0x104
lea rdx, [rsp + 0x19a0]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.FLTLIB.DLL_FilterGetDosName]
mov dword [rsp + 0x1d0], eax
test eax, eax
jne 0x1400681ee
mov rax, qword [rsp + 0x58]
mov r8d, dword [rax - 0x10]
mov dword [rsp + 0x128], r8d
sub r8d, edi
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x58]
call fcn.140016140
nop
mov r9, qword [rax]
lea r8, [rsp + 0x19a0]
lea rdx, [0x14012f290]
lea rcx, [rsp + 0x70]
call fcn.140016060
nop
mov rcx, qword [rsp + 0x1a0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xd8], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x140067fdf
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 0x18]
mov qword [rsp + 0x1e0], rax
cmp dword [rax + 0x10], 1
jle 0x140068008
mov edx, dword [rax + 8]
lea rcx, [rsp + 0x70]
call fcn.140001fb0
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x40], 0x100
lea rax, [rsp + 0x17a0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x100
lea rax, [rsp + 0x15a0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x100
lea r9, [rsp + 0x1dc0]
mov r8d, 3
lea rdx, [rsp + 0x1590]
call fcn.1400d567c
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
mov qword [rsp + 0x1e8], rax
add rax, 0x18
mov qword [rsp + 0xc8], rax
lea r9, [rsp + 0x17a0]
lea r8, [rsp + 0x15a0]
lea rdx, [0x14012ffb8]
lea rcx, [rsp + 0xc8]
call fcn.140016060
mov ecx, r13d
mov rdx, qword [rsp + 0x60]
test rdx, rdx
setne cl
mov dword [rsp + 0x1ac], ecx
test ecx, ecx
jne 0x1400680c4
mov ecx, 0x80004005
call fcn.1400022b0
mov rdi, qword [rsp + 0xc8]
mov rcx, rdi
call fcn.1400d519c
mov dword [rsp + 0x138], eax
test eax, eax
jne 0x1400681bc
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x50], 1
add rdi, 0xffffffffffffffe8
mov qword [rsp + 0x168], rdi
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x140068121
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x1b8], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x140068154
mov rdx, qword [rsp + 0x1b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x118], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x140068184
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x120], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x1400682b7
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x1400682b7
add rdi, 0xffffffffffffffe8
mov qword [rsp + 0x130], rdi
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x1400681e6
mov rdx, qword [rsp + 0x130]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r12, qword [rsp + 0x88]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x140], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x14006822b
mov rdx, qword [rsp + 0x140]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x150], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x14006825b
mov rdx, qword [rsp + 0x150]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x160], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x14006828a
mov rdx, qword [rsp + 0x160]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov dword [rsp + 0x350], 0x238
lea rdx, [rsp + 0x350]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [rsp + 0x98], eax
jmp 0x140067e20
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0x50], 0
je 0x1400684a4
lea r9, [0x14012ba88]
lea r8, [rsp + 0x15a0]
lea rdx, [0x140130668]
lea rcx, [rsp + 0x78]
call fcn.140016060
lea rcx, [rsp + 0x300]
call fcn.14009b8c0
nop
lea rdx, [0x140130674]
lea rcx, [rsp + 0xc0]
call fcn.140035370
nop
lea rdx, [r14 + 0x110]
lea r8, [rsp + 0xc0]
lea rcx, [rsp + 0xe0]
call fcn.14001cad0
nop
lea r8, [rsp + 0x78]
mov rdx, rax
lea rcx, [rsp + 0x170]
call fcn.14001cad0
mov qword [rsp + 0x1f8], rax
mov rdi, qword [rax]
mov qword [rsp + 0x208], rdi
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rsp + 0x1bb0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsp + 0x218], rax
test rax, rax
jne 0x140068381
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140068394
mov r8, rax
mov rdx, rdi
lea rcx, [rsp + 0x300]
call fcn.14009b910
mov dword [rsp + 0x94], eax
test eax, eax
setne byte [rsp + 0x51]
mov rcx, qword [rsp + 0x170]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x190], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x1400683d5
mov rdx, qword [rsp + 0x190]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rcx, qword [rsp + 0xe0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xe8], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x140068408
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rcx, qword [rsp + 0xc0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xf8], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x14006843a
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
cmp byte [rsp + 0x51], 0
je 0x140068485
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x198], eax
test eax, eax
jle 0x14006845a
movzx eax, ax
or eax, 0x80070000
lea r8, str.ie.ExtractIconFromExe_szFileName__m_strIconLogPath______strIconFileName__0___0L
mov edx, eax
lea rcx, [rsp + 0x260]
call fcn.140058db0
lea rdx, [0x140176c18]
lea rcx, [rsp + 0x260]
call fcn.1400de560
nop
lea r9, [fcn.14005d820]
mov edx, 8
lea r8d, [rdx - 3]
lea rcx, [rsp + 0x318]
call fcn.1400d9874
jmp 0x14006851a
mov qword [rsp + 0x40], 0x100
lea rax, [rsp + 0x17a0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x100
lea rax, [rsp + 0x15a0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x100
lea r9, [rsp + 0x1dc0]
mov r8d, 3
lea rdx, [rsp + 0x1590]
mov rcx, qword [rsp + 0x60]
call fcn.1400d567c
lea r9, [0x14012ba88]
lea r8, [rsp + 0x15a0]
lea rdx, [0x140130668]
lea rcx, [rsp + 0x78]
call fcn.140016060
nop
jmp 0x14006852f
mov r8, qword [rsp + 0x78]
mov rdx, qword [r14 + 0x110]
mov rcx, qword [rsp + 0x108]
call fcn.1400729a0
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140068569
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x140068587
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov qword [rsp + 0x178], r15
cmp dword [rsp + 0x188], 0
je 0x1400685af
mov rcx, qword [rsp + 0x180]
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400685af
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, 1
mov rcx, qword [rsp + 0x1fc0]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0x1fd0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret