Function at 0x14001f267
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140027840
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x698
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x10a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x6b8]
mov rax, qword [0x140069040]
xor rax, rbp
mov qword [rbp + 0x650], rax
lea rcx, [0x140072106]
call fcn.14001fb2c
nop
mov dword [rbp + 4], 0
xor edx, edx
mov ecx, 2
call fcn.14001f555
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
jne 0x1400278af
xor al, al
jmp 0x140027cf9
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.14001f6fe
test eax, eax
je 0x1400278f5
lea rdx, str.javaw.exe
lea rcx, [rbp + 0x7c]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x1400278e4
mov eax, dword [rbp + 0x58]
mov dword [rbp + 4], eax
jmp 0x1400278f5
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.14001f9d3
test eax, eax
jne 0x1400278c7
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [rbp + 4], 0
jne 0x14002790d
xor al, al
jmp 0x140027cf9
mov r8d, dword [rbp + 4]
xor edx, edx
mov ecx, 0x430
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, qword [rbp + 0x680]
mov qword [rcx], rax
mov rax, qword [rbp + 0x680]
cmp qword [rax], 0
jne 0x14002797d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x644], eax
lea rdx, [0x140061a38]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001f140
mov ecx, dword [rbp + 0x644]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14001f073]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
xor al, al
jmp 0x140027cf9
mov edx, 0x20
lea rcx, [rbp + 0x2a8]
call fcn.14001f0aa
lea rcx, [rbp + 0x5f4]
call fcn.14001f53c
mov r8, rax
mov edx, 0x100000
lea rcx, [rbp + 0x2a8]
call fcn.14001f6b3
nop
movabs rax, 0x4c0000000
mov qword [rbp + 0x338], rax
mov r9d, 0x30
lea r8, [rbp + 0x2e8]
mov rdx, qword [rbp + 0x338]
mov rax, qword [rbp + 0x680]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x140027cce
cmp dword [rbp + 0x308], 0x1000
jne 0x140027cae
cmp dword [rbp + 0x30c], 0x20
je 0x140027a25
cmp dword [rbp + 0x30c], 0x40
je 0x140027a25
cmp dword [rbp + 0x30c], 4
je 0x140027a25
cmp dword [rbp + 0x30c], 2
jne 0x140027cae
lea rdx, [0x140061ab8]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001f140
lea rdx, str.__
mov rcx, rax
call fcn.14001f140
lea rdx, [0x14001fa4b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [rbp + 0x2e8]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x14001f019]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov dl, 0xa
mov rcx, rax
call fcn.14001f8ac
lea rdx, [0x140061a78]
mov rcx, rax
call fcn.14001f140
mov rdx, qword [rbp + 0x300]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x140061a6c]
mov rcx, rax
call fcn.14001f140
nop
mov qword [rbp + 0x358], 0
jmp 0x140027ad1
mov rax, qword [rbp + 0x358]
add rax, 0x100000
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x300]
cmp qword [rbp + 0x358], rax
jae 0x140027cae
mov rax, qword [rbp + 0x358]
mov rcx, qword [rbp + 0x300]
sub rcx, rax
mov rax, rcx
cmp rax, 0x100000
jbe 0x140027b0e
mov qword [rbp + 0x648], 0x100000
jmp 0x140027b29
mov rax, qword [rbp + 0x358]
mov rcx, qword [rbp + 0x300]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x648], rax
mov rax, qword [rbp + 0x648]
mov qword [rbp + 0x378], rax
lea rcx, [rbp + 0x2a8]
call fcn.14001fc0d
mov rcx, qword [rbp + 0x358]
mov rdx, qword [rbp + 0x2e8]
add rdx, rcx
mov rcx, rdx
lea rdx, [rbp + 0x398]
mov qword [rsp + 0x20], rdx
mov r9, qword [rbp + 0x378]
mov r8, rax
mov rdx, rcx
mov rax, qword [rbp + 0x680]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140027c0b
mov rax, qword [rbp + 0x358]
mov rcx, qword [rbp + 0x2e8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x648], rax
lea rcx, [rbp + 0x2a8]
call fcn.14001fc0d
mov rcx, qword [rbp + 0x648]
mov r9, rcx
mov r8, qword [rbp + 0x398]
mov rdx, rax
mov rcx, qword [rbp + 0x680]
call fcn.14001f11d
movzx eax, al
test eax, eax
je 0x140027c06
mov rax, qword [rbp + 0x680]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov byte [rbp + 0x614], 1
lea rcx, [rbp + 0x2a8]
call fcn.14001f35c
movzx eax, byte [rbp + 0x614]
jmp 0x140027cf9
jmp 0x140027ca9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x644], eax
mov rcx, qword [rbp + 0x358]
mov rdx, qword [rbp + 0x2e8]
add rdx, rcx
mov rcx, rdx
mov qword [rbp + 0x648], rcx
lea rdx, [0x140061af0]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001f140
lea rdx, [0x14001fa4b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, qword [rbp + 0x648]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x140061ad8]
mov rcx, rax
call fcn.14001f140
mov ecx, dword [rbp + 0x644]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14001f019]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
lea rdx, [0x14001f073]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x140027abd
mov rax, qword [rbp + 0x300]
mov rcx, qword [rbp + 0x2e8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x338], rax
jmp 0x1400279c0
mov rax, qword [rbp + 0x680]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov byte [rbp + 0x634], 0
lea rcx, [rbp + 0x2a8]
call fcn.14001f35c
movzx eax, byte [rbp + 0x634]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140060790]
call fcn.14001f974
mov rax, rdi
mov rcx, qword [rbp + 0x650]
xor rcx, rbp
call fcn.14001f578
lea rsp, [rbp + 0x668]
pop rdi
pop rbp
ret