Function at 0x180002790
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov eax, 0x8e3baa62
lea rsi, [rsp + 0x68]
mov ebp, 0x5d4a4239
mov r14d, 0x69ffc714
cmp eax, 0x5489b22
jle 0x180002815
cmp eax, 0x573e3cbe
jle 0x180002856
cmp eax, 0x6616a264
jle 0x1800028c8
cmp eax, 0x6d10650d
jle 0x18000299a
cmp eax, 0x6d10650e
je 0x180002b11
cmp eax, 0x7a09d593
je 0x180002b2a
cmp eax, 0x7a75e19b
jne 0x1800027b8
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
call sub.KERNEL32.dll_Process32First
mov dword [rsp + 0x38], eax
mov eax, 0xdf13e5e4
jmp 0x1800027b8
cmp eax, 0xad166c64
jg 0x18000288c
cmp eax, 0x90eb637e
jle 0x1800028f6
cmp eax, 0x9ec5bbfa
jle 0x1800029be
cmp eax, 0x9ec5bbfb
je 0x180002b52
cmp eax, 0xa4d97d32
jne 0x180002cf7
mov eax, dword [rsp + 0x24]
mov eax, 0x84f24cde
jmp 0x1800027b8
cmp eax, 0x19975397
jg 0x180002923
cmp eax, 0x15ed0af8
jg 0x1800029f7
cmp eax, 0x5489b23
je 0x180002b61
cmp eax, 0x9514232
jne 0x1800027b8
mov eax, 0x7a09d593
jmp 0x1800027b8
cmp eax, 0xc97c66c1
jg 0x180002962
cmp eax, 0xc1ded38f
jg 0x180002a21
cmp eax, 0xad166c65
je 0x180002b6b
cmp eax, 0xb744df32
jne 0x1800027b8
mov eax, 0xc97c66c2
mov r15d, 1
jmp 0x1800027b8
cmp eax, 0x5d4a4238
jg 0x180002a41
cmp eax, 0x573e3cbf
je 0x180002b7e
cmp eax, 0x599ff2d8
jne 0x1800027b8
mov eax, 0x3039a5da
xor r13d, r13d
jmp 0x1800027b8
cmp eax, 0x8a5ab486
jg 0x180002a82
cmp eax, 0x84f24cde
je 0x180002bb7
cmp eax, 0x86d638b1
jne 0x1800027b8
mov eax, 0xa003f389
xor edi, edi
jmp 0x1800027b8
cmp eax, 0x37df404d
jg 0x180002ab6
cmp eax, 0x19975398
je 0x180002bec
cmp eax, 0x3039a5da
jne 0x1800027b8
mov dword [rsp + 0x24], r13d
mov eax, dword [rsp + 0x24]
cmp eax, 7
mov eax, 0x19975398
mov ecx, 0x4ebefcec
cmovl eax, ecx
jmp 0x1800027b8
cmp eax, 0xd055fadc
jg 0x180002aea
cmp eax, 0xc97c66c2
je 0x180002bfb
cmp eax, 0xcf493706
jne 0x1800027b8
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
call sub.KERNEL32.dll_Process32Next
mov eax, 0x37df404e
jmp 0x1800027b8
cmp eax, 0x6616a265
je 0x180002c1e
cmp eax, 0x69ffc714
jne 0x1800027b8
mov eax, 0xa003f389
mov edi, dword [rsp + 0x34]
jmp 0x1800027b8
cmp eax, 0x90eb637f
je 0x180002c41
cmp eax, 0x97d04fce
jne 0x1800027b8
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
call fcn.180006adc
test eax, eax
mov eax, 0x18189d7a
mov ecx, 0xb744df32
cmove eax, ecx
jmp 0x1800027b8
cmp eax, 0x15ed0af9
je 0x180002c5c
cmp eax, 0x18189d7a
jne 0x1800027b8
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x3c], eax
mov eax, 0x9ec5bbfb
jmp 0x1800027b8
cmp eax, 0xc1ded390
je 0x180002c77
cmp eax, 0xc55d00ac
jne 0x1800027b8
mov eax, 0x655193d4
jmp 0x1800027b8
cmp eax, 0x5d4a4239
je 0x180002c92
cmp eax, 0x655193d4
jne 0x1800027b8
mov qword [rsp + 0x48], rsi
mov eax, dword [0x18001ac3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc55d00ac
cmove eax, ebp
cmp dword [0x18001ac38], 0xa
cmovl eax, ebp
jmp 0x1800027b8
cmp eax, 0x8a5ab487
je 0x180002c9c
cmp eax, 0x8e3baa62
jne 0x1800027b8
mov eax, dword [0x18001ac3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc55d00ac
mov ecx, 0x655193d4
jmp 0x180002cdb
cmp eax, 0x37df404e
je 0x180002cb1
cmp eax, 0x4ebefcec
jne 0x1800027b8
mov eax, dword [0x18001ac3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa4d97d32
mov ecx, 0x84f24cde
jmp 0x180002cdb
cmp eax, 0xd055fadd
je 0x180002ced
cmp eax, 0xdf13e5e4
jne 0x1800027b8
mov eax, 0x6d10650e
xor ebx, ebx
mov r12d, dword [rsp + 0x38]
jmp 0x1800027b8
mov dword [rsp + 0x34], ebx
test r12d, r12d
mov eax, 0xc1ded390
mov ecx, 0x8a5ab487
cmove eax, ecx
jmp 0x1800027b8
mov eax, dword [0x18001ac3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x9514232
cmove eax, r14d
cmp dword [0x18001ac38], 0xa
cmovl eax, r14d
jmp 0x1800027b8
mov eax, 0x3039a5da
mov r13d, dword [rsp + 0x3c]
jmp 0x1800027b8
mov eax, 0x15ed0af9
jmp 0x1800027b8
mov r12d, dword [rsp + 0x40]
mov eax, 0x6d10650e
mov ebx, dword [rsp + 0x44]
jmp 0x1800027b8
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x68], 0x130
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 0xffffffffffffffff
mov eax, 0x7a75e19b
mov ecx, 0x86d638b1
cmove eax, ecx
jmp 0x1800027b8
lea rax, [rsp + 0x94]
mov qword [rsp + 0x50], rax
movsxd rax, dword [rsp + 0x24]
mov qword [rsp + 0x58], rax
mov eax, dword [0x18001ac3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa4d97d32
mov ecx, 0xd055fadd
jmp 0x180002cdb
mov eax, 0xc97c66c2
mov r15d, dword [rsp + 0x34]
jmp 0x1800027b8
mov dword [rsp + 0x44], r15d
mov eax, dword [0x18001ac3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcf493706
mov ecx, 0x37df404e
jmp 0x180002cdb
mov rax, qword [rsp + 0x58]
lea rax, [rax + rax*4]
lea rcx, str.taskmgr.exe
lea rax, [rcx + rax*4]
mov qword [rsp + 0x60], rax
mov eax, 0x97d04fce
jmp 0x1800027b8
mov eax, dword [0x18001ac3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x9514232
mov ecx, 0x7a09d593
jmp 0x180002cdb
mov eax, dword [0x18001ac3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5489b23
mov ecx, 0x599ff2d8
jmp 0x180002cdb
mov eax, dword [0x18001ac3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5489b23
mov ecx, 0x15ed0af9
jmp 0x180002cdb
mov eax, 0x573e3cbf
jmp 0x1800027b8
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x90eb637f
jmp 0x1800027b8
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
call sub.KERNEL32.dll_Process32Next
mov dword [rsp + 0x40], eax
mov eax, dword [0x18001ac3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcf493706
mov ecx, 0xad166c65
cmove eax, ecx
cmp dword [0x18001ac38], 0xa
cmovl eax, ecx
jmp 0x1800027b8
mov eax, 0x6616a265
jmp 0x1800027b8
cmp eax, 0xa003f389
jne 0x1800027b8
mov rax, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret