Function at 0x140070550
Capabilities:
Create process on windows
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x1401a9600]
xor rax, rsp
mov qword [rbp + 0x260], rax
xor r13d, r13d
call fcn.140061770
mov dword [rbp + 0x70], 0x43fa0000
mov dword [rbp + 0x74], 0x43fa0000
lea edx, [r13 + 2]
lea rcx, [rbp + 0x70]
call fcn.140025590
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rbp + 0x1f0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
movd xmm1, dword [rbp + 0x1fc]
cvtdq2ps xmm1, xmm1
mov qword [rbp - 0x70], r13
subss xmm1, dword [rbp + 0x74]
mulss xmm1, dword [0x1400f6cb4]
movd xmm0, dword [rbp + 0x1f8]
cvtdq2ps xmm0, xmm0
subss xmm0, dword [rbp + 0x70]
mulss xmm0, dword [0x1400f6cb4]
movss dword [rbp - 0x68], xmm0
movss dword [rbp - 0x64], xmm1
lea r8, [rbp - 0x70]
lea edx, [r13 + 2]
lea rcx, [rbp - 0x68]
call fcn.1400254f0
cmp byte [reloc.WS2_32.dll_accept], r13b
je 0x140070fa3
mov r8d, dword [0x1401a9200]
lea rdx, [0x1401aa560]
lea rcx, str.Loader
call fcn.1400047c0
mov dword [rbp + 0x200], 0x42c80000
mov dword [rbp + 0x204], 0x42a70000
lea rcx, [rbp + 0x200]
call fcn.140025160
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
movaps xmm1, xmmword [0x1400f6e60]
movups xmmword [rbp + 0x40], xmm1
mov dword [rsp + 0x70], 0x3f800000
mov dword [rsp + 0x74], 0x3f800000
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x40], 0x43960000
mov dword [rsp + 0x44], 0x43960000
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, qword [0x1401aa2b8]
call fcn.140045a20
mov dword [rsp + 0x48], 0x41200000
mov dword [rsp + 0x4c], 0x43b6c000
lea rcx, [rsp + 0x48]
call fcn.140025160
movss xmm0, dword [0x1401676dc]
call fcn.1400210e0
mov dword [rsp + 0x50], 0x41180000
mov dword [rsp + 0x54], 0x41480000
lea rcx, [rsp + 0x50]
call fcn.140025160
mov r15, qword [0x1401aa790]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xd
jb 0x140070fe4
lea r14, [0x1401aa780]
cmp qword [0x1401aa798], 0xf
cmova r14, qword [0x1401aa780]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1c8], xmm1
lea rsi, [r15 + 0xd]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp + 0x1b8]
cmp rsi, rbx
jbe 0x1400707db
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x14007079a
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400e9dac
test rax, rax
je 0x140070f97
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400707d4
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400707c2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140070fde
jmp 0x14007077b
test rcx, rcx
je 0x1400707d1
call fcn.1400e9dac
mov rdi, rax
jmp 0x1400707d4
mov rdi, r13
mov qword [rbp + 0x1b8], rdi
mov qword [rbp + 0x1c8], rsi
mov qword [rbp + 0x1d0], rbx
movsd xmm0, qword [str.AIO_Version:]
movsd qword [rdi], xmm0
mov eax, dword [0x140165490]
mov dword [rdi + 8], eax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 0xc], al
lea rcx, [rdi + 0xd]
mov r8, r15
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], r13b
lea rdx, [rbp + 0x1b8]
cmp qword [rbp + 0x1d0], 0xf
cmova rdx, qword [rbp + 0x1b8]
lea rcx, [0x1400f6ae4]
call fcn.14004d790
call fcn.140019130
subss xmm0, dword [0x1400f6e44]
call fcn.1400251e0
movss xmm0, dword [0x1400f6d2c]
call fcn.140025230
mov dword [rbp - 0x60], 0x41a00000
mov dword [rbp - 0x5c], 0x41a00000
movabs rax, 0x8abce5f51f6a245d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x10], rax
movabs rdi, 0x77ed4e0b91102a6
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x18], rax
movabs rsi, 0x8abce5f51f6a2405
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x210], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x218], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x210]
movdqa xmmword [rbp + 0x10], xmm0
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x10]
call fcn.140061250
test al, al
je 0x140070adc
movabs rax, 0xc3fdc5866b054856
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
movabs rax, 0x77ed485c1742ce9
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x220], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x228], rax
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp + 0x220]
movdqa xmmword [rbp - 0x80], xmm0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r12, rax
xor edx, edx
mov r8d, Ordinal_301
lea rcx, [rbp + 0x84]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x80], 0x130
lea rdx, [rbp + 0x80]
mov rcx, r12
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140070ac7
lea rax, [rbp - 0x80]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400709a0
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
lea rax, [rbp + 0xac]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400709d0
lea rdx, [rbp + 0xac]
lea rcx, [rbp - 0x38]
call fcn.140050470
lea rcx, [rbp - 0x38]
mov rsi, qword [rbp - 0x20]
cmp rsi, 0xf
seta r15b
mov rbx, qword [rbp - 0x38]
cmova rcx, rbx
mov r8, qword [rbp - 0x28]
cmp r8, rdi
jne 0x140070a1d
lea rdx, [rbp - 0x80]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140070a1d
mov r14b, 1
jmp 0x140070a20
xor r14b, r14b
test r15b, r15b
je 0x140070a56
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140070a4e
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140070b5a
mov rcx, rbx
call fcn.1400e970c
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
test r14b, r14b
je 0x140070a9c
mov r8d, dword [rbp + 0x88]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140070a9c
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x80]
mov rcx, r12
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400709b0
movabs rdi, 0x77ed4e0b91102a6
movabs rsi, 0x8abce5f51f6a2405
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400621b0
mov byte [0x1401aa560], 0
mov dword [rsp + 0x58], 0x435c0000
mov dword [rsp + 0x5c], 0x42000000
mov dword [rbp - 0x58], 0x41880000
mov dword [rbp - 0x54], 0x42820000
lea rcx, [rbp - 0x58]
call fcn.140025160
lea rdx, [rsp + 0x58]
lea rcx, [0x140165498]
call fcn.140061250
test al, al
je 0x140070b1f
mov dword [0x1401aa804], r13d
mov dword [rbp - 0x50], 0x43838000
mov dword [rbp - 0x4c], 0x42820000
lea rcx, [rbp - 0x50]
call fcn.140025160
lea rdx, [rsp + 0x58]
lea rcx, [0x14016549c]
call fcn.140061250
test al, al
je 0x140070b61
mov dword [0x1401aa804], 1
jmp 0x140070ee0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp dword [0x1401aa804], 0
jne 0x140070ed7
lea rbx, [0x1401aa660]
mov rdx, rbx
cmp qword [0x1401aa678], 0xf
cmova rdx, qword [0x1401aa660]
movss xmm0, dword [0x1400f6d60]
movss dword [rsp + 0x20], xmm0
xor r9d, r9d
xor r8d, r8d
lea rcx, [rbp + 0x1d8]
call fcn.140009530
movss xmm1, dword [rbp + 0x1d8]
mulss xmm1, dword [0x1400f6cb4]
movss xmm0, dword [0x1401676d8]
subss xmm0, xmm1
movss dword [rbp + 0x1b0], xmm0
mov dword [rbp + 0x1b4], 0x43ac8000
lea rcx, [rbp + 0x1b0]
call fcn.140025160
cmp qword [0x1401aa678], 0xf
cmova rbx, qword [0x1401aa660]
mov rdx, rbx
lea rcx, [0x1400f6ae4]
call fcn.14004d790
mov dword [rbp - 0x48], 0x416e6666
mov dword [rbp - 0x44], 0x43acc000
lea rcx, [rbp - 0x48]
call fcn.140025160
lea rcx, [0x1401654a0]
call fcn.14004d790
movabs rax, 0xaad9969b7a094d49
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp], rax
movabs rax, 0x750facedc6367ce
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 8], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x230], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x238], rax
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x230]
movdqa xmmword [rbp], xmm0
movabs rax, 0xf9d2809676060726
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x10], rax
movabs rax, 0x77ed4e0c07449c3
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 8], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x240], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x248], rax
movdqa xmm0, xmmword [rbp - 0x10]
xorps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rsp + 0x20], r13d
lea r9, [rbp]
mov r8d, 0xff
lea rdx, [0x1401aa561]
lea rcx, [rbp - 0x10]
call fcn.140063b20
call fcn.140020ac0
mov dword [rsp + 0x60], 0x43390000
mov dword [rsp + 0x64], 0x42000000
mov dword [rbp - 0x40], 0x43228000
mov dword [rbp - 0x3c], 0x43d14000
lea rcx, [rbp - 0x40]
call fcn.140025160
movabs rax, 0xe3c88b90771e5144
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x20], rax
movabs rax, 0x77ed4e0dc6563c5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x250], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x258], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x250]
movdqa xmmword [rbp + 0x20], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x20]
call fcn.140061250
test al, al
je 0x140070e08
call fcn.1400635d0
movzx eax, byte [0x1401aa2c0]
nop
test al, al
jne 0x140070e08
lea rdx, [0x1400659f0]
lea rcx, [rbp + 0x1e0]
call fcn.14004fa80
nop
cmp dword [rbp + 0x1e8], 0
je 0x140070fd3
movaps xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x50], xmm0
lea rcx, [rbp + 0x50]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140070fd3
xorps xmm0, xmm0
movaps xmmword [rbp + 0x60], xmm0
movdqa xmmword [rbp + 0x1e0], xmm0
mov dword [rsp + 0x50], 0x43228000
mov dword [rsp + 0x54], 0x43e3c000
lea rcx, [rsp + 0x50]
call fcn.140025160
movabs rax, 0x8abce5f51f135147
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x200], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x208], rax
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x200]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.140061250
test al, al
je 0x140070eb8
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.https:__slotsrealm.mysellix.io
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp byte [0x1401aa2c2], 0
je 0x140070ed7
call fcn.140018550
movss xmm1, dword [rax + 0x10]
lea rcx, [0x1401aa2c2]
call fcn.140065670
cmp dword [0x1401aa804], 1
jne 0x140070f59
mov dword [rsp + 0x48], 0x41300000
mov dword [rsp + 0x4c], 0x42e60000
lea rcx, [rsp + 0x48]
call fcn.140025160
mov dword [rsp + 0x40], 0x43ef0000
mov dword [rsp + 0x44], 0x43ba8000
xor r9d, r9d
mov r8b, 1
lea rdx, [rsp + 0x40]
lea ecx, [r9 + 0xa]
call fcn.140007520
mov dword [rsp + 0x38], 0x41580000
mov dword [rsp + 0x3c], 0x41ac0000
lea rcx, [rsp + 0x38]
call fcn.140025160
lea rcx, [0x1401aa760]
cmp qword [0x1401aa778], 0xf
cmova rcx, qword [0x1401aa760]
call fcn.14004d790
call fcn.140015030
call fcn.140014b10
nop
mov rdx, qword [rbp + 0x1d0]
cmp rdx, 0xf
jbe 0x140070fa3
inc rdx
mov rcx, qword [rbp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140070f9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140070f9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e970c
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1400e9b80
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
call fcn.140069f10
int3
call fcn.14006a210
int3