Function at 0x140099840
Capabilities:
Enumerate processes

Disassembly:
push r14
push r15
sub rsp, 0xab8
xor edx, edx
mov qword [rsp + 0xab0], r12
mov r15, rcx
mov dword [rsp + 0x30], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rdx, r15
nop dword [rax]
movzx ecx, word [rdx]
cmp cx, 0x20
je 0x14009988f
cmp cx, 9
jne 0x140099895
add rdx, 2
jmp 0x140099880
mov qword [rsp + 0xad0], rbx
mov r12d, 0xffdf
mov qword [rsp + 0xad8], rbp
mov qword [rsp + 0xae0], rsi
mov qword [rsp + 0xae8], rdi
test cx, cx
je 0x1400999a5
xor esi, esi
cmp cx, 0x2d
je 0x140099a1e
movzx eax, cx
cmp cx, 0x2b
jne 0x1400998dd
movzx eax, word [rdx + 2]
lea rbx, [rdx + 2]
cmovne rbx, rdx
cmp ax, 0x30
jne 0x140099911
movzx eax, word [rbx + 2]
sub ax, 0x58
test r12w, ax
jne 0x140099911
movzx ecx, word [rbx + 4]
lea rdi, [rbx + 4]
call fcn.1400f57c0
test eax, eax
je 0x140099911
mov ebp, 1
jmp 0x140099917
mov ebp, esi
lea rdi, [rbx + 4]
test ebp, ebp
mov ecx, esi
cmove rdi, rbx
movzx ebx, word [rdi]
cmp ebx, 0x20
je 0x140099987
cmp ebx, 9
je 0x140099987
test ebx, ebx
je 0x1400999a1
cmp ebx, 0x2e
je 0x140099a1e
test ebp, ebp
je 0x14009996d
movzx ecx, bx
call fcn.140102b5c
test eax, eax
mov ecx, esi
sete cl
test ecx, ecx
je 0x140099975
test ebx, 0xffffff80
jne 0x140099a1e
mov edx, 2
mov ecx, ebx
call fcn.1400fc354
jmp 0x140099a1e
lea eax, [rbx - 0x30]
cmp eax, 9
ja 0x140099950
movzx ebx, word [rdi + 2]
add rdi, 2
mov ecx, 1
cmp ebx, 0x20
jne 0x140099927
movzx eax, word [rdi]
cmp ax, 0x20
je 0x140099996
cmp ax, 9
jne 0x14009999c
add rdi, 2
jmp 0x140099987
test ax, ax
jne 0x140099a1e
test ecx, ecx
je 0x140099a1e
mov rcx, r15
nop dword [rax + rax]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x1400999bf
cmp ax, 9
jne 0x1400999c5
add rcx, 2
jmp 0x1400999b0
test ax, ax
je 0x140099a14
cmp ax, 0x2d
je 0x1400999d6
cmp ax, 0x2b
jne 0x1400999e0
lea rax, [rcx + 2]
mov rcx, rax
movzx eax, word [rax]
cmp ax, 0x30
jne 0x140099a14
movzx eax, word [rcx + 2]
sub ax, 0x58
test r12w, ax
jne 0x140099a14
movzx ecx, word [rcx + 4]
call fcn.1400f57c0
test eax, eax
je 0x140099a14
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 0x10]
call fcn.1400f6ec0
mov rsi, rax
jmp 0x140099a1e
mov rcx, r15
call fcn.1400f745c
mov esi, eax
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov r12, qword [rsp + 0xab0]
mov rdi, qword [rsp + 0xae8]
mov rbp, qword [rsp + 0xad8]
mov rbx, qword [rsp + 0xad0]
test eax, eax
je 0x140099afc
test esi, esi
je 0x140099a62
cmp esi, dword [rsp + 0x38]
je 0x140099b1b
lea rax, [rsp + 0x480]
lea r9, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x690]
lea rdx, [rsp + 0x8a0]
lea rcx, [rsp + 0x5c]
call fcn.140104438
lea rax, [rsp + 0x270]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140099aa0
lea r8, [rsp + 0x480]
xor edx, edx
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x140099ac0
mov rdx, r15
lea rcx, [rsp + 0x270]
call fcn.1400f55a0
mov rcx, r14
test eax, eax
je 0x140099b3a
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140099a54
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret