Function at 0x140003430
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x260], rax
xor r13d, r13d
movabs rax, 0x6578652e524452
mov qword [rbp + 0x240], rax
movups xmm0, xmmword [str.RDRUltrawideRose.asi]
movups xmmword [rbp + 0x248], xmm0
mov eax, dword [0x1400287a0]
mov dword [rbp + 0x258], eax
movzx eax, byte [0x1400287a4]
mov byte [rbp + 0x25c], al
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x240]
call fcn.14000e39c
mov r15d, eax
test eax, eax
jne 0x14000356c
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140003551
mov dword [rbp - 0x10], 0x130
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x1400034fc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003551
xor bl, bl
nop
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x1c]
call fcn.14000e528
test eax, eax
jne 0x140003533
test bl, bl
je 0x14000352d
mov r8d, r15d
lea rdx, [rbp + 0x1c]
lea rcx, str.There_are_several_instances_of__s__process_ID__d_will_be_used._n
call fcn.140001010
jmp 0x140003533
mov bl, 1
mov r15d, dword [rbp - 8]
lea rdx, [rbp - 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140003500
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14000356c
lea rcx, str.Failure_to_find_the_target_app_process_or_the_fix_file._n
call fcn.140001010
call fcn.14000e74c
mov eax, 1
jmp 0x140003c42
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov qword [rbp - 0x80], r13
lea rax, [rbp + 0x248]
mov qword [rsp + 0x60], rax
lea rcx, [rbp + 0x248]
mov rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp byte [rcx + rax], 0
jne 0x140003596
mov qword [rsp + 0x68], rax
call fcn.140005ba4
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov edx, eax
lea rcx, [rbp - 0x70]
call fcn.1400018c0
nop
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp - 0x40]
call fcn.140005ee8
mov edx, eax
mov r12d, 1
test eax, eax
jne 0x14000362b
mov ebx, dword [rbp - 0x30]
mov eax, ebx
shr eax, 0xa
test r12b, al
je 0x140003620
mov eax, dword [rbp - 0x2c]
cmp eax, 0xa000000c
jne 0x140003612
mov ebx, 4
jmp 0x140003645
cmp eax, 0xa0000003
jne 0x140003620
mov ebx, 0xa
jmp 0x140003645
shr ebx, 4
and ebx, r12d
add ebx, 2
jmp 0x140003645
sub eax, 2
je 0x140003642
sub eax, r12d
je 0x140003642
sub eax, 0x32
je 0x140003642
cmp eax, 0x46
mov ebx, r13d
jne 0x140003645
mov ebx, r12d
test edx, edx
je 0x140003657
lea eax, [rbx - 1]
test eax, 0xfffffff7
jne 0x140003cdc
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x140003697
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003692
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ced
call fcn.1400065b4
cmp ebx, 3
jne 0x140003ad4
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
lea rax, [rbp + 0x248]
mov qword [rsp + 0x60], rax
lea rcx, [rbp + 0x248]
mov rax, rsi
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400036c0
mov qword [rsp + 0x68], rax
call fcn.140005ba4
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov edx, eax
lea rcx, [rbp - 0x40]
call fcn.1400018c0
nop
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x50]
call fcn.140004190
test eax, eax
jne 0x140003cf3
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x14000374c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003747
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003d06
call fcn.1400065b4
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140003765
lock inc dword [rcx + 8]
mov rcx, qword [rbp - 0x48]
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rsp + 0x60], xmm0
test rcx, rcx
je 0x14000377c
lock inc dword [rcx + 8]
mov rcx, qword [rbp - 0x48]
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
test rcx, rcx
je 0x1400037b8
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400037b8
mov rbx, qword [rbp - 0x48]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400037b8
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdi, qword [rsp + 0x60]
nop dword [rax]
test rdi, rdi
je 0x140003a5a
lea rcx, [rdi + 0x20]
cmp qword [rdi + 0x38], 7
jbe 0x1400037d8
mov rcx, qword [rdi + 0x20]
mov rax, qword [rdi + 0x30]
lea rdx, [rcx + rax*2]
mov rbx, rdx
call fcn.140001a10
cmp rax, rdx
je 0x14000382c
nop dword [rax]
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400037ff
cmp cx, 0x2f
jne 0x140003808
add rax, 2
cmp rax, rdx
jne 0x1400037f0
cmp rax, rdx
je 0x14000382c
nop dword [rax]
lea r8, [rbx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x14000382c
cmp cx, 0x2f
je 0x14000382c
mov rbx, r8
cmp rax, r8
jne 0x140003810
mov r8d, 0x3a
mov rcx, rbx
call fcn.140006470
cmp rbx, rax
je 0x140003877
lea rcx, [rax - 2]
cmp rbx, rcx
je 0x140003877
cmp word [rcx], 0x2e
jne 0x14000385f
lea rdx, [rcx - 2]
cmp rbx, rdx
jne 0x14000387a
cmp word [rdx], 0x2e
jne 0x14000387a
jmp 0x140003877
sub rcx, 2
cmp rbx, rcx
je 0x140003877
cmp word [rcx], 0x2e
je 0x14000387a
sub rcx, 2
cmp rbx, rcx
jne 0x140003868
mov rcx, rax
mov qword [rsp + 0x30], rcx
sub rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x40]
call fcn.140005000
nop
lea rax, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rax, qword [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x28], rax
call fcn.140005ba4
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rbp - 0x70], xmm0
lea r8, [rbp - 0x70]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1400059c0
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
cmova rax, rcx
cmp qword [rsp + 0x50], 4
jne 0x1400038ff
cmp dword [rax], 0x6c6c642e
jne 0x1400038ff
mov bl, 1
jmp 0x140003901
xor bl, bl
cmp rdx, 0xf
jbe 0x140003934
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000392f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003d0c
call fcn.1400065b4
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140003987
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003982
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003d12
call fcn.1400065b4
test bl, bl
je 0x1400039c0
mov rax, qword [rsp + 0x78]
cmp rax, qword [rbp - 0x80]
je 0x1400039aa
lea rdx, [rdi + 0x20]
mov rcx, rax
call fcn.140001e80
add qword [rsp + 0x78], 0x20
jmp 0x1400039c0
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140005150
nop word [rax + rax]
lea rdx, [rbp - 0x10]
mov rcx, qword [rdi + 0x40]
call fcn.140005e04
cmp eax, 0x12
je 0x140003a05
test eax, eax
jne 0x140003cd4
cmp word [rbp + 0x1c], 0x2e
jne 0x1400039f7
movzx eax, word [rbp + 0x1e]
test ax, ax
je 0x1400039c0
cmp ax, 0x2e
jne 0x1400039f7
cmp word [rbp + 0x20], 0
je 0x1400039c0
lea rdx, [rbp - 0x10]
mov rcx, rdi
call fcn.140002c10
jmp 0x140003a4a
mov rdi, r13
mov qword [rsp + 0x60], r13
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x68], r13
test rbx, rbx
je 0x140003a4a
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140003a45
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140003a45
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rdi, qword [rsp + 0x60]
mov eax, r13d
test eax, eax
jne 0x140003cd4
jmp 0x1400037c0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140003a95
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140003a95
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140003a95
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140003b3e
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140003b3e
mov rbx, qword [rbp - 0x48]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x140003b3e
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140003b3e
mov rbx, qword [rsp + 0x78]
cmp rbx, qword [rbp - 0x80]
je 0x140003b2a
mov qword [rsp + 0x30], rbx
lea rax, [rbp + 0x248]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x248]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140003af7
mov qword [rsp + 0x28], rsi
call fcn.140005ba4
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rbp - 0x70], xmm0
lea r8, [rbp - 0x70]
mov edx, eax
mov rcx, rbx
call fcn.1400018c0
add qword [rsp + 0x78], 0x20
jmp 0x140003b3e
lea r8, [rbp + 0x248]
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140005430
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
cmp rbx, rdi
je 0x140003bdd
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140003080
nop
lea rdx, [rbp - 0x70]
mov ecx, r15d
call fcn.140003100
lea rdx, [rbp - 0x70]
mov r8d, r15d
test al, al
je 0x140003c72
cmp qword [rbp - 0x58], 7
cmova rdx, qword [rbp - 0x70]
lea rcx, str.Successfully_applied__ls_to_process__d._n
call fcn.140001010
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x140003bd0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cce
call fcn.1400065b4
add rbx, 0x20
cmp rbx, rdi
jne 0x140003b51
lea rcx, str.Done._n
call fcn.140001010
call fcn.14000e74c
mov r12d, r13d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140003c3f
mov rdx, qword [rsp + 0x78]
call fcn.140004bb0
mov rdx, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x70]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003d18
call fcn.1400065b4
mov eax, r12d
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140006550
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp qword [rbp - 0x58], 7
cmova rdx, qword [rbp - 0x70]
lea rcx, str.Error_while_applying__ls_to_process__d._n
call fcn.140001010
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x140003bf1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003cc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cce
call fcn.1400065b4
jmp 0x140003bf1
call fcn.14000eb0c
nop
mov edx, eax
call fcn.1400027e0
nop
lea r8, [rbp - 0x70]
lea rcx, str.status
call fcn.1400028d0
nop
call fcn.14000eb0c
nop
lea r8, [rbp - 0x40]
mov edx, eax
lea rcx, str.directory_iterator::directory_iterator
call fcn.1400028d0
nop
call fcn.14000eb0c
nop
call fcn.14000eb0c
nop
call fcn.14000eb0c
nop
call fcn.14000eb0c
int3