Function at 0x14003b550
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x220
xor edi, edi
lea rcx, str..jeremyownsyou
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x1401d54a8], rax
movabs rcx, 0x433131e52e746ef3
mov qword [rsp + 0xb8], rcx
xor edx, edx
movabs rax, 0x2274a1aa6fda4076
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x60], rax
mov ecx, 2
movabs rax, 0x3cdb8549a19d79df
mov qword [rsp + 0x68], rax
movabs rax, 0xa1dc66e81c0d3078
mov qword [rsp + 0x70], rax
movabs rax, 0x71c409ef83f573d1
mov qword [rsp + 0x78], rax
movabs rax, 0xd8494a611c769ba
mov qword [rsp + 0x80], rax
movabs rax, 0x4700c8c41ba82f30
mov qword [rsp + 0x90], rax
movabs rax, 0x6bf6f127c4f4159c
mov qword [rsp + 0x98], rax
movabs rax, 0xc8b435c5283b5e11
mov qword [rsp + 0xa0], rax
movabs rax, 0x9a12788ed9c03a1
mov qword [rsp + 0xa8], rax
movabs rax, 0xd8494a611c769df
vmovups ymm0, ymmword [rsp + 0x90]
vmovups ymmword [rsp + 0xc0], ymm0
vpxor xmm0, xmm0, xmmword [rsp + 0x60]
vmovdqu xmm1, xmmword [rsp + 0xd0]
vpxor xmm2, xmm1, xmmword [rsp + 0x70]
vmovdqu xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xb0], rax
vmovups xmm3, xmmword [rsp + 0xb0]
vpxor xmm0, xmm3, xmmword [rsp + 0x80]
vmovdqu xmmword [rsp + 0xe0], xmm0
vmovdqu xmmword [rsp + 0xd0], xmm2
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0xf0]
mov dword [rsp + 0xf0], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14003b713
nop dword [rax]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x11c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14003b85b
lea rdx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14003b6e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1401d54b0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.process_id___
mov dword [0x1401d52b0], eax
call fcn.14003bcc0
mov edx, dword [0x1401d52b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14003be80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, dword [0x1401d54b0]
lea r8, [rsp + 0x40]
mov rcx, qword [0x1401d54a8]
mov r9d, 0x10
mov qword [rsp + 0x38], rdi
mov edx, 0x23de8c
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x230]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x230], dil
mov dword [rsp + 0x40], 0x7f1e8b
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [0x1401d54b0]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401d54a8]
mov r9d, 0x10
mov qword [rsp + 0x38], rdi
mov edx, 0x2360d4
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x238]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x238], rdi
mov dword [rsp + 0x50], 0x7f1e8b
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0x238]
lea rdx, str.image_base___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [0x1401d54b8], rax
call fcn.14003bcc0
mov rdx, qword [0x1401d54b8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14003be80]
mov rbx, qword [rsp + 0x240]
add rsp, 0x220
pop rdi
jmp qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0xf8]
mov dword [0x1401d54b0], eax
jmp 0x14003b722