Function at 0x14000d438
Capabilities:
Enumerate processes

Disassembly:
test edx, edx
je 0x14000d7b8
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x318
mov rax, qword [0x140029c30]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov ebp, r8d
or r8, 0xffffffffffffffff
mov edi, r9d
mov dword [rsp + 0x40], r9d
mov esi, edx
mov rbx, rcx
mov dword [rsp + 0x20], edx
lea edx, [r8 + 0x11]
lea r9, [0x1400230e0]
lea rcx, [rsp + 0x2a0]
call fcn.140016e78
or r8, 0xffffffffffffffff
lea r9, [0x1400230e0]
lea rcx, [rsp + 0x2e0]
lea edx, [r8 + 0x11]
mov dword [rsp + 0x20], ebp
call fcn.140016e78
lea rcx, [rsp + 0x2e0]
lea rax, [rbx + 2]
mov r10d, 4
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x2a0]
mov r8, rax
mov edx, 0x400003ff
movzx ecx, r10w
mov qword [rsp + 0x48], rax
call fcn.140007160
mov r8d, esi
xor edx, edx
mov ecx, 0x100411
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14000d62b
or r8, 0xffffffffffffffff
lea r9, [0x1400230e0]
lea rcx, [rsp + 0x2c0]
lea edx, [r8 + 0x11]
mov dword [rsp + 0x20], edi
call fcn.140016e78
mov eax, 4
lea rdi, [rbx + 2]
lea r9, [rsp + 0x2c0]
lea r8, [rsp + 0x2a0]
movzx ecx, ax
mov edx, 0x40000403
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
call fcn.140007160
mov rdx, qword [rsp + 0x58]
mov r9d, ebp
mov r8d, esi
mov rcx, rbx
call fcn.14000d300
test eax, eax
jne 0x14000d5cb
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000d58a
cmp dword [rsp + 0x50], 0x103
jne 0x14000d5cb
test byte [rbx + 0x704b8], 8
je 0x14000d5e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006fa0
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
mov eax, 1
mov r9, rdi
movzx ecx, ax
mov edx, 0xc0000404
call fcn.140007160
mov rcx, qword [rsp + 0x58]
mov edi, 2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000d669
lea rax, str.AppStopMethodSkip
mov qword [rsp + 0x30], 0
mov r8, rdi
mov qword [rsp + 0x28], rax
lea rax, str.NSSM
mov edi, 2
lea r9, [rsp + 0x2a0]
mov edx, 0x8000041d
movzx ecx, di
mov qword [rsp + 0x20], rax
call fcn.140007160
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000d669
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006fa0
mov ecx, 1
lea r9, [rbx + 2]
lea r8, [rsp + 0x2a0]
movzx ecx, cx
mov edx, 0xc0000402
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.140007160
mov edi, 2
xor edx, edx
mov ecx, edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
test rax, rax
jne 0x14000d6ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006fa0
mov r8, qword [rsp + 0x48]
mov edx, 0xc0000400
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], rdi
movzx ecx, ax
call fcn.140007160
jmp 0x14000d79d
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x238
call fcn.1400174b0
lea rdx, [rsp + 0x60]
mov rcx, rdi
mov dword [rsp + 0x60], 0x238
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000d764
lea rdx, [rsp + 0x60]
mov r8d, esi
mov rcx, rbx
call fcn.14000ce10
test eax, eax
jne 0x14000d702
mov r9d, dword [rsp + 0x40]
mov edx, dword [rsp + 0x68]
mov r8d, ebp
mov rcx, rbx
call fcn.14000d430
lea rdx, [rsp + 0x60]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x14000d759
nop word [rax + rax]
lea rdx, [rsp + 0x60]
mov r8d, esi
mov rcx, rbx
call fcn.14000ce10
test eax, eax
jne 0x14000d748
mov r9d, dword [rsp + 0x40]
mov edx, dword [rsp + 0x68]
mov r8d, ebp
mov rcx, rbx
call fcn.14000d430
lea rdx, [rsp + 0x60]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000d720
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x14000d794
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006fa0
mov r8, qword [rsp + 0x48]
mov edx, 0xc0000401
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], 0
movzx ecx, ax
call fcn.140007160
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.140017480
add rsp, 0x318
pop rdi
pop rsi
pop rbp
pop rbx
repz ret