Function at 0x1400697d0
Capabilities:
Check if file exists
Create process on windows
Enumerate process modules
Enumerate threads
Suspend thread
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x990
mov rax, qword [0x1403e5188]
xor rax, rsp
mov qword [rsp + 0x980], rax
mov rbx, rdx
mov qword [rsp + 0x78], rdx
mov r14, rcx
mov qword [rsp + 0x68], rcx
lea rcx, [0x1403f1bb0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1403f1ba8], 0
jne 0x140069ea0
mov r12d, 1
mov dword [0x1403f1ba8], r12d
mov rax, qword [0x1403f1bd8]
test rax, rax
je 0x14006985f
mov rcx, r14
call rax
test eax, eax
je 0x14006985f
lea rcx, [0x1403f1bb0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [r12 - 2]
jmp 0x140069ea2
mov rax, qword [0x1403f1b50]
test rax, rax
je 0x14006986d
call rax
mov byte [rsp + 0x50], 0
xor edi, edi
mov dword [rsp + 0x60], edi
mov rax, qword [0x1403f1b68]
test rax, rax
je 0x140069981
mov dword [rsp + 0x58], edi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x58]
lea ecx, [rdi + 2]
call rax
test eax, eax
js 0x140069981
cmp dword [rsp + 0x58], r12d
jne 0x140069981
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
test eax, eax
jne 0x1400698c2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r13d, eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x124], xmm0
mov qword [rsp + 0x134], rdi
mov dword [rsp + 0x120], 0x1c
xor edx, edx
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r15, rax
test rax, rax
je 0x14006996d
lea rdx, [rsp + 0x120]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x140069964
cmp esi, dword [rsp + 0x12c]
jne 0x14006994b
mov r8d, dword [rsp + 0x128]
cmp r13d, r8d
je 0x14006994b
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x14006994b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x120]
mov rcx, r15
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x140069910
mov rbx, qword [rsp + 0x78]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1403f1b70]
test rax, rax
je 0x140069981
mov edx, dword [rsp + 0x60]
xor ecx, ecx
call rax
call fcn.140029940
mov rdx, qword [0x1403f1b98]
mov qword [rdx + 0x28], rax
mov qword [rdx + 0x5b0], r14
mov rax, qword [r14]
movups xmm0, xmmword [rax]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x60], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x70], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x80], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x90], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx + 0xb0], xmm1
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rdx + 0xc0], xmm0
movsd xmm1, qword [rax + 0x90]
movsd qword [rdx + 0xd0], xmm1
mov rax, qword [r14 + 8]
lea rcx, [rdx + 0xe0]
mov r8d, 9
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub r8, r12
jne 0x140069a20
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
mov qword [rdx + 0x874], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [0x1403f1b98]
mov dword [rcx + 0x20], eax
test byte [rcx + 4], 4
je 0x140069ab8
mov eax, edi
jmp 0x140069ac5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x1403f1b98]
mov dword [rcx + 0x880], eax
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x90], 0x18
mov qword [rsp + 0x98], rdi
mov dword [rsp + 0xa0], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140069b85
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov r8, rcx
mov rdx, rcx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ebx, eax
test eax, eax
je 0x140069b85
lea r15, [0x1403f1be0]
cmp word [0x1403f1be0], di
je 0x140069b61
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140069b8c
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r15
mov r9d, 0x105
xor r8d, r8d
lea rdx, str.TxBugReport.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
jmp 0x140069b8c
lea r15, [0x1403f1be0]
test rsi, rsi
je 0x140069e6b
test ebx, ebx
je 0x140069e5d
cmp word [0x1403f1be0], di
je 0x140069e5d
mov qword [rsp + 0x88], rdi
call fcn.14006b6c0
mov qword [rsp + 0x88], rax
jmp 0x140069bd8
mov rax, qword [0x1403f1b98]
test byte [rax + 4], 0x10
je 0x140069cb1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x140], 0x438
lea rdx, [rsp + 0x140]
mov rcx, rax
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x140069c8f
lea rcx, [rsp + 0x170]
call qword [0x1402da260]
lea rcx, [rsp + 0x170]
call fcn.14006aa80
test eax, eax
jne 0x140069c5d
mov edx, dword [rsp + 0x160]
lea r8, [rsp + 0x370]
mov rcx, qword [rsp + 0x168]
call fcn.14006ac00
jmp 0x140069c7b
lea rdx, [rsp + 0x140]
mov rcx, rbx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x140069c22
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140069cb1
test r14, r14
je 0x140069cde
mov edx, 0x10
mov rcx, r14
call fcn.1400692b0
mov edx, 0x98
mov rcx, qword [r14]
call fcn.1400692b0
mov edx, 0x4d0
mov rcx, qword [r14 + 8]
call fcn.1400692b0
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x580]
call fcn.1402b61f1
mov rbx, qword [0x1403f1ba0]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], eax
mov rax, qword [0x1403f1b98]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov r9, r15
lea r8, str.__s___buginfo:_p:_p:_p:_lu__extinfo:_p
mov edx, 0x200
lea rcx, [rsp + 0x580]
call fcn.14006d970
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], rax
mov dword [rsp + 0xb0], 0x68
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0xd8], xmm0
movups xmmword [rsp + 0xe8], xmm0
movups xmmword [rsp + 0xf8], xmm0
movups xmmword [rsp + 0x108], xmm0
mov dword [rsp + 0xec], r12d
mov word [rsp + 0xf0], r12w
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rax, [rsp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x580]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140069e4a
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rsi
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
movzx ecx, byte [rsp + 0x50]
cmp eax, 1
cmove ecx, r12d
mov byte [rsp + 0x50], cl
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140069e5d
call qword [0x1402d9fb0]
test rsi, rsi
je 0x140069e6b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1403f1b58]
test rax, rax
je 0x140069e79
call rax
cmp byte [rsp + 0x50], 0
jne 0x140069e8a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x140069ea0
mov rax, qword [r14]
mov ebx, dword [rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov rcx, qword [rsp + 0x980]
xor rcx, rsp
call fcn.14026fc70
lea r11, [rsp + 0x990]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret