Function at 0x401d40
Capabilities:
Enumerate processes

Disassembly:
mov r11, rsp
sub rsp, 0x248
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 8], rdi
mov qword [r11 - 0x10], r12
mov rax, qword [0x0041c040]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rbp, rcx
xor r12d, r12d
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov word [rsp + 0x30], 0x4d
lea rax, [rsp + 0x38]
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], r12
movaps xmm0, xmmword [r11 - 0x38]
movdqa xmmword [rsp + 0x60], xmm0
lea r9, [rsp + 0x30]
lea r8d, [r12 + 1]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.0040a640
mov rbx, qword [rsp + 0x40]
mov rdi, rbx
mov rdx, qword [rsp + 0x48]
cmp rbx, rdx
jbe 0x401dea
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
cmp rdi, rdx
ja 0x401df4
cmp rdi, rbx
jae 0x401e03
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov word [rsp + 0x30], 0x69
test rbx, rbx
je 0x401e40
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x50]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x401e40
mov word [rdx], 0x69
add rdx, 2
mov qword [rsp + 0x48], rdx
mov rbx, qword [rsp + 0x40]
jmp 0x401eee
mov rdi, rdx
cmp rbx, rdx
jbe 0x401e57
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
test rbx, rbx
je 0x401e88
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x401e88
cmp rbx, rdx
jbe 0x401e80
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x401e8b
mov rdi, r12
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea r9, [rsp + 0x30]
mov r8d, 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.0040a640
mov rbx, qword [rsp + 0x40]
mov rsi, rbx
mov rdx, qword [rsp + 0x48]
cmp rbx, rdx
jbe 0x401ed1
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x401edf
cmp rax, rbx
jae 0x401eee
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov word [rsp + 0x30], 0x77
test rbx, rbx
je 0x401f2b
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x50]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x401f2b
mov word [rdx], 0x77
add rdx, 2
mov qword [rsp + 0x48], rdx
mov rbx, qword [rsp + 0x40]
jmp 0x401fd9
mov rdi, rdx
cmp rbx, rdx
jbe 0x401f42
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
test rbx, rbx
je 0x401f73
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x401f73
cmp rbx, rdx
jbe 0x401f6b
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x401f76
mov rdi, r12
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea r9, [rsp + 0x30]
mov r8d, 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.0040a640
mov rbx, qword [rsp + 0x40]
mov rsi, rbx
mov rdx, qword [rsp + 0x48]
cmp rbx, rdx
jbe 0x401fbc
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x401fca
cmp rax, rbx
jae 0x401fd9
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov word [rsp + 0x30], 0x44
test rbx, rbx
je 0x402016
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x50]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x402016
mov word [rdx], 0x44
add rdx, 2
mov qword [rsp + 0x48], rdx
mov rbx, qword [rsp + 0x40]
jmp 0x4020c4
mov rdi, rdx
cmp rbx, rdx
jbe 0x40202d
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
test rbx, rbx
je 0x40205e
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x40205e
cmp rbx, rdx
jbe 0x402056
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x402061
mov rdi, r12
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea r9, [rsp + 0x30]
mov r8d, 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.0040a640
mov rbx, qword [rsp + 0x40]
mov rsi, rbx
mov rdx, qword [rsp + 0x48]
cmp rbx, rdx
jbe 0x4020a7
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x4020b5
cmp rax, rbx
jae 0x4020c4
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov word [rsp + 0x30], 0x6a
test rbx, rbx
je 0x402101
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x50]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x402101
mov word [rdx], 0x6a
add rdx, 2
mov qword [rsp + 0x48], rdx
mov rbx, qword [rsp + 0x40]
jmp 0x4021af
mov rdi, rdx
cmp rbx, rdx
jbe 0x402118
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
test rbx, rbx
je 0x402149
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x402149
cmp rbx, rdx
jbe 0x402141
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x40214c
mov rdi, r12
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea r9, [rsp + 0x30]
mov r8d, 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.0040a640
mov rbx, qword [rsp + 0x40]
mov rsi, rbx
mov rdx, qword [rsp + 0x48]
cmp rbx, rdx
jbe 0x402192
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x4021a0
cmp rax, rbx
jae 0x4021af
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov word [rsp + 0x30], 0x74
test rbx, rbx
je 0x4021ec
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x50]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x4021ec
mov word [rdx], 0x74
add rdx, 2
mov qword [rsp + 0x48], rdx
mov rbx, qword [rsp + 0x40]
jmp 0x40229a
mov rdi, rdx
cmp rbx, rdx
jbe 0x402203
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
test rbx, rbx
je 0x402234
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x402234
cmp rbx, rdx
jbe 0x40222c
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x402237
mov rdi, r12
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea r9, [rsp + 0x30]
mov r8d, 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.0040a640
mov rbx, qword [rsp + 0x40]
mov rsi, rbx
mov rdx, qword [rsp + 0x48]
cmp rbx, rdx
jbe 0x40227d
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x40228b
cmp rax, rbx
jae 0x40229a
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov word [rsp + 0x30], 0x79
test rbx, rbx
je 0x4022d7
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x50]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x4022d7
mov word [rdx], 0x79
add rdx, 2
mov qword [rsp + 0x48], rdx
mov rbx, qword [rsp + 0x40]
jmp 0x402385
mov rdi, rdx
cmp rbx, rdx
jbe 0x4022ee
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
test rbx, rbx
je 0x40231f
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x40231f
cmp rbx, rdx
jbe 0x402317
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x402322
mov rdi, r12
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea r9, [rsp + 0x30]
mov r8d, 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.0040a640
mov rbx, qword [rsp + 0x40]
mov rsi, rbx
mov rdx, qword [rsp + 0x48]
cmp rbx, rdx
jbe 0x402368
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x402376
cmp rax, rbx
jae 0x402385
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov word [rsp + 0x30], 0x4b
test rbx, rbx
je 0x4023c2
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x50]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x4023c2
mov word [rdx], 0x4b
add rdx, 2
mov qword [rsp + 0x48], rdx
mov rbx, qword [rsp + 0x40]
jmp 0x402470
mov rdi, rdx
cmp rbx, rdx
jbe 0x4023d9
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
test rbx, rbx
je 0x40240a
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x40240a
cmp rbx, rdx
jbe 0x402402
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x40240d
mov rdi, r12
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea r9, [rsp + 0x30]
mov r8d, 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.0040a640
mov rbx, qword [rsp + 0x40]
mov rsi, rbx
mov rdx, qword [rsp + 0x48]
cmp rbx, rdx
jbe 0x402453
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x402461
cmp rax, rbx
jae 0x402470
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov word [rsp + 0x30], 0x66
test rbx, rbx
je 0x4024ad
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x50]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x4024ad
mov word [rdx], 0x66
add rdx, 2
mov qword [rsp + 0x48], rdx
mov rbx, qword [rsp + 0x40]
jmp 0x40255b
mov rdi, rdx
cmp rbx, rdx
jbe 0x4024c4
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
test rbx, rbx
je 0x4024f5
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x4024f5
cmp rbx, rdx
jbe 0x4024ed
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x4024f8
mov rdi, r12
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea r9, [rsp + 0x30]
mov r8d, 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.0040a640
mov rbx, qword [rsp + 0x40]
mov rsi, rbx
mov rdx, qword [rsp + 0x48]
cmp rbx, rdx
jbe 0x40253e
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsi + rdi*2]
cmp rax, rdx
ja 0x40254c
cmp rax, rbx
jae 0x40255b
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov word [rsp + 0x30], 0x65
test rbx, rbx
je 0x402593
mov rcx, rdx
sub rcx, rbx
sar rcx, 1
mov rax, qword [rsp + 0x50]
sub rax, rbx
sar rax, 1
cmp rcx, rax
jae 0x402593
mov word [rdx], 0x65
lea rax, [rdx + 2]
mov qword [rsp + 0x48], rax
jmp 0x402637
mov rdi, rdx
cmp rbx, rdx
jbe 0x4025aa
call fcn.0040bf80
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
test rbx, rbx
je 0x4025db
mov rax, rdx
sub rax, rbx
sar rax, 1
je 0x4025db
cmp rbx, rdx
jbe 0x4025d3
call fcn.0040bf80
sub rdi, rbx
sar rdi, 1
jmp 0x4025de
mov rdi, r12
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea r9, [rsp + 0x30]
mov r8d, 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.0040a640
mov r11, qword [rsp + 0x40]
mov rbx, r11
mov rcx, qword [rsp + 0x48]
cmp r11, rcx
jbe 0x402624
call fcn.0040bf80
mov rcx, qword [rsp + 0x48]
mov r11, qword [rsp + 0x40]
lea rax, [rbx + rdi*2]
cmp rax, rcx
ja 0x402632
cmp rax, r11
jae 0x402637
call fcn.0040bf80
mov word [rsp + 0x30], 0x77
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.00409bd0
mov word [rsp + 0x210], 0x71
mov word [rsp + 0x212], 0x41
mov word [rsp + 0x214], 0x4a
mov word [rsp + 0x216], 0x77
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.00409a40
mov r9d, 4
lea r8, [rsp + 0x210]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.00401270
nop
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x4026f4
mov dword [rsp + 0xe0], 0x130
lea rdx, [rsp + 0xe0]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4026f4
nop
nop
nop
lea rdx, [rsp + 0xe0]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4026e0
mov qword [rsp + 0xa0], 0xf
mov qword [rsp + 0x98], r12
mov byte [rsp + 0x88], 0
mov r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x80]
call fcn.00409ed0
lea rdx, [rsp + 0x80]
mov rcx, rbp
call fcn.00401b00
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
mov rbx, rax
cmp qword [rsp + 0xd0], 0x10
jb 0x40276b
mov rcx, qword [rsp + 0xb8]
call fcn.0040bb10
mov qword [rsp + 0xd0], 0xf
mov qword [rsp + 0xc8], r12
mov byte [rsp + 0xb8], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x40279b
call fcn.0040bb10
mov rax, rbx
jmp 0x40279e
mov rax, rbx
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.0040b8c0
mov rbx, qword [rsp + 0x258]
mov rbp, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x268]
mov rdi, qword [rsp + 0x240]
mov r12, qword [rsp + 0x238]
add rsp, 0x248
ret