Function at 0x140040680
Capabilities:
Enumerate processes

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x5a0
mov rax, qword [0x14010c1f0]
xor rax, rsp
mov qword [rsp + 0x590], rax
mov edi, r9d
mov dword [rsp + 0x30], r9d
mov r12, rdx
mov r13, rcx
mov qword [rsp + 0x90], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x230], xmm0
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x350]
call fcn.1400a6530
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c8], xmm0
xor r14d, r14d
mov qword [rsp + 0x1c8], r14
mov qword [rsp + 0x1d0], r14
lea ecx, [r14 + 0x48]
call fcn.1400a36b0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x1c8], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1b8], xmm1
lea ecx, [r14 + 0x30]
call fcn.1400a36b0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x1b8], rax
test r12, r12
jne 0x140040790
mov qword [r13], r14
mov qword [r13 + 8], r14
lea ecx, [r14 + 0x30]
call fcn.1400a36b0
mov rdx, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x1b8]
mov qword [r13], rax
mov qword [rsp + 0x1b8], rdx
mov rcx, qword [r13 + 8]
mov rax, qword [rsp + 0x1c0]
mov qword [r13 + 8], rax
mov qword [rsp + 0x1c0], rcx
jmp 0x1400412ab
mov edx, 1
call fcn.14003f270
test eax, eax
jne 0x1400407e9
mov qword [r13], r14
mov qword [r13 + 8], r14
lea ecx, [rax + 0x30]
call fcn.1400a36b0
mov qword [rax], rax
mov qword [rax + 8], rax
mov rcx, qword [rsp + 0x1b8]
mov qword [r13], rcx
mov qword [rsp + 0x1b8], rax
mov rdx, qword [r13 + 8]
mov rcx, qword [rsp + 0x1c0]
mov qword [r13 + 8], rcx
mov qword [rsp + 0x1c0], rdx
mov rdx, rax
jmp 0x1400412ab
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140040ab2
lea rcx, [rsp + 0x170]
call fcn.140006d90
mov rdx, rax
lea rcx, [rsp + 0x2e0]
call fcn.14003f350
nop
cmp qword [rsp + 0x2f0], 0
je 0x140040aa2
mov dword [rsp + 0x350], 0x238
lea rdx, [rsp + 0x350]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140040aa2
mov r15, 0xffffffffffffffff
nop dword [rax]
lea rcx, [rsp + 0x2e0]
cmp qword [rsp + 0x2f8], 8
cmovae rcx, qword [rsp + 0x2e0]
lea rdx, [rsp + 0x37c]
call fcn.1400b3d10
test eax, eax
jne 0x140040a36
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rsp + 0x358]
cmp eax, ecx
je 0x140040a36
mov dword [rsp + 0x68], ecx
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], r14w
lea rax, [rsp + 0x37c]
mov r8, r15
inc r8
cmp word [rax + r8*2], 0
jne 0x1400408d2
lea rdx, [rsp + 0x37c]
lea rcx, [rsp + 0x70]
call fcn.14003d900
nop
mov rdi, qword [rsp + 0x1c8]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], r14d
mov rcx, rdi
mov ebx, dword [rsp + 0x68]
cmp byte [rax + 0x19], 0
jne 0x14004093c
mov qword [rsp + 0x48], rax
cmp dword [rax + 0x20], ebx
jae 0x140040928
mov dword [rsp + 0x50], r14d
mov rax, qword [rax + 0x10]
jmp 0x140040936
mov dword [rsp + 0x50], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140040913
cmp byte [rcx + 0x19], 0
jne 0x140040954
cmp ebx, dword [rcx + 0x20]
jb 0x140040954
mov rbx, qword [rsp + 0x88]
jmp 0x1400409f9
movabs rax, 0x38e38e38e38e38e
cmp qword [rsp + 0x1d0], rax
je 0x1400413c1
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], r14
mov ecx, 0x48
call fcn.1400a36b0
nop
mov dword [rax + 0x20], ebx
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rax + 0x28], xmm0
movups xmm1, xmmword [rsp + 0x80]
movups xmmword [rax + 0x38], xmm1
mov ebx, 7
mov qword [rsp + 0x88], rbx
mov word [rsp + 0x70], r14w
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov word [rax + 0x18], 0
mov qword [rsp + 0xc8], r14
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0xb0], xmm0
mov r8, rax
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x1c8]
call fcn.140038ad0
nop
cmp rbx, 8
jb 0x140040a36
lea rdx, [rbx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040a31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400413bb
call fcn.1400a36a0
lea rdx, [rsp + 0x350]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140040860
mov edi, dword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x2f8]
cmp rdx, 8
jb 0x140040ab9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040aab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400413b5
jmp 0x140040aab
mov r15, 0xffffffffffffffff
jmp 0x140040a53
call fcn.1400a36a0
jmp 0x140040ab9
mov r15, 0xffffffffffffffff
mov r8d, edi
mov rdx, r12
lea rcx, [rsp + 0x210]
call fcn.14003f610
nop
cmp qword [rsp + 0x220], 0
je 0x14004131c
mov dword [rsp + 0x38], r14d
movsd xmm0, qword [rsp + 0x38]
movsd qword [rsp + 0xa0], xmm0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xa8], eax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x240]
call fcn.14003ee80
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x290], xmm0
movups xmmword [rsp + 0x2a0], xmm0
movups xmmword [rsp + 0x2b0], xmm0
movups xmmword [rsp + 0x2c0], xmm0
movups xmmword [rsp + 0x2d0], xmm0
lea rax, [rsp + 0x120]
mov qword [rsp + 0x60], rax
movdqu xmmword [rsp + 0x120], xmm0
mov rcx, qword [rsp + 0x248]
test rcx, rcx
je 0x140040b6b
lock inc dword [rcx + 8]
mov rcx, qword [rsp + 0x248]
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], rcx
movsd xmm0, qword [rsp + 0x250]
movsd qword [rsp + 0x130], xmm0
mov eax, dword [rsp + 0x258]
mov dword [rsp + 0x138], eax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x160], 0
cmp byte [rsp + 0x280], 0
je 0x140040bdf
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x140]
call fcn.140021f90
mov byte [rsp + 0x160], 1
mov eax, dword [rsp + 0x288]
mov dword [rsp + 0x168], eax
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x290]
call fcn.14003e340
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x300], xmm0
movups xmmword [rsp + 0x310], xmm0
movups xmmword [rsp + 0x320], xmm0
movups xmmword [rsp + 0x330], xmm0
movups xmmword [rsp + 0x340], xmm0
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x38], rax
movdqu xmmword [rsp + 0xd0], xmm0
mov rcx, qword [rsp + 0x248]
test rcx, rcx
je 0x140040c5d
lock inc dword [rcx + 8]
mov rcx, qword [rsp + 0x248]
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rcx
movsd xmm0, qword [rsp + 0x250]
movsd qword [rsp + 0xe0], xmm0
mov eax, dword [rsp + 0x258]
mov dword [rsp + 0xe8], eax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x110], 0
cmp byte [rsp + 0x280], 0
je 0x140040cd1
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0xf0]
call fcn.140021f90
mov byte [rsp + 0x110], 1
mov eax, dword [rsp + 0x288]
mov dword [rsp + 0x118], eax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x300], xmm0
mov dword [rsp + 0x310], r14d
mov byte [rsp + 0x340], 0
mov dword [rsp + 0x348], r14d
lea rcx, [rsp + 0xf0]
call fcn.1400201f0
mov rbx, qword [rsp + 0xd8]
test rbx, rbx
je 0x140040d57
mov eax, r15d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140040d57
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14003c2ce.0]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140040d57
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x14003c2ce.0]
nop
lea rbx, str.Global_
movabs r12, 0x555555555555555
nop dword [rax + rax]
mov r11d, dword [rsp + 0x2a0]
mov r10, qword [rsp + 0x2d0]
cmp r11d, dword [rsp + 0x310]
jne 0x140040e23
cmp r10b, byte [rsp + 0x340]
jne 0x140040e23
test r10b, r10b
je 0x140040e58
lea rax, [rsp + 0x320]
cmp qword [rsp + 0x338], 8
cmovae rax, qword [rsp + 0x320]
lea r9, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 8
cmovae r9, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x2c0]
cmp rcx, qword [rsp + 0x330]
jne 0x140040e23
test rcx, rcx
je 0x140040e58
movzx edx, word [r9]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x140040e23
sub r9, rax
cmp dx, r8w
ja 0x140040e23
cmp rcx, 1
je 0x140040e58
dec rcx
add rax, 2
movzx edx, word [rax + r9]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x140040e05
test r10b, r10b
je 0x1400411a3
mov rdx, qword [rsp + 0x1c8]
mov rax, qword [rdx + 8]
mov rcx, rdx
cmp byte [rax + 0x19], 0
jne 0x140040f68
cmp dword [rax + 0x20], r11d
jae 0x140040f58
mov rax, qword [rax + 0x10]
jmp 0x140040f5e
lea rcx, [rsp + 0x320]
call fcn.1400201f0
mov rbx, qword [rsp + 0x308]
test rbx, rbx
je 0x140040eac
mov eax, r15d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140040eac
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14003c2ce.0]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140040eac
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x14003c2ce.0]
nop
lea rcx, [rsp + 0x2b0]
call fcn.1400201f0
mov rbx, qword [rsp + 0x298]
test rbx, rbx
je 0x140040f00
mov eax, r15d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140040f00
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14003c2ce.0]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140040f00
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x14003c2ce.0]
nop
lea rcx, [rsp + 0x260]
call fcn.1400201f0
mov rbx, qword [rsp + 0x248]
test rbx, rbx
je 0x140040f53
mov eax, r15d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140040f53
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14003c2ce.0]
lock xadd dword [rbx + 0xc], r15d
cmp r15d, 1
jne 0x140040f53
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x14003c2ce.0]
nop
jmp 0x14004120c
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140040e45
cmp byte [rcx + 0x19], 0
jne 0x1400411a3
cmp r11d, dword [rcx + 0x20]
jb 0x1400411a3
cmp rdx, rcx
je 0x1400411a3
lea rcx, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 8
cmovae rcx, qword [rsp + 0x2b0]
mov edx, 0x5c
call fcn.1400a5970
test rax, rax
je 0x1400411a3
lea rsi, [rax + 2]
test rsi, rsi
je 0x1400411a3
lea rdx, [rsp + 0x230]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jne 0x1400411a3
mov rax, qword [rsp + 0x220]
lea rdx, [rax + rax]
lea rcx, [rsp + 0x210]
cmp qword [rsp + 0x228], 8
cmovae rcx, qword [rsp + 0x210]
mov r8, qword [rsp + 0x230]
call fcn.14003f810
cmp rax, qword [rsp + 0x238]
jne 0x1400411a3
lea rdx, str.Local_
test edi, edi
cmovne rdx, rbx
mov qword [rsp + 0x1f0], r14
mov qword [rsp + 0x200], r14
mov qword [rsp + 0x208], 7
mov word [rsp + 0x1f0], r14w
mov r8, r15
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x140041050
lea rcx, [rsp + 0x1f0]
call fcn.14003d900
nop
mov rdx, r15
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], 0
jne 0x140041070
mov rcx, qword [rsp + 0x200]
mov r8, qword [rsp + 0x208]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1400410cd
lea rdi, [rcx + rdx]
mov qword [rsp + 0x200], rdi
lea rbx, [rsp + 0x1f0]
cmp r8, 8
cmovae rbx, qword [rsp + 0x1f0]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
mov rdx, rsi
call fcn.1400a5e80
mov word [rbx + rdi*2], r14w
jmp 0x1400410e5
mov qword [rsp + 0x20], rdx
mov r9, rsi
xor r8d, r8d
lea rcx, [rsp + 0x1f0]
call fcn.14002dbe0
mov rdi, qword [rsp + 0x1b8]
cmp qword [rsp + 0x1c0], r12
je 0x1400413c7
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r14
mov ecx, 0x30
call fcn.1400a36b0
mov rbx, rax
mov qword [rsp + 0x50], rax
lea rcx, [rax + 0x10]
lea rdx, [rsp + 0x1f0]
call fcn.140021f90
nop
inc qword [rsp + 0x1c0]
mov rax, qword [rdi + 8]
mov qword [rbx], rdi
mov qword [rbx + 8], rax
mov qword [rsp + 0x50], r14
mov qword [rdi + 8], rbx
mov qword [rax], rbx
mov rdx, qword [rsp + 0x208]
cmp rdx, 8
jb 0x140041198
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041193
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400413d4
call fcn.1400a36a0
lea rbx, str.Global_
mov edi, dword [rsp + 0x30]
mov qword [rsp + 0x1e0], r14
lea rax, [0x14010ce10]
mov qword [rsp + 0x1e8], rax
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x290]
call fcn.14003f040
mov rcx, qword [0x14010ce18]
mov rax, qword [rsp + 0x1e8]
cmp qword [rax + 8], rcx
jne 0x1400411f2
cmp dword [rsp + 0x1e0], 0
jne 0x1400411f2
xor al, al
jmp 0x1400411f4
mov al, 1
test al, al
jne 0x1400413da
jmp 0x140040d70
xor edx, edx
call fcn.14003f270
mov qword [r13], r14
mov qword [r13 + 8], r14
mov ecx, 0x30
call fcn.1400a36b0
mov rdx, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x1b8]
mov qword [r13], rax
mov qword [rsp + 0x1b8], rdx
mov rcx, qword [r13 + 8]
mov rax, qword [rsp + 0x1c0]
mov qword [r13 + 8], rax
mov qword [rsp + 0x1c0], rcx
mov rax, qword [rsp + 0x228]
cmp rax, 8
jb 0x1400412ab
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004129e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400413af
call fcn.1400a36a0
mov rdx, qword [rsp + 0x1b8]
call fcn.14002e340
mov edx, 0x30
mov rcx, qword [rsp + 0x1b8]
call fcn.1400a36a0
nop
mov r8, qword [rsp + 0x1c8]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0x1c8]
call fcn.1400447a0
mov edx, 0x48
mov rcx, qword [rsp + 0x1c8]
call fcn.1400a36a0
mov rax, r13
mov rcx, qword [rsp + 0x590]
xor rcx, rsp
call fcn.1400a3640
add rsp, 0x5a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [r13], r14
mov qword [r13 + 8], r14
mov ecx, 0x30
call fcn.1400a36b0
mov rdx, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x1b8]
mov qword [r13], rax
mov qword [rsp + 0x1b8], rdx
mov rcx, qword [r13 + 8]
mov rax, qword [rsp + 0x1c0]
mov qword [r13 + 8], rax
mov qword [rsp + 0x1c0], rcx
mov rax, qword [rsp + 0x228]
cmp rax, 8
jb 0x1400412ab
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004129e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004129e
call fcn.1400aa5b0
int3
call fcn.1400aa5b0
nop
call fcn.1400aa5b0
nop
call fcn.140001a30
nop
lea rcx, str.list_too_long
call fcn.1400465d0
nop
call fcn.1400aa5b0
int3
movaps xmm0, xmmword [rsp + 0x1e0]
movdqa xmmword [rsp + 0xb0], xmm0
lea r8, str.handles_iterator::increment_failed
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x190]
call fcn.140003de0
lea rdx, [0x140108e60]
lea rcx, [rsp + 0x190]
call fcn.1400a5db0
int3