Function at 0x1400dd573
Capabilities:
Enumerate processes

Disassembly:
push rax
pushf
mov eax, 0xb52eae53
pushf
not eax
add eax, 0xd1b1ccfc
xor eax, 0x9ed72e8c
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xdc6e3d97
xor eax, 0xb64b993d
rol eax, 0x55
popf
pushf
not eax
add eax, 0xe38ecd13
xor eax, 0x975e9185
rol eax, 0x77
popf
pushf
not eax
add eax, 0xaac92c44
xor eax, 0xe67bc3bb
rol eax, 0xe6
popf
cmp eax, 4
jne 0x1400dd5d6
popf
pop rax
jmp 0x1400dd8b3
cmp eax, 0
jne 0x1400dd5e5
popf
pop rax
jmp 0x1400dd67b
cmp eax, 3
jne 0x1400dd5f4
popf
pop rax
jmp 0x1400dd832
cmp eax, 1
jne 0x1400dd603
popf
pop rax
jmp 0x1400dd79c
cmp eax, 0xa
jne 0x1400dd612
popf
pop rax
jmp 0x1400ddb82
cmp eax, 7
jne 0x1400dd621
popf
pop rax
jmp 0x1400dda00
cmp eax, 6
jne 0x1400dd630
popf
pop rax
jmp 0x1400dd9cb
cmp eax, 0xb
jne 0x1400dd63f
popf
pop rax
jmp 0x1400ddbe9
cmp eax, 9
jne 0x1400dd64e
popf
pop rax
jmp 0x1400ddb2b
cmp eax, 8
jne 0x1400dd65d
popf
pop rax
jmp 0x1400dda9f
cmp eax, 5
jne 0x1400dd66c
popf
pop rax
jmp 0x1400dd952
cmp eax, 2
jne 0x1400dd67b
popf
pop rax
jmp 0x1400dd813
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140034010]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0xedead5b
pushf
not ecx
add ecx, 0xc56fd983
xor ecx, 0xebca2e1f
rol ecx, 0x6c
popf
pushf
not ecx
add ecx, 0x81b907b5
xor ecx, 0xf21581df
rol ecx, 0xc
popf
rep stosb byte [rdi], al
lea ecx, [rax + 2]
xor edx, edx
jmp 0x1400dd6db
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400dd743
push rax
pushf
mov eax, 0xa982a61
pushf
not eax
add eax, 0xeae7ba9b
xor eax, 0xe1cbeee6
rol eax, 0xb8
popf
pushf
not eax
add eax, 0xd8107786
xor eax, 0xc01719e4
rol eax, 0x9a
popf
pushf
not eax
add eax, 0xccd61602
xor eax, 0xd4fb878d
rol eax, 0x75
popf
pushf
not eax
add eax, 0xce2ec1e3
xor eax, 0x92a1609d
rol eax, 0xcc
popf
jmp 0x1400dd5c7
push rax
pushf
mov eax, 0xde5cc365
pushf
not eax
add eax, 0xfc3ffaab
xor eax, 0xc73f73c8
rol eax, 0x97
popf
pushf
not eax
add eax, 0xbe458d85
xor eax, 0x9b90e4e6
rol eax, 0x8b
popf
pushf
not eax
add eax, 0xf17c2a9b
xor eax, 0xa56755bb
rol eax, 0xa1
popf
pushf
not eax
add eax, 0xfc885496
xor eax, 0xe3f9a777
rol eax, 0xc9
popf
jmp 0x1400dd5c7
lea rcx, [0x18cd9d167]
pushf
sub rcx, 0x4cd77daf
popf
call fcn.140090778
xor eax, eax
jmp 0x1400ddbe9
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
jmp 0x1400dd824
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400dd8b3
lea rcx, [0x18c5a2050]
pushf
sub rcx, 0x4c57cc60
popf
call fcn.140090778
mov rcx, rdi
jmp 0x1400dd84d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400ddbe9
mov rdx, rbx
lea rcx, [rsp + 0x4c]
jmp 0x1400dd8bc
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1400dd91f
push rax
pushf
mov eax, 0xefe77ae0
pushf
not eax
add eax, 0xf0d0ab2d
xor eax, 0x84747c18
rol eax, 0xd0
popf
pushf
not eax
add eax, 0x849014ec
xor eax, 0x9c5aeea3
rol eax, 0xd7
popf
pushf
not eax
add eax, 0xecf15cb5
xor eax, 0x835a7ab5
rol eax, 0x6c
popf
pushf
not eax
add eax, 0xe54fafa1
xor eax, 0x917ba04c
rol eax, 0xea
popf
jmp 0x1400dd5c7
push rax
pushf
mov eax, 0xad86132c
pushf
not eax
add eax, 0xbf46f8fe
xor eax, 0x84d9f465
rol eax, 0xa2
popf
pushf
not eax
add eax, 0xfee021ff
xor eax, 0xaa7bf32c
rol eax, 0x16
popf
jmp 0x1400dd5c7
lea rdx, [rsp + 0x20]
mov rcx, rdi
jmp 0x1400dd95b
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400dd998
push rax
pushf
mov eax, 0x5752e2ea
pushf
not eax
add eax, 0xf8e1b4cf
xor eax, 0x895f3468
rol eax, 0x7e
popf
pushf
not eax
add eax, 0xbb887c56
xor eax, 0xb15582f2
rol eax, 0x92
popf
jmp 0x1400dd5c7
push rax
pushf
mov eax, 0x429d5ecd
pushf
not eax
add eax, 0xef251de2
xor eax, 0xa2944374
rol eax, 0xdc
popf
pushf
not eax
add eax, 0xa94eb689
xor eax, 0xa86d76e6
rol eax, 0x5e
popf
jmp 0x1400dd5c7
nop
push rax
pushf
mov eax, 0x978afe06
pushf
not eax
add eax, 0xdb2dc3a2
xor eax, 0xa12370ef
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xa9f21447
xor eax, 0xcf39a306
rol eax, 0xf
popf
jmp 0x1400dd5c7
mov rdx, rbx
lea rcx, [rsp + 0x4c]
jmp 0x1400dda09
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1400dda46
push rax
pushf
mov eax, 0xb66e0c50
pushf
not eax
add eax, 0xc56f2f94
xor eax, 0xa3f710db
rol eax, 0x26
popf
pushf
not eax
add eax, 0xfcd530c7
xor eax, 0xbe484a9b
rol eax, 0xeb
popf
jmp 0x1400dd5c7
push rax
pushf
mov eax, 0xe54fb35
pushf
not eax
add eax, 0xa04ed4c3
xor eax, 0xbc8def74
rol eax, 0xcc
popf
pushf
not eax
add eax, 0xe280f674
xor eax, 0xdebd5b0f
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xca5bda72
xor eax, 0xfeed5039
rol eax, 5
popf
pushf
not eax
add eax, 0xcfc88e02
xor eax, 0x889707f4
rol eax, 0x52
popf
jmp 0x1400dd5c7
lea rdx, [rsp + 0x20]
mov rcx, rdi
jmp 0x1400ddaa8
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400ddaf8
push rax
pushf
mov eax, 0x8336bc86
pushf
not eax
add eax, 0xdafcda50
xor eax, 0xca35ff79
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xaeeec36b
xor eax, 0x8495b839
rol eax, 0xb7
popf
pushf
not eax
add eax, 0xbc87daab
xor eax, 0xee230ef9
rol eax, 0xd5
popf
jmp 0x1400dd5c7
push rax
pushf
mov eax, 0x166cdfb7
pushf
not eax
add eax, 0xb972dbbf
xor eax, 0x9bc00078
rol eax, 0x85
popf
pushf
not eax
add eax, 0xaa033db3
xor eax, 0x9143ae4b
rol eax, 0x59
popf
jmp 0x1400dd5c7
mov rcx, rdi
jmp 0x1400ddb2f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400ddbe9
mov rcx, rdi
jmp 0x1400ddb86
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
push rax
pushf
mov eax, 0x8162fb1d
pushf
not eax
add eax, 0xbb810c9b
xor eax, 0xa5166a01
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xb197431a
xor eax, 0xf2aca221
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xc68a7e0a
xor eax, 0xea891ddf
rol eax, 0x26
popf
pushf
not eax
add eax, 0xe7a75565
xor eax, 0x8323f3aa
rol eax, 0xb3
popf
jmp 0x1400dd5c7
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400bc272
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret