Function at 0x140077d15
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x3a8
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x310], xmm8
movdqa xmmword [rbp + 0x300], xmm7
movdqa xmmword [rbp + 0x2f0], xmm6
mov qword [rbp + 0x2e8], 0xfffffffffffffffe
mov qword [rbp + 0x288], rcx
mov eax, dword [0x140532338]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x60], 0
jne 0x140077d7c
call case.0x14002fb1b.69
mov eax, dword [0x140532338]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x68]
mov rdx, qword [rax + 0x70]
lea r8, [rcx + 1]
mov qword [rax + 0x68], r8
movups xmm0, xmmword [0x1404ccc40]
movaps xmmword [rbp + 0x290], xmm0
movdqu xmm0, xmmword [0x1404ccc50]
movdqa xmmword [rbp + 0x2a0], xmm0
mov qword [rbp + 0x2b0], rcx
mov qword [rbp + 0x2b8], rdx
mov byte [rbp + 0x2e7], 0
mov ecx, 0xf
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
inc rax
cmp rax, 2
jae 0x140077ea9
call qword [sym.imp.kernel32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
xor eax, eax
lea rdx, [rbp + 0x258]
mov qword [rdx], rax
mov dword [rdx + 8], ecx
lea r8, [rbp + 0x1e0]
mov qword [r8], rdx
lea rcx, [0x1400af80c]
mov qword [r8 + 8], rcx
lea rdx, str.called__Result::unwrap____on_an__Err__value
lea rcx, [rbp - 0x58]
mov qword [rcx], rdx
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x10], r8
mov qword [rcx + 0x18], 1
call fcn.140070d40
movdqa xmm0, xmmword [rbp + 0x290]
movaps xmm1, xmmword [rbp + 0x2a0]
movaps xmm2, xmmword [rbp + 0x2b0]
mov rax, qword [rbp + 0x288]
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movdqu xmmword [rax], xmm0
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x140078750
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov byte [rbp + 0x2e7], 1
call rax
jmp 0x140078750
lea rbx, [rbp - 0x58]
mov r8d, 0x238
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbx], 0x238
mov byte [rbp + 0x2e7], 0
mov rcx, rsi
mov rdx, rbx
call qword [sym.imp.kernel32.dll_Process32FirstW]
test eax, eax
je 0x140078573
pcmpeqd xmm6, xmm6
mov qword [rbp + 0x250], rsi
mov byte [rbp + 0x2e7], 0
mov r8d, 0x104
lea rcx, [rbp + 0x258]
lea rdx, [rbp - 0x2c]
call fcn.1400090f0
mov rcx, qword [rbp + 0x258]
movabs rax, 0x8000000000000000
mov qword [rbp + 0x278], rcx
cmp rcx, rax
je 0x140078627
mov rdi, qword [rbp + 0x260]
mov rax, qword [rbp + 0x268]
xor ecx, ecx
cmp rcx, rax
je 0x140077fe0
mov rdx, rcx
add rcx, rdi
mov r11b, byte [rcx]
movzx r8d, r11b
test r8b, r8b
js 0x140077f57
inc rcx
jmp 0x140077fcc
mov r9d, r8d
and r9d, 0x1f
movzx esi, byte [rcx + 1]
and esi, 0x3f
cmp r8b, 0xdf
jbe 0x140077fae
movzx r10d, byte [rcx + 2]
shl esi, 6
and r10d, 0x3f
or r10d, esi
cmp r11b, 0xf0
jb 0x140077fbe
movzx r8d, byte [rcx + 3]
and r9d, 7
shl r9d, 0x12
shl r10d, 6
and r8d, 0x3f
or r8d, r10d
or r8d, r9d
cmp r8d, 0x110000
je 0x1400784ea
add rcx, 4
jmp 0x140077fcc
add rcx, 2
shl r9d, 6
or r9d, esi
mov r8d, r9d
jmp 0x140077fcc
add rcx, 3
shl r9d, 0xc
or r10d, r9d
mov r8d, r10d
sub rcx, rdi
mov r15, rdx
mov rdx, rcx
test r8d, r8d
je 0x140077f37
jmp 0x140077fe8
xor r15d, r15d
mov rcx, rax
xor edx, edx
cmp rcx, rax
je 0x14007807c
mov r12, rax
add rax, rdi
mov r8b, byte [rax - 1]
test r8b, r8b
js 0x140078009
dec rax
movzx r8d, r8b
jmp 0x14007806e
movzx r9d, byte [rax - 2]
cmp r9b, 0xc0
jge 0x140078039
movzx r10d, byte [rax - 3]
cmp r10b, 0xc0
jge 0x140078043
movzx r11d, byte [rax - 4]
add rax, 0xfffffffffffffffc
and r11d, 7
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
jmp 0x14007804b
add rax, 0xfffffffffffffffe
and r9d, 0x1f
jmp 0x140078056
add rax, 0xfffffffffffffffd
and r10d, 0xf
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
shl r9d, 6
and r8b, 0x3f
movzx r8d, r8b
or r8d, r9d
cmp r8d, 0x110000
je 0x14007807c
sub rax, rdi
test r8d, r8d
je 0x140077fe8
jmp 0x14007807f
mov r12, rdx
mov qword [rbp + 0x2d8], rdi
sub r12, r15
mov rcx, r12
call fcn.140019604
mov qword [rbp + 0x280], rax
mov rsi, qword [rbp + 0x2d8]
add r15, rsi
mov qword [rbp + 0x2d0], rdx
mov rcx, rdx
mov rdx, r15
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rbp + 0x278], 0
je 0x1400780d3
mov rcx, qword [0x140532288]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [rbp - 0x50]
mov dword [rbp + 0x274], eax
cmp qword [rbp + 0x2a8], 0
je 0x1400781b4
mov rcx, qword [rbp + 0x2b0]
mov rdx, qword [rbp + 0x2b8]
mov r8, qword [rbp + 0x2d0]
mov r9, r12
call fcn.14003426c
mov rsi, qword [rbp + 0x290]
mov rdi, qword [rbp + 0x298]
mov rbx, rdi
and rbx, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea r14, [rsi - 0x30]
xor r15d, r15d
movdqu xmm8, xmmword [rsi + rbx]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r13d, xmm0
test r13w, r13w
je 0x140078196
mov eax, r13d
lea r13d, [rax - 1]
and r13d, eax
bsf eax, eax
add rax, rbx
and rax, rdi
neg rax
lea rax, [rax + rax*2]
shl rax, 4
cmp r12, qword [r14 + rax + 0x10]
jne 0x14007814c
add rax, r14
mov rdx, qword [rax + 8]
mov rcx, qword [rbp + 0x2d0]
mov r8, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14007814c
jmp 0x140078386
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400781b4
add rbx, r15
add rbx, 0x10
add r15, 0x10
and rbx, rdi
jmp 0x140078138
lea rcx, [rbp + 0x1e0]
mov rdx, qword [rbp + 0x2d0]
mov r8, r12
call fcn.140009290
mov rbx, qword [rbp + 0x2b0]
mov r14, qword [rbp + 0x2b8]
mov r8, qword [rbp + 0x1e8]
mov r13, qword [rbp + 0x1f0]
mov rcx, rbx
mov rdx, r14
mov qword [rbp + 0x2d8], r8
mov r9, r13
call fcn.14003426c
mov rdi, rax
cmp qword [rbp + 0x2a0], 0
jne 0x14007821a
lea rcx, [rbp + 0x290]
mov rdx, rbx
mov r8, r14
call fcn.1400db352
mov rbx, qword [rbp + 0x290]
mov rsi, qword [rbp + 0x298]
mov r14, rsi
and r14, rdi
shr rdi, 0x39
mov qword [rbp + 0x210], rdi
movd xmm0, edi
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rbp + 0x248], rax
xor eax, eax
mov qword [rbp + 0x240], rax
movdqu xmm8, xmmword [rbx + r14]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r15d, xmm0
test r15w, r15w
je 0x1400782b9
bsf eax, r15d
add rax, r14
and rax, rsi
neg rax
lea rdi, [rax + rax*2]
shl rdi, 4
cmp r13, qword [rbx + rdi - 0x20]
jne 0x1400782ad
add rdi, rbx
mov rdx, qword [rdi - 0x28]
mov rcx, qword [rbp + 0x2d8]
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140078325
lea eax, [r15 - 1]
and eax, r15d
mov r15d, eax
jmp 0x140078271
cmp qword [rbp + 0x240], 1
mov edx, 1
je 0x1400782e4
pmovmskb eax, xmm8
xor edx, edx
test eax, eax
setne dl
bsf eax, eax
add rax, r14
and rax, rsi
mov qword [rbp + 0x218], rax
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
mov rcx, qword [rbp + 0x210]
jne 0x1400784f7
mov qword [rbp + 0x240], rdx
mov rax, qword [rbp + 0x248]
add r14, rax
add r14, 0x10
add rax, 0x10
mov qword [rbp + 0x248], rax
and r14, rsi
jmp 0x14007825d
mov rsi, qword [rdi - 0x18]
mov r15, qword [rdi - 0x10]
xor eax, eax
mov qword [rdi - 0x18], rax
mov qword [rdi - 0x10], 4
mov qword [rdi - 8], rax
cmp qword [rbp + 0x1e0], rax
je 0x14007835e
mov rcx, qword [0x140532288]
xor edx, edx
mov r8, qword [rbp + 0x2d8]
call qword [sym.imp.kernel32.dll_HeapFree]
shl rsi, 1
test rsi, rsi
je 0x140078378
mov rcx, qword [0x140532288]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rbp + 0x2a8], 0
je 0x14007877a
mov rcx, qword [rbp + 0x2b0]
mov rdx, qword [rbp + 0x2b8]
mov r8, qword [rbp + 0x2d0]
mov r9, r12
call fcn.14003426c
mov rcx, qword [rbp + 0x290]
mov rdi, qword [rbp + 0x298]
mov rbx, rdi
and rbx, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea r14, [rcx - 0x30]
xor r15d, r15d
mov qword [rbp + 0x2d8], rcx
movdqu xmm8, xmmword [rcx + rbx]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r13d, xmm0
test r13w, r13w
je 0x140078437
mov eax, r13d
lea r13d, [rax - 1]
and r13d, eax
bsf eax, eax
add rax, rbx
and rax, rdi
neg rax
lea rsi, [rax + rax*2]
shl rsi, 4
cmp r12, qword [r14 + rsi + 0x10]
jne 0x1400783ef
lea rax, [r14 + rsi]
mov rdx, qword [rax + 8]
mov rcx, qword [rbp + 0x2d0]
mov r8, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400783ef
jmp 0x140078463
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14007877a
add rbx, r15
add rbx, 0x10
add r15, 0x10
and rbx, rdi
mov rcx, qword [rbp + 0x2d8]
jmp 0x1400783db
mov rax, qword [rbp + 0x2d8]
lea rdi, [rax + rsi]
mov rdx, qword [rax + rsi - 8]
cmp rdx, qword [rax + rsi - 0x18]
jne 0x140078494
lea rcx, [rax + rsi]
add rcx, 0xffffffffffffffe8
call fcn.1400a13ee
mov rsi, qword [rbp + 0x250]
mov rdx, qword [rdi - 8]
jmp 0x14007849b
mov rsi, qword [rbp + 0x250]
mov rax, qword [rdi - 0x10]
mov ecx, dword [rbp + 0x274]
mov dword [rax + rdx*4], ecx
inc qword [rdi - 8]
mov rcx, rsi
lea rdx, [rbp - 0x58]
call qword [sym.imp.kernel32.dll_Process32NextW]
test eax, eax
je 0x14007867a
cmp qword [rbp + 0x280], 0
je 0x140077ee9
mov rcx, qword [0x140532288]
xor edx, edx
mov r8, qword [rbp + 0x2d0]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140077ee9
xor r15d, r15d
mov rcx, rdx
xor edx, edx
jmp 0x140077fe8
mov rdx, qword [rbp + 0x218]
mov al, byte [rbx + rdx]
test al, al
js 0x140078513
movdqa xmm0, xmmword [rbx]
pmovmskb eax, xmm0
bsf edx, eax
mov al, byte [rbx + rdx]
and al, 1
movzx eax, al
sub qword [rbp + 0x2a0], rax
lea rax, [rdx - 0x10]
and rsi, rax
mov byte [rbx + rdx], cl
mov byte [rsi + rbx + 0x10], cl
inc qword [rbp + 0x2a8]
neg rdx
lea rax, [rdx + rdx*2]
shl rax, 4
mov rcx, qword [rbp + 0x1f0]
mov qword [rbx + rax - 0x20], rcx
movdqu xmm0, xmmword [rbp + 0x1e0]
movdqu xmmword [rbx + rax - 0x30], xmm0
xor ecx, ecx
mov qword [rbx + rax - 0x18], rcx
mov qword [rbx + rax - 0x10], 4
mov qword [rbx + rax - 8], rcx
jmp 0x140078378
call qword [sym.imp.kernel32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
xor eax, eax
lea rdx, [rbp + 0x220]
mov qword [rdx], rax
mov dword [rdx + 8], ecx
lea r8, [rbp + 0x258]
mov qword [r8], rdx
lea rcx, [0x1400af80c]
mov qword [r8 + 8], rcx
lea rdx, str.called__Result::unwrap____on_an__Err__value
lea rcx, [rbp + 0x1e0]
mov qword [rcx], rdx
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x10], r8
mov qword [rcx + 0x18], 1
call fcn.140070d40
movdqa xmm0, xmmword [rbp + 0x290]
movaps xmm1, xmmword [rbp + 0x2a0]
movaps xmm2, xmmword [rbp + 0x2b0]
mov rax, qword [rbp + 0x288]
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movdqu xmmword [rax], xmm0
mov rcx, qword [rbp + 0x220]
test rcx, rcx
je 0x140078750
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov byte [rbp + 0x2e7], 1
call rax
jmp 0x140078750
lea rax, [rbp + 0x2cf]
lea rdx, [rbp + 0x220]
mov qword [rdx], rax
lea rax, [0x140009270]
mov qword [rdx + 8], rax
lea rax, str.called__Result::unwrap____on_an__Err__value
lea rcx, [rbp + 0x1e0]
mov qword [rcx], rax
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], 0
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 1
call fcn.140070d40
jmp 0x140078727
call qword [sym.imp.kernel32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov qword [rbp + 0x230], 0
mov dword [rbp + 0x238], ecx
cmp ecx, 0x80070012
je 0x140078707
lea rax, [rbp + 0x230]
lea rdx, [rbp + 0x220]
mov qword [rdx], rax
lea rax, [0x1400af2f5]
mov qword [rdx + 8], rax
lea rax, str.called__Result::unwrap____on_an__Err__value
lea rcx, [rbp + 0x1e0]
mov qword [rcx], rax
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], 0
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 1
call fcn.140070d40
mov rcx, qword [rbp + 0x230]
test rcx, rcx
je 0x140078707
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp qword [rbp + 0x280], 0
je 0x140078727
mov rcx, qword [0x140532288]
xor edx, edx
mov r8, qword [rbp + 0x2d0]
call qword [sym.imp.kernel32.dll_HeapFree]
movdqa xmm0, xmmword [rbp + 0x290]
movaps xmm1, xmmword [rbp + 0x2a0]
movaps xmm2, xmmword [rbp + 0x2b0]
mov rax, qword [rbp + 0x288]
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movdqu xmmword [rax], xmm0
movaps xmm6, xmmword [rbp + 0x2f0]
movaps xmm7, xmmword [rbp + 0x300]
movaps xmm8, xmmword [rbp + 0x310]
add rsp, 0x3a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [0x1404e3b7a]
lea r8, str.tools_srcprocess.rs
mov edx, 0x2b
call fcn.1400d9150
ud2