Function at 0x140046ee0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
xor edi, edi
mov ebx, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rsp + 0x50], 0x130
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140046fe8
nop dword [rax]
lea rdx, str.HD_Player.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
je 0x140046fc4
lea rdx, str.LdVBoxHeadless.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
je 0x140046fc4
lea rdx, str.MEmuHeadless.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
je 0x140046fc4
lea rdx, str.AndroidProcess.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
je 0x140046fc4
lea rdx, str.AndroidEmulatorEx
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
je 0x140046fc4
lea rdx, str.aow_exe.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x140046fd2
mov eax, dword [rsp + 0x6c]
cmp eax, ebx
jbe 0x140046fd2
mov edi, dword [rsp + 0x58]
mov ebx, eax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140046f40
mov dword [0x1401b3b48], edi
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x1f8
mov eax, dword [rcx + rdi]
mov ebx, 0x838
add rbx, rdi
test al, 1
jne 0x140047038
or eax, 1
mov dword [rcx + rdi], eax
mov word [rbx + 9], 0x1c1
mov dword [rbx], 0x5717b54b
mov dword [rbx + 4], 0x673bdb47
mov byte [rbx + 8], 0x49
lea rcx, [0x1400eedd0]
call fcn.1400e75cc
nop
cmp byte [rbx + 0xa], 0
je 0x140047059
mov edx, 0xa
movabs r8, 0xb5ff52b3b73c125
mov rcx, rbx
call fcn.140046a30
mov byte [rbx + 0xa], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x1400471ed
movdqa xmm0, xmmword [0x140112550]
mov dword [rsp + 0x48], 0xd045b82a
mov ecx, 0x954
mov eax, dword [rcx + rdi]
mov ebx, 0xa48
test al, 1
jne 0x1400470e0
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rdi + rbx]
mov byte [rcx + 0x15], 1
lea rax, [rcx + 0x14]
lea rdx, [rsp + 0x4c]
cmp rcx, rdx
ja 0x1400470c5
lea rdx, [rsp + 0x38]
cmp rax, rdx
jb 0x1400470c5
movups xmmword [rcx], xmm0
mov eax, dword [rsp + 0x48]
mov dword [rcx + 0x10], eax
mov byte [rcx + 0x14], reloc.WLDAP32.dll_Ordinal_211
jmp 0x1400470d3
movups xmmword [rcx], xmm0
mov eax, dword [rsp + 0x48]
mov dword [rcx + 0x10], eax
mov byte [rcx + 0x14], reloc.WLDAP32.dll_Ordinal_211
lea rcx, [0x1400eedb0]
call fcn.1400e75cc
nop
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
lea r11, [rdi + rbx]
mov rcx, r11
call fcn.140071d90
mov rdx, r11
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401b3b68], rax
movdqa xmm0, xmmword [0x140112230]
mov dword [rsp + 0x30], 0xd53e2f56
mov ecx, 0x16b8
mov eax, dword [rcx + rdi]
mov ebx, 0xc20
test al, 1
jne 0x140047175
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rdi + rbx]
mov byte [rcx + 0x14], 1
lea rax, [rcx + 0x13]
lea rdx, [rsp + 0x33]
cmp rcx, rdx
ja 0x14004715e
lea rdx, [rsp + 0x20]
cmp rax, rdx
jb 0x14004715e
movups xmmword [rcx], xmm0
mov eax, dword [rsp + 0x30]
mov dword [rcx + 0x10], eax
jmp 0x140047168
movups xmmword [rcx], xmm0
mov eax, dword [rsp + 0x30]
mov dword [rcx + 0x10], eax
lea rcx, [0x1400eed90]
call fcn.1400e75cc
nop
lea r11, [rbx + rdi]
mov rcx, r11
call fcn.140071c10
mov rdx, r11
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401b3b60], rax
mov rcx, qword [0x1401b3b68]
test rcx, rcx
je 0x1400471ed
test rax, rax
je 0x1400471ed
movzx ecx, byte [rcx]
cmp cl, 0xe9
je 0x1400471ed
cmp cl, 0x90
je 0x1400471ed
cmp cl, 0xc3
je 0x1400471ed
movzx eax, byte [rax]
cmp al, 0xe9
je 0x1400471ed
cmp al, 0x90
je 0x1400471ed
cmp al, 0xc3
je 0x1400471ed
mov r8d, dword [0x1401b3b48]
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1401b3b50], rax
dec rax
cmp rax, 0xfffffffffffffffd
setbe al
jmp 0x1400471ef
xor al, al
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret