Function at 0x140002570
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rsp + 0x180], rax
call fcn.140001300
mov rsi, rax
test rax, rax
jne 0x1400025d4
lea rcx, str.No_Dll_Found_n
call fcn.140001020
lea rcx, str.Press_Enter_To_Exit_n
call fcn.140001020
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
jmp 0x14000287a
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
xor r8d, r8d
lea rdx, [0x1400054e8]
lea rcx, [rsp + 0x28]
call fcn.140002ed0
nop
lea rdx, str.Enter_Target_Proccess__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002ae0
lea rdx, [rsp + 0x28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140002cf0
lea rbp, [rsp + 0x28]
mov r14, qword [rsp + 0x28]
mov r15, qword [rsp + 0x40]
cmp r15, 0x10
cmovae rbp, r14
xor edx, edx
mov r8d, 0x12c
lea rcx, [rsp + 0x54]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x50], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000267b
lea rcx, str.CreateToolhelp32Snapshot_failed_
call fcn.140001020
lea rbx, str.LastError_:_0x_x_n
jmp 0x140002710
xor ebx, ebx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400026cc
nop
mov rax, rbp
lea r8, [rsp + 0x7c]
sub r8, rbp
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400026b3
inc rax
test ecx, ecx
jne 0x1400026a0
test edx, edx
cmove ebx, dword [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140002690
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
lea rcx, str.Program_PID:__d_n_n
call fcn.140001020
mov r8d, ebx
xor edx, edx
mov ecx, 0x42a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140002725
mov edx, ebx
lea rcx, str.Could_not_open_Process_for_PID__d_n
call fcn.140001020
lea rbx, str.LastError_:_0X_x_n
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140001020
jmp case.0x1400027d0.6
lea rcx, [0x140005c3c]
call fcn.140001020
lea rcx, str.___1__CreateRemoteThread_n
call fcn.140001020
lea rcx, str.___2__NtCreateThread_n
call fcn.140001020
lea rcx, str.___3__QueueUserAPC_n
call fcn.140001020
lea rcx, str.___4__SetWindowsHookEx_n
call fcn.140001020
lea rcx, str.___5__RtlCreateUserThread_n
call fcn.140001020
lea rcx, str.___6__Exit_n
call fcn.140001020
lea rcx, [0x140005c3c]
call fcn.140001020
mov dword [rsp + 0x20], 0
lea rdx, str.Choose_Injection_Method__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002ae0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rsp + 0x20]
dec eax
cmp eax, 5
ja case.default.0x1400027d0
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x28ac]
add rcx, rdx
jmp rcx
mov rdx, rdi
mov rcx, rsi
call fcn.140001d30
jmp 0x140002821
mov rdx, rdi
mov rcx, rsi
call fcn.140001850
jmp 0x140002821
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call fcn.140002280
jmp 0x140002821
mov rdx, rsi
mov ecx, ebx
call fcn.140001b20
jmp 0x140002821
mov rdx, rsi
mov rcx, rdi
call fcn.140001f70
jmp 0x140002821
lea rcx, str.Choose_a_valid_mathod_n
call fcn.140001020
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne case.0x1400027d0.6
lea rcx, str.Cant_Terminate_Proccess
call fcn.140001020
nop
cmp r15, 0x10
jb 0x14000287a
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140002872
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002872
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.140003214
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400031b0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret