Function at 0x14001ed00
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x140083100]
xor rax, rsp
mov qword [rbp + 0x560], rax
mov r12, rdx
mov r14, rcx
mov qword [rsp + 0x70], rcx
xor r15d, r15d
mov edi, r15d
mov dword [rsp + 0x60], r15d
lea rcx, [rbp + 0x240]
call fcn.14001dae0
nop
mov r13d, r15d
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp + 0x260]
call fcn.140062f70
lea rcx, [rbp + 0x260]
call fcn.140004600
nop
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
jne 0x14001eeb1
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], r15
mov r8d, 0x20
lea rdx, str.Failed_to_retrieve_process_info.
mov rcx, r14
call fcn.140002950
nop
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x260], rax
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0x25c], edx
lea rcx, [rbp + 0x268]
call fcn.1400042e0
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x260], rax
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x25c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x2e8], rax
lea rcx, [rbp + 0x2e8]
call fcn.140033df4
nop
mov rdx, qword [rbp + 0x258]
cmp rdx, 0xf
jbe 0x14001ee84
inc rdx
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ee7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f856
call fcn.1400361dc
mov rax, r14
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.140036180
mov rbx, qword [rsp + 0x6c0]
add rsp, 0x670
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rbp - 0x80], 0x238
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14001f4ac
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
lea rax, [rbp - 0x54]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001eef0
lea rdx, [rbp - 0x54]
lea rcx, [rsp + 0x40]
call fcn.140009570
nop
cmp qword [rsp + 0x50], 0
jne 0x14001ef3a
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], r15
mov qword [rbp + 0x1f8], 0xf
mov byte [rbp + 0x1e0], 0
jmp 0x14001efef
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova r8, qword [rsp + 0x40]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, dword [rsp + 0x50]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rdx, rbx
xor r8d, r8d
lea rcx, [rbp + 0x1c0]
call fcn.140002620
lea rax, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 0xf
cmova rax, qword [rbp + 0x1c0]
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova r8, qword [rsp + 0x40]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x50]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movups xmm0, xmmword [rbp + 0x1c0]
movups xmmword [rbp + 0x1e0], xmm0
movups xmm1, xmmword [rbp + 0x1d0]
movups xmmword [rbp + 0x1f0], xmm1
or edi, 2
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14001f034
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f02f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f862
call fcn.1400361dc
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r15w
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x220]
call fcn.14001dae0
nop
lea rdx, [rbp + 0x220]
mov rbx, qword [rbp + 0x238]
cmp rbx, 0xf
cmova rdx, qword [rbp + 0x220]
lea rcx, [rbp + 0x240]
cmp qword [rbp + 0x258], 0xf
cmova rcx, qword [rbp + 0x240]
mov r8, qword [rbp + 0x250]
cmp r8, qword [rbp + 0x230]
jne 0x14001f402
call fcn.140063310
test eax, eax
jne 0x14001f402
mov r8d, dword [rbp - 0x78]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14001f3f6
mov r9d, 0x104
lea r8, [rbp + 0x350]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
lea rdx, str.PID:
lea rcx, [rbp + 0x260]
test eax, eax
je 0x14001f378
call fcn.140005190
mov edx, dword [rbp - 0x78]
mov rcx, rax
call fcn.14001f880
mov rcx, rax
lea rdx, [0x140075c34]
call fcn.140005190
mov rcx, rax
lea rdx, str.Name:
call fcn.140005190
lea rdx, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], 0xf
cmova rdx, qword [rbp + 0x1e0]
mov r8, qword [rbp + 0x1f0]
mov rcx, rax
call fcn.14001fec0
lea rdx, [0x140075c34]
mov rcx, rax
call fcn.140005190
mov rcx, rax
lea rdx, str.Location:
call fcn.140005190
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea rax, [rbp + 0x350]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bx
jne 0x14001f190
lea rdx, [rbp + 0x350]
lea rcx, [rsp + 0x40]
call fcn.140009570
nop
mov r9, qword [rsp + 0x50]
test r9, r9
jne 0x14001f1e1
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
mov r8, rbx
mov qword [rbp + 0x1d0], rbx
mov eax, 0xf
mov qword [rbp + 0x1d8], rax
mov byte [rbp + 0x1c0], bl
jmp 0x14001f2a5
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova r8, qword [rsp + 0x40]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rdx, rbx
xor r8d, r8d
lea rcx, [rbp + 0x200]
call fcn.140002620
lea rax, [rbp + 0x200]
cmp qword [rbp + 0x218], 0xf
cmova rax, qword [rbp + 0x200]
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova r8, qword [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x50]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movups xmm0, xmmword [rbp + 0x200]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rbp + 0x210]
movups xmmword [rbp + 0x1d0], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
movq r8, xmm1
or edi, 4
lea rdx, [rbp + 0x1c0]
cmp rax, 0xf
cmova rdx, qword [rbp + 0x1c0]
mov rcx, r15
call fcn.14001fec0
lea rdx, [0x140075c34]
mov rcx, rax
call fcn.140005190
nop
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x14001f314
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f30f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f868
call fcn.1400361dc
xor r15d, r15d
mov qword [rbp + 0x1d0], r15
mov qword [rbp + 0x1d8], 0xf
mov byte [rbp + 0x1c0], r15b
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14001f3ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f371
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f86e
call fcn.1400361dc
jmp 0x14001f3ea
call fcn.140005190
mov edx, dword [rbp - 0x78]
mov rcx, rax
call fcn.14001f880
mov rcx, rax
lea rdx, [0x140075c34]
call fcn.140005190
mov rcx, rax
lea rdx, str.Name:
call fcn.140005190
lea rdx, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], 0xf
cmova rdx, qword [rbp + 0x1e0]
mov r8, qword [rbp + 0x1f0]
mov rcx, rax
call fcn.14001fec0
lea rdx, [0x140075c34]
mov rcx, rax
call fcn.140005190
mov rcx, rax
lea rdx, str.Location:_Not_available_n
call fcn.140005190
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r13d
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rbp + 0x238]
cmp rbx, 0xf
jbe 0x14001f43d
lea rdx, [rbx + 1]
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f438
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f874
call fcn.1400361dc
mov qword [rbp + 0x230], r15
mov qword [rbp + 0x238], 0xf
mov byte [rbp + 0x220], 0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x14001f497
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f492
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f87a
call fcn.1400361dc
lea rdx, [rbp - 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14001eed0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13d, r13d
jne 0x14001f67d
mov rcx, qword [r12 + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x10
jb 0x14001f85c
cmp qword [r12 + 0x18], 0xf
jbe 0x14001f4e6
mov r12, qword [r12]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0x10
lea r9, str.No_instances_of
lea rcx, [rbp + 0x200]
call fcn.14000a7b0
nop
mov r8d, 7
lea rdx, str._found.
lea rcx, [rbp + 0x200]
call fcn.140004b10
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r14 + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x14001f595
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f590
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f84a
call fcn.1400361dc
movdqa xmm0, xmmword [0x140077370]
movdqu xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x200], 0
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x260], rax
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0x25c], edx
lea rcx, [rbp + 0x268]
call fcn.1400042e0
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x260], rax
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x25c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x2e8], rax
lea rcx, [rbp + 0x2e8]
call fcn.140033df4
nop
mov rdx, qword [rbp + 0x258]
cmp rdx, 0xf
jbe 0x14001ee84
inc rdx
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ee7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f850
jmp 0x14001ee7f
lea rdx, str.Found
lea rcx, [rbp + 0x260]
call fcn.140005190
mov edx, r13d
mov rcx, rax
call fcn.140007820
mov rcx, rax
lea rdx, str._instances_of
call fcn.140005190
mov r8, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 0xf
jbe 0x14001f6bb
mov r12, qword [r12]
mov rdx, r12
mov rcx, rax
call fcn.14001fec0
lea rdx, [0x140075c34]
mov rcx, rax
call fcn.140005190
nop
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
or edi, 0x40
mov dword [rsp + 0x60], edi
movups xmmword [rsp + 0x40], xmm0
mov rcx, qword [rbp + 0x2d8]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14001f735
mov rax, qword [rbp + 0x2a8]
mov r8, qword [rax]
test r8, r8
je 0x14001f735
mov rax, qword [rbp + 0x288]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x2d0]
cmovb r8, qword [rbp + 0x2d0]
sub r8, rdx
jmp 0x14001f76f
test cl, 4
jne 0x14001f765
mov rax, qword [rbp + 0x2a0]
mov rcx, qword [rax]
test rcx, rcx
je 0x14001f765
mov rax, qword [rbp + 0x280]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x2b8]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x14001f76f
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x14001f77d
mov rcx, r14
call fcn.140004d90
nop
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x260], rax
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0x25c], edx
lea rcx, [rbp + 0x268]
call fcn.1400042e0
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x260], rax
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x25c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x2e8], rax
lea rcx, [rbp + 0x2e8]
call fcn.140033df4
nop
mov rdx, qword [rbp + 0x258]
cmp rdx, 0xf
jbe 0x14001ee84
inc rdx
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ee7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f856
jmp 0x14001ee7f
call fcn.14003c334
nop
call fcn.14003c334
int3
call fcn.14003c334
nop
call fcn.140001980
nop
call fcn.14003c334
nop
call fcn.14003c334
nop
call fcn.14003c334
nop
call fcn.14003c334
nop
call fcn.14003c334
int3