Function at 0x140066810
Capabilities:
Allocate or change rwx memory
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3a0
mov r13, r9
mov r12, r8
mov rdi, rdx
mov r14, rcx
call fcn.140065d50
mov r15, rax
test rax, rax
je 0x140066abb
xor esi, esi
xor ebx, ebx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400668ce
nop word [rax + rax]
mov r8d, 0x104
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x290]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
mov rdx, r15
lea rcx, [rsp + 0x290]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x1400668bc
mov eax, dword [rsp + 0x6c]
cmp eax, ebx
jbe 0x1400668bc
mov ebx, eax
mov esi, dword [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140066880
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x140066abb
mov dword [r14], esi
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r14 + 8], rax
test rax, rax
je 0x140066abb
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov rbp, rax
test eax, eax
jg 0x140066916
xor bl, bl
jmp 0x140066a5e
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 0
lea r8, [rsp + 0x38]
mov rdx, r12
mov rcx, r14
call fcn.140066b10
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
cmp rbx, rsi
jne 0x14006698c
test rbx, rbx
je 0x140066985
mov rdx, qword [rsp + 0x48]
sub rdx, rbx
and rdx, 0xfffffffffffffff8
mov rax, rbx
cmp rdx, 0x1000
jb 0x14006697d
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066a4d
mov rcx, rbx
call fcn.1400c36f8
xor bl, bl
jmp 0x140066a5e
xor r12d, r12d
sub rsi, rbx
sar rsi, 3
test rsi, rsi
je 0x140066a1b
movsxd rbp, ebp
mov r15, rbx
nop word [rax + rax]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, rbp
mov rdx, qword [r15]
mov rcx, qword [r14 + 8]
call qword [sym.imp.ntdll.dll_ZwProtectVirtualMemory]
mov qword [rsp + 0x20], 0
mov r9, rbp
mov r8, r13
mov rdx, qword [r15]
mov rcx, qword [r14 + 8]
call qword [sym.imp.ntdll.dll_ZwWriteVirtualMemory]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov r8, rbp
mov rdx, qword [r15]
mov rcx, qword [r14 + 8]
call qword [sym.imp.ntdll.dll_ZwProtectVirtualMemory]
inc r12d
lea r15, [r15 + 8]
movsxd rax, r12d
cmp rax, rsi
jb 0x1400669b0
test rbx, rbx
je 0x140066a5c
mov rdx, qword [rsp + 0x48]
sub rdx, rbx
and rdx, 0xfffffffffffffff8
mov rax, rbx
cmp rdx, 0x1000
jb 0x140066a54
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140066a54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400c36f8
mov bl, 1
cmp qword [rdi + 0x18], 0xf
jbe 0x140066a68
mov rdi, qword [rdi]
lea rax, str.aplicado
lea rcx, str.falha_ao_aplicar
test bl, bl
cmovne rcx, rax
mov qword [rsp + 0x20], rcx
mov r9, rdi
lea r8, str._s____s
mov edx, 0xff
lea rcx, [0x140167ee6]
call fcn.14004ede0
mov edx, Ordinal_301
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
jmp 0x140066ae2
cmp qword [rdi + 0x18], 0xf
jbe 0x140066ac5
mov rdi, qword [rdi]
mov r9, rdi
lea r8, str._s___Erro:_Processo_n
mov edx, 0xff
lea rcx, [0x140167ee6]
call fcn.14004ede0
xor al, al
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret