Function at 0x14007b770
Capabilities:
Enumerate processes

Disassembly:
push r14
push r15
sub rsp, 0xab8
xor edx, edx
mov dword [rsp + 0x30], 0x238
mov r15, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rdx, r15
movzx ecx, word [rdx]
cmp cx, 0x20
je 0x14007b7b4
cmp cx, 9
jne 0x14007b7ba
add rdx, 2
jmp 0x14007b7a5
mov qword [rsp + 0xad0], rbx
mov qword [rsp + 0xad8], rbp
mov qword [rsp + 0xae0], rsi
mov qword [rsp + 0xab0], rdi
test cx, cx
je 0x14007b8be
xor esi, esi
cmp cx, 0x2d
je 0x14007b8e6
movzx eax, cx
cmp cx, 0x2b
jne 0x14007b7fc
movzx eax, word [rdx + 2]
lea rdi, [rdx + 2]
cmovne rdi, rdx
cmp ax, 0x30
jne 0x14007b835
movzx eax, word [rdi + 2]
mov ecx, 0xffdf
sub ax, 0x58
test cx, ax
jne 0x14007b835
movzx ecx, word [rdi + 4]
lea rbx, [rdi + 4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isxdigit]
test eax, eax
je 0x14007b835
mov ebp, 1
jmp 0x14007b83b
mov ebp, esi
lea rbx, [rdi + 4]
test ebp, ebp
mov ecx, esi
cmove rbx, rdi
movzx edi, word [rbx]
cmp edi, 0x20
je 0x14007b8a0
nop dword [rax + rax]
cmp edi, 9
je 0x14007b8a0
test edi, edi
je 0x14007b8ba
cmp edi, 0x2e
je 0x14007b8e6
test ebp, ebp
je 0x14007b884
movzx ecx, di
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswxdigit]
test eax, eax
mov ecx, esi
sete cl
test ecx, ecx
je 0x14007b88c
movzx ecx, di
call fcn.14000d4e0
jmp 0x14007b8e6
lea eax, [rdi - 0x30]
cmp eax, 9
ja 0x14007b87a
movzx edi, word [rbx + 2]
add rbx, 2
mov ecx, 1
cmp edi, 0x20
jne 0x14007b850
nop
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14007b8af
cmp ax, 9
jne 0x14007b8b5
add rbx, 2
jmp 0x14007b8a0
test ax, ax
jne 0x14007b8e6
test ecx, ecx
je 0x14007b8e6
mov rcx, r15
call fcn.1400132b0
mov rcx, r15
test al, al
je 0x14007b8de
xor edx, edx
lea r8d, [rdx + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wcstoi64]
mov rsi, rax
jmp 0x14007b8e6
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi64]
mov esi, eax
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov rdi, qword [rsp + 0xab0]
mov rbp, qword [rsp + 0xad8]
mov rbx, qword [rsp + 0xad0]
test eax, eax
je 0x14007b9bd
test esi, esi
je 0x14007b922
cmp esi, dword [rsp + 0x38]
je 0x14007b9dc
lea rax, [rsp + 0x480]
lea r9, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x690]
lea rdx, [rsp + 0x8a0]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath]
lea rax, [rsp + 0x270]
sub rax, 2
nop
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x14007b960
lea r8, [rsp + 0x480]
xor edx, edx
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x14007b980
mov rdx, r15
lea rcx, [rsp + 0x270]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, r14
test eax, eax
je 0x14007b9fb
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14007b914
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret