Function at 0x14005d783
Capabilities:
Enumerate processes

Disassembly:
push rax
pushf
mov eax, 0xf5fa0dfa
pushf
not eax
add eax, 0x7a9d122a
xor eax, 0x4809bc80
rol eax, 0xcb
popf
pushf
not eax
add eax, 0x20a14d7c
xor eax, 0x5e310b0f
rol eax, 0x96
popf
pushf
not eax
add eax, 0xa7c3b2
xor eax, 0x67fddac0
rol eax, 0x47
popf
pushf
not eax
add eax, 0x396175a5
xor eax, 0x59b79556
rol eax, 0x16
popf
cmp eax, 0xe
jne 0x14005d7e6
popf
pop rax
jmp 0x14005dfa6
cmp eax, 0xd
jne 0x14005d7f5
popf
pop rax
jmp 0x14005df65
cmp eax, 7
jne 0x14005d804
popf
pop rax
jmp 0x14005dc85
cmp eax, 2
jne 0x14005d813
popf
pop rax
jmp 0x14005da19
cmp eax, 0
jne 0x14005d822
popf
pop rax
jmp 0x14005d8b8
cmp eax, 0xc
jne 0x14005d831
popf
pop rax
jmp 0x14005def6
cmp eax, 3
jne 0x14005d840
popf
pop rax
jmp 0x14005daa5
cmp eax, 1
jne 0x14005d84f
popf
pop rax
jmp 0x14005d9df
cmp eax, 8
jne 0x14005d85e
popf
pop rax
jmp 0x14005dce1
cmp eax, 0xa
jne 0x14005d86d
popf
pop rax
jmp 0x14005de0c
cmp eax, 9
jne 0x14005d87c
popf
pop rax
jmp 0x14005dd85
cmp eax, 0xb
jne 0x14005d88b
popf
pop rax
jmp 0x14005deab
cmp eax, 6
jne 0x14005d89a
popf
pop rax
jmp 0x14005dbd8
cmp eax, 4
jne 0x14005d8a9
popf
pop rax
jmp 0x14005daed
cmp eax, 5
jne 0x14005d8b8
popf
pop rax
jmp 0x14005db43
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x130
mov ecx, 0xd7ceea89
pushf
not ecx
add ecx, 0x452bf43e
xor ecx, 0x7eedc7bb
rol ecx, 0x6a
popf
pushf
not ecx
add ecx, 0x4ed912f1
xor ecx, 0x6950c369
rol ecx, 0xef
popf
pushf
not ecx
add ecx, 0x718d21eb
xor ecx, 0x66af3072
rol ecx, 0xee
popf
xor edx, edx
xor sil, sil
jmp 0x14005d931
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14005d999
push rax
pushf
mov eax, 0x7881fb1f
pushf
not eax
add eax, 0x4dff1766
xor eax, 0x42cecb48
rol eax, 0xbb
popf
pushf
not eax
add eax, 0x712a89d3
xor eax, 0x32608108
rol eax, 0x7e
popf
pushf
not eax
add eax, 0x6b8b2421
xor eax, 0x1be2aeec
rol eax, 0
popf
pushf
not eax
add eax, 0x10d1783
xor eax, 0x5d227092
rol eax, 0x59
popf
jmp 0x14005d7d7
push rax
pushf
mov eax, 0x56e90aee
pushf
not eax
add eax, 0x39309bcb
xor eax, 0x5e1cae1e
rol eax, 0xb1
popf
pushf
not eax
add eax, 0x3b962525
xor eax, 0xdb8b1ee
rol eax, 0x33
popf
pushf
not eax
add eax, 0x30e53901
xor eax, 0x44cf9bc0
rol eax, 0x2d
popf
jmp 0x14005d7d7
xor al, al
jmp 0x14005dfa6
lea rdx, [rsp + 0x20]
mov rcx, rdi
jmp 0x14005da22
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14005da5f
push rax
pushf
mov eax, 0x1ca1c26b
pushf
not eax
add eax, 0x57381e0c
xor eax, 0x4cfa39f9
rol eax, 0xf9
popf
pushf
not eax
add eax, 0x2e67e4d6
xor eax, 0x7b7bcc11
rol eax, 0x72
popf
jmp 0x14005d7d7
push rax
pushf
mov eax, 0x4a5311b8
pushf
not eax
add eax, 0x619db1d3
xor eax, 0x13cd8766
rol eax, 0x38
popf
pushf
not eax
add eax, 0x65bf9496
xor eax, 0x64a155df
rol eax, 0x64
popf
pushf
not eax
add eax, 0x205ffbe6
xor eax, 0x4eba70d7
rol eax, 0x7f
popf
jmp 0x14005d7d7
nop
push rax
pushf
mov eax, 0x451bb48f
pushf
not eax
add eax, 0x7df5fca2
xor eax, 0x40a35449
rol eax, 0x52
popf
pushf
not eax
add eax, 0x49922b89
xor eax, 0x6f81a89b
rol eax, 0x26
popf
pushf
not eax
add eax, 0x18df0f6c
xor eax, 0x2f66ff7e
rol eax, 0x34
popf
jmp 0x14005d7d7
lea rcx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
nop dword [rax]
push rax
pushf
mov eax, 0xd2e2912
pushf
not eax
add eax, 0x7bd3a91e
xor eax, 0x66c6f035
rol eax, 0xc5
popf
pushf
not eax
add eax, 0x6f7547fb
xor eax, 0x78e86a64
rol eax, 0x9c
popf
pushf
not eax
add eax, 0xcb938c
xor eax, 0x70ca0e6
rol eax, 0x45
popf
jmp 0x14005d7d7
inc rax
cmp byte [rcx + rax], sil
jne 0x14005dba5
push rax
pushf
mov eax, 0xa0a14875
pushf
not eax
add eax, 0x69c05c3a
xor eax, 0x4aab0de7
rol eax, 0xe
popf
pushf
not eax
add eax, 0x6eee9071
xor eax, 0x9640c0a
rol eax, 0x2a
popf
pushf
not eax
add eax, 0x727721b4
xor eax, 0xf14a802
rol eax, 0x3a
popf
pushf
not eax
add eax, 0xc489523
xor eax, 0x26b4a3e3
rol eax, 0x1d
popf
jmp 0x14005d7d7
push rax
pushf
mov eax, 0xc0f12698
pushf
not eax
add eax, 0x1536aa1a
xor eax, 0x405c97d6
rol eax, 0x50
popf
pushf
not eax
add eax, 0x619a1977
xor eax, 0x4843055d
rol eax, 0x48
popf
jmp 0x14005d7d7
cmp qword [rbx + 0x18], 0xf
mov rcx, rbx
mov r8, qword [rbx + 0x10]
jbe 0x14005dc3f
push rax
pushf
mov eax, 0x17e7242
pushf
not eax
add eax, 0x48b931eb
xor eax, 0x10a66046
rol eax, 0xb2
popf
pushf
not eax
add eax, 0x2a95127d
xor eax, 0x3774dbc3
rol eax, 0xd8
popf
pushf
not eax
add eax, 0x40d68348
xor eax, 0x2bb2def5
rol eax, 0xe9
popf
pushf
not eax
add eax, 0x2e00fc8f
xor eax, 0x19e6a1eb
rol eax, 0xfd
popf
jmp 0x14005d7d7
push rax
pushf
mov eax, 0x6f784c4
pushf
not eax
add eax, 0x68e7264a
xor eax, 0x60c68225
rol eax, 0x76
popf
pushf
not eax
add eax, 0x59981496
xor eax, 0x7ed88e3c
rol eax, 0xc6
popf
pushf
not eax
add eax, 0x35c57fc2
xor eax, 0x61f4237e
rol eax, 0x35
popf
jmp 0x14005d7d7
mov rcx, qword [rbx]
push rax
pushf
mov eax, 0x8596a207
pushf
not eax
add eax, 0x58148898
xor eax, 0x5dc33dfe
rol eax, 0x50
popf
pushf
not eax
add eax, 0x3d90fc26
xor eax, 0x1f6af985
rol eax, 0xcd
popf
pushf
not eax
add eax, 0x72610286
xor eax, 0x43cb8642
rol eax, 0x87
popf
pushf
not eax
add eax, 0x6d84e9de
xor eax, 0x35ee9acf
rol eax, 0x11
popf
jmp 0x14005d7d7
cmp r8, rax
jne 0x14005dd2c
push rax
pushf
mov eax, 0x4cf53dbf
pushf
not eax
add eax, 0x49c7fef3
xor eax, 0x2d3aa9e0
rol eax, 0xda
popf
pushf
not eax
add eax, 0xce3562a
xor eax, 0x5d2dd942
rol eax, 0xf
popf
pushf
not eax
add eax, 0x7e5e1bc5
xor eax, 0x477ba929
rol eax, 0x7a
popf
jmp 0x14005d7d7
push rax
pushf
mov eax, 0xb1f1c2a8
pushf
not eax
add eax, 0xbf2c858
xor eax, 0x4fc0f28
rol eax, 0x49
popf
pushf
not eax
add eax, 0x42518dfa
xor eax, 0x18886d36
rol eax, 0
popf
pushf
not eax
add eax, 0x29e6acce
xor eax, 0x6a8fb272
rol eax, 0x4d
popf
pushf
not eax
add eax, 0x10d71d17
xor eax, 0x6b60e69f
rol eax, 0xcc
popf
jmp 0x14005d7d7
lea rdx, [rsp + 0x4c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14005ddc6
push rax
pushf
mov eax, 0x95907bb2
pushf
not eax
add eax, 0x27ee41bc
xor eax, 0x5b6f51dc
rol eax, 0xc3
popf
pushf
not eax
add eax, 0x4deb9837
xor eax, 0x456d982
rol eax, 0x80
popf
jmp 0x14005d7d7
push rax
pushf
mov eax, 0xcd702d09
pushf
not eax
add eax, 0x6d524b5d
xor eax, 0x7e8180d5
rol eax, 4
popf
pushf
not eax
add eax, 0x5bde0be9
xor eax, 0x15917a81
rol eax, 0x87
popf
pushf
not eax
add eax, 0x766e9259
xor eax, 0x5bc294b0
rol eax, 0xd2
popf
jmp 0x14005d7d7
lea rdx, [rsp + 0x20]
mov rcx, rdi
jmp 0x14005de15
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005de52
push rax
pushf
mov eax, 0x3cb1717b
pushf
not eax
add eax, 0xb54ba74
xor eax, 0x308f7e91
rol eax, 0x4b
popf
pushf
not eax
add eax, 0x76e6a600
xor eax, 0x1538560e
rol eax, 0xd0
popf
jmp 0x14005d7d7
push rax
pushf
mov eax, 0xf7e8bd6c
pushf
not eax
add eax, 0x416619fe
xor eax, 0x66c6771e
rol eax, 0x4c
popf
pushf
not eax
add eax, 0x613c7249
xor eax, 0x743299f0
rol eax, 0x3d
popf
pushf
not eax
add eax, 0x4f3a6b55
xor eax, 0x76a06f86
rol eax, 0x3e
popf
pushf
not eax
add eax, 0x71bbaf68
xor eax, 0x786a9ce9
rol eax, 0x39
popf
jmp 0x14005d7d7
jmp 0x14005df65
mov sil, 0x77
pushf
not sil
add sil, 0x3f
xor sil, 0x7e
rol sil, 0xe4
popf
pushf
not sil
add sil, 0x5b
xor sil, 0x20
rol sil, 0xba
popf
pushf
not sil
add sil, 0x3f
xor sil, 0x40
rol sil, 0xd9
popf
push rax
pushf
mov eax, 0x8011816b
pushf
not eax
add eax, 0x4df48862
xor eax, 0x4043153b
rol eax, 0x4e
popf
pushf
not eax
add eax, 0x4691f1c1
xor eax, 0x419ee658
rol eax, 0x55
popf
jmp 0x14005d7d7
mov rcx, rdi
jmp 0x14005df69
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, sil
push rax
pushf
mov eax, 0x9941993b
pushf
not eax
add eax, 0x5ebd29f
xor eax, 0x1340ebf1
rol eax, 0xe3
popf
pushf
not eax
add eax, 0x6993d677
xor eax, 0x643d41e3
rol eax, 0xe8
popf
jmp 0x14005d7d7
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140112590
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret