Function at 0x140004450
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rbx
push r14
sub rsp, 0x188
mov rax, qword [0x140076040]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14000449e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_creating_process_snapshot_n
call fcn.1400089b0
xor al, al
jmp 0x1400046f7
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x130
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x1400044db
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_getting_first_process_n
call fcn.1400089b0
xor al, al
jmp 0x1400046f7
mov qword [rsp + 0x1a8], rbp
mov qword [rsp + 0x1b8], rdi
mov qword [rsp + 0x180], r15
xor r15d, r15d
mov qword [rsp + 0x1b0], rsi
nop
xorps xmm0, xmm0
mov qword [rsp + 0x30], r15
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r15b
jne 0x140004520
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.1400091c0
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
jbe 0x140004545
mov rdx, qword [rbx]
mov rbp, qword [rsp + 0x38]
lea rcx, [rsp + 0x20]
mov rdi, qword [rsp + 0x20]
cmp rbp, 0xf
mov r8, qword [rsp + 0x30]
cmova rcx, rdi
cmp r8, qword [rbx + 0x10]
jne 0x140004575
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004575
mov sil, 1
jmp 0x140004578
xor sil, sil
cmp rbp, 0xf
jbe 0x1400045ab
lea rdx, [rbp + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400045a3
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004611
mov rcx, rdi
call fcn.14005adcc
mov rcx, r14
test sil, sil
jne 0x140004618
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140004500
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Process
call fcn.1400089b0
cmp qword [rbx + 0x18], 0xf
mov r8, qword [rbx + 0x10]
jbe 0x1400045f0
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140009cb0
mov rcx, rax
lea rdx, str._not_found_n
call fcn.1400089b0
xor al, al
jmp 0x1400046d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x48]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140004675
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_opening_process
call fcn.1400089b0
cmp qword [rbx + 0x18], 0xf
mov r8, qword [rbx + 0x10]
jbe 0x140004657
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140009cb0
mov rcx, rax
lea rdx, [0x14005dd6c]
call fcn.1400089b0
xor al, al
jmp 0x1400046d7
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1400046cc
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_terminating_process
call fcn.1400089b0
cmp qword [rbx + 0x18], 0xf
mov r8, qword [rbx + 0x10]
jbe 0x1400046a5
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140009cb0
mov rcx, rax
lea rdx, [0x14005dd6c]
call fcn.1400089b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1400046d7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rsi, qword [rsp + 0x1b0]
mov rdi, qword [rsp + 0x1b8]
mov rbp, qword [rsp + 0x1a8]
mov r15, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14005a940
add rsp, 0x188
pop r14
pop rbx
ret