Function at 0x140002f20
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x290
mov rax, qword [0x14008c320]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
mov rbp, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002fa2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x10]
lea rbx, str.Failed_to_create_TH_snapshot._System_error__lu
mov dword [rsp + 0x28], eax
lea rdx, str.C:dvsp4_build_swgcompdev_srcNvContainercontainerNvcHost.cpp
mov r9d, 1
mov qword [rsp + 0x20], rbx
mov r8d, 0x2dd
call fcn.140012d40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov ecx, 4
mov r8d, eax
call fcn.140004740
jmp 0x140003153
xor edx, edx
mov qword [rsp + 0x2b0], rdi
mov r8d, 0x238
lea rcx, [rsp + 0x40]
call fcn.140015d80
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x140003022
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x10]
lea rdi, str.Failed_start_walking_TH_snapshot._System_error__lu
mov dword [rsp + 0x28], eax
lea rdx, str.C:dvsp4_build_swgcompdev_srcNvContainercontainerNvcHost.cpp
mov r9d, 1
mov qword [rsp + 0x20], rdi
mov r8d, 0x2e9
call fcn.140012d40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rdi
mov ecx, 4
mov r8d, eax
call fcn.140004740
jmp 0x140003142
mov qword [rsp + 0x2a8], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor esi, esi
cmp dword [rsp + 0x48], edi
je 0x14000304d
lea rdx, [rsp + 0x40]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140003034
jmp 0x140003051
mov esi, dword [rsp + 0x60]
test esi, esi
jne 0x140003096
mov rcx, qword [rbp + 0x10]
lea rsi, str.Failed_find_our_PID__lu_in_TH_snapshot
mov dword [rsp + 0x28], edi
lea rdx, str.C:dvsp4_build_swgcompdev_srcNvContainercontainerNvcHost.cpp
mov r9d, 1
mov qword [rsp + 0x20], rsi
mov r8d, 0x2fd
call fcn.140012d40
mov r8d, edi
mov rdx, rsi
mov ecx, 4
call fcn.140004740
jmp 0x14000313a
mov r8d, esi
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x138], rax
test rax, rax
je 0x1400030eb
mov rcx, qword [rbp + 0x10]
lea rdx, str.C:dvsp4_build_swgcompdev_srcNvContainercontainerNvcHost.cpp
mov dword [rsp + 0x30], esi
mov r9d, 3
mov qword [rsp + 0x28], rax
mov r8d, 0x305
lea rax, str.Open_parent_process__p_for_PID__lu
mov dword [rbp + 0x140], esi
mov qword [rsp + 0x20], rax
call fcn.140012d40
jmp 0x14000313a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x10]
lea rdi, str.Failed_open_parent_process_for_PID__lu._System_error__lu
mov dword [rsp + 0x30], eax
lea rdx, str.C:dvsp4_build_swgcompdev_srcNvContainercontainerNvcHost.cpp
mov dword [rsp + 0x28], esi
mov r9d, 1
mov r8d, 0x30d
mov qword [rsp + 0x20], rdi
call fcn.140012d40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, esi
mov rdx, rdi
mov r9d, eax
mov ecx, 4
call fcn.140004740
mov rsi, qword [rsp + 0x2a8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400141d0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x290
pop rbp
ret