Function at 0x140005780
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x800
mov rax, qword [0x1400ab080]
xor rax, rsp
mov qword [rsp + 0x7f0], rax
xor r15d, r15d
call fcn.140005610
mov edx, 0x400
lea rcx, [rsp + 0x3f0]
call fcn.1400638dc
test rax, rax
je 0x140005d79
lea rdx, str.Current_working_directory:
lea rcx, [0x1400afc40]
call fcn.140008fb0
mov rcx, rax
lea rdx, [rsp + 0x3f0]
call fcn.140008fb0
mov rcx, rax
call fcn.140009260
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0xa0]
call fcn.140084000
lea rcx, [rsp + 0xa0]
call fcn.140006d90
nop
cmp qword [rsp + 0x130], r15
jne 0x140005913
lea rdx, str.Failed_to_open_nicecode_file.
lea rcx, [0x1400afdc0]
call fcn.140008fb0
mov rcx, rax
call fcn.140009260
call fcn.140063dec
mov ecx, dword [rax]
call fcn.140064aac
mov rbx, rax
lea rdx, str.Error:
lea rcx, [0x1400afdc0]
call fcn.140008fb0
mov rcx, rax
mov rdx, rbx
call fcn.140008fb0
mov rcx, rax
call fcn.140009260
nop
mov rax, qword [rsp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0xa0], rax
mov rax, qword [rsp + 0xa0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x9c], edx
lea rcx, [rsp + 0xb0]
call fcn.140006ce0
mov rax, qword [rsp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0xa0], rax
mov rax, qword [rsp + 0xa0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rsp + rcx + 0x9c], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x150]
call fcn.1400198fc
nop
jmp 0x140005d94
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xa0]
call fcn.140007000
mov rdi, qword [rax + 8]
add rdi, qword [rax]
lea rcx, [rsp + 0xa0]
call fcn.1400070e0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov rsi, r15
mov qword [rsp + 0x80], r15
test rdi, rdi
je 0x1400059ca
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140005dc7
cmp rdi, 0x1000
jb 0x140005997
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x140005dcd
call fcn.14003e090
test rax, rax
je 0x140005e29
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400059a2
mov rcx, rdi
call fcn.14003e090
mov rbx, rax
mov qword [rsp + 0x70], rbx
lea rsi, [rbx + rdi]
mov qword [rsp + 0x80], rsi
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.140084000
mov r14, rsi
mov qword [rsp + 0x78], rsi
jmp 0x1400059d4
mov r14, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.1400072d0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
je 0x140005ae2
lea rdx, str.Failed_to_read_nicecode_file.
lea rcx, [0x1400afdc0]
call fcn.140008fb0
mov rcx, rax
call fcn.140009260
nop
test rbx, rbx
je 0x140005a4e
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x140005a42
add rsi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e29
mov rdx, rsi
mov rcx, rbx
call fcn.14003e0cc
nop
mov rax, qword [rsp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0xa0], rax
mov rax, qword [rsp + 0xa0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x9c], edx
lea rcx, [rsp + 0xb0]
call fcn.140006ce0
mov rax, qword [rsp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0xa0], rax
mov rax, qword [rsp + 0xa0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rsp + rcx + 0x9c], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x150]
call fcn.1400198fc
nop
jmp 0x140005d94
lea rcx, [rsp + 0xb0]
call fcn.140007fd0
mov edi, 2
test rax, rax
jne 0x140005b34
mov rax, qword [rsp + 0xa0]
movsxd rcx, dword [rax + 4]
mov eax, 6
cmp qword [rsp + rcx + 0xe8], 0
cmovne eax, edi
or eax, dword [rsp + rcx + 0xb0]
and eax, 0x17
mov dword [rsp + rcx + 0xb0], eax
and eax, dword [rsp + rcx + 0xb4]
jne 0x140005dd3
sub r14, rbx
mov qword [0x1400b1618], r14
mov rcx, r14
call fcn.14003e220
mov qword [0x1400b1610], rax
mov r8, r14
mov rdx, rbx
mov rcx, rax
call fcn.140083960
nop
mov r14d, r15d
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
test rax, rax
je 0x140005bd1
mov dword [rsp + 0x1b0], 0x238
lea rdx, [rsp + 0x1b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005bc8
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x1dc]
call fcn.14005eae8
test eax, eax
je 0x140005bc0
lea rdx, [rsp + 0x1b0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005b91
jmp 0x140005bc8
mov r14d, dword [rsp + 0x1b8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x58
call fcn.14003e090
mov rdi, rax
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
mov qword [rdi + 0x50], rax
mov rcx, qword [0x1400b1618]
mov rax, qword [0x1400b1610]
mov dword [rdi + 8], r14d
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rcx
lea rax, vtable.RemoteTpTimerInsertion.0
mov qword [rdi], rax
mov qword [rdi + 0x38], r15
mov qword [rdi + 0x40], r15
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x50], r15
mov qword [rsp + 0x88], rdi
mov rcx, rdi
call fcn.140011ff0
nop
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax + 0x18]
nop
test rbx, rbx
je 0x140005c97
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x140005c8b
add rsi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e29
mov rdx, rsi
mov rcx, rbx
call fcn.14003e0cc
nop
mov rax, qword [rsp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0xa0], rax
mov rax, qword [rsp + 0xa0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x9c], edx
lea rcx, [rsp + 0xb0]
call fcn.140006ce0
mov rax, qword [rsp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0xa0], rax
mov rax, qword [rsp + 0xa0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rsp + rcx + 0x9c], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x150]
call fcn.1400198fc
nop
jmp 0x140005d94
lea rdx, str.getcwd___error
lea rcx, [0x1400afdc0]
call fcn.140008fb0
mov rcx, rax
call fcn.140009260
mov eax, 1
mov rcx, qword [rsp + 0x7f0]
xor rcx, rsp
call fcn.14003e070
lea r11, [rsp + 0x800]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
call fcn.1400028e0
nop
call fcn.140001520
nop
test al, 4
je 0x140005de0
lea rbx, str.ios_base::badbit_set
jmp 0x140005df5
test dil, al
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rsp + 0x88]
call fcn.140002f90
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140003d00
lea rdx, [0x1400a9430]
lea rcx, [rsp + 0x40]
call fcn.140052654
nop
call fcn.14005e774
int3