Function at 0x1400109e0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x140022040]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov r15, rcx
xor r12d, r12d
mov ecx, 2
mov qword [0x140022990], r12
xor edx, edx
xor sil, sil
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140010a85
nop word [rax + rax]
lea rdx, [rbp - 0x74]
lea rcx, str.Unturned.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
lea ecx, [rsi + 1]
test eax, eax
movzx edx, cl
movzx ecx, sil
cmovne edx, ecx
mov rcx, rbx
movzx esi, dl
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140010a50
mov rcx, qword [0x140022990]
xor r14b, r14b
mov qword [rsp + 0x328], rdi
mov qword [rsp + 0x330], r13
test sil, sil
je 0x140010b87
lea r13, str.mono_2.0_bdwgc.dll
nop
test rcx, rcx
jne 0x140010b8c
xor edx, edx
mov ecx, 2
movzx ebx, r14b
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140010b1e
nop word [rax + rax]
lea rdx, [rbp - 0x74]
lea rcx, str.Unturned.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140010b0c
test bl, bl
je 0x140010b32
add bl, 0xff
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140010af0
mov ecx, r12d
mov rax, qword [0x140022c80]
test rax, rax
jne 0x140010b39
mov rcx, r12
jmp 0x140010b74
movzx ecx, word [rsp + 0x68]
jmp 0x140010b21
movsx ebx, cx
xor edx, edx
lea rcx, [rsp + 0x60]
mov dword [rax], ebx
mov r8d, 0x158
call sub.VCRUNTIME140.dll_memset
mov edx, 3
mov dword [rsp + 0x78], ebx
lea rcx, [rsp + 0x60]
mov qword [rbp + 0xa8], r13
call fcn.1400012b0
mov rcx, qword [rbp - 0x78]
test al, al
cmove rcx, r12
inc r14b
mov qword [0x140022990], rcx
cmp r14b, sil
jb 0x140010ab0
test rcx, rcx
je 0x140010b93
mov al, 1
jmp 0x140010cb9
mov rcx, qword [r15]
movaps xmmword [rsp + 0x2e0], xmm6
movaps xmmword [rsp + 0x2d0], xmm7
movaps xmmword [rsp + 0x2c0], xmm8
movaps xmmword [rsp + 0x2b0], xmm9
call fcn.140001e10
movss xmm9, dword [0x14001db38]
lea rbx, str.Searching_for_Unturned.exe
movss xmm8, dword [0x14001db60]
lea rdx, [rsp + 0x40]
mov rcx, qword [r15]
xorps xmm0, xmm0
xorps xmm7, xmm7
mov qword [rsp + 0x30], rbx
unpcklps xmm0, xmm7
mov r9d, 1
movss dword [rsp + 0x28], xmm9
movq r8, xmm0
movss dword [rsp + 0x20], xmm8
call fcn.1400022e0
movdqa xmm0, xmmword [0x14001dca0]
lea r9, [rsp + 0x50]
movups xmm6, xmmword [rsp + 0x40]
mov rcx, qword [r15]
lea rdx, [rsp + 0x40]
movaps xmmword [rsp + 0x50], xmm0
xorps xmm0, xmm0
unpcklps xmm0, xmm7
movq r8, xmm0
movdqa xmmword [rsp + 0x40], xmm6
call fcn.1400032e0
movdqa xmm0, xmmword [0x14001de00]
lea rax, [rsp + 0x50]
mov rcx, qword [r15]
lea rdx, [rsp + 0x40]
movaps xmm3, xmm9
mov qword [rsp + 0x28], rbx
movaps xmm2, xmm8
movd r9d, xmm3
movd r8d, xmm2
movaps xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x20], rax
call fcn.140002d80
mov rcx, qword [0x140022c98]
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x188]
movaps xmm9, xmmword [rsp + 0x2b0]
xor al, al
movaps xmm8, xmmword [rsp + 0x2c0]
movaps xmm7, xmmword [rsp + 0x2d0]
movaps xmm6, xmmword [rsp + 0x2e0]
mov r13, qword [rsp + 0x330]
mov rdi, qword [rsp + 0x328]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140019d00
mov rbx, qword [rsp + 0x338]
add rsp, 0x2f0
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret