Function at 0x140049b80
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x170
xor edx, edx
mov r14, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140049be6
lea rdx, str.Erro_ao_criar_snapshot_do_processo:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140059530
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140059700]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rsp, 0x170
pop r14
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], pe_nt_image_headers64
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x140049c12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Erro_ao_obter_informa
jmp 0x140049baa
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x1a0], r15
xor r15d, r15d
mov qword [rsp + 0x198], rdi
nop dword [rax]
xorps xmm0, xmm0
mov qword [rsp + 0x30], r15
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r15b
jne 0x140049c50
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.14003fae0
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x140049c75
mov rdx, qword [r14]
mov rsi, qword [rsp + 0x38]
lea rcx, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
cmp rsi, 0x10
mov r8, qword [rsp + 0x30]
cmovae rcx, rbx
cmp r8, qword [r14 + 0x10]
jne 0x140049ca5
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140049ca5
mov dil, 1
jmp 0x140049ca8
xor dil, dil
cmp rsi, 0x10
jb 0x140049cdb
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140049cd3
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049d10
mov rcx, rbx
call fcn.140139f2c
test dil, dil
je 0x140049cf8
mov r8d, dword [rsp + 0x48]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140049d17
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140049c30
jmp 0x140049d66
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x140049d5d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Erro_ao_encerrar_o_processo:
call fcn.140059530
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140059700]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov r15, qword [rsp + 0x1a0]
add rsp, 0x170
pop r14
pop rbp
pop rbx
ret