Function at 0x140036900
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3d8]
sub rsp, 0x4d8
mov qword [rbp + 0x188], 0xfffffffffffffffe
xor r14d, r14d
mov ebx, r14d
mov dword [rsp + 0x58], ebx
mov dword [rbp + 0x190], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13, rax
mov qword [rbp - 0x60], rax
mov edx, 0x109
lea rcx, [rbp + 0x168]
call fcn.1400160a0
nop
cmp r13, 0xffffffffffffffff
je 0x140037241
lea rdx, [rbp + 0x190]
mov rcx, r13
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x140037237
movzx edi, byte [rbp + 0x420]
nop word [rax + rax]
mov qword [rbp - 0x68], 7
mov qword [rbp - 0x70], r14
mov word [rbp - 0x80], r14w
cmp word [rbp + 0x1bc], 0
jne 0x1400369b0
mov r8, r14
jmp 0x1400369cb
lea rax, [rbp + 0x1bc]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400369c0
lea rdx, [rbp + 0x1bc]
lea rcx, [rbp - 0x80]
call fcn.14000b804
nop
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov rax, qword [rbp - 0x70]
lea rbx, [rdx + rax*2]
lea r14, [rbp - 0x80]
cmovae r14, qword [rbp - 0x80]
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
xor r12d, r12d
mov qword [rsp + 0x48], r12
mov byte [rsp + 0x38], r12b
mov rsi, rbx
sub rsi, r14
sar rsi, 1
cmp rsi, 0xf
je 0x140036a86
cmp rsi, 0xfffffffffffffffe
ja 0x140037212
cmp rsi, 0xf
jbe 0x140036a42
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.14000cca4
jmp 0x140036a68
cmp rsi, 0x10
jae 0x140036a59
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x38]
call fcn.14000cea8
jmp 0x140036a68
test rsi, rsi
jne 0x140036a6d
mov qword [rsp + 0x48], r12
mov byte [rsp + 0x38], r12b
test rsi, rsi
je 0x140036a86
mov qword [rsp + 0x48], r12
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rax, qword [rsp + 0x38]
mov byte [rax], r12b
movzx r9d, dil
mov r8, rbx
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.140037300
nop
lea r15, [rsp + 0x38]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x50]
cmp r9, 0x10
cmovae r15, r8
lea rax, [rsp + 0x38]
cmovae rax, r8
mov rcx, qword [rsp + 0x48]
add rax, rcx
lea r14, [rsp + 0x38]
cmp r9, 0x10
cmovae r14, r8
mov rsi, rax
sub rsi, r14
cmp r14, rax
cmova rsi, r12
test rsi, rsi
je 0x140036b0a
mov rbx, r12
movsx ecx, byte [r14 + rbx]
call fcn.140155970
mov byte [r15 + rbx], al
inc rbx
cmp rbx, rsi
jne 0x140036ae5
mov r9, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x38]
lea rbx, [rsp + 0x38]
cmp r9, 0x10
cmovae rbx, r8
add rbx, rcx
lea rdx, [rsp + 0x38]
cmp r9, 0x10
cmovae rdx, r8
add rdx, rcx
lea rcx, [rsp + 0x38]
cmp r9, 0x10
cmovae rcx, r8
lea rax, [fcn.14015a988]
mov qword [rbp + 0x420], rax
lea r8, [rbp + 0x420]
call fcn.140037400
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rcx, qword [rsp + 0x38]
mov rdx, rax
sub rdx, rcx
sub rbx, rax
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.14000c94c
mov edx, 0x109
lea rcx, [rsp + 0x60]
call fcn.1400160a0
mov r15, rax
mov r12, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140036b98
mov r15, qword [rax]
mov rbx, qword [rsp + 0x48]
test r12, r12
jne 0x140036bad
xor r14d, r14d
mov esi, r14d
jmp 0x140036c34
test rbx, rbx
je 0x140036c2d
cmp r12, rbx
ja 0x140036c2d
sub rbx, r12
inc rbx
lea r14, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae r14, qword [rsp + 0x38]
nop
test rbx, rbx
je 0x140036c28
movsx edx, byte [r15]
mov r8, rbx
mov rcx, r14
call fcn.14011daf8
mov rsi, rax
test rax, rax
je 0x140036c28
mov r8, r12
mov rdx, r15
mov rcx, rax
call fcn.14011db30
test eax, eax
