Function at 0x1400011c0
Capabilities:
Allocate or change rwx memory
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x98], rax
xor r15d, r15d
mov dword [rsp + 0x50], r15d
cmp ecx, 1
jle 0x140001342
mov r14, qword [rdx + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [r14 + rbx], r15b
jne 0x140001220
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x140001508
cmp rbx, 0x10
jae 0x140001279
mov r8, rbx
mov qword [rsp + 0x40], rbx
mov rdx, r14
mov qword [rsp + 0x48], 0xf
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x30], r15b
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x30]
jmp 0x140001310
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x1400012b2
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400017b0
test rax, rax
je 0x14000137f
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400012ef
mov ecx, 0x16
mov rsi, rax
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400012dd
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000150e
jmp 0x140001293
test rcx, rcx
je 0x1400012ec
call fcn.1400017b0
mov rdi, rax
jmp 0x1400012ef
mov rdi, r15
mov r8, rbx
mov qword [rsp + 0x30], rdi
mov rdx, r14
mov qword [rsp + 0x40], rbx
mov rcx, rdi
mov qword [rsp + 0x48], rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], r15b
cmp rsi, 0x10
lea rcx, [rsp + 0x30]
mov r15d, 1
cmovae rcx, rdi
cmp rbx, 8
jne 0x14000134c
mov r8, rbx
lea rdx, str.ax84c0ld
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000134c
movzx ebx, r15b
jmp 0x14000134e
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x30]
xor bl, bl
test r15b, 1
je 0x14000138e
cmp rsi, 0x10
jb 0x14000138e
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140001386
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001386
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400017ec
test bl, bl
je 0x1400014bb
xor edx, edx
mov dword [rsp + 0x60], 0x130
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400014d7
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400013f6
nop dword [rax + rax]
lea rdx, str.Neuz.exe
lea rcx, [rbp - 0x74]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov rcx, rbx
test eax, eax
je 0x140001404
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400013d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400014d7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x68]
test r8d, r8d
je 0x1400014d7
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400014d7
mov r9d, 0x40
mov dword [rbp + 0x90], 0x90909090
lea rax, [rsp + 0x50]
mov word [rbp + 0x94], 0x9090
mov edx, 0xd25604
mov qword [rsp + 0x20], rax
mov rcx, rbx
lea r8d, [r9 - 0x3a]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rsp + 0x58]
mov r9d, 6
lea r8, [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov edx, 0xd25604
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, dword [rsp + 0x50]
lea rax, [rsp + 0x50]
mov edx, 0xd25604
mov qword [rsp + 0x20], rax
mov r8d, 6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400014dc
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001520
mov rcx, rax
lea rdx, [0x1400016d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
mov rcx, qword [rbp + 0x98]
xor rcx, rsp
call fcn.140001790
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400011a0
int3
call fcn.140001100
int3