Function at 0x18000150a
Capabilities:
Enumerate processes
Terminate process

Disassembly:
jmp 0x180006460
push rdi
sub rsp, 0x1f0
lea rdi, [rsp + 0x20]
mov ecx, 0x74
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x18003c038]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov dword [rsp + 0x20], 0xcc3
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
movzx eax, byte [0x18003c015]
movsx eax, al
mov dword [rsp + 0x188], eax
call fcn.180003770
movsx eax, al
mov ecx, dword [rsp + 0x188]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x18c], eax
call fcn.180003740
movsx eax, al
shl eax, 2
mov dword [rsp + 0x190], eax
call fcn.180003730
movsx eax, al
mov ecx, dword [rsp + 0x190]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x18c]
add ecx, eax
mov eax, ecx
movzx ecx, byte [0x18003c014]
movsx ecx, cl
xor edx, edx
div ecx
movzx ecx, byte [0x18003c011]
movsx ecx, cl
sub eax, ecx
test eax, eax
je 0x1800065f0
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x180006539
mov qword [rsp + 0x198], 1
jmp 0x180006545
mov qword [rsp + 0x198], 0
cvtsi2sd xmm0, qword [rsp + 0x198]
call fcn.180003790
mov dword [rsp + 0x1a0], eax
movzx ecx, byte [0x18003c015]
movsx ecx, cl
mov dword [rsp + 0x1a4], ecx
call fcn.180003770
movsx eax, al
mov ecx, dword [rsp + 0x1a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a8], eax
call fcn.180003740
movsx eax, al
imul eax, eax, 9
mov dword [rsp + 0x1ac], eax
call fcn.180003730
movsx eax, al
mov ecx, dword [rsp + 0x1ac]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x1a8]
add ecx, eax
mov eax, ecx
movzx ecx, byte [0x18003c014]
movsx ecx, cl
xor edx, edx
div ecx
movzx ecx, byte [0x18003c011]
movsx ecx, cl
sub eax, ecx
mov ecx, dword [rsp + 0x1a0]
imul ecx, eax
mov eax, ecx
test eax, eax
je 0x1800065f0
xor eax, eax
cmp eax, 4
je 0x1800065f0
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov dword [rsp + 0x40], 0x130
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, 0x12c
rep stosb byte [rdi], al
mov dword [rsp + 0x174], 0
mov dword [rsp + 0x178], 0
jmp 0x180006631
mov eax, dword [rsp + 0x178]
inc eax
mov dword [rsp + 0x178], eax
movzx eax, byte [0x18003c015]
movsx eax, al
mov dword [rsp + 0x1b0], eax
call fcn.180003770
movsx eax, al
mov ecx, dword [rsp + 0x1b0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1b4], eax
call fcn.180003740
movsx eax, al
imul eax, eax, 5
mov dword [rsp + 0x1b8], eax
call fcn.180003730
movsx eax, al
mov ecx, dword [rsp + 0x1b8]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x1b4]
add ecx, eax
mov eax, ecx
movzx ecx, byte [0x18003c014]
movsx ecx, cl
xor edx, edx
div ecx
movzx ecx, byte [0x18003c011]
movsx ecx, cl
sub eax, ecx
mov eax, eax
cvtsi2sd xmm0, rax
call fcn.180003790
cmp dword [rsp + 0x178], eax
jge 0x18000670b
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32First
mov dword [rsp + 0x17c], eax
jmp 0x1800066ea
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32Next
mov dword [rsp + 0x17c], eax
cmp dword [rsp + 0x17c], 0
je 0x180006706
mov eax, dword [rsp + 0x174]
inc eax
mov dword [rsp + 0x174], eax
jmp 0x1800066d4
jmp 0x180006621
movzx eax, byte [0x18003c015]
movsx eax, al
mov dword [rsp + 0x1bc], eax
call fcn.180003770
movsx eax, al
mov ecx, dword [rsp + 0x1bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1c0], eax
call fcn.180003740
movsx eax, al
imul eax, eax, 0xa
mov dword [rsp + 0x1c4], eax
call fcn.180003730
movsx eax, al
mov ecx, dword [rsp + 0x1c4]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x1c0]
add ecx, eax
mov eax, ecx
movzx ecx, byte [0x18003c014]
movsx ecx, cl
xor edx, edx
div ecx
movzx ecx, byte [0x18003c011]
movsx ecx, cl
sub eax, ecx
test eax, eax
je 0x180006855
cmp dword [rsp + 0x174], 0x37
jg 0x1800067a1
mov qword [rsp + 0x1c8], 1
jmp 0x1800067ad
mov qword [rsp + 0x1c8], 0
cvtsi2sd xmm0, qword [rsp + 0x1c8]
call fcn.180003790
mov dword [rsp + 0x1d0], eax
movzx ecx, byte [0x18003c015]
movsx ecx, cl
mov dword [rsp + 0x1d4], ecx
call fcn.180003770
movsx eax, al
mov ecx, dword [rsp + 0x1d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d8], eax
call fcn.180003740
movsx eax, al
mov dword [rsp + 0x1dc], eax
call fcn.180003730
movsx eax, al
mov ecx, dword [rsp + 0x1dc]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x1d8]
add ecx, eax
mov eax, ecx
movzx ecx, byte [0x18003c014]
movsx ecx, cl
xor edx, edx
div ecx
movzx ecx, byte [0x18003c011]
movsx ecx, cl
sub eax, ecx
mov ecx, dword [rsp + 0x1d0]
imul ecx, eax
mov eax, ecx
test eax, eax
je 0x180006855
xor eax, eax
cmp eax, 6
je 0x180006855
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov rcx, rsp
lea rdx, [0x180021e88]
call fcn.180001582
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.180001348
add rsp, 0x1f0
pop rdi
ret