Function at 0x140059d10
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3d8]
sub rsp, 0x4b0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov r12, rdx
xor sil, sil
call fcn.140039c50
mov rcx, rax
test rax, rax
je 0x14005a05c
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14004487d.0]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rdx, [0x140351d18]
lea rcx, [rsp + 0x20]
call fcn.14003b370
test al, al
jne 0x140059daa
mov r8d, 0xe
lea rdx, [0x140351d18]
lea rcx, [rsp + 0x20]
call fcn.14003beb0
nop
mov rdi, qword [rsp + 0x20]
movsxd rbx, dword [rdi - 0x10]
mov r14, 0xffffffffffffffff
test ebx, ebx
je 0x140059ff2
js 0x14005a067
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x140059dea
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.14003b630
mov rdi, qword [rsp + 0x20]
lea eax, [rbx + 1]
movsxd rdx, eax
mov rcx, rdi
call fcn.140245abc
cmp ebx, dword [rdi - 0xc]
jg 0x14005a051
mov dword [rdi - 0x10], ebx
xor ecx, ecx
mov word [rdi + rbx*2], cx
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
cmp rax, r14
je 0x140059ff2
mov dword [rsp + 0x40], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x44]
call fcn.140222790
lea rdx, [rsp + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140059fe8
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x140059fd5
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x190]
call fcn.140222790
mov dword [rbp + 0x180], 0x104
lea r9, [rbp + 0x180]
lea r8, [rbp + 0x190]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x140059fc7
call fcn.140039c50
mov rcx, rax
test rax, rax
je 0x14005a046
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14004487d.0]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x28]
call fcn.14003b370
test al, al
jne 0x140059f13
lea rcx, [rbp + 0x190]
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x140059ef4
mov r8d, eax
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x28]
call fcn.14003beb0
nop
mov rbx, qword [rsp + 0x28]
movsxd rsi, dword [rbx - 0x10]
test esi, esi
js 0x14005a07d
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x140059f46
mov edx, esi
lea rcx, [rsp + 0x28]
call fcn.14003b630
mov rbx, qword [rsp + 0x28]
lea eax, [rsi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.140245abc
cmp esi, dword [rbx - 0xc]
jg 0x14005a072
mov dword [rbx - 0x10], esi
xor ecx, ecx
mov word [rbx + rsi*2], cx
cmp dword [rbx - 0x10], ecx
jge 0x140059f70
mov eax, r14d
jmp 0x140059f8b
mov rdx, rdi
mov rcx, rbx
call fcn.140221480
test rax, rax
jne 0x140059f85
mov eax, r14d
jmp 0x140059f8b
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
setne sil
je 0x140059fa1
test r12, r12
je 0x140059fa1
mov eax, dword [rsp + 0x48]
mov dword [r12], eax
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140059fc2
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004487d.0]
mov rdi, qword [rsp + 0x20]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
jne 0x140059fe8
lea rdx, [rsp + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140059e49
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14005a012
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14004487d.0]
movzx eax, sil
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140202880
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140039950
int3
mov ecx, 0x80070057
call fcn.140039950
nop
mov ecx, 0x80004005
call fcn.140039950
nop
mov ecx, 0x80070057
call fcn.140039950
nop
mov ecx, 0x80070057
call fcn.140039950
int3
mov ecx, 0x80070057
call fcn.140039950
int3