Function at 0x14000c240
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12d, ecx
mov r14, rdx
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtSuspendProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll
mov qword [0x1400633c0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtResumeProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
mov qword [0x1400634b0], rax
mov ebp, edi
test r12d, r12d
jle 0x14000c793
lea r15, [r14 + 8]
lea r13d, [rdi + 5]
lea rsi, str._yara
mov rdx, qword [r14]
lea r10, str._direct
lea r9, str._heap
mov rcx, rdi
lea r8, str._stack
lea rbx, str._iat
lea r11, str._help
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r11 + rcx - 1]
jne 0x14000c43c
cmp rcx, 6
jne 0x14000c2f0
cmp qword [0x1400626b0], 0x10
lea rdx, [0x140062698]
mov r8, qword [0x1400626a8]
cmovae rdx, qword [0x140062698]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140015860
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_t_t_te_0_38_2_128_0_32mhttps:__github.com_Xacone_BestEdrOfTheMarkete_0m
call fcn.140011ae0
mov rcx, rax
lea rdx, str._n_n_tUsage:_BestEdrOfTheMarket.exe__args__n
call fcn.140011ae0
mov rcx, rax
lea rdx, str._n_t_t__v_:_Verbosity
call fcn.140011ae0
mov rcx, rax
lea rdx, str._n_t_t__yara_:_Enabling_YARA_rules
call fcn.140011ae0
mov rcx, rax
lea rdx, str._n_t_t__nt_:_Inline_Nt_level_hooking
call fcn.140011ae0
mov rcx, rax
lea rdx, str._n_t_t__k32_:_Inline_Kernel32_Kernelbase_hooking
call fcn.140011ae0
mov rcx, rax
lea rdx, str._n_t_t__iat_:_IAT_hooking
call fcn.140011ae0
mov rcx, rax
lea rdx, str._n_t_t__stack_:_Threads_call_stack_monitoring
call fcn.140011ae0
mov rcx, rax
lea rdx, str._n_t_t__heap_:_Heap_monitoring__to_use_with__k32___iat_or__nt_
call fcn.140011ae0
mov rcx, rax
lea rdx, str._n_t_t__patch_:_ETW_AMSI_patching_detection
call fcn.140011ae0
mov rcx, rax
lea rdx, str._n_t_t__direct_:_Direct_Syscalls_Detection
call fcn.140011ae0
mov rcx, rax
lea rdx, str._n_t_t__indirect_:_Indirect_Syscalls_Detection
call fcn.140011ae0
mov rcx, rax
lea rdx, str._n_t_t__ssn_:_SSNcrushing
call fcn.140011ae0
mov rcx, rax
lea rdx, str._n_t_t__help_:_Shows_this_help_message_and_quits
call fcn.140011ae0
mov rcx, rax
lea rdx, [0x1400578b8]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000c798
cmp byte [rdx], 0x2f
jne 0x14000c457
cmp byte [rdx + 1], 0x76
jne 0x14000c457
cmp byte [rdx + 2], 0
jne 0x14000c457
mov dword [0x1400633d4], 1
mov rdx, qword [r14]
mov rcx, rdi
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x14000c47c
cmp rcx, r13
jne 0x14000c460
mov dword [0x140063400], 1
mov rcx, rdi
lea r11, [0x140056650]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r11 + rcx - 1]
jne 0x14000c4ae
cmp rcx, 4
jne 0x14000c490
mov dword [0x14006340c], 1
mov rcx, rdi
lea r11, str._k32
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r11 + rcx - 1]
jne 0x14000c4dd
cmp rcx, r13
jne 0x14000c4c0
mov dword [0x140063408], 1
mov rcx, rdi
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x14000c4fe
cmp rcx, 7
jne 0x14000c4e0
mov dword [0x140063484], 1
mov rdx, qword [r14]
mov rax, rdi
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r9 + rax - 1]
jne 0x14000c52e
cmp rax, 6
jne 0x14000c510
mov dword [0x140063404], 1
mov rdx, qword [r14]
lea r8, str._ssn
mov rcx, rdi
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x14000c55d
cmp rcx, r13
jne 0x14000c540
mov dword [0x1400633d0], 1
mov rcx, rdi
lea r8, str._debug
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x14000c58e
cmp rcx, 7
jne 0x14000c570
mov dword [0x140063488], 1
mov rcx, rdi
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r10 + rcx - 1]
jne 0x14000c5af
cmp rcx, 8
jne 0x14000c591
mov dword [0x140063390], 1
mov rbx, qword [r14]
lea rdx, str._indirect
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14000c5cf
mov dword [0x1400633f4], 1
mov rcx, rdi
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rsi + rcx - 1]
jne 0x14000c5ef
cmp rcx, 6
jne 0x14000c5d2
mov dword [0x14006348c], 1
mov rax, qword [r14]
cmp byte [rax], 0x2f
jne 0x14000c780
cmp byte [rax + 1], 0x70
jne 0x14000c780
cmp byte [rax + 2], 0
jne 0x14000c780
cmp qword [r15], 0
je 0x14000c780
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___Spawning
xorps xmm0, xmm0
mov dword [0x1400634a0], 1
xor eax, eax
mov dword [0x140063480], 1
movups xmmword [0x140063410], xmm0
mov dword [0x140063410], 0x68
movups xmmword [0x140063440], xmm0
mov dword [0x14006344c], 1
movups xmmword [0x140063450], xmm0
mov word [0x140063450], r13w
movups xmmword [0x140063420], xmm0
mov qword [0x140063470], rax
movups xmmword [0x140063430], xmm0
mov qword [0x1400633a8], rax
movups xmmword [0x140063460], xmm0
movups xmmword [0x140063398], xmm0
call fcn.140011ae0
mov rdx, qword [r15]
mov rcx, rax
call fcn.140011ae0
mov rcx, rax
lea rdx, str._...
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, qword [r15]
mov r8, 0xffffffffffffffff
mov rdi, r8
inc rdi
cmp byte [rsi + rdi], 0
jne 0x14000c6d7
inc edi
mov eax, 2
movsxd rcx, edi
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400461b8
mov r9d, edi
mov dword [rsp + 0x28], edi
mov r8, rsi
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edi, edi
lea rax, [0x140063398]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [0x140063410]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, rbx
mov qword [rsp + 0x38], rdi
xor ecx, ecx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000c7b8
inc ebp
lea ecx, [rdi + 0x64]
add r14, 8
add r15, 8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1400633a8]
lea rsi, str._yara
mov dword [0x140063394], eax
inc ebp
add r14, 8
add r15, 8
cmp ebp, r12d
jl 0x14000c2c6
call fcn.14000c810
lea r11, [rsp + 0x50]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str._X__Failed_to_spawn_process._Error_code:
call fcn.140011ae0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140011cb0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400039a0
call fcn.14000c810
mov rcx, 0xffffffffffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3