Function at 0x140001000
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x10], rdx
mov qword [rbp - 0x20], rcx
mov eax, 0x40cad0f5
cmp eax, 0xe4c6484f
je 0x1400018c2
mov eax, 0x7a23a867
cmp eax, 0xcf0dfeb9
mov rdi, qword [rbp - 0x20]
je 0x140001c84
mov eax, 0x40
call fcn.14000f800
sub rsp, rax
mov rbx, rsp
sub rsp, 0x20
lea rcx, str.3b51317649467321523b4f4a4261794555516a7351263a56226742395f663e4638292f6d5a4b3c6b5b722c79505477792d29
lea rdx, str.6014632406142e011b55392b2e081d651d1024371d631a224d47324b30055b354b095c033b3b4f0334065f590b7113242729
mov r8, rbx
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r14, rsp
sub rsp, 0x20
lea rcx, str.44565a4d454c5259534c4d454f55494b4150544d474f504c584b42464e5742594d494c4946524847575a4a
lea rdx, str.5b5a514453435d20557a6770722076797420787a6161746378646620636e70617161646d78205b257a5d0a00
mov r8, r14
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x20
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.494c565149504d52555651414d435451434e434f4b
lea rdx, str.58636a736d68652068766365206f746a657567720a00
mov qword [rbp - 0x50], r8
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.4e42554f545a5057445657444257535a43524b4e574c50554b5a50564c42574b44574553575249565a5a5150
lea rdx, str.5b215d204d716e65716220777020676f67652075777973666f206469202568632c207366206771792025740a00
mov qword [rbp - 0x48], r8
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
sub rsp, 0x20
lea rcx, str.5b585d20436f756c64206e6f74206f70656e2068616e646c65206f6e2025642c20636f6e74696e75696e670a00
mov qword [rbp - 0x40], rdx
call fcn.140003030
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.26727d3f2d21662942725f2a39304c3b627c69704a4d5438785d6e25307a79747a702e
lea rdx, str.7d59201f7e54054a27012c4c4c5c2042421b06046a2535561c310b055f1459511e7a2e
mov qword [rbp - 0x38], r8
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov qword [rbp], rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r15, rsp
mov eax, 0x130
call fcn.14000f800
sub rsp, rax
mov r13, rsp
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x18]
mov qword [rcx], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp - 0x10]
mov qword [rdx], rax
mov r12, r8
mov qword [r8], rdi
mov dword [rsi], 0
mov qword [rbp - 8], r9
mov qword [r9], 0
sub rsp, 0x20
mov ecx, 0xf
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov qword [r15], rax
mov rax, 0xffffffffffffffff
cmp qword [r15], rax
sete al
mov ecx, 0xf9989d59
cmp ecx, 0x69f2a0ae
setne cl
mov edx, 0xd044001c
cmp edx, 0x75aa6d6d
je 0x140001c84
test cl, 1
jne 0x140001251
jmp 0x1400018c2
mov ecx, 0xdc757d6a
cmp ecx, 0x485c96c1
je 0x140002122
mov ecx, 0xda0217b0
cmp ecx, 0x3ca5f17d
je 0x140002122
test al, 1
jne 0x14000127c
jmp 0x14000135b
mov eax, 0xd64e041f
cmp eax, 0x6d1beaa
je 0x140002127
mov eax, 0xfdb996a3
cmp eax, 0x33ee9150
setne al
mov ecx, 0x63198807
cmp ecx, 0x755a3c50
je 0x140002127
test al, 1
mov rsi, qword [rbp]
jne 0x1400012b7
jmp 0x140001e27
mov eax, 0x82574cdb
cmp eax, 0xbf106c8b
je 0x14000212c
mov eax, 0x16ae4efb
cmp eax, 0xcf8b1c0f
setne al
mov ecx, 0x54945d22
cmp ecx, 0x1afbf013
setne cl
mov edx, 0x1329be25
cmp edx, 0x50027f4b
je 0x14000212c
test cl, 1
jne 0x1400012fd
jmp 0x140001e27
mov ecx, 0x4e027a50
cmp ecx, 0xd1dd5178
je 0x140002131
mov ecx, 0x8d8da21d
cmp ecx, 0xf1bb09f6
je 0x140002131
test al, 1
jne 0x140001328
jmp 0x140001ab0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edx, eax
call fcn.140002f60
add rsp, 0x20
mov dword [rsi], 0
mov eax, 0xf48872af
cmp eax, 0xbe2faf02
je 0x140001ab0
jmp 0x1400017f3
mov eax, 0x664100a
cmp eax, 0x988c9fdf
je 0x140001e2c
mov dword [r13], 0x130
mov rcx, qword [r15]
sub rsp, 0x20
mov rdx, r13
call sub.KERNEL32.dll_Process32First
add rsp, 0x20
cmp eax, 0
setne al
mov ecx, 0xf4373b8e
cmp ecx, 0x9e8aed87
je 0x140001e2c
test al, 1
jne 0x1400013ea
jmp 0x1400013a3
mov eax, 0x8aee7512
cmp eax, 0x2e6a865d
mov rsi, qword [rbp]
je 0x140001e4c
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
mov edx, eax
call fcn.140002f60
add rsp, 0x20
mov dword [rsi], 0
mov eax, 0x6fb9caa7
cmp eax, 0xb6db5d32
je 0x140001e4c
jmp 0x1400017f3
mov eax, 0x61a0516e
cmp eax, 0x49746452
je 0x140001e6f
mov eax, 0xddd5b4e8
cmp eax, 0x95071bd6
setne al
mov ecx, 0x33759419
cmp ecx, 0xb805acac
je 0x140001e6f
mov ecx, 0xd5087409
cmp ecx, 0x243c4627
mov rdi, qword [rbp - 0x50]
mov rbx, qword [rbp - 0x48]
je 0x140002136
mov ecx, 0x71229718
cmp ecx, 0x97d649bf
je 0x140002136
test al, 1
jne 0x14000144b
jmp 0x140001af3
mov eax, 0xae07461d
cmp eax, 0xa4146bdb
je 0x140001af3
mov eax, 0x59fa1b1c
cmp eax, 0x16d80685
je 0x140001e74
mov eax, 0x1c2e236b
cmp eax, 0x8dc36737
je 0x14000213b
mov eax, 0x24e5a01c
cmp eax, 0x289a17d7
setne al
mov ecx, 0xca4bb237
cmp ecx, 0x55687b9a
je 0x14000213b
test al, 1
jne 0x1400014a2
jmp 0x140001e74
jmp 0x1400014a4
mov rdx, r13
add rdx, 0x2c
mov rcx, qword [r12]
sub rsp, 0x20
call fcn.1400167d0
add rsp, 0x20
xor ecx, ecx
cmp ecx, eax
jne 0x14000164b
mov eax, 0xc787c581
cmp eax, 0x38f716b3
je 0x140001af8
mov eax, 0x103c536a
cmp eax, 0xcd40ba6b
mov r14, qword [rbp - 8]
je 0x140002140
mov rdx, r13
add rdx, 0x2c
sub rsp, 0x20
mov rcx, rdi
call fcn.140002f60
add rsp, 0x20
mov eax, dword [r13 + 8]
mov dword [rsi], eax
mov r8d, dword [rsi]
mov rdx, qword [r12]
sub rsp, 0x20
mov rcx, rbx
call fcn.140002f60
add rsp, 0x20
mov r8d, dword [rsi]
sub rsp, 0x20
mov ecx, 0x43a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
add rsp, 0x20
mov qword [r14], rax
cmp qword [r14], 0
sete al
mov ecx, 0xdbdba074
cmp ecx, 0x7b402d2f
setne cl
mov edx, 0xac8b9b2c
cmp edx, 0x45b8036a
je 0x140002140
test cl, 1
jne 0x140001569
jmp 0x140001af8
mov ecx, 0xfbe3e5f2
cmp ecx, 0x79a5ce93
je 0x140001e79
mov ecx, 0xa3794742
cmp ecx, 0xcdc45572
je 0x140001e79
mov ecx, 0xee8ec889
cmp ecx, 0x8afcc4d
mov r14, qword [rbp - 0x40]
je 0x140002194
mov ecx, 0x380686eb
cmp ecx, 0xbe81663c
je 0x140002194
test al, 1
jne 0x1400015b7
jmp 0x1400015eb
mov eax, 0x7dd54c14
cmp eax, 0xc59535d8
je 0x140002199
mov edx, dword [rsi]
sub rsp, 0x20
mov rcx, r14
call fcn.140002f60
add rsp, 0x20
mov eax, 0xe3da9a83
cmp eax, 0xec8372c3
je 0x140002199
jmp 0x140001629
mov edx, dword [rsi]
sub rsp, 0x20
mov rcx, qword [rbp - 0x38]
call fcn.140002f60
add rsp, 0x20
mov eax, dword [rsi]
mov rcx, qword [rbp - 0x30]
mov rcx, qword [rcx]
mov dword [rcx], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax]
mov rcx, qword [rbp - 0x28]
mov rcx, qword [rcx]
mov qword [rcx], rax
mov rsi, qword [rbp]
mov dword [rsi], 1
jmp 0x1400017f3
mov eax, 0x14425c36
cmp eax, 0x67fefd0e
je 0x140001e7e
mov eax, 0x4b12cf1
cmp eax, 0xda11b08e
je 0x140001e7e
jmp 0x14000164b
mov eax, 0x18f21332
cmp eax, 0xb6afc847
je 0x140001bb7
mov eax, 0x98f39742
cmp eax, 0xadd1b4c9
je 0x1400021b0
mov eax, 0xff3d3383
cmp eax, 0x23fec58f
setne al
mov ecx, 0x29418a6a
cmp ecx, 0xebb43cc1
je 0x1400021b0
test al, 1
jne 0x140001692
jmp 0x140001e83
mov eax, 0x500e4889
cmp eax, 0x7ae678c5
je 0x1400021b5
mov eax, 0xe371e43c
cmp eax, 0x45944135
setne al
mov ecx, 0xb9affc94
cmp ecx, 0x1b45b906
setne cl
mov edx, 0xf58acc5
cmp edx, 0xe056e069
je 0x1400021b5
test cl, 1
jne 0x1400016d8
jmp 0x140001e83
test al, 1
jne 0x1400016e1
jmp 0x140001bb7
jmp 0x1400016e3
mov eax, 0xde648617
cmp eax, 0x5b1dfe85
je 0x140001e88
mov eax, 0x6af11083
cmp eax, 0xc5dbf2b5
je 0x1400021ba
mov rcx, qword [r15]
sub rsp, 0x20
mov rdx, r13
call sub.KERNEL32.dll_Process32Next
add rsp, 0x20
cmp eax, 0
setne al
mov ecx, 0x526318b4
cmp ecx, 0xfe40b139
setne cl
mov edx, 0x577522d4
cmp edx, 0x9111eebc
je 0x1400021ba
test cl, 1
jne 0x140001745
jmp 0x140001e88
test al, 1
jne 0x1400014a4
jmp 0x14000174f
mov eax, 0xae6f9ba7
cmp eax, 0x80713f1f
mov rsi, qword [rbp]
je 0x140001bfc
mov rcx, qword [r15]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov dword [rsi], 0
mov eax, 0xe3fb8082
cmp eax, 0x8d5337
je 0x140001bfc
mov eax, 0x127a56e5
cmp eax, 0x3b28ab8e
je 0x1400021d2
mov eax, 0x421f82b4
cmp eax, 0xb4a857e4
setne al
mov ecx, 0xe45b1a8a
cmp ecx, 0x9443daaf
je 0x1400021d2
test al, 1
jne 0x1400017c1
jmp 0x140001ea0
mov eax, 0x684f1d24
cmp eax, 0x4202b825
je 0x140001ea0
mov eax, 0x5f68260
cmp eax, 0x25fb6bb5
je 0x1400021d7
mov eax, 0xedb4f094
cmp eax, 0xca672bf5
je 0x1400021d7
jmp 0x1400017f3
mov eax, 0x27370f88
cmp eax, 0x83ac0305
je 0x1400021dc
mov eax, 0x7773071d
cmp eax, 0xb570cff7
setne al
mov ecx, 0x90467f30
cmp ecx, 0xebcbee74
je 0x1400021dc
test al, 1
jne 0x14000182a
jmp 0x140001c5f
mov eax, 0x4eef6e2d
cmp eax, 0xdb648091
je 0x140001ea5
mov eax, 0xc51522b8
cmp eax, 0x8c4276d7
je 0x1400021e1
mov eax, dword [rsi]
mov ecx, 0xb53a6e3a
cmp ecx, 0x240e547e
setne cl
mov edx, 0x15570aa9
cmp edx, 0x895c9af6
setne dl
mov r8d, 0xce0a8e9f
cmp r8d, 0x51fa114f
je 0x1400021e1
test dl, 1
jne 0x140001885
jmp 0x140001ea5
test cl, 1
jne 0x14000188f
jmp 0x140001c5f
mov ecx, 0xc1dff968
cmp ecx, 0x2b5be4d1
je 0x140001eaa
mov ecx, 0xa8956d69
cmp ecx, 0x348d5c9e
je 0x140001eaa
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, 0x8931eb32
cmp eax, 0x9ec8ae91
mov rdi, qword [rbp - 0x18]
mov rbx, qword [rbp - 0x10]
mov r14, qword [rbp - 0x20]
je 0x1400021e6
mov eax, 0x14e0897b
cmp eax, 0x647a76c9
setne al
mov ecx, 0xd6d99d5b
cmp ecx, 0xde11ef58
je 0x1400021e6
test al, 1
jne 0x140001905
jmp 0x140001eaf
mov eax, 0x40
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.3b51317649467321523b4f4a4261794555516a7351263a56226742395f663e4638292f6d5a4b3c6b5b722c79505477792d29
lea rdx, str.6014632406142e011b55392b2e081d651d1024371d631a224d47324b30055b354b095c033b3b4f0334065f590b7113242729
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.44565a4d454c5259534c4d454f55494b4150544d474f504c584b42464e5742594d494c4946524847575a4a
lea rdx, str.5b5a514453435d20557a6770722076797420787a6161746378646620636e70617161646d78205b257a5d0a00
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x20
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.494c565149504d52555651414d435451434e434f4b
lea rdx, str.58636a736d68652068766365206f746a657567720a00
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.4e42554f545a5057445657444257535a43524b4e574c50554b5a50564c42574b44574553575249565a5a5150
lea rdx, str.5b215d204d716e65716220777020676f67652075777973666f206469202568632c207366206771792025740a00
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
sub rsp, 0x20
lea rcx, str.5b585d20436f756c64206e6f74206f70656e2068616e646c65206f6e2025642c20636f6e74696e75696e670a00
call fcn.140003030
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.26727d3f2d21662942725f2a39304c3b627c69704a4d5438785d6e25307a79747a702e
lea rdx, str.7d59201f7e54054a27012c4c4c5c2042421b06046a2535561c310b055f1459511e7a2e
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rsi, rsp
mov qword [rcx], rdi
mov qword [rdx], rbx
mov qword [r8], r14
mov dword [r9], 0
mov qword [r10], 0
sub rsp, 0x20
mov ecx, 0xf
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov qword [rsi], rax
mov eax, 0x33f68952
cmp eax, 0xff9b1b0a
je 0x140001eaf
jmp 0x140001031
mov eax, 0xdc5cc7f6
cmp eax, 0xefb132f5
je 0x14000204a
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edx, eax
call fcn.140002f60
add rsp, 0x20
mov dword [rsi], 0
mov eax, 0x189c2249
cmp eax, 0x82af73d8
je 0x14000204a
jmp 0x140001328
jmp 0x14000144b
mov eax, 0xbc1469ec
cmp eax, 0xb8e08792
je 0x1400021eb
mov eax, 0xd658c16f
cmp eax, 0x5b72d941
setne al
mov ecx, 0x229b1720
cmp ecx, 0xf9c6aa60
je 0x1400021eb
test al, 1
mov r14, qword [rbp - 8]
jne 0x140001b33
jmp 0x14000208d
mov rdx, r13
add rdx, 0x2c
sub rsp, 0x20
mov rcx, rdi
call fcn.140002f60
add rsp, 0x20
mov eax, dword [r13 + 8]
mov dword [rsi], eax
mov r8d, dword [rsi]
mov rdx, qword [r12]
sub rsp, 0x20
mov rcx, rbx
call fcn.140002f60
add rsp, 0x20
mov r8d, dword [rsi]
sub rsp, 0x20
mov ecx, 0x43a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
add rsp, 0x20
mov qword [r14], rax
mov eax, 0x4aa38e48
cmp eax, 0xf700ce64
je 0x14000208d
mov eax, 0xda9ee67b
cmp eax, 0xf40a329a
je 0x1400021f0
mov eax, 0xbc8cd49d
cmp eax, 0xf0b6138f
je 0x1400021f0
jmp 0x1400014d6
mov eax, 0x30fd46fd
cmp eax, 0x765bc51d
je 0x1400020e1
mov eax, 0x6ecf3ed3
cmp eax, 0x338cc68b
je 0x1400020e1
mov eax, 0x183372cb
cmp eax, 0xd9625a11
je 0x1400021f5
mov eax, 0x281a975a
cmp eax, 0xe356286c
je 0x1400021f5
jmp 0x14000165b
mov eax, 0x5ddb0630
cmp eax, 0x22a7ad28
je 0x1400020e6
mov eax, 0xe956fa1b
cmp eax, 0x485ef1fa
je 0x1400021fa
mov rcx, qword [r15]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov dword [rsi], 0
mov eax, 0x3dd2d092
cmp eax, 0xc38571e0
setne al
mov ecx, 0xeb2938fd
cmp ecx, 0x5ab03962
je 0x1400021fa
test al, 1
jne 0x140001c5a
jmp 0x1400020e6
jmp 0x140001763
mov eax, 0x650d43cb
cmp eax, 0x961a6f24
je 0x140002216
mov eax, 0xba46acaf
cmp eax, 0x1eb6488f
je 0x140002216
jmp 0x14000182a
mov eax, 0x40
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.3b51317649467321523b4f4a4261794555516a7351263a56226742395f663e4638292f6d5a4b3c6b5b722c79505477792d29
lea rdx, str.6014632406142e011b55392b2e081d651d1024371d631a224d47324b30055b354b095c033b3b4f0334065f590b7113242729
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.44565a4d454c5259534c4d454f55494b4150544d474f504c584b42464e5742594d494c4946524847575a4a
lea rdx, str.5b5a514453435d20557a6770722076797420787a6161746378646620636e70617161646d78205b257a5d0a00
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x20
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.494c565149504d52555651414d435451434e434f4b
lea rdx, str.58636a736d68652068766365206f746a657567720a00
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.4e42554f545a5057445657444257535a43524b4e574c50554b5a50564c42574b44574553575249565a5a5150
lea rdx, str.5b215d204d716e65716220777020676f67652075777973666f206469202568632c207366206771792025740a00
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
sub rsp, 0x20
lea rcx, str.5b585d20436f756c64206e6f74206f70656e2068616e646c65206f6e2025642c20636f6e74696e75696e670a00
call fcn.140003030
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.26727d3f2d21662942725f2a39304c3b627c69704a4d5438785d6e25307a79747a702e
lea rdx, str.7d59201f7e54054a27012c4c4c5c2042421b06046a2535561c310b055f1459511e7a2e
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rsi, rsp
mov rax, qword [rbp - 0x18]
mov qword [rcx], rax
mov rax, qword [rbp - 0x10]
mov qword [rdx], rax
mov qword [r8], rdi
mov dword [r9], 0
mov qword [r10], 0
sub rsp, 0x20
mov ecx, 0xf
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov qword [rsi], rax
jmp 0x140001045
jmp 0x1400012b7
mov dword [r13], 0x130
mov rcx, qword [r15]
sub rsp, 0x20
mov rdx, r13
call sub.KERNEL32.dll_Process32First
add rsp, 0x20
jmp 0x14000136b
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
mov edx, eax
call fcn.140002f60
add rsp, 0x20
mov dword [rsi], 0
jmp 0x1400013b7
jmp 0x1400013fa
jmp 0x14000146b
jmp 0x14000157a
jmp 0x140001639
jmp 0x140001692
mov rcx, qword [r15]
sub rsp, 0x20
mov rdx, r13
call sub.KERNEL32.dll_Process32Next
add rsp, 0x20
jmp 0x1400016f3
jmp 0x1400017c1
jmp 0x14000183a
jmp 0x1400018a0
mov eax, 0x40
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.3b51317649467321523b4f4a4261794555516a7351263a56226742395f663e4638292f6d5a4b3c6b5b722c79505477792d29
lea rdx, str.6014632406142e011b55392b2e081d651d1024371d631a224d47324b30055b354b095c033b3b4f0334065f590b7113242729
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.44565a4d454c5259534c4d454f55494b4150544d474f504c584b42464e5742594d494c4946524847575a4a
lea rdx, str.5b5a514453435d20557a6770722076797420787a6161746378646620636e70617161646d78205b257a5d0a00
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x20
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.494c565149504d52555651414d435451434e434f4b
