Function at 0x14008e5d0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov qword [rsp + 0x40], 0
mov rsi, rcx
lea rdx, [rsp + 0x40]
lea rcx, str.kernel32.dll
call fcn.14008eca0
test eax, eax
jne 0x14008e62f
mov rdx, qword [str.Process32FirstW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14008e62f
mov rcx, qword [rsp + 0x40]
mov r8, rdi
mov rdx, rsi
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14008e690
lea rdx, [rsp + 0x40]
lea rcx, str.PSAPI.dll
call fcn.14008eca0
test eax, eax
jne 0x14008e675
mov rdx, qword [str.GetModuleFileNameExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14008e675
mov rcx, qword [rsp + 0x40]
mov r8, rdi
mov rdx, rsi
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14008e7a0
mov rsi, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x1400db800]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbp, rdx
mov r14, r8
lea rdx, str.CreateToolhelp32Snapshot
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [str.Process32FirstW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [str.Process32NextW]
mov rcx, rdi
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov rdi, rax
xor sil, sil
lea ecx, [rdx + 2]
call rbx
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14008e76c
lea rdx, [rsp + 0x40]
mov rcx, rax
call r15
test eax, eax
je 0x14008e763
mov sil, 1
xor r15d, r15d
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
mov eax, dword [rsp + 0x48]
mov rdx, r14
mov dword [rsp + 0x30], eax
call rbp
test al, al
je 0x14008e763
lea rdx, [rsp + 0x40]
mov rcx, rbx
call rdi
test eax, eax
jne 0x14008e730
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, sil
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140094850
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x290
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe60
mov rax, qword [0x1400db800]
xor rax, rsp
mov qword [rsp + 0xe50], rax
mov r15, rdx
mov r12, r8
mov rdx, qword [str.GetModuleFileNameExW]
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumProcesses
mov rcx, rdi
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumProcessModules
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov edx, 0x400
lea rcx, [rsp + 0x40]
mov r14, rax
xor bpl, bpl
call rbx
test eax, eax
je 0x14008e93e
mov ecx, dword [rsp + 0x20]
xor ebx, ebx
shr ecx, 2
mov dword [rsp + 0x20], ecx
test ecx, ecx
je 0x14008e93e
mov qword [rsp + 0xeb8], rsi
nop word [rax + rax]
lea rsi, [rsp + 0x40]
xor edx, edx
mov r8d, dword [rsi + rbx*4]
lea rsi, [rsi + rbx*4]
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14008e903
xor edx, edx
lea rcx, [rsp + 0xc40]
mov r8d, 0x208
call fcn.1400b1140
lea r9, [rsp + 0x24]
mov dword [rsp + 0x24], 0
mov r8d, 0x800
lea rdx, [rsp + 0x440]
mov rcx, rdi
call r14
test eax, eax
je 0x14008e8fa
mov rdx, qword [rsp + 0x440]
lea r8, [rsp + 0xc40]
mov r9d, 0x104
mov rcx, rdi
call r13
lea rax, [rsp + 0xc40]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
mov eax, dword [rsi]
mov rdx, r12
mov dword [rsp + 0x38], eax
mov bpl, 1
call r15
test al, al
je 0x14008e90f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rsp + 0x20]
jb 0x14008e850
mov rsi, qword [rsp + 0xeb8]
movzx eax, bpl
mov rcx, qword [rsp + 0xe50]
xor rcx, rsp
call fcn.140094850
add rsp, 0xe60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
movzx eax, bpl
jmp 0x14008e91b