Function at 0x140004e40
Capabilities:
Enumerate processes
Enumerate threads
Suspend thread
Terminate thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x120], xmm6
mov qword [rbp + 0x118], 0xfffffffffffffffe
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140005047
mov rsi, rax
lea rdi, [rbp - 0x60]
mov r8d, 0x130
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x60], 0x130
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14000508b
lea rdi, [rbp - 0x34]
lea rbx, [rbp + 0xf0]
movabs r12, 0x8000000000000000
lea r15, [rbp + 0xd0]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea r8, [rax + 1]
mov rcx, rbx
mov rdx, rdi
call fcn.14004e4a0
mov rax, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xf8]
mov r13, qword [rbp + 0x100]
cmp rax, r12
jne 0x140004f60
test r13, r13
je 0x140004f69
js 0x140005334
mov rbx, rdi
mov rdi, rsi
mov rsi, r15
mov r15, r12
mov r12, rdx
movzx eax, byte [0x140108f61]
mov edx, 1
mov rcx, r13
call fcn.1400168f0
mov r14, rax
test rax, rax
mov rdx, r12
mov r12, r15
mov r15, rsi
mov rsi, rdi
mov rdi, rbx
lea rbx, [rbp + 0xf0]
jne 0x140004f6f
jmp 0x140005339
mov qword [rbp + 0x110], rax
jmp 0x140004f84
mov r14d, 1
mov rcx, r14
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov rdx, r14
mov qword [rbp + 0x110], r13
mov rcx, r15
mov qword [rbp + 0xe8], rdx
mov r8, r13
call fcn.14004e670
mov r8d, 0x19
mov rcx, rbx
lea rdx, [0x1400c1d73]
call fcn.14004e670
mov r13, qword [rbp + 0xd8]
mov r8, qword [rbp + 0xe0]
mov r14, qword [rbp + 0xf8]
cmp r8, qword [rbp + 0x100]
jne 0x140004fdc
mov rcx, r13
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000511c
mov rdx, qword [rbp + 0xf0]
test rdx, rdx
je 0x140004ff6
mov r8d, 1
mov rcx, r14
call fcn.140016900
mov rdx, qword [rbp + 0xd0]
test rdx, rdx
je 0x140005010
mov r8d, 1
mov rcx, r13
call fcn.140016900
mov rcx, rsi
lea rdx, [rbp - 0x60]
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x140005056
mov rdx, qword [rbp + 0x110]
test rdx, rdx
je 0x140004ed0
mov r8d, 1
mov rcx, qword [rbp + 0xe8]
call fcn.140016900
jmp 0x140004ed0
mov r13d, 0x22
lea rsi, [0x1400c1d51]
jmp 0x1400050a0
mov rdx, qword [rbp + 0x110]
test rdx, rdx
je 0x140005074
mov r8d, 1
mov rcx, qword [rbp + 0xe8]
call fcn.140016900
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
mov r13d, 0x12
lea rsi, [0x1400c1d00]
jmp 0x1400050a0
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
mov r13d, 0x21
lea rsi, [0x1400c1d30]
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], r13
lea rax, [rbp + 0xd0]
mov qword [rbp + 0xf0], rax
lea rax, [0x140012960]
mov qword [rbp + 0xf8], rax
lea rax, str.Error:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 2
mov qword [rbp - 0x40], 0
lea rax, [rbp + 0xf0]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rcx, [rbp - 0x60]
call fcn.140033780
movaps xmm6, xmmword [rbp + 0x120]
add rsp, 0x1b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rdx, qword [rbp + 0xf0]
test rdx, rdx
je 0x140005136
mov r8d, 1
mov rcx, r14
call fcn.140016900
mov rdx, qword [rbp + 0xd0]
test rdx, rdx
je 0x140005150
mov r8d, 1
mov rcx, r13
call fcn.140016900
mov r8d, dword [rbp - 0x58]
mov ecx, 0x1fffff
xor edx, edx
call sub.KERNEL32.dll_OpenProcess
mov rdi, rax
test rax, rax
je 0x14000529a
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
mov r13d, dword [rbp - 0x58]
mov rsi, rdi
mov rdx, qword [rbp + 0x110]
test rdx, rdx
je 0x140005199
mov r8d, 1
mov rcx, qword [rbp + 0xe8]
call fcn.140016900
test rdi, rdi
je 0x1400050a0
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x1400052c4
mov rdi, rax
mov dword [rbp + 0xf0], 0x1c
xorps xmm6, xmm6
movups xmmword [rbp + 0xf4], xmm6
mov qword [rbp + 0x104], 0
lea rdx, [rbp + 0xf0]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1400052f4
call sub.KERNEL32.dll_GetCurrentThreadId
mov ebx, eax
lea r14, [rbp - 0x60]
lea r15, [rbp + 0xf0]
jmp 0x14000524a
lea rax, str.Failed_to_suspend_thread._n
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
lea rax, [0x1400c16b0]
mov qword [rbp - 0x50], rax
movups xmmword [rbp - 0x48], xmm6
mov rcx, r14
call fcn.140033780
mov rcx, r12
call sub.KERNEL32.dll_CloseHandle
mov rcx, rdi
mov rdx, r15
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x14000531f
mov r8d, dword [rbp + 0xf8]
cmp r8d, ebx
je 0x140005237
cmp dword [rbp + 0xfc], r13d
jne 0x140005237
mov ecx, 0x1fffff
xor edx, edx
call sub.KERNEL32.dll_OpenThread
test rax, rax
je 0x140005237
mov r12, rax
mov rcx, rax
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x140005205
mov rcx, r12
xor edx, edx
call sub.KERNEL32.dll_TerminateThread
test eax, eax
jne 0x14000522f
lea rax, str.Failed_to_terminate_thread._n
jmp 0x14000520c
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
lea rsi, [0x1400c1d12]
mov r13d, 0x1e
mov rdx, qword [rbp + 0x110]
test rdx, rdx
jne 0x140005187
jmp 0x140005199
lea rax, str.Failed_to_create_snapshot_of_threads._n
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
lea rax, [0x1400c16b0]
mov qword [rbp - 0x50], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
lea rcx, [rbp - 0x60]
call fcn.140033780
jmp 0x140005327
lea rax, [0x1400c1db8]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
lea rax, [0x1400c16b0]
mov qword [rbp - 0x50], rax
movups xmmword [rbp - 0x48], xmm6
lea rcx, [rbp - 0x60]
call fcn.140033780
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
jmp 0x140005101
call fcn.14004e0a0
mov ecx, 1
mov rdx, r13
call fcn.1400bf820
int3