Function at 0x14003b6f0
Capabilities:
Create directory
Create thread
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x140055040]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Close_this_console_to_stop_RuitAntiLeak_process..._n
xor r15d, r15d
call fcn.14003c710
lea rdx, str.RuitAntiLeak.exe
lea rcx, [rbp - 0x78]
call fcn.14003bfd0
xor edx, edx
mov dword [rbp - 0x20], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, qword [rbp - 0x60]
mov rdi, rax
mov rsi, qword [rbp - 0x78]
cmp rax, 0xffffffffffffffff
je 0x14003b875
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rax, [rbp + 0xc]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], r15w
jne 0x14003b790
mov rbx, qword [rbp - 0x68]
lea r9, [rbp - 0x78]
cmp r14, 7
lea rdx, [rbp + 0xc]
mov r8, rbx
cmova r9, rsi
cmp rcx, rbx
cmovb r8, rcx
test r8, r8
je 0x14003b7d8
lea rax, [rbp + 0xc]
sub r9, rax
movzx eax, word [rdx]
cmp word [r9 + rdx], ax
jne 0x14003b7f0
add rdx, 2
sub r8, 1
jne 0x14003b7c4
cmp rbx, rcx
jb 0x14003b7f0
ja 0x14003b7f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 0x18]
jmp 0x14003b878
lea rdx, [rbp - 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003b86c
lea rax, [rbp + 0xc]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], r15w
jne 0x14003b810
cmp r14, 7
lea r9, [rbp - 0x78]
mov r8, rbx
lea rax, [rbp + 0xc]
cmova r9, rsi
cmp rdx, rbx
cmovb r8, rdx
test r8, r8
je 0x14003b854
lea rcx, [rbp + 0xc]
sub r9, rcx
movzx ecx, word [rax]
cmp word [r9 + rax], cx
jne 0x14003b85b
add rax, 2
sub r8, 1
jne 0x14003b840
cmp rbx, rdx
jb 0x14003b85b
jbe 0x14003b7df
lea rdx, [rbp - 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003b801
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, r15d
cmp r14, 7
jbe 0x14003b8b3
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003b8ab
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003be59
mov rcx, rsi
call fcn.1400448c0
test ebx, ebx
je 0x14003b93c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebx, eax
je 0x14003b93c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x14004caf0]
call fcn.14003c710
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140047da0]
call fcn.14003c710
xor r9d, r9d
lea r8, str.RuitAntiLeak
lea rdx, str.Another_instance_is_already_running
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1400447d0
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov edx, 0x7f00
mov dword [0x140071c70], r15d
xor ecx, ecx
mov dword [0x140071c78], r15d
mov dword [0x140071bdc], 0x780
mov dword [0x140071c7c], 0x438
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov edx, 0x7f00
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [0x140036500]
mov qword [0x140071ca8], rbx
mov qword [0x140071c88], rcx
lea rbx, str.RuitAntiLeak
xorps xmm0, xmm0
mov qword [0x140071c80], 0x50
lea rcx, [0x140071c80]
mov qword [0x140071c90], r15
mov qword [0x140071c98], r15
mov qword [0x140071ca0], rdi
movdqa xmmword [0x140071cb0], xmm0
mov qword [0x140071cc0], rbx
mov qword [0x140071cc8], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rax, qword [0x140071c98]
mov r9d, 0x90000000
mov qword [rsp + 0x58], r15
mov r8, rbx
mov qword [rsp + 0x50], rax
mov rdx, rbx
mov eax, dword [0x140071c7c]
xor ecx, ecx
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], eax
mov eax, dword [0x140071bdc]
mov dword [rsp + 0x30], eax
mov eax, dword [0x140071c78]
mov dword [rsp + 0x28], eax
mov eax, dword [0x140071c70]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov qword [0x140071cd0], rax
lea rdx, [0x1400550c0]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x140071cd0]
mov edx, 0xffffffec
mov r8d, 0x800a0
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x140071cd0]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140071cd0]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.140036c80
mov rcx, qword [0x140071148]
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
sub rax, rcx
cmp rax, 0x25
jb 0x14003be7f
cmp qword [0x140071150], 0xf
lea rbx, [0x140071138]
mov qword [rsp + 0x30], rcx
lea r9, str.Checking_if_C:RuitAntiLeak_exists_n
mov rax, rbx
lea rcx, [rsp + 0x60]
cmova rax, qword [0x140071138]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x25
call fcn.14003d290
lea rdx, [rsp + 0x60]
call fcn.14003c220
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003bb3d
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bb38
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003be59
call fcn.1400448c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Checking_if_C:RuitAntiLeak_exists_n
call fcn.14003c710
lea rdx, [rbp - 0x58]
lea rcx, str.C:RuitAntiLeak_
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x14003bd76
mov rcx, qword [0x140071148]
mov rax, rdi
sub rax, rcx
cmp rax, 0x22
jb 0x14003be7f
cmp qword [0x140071150], 0xf
lea r9, str.Creating_C:RuitAntiLeak_folder_n
mov qword [rsp + 0x30], rcx
mov rax, rbx
cmova rax, qword [0x140071138]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x22
call fcn.14003d290
lea rdx, [rsp + 0x60]
call fcn.14003c220
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003bbfe
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bbf9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003be59
call fcn.1400448c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Creating_C:RuitAntiLeak_folder_n
call fcn.14003c710
lea rcx, str.C:RuitAntiLeak
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
lea rdx, [rbp - 0x58]
lea rcx, str.C:RuitAntiLeak_
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
mov rcx, qword [0x140071148]
test eax, eax
mov rax, rdi
jne 0x14003bcd8
sub rax, rcx
cmp rax, 0x14
jb 0x14003be7f
cmp qword [0x140071150], 0xf
lea r9, str.Temp_folder_created_n
mov qword [rsp + 0x30], rcx
mov rax, rbx
cmova rax, qword [0x140071138]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], socket
call fcn.14003d290
lea rdx, [rsp + 0x60]
call fcn.14003c220
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003bccc
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bcc7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003be59
call fcn.1400448c0
lea rdx, str.Temp_folder_created_n
jmp 0x14003bd6a
sub rax, rcx
cmp rax, 0x2f
jb 0x14003be7f
cmp qword [0x140071150], 0xf
lea r9, str.Failed_to_create_C:RuitAntiLeak_temp_folder_n
mov qword [rsp + 0x30], rcx
mov rax, rbx
cmova rax, qword [0x140071138]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x2f
call fcn.14003d290
lea rdx, [rsp + 0x60]
call fcn.14003c220
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003bd63
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bd5e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003be59
call fcn.1400448c0
lea rdx, str.Failed_to_create_C:RuitAntiLeak_temp_folder_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003c710
cmp dword [0x140071168], 1
jne 0x14003be78
lea rcx, [0x140071160]
call fcn.14003fcd0
cmp qword [0x1400711a0], 1
jbe 0x14003be78
cmp qword [0x1400711c0], 1
jbe 0x14003be78
mov qword [rsp + 0x28], r15
lea r8, [0x1400370e0]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x140071168], 2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rax, qword [0x140071148]
sub rdi, rax
cmp rdi, 0x19
jb 0x14003be7f
cmp qword [0x140071150], 0xf
lea r9, str.Connecting_to_RuitNET..._n
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x60]
cmova rbx, qword [0x140071138]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0x19
call fcn.14003d290
lea rdx, [rsp + 0x60]
call fcn.14003c220
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003be65
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003be60
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003be60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400448c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Connecting_to_RuitNET..._n
call fcn.14003c710
call fcn.14003b2d0
jmp 0x14003be78
call fcn.140035460
int3