Function at 0x140001060
Capabilities:
Enumerate process modules
Enumerate processes
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push r12
lea rbp, [rsp - 0x458]
sub rsp, 0x558
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x440], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0xff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r12d, r12d
mov rbx, rax
test rax, rax
jne 0x1400010b0
mov ebx, r12d
jmp 0x1400010b6
mov dword [rax], 0xf1
cmp dword [rbx], 0x15e
jle 0x14000112c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0x5f5e100
call fcn.140007a58
mov rbx, rax
test rax, rax
je 0x14000116a
xor edx, edx
mov r8d, 0x5f5e100
mov rcx, rax
call fcn.140015ec0
mov rcx, rbx
call fcn.140007a44
mov qword [rsp + 0x580], rdi
mov ecx, 0x90
mov qword [rsp + 0x590], r14
mov qword [rsp + 0x550], r15
call fcn.140001d20
xor edx, edx
mov ecx, 2
mov rbx, rax
mov dword [rax], 0x83485756
mov dword [rax + 4], 0xd78928ec
mov dword [rax + 8], 0xe8ce8948
mov dword [rax + 0xc], 0xaaaaaaaa
mov dword [rax + 0x10], 0x874ff85
mov dword [rax + 0x14], 0xe8f18948
mov dword [rax + 0x18], 0xaaaaaaaa
mov dword [rax + 0x1c], 0x48f08948
mov dword [rax + 0x20], 0x5f28c483
mov dword [rax + 0x24], 0xccccc35e
mov dword [rax + 0x28], 0xcccccccc
mov dword [rax + 0x2c], 0xcccccccc
mov dword [rax + 0x30], 0x48535756
mov dword [rax + 0x34], 0x4820ec83
mov dword [rax + 0x38], 0x8948d789
mov dword [rax + 0x3c], 0xbb48ce
mov dword [rax + 0x40], 0xfc000000
mov dword [rax + 0x44], 0x48ffffff
mov dword [rax + 0x48], 0x2148d0aa
mov dword [rax + 0x4c], 0x53b48d8
mov dword [rax + 0x50], 0xbaaaaaa
mov dword [rax + 0x54], 0x89480875
mov dword [rax + 0x58], 0xaaaae8aa
mov dword [rax + 0x5c], 0x8b48fdaa
mov dword [rax + 0x60], 0x2148184e
mov dword [rax + 0x64], 0x1d3b48cb
mov dword [rax + 0x68], 0xbaaaaaa
mov dword [rax + 0x6c], 0x89482074
mov dword [rax + 0x70], 0xa0b9187e
mov dword [rax + 0x74], 0x48000000
mov dword [rax + 0x78], 0x48104e03
mov dword [rax + 0x7c], 0x4808c683
mov dword [rax + 0x80], 0x8348f289
mov dword [rax + 0x84], 0x5f5b20aa
mov dword [rax + 0x88], 0xaaaae95e
mov dword [rax + 0x8c], 0xaae8feaa
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400014de
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400014d5
lea r15, str.chrome.exe
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp - 0x44]
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r15 + rcx*2 + 2]
jne 0x1400014c0
add rcx, 2
cmp rcx, 0xb
je 0x14000131b
movzx eax, word [rdx + rcx*2]
cmp ax, word [r15 + rcx*2]
je 0x1400012f0
jmp 0x1400014c0
mov r8d, dword [rbp - 0x50]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r9, [rbp + 0x220]
mov dword [rbp + 0x220], 0x104
mov rcx, rax
lea r8, [rbp + 0x230]
xor edx, edx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x140001398
lea rcx, [rbp + 0x230]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r8, rax
mov rdx, 0xffffffffffffffff
nop dword [rax]
movzx ecx, word [r8 + rdx*2 + 2]
cmp cx, word [r15 + rdx*2 + 2]
jne 0x140001398
add rdx, 2
cmp rdx, 0xb
je 0x1400014b7
movzx eax, word [r8 + rdx*2]
cmp ax, word [r15 + rdx*2]
je 0x140001370
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8d, dword [rbp - 0x68]
lea rcx, str.Found__ls_main_process_PID:__lu_n
mov rdx, r15
mov r14, rax
call fcn.140001010
test r14, r14
je 0x1400014de
lea rdx, [rbp + 0x220]
mov dword [rbp + 0x220], r12d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x1400018a2
cmp dword [rbp + 0x220], r12d
jne 0x1400018a2
mov ecx, 0x2000
call fcn.140007a58
mov r15, rax
test rax, rax
je 0x14000149c
lea r9, [rbp + 0x220]
mov dword [rsp + 0x20], 3
mov r8d, 0x2000
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModulesEx]
test eax, eax
je 0x14000149c
mov eax, dword [rbp + 0x220]
mov edi, r12d
test rax, 0xfffffffffffffff8
jbe 0x14000149c
mov rsi, r15
nop dword [rax]
mov rdx, qword [rsi]
lea r8, [rbp + 0x230]
mov r9d, 0x104
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x140001484
lea rdx, str.chrome.dll
lea rcx, [rbp + 0x230]
call fcn.140007b3c
test eax, eax
je 0x1400014e8
mov ecx, dword [rbp + 0x220]
inc edi
shr rcx, 3
add rsi, 8
movsxd rax, edi
cmp rax, rcx
jb 0x140001450
mov rcx, r15
call fcn.140007a44
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140001856
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400012e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140001856
movsxd rdx, edi
lea r8, [rsp + 0x30]
mov r9d, 0x18
mov rcx, r14
mov rdx, qword [r15 + rdx*8]
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rcx, r15
test eax, eax
je 0x14000149f
mov rsi, qword [rsp + 0x30]
mov edi, dword [rsp + 0x38]
call fcn.140007a44
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x1d0], r12
mov qword [rsp + 0x28], rax
mov r9, rsi
mov r8d, 0x90
mov dword [rsp + 0x20], edi
mov rdx, rbx
mov rcx, r14
call fcn.140001bf0
test eax, eax
je 0x1400014a4
mov rax, qword [rbp + 0x1d0]
mov ecx, edi
mov byte [rbp + 0x228], al
mov ebx, edi
shr rax, 8
mov byte [rbp + 0x229], al
shr rax, 8
mov byte [rbp + 0x22a], al
shr rax, 8
mov byte [rbp + 0x22b], al
shr rax, 8
mov byte [rbp + 0x22c], al
shr rax, 8
mov byte [rbp + 0x22d], al
shr rax, 8
mov byte [rbp + 0x22e], al
shr rax, 8
mov byte [rbp + 0x22f], al
call fcn.140001d20
mov rdi, rax
mov r9d, ebx
lea rax, [rbp + 0x1d0]
mov r8, rdi
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x1400015df
cmp eax, 0x12b
jne 0x1400014a4
mov r11, qword [rbp + 0x1d0]
lea rax, [rbp + 0x228]
add r11, 0xfffffffffffffff8
mov r10, rdi
sub r10, rax
mov r9, r12
nop word [rax + rax]
mov rax, r12
lea r8, [r10 + r9]
nop word [rax + rax]
lea rcx, [rbp + 0x228]
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xaa
je 0x14000162c
cmp byte [r8 + rcx], dl
jne 0x1400017d4
inc rax
cmp rax, 8
jb 0x140001610
mov rcx, rdi
mov qword [rsp + 0x588], r13
lea rbx, [r9 + rsi]
call fcn.140001d28
mov byte [rbp + 0x220], bl
mov ecx, 0x320
shr rbx, 8
mov byte [rbp + 0x221], bl
shr rbx, 8
mov byte [rbp + 0x222], bl
shr rbx, 8
mov byte [rbp + 0x223], bl
shr rbx, 8
mov byte [rbp + 0x224], bl
shr rbx, 8
mov byte [rbp + 0x225], bl
shr rbx, 8
mov byte [rbp + 0x226], bl
shr rbx, 8
mov byte [rbp + 0x227], bl
call fcn.140007a58
mov rsi, rax
mov rdi, r12
test rax, rax
je 0x14000188a
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r15, qword [rsp + 0x68]
mov r13, qword [rsp + 0x70]
cmp r15, r13
jae 0x14000188a
mov rbx, qword [rbp + 0x220]
nop dword [rax]
nop word [rax + rax]
mov r9d, 0x30
lea r8, [rsp + 0x30]
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x14000177a
cmp dword [rsp + 0x50], 0x1000
jne 0x140001775
test byte [rsp + 0x54], 0x44
je 0x140001775
mov rcx, qword [rsp + 0x48]
call fcn.140001d20
mov r9, qword [rsp + 0x48]
mov r12, rax
mov rdx, qword [rsp + 0x30]
lea rax, [rbp + 0x1d0]
mov r8, r12
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000176d
mov rax, qword [rsp + 0x30]
mov rdx, r12
mov rcx, qword [rbp + 0x1d0]
sub rdx, rax
add rcx, 0xfffffffffffffff9
cmp qword [rax + rdx], rbx
jne 0x140001764
mov qword [rsi + rdi*8], rax
inc rdi
inc rax
sub rcx, 1
jne 0x140001757
mov rcx, r12
call fcn.140001d28
add r15, qword [rsp + 0x48]
cmp r15, r13
jb 0x1400016e0
test rdi, rdi
je 0x14000188a
xor r15d, r15d
mov ebx, r15d
mov rdx, qword [rsi + rbx*8]
test rdx, rdx
je 0x14000182a
add rdx, 8
mov qword [rsp + 0x20], r15
mov r9d, 0x18
lea r8, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x38]
test rdx, rdx
jne 0x1400017f0
lea rcx, str.empty_n
call fcn.140001010
jmp 0x14000181e
inc r9
cmp r9, r11
jbe 0x140001600
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140001856
mov r9d, 0x40
mov qword [rsp + 0x20], r15
lea r8, [rbp + 0x1e0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000181e
lea rdx, [rbp + 0x1e0]
mov rcx, r14
call fcn.1400019c0
inc rbx
cmp rbx, rdi
jb 0x140001792
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140007a44
lea rcx, str._nDone_n
call fcn.140001010
call fcn.140005710
xor eax, eax
mov r13, qword [rsp + 0x588]
mov r15, qword [rsp + 0x550]
mov r14, qword [rsp + 0x590]
mov rdi, qword [rsp + 0x580]
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.140001d00
add rsp, 0x558
pop r12
pop rsi
pop rbx
pop rbp
ret
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140007a44
mov eax, 1
jmp 0x14000184e
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140001856