Function at 0x1400011c0
Capabilities:
Create thread
Enumerate processes
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r13, rdx
cmp ecx, 3
jl 0x1400014ce
mov rdi, qword [rdx + 8]
xorps xmm0, xmm0
mov rsi, 0xffffffffffffffff
mov r15b, 1
movups xmmword [rsp + 0x40], xmm0
mov rbx, rsi
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140001210
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x140001558
cmp rbx, 0xf
ja 0x140001269
mov r8, rbx
mov qword [rsp + 0x50], rbx
mov rdx, rdi
mov qword [rsp + 0x58], 0xf
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x40], 0
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x40]
jmp 0x140001301
mov rax, rbx
or rax, 0xf
cmp rax, rbp
jbe 0x1400012a2
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400015a0
test rax, rax
je 0x140001365
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400012df
mov ecx, 0x16
mov rbp, rax
cmp rax, rcx
cmovb rbp, rcx
lea rcx, [rbp + 1]
cmp rcx, 0x1000
jb 0x1400012cd
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000155e
jmp 0x140001283
test rcx, rcx
je 0x1400012dc
call fcn.1400015a0
mov r14, rax
jmp 0x1400012df
xor r14d, r14d
mov r8, rbx
mov qword [rsp + 0x40], r14
mov rdx, rdi
mov qword [rsp + 0x50], rbx
mov rcx, r14
mov qword [rsp + 0x58], rbp
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
cmp rbp, 0xf
lea rax, [rsp + 0x40]
lea rdi, [rsp + 0x40]
cmova rax, r14
cmova rdi, r14
add rbx, rax
cmp rdi, rbx
je 0x14000133a
nop
movsx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
test eax, eax
je 0x140001337
inc rdi
cmp rdi, rbx
jne 0x140001320
jmp 0x14000133a
xor r15b, r15b
cmp rbp, 0xf
jbe 0x140001374
lea rdx, [rbp + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000136c
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000136c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1400015e4
mov rdi, qword [r13 + 8]
test r15b, r15b
je 0x14000138a
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ebx, eax
jmp 0x140001408
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
test rax, rax
je 0x140001406
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
mov rcx, rbx
test eax, eax
je 0x140001400
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400013fd
lea rax, [rsp + 0x8c]
mov r8, rdi
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400013e3
inc rax
test ecx, ecx
jne 0x1400013d0
mov rcx, rbx
test edx, edx
je 0x1400014ff
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400013c1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov rcx, qword [r13 + 0x10]
lea r8, [rsp + 0x190]
xor r9d, r9d
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x1400014ce
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005708], rax
test rax, rax
je 0x1400014ce
lea rcx, [rsp + 0x190]
mov r8, rsi
inc r8
cmp byte [rcx + r8], 0
jne 0x140001455
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
lea rax, [rsp + 0x190]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140001483
mov rcx, qword [0x140005708]
lea r8, [rsp + 0x190]
mov r9, rsi
mov qword [rsp + 0x20], 0
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140005708]
test eax, eax
jne 0x14000150e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140005708]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140001580
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x68]
jmp 0x140001408
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
mov qword [rsp + 0x30], 0
xor edx, edx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140001544
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140005708]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400014d3
call fcn.1400011a0
int3
call fcn.140001100
int3