Function at 0x140002d60
Capabilities:
Enumerate process modules
Parse pe header
Terminate process

Disassembly:
push rbp
push r15
lea rbp, [rsp - 0xfb8]
mov eax, 0x10b8
call fcn.14000cb00
sub rsp, rax
mov rax, qword [0x1400731f0]
xor rax, rsp
mov qword [rbp + 0xf90], rax
lea rcx, [rsp + 0x44]
xor r15d, r15d
xor edx, edx
mov r8d, 0xffc
mov dword [rsp + 0x40], r15d
call fcn.14000cb60
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov edx, 0x1000
mov dword [rsp + 0x30], r15d
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x14000300e
mov eax, dword [rsp + 0x30]
shr eax, 2
test eax, eax
je 0x14000300e
mov qword [rsp + 0x10d0], rbx
mov qword [rsp + 0x10e0], rdi
mov qword [rsp + 0x10b0], r12
mov qword [rsp + 0x10a8], r13
mov qword [rsp + 0x10a0], r14
mov ebx, 0x5a4d
mov r14d, eax
mov qword [rsp + 0x10d8], rsi
lea r13, [rsp + 0x40]
movzx eax, word [0x14005fb58]
movups xmm0, xmmword [str.Chrome_29.0.1547.7]
mov r8d, dword [r13]
mov word [rbp + 0xf50], ax
movzx eax, byte [0x14005fb5a]
or rcx, 0xffffffffffffffff
movaps xmmword [rbp + 0xf40], xmm0
mov byte [rbp + 0xf52], al
xor eax, eax
xor edx, edx
mov qword [rbp + 0xf53], rax
mov qword [rbp + 0xf5b], rax
mov qword [rbp + 0xf63], rax
mov qword [rbp + 0xf6b], rax
mov qword [rbp + 0xf73], rax
mov qword [rbp + 0xf7b], rax
mov qword [rbp + 0xf83], rax
mov dword [rbp + 0xf8b], eax
mov byte [rbp + 0xf8f], al
lea rdi, [rbp + 0xf40]
repne scasb al, byte [rdi]
mov rax, qword [str.2_Safari_537.36]
lea ecx, [rdx + 0x11]
mov qword [rdi - 1], rax
mov rax, qword [0x14005fb40]
mov qword [rdi + 7], rax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
test rax, rax
je 0x140002fcc
xor ecx, ecx
mov edx, 0x300000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9d, 0x2800
mov edx, 0x400000
mov rcx, r12
mov r8, rax
mov qword [rsp + 0x20], r15
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140002fb2
movsxd rcx, dword [rsi + 0x3c]
cmp word [rsi], bx
jne 0x140002fcc
cmp dword [rcx + rsi], 0x4550
jne 0x140002fcc
mov ebx, dword [rcx + rsi + 0x50]
mov eax, 0x2ffc00
mov r8, rsi
cmp ebx, 0x300000
mov edx, 0x400000
mov rcx, r12
cmovae ebx, eax
mov qword [rsp + 0x20], r15
mov r9d, ebx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140002fb2
mov r10d, r15d
test ebx, ebx
je 0x140002fb2
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0xf40]
repne scasb al, byte [rdi]
lea rax, [rbp + 0xf40]
mov r9, rsi
not rcx
sub r9, rax
lea r8, [rcx - 1]
mov edx, r15d
test r8, r8
je 0x140002fa7
lea rdi, [rbp + 0xf40]
nop word [rax + rax]
movzx ecx, byte [r9 + rdi]
movsx eax, byte [rdi]
cmp ecx, eax
jne 0x140002fa7
lea rcx, [r8 - 2]
mov eax, edx
cmp rax, rcx
je 0x140003028
inc edx
inc rdi
mov eax, edx
cmp rax, r8
jb 0x140002f80
inc r10d
inc r9
cmp r10d, ebx
jb 0x140002f68
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add r13, 4
dec r14
mov ebx, 0x5a4d
jne 0x140002e11
mov r14, qword [rsp + 0x10a0]
mov r13, qword [rsp + 0x10a8]
mov r12, qword [rsp + 0x10b0]
mov rdi, qword [rsp + 0x10e0]
mov rsi, qword [rsp + 0x10d8]
mov rbx, qword [rsp + 0x10d0]
mov rcx, qword [rbp + 0xf90]
xor rcx, rsp
call fcn.14000cad0
add rsp, 0x10b8
pop r15
pop rbp
ret
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x140074850], 1
jmp 0x140002fcc