Function at 0x14000d310
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x228
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1a0], 0xfffffffffffffffe
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov qword [rbp + 0x128], rdx
mov qword [rbp + 0x130], r8
mov ecx, 2
xor edx, edx
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov rdi, rax
lea rcx, [rbp - 0x50]
mov r8d, 0x130
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xffffffffffffffff
je 0x14000d42b
mov r12d, 0x67b21c44
lea rbx, [rbp - 0x50]
xor ecx, ecx
jmp 0x14000d3a0
mov dword [rbp - 0x50], 0x130
mov ecx, 0x67cda46c
xor r12d, ecx
nop word cs:[rax + rax]
cmp r12d, 0x67b21c43
jg 0x14000d3e0
cmp r12d, 0x353910af
je 0x14000d385
cmp r12d, 0x52f4b4c3
jne 0x14000d416
mov rcx, rdi
mov rdx, rbx
call sub.kernel32.dll_Process32First
mov ecx, 0xe1bc64d2
test eax, eax
jne 0x14000d423
jmp 0x14000d647
cmp r12d, 0x67b21c44
je 0x14000d40c
cmp r12d, 0x6cdd98f4
jne 0x14000d423
mov r8d, 0x130
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x59e4885b
xor r12d, ecx
jmp 0x14000d3a0
mov ecx, 0xb6f84b0
xor r12d, ecx
jmp 0x14000d3a0
cmp r12d, 0xb348d011
je 0x14000d554
xor r12d, ecx
jmp 0x14000d3a0
movzx eax, byte [0x1400ebd19]
mov ecx, 0x1a
mov edx, 1
call fcn.140013c30
test rax, rax
je 0x14000da51
mov rdi, rax
movaps xmm0, xmmword [0x140091240]
movups xmmword [rax], xmm0
movabs rax, 0x437a5976539f4c07
mov qword [rdi + 0x10], rax
mov word [rdi + 0x18], 0xaa1d
movzx eax, byte [0x1400ebd19]
mov ecx, 0x1a
mov edx, 1
call fcn.140013c30
test rax, rax
mov qword [rbp + 0x190], rdi
je 0x14000da60
mov rdx, rax
movups xmm0, xmmword [rdi]
xorps xmm0, xmmword [0x140091250]
movabs rax, 0x2c122a0632f13f27
xor rax, qword [rdi + 0x10]
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rax
movzx eax, byte [rdi + 0x18]
xor al, 0x69
mov byte [rdx + 0x18], al
movzx eax, byte [rdi + 0x19]
xor al, 0x84
mov byte [rdx + 0x19], al
lea rcx, [rbp + 0x160]
mov r8d, 0x1a
mov qword [rbp + 0x198], rdx
call fcn.140043410
cmp qword [rbp + 0x160], 0
jne 0x14000da74
mov edx, 0x1a
mov r8d, 1
mov rcx, qword [rbp + 0x190]
call fcn.140013c40
movzx eax, byte [0x1400ebd19]
mov ecx, 0x1a
mov edx, 1
call fcn.140013c30
test rax, rax
mov rcx, qword [rbp + 0x198]
je 0x14000dad6
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0xa]
movups xmmword [rax + 0xa], xmm1
movups xmmword [rax], xmm0
mov qword [rsi], 0x1a
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0x1a
mov edx, 0x1a
jmp 0x14000da2f
mov qword [rbp + 0x158], rsi
lea rcx, [rbp + 0x138]
mov rdx, r15
mov r8, r14
call fcn.14003dba0
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x138], rax
jne 0x14000daea
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0x190], rax
mov rax, qword [rbp + 0x148]
lea r14, [rbp - 0x24]
mov qword [rbp + 0x198], rax
lea r15, [rax - 1]
mov ebx, 0xe985802c
xor esi, esi
lea r12, [rbp - 0x50]
mov r13, qword [sym.imp.kernel32.dll_CloseHandle]
cmp ebx, 0xe985802c
jne 0x14000d5e5
jmp 0x14000d600
mov esi, 0x51e3ffa4
mov rcx, rdi
call r13
xor ebx, esi
cmp ebx, 0xe985802c
je 0x14000d600
cmp ebx, 0x42376472
je 0x14000d5d0
cmp ebx, 0x13d49bd6
jne 0x14000d5db
jmp 0x14000d991
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp rax, r15
jne 0x14000d627
mov rcx, r14
mov rdx, qword [rbp + 0x190]
mov r8, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000d76f
mov rcx, rdi
mov rdx, r12
call sub.kernel32.dll_Process32Next
test eax, eax
jne 0x14000d600
mov esi, 0xabb2e45e
xor ebx, esi
cmp ebx, 0xe985802c
jne 0x14000d5e5
jmp 0x14000d600
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
movzx eax, byte [0x1400ebd19]
mov ecx, 0x21
mov edx, 1
call fcn.140013c30
test rax, rax
je 0x14000db36
mov rdi, rax
movaps xmm0, xmmword [0x140091200]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x140091210]
movups xmmword [rax + 0x10], xmm0
mov byte [rax + 0x20], 0xe0
movzx eax, byte [0x1400ebd19]
mov ecx, 0x21
mov edx, 1
call fcn.140013c30
test rax, rax
mov qword [rbp + 0x190], rdi
je 0x14000db45
mov rdx, rax
movups xmm0, xmmword [rdi]
xorps xmm0, xmmword [0x140091220]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rdi + 0x10]
xorps xmm0, xmmword [0x140091230]
movups xmmword [rax + 0x10], xmm0
movzx eax, byte [rdi + 0x20]
xor al, 0xce
mov byte [rdx + 0x20], al
lea rcx, [rbp + 0x160]
mov r8d, 0x21
mov qword [rbp + 0x198], rdx
call fcn.140043410
cmp qword [rbp + 0x160], 0
jne 0x14000db56
mov edx, 0x21
mov r8d, 1
mov rcx, qword [rbp + 0x190]
call fcn.140013c40
movzx eax, byte [0x1400ebd19]
mov ecx, 0x21
mov edx, 1
call fcn.140013c30
test rax, rax
mov rcx, qword [rbp + 0x198]
je 0x14000dbb5
movzx edx, byte [rcx + 0x20]
mov byte [rax + 0x20], dl
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov qword [rsi], 0x21
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0x21
mov edx, 0x21
jmp 0x14000da2f
mov r8d, dword [rbp - 0x48]
xor r15d, r15d
mov ecx, 1
xor edx, edx
call sub.kernel32.dll_OpenProcess
mov r14, rax
lea rsi, [rbp - 0x48]
mov r12d, 0x832028b4
jmp 0x14000d7a0
mov r15d, 0x43a458dc
mov rcx, rdi
call r13
xor r12d, r15d
cmp r12d, 0x3ef317a9
jle 0x14000d7d0
cmp r12d, 0x3ef317aa
je 0x14000d791
cmp r12d, 0x483e0feb
jne 0x14000d80b
mov r15d, 0x76cd1841
mov rcx, r14
call r13
jmp 0x14000d79d
cmp r12d, 0x832028b4
je 0x14000d7fe
cmp r12d, 0x271938a9
jne 0x14000d79d
mov rcx, r14
mov edx, 1
call sub.kernel32.dll_TerminateProcess
mov r15d, 0x6f273742
test eax, eax
jne 0x14000d79d
jmp 0x14000d8b9
mov r15d, 0xa439101d
test r14, r14
jne 0x14000d79d
jmp 0x14000d82d
cmp r12d, 0x7d574f76
jne 0x14000d79d
mov rsi, qword [rbp + 0x158]
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x14000da19
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
mov qword [rbp + 0x138], rsi
lea rax, [0x140046050]
mov qword [rbp + 0x140], rax
lea rax, str.Failed_to_open_process_with_ID:_.
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x168], 2
mov qword [rbp + 0x180], 0
lea rax, [rbp + 0x138]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x178], 1
lea rcx, [rbp + 0x110]
lea rdx, [rbp + 0x160]
call fcn.14003df20
mov rax, qword [rbp + 0x120]
mov rsi, qword [rbp + 0x158]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp + 0x110]
jmp 0x14000da16
mov ebx, 0x17c67e86
xor r15d, r15d
jmp 0x14000d8df
mov r15d, 0x4ce48d4b
mov rcx, rdi
call r13
xor ebx, r15d
cmp ebx, 0x17c67e86
je 0x14000d900
cmp ebx, 0x2d20d1c6
je 0x14000d8d0
cmp ebx, 0x61c45c8d
jne 0x14000d8dc
jmp 0x14000d90e
mov r15d, 0x3ae6af40
mov rcx, r14
call r13
jmp 0x14000d8dc
mov qword [rbp + 0x138], rsi
lea rax, [0x140046050]
mov qword [rbp + 0x140], rax
lea rax, str.Failed_to_terminate_process_with_ID:
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x168], 2
mov qword [rbp + 0x180], 0
lea rax, [rbp + 0x138]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x178], 1
lea rcx, [rbp + 0xf8]
lea rdx, [rbp + 0x160]
call fcn.14003df20
mov rax, qword [rbp + 0x108]
mov rsi, qword [rbp + 0x158]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp + 0xf8]
jmp 0x14000da16
lea rax, [rbp + 0x128]
mov qword [rbp + 0x138], rax
lea rax, [0x140012380]
mov qword [rbp + 0x140], rax
lea rax, str.Process_with_name__not_found.
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x168], 2
mov qword [rbp + 0x180], 0
lea rax, [rbp + 0x138]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x178], 1
lea rcx, [rbp + 0xe0]
lea rdx, [rbp + 0x160]
call fcn.14003df20
mov rax, qword [rbp + 0xf0]
mov rsi, qword [rbp + 0x158]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp + 0xe0]
movups xmmword [rsi], xmm0
mov rcx, qword [rbp + 0x190]
mov byte [rcx], 0
mov rdx, qword [rbp + 0x198]
test rdx, rdx
je 0x14000da3a
mov r8d, 1
call fcn.140013c40
mov rax, rsi
add rsp, 0x228
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 1
mov edx, 0x1a
call fcn.14008d3c0
mov ecx, 1
mov edx, 0x1a
call fcn.14008d3c0
jmp 0x14000dbc4
movups xmm0, xmmword [rbp + 0x168]
mov qword [rbp + 0x160], 0x1a
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x170], 0x1a
movups xmmword [rbp + 0x178], xmm0
lea rax, str.src_prockill.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400914c0]
lea r9, [0x140091510]
lea r8, [rbp + 0x160]
mov edx, 0x2b
call fcn.14008d8b0
jmp 0x14000dbc4
mov ecx, 1
mov edx, 0x1a
call fcn.14008d3a0
jmp 0x14000dbc4
movups xmm0, xmmword [rbp + 0x138]
movups xmm1, xmmword [rbp + 0x148]
movaps xmmword [rbp + 0x170], xmm1
movaps xmmword [rbp + 0x160], xmm0
lea rax, str.src_prockill.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400914c0]
lea r9, [0x1400914f0]
lea r8, [rbp + 0x160]
mov edx, 0x2b
call fcn.14008d8b0
jmp 0x14000dbc4
mov ecx, 1
mov edx, 0x21
call fcn.14008d3c0
mov ecx, 1
mov edx, 0x21
call fcn.14008d3c0
jmp 0x14000dbc4
movups xmm0, xmmword [rbp + 0x168]
mov qword [rbp + 0x160], 0x21
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x170], 0x21
movups xmmword [rbp + 0x178], xmm0
lea rax, str.src_prockill.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400914c0]
lea r9, [0x140091510]
lea r8, [rbp + 0x160]
mov edx, 0x2b
call fcn.14008d8b0
jmp 0x14000dbc4
mov ecx, 1
mov edx, 0x21
call fcn.14008d3a0
ud2