Function at 0x14006d340
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x260
movzx r15d, r8b
movzx r12d, dl
mov r14, rcx
mov rdi, rcx
movzx eax, word [rdi]
cmp ax, 0x20
je 0x14006d36f
cmp ax, 9
jne 0x14006d375
add rdi, 2
jmp 0x14006d360
mov qword [rsp + 0x280], rbx
mov qword [rsp + 0x288], rbp
mov qword [rsp + 0x290], rsi
test ax, ax
je 0x14006d466
xor esi, esi
cmp ax, 0x2d
je 0x14006d4e8
cmp ax, 0x2b
jne 0x14006d3b2
lea rax, [rdi + 2]
mov rdi, rax
movzx eax, word [rax]
cmp ax, 0x30
jne 0x14006d3e2
movzx eax, word [rdi + 2]
mov ecx, 0xffdf
sub ax, 0x58
test cx, ax
jne 0x14006d3e2
movzx ecx, word [rdi + 4]
lea rbx, [rdi + 4]
call fcn.1400c56b0
test eax, eax
je 0x14006d3e2
mov ebp, 1
jmp 0x14006d3e8
mov ebp, esi
lea rbx, [rdi + 4]
test ebp, ebp
mov ecx, esi
cmove rbx, rdi
movzx eax, word [rbx]
cmp eax, 0x20
je 0x14006d440
cmp eax, 9
je 0x14006d440
test eax, eax
je 0x14006d45e
cmp eax, 0x2e
je 0x14006d4e8
test ebp, ebp
je 0x14006d420
movzx ecx, ax
call fcn.1400ccf18
test eax, eax
je 0x14006d4e8
jmp 0x14006d42c
add eax, 0xffffffd0
cmp eax, 9
ja 0x14006d4e8
movzx eax, word [rbx + 2]
add rbx, 2
mov ecx, 1
cmp eax, 0x20
jne 0x14006d3f8
nop
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14006d44f
cmp ax, 9
jne 0x14006d455
add rbx, 2
jmp 0x14006d440
test ax, ax
jne 0x14006d4e8
test ecx, ecx
je 0x14006d4e8
mov rcx, r14
call fcn.14009d5f0
mov rsi, rax
test eax, eax
je 0x14006d4e8
test r12b, r12b
jne 0x14006d4e8
mov r8d, esi
xor edx, edx
mov ecx, 0x101000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14006d4ce
mov rcx, rax
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetProcessId]
cmp eax, esi
jne 0x14006d4b1
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14006d573
cmp edi, 0x102
je 0x14006d5b4
test r15b, r15b
jne 0x14006d4e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x14006d4e8
test sil, 3
je 0x14006d5b4
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14006d56a
nop
test esi, esi
je 0x14006d52a
cmp esi, dword [rsp + 0x28]
je 0x14006d5a3
mov edx, 0x5c
lea rcx, [rsp + 0x4c]
call fcn.1400bbdec
test rax, rax
je 0x14006d544
add rax, 2
jmp 0x14006d549
lea rax, [rsp + 0x4c]
mov rdx, r14
mov rcx, rax
call fcn.1400c0814
mov rcx, rbx
test eax, eax
je 0x14006d5b8
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14006d520
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x280]
mov rdi, qword [rsp + 0x298]
add rsp, 0x260
pop r15
pop r14
pop r12
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12b, r12b
cmovne esi, dword [rsp + 0x40]
mov eax, esi
jmp 0x14006d575
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
test r12b, r12b
cmovne eax, dword [rsp + 0x40]
jmp 0x14006d575