Function at 0x140003950
Capabilities:
Create process on windows
Create thread
Enumerate processes
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14003f080]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor r12d, r12d
mov dword [rbp - 0x18], r12d
xor ecx, ecx
call fcn.14001275c
mov rbx, rax
call sub.KERNEL32.dll_GetCurrentProcessId
imul eax, ebx
mov ecx, eax
call fcn.14000f5e4
mov ebx, r12d
mov qword [rbp - 0x20], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x20]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400039fa
mov dword [rbp - 0x18], 4
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x10]
mov edx, 0x14
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne ebx, dword [rbp + 0x10]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140003a09
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140003a2c
lea rcx, str.____Run_as_admin__n
call fcn.140001140
lea rcx, str.pause
call fcn.140011f54
xor eax, eax
jmp 0x140003fb1
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r12
mov qword [rbp + 8], r12
mov r8d, 0xb
lea rdx, [0x140039208]
lea rcx, [rbp - 0x10]
call fcn.1400069e0
mov r14d, 0x18
lea rcx, [rbp - 0x10]
call fcn.140002db0
movzx ebx, al
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x140003aa3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003fe7
call fcn.140009910
test bl, bl
jne 0x140003ab3
lea rcx, str.____ExitLag.dll_not_found_n
jmp 0x140003a14
lea rcx, [rbp + 0x40]
call fcn.140003500
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
lea rcx, str.ExitCrack_By_Dante____n_n_1__Generate_New_Serial_n_2__Run_Exitlag_n
call fcn.140001140
movabs r13, 0xe38e38e38e38e38f
mov r15d, 1
movzx ebx, byte [rsp + 0x40]
lea rdx, [rbp + 0x20]
call fcn.140006410
lea rax, [rbp + 0x20]
mov rdi, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x38]
cmp rsi, 0xf
cmova rax, rdi
mov rcx, qword [rbp + 0x30]
cmp rcx, 1
jne 0x140003d43
cmp byte [rax], 0x31
jne 0x140003d43
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r12
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
or r14d, ecx
mov dword [rbp - 0x18], r14d
mov edx, 0x10
lea rcx, [rbp - 0x10]
call fcn.140006b10
mov rdi, r12
mov qword [rbp], r12
mov esi, 0x10
lea r12, str.0123456789abcdefghijklmnopqrstuvwxyz
call fcn.14000f5b8
movsxd rcx, eax
mov rax, r13
mul rcx
shr rdx, 5
lea rax, [rdx + rdx*8]
shl rax, 2
sub rcx, rax
movzx r9d, byte [rcx + r12]
mov rcx, qword [rbp + 8]
cmp rdi, rcx
jae 0x140003bb3
lea rax, [rdi + 1]
mov qword [rbp], rax
lea rax, [rbp - 0x10]
cmp rcx, 0xf
cmova rax, qword [rbp - 0x10]
mov byte [rax + rdi], r9b
mov byte [rax + rdi + 1], 0
jmp 0x140003bc3
movzx r8d, bl
mov rdx, r15
lea rcx, [rbp - 0x10]
call fcn.140006f20
sub rsi, 1
je 0x140003bcf
mov rdi, qword [rbp]
jmp 0x140003b68
lea rax, [rbp - 0x60]
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x60]
call fcn.1400051d0
mov rsi, rax
lea rcx, [rbp - 0x80]
call fcn.140003350
mov rdi, rax
lea rax, str._serial.txt
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0xb
call fcn.1400083c4
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x10], xmm0
lea r8, [rbp + 0x10]
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.140002340
or r14d, 6
mov dword [rbp - 0x18], r14d
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x58]
mov rcx, rdi
call fcn.1400050a0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
mov r12d, 0
jbe 0x140003c96
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003fed
call fcn.140009910
mov rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.140002510
nop
mov rdx, rsi
mov rcx, rax
call fcn.140002eb0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x140003cef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003cea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ff3
call fcn.140009910
lea rcx, str.___Generated_New_Serial_n
call fcn.140001140
and r14d, 0xfffffffe
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140003af5
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ff9
call fcn.140009910
jmp 0x140003af5
lea rax, [rbp + 0x20]
cmp rsi, 0xf
cmova rax, rdi
cmp rcx, 1
jne 0x140003d5a
cmp byte [rax], 0x32
je 0x140003d6b
lea rcx, str.____Unknown_operation_n
call fcn.140001140
jmp 0x140003af5
lea r8, [rbp + 0x40]
cmp qword [rbp + 0x58], 7
cmova r8, qword [rbp + 0x40]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, str.___Starting_Exitlag_n
call fcn.140001140
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x60], 0x130
lea rdx, [rbp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x140003de0
mov ebx, r12d
jmp 0x140003e1f
lea rdx, str.ExitLag.exe
lea rcx, [rbp + 0x8c]
call fcn.14002b580
mov rcx, rbx
test eax, eax
je 0x140003e16
lea rdx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140003de0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, r12d
jmp 0x140003e1f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x68]
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
je 0x140003db0
xor r9d, r9d
lea r8, [rbp + 0x60]
mov edx, 0x104
lea rcx, str.ExitLag.dll
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x140003f1f
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140003f1f
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
mov rcx, rbx
test rax, rax
je 0x140003f19
mov qword [rsp + 0x20], r12
mov r9d, 0x104
lea r8, [rbp + 0x60]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003f01
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140003f01
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.___Injected_n
call fcn.140001140
lea rcx, str.pause
call fcn.140011f54
jmp 0x140003f3a
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.____Inject_Failed_n
call fcn.140001140
lea rcx, str.pause
call fcn.140011f54
mov r15d, r12d
cmp rsi, 0xf
jbe 0x140003f72
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140003f69
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003fff
mov rcx, rdi
call fcn.140009910
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x140003fae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003fe1
call fcn.140009910
mov eax, r15d
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400098f0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140013404
int3
call fcn.140013404
nop
call fcn.140013404
nop
call fcn.140013404
nop
call fcn.140013404
nop
call fcn.140013404
int3