Function at 0x140005688
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x340
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2e0], rcx
mov qword [rbp + 0x2e8], rdx
lea rax, str.vboxservice.exe
mov qword [rbp + 0x100], rax
lea rax, str.vboxtray.exe
mov qword [rbp + 0x108], rax
lea rax, str.vmtoolsd.exe
mov qword [rbp + 0x110], rax
lea rax, str.vmwaretray.exe
mov qword [rbp + 0x118], rax
lea rax, str.vmwareuser
mov qword [rbp + 0x120], rax
lea rax, str.VGAuthService.exe
mov qword [rbp + 0x128], rax
lea rax, str.vmacthlp.exe
mov qword [rbp + 0x130], rax
lea rax, str.vmsrvc.exe
mov qword [rbp + 0x138], rax
lea rax, str.vmusrvc.exe
mov qword [rbp + 0x140], rax
lea rax, str.prl_cc.exe
mov qword [rbp + 0x148], rax
lea rax, str.prl_tools.exe
mov qword [rbp + 0x150], rax
lea rax, str.xenservice.exe
mov qword [rbp + 0x158], rax
lea rax, str.qemu_ga.exe
mov qword [rbp + 0x160], rax
lea rax, [rbp + 0x100]
add rax, 0x68
lea rdx, [rbp + 0x16f]
mov qword [rbp + 0x2a0], rdx
nop
nop
lea r8, [rbp + 0x16f]
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0xe0]
mov r9, r8
mov r8, rax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.vector_char_const_const__void__char_const_const__cha
nop
mov dword [rbp - 0x50], 0x130
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x2b8], rax
cmp qword [rbp + 0x2b8], 0xffffffffffffffff
jne 0x140005855
lea rax, [rbp + 0x170]
lea rdx, str.failed_to_create_snapshot_of_processes
mov rcx, rax
call dbg.std::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >::optional<char const (&) [39], true>(char const (&) [39])
lea rax, [rbp + 0x1cf]
mov qword [rbp + 0x298], rax
nop
nop
lea rdx, [rbp + 0x1cf]
lea rax, [rbp + 0x1a0]
mov r8, rdx
lea rdx, str.process_checks
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string<std::allocator<char> >(char const*, std::allocator<char> const&)
lea rcx, [rbp + 0x170]
lea rdx, [rbp + 0x1a0]
mov rax, qword [rbp + 0x2e0]
mov r9d, 0
mov r8, rcx
mov rcx, rax
call method.protection::checks::base::CheckResult.CheckResult_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::optional_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char______const__bool_
lea rax, [rbp + 0x1a0]
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string()
nop
lea rax, [rbp + 0x170]
mov rcx, rax
call dbg.std::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >::~optional()
jmp 0x140005a72
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x2b8]
mov rcx, rax
call sym.Process32First
test eax, eax
setne al
test al, al
je 0x1400059d9
lea rax, [rbp + 0xe0]
mov qword [rbp + 0x2b0], rax
mov rax, qword [rbp + 0x2b0]
mov rcx, rax
call dbg.std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >::begin()
mov qword [rbp - 0x58], rax
mov rax, qword [rbp + 0x2b0]
mov rcx, rax
call dbg.std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >::end()
mov qword [rbp - 0x60], rax
jmp 0x14000599e
lea rax, [rbp - 0x58]
mov rcx, rax
call sym.__gnu_cxx::__normal_iterator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_________::operator___const
mov qword [rbp + 0x2a8], rax
mov rax, qword [rbp + 0x2a8]
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::c_str() const
mov rdx, rax
lea rax, [rbp - 0x50]
add rax, 0x2c
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
sete al
test al, al
je 0x140005992
mov rax, qword [rbp + 0x2b8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x1d0]
mov edx, esi
mov rcx, rax
call dbg.std::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >::optional(std::nullopt_t)
lea rax, [rbp + 0x22f]
mov qword [rbp + 0x290], rax
nop
nop
lea rdx, [rbp + 0x22f]
lea rax, [rbp + 0x200]
mov r8, rdx
lea rdx, str.process_checks
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string<std::allocator<char> >(char const*, std::allocator<char> const&)
lea rcx, [rbp + 0x1d0]
lea rdx, [rbp + 0x200]
mov rax, qword [rbp + 0x2e0]
mov r9d, 1
mov r8, rcx
mov rcx, rax
call method.protection::checks::base::CheckResult.CheckResult_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::optional_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char______const__bool_
lea rax, [rbp + 0x200]
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string()
nop
lea rax, [rbp + 0x1d0]
mov rcx, rax
call dbg.std::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >::~optional()
jmp 0x140005a72
lea rax, [rbp - 0x58]
mov rcx, rax
call sym.__gnu_cxx::__normal_iterator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_________::operator__
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x58]
mov rcx, rax
call sym._ZN9__gnu_cxxeqIPNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt6vectorIS6_SaIS6_EEEEbRKNS_17__normal_iteratorIT_T0_EES
xor eax, 1
test al, al
jne 0x1400058ae
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x2b8]
mov rcx, rax
call sym.Process32Next
test eax, eax
setne al
test al, al
jne 0x140005875
mov rax, qword [rbp + 0x2b8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x230]
mov edx, ebx
mov rcx, rax
call dbg.std::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >::optional(std::nullopt_t)
lea rax, [rbp + 0x287]
mov qword [rbp + 0x288], rax
nop
nop
lea rdx, [rbp + 0x287]
lea rax, [rbp + 0x260]
mov r8, rdx
lea rdx, str.process_checks
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string<std::allocator<char> >(char const*, std::allocator<char> const&)
lea rcx, [rbp + 0x230]
lea rdx, [rbp + 0x260]
mov rax, qword [rbp + 0x2e0]
mov r9d, 0
mov r8, rcx
mov rcx, rax
call method.protection::checks::base::CheckResult.CheckResult_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::optional_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char______const__bool_
lea rax, [rbp + 0x260]
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string()
nop
lea rax, [rbp + 0x230]
mov rcx, rax
call dbg.std::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >::~optional()
lea rax, [rbp + 0xe0]
mov rcx, rax
call dbg.std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >::~vector()
jmp 0x140005b27
mov rax, qword [rbp + 0x2e0]
add rsp, 0x340
pop rbx
pop rsi
pop rbp
ret