Function at 0x140001ab0
Capabilities:
Create thread
Enumerate processes
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rbp + 0x200], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xor r12d, r12d
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], r12b
movups xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x1400046b0]
movdqu xmmword [rbp - 0x58], xmm1
mov byte [rbp - 0x68], r12b
lea r8d, [r12 + 6]
lea rcx, [rsp + 0x78]
call fcn.140001e70
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea r14, [rsp + 0x78]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rbp - 0x70]
cmp r15, 0x10
cmovae r14, rsi
movabs rbx, 0x7fffffffffffffff
mov rdi, qword [rbp - 0x78]
cmp rdi, rbx
ja 0x140001dfe
mov qword [rsp + 0x48], 0xf
cmp rdi, 0x10
jae 0x140001b9b
mov qword [rsp + 0x40], rdi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x30], xmm0
jmp 0x140001c32
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140001bd3
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002420
mov rcx, rax
test rax, rax
je 0x140001bfe
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001c14
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001c05
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001e04
jmp 0x140001bb5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001c11
call fcn.140002420
jmp 0x140001c14
mov rax, r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x30]
call fcn.140001920
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x140001400]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x60], r12
mov ecx, 0x20
call fcn.140002420
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0xa
mov qword [rsp + 0x70], 0xf
movups xmm0, xmmword [str.aworex.exe]
movups xmmword [rax], xmm0
mov ecx, dword [0x140004698]
mov dword [rax + 0x10], ecx
mov word [rax + 0x14], r12w
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001ddb
mov dword [rbp - 0x40], 0x238
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001dd2
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea rcx, [rbp - 0x14]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x140001cfa
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140001cc4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140001d52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d4d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000245c
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r12w
cmp r15, 0x10
jb 0x140001da0
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001d98
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d98
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14000245c
xor eax, eax
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140002400
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400066c8]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [0x1400066d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1400011a0
int3
call fcn.140001100
int3