Function at 0x18002fc70
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb28
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xaa0], 0xfffffffffffffffe
mov r15, r8
mov qword [rbp + 0xa80], rdx
mov rsi, rcx
mov ecx, 2
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1800301ac
mov qword [rbp + 0xa78], rsi
lea rcx, [rbp + 0x610]
call fcn.18003b460
mov dword [rbp + 0x3d8], 0x238
mov rax, qword [rbp + 0x614]
mov rcx, qword [rbp + 0x620]
mov qword [rbp + 0x3dc], rax
mov qword [rbp + 0x3e8], rcx
movups xmm0, xmmword [rbp + 0x628]
movups xmmword [rbp + 0x3f0], xmm0
mov eax, dword [rbp + 0x638]
mov dword [rbp + 0x400], eax
lea rdx, [rbp + 0x63c]
lea rcx, [rbp + 0x404]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp + 0x3d8]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_Process32FirstW]
test eax, eax
je 0x180030225
lea r13, [rbp - 0x60]
xor eax, eax
mov qword [rbp + 0xa70], rax
mov qword [rbp + 0xa90], r15
nop dword [rax + rax]
mov rcx, rbx
lea rdx, [rbp + 0x3d8]
call qword [sym.imp.kernel32.dll_Process32NextW]
test eax, eax
je 0x1800301c7
mov qword [rbp - 0x60], 0
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x50], 0
mov r8d, 0x82
mov rcx, r13
xor edx, edx
call fcn.18009eca0
lea rax, [rbp + 0x404]
mov qword [rbp + 0x610], rax
lea rax, [rbp + 0x60c]
mov qword [rbp + 0x618], rax
mov word [rbp + 0x620], 0
lea rcx, [rbp + 0x610]
mov rdx, r13
call fcn.180011ad0
mov r10, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x58]
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0xa98], r10
jmp 0x18002fe01
dec rax
movzx ecx, cl
sub rax, rdi
test ecx, ecx
jne 0x18002fe80
test rax, rax
je 0x18002fe76
mov r12, rax
add rax, rdi
movzx ecx, byte [rax - 1]
test cl, cl
jns 0x18002fdf0
movzx r11d, byte [rax - 2]
cmp r11b, 0xc0
jge 0x18002fe44
movzx r8d, byte [rax - 3]
cmp r8b, 0xbf
jg 0x18002fe4e
movzx r9d, byte [rax - 4]
add rax, 0xfffffffffffffffc
and r9d, 7
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
jmp 0x18002fe56
add rax, 0xfffffffffffffffe
and r11d, 0x1f
jmp 0x18002fe61
add rax, 0xfffffffffffffffd
and r8d, 0xf
shl r8d, 6
and r11d, 0x3f
or r11d, r8d
shl r11d, 6
and cl, 0x3f
movzx ecx, cl
or ecx, r11d
cmp ecx, 0x110000
jne 0x18002fdf6
xor r12d, r12d
mov esi, 1
jmp 0x18002febf
mov qword [rbp + 0xa88], rdi
test r12, r12
js 0x180030316
movzx eax, byte [0x180101c71]
mov esi, 1
mov edx, 1
mov rcx, r12
call fcn.180030bd0
test rax, rax
je 0x180030311
mov rcx, rax
mov rsi, rax
mov rdi, qword [rbp + 0xa88]
mov rcx, rsi
mov rdx, rdi
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rbp + 0xa98]
test rdx, rdx
je 0x18002fee7
mov r8d, 1
mov rcx, rdi
call fcn.180030be0
cmp r12, r15
jne 0x18002ff02
mov rcx, rsi
mov rdx, qword [rbp + 0xa80]
mov r8, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18002ff21
test r12, r12
je 0x18002fd60
mov r8d, 1
mov rcx, rsi
mov rdx, r12
call fcn.180030be0
jmp 0x18002fd60
mov qword [rbp + 0xa98], rsi
mov edx, dword [rbp + 0x3e0]
mov ecx, 0x18
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
lea r15, [rbp + 0xa58]
mov rsi, rax
dec rax
cmp rax, 0xfffffffffffffffe
jae 0x180030278
lea rcx, [rbp + 0x610]
call fcn.18003b480
mov dword [rbp - 0x60], 0x438
movups xmm0, xmmword [rbp + 0x614]
movups xmmword [rbp - 0x5c], xmm0
mov rax, qword [rbp + 0x628]
mov qword [rbp - 0x48], rax
mov eax, dword [rbp + 0x630]
mov dword [rbp - 0x40], eax
mov rax, qword [rbp + 0x638]
mov qword [rbp - 0x38], rax
mov r8d, 0x200
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x640]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x208
lea rcx, [rbp + 0x1d0]
lea rdx, [rbp + 0x840]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
mov rdx, r13
call qword [sym.imp.kernel32.dll_Module32FirstW]
test eax, eax
je 0x1800302bc
mov qword [rbp + 0xa58], 0
mov qword [rbp + 0xa60], 1
mov qword [rbp + 0xa68], 0
mov r8d, 0x82
mov rcx, r15
xor edx, edx
call fcn.18009eca0
lea rax, [rbp + 0x404]
mov qword [rbp + 0x610], rax
lea rax, [rbp + 0x60c]
mov qword [rbp + 0x618], rax
mov word [rbp + 0x620], 0
lea rcx, [rbp + 0x610]
mov rdx, r15
call fcn.180011ad0
mov r10, qword [rbp + 0xa58]
mov rdi, qword [rbp + 0xa60]
mov rax, qword [rbp + 0xa68]
mov r15, qword [rbp + 0xa90]
mov qword [rbp + 0xa88], r10
jmp 0x18003006d
dec rax
movzx ecx, cl
sub rax, rdi
test ecx, ecx
jne 0x1800300e6
test rax, rax
je 0x1800300dc
mov rsi, rax
add rax, rdi
movzx ecx, byte [rax - 1]
test cl, cl
jns 0x180030060
movzx edx, byte [rax - 2]
cmp dl, 0xc0
jge 0x1800300ae
movzx r8d, byte [rax - 3]
cmp r8b, 0xbf
jg 0x1800300b7
movzx r9d, byte [rax - 4]
add rax, 0xfffffffffffffffc
and r9d, 7
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
jmp 0x1800300bf
add rax, 0xfffffffffffffffe
and edx, 0x1f
jmp 0x1800300c9
add rax, 0xfffffffffffffffd
and r8d, 0xf
shl r8d, 6
and edx, 0x3f
or edx, r8d
shl edx, 6
and cl, 0x3f
movzx ecx, cl
or ecx, edx
cmp ecx, 0x110000
jne 0x180030066
xor esi, esi
mov r14d, 1
jmp 0x18003011c
test rsi, rsi
js 0x180030331
movzx eax, byte [0x180101c71]
mov r15d, 1
mov edx, 1
mov rcx, rsi
call fcn.180030bd0
test rax, rax
je 0x180030325
mov r14, rax
mov r15, qword [rbp + 0xa90]
mov rcx, r14
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rbp + 0xa88]
test rdx, rdx
je 0x180030144
mov r8d, 1
mov rcx, rdi
call fcn.180030be0
cmp rsi, r15
jne 0x180030181
mov rcx, r14
mov rdx, qword [rbp + 0xa80]
mov r8, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180030181
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0xa48], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp + 0xa50], rax
mov eax, 1
mov qword [rbp + 0xa70], rax
test rsi, rsi
je 0x180030197
mov r8d, 1
mov rcx, r14
mov rdx, rsi
call fcn.180030be0
mov rsi, qword [rbp + 0xa98]
test r12, r12
jne 0x18002ff0b
jmp 0x18002fd60
call fcn.18003b7f0
mov ecx, edx
mov qword [rsi], 1
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
jmp 0x180030261
call fcn.18003b7f0
mov qword [rbp + 0x618], rax
mov dword [rbp + 0x620], edx
mov qword [rbp + 0x610], 1
test rax, rax
je 0x1800301f5
lea rcx, [rbp + 0x618]
call fcn.18003b4a0
cmp qword [rbp + 0xa70], 0
je 0x180030253
mov rax, qword [rbp + 0xa48]
mov rsi, qword [rbp + 0xa78]
mov qword [rsi + 8], rax
mov rax, qword [rbp + 0xa50]
mov qword [rsi + 0x10], rax
mov qword [rsi], 3
jmp 0x180030261
call fcn.18003b7f0
mov qword [rbp + 0x618], rax
mov dword [rbp + 0x620], edx
mov qword [rbp + 0x610], 1
test rax, rax
je 0x180030253
lea rcx, [rbp + 0x618]
call fcn.18003b4a0
mov rsi, qword [rbp + 0xa78]
mov qword [rsi], 0
mov rax, rsi
add rsp, 0xb28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.18003b7f0
mov ecx, edx
mov rsi, qword [rbp + 0xa78]
mov qword [rsi], 2
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov rdx, qword [rbp + 0xa90]
test rdx, rdx
je 0x180030261
mov r8d, 1
mov rcx, qword [rbp + 0xa98]
call fcn.180030be0
mov rsi, qword [rbp + 0xa78]
jmp 0x180030261
call fcn.18003b7f0
mov qword [rbp + 0x618], rax
mov dword [rbp + 0x620], edx
mov qword [rbp + 0x610], 1
test rax, rax
je 0x1800302ea
lea rcx, [rbp + 0x618]
call fcn.18003b4a0
mov rdx, qword [rbp + 0xa90]
test rdx, rdx
je 0x1800301f5
mov r8d, 1
mov rcx, qword [rbp + 0xa98]
call fcn.180030be0
jmp 0x1800301f5
mov rdx, r12
jmp 0x18003031b
mov rdx, rsi
xor esi, esi
mov rcx, rsi
call fcn.1800a5610
jmp 0x180030346
mov qword [rbp + 0xa80], rdi
mov r14, rsi
jmp 0x18003033b
mov qword [rbp + 0xa80], rdi
xor r15d, r15d
mov rcx, r15
mov rdx, r14
call fcn.1800a5610
ud2