Function at 0x140001210
Capabilities:
Create thread
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rdi, rcx
xor r15d, r15d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140001287
lea rdx, str.Error:_CreateToolhelp32Snapshot_failed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001c40
mov rcx, rax
lea rdx, [0x140001e10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400012cd
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400012fd
lea rdx, str.Error:_Process32First_failed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001c40
mov rcx, rax
lea rdx, [0x140001e10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140002360
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r13, str.ProcessHacker.exe
lea rbx, str.AyuGram.exe
lea r12, str.Razer_Synapse_3.exe
lea rax, [rsp + 0x6c]
mov r8, rdi
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140001334
add rax, 2
test ecx, ecx
jne 0x140001320
test edx, edx
jne 0x140001824
mov r8d, dword [rsp + 0x48]
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140001824
lea rdx, [rsp + 0x6c]
lea rcx, [rbp + 0x1e0]
call fcn.140001af0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1c0], r15
mov qword [rbp + 0x1c8], 7
mov word [rbp + 0x1b0], r15w
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r15
mov qword [rbp + 0x198], 7
mov word [rbp + 0x180], r15w
mov rcx, r15
movzx eax, word [rdi + rcx*2]
cmp ax, word [r13 + rcx*2]
jne 0x14000144f
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [r13 + rcx*2 + 2]
jne 0x14000144f
add rcx, 2
cmp rcx, 0x12
jne 0x1400013b0
lea r9, str.Process_Hacker___System_Error
lea edx, [rcx + 0xb]
lea rcx, [rbp + 0x1b0]
call fcn.140001e50
mov rax, qword [rbp + 0x198]
cmp rax, 0x78
jb 0x14000143e
lea rbx, [rbp + 0x180]
cmp rax, 7
cmova rbx, qword [rbp + 0x180]
mov qword [rbp + 0x190], 0x78
mov r8d, pe_nt_image_headers64
lea rdx, str.This_application_failed_to_start_because_msvcp110.dll_was_not_found._Re_installing_the_application_may_fix_this_problem.
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + 0xf0], r15w
jmp 0x140001632
lea r9, str.This_application_failed_to_start_because_msvcp110.dll_was_not_found._Re_installing_the_application_may_fix_this_problem.
mov edx, 0x78
jmp 0x140001626
mov rcx, r15
movzx eax, word [rdi + rcx*2]
cmp ax, word [rbx + rcx*2]
jne 0x1400014ee
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [rbx + rcx*2 + 2]
jne 0x1400014ee
add rcx, 2
cmp rcx, 0xc
jne 0x140001452
lea r9, str.AyuGram___System_Error
lea edx, [rcx + 0xa]
lea rcx, [rbp + 0x1b0]
call fcn.140001e50
mov rax, qword [rbp + 0x198]
cmp rax, 0x77
jb 0x1400014dd
lea rbx, [rbp + 0x180]
cmp rax, 7
cmova rbx, qword [rbp + 0x180]
mov qword [rbp + 0x190], 0x77
mov r8d, 0xee
lea rdx, str.This_application_failed_to_start_because_mfc110u.dll_was_not_found._Re_installing_the_application_may_fix_this_problem.
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + 0xee], r15w
jmp 0x140001632
lea r9, str.This_application_failed_to_start_because_mfc110u.dll_was_not_found._Re_installing_the_application_may_fix_this_problem.
mov edx, 0x77
jmp 0x140001626
mov rcx, r15
movzx eax, word [rdi + rcx*2]
cmp ax, word [r12 + rcx*2]
jne 0x140001584
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [r12 + rcx*2 + 2]
jne 0x140001584
add rcx, 2
cmp rcx, 0x14
jne 0x1400014f1
mov r9, r12
lea edx, [rcx - 1]
lea rcx, [rbp + 0x1b0]
call fcn.140001e50
mov rax, qword [rbp + 0x198]
cmp rax, 0x1f
jb 0x140001573
lea rbx, [rbp + 0x180]
cmp rax, 7
cmova rbx, qword [rbp + 0x180]
mov qword [rbp + 0x190], 0x1f
mov r8d, 0x3e
lea rdx, str.File_system_error___2018375670_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + 0x3e], r15w
jmp 0x140001632
lea r9, str.File_system_error___2018375670_
mov edx, 0x1f
jmp 0x140001626
mov rax, r15
lea rdx, str.nvcplui.exe
nop
movzx ecx, word [rdi + rax*2]
cmp cx, word [rdx + rax*2]
jne 0x140001632
movzx ecx, word [rdi + rax*2 + 2]
cmp cx, word [rdx + rax*2 + 2]
jne 0x140001632
add rax, 2
cmp rax, 0xc
jne 0x140001590
lea r9, str.nvcplui___System_Error
lea edx, [rax + 0xa]
lea rcx, [rbp + 0x1b0]
call fcn.140001e50
mov rax, qword [rbp + 0x198]
cmp rax, 0x94
jb 0x14000161a
lea rbx, [rbp + 0x180]
cmp rax, 7
cmova rbx, qword [rbp + 0x180]
mov qword [rbp + 0x190], 0x94
mov r8d, 0x128
lea rdx, str.The_program_cant_start_because_api_ms_win_crt_multibyte_l1_1_0.dll_is_missing_from_your_computer._Try_reinstalling_the_program_to_fix_this_problem.
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + 0x128], r15w
jmp 0x140001632
lea r9, str.The_program_cant_start_because_api_ms_win_crt_multibyte_l1_1_0.dll_is_missing_from_your_computer._Try_reinstalling_the_program_to_fix_this_problem.
mov edx, 0x94
lea rcx, [rbp + 0x180]
call fcn.140001e50
mov ecx, 0x68
call fcn.140002380
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x1b0]
mov rcx, rax
call fcn.140002220
nop
lea rcx, [rbx + 0x20]
lea rdx, [rbp + 0x180]
call fcn.140002220
nop
lea rcx, [rbx + 0x40]
lea rdx, [rbp + 0x1e0]
call fcn.140002220
nop
lea rax, [0x1400011e0]
mov qword [rbx + 0x60], rax
mov qword [rbp + 0x1d0], rbx
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rbx
lea r8, [0x140002180]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x1a0], rax
test rax, rax
je 0x140001867
cmp dword [rbp + 0x1a8], 0
je 0x14000185b
movaps xmm0, xmmword [rbp + 0x1a0]
movdqa xmmword [rbp + 0x1d0], xmm0
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000185b
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1a0], xmm0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [rbp + 0x1a8], 0
jne 0x140001854
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x140001761
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000175c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000183f
call fcn.1400023bc
mov qword [rbp + 0x190], r15
mov qword [rbp + 0x198], 7
mov word [rbp + 0x180], r15w
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 7
jbe 0x1400017c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001846
call fcn.1400023bc
mov qword [rbp + 0x1c0], r15
mov qword [rbp + 0x1c8], 7
mov word [rbp + 0x1b0], r15w
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 7
jbe 0x14000181d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001818
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000184d
call fcn.1400023bc
lea rbx, str.AyuGram.exe
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001312
jmp 0x1400012c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x1a8], r15d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3