Function at 0x2d9e3c8150
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc10]
sub rsp, 0xd10
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rbp + 0xc00], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x238
call fcn.2d9e3e3840
xor edx, edx
lea rcx, [rbp + 0x1b0]
mov r8d, 0x208
call fcn.2d9e3e3840
xor edx, edx
lea rcx, [rbp + 0x3c0]
mov r8d, 0x208
call fcn.2d9e3e3840
xor edx, edx
lea rcx, [rbp + 0x5d0]
mov r8d, 0x208
call fcn.2d9e3e3840
xor edx, edx
lea rcx, [rbp + 0x7e0]
mov r8d, 0x208
call fcn.2d9e3e3840
xor edx, edx
lea rcx, [rbp + 0x9f0]
mov r8d, 0x208
call fcn.2d9e3e3840
xor edx, edx
mov qword [rbp + 0x188], 7
xor r12d, r12d
mov qword [rbp + 0x180], r12
mov word [rbp + 0x170], r12w
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x28], rax
mov rbx, rax
movabs rdi, 0x7fffffffffffffff
cmp rax, 0xffffffffffffffff
je 0x2d9e3c8667
mov edx, 0x19000
mov dword [rsp + 0x30], 0x238
lea ecx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov r15, rax
lea r13d, [r12 + 1]
mov byte [rax], 0x80
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x2d9e3c8649
nop dword [rax + rax]
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov eax, dword [rsp + 0x38]
test eax, 0xfffffff3
jne 0x2d9e3c82a9
cmp eax, 0xc
jne 0x2d9e3c862a
lea rdx, [rbp + 0x1b0]
mov rcx, r14
call fcn.2d9e3c7a60
lea r9, [rbp + 0x9f0]
lea r8, [rbp + 0x7e0]
lea rdx, [rbp + 0x5d0]
lea rcx, [rbp + 0x1b0]
call fcn.2d9e3c95d0
lea rdx, [rbp + 0x3c0]
mov rcx, r14
call fcn.2d9e3c78c0
lea rcx, [0x2d9e409610]
mov dword [rsp + 0x24], r12d
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x2d9e409600]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x2d9e3c8319
lea rdx, [rsp + 0x24]
mov rcx, r14
call rax
mov ecx, dword [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov edx, dword [rsp + 0x38]
lea rcx, [rbp + 0x190]
call fcn.2d9e3b6ce0
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.2d9e3c89c0
mov rax, qword [rbp + 0x1a8]
cmp rax, 8
jb 0x2d9e3c83ac
mov rcx, qword [rbp + 0x190]
inc rax
cmp rax, rdi
ja 0x2d9e3c8708
add rax, rax
cmp rax, 0x1000
jb 0x2d9e3c83a7
test cl, 0x1f
jne 0x2d9e3c8702
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x2d9e3c86fc
sub rcx, rax
cmp rcx, 8
jb 0x2d9e3c86f6
cmp rcx, 0x27
ja 0x2d9e3c86f0
mov rcx, rax
call fcn.2d9e3da86c
mov rbx, qword [rbp + 0x180]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x9f0]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x7e0]
add esi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x5d0]
add esi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x3c0]
add esi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x1b0]
add ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add ebx, esi
mov rcx, r15
add eax, ebx
lea ebx, [rax*2 + 0x22]
add ebx, r13d
call qword [sym.imp.KERNEL32.dll_LocalSize]
cmp rax, rbx
jae 0x2d9e3c8439
mov r8d, 0x42
mov edx, ebx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov r15, rax
mov eax, dword [rsp + 0x38]
mov ecx, r13d
add r13d, 4
mov dword [rcx + r15], eax
lea rcx, [rsp + 0x5c]
mov eax, dword [rsp + 0x50]
mov dword [r13 + r15], eax
add r13d, 4
mov eax, dword [rsp + 0x4c]
mov dword [r13 + r15], eax
add r13d, 4
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, r13d
lea rdx, [rsp + 0x5c]
add rcx, r15
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.2d9e3e2bb0
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x1b0]
lea eax, [rax + 1]
lea ebx, [rax*2]
add ebx, r13d
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
lea rdx, [rbp + 0x1b0]
add rcx, r15
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.2d9e3e2bb0
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, qword [rbp + 0x180]
lea rdx, [rbp + 0x170]
lea ebx, [rbx + rax*2]
add ebx, 2
lea r8, [r8*2 + 2]
cmp qword [rbp + 0x188], 8
mov ecx, ebx
cmovae rdx, qword [rbp + 0x170]
add rcx, r15
call fcn.2d9e3e2bb0
mov eax, dword [rbp + 0x180]
lea rcx, [rbp + 0x3c0]
lea ebx, [rbx + rax*2]
add ebx, 2
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
lea rdx, [rbp + 0x3c0]
add rcx, r15
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.2d9e3e2bb0
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x5d0]
lea ebx, [rbx + rax*2]
mov eax, dword [rsp + 0x20]
add ebx, 2
mov dword [rbx + r15], eax
add ebx, 4
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
lea rdx, [rbp + 0x5d0]
add rcx, r15
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.2d9e3e2bb0
lea rcx, [rbp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x7e0]
lea ebx, [rbx + rax*2]
add ebx, 2
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
lea rdx, [rbp + 0x7e0]
add rcx, r15
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.2d9e3e2bb0
lea rcx, [rbp + 0x7e0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x9f0]
lea ebx, [rbx + rax*2]
add ebx, 2
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
lea rdx, [rbp + 0x9f0]
add rcx, r15
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.2d9e3e2bb0
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movabs rdi, 0x7fffffffffffffff
lea eax, [rax + 1]
lea r13d, [rbx + rax*2]
mov eax, dword [rsp + 0x24]
mov rbx, qword [rsp + 0x28]
mov dword [r13 + r15], eax
add r13d, 4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x2d9e3c8280
mov edx, r13d
mov r8d, 0x42
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x188]
cmp rax, 8
jb 0x2d9e3c86b7
mov rcx, qword [rbp + 0x170]
inc rax
cmp rax, rdi
ja 0x2d9e3c86ea
add rax, rax
cmp rax, 0x1000
jb 0x2d9e3c86b2
test byte [rbp + 0x170], 0x1f
jne 0x2d9e3c870e
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x2d9e3c8714
sub rcx, rax
cmp rcx, 8
jb 0x2d9e3c871a
cmp rcx, 0x27
ja 0x2d9e3c8720
mov rcx, rax
call fcn.2d9e3da86c
mov rax, r12
mov rcx, qword [rbp + 0xc00]
xor rcx, rsp
call fcn.2d9e3da7d0
lea r11, [rsp + 0xd10]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.2d9e3e4358
int3
call fcn.2d9e3e4358
int3
call fcn.2d9e3e4358
int3
call fcn.2d9e3e4358
int3
call fcn.2d9e3e4358
int3
call fcn.2d9e3e4358
int3
call fcn.2d9e3e4358
int3
call fcn.2d9e3e4358
int3
call fcn.2d9e3e4358
int3
call fcn.2d9e3e4358
int3