Function at 0x140001af0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0xa8]
sub rsp, 0x1a8
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov qword [rsp + 0x20], rdx
mov rbx, rdx
cmp ecx, 2
jge 0x140001b36
lea rcx, str.___usage:_dumper__process.exe__n
call fcn.140001010
mov eax, 0xffffffff
jmp 0x140001e87
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x1c0], rsi
mov qword [rsp + 0x1d0], rdi
mov qword [rsp + 0x1a0], r13
mov qword [rsp + 0x198], r14
mov qword [rsp + 0x190], r15
call fcn.1400019d0
xor edx, edx
mov dword [rsp + 0x50], 0x130
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, qword [rsp + 0x40]
xor esi, esi
mov r15, qword [rsp + 0x28]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140001c85
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rax, [rsp + 0x7c]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], sil
jne 0x140001bb2
mov rdi, qword [rsp + 0x38]
lea rcx, [rsp + 0x28]
cmp r13, 0x10
lea rdx, [rsp + 0x7c]
mov r8, rdi
cmovae rcx, r15
cmp rbx, rdi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140001c04
cmp rdi, rbx
jb 0x140001c04
ja 0x140001c04
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x20]
jmp 0x140001c88
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140001c77
nop word [rax + rax]
lea rax, [rsp + 0x7c]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], sil
jne 0x140001c30
cmp r13, 0x10
lea rcx, [rsp + 0x28]
mov r8, rdi
lea rdx, [rsp + 0x7c]
cmovae rcx, r15
cmp rbx, rdi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140001c65
cmp rdi, rbx
jb 0x140001c65
jbe 0x140001bec
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001c20
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x20]
mov r14d, esi
cmp r13, 0x10
jb 0x140001cc2
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140001cba
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001cba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.140001f1c
test r14d, r14d
jne 0x140001cdc
lea rcx, str.____unable_to_find_process_id_n
call fcn.140001010
lea eax, [r14 - 1]
jmp 0x140001e5f
mov edx, r14d
mov qword [rsp + 0x1d8], r12
lea rcx, str.___process_id___d__n
call fcn.140001010
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
test rax, rax
jne 0x140001d17
lea rcx, str.____unable_to_open_handle_to_game_n
jmp 0x140001e4d
mov rdx, r12
lea rcx, str.___game_handle___p__n
call fcn.140001010
mov r15, qword [rbx + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rsi
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x40], rsi
inc rbx
cmp byte [r15 + rbx], sil
jne 0x140001d43
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140001ea0
mov qword [rsp + 0x40], 0xf
cmp rbx, 0x10
jae 0x140001d8d
mov r8, rbx
mov qword [rsp + 0x38], rbx
mov rdx, r15
lea rcx, [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x28], sil
jmp 0x140001e22
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140001dc2
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140001ee0
test rax, rax
je 0x140001ded
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001e01
mov ecx, 0x16
mov rdi, rax
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001df4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001ea6
jmp 0x140001da7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001e01
call fcn.140001ee0
mov rsi, rax
mov r8, rbx
mov qword [rsp + 0x28], rsi
mov rdx, r15
mov qword [rsp + 0x38], rbx
mov rcx, rsi
mov qword [rsp + 0x40], rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
lea r8, [rsp + 0x28]
mov edx, r14d
mov rcx, r12
call fcn.140001230
test al, al
je 0x140001e46
lea rcx, str.___dumped_game_n
call fcn.140001010
xor eax, eax
jmp 0x140001e57
lea rcx, str.____failed_to_dump_game_n
call fcn.140001010
mov eax, 0xffffffff
mov r12, qword [rsp + 0x1d8]
mov r13, qword [rsp + 0x1a0]
mov r14, qword [rsp + 0x198]
mov rdi, qword [rsp + 0x1d0]
mov rsi, qword [rsp + 0x1c0]
mov r15, qword [rsp + 0x190]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140001ec0
add rsp, 0x1a8
pop rbx
pop rbp
ret
call fcn.140001210
int3
call fcn.140001170
int3