Function at 0x140001765
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
sub rsp, 0x1a8
lea rbp, [rsp + 0x80]
lea rcx, sym.__dyn_tls_init
lea rax, [rbp + 0xff]
mov qword [rbp + 0x100], rax
nop
nop
lea rdx, [rbp + 0xff]
lea rax, [rbp + 0xe0]
mov r9, rdx
mov r8, rcx
lea rdx, str.vmtoolsd.exe
mov rcx, rax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.vector_char_const_const__void__char_const_const__cha
lea rax, [rbp + 0xff]
mov rcx, rax
call method.std::__new_allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____.__new_allocator__
nop
lea rax, [rbp + 0xe0]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x118]
mov rcx, rax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.begin__
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0x118]
mov rcx, rax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.end__
mov qword [rbp + 0xd0], rax
jmp 0x1400018d5
lea rax, [rbp + 0xd8]
mov rcx, rax
call sym.__gnu_cxx::__normal_iterator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_________::operator___const
mov qword [rbp + 0x110], rax
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0x108], 0xffffffffffffffff
jne 0x14000183f
mov ebx, 0
jmp 0x1400018f8
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x108]
mov rcx, rax
call sym.Process32First
test eax, eax
setne al
test al, al
je 0x1400018b3
lea rax, [rbp - 0x60]
lea rdx, [rax + 0x2c]
mov rax, qword [rbp + 0x110]
mov rcx, rax
call method.bool_std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
test al, al
je 0x140001897
mov rax, qword [rbp + 0x108]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ebx, 1
jmp 0x1400018f8
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x108]
mov rcx, rax
call sym.Process32Next
test eax, eax
setne al
test al, al
jne 0x140001862
mov rax, qword [rbp + 0x108]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0xd8]
mov rcx, rax
call sym.__gnu_cxx::__normal_iterator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_________::operator__
lea rdx, [rbp + 0xd0]
lea rax, [rbp + 0xd8]
mov rcx, rax
call sym._ZN9__gnu_cxxneIPNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt6vectorIS6_SaIS6_EEEEbRKNS_17__normal_iteratorIT_T0_EES
test al, al
jne 0x1400017ff
mov ebx, 0
lea rax, [rbp + 0xe0]
mov rcx, rax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.vector__
mov eax, ebx
jmp 0x140001946
add rsp, 0x1a8
pop rbx
pop rbp
ret