Function at 0x1400118fc
Capabilities:
Enumerate processes

Disassembly:
jmp 0x14001a5a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xab8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xad8]
mov rax, qword [0x140032040]
xor rax, rbp
mov qword [rbp + 0xa78], rax
lea rcx, [0x1400390f6]
call fcn.1400119dd
xor edx, edx
mov ecx, 2
call fcn.1400114ba
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14001a60a
jmp 0x14001aade
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001160e
test eax, eax
je 0x14001aad4
mov rax, qword [rbp + 0xaa0]
mov qword [rbp + 0x288], rax
mov rcx, qword [rbp + 0x288]
call fcn.140011370
mov qword [rbp + 0x2a8], rax
mov rcx, qword [rbp + 0x288]
call fcn.14001196f
mov qword [rbp + 0x2c8], rax
jmp 0x14001a66e
mov rax, qword [rbp + 0x2a8]
add rax, 0x28
mov qword [rbp + 0x2a8], rax
mov rax, qword [rbp + 0x2c8]
cmp qword [rbp + 0x2a8], rax
je 0x14001aabd
mov rax, qword [rbp + 0x2a8]
mov qword [rbp + 0x2e8], rax
lea rax, [rbp + 0x838]
mov qword [rbp + 0x868], rax
lea rax, [rbp + 0x888]
mov qword [rbp + 0x8b8], rax
lea rcx, [rbp + 0x814]
call fcn.140011555
mov qword [rbp + 0xa48], rax
mov rdx, qword [rbp + 0x868]
mov rcx, qword [rbp + 0x2e8]
call fcn.14001114a
mov qword [rbp + 0xa50], rax
mov rdx, qword [rbp + 0x8b8]
mov rcx, qword [rbp + 0x2e8]
call fcn.14001100a
mov qword [rbp + 0xa58], rax
mov rax, qword [rbp + 0xa48]
mov r9, rax
mov r8, qword [rbp + 0xa50]
mov rdx, qword [rbp + 0xa58]
lea rcx, [rbp + 0x7d8]
call fcn.1400112f3
mov qword [rbp + 0xa60], rax
mov rax, qword [rbp + 0xa60]
mov qword [rbp + 0xa68], rax
lea rdx, [rbp + 0x5c]
lea rcx, [rbp + 0x8d8]
call fcn.140011334
mov qword [rbp + 0xa70], rax
mov rdx, qword [rbp + 0xa68]
mov rcx, qword [rbp + 0xa70]
call fcn.14001126c
mov byte [rbp + 0x7b4], al
lea rcx, [rbp + 0x8d8]
call fcn.14001187f
nop
lea rcx, [rbp + 0x7d8]
call fcn.14001187f
movzx eax, byte [rbp + 0x7b4]
test eax, eax
je 0x14001aab8
lea rdx, str.___Starting__wait...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011113
lea rdx, [0x14001105a]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, dword [rbp + 0x38]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x308], rax
cmp qword [rbp + 0x308], 0
je 0x14001aab8
mov qword [rbp + 0x398], 0
mov r9d, 0x30
lea r8, [rbp + 0x328]
mov rdx, qword [rbp + 0x398]
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x14001aaa1
cmp dword [rbp + 0x348], 0x1000
jne 0x14001aa81
cmp qword [rbp + 0x340], 0
jbe 0x14001aa81
mov edx, 0x20
lea rcx, [rbp + 0x3b8]
call fcn.140011087
lea rcx, [rbp + 0x914]
call fcn.1400114b0
mov r8, rax
mov rdx, qword [rbp + 0x340]
lea rcx, [rbp + 0x3b8]
call fcn.1400115b9
nop
lea rcx, [rbp + 0x3b8]
call fcn.140011a9b
lea rcx, [rbp + 0x378]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x340]
mov r8, rax
mov rdx, qword [rbp + 0x328]
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14001aa75
lea rcx, [rbp + 0x3b8]
call fcn.140011a9b
mov r8, qword [rbp + 0x378]
mov rdx, rax
lea rcx, [rbp + 0x3f8]
call fcn.1400110ff
nop
mov rax, qword [rbp + 0xaa8]
mov qword [rbp + 0x438], rax
mov rcx, qword [rbp + 0x438]
call fcn.140011370
mov qword [rbp + 0x458], rax
mov rcx, qword [rbp + 0x438]
call fcn.14001196f
mov qword [rbp + 0x478], rax
jmp 0x14001a8fd
mov rax, qword [rbp + 0x458]
add rax, 0x28
mov qword [rbp + 0x458], rax
mov rax, qword [rbp + 0x478]
cmp qword [rbp + 0x458], rax
je 0x14001aa68
mov rax, qword [rbp + 0x458]
mov qword [rbp + 0x498], rax
xor r8d, r8d
mov rdx, qword [rbp + 0x498]
lea rcx, [rbp + 0x3f8]
call fcn.1400112ad
cmp rax, 0xffffffffffffffff
je 0x14001aa63
lea rax, [rbp + 0x958]
mov qword [rbp + 0x988], rax
lea rax, [rbp + 0x9a8]
mov qword [rbp + 0x9d8], rax
lea rdx, [rbp + 0xa28]
lea rcx, [0x1400324c0]
call fcn.1400116ae
mov qword [rbp + 0xa48], rax
mov rax, qword [rbp + 0xa48]
mov qword [rbp + 0xa50], rax
mov rdx, qword [rbp + 0x988]
lea rcx, [0x1400324c0]
call fcn.1400116ae
mov qword [rbp + 0xa58], rax
mov rdx, qword [rbp + 0x9d8]
lea rcx, [0x1400324c0]
call fcn.140011294
mov qword [rbp + 0xa60], rax
mov r9, qword [rbp + 0x498]
mov r8, qword [rbp + 0xa58]
mov rdx, qword [rbp + 0xa60]
lea rcx, [rbp + 0x9f8]
call fcn.14001194c
mov qword [rbp + 0xa68], rax
mov rdx, qword [rbp + 0xa50]
mov rcx, qword [rbp + 0xa68]
call fcn.14001196a
mov byte [rbp + 0x934], al
lea rcx, [rbp + 0x9f8]
call fcn.1400110be
nop
lea rcx, [rbp + 0xa28]
call fcn.1400110be
movzx eax, byte [rbp + 0x934]
test eax, eax
je 0x14001aa1e
jmp 0x14001aa68
lea rdx, str.find:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011113
mov rdx, qword [rbp + 0x498]
mov rcx, rax
call fcn.1400118c5
lea rdx, [0x14001105a]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, qword [rbp + 0x498]
lea rcx, [0x1400324c0]
call fcn.14001152d
jmp 0x14001a8eb
lea rcx, [rbp + 0x3f8]
call fcn.1400111a4
nop
lea rcx, [rbp + 0x3b8]
call fcn.1400112fd
mov rax, qword [rbp + 0x340]
mov rcx, qword [rbp + 0x398]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x398], rax
jmp 0x14001a7d8
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001a65c
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011884
test eax, eax
jne 0x14001a626
jmp 0x14001aade
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x30]
lea rdx, [0x14002b4c0]
call fcn.14001182a
mov rcx, qword [rbp + 0xa78]
xor rcx, rbp
call fcn.1400114d3
lea rsp, [rbp + 0xa88]
pop rdi
pop rbp
ret