Function at 0x140033000
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x14009b0a0]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x70], rdx
mov rax, qword [rdx]
cmp rax, qword [rdx + 8]
jne 0x140033136
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0x29
jb 0x14003391b
mov rax, rsi
cmp qword [rsi + 0x18], 8
jb 0x14003306f
mov rax, qword [rsi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x29
lea r9, str.Error:_No_running_process_with_the_name:
lea rcx, [rbp - 0x80]
call fcn.14000a3f0
cmp byte [0x14009e9ba], 0
je 0x1400330af
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x1400330f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400330ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033921
call fcn.140041080
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14003312f
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14003312a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003390f
mov rcx, r8
call fcn.140041080
xor ebx, ebx
jmp 0x14003343d
mov edi, dword [rax]
lea r9, [rbp + 0x35]
mov r8d, edi
nop
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140033140
xor ebx, ebx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], bl
lea rax, [rbp + 0x35]
cmp r9, rax
je 0x14003319c
lea r8, [rbp + 0x35]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x60]
call fcn.140007ec0
nop
mov r9d, 0x18
lea r8, str.Process_PID_to_inspect:
lea rcx, [rbp - 0x60]
call fcn.14000b550
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x80]
call fcn.1400307e0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140033221
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003321c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033927
call fcn.140041080
mov edx, 0x100000
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
jne 0x14003333b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r10, [rbp + 0x35]
dec r10
mov eax, 0xcccccccd
mul r9d
shr edx, 3
movzx ecx, dl
shl cl, 2
lea r8d, [rcx + rdx]
add r8b, r8b
sub r9b, r8b
add r9b, 0x30
mov byte [r10], r9b
mov r9d, edx
test edx, edx
jne 0x140033251
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], dl
lea rax, [rbp + 0x35]
cmp r10, rax
je 0x1400332ad
lea r8, [rbp + 0x35]
sub r8, r10
mov rdx, r10
lea rcx, [rbp - 0x60]
call fcn.140007ec0
nop
mov r9d, 0x39
lea r8, str.Error:_Unable_to_allocate_memory_for_process_list._Code:
lea rcx, [rbp - 0x60]
call fcn.14000b550
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x80]
call fcn.1400307e0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1400333fe
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033331
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003392d
call fcn.140041080
jmp 0x1400333fe
mov r15, r12
xor r9d, r9d
mov r8d, 0x100000
mov rdx, r12
lea ecx, [r9 + 5]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x14003349b
mov edx, eax
lea rcx, [rbp - 0x20]
call fcn.140001f60
nop
mov r9d, 0x24
lea r8, str.Error:_Unable_to_query_process_list
mov rcx, rax
call fcn.14000b550
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x80]
call fcn.1400307e0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400333ec
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400333e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033933
call fcn.140041080
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14003343d
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x140033438
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003390f
mov rcx, r8
call fcn.140041080
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
mov rcx, qword [r14]
test rcx, rcx
je 0x140033494
mov rdx, qword [r14 + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140033484
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140033915
mov rcx, r8
call fcn.140041080
mov qword [r14], rbx
mov qword [r14 + 8], rbx
mov qword [r14 + 0x10], rbx
xor al, al
jmp 0x140033574
xor r13b, r13b
cmp dword [r12], 0
je 0x1400338ed
nop dword [rax]
cmp dword [r15 + 0x50], edi
je 0x14003359b
mov eax, dword [r15]
add r15, rax
cmp dword [r15], 0
jne 0x1400334b0
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor dil, dil
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x140033519
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140033514
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003390f
mov rcx, r8
call fcn.140041080
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
mov rcx, qword [r14]
test rcx, rcx
je 0x140033570
mov rdx, qword [r14 + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140033560
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140033915
mov rcx, r8
call fcn.140041080
mov qword [r14], rbx
mov qword [r14 + 8], rbx
mov qword [r14 + 0x10], rbx
movzx eax, dil
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.140041060
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r13d, dword [r15 + 4]
lea r9, [rbp + 0x35]
mov r8d, r13d
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x1400335b0
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], dl
lea rax, [rbp + 0x35]
cmp r9, rax
je 0x14003360a
lea r8, [rbp + 0x35]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x80]
call fcn.140007ec0
nop
lea r9, [rbp + 0x15]
nop
dec r9
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r9], dil
mov edi, edx
test edx, edx
jne 0x140033610
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], dl
lea rax, [rbp + 0x15]
cmp r9, rax
je 0x140033668
lea r8, [rbp + 0x15]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x60]
call fcn.140007ec0
nop
mov r9d, 0xe
lea r8, str.Found_process
lea rcx, [rbp - 0x60]
call fcn.14000b550
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 6
lea rdx, str._with
lea rcx, [rbp - 0x40]
call fcn.140008020
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp - 0x80]
lea r8, [rbp]
lea rcx, [rbp - 0x20]
call fcn.14000a530
nop
mov r8d, 8
lea rdx, str._threads
lea rcx, [rbp - 0x20]
call fcn.140008020
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
call fcn.1400307e0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140033779
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033774
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033939
call fcn.140041080
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1400337c5
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400337bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003393f
call fcn.140041080
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140033800
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400337fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033945
call fcn.140041080
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14003384b
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033846
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003394b
call fcn.140041080
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140033896
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033891
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033951
call fcn.140041080
mov eax, 1
cmp r13d, eax
jb 0x1400338e9
add r15, 0x148
nop word [rax + rax]
cmp dword [r15 - 4], 5
jne 0x1400334c6
cmp dword [r15], 5
jne 0x1400334c6
add r15, 0x50
inc eax
cmp eax, r13d
jbe 0x1400338b0
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dil, 1
jmp 0x1400334da
movzx r13d, al
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r13b, r13b
je 0x1400334d7
mov dil, 1
jmp 0x1400334da
call fcn.140053bb4
nop
call fcn.140053bb4
nop
call fcn.140001380
int3
call fcn.140053bb4
int3
call fcn.140053bb4
int3
call fcn.140053bb4
int3
call fcn.140053bb4
nop
call fcn.140053bb4
nop
call fcn.140053bb4
nop
call fcn.140053bb4
nop
call fcn.140053bb4
nop
call fcn.140053bb4
int3