Function at 0x140001260
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x290], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov ecx, 0x20
call fcn.1400018d0
mov rsi, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 0xb
mov qword [rsp + 0x40], 0xf
movups xmm0, xmmword [str.Discord.exe]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400033e0]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x1400033e4]
mov word [rax + 0x14], cx
xor eax, eax
mov word [rsi + 0x16], ax
movabs rbp, 0x4e94914f0000
movabs r13, 0x7ffffffed5fa0dff
movabs r12, 0x7fffffffffffffff
movabs r15, 0xb2f4fc0794908cf3
movabs r14, 0x431bde82d7b634db
movabs rdi, 0x12a05f200
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001477
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000146e
nop word [rax + rax]
lea rcx, [rsp + 0x7c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140001370
cmp rax, 0xb
jne 0x140001458
mov rdx, rax
lea rax, [rsp + 0x7c]
lea rcx, [rsp + 0x7c]
mov r8, rsi
sub r8, rcx
nop word [rax + rax]
movzx ecx, word [rax]
cmp word [rax + r8], cx
jne 0x140001458
add rax, 2
sub rdx, 1
jne 0x1400013a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x58]
test ebx, ebx
je 0x140001477
lea rdx, str.Discord_is_running._Shutting_it_down...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001610
mov rcx, rax
lea rdx, [0x1400017f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, ebx
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140001429
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
lea rdx, str.Discord_has_been_successfully_shut_down.
jne 0x140001430
lea rdx, str.Failed_to_terminate_Discord.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001610
mov rcx, rax
lea rdx, [0x1400017f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
movabs rdi, 0x12a05f200
jmp 0x14000149a
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001360
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Discord_is_not_running._Waiting...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001610
mov rcx, rax
lea rdx, [0x1400017f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rsp + 0x20]
call fcn.140001180
mov rax, qword [rsp + 0x20]
cmp rax, r13
jge 0x1400014b3
add rdi, rax
jmp 0x1400014b6
mov rdi, r12
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x1400014d7
imul rax, rcx, 0x64
jmp 0x140001548
cmp rbx, 0x16e3600
jne 0x14000152a
mov rax, r15
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r15
imul rcx
lea rax, [rcx + rdx]
sar rax, 0x18
mov rcx, rax
shr rcx, 0x3f
add rax, rcx
imul rcx, r8, 0x3b9aca00
jmp 0x140001545
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rdi
jge 0x140001313
mov rcx, rdi
sub rcx, rax
cmp rcx, rbp
jl 0x14000156b
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x1400014b6
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14000158e
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x1400014b6