Function at 0x18006a790
Capabilities:
Enumerate processes
Get system information on windows

Disassembly:
push rbp
push rbx
push r13
push r14
push r15
lea rbp, [rsp - 0x630]
sub rsp, 0x730
mov rax, qword [0x1801044f8]
xor rax, rsp
mov qword [rbp + 0x610], rax
mov r13, r8
lea rcx, [rbp + 0x1f0]
mov r14d, edx
mov r8d, 0x208
xor edx, edx
call fcn.180095d50
xor edx, edx
lea rcx, [rbp + 0x400]
mov r8d, 0x208
call fcn.180095d50
xor edx, edx
mov dword [rbp - 0x50], 0x238
mov r8d, 0x234
lea rcx, [rbp - 0x4c]
call fcn.180095d50
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18006aab8
lea rdx, [rbp - 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
xor r15d, r15d
test eax, eax
je 0x18006a866
nop dword [rax]
cmp dword [rbp - 0x48], r14d
je 0x18006a848
lea rdx, [rbp - 0x50]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x18006a830
jmp 0x18006a866
mov rcx, r15
nop dword [rax + rax]
movzx eax, word [rbp + rcx - 0x24]
mov word [rbp + rcx + 0x1f0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x18006a850
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x1f0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x18006a880
cmp rax, 1
jb 0x18006aab8
cmp dword [0x180104090], 0xffffffff
mov qword [rsp + 0x728], rdi
jne 0x18006a8b9
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp - 0x80]
mov dword [0x180104090], eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x18006a8e9
movsd xmm1, qword [0x1800d0400]
jmp 0x18006aa4e
lea rax, [rsp + 0x30]
mov rcx, rbx
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x18006a8dc
mov edx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x40]
shl rax, 0x20
or rax, rdx
shl r8, 0x20
mov edx, dword [rsp + 0x38]
or r8, rdx
mov qword [0x180108880], rcx
add rax, r8
mov qword [rsp + 0x720], r12
movsxd r8, dword [0x180104090]
cqo
idiv r8
mov rcx, rbx
mov qword [0x180108888], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
test rax, rax
je 0x18006a9aa
lea rax, [rsp + 0x30]
mov rcx, r12
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x18006a9b7
movsd xmm1, qword [0x1800d0400]
jmp 0x18006aa46
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x760], rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
mov edx, dword [rsp + 0x3c]
mov esi, dword [rsp + 0x40]
mov ebx, dword [rsp + 0x44]
shl rax, 0x20
or rax, rcx
shl rdx, 0x20
mov ecx, dword [rsp + 0x38]
or rdx, rcx
movsxd rcx, dword [0x180104090]
add rax, rdx
cqo
idiv rcx
mov rcx, r12
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
sub rdi, qword [0x180108888]
xorps xmm1, xmm1
mov ecx, ebx
xorps xmm0, xmm0
shl rcx, 0x20
or rcx, rsi
mov rsi, qword [rsp + 0x760]
sub rcx, qword [0x180108880]
cvtsi2sd xmm1, rdi
cvtsi2sd xmm0, rcx
divsd xmm1, xmm0
mulsd xmm1, qword [0x1800d03f8]
mov r12, qword [rsp + 0x720]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
cvttsd2si rdi, xmm1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8d, 0x48
lea rdx, [rsp + 0x60]
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
mov rcx, rbx
cmovne r15d, dword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x400]
mov dword [rsp + 0x28], r15d
lea r8, [rbp + 0x1f0]
mov dword [rsp + 0x20], edi
lea rdx, str._s_s_d_d
mov rcx, r13
call fcn.18006b8d0
mov rdi, qword [rsp + 0x728]
xor al, al
mov rcx, qword [rbp + 0x610]
xor rcx, rsp
call fcn.180093c30
add rsp, 0x730
pop r15
pop r14
pop r13
pop rbx
pop rbp
ret