Function at 0x140096ee0
Capabilities:
Enumerate processes

Disassembly:
push r14
push r15
sub rsp, 0xab8
xor edx, edx
mov dword [rsp + 0x30], 0x238
mov r15, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rdx, r15
movzx ecx, word [rdx]
cmp cx, 0x20
je 0x140096f24
cmp cx, 9
jne 0x140096f2a
add rdx, 2
jmp 0x140096f15
mov qword [rsp + 0xad0], rbx
mov qword [rsp + 0xad8], rbp
mov qword [rsp + 0xae0], rsi
mov qword [rsp + 0xab0], rdi
test cx, cx
je 0x140097035
xor esi, esi
cmp cx, 0x2d
je 0x140097040
movzx eax, cx
cmp cx, 0x2b
jne 0x140096f6c
movzx eax, word [rdx + 2]
lea rdi, [rdx + 2]
cmovne rdi, rdx
cmp ax, 0x30
jne 0x140096fa5
movzx eax, word [rdi + 2]
mov ecx, 0xffdf
sub ax, 0x58
test cx, ax
jne 0x140096fa5
movzx ecx, word [rdi + 4]
lea rbx, [rdi + 4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isxdigit]
test eax, eax
je 0x140096fa5
mov ebp, 1
jmp 0x140096fab
mov ebp, esi
lea rbx, [rdi + 4]
test ebp, ebp
mov ecx, esi
cmove rbx, rdi
movzx edi, word [rbx]
cmp edi, 0x20
je 0x140097017
nop dword [rax + rax]
cmp edi, 9
je 0x140097017
test edi, edi
je 0x140097031
cmp edi, 0x2e
je 0x140097040
test ebp, ebp
je 0x140096ffd
movzx ecx, di
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswxdigit]
test eax, eax
mov ecx, esi
sete cl
test ecx, ecx
je 0x140097005
test edi, 0xffffff80
jne 0x140097040
mov edx, 2
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
jmp 0x140097040
lea eax, [rdi - 0x30]
cmp eax, 9
ja 0x140096fe6
movzx edi, word [rbx + 2]
add rbx, 2
mov ecx, 1
cmp edi, 0x20
jne 0x140096fc0
movzx eax, word [rbx]
cmp ax, 0x20
je 0x140097026
cmp ax, 9
jne 0x14009702c
add rbx, 2
jmp 0x140097017
test ax, ax
jne 0x140097040
test ecx, ecx
je 0x140097040
mov rcx, r15
call fcn.140005bc0
mov rsi, rax
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov rdi, qword [rsp + 0xab0]
mov rbp, qword [rsp + 0xad8]
mov rbx, qword [rsp + 0xad0]
test eax, eax
je 0x14009711d
nop
test esi, esi
je 0x14009707e
cmp esi, dword [rsp + 0x38]
je 0x14009713c
lea rax, [rsp + 0x480]
lea r9, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x690]
lea rdx, [rsp + 0x8a0]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath]
lea rax, [rsp + 0x270]
sub rax, 2
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1400970c0
lea r8, [rsp + 0x480]
xor edx, edx
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x1400970e0
mov rdx, r15
lea rcx, [rsp + 0x270]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, r14
test eax, eax
je 0x14009715b
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140097070
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret