Function at 0x140001180
Capabilities:
Enumerate processes
Execute command
Set console window title

Disassembly:
sub rsp, 0x298
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rcx, [0x1400033b0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n_n_____We_are_waiting_for_process_RustClient.exe
call fcn.140001410
cmp dword [0x14000570c], 0
jne 0x1400013b0
mov qword [rsp + 0x2a0], rbx
mov qword [rsp + 0x2a8], rbp
xor ebp, ebp
mov qword [rsp + 0x2b0], rsi
mov qword [rsp + 0x290], rdi
nop dword [rax + rax]
mov ecx, 0x20
mov qword [rsp + 0x28], rbp
call fcn.140001690
movups xmm0, xmmword [str.dota2.exe]
xor edx, edx
mov qword [rsp + 0x20], rax
mov rsi, rax
mov qword [rsp + 0x30], 9
movups xmmword [rax], xmm0
movzx ecx, word [0x140003408]
mov word [rax + 0x10], cx
mov ecx, 2
mov qword [rsp + 0x38], 0xf
mov word [rax + 0x12], bp
mov dword [rsp + 0x40], 0x238
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000125b
mov dword [0x14000570c], ebp
jmp 0x140001377
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rax, [rsp + 0x6c]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], bp
jne 0x140001275
mov r8d, 9
lea rcx, [rsp + 0x6c]
cmp rdx, r8
cmovb r8, rdx
test r8, r8
je 0x1400012b3
lea rax, [rsp + 0x6c]
mov rbx, rsi
sub rbx, rax
movzx eax, word [rcx]
cmp word [rbx + rcx], ax
jne 0x1400012c8
add rcx, 2
sub r8, 1
jne 0x1400012a0
lea rcx, [rsp + 0x6c]
mov rbx, rsi
sub rbx, rcx
cmp rdx, 9
je 0x140001364
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140001353
lea rax, [rsp + 0x6c]
mov r9, rsi
sub r9, rax
nop word [rax + rax]
lea rax, [rsp + 0x6c]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], bp
jne 0x140001300
mov r8d, 9
lea rax, [rsp + 0x6c]
cmp rdx, r8
cmovb r8, rdx
test r8, r8
je 0x140001334
movzx ecx, word [rax]
cmp word [rax + r9], cx
jne 0x14000133c
add rax, 2
sub r8, 1
jne 0x140001320
cmp rdx, 9
ja 0x14000133c
jae 0x140001364
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140001353
mov r9, rbx
jmp 0x1400012f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x14000570c], ebp
jmp 0x140001377
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
mov dword [0x14000570c], eax
mov edx, 0x20
mov rcx, rsi
call fcn.1400016cc
cmp dword [0x14000570c], ebp
je 0x1400011f0
mov rdi, qword [rsp + 0x290]
mov rsi, qword [rsp + 0x2b0]
mov rbp, qword [rsp + 0x2a8]
mov rbx, qword [rsp + 0x2a0]
lea rcx, [0x14000340c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0xc8
mov ecx, 0x5c8
call qword [sym.imp.KERNEL32.dll_Beep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n_n__x__Driver_is_not_into_your_system__Inject_have_been_failed
call fcn.140001410
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140001670
add rsp, 0x298
ret