je 0x140036c0d
sub r14, rsi
dec r14
add rbx, r14
lea r14, [rsi + 1]
jmp 0x140036bd0
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rax, qword [rsp + 0x38]
sub rsi, rax
mov rbx, qword [rsp + 0x48]
jmp 0x140036c31
mov rbx, qword [rsp + 0x48]
or rsi, 0xffffffffffffffff
xor r14d, r14d
mov rax, qword [rsp + 0x78]
cmp rax, 0x10
jb 0x140036c89
inc rax
mov rcx, qword [rsp + 0x60]
cmp rax, 0x1000
jb 0x140036c7f
test cl, 0x1f
jne 0x140037231
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14003722b
sub rcx, rax
cmp rcx, 8
jb 0x140037225
cmp rcx, 0x27
ja 0x14003721f
mov rcx, rax
call fcn.1400eb7f4
mov rbx, qword [rsp + 0x48]
cmp rsi, 0xffffffffffffffff
je 0x1400371d0
mov r12, qword [rbp + 0x178]
lea r15, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae r15, qword [rbp + 0x168]
test r12, r12
jne 0x140036cbb
mov rsi, r14
jmp 0x140036d3a
test rbx, rbx
je 0x140036d33
cmp r12, rbx
ja 0x140036d33
sub rbx, r12
inc rbx
lea r14, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae r14, qword [rsp + 0x38]
nop dword [rax]
test rbx, rbx
je 0x140036d33
movsx edx, byte [r15]
mov r8, rbx
mov rcx, r14
call fcn.14011daf8
mov rsi, rax
test rax, rax
je 0x140036d33
mov r8, r12
mov rdx, r15
mov rcx, rax
call fcn.14011db30
test eax, eax
je 0x140036d1d
sub r14, rsi
dec r14
add rbx, r14
lea r14, [rsi + 1]
jmp 0x140036ce0
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rax, qword [rsp + 0x38]
sub rsi, rax
jmp 0x140036d37
or rsi, 0xffffffffffffffff
xor r14d, r14d
mov qword [rsp + 0x20], r14
lea r9, [0x14069df3a]
mov r8d, 4
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140009448
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x48], r14
mov byte [rbp - 0x58], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x58]
call fcn.14000ca10
lea rcx, [rbp - 0x58]
call fcn.140036050
mov byte [rsp + 0x33], al
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x38], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x38]
call fcn.14000ca10
lea rcx, [rbp - 0x38]
call fcn.1400360d0
mov byte [rsp + 0x32], al
mov qword [rbp], reloc.WS2_32.dll_ntohs
mov qword [rbp - 8], r14
mov byte [rbp - 0x18], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x18]
call fcn.14000ca10
lea rcx, [rbp - 0x18]
call fcn.140036150
mov byte [rsp + 0x31], al
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x18], r14
mov byte [rbp + 8], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 8]
call fcn.14000ca10
lea rcx, [rbp + 8]
call fcn.1400361d0
mov byte [rsp + 0x30], al
mov qword [rbp + 0x40], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x38], r14
mov byte [rbp + 0x28], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x28]
call fcn.14000ca10
lea rcx, [rbp + 0x28]
call fcn.140036250
mov byte [rbp + 0x438], al
mov qword [rbp + 0x60], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x58], r14
mov byte [rbp + 0x48], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x48]
call fcn.14000ca10
lea rcx, [rbp + 0x48]
call fcn.1400362d0
mov byte [rbp + 0x430], al
mov qword [rbp + 0x80], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x78], r14
mov byte [rbp + 0x68], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x68]
call fcn.14000ca10
lea rcx, [rbp + 0x68]
call fcn.140036360
mov byte [rbp + 0x428], al
mov qword [rbp + 0xa0], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x98], r14
mov byte [rbp + 0x88], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x88]
call fcn.14000ca10
lea rcx, [rbp + 0x88]
call fcn.1400363e0
mov byte [rbp + 0x420], al
mov qword [rbp + 0xc0], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xb8], r14
mov byte [rbp + 0xa8], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0xa8]
call fcn.14000ca10
lea rcx, [rbp + 0xa8]
call fcn.140036460
movzx r13d, al
mov qword [rbp + 0xe0], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xd8], r14
mov byte [rbp + 0xc8], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0xc8]
call fcn.14000ca10
lea rcx, [rbp + 0xc8]
call fcn.1400364e0
movzx r12d, al
mov qword [rbp + 0x100], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xf8], r14
mov byte [rbp + 0xe8], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0xe8]
call fcn.14000ca10
lea rcx, [rbp + 0xe8]
call fcn.140036560
movzx r15d, al
mov qword [rbp + 0x120], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x118], r14
mov byte [rbp + 0x108], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x108]
call fcn.14000ca10
lea rcx, [rbp + 0x108]
call fcn.1400365e0
movzx r14d, al
xor ebx, ebx
mov qword [rbp + 0x138], rbx
mov qword [rbp + 0x140], rbx
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x128]
call fcn.14000cea8
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x128]
call fcn.14000ca10
lea rcx, [rbp + 0x128]
call fcn.140036660
movzx esi, al
mov qword [rbp + 0x158], rbx
mov qword [rbp + 0x160], rbx
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x148]
call fcn.14000cea8
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x148]
call fcn.14000ca10
lea rcx, [rbp + 0x148]
call fcn.140036780
movzx ebx, al
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.14000cea8
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.14000ca10
lea rcx, [rsp + 0x60]
call fcn.140036810
neg al
sbb ecx, ecx
and ecx, 0x4000
neg bl
sbb eax, eax
and eax, 0x2000
or ecx, eax
neg sil
sbb eax, eax
and eax, 0x1000
or ecx, eax
neg r14b
sbb eax, eax
and eax, 0x800
or ecx, eax
neg r15b
sbb eax, eax
and eax, 0x400
or ecx, eax
neg r12b
sbb eax, eax
and eax, 0x200
or ecx, eax
neg r13b
sbb eax, eax
and eax, 0x100
or ecx, eax
neg byte [rbp + 0x420]
sbb eax, eax
and eax, 0x80
or ecx, eax
neg byte [rbp + 0x428]
sbb eax, eax
and eax, 0x40
or ecx, eax
neg byte [rbp + 0x430]
sbb eax, eax
and eax, 0x20
or ecx, eax
neg byte [rbp + 0x438]
sbb eax, eax
and eax, 0x10
or ecx, eax
neg byte [rsp + 0x30]
sbb eax, eax
and eax, 8
or ecx, eax
neg byte [rsp + 0x31]
sbb eax, eax
and eax, 4
or ecx, eax
neg byte [rsp + 0x32]
sbb eax, eax
and eax, 2
or ecx, eax
xor r14d, r14d
mov eax, r14d
cmp byte [rsp + 0x33], al
setne al
or ecx, eax
mov ebx, dword [rsp + 0x58]
or ebx, ecx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.14000cea8
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.14000ca10
lea rcx, [rsp + 0x60]
call fcn.140036050
mov r13, qword [rbp - 0x60]
jmp 0x1400371d4
mov ebx, dword [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.14000c7e0
nop
mov r8, qword [rbp - 0x68]
cmp r8, 8
jb 0x1400371f9
inc r8
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.14000c6f4
lea rdx, [rbp + 0x190]
mov rcx, r13
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x140037237
jmp 0x140036990
lea rcx, str.string_too_long
call fcn.1400bc800
nop
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
nop
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x168]
call fcn.14000c7e0
mov eax, ebx
add rsp, 0x4d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret