Function at 0x1400013f0
Capabilities:
Enumerate processes
Execute command
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x1a0
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x180], rax
movsd xmm6, qword [0x1400034a8]
movabs rbp, 0x311cdad160000
movabs r12, 0x7fffffff88ca6bff
movabs r15, 0x7fffffffffffffff
movabs r14, 0x112e0be826d694b3
nop word [rax + rax]
xor edi, edi
xor edx, edx
xor ebx, ebx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400014d5
nop word [rax + rax]
lea rdx, str.NIMROD.exe
lea rcx, [rsp + 0x7c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x1400014c3
mov eax, dword [rsp + 0x6c]
cmp eax, ebx
jle 0x1400014c3
mov edi, dword [rsp + 0x58]
mov ebx, eax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400014a0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001790
mov rcx, rax
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001940]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
test edi, edi
je 0x140001607
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140001522
imul rax, rax, 0x64
jmp 0x140001540
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea rdi, [rax + 0x77359400]
cmp rax, r12
jl 0x140001550
mov rdi, r15
nop
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14000156e
imul rbx, rax, 0x64
jmp 0x14000158f
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rbx, rdi
jge 0x140001460
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rdx, rax, 0x64
xorps xmm0, xmm0
mov rax, rdi
sub rax, rbx
lea rcx, [rdx + rbp]
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
seta r8b
test r8b, r8b
jne 0x1400015c5
lea rcx, [rdx + rax]
add rax, rdx
add rdx, rbp
test r8b, r8b
cmove rdx, rax
mov rax, r14
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x40], rdx
sub ecx, eax
mov dword [rsp + 0x48], ecx
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x140001550
lea rcx, [rsp + 0x20]
call fcn.1400016b0
mov rcx, rax
call fcn.1400011c0
lea rcx, str.TASKKILL__F__IM_AndroidEmulatorEx.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3