Function at 0x18008ead0
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push r12
push r13
push r14
sub rsp, 0x450
mov qword [rsp + 0x1c8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800fca30]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor edx, edx
mov r14d, 2
mov ecx, r14d
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18008eb36
xor eax, eax
jmp 0x18008f91f
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x204]
call fcn.1800a3870
mov dword [rsp + 0x200], 0x238
lea rdx, [rsp + 0x200]
mov rcx, rsi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x18008eb7a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18008f91f
lea rcx, [rsp + 0x50]
call fcn.18008cbd0
mov qword [rsp + 0x58], rax
mov byte [rax + 0x41], 1
mov rax, qword [rsp + 0x58]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x58]
mov qword [rax], rax
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x10], rax
mov qword [rsp + 0x60], r12
movabs r13, 0x7ffffffffffffffe
nop
nop
nop
mov edx, 7
mov qword [rsp + 0x48], rdx
mov r8, r12
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r8w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x22c]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
cmp rcx, r13
jbe 0x18008ec07
call fcn.1800a09f0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
cmp rdx, rbx
jae 0x18008ec20
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180003710
mov rdx, qword [rsp + 0x48]
jmp 0x18008ec3e
test rbx, rbx
jne 0x18008ec3e
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x30]
cmp rdx, 8
cmovae rax, qword [rsp + 0x30]
mov word [rax], bx
jmp 0x18008ec85
test rbx, rbx
je 0x18008ec85
lea rcx, [rsp + 0x30]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x30]
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x22c]
call fcn.1800a1c40
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rax + rdi], 0
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x1d0]
call fcn.18000cd20
nop
cmp qword [rsp + 0x48], 8
jb 0x18008ecaa
mov rcx, qword [rsp + 0x30]
call fcn.1800a2030
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], 0
lea rcx, [rsp + 0x1d0]
call fcn.1800047d0
lea r8, [rsp + 0x1d0]
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x50]
call fcn.18008e590
nop
cmp qword [rsp + 0x1f0], 8
jb 0x18008ecff
mov rcx, qword [rsp + 0x1d8]
call fcn.1800a2030
lea rdx, [rsp + 0x200]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x18008ebc0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], r12
mov word [rsp + 0x70], 0
xor r8d, r8d
lea edx, [r8 + 0x18]
lea rcx, [rsp + 0x68]
call fcn.180003710
lea rcx, [rsp + 0x70]
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x70]
add rdx, rdx
mov r9d, 0x30
lea r8, str.g2dJqYtJmU_BKiHLMosd6g
call fcn.1800a1c40
mov qword [rsp + 0x80], 0x18
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rax, qword [rsp + 0x70]
mov word [rax + 0x30], 0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x90]
call fcn.18008dd50
nop
cmp qword [rax + 0x20], 8
jb 0x18008edbe
mov rsi, qword [rax + 8]
jmp 0x18008edc2
lea rsi, [rax + 8]
mov edx, 7
mov qword [rsp + 0x48], rdx
mov r8, r12
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r8w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
cmp rcx, r13
jbe 0x18008ee04
call fcn.1800a09f0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
cmp rdx, rbx
jae 0x18008ee1d
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180003710
mov rdx, qword [rsp + 0x48]
jmp 0x18008ee3b
test rbx, rbx
jne 0x18008ee3b
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x30]
cmp rdx, 8
cmovae rax, qword [rsp + 0x30]
mov word [rax], bx
jmp 0x18008ee7d
test rbx, rbx
je 0x18008ee7d
lea rcx, [rsp + 0x30]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x30]
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
mov r8, rsi
call fcn.1800a1c40
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rax + rdi], 0
mov rbx, qword [rsp + 0x58]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.18008cc50
mov rdi, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x18008eeae
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x18008eeb3
call fcn.1800a2200
cmp qword [rdi + 8], rbx
setne dil
cmp qword [rsp + 0x48], 8
jb 0x18008eecd
mov rcx, qword [rsp + 0x30]
call fcn.1800a2030
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], 0
cmp qword [rsp + 0xb0], 8
jb 0x18008eefa
mov rcx, qword [rsp + 0x98]
call fcn.1800a2030
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r12
mov word [rsp + 0x98], 0
cmp qword [rsp + 0x88], 8
jb 0x18008ef2d
mov rcx, qword [rsp + 0x70]
call fcn.1800a2030
mov ebp, r12d
test dil, dil
cmovne ebp, r14d
mov qword [rsp + 0xf0], 7
mov qword [rsp + 0xe8], r12
mov word [rsp + 0xd8], 0
xor r8d, r8d
lea edx, [r8 + 0x18]
lea rcx, [rsp + 0xd0]
call fcn.180003710
lea rcx, [rsp + 0xd8]
mov rdx, qword [rsp + 0xf0]
cmp rdx, 8
cmovae rcx, qword [rsp + 0xd8]
add rdx, rdx
mov r9d, 0x30
lea r8, str.gCRuyN7kke1mlI7007HfcA
call fcn.1800a1c40
mov qword [rsp + 0xe8], 0x18
lea rax, [rsp + 0xd8]
cmp qword [rsp + 0xf0], 8
cmovae rax, qword [rsp + 0xd8]
mov word [rax + 0x30], 0
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x1d0]
call fcn.18008dd50
nop
mov dword [rsp + 0x20], 3
cmp qword [rax + 0x20], 8
jb 0x18008effa
mov rsi, qword [rax + 8]
jmp 0x18008effe
lea rsi, [rax + 8]
mov edx, 7
mov qword [rsp + 0x48], rdx
mov r8, r12
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r8w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
cmp rcx, r13
jbe 0x18008f040
call fcn.1800a09f0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
cmp rdx, rbx
jae 0x18008f059
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180003710
mov rdx, qword [rsp + 0x48]
jmp 0x18008f077
test rbx, rbx
jne 0x18008f077
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x30]
cmp rdx, 8
cmovae rax, qword [rsp + 0x30]
mov word [rax], bx
jmp 0x18008f0b9
test rbx, rbx
je 0x18008f0b9
lea rcx, [rsp + 0x30]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x30]
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
mov r8, rsi
call fcn.1800a1c40
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rax + rdi], 0
mov ebx, 7
mov dword [rsp + 0x20], ebx
mov rsi, qword [rsp + 0x58]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.18008cc50
mov rdi, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x18008f0f3
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x18008f0f8
call fcn.1800a2200
cmp qword [rdi + 8], rsi
jne 0x18008f337
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], r12
mov word [rsp + 0x70], 0
xor r8d, r8d
lea edx, [r8 + 0x18]
lea rcx, [rsp + 0x68]
call fcn.180003710
lea rcx, [rsp + 0x70]
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x70]
add rdx, rdx
mov r9d, 0x30
lea r8, str.sjFFrtWnK15mlI7007HfcA
call fcn.1800a1c40
mov qword [rsp + 0x80], 0x18
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rax, qword [rsp + 0x70]
mov word [rax + 0x30], 0
mov dword [rsp + 0x20], 0xf
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x160]
call fcn.18008dd50
nop
mov dword [rsp + 0x20], 0x1f
cmp qword [rax + 0x20], 8
jb 0x18008f1ac
mov rdx, qword [rax + 8]
jmp 0x18008f1b0
lea rdx, [rax + 8]
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r12
mov word [rsp + 0x98], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x90]
call fcn.180005e10
nop
mov ebx, 0x3f
mov dword [rsp + 0x20], ebx
mov rsi, qword [rsp + 0x58]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x50]
call fcn.18008cc50
mov rdi, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x18008f22c
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x18008f231
call fcn.1800a2200
cmp qword [rdi + 8], rsi
jne 0x18008f337
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], r12
mov word [rsp + 0x128], 0
mov r8d, 0x18
lea rdx, str.NIfVcoTVJMEp1gPELFqSw
lea rcx, [rsp + 0x120]
call fcn.180005e10
nop
mov dword [rsp + 0x20], 0x7f
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x1a0]
call fcn.18008dd50
nop
mov dword [rsp + 0x20], 0xff
cmp qword [rax + 0x20], 8
jb 0x18008f2a7
mov rdx, qword [rax + 8]
jmp 0x18008f2ab
lea rdx, [rax + 8]
mov qword [rsp + 0x118], 7
mov qword [rsp + 0x110], r12
mov word [rsp + 0x100], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0xf8]
call fcn.180005e10
nop
mov ebx, 0x1ff
mov dword [rsp + 0x20], ebx
mov rsi, qword [rsp + 0x58]
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x50]
call fcn.18008cc50
mov rdi, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x18008f327
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x18008f32c
call fcn.1800a2200
cmp qword [rdi + 8], rsi
jne 0x18008f337
xor dil, dil
jmp 0x18008f33a
mov dil, 1
bt ebx, 8
jae 0x18008f37a
btr ebx, 8
cmp qword [rsp + 0x118], 8
jb 0x18008f35c
mov rcx, qword [rsp + 0x100]
call fcn.1800a2030
mov qword [rsp + 0x118], 7
mov qword [rsp + 0x110], r12
mov word [rsp + 0x100], 0
test bl, bl
jns 0x18008f3b8
btr ebx, 7
cmp qword [rsp + 0x1c0], 8
jb 0x18008f39a
mov rcx, qword [rsp + 0x1a8]
call fcn.1800a2030
mov qword [rsp + 0x1c0], 7
mov qword [rsp + 0x1b8], r12
mov word [rsp + 0x1a8], 0
test bl, 0x40
je 0x18008f3f6
and ebx, 0xffffffbf
cmp qword [rsp + 0x140], 8
jb 0x18008f3d8
mov rcx, qword [rsp + 0x128]
call fcn.1800a2030
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], r12
mov word [rsp + 0x128], 0
test bl, 0x20
je 0x18008f434
and ebx, 0xffffffdf
cmp qword [rsp + 0xb0], 8
jb 0x18008f416
mov rcx, qword [rsp + 0x98]
call fcn.1800a2030
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r12
mov word [rsp + 0x98], 0
test bl, 0x10
je 0x18008f472
and ebx, 0xffffffef
cmp qword [rsp + 0x180], 8
jb 0x18008f454
mov rcx, qword [rsp + 0x168]
call fcn.1800a2030
mov qword [rsp + 0x180], 7
mov qword [rsp + 0x178], r12
mov word [rsp + 0x168], 0
test bl, 8
je 0x18008f4aa
and ebx, 0xfffffff7
cmp qword [rsp + 0x88], 8
jb 0x18008f48f
mov rcx, qword [rsp + 0x70]
call fcn.1800a2030
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], r12
mov word [rsp + 0x70], 0
test bl, 4
je 0x18008f4d9
and ebx, 0xfffffffb
cmp qword [rsp + 0x48], 8
jb 0x18008f4c4
mov rcx, qword [rsp + 0x30]
call fcn.1800a2030
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], 0
test bl, 2
je 0x18008f517
and ebx, 0xfffffffd
cmp qword [rsp + 0x1f0], 8
jb 0x18008f4f9
mov rcx, qword [rsp + 0x1d8]
call fcn.1800a2030
mov qword [rsp + 0x1f0], 7
mov qword [rsp + 0x1e8], r12
mov word [rsp + 0x1d8], 0
test bl, 1
je 0x18008f537
and ebx, 0xfffffffe
cmp qword [rsp + 0xf0], 8
jb 0x18008f537
mov rcx, qword [rsp + 0xd8]
call fcn.1800a2030
test dil, dil
je 0x18008f53f
or ebp, 1
mov qword [rsp + 0xf0], 7
mov qword [rsp + 0xe8], r12
mov word [rsp + 0xd8], 0
mov r8d, 0x18
lea rdx, str.igE9GT3zhQIp1gPELFqSw
lea rcx, [rsp + 0xd0]
call fcn.180005e10
nop
bts ebx, 9
mov dword [rsp + 0x20], ebx
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x160]
call fcn.18008dd50
nop
bts ebx, 0xa
mov dword [rsp + 0x20], ebx
cmp qword [rax + 0x20], 8
jb 0x18008f5ab
mov rdx, qword [rax + 8]
jmp 0x18008f5af
lea rdx, [rax + 8]
mov qword [rsp + 0x118], 7
mov qword [rsp + 0x110], r12
mov word [rsp + 0x100], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0xf8]
call fcn.180005e10
nop
bts ebx, 0xb
mov dword [rsp + 0x20], ebx
mov rsi, qword [rsp + 0x58]
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x50]
call fcn.18008cc50
mov rdi, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x18008f62a
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x18008f62f
call fcn.1800a2200
cmp qword [rdi + 8], rsi
jne 0x18008f734
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], r12
mov word [rsp + 0x128], 0
mov r8d, 0x18
lea rdx, str.l0PF_ifqACrATEfPeOVdg
lea rcx, [rsp + 0x120]
call fcn.180005e10
nop
bts ebx, 0xc
mov dword [rsp + 0x20], ebx
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x1d0]
call fcn.18008dd50
nop
bts ebx, 0xd
mov dword [rsp + 0x20], ebx
cmp qword [rax + 0x20], 8
jb 0x18008f6a5
mov rdx, qword [rax + 8]
jmp 0x18008f6a9
lea rdx, [rax + 8]
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r12
mov word [rsp + 0x98], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x90]
call fcn.180005e10
nop
bts ebx, 0xe
mov dword [rsp + 0x20], ebx
mov rsi, qword [rsp + 0x58]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.18008cc50
mov rdi, rax
mov rax, qword [rax]
test rax, rax
je 0x18008f724
lea rcx, [rsp + 0x50]
cmp rax, rcx
je 0x18008f729
call fcn.1800a2200
cmp qword [rdi + 8], rsi
jne 0x18008f734
xor dil, dil
jmp 0x18008f737
mov dil, 1
bt ebx, 0xe
jae 0x18008f777
btr ebx, 0xe
cmp qword [rsp + 0xb0], 8
jb 0x18008f759
mov rcx, qword [rsp + 0x98]
call fcn.1800a2030
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r12
mov word [rsp + 0x98], 0
bt ebx, 0xd
jae 0x18008f7b7
btr ebx, 0xd
cmp qword [rsp + 0x1f0], 8
jb 0x18008f799
mov rcx, qword [rsp + 0x1d8]
call fcn.1800a2030
mov qword [rsp + 0x1f0], 7
mov qword [rsp + 0x1e8], r12
mov word [rsp + 0x1d8], 0
bt ebx, 0xc
jae 0x18008f7f7
btr ebx, 0xc
cmp qword [rsp + 0x140], 8
jb 0x18008f7d9
mov rcx, qword [rsp + 0x128]
call fcn.1800a2030
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], r12
mov word [rsp + 0x128], 0
bt ebx, 0xb
jae 0x18008f837
btr ebx, 0xb
cmp qword [rsp + 0x118], 8
jb 0x18008f819
mov rcx, qword [rsp + 0x100]
call fcn.1800a2030
mov qword [rsp + 0x118], 7
mov qword [rsp + 0x110], r12
mov word [rsp + 0x100], 0
bt ebx, 0xa
jae 0x18008f877
btr ebx, 0xa
cmp qword [rsp + 0x180], 8
jb 0x18008f859
mov rcx, qword [rsp + 0x168]
call fcn.1800a2030
mov qword [rsp + 0x180], 7
mov qword [rsp + 0x178], r12
mov word [rsp + 0x168], 0
bt ebx, 9
jae 0x18008f895
cmp qword [rsp + 0xf0], 8
jb 0x18008f895
mov rcx, qword [rsp + 0xd8]
call fcn.1800a2030
test dil, dil
je 0x18008f89d
or ebp, 8
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0xc8], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0xc0], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0x150], xmm0
mov rcx, qword [rcx]
mov qword [rsp + 0xc8], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0xc0], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
lea r9, [rsp + 0x150]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x50]
call fcn.18008e880
mov rcx, qword [rsp + 0x58]
call fcn.1800a2030
mov eax, ebp
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1800a3210
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret