Function at 0x140001000
Capabilities:
Enumerate processes
Execute command

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x270], rax
call qword [sym.imp.KERNEL32.dll_FreeConsole]
movsd xmm6, qword [0x1400033d0]
movabs rbp, 0x311cdad160000
movabs r12, 0x7ffffffdabf41bff
movabs r13, 0x2540be400
movabs r15, 0x7fffffffffffffff
movabs r14, 0x112e0be826d694b3
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001110
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001107
lea rdx, str.xingncode.exe
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x1400010cd
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x1400010a3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.xingncode.exe
call fcn.140001270
mov rcx, rax
lea rdx, str._is_already_running.
call fcn.140001270
mov rcx, rax
lea rdx, [0x140001440]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14000114f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.xingncode.exe
call fcn.140001270
mov rcx, rax
lea rdx, str._is_not_running._Starting_it...
call fcn.140001270
mov rcx, rax
lea rdx, [0x140001440]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, str.start_xingncode.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov r8, rax
cmp rbx, 0x989680
jne 0x140001170
imul rcx, r8, 0x64
jmp 0x140001196
cqo
idiv rbx
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rcx, rax
mov rax, r8
cqo
idiv rbx
imul rdx, rax, 0x3b9aca00
add rcx, rdx
lea rsi, [rcx + r13]
cmp rcx, r12
jl 0x1400011a2
mov rsi, r15
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rdi, 0x989680
jne 0x1400011c3
imul rbx, rcx, 0x64
jmp 0x1400011e9
cqo
idiv rdi
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
mov rbx, rax
mov rax, rcx
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
add rbx, rcx
cmp rbx, rsi
jge 0x140001075
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rcx, rax, 0x64
xorps xmm0, xmm0
mov rax, rsi
sub rax, rbx
lea r8, [rcx + rbp]
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
seta r9b
test r9b, r9b
jne 0x14000121f
lea r8, [rcx + rax]
add rax, rcx
lea rdx, [rcx + rbp]
test r9b, r9b
lea rcx, [rsp + 0x20]
cmove rdx, rax
mov rax, r14
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x20], rdx
sub r8d, eax
mov dword [rsp + 0x28], r8d
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x1400011a2