Function at 0x140002050
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x470
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rcx
lea rdx, str._nGetting_process_ID..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a90
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140002108
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rdx, str.cs2.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140002132
nop word [rax + rax]
lea rdx, str.cs2.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140002132
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400020e0
mov dword [rbx + 0x10], 0
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400022b0
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov dword [rbx + 0x10], eax
test eax, eax
je 0x14000210f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Getting_process_handle..._n
call fcn.140001a90
mov ecx, dword [rbx + 0x10]
call fcn.140001cd0
mov qword [rbx + 8], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14000210f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Getting_client.dll_module_base_address..._n
call fcn.140001a90
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x434
call sub.VCRUNTIME140.dll_memset
mov edx, dword [rbx + 0x10]
mov ecx, 0x18
mov dword [rsp + 0x20], 0x438
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140002208
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
lea rdx, str.client.dll
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140002214
nop word [rax + rax]
lea rdx, str.client.dll
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140002214
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400021e0
mov qword [rbx], 0
jmp 0x14000210f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x38]
mov qword [rbx], rax
test rax, rax
je 0x14000210f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._nSuccessfully_attached_to_CS2__nProcess_ID:
call fcn.140001a90
mov edx, dword [rbx + 0x10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._nProcess:
call fcn.140001a90
mov rdx, qword [rbx + 8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, str._nclient.dll_base_address:
call fcn.140001a90
mov rdx, qword [rbx]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140004640]
call fcn.140001a90
jmp 0x140002111