Function at 0x14000b570
Capabilities:
Check if file exists
Enumerate processes
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1b8
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rdi]
mov qword [rsp + 0x1a8], rax
xor eax, eax
mov rbx, rcx
mov r12, rdx
mov esi, ecx
mov edx, ecx
lea rcx, str.guest_exec_terminate_called__pid:__u
call dbg.slog
mov rax, qword [0x140083840]
test rax, rax
jne 0x14000b5cc
jmp 0x14000b610
mov rax, qword [rax + 0xd0]
test rax, rax
je 0x14000b610
cmp rbx, qword [rax + 8]
jne 0x14000b5c0
movzx eax, byte [rax + 0x20]
test al, al
je 0x14000b678
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsp + 0x1a8]
sub rax, qword [rdi]
jne 0x14000b898
add rsp, 0x1b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.Guest_agent_command_failed__pid:__u_not_found
mov dword [rsp + 0x28], ebx
mov rcx, r12
lea r9, str.guest_exec_info_find
mov qword [rsp + 0x20], rax
mov r8d, 0xd6
lea rdx, str..._qga_commands.c
call dbg.error_setg_internal
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsp + 0x1a8]
sub rax, qword [rdi]
jne 0x14000b898
mov edx, esi
lea rcx, str.guest_exec_terminate__pid:__u_not_found
add rsp, 0x1b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp dbg.slog
xor edx, edx
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000b879
mov rdx, rbx
xor ecx, ecx
lea rdi, [rsp + 0x30]
call sym.g_list_append
mov dword [rsp + 0x30], 0x130
mov rbx, rax
nop dword [rax + rax]
mov rdx, rdi
mov rcx, rsi
call sym.Process32First
test eax, eax
je 0x14000b708
xor ebp, ebp
nop dword [rax]
mov edx, dword [rsp + 0x50]
mov rcx, rbx
call sym.g_list_find
test rax, rax
je 0x14000b6ee
mov edx, dword [rsp + 0x38]
mov rcx, rbx
call sym.g_list_find
test rax, rax
je 0x14000b860
mov rdx, rdi
mov rcx, rsi
call sym.Process32Next
test eax, eax
jne 0x14000b6c8
test bpl, bpl
jne 0x14000b6b0
nop word [rax + rax]
mov rdx, rdi
mov rcx, rsi
call sym.Process32First
test eax, eax
je 0x14000b769
lea r14, [rsp + 0x5c]
lea rbp, str.killing_pid_u_ppid_u_name_s
nop dword [rax + rax]
mov edx, dword [rsp + 0x38]
mov rcx, rbx
call sym.g_list_find
test rax, rax
je 0x14000b75a
mov eax, dword [rsp + 0x50]
mov qword [rsp + 0x28], r14
mov r8, rbp
xor ecx, ecx
mov r9d, dword [rsp + 0x38]
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], eax
call sym.g_log
mov rdx, rdi
mov rcx, rsi
call sym.Process32Next
test eax, eax
jne 0x14000b728
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call rbp
test rbx, rbx
je 0x14000b887
mov rdi, qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r13, rbx
xor r14d, r14d
jmp 0x14000b7b1
mov rcx, rax
mov edx, 0xff
call r15
mov rcx, rsi
call rbp
mov r13, qword [r13 + 8]
test r13, r13
je 0x14000b7e8
mov r8d, dword [r13]
xor edx, edx
mov ecx, 1
call rdi
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000b798
test r14d, r14d
jne 0x14000b7a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13, qword [r13 + 8]
cmp eax, 2
cmovne r14d, eax
test r13, r13
jne 0x14000b7b1
nop word [rax + rax]
mov rcx, rbx
call sym.g_list_free
test r14d, r14d
je 0x14000b5de
lea rbx, [rsp + 0x160]
mov r9d, r14d
mov edx, 0x40
lea r8, str.win32_err__d
mov rcx, rbx
call sym.__mingw_snprintf
test eax, eax
js 0x14000b828
cdqe
add rax, 1
cmp rax, 0x40
ja 0x14000b893
lea rax, [0x1400879e0]
mov qword [rsp + 0x28], rbx
mov rcx, r12
lea r9, str.qmp_guest_exec_terminate
mov qword [rsp + 0x20], rax
mov r8d, 0x3f2
lea rdx, str..._qga_commands.c
call dbg.error_setg_internal
jmp 0x14000b5de
mov edx, dword [rsp + 0x38]
mov rcx, rbx
mov ebp, 1
call sym.g_list_append
mov rbx, rax
jmp 0x14000b6ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
jmp 0x14000b7f0
xor ecx, ecx
call sym.g_list_free
jmp 0x14000b5de
call sym.__chk_fail
call sym.__stack_chk_fail
nop
nop