Function at 0x14037c740
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a8
mov rsi, rcx
mov rax, qword [0x140ad7868]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x68], 0x238
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x30], rax
mov eax, 0x59fd37de
mov ebp, 0x8af2bb23
mov ebx, 0xdf645168
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12d, 0xc0cbc6aa
mov r14d, 0xb41e9dbd
mov r13d, 0x3d1b29f5
jmp 0x14037c7ed
mov eax, dword [0x140ae0bf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x316e1061
mov ecx, 0x3f18226
nop word cs:[rax + rax]
nop dword [rax]
cmove eax, ecx
cmp dword [0x140ae0bfc], 0xa
cmovl eax, ecx
cmp eax, 0x1344ea
jg 0x14037c840
cmp eax, 0xc026f662
jle 0x14037c8a0
cmp eax, 0xcd3ce0c7
jle 0x14037c938
cmp eax, 0xd920e80b
jg 0x14037ca5c
cmp eax, 0xcd3ce0c8
je 0x14037ccdb
cmp eax, 0xd3190990
je 0x14037ccec
cmp eax, 0xd83df9a4
jne 0x14037c7ed
mov eax, 0x54ee442
jmp 0x14037c7ed
cmp eax, 0x44d64b0e
jle 0x14037c8f0
cmp eax, 0x65cfad34
jg 0x14037c982
cmp eax, 0x5d2240cd
jle 0x14037ca87
cmp eax, 0x5d2240ce
je 0x14037ccfb
cmp eax, 0x5fade4a0
je 0x14037cd23
cmp eax, 0x6520bfd1
jne 0x14037c7ed
cmp byte [rsp + 0x2e], 0
mov eax, 0xc739b533
mov ecx, 0x6d72d5fa
cmovne eax, ecx
jmp 0x14037c7ed
cmp eax, 0xb0d4a054
jg 0x14037c9cb
cmp eax, 0x9690a015
jle 0x14037caa7
cmp eax, 0x9690a016
je 0x14037cd32
cmp eax, 0xa44260f2
je 0x14037cd46
cmp eax, 0xb0023db7
jne 0x14037c7ed
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x4c], eax
mov eax, 0x5fade4a0
jmp 0x14037c7ed
cmp eax, 0x1ad6ccb1
jg 0x14037ca01
cmp eax, 0x54ee441
jle 0x14037cac2
cmp eax, 0x54ee442
je 0x14037cd7d
cmp eax, 0x77ad51d
je 0x14037cd8c
cmp eax, 0x144f0915
jne 0x14037c7ed
mov rcx, qword [rsp + 0x30]
call rdi
mov eax, 0xc13289ff
jmp 0x14037c7ed
cmp eax, 0xc13289fe
jle 0x14037caf6
cmp eax, 0xc13289ff
je 0x14037cdaa
cmp eax, 0xc6f6e637
je 0x14037cdcf
cmp eax, 0xc739b533
jne 0x14037c7ed
mov eax, dword [0x140ae0bf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb9dcf2e7
mov ecx, 0x44d64b0f
jmp 0x14037c7e0
cmp eax, 0x6d72d5f9
jle 0x14037cb2a
cmp eax, 0x6d72d5fa
je 0x14037cde6
cmp eax, 0x79220242
je 0x14037ce0e
cmp eax, 0x792a2d86
jne 0x14037c7ed
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x68]
call sub.KERNEL32.dll_Process32NextW
mov dword [rsp + 0x50], eax
mov eax, 0x9690a016
jmp 0x14037c7ed
cmp eax, 0xb9209f22
jle 0x14037cb72
cmp eax, 0xb9209f23
je 0x14037ce22
cmp eax, 0xb9dcf2e7
je 0x14037cf41
cmp eax, 0xbdc3b106
jne 0x14037c7ed
mov eax, 0x1ad6ccb2
jmp 0x14037c7ed
cmp eax, 0x2307f690
jle 0x14037cca1
cmp eax, 0x2307f691
je 0x14037cf52
cmp eax, 0x316e1061
je 0x14037cf70
cmp eax, 0x3d1b29f5
jne 0x14037c7ed
mov rdx, qword [rsp + 0x38]
mov rcx, rsi
call fcn.14024bb00
mov dword [rsp + 0x54], eax
mov eax, dword [0x140ae0bf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1f5a2bfe
mov ecx, 0xd9a3e6df
jmp 0x14037c7e0
cmp eax, 0xd920e80c
je 0x14037cf7a
cmp eax, 0xd9a3e6df
je 0x14037cf84
cmp eax, 0xe7165a89
jne 0x14037c7ed
mov eax, 0xb0023db7
jmp 0x14037c7ed
cmp eax, 0x44d64b0f
je 0x14037cf8e
cmp eax, 0x59fd37de
jne 0x14037d03a
mov eax, 0xc026f663
jmp 0x14037c7ed
cmp eax, 0x8dc70c12
je 0x14037cfb3
cmp eax, 0x958cc45a
je 0x14037ccce
jmp 0x14037c7ed
cmp eax, 0x1344eb
je 0x14037cfbd
cmp eax, 0x3f18226
jne 0x14037c7ed
mov eax, dword [0x140ae0bf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x316e1061
mov ecx, 0xd3190990
jmp 0x14037c7e0
cmp eax, 0xc026f663
je 0x14037cfd1
cmp eax, 0xc0cbc6aa
jne 0x14037c7ed
mov eax, dword [0x140ae0bf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8dc70c12
mov ecx, 0x65cfad35
jmp 0x14037c7e0
cmp eax, 0x65cfad35
je 0x14037ccce
cmp eax, 0x695055c1
jne 0x14037c7ed
mov dword [rsp + 0x5c], r15d
mov rax, qword [rsp + 0x60]
mov eax, dword [0x140ae0bf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb9209f23
cmove eax, r14d
cmp dword [0x140ae0bfc], 0xa
cmovl eax, r14d
jmp 0x14037c7ed
cmp eax, 0xb0d4a055
je 0x14037c7ba
cmp eax, 0xb41e9dbd
jne 0x14037c7ed
mov eax, dword [0x140ae0c08]
mov ecx, dword [0x140ae0c0c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rsp + 0x2b]
cmp ecx, 0xa
setl byte [rsp + 0x2c]
mov eax, 0x405da2dd
nop
cmp eax, 0x22900b0d
jg 0x14037cc00
cmp eax, 0x88b19b33
je 0x14037cfec
cmp eax, 0x8af2bb23
je 0x14037cc2d
cmp eax, 0xdf645168
jne 0x14037cbb0
mov rcx, rsi
call fcn.1402a0970
mov eax, dword [0x140ae0c08]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x327dc699
cmove eax, ebp
cmp dword [0x140ae0c0c], 0xa
cmovl eax, ebp
jmp 0x14037cbb0
cmp eax, 0x22900b0e
je 0x14037cc37
cmp eax, 0x327dc699
je 0x14037cc57
cmp eax, 0x405da2dd
jne 0x14037cbb0
mov cl, byte [rsp + 0x2b]
cmp byte [rsp + 0x2c], 0
mov eax, 0x327dc699
cmovne eax, ebx
test cl, cl
cmovne eax, ebx
jmp 0x14037cbb0
mov eax, 0x22900b0e
jmp 0x14037cbb0
mov eax, 0xde8a18f1
nop dword [rax]
cmp eax, 0xde8a18f1
je 0x14037cc50
cmp eax, 0xf07f3725
jne 0x14037cc40
jmp 0x14037cc69
mov eax, 0xf07f3725
jmp 0x14037cc40
mov rcx, rsi
call fcn.1402a0970
mov eax, 0xdf645168
jmp 0x14037cbb0
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov eax, 0x34637a74
nop dword [rax + rax]
cmp eax, 0x34637a74
je 0x14037cc90
cmp eax, 0x207eeee4
jne 0x14037cc80
jmp 0x14037cc97
mov eax, 0x207eeee4
jmp 0x14037cc80
mov eax, 0x88b19b33
jmp 0x14037cbb0
cmp eax, 0x1ad6ccb2
je 0x14037d00a
cmp eax, 0x1f5a2bfe
jne 0x14037c7ed
mov rdx, qword [rsp + 0x38]
mov rcx, rsi
call fcn.14024bb00
mov eax, 0x3d1b29f5
jmp 0x14037c7ed
mov eax, 0x695055c1
xor r15d, r15d
jmp 0x14037c7ed
mov rcx, qword [rsp + 0x30]
call rdi
mov eax, 0x2307f691
jmp 0x14037c7ed
cmp byte [rsp + 0x2d], 0
mov eax, 0x77ad51d
jmp 0x14037cdd9
mov eax, dword [0x140ae0bf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8dc70c12
cmove eax, r12d
cmp dword [0x140ae0bfc], 0xa
cmovl eax, r12d
jmp 0x14037c7ed
mov eax, 0x695055c1
mov r15d, dword [rsp + 0x4c]
jmp 0x14037c7ed
cmp dword [rsp + 0x50], 0
setne byte [rsp + 0x2e]
mov eax, 0x6520bfd1
jmp 0x14037c7ed
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x68]
call sub.KERNEL32.dll_Process32FirstW
lea rax, [rsp + 0x94]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
mov rcx, rsi
call fcn.14024bb00
mov dword [rsp + 0x48], eax
mov eax, 0x79220242
jmp 0x14037c7ed
mov eax, 0x695055c1
mov r15d, dword [rsp + 0x58]
jmp 0x14037c7ed
mov eax, dword [0x140ae0bf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x144f0915
mov ecx, 0xc13289ff
jmp 0x14037c7e0
mov rcx, qword [rsp + 0x30]
call rdi
mov eax, dword [0x140ae0bf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x144f0915
mov ecx, 0xe7165a89
jmp 0x14037c7e0
cmp byte [rsp + 0x2f], 0
mov eax, 0xcd3ce0c8
mov ecx, 0x792a2d86
cmovne eax, ecx
jmp 0x14037c7ed
mov eax, dword [0x140ae0bf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1f5a2bfe
cmove eax, r13d
cmp dword [0x140ae0bfc], 0xa
cmovl eax, r13d
jmp 0x14037c7ed
cmp dword [rsp + 0x48], 0
setne byte [rsp + 0x2d]
mov eax, 0xb0d4a055
jmp 0x14037c7ed
mov eax, dword [0x140ae0c08]
mov ecx, dword [0x140ae0c0c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rsp + 0x2b]
cmp ecx, 0xa
setl byte [rsp + 0x2c]
mov eax, 0x405da2dd
nop dword [rax]
cmp eax, 0x22900b0d
jg 0x14037cea0
cmp eax, 0x88b19b33
je 0x14037d030
cmp eax, 0x8af2bb23
je 0x14037cecd
cmp eax, 0xdf645168
jne 0x14037ce50
mov rcx, rsi
call fcn.1402a0970
mov eax, dword [0x140ae0c08]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x327dc699
cmove eax, ebp
cmp dword [0x140ae0c0c], 0xa
cmovl eax, ebp
jmp 0x14037ce50
cmp eax, 0x22900b0e
je 0x14037ced7
cmp eax, 0x327dc699
je 0x14037cef7
cmp eax, 0x405da2dd
jne 0x14037ce50
mov cl, byte [rsp + 0x2b]
cmp byte [rsp + 0x2c], 0
mov eax, 0x327dc699
cmovne eax, ebx
test cl, cl
cmovne eax, ebx
jmp 0x14037ce50
mov eax, 0x22900b0e
jmp 0x14037ce50
mov eax, 0xde8a18f1
nop dword [rax]
cmp eax, 0xde8a18f1
je 0x14037cef0
cmp eax, 0xf07f3725
jne 0x14037cee0
jmp 0x14037cf09
mov eax, 0xf07f3725
jmp 0x14037cee0
mov rcx, rsi
call fcn.1402a0970
mov eax, 0xdf645168
jmp 0x14037ce50
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov eax, 0x34637a74
nop dword [rax + rax]
cmp eax, 0x34637a74
je 0x14037cf30
cmp eax, 0x207eeee4
jne 0x14037cf20
jmp 0x14037cf37
mov eax, 0x207eeee4
jmp 0x14037cf20
mov eax, 0x88b19b33
jmp 0x14037ce50
mov rcx, qword [rsp + 0x30]
call rdi
mov eax, 0x44d64b0f
jmp 0x14037c7ed
mov eax, dword [0x140ae0bf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbdc3b106
mov ecx, 0x1ad6ccb2
jmp 0x14037c7e0
mov eax, 0x3f18226
jmp 0x14037c7ed
mov eax, 0x5d2240ce
jmp 0x14037c7ed
mov eax, 0x1344eb
jmp 0x14037c7ed
mov rcx, qword [rsp + 0x30]
call rdi
mov eax, dword [0x140ae0bf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb9dcf2e7
mov ecx, 0xd920e80c
jmp 0x14037c7e0
mov eax, 0xc0cbc6aa
jmp 0x14037c7ed
cmp dword [rsp + 0x54], 0
setne byte [rsp + 0x2f]
mov eax, 0xc6f6e637
jmp 0x14037c7ed
mov rax, qword [rsp + 0x30]
cmp rax, 0xffffffffffffffff
mov eax, 0xa44260f2
mov ecx, 0x958cc45a
cmove eax, ecx
jmp 0x14037c7ed
mov eax, dword [0x140ae0bf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb9209f23
mov ecx, 0x4b2affd4
jmp 0x14037c7e0
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x58], eax
mov eax, dword [0x140ae0bf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbdc3b106
mov ecx, 0xd83df9a4
jmp 0x14037c7e0
mov eax, 0xb41e9dbd
jmp 0x14037c7ed
cmp eax, 0x4b2affd4
jne 0x14037c7ed
mov esi, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140616370
mov eax, esi
add rsp, 0x2a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret