Function at 0x140040770
Capabilities:
Enumerate processes
Execute command

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140064010]
xor rax, rsp
mov qword [rbp + 0x170], rax
cmp qword [0x14006c478], 0
movabs r15, 0x7ffffffffa0a1efe
movabs r14, 0x7fffffffffffffff
jne 0x14004088f
nop dword [rax]
lea rcx, [0x140059e88]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.please_start
call fcn.140050b60
mov rdx, qword [str.project8.exe]
mov rcx, rax
call fcn.140050dc0
mov rcx, rax
lea rdx, [0x140054908]
call fcn.140050b60
lea rdx, [0x140050f90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.deadlock
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x14006c478], rax
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140040842
imul rax, rax, 0x64
jmp 0x140040860
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jg 0x140040872
add rax, 0x5f5e100
mov qword [rsp + 0x20], rax
jmp 0x140040877
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
call fcn.140051560
cmp qword [0x14006c478], 0
je 0x1400407c0
cmp dword [0x14006c480], 0xffffffff
jne 0x1400409b9
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x2a8], rdi
nop dword [rax]
mov rsi, qword [str.project8.exe]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov edi, 0xffffffff
cmp rax, 0xffffffffffffffff
je 0x140040939
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140040930
nop word [rax + rax]
lea rax, [rsp + 0x5c]
mov r8, rsi
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140040914
add rax, 2
test ecx, ecx
jne 0x140040900
test edx, edx
je 0x14004092c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400408f0
jmp 0x140040930
mov edi, dword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x14006c480], edi
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14004095d
imul rax, rax, 0x64
jmp 0x14004097b
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jg 0x14004098d
add rax, 0x5f5e100
mov qword [rsp + 0x20], rax
jmp 0x140040992
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
call fcn.140051560
cmp dword [0x14006c480], 0xffffffff
je 0x1400408b0
mov rdi, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2a0]
mov rcx, qword [0x14006c4a0]
test rcx, rcx
jne 0x140040a58
nop dword [rax]
mov r8d, dword [0x14006c480]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14006c4a0], rax
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140040a09
imul rax, rax, 0x64
jmp 0x140040a27
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jg 0x140040a39
add rax, 0x5f5e100
mov qword [rsp + 0x20], rax
jmp 0x140040a3e
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
call fcn.140051560
mov rcx, qword [0x14006c4a0]
test rcx, rcx
je 0x1400409d0
cmp qword [0x14006c488], 0
jne 0x140040af6
nop word [rax + rax]
mov rdx, qword [str.project8.exe]
call fcn.1400403d0
mov qword [0x14006c488], rax
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140040aa1
imul rax, rax, 0x64
jmp 0x140040abf
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jg 0x140040ad1
add rax, 0x5f5e100
mov qword [rsp + 0x20], rax
jmp 0x140040ad6
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
call fcn.140051560
cmp qword [0x14006c488], 0
jne 0x140040af6
mov rcx, qword [0x14006c4a0]
jmp 0x140040a70
cmp qword [0x14006c490], 0
jne 0x140040b90
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [0x14006c480]
mov rcx, qword [str.client.dll]
call fcn.1400405a0
mov qword [0x14006c490], rax
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140040b47
imul rax, rax, 0x64
jmp 0x140040b65
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jg 0x140040b77
add rax, 0x5f5e100
mov qword [rsp + 0x20], rax
jmp 0x140040b7c
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
call fcn.140051560
cmp qword [0x14006c490], 0
je 0x140040b10
cmp qword [0x14006c498], 0
jne 0x140040c20
nop
mov edx, dword [0x14006c480]
mov rcx, qword [str.engine2.dll]
call fcn.1400405a0
mov qword [0x14006c498], rax
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140040bd7
imul rax, rax, 0x64
jmp 0x140040bf5
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jg 0x140040c07
add rax, 0x5f5e100
mov qword [rsp + 0x20], rax
jmp 0x140040c0c
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
call fcn.140051560
cmp qword [0x14006c498], 0
je 0x140040ba0
lea rcx, [0x140059e88]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov al, 1
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140051a50
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop r15
pop r14
pop rbp
ret