Function at 0x1400c0010
Capabilities:
Enumerate processes
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x438
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], rdx
mov qword [rbp + 0x3e0], r8
mov dword [rbp + 0x3e8], r9d
call fcn.14001bec0
call fcn.14001bec0
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x1400c1570]
test rax, rax
je 0x14001a862
mov rax, qword [0x1400c1540]
test rax, rax
je 0x14001a862
mov ecx, 0xbe40223
call fcn.14001c1e0
test eax, eax
setne al
test al, al
je 0x14001a8e9
lea rax, [0x1400c1220]
mov rdx, rax
mov ecx, 0x48fc0af3
call fcn.14001c290
lea rax, [0x1400c11e0]
mov rdx, rax
mov ecx, 0x7fac47d
call fcn.14001c340
mov ecx, 0x3ea
call fcn.14001d640
mov dword [rbp + 0x3a0], eax
xor dword [rbp + 0x3a0], 0xaaaaaa8
call fcn.14001bc00
jmp 0x14001a935
lea rax, [0x1400c1220]
mov rdx, rax
mov ecx, 0x499107b1
call fcn.14001c290
mov ecx, 0x64
call fcn.14001d640
mov dword [rbp + 0x3a4], eax
xor dword [rbp + 0x3a4], 0xaaaaaa8
mov ecx, 0xa3df7d64
call fcn.14001c1e0
lea rax, [0x1400c11e0]
mov rdx, rax
mov ecx, 0x7ef841e
call fcn.14001c340
call fcn.1400bca20
mov byte [rbp + 0x1df], al
lea rax, [rbp + 0x1df]
mov rcx, rax
call fcn.140024990
mov rbx, rax
lea rax, [rbp + 0x1e0]
mov rcx, rax
call fcn.14001b060
lea rax, [rbp + 0x1e0]
mov rdx, rbx
mov rcx, rax
call fcn.1400ba2f0
mov ebx, eax
lea rax, [rbp + 0x1e0]
mov rcx, rax
call fcn.1400a9820
test bl, bl
je 0x14001a992
mov eax, 0
jmp 0x14001afc3
mov ecx, 0x64
call fcn.14001d640
mov dword [rbp + 0x39c], eax
mov ecx, 0
call fcn.14001dd60
lea rax, [0x1400c11e0]
mov rcx, rax
call fcn.1400a4d30
mov rbx, rax
lea rax, [rbp + 0x20b]
mov rcx, rax
call fcn.1400bcad0
lea rax, [rbp + 0x20b]
mov rcx, rax
call fcn.140024a60
mov rdx, rbx
mov rcx, rax
call fcn.14001be60
mov ecx, 0
call fcn.14001dd60
lea rax, [rbp + 0x210]
mov rcx, rax
call fcn.1400bcaa0
lea rax, [rbp + 0x210]
mov rcx, rax
call fcn.140024bc0
mov rcx, rax
call fcn.14001be60
mov ecx, 1
call fcn.14001dd60
lea rax, [rbp + 0x250]
mov rcx, rax
call fcn.1400bcea0
lea rax, [rbp + 0x250]
mov rcx, rax
call fcn.140024bd0
mov rcx, rax
call fcn.14001be60
mov ecx, 4
call fcn.14001dd60
lea rax, [rbp + 0x290]
mov rcx, rax
call fcn.1400bced0
lea rax, [rbp + 0x290]
mov rcx, rax
call fcn.140024a30
mov rcx, rax
call fcn.14001be60
mov ecx, 0
call fcn.14001dd60
xor dword [rbp + 0x39c], 0xaaaaaa8
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x390], rax
cmp qword [rbp + 0x390], 0xffffffffffffffff
jne 0x14001aab5
mov eax, 1
jmp 0x14001afc3
mov qword [rbp + 0x3a8], 0
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x390]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
setne al
test al, al
je 0x14001ab7d
lea rax, [rbp + 0x2c0]
lea rdx, [0x1400c1220]
mov rcx, rax
call fcn.14001c0c0
lea rax, [rbp + 0x2c0]
mov rcx, rax
call fcn.140031650
mov rdx, rax
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpW]
call rax
test eax, eax
sete bl
lea rax, [rbp + 0x2c0]
mov rcx, rax
call fcn.1400add00
test bl, bl
je 0x14001ab5d
mov eax, dword [rbp - 0x58]
mov r8d, eax
mov edx, 0
mov ecx, 0x2a
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x3a8], rax
jmp 0x14001ab7d
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x390]
mov rcx, rax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
test al, al
jne 0x14001aae7
mov rax, qword [rbp + 0x390]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x390], rax
cmp qword [rbp + 0x390], 0xffffffffffffffff
jne 0x14001abba
mov eax, 1
jmp 0x14001afc3
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x390]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
setne al
test al, al
je 0x14001ac70
lea rax, [rbp + 0x2e0]
lea rdx, [0x1400c1220]
mov rcx, rax
call fcn.14001c0c0
lea rax, [rbp + 0x2e0]
mov rcx, rax
call fcn.140031650
mov rdx, rax
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpW]
call rax
test eax, eax
sete bl
lea rax, [rbp + 0x2e0]
mov rcx, rax
call fcn.1400add00
test bl, bl
je 0x14001ac50
mov eax, dword [rbp - 0x58]
mov r8d, eax
mov edx, 0
mov ecx, 0x2a
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x3a8], rax
jmp 0x14001ac70
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x390]
mov rcx, rax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
test al, al
jne 0x14001abda
mov rax, qword [rbp + 0x390]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x300]
mov rcx, rax
call fcn.1400bcdd0
lea rax, [rbp + 0x300]
mov rcx, rax
call fcn.140024a70
mov rcx, rax
call fcn.14001be60
mov ecx, 2
call fcn.14001dd60
lea rax, [0x1400c1220]
mov rcx, rax
call fcn.140030870
mov rbx, rax
call fcn.1400bcf80
mov dword [rbp + 0x329], eax
lea rax, [rbp + 0x329]
mov rcx, rax
call fcn.140024b00
mov rdx, rbx
mov rcx, rax
call fcn.14001be60
mov ecx, 0
call fcn.14001dd60
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
cmp qword [rbp + 0x3a8], 0
je 0x14001ab90
mov ecx, 0
call fcn.14001dd60
lea rax, [rbp + 0x32d]
mov rcx, rax
call fcn.1400bcd40
lea rax, [rbp + 0x32d]
mov rcx, rax
call fcn.140024bb0
mov rcx, rax
call fcn.14001be60
mov ecx, 2
call fcn.14001dd60
call fcn.1400bcf30
mov dword [rbp + 0x33c], eax
lea rax, [rbp + 0x33c]
mov rcx, rax
call fcn.140024ae0
mov rcx, rax
mov rax, qword [rbp + 0x3a8]
mov rdx, rax
call fcn.14001be60
mov ecx, 0
call fcn.14001dd60
mov rax, qword [rbp + 0x3a8]
mov rcx, rax
call fcn.14001bb30
xor eax, 1
test al, al
je 0x14001ae09
mov ecx, 4
call fcn.14001dd60
lea rax, [rbp + 0x340]
mov rcx, rax
call fcn.1400bcce0
lea rax, [rbp + 0x340]
mov rcx, rax
call fcn.1400249f0
mov rcx, rax
call fcn.14001be60
mov rax, qword [rbp + 0x3a8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x365]
mov rcx, rax
call fcn.1400bd0f0
lea rax, [rbp + 0x365]
mov rcx, rax
call fcn.140024be0
mov rcx, rax
call sub.msvcrt.dll_system
mov eax, 0xfffffffd
jmp 0x14001afc3
mov ecx, 1
call fcn.14001dd60
lea rax, [rbp + 0x36b]
mov rcx, rax
call fcn.1400bcc20
lea rax, [rbp + 0x36b]
mov rcx, rax
call fcn.140024b20
mov rcx, rax
call fcn.14001be60
mov ecx, 4
call fcn.14001dd60
call fcn.1400bce80
mov qword [rbp + 0x375], rax
lea rax, [rbp + 0x375]
mov rcx, rax
call fcn.140024a20
mov rcx, rax
call fcn.14001be60
mov ecx, 1
call fcn.14001dd60
lea rax, [rbp + 0x37d]
mov rcx, rax
call fcn.1400bd090
lea rax, [rbp + 0x37d]
mov rcx, rax
call fcn.140024b80
mov rcx, rax
call fcn.14001be60
mov ecx, 0
call fcn.14001dd60
lea rax, [0x1400c1200]
mov rcx, rax
call fcn.14002ec30
mov rcx, rax
call fcn.1400bd180
mov qword [rbp + 0x388], rax
lea rax, [0x1400c1200]
mov rcx, rax
call fcn.1400a4d00
mov rbx, rax
lea rax, [0x1400c1200]
mov rcx, rax
call fcn.1400a4d60
mov rdx, qword [rbp + 0x388]
mov r8, rdx
mov rdx, rbx
mov rcx, rax
call fcn.1400b7f50
cmp qword [rbp + 0x388], 0
je 0x14001af0d
mov rax, qword [rbp + 0x388]
mov rcx, rax
call fcn.1400bc9f0
mov rdx, qword [rbp + 0x388]
mov rax, qword [rbp + 0x3a8]
mov rcx, rax
call fcn.14001c3f0
xor eax, 1
test al, al
je 0x14001af6a
mov rax, qword [rbp + 0x3a8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x382]
mov rcx, rax
call fcn.1400bd0f0
lea rax, [rbp + 0x382]
mov rcx, rax
call fcn.140024be0
mov rcx, rax
call sub.msvcrt.dll_system
mov eax, 0xfffffffc
jmp 0x14001afc3
mov ecx, 1
call fcn.14001dd60
mov rax, qword [rbp + 0x3a8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x14001afc3
add rsp, 0x438
pop rbx
pop rbp
ret
sub rsp, 0x28
call fcn.14000a7b0
mov rax, qword [0x1400cb570]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x1400cb560]
mov r8, qword [rax]
mov rax, qword [0x1400cb550]
mov rcx, qword [rax]
add rsp, 0x28
jmp 0x14001a830