Function at 0x14009e330
Capabilities:
Enumerate processes

Disassembly:
push r14
push r15
sub rsp, 0xab8
mov r15, rcx
mov qword [rsp + 0xab0], rdi
mov ecx, 2
mov dword [rsp + 0x30], 0x238
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rdi, r15
nop
movzx ecx, word [rdi]
cmp cx, 0x20
je 0x14009e37f
cmp cx, 9
jne 0x14009e385
add rdi, 2
jmp 0x14009e370
mov qword [rsp + 0xad0], rbx
mov qword [rsp + 0xad8], rbp
mov qword [rsp + 0xae0], rsi
test cx, cx
je 0x14009e47e
xor esi, esi
cmp cx, 0x2d
je 0x14009e489
cmp cx, 0x2b
jne 0x14009e3c3
movzx ecx, word [rdi + 2]
lea rax, [rdi + 2]
mov rdi, rax
cmp cx, 0x30
jne 0x14009e3f4
movzx eax, word [rdi + 2]
mov ecx, 0xffdf
sub ax, 0x58
test cx, ax
jne 0x14009e3f4
movzx ecx, word [rdi + 4]
lea rbx, [rdi + 4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isxdigit]
test eax, eax
je 0x14009e3f4
mov ebp, 1
jmp 0x14009e3fa
mov ebp, esi
lea rbx, [rdi + 4]
test ebp, ebp
mov ecx, esi
cmove rbx, rdi
movzx edi, word [rbx]
cmp edi, 0x20
je 0x14009e460
nop word [rax + rax]
cmp edi, 9
je 0x14009e460
test edi, edi
je 0x14009e47a
cmp edi, 0x2e
je 0x14009e489
test ebp, ebp
je 0x14009e446
movzx ecx, di
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswxdigit]
test eax, eax
jne 0x14009e44e
test edi, 0xffffff80
jne 0x14009e489
mov edx, 2
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
jmp 0x14009e489
lea eax, [rdi - 0x30]
cmp eax, 9
ja 0x14009e42f
movzx edi, word [rbx + 2]
add rbx, 2
mov ecx, 1
cmp edi, 0x20
jne 0x14009e410
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14009e46f
cmp ax, 9
jne 0x14009e475
add rbx, 2
jmp 0x14009e460
test ax, ax
jne 0x14009e489
test ecx, ecx
je 0x14009e489
mov rcx, r15
call fcn.140005d80
mov rsi, rax
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov rdi, qword [rsp + 0xab0]
mov rbp, qword [rsp + 0xad8]
mov rbx, qword [rsp + 0xad0]
test eax, eax
je 0x14009e55d
test esi, esi
je 0x14009e4c5
cmp esi, dword [rsp + 0x38]
je 0x14009e57c
lea rax, [rsp + 0x480]
lea r9, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x690]
lea rdx, [rsp + 0x8a0]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath]
lea rax, [rsp + 0x270]
sub rax, 2
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x14009e501
lea r8, [rsp + 0x480]
xor edx, edx
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x14009e520
mov rdx, r15
lea rcx, [rsp + 0x270]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, r14
test eax, eax
je 0x14009e59b
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14009e4b7
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret