Function at 0x1400012d0
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x14005af10]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor r15d, r15d
mov dword [rbp + 0x1c0], 0x4f4c4156
mov dword [rbp + 0x1c4], 0x544e4152
mov dword [rbp + 0x1c8], 0x6e69572d
mov dword [rbp + 0x1cc], 0x532d3436
mov dword [rbp + 0x1d0], 0x70706968
mov dword [rbp + 0x1d4], 0x2e676e69
mov dword [rbp + 0x1d8], 0x657865
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea rax, [rbp + 0x1c0]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], r15b
jne 0x140001370
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x1400017e2
mov qword [rsp + 0x48], 0xf
cmp rbx, 0x10
jae 0x1400013be
mov qword [rsp + 0x40], rbx
mov r8, rbx
lea rdx, [rbp + 0x1c0]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x30], r15b
jmp 0x140001466
mov rdi, rbx
or rdi, 0xf
cmp rdi, rsi
jbe 0x1400013f6
mov rdi, rsi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14001c2cc
test rax, rax
je 0x14000141e
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001437
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001425
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400017dc
jmp 0x1400013db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001434
call fcn.14001c2cc
mov rsi, rax
jmp 0x140001437
mov rsi, r15
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov r8, rbx
lea rdx, [rbp + 0x1c0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r15b
movabs rsi, 0x7fffffffffffffff
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae r8, qword [rsp + 0x30]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov r8, rbx
lea rcx, [rsp + 0x58]
call fcn.140001bf0
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rax, qword [rsp + 0x58]
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae r8, qword [rsp + 0x30]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140001530
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000152b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000152b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001bce0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
mov dword [rbp - 0x80], 0x238
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000175e
lea rdx, [rbp - 0x80]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000175e
movabs r13, 0x7ffffffffffffffe
mov ecx, 0xa
mov qword [rbp + 0x1c0], r15
lea rax, [rbp - 0x54]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400015a3
cmp rbx, r13
ja 0x1400017d6
cmp rbx, 8
jae 0x140001607
mov qword [rbp + 0x1d0], rbx
mov qword [rbp + 0x1d8], 7
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0x1c0]
call sub.VCRUNTIME140.dll_memcpy
mov word [rbp + rbx + 0x1c0], r15w
mov r14, qword [rbp + 0x1d8]
mov rbx, qword [rbp + 0x1d0]
mov rsi, qword [rbp + 0x1c0]
jmp 0x1400016a8
mov r14, rbx
or r14, 7
cmp r14, r13
jbe 0x14000161c
mov r14, r13
lea rcx, [rsi + rsi]
jmp 0x14000163d
cmp r14, 0xa
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, rsi
ja 0x1400017e8
add rcx, rcx
cmp rcx, 0x1000
jb 0x140001669
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400017e8
mov rcx, rax
call fcn.14001c2cc
test rax, rax
je 0x140001753
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000167b
test rcx, rcx
je 0x140001678
call fcn.14001c2cc
mov rsi, rax
jmp 0x14000167b
mov rsi, r15
mov qword [rbp + 0x1c0], rsi
mov qword [rbp + 0x1d0], rbx
mov qword [rbp + 0x1d8], r14
lea rdi, [rbx + rbx]
mov r8, rdi
lea rdx, [rbp - 0x54]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rsi + rdi], r15w
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0x1c0]
cmp r14, 8
setae r8b
cmovae rdx, rsi
cmp rbx, qword [rsp + 0x68]
jne 0x1400016f7
test rbx, rbx
je 0x1400016f3
sub rdx, rcx
nop dword [rax + rax]
movzx eax, word [rcx]
cmp word [rdx + rcx], ax
jne 0x1400016f7
add rcx, 2
sub rbx, 1
jne 0x1400016e0
mov bl, 1
jmp 0x1400016f9
xor bl, bl
test r8b, r8b
je 0x14000172f
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001727
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001753
mov rcx, rsi
call fcn.14001bce0
test bl, bl
jne 0x14000175a
lea rdx, [rbp - 0x80]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000175e
movabs rsi, 0x7fffffffffffffff
jmp 0x14000158c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r15d, dword [rbp - 0x78]
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1400017a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000179e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000179e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001bce0
mov eax, r15d
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.14001bcc0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400012b0
nop
call fcn.140001210
int3
call fcn.1400012b0
nop
call fcn.140001210
int3