lea rdx, str.58636a736d68652068766365206f746a657567720a00
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.4e42554f545a5057445657444257535a43524b4e574c50554b5a50564c42574b44574553575249565a5a5150
lea rdx, str.5b215d204d716e65716220777020676f67652075777973666f206469202568632c207366206771792025740a00
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
sub rsp, 0x20
lea rcx, str.5b585d20436f756c64206e6f74206f70656e2068616e646c65206f6e2025642c20636f6e74696e75696e670a00
call fcn.140003030
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.26727d3f2d21662942725f2a39304c3b627c69704a4d5438785d6e25307a79747a702e
lea rdx, str.7d59201f7e54054a27012c4c4c5c2042421b06046a2535561c310b055f1459511e7a2e
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rsi, rsp
mov qword [rcx], rdi
mov qword [rdx], rbx
mov qword [r8], r14
mov dword [r9], 0
mov qword [r10], 0
sub rsp, 0x20
mov ecx, 0xf
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov qword [rsi], rax
jmp 0x140001905
mov eax, 0xe54f0f11
cmp eax, 0xad62c009
je 0x14000221b
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edx, eax
call fcn.140002f60
add rsp, 0x20
mov dword [rsi], 0
mov eax, 0x41692f8b
cmp eax, 0x832735fd
je 0x14000221b
jmp 0x140001ac0
mov rdx, r13
add rdx, 0x2c
sub rsp, 0x20
mov rcx, rdi
call fcn.140002f60
add rsp, 0x20
mov eax, dword [r13 + 8]
mov dword [rsi], eax
mov r8d, dword [rsi]
mov rdx, qword [r12]
sub rsp, 0x20
mov rcx, rbx
call fcn.140002f60
add rsp, 0x20
mov r8d, dword [rsi]
sub rsp, 0x20
mov ecx, 0x43a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
add rsp, 0x20
mov qword [r14], rax
jmp 0x140001b33
jmp 0x140001bc7
mov eax, 0x456f5779
cmp eax, 0xa9c3166c
je 0x14000223e
mov rcx, qword [r15]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov dword [rsi], 0
mov eax, 0xd550dde6
cmp eax, 0xeadca551
je 0x14000223e
jmp 0x140001c0c
jmp 0x140001262
jmp 0x14000128c
jmp 0x1400012c7
jmp 0x14000130e
jmp 0x140001431
jmp 0x14000147b
mov rdx, r13
add rdx, 0x2c
sub rsp, 0x20
mov rcx, rdi
call fcn.140002f60
add rsp, 0x20
mov eax, dword [r13 + 8]
mov dword [rsi], eax
mov r8d, dword [rsi]
mov rdx, qword [r12]
sub rsp, 0x20
mov rcx, rbx
call fcn.140002f60
add rsp, 0x20
mov r8d, dword [rsi]
sub rsp, 0x20
mov ecx, 0x43a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
add rsp, 0x20
mov qword [r14], rax
jmp 0x1400014ea
jmp 0x1400015a0
mov edx, dword [rsi]
sub rsp, 0x20
mov rcx, r14
call fcn.140002f60
add rsp, 0x20
jmp 0x1400015c7
jmp 0x14000166b
jmp 0x1400016a2
mov rcx, qword [r15]
sub rsp, 0x20
mov rdx, r13
call sub.KERNEL32.dll_Process32Next
add rsp, 0x20
jmp 0x140001703
jmp 0x14000179a
jmp 0x1400017e1
jmp 0x140001803
jmp 0x14000184a
jmp 0x1400018de
jmp 0x140001b08
jmp 0x140001ba2
jmp 0x140001be7
mov rcx, qword [r15]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov dword [rsi], 0
jmp 0x140001c1c
jmp 0x140001c6f
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edx, eax
call fcn.140002f60
add rsp, 0x20
mov dword [rsi], 0
jmp 0x14000205a
mov rcx, qword [r15]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov dword [rsi], 0
jmp 0x1400020f6