Function at 0x140009cd0
Capabilities:
Enumerate processes
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0xa40]
sub rsp, 0xb40
mov rax, qword [0x1400440c0]
xor rax, rsp
mov qword [rbp + 0xa30], rax
xor r12d, r12d
mov dword [rsp + 0x40], r12d
movups xmm0, xmmword [str.SafeExamBrowser.exe]
movaps xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [0x14003dd70]
movaps xmmword [rbp - 0x80], xmm1
movsd xmm0, qword [0x14003dd80]
movsd qword [rbp - 0x70], xmm0
xor edx, edx
mov r8d, 0x1e0
lea rcx, [rbp - 0x68]
call fcn.14002feb0
mov r8d, 0x104
lea rdx, [rbp + 0x820]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8, [rbp + 0x820]
mov edx, 0x104
lea rcx, [rbp + 0x400]
call fcn.1400175e0
lea rcx, [rbp + 0x400]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r8, str.loader.bin
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x610]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edi, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov r8d, 1
lea rcx, [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140009e02
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Impossible_douvrir_le_fichier_:
call fcn.140004720
mov rcx, rax
mov edx, ebx
call fcn.140002940
mov rcx, rax
call fcn.140004a00
jmp 0x140009ee0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140009e41
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Erreur_lors_de_lobtention_de_la_taille_du_fichier_:
call fcn.140004720
mov rcx, rax
mov edx, ebx
call fcn.140002940
mov rcx, rax
call fcn.140004a00
jmp 0x140009ed7
mov rcx, rdi
call fcn.14000ee94
mov r14, rax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x180]
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140009ea9
cmp dword [rbp + 0x180], edi
jne 0x140009ea9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x140009ee3
mov edi, ebx
lea rdx, str.File_read_successfully._File_size:
lea rcx, [0x140045830]
call fcn.1400080f0
mov rcx, rax
mov edx, ebx
call fcn.140006830
lea rdx, str._bytes
jmp 0x140009efd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Erreur_lors_de_la_lecture_du_fichier_:
call fcn.140004720
mov rcx, rax
mov edx, ebx
call fcn.140002940
mov rcx, rax
call fcn.140004a00
mov rcx, r14
call fcn.14000ee50
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, r12
lea rdx, str.Error_reading_file:
lea rcx, [0x140045830]
call fcn.1400080f0
lea rdx, [rbp + 0x610]
mov rcx, rax
call fcn.1400080f0
mov rcx, rax
call fcn.1400083b0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x188], xmm0
mov qword [rbp + 0x198], rax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov r8d, 0x1a
lea rdx, str.Seb_Inject_LoaderShellcode
lea rcx, [rsp + 0x48]
call fcn.1400019a0
nop
mov r15d, edi
mov r8d, edi
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x188]
call fcn.140001530
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140009fa1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a0f9
call fcn.14000ee50
lea rdx, str.Shared_memory_initialized_with_name:
lea rcx, [0x140045830]
call fcn.1400080f0
mov rcx, rax
lea rdx, str.Seb_Inject_LoaderShellcode
call fcn.1400080f0
mov rcx, rax
lea rdx, str._and_size:
call fcn.1400080f0
mov rcx, rax
mov edx, edi
call fcn.140006830
mov rcx, rax
call fcn.1400083b0
cmp r15, qword [rbp + 0x198]
je 0x14000a014
lea rdx, str.Data_size_does_not_match_allocated_size
lea rcx, [rbp + 0x188]
call fcn.140001480
lea rdx, [0x140042f20]
lea rcx, [rbp + 0x188]
call fcn.140010de0
int3
mov rcx, qword [rbp + 0x190]
add rcx, 8
mov r8, r15
mov rdx, r14
call fcn.14002f810
lea rdx, str.Data_written_to_shared_memory._Data_size:
lea rcx, [0x140045830]
call fcn.1400080f0
mov rcx, rax
mov edx, edi
call fcn.140006830
mov rcx, rax
lea rdx, str._bytes
call fcn.1400080f0
mov rcx, rax
call fcn.1400083b0
mov ecx, 0x20
call fcn.14000ee58
mov rbx, rax
mov qword [rbp + 0x1a0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov r8d, 0x17
lea rdx, str.Seb_Inject_Console_Pipe
lea rcx, [rsp + 0x48]
call fcn.1400019a0
nop
mov dword [rsp + 0x40], 1
lea r8, [rsp + 0x48]
lea rdx, str..pipe_
mov rcx, rbx
call fcn.1400016f0
nop
mov qword [0x1400472e0], rbx
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x14000a104
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a0ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a0ff
call fcn.140014e00
int3
call fcn.14000ee50
mov ecx, 1
call fcn.14000ee58
mov qword [rbp + 0x1a0], rax
lea rcx, [rbp + 0x1b0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14000a4a0]
xor edx, edx
xor ecx, ecx
call fcn.1400174f8
mov qword [rbp + 0x1a8], rax
test rax, rax
je 0x14000a244
mov esi, r12d
nop dword [rax]
mov dword [rbp + 0x1c0], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000a20a
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000a1dc
nop dword [rax]
nop dword [rax + rax]
lea rax, [rbp + 0x1ec]
lea r8, [rsp + 0x70]
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000a1c4
add rax, 2
test ecx, ecx
jne 0x14000a1b0
mov rcx, rbx
test edx, edx
je 0x14000a236
lea rdx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000a1a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000a180
call fcn.14000a260
mov rcx, rax
call fcn.140004a00
mov edi, r12d
cmp esi, edi
je 0x14000a150
mov r8, r14
mov rdx, r15
mov ecx, edi
call fcn.140009870
mov esi, eax
jmp 0x14000a150
mov edi, dword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000a21a
mov dword [rbp + 0x1b0], r12d
mov ecx, 6
call fcn.14000e4bc
int3