Function at 0x140046ba0
Capabilities:
Enumerate processes
Execute command

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140064028]
xor rax, rsp
mov qword [rbp + 0x170], rax
cmp qword [0x140064248], 0
movabs r15, 0x7ffffffffa0a1efe
movabs r14, 0x7fffffffffffffff
jne 0x140046cbf
nop dword [rax]
lea rcx, [0x140059f88]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.please_start
call fcn.1400512a0
mov rdx, qword [str.project8.exe]
mov rcx, rax
call fcn.140051500
mov rcx, rax
lea rdx, [0x140054908]
call fcn.1400512a0
lea rdx, [0x1400516d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.deadlock
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140064248], rax
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140046c72
imul rax, rax, 0x64
jmp 0x140046c90
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jg 0x140046ca2
add rax, 0x5f5e100
mov qword [rsp + 0x20], rax
jmp 0x140046ca7
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
call fcn.140051ca0
cmp qword [0x140064248], 0
je 0x140046bf0
cmp dword [0x140064250], 0xffffffff
jne 0x140046de9
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x2a8], rdi
nop dword [rax]
mov rsi, qword [str.project8.exe]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov edi, 0xffffffff
cmp rax, 0xffffffffffffffff
je 0x140046d69
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140046d60
nop word [rax + rax]
lea rax, [rsp + 0x5c]
mov r8, rsi
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140046d44
add rax, 2
test ecx, ecx
jne 0x140046d30
test edx, edx
je 0x140046d5c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140046d20
jmp 0x140046d60
mov edi, dword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x140064250], edi
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140046d8d
imul rax, rax, 0x64
jmp 0x140046dab
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jg 0x140046dbd
add rax, 0x5f5e100
mov qword [rsp + 0x20], rax
jmp 0x140046dc2
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
call fcn.140051ca0
cmp dword [0x140064250], 0xffffffff
je 0x140046ce0
mov rdi, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2a0]
mov rcx, qword [0x140064270]
test rcx, rcx
jne 0x140046e88
nop dword [rax]
mov r8d, dword [0x140064250]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140064270], rax
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140046e39
imul rax, rax, 0x64
jmp 0x140046e57
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jg 0x140046e69
add rax, 0x5f5e100
mov qword [rsp + 0x20], rax
jmp 0x140046e6e
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
call fcn.140051ca0
mov rcx, qword [0x140064270]
test rcx, rcx
je 0x140046e00
cmp qword [0x140064258], 0
jne 0x140046f26
nop word [rax + rax]
mov rdx, qword [str.project8.exe]
call fcn.1400011d0
mov qword [0x140064258], rax
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140046ed1
imul rax, rax, 0x64
jmp 0x140046eef
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jg 0x140046f01
add rax, 0x5f5e100
mov qword [rsp + 0x20], rax
jmp 0x140046f06
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
call fcn.140051ca0
cmp qword [0x140064258], 0
jne 0x140046f26
mov rcx, qword [0x140064270]
jmp 0x140046ea0
cmp qword [0x140064260], 0
jne 0x140046fc0
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [0x140064250]
mov rcx, qword [str.client.dll]
call fcn.1400013a0
mov qword [0x140064260], rax
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140046f77
imul rax, rax, 0x64
jmp 0x140046f95
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jg 0x140046fa7
add rax, 0x5f5e100
mov qword [rsp + 0x20], rax
jmp 0x140046fac
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
call fcn.140051ca0
cmp qword [0x140064260], 0
je 0x140046f40
cmp qword [0x140064268], 0
jne 0x140047050
nop
mov edx, dword [0x140064250]
mov rcx, qword [str.engine2.dll]
call fcn.1400013a0
mov qword [0x140064268], rax
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140047007
imul rax, rax, 0x64
jmp 0x140047025
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jg 0x140047037
add rax, 0x5f5e100
mov qword [rsp + 0x20], rax
jmp 0x14004703c
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
call fcn.140051ca0
cmp qword [0x140064268], 0
je 0x140046fd0
lea rcx, [0x140059f88]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov al, 1
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400522a0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop r15
pop r14
pop rbp
ret