Function at 0x1400019a0
Capabilities:
Acquire debug privileges
Enumerate processes
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x48], rdi
movdqa xmm0, xmmword [0x140024960]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], dil
mov r12, qword [rdx + 8]
cmp ecx, 2
jl 0x140001dd0
lea rdx, [0x140024908]
mov rcx, r12
call fcn.1400083e4
mov r14, rax
test rax, rax
jne 0x140001a19
mov rdx, qword [rbx + 8]
lea rcx, str.unable_to_open_file:__s_n
call fcn.140001010
lea r15d, [rdi + 1]
jmp 0x140001ddf
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, r14
call fcn.1400089a0
mov rcx, r14
call fcn.140008288
movsxd rbx, eax
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.1400089a0
lea eax, [rbx + 1]
movsxd rdx, eax
mov r15d, 1
mov ecx, r15d
call fcn.140008320
mov rsi, rax
mov r8, rbx
mov r9, r14
mov edx, r15d
mov rcx, rax
call fcn.14000ac84
mov rcx, r14
call fcn.1400086b8
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rsi + r8], 0
jne 0x140001a76
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140001ea0
mov qword [rbp + 0xf8], rdi
mov qword [rbp + 0xf0], r15
lea rcx, [0x140024938]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.Py_NoSiteFlag
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rax], r15
xor ecx, ecx
call qword [sym.imp.python27.dll_Py_InitializeEx]
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rcx, qword [rsp + 0x48]
xor r9d, r9d
mov r8d, 0x101
mov rdx, r12
call qword [sym.imp.python27.dll_Py_CompileStringFlags]
mov rbx, rax
test rax, rax
jne 0x140001b48
lea r8, [rsp + 0x38]
lea rdx, [rbp + 0xe8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.python27.dll_PyErr_Fetch]
lea r8, [rsp + 0x38]
lea rdx, [rbp + 0xe8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.python27.dll_PyErr_NormalizeException]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.python27.dll_PyObject_Str]
mov rcx, rax
call qword [sym.imp.python27.dll_PyString_AsString]
lea r9d, [rbx + 0x10]
lea r8, str.Compile_Error_
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 2
mov rcx, rbx
call qword [sym.imp.python27.dll_PyMarshal_WriteObjectToString]
mov rbx, rax
test rax, rax
jne 0x140001bb8
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0xe8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.python27.dll_PyErr_Fetch]
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0xe8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.python27.dll_PyErr_NormalizeException]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.python27.dll_PyObject_Str]
mov rcx, rax
call qword [sym.imp.python27.dll_PyString_AsString]
lea r9d, [rbx + 0x10]
lea r8, str.Compile_Error_
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0xf8]
mov rcx, rbx
call qword [sym.imp.python27.dll_PyString_AsStringAndSize]
cmp eax, 0xffffffff
jne 0x140001c30
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0xe8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.python27.dll_PyErr_Fetch]
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0xe8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.python27.dll_PyErr_NormalizeException]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.python27.dll_PyObject_Str]
mov rcx, rax
call qword [sym.imp.python27.dll_PyString_AsString]
mov r9d, 0x10
lea r8, str.Compile_Error_
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.python27.dll_Py_Finalize]
mov r12d, dword [rbp + 0xf0]
mov r13, qword [rbp + 0xf8]
xor edx, edx
mov r8d, 0x12c
lea rcx, [rsp + 0x74]
call fcn.140003e30
mov dword [rsp + 0x70], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140001de2
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140001dc5
lea rdx, str.exeFile.exe
lea rcx, [rbp - 0x64]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140001d7d
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0xe8]
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140001d2c
lea r8, [rsp + 0x30]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140001d1f
mov dword [rsp + 0x38], r15d
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x78]
mov r8d, esi
xor edx, edx
mov ecx, 0x43b
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140001da7
mov edx, esi
lea rcx, str.Processing__eve_process__d_n
call fcn.140001010
mov r8d, r12d
mov rdx, r13
mov rcx, rbx
call fcn.1400014c0
test eax, eax
je 0x140001d90
lea rcx, str.Injection_succeeded._n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x140001c84
lea rcx, str.Injection_failed._n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001de2
mov r9d, 0x10
lea r8, str.Error_
lea rdx, str.Couldnt_open_process_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140001de2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001de2
lea rcx, str.no_args
call fcn.140001010
mov r15d, edi
mov edi, r15d
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140001e1b
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e38
call fcn.140002194
mov eax, edi
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14000b0f4
int3