Function at 0x140032770
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x1400990a0]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov rdi, rcx
mov qword [rbp - 0x80], rcx
mov rdx, rcx
lea rcx, [rbp - 0x18]
call fcn.140006d80
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140032610
nop
mov rax, qword [rsp + 0x40]
cmp rax, qword [rsp + 0x48]
jne 0x14003291a
mov rcx, qword [rdi + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0x29
jb 0x14003306a
mov rax, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400327fb
mov rax, qword [rdi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x29
lea r9, str.Error:_No_running_process_with_the_name:
lea rcx, [rbp - 0x78]
call fcn.14000a3f0
cmp byte [0x14009c9ba], 0
je 0x14003283b
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14003287c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032876
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033070
call fcn.1400407d0
nop
xor ebx, ebx
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400328d4
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400328c1
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033088
call fcn.1400407d0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140032913
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x14003290e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140033064
mov rcx, r8
call fcn.1400407d0
xor al, al
jmp 0x140032cc3
mov esi, dword [rax]
lea r9, [rbp + 0x3d]
mov r8d, esi
nop dword [rax]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140032930
xor ebx, ebx
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], bl
lea rax, [rbp + 0x3d]
cmp r9, rax
je 0x14003298c
lea r8, [rbp + 0x3d]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x58]
call fcn.140007ec0
nop
mov r9d, 0x18
lea r8, str.Process_PID_to_inspect:
lea rcx, [rbp - 0x58]
call fcn.14000b550
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x78]
call fcn.14002ff50
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140032a11
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032a0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033076
call fcn.1400407d0
mov edx, 0x100000
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x140032b28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r10, [rbp + 0x3d]
dec r10
mov eax, 0xcccccccd
mul r9d
shr edx, 3
movzx ecx, dl
shl cl, 2
lea r8d, [rcx + rdx]
add r8b, r8b
sub r9b, r8b
add r9b, 0x30
mov byte [r10], r9b
mov r9d, edx
test edx, edx
jne 0x140032a41
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], dl
lea rax, [rbp + 0x3d]
cmp r10, rax
je 0x140032a9d
lea r8, [rbp + 0x3d]
sub r8, r10
mov rdx, r10
lea rcx, [rbp - 0x58]
call fcn.140007ec0
nop
mov r9d, 0x39
lea r8, str.Error:_Unable_to_allocate_memory_for_process_list._Code:
lea rcx, [rbp - 0x58]
call fcn.14000b550
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x78]
call fcn.14002ff50
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140032b23
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032b1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003307c
call fcn.1400407d0
nop
jmp 0x14003287e
mov r14, r15
xor r9d, r9d
mov r8d, 0x100000
mov rdx, r15
lea ecx, [r9 + 5]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x140032bf0
mov edx, eax
lea rcx, [rbp + 8]
call fcn.140001f60
nop
mov r9d, 0x24
lea r8, str.Error:_Unable_to_query_process_list
mov rcx, rax
call fcn.14000b550
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x78]
call fcn.14002ff50
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x140032bd9
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032bd4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033082
call fcn.1400407d0
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
jmp 0x14003287e
xor r13b, r13b
cmp dword [r15], 0
je 0x14003303c
nop dword [rax]
cmp dword [r14 + 0x50], esi
je 0x140032cff
mov eax, dword [r14]
add r14, rax
cmp dword [r14], 0
jne 0x140032c00
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor sil, sil
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140032c80
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032c6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033088
call fcn.1400407d0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140032cbf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140032cba
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140033064
mov rcx, r8
call fcn.1400407d0
movzx eax, sil
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 7
mov word [rdi], bx
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1400407b0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r13b, 1
mov r12d, dword [r14 + 4]
lea r9, [rbp + 0x3d]
mov r8d, r12d
nop dword [rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140032d10
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], dl
lea rax, [rbp + 0x3d]
cmp r9, rax
je 0x140032d6a
lea r8, [rbp + 0x3d]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x78]
call fcn.140007ec0
nop
lea r9, [rbp - 3]
nop
dec r9
mov eax, 0xcccccccd
mul esi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub sil, cl
add sil, 0x30
mov byte [r9], sil
mov esi, edx
test edx, edx
jne 0x140032d70
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], dl
lea rax, [rbp - 3]
cmp r9, rax
je 0x140032dc8
lea r8, [rbp - 3]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x58]
call fcn.140007ec0
nop
mov r9d, 0xe
lea r8, str.Found_process
lea rcx, [rbp - 0x58]
call fcn.14000b550
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 6
lea rdx, str._with
lea rcx, [rbp - 0x38]
call fcn.140008020
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp - 0x78]
lea r8, [rbp - 0x18]
lea rcx, [rbp + 8]
call fcn.14000a530
nop
mov r8d, 8
lea rdx, str._threads
lea rcx, [rbp + 8]
call fcn.140008020
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x60]
call fcn.14002ff50
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x140032ed9
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032ed4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003308e
call fcn.1400407d0
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], 0xf
mov byte [rbp + 8], 0
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x140032f25
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032f1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033094
call fcn.1400407d0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140032f60
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032f5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003309a
call fcn.1400407d0
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140032fab
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032fa6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400330a0
call fcn.1400407d0
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140032ff2
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032fed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003305e
call fcn.1400407d0
mov eax, 1
cmp r12d, eax
jb 0x14003303c
add r14, 0x148
cmp dword [r14 - 4], 5
jne 0x140032c16
cmp dword [r14], 5
jne 0x140032c16
add r14, 0x50
inc eax
cmp eax, r12d
jbe 0x140033003
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov sil, 1
jmp 0x140032c2a
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r13b, r13b
je 0x140032c27
mov sil, 1
jmp 0x140032c2a
call fcn.140053304
nop
call fcn.140053304
nop
call fcn.140001380
int3
call fcn.140053304
int3
call fcn.140053304
int3
call fcn.140053304
int3
call fcn.140053304
nop
call fcn.140053304
nop
call fcn.140053304
nop
call fcn.140053304
nop
call fcn.140053304
nop
call fcn.140053304
int3