Function at 0x140084c50
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x610
mov qword [rsp + 0x1a0], 0xfffffffffffffffe
mov qword [rsp + 0x660], rbx
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x600], rax
mov r15, rdx
mov rbp, rcx
call fcn.1400775b0
test eax, eax
je 0x1400858b3
mov ecx, 8
call fcn.1400aee14
xor r13d, r13d
test rax, rax
je 0x140084cbb
lea rcx, [rsp + 0x130]
mov qword [rax], rcx
jmp 0x140084cbe
mov rax, r13
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x130]
call fcn.14007a5d0
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x160], r13
mov rax, qword [rbp + 0x28]
mov rdi, qword [rax]
mov rbx, qword [rbp]
nop
mov rsi, qword [rbp + 0x28]
test rbx, rbx
je 0x140084cff
cmp rbx, qword [rbp]
je 0x140084d04
call fcn.1400aedac
cmp rdi, rsi
je 0x140084d76
test rbx, rbx
jne 0x140084d18
call fcn.1400aedac
mov r11, r13
jmp 0x140084d1b
mov r11, qword [rbx]
cmp rdi, qword [r11 + 0x28]
jne 0x140084d26
call fcn.1400aedac
cmp qword [rdi + 0x30], 8
jb 0x140084d33
mov rcx, qword [rdi + 0x18]
jmp 0x140084d37
lea rcx, [rdi + 0x18]
mov r9d, 1
lea r8, [rsp + 0x130]
lea rdx, [0x1400eff18]
call fcn.140082ba0
test rbx, rbx
jne 0x140084d60
call fcn.1400aedac
mov r11, r13
jmp 0x140084d63
mov r11, qword [rbx]
cmp rdi, qword [r11 + 0x28]
jne 0x140084d6e
call fcn.1400aedac
mov rdi, qword [rdi]
jmp 0x140084cf0
mov ecx, 8
call fcn.1400aee14
test rax, rax
je 0x140084d92
lea rcx, [rsp + 0xa0]
mov qword [rax], rcx
jmp 0x140084d95
mov rax, r13
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0xa0]
call fcn.14007a920
mov qword [rsp + 0xd0], rax
mov byte [rax + 0x41], 1
mov rax, qword [rsp + 0xd0]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0xd0]
mov qword [rax], rax
mov rax, qword [rsp + 0xd0]
mov qword [rax + 0x10], rax
mov qword [rsp + 0xd8], r13
mov ecx, 8
call fcn.1400aee14
test rax, rax
je 0x140084dfd
lea rcx, [rsp + 0xe0]
mov qword [rax], rcx
jmp 0x140084e00
mov rax, r13
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0xe0]
call fcn.14007a920
mov qword [rsp + 0x110], rax
mov byte [rax + 0x41], 1
mov rax, qword [rsp + 0x110]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x110]
mov qword [rax], rax
mov rax, qword [rsp + 0x110]
mov qword [rax + 0x10], rax
mov qword [rsp + 0x118], r13
mov rdi, qword [rsp + 0x158]
mov rsi, qword [rdi]
mov rax, qword [rsp + 0x130]
mov rbx, rax
test rbx, rbx
je 0x140084e6c
cmp rbx, rax
je 0x140084e71
call fcn.1400aedac
cmp rsi, rdi
je 0x140084f7e
test rbx, rbx
jne 0x140084e89
call fcn.1400aedac
mov rdx, r13
jmp 0x140084e8c
mov rdx, qword [rbx]
cmp rsi, qword [rdx + 0x28]
jne 0x140084e97
call fcn.1400aedac
lea r8, [rsi + 0x10]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.140081330
test rbx, rbx
jne 0x140084ebc
call fcn.1400aedac
mov r11, r13
jmp 0x140084ebf
mov r11, qword [rbx]
cmp rsi, qword [r11 + 0x28]
jne 0x140084eca
call fcn.1400aedac
cmp qword [rsi + 0x30], 8
jb 0x140084ed7
mov rcx, qword [rsi + 0x18]
jmp 0x140084edb
lea rcx, [rsi + 0x18]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdx, rax
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], r13
mov word [rsp + 0x78], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x70]
call fcn.140025a70
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.140081330
nop
cmp qword [rsp + 0x90], 8
jb 0x140084f49
mov rcx, qword [rsp + 0x78]
call fcn.1400ad0b8
test rbx, rbx
jne 0x140084f58
call fcn.1400aedac
mov rdx, r13
jmp 0x140084f5b
mov rdx, qword [rbx]
cmp rsi, qword [rdx + 0x28]
jne 0x140084f66
call fcn.1400aedac
mov rsi, qword [rsi]
mov rdi, qword [rsp + 0x158]
mov rax, qword [rsp + 0x130]
jmp 0x140084e62
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x14008513d
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x50], rcx
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rcx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x20], xmm1
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0xe0]
call fcn.140082080
mov rcx, qword [rsp + 0x110]
call fcn.1400ad0b8
mov qword [rsp + 0x110], r13
mov qword [rsp + 0x118], r13
mov rcx, qword [rsp + 0xe0]
call fcn.1400ad0b8
nop
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rcx
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rcx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x20], xmm1
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0xa0]
call fcn.140082080
mov rcx, qword [rsp + 0xd0]
call fcn.1400ad0b8
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xd8], r13
mov rcx, qword [rsp + 0xa0]
call fcn.1400ad0b8
nop
mov rax, qword [rsp + 0x158]
mov rdi, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x158]
mov qword [rax + 8], rax
mov qword [rsp + 0x160], r13
mov rcx, qword [rsp + 0x158]
cmp rdi, rcx
je 0x14008511c
nop word [rax + rax]
mov rbx, qword [rdi]
cmp qword [rdi + 0x30], 8
jb 0x1400850f3
mov rcx, qword [rdi + 0x18]
call fcn.1400ad0b8
mov qword [rdi + 0x30], 7
mov qword [rdi + 0x28], r13
mov word [rdi + 0x18], r13w
mov rcx, rdi
call fcn.1400ad0b8
mov rdi, rbx
mov rcx, qword [rsp + 0x158]
cmp rbx, rcx
jne 0x1400850e0
call fcn.1400ad0b8
mov qword [rsp + 0x158], r13
mov rcx, qword [rsp + 0x130]
call fcn.1400ad0b8
xor eax, eax
jmp 0x1400858b3
mov dword [rsp + 0x1b0], 0x238
lea rdx, [rsp + 0x1b0]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x14008530d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x50], rcx
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rcx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x20], xmm1
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0xe0]
call fcn.140082080
mov rcx, qword [rsp + 0x110]
call fcn.1400ad0b8
mov qword [rsp + 0x110], r13
mov qword [rsp + 0x118], r13
mov rcx, qword [rsp + 0xe0]
call fcn.1400ad0b8
nop
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rcx
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rcx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x20], xmm1
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0xa0]
call fcn.140082080
mov rcx, qword [rsp + 0xd0]
call fcn.1400ad0b8
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xd8], r13
mov rcx, qword [rsp + 0xa0]
call fcn.1400ad0b8
nop
mov rax, qword [rsp + 0x158]
mov rdi, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x158]
mov qword [rax + 8], rax
mov qword [rsp + 0x160], r13
mov rcx, qword [rsp + 0x158]
cmp rdi, rcx
je 0x1400852ec
nop word [rax + rax]
mov rbx, qword [rdi]
cmp qword [rdi + 0x30], 8
jb 0x1400852c3
mov rcx, qword [rdi + 0x18]
call fcn.1400ad0b8
mov qword [rdi + 0x30], 7
mov qword [rdi + 0x28], r13
mov word [rdi + 0x18], r13w
mov rcx, rdi
call fcn.1400ad0b8
mov rdi, rbx
mov rcx, qword [rsp + 0x158]
cmp rbx, rcx
jne 0x1400852b0
call fcn.1400ad0b8
mov qword [rsp + 0x158], r13
mov rcx, qword [rsp + 0x130]
call fcn.1400ad0b8
xor eax, eax
jmp 0x1400858b3
call fcn.140078600
mov r14, r13
test eax, eax
je 0x140085340
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.QueryFullProcessImageNameW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
nop dword [rax]
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], r13
mov word [rsp + 0x78], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1dc]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1dc]
lea rcx, [rsp + 0x70]
call fcn.140025a70
mov r11, qword [rsp + 0xd0]
mov r12, r11
mov rax, qword [rsp + 0xa0]
mov rbp, rax
mov rdi, qword [r11 + 8]
mov rbx, r11
cmp byte [rdi + 0x41], 0
jne 0x140085400
nop word [rax + rax]
lea rdx, [rsp + 0x78]
cmp qword [rsp + 0x90], 8
cmovae rdx, qword [rsp + 0x78]
cmp qword [rdi + 0x38], 8
jb 0x1400853d1
mov rcx, qword [rdi + 0x20]
jmp 0x1400853d5
lea rcx, [rdi + 0x20]
call fcn.1400af0e8
test eax, eax
jns 0x1400853e4
mov rdi, qword [rdi + 0x10]
jmp 0x1400853ea
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x41], 0
je 0x1400853b0
mov r11, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x190], rax
mov rdi, r11
test rax, rax
jne 0x14008542d
call fcn.1400aedac
mov r11, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xa0]
cmp rbx, rdi
je 0x14008547a
cmp qword [rbx + 0x38], 8
jb 0x14008543f
mov rdx, qword [rbx + 0x20]
jmp 0x140085443
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0x78]
cmp qword [rsp + 0x90], 8
cmovae rcx, qword [rsp + 0x78]
call fcn.1400af0e8
test eax, eax
js 0x14008546a
lea rcx, [rsp + 0x190]
jmp 0x140085492
mov r11, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x188], r11
mov qword [rsp + 0x180], rax
lea rcx, [rsp + 0x180]
lea rdx, [rsp + 0x170]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rsp + 0x170]
test rax, rax
je 0x1400854ba
cmp rax, rbp
je 0x1400854bf
call fcn.1400aedac
cmp qword [rsp + 0x178], r12
setne dil
cmp qword [rsp + 0x90], 8
jb 0x1400854e0
mov rcx, qword [rsp + 0x78]
call fcn.1400ad0b8
test dil, dil
je 0x14008574f
mov r8d, dword [rsp + 0x1b8]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140085741
mov word [rsp + 0x3f0], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x3f2]
call fcn.1400ad2f0
test r14, r14
je 0x140085557
mov dword [rsp + 0x168], 0x104
lea r9, [rsp + 0x168]
lea r8, [rsp + 0x3f0]
xor edx, edx
mov rcx, rbx
call r14
jmp 0x14008556f
mov r9d, 0x104
lea r8, [rsp + 0x3f0]
xor edx, edx
mov rcx, rbx
call sub.PSAPI.DLL_GetModuleFileNameExW
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], r13
mov word [rsp + 0x78], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x3f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x70]
call fcn.140025a70
mov r11, qword [rsp + 0x110]
mov r13, r11
mov rax, qword [rsp + 0xe0]
mov r12, rax
mov rdi, qword [r11 + 8]
mov rbp, r11
cmp byte [rdi + 0x41], 0
jne 0x140085630
nop word [rax + rax]
lea rdx, [rsp + 0x78]
cmp qword [rsp + 0x90], 8
cmovae rdx, qword [rsp + 0x78]
cmp qword [rdi + 0x38], 8
jb 0x140085601
mov rcx, qword [rdi + 0x20]
jmp 0x140085605
lea rcx, [rdi + 0x20]
call fcn.1400af0e8
test eax, eax
jns 0x140085614
mov rdi, qword [rdi + 0x10]
jmp 0x14008561a
mov rbp, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x41], 0
je 0x1400855e0
mov r11, qword [rsp + 0x110]
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x128], rbp
mov qword [rsp + 0x120], rax
mov rdi, r11
test rax, rax
jne 0x14008565d
call fcn.1400aedac
mov r11, qword [rsp + 0x110]
mov rax, qword [rsp + 0xe0]
cmp rbp, rdi
je 0x1400856aa
cmp qword [rbp + 0x38], 8
jb 0x14008566f
mov rdx, qword [rbp + 0x20]
jmp 0x140085673
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x78]
cmp qword [rsp + 0x90], 8
cmovae rcx, qword [rsp + 0x78]
call fcn.1400af0e8
test eax, eax
js 0x14008569a
lea rcx, [rsp + 0x120]
jmp 0x1400856b9
mov r11, qword [rsp + 0x110]
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400856db
cmp rax, r12
je 0x1400856e0
call fcn.1400aedac
cmp qword [rsp + 0x38], r13
setne dil
cmp qword [rsp + 0x90], 8
jb 0x1400856fe
mov rcx, qword [rsp + 0x78]
call fcn.1400ad0b8
test dil, dil
je 0x14008573e
mov rbp, qword [r15 + 0x28]
lea r9, [rsp + 0x1b8]
mov r8, qword [rbp + 8]
mov rdx, rbp
mov rcx, r15
call fcn.14007a800
mov rdi, rax
mov edx, 1
mov rcx, r15
call fcn.14007efb0
mov qword [rbp + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
xor r13d, r13d
jmp 0x140085741
xor r13d, r13d
test rbx, rbx
je 0x14008574f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x1b0]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140085340
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x30], rcx
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm1
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0xe0]
call fcn.140082080
mov rcx, qword [rsp + 0x110]
call fcn.1400ad0b8
mov qword [rsp + 0x110], r13
mov qword [rsp + 0x118], r13
mov rcx, qword [rsp + 0xe0]
call fcn.1400ad0b8
nop
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rcx
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm1
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0xa0]
call fcn.140082080
mov rcx, qword [rsp + 0xd0]
call fcn.1400ad0b8
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xd8], r13
mov rcx, qword [rsp + 0xa0]
call fcn.1400ad0b8
nop
lea rcx, [rsp + 0x130]
call fcn.14007fbc0
mov rcx, qword [rsp + 0x158]
call fcn.1400ad0b8
mov qword [rsp + 0x158], r13
mov rcx, qword [rsp + 0x130]
call fcn.1400ad0b8
mov eax, 1
mov rcx, qword [rsp + 0x600]
xor rcx, rsp
call fcn.1400ad2c0
mov rbx, qword [rsp + 0x660]
add rsp, 0x610
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret