Function at 0x140074992
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x3c8
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x330], xmm8
movdqa xmmword [rbp + 0x320], xmm7
movdqa xmmword [rbp + 0x310], xmm6
mov qword [rbp + 0x308], 0xfffffffffffffffe
mov qword [rbp + 0x2a8], rcx
mov eax, dword [0x1406a72c8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x50], 0
jne 0x1400749f9
call case.0x14002e566.77
mov eax, dword [0x1406a72c8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x58]
mov rdx, qword [rax + 0x60]
lea r8, [rcx + 1]
mov qword [rax + 0x58], r8
movups xmm0, xmmword [0x140641940]
movaps xmmword [rbp + 0x2b0], xmm0
movdqu xmm0, xmmword [0x140641950]
movdqa xmmword [rbp + 0x2c0], xmm0
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], rdx
mov byte [rbp + 0x307], 0
mov ecx, 0xf
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x268], rax
mov rdi, qword [rbp + 0x268]
lea rax, [rdi + 1]
cmp rax, 2
jae 0x140074b32
call qword [sym.imp.kernel32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
xor eax, eax
lea rdx, [rbp + 0x280]
mov qword [rdx], rax
mov dword [rdx + 8], ecx
lea r8, [rbp + 0x1e0]
mov qword [r8], rdx
lea rcx, [0x1400ac5fa]
mov qword [r8 + 8], rcx
lea rdx, [0x14061e8e8]
lea rcx, [rbp - 0x58]
mov qword [rcx], rdx
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x10], r8
mov qword [rcx + 0x18], 1
call fcn.14006cc30
movdqa xmm0, xmmword [rbp + 0x2b0]
movaps xmm1, xmmword [rbp + 0x2c0]
movaps xmm2, xmmword [rbp + 0x2d0]
mov rax, qword [rbp + 0x2a8]
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movdqu xmmword [rax], xmm0
mov rcx, qword [rbp + 0x280]
test rcx, rcx
je 0x140075415
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov byte [rbp + 0x307], 1
call rax
jmp 0x140075415
lea rsi, [rbp - 0x58]
mov r8d, 0x238
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi], 0x238
mov byte [rbp + 0x307], 0
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.kernel32.dll_Process32FirstW]
test eax, eax
je 0x14007522b
xor eax, eax
mov qword [rbp + 0x278], rax
pcmpeqd xmm6, xmm6
mov byte [rbp + 0x307], 0
mov r8d, 0x104
lea rcx, [rbp + 0x280]
lea rdx, [rbp - 0x2c]
call fcn.140009000
mov rsi, qword [rbp + 0x280]
movabs rax, 0x8000000000000000
cmp rsi, rax
mov qword [rbp + 0x270], rsi
je 0x1400752df
mov rdi, qword [rbp + 0x288]
mov rax, qword [rbp + 0x290]
xor ecx, ecx
cmp rcx, rax
je 0x140074c64
mov r13, rcx
add rcx, rdi
mov r10b, byte [rcx]
movzx edx, r10b
test dl, dl
js 0x140074be1
inc rcx
jmp 0x140074c55
mov r8d, edx
and r8d, 0x1f
movzx r11d, byte [rcx + 1]
and r11d, 0x3f
cmp dl, 0xdf
jbe 0x140074c37
movzx r9d, byte [rcx + 2]
shl r11d, 6
and r9d, 0x3f
or r9d, r11d
cmp r10b, 0xf0
jb 0x140074c47
movzx edx, byte [rcx + 3]
and r8d, 7
shl r8d, 0x12
shl r9d, 6
and edx, 0x3f
or edx, r9d
or edx, r8d
cmp edx, 0x110000
je 0x1400751a5
add rcx, 4
jmp 0x140074c55
add rcx, 2
shl r8d, 6
or r8d, r11d
mov edx, r8d
jmp 0x140074c55
add rcx, 3
shl r8d, 0xc
or r9d, r8d
mov edx, r9d
sub rcx, rdi
test edx, edx
je 0x140074bc2
mov dl, 1
jmp 0x140074c6c
xor edx, edx
mov r13, rax
mov rcx, rax
cmp rcx, rax
je 0x140074d0b
mov r12, rax
add rax, rdi
mov r8b, byte [rax - 1]
test r8b, r8b
js 0x140074c8d
dec rax
movzx r8d, r8b
jmp 0x140074cf2
movzx r9d, byte [rax - 2]
cmp r9b, 0xc0
jge 0x140074cbd
movzx r10d, byte [rax - 3]
cmp r10b, 0xbf
jg 0x140074cc7
movzx r11d, byte [rax - 4]
add rax, 0xfffffffffffffffc
and r11d, 7
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
jmp 0x140074ccf
add rax, 0xfffffffffffffffe
and r9d, 0x1f
jmp 0x140074cda
add rax, 0xfffffffffffffffd
and r10d, 0xf
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
shl r9d, 6
and r8b, 0x3f
movzx r8d, r8b
or r8d, r9d
cmp r8d, 0x110000
je 0x140074d0b
sub rax, rdi
test r8d, r8d
je 0x140074c6c
test dl, dl
mov eax, 0
cmove r13, rax
jmp 0x140074d1d
test dl, dl
mov edx, 0
cmove r13, rdx
cmove rcx, rdx
mov r12, rcx
sub r12, r13
jne 0x140074d32
mov eax, 1
xor ecx, ecx
mov qword [rbp + 0x2a0], rcx
jmp 0x140074d58
js 0x14007545b
mov al, byte [0x1406a72b1]
xor ecx, ecx
mov rdx, r12
call fcn.14006ef50
test rax, rax
je 0x140075467
mov qword [rbp + 0x2a0], r12
add r13, rdi
mov qword [rbp + 0x2f8], rax
mov rcx, rax
mov rdx, r13
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
test rsi, rsi
je 0x140074d87
mov rcx, qword [0x1406a7220]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [rbp - 0x50]
mov dword [rbp + 0x29c], eax
cmp qword [rbp + 0x2c8], 0
je 0x140074e69
mov rcx, qword [rbp + 0x2d0]
mov rdx, qword [rbp + 0x2d8]
mov r8, qword [rbp + 0x2f8]
mov r9, r12
call fcn.140032d76
mov rsi, qword [rbp + 0x2b0]
mov rdi, qword [rbp + 0x2b8]
mov rbx, rdi
and rbx, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea r14, [rsi - 0x30]
xor r15d, r15d
movdqu xmm8, xmmword [rsi + rbx]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r13d, xmm0
test r13w, r13w
je 0x140074e4b
bsf eax, r13d
lea ecx, [r13 - 1]
and ecx, r13d
mov r13d, ecx
add rax, rbx
and rax, rdi
neg rax
lea rax, [rax + rax*2]
shl rax, 4
cmp r12, qword [r14 + rax + 0x10]
jne 0x140074e00
add rax, r14
mov rdx, qword [rax + 8]
mov rcx, qword [rbp + 0x2f8]
mov r8, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140074e00
jmp 0x14007503e
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140074e69
add rbx, r15
add rbx, 0x10
add r15, 0x10
and rbx, rdi
jmp 0x140074dec
mov rdx, qword [rbp + 0x2f8]
mov qword [rbp + 0x2f0], rdx
lea rcx, [rbp + 0x228]
mov r8, r12
call fcn.140009190
mov r15, qword [rbp + 0x2d0]
mov rsi, qword [rbp + 0x2d8]
mov r8, qword [rbp + 0x230]
mov r14, qword [rbp + 0x238]
mov rcx, r15
mov rdx, rsi
mov qword [rbp + 0x2e0], r8
mov r9, r14
call fcn.140032d76
mov rbx, rax
cmp qword [rbp + 0x2c0], 0
jne 0x140074ed6
lea rcx, [rbp + 0x2b0]
mov rdx, r15
mov r8, rsi
call fcn.1400d88c6
mov rsi, qword [rbp + 0x2b0]
mov rdi, qword [rbp + 0x2b8]
mov r15, rdi
and r15, rbx
shr rbx, 0x39
mov qword [rbp + 0x218], rbx
movd xmm0, ebx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor ecx, ecx
xor eax, eax
mov qword [rbp + 0x260], rax
mov qword [rbp + 0x210], rcx
movdqu xmm8, xmmword [rsi + r15]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r13d, xmm0
test r13w, r13w
je 0x140074f75
bsf eax, r13d
add rax, r15
and rax, rdi
neg rax
lea rbx, [rax + rax*2]
shl rbx, 4
cmp r14, qword [rsi + rbx - 0x20]
jne 0x140074f69
add rbx, rsi
mov rdx, qword [rbx - 0x28]
mov rcx, qword [rbp + 0x2e0]
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140074fdd
lea eax, [r13 - 1]
and eax, r13d
mov r13d, eax
jmp 0x140074f2d
cmp qword [rbp + 0x260], 1
mov edx, 1
je 0x140074fa0
pmovmskb eax, xmm8
xor edx, edx
test eax, eax
setne dl
bsf eax, eax
add rax, r15
and rax, rdi
mov qword [rbp + 0x220], rax
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
mov rcx, qword [rbp + 0x218]
mov rax, qword [rbp + 0x210]
jne 0x1400751af
mov qword [rbp + 0x260], rdx
add r15, rax
add r15, 0x10
add rax, 0x10
and r15, rdi
mov rcx, rax
jmp 0x140074f12
mov rsi, qword [rbx - 0x18]
mov r14, qword [rbx - 0x10]
xor ecx, ecx
mov qword [rbx - 0x18], rcx
mov qword [rbx - 0x10], 4
mov qword [rbx - 8], rcx
cmp qword [rbp + 0x228], rcx
je 0x140075016
mov rcx, qword [0x1406a7220]
xor edx, edx
mov r8, qword [rbp + 0x2e0]
call qword [sym.imp.kernel32.dll_HeapFree]
shl rsi, 1
test rsi, rsi
je 0x140075030
mov rcx, qword [0x1406a7220]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rbp + 0x2c8], 0
je 0x14007543f
mov rcx, qword [rbp + 0x2d0]
mov rdx, qword [rbp + 0x2d8]
mov r8, qword [rbp + 0x2f8]
mov r9, r12
call fcn.140032d76
mov rcx, qword [rbp + 0x2b0]
mov rdi, qword [rbp + 0x2b8]
mov rbx, rdi
and rbx, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea r14, [rcx - 0x30]
xor esi, esi
mov qword [rbp + 0x2e0], rcx
movdqu xmm8, xmmword [rcx + rbx]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r13d, xmm0
test r13w, r13w
je 0x1400750ef
bsf eax, r13d
lea ecx, [r13 - 1]
and ecx, r13d
mov r13d, ecx
add rax, rbx
and rax, rdi
neg rax
lea r15, [rax + rax*2]
shl r15, 4
cmp r12, qword [r14 + r15 + 0x10]
jne 0x1400750a6
lea rax, [r14 + r15]
mov rdx, qword [rax + 8]
mov rcx, qword [rbp + 0x2f8]
mov r8, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400750a6
jmp 0x14007511b
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14007543f
add rbx, rsi
add rbx, 0x10
add rsi, 0x10
and rbx, rdi
mov rcx, qword [rbp + 0x2e0]
jmp 0x140075092
mov rsi, qword [rbp + 0x2e0]
mov rdi, qword [rsi + r15 - 8]
cmp rdi, qword [rsi + r15 - 0x18]
mov rbx, qword [rbp + 0x2f8]
jne 0x140075149
lea rcx, [rsi + r15]
add rcx, 0xffffffffffffffe8
mov qword [rbp + 0x2f0], rbx
call fcn.14009e291
add rsi, r15
mov rax, qword [rsi - 0x10]
mov ecx, dword [rbp + 0x29c]
mov dword [rax + rdi*4], ecx
inc rdi
mov qword [rsi - 8], rdi
mov qword [rbp + 0x2f0], rbx
mov rcx, qword [rbp + 0x268]
lea rdx, [rbp - 0x58]
call qword [sym.imp.kernel32.dll_Process32NextW]
test eax, eax
je 0x140075332
cmp qword [rbp + 0x2a0], 0
je 0x140074b74
mov rcx, qword [0x1406a7220]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140074b74
xor edx, edx
mov rcx, r13
jmp 0x140074c6c
mov rdx, qword [rbp + 0x220]
mov al, byte [rsi + rdx]
test al, al
js 0x1400751cb
movdqa xmm0, xmmword [rsi]
pmovmskb eax, xmm0
bsf edx, eax
mov al, byte [rsi + rdx]
and al, 1
movzx eax, al
sub qword [rbp + 0x2c0], rax
lea rax, [rdx - 0x10]
and rdi, rax
mov byte [rsi + rdx], cl
mov byte [rsi + rdi + 0x10], cl
inc qword [rbp + 0x2c8]
neg rdx
lea rax, [rdx + rdx*2]
shl rax, 4
mov rcx, qword [rbp + 0x238]
mov qword [rsi + rax - 0x20], rcx
movdqu xmm0, xmmword [rbp + 0x228]
movdqu xmmword [rsi + rax - 0x30], xmm0
xor edx, edx
mov qword [rsi + rax - 0x18], rdx
mov qword [rsi + rax - 0x10], 4
mov qword [rsi + rax - 8], rdx
jmp 0x140075030
call qword [sym.imp.kernel32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
xor eax, eax
lea rdx, [rbp + 0x240]
mov qword [rdx], rax
mov dword [rdx + 8], ecx
lea r8, [rbp + 0x280]
mov qword [r8], rdx
lea rcx, [0x1400ac5fa]
mov qword [r8 + 8], rcx
lea rdx, [0x14061e8e8]
lea rcx, [rbp + 0x1e0]
mov qword [rcx], rdx
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x10], r8
mov qword [rcx + 0x18], 1
call fcn.14006cc30
movdqa xmm0, xmmword [rbp + 0x2b0]
movaps xmm1, xmmword [rbp + 0x2c0]
movaps xmm2, xmmword [rbp + 0x2d0]
mov rax, qword [rbp + 0x2a8]
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movdqu xmmword [rax], xmm0
mov rcx, qword [rbp + 0x240]
test rcx, rcx
je 0x140075415
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov byte [rbp + 0x307], 1
call rax
jmp 0x140075415
lea rax, [rbp + 0x2ef]
lea rdx, [rbp + 0x240]
mov qword [rdx], rax
lea rax, [0x140009170]
mov qword [rdx + 8], rax
lea rax, [0x14061e8e8]
lea rcx, [rbp + 0x1e0]
mov qword [rcx], rax
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], 0
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 1
call fcn.14006cc30
jmp 0x1400753ec
call qword [sym.imp.kernel32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov qword [rbp + 0x250], 0
mov dword [rbp + 0x258], ecx
cmp ecx, 0x80070012
je 0x1400753d0
lea rax, [rbp + 0x250]
lea rdx, [rbp + 0x240]
mov qword [rdx], rax
lea rax, [0x1400ac0c9]
mov qword [rdx + 8], rax
lea rax, [0x14061e8e8]
lea rcx, [rbp + 0x1e0]
mov qword [rcx], rax
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], 0
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 1
call fcn.14006cc30
mov rcx, qword [rbp + 0x250]
test rcx, rcx
mov rbx, qword [rbp + 0x2f8]
je 0x1400753d0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x2f0], rbx
call rax
cmp qword [rbp + 0x2a0], 0
je 0x1400753ec
mov rcx, qword [0x1406a7220]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
movdqa xmm0, xmmword [rbp + 0x2b0]
movaps xmm1, xmmword [rbp + 0x2c0]
movaps xmm2, xmmword [rbp + 0x2d0]
mov rax, qword [rbp + 0x2a8]
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movdqu xmmword [rax], xmm0
movaps xmm6, xmmword [rbp + 0x310]
movaps xmm7, xmmword [rbp + 0x320]
movaps xmm8, xmmword [rbp + 0x330]
add rsp, 0x3c8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [rbp + 0x2f8]
mov qword [rbp + 0x2f0], rax
lea rcx, str.tools_srcprocess.rs
call fcn.1400d6620
jmp 0x140075489
mov qword [rbp + 0x2f8], rdi
mov rdx, rbx
jmp 0x14007547d
mov qword [rbp + 0x2f8], rdi
mov eax, 1
mov qword [rbp + 0x278], rax
mov rdx, r12
mov rcx, qword [rbp + 0x278]
call fcn.1400d60e0
ud2