Function at 0x140002ee0
Capabilities:
Create thread
Encode data using xor
Enumerate processes
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x140027040]
xor rax, rsp
mov qword [rbp + 0x110], rax
xor r13d, r13d
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov qword [rbp - 0x70], r13
lea rcx, [rbp - 0x68]
call fcn.140004050
nop
lea r8d, [r13 + 1]
lea rdx, [0x140023a84]
lea rcx, [rbp - 0x68]
call fcn.1400013d0
lea r8d, [r13 + 0xa]
lea rdx, str.TceApp.dll
lea rcx, [rbp - 0x68]
call fcn.1400013d0
lea rax, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rax, qword [rbp - 0x68]
mov qword [0x1400278a0], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400038d0
lea rdx, [0x140003aa0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp qword [0x1400278a0], r13
jne 0x140002fa8
lea rcx, str.DLL_path_is_not_specified._n
call fcn.1400019d0
lea ebx, [r13 - 1]
jmp 0x140003059
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp - 0x1c]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x20], 0x130
mov edi, r13d
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000301a
nop dword [rax]
nop word [rax + rax]
lea rdx, str.GTA5.exe
lea rcx, [rbp + 0xc]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140003017
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140002ff0
jmp 0x14000301a
mov edi, dword [rbp - 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400278a8], rax
test rax, rax
jne 0x140003117
lea rdx, str.GTA5.exe
lea rcx, str.Unable_to_open_process:__s.
call fcn.1400019d0
mov ebx, r13d
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140003094
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000308f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400034f7
call fcn.140004990
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400030e5
mov r8, qword [rbp - 0x70]
sub r8, rcx
and r8, 0xfffffffffffffffc
mov rdx, rcx
cmp r8, 0x1000
jb 0x1400030dd
add r8, 0x27
mov rcx, qword [rcx - 8]
sub rdx, rcx
add rdx, 0xfffffffffffffff8
cmp rdx, 0x1f
ja 0x140003548
mov rdx, r8
call fcn.140004990
mov eax, ebx
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140004780
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov edx, edi
lea rcx, str.PID:__lu_n
call fcn.1400019d0
cmp qword [0x1400278b0], 0
je 0x140003134
call fcn.140002e20
mov rdi, qword [rbp - 0x58]
lea rbx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rbx, qword [rbp - 0x68]
call fcn.1400042ac
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rdi
lea r8, [rbp - 0x40]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140002070
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
mov r9d, 0xffffffff
mov r8d, 9
lea rdx, [rbp - 0x40]
call fcn.1400043e8
test eax, eax
jne 0x14000355b
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400031d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400031d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004990
mov rdx, qword [rbp - 0x38]
lea rcx, [rsp + 0x60]
call fcn.1400035d0
lea r9, [rsp + 0x60]
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x78]
cmp r11, 0xf
cmova r9, r10
mov ecx, r13d
mov r8d, r13d
cmp byte [r9], r13b
je 0x140003236
nop word [rax + rax]
lea edx, [rcx + 1]
mov eax, ecx
movsx ecx, byte [rax + r9]
add ecx, r8d
imul r8d, ecx, 0x401
mov eax, r8d
shr eax, 6
xor r8d, eax
mov ecx, edx
cmp byte [rdx + r9], 0
jne 0x140003210
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
cmp eax, dword [str._]
sete bl
cmp r11, 0xf
jbe 0x14000328a
lea rdx, [r11 + 1]
mov rax, r10
cmp rdx, 0x1000
jb 0x140003282
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003282
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r10
call fcn.140004990
test bl, bl
je 0x1400032b5
mov dword [rbp - 0x40], r13d
mov rdx, qword [rbp - 0x78]
cmp rdx, qword [rbp - 0x70]
je 0x1400032a6
mov dword [rdx], r13d
add qword [rbp - 0x78], 4
jmp 0x1400032c8
lea r8, [rbp - 0x40]
lea rcx, [rbp - 0x80]
call fcn.140003e90
jmp 0x1400032c8
mov rdx, qword [0x1400278a0]
lea rcx, str.TcEditor_failed_to_load._n
call fcn.1400019d0
mov r12, qword [rbp - 0x78]
mov r15, qword [rbp - 0x80]
cmp r15, r12
je 0x1400034aa
nop dword [rax]
mov eax, dword [r15]
test eax, eax
jne 0x14000335d
mov dword [str._], r13d
mov rdx, qword [0x1400278a0]
mov rcx, qword [0x1400278a8]
call fcn.140002b50
test rax, rax
je 0x140003312
lea rcx, str.TcEditor_already_loaded._n
jmp 0x140003498
call fcn.140002e20
test eax, eax
je 0x14000349d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.Init
mov rdx, qword [0x1400278a0]
mov rcx, qword [0x1400278a8]
call fcn.140002c50
test eax, eax
je 0x140003351
lea rcx, str.TcEditor_loaded._n
jmp 0x140003498
lea rcx, str.TcEditor_failed_to_load._n
jmp 0x140003498
cmp eax, 1
jne 0x14000349d
mov rcx, qword [0x1400278a8]
test rcx, rcx
je 0x14000349d
mov rdx, qword [0x1400278a0]
call fcn.140002b50
test rax, rax
jne 0x140003393
lea rcx, str.TcEditor_not_loaded._n
jmp 0x140003498
lea rcx, str.calling__tceApp.dll::Shutdown_n
call fcn.1400019d0
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.Shutdown
mov rdx, qword [0x1400278a0]
mov rcx, qword [0x1400278a8]
call fcn.140002c50
mov rdi, qword [0x1400278a0]
mov rsi, qword [0x1400278a8]
mov rdx, rdi
mov rcx, rsi
call fcn.140002b50
mov r14, rax
mov rdx, rdi
test rax, rax
jne 0x1400033f6
lea rcx, str.DLL__s_was_not_loaded_into_the_process._n
call fcn.1400019d0
jmp 0x140003491
mov ebx, r13d
mov rcx, rsi
call fcn.140002b50
test rax, rax
je 0x140003443
mov eax, ebx
inc ebx
cmp eax, 0x64
jge 0x140003443
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r14
mov r9, qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdx, rdi
mov rcx, rsi
call fcn.140002b50
test rax, rax
jne 0x140003406
mov rdx, rdi
mov rcx, rsi
call fcn.140002b50
mov rsi, rax
mov rdx, rdi
test rax, rax
jne 0x140003479
cmp ebx, 1
jne 0x140003467
lea rcx, str.DLL__s_was_unloaded_with_status_OK_n
jmp 0x140003480
lea r8d, [rbx - 1]
lea rcx, str.DLL__s_was_unloaded_with_status_OK__but_took_several_attempts...__i_unreleased_refs._n
call fcn.1400019d0
jmp 0x140003485
lea rcx, str.DLL__s_failed_to_unload__possible_deadlock_or_unreleased_module_refs._n
call fcn.1400019d0
test rsi, rsi
lea rcx, str.TcEditor_unloaded._n
je 0x140003498
lea rcx, str.TcEditor_failed_to_unload._n
call fcn.1400019d0
add r15, 4
cmp r15, r12
jne 0x1400032e0
mov rcx, qword [0x1400278a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140003503
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400034fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004990
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140003554
mov rdx, qword [rbp - 0x70]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000354f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000354f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004990
xor eax, eax
jmp 0x1400030e7
lea r8, [rsp + 0x40]
mov edx, eax
call fcn.140002ae0
int3