Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Enumerate processes
Enumerate threads
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x760
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000121b
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000106f
lea rdx, [rsp + 0x7c]
lea rcx, str.explorer.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14000106b
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001041
jmp 0x14000106f
mov ebx, dword [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x14000121b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.PID_:
mov qword [rsp + 0x778], rsi
call fcn.1400012d0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400014a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, ebx
mov dword [rsp + 0x2c0], 0x10000b
xor edx, edx
mov dword [rsp + 0x30], 0x1c
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x140001120
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.OpenProcess_faild_
call fcn.1400012d0
mov rcx, rax
lea rdx, [0x1400014a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea eax, [rsi - 2]
mov rsi, qword [rsp + 0x778]
mov rbx, qword [rsp + 0x788]
add rsp, 0x760
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x770], rbp
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
mov r8d, 0x114
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 0x114
mov qword [rsp + 0x20], 0
mov rdx, rax
lea r8, [0x140005040]
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1400011a8
nop dword [rax]
cmp ebx, dword [rsp + 0x3c]
je 0x140001204
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140001190
mov rbx, qword [rsp + 0x780]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, [rsp + 0x290]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rdx, [rsp + 0x290]
mov qword [rsp + 0x388], rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x770]
xor eax, eax
jmp 0x140001107
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
jmp 0x1400011b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.PID_not_found
call fcn.1400012d0
mov rcx, rax
lea rdx, [0x1400014a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [rsp + 0x788]
mov eax, 0xffffffff
add rsp, 0x760
pop rdi
ret