Function at 0x1400010e0
Capabilities:
Enumerate processes
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov dword [rsp + 0x30], ecx
xor edx, edx
mov ecx, 2
mov dword [rsp + 0x40], 0x238
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x1400014ec
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x1400014ec
xor ebx, ebx
nop dword [rax]
lea r8, [rsp + 0x6c]
lea rdx, [0x1400033a0]
lea rcx, [rsp + 0x2a0]
call fcn.140001610
lea rdx, [0x1400033a8]
lea rcx, [rsp + 0x2a0]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x1400014d5
mov ecx, 0x30
mov qword [rsp + 0x288], rbx
call fcn.140001828
movups xmm0, xmmword [str.RelicCardinal.exe]
mov qword [rsp + 0x280], rax
mov rbx, rax
mov qword [rsp + 0x290], 0x11
xor edx, edx
mov qword [rsp + 0x298], 0x17
mov ecx, 0x1fffff
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400033d0]
movups xmmword [rax + 0x10], xmm1
movzx eax, word [0x1400033e0]
mov word [rbx + 0x20], ax
xor eax, eax
mov word [rbx + 0x22], ax
mov r8d, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [rsp + 0x48]
mov rdx, rbx
mov rdi, rax
call fcn.140001020
lea rdx, [rax + 0x3abb28]
lea rbx, [rax + 0x6aff62]
lea rbp, [rax + 0x2e137c0]
lea r14, [rax + 0x50cd1c]
lea r15, [rax + 0x50ca71]
lea r12, [rax + 0x78695e]
lea r13, [rax + 0x27f1dd6]
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x140001371
xor eax, eax
lea r8, [0x1400033ec]
mov r9d, 5
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
lea r8, [0x1400033f4]
mov r9d, 5
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor ebx, ebx
lea r8, [0x1400033fc]
mov r9d, 5
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 5
mov qword [rsp + 0x20], rbx
lea r8, [0x140003404]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 5
mov qword [rsp + 0x20], rbx
lea r8, [0x14000340c]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 5
mov qword [rsp + 0x20], rbx
lea r8, [0x140003414]
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 5
mov qword [rsp + 0x20], rbx
lea r8, [0x14000341c]
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [0x140003424]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.status:
call fcn.1400015a0
mov rcx, qword [0x140005720]
mov edx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.OFF_n
call fcn.1400015a0
mov rcx, qword [0x140005720]
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x140001488
cmp eax, 1
jne 0x140001486
xor eax, eax
lea r8, [0x140003434]
mov r9d, 5
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
lea r8, [0x14000343c]
mov r9d, 5
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor ebx, ebx
lea r8, [0x140003444]
mov r9d, 5
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 5
mov qword [rsp + 0x20], rbx
lea r8, [0x14000344c]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 5
mov qword [rsp + 0x20], rbx
lea r8, [0x140003454]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 5
mov qword [rsp + 0x20], rbx
lea r8, [0x14000345c]
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 5
mov qword [rsp + 0x20], rbx
lea r8, [0x140003464]
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [0x140003424]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.status:
call fcn.1400015a0
mov rcx, qword [0x140005720]
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x14000346c]
jmp 0x140001355
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x298]
cmp rdx, 7
jbe 0x1400014d5
mov rcx, qword [rsp + 0x280]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014d0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001528
call fcn.140001820
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140001160
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.140001800
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3