Function at 0x1400565b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
xor r15d, r15d
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056656
nop dword [rax + rax]
lea rdx, [0x1400ec4b0]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x140056634
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056634
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056610
test edi, edi
je 0x140056656
lea rax, [0x1400ec4b0]
jmp 0x140056ccc
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400566da
lea rdx, [0x1400ec4d0]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x1400566b8
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x1400566b8
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056694
test edi, edi
je 0x1400566da
lea rax, [0x1400ec4d0]
jmp 0x140056ccc
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056766
nop dword [rax + rax]
lea rdx, [0x1400ec4e8]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x140056744
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056744
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056720
test edi, edi
je 0x140056766
lea rax, [0x1400ec4e8]
jmp 0x140056ccc
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400567ea
lea rdx, [0x1400ec500]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x1400567c8
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x1400567c8
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400567a4
test edi, edi
je 0x1400567ea
lea rax, [0x1400ec500]
jmp 0x140056ccc
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056876
nop dword [rax + rax]
lea rdx, [0x1400ec518]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x140056854
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056854
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056830
test edi, edi
je 0x140056876
lea rax, [0x1400ec518]
jmp 0x140056ccc
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400568fa
lea rdx, [0x1400ec628]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x1400568d8
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x1400568d8
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400568b4
test edi, edi
je 0x1400568fa
lea rax, [0x1400ec628]
jmp 0x140056ccc
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056986
nop dword [rax + rax]
lea rdx, [0x1400ec638]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x140056964
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056964
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056940
test edi, edi
je 0x140056986
lea rax, [0x1400ec638]
jmp 0x140056ccc
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056a0a
lea rdx, [0x1400ec648]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x1400569e8
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x1400569e8
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400569c4
test edi, edi
je 0x140056a0a
lea rax, [0x1400ec648]
jmp 0x140056ccc
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056a96
nop dword [rax + rax]
lea rdx, [0x1400ec658]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x140056a74
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056a74
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056a50
test edi, edi
je 0x140056a96
lea rax, [0x1400ec658]
jmp 0x140056ccc
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056b1a
lea rdx, [0x1400ec668]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x140056af8
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056af8
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056ad4
test edi, edi
je 0x140056b1a
lea rax, [0x1400ec668]
jmp 0x140056ccc
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056ba6
nop dword [rax + rax]
lea rdx, [0x1400ec680]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x140056b84
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056b84
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056b60
test edi, edi
je 0x140056ba6
lea rax, [0x1400ec680]
jmp 0x140056ccc
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056c2a
lea rdx, [0x1400ec690]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x140056c08
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056c08
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056be4
test edi, edi
je 0x140056c2a
lea rax, [0x1400ec690]
jmp 0x140056ccc
xor edx, edx
mov qword [rsp + 0x170], r14
mov ecx, 2
mov esi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140056cbd
lea rdi, [0x1400ec6a0]
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x140056ca0
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140056ca0
mov esi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140056c80
test esi, esi
cmove r15, rdi
mov rax, r15
jmp 0x140056cc4
lea rax, [0x1400ec6a0]
mov r14, qword [rsp + 0x170]
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret