Function at 0x1400ca910
Capabilities:
Allocate or change rwx memory
Create process on windows
Enumerate processes
Execute command
Execute shellcode via indirect call
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x208
call fcn.14000b607
mov rbx, qword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
call rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
call rbx
lea rbx, [rsp + 0xd0]
mov rcx, rax
call qword [sym.imp.USER32.dll_DestroyWindow]
call fcn.14001f470
test al, al
jne 0x1400ca9ad
mov r8d, 0x104
mov rdx, rbx
lea rdi, [rsp + 0x64]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
xor eax, eax
mov ecx, 0x1b
rep stosd dword [rdi], eax
lea rax, str.runas
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x70
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x90], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
xor ecx, ecx
call sub.msvcrt.dll_exit
xor edx, edx
mov ecx, 0xf
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400caa4c
mov rdx, rbx
mov rcx, rax
mov dword [rsp + 0xd0], 0x130
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x1400caa43
mov r12, qword [sym.imp.KERNEL32.DLL_OpenProcess]
mov r13, qword [sym.imp.KERNEL32.DLL_TerminateProcess]
lea rbp, str.Minecraft.Windows.exe
lea rcx, [rsp + 0xfc]
mov rdx, rbp
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400caa34
mov r8d, dword [rsp + 0xd8]
xor edx, edx
mov ecx, 1
call r12
mov rdi, rax
test rax, rax
je 0x1400caa34
mov rcx, rax
xor edx, edx
call r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rdx, rbx
mov rcx, rsi
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x1400ca9f5
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, str.start_https:__discord.gg_kodiakext
lea rsi, [rsp + 0x48]
call sub.msvcrt.dll_system
lea rdi, [rsp + 0x60]
xor ecx, ecx
mov r9d, 0x40
lea r8, str.Kodiak
lea rdx, str.Join_discord.gg_kodiakext
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, rsi
mov rcx, rdi
lea r8, [rsp + 0x58]
lea rax, str..ent
mov qword [rsp + 0x48], rax
lea rax, str..cache
mov qword [rsp + 0x50], rax
call fcn.1400016ec
lea rdx, str.LocalState
mov rcx, rbx
call fcn.1400016a8
mov rdx, rdi
mov rcx, rbx
call fcn.14001eb20
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rdi
call fcn.1400a1d40
mov rcx, rbx
lea rdx, str.LocalStatelogs
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.LocalStatepremium_cache
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.LocalStatecrash
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.LocalStatecdn
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.LocalState_speech
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.LocalState_treatments
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.LocalState_bootstrap_settings.json
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.LocalStategamescom.mojangminecraftpehs
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.LocalStategamescom.mojangminecraftpe_storage_object
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.LocalStategamescom.mojangminecraftpe_telemetry_info.json
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.LocalStategamescom.mojangminecraftpeclientId.txt
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.LocalStategamescom.mojangminecraftpecatalog_info.json
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.LocalStategamescom.mojangminecraftpeNonAssertErrorLog.txt
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.LocalStategamescom.mojangminecraftpeNotificationCenterSettings.dat
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.LocalStategamescom.mojangminecraftpe_splitscreen_appearance.json
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.LocalStategamescom.mojangminecraftpepack_settings
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rdx, rsi
mov rcx, rdi
lea r8, [rsp + 0x50]
lea rax, str..dat
mov qword [rsp + 0x48], rax
call fcn.1400016ec
lea rdx, str.LocalStategamescom.mojang
mov rcx, rbx
call fcn.1400016a8
mov rdx, rdi
mov rcx, rbx
call fcn.14001eb20
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rdi
call fcn.1400a1d40
mov rcx, rbx
lea rdx, str.ACMicrosoftCryptnetUrlCacheContent
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.ACMicrosoftCryptnetUrlCacheMetaData
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.ACMicrosoftCryptnetUrlCache
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.ACMicrosoft
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.ACTemp
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.ACTokenBrokerCache
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.ACTokenBroker
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
call fcn.1400a2f30
mov rcx, rbx
lea rdx, [0x1400d0582]
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rbx
lea rsi, [rsp + 0xd0]
call fcn.1400a2f30
mov rcx, rbx
lea rdx, str.AppData
call fcn.1400016a8
mov rcx, rbx
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.Settings
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.SystemAppData
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.TempState
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCachelastdevicesessionid.txt
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeContentCachePatchNotes
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeContentCacheThirdPartyServer
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeContentCache
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeClubsScreenshots
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeCatalogScratch
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeCatalogCache
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeAchievementIcons
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeFriendIcons
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeimages
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpe_font
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeServerContent
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpepersona
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeTreatments
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeTempImportPacks
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeProgressions
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeDownloadTemp
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeShaderCache
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeFlighting
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeMCProfileCache
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeMessagingService
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
call fcn.1400a2f30
mov rcx, rsi
lea rdx, str.LocalCacheminecraftpeXblProfileCache
call fcn.1400016a8
mov rcx, rsi
call fcn.14001ee70
mov rcx, rsi
lea rbx, str.Minecraft.Windows.exe
call fcn.1400a2f30
lea rcx, str.start_minecraft:__
call sub.msvcrt.dll_system
mov rdi, qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
mov r9d, 0x30
lea r8, str.Kodiak
lea rdx, str.Just_click_on_Ok_when_the_game_is_launched_and_youre_in_the_menu__please_wait_until_youre_connected_to_xbox_live_.
call rdi
cmp qword [0x1400cf880], 0
jne 0x1400cb188
mov rcx, rbx
call fcn.14001e9f0
mov rcx, rax
mov qword [0x1400cf880], rax
call fcn.14001f140
mov qword [0x1400cf890], rax
jmp 0x1400cb15e
mov rax, qword [0x1400cf890]
test rax, rax
je 0x1400cb168
mov qword [0x1400cf860], rax
lea rax, [rsp + 0x60]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.14001e820
mov rcx, rsi
call fcn.14001f2a0
lea rax, [rsp + 0x48]
mov r8, qword [rsp + 0x30]
mov rdx, qword [0x1400cf880]
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.14001e5e0
mov r13, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
lea rbp, [rsp + 0x44]
mov r12, qword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
cmp rbx, r13
je 0x1400cb258
mov r15, qword [rbx]
mov esi, dword [rsp + 0xd8]
mov qword [rsp + 0x20], rbp
mov r9d, 0x40
mov r14, qword [rsp + 0xd0]
mov rcx, qword [0x1400cf880]
mov r8, rsi
mov rdx, r15
call r12
xor eax, eax
mov rcx, qword [0x1400cf880]
mov r9, rsi
mov r8, r14
mov qword [rsp + 0x20], rax
mov rdx, r15
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov qword [rsp + 0x20], rbp
mov r9d, dword [rsp + 0x44]
mov r8, rsi
mov rdx, r15
mov rcx, qword [0x1400cf880]
call r12
add rbx, 8
jmp 0x1400cb1e9
mov r9d, 0x40
lea r8, str.Kodiak
lea rdx, str.Successful_Spoof_
xor ecx, ecx
call rdi
mov rcx, qword [rsp + 0x38]
call fcn.1400a1e90
lea rcx, [rsp + 0xd0]
call fcn.1400a2f30
mov rcx, qword [rsp + 0x30]
call fcn.1400a2f30
xor eax, eax
add rsp, 0x208
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret