Function at 0x1400043d0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [0x140055008]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor esi, esi
mov qword [rsp + 0x40], rdx
mov rbx, rdx
mov r13, rcx
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x234
mov edi, esi
mov r15d, esi
mov ebp, esi
mov r14d, esi
call sub.msvcrt.dll_memset
cmp dword [0x140055944], esi
lea r12d, [rsi + 7]
mov dword [rsp + 0x60], 0x238
mov dword [rbx], esi
je 0x140004450
mov r9, r13
movzx edx, r12w
lea r8, str._Looking_for_PID_of_process__S_n
mov ecx, 0xfffffff4
call fcn.1400085c0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.api_ms_win_core_toolhelp_l1_1_0.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x30], rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140004542
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x140004482
movzx edi, ax
or edi, 0x80070000
mov edx, 0x114f
mov r10d, edi
mov r11, rsi
lea r9, [0x14003c070]
nop dword [rax]
nop dword [rax + rax]
mov eax, esi
mov r8, r10
add rax, rax
mov ecx, esi
mov eax, dword [r9 + rax*8]
sub r8, rax
je 0x1400044d0
mov ecx, edx
sub ecx, esi
shr ecx, 1
add ecx, esi
test r8, r8
mov eax, ecx
cmovns eax, edx
cmovns esi, ecx
inc esi
mov edx, eax
cmp eax, esi
jae 0x1400044a0
jmp 0x1400044d8
add rcx, rcx
mov r11, qword [r9 + rcx*8 + 8]
cmp dword [0x140055944], ebp
je 0x140004a37
lea rax, str.__HANDLE__LONG_PTR__1____hSnapshot
movzx edx, r12w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov r9d, edi
mov qword [rsp + 0x20], r11
mov ecx, 0xfffffff4
call fcn.1400085c0
cmp dword [0x140055944], ebp
je 0x140004a37
lea r9, str.avcoremf_samplesmf360mftracemftraceexemain.cpp
movzx edx, r12w
lea r8, str.___at__s:_i_n
mov dword [rsp + 0x20], 0x281
mov ecx, 0xfffffff4
call fcn.1400085c0
jmp 0x140004a37
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_toolhelp_l1_1_0.dll_Process32FirstW]
test eax, eax
jne 0x140004622
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x14000456d
movzx edi, ax
or edi, 0x80070000
mov edx, 0x114f
mov r10d, edi
mov r11, rsi
lea r9, [0x14003c070]
nop
mov eax, esi
mov r8, r10
add rax, rax
mov ecx, esi
mov eax, dword [r9 + rax*8]
sub r8, rax
je 0x1400045b0
mov ecx, edx
sub ecx, esi
shr ecx, 1
add ecx, esi
test r8, r8
mov eax, ecx
cmovns eax, edx
cmovns esi, ecx
inc esi
mov edx, eax
cmp eax, esi
jae 0x140004580
jmp 0x1400045b8
add rcx, rcx
mov r11, qword [r9 + rcx*8 + 8]
cmp dword [0x140055944], ebp
je 0x140004a20
lea rax, str.Process32FirstW__hSnapshot__proc__
movzx edx, r12w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov r9d, edi
mov qword [rsp + 0x20], r11
mov ecx, 0xfffffff4
call fcn.1400085c0
cmp dword [0x140055944], ebp
je 0x140004a20
mov dword [rsp + 0x20], 0x283
lea r9, str.avcoremf_samplesmf360mftracemftraceexemain.cpp
movzx edx, r12w
lea r8, str.___at__s:_i_n
mov ecx, 0xfffffff4
call fcn.1400085c0
jmp 0x140004a20
cmp dword [0x140055944], esi
je 0x14000464f
mov eax, dword [rsp + 0x68]
lea r9, [rsp + 0x8c]
lea r8, str.___Process__S__PID:__i__n
movzx edx, r12w
mov ecx, 0xfffffff4
mov dword [rsp + 0x20], eax
call fcn.1400085c0
lea rdx, [rsp + 0x8c]
mov rcx, r13
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140004759
cmp dword [0x140055944], esi
je 0x140004685
lea r8, str._____Match_found_n
movzx edx, r12w
mov ecx, 0xfffffff4
call fcn.1400085c0
mov r12d, dword [rsp + 0x68]
cmp rbp, r14
jb 0x14000474c
lea rbx, [rbp + 1]
cmp rbx, r14
jbe 0x140004747
mov edx, 4
test r15, r15
jne 0x1400046c7
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_calloc]
mov r15, rax
test rax, rax
je 0x140004a8b
mov r14, rbx
jmp 0x140004747
mov rcx, r14
mov rax, rbx
sub rax, r14
shr rcx, 1
cmp rax, rcx
cmovbe rax, rcx
add rax, r14
cmp rbx, rax
mov r14, rax
cmovae r14, rbx
mov rcx, r14
call qword [sym.imp.msvcrt.dll_calloc]
mov rbx, rax
test rax, rax
je 0x140004a8b
lea rdx, [rbp*4]
mov r8, r15
mov r9, rdx
mov rcx, rax
call qword [sym.imp.msvcrt.dll_memmove_s]
test eax, eax
je 0x14000473b
cmp eax, 0xc
je 0x140004a8b
cmp eax, 0x16
je 0x140004a75
cmp eax, 0x22
je 0x140004a75
cmp eax, 0x50
jne 0x140004a80
mov rcx, r15
call qword [sym.imp.msvcrt.dll_free]
mov r15, rbx
mov rbx, qword [rsp + 0x30]
mov dword [r15 + rbp*4], r12d
inc rbp
mov r12d, 7
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_toolhelp_l1_1_0.dll_Process32NextW]
test eax, eax
jne 0x140004622
test rbp, rbp
jne 0x1400047fa
mov eax, 0xc
lea r8, str.Process_not_found_n
movzx edx, ax
mov ecx, 0xfffffff4
call fcn.1400085c0
mov edi, 0x80070002
mov qword [rsp + 0x50], rsi
mov ecx, edi
lea rdx, [rsp + 0x50]
call fcn.140008520
cmp dword [0x140055944], esi
je 0x140004a20
lea rax, str.HRESULT_FROM_WIN32__2L__
movzx edx, r12w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov rax, qword [rsp + 0x50]
mov r9d, edi
mov ecx, 0xfffffff4
mov qword [rsp + 0x20], rax
call fcn.1400085c0
cmp dword [0x140055944], esi
je 0x140004a20
mov dword [rsp + 0x20], 0x294
jmp 0x140004601
cmp rbp, 1
jbe 0x140004a64
mov rax, qword [0x140055248]
lea rcx, [0x140055248]
mov rax, qword [rax + 0x18]
call qword [0x1400185c0]
mov r12d, esi
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
nop dword [rax + rax]
mov rax, qword [0x140055248]
lea rcx, [0x140055248]
mov rax, qword [rax + 0x18]
call qword [0x1400185c0]
add rax, 0x18
mov qword [rsp + 0x40], rax
cmp rdi, rbp
jae 0x140004a75
mov r8d, dword [r15 + rdi*4]
lea rdx, [0x14004e5d4]
lea rcx, [rsp + 0x40]
call fcn.140006ed0
mov ecx, dword [rbx - 0x10]
mov rdi, qword [rsp + 0x40]
mov dword [rsp + 0x48], ecx
mov r13, rdi
sub r13, rbx
mov eax, dword [rdi - 0x10]
mov dword [rsp + 0x4c], eax
lea r14d, [rcx + rax]
mov eax, dword [rbx - 0xc]
mov ecx, 1
sub eax, r14d
sub ecx, dword [rbx - 8]
or ecx, eax
jge 0x1400048b0
mov edx, r14d
lea rcx, [rsp + 0x38]
call fcn.140006d20
mov rbx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x48]
lea r8, [rbx + r13]
movsxd rdx, dword [rsp + 0x4c]
cmp r13, rax
mov r9, rdx
cmova r8, rdi
lea rcx, [rax + rbx]
call qword [sym.imp.msvcrt.dll_memcpy_s]
test r14d, r14d
js 0x140004a75
cmp r14d, dword [rbx - 0xc]
jg 0x140004a75
movsxd rax, r14d
lea rdx, [rdi - 0x18]
mov dword [rbx - 0x10], r14d
mov r14d, 0xffffffff
mov byte [rax + rbx], sil
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004916
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400185c0]
mov rbx, qword [rsp + 0x38]
inc r12d
mov edi, r12d
cmp rdi, rbp
jb 0x140004830
mov eax, 0xc
lea r8, str.Multiple_instances_of_the_process_found._Specify_one_of_these_PIDs_on_the_command_line:__s_n
movzx edx, ax
mov r9, rbx
mov ecx, 0xfffffff4
call fcn.1400085c0
mov edx, 0x114f
lea r9, [0x14003c070]
mov r10, rsi
mov r11d, 0x80070057
mov edi, 0x80070057
mov eax, esi
mov r8, r11
add rax, rax
mov ecx, esi
mov eax, dword [r9 + rax*8]
sub r8, rax
je 0x140004991
mov ecx, edx
sub ecx, esi
shr ecx, 1
add ecx, esi
test r8, r8
cmovns esi, ecx
inc esi
test r8, r8
cmovns ecx, edx
mov edx, ecx
cmp ecx, esi
jae 0x140004960
jmp 0x140004999
add rcx, rcx
mov r10, qword [r9 + rcx*8 + 8]
cmp dword [0x140055944], 0
je 0x1400049fb
lea rax, str.HRESULT_FROM_WIN32____HRESULT_0x80070057L___
mov esi, 7
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
movzx edx, si
mov r9d, edi
mov ecx, 0xfffffff4
mov qword [rsp + 0x20], r10
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x1400049fb
lea r9, str.avcoremf_samplesmf360mftracemftraceexemain.cpp
movzx edx, si
lea r8, str.___at__s:_i_n
mov dword [rsp + 0x20], 0x2a1
mov ecx, 0xfffffff4
call fcn.1400085c0
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140004a1b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400185c0]
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test r15, r15
je 0x140004a37
mov rcx, r15
call qword [sym.imp.msvcrt.dll_free]
mov eax, edi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140016790
mov rbx, qword [rsp + 0x300]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rbp, rbp
je 0x140004a75
mov rdx, qword [rsp + 0x40]
mov ecx, dword [r15]
mov dword [rdx], ecx
jmp 0x140004a20
mov ecx, 0x80070057
call fcn.140008690
int3
mov ecx, 0x80004005
call fcn.140008690
int3
mov ecx, 0x8007000e
call fcn.140008690
int3