Function at 0x14000a6e0
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
mov qword [rsp + 0x40], rcx
mov rax, qword [0x140029090]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea r14, [rsp + 0x50]
mov qword [rsp + 0x48], r14
mov rax, qword [rsp + 0x48]
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
mov eax, 0x30b571cb
mov ebp, 0x9d3d2cd1
mov ebx, 0x4af28f50
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0xa0070486
jmp 0x14000a77d
mov dword [rsp + 0x3c], r12d
mov rax, qword [rsp + 0x48]
mov eax, dword [0x14002b87c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x349f63f1
mov ecx, 0xa113c4d6
nop word [rax + rax]
cmove eax, ecx
cmp dword [0x14002b878], 0xa
cmovl eax, ecx
cmp eax, 0x23da275
jg 0x14000a860
cmp eax, 0xa4fbcf2f
jg 0x14000a8c0
cmp eax, 0x91ae8c57
jle 0x14000a96b
cmp eax, 0xa0070485
jg 0x14000aa3a
cmp eax, 0x91ae8c58
je 0x14000aacb
cmp eax, 0x9769ac90
jne 0x14000a77d
mov eax, dword [0x14002b874]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete byte [rsp + 0x23]
mov eax, dword [0x14002b870]
mov r13d, 0x7d02d207
cmove r13d, ebp
cmp eax, 0xa
setl byte [rsp + 0x24]
cmovl r13d, ebp
mov eax, 0x5e48f2b
cmp eax, 0x4af28f4f
jg 0x14000a830
cmp eax, 0x9d3d2cd1
je 0x14000aaee
cmp eax, 0x5e48f2b
jne 0x14000a7f0
movzx ecx, byte [rsp + 0x23]
cmp byte [rsp + 0x24], 0
mov eax, 0x7d02d207
cmovne eax, ebx
test cl, cl
cmovne eax, ebx
jmp 0x14000a7f0
cmp eax, 0x4af28f50
je 0x14000a845
cmp eax, 0x7d02d207
jne 0x14000a7f0
mov eax, 0x4af28f50
jmp 0x14000a7f0
lea rcx, [rsp + 0x7c]
mov rdx, qword [rsp + 0x40]
call fcn.14000fd24
mov qword [rsp + 0x30], rax
mov eax, r13d
jmp 0x14000a7f0
cmp eax, 0x509db9f0
jle 0x14000a920
cmp eax, 0x5d3018a6
jle 0x14000a9a3
cmp eax, 0x74e1edee
jg 0x14000aa6e
cmp eax, 0x5d3018a7
je 0x14000a747
cmp eax, 0x6aa6e38f
jne 0x14000a77d
mov eax, dword [0x14002b87c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf08a4d74
mov ecx, 0x1942485c
jmp 0x14000a770
cmp eax, 0xbb8fe3d8
jg 0x14000a9d6
cmp eax, 0xb0f40244
jg 0x14000aaa2
cmp eax, 0xa4fbcf30
je 0x14000ab17
cmp eax, 0xad8da553
jne 0x14000a77d
mov rcx, qword [rsp + 0x28]
mov rdx, r14
call sub.KERNEL32.dll_Process32Next
test eax, eax
setne byte [rsp + 0x27]
mov eax, dword [0x14002b87c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8aba7923
mov ecx, 0xf75481b0
jmp 0x14000a770
cmp eax, 0x1942485b
jg 0x14000aa0f
cmp eax, 0x23da276
je 0x14000ab26
cmp eax, 0x13aa8b01
je 0x14000abcd
cmp eax, 0x152ca9a1
jne 0x14000a77d
mov dword [rsp + 0x50], 0x130
mov rcx, qword [rsp + 0x28]
mov rdx, r14
call sub.KERNEL32.dll_Process32First
mov eax, 0x860636eb
jmp 0x14000a77d
cmp eax, 0x81a315c7
je 0x14000abf2
cmp eax, 0x860636eb
je 0x14000ac01
cmp eax, 0x8aba7923
jne 0x14000a77d
mov rcx, qword [rsp + 0x28]
mov rdx, r14
call sub.KERNEL32.dll_Process32Next
mov eax, 0xad8da553
jmp 0x14000a77d
cmp eax, 0x509db9f1
je 0x14000ac3b
cmp eax, 0x50c280eb
je 0x14000ac52
cmp eax, 0x5bf32e9a
jne 0x14000a77d
cmp byte [rsp + 0x25], 0
mov eax, 0x509db9f1
cmovne eax, edi
jmp 0x14000a77d
cmp eax, 0xbb8fe3d9
je 0x14000ac69
cmp eax, 0xf08a4d74
je 0x14000ac7a
cmp eax, 0xf75481b0
jne 0x14000a77d
cmp byte [rsp + 0x27], 0
mov eax, 0x91ae8c58
cmovne eax, edi
mov r15d, 0xffffffff
jmp 0x14000a77d
cmp eax, 0x1942485c
je 0x14000ac42
cmp eax, 0x30b571cb
je 0x14000ac84
cmp eax, 0x349f63f1
jne 0x14000a77d
mov eax, 0xa113c4d6
jmp 0x14000a77d
cmp eax, 0xa0070486
je 0x14000ac9f
cmp eax, 0xa113c4d6
jne 0x14000a77d
mov eax, dword [0x14002b87c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x349f63f1
mov ecx, 0xb0f40245
jmp 0x14000a770
cmp eax, 0x74e1edef
je 0x14000acbd
cmp eax, 0x7bfc736e
jne 0x14000a77d
mov eax, dword [0x14002b87c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x152ca9a1
mov ecx, 0x860636eb
jmp 0x14000a770
cmp eax, 0xb7f6c823
jne 0x14000acf2
mov eax, dword [0x14002b87c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf08a4d74
mov ecx, 0x6aa6e38f
jmp 0x14000a770
mov dword [rsp + 0x38], r15d
mov eax, dword [0x14002b87c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbb8fe3d9
mov ecx, 0x13aa8b01
jmp 0x14000a770
cmp qword [rsp + 0x30], 0
setne byte [rsp + 0x26]
mov eax, dword [0x14002b87c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x23da276
mov ecx, 0x50c280eb
jmp 0x14000a770
mov eax, 0x5d3018a7
mov r12d, dword [rsp + 0x38]
jmp 0x14000a77d
mov rdi, rsi
mov eax, dword [0x14002b874]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete byte [rsp + 0x23]
mov eax, dword [0x14002b870]
mov esi, 0x7d02d207
cmove esi, ebp
cmp eax, 0xa
setl byte [rsp + 0x24]
cmovl esi, ebp
mov eax, 0x5e48f2b
nop dword [rax + rax]
cmp eax, 0x4af28f4f
jg 0x14000aba0
cmp eax, 0x9d3d2cd1
je 0x14000acdb
cmp eax, 0x5e48f2b
jne 0x14000ab60
movzx ecx, byte [rsp + 0x23]
cmp byte [rsp + 0x24], 0
mov eax, 0x7d02d207
cmovne eax, ebx
test cl, cl
cmovne eax, ebx
jmp 0x14000ab60
cmp eax, 0x4af28f50
je 0x14000abb5
cmp eax, 0x7d02d207
jne 0x14000ab60
mov eax, 0x4af28f50
jmp 0x14000ab60
lea rcx, [rsp + 0x7c]
mov rdx, qword [rsp + 0x40]
call fcn.14000fd24
mov qword [rsp + 0x30], rax
mov eax, esi
jmp 0x14000ab60
mov rcx, qword [rsp + 0x28]
call rsi
mov eax, dword [0x14002b87c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbb8fe3d9
mov ecx, 0xa4fbcf30
jmp 0x14000a770
mov eax, 0x91ae8c58
mov r15d, dword [rsp + 0x58]
jmp 0x14000a77d
mov dword [rsp + 0x50], 0x130
mov rcx, qword [rsp + 0x28]
mov rdx, r14
call sub.KERNEL32.dll_Process32First
test eax, eax
setne byte [rsp + 0x25]
mov eax, dword [0x14002b87c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x152ca9a1
mov ecx, 0x5bf32e9a
jmp 0x14000a770
mov rcx, qword [rsp + 0x28]
call rsi
mov eax, 0x5d3018a7
mov r12d, 0xffffffff
jmp 0x14000a77d
cmp byte [rsp + 0x26], 0
mov eax, 0x74e1edef
mov ecx, 0x81a315c7
cmovne eax, ecx
jmp 0x14000a77d
mov rcx, qword [rsp + 0x28]
call rsi
mov eax, 0x13aa8b01
jmp 0x14000a77d
mov eax, 0x6aa6e38f
jmp 0x14000a77d
mov rax, qword [rsp + 0x28]
cmp rax, 0xffffffffffffffff
mov eax, 0x7bfc736e
mov ecx, 0xb7f6c823
cmove eax, ecx
jmp 0x14000a77d
mov eax, dword [0x14002b87c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x23da276
mov ecx, 0x9769ac90
jmp 0x14000a770
mov eax, dword [0x14002b87c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8aba7923
mov ecx, 0xad8da553
jmp 0x14000a770
mov rax, qword [rsp + 0x30]
mov eax, 0x9769ac90
mov rsi, rdi
mov edi, 0xa0070486
jmp 0x14000a77d
cmp eax, 0xb0f40245
jne 0x14000a77d
mov esi, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14000d8c0
mov eax, esi
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret