Function at 0x1400031d0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x2f0], rbx
mov rax, qword [0x1400110b8]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rbx, r8
mov qword [rsp + 0x28], rbx
mov rsi, rdx
mov r15, rcx
mov dword [rsp + 0x60], 0x130
mov byte [rbp + 0x90], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x91]
call fcn.140006a50
mov r8d, 0x104
lea rdx, [rbp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x90]
repne scasb al, byte [rdi]
not rcx
dec rcx
movsxd rax, ecx
test ecx, ecx
jle 0x1400032ae
nop
movzx edx, byte [rbp + rax + 0x90]
cmp dl, 0x5c
je 0x14000328e
cmp dl, 0x2f
je 0x14000328e
dec ecx
dec rax
test rax, rax
jg 0x140003270
jmp 0x1400032ae
lea eax, [rcx + 1]
movsxd rcx, eax
lea rdx, [rbp + rcx + 0x90]
mov r8d, 0x104
lea rcx, [rbp + 0x90]
call fcn.140003c60
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400034c6
lea rax, vtable.G2XUtility::CGxxString_char_.0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0
mov ecx, 1
call fcn.140003950
mov r13, rax
mov qword [rsp + 0x38], rax
xor r14d, r14d
mov dword [rsp + 0x48], r14d
mov byte [rax], r14b
lea rcx, [rbp - 0x74]
xor ebx, ebx
cmp byte [rbp - 0x74], bl
je 0x14000333f
inc ebx
inc rcx
cmp byte [rcx], r14b
jne 0x140003301
test ebx, ebx
jle 0x14000333f
movsxd rdi, ebx
lea rcx, [rdi + 1]
call fcn.140003950
mov r12, rax
test rax, rax
je 0x14000335d
movzx ecx, byte [r13]
mov byte [rax], cl
mov rcx, r13
call fcn.140003f94
mov r13, r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rdi
movsxd rdi, ebx
mov r8, rdi
lea rdx, [rbp - 0x74]
mov rcx, r13
call fcn.140003c60
mov r14d, ebx
mov dword [rsp + 0x48], ebx
mov byte [rdi + r13], 0
mov rcx, r15
call fcn.1400022d0
mov r11, rax
mov rcx, rax
xor r8d, r8d
cmp byte [rax], r8b
je 0x14000337e
inc r8d
inc rcx
cmp byte [rcx], 0
jne 0x140003373
test r14d, r14d
jne 0x140003388
test r8d, r8d
je 0x1400033df
mov eax, r8d
cmp r8d, r14d
cmovg eax, r14d
xor edi, edi
movsxd r9, eax
test eax, eax
jle 0x1400033d6
nop dword [rax + rax]
movzx edx, byte [rdi + r13]
movzx ecx, byte [r11]
lea eax, [rdx - 0x41]
cmp al, 0x19
ja 0x1400033b3
add dl, 0x20
lea eax, [rcx - 0x41]
cmp al, 0x19
ja 0x1400033bd
add cl, 0x20
cmp dl, cl
jl 0x140003493
jg 0x140003493
inc rdi
inc r11
cmp rdi, r9
jl 0x1400033a0
cmp r8d, r14d
jne 0x140003493
mov rcx, qword [rsi + 8]
sub rcx, qword [rsi]
sar rcx, 3
movsxd rax, dword [r15 + 0x50]
cmp rcx, rax
jae 0x140003493
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140003493
mov rcx, qword [rsi + 8]
lea rax, [rsp + 0x20]
cmp rax, rcx
jae 0x140003460
mov rax, qword [rsi]
lea rdx, [rsp + 0x20]
cmp rax, rdx
ja 0x140003460
lea rdi, [rsp + 0x20]
sub rdi, rax
sar rdi, 3
cmp rcx, qword [rsi + 0x10]
jne 0x14000344b
mov rcx, rsi
call fcn.140003750
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000347a
mov rax, qword [rax + rdi*8]
mov qword [rcx], rax
jmp 0x14000347a
cmp rcx, qword [rsi + 0x10]
jne 0x14000346e
mov rcx, rsi
call fcn.140003750
mov rax, qword [rsi + 8]
test rax, rax
je 0x14000347a
mov qword [rax], rdi
add qword [rsi + 8], 8
mov rcx, qword [rsi + 8]
sub rcx, qword [rsi]
sar rcx, 3
movsxd rax, dword [r15 + 0x50]
cmp rcx, rax
jae 0x1400034b9
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32Next]
mov edi, eax
test r13, r13
je 0x1400034b2
mov rcx, r13
call fcn.140003f94
test edi, edi
jmp 0x1400032be
test r13, r13
je 0x1400034c6
mov rcx, r13
call fcn.140003f94
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400034d9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140003a90
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret