Function at 0x140001810
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140012028]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rsi, rdx
movsxd r15, ecx
xor edi, edi
mov qword [0x140012b10], rdi
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
dec rax
lea ebx, [rdi + 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001bb9
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140001bb9
lea rdx, str.NtGdiGetDhpdev
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140012b10], rax
test rax, rax
je 0x140001bb9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r14d, eax
test eax, eax
je 0x140001bb9
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 9
mov r10, qword [0x140012b10]
movabs r12, 0x476f832a47
mov r9, r12
lea r8, [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call r10
test eax, eax
js 0x140001bb9
cmp qword [rsp + 0x40], rdi
je 0x140001bb9
mov dword [rsp + 0x70], 0x83758239
mov dword [rsp + 0x74], edi
mov dword [rsp + 0x38], r14d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 4
lea rax, [rsp + 0x20]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov r9, r12
lea r8, [rsp + 0x60]
xor edx, edx
xor ecx, ecx
call qword [0x140012b10]
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x74], eax
jne 0x140001bb9
cmp r15d, 3
jge 0x1400019b3
lea rcx, str.Too_few_arguments__nCurrent_arguments:_n
call fcn.140001fa0
test r15d, r15d
jle 0x14000199c
nop dword [rax]
mov r8, qword [rsi + rdi*8]
mov edx, ebx
lea rcx, str.__d___ls_n
call fcn.140001fa0
inc ebx
inc rdi
cmp rdi, r15
jl 0x140001980
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov eax, 2
jmp 0x140001bd4
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1400019d1
imul rbx, rax, 0x64
jmp 0x1400019ed
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
lea rdx, [rsi + 0x10]
lea rcx, [rsp + 0x20]
call fcn.140001c00
nop
mov r14, qword [rsi + 8]
test r14, r14
je 0x140001a94
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140001a94
mov dword [rbp - 0x80], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x7c]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001a8b
nop word [rax + rax]
test edi, edi
jne 0x140001a7a
lea rax, [rbp - 0x54]
mov r8, r14
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140001a74
add rax, 2
test ecx, ecx
jne 0x140001a60
test edx, edx
cmove edi, dword [rbp - 0x78]
lea rdx, [rbp - 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001a50
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.140008af0
test al, al
sete dil
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140001aeb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ae6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ae6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b5ac
test dil, dil
je 0x140001b13
lea rcx, str._nMapper_failed__n
call fcn.140001fa0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov eax, 3
jmp 0x140001bd4
movabs rsi, 0x20c49ba5e353f7cf
mov rax, rsi
imul rbx
mov rbx, rdx
sar rbx, 7
mov rax, rbx
shr rax, 0x3f
add rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x140001b52
imul rcx, rax, 0x64
jmp 0x140001b70
cqo
idiv rdi
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
imul rcx, r8, 0x3b9aca00
add rcx, rax
mov rax, rsi
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
sub rdx, rbx
xorps xmm1, xmm1
cvtsi2sd xmm1, rdx
mulsd xmm1, qword [0x14000e928]
movq rdx, xmm1
lea rcx, str._nTotal_injection_time:__.2lfms_n
call fcn.140001fa0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
xor eax, eax
jmp 0x140001bd4
lea rcx, str.Protected_process_initialization_failed__n
call fcn.140001fa0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov eax, ebx
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14000b560
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret