Function at 0x1400036e0
Capabilities:
Enumerate processes

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x270
mov rax, qword [0x140047040]
xor rax, rsp
mov qword [rsp + 0x268], rax
mov rbx, rdx
cmp ecx, 3
jne 0x1400039c9
mov qword [r11 + 0x18], rsi
lea rdx, str._tWhich_kind_of_Injection_do_you_want_
lea rcx, [0x140048460]
mov qword [r11 + 0x20], rdi
call fcn.140005910
mov rcx, rax
call fcn.140005bc0
lea rdx, str._t_1_:_DLLInject
lea rcx, [0x140048460]
call fcn.140005910
mov rcx, rax
call fcn.140005bc0
lea rdx, str._t_2_:_APCInject
mov rcx, rax
call fcn.140005910
mov rcx, rax
call fcn.140005bc0
lea rdx, str._t_3_:_ThreadHiJacking
lea rcx, [0x140048460]
call fcn.140005910
mov rcx, rax
call fcn.140005bc0
lea rdx, str._t_4_:_MappingInject
mov rcx, rax
call fcn.140005910
mov rcx, rax
call fcn.140005bc0
lea rdx, str._t_5_:_FunctionStomping
lea rcx, [0x140048460]
call fcn.140005910
mov rcx, rax
call fcn.140005bc0
xor edi, edi
lea rdx, [rsp + 0x260]
mov dword [rsp + 0x260], edi
call fcn.140005e70
mov esi, dword [rsp + 0x260]
mov ecx, esi
call fcn.1400033e0
call fcn.140002060
lea rcx, [0x140048460]
test eax, eax
je 0x1400039bd
lea rdx, str._t___Dynamic_Call_Successfully_:_
call fcn.140005910
mov rcx, rax
call fcn.140005bc0
cmp esi, 1
jne 0x140003815
mov rcx, qword [rbx + 8]
call fcn.1400023c0
mov rdx, qword [rbx + 0x10]
mov ecx, eax
call fcn.140003180
jmp 0x1400038fe
cmp esi, 2
jne 0x140003833
mov rcx, qword [rbx + 8]
call fcn.1400023c0
mov rdx, qword [rbx + 0x10]
mov ecx, eax
call fcn.140002480
jmp 0x1400038fe
cmp esi, 3
jne 0x140003977
mov qword [rsp + 0x280], rbp
lea rcx, [rsp + 0x24]
mov rbp, qword [rbx + 8]
xor edx, edx
mov r8d, 0x234
call fcn.140031fb0
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rsi - 1]
call qword [0x140049d10]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rdx, str._t___Below_Are_The_Process_PID_:_
lea rcx, [0x140048460]
call fcn.140005910
mov rcx, rax
call fcn.140005bc0
nop dword [rax]
mov rdx, rbp
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1400038c5
mov edx, dword [rsp + 0x28]
inc edi
call fcn.1400039f0
mov rcx, rax
call fcn.140005bc0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400038a0
mov rbp, qword [rsp + 0x280]
lea rcx, [0x140048460]
test edi, edi
jne 0x140003929
lea rdx, str._t____Process_PID_Not_Found_:_
call fcn.140005910
mov rcx, rax
call fcn.140005bc0
mov rsi, qword [rsp + 0x290]
mov rdi, qword [rsp + 0x298]
xor eax, eax
mov rcx, qword [rsp + 0x268]
xor rcx, rsp
call fcn.14000e150
add rsp, 0x270
pop rbx
ret
lea rdx, str._t___Which_Threads_PID_Do_You_Wanna_HiJack_:_
call fcn.140005910
mov rcx, rax
call fcn.140005bc0
lea rdx, str._t____This_May_Cause_Process_Collapse___Watch_Out____
lea rcx, [0x140048460]
call fcn.140005910
mov rcx, rax
call fcn.140005bc0
lea rdx, [rsp + 0x260]
call fcn.140005c50
mov rdx, qword [rbx + 0x10]
mov ecx, dword [rsp + 0x260]
call fcn.1400027a0
jmp 0x1400038fe
cmp esi, 4
jne 0x14000398e
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.140002e10
jmp 0x1400038fe
cmp esi, 5
jne 0x1400039a5
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.140002a30
jmp 0x1400038fe
call fcn.140003600
lea rdx, str._t____Please_choose_the_number_below_:_
lea rcx, [0x140048460]
jmp 0x1400038f1
lea rdx, str._t____Dynamic_Call_Failed_:_
jmp 0x1400038f1
call fcn.140003600
lea rdx, str._t____Two_Parameters_are_required
lea rcx, [0x140048460]
call fcn.140005910
mov rcx, rax
call fcn.140005bc0
jmp 0x14000390e