Function at 0x14005ae2d
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400b28e0
push rbp
push rsi
push rdi
mov eax, 0x1e40
call fcn.1400599ba
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x608
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140159080]
xor rax, rbp
mov qword [rbp + 0x1e18], rax
lea rcx, [0x1401b1503]
call fcn.14005c363
lea rdx, [rbp + 0xad8]
lea rcx, [rbp + 0xab4]
call fcn.1400ac870
mov rcx, rax
call fcn.14005917c
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0xb48]
lea rcx, [rbp + 0xb24]
call fcn.1400ad5c0
mov rcx, rax
call fcn.1400599ce
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0xb98]
lea rcx, [rbp + 0xb74]
call fcn.1400ae0b0
mov rcx, rax
call fcn.140059190
mov qword [rbp + 0x20], rax
lea rdx, [rbp + 0xbe8]
lea rcx, [rbp + 0xbc4]
call fcn.1400ae820
mov rcx, rax
call fcn.1400590d7
mov qword [rbp + 0x28], rax
lea rdx, [rbp + 0xc48]
lea rcx, [rbp + 0xc24]
call fcn.1400ae960
mov rcx, rax
call fcn.1400597e9
mov qword [rbp + 0x30], rax
lea rdx, [rbp + 0xca8]
lea rcx, [rbp + 0xc84]
call fcn.1400aea40
mov rcx, rax
call fcn.14005a0db
mov qword [rbp + 0x38], rax
lea rdx, [rbp + 0xd08]
lea rcx, [rbp + 0xce4]
call fcn.1400aeb20
mov rcx, rax
call fcn.1400597df
mov qword [rbp + 0x40], rax
lea rdx, [rbp + 0xd78]
lea rcx, [rbp + 0xd54]
call fcn.1400aec00
mov rcx, rax
call fcn.14005a07c
mov qword [rbp + 0x48], rax
lea rdx, [rbp + 0xdd8]
lea rcx, [rbp + 0xdb4]
call fcn.1400aece0
mov rcx, rax
call fcn.1400597df
mov qword [rbp + 0x50], rax
lea rdx, [rbp + 0xe48]
lea rcx, [rbp + 0xe24]
call fcn.1400abc30
mov rcx, rax
call fcn.1400599ce
mov qword [rbp + 0x58], rax
lea rdx, [rbp + 0xe98]
lea rcx, [rbp + 0xe74]
call fcn.1400abd10
mov rcx, rax
call fcn.14005b706
mov qword [rbp + 0x60], rax
lea rdx, [rbp + 0xef8]
lea rcx, [rbp + 0xed4]
call fcn.1400abdf0
mov rcx, rax
call fcn.14005a941
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0xf48]
lea rcx, [rbp + 0xf24]
call fcn.1400abed0
mov rcx, rax
call fcn.1400595b9
mov qword [rbp + 0x70], rax
lea rdx, [rbp + 0xfa8]
lea rcx, [rbp + 0xf84]
call fcn.1400abfb0
mov rcx, rax
call fcn.14005b297
mov qword [rbp + 0x78], rax
lea rdx, [rbp + 0x1008]
lea rcx, [rbp + 0xfe4]
call fcn.1400ac090
mov rcx, rax
call fcn.1400599ce
mov qword [rbp + 0x80], rax
lea rdx, [rbp + 0x1058]
lea rcx, [rbp + 0x1034]
call fcn.1400ac170
mov rcx, rax
call fcn.14005a07c
mov qword [rbp + 0x88], rax
lea rdx, [rbp + 0x10b8]
lea rcx, [rbp + 0x1094]
call fcn.1400ac250
mov rcx, rax
call fcn.1400597e9
mov qword [rbp + 0x90], rax
lea rdx, [rbp + 0x1118]
lea rcx, [rbp + 0x10f4]
call fcn.1400ac330
mov rcx, rax
call fcn.14005b706
mov qword [rbp + 0x98], rax
lea rdx, [rbp + 0x1178]
lea rcx, [rbp + 0x1154]
call fcn.1400ac410
mov rcx, rax
call fcn.1400597e9
mov qword [rbp + 0xa0], rax
lea rdx, [rbp + 0x11d8]
lea rcx, [rbp + 0x11b4]
call fcn.1400acca0
mov rcx, rax
call fcn.14005a941
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0x1228]
lea rcx, [rbp + 0x1204]
call fcn.1400acd80
mov rcx, rax
call fcn.1400599ce
mov qword [rbp + 0xb0], rax
lea rdx, [rbp + 0x1278]
lea rcx, [rbp + 0x1254]
call fcn.1400ace60
mov rcx, rax
call fcn.1400597df
mov qword [rbp + 0xb8], rax
lea rdx, [rbp + 0x12e8]
lea rcx, [rbp + 0x12c4]
call fcn.1400acf40
mov rcx, rax
call fcn.1400599ce
mov qword [rbp + 0xc0], rax
lea rdx, [rbp + 0x1338]
lea rcx, [rbp + 0x1314]
call fcn.1400ad020
mov rcx, rax
call fcn.14005a941
mov qword [rbp + 0xc8], rax
lea rdx, [rbp + 0x1388]
lea rcx, [rbp + 0x1364]
call fcn.1400ad100
mov rcx, rax
call fcn.14005a07c
mov qword [rbp + 0xd0], rax
lea rdx, [rbp + 0x13e8]
lea rcx, [rbp + 0x13c4]
call fcn.1400ad1e0
mov rcx, rax
call fcn.140059190
mov qword [rbp + 0xd8], rax
lea rdx, [rbp + 0x1438]
lea rcx, [rbp + 0x1414]
call fcn.1400ad2c0
mov rcx, rax
call fcn.14005a1a3
mov qword [rbp + 0xe0], rax
lea rdx, [rbp + 0x1478]
lea rcx, [rbp + 0x1454]
call fcn.1400ad390
mov rcx, rax
call fcn.140059221
mov qword [rbp + 0xe8], rax
lea rdx, [rbp + 0x14c8]
lea rcx, [rbp + 0x14a4]
call fcn.1400ad470
mov rcx, rax
call fcn.140059924
mov qword [rbp + 0xf0], rax
lea rdx, [rbp + 0x1518]
lea rcx, [rbp + 0x14f4]
call fcn.1400ad780
mov rcx, rax
call fcn.14005917c
mov qword [rbp + 0xf8], rax
lea rdx, [rbp + 0x1590]
lea rcx, [rbp + 0x1564]
call fcn.1400ad860
mov rcx, rax
call fcn.14005a4d7
mov qword [rbp + 0x100], rax
lea rdx, [rbp + 0x1618]
lea rcx, [rbp + 0x15f4]
call fcn.1400ad940
mov rcx, rax
call fcn.1400590d7
mov qword [rbp + 0x108], rax
lea rdx, [rbp + 0x1678]
lea rcx, [rbp + 0x1654]
call fcn.1400ada20
mov rcx, rax
call fcn.140059190
mov qword [rbp + 0x110], rax
lea rdx, [rbp + 0x16d0]
lea rcx, [rbp + 0x16a4]
call fcn.1400adb00
mov rcx, rax
call fcn.14005a4d7
mov qword [rbp + 0x118], rax
lea rdx, [rbp + 0x1758]
lea rcx, [rbp + 0x1734]
call fcn.1400adbe0
mov rcx, rax
call fcn.14005a07c
mov qword [rbp + 0x120], rax
lea rdx, [rbp + 0x17b8]
lea rcx, [rbp + 0x1794]
call fcn.1400adcc0
mov rcx, rax
call fcn.1400597df
mov qword [rbp + 0x128], rax
lea rdx, [rbp + 0x1828]
lea rcx, [rbp + 0x1804]
call fcn.1400adda0
mov rcx, rax
call fcn.14005917c
mov qword [rbp + 0x130], rax
lea rdx, [rbp + 0x1898]
lea rcx, [rbp + 0x1874]
call fcn.1400ade80
mov rcx, rax
call fcn.14005a941
mov qword [rbp + 0x138], rax
lea rdx, [rbp + 0x18e8]
lea rcx, [rbp + 0x18c4]
call fcn.1400adf60
mov rcx, rax
call fcn.14005c304
mov qword [rbp + 0x140], rax
lea rdx, [rbp + 0x1938]
lea rcx, [rbp + 0x1914]
call fcn.1400ae200
mov rcx, rax
call fcn.14005921c
mov qword [rbp + 0x148], rax
lea rdx, [rbp + 0x1988]
lea rcx, [rbp + 0x1964]
call fcn.1400ae2e0
mov rcx, rax
call fcn.14005bcf6
mov qword [rbp + 0x150], rax
lea rdx, [rbp + 0x1a10]
lea rcx, [rbp + 0x19e4]
call fcn.1400ae3c0
mov rcx, rax
call fcn.14005b4e5
mov qword [rbp + 0x158], rax
lea rdx, [rbp + 0x1a98]
lea rcx, [rbp + 0x1a74]
call fcn.1400ae4a0
mov rcx, rax
call fcn.140059221
mov qword [rbp + 0x160], rax
lea rdx, [rbp + 0x1ae8]
lea rcx, [rbp + 0x1ac4]
call fcn.1400ae580
mov rcx, rax
call fcn.1400595b9
mov qword [rbp + 0x168], rax
lea rdx, [rbp + 0x1b48]
lea rcx, [rbp + 0x1b24]
call fcn.1400ae660
mov rcx, rax
call fcn.14005a07c
mov qword [rbp + 0x170], rax
mov dword [rbp + 0x1c0], 0x238
lea rax, [rbp + 0x1c4]
mov rdi, rax
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
xor edx, edx
mov ecx, 2
call fcn.14005a824
mov qword [rbp + 0x418], rax
mov dword [rbp + 0x1b90], 0x238
lea rax, [rbp + 0x1b94]
mov rdi, rax
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
lea rax, [rbp + 0x1c0]
lea rcx, [rbp + 0x1b90]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x238
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0x1c0]
mov rcx, qword [rbp + 0x418]
call fcn.14005aee6
test eax, eax
jne 0x1400b2f84
lea rcx, [0x14011f06a]
call fcn.14005a7fc
jmp 0x1400b3046
lea rax, [rbp + 0x10]
mov qword [rbp + 0x438], rax
mov rax, qword [rbp + 0x438]
mov qword [rbp + 0x458], rax
mov rax, qword [rbp + 0x438]
add rax, 0x168
mov qword [rbp + 0x478], rax
jmp 0x1400b2fc5
mov rax, qword [rbp + 0x458]
add rax, 8
mov qword [rbp + 0x458], rax
mov rax, qword [rbp + 0x478]
cmp qword [rbp + 0x458], rax
je 0x1400b302b
mov rax, qword [rbp + 0x458]
mov rax, qword [rax]
mov qword [rbp + 0x498], rax
lea rax, [rbp + 0x1ec]
mov qword [rbp + 0x198], rax
mov rdx, qword [rbp + 0x198]
mov rcx, qword [rbp + 0x498]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x1400b3029
mov dword [rbp + 0x1e04], 0
lea rdx, [rbp + 0x1e04]
lea rcx, [rbp + 0x1de4]
call fcn.140059bb3
jmp 0x1400b2fb3
lea rdx, [rbp + 0x1c0]
mov rcx, qword [rbp + 0x418]
call fcn.14005bb57
test eax, eax
jne 0x1400b2f84
mov rcx, qword [rbp + 0x418]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x20]
lea rdx, [0x140122bd0]
call fcn.14005b9c7
mov rcx, qword [rbp + 0x1e18]
xor rcx, rbp
call fcn.14005a892
lea rsp, [rbp + 0x1e20]
pop rdi
pop rsi
pop rbp
ret