Function at 0x140003e80
Capabilities:
Check if file exists
Enumerate processes
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x488]
sub rsp, 0x560
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rbp + 0x450], rax
mov r13, rdx
mov r12d, ecx
xor eax, eax
mov qword [rsp + 0x40], rax
xor esi, esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], si
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], si
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rax
lea rcx, [0x140009fdc]
call fcn.140001020
lea rcx, str.Process_Injection_via_COM._PoC_by_modexp_MDSec_n
call fcn.140001020
lea rcx, str.Built_on_Nov_16_2023_at_14:07:03_for_64_Bit_n_n
call fcn.140001020
mov r15d, 1
cmp r12d, r15d
jle 0x140004222
lea r14, [r13 + 8]
mov ecx, 0xfffd
mov rbx, qword [r14]
movzx eax, word [rbx]
sub ax, 0x2d
test cx, ax
je 0x1400040c6
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003f6c
mov dword [rsp + 0x40], esi
jmp 0x140003fcf
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x2c]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x30], 0x238
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140003fb8
lea rdx, [rbp - 4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140003fb5
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140003f91
mov esi, dword [rbp - 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], esi
test esi, esi
jne 0x14000420f
xor esi, esi
xor edx, edx
lea r8d, [rdx + 0xa]
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x14000420f
movsxd rdx, r15d
mov rdx, qword [r13 + rdx*8]
lea rcx, str.unable_to_resolve_PID_for___lS__n
call fcn.140001020
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140004040
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000403b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004576
call fcn.140007080
mov qword [rsp + 0x78], rsi
mov word [rsp + 0x68], si
mov qword [rbp - 0x80], 7
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140004094
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000408f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004576
call fcn.140007080
xor eax, eax
mov rcx, qword [rbp + 0x450]
xor rcx, rsp
call fcn.140007020
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movzx ecx, word [rbx + 2]
sub ecx, 0x64
je 0x140004197
sub ecx, 8
je 0x140004191
sub ecx, 1
je 0x14000418b
sub ecx, 6
je 0x1400040fc
cmp ecx, 3
jne 0x14000420f
mov byte [rbp - 0x75], 1
jmp 0x14000420f
lea r9, [rbx + 4]
mov rdx, 0xffffffffffffffff
cmp word [r9], 0
jne 0x140004130
inc r15d
add r14, 8
mov r9, qword [r14]
nop dword [rax + rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x140004120
jmp 0x14000413b
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x140004130
cmp rdx, qword [rbp - 0x80]
lfence
ja 0x140004178
lea rdi, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdi, qword [rsp + 0x68]
mov qword [rsp + 0x78], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rbx], si
mov byte [rbp - 0x78], 1
jmp 0x14000420f
lea rcx, [rsp + 0x68]
call fcn.140006210
mov byte [rbp - 0x78], 1
jmp 0x14000420f
mov byte [rbp - 0x74], 1
jmp 0x14000420f
mov byte [rbp - 0x76], 1
jmp 0x14000420f
lea r9, [rbx + 4]
mov rdx, 0xffffffffffffffff
cmp word [r9], 0
jne 0x1400041c0
inc r15d
add r14, 8
mov r9, qword [r14]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x1400041b3
jmp 0x1400041cb
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x1400041c0
cmp rdx, qword [rbp - 0x80]
lfence
ja 0x140004201
lea rdi, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdi, qword [rsp + 0x68]
mov qword [rsp + 0x78], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rbx], si
jmp 0x14000420b
lea rcx, [rsp + 0x68]
call fcn.140006210
mov byte [rbp - 0x77], 1
inc r15d
add r14, 8
cmp r15d, r12d
jge 0x140004222
xor esi, esi
jmp 0x140003f3a
cmp byte [rbp - 0x77], 0
jne 0x140004238
cmp byte [rbp - 0x78], 0
jne 0x140004238
cmp byte [rbp - 0x76], 0
je 0x14000457d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rcx, [rsp + 0x40]
call fcn.1400011b0
movzx ebx, al
lea rcx, [0x140009fdc]
call fcn.140001020
mov edx, dword [rbp - 0x60]
lea rcx, str.CProcessSecret::s_guidOle32Secret_:__08lX_n
call fcn.140001020
mov edx, dword [rbp - 0x5c]
lea rcx, str.g_pMTAEmptyCtx____________________:__08lX_n
call fcn.140001020
mov edx, dword [rbp - 0x58]
lea rcx, str.CIPIDTable::_palloc_______________:__08lX_n
call fcn.140001020
mov edx, dword [rbp - 0x54]
lea rcx, str.offsetof_tagOXIDEntry__OXID_______:__08lX_n
call fcn.140001020
lea rsi, [0x1400097e8]
lea rdi, str.FAILED
mov rdx, rdi
test bl, bl
cmovne rdx, rsi
lea rcx, str.Initialisation____________________:__s_n_n
call fcn.140001020
test bl, bl
jne 0x140004312
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400042ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400042fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004576
call fcn.140007080
xor r14d, r14d
mov qword [rsp + 0x78], r14
mov word [rsp + 0x68], r14w
jmp 0x14000404a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x50]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor r14d, r14d
test eax, eax
je 0x14000437e
mov dword [rbp - 0x48], 1
mov qword [rsp + 0x30], 0x14
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x44], rax
mov dword [rbp - 0x3c], 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rbp - 0x48]
xor edx, edx
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rbp - 0x76], 0
je 0x140004438
lea rcx, str.Listing_IPID_entries._n
call fcn.140001020
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400043c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateToolhelp32Snapshot___failed_:__ld_n
call fcn.140001020
jmp 0x1400044da
mov dword [rbp + 0x210], 0x238
lea rdx, [rbp + 0x210]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000442a
nop
cmp dword [rbp + 0x218], 4
jbe 0x140004416
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rbp + 0x218]
cmp ecx, eax
je 0x140004416
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140004405
cmp eax, ecx
jne 0x140004416
lea rdx, [rbp + 0x210]
lea rcx, [rsp + 0x40]
call fcn.140002280
lea rdx, [rbp + 0x210]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400043e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400044da
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140004487
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
lea rax, [0x14000a308]
lea r8, str.shellcode
cmp byte [rbp - 0x77], 0
cmovne r8, rax
lea rcx, str.__lS__for__lS_injection_cannot_be_found..._n
call fcn.140001020
jmp 0x1400044da
cmp byte [rbp - 0x77], 0
je 0x1400044a0
lea rcx, [rsp + 0x40]
call fcn.1400037f0
lea rcx, str.DLL_injection_:__s_n
jmp 0x1400044cc
cmp byte [rbp - 0x78], 0
je 0x1400044da
cmp dword [rsp + 0x40], 0
jne 0x1400044bb
lea rcx, str.COM_injection_with_shellcode_requires_a_process_ID._n
call fcn.140001020
jmp 0x1400044da
lea rcx, [rsp + 0x40]
call fcn.140003aa0
lea rcx, str.Shellcode_injection_:__s_n
test al, al
cmovne rdi, rsi
mov rdx, rdi
call fcn.140001020
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14000451e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004519
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004576
call fcn.140007080
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r14w
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140004094
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000408f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000408f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140003e10
int3