Function at 0x140032c90
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x14009a0a0]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x70], rdx
mov rax, qword [rdx]
cmp rax, qword [rdx + 8]
jne 0x140032dc6
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0x29
jb 0x1400335ab
mov rax, rsi
cmp qword [rsi + 0x18], 8
jb 0x140032cff
mov rax, qword [rsi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x29
lea r9, str.Error:_No_running_process_with_the_name:
lea rcx, [rbp - 0x80]
call fcn.14000a3f0
cmp byte [0x14009d9ba], 0
je 0x140032d3f
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140032d80
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032d7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400335b1
call fcn.140040d10
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x140032dbf
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140032dba
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003359f
mov rcx, r8
call fcn.140040d10
xor ebx, ebx
jmp 0x1400330cd
mov edi, dword [rax]
lea r9, [rbp + 0x35]
mov r8d, edi
nop
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140032dd0
xor ebx, ebx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], bl
lea rax, [rbp + 0x35]
cmp r9, rax
je 0x140032e2c
lea r8, [rbp + 0x35]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x60]
call fcn.140007ec0
nop
mov r9d, 0x18
lea r8, str.Process_PID_to_inspect:
lea rcx, [rbp - 0x60]
call fcn.14000b550
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x80]
call fcn.140030470
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140032eb1
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032eac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400335b7
call fcn.140040d10
mov edx, 0x100000
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
jne 0x140032fcb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r10, [rbp + 0x35]
dec r10
mov eax, 0xcccccccd
mul r9d
shr edx, 3
movzx ecx, dl
shl cl, 2
lea r8d, [rcx + rdx]
add r8b, r8b
sub r9b, r8b
add r9b, 0x30
mov byte [r10], r9b
mov r9d, edx
test edx, edx
jne 0x140032ee1
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], dl
lea rax, [rbp + 0x35]
cmp r10, rax
je 0x140032f3d
lea r8, [rbp + 0x35]
sub r8, r10
mov rdx, r10
lea rcx, [rbp - 0x60]
call fcn.140007ec0
nop
mov r9d, 0x39
lea r8, str.Error:_Unable_to_allocate_memory_for_process_list._Code:
lea rcx, [rbp - 0x60]
call fcn.14000b550
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x80]
call fcn.140030470
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14003308e
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032fc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400335bd
call fcn.140040d10
jmp 0x14003308e
mov r15, r12
xor r9d, r9d
mov r8d, 0x100000
mov rdx, r12
lea ecx, [r9 + 5]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x14003312b
mov edx, eax
lea rcx, [rbp - 0x20]
call fcn.140001f60
nop
mov r9d, 0x24
lea r8, str.Error:_Unable_to_query_process_list
mov rcx, rax
call fcn.14000b550
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x80]
call fcn.140030470
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14003307c
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033077
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400335c3
call fcn.140040d10
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x1400330cd
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x1400330c8
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003359f
mov rcx, r8
call fcn.140040d10
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
mov rcx, qword [r14]
test rcx, rcx
je 0x140033124
mov rdx, qword [r14 + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140033114
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400335a5
mov rcx, r8
call fcn.140040d10
mov qword [r14], rbx
mov qword [r14 + 8], rbx
mov qword [r14 + 0x10], rbx
xor al, al
jmp 0x140033204
xor r13b, r13b
cmp dword [r12], 0
je 0x14003357d
nop dword [rax]
cmp dword [r15 + 0x50], edi
je 0x14003322b
mov eax, dword [r15]
add r15, rax
cmp dword [r15], 0
jne 0x140033140
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor dil, dil
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x1400331a9
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400331a4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003359f
mov rcx, r8
call fcn.140040d10
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
mov rcx, qword [r14]
test rcx, rcx
je 0x140033200
mov rdx, qword [r14 + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x1400331f0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400335a5
mov rcx, r8
call fcn.140040d10
mov qword [r14], rbx
mov qword [r14 + 8], rbx
mov qword [r14 + 0x10], rbx
movzx eax, dil
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.140040cf0
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r13d, dword [r15 + 4]
lea r9, [rbp + 0x35]
mov r8d, r13d
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140033240
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], dl
lea rax, [rbp + 0x35]
cmp r9, rax
je 0x14003329a
lea r8, [rbp + 0x35]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x80]
call fcn.140007ec0
nop
lea r9, [rbp + 0x15]
nop
dec r9
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r9], dil
mov edi, edx
test edx, edx
jne 0x1400332a0
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], dl
lea rax, [rbp + 0x15]
cmp r9, rax
je 0x1400332f8
lea r8, [rbp + 0x15]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x60]
call fcn.140007ec0
nop
mov r9d, 0xe
lea r8, str.Found_process
lea rcx, [rbp - 0x60]
call fcn.14000b550
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 6
lea rdx, str._with
lea rcx, [rbp - 0x40]
call fcn.140008020
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp - 0x80]
lea r8, [rbp]
lea rcx, [rbp - 0x20]
call fcn.14000a530
nop
mov r8d, 8
lea rdx, str._threads
lea rcx, [rbp - 0x20]
call fcn.140008020
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
call fcn.140030470
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140033409
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033404
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400335c9
call fcn.140040d10
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140033455
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003344f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400335cf
call fcn.140040d10
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140033490
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003348b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400335d5
call fcn.140040d10
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1400334db
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400334d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400335db
call fcn.140040d10
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140033526
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033521
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400335e1
call fcn.140040d10
mov eax, 1
cmp r13d, eax
jb 0x140033579
add r15, 0x148
nop word [rax + rax]
cmp dword [r15 - 4], 5
jne 0x140033156
cmp dword [r15], 5
jne 0x140033156
add r15, 0x50
inc eax
cmp eax, r13d
jbe 0x140033540
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dil, 1
jmp 0x14003316a
movzx r13d, al
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r13b, r13b
je 0x140033167
mov dil, 1
jmp 0x14003316a
call fcn.140053844
nop
call fcn.140053844
nop
call fcn.140001380
int3
call fcn.140053844
int3
call fcn.140053844
int3
call fcn.140053844
int3
call fcn.140053844
nop
call fcn.140053844
nop
call fcn.140053844
nop
call fcn.140053844
nop
call fcn.140053844
nop
call fcn.140053844
int3