Function at 0x1400039b0
Capabilities:
Acquire debug privileges
Encode data using xor
Enumerate processes
Reference http user-agent string
Terminate process

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x4a8]
sub rsp, 0x5a8
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.140001d20
test al, al
jne 0x1400041ef
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x1400041ef
mov qword [rsp + 0x5a0], r13
mov qword [rsp + 0x5c0], rbx
mov qword [rsp + 0x5c8], rsi
mov qword [rsp + 0x5d0], r12
mov qword [rsp + 0x598], r14
mov qword [rsp + 0x590], r15
call fcn.1400045c0
mov r13, rax
test rax, rax
je 0x140004045
xorps xmm0, xmm0
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
xor esi, esi
lea rdx, [0x140053108]
movups xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x38]
mov byte [rbp - 0x80], sil
mov qword [rbp - 0x70], rsi
call fcn.1400042f0
mov r8d, 0x104
lea rdx, str.cs2.exe
lea rcx, [rbp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edx, edx
mov dword [rbp + 0x40], 0x238
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp + 0x40]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x140003ade
lea rdx, [rbp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x140003ade
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140003b94
lea rdx, [rbp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140003ab3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x50], esi
mov rdx, rdi
lea rcx, [rbp + 0x18]
call fcn.140003730
mov r15, qword [rbp + 0x28]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xb
jb 0x1400041f8
mov r14, qword [rbp + 0x30]
lea rdx, [rbp + 0x18]
mov rdi, qword [rbp + 0x18]
lea r12, [r15 + 0xb]
cmp r14, 0x10
lea rsi, [rbp - 8]
mov ebx, reloc.WS2_32.dll_ntohs
xorps xmm0, xmm0
cmovae rdx, rdi
xorps xmm1, xmm1
mov qword [rsp + 0x58], rdx
movups xmmword [rbp - 8], xmm0
movdqu xmmword [rbp + 8], xmm1
cmp r12, rbx
jbe 0x140003be2
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x140003ba0
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.14003f0b4
test rax, rax
je 0x140003c94
mov rdx, qword [rsp + 0x58]
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140003bde
mov ebx, dword [rbp + 0x48]
mov dword [rsp + 0x50], ebx
jmp 0x140003aeb
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140003bc8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400041fe
jmp 0x140003b70
test rcx, rcx
je 0x140003bdc
call fcn.14003f0b4
mov rdx, qword [rsp + 0x58]
mov rsi, rax
jmp 0x140003bde
xor esi, esi
mov qword [rbp - 8], rsi
movsd xmm0, qword [str._modId_:__]
lea rcx, [rsi + 0xb]
mov qword [rbp + 8], r12
mov r8, r15
mov qword [rbp + 0x10], rbx
movsd qword [rsi], xmm0
movzx eax, word [0x14004c790]
mov word [rsi + 8], ax
movzx eax, byte [0x14004c792]
mov byte [rsi + 0xa], al
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 2
mov byte [rsi + r12], 0
lea rdx, [0x14004c780]
lea rcx, [rbp - 8]
call fcn.140004210
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x140003ca0
mov rcx, qword [rbp - 8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c9b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c9b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003f0ac
lea r8, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64_
mov edx, 0x2722
mov rcx, r13
call fcn.140004680
cmp qword [rbp - 0x40], 0x10
lea r8, [rbp - 0x58]
mov edx, 0x271f
mov rcx, r13
cmovae r8, qword [rbp - 0x58]
call fcn.140004680
lea r8, [0x140003700]
mov edx, 0x4e2b
mov rcx, r13
call fcn.140004680
lea r8, [rbp - 0x80]
mov edx, 0x2711
mov rcx, r13
call fcn.140004680
cmp qword [rbp - 0x20], 0x10
lea r8, [rbp - 0x38]
mov edx, 0x2712
mov rcx, r13
cmovae r8, qword [rbp - 0x38]
call fcn.140004680
mov rcx, r13
call fcn.140004670
test eax, eax
je 0x140003d23
mov ebx, r15d
jmp 0x1400040df
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.1400042f0
mov r9, r15
mov r10, qword [0x140053138]
cmp qword [rbp - 0x70], r15
jbe 0x140003d9f
lea r11, [0x140053128]
nop dword [rax + rax]
cmp qword [rbp - 0x68], 0x10
lea r8, [rbp - 0x80]
mov rax, r9
mov rcx, r11
cmovae r8, qword [rbp - 0x80]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x140053128]
xor edx, edx
div r10
lea rax, [rsp + 0x60]
movzx ecx, byte [rdx + rcx]
xor cl, byte [r8 + r9]
cmp qword [rsp + 0x78], 0x10
cmovae rax, qword [rsp + 0x60]
mov byte [rax + r9], cl
inc r9
cmp r9, qword [rbp - 0x70]
jb 0x140003d50
cmp qword [rsp + 0x78], 0x10
lea rsi, [rsp + 0x60]
xorps xmm0, xmm0
mov qword [rbp - 0x60], r15
cmovae rsi, qword [rsp + 0x60]
movups xmmword [rbp - 0x18], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x60]
mov edx, Ordinal_41
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140003e23
lea r8, [rbp - 0x14]
mov dword [rbp - 0x18], 1
lea rdx, str.SeDebugPrivilege
mov dword [rbp - 0xc], 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140003e19
mov rcx, qword [rbp - 0x60]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140003e45
lea ebx, [rax - 2]
jmp 0x14000408f
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], r15d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x140004081
mov dword [rsp + 0x50], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x58], eax
jne 0x140004081
mov rdx, rsi
mov rcx, rbx
call fcn.140001120
test al, al
jne 0x140003ea9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0xfffffff8
jmp 0x14000408f
mov rcx, rsi
call fcn.14003f0ac
cmp qword [rsp + 0x78], 0x10
lea rcx, [rsp + 0x60]
cmovae rcx, qword [rsp + 0x60]
call fcn.14003f0ac
cmp qword [rbp - 0x68], 0x10
lea rcx, [rbp - 0x80]
cmovae rcx, qword [rbp - 0x80]
call fcn.14003f0ac
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call fcn.1400045b0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140003f28
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f23
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041dc
call fcn.14003f0ac
mov rdx, qword [rbp - 0x40]
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], r15b
cmp rdx, 0x10
jb 0x140003f76
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f71
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041dc
call fcn.14003f0ac
movdqa xmm0, xmmword [0x14004c7f0]
mov byte [rbp - 0x58], r15b
movdqu xmmword [rbp - 0x48], xmm0
cmp r14, 0x10
jb 0x140003fbe
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140003fb6
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041dc
mov rcx, rdi
call fcn.14003f0ac
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140003ff9
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ff4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041dc
call fcn.14003f0ac
mov rdx, qword [rbp - 0x68]
movdqa xmm0, xmmword [0x14004c7f0]
mov byte [rbp - 0x38], r15b
movdqu xmmword [rbp - 0x28], xmm0
cmp rdx, 0x10
jb 0x140004045
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004040
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041dc
call fcn.14003f0ac
xor eax, eax
mov r14, qword [rsp + 0x598]
mov rbx, qword [rsp + 0x5c0]
mov r12, qword [rsp + 0x5d0]
mov rsi, qword [rsp + 0x5c8]
mov r15, qword [rsp + 0x590]
mov r13, qword [rsp + 0x5a0]
add rsp, 0x5a8
pop rdi
pop rbp
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0xfffffffd
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400040cc
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040c7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041dc
call fcn.14003f0ac
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], r15b
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14000411a
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004115
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041dc
call fcn.14003f0ac
movdqa xmm0, xmmword [0x14004c7f0]
mov byte [rbp - 0x58], r15b
movdqu xmmword [rbp - 0x48], xmm0
cmp r14, 0x10
jb 0x140004162
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000415a
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041dc
mov rcx, rdi
call fcn.14003f0ac
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140004199
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004194
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041dc
call fcn.14003f0ac
mov rdx, qword [rbp - 0x68]
movdqa xmm0, xmmword [0x14004c7f0]
mov byte [rbp - 0x38], r15b
movdqu xmmword [rbp - 0x28], xmm0
cmp rdx, 0x10
jb 0x1400041e8
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041e3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400041e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003f0ac
mov eax, ebx
jmp 0x140004047
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140001d00
int3
call fcn.140001c60
int3