Function at 0x1400393a0
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x140048040]
xor rax, rsp
mov qword [rbp + 0xa0], rax
xor r12d, r12d
mov rdi, rdx
mov qword [rsp + 0x48], r12
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x48]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14003964e
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x50]
mov dword [rsp + 0x40], 4
mov edx, 0x14
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x14003964e
mov qword [rsp + 0x1e8], r13
movabs r13, 0x7fffffffffffffff
mov qword [rsp + 0x1f0], r14
movabs r14, 0x4e94914f0000
mov qword [rsp + 0x1f8], r15
movabs r15, 0x431bde82d7b634db
nop
xor edx, edx
lea rcx, [rsp + 0x74]
mov r8d, 0x12c
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rsp + 0x70], 0x130
mov ecx, 2
mov dword [rsi + 0x10], r12d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140039506
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400394fd
nop word [rax + rax]
lea r8, [rbp - 0x64]
mov rcx, rdi
sub r8, rdi
nop word [rax + rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x1400394e3
inc rcx
test eax, eax
jne 0x1400394d0
mov rcx, rbx
test edx, edx
je 0x1400395a5
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400394c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
call fcn.140039280
mov rbx, qword [rsp + 0x40]
movabs rax, 0x7fffffffc46535ff
cmp rbx, rax
jge 0x14003952d
add rbx, 0x3b9aca00
jmp 0x140039530
mov rbx, r13
lea rcx, [rsp + 0x50]
call fcn.140039280
mov rax, qword [rsp + 0x50]
cmp rax, rbx
jge 0x140039470
nop dword [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jl 0x140039562
mov ecx, 0x5265c00
jmp 0x140039587
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140039585
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x50]
call fcn.140039280
mov rax, qword [rsp + 0x50]
cmp rax, rbx
jl 0x140039550
jmp 0x140039470
mov eax, dword [rsp + 0x78]
mov dword [rsi + 0x10], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], r12d
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov r8d, 3
mov dword [rsp + 0x5c], 0x454349
mov dword [rsp + 0x50], 0x5c2e5c5c
mov dword [rsp + 0x54], 0x544f4f52
mov dword [rsp + 0x58], 0x5645445f
mov byte [rsp + 0x60], r12b
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, qword [rsp + 0x1f8]
mov r14, qword [rsp + 0x1f0]
mov r13, qword [rsp + 0x1e8]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x14003964a
movdqa xmm0, xmmword [0x140041910]
lea rdx, [rsp + 0x50]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x61], 0x64
mov byte [rsp + 0x60], 0x65
mov byte [rsp + 0x63], r12b
jmp 0x14003967b
mov al, 1
jmp 0x14003968b
mov word [rsp + 0x5b], 0x6e
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x206e7552
mov dword [rsp + 0x54], 0x61207361
mov word [rsp + 0x58], 0x6d64
mov byte [rsp + 0x5a], 0x69
mov byte [rsp + 0x5d], r12b
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140039b90
add rsp, 0x1b0
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret