Function at 0x14024eaa0
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a8
mov rsi, rdx
mov rax, qword [0x140b74de8]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
lea r15, [rsp + 0x68]
mov qword [rsp + 0x50], r15
mov rax, qword [rsp + 0x50]
mov eax, 0xd704c20f
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, 0x7dc23361
mov r12d, 0xced3fe8f
mov r13d, 0xfea22e4a
mov ebp, 0x6f12c
jmp 0x14024eb10
cmp eax, 0x9f8ba2be
jne 0x14024eb10
mov eax, 0x508ad456
xor edi, edi
nop word [rax + rax]
cmp eax, 0x8a9697
jg 0x14024eb60
cmp eax, 0xced3fe8e
jle 0x14024ebd0
cmp eax, 0xe8180c17
jg 0x14024ec68
cmp eax, 0xd2951e2a
jg 0x14024ed34
cmp eax, 0xced3fe8f
je 0x14024ee23
cmp eax, 0xced91db8
jne 0x14024eb10
mov eax, 0xfea22e4a
jmp 0x14024eb10
cmp eax, 0x2ebb5436
jle 0x14024ec10
cmp eax, 0x585f2d1e
jle 0x14024ec98
cmp eax, 0x6398d7f5
jg 0x14024ed5c
cmp eax, 0x585f2d1f
je 0x14024ee41
cmp eax, 0x5f7a6faa
jne 0x14024eb10
cmp dword [rsp + 0x3c], 0
setne byte [rsp + 0x2f]
mov eax, dword [0x140b7e8b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc351598
cmove eax, ebp
cmp dword [0x140b7e8b4], 0xa
cmovl eax, ebp
jmp 0x14024eb10
cmp eax, 0xa674ca2f
jle 0x14024ece1
cmp eax, 0xc51d6d6c
jg 0x14024ed89
cmp eax, 0xa674ca30
je 0x14024ee76
cmp eax, 0xb8b3fbd3
jne 0x14024eb10
mov rcx, qword [rsp + 0x30]
call rbx
mov eax, 0xe8180c18
jmp 0x14024eb10
cmp eax, 0x189c88ac
jle 0x14024ed05
cmp eax, 0x1d1ad179
jg 0x14024edb3
cmp eax, 0x189c88ad
je 0x14024ee91
cmp eax, 0x1c844858
jne 0x14024eb10
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 0xffffffffffffffff
mov eax, 0x585f2d1f
mov ecx, 0x8a9698
cmove eax, ecx
jmp 0x14024eb10
cmp eax, 0xfea22e49
jg 0x14024eddd
cmp eax, 0xe8180c18
je 0x14024eea2
cmp eax, 0xe9f1f563
jne 0x14024eb10
cmp byte [rsp + 0x2f], 0
mov eax, 0xb8b3fbd3
jmp 0x14024eedd
cmp eax, 0x36251986
jg 0x14024edfd
cmp eax, 0x2ebb5437
je 0x14024eeb4
cmp eax, 0x2f205acb
jne 0x14024eb10
mov eax, dword [0x140b7e8b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xced91db8
cmove eax, r13d
cmp dword [0x140b7e8b4], 0xa
cmovl eax, r13d
jmp 0x14024eb10
cmp eax, 0x879eeba7
je 0x14024eec2
cmp eax, 0x8e59a307
jne 0x14024eafc
mov eax, 0x508ad456
mov edi, dword [rsp + 0x44]
jmp 0x14024eb10
cmp eax, 0x8a9698
je 0x14024eb03
cmp eax, 0x39e36fd
je 0x14024eed3
cmp eax, 0xc351598
jne 0x14024eb10
mov eax, dword [rsp + 0x3c]
mov eax, 0x5f7a6faa
jmp 0x14024eb10
cmp eax, 0xd2951e2b
je 0x14024eeea
cmp eax, 0xd704c20f
jne 0x14024eb10
mov dword [rsp + 0x68], 0x238
mov eax, 0x1c844858
jmp 0x14024eb10
cmp eax, 0x6398d7f6
je 0x14024ef15
cmp eax, 0x7dc23361
jne 0x14024eb10
cmp byte [rsp + 0x2e], 0
mov eax, 0x189c88ad
mov ecx, 0x36251987
cmovne eax, ecx
jmp 0x14024eb10
cmp eax, 0xc51d6d6d
je 0x14024ef27
cmp eax, 0xc7dbcb6e
jne 0x14024eb10
cmp dword [rsp + 0x40], 0
setne byte [rsp + 0x2d]
mov eax, 0x39e36fd
jmp 0x14024eb10
cmp eax, 0x1d1ad17a
je 0x14024ef31
cmp eax, 0x237cbc76
jne 0x14024eb10
cmp dword [rsp + 0x48], 0
setne byte [rsp + 0x2e]
mov eax, 0x2f205acb
jmp 0x14024eb10
cmp eax, 0xfea22e4a
je 0x14024ef59
cmp eax, 0x6f12c
jne 0x14024eb10
mov eax, 0x1d1ad17a
jmp 0x14024eb10
cmp eax, 0x36251987
jne 0x14024ef81
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.14024f020
mov dword [rsp + 0x3c], eax
mov eax, 0xd2951e2b
jmp 0x14024eb10
mov eax, dword [0x140b7e8b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc51d6d6d
mov ecx, 0xe9f1f563
jmp 0x14024ef03
mov rcx, qword [rsp + 0x30]
mov rdx, r15
call sub.KERNEL32.dll_Process32FirstW
lea rax, [rsp + 0x94]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.14024f020
mov dword [rsp + 0x40], eax
mov eax, 0xc7dbcb6e
jmp 0x14024eb10
mov rcx, qword [rsp + 0x30]
mov rdx, r15
call sub.KERNEL32.dll_Process32NextW
mov dword [rsp + 0x48], eax
mov eax, 0x237cbc76
jmp 0x14024eb10
mov rcx, qword [rsp + 0x30]
call rbx
mov eax, 0x9f8ba2be
jmp 0x14024eb10
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x4c], eax
mov eax, 0x2ebb5437
jmp 0x14024eb10
mov eax, 0x508ad456
mov edi, dword [rsp + 0x4c]
jmp 0x14024eb10
mov rcx, qword [rsp + 0x30]
call rbx
mov eax, 0x6398d7f6
jmp 0x14024eb10
cmp byte [rsp + 0x2d], 0
mov eax, 0x879eeba7
mov ecx, 0xa674ca30
cmovne eax, ecx
jmp 0x14024eb10
mov eax, dword [0x140b7e8b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc351598
mov ecx, 0x5f7a6faa
cmove eax, ecx
cmp dword [0x140b7e8b4], 0xa
cmovl eax, ecx
jmp 0x14024eb10
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x44], eax
mov eax, 0x8e59a307
jmp 0x14024eb10
mov eax, 0xced3fe8f
jmp 0x14024eb10
mov eax, dword [0x140b7e8b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc51d6d6d
cmove eax, r12d
cmp dword [0x140b7e8b4], 0xa
cmovl eax, r12d
jmp 0x14024eb10
mov eax, dword [0x140b7e8b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xced91db8
cmove eax, r14d
cmp dword [0x140b7e8b4], 0xa
cmovl eax, r14d
jmp 0x14024eb10
cmp eax, 0x508ad456
jne 0x14024eb10
mov rax, qword [rsp + 0x50]
mov rcx, rsi
call fcn.14028f210
mov eax, 0xfebf9abd
nop
cmp eax, 0xf9693aa6
je 0x14024efed
cmp eax, 0xfebf9abd
jne 0x14024efa0
mov eax, 0xe0a5c223
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0xe0a5c223
je 0x14024efd0
cmp eax, 0x2008cb38
jne 0x14024efc0
jmp 0x14024efd7
mov eax, 0x2008cb38
jmp 0x14024efc0
mov qword [rsp + 0x60], rsi
mov rcx, qword [rsp + 0x60]
call fcn.14028f5f0
mov eax, 0xf9693aa6
jmp 0x14024efa0
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1406ad9c0
mov eax, edi
add rsp, 0x2a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret