Function at 0x1400058d0
Capabilities:
Contain obfuscated stackstrings
Enumerate process modules

Disassembly:
push rbp
lea rbp, [rsp - 0x1010]
mov eax, 0x1110
call fcn.140120d90
sub rsp, rax
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x1120], rbx
mov qword [rsp + 0x1128], rsi
mov qword [rsp + 0x1130], rdi
mov qword [rsp + 0x1138], r14
mov rax, qword [0x1419761c8]
xor rax, rsp
mov qword [rbp + 0x1000], rax
mov dword [rsp + 0x20], 0x360033
mov dword [rsp + 0x24], 0x740030
mov dword [rsp + 0x28], 0x610072
mov dword [rsp + 0x2c], 0x2e0079
mov dword [rsp + 0x30], 0x780065
mov dword [rsp + 0x34], reloc.WS2_32.dll_WSAAsyncSelect
xor esi, esi
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], rsi
mov word [rbp - 0x60], si
lea r8d, [rsi + 8]
lea rdx, [0x1402b8708]
lea rcx, [rbp - 0x60]
call fcn.1400081d0
nop
mov qword [rbp - 0x68], 7
mov qword [rbp - 0x70], rsi
mov word [rbp - 0x80], si
lea r8d, [rsi + 0x53]
lea rdx, [0x1402b8720]
lea rcx, [rbp - 0x80]
call fcn.1400081d0
nop
call fcn.1400098f0
lea r14, [0x1402b84e0]
nop dword [rax]
lea rcx, [rsp + 0x20]
call fcn.14000ab70
mov ebx, eax
test eax, eax
je 0x140005c19
lea r8, [rsp + 0x78]
mov edx, 0x1000
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140005c19
mov edx, dword [rsp + 0x78]
shr edx, 2
mov dword [rsp + 0x78], edx
mov ecx, esi
test edx, edx
je 0x140005c19
mov eax, ecx
cmp dword [rbp + rax*4], ebx
je 0x140005a09
inc ecx
cmp ecx, edx
jae 0x140005c19
jmp 0x1400059f5
mov edi, esi
nop dword [rax + rax]
mov qword [rsp + 0x50], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.140025fb0
mov rbx, rax
or r8d, 0xffffffff
lea rdx, [0x1402b87c8]
lea rcx, [rsp + 0x38]
call fcn.140004290
nop
mov rdx, rax
mov rcx, qword [rbx]
call fcn.14003ffd0
nop
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx]
test eax, eax
je 0x140005a7c
cmp eax, 0xffffffff
je 0x140005a8a
or eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140005a8a
mov rcx, qword [rsp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140039ba0
mov rcx, qword [rbx]
cmp byte [rcx + 0x20], 0
je 0x140005a9a
mov dl, 0x20
call fcn.140040050
mov edx, WSAAsyncSelect
mov rcx, qword [rbx]
call fcn.1400401b0
mov rcx, qword [rbx]
cmp byte [rcx + 0x20], 0
je 0x140005ab7
mov dl, 0x20
call fcn.140040050
or r8d, 0xffffffff
lea rdx, [0x1402b87d0]
lea rcx, [rsp + 0x40]
call fcn.140004290
nop
mov rdx, rax
mov rcx, qword [rbx]
call fcn.14003ffd0
nop
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx]
test eax, eax
je 0x140005afa
cmp eax, 0xffffffff
je 0x140005b08
or eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140005b08
mov rcx, qword [rsp + 0x40]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140039ba0
mov rcx, qword [rbx]
cmp byte [rcx + 0x20], 0
je 0x140005b18
mov dl, 0x20
call fcn.140040050
mov edx, edi
mov rcx, qword [rbx]
call fcn.1400401b0
mov rcx, qword [rbx]
cmp byte [rcx + 0x20], 0
je 0x140005b33
mov dl, 0x20
call fcn.140040050
nop
lea rcx, [rsp + 0x48]
call fcn.1400380f0
mov ecx, 1
call fcn.140029e90
inc edi
cmp edi, 0xa
jl 0x140005a10
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.1400092b0
nop
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x40]
call fcn.1400092b0
nop
mov r9d, 0xa
xor r8d, r8d
lea rdx, [0x1402b86b0]
lea rcx, [rbp - 0x20]
call fcn.1400080b0
cmp rax, 0xffffffffffffffff
je 0x140005ba3
mov r8d, 0x1d
lea rdx, [0x1402b86c8]
lea rcx, [rbp - 0x40]
call fcn.1400081d0
lea r8, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae r8, qword [rbp - 0x60]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
xor ecx, ecx
lea r9d, [rcx + 0x40]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov r8, qword [rbp - 0x28]
cmp r8, 8
jb 0x140005be6
inc r8
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.140008870
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], rsi
mov word [rbp - 0x40], si
mov r8, qword [rbp - 8]
cmp r8, 8
jb 0x1400059b0
inc r8
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
call fcn.140008870
jmp 0x1400059b0
mov r8, qword [rbp - 0x68]
cmp r8, 8
jb 0x140005c33
inc r8
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.140008870
mov qword [rbp - 0x68], 7
mov qword [rbp - 0x70], rsi
mov word [rbp - 0x80], si
mov r8, qword [rbp - 0x48]
cmp r8, 8
jb 0x140005c5d
inc r8
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x60]
call fcn.140008870
mov rcx, qword [rbp + 0x1000]
xor rcx, rsp
call fcn.1401202c0
lea r11, [rsp + 0x1110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret