Function at 0x140089790
Capabilities:
Enumerate processes

Disassembly:
push r14
push r15
sub rsp, 0xab8
xor edx, edx
mov qword [rsp + 0xab0], r12
mov r15, rcx
mov dword [rsp + 0x30], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rdx, r15
nop dword [rax]
movzx ecx, word [rdx]
cmp cx, 0x20
je 0x1400897df
cmp cx, 9
jne 0x1400897e5
add rdx, 2
jmp 0x1400897d0
mov qword [rsp + 0xad0], rbx
mov r12d, 0xffdf
mov qword [rsp + 0xad8], rbp
mov qword [rsp + 0xae0], rsi
mov qword [rsp + 0xae8], rdi
test cx, cx
je 0x1400898f5
xor esi, esi
cmp cx, 0x2d
je 0x14008996e
movzx eax, cx
cmp cx, 0x2b
jne 0x14008982d
movzx eax, word [rdx + 2]
lea rbx, [rdx + 2]
cmovne rbx, rdx
cmp ax, 0x30
jne 0x140089861
movzx eax, word [rbx + 2]
sub ax, 0x58
test r12w, ax
jne 0x140089861
movzx ecx, word [rbx + 4]
lea rdi, [rbx + 4]
call fcn.1400ea440
test eax, eax
je 0x140089861
mov ebp, 1
jmp 0x140089867
mov ebp, esi
lea rdi, [rbx + 4]
test ebp, ebp
mov ecx, esi
cmove rdi, rbx
movzx ebx, word [rdi]
cmp ebx, 0x20
je 0x1400898d7
cmp ebx, 9
je 0x1400898d7
test ebx, ebx
je 0x1400898f1
cmp ebx, 0x2e
je 0x14008996e
test ebp, ebp
je 0x1400898bd
movzx ecx, bx
call fcn.1400eb8cc
test eax, eax
mov ecx, esi
sete cl
test ecx, ecx
je 0x1400898c5
test ebx, 0xffffff80
jne 0x14008996e
mov edx, 2
mov ecx, ebx
call fcn.1400e8e20
jmp 0x14008996e
lea eax, [rbx - 0x30]
cmp eax, 9
ja 0x1400898a0
movzx ebx, word [rdi + 2]
add rdi, 2
mov ecx, 1
cmp ebx, 0x20
jne 0x140089877
movzx eax, word [rdi]
cmp ax, 0x20
je 0x1400898e6
cmp ax, 9
jne 0x1400898ec
add rdi, 2
jmp 0x1400898d7
test ax, ax
jne 0x14008996e
test ecx, ecx
je 0x14008996e
mov rcx, r15
nop dword [rax + rax]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14008990f
cmp ax, 9
jne 0x140089915
add rcx, 2
jmp 0x140089900
test ax, ax
je 0x140089964
cmp ax, 0x2d
je 0x140089926
cmp ax, 0x2b
jne 0x140089930
lea rax, [rcx + 2]
mov rcx, rax
movzx eax, word [rax]
cmp ax, 0x30
jne 0x140089964
movzx eax, word [rcx + 2]
sub ax, 0x58
test r12w, ax
jne 0x140089964
movzx ecx, word [rcx + 4]
call fcn.1400ea440
test eax, eax
je 0x140089964
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 0x10]
call fcn.1400ea4ec
mov rsi, rax
jmp 0x14008996e
mov rcx, r15
call fcn.1400e9f38
mov esi, eax
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov r12, qword [rsp + 0xab0]
mov rdi, qword [rsp + 0xae8]
mov rbp, qword [rsp + 0xad8]
mov rbx, qword [rsp + 0xad0]
test eax, eax
je 0x140089a4c
test esi, esi
je 0x1400899b2
cmp esi, dword [rsp + 0x38]
je 0x140089a6b
lea rax, [rsp + 0x480]
lea r9, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x690]
lea rdx, [rsp + 0x8a0]
lea rcx, [rsp + 0x5c]
call fcn.1400f114c
lea rax, [rsp + 0x270]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1400899f0
lea r8, [rsp + 0x480]
xor edx, edx
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x140089a10
mov rdx, r15
lea rcx, [rsp + 0x270]
call fcn.1400e5cc0
mov rcx, r14
test eax, eax
je 0x140089a8a
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400899a4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab8
pop r15
pop r14
ret