Function at 0x1400012c0
Capabilities:
Accept command line arguments
Create process on windows
Enumerate processes

Disassembly:
push rbp
push rbx
push r12
push r13
push r14
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x430], rax
xorps xmm0, xmm0
lea rdx, [rbp + 0x220]
mov r14, r8
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
mov r13d, 1
mov qword [rbp - 0x30], rax
mov r8d, 0x104
mov dword [rbp - 0x54], r13d
xor ecx, ecx
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, eax
test eax, eax
je 0x140001402
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000134d
cmp ebx, 0x104
je 0x140001402
mov edx, 0x104
lea rcx, [rbp + 0x220]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveFileSpec]
test eax, eax
jne 0x140001402
lea r9, [0x1400032c0]
mov edx, 0x104
lea r8, [rbp + 0x220]
lea rcx, [rbp + 0x220]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
test eax, eax
jne 0x140001402
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x220]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rax + 4]
add ecx, ebx
movsxd rbx, ecx
add rbx, rbx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
test rax, rax
je 0x140001402
mov qword [rsp + 0x38], r14
lea rax, [rbp + 0x220]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, str.__s___s
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbx
mov rcx, r12
mov dword [rsp + 0x20], 0x800
call section..text
test eax, eax
je 0x140001426
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.1400016c0
add rsp, 0x540
pop r14
pop r13
pop r12
pop rbx
pop rbp
ret
lea rax, [rsp + 0x58]
mov qword [rsp + 0x570], rsi
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x220]
lea rax, [rsp + 0x70]
xor esi, esi
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov rdx, r12
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov ecx, 0xffffffff
cmovne ecx, esi
mov dword [rsp + 0x54], ecx
je 0x140001600
xor edx, edx
mov qword [rsp + 0x588], r15
lea ecx, [rsi + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov r15d, esi
test rax, rax
je 0x140001546
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x238
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x1400014c8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001546
mov qword [rsp + 0x578], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
cmp dword [rbp - 0x18], edi
je 0x1400014ef
lea rdx, [rbp - 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400014d8
jmp 0x140001535
mov edi, dword [rbp]
cmp edi, 0xffffffff
je 0x140001535
lea rdx, [rbp - 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140001535
cmp dword [rbp - 0x18], edi
je 0x14000151e
lea rdx, [rbp - 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140001507
jmp 0x140001535
lea rdx, str.steam.exe
lea rcx, [rbp + 0xc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
cmove r15d, r13d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x578]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], esi
mov rcx, r14
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r9d, dword [rsp + 0x50]
mov r8, rax
test r9d, r9d
jle 0x1400015bd
lea r10, str.__background
nop dword [rax]
mov rdx, qword [r8]
cmp word [rdx], 0x2d
jne 0x140001587
cmp word [rdx + 2], 0x62
jne 0x140001587
cmp word [rdx + 4], 0
je 0x1400015c2
mov rax, 0xffffffffffffffff
nop
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r10 + rax*2 + 2]
jne 0x1400015b2
add rax, 2
cmp rax, 0xd
je 0x1400015c2
movzx ecx, word [rdx + rax*2]
cmp cx, word [r10 + rax*2]
je 0x140001590
inc esi
add r8, 8
cmp esi, r9d
jl 0x140001570
test r15d, r15d
je 0x1400015e2
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x588]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [rsp + 0x54]
mov rsi, qword [rsp + 0x570]
jmp 0x140001407