Function at 0x14003f4f0
Capabilities:
Enumerate processes
Execute command

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140055040]
xor rax, rsp
mov qword [rbp + 0x170], rax
cmp qword [0x140055248], 0
movabs r13, 0x7ffffffffa0a1efe
movabs r12, 0x7fffffffffffffff
movabs r14, 0x4e94914effff
movabs r15, 0x431bde82d7b634db
jne 0x14003f649
nop dword [rax]
nop dword [rax + rax]
lea rcx, [0x14004c5e8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.please_start
call fcn.1400447c0
mov rdx, qword [str.cs2.exe]
mov rcx, rax
call fcn.140044a30
mov rcx, rax
lea rdx, [0x140047858]
call fcn.1400447c0
lea rdx, [0x140044c10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.Counter_Strike_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rcx, [rsp + 0x20]
mov qword [0x140055248], rax
call fcn.14003f410
mov rax, qword [rsp + 0x20]
lea rbx, [rax + 0x5f5e100]
cmp rax, r13
jle 0x14003f5e2
mov rbx, r12
lea rcx, [rsp + 0x28]
call fcn.14003f410
mov rax, qword [rsp + 0x28]
cmp rbx, rax
je 0x14003f63b
jl 0x14003f63b
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jg 0x14003f62f
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14003f626
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x14003f5e2
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x14003f5e2
cmp qword [0x140055248], 0
je 0x14003f560
cmp dword [0x140055250], 0xffffffff
jne 0x14003f7e6
mov qword [rsp + 0x2b0], rsi
mov qword [rsp + 0x2b8], rdi
nop word [rax + rax]
lea rcx, [0x14004c5e8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.trying_to_get_process_id_of_
call fcn.1400447c0
mov rdx, qword [str.cs2.exe]
mov rcx, rax
call fcn.140044a30
mov rcx, rax
lea rdx, [0x14004c614]
call fcn.1400447c0
lea rdx, [0x140044c10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rsi, qword [str.cs2.exe]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov edi, 0xffffffff
cmp rax, 0xffffffffffffffff
je 0x14003f749
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003f740
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r8, rsi
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14003f724
add rax, 2
test ecx, ecx
jne 0x14003f710
test edx, edx
je 0x14003f73c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003f700
jmp 0x14003f740
mov edi, dword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x28]
mov dword [0x140055250], edi
call fcn.14003f410
mov rax, qword [rsp + 0x28]
lea rbx, [rax + 0x5f5e100]
cmp rax, r13
jle 0x14003f770
mov rbx, r12
nop dword [rax]
lea rcx, [rsp + 0x20]
call fcn.14003f410
mov rax, qword [rsp + 0x20]
cmp rbx, rax
je 0x14003f7c9
jl 0x14003f7c9
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jg 0x14003f7bd
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14003f7b4
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x14003f770
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x14003f770
cmp dword [0x140055250], 0xffffffff
je 0x14003f670
mov rdi, qword [rsp + 0x2b8]
mov rsi, qword [rsp + 0x2b0]
cmp qword [0x140055270], 0
jne 0x14003f8f7
nop dword [rax]
nop dword [rax + rax]
lea rcx, [0x14004c5e8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.trying_to_get_process_handle_of_
call fcn.1400447c0
mov rdx, qword [str.cs2.exe]
mov rcx, rax
call fcn.140044a30
mov rcx, rax
lea rdx, [0x14004c614]
call fcn.1400447c0
lea rdx, [0x140044c10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, dword [0x140055250]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, [rsp + 0x28]
mov qword [0x140055270], rax
call fcn.14003f410
mov rax, qword [rsp + 0x28]
lea rbx, [rax + 0x5f5e100]
cmp rax, r13
jle 0x14003f890
mov rbx, r12
nop word [rax + rax]
lea rcx, [rsp + 0x20]
call fcn.14003f410
mov rax, qword [rsp + 0x20]
cmp rbx, rax
je 0x14003f8e9
jl 0x14003f8e9
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jg 0x14003f8dd
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14003f8d4
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x14003f890
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x14003f890
cmp qword [0x140055270], 0
je 0x14003f800
cmp qword [0x140055258], 0
jne 0x14003f9fd
nop word [rax + rax]
lea rcx, [0x14004c5e8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.trying_to_get_process_base_of_
call fcn.1400447c0
mov rdx, qword [str.cs2.exe]
mov rcx, rax
call fcn.140044a30
mov rcx, rax
lea rdx, [0x14004c614]
call fcn.1400447c0
lea rdx, [0x140044c10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, qword [str.cs2.exe]
mov rcx, qword [0x140055270]
call fcn.1400011d0
lea rcx, [rsp + 0x28]
mov qword [0x140055258], rax
call fcn.14003f410
mov rax, qword [rsp + 0x28]
lea rbx, [rax + 0x5f5e100]
cmp rax, r13
jle 0x14003f996
mov rbx, r12
lea rcx, [rsp + 0x20]
call fcn.14003f410
mov rax, qword [rsp + 0x20]
cmp rbx, rax
je 0x14003f9ef
jl 0x14003f9ef
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jg 0x14003f9e3
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14003f9da
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x14003f996
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x14003f996
cmp qword [0x140055258], 0
je 0x14003f910
cmp qword [0x140055260], 0
jne 0x14003fafc
nop dword [rax + rax]
lea rcx, [0x14004c5e8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.trying_to_get_process_base_of_
call fcn.1400447c0
mov rdx, qword [str.client.dll]
mov rcx, rax
call fcn.140044a30
mov rcx, rax
lea rdx, [0x14004c614]
call fcn.1400447c0
lea rdx, [0x140044c10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov edx, dword [0x140055250]
mov rcx, qword [str.client.dll]
call fcn.1400013a0
lea rcx, [rsp + 0x28]
mov qword [0x140055260], rax
call fcn.14003f410
mov rax, qword [rsp + 0x28]
lea rbx, [rax + 0x5f5e100]
cmp rax, r13
jle 0x14003fa95
mov rbx, r12
lea rcx, [rsp + 0x20]
call fcn.14003f410
mov rax, qword [rsp + 0x20]
cmp rbx, rax
je 0x14003faee
jl 0x14003faee
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jg 0x14003fae2
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14003fad9
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x14003fa95
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x14003fa95
cmp qword [0x140055260], 0
je 0x14003fa10
cmp qword [0x140055268], 0
jne 0x14003fbfc
nop word [rax + rax]
lea rcx, [0x14004c5e8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.trying_to_get_process_base_of_
call fcn.1400447c0
mov rdx, qword [str.engine2.dll]
mov rcx, rax
call fcn.140044a30
mov rcx, rax
lea rdx, [0x14004c614]
call fcn.1400447c0
lea rdx, [0x140044c10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov edx, dword [0x140055250]
mov rcx, qword [str.engine2.dll]
call fcn.1400013a0
lea rcx, [rsp + 0x28]
mov qword [0x140055268], rax
call fcn.14003f410
mov rax, qword [rsp + 0x28]
lea rbx, [rax + 0x5f5e100]
cmp rax, r13
jle 0x14003fb95
mov rbx, r12
lea rcx, [rsp + 0x20]
call fcn.14003f410
mov rax, qword [rsp + 0x20]
cmp rbx, rax
je 0x14003fbee
jl 0x14003fbee
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jg 0x14003fbe2
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14003fbd9
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x14003fb95
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x14003fb95
cmp qword [0x140055268], 0
je 0x14003fb10
lea rcx, [0x14004c5e8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.got_process_id_of_
call fcn.1400447c0
mov rdx, qword [str.cs2.exe]
mov rcx, rax
call fcn.140044a30
mov rcx, rax
lea rdx, str._:
call fcn.1400447c0
mov edx, dword [0x140055250]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140044c10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.got_handle_of_
call fcn.1400447c0
mov rdx, qword [str.cs2.exe]
mov rcx, rax
call fcn.140044a30
mov rcx, rax
lea rdx, [0x14004c614]
call fcn.1400447c0
lea rdx, [0x140044c10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.got_window_handle_of_
call fcn.1400447c0
mov rdx, qword [str.cs2.exe]
mov rcx, rax
call fcn.140044a30
mov rcx, rax
lea rdx, [0x14004c6b4]
call fcn.1400447c0
mov rdx, qword [0x140055248]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x14004c6b0]
call fcn.1400447c0
lea rdx, [0x140044c10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.got_base_adress_of_
call fcn.1400447c0
mov rdx, qword [str.cs2.exe]
mov rcx, rax
call fcn.140044a30
mov rcx, rax
lea rdx, str._:_0x
call fcn.1400447c0
lea rdx, [0x14003f3f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [0x140055258]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140044c10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.got_base_adress_of_
call fcn.1400447c0
mov rdx, qword [str.client.dll]
mov rcx, rax
call fcn.140044a30
mov rcx, rax
lea rdx, str._:_0x
call fcn.1400447c0
lea rdx, [0x14003f3f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [0x140055260]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x140044c10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.got_base_adress_of_
call fcn.1400447c0
mov rdx, qword [str.engine2.dll]
mov rcx, rax
call fcn.140044a30
mov rcx, rax
lea rdx, str._:_0x
call fcn.1400447c0
lea rdx, [0x14003f3f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [0x140055268]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140044c10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov al, 1
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140045610
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rbp
ret