Function at 0x180002d00
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov rax, qword [0x18000a128]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x18000a160]
mov edx, dword [0x18000a164]
lea ebx, [rax - 1]
imul ebx, eax
test bl, 1
sete byte [rbp - 1]
cmp edx, 0xa
setl byte [rbp - 2]
mov rsi, rcx
mov eax, 0xee1a2e4b
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov r13d, 0x4ae9631b
mov r14d, 0x43c80065
mov r15d, 0xe04a06d9
jmp 0x180002d9d
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa8336d30
mov ecx, 0x67588db5
nop word cs:[rax + rax]
cmove eax, ecx
cmp dword [0x18000a164], 0xa
cmovl eax, ecx
cmp eax, 0x2d07d39
jle 0x180002e20
cmp eax, 0x43c80064
jle 0x180002e90
cmp eax, 0x644e1db8
jle 0x180002f4e
cmp eax, 0x6cfa892e
jg 0x180003055
cmp eax, 0x67eca04e
jg 0x18000326d
cmp eax, 0x644e1db9
je 0x180003418
cmp eax, 0x67588db5
jne 0x180002d9d
sub rsp, 0x20
lea rcx, [0x180008359]
call fcn.1800037f0
add rsp, 0x20
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa8336d30
mov ecx, 0xa4d0ffab
jmp 0x180002d90
cmp eax, 0xd8272f2f
jg 0x180002ef0
cmp eax, 0xa0666d98
jle 0x180002f90
cmp eax, 0xabb193d4
jle 0x180003098
cmp eax, 0xc641dedf
jg 0x1800032ab
cmp eax, 0xabb193d5
je 0x180003426
cmp eax, 0xbd7e522c
jne 0x180002d9d
mov rax, qword [rbp - 0x38]
mov dword [rax], 0x130
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32First
add rsp, 0x20
mov eax, 0xa9cc6ac2
jmp 0x180002d9d
cmp eax, 0x240997a9
jg 0x180002fc1
cmp eax, 0x10247795
jle 0x1800030fc
cmp eax, 0x12abcc59
jg 0x1800032cb
cmp eax, 0x10247796
je 0x180003444
cmp eax, 0x1163d1d5
jne 0x180002d9d
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x80377063
mov ecx, 0x240997aa
jmp 0x180002d90
cmp eax, 0xea364905
jg 0x180003013
cmp eax, 0xdd9007cf
jle 0x18000313b
cmp eax, 0xe18a519b
jg 0x1800032ff
cmp eax, 0xdd9007d0
je 0x18000344e
cmp eax, 0xe04a06d9
jne 0x180002d9d
mov rax, qword [rbp - 0x40]
mov eax, dword [rax]
mov dword [rbp - 0x30], eax
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdd9007d0
mov ecx, 0x996f39eb
jmp 0x180002d90
cmp eax, 0x4bff7cce
jle 0x180003178
cmp eax, 0x52bad78e
jg 0x18000331f
cmp eax, 0x4bff7ccf
je 0x18000345c
cmp eax, 0x4f4ff966
jne 0x180002d9d
cmp byte [rbp - 4], 0
mov eax, 0x68ca19ff
mov ecx, 0x5099cdc
cmovne eax, ecx
jmp 0x180002d9d
cmp eax, 0x8c932cb3
jle 0x1800031c3
cmp eax, 0x996f39ea
jg 0x18000333f
cmp eax, 0x8c932cb4
je 0x180002d6d
cmp eax, 0x93c27842
je 0x180003375
jmp 0x180002d9d
cmp eax, 0x30d7a1bb
jle 0x1800031ee
cmp eax, 0x324c19de
jg 0x18000335f
cmp eax, 0x30d7a1bc
je 0x180003469
cmp eax, 0x316b0918
jne 0x180002d9d
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rax
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6cfa892f
mov ecx, 0x8badf990
jmp 0x180002d90
cmp eax, 0xf185564f
jle 0x18000322d
cmp eax, 0xf9e8440f
jg 0x180003381
cmp eax, 0xf1855650
je 0x180003487
cmp eax, 0xf8b84225
jne 0x180002d9d
cmp byte [rbp - 6], 0
mov eax, 0x7410f094
mov ecx, 0x1163d1d5
cmovne eax, ecx
jmp 0x180002d9d
cmp eax, 0x7410f093
jg 0x1800033c5
cmp eax, 0x6cfa892f
je 0x180003491
cmp eax, 0x70fbec4c
jne 0x180002d9d
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 8]
mov dword [rbp - 0x2c], eax
mov eax, 0x2e331a0e
jmp 0x180002d9d
cmp eax, 0xa8336d2f
jle 0x180003403
cmp eax, 0xa8336d30
je 0x18000349f
cmp eax, 0xa9cc6ac2
jne 0x180002d9d
mov rax, qword [rbp - 0x38]
mov dword [rax], 0x130
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32First
add rsp, 0x20
test eax, eax
sete byte [rbp - 4]
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbd7e522c
mov ecx, 0x4f4ff966
jmp 0x180002d90
cmp eax, 0x2d07d3a
je 0x1800034bd
cmp eax, 0x5099cdc
je 0x1800034e9
cmp eax, 0xe8c8778
jne 0x180002d9d
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdd4aa38d
mov ecx, 0x67eca04f
jmp 0x180002d90
cmp eax, 0xd8272f30
je 0x180003507
cmp eax, 0xd8f6cd47
je 0x180003375
cmp eax, 0xdd4aa38d
jne 0x180002d9d
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
mov rdx, rsi
call r12
add rsp, 0x20
mov eax, 0x67eca04f
jmp 0x180002d9d
cmp eax, 0x43c80065
je 0x180003525
cmp eax, 0x45f9e0cf
je 0x18000355e
cmp eax, 0x4ae9631b
jne 0x180002d9d
mov rax, qword [rbp - 0x10]
add rax, 0x2c
mov qword [rbp - 0x28], rax
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x644e1db9
mov ecx, 0x12abcc5a
jmp 0x180002d90
cmp eax, 0x80377063
je 0x18000357d
cmp eax, 0x840aabdb
je 0x180003599
cmp eax, 0x8badf990
jne 0x180002d9d
mov eax, 0xd8272f30
jmp 0x180002d9d
cmp eax, 0x240997aa
je 0x1800035c5
cmp eax, 0x2dc57139
je 0x1800035fd
cmp eax, 0x2e331a0e
jne 0x180002d9d
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe6df17d6
mov ecx, 0x30d7a1bc
jmp 0x180002d90
cmp eax, 0xea364906
je 0x180003607
cmp eax, 0xececc9ad
je 0x180003647
cmp eax, 0xee1a2e4b
jne 0x180002d9d
movzx ecx, byte [rbp - 1]
cmp byte [rbp - 2], 0
mov eax, 0xc641dee0
mov edx, 0x324c19df
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x180002d9d
cmp eax, 0x67eca04f
je 0x18000365d
cmp eax, 0x68ca19ff
jne 0x180002d9d
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x644e1db9
cmove eax, r13d
cmp dword [0x18000a164], 0xa
cmovl eax, r13d
jmp 0x180002d9d
cmp eax, 0xc641dee0
je 0x180003693
cmp eax, 0xca21ca77
jne 0x180002d9d
mov eax, 0x744ae5bc
jmp 0x180002d9d
cmp eax, 0x12abcc5a
je 0x1800036c2
cmp eax, 0x2347c966
jne 0x180002d9d
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6cfa892f
mov ecx, 0x316b0918
jmp 0x180002d90
cmp eax, 0xe18a519c
je 0x1800036cc
cmp eax, 0xe6df17d6
jne 0x180002d9d
mov eax, 0x30d7a1bc
jmp 0x180002d9d
cmp eax, 0x52bad78f
je 0x1800036e4
cmp eax, 0x558a243b
jne 0x180002d9d
mov eax, 0xececc9ad
jmp 0x180002d9d
cmp eax, 0x996f39eb
je 0x1800036fa
cmp eax, 0x9ffb660c
jne 0x180002d9d
mov eax, 0xfde44f6b
jmp 0x180002d9d
cmp eax, 0x324c19df
je 0x180003707
cmp eax, 0x387b8931
jne 0x180002d9d
mov eax, 0xa0666d99
xor edi, edi
jmp 0x180002d9d
cmp eax, 0xf9e84410
je 0x18000375e
cmp eax, 0xfde44f6b
jne 0x180002d9d
sub rsp, 0x20
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, 0xffffffffffffffff
sete byte [rbp - 3]
mov eax, 0x52bad78f
jmp 0x180002d9d
cmp eax, 0x7410f094
je 0x180003784
cmp eax, 0x744ae5bc
jne 0x180002d9d
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdd9007d0
cmove eax, r15d
cmp dword [0x18000a164], 0xa
cmovl eax, r15d
jmp 0x180002d9d
cmp eax, 0xa4d0ffab
jne 0x1800037ac
mov eax, 0x93c27842
jmp 0x180002d9d
mov rax, qword [rbp - 0x10]
mov eax, 0x4ae9631b
jmp 0x180002d9d
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe18a519c
mov ecx, 0x2d07d3a
jmp 0x180002d90
mov eax, 0xf8b84225
jmp 0x180002d9d
mov rax, qword [rbp - 0x40]
mov eax, 0xe04a06d9
jmp 0x180002d9d
mov eax, 0xa0666d99
mov edi, dword [rbp - 0x2c]
jmp 0x180002d9d
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe6df17d6
mov ecx, 0x4bff7ccf
jmp 0x180002d90
mov eax, 0x387b8931
jmp 0x180002d9d
mov rax, qword [rbp - 0x10]
mov eax, 0x316b0918
jmp 0x180002d9d
sub rsp, 0x20
lea rcx, [0x180008359]
call fcn.1800037f0
add rsp, 0x20
mov eax, 0x67588db5
jmp 0x180002d9d
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe18a519c
mov ecx, 0xf1855650
jmp 0x180002d90
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x840aabdb
mov ecx, 0xea364906
jmp 0x180002d90
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbd7e522c
mov ecx, 0xa9cc6ac2
jmp 0x180002d90
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32Next
add rsp, 0x20
test eax, eax
setne byte [rbp - 5]
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x45f9e0cf
mov ecx, 0x558a243b
jmp 0x180002d90
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32Next
add rsp, 0x20
mov eax, 0x43c80065
jmp 0x180002d9d
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov eax, 0x240997aa
jmp 0x180002d9d
sub rsp, 0x20
lea rcx, [0x18000834a]
call fcn.1800037f0
add rsp, 0x20
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov eax, 0xea364906
jmp 0x180002d9d
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov rax, qword [rbp - 0x10]
add rax, 8
mov qword [rbp - 0x40], rax
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x80377063
mov ecx, 0xca21ca77
jmp 0x180002d90
mov eax, 0xd8f6cd47
jmp 0x180002d9d
sub rsp, 0x20
lea rcx, [0x18000834a]
call fcn.1800037f0
add rsp, 0x20
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x840aabdb
mov ecx, 0x2dc57139
jmp 0x180002d90
cmp byte [rbp - 5], 0
mov eax, 0xabb193d5
mov ecx, 0xe8c8778
cmovne eax, ecx
jmp 0x180002d9d
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
mov rdx, rsi
call r12
add rsp, 0x20
test eax, eax
sete byte [rbp - 6]
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdd4aa38d
mov ecx, 0x10247796
jmp 0x180002d90
mov eax, 0x130
call fcn.180006b60
sub rsp, rax
mov rcx, rsp
sub rsp, 0x20
mov r8d, 0x130
xor edx, edx
call sub.VCRUNTIME140.dll_memset
add rsp, 0x20
mov eax, 0x324c19df
jmp 0x180002d9d
mov eax, 0xf9e84410
jmp 0x180002d9d
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov eax, 0x2d07d3a
jmp 0x180002d9d
cmp byte [rbp - 3], 0
mov eax, 0x2347c966
mov ecx, 0x8c932cb4
cmovne eax, ecx
jmp 0x180002d9d
mov eax, 0xa0666d99
mov edi, dword [rbp - 0x30]
jmp 0x180002d9d
mov eax, 0x130
call fcn.180006b60
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
mov r8d, 0x130
xor edx, edx
call sub.VCRUNTIME140.dll_memset
add rsp, 0x20
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc641dee0
mov ecx, 0x9ffb660c
jmp 0x180002d90
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
mov rdx, rsi
call r12
add rsp, 0x20
test eax, eax
mov eax, 0x7410f094
mov ecx, 0x70fbec4c
cmove eax, ecx
jmp 0x180002d9d
mov eax, dword [0x18000a160]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x45f9e0cf
cmove eax, r14d
cmp dword [0x18000a164], 0xa
cmovl eax, r14d
jmp 0x180002d9d
cmp eax, 0xa0666d99
jne 0x180002d9d
mov rax, qword [rbp - 0x20]
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.180006bc0
add rsp, 0x20
mov eax, edi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret