Function at 0x14000b040
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x8a8]
sub rsp, 0x9a8
mov ebx, edx
mov rdi, rcx
xor edx, edx
lea rcx, [rbp + 0x90]
mov r8d, 0x800
call fcn.140022720
xor r15d, r15d
cmp ebx, 4
jae 0x14000b07e
mov r14d, r15d
jmp 0x14000b089
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov r14d, eax
mov ecx, 0x8000
mov dword [rbp + 0x8f0], r14d
call fcn.140028a64
xor edx, edx
mov dword [rsp + 0x50], r15d
mov r8d, 0x8000
mov qword [rsp + 0x40], rax
mov rcx, rax
mov qword [rsp + 0x48], rax
mov rbx, rax
mov dword [rsp + 0x54], 0x8000
call fcn.140022720
test r14d, r14d
jle 0x14000b0e5
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rbx], eax
lea rax, [rbx + 4]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, str.kernel32
mov dword [rbp + 0x8e0], r15d
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000b123
lea rdx, [rbp + 0x8e0]
mov rcx, rbx
call rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000b3a1
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000b398
mov qword [rsp + 0x9a0], r12
mov r14d, 0xffffffff
mov qword [rsp + 0x998], r13
mov r12d, 0x1000
lea r13, [0x14004c2d8]
nop dword [rax]
cmp dword [0x14005d450], 6
mov ecx, 0x400
mov r8d, dword [rsp + 0x68]
cmovae ecx, r12d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14000b2a1
lea r8, [rbp + 0x8f8]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000b1ed
mov rdx, qword [rbp + 0x8f8]
lea r8, [rbp + 0x90]
mov ecx, 0x800
call fcn.14000ae90
mov rcx, qword [rbp + 0x8f8]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14000b1f4
mov byte [rbp + 0x90], r15b
mov ecx, dword [rsp + 0x68]
lea rdx, [rbp + 0x8e8]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov ecx, dword [rbp + 0x8e8]
test eax, eax
mov dword [rbp + 0x8e0], r15d
cmove ecx, r14d
mov dword [rbp + 0x8e8], ecx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000b250
lea rdx, [rbp + 0x8e0]
mov rcx, rdi
call rax
test eax, eax
je 0x14000b256
mov eax, dword [rbp + 0x8e0]
mov r9d, dword [rbp - 0x80]
lea rcx, [0x14004c2d4]
test eax, eax
lea r8, [rbp - 0x74]
mov eax, dword [rbp + 0x8e8]
lea rdx, str._s_t_d_t_d_t_s_t_s_t_d_n
mov dword [rsp + 0x38], eax
cmovne rcx, r13
lea rax, [rbp + 0x90]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x68]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], eax
call fcn.14000ce40
jmp 0x14000b2c2
mov eax, dword [rsp + 0x68]
lea r8, [rbp - 0x74]
mov r9d, dword [rbp - 0x80]
lea rdx, str._s_t_d_t_d_n
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], eax
call fcn.14000ce40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14000b180
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0x8f0], r15d
mov eax, send
mov r13, qword [rsp + 0x998]
mov r8d, reloc.WS2_32.dll_shutdown
mov r12, qword [rsp + 0x9a0]
cmove r8d, eax
cmp dword [0x14005c344], 1
jne 0x14000b35c
mov rax, qword [0x14005c350]
cmp word [rax + 0x1c0], 2
jne 0x14000b35c
movsxd rcx, dword [rax + 0x1c8]
test ecx, ecx
je 0x14000b35c
movsxd r9, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rdx, r9
cmp r9, rcx
ja 0x14000b34f
mov r9d, 1
jmp 0x14000b369
mov rdx, rbx
mov ecx, r9d
call fcn.140009a20
jmp 0x14000b371
movsxd rdx, dword [rsp + 0x50]
xor r9d, r9d
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.140009930
movsxd r8, dword [rsp + 0x54]
xor edx, edx
mov rcx, rbx
call fcn.140022720
mov rcx, rbx
call fcn.140028a50
add rsp, 0x9a8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x9a8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret