Function at 0x140003050
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x278]
sub rsp, 0x378
mov rax, qword [0x14004a058]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x20], r8
mov r8d, edx
mov dword [rsp + 0x34], edx
mov qword [rbp - 0x40], rcx
mov r12, qword [rbp + 0x2e0]
mov rdi, qword [rbp + 0x2e8]
mov qword [rbp - 0x10], rdi
cmp qword [rcx + 0x40], 0
jne 0x1400030f3
test r12, r12
je 0x1400030cd
mov dword [rbp - 0x30], 0x16
lea rax, section..data
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
mov rcx, r12
call fcn.140002920
nop
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140003560
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
xor ebx, ebx
mov qword [rdi + 0x38], rbx
xor al, al
jmp 0x1400039d7
xor ebx, ebx
mov esi, ebx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x38], ebx
mov qword [rbp + 0x240], rbx
mov qword [rbp + 0x250], rbx
mov qword [rbp + 0x258], rbx
lea r15, [rcx + 0x30]
mov r14, qword [r15 + 0x10]
mov r13, r15
cmp qword [r15 + 0x18], 8
jb 0x14000312e
mov r13, qword [r15]
cmp r14, 8
jae 0x140003152
movups xmm0, xmmword [r13]
movups xmmword [rbp + 0x240], xmm0
mov qword [rbp + 0x258], 7
mov edx, 7
jmp 0x1400031ac
mov rax, r14
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
cmova rax, rcx
mov qword [rbp - 0x38], rax
lea rdx, [rax + 1]
lea rcx, [rbp + 0x240]
call fcn.140004c70
mov qword [rbp + 0x240], rax
lea r8, [r14*2 + 2]
mov rdx, r13
mov rcx, rax
call fcn.1400145d0
mov rdx, qword [rbp - 0x38]
mov qword [rbp + 0x258], rdx
mov rcx, qword [rbp - 0x40]
mov r8d, dword [rsp + 0x34]
mov qword [rbp + 0x250], r14
mov eax, r8d
and eax, 0x40
shl eax, 0x12
mov dword [rbp - 0x38], eax
lea r9, str.runas
mov r13d, 1
and r8d, 0x20
mov dword [rbp - 0x40], r8d
lea r14, [rcx + 0x10]
je 0x140003271
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x50], 0x70
mov dword [rsp + 0x54], 0x440
mov qword [rsp + 0x60], r9
lea rax, [rbp + 0x240]
cmp rdx, 8
cmovae rax, qword [rbp + 0x240]
mov qword [rsp + 0x68], rax
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x14000323a
mov rax, qword [r14]
mov qword [rsp + 0x70], rax
mov dword [rbp - 0x80], r13d
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140003256
mov ecx, ebx
jmp 0x1400032a2
mov rsi, qword [rbp - 0x48]
mov qword [rsp + 0x40], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x38], eax
mov ecx, r13d
jmp 0x14000329e
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
mov r8d, eax
mov rdx, r14
lea rcx, [rbp + 0x240]
call fcn.140003e90
movzx ecx, al
mov rsi, qword [rsp + 0x40]
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x30], eax
test ecx, ecx
jne 0x140003622
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x490
je 0x1400032c0
cmp eax, 3
jne 0x140003414
test byte [rsp + 0x34], 4
je 0x1400034ce
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp]
call fcn.140014c80
cmp qword [r15 + 0x18], 8
jb 0x1400032e6
mov r15, qword [r15]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
lea r8, str..exe
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
lea rax, [rbp]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140003320
lea rdx, [rbp]
lea rcx, [rbp + 0x240]
call fcn.140004ed0
cmp dword [rbp - 0x40], 0
je 0x1400033da
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x50], 0x70
mov dword [rsp + 0x54], 0x440
lea rax, str.runas
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x240]
cmp qword [rbp + 0x258], 8
cmovae rax, qword [rbp + 0x240]
mov qword [rsp + 0x68], rax
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x1400033ac
mov rax, qword [r14]
mov qword [rsp + 0x70], rax
mov dword [rbp - 0x80], r13d
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1400033c8
mov ecx, ebx
jmp 0x14000340c
mov rsi, qword [rbp - 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov ecx, r13d
jmp 0x140003408
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, dword [rbp - 0x38]
mov rdx, r14
lea rcx, [rbp + 0x240]
call fcn.140003e90
movzx ecx, al
mov rsi, qword [rsp + 0x40]
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x30], eax
test ecx, ecx
jne 0x140003622
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2e4
jne 0x140003589
mov r15d, dword [rsp + 0x34]
test r13b, r15b
je 0x140003567
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x50], 0x70
mov dword [rsp + 0x54], 0x440
lea rax, str.runas
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x240]
cmp qword [rbp + 0x258], 8
cmovae rax, qword [rbp + 0x240]
mov qword [rsp + 0x68], rax
cmp qword [r14 + 0x18], 8
jb 0x140003497
mov r14, qword [r14]
mov qword [rsp + 0x70], r14
mov dword [rbp - 0x80], r13d
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1400034b4
mov r13d, ebx
jmp 0x1400034c5
mov rsi, qword [rbp - 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x30], eax
test r13d, r13d
jne 0x140003627
test r12, r12
je 0x1400034e8
lea rcx, [rbp - 0x30]
call fcn.140005780
mov rdx, rax
mov rcx, r12
call fcn.140002920
nop
mov rdx, qword [rbp + 0x258]
cmp rdx, 8
jb 0x14000352e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x240]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140003529
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400039fa
call fcn.1400124f4
mov word [rbp + 0x240], bx
mov qword [rbp + 0x258], 7
mov qword [rbp + 0x250], rbx
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140003560
cmp rcx, rdi
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
mov qword [rdi + 0x38], rbx
xor al, al
jmp 0x1400039d7
test r12, r12
je 0x140003833
lea rcx, [rbp - 0x30]
call fcn.140005780
mov rdx, rax
mov rcx, r12
call fcn.140002920
jmp 0x140003833
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x1400034ce
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x50], 0x70
mov dword [rsp + 0x54], 0x440
lea rax, str.open
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x240]
cmp qword [rbp + 0x258], 8
cmovae rax, qword [rbp + 0x240]
mov qword [rsp + 0x68], rax
mov dword [rbp - 0x80], r13d
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1400034ce
mov rsi, qword [rbp - 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov r14d, eax
mov r15d, dword [rsp + 0x34]
jmp 0x14000362c
mov r15d, dword [rsp + 0x34]
mov r14d, dword [rsp + 0x30]
mov r13, qword [rbp - 0x18]
test r13, r13
je 0x140003639
mov qword [r13], rsi
test r15b, 2
jne 0x14000364a
cmp qword [rbp - 0x20], 0
je 0x140003952
mov rcx, rsi
cmp qword [rdi + 0x38], 0
jne 0x1400036e3
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test r15b, 8
je 0x1400037e8
xor edx, edx
lea ecx, [rdx + 0xf]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400037e8
mov dword [rbp], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 4]
call fcn.140014c80
lea rdx, [rbp]
mov rcx, r15
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400037df
lea rdx, [rbp]
mov rcx, r15
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x1400037df
cmp dword [rbp + 0x20], r14d
je 0x1400037a4
lea rdx, [rbp]
mov rcx, r15
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400036c4
jmp 0x1400037df
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140003663
nop dword [rax]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140003a06
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rsi
test al, al
jne 0x140003731
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x140003700
jmp 0x140003663
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x258]
cmp rdx, 8
jb 0x14000377e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003779
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400039fa
call fcn.1400124f4
mov qword [rbp + 0x250], rbx
mov qword [rbp + 0x258], 7
mov word [rbp + 0x240], bx
mov rcx, rdi
call fcn.140002790
jmp 0x1400039d5
mov r8d, dword [rbp + 8]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x1400037df
mov rcx, rax
cmp qword [rdi + 0x38], 0
jne 0x1400038a1
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp - 0x20]
test rax, rax
je 0x140003952
mov dword [rax], ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140003952
test r12, r12
je 0x140003824
lea rcx, [rbp - 0x30]
call fcn.140005780
mov rdx, rax
mov rcx, r12
call fcn.140002920
test r13, r13
jne 0x140003833
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x258]
cmp rdx, 8
jb 0x140003879
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x240]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140003874
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400039fa
call fcn.1400124f4
mov qword [rbp + 0x250], rbx
mov qword [rbp + 0x258], 7
mov word [rbp + 0x240], bx
mov rcx, rdi
call fcn.140002790
xor al, al
jmp 0x1400039d7
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400037d6
nop word [rax + rax]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140003a0c
mov rax, qword [rcx]
call qword [rax + 0x10]
test al, al
jne 0x1400038f1
mov edx, 0x64
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1400038c0
jmp 0x1400037d6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x258]
cmp rdx, 8
jb 0x14000377e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003779
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a00
jmp 0x140003779
test r13, r13
jne 0x140003961
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x258]
cmp rdx, 8
jb 0x1400039a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000399e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400039fa
call fcn.1400124f4
mov qword [rbp + 0x250], rbx
mov qword [rbp + 0x258], 7
mov word [rbp + 0x240], bx
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400039d5
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
mov qword [rdi + 0x38], rbx
mov al, 1
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140012b20
add rsp, 0x378
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400190b8
nop
call fcn.1400190b8
nop
call fcn.140010ca8
int3
call fcn.140010ca8
int3