Function at 0x140005d40
Capabilities:
Create process on windows
Enumerate processes
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x308]
sub rsp, 0x3e0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140038080]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xor r12b, r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
xor r15d, r15d
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x20], r15
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x34], r15d
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r15w
movdqu xmmword [rbp - 0x10], xmm1
mov qword [rbp], r15
mov byte [rsp + 0x30], r15b
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x48]
call fcn.140005040
test al, al
je 0x14000650b
mov rdx, qword [rbp - 8]
sub rdx, qword [rbp - 0x10]
sar rdx, 5
lea rcx, [rbp + 8]
call fcn.140006520
cmp byte [rsp + 0x30], r15b
je 0x140005ec3
mov r8d, 0x104
lea rdx, [rbp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
lea rax, [rbp + 0x80]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140005e51
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x28]
call fcn.1400073c0
nop
call fcn.140008060
movzx ebx, al
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x140005eb7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005eb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005eb2
call fcn.140011ccc
int3
call fcn.14000984c
test bl, bl
jne 0x140005ec8
xor ecx, ecx
call fcn.14001204c
int3
call fcn.140008460
mov r13d, dword [rsp + 0x38]
mov esi, dword [rsp + 0x34]
mov dword [rsp + 0x34], esi
movsd xmm6, qword [0x140031e58]
nop dword [rax]
mov rdx, qword [rbp - 8]
sub rdx, qword [rbp - 0x10]
sar rdx, 5
lea rcx, [rbp + 8]
call fcn.140006520
mov r14, r15
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
sub rax, rcx
sar rax, 5
test rax, rax
je 0x140005ffa
lea rdi, [r15 + rcx]
mov dword [rbp + 0x80], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140005fad
lea rdx, [rbp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005fa4
mov rbx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140005f53
mov rbx, qword [rdi]
lea rcx, [rbp + 0xac]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rcx, rax
mov rdx, rbx
call fcn.140012a08
mov rcx, rsi
test eax, eax
je 0x140005f81
lea rdx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140005f42
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
shr rcx, 5
mov rax, qword [rbp + 8]
lea r8, [rax + rcx*4]
mov eax, r14d
and eax, 0x1f
mov edx, dword [r8]
bts edx, eax
jmp 0x140005fd1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
shr rcx, 5
mov rax, qword [rbp + 8]
lea r8, [rax + rcx*4]
movzx ecx, r14b
and cl, 0x1f
mov edx, 1
mov eax, dword [r8]
shl edx, cl
not edx
and edx, eax
mov dword [r8], edx
inc r14
add r15, 0x20
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
sub rax, rcx
sar rax, 5
cmp r14, rax
jb 0x140005f10
mov esi, dword [rsp + 0x34]
xor r15d, r15d
mov r10, qword [rbp + 8]
mov r11, qword [rbp + 0x20]
test r11, r11
jns 0x14000602c
mov rax, r11
neg rax
cmp r15, rax
jae 0x14000602c
mov rax, r11
not rax
shr rax, 5
lea rax, [rax*4 + 4]
mov r9, r10
sub r9, rax
jmp 0x140006037
mov rax, r11
shr rax, 5
lea r9, [r10 + rax*4]
mov r8, r11
and r8d, 0x1f
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r15
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x30], xmm0
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x30]
mov rax, r15
nop dword [rax]
cmp rdx, r9
jne 0x14000606e
cmp rax, r8
je 0x1400061ec
mov eax, 1
shl eax, cl
test dword [rdx], eax
jne 0x140006090
cmp rcx, 0x1f
jae 0x140006087
inc rcx
mov rax, rcx
jmp 0x140006060
mov rcx, r15
add rdx, 4
jmp 0x14000605a
test r12b, r12b
jne 0x1400061ec
lea r8, [0x140031ce0]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x28]
call fcn.1400071a0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov r8d, 0x2c
lea rdx, str.__startreplaybuffer___disable_shutdown_check
lea rcx, [rbp - 0x30]
call fcn.1400073c0
mov dword [rsp + 0x60], 0x70
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
mov qword [rbp - 0x3c], rax
mov dword [rbp - 0x34], eax
mov dword [rsp + 0x64], 0x40
lea rax, [rbp + 0x28]
cmp qword [rbp + 0x40], 8
cmovae rax, qword [rbp + 0x28]
mov qword [rsp + 0x78], rax
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rax, qword [rbp - 0x30]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x60], 8
cmovae rax, qword [rbp + 0x48]
mov qword [rbp - 0x78], rax
mov dword [rbp - 0x70], r15d
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov r12b, 1
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140006192
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000618d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064f9
call fcn.14000984c
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x1400063be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064ff
call fcn.14000984c
jmp 0x1400063be
test r11, r11
jns 0x140006213
mov rax, r11
neg rax
je 0x140006213
mov rax, r11
not rax
shr rax, 5
lea rax, [rax*4 + 4]
mov rdi, r10
sub rdi, rax
jmp 0x14000621e
mov rax, r11
shr rax, 5
lea rdi, [r10 + rax*4]
and r11d, 0x1f
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x58], r15
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x30], xmm0
mov rbx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x30]
mov r10, r15
mov rdx, r15
mov r9, r15
mov rcx, r15
mov rax, r15
nop dword [rax]
cmp r8, rdi
jne 0x140006260
mov rcx, r9
mov rdx, r10
cmp rax, r11
je 0x140006294
mov eax, 1
shl eax, cl
test dword [r8], eax
jne 0x1400063be
cmp rdx, 0x1f
jae 0x14000628b
lea rax, [rbx + 1]
mov rbx, rax
mov rcx, rax
mov r9, rax
mov rdx, rax
mov r10, rax
jmp 0x140006250
mov rbx, r15
add r8, 4
jmp 0x14000623e
test r12b, r12b
je 0x1400063be
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov r8d, 9
lea rdx, str.obs64.exe
lea rcx, [rbp - 0x30]
call fcn.1400073c0
mov dword [rbp + 0x80], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140006347
lea rdx, [rbp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000633e
lea rbx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rbx, qword [rbp - 0x30]
lea rcx, [rbp + 0xac]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rcx, rax
mov rdx, rbx
call fcn.140012a08
mov rcx, rdi
test eax, eax
je 0x140006330
lea rdx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x1400062f0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x88]
jmp 0x14000634c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0xffffffff
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14000638c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006387
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006505
call fcn.14000984c
cmp ebx, 0xffffffff
je 0x1400063bb
mov r8d, ebx
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400063bb
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12b, r12b
mov eax, r13d
test r12b, r12b
cmovne eax, esi
movsxd rbx, eax
call fcn.14000949c
mov rdi, rax
call fcn.140009480
cmp rdi, 0x989680
jne 0x1400063e6
imul rdi, rax, 0x64
jmp 0x140006404
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
imul rdi, rcx, 0x3b9aca00
add rdi, rax
test rbx, rbx
jle 0x14000642d
imul rax, rbx, 0xf4240
movabs rdx, 0x7fffffffffffffff
mov rcx, rdx
sub rcx, rax
cmp rdi, rcx
jge 0x14000642a
add rdi, rax
jmp 0x14000642d
mov rdi, rdx
movabs rsi, 0x112e0be826d694b3
movabs r15, 0x311cdad160000
call fcn.14000949c
mov rbx, rax
call fcn.140009480
cmp rbx, 0x989680
jne 0x14000645d
imul rbx, rax, 0x64
jmp 0x14000647e
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rbx, rdi
jge 0x1400064ed
call fcn.1400095d0
imul rdx, rax, 0x64
mov rax, rdi
sub rax, rbx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
seta r8b
test r8b, r8b
lea rcx, [rdx + r15]
jne 0x1400064af
lea rcx, [rdx + rax]
add rax, rdx
add rdx, r15
test r8b, r8b
cmove rdx, rax
mov rax, rsi
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp + 0x68], rdx
imul eax, edx, 0x3b9aca00
sub ecx, eax
mov dword [rbp + 0x70], ecx
lea rcx, [rbp + 0x68]
call fcn.140009600
jmp 0x140006441
mov esi, dword [rsp + 0x34]
xor r15d, r15d
jmp 0x140005ee0
call fcn.140011ccc
nop
call fcn.140011ccc
int3
call fcn.140011ccc
int3
xor ecx, ecx
call fcn.14001204c
int3