Function at 0x1400f7180
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov dword [rbp - 0x50], edx
mov rdi, rcx
mov rax, qword [0x1402b5380]
xor rax, rbp
mov qword [rbp], rax
mov eax, 0x3244996c
mov r15d, 0x2b7b1f82
mov ebx, 0x992b48cc
mov r12d, 0x1fc05bb2
mov r13d, 0xe0941ea8
jmp 0x1400f7220
mov eax, dword [0x1402b6668]
mov ecx, dword [0x1402b666c]
lea edx, [rax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete r8b
cmp ecx, 0xa
setl r9b
xor r9b, r8b
mov r8d, 0xa52aaa1a
mov r9d, 0xe2f963e9
cmovne r8d, r9d
test eax, edx
mov eax, r8d
cmove eax, r9d
cmp ecx, 0xa
cmovge eax, r8d
nop word cs:[rax + rax]
cmp eax, 0xe697f13a
jg 0x1400f7290
cmp eax, 0xbb50446e
jg 0x1400f72f0
cmp eax, 0xa135fea9
jg 0x1400f739d
cmp eax, 0x992b48cb
jle 0x1400f74e7
cmp eax, 0x9d02d7bf
jg 0x1400f7765
cmp eax, 0x992b48cc
je 0x1400f79e1
cmp eax, 0x9a086ee9
jne 0x1400f7220
mov eax, dword [0x1402b6668]
lea ecx, [rax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0x5ad643b4
mov r8d, 0xbcfeba7d
jmp 0x1400f7b9f
cmp eax, 0x2bde919b
jle 0x1400f7350
cmp eax, 0x4d7f84c3
jg 0x1400f7408
cmp eax, 0x3f5ed5b6
jle 0x1400f751e
cmp eax, 0x45d90dd2
jg 0x1400f77e6
cmp eax, 0x3f5ed5b7
je 0x1400f79eb
cmp eax, 0x400408f7
jne 0x1400f7220
mov rax, qword [rbp - 0x70]
mov r14d, dword [rax]
mov eax, 0x78c91455
jmp 0x1400f7220
cmp eax, 0xd69c4703
jg 0x1400f743e
cmp eax, 0xc3ce8931
jle 0x1400f75cb
cmp eax, 0xc9156b40
jg 0x1400f783c
cmp eax, 0xc3ce8932
je 0x1400f79f5
cmp eax, 0xc8af3a24
jne 0x1400f7220
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax]
mov rdx, qword [rbp - 0x20]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32Next
add rsp, 0x20
mov dword [rbp - 0x54], eax
mov eax, 0x7c0fbd44
jmp 0x1400f7220
cmp eax, 0x2644655
jg 0x1400f74a9
cmp eax, 0xf45afaf9
jle 0x1400f7624
cmp eax, 0xf7c1fd49
jg 0x1400f78a2
cmp eax, 0xf45afafa
je 0x1400f7a52
cmp eax, 0xf4a34328
jne 0x1400f7220
cmp dword [rbp - 0x58], 0
mov eax, 0xde1b6bbc
mov ecx, 0x2644656
cmove eax, ecx
jmp 0x1400f7220
cmp eax, 0xa6cc0d28
jle 0x1400f7653
cmp eax, 0xb3485878
jg 0x1400f78cc
cmp eax, 0xa6cc0d29
je 0x1400f7a66
cmp eax, 0xb27b9325
jne 0x1400f7220
mov eax, dword [0x1402b6668]
mov ecx, dword [0x1402b666c]
lea edx, [rax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl r8b
xor r8b, al
mov r8d, 0xfa08e78a
mov r9d, 0xc3ce8932
cmovne r8d, r9d
cmp edx, 0xffffffff
jmp 0x1400f7206
cmp eax, 0x694dd601
jle 0x1400f76da
cmp eax, 0x78c91454
jg 0x1400f78f6
cmp eax, 0x694dd602
je 0x1400f7a9d
cmp eax, 0x6e38603e
jne 0x1400f7220
mov eax, 0xc8af3a24
jmp 0x1400f7220
cmp eax, 0xde1b6bbb
jle 0x1400f770b
cmp eax, 0xe2f963e8
jg 0x1400f791e
cmp eax, 0xde1b6bbc
je 0x1400f7aa7
cmp eax, 0xe0941ea8
jne 0x1400f7220
mov rax, qword [rbp - 0x60]
mov eax, dword [rax]
mov dword [rbp - 0x58], eax
mov eax, dword [0x1402b6668]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0xd69c4704
mov r8d, 0xb3485879
cmove eax, r8d
cmp dword [0x1402b666c], 0xa
mov edx, 0xd69c4704
jmp 0x1400f7baf
cmp eax, 0x240d0aff
jg 0x1400f773a
cmp eax, 0xd180d80
jg 0x1400f7999
cmp eax, 0x2644656
je 0x1400f7af8
cmp eax, 0xa04e368
jne 0x1400f7220
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x60], rax
mov eax, 0x4d7f84c4
jmp 0x1400f7220
cmp eax, 0x80ef18af
je 0x1400f7b02
cmp eax, 0x831745c8
je 0x1400f7b2a
cmp eax, 0x85fb1768
jne 0x1400f7220
cmp byte [rbp - 0xc], 0
mov eax, 0x9d02d7c0
mov ecx, 0xbb50446f
cmovne eax, ecx
jmp 0x1400f7220
cmp eax, 0x2bde919c
je 0x1400f7b40
cmp eax, 0x2f605307
je 0x1400f7b54
cmp eax, 0x3244996c
jne 0x1400f7220
mov eax, reloc.WS2_32.dll_recv
call fcn.140238890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
mov eax, 0x130
call fcn.140238890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov eax, reloc.WS2_32.dll_recv
call fcn.140238890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
mov eax, Ordinal_50
call fcn.140238890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 8], rax
mov eax, reloc.WS2_32.dll_recv
call fcn.140238890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
mov eax, reloc.WS2_32.dll_recv
call fcn.140238890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x18], rdi
mov eax, 0xb27b9325
xor r14d, r14d
mov esi, dword [rbp - 0x50]
jmp 0x1400f7220
cmp eax, 0xbb50446f
je 0x1400f7b5e
cmp eax, 0xbcfeba7d
je 0x1400f7b74
cmp eax, 0xc2b06589
jne 0x1400f7220
mov eax, dword [0x1402b6668]
mov ecx, dword [0x1402b666c]
lea edx, [rax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete r8b
cmp ecx, 0xa
setl r9b
xor r9b, r8b
mov r8d, 0x2f605307
mov r9d, 0xd180d81
jmp 0x1400f7200
cmp eax, 0xe697f13b
je 0x1400f7bc0
cmp eax, 0xf1b1fa64
je 0x1400f7bd6
cmp eax, 0xf36a99e6
jne 0x1400f7220
mov dword [rbp - 0x48], r14d
mov eax, 0x9a086ee9
jmp 0x1400f7220
cmp eax, 0xa135feaa
je 0x1400f7be0
cmp eax, 0xa2f5e62c
je 0x1400f7c42
cmp eax, 0xa52aaa1a
jne 0x1400f7220
mov rax, qword [rbp - 8]
mov dword [rax], Ordinal_50
mov rax, qword [rbp - 8]
mov qword [rax + 8], 0
mov rax, qword [rbp - 8]
mov dword [rax + 0x18], 0
mov rax, qword [rbp - 8]
mov qword [rax + 0x10], 0
mov rax, qword [rbp - 8]
mov qword [rax + 0x20], 0
mov rax, qword [rbp - 8]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x30]
mov rax, qword [rbp - 0x30]
mov qword [rax], 0
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x18]
mov eax, 0xe2f963e9
jmp 0x1400f7220
cmp eax, 0x4d7f84c4
je 0x1400f7c58
cmp eax, 0x530c6255
je 0x1400f7c97
cmp eax, 0x5ad643b4
jne 0x1400f7220
mov eax, dword [rbp - 0x44]
mov eax, dword [rbp - 0x48]
mov eax, 0xbcfeba7d
jmp 0x1400f7220
cmp eax, 0xd69c4704
je 0x1400f7cab
cmp eax, 0xdbbdfd7e
je 0x1400f7cb9
cmp eax, 0xdc217c90
jne 0x1400f7220
mov rax, qword [rbp - 0x38]
mov eax, 0xf1b1fa64
jmp 0x1400f7220
cmp eax, 0x240d0b00
je 0x1400f7cc6
cmp eax, 0x2733568a
je 0x1400f7ce8
cmp eax, 0x2b7b1f82
jne 0x1400f7220
mov eax, 0x530c6255
jmp 0x1400f7220
cmp eax, 0x9d02d7c0
je 0x1400f7d10
cmp eax, 0x9e93eca6
jne 0x1400f7220
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x18]
movsxd rcx, dword [rcx]
mov qword [rax], rcx
mov rax, qword [rbp - 0x28]
mov qword [rax + 8], 0
mov eax, dword [0x1402b6668]
mov ecx, dword [0x1402b666c]
lea edx, [rax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl r8b
xor r8b, al
mov r8d, 0x80ef18af
mov r9d, 0x3f5ed5b7
cmovne r8d, r9d
cmp edx, 0xffffffff
mov eax, r8d
cmove eax, r9d
cmp ecx, 0xa
mov rcx, qword [rbp - 8]
cmovge eax, r8d
jmp 0x1400f7220
cmp eax, 0x45d90dd3
je 0x1400f7d1a
cmp eax, 0x47b95156
jne 0x1400f7220
mov eax, dword [0x1402b6668]
mov ecx, dword [0x1402b666c]
lea edx, [rax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl r8b
xor r8b, al
mov r8d, 0xdbbdfd7e
cmovne r8d, r12d
cmp edx, 0xffffffff
mov eax, r8d
cmove eax, r12d
jmp 0x1400f720d
cmp eax, 0xc9156b41
je 0x1400f71cd
cmp eax, 0xd34613ee
jne 0x1400f7220
mov eax, dword [0x1402b6668]
mov ecx, dword [0x1402b666c]
lea edx, [rax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete r8b
cmp ecx, 0xa
setl r9b
xor r9b, r8b
mov r8d, 0x45d90dd3
mov r9d, 0xe31d0f2c
cmovne r8d, r9d
test eax, edx
mov eax, r8d
cmove eax, r9d
cmp ecx, 0xa
mov rcx, qword [rbp - 0x38]
cmovge eax, r8d
jmp 0x1400f7220
cmp eax, 0xf7c1fd4a
je 0x1400f7d43
cmp eax, 0xfa08e78a
jne 0x1400f7220
mov rax, qword [rbp - 0x18]
mov dword [rax], esi
mov rax, qword [rbp - 0x18]
mov eax, 0xc3ce8932
jmp 0x1400f7220
cmp eax, 0xb3485879
je 0x1400f7d59
cmp eax, 0xb6c8f94b
jne 0x1400f7220
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x1c]
mov dword [rbp - 0x44], eax
mov eax, 0xf36a99e6
jmp 0x1400f7220
cmp eax, 0x78c91455
je 0x1400f7d63
cmp eax, 0x7c0fbd44
jne 0x1400f7220
cmp dword [rbp - 0x54], 0
setne byte [rbp - 0xa]
mov eax, 0xa2f5e62c
jmp 0x1400f7220
cmp eax, 0xe2f963e9
je 0x1400f7d6d
cmp eax, 0xe31d0f2c
jne 0x1400f7220
sub rsp, 0x20
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov rcx, qword [rbp - 0x38]
mov qword [rcx], rax
mov eax, dword [0x1402b6668]
mov ecx, dword [0x1402b666c]
lea edx, [rax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete r8b
cmp ecx, 0xa
setl r9b
xor r9b, r8b
mov r8d, 0x45d90dd3
cmovne r8d, r15d
test eax, edx
mov eax, r8d
cmove eax, r15d
cmp ecx, 0xa
mov rcx, qword [rbp - 0x20]
cmovge eax, r8d
jmp 0x1400f7220
cmp eax, 0x1fc05bb2
jne 0x1400f7e1e
mov esi, dword [rbp - 0x4c]
mov eax, dword [0x1402b6668]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0xdbbdfd7e
cmove eax, ebx
cmp dword [0x1402b666c], 0xa
mov edx, 0xdbbdfd7e
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, ebx
jmp 0x1400f7220
mov eax, 0x6e38603e
jmp 0x1400f7220
mov eax, 0xc9156b41
jmp 0x1400f7220
mov rax, qword [rbp - 0x18]
mov dword [rax], esi
mov eax, dword [0x1402b6668]
mov ecx, dword [0x1402b666c]
lea edx, [rax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete r8b
cmp ecx, 0xa
setl r9b
xor r9b, r8b
mov r8d, 0xfa08e78a
mov r9d, 0xe697f13b
cmovne r8d, r9d
test eax, edx
mov eax, r8d
cmove eax, r9d
cmp ecx, 0xa
mov rcx, qword [rbp - 0x18]
cmovge eax, r8d
cmp dword [rcx], 0
setne byte [rbp - 9]
jmp 0x1400f7220
mov rax, qword [rbp - 0x18]
mov dword [rax], esi
mov rax, qword [rbp - 0x20]
mov eax, 0xdc217c90
jmp 0x1400f7220
mov eax, dword [0x1402b6668]
lea ecx, [rax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0x2f605307
mov r8d, 0xc2b06589
cmove eax, r8d
cmp dword [0x1402b666c], 0xa
mov edx, 0x2f605307
jmp 0x1400f7baf
mov eax, 0xa135feaa
jmp 0x1400f7220
mov eax, dword [0x1402b6668]
mov ecx, dword [0x1402b666c]
lea edx, [rax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl r8b
xor r8b, al
mov r8d, 0x80ef18af
mov r9d, 0x9e93eca6
cmovne r8d, r9d
cmp edx, 0xffffffff
mov eax, r8d
cmove eax, r9d
cmp ecx, 0xa
mov rcx, qword [rbp - 0x28]
cmovge eax, r8d
jmp 0x1400f7220
mov eax, 0xa6cc0d29
jmp 0x1400f7220
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x18]
movsxd rcx, dword [rcx]
mov qword [rax], rcx
mov rax, qword [rbp - 0x28]
mov qword [rax + 8], 0
mov rax, qword [rbp - 8]
mov eax, 0x9e93eca6
jmp 0x1400f7220
cmp byte [rbp - 0xb], 0
mov eax, 0x2bde919c
mov ecx, 0xb6c8f94b
cmovne eax, ecx
jmp 0x1400f7220
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 8]
mov dword [rbp - 0x4c], eax
mov eax, 0x47b95156
jmp 0x1400f7220
mov eax, 0xc2b06589
jmp 0x1400f7220
mov rax, qword [rbp - 0x20]
add rax, 0x1c
mov qword [rbp - 0x70], rax
mov eax, 0x400408f7
jmp 0x1400f7220
mov eax, dword [rbp - 0x44]
cmp eax, dword [rbp - 0x48]
seta byte [rbp - 0xc]
mov eax, dword [0x1402b6668]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0x5ad643b4
mov r8d, 0x85fb1768
cmove eax, r8d
cmp dword [0x1402b666c], 0xa
mov edx, 0x5ad643b4
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, r8d
jmp 0x1400f7220
cmp byte [rbp - 9], 0
mov eax, 0xd34613ee
mov ecx, 0xa04e368
cmovne eax, ecx
jmp 0x1400f7220
mov eax, 0xa04e368
jmp 0x1400f7220
mov r9, qword [rbp - 0x28]
mov r8, qword [rbp - 8]
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x78]
sub rsp, 0x20
mov edx, gethostname
call rax
add rsp, 0x20
mov rcx, qword [rbp - 0x40]
mov dword [rcx], eax
mov rax, qword [rbp - 0x40]
mov ecx, dword [rax]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_SetLastError]
add rsp, 0x20
mov rax, qword [rbp - 0x30]
mov rax, qword [rax]
mov rcx, qword [rbp - 0x18]
mov qword [rcx + 0x10], rax
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x30]
mov rax, qword [rbp - 8]
mov rax, qword [rbp - 0x28]
mov eax, 0x2644656
jmp 0x1400f7220
cmp byte [rbp - 0xa], 0
mov eax, 0xf45afafa
mov ecx, 0xf7c1fd4a
cmovne eax, ecx
jmp 0x1400f7220
mov eax, dword [0x1402b6668]
mov ecx, dword [0x1402b666c]
lea edx, [rax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete r8b
cmp ecx, 0xa
setl r9b
xor r9b, r8b
mov r8d, 0xd69c4704
cmovne r8d, r13d
test eax, edx
mov eax, r8d
cmove eax, r13d
jmp 0x1400f720d
mov rax, qword [rbp - 0x20]
mov dword [rax], 0x130
mov eax, 0x240d0b00
jmp 0x1400f7220
mov rax, qword [rbp - 0x60]
mov eax, 0xe0941ea8
jmp 0x1400f7220
mov eax, 0x1fc05bb2
mov esi, dword [rbp - 0x4c]
jmp 0x1400f7220
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax]
mov rdx, qword [rbp - 0x20]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32First
add rsp, 0x20
mov eax, 0xc8af3a24
jmp 0x1400f7220
mov rcx, qword [rbp - 0x68]
sub rsp, 0x20
lea rdx, str.HD_Player.exe
call fcn.1400f6ef0
add rsp, 0x20
test eax, eax
sete byte [rbp - 0xb]
mov eax, 0x831745c8
jmp 0x1400f7220
mov eax, 0x2bde919c
jmp 0x1400f7220
sub rsp, 0x20
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov rcx, qword [rbp - 0x38]
mov qword [rcx], rax
mov rax, qword [rbp - 0x20]
mov eax, 0xe31d0f2c
jmp 0x1400f7220
mov rax, qword [rbp - 0x20]
add rax, 0x2c
mov qword [rbp - 0x68], rax
mov eax, 0x2733568a
jmp 0x1400f7220
mov eax, 0xf4a34328
jmp 0x1400f7220
mov eax, 0x9d02d7c0
jmp 0x1400f7220
mov rax, qword [rbp - 8]
mov dword [rax], Ordinal_50
mov rax, qword [rbp - 8]
mov qword [rax + 8], 0
mov rax, qword [rbp - 8]
mov dword [rax + 0x18], 0
mov rax, qword [rbp - 8]
mov qword [rax + 0x10], 0
mov rax, qword [rbp - 8]
mov qword [rax + 0x20], 0
mov rax, qword [rbp - 8]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x30]
mov rax, qword [rbp - 0x30]
mov qword [rax], 0
mov eax, dword [0x1402b6668]
mov ecx, dword [0x1402b666c]
lea edx, [rax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl r8b
xor r8b, al
mov r8d, 0xa52aaa1a
mov r9d, 0x694dd602
cmovne r8d, r9d
cmp edx, 0xffffffff
mov eax, r8d
cmove eax, r9d
cmp ecx, 0xa
mov rcx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x18]
mov rcx, qword [rcx + 0x30]
mov qword [rbp - 0x78], rcx
cmovge eax, r8d
jmp 0x1400f7220
cmp eax, 0xd180d81
jne 0x1400f7220
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.1402388f0
nop
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret