Function at 0x1800045f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x180044020]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbp, rcx
call qword [0x180044c68]
mov r13d, eax
mov r12, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea rcx, [r13*8]
call fcn.180017a0c
mov qword [rsp + 0x30], rax
mov rdi, rax
test r12d, r12d
je 0x1800046f1
mov r15d, r13d
mov r14, rax
movabs r13, 0x140906a60
movabs r12, 0x140906a10
mov rcx, rbp
call r13
test eax, eax
jg 0x180004680
xor edi, edi
jmp 0x1800046b5
movsxd rsi, eax
lea rcx, [rsi + 1]
call fcn.180017a0c
mov rdi, rax
test rax, rax
je 0x1800046b5
xor ebx, ebx
test rsi, rsi
jle 0x1800046b1
nop dword [rax + rax]
mov rcx, rbp
call r12
mov byte [rbx + rdi], al
inc rbx
cmp rbx, rsi
jl 0x1800046a0
mov byte [rsi + rdi], 0
movzx eax, byte [rdi]
mov rbx, rdi
test al, al
je 0x1800046d5
nop
movzx ecx, al
call fcn.1800179e0
mov byte [rbx], al
lea rbx, [rbx + 1]
movzx eax, byte [rbx]
test al, al
jne 0x1800046c0
mov qword [r14], rdi
add r14, 8
sub r15, 1
jne 0x180004672
mov r12, qword [rsp + 0x28]
mov r13, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x30]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x20], rax
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x180004874
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x180004736
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180004874
mov ecx, 0x40
call fcn.180017a0c
mov rsi, rax
mov rcx, rax
movabs rax, 0x140907a10
mov edx, 0xa0
call rax
mov edx, 2
mov rcx, rsi
movabs rax, 0x140907d20
call rax
nop dword [rax + rax]
movzx eax, byte [rsp + 0x6c]
lea rbx, [rsp + 0x6c]
test al, al
je 0x180004795
nop
movzx ecx, al
call fcn.1800179e0
mov byte [rbx], al
lea rbx, [rbx + 1]
movzx eax, byte [rbx]
test al, al
jne 0x180004780
test r12d, r12d
je 0x18000482a
mov r14, rdi
mov rbp, r13
movabs r15, 0x140907c40
movabs r12, 0x140907cb0
nop dword [rax + rax]
mov rdx, qword [r14]
lea rcx, [rsp + 0x6c]
call fcn.18000e500
test rax, rax
je 0x180004816
mov dl, 1
mov rcx, rsi
call r15
lea rax, [rsp + 0x6c]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800047e6
movzx edx, bx
mov rcx, rsi
call r12
test ebx, ebx
jle 0x180004816
lea rdi, [rsp + 0x6c]
mov ebx, ebx
movzx edx, byte [rdi]
mov rcx, rsi
call r15
lea rdi, [rdi + 1]
sub rbx, 1
jne 0x180004803
add r14, 8
sub rbp, 1
jne 0x1800047c0
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32Next]
mov rdi, qword [rsp + 0x30]
test eax, eax
jne 0x180004770
xor edx, edx
mov rcx, rsi
movabs rax, 0x140907c40
call rax
mov rcx, rsi
movabs rax, 0x14180ba50
call rax
mov rcx, rsi
movabs rax, 0x140907b90
call rax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18000b530
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret