Function at 0x1400b5bd0
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov rsi, rcx
mov rax, qword [0x1406de900]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x20], 0x130
xor edi, edi
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov edx, dword [0x1406dfde8]
mov eax, dword [0x1406dfdec]
lea ecx, [rdx - 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x1400b5c32
test ecx, ecx
je 0x1400b5c32
nop
jmp 0x1400b5c30
cmp rbx, 0xffffffffffffffff
je 0x1400b5eba
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32First
mov eax, dword [0x1406dee98]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406dee9c], 0xa
setl al
or al, cl
nop word [rax + rax]
test al, al
je 0x1400b5c70
lea rcx, [rsp + 0x4c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r14, rax
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x1400b5c8e
mov rcx, qword [rsi]
mov rbp, qword [rsi + 0x10]
mov eax, dword [0x1406f0ba8]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete dl
cmp dword [0x1406f0bac], 0xa
setl al
or al, dl
test al, al
je 0x1400b5cb0
xor edi, edi
cmp r14, rbp
setb dil
mov r8, rbp
cmovb r8, r14
lea rdx, [rsp + 0x4c]
call sub.VCRUNTIME140.dll_memcmp
cmp rbp, r14
mov ecx, 0xffffffff
cmovb edi, ecx
test eax, eax
cmovne edi, eax
mov ebp, dword [0x1406dfde8]
mov r14d, dword [0x1406dfdec]
test edi, edi
je 0x1400b5e6a
lea r13, [rsp + 0x20]
nop dword [rax + rax]
cmp r14d, 0xa
jl 0x1400b5d20
lea eax, [rbp - 1]
imul eax, ebp
and eax, 1
jne 0x1400b5d49
nop word cs:[rax + rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdx, r13
call sub.KERNEL32.dll_Process32Next
mov ebp, dword [0x1406dfde8]
mov r14d, dword [0x1406dfdec]
cmp r14d, 0xa
jl 0x1400b5d60
lea ecx, [rbp - 1]
imul ecx, ebp
and ecx, 1
je 0x1400b5d60
mov rcx, rbx
mov rdx, r13
call sub.KERNEL32.dll_Process32Next
jmp 0x1400b5d20
test eax, eax
je 0x1400b5e81
mov eax, dword [0x1406dee98]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406dee9c], 0xa
setl al
or al, cl
nop word cs:[rax + rax]
test al, al
je 0x1400b5d90
lea rcx, [rsp + 0x4c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x1400b5dae
mov rcx, qword [rsi]
mov r12, qword [rsi + 0x10]
mov eax, dword [0x1406f0ba8]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete dl
cmp dword [0x1406f0bac], 0xa
setl al
or al, dl
test al, al
je 0x1400b5dd0
xor r15d, r15d
cmp rdi, r12
setb r15b
mov r8, r12
cmovb r8, rdi
lea rdx, [rsp + 0x4c]
call sub.VCRUNTIME140.dll_memcmp
cmp r12, rdi
mov ecx, 0xffffffff
cmovb r15d, ecx
test eax, eax
cmovne r15d, eax
test r15d, r15d
jne 0x1400b5d00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1406dfde8]
mov eax, dword [0x1406dfdec]
lea ecx, [rdx - 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x1400b5eb6
test ecx, ecx
je 0x1400b5eb6
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call rdi
mov rcx, rbx
call rdi
mov edx, dword [0x1406dfde8]
mov eax, dword [0x1406dfdec]
lea ecx, [rdx - 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x1400b5eb6
test ecx, ecx
jne 0x1400b5e40
jmp 0x1400b5eb6
cmp r14d, 0xa
jl 0x1400b5ee5
lea eax, [rbp - 1]
imul eax, ebp
and eax, 1
jne 0x1400b5f0c
jmp 0x1400b5ee5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1406dfde8]
mov eax, dword [0x1406dfdec]
lea ecx, [rdx - 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x1400b5eb2
test ecx, ecx
mov edi, 0
je 0x1400b5eba
nop dword [rax]
jmp 0x1400b5eb0
xor edi, edi
jmp 0x1400b5eba
mov edi, dword [rsp + 0x28]
mov r8, qword [rsi + 0x18]
cmp eax, 0xa
jl 0x1400b5f17
test ecx, ecx
je 0x1400b5f17
cmp r8, 0x10
jb 0x1400b5f6e
mov rdx, qword [rsi]
add r8, 1
mov rcx, rsi
call fcn.14017a700
jmp 0x1400b5f6e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1406dfde8]
mov eax, dword [0x1406dfdec]
lea ecx, [rdx - 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x1400b5eb6
test ecx, ecx
je 0x1400b5eb6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400b5ee5
cmp r8, 0x10
jb 0x1400b5f2c
mov rdx, qword [rsi]
add r8, 1
mov rcx, rsi
call fcn.14017a700
movaps xmm0, xmmword [0x1402599c0]
movups xmmword [rsi + 0x10], xmm0
mov byte [rsi], 0
cmp dword [0x1406f0a30], 0xa
jl 0x1400b5f54
mov eax, dword [0x1406f0a34]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400b5fb0
cmp dword [0x1406dfdec], 0xa
jl 0x1400b5fb2
mov eax, dword [0x1406dfde8]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400b5fb2
movaps xmm0, xmmword [0x1402599c0]
movups xmmword [rsi + 0x10], xmm0
mov byte [rsi], 0
cmp dword [0x1406f0a30], 0xa
mov r8d, reloc.WS2_32.dll_ntohs
jl 0x1400b5f17
mov eax, dword [0x1406f0a34]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400b5f17
jmp 0x1400b5fa0
jmp 0x1400b5fb0
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401fc630
mov eax, edi
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret