Function at 0x18000aeb0
Capabilities:
Enumerate processes
Print debug messages

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov rax, qword [0x1800a2de8]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov qword [rsp + 0x38], rsp
mov rsi, r8
mov rdi, rdx
mov r15d, ecx
mov qword [rsp + 0x48], 0xffffffffffffffff
xor r13d, r13d
mov dword [rsp + 0x70], r13d
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x74]
call fcn.180056c20
nop
mov dword [rdi], r13d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x18000aff6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0x1e]
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0x1e]
mov ecx, 0x1000a
call fcn.180053ad4
mov rbx, rax
test rax, rax
jne 0x18000af6a
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18000afd5
lea r8, [0x180088a64]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a70
test eax, eax
jle 0x18000afb2
mov byte [rbx + 0xffff], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
lea r9, str.GetParentProcessInfoEx
mov edx, 0x30b
mov r8d, 1
lea rcx, str...ApiAuxNA.cpp
call fcn.180001b40
jmp 0x18000afcd
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x5c], edi
lea rdx, [0x18000afed]
mov rcx, qword [rsp + 0x38]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0x30]
jmp 0x18000b69b
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x18000b0e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0x1e]
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0x1e]
mov ecx, 0x1000a
call fcn.180053ad4
mov rbx, rax
test rax, rax
jne 0x18000b057
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18000b0c2
lea r8, [0x180088a64]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a70
test eax, eax
jle 0x18000b09f
mov byte [rbx + 0xffff], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
lea r9, str.GetParentProcessInfoEx
mov edx, 0x30f
mov r8d, 1
lea rcx, str...ApiAuxNA.cpp
call fcn.180001b40
jmp 0x18000b0ba
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x60], edi
lea rdx, [0x18000b0da]
mov rcx, qword [rsp + 0x38]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0x30]
jmp 0x18000b69b
cmp dword [rsp + 0x78], r15d
je 0x18000b0fe
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x18000b107
jmp 0x18000b0e3
mov eax, dword [rsp + 0x90]
mov dword [rdi], eax
cmp dword [rdi], 0
jne 0x18000b256
mov qword [rsp + 0x30], r13
mov ecx, 0x1000a
call fcn.180053ad4
mov rdi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rdi, rdi
je 0x18000b1fd
test rax, rax
je 0x18000b1fd
mov r9d, r15d
lea r8, [0x180088b38]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18000b1e3
mov word [rbx + 0x1fffe], r13w
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.180054798
test eax, eax
je 0x18000b1b6
mov r8d, 9
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], 9
mov qword [rsp + 0x20], rdi
lea r9, str.GetParentProcessInfoEx
mov edx, 0x31a
mov r8d, 1
lea rcx, str...ApiAuxNA.cpp
call fcn.180001b40
jmp 0x18000b216
mov edx, 9
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18000b210
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rdi, rdi
je 0x18000b223
mov rcx, rdi
call fcn.180053a94
test rbx, rbx
je 0x18000b230
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x54], 9
lea rdx, [0x18000b24c]
mov rcx, qword [rsp + 0x38]
call fcn.180057580
nop
nop
nop
mov eax, 9
jmp 0x18000b69b
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x18000b340
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0x1e]
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0x1e]
mov ecx, 0x1000a
call fcn.180053ad4
mov rbx, rax
test rax, rax
jne 0x18000b2af
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18000b31a
lea r8, [0x180088a64]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a70
test eax, eax
jle 0x18000b2f7
mov byte [rbx + 0xffff], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
lea r9, str.GetParentProcessInfoEx
mov edx, 0x31d
mov r8d, 1
lea rcx, str...ApiAuxNA.cpp
call fcn.180001b40
jmp 0x18000b312
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x50], edi
lea rdx, [0x18000b332]
mov rcx, qword [rsp + 0x38]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0x30]
jmp 0x18000b69b
mov eax, dword [rdi]
cmp dword [rsp + 0x78], eax
jne 0x18000b381
or r9, 0xffffffffffffffff
lea r8, [rsp + 0x9c]
mov edx, 0x104
mov rcx, rsi
call fcn.180054f68
mov dword [rsp + 0x58], r13d
lea rdx, [0x18000b37a]
mov rcx, qword [rsp + 0x38]
call fcn.180057580
nop
nop
nop
xor eax, eax
jmp 0x18000b69b
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18000b340
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14d, [rax + 0x1e]
mov qword [rsp + 0x40], r13
mov ecx, 0x1000a
call fcn.180053ad4
mov r12, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rsi, rax
test r12, r12
je 0x18000b484
test rax, rax
je 0x18000b484
mov ecx, dword [rdi]
mov dword [rsp + 0x20], ecx
mov r9d, r15d
lea r8, str.Parent_process_name_not_found:__d____d
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18000b46c
mov word [rsi + 0x1fffe], r13w
mov rdx, 0xfffffffffffffffe
mov rcx, rsi
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rsi
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.180054798
test eax, eax
je 0x18000b442
mov r8d, r14d
mov rdx, rsi
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r12
lea r9, str.GetParentProcessInfoEx
mov edx, 0x328
mov r8d, 3
lea rcx, str...ApiAuxNA.cpp
call fcn.180001b40
jmp 0x18000b49d
mov edx, r14d
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18000b497
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test r12, r12
je 0x18000b4aa
mov rcx, r12
call fcn.180053a94
test rsi, rsi
je 0x18000b4b8
mov rcx, rsi
call fcn.180053a94
nop
cmp rbx, 0xffffffffffffffff
je 0x18000b4c8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov qword [rsp + 0x40], r13
mov ecx, 0x1000a
call fcn.180053ad4
mov rdi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rdi, rdi
je 0x18000b5b5
test rax, rax
je 0x18000b5b5
mov r9d, r15d
lea r8, [0x180088b38]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18000b59b
mov word [rbx + 0x1fffe], r13w
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.180054798
test eax, eax
je 0x18000b56e
mov r8d, 9
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], 9
mov qword [rsp + 0x20], rdi
lea r9, str.GetParentProcessInfoEx
mov edx, 0x335
mov r8d, 1
lea rcx, str...ApiAuxNA.cpp
call fcn.180001b40
jmp 0x18000b5ce
mov edx, 9
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18000b5c8
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rdi, rdi
je 0x18000b5db
mov rcx, rdi
call fcn.180053a94
test rbx, rbx
je 0x18000b24c
mov rcx, rbx
call fcn.180053a94
mov eax, 9
jmp 0x18000b69b
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.180052be0
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret