Function at 0x14005bb60
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
xor r15d, r15d
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005bc06
nop dword [rax + rax]
lea rdx, [0x1400fbc10]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14005bbe4
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14005bbe4
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005bbc0
test edi, edi
je 0x14005bc06
lea rax, [0x1400fbc10]
jmp 0x14005c27c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005bc8a
lea rdx, [0x1400fbc30]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14005bc68
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14005bc68
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005bc44
test edi, edi
je 0x14005bc8a
lea rax, [0x1400fbc30]
jmp 0x14005c27c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005bd16
nop dword [rax + rax]
lea rdx, [0x1400fbc48]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14005bcf4
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14005bcf4
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005bcd0
test edi, edi
je 0x14005bd16
lea rax, [0x1400fbc48]
jmp 0x14005c27c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005bd9a
lea rdx, [0x1400fbc60]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14005bd78
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14005bd78
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005bd54
test edi, edi
je 0x14005bd9a
lea rax, [0x1400fbc60]
jmp 0x14005c27c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005be26
nop dword [rax + rax]
lea rdx, [0x1400fbc78]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14005be04
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14005be04
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005bde0
test edi, edi
je 0x14005be26
lea rax, [0x1400fbc78]
jmp 0x14005c27c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005beaa
lea rdx, [0x1400fbdc0]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14005be88
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14005be88
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005be64
test edi, edi
je 0x14005beaa
lea rax, [0x1400fbdc0]
jmp 0x14005c27c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005bf36
nop dword [rax + rax]
lea rdx, [0x1400fbdd0]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14005bf14
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14005bf14
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005bef0
test edi, edi
je 0x14005bf36
lea rax, [0x1400fbdd0]
jmp 0x14005c27c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005bfba
lea rdx, [0x1400fbde0]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14005bf98
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14005bf98
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005bf74
test edi, edi
je 0x14005bfba
lea rax, [0x1400fbde0]
jmp 0x14005c27c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005c046
nop dword [rax + rax]
lea rdx, [0x1400fbdf0]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14005c024
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14005c024
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005c000
test edi, edi
je 0x14005c046
lea rax, [0x1400fbdf0]
jmp 0x14005c27c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005c0ca
lea rdx, [0x1400fbe00]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14005c0a8
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14005c0a8
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005c084
test edi, edi
je 0x14005c0ca
lea rax, [0x1400fbe00]
jmp 0x14005c27c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005c156
nop dword [rax + rax]
lea rdx, [0x1400fbe18]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14005c134
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14005c134
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005c110
test edi, edi
je 0x14005c156
lea rax, [0x1400fbe18]
jmp 0x14005c27c
xor edx, edx
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005c1da
lea rdx, [0x1400fbe28]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14005c1b8
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14005c1b8
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005c194
test edi, edi
je 0x14005c1da
lea rax, [0x1400fbe28]
jmp 0x14005c27c
xor edx, edx
mov qword [rsp + 0x170], r14
mov ecx, 2
mov esi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005c26d
lea rdi, [0x1400fbe38]
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14005c250
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14005c250
mov esi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005c230
test esi, esi
cmove r15, rdi
mov rax, r15
jmp 0x14005c274
lea rax, [0x1400fbe38]
mov r14, qword [rsp + 0x170]
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret