Function at 0x1400b8d70
Capabilities:
Enumerate processes
Terminate process
Write file on windows

Disassembly:
push r15
mov eax, 0x10178
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1401be370
sub rsp, rax
mov rsi, qword [0x140207460]
xor edx, edx
mov r12d, 1
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov ecx, 2
lea rbp, [rsp + 0x160]
mov rax, qword [rsi]
mov qword [rsp + 0x10168], rax
xor eax, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rcx, rbx
lea rbx, [rsp + 0x30]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x160], eax
xor eax, eax
mov ecx, 0x26
mov rdi, rbx
mov rdx, rbx
rep stosq qword [rdi], rax
mov rcx, rsi
mov dword [rsp + 0x30], 0x130
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1400b8e91
mov r15d, r12d
lea r13d, [r12 - 1]
lea rdi, [rsp + 0x15c]
nop
mov r14d, r13d
test r13d, r13d
js 0x1400b8e75
movsxd rcx, r15d
mov r9d, r13d
mov r8d, dword [rsp + 0x38]
mov r10d, dword [rsp + 0x50]
shl rcx, 2
shl r9, 2
lea rax, [rbp + rcx]
add rcx, rdi
sub rcx, r9
jmp 0x1400b8e5d
cmp edx, r10d
jne 0x1400b8e54
movsxd rdx, r15d
add r15d, 1
mov dword [rsp + rdx*4 + 0x160], r8d
sub rax, 4
cmp rax, rcx
je 0x1400b8e65
mov edx, dword [rax - 4]
cmp edx, r8d
jne 0x1400b8e40
lea r13d, [r15 - 1]
mov r14d, r13d
cmp r15d, 0x3fff
jg 0x1400b8e96
mov rdx, rbx
mov rcx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400b8e10
cmp r12d, r15d
je 0x1400b8e96
mov r12d, r15d
jmp 0x1400b8dd7
lea r14d, [r12 - 1]
test r14d, r14d
jle 0x1400b8f5d
movsxd rax, r14d
mov rdi, qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ebx, ebx
shl rax, 2
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rsi, [rsp + rax + 0x15c]
lea r13, [rsp + rax + 0x160]
lea eax, [r14 - 1]
mov r14d, 0xffffffff
shl rax, 2
sub rsi, rax
nop
mov r8d, dword [r13]
xor edx, edx
mov ecx, 1
call rdi
mov r15, rax
test rax, rax
je 0x1400b8f0b
mov rcx, rax
mov edx, 0x8f
call r12
mov rcx, r15
test eax, eax
cmove ebx, r14d
call rbp
sub r13, 4
cmp r13, rsi
jne 0x1400b8ee0
mov rsi, qword [rsp + 0x28]
mov edx, 0x8f
mov rcx, rsi
call r12
mov rcx, rsi
test eax, eax
mov eax, 0xffffffff
cmove ebx, eax
call rbp
mov rsi, qword [0x140207460]
mov rax, qword [rsp + 0x10168]
sub rax, qword [rsi]
jne 0x1400b8f6f
mov eax, ebx
add rsp, 0x10178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r12, qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x1400b8f14
call fcn.1401be670
nop
nop word cs:[rax + rax]
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
movzx eax, byte [rcx]
mov rbx, rcx
test al, al
je 0x1400b9170
mov r11, qword [str._________AA__A__________________]
mov r9, rcx
xor r10d, r10d
xor r8d, r8d
xor edx, edx
jmp 0x1400b8fe3
cmp al, 0x3f
je 0x1400b8fed
jg 0x1400b8ff8
cmp al, 0x27
je 0x1400b8fed
cmp al, 0x2a
je 0x1400b8fed
cmp al, 0x22
sete al
movzx eax, al
add r8d, eax
nop dword [rax]
movzx eax, byte [r9 + 1]
add edx, 1
lea rcx, [r9 + 1]
test al, al
je 0x1400b9010
mov r9, rcx
movzx ecx, al
test byte [r11 + rcx], 1
je 0x1400b8fb0
mov r10d, 1
jmp 0x1400b8fd0
cmp al, 0x5c
je 0x1400b9028
cmp al, 0x7b
mov eax, 1
cmove r10d, eax
jmp 0x1400b8fd0
or r10d, r8d
mov rdi, rbx
jne 0x1400b9068
mov rax, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
movzx eax, byte [r9]
mov rcx, r9
xor esi, esi
cmp al, 0x5c
jne 0x1400b9052
nop dword [rax]
mov rsi, rcx
movzx eax, byte [rcx + 1]
add rcx, 1
cmp al, 0x5c
je 0x1400b9038
sub esi, r9d
sub edx, r9d
add esi, 1
add edx, ecx
cmp al, 0x22
je 0x1400b905a
test al, al
jne 0x1400b8fe0
lea r8d, [r8 + rsi*2 + 1]
jmp 0x1400b8fdc
movsxd rdx, edx
movsxd r8, r8d
mov rcx, rdx
add rcx, r8
jb 0x1400b919a
cmp rcx, 0xfffffffffffffffc
ja 0x1400b9191
add rcx, 3
call fcn.1400a5fa0
mov byte [rax], 0x22
movzx edx, byte [rbx]
mov rdi, rax
lea rcx, [rax + 1]
test dl, dl
jne 0x1400b90ce
jmp 0x1400b9158
movzx eax, byte [rbx]
mov r8, rcx
mov r9, rbx
cmp dl, 0x5c
je 0x1400b90e8
mov byte [r8], al
movzx edx, byte [r9 + 1]
add rbx, 1
lea rcx, [r8 + 1]
test dl, dl
je 0x1400b9158
cmp dl, 0x22
jne 0x1400b90a8
mov byte [rcx], 0x5c
lea r8, [rcx + 1]
movzx eax, byte [rbx]
mov r9, rbx
jmp 0x1400b90b6
cmp al, 0x5c
jne 0x1400b9180
xor r8d, r8d
nop dword [rax + rax]
mov rbp, rbx
add rbx, 1
mov byte [rcx], 0x5c
mov edx, r8d
movzx eax, byte [rbx]
add rcx, 1
lea r8d, [r8 + 1]
cmp al, 0x5c
je 0x1400b90f8
cmp al, 0x22
je 0x1400b9122
mov r8, rcx
mov r9, rbx
test al, al
jne 0x1400b90b6
add edx, 1
movsxd rsi, edx
mov edx, 0x5c
mov r8, rsi
call sub.msvcrt.dll_memset
mov r9, rbx
mov rcx, rax
movzx eax, byte [rbp + 1]
add rcx, rsi
test al, al
je 0x1400b9158
mov byte [rcx], 0x5c
lea r8, [rcx + 1]
movzx eax, byte [rbx]
jmp 0x1400b90b6
mov eax, 0x22
mov word [rcx], ax
mov rax, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 3
jmp 0x1400b9088
test al, al
je 0x1400b918c
cmp al, 0x22
jne 0x1400b90b6
mov r9, rbx
jmp 0x1400b9142
mov r8d, 3
mov rdx, rcx
lea rcx, [0x1401e0400]
call fcn.1400a08a0
nop
nop word [rax + rax]
push rbx
sub rsp, 0x20
mov rbx, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1400b91e3
mov rax, qword [0x14023eea0]
test rax, rax
je 0x1400b9201
cmp rax, 1
je 0x1400b91d9
mov ecx, 0xe
call rax
mov eax, dword [0x14023eea8]
test eax, eax
jne 0x1400b91f9
mov edx, dword [0x14023eeac]
mov rcx, qword [0x14023eeb8]
call rbx
cmp eax, 0x102
je 0x1400b91c0
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov ecx, 2
call fcn.1400c2da0
test eax, eax
jne 0x1400b922d
lea rcx, str.compat_mingw.c
mov r8d, 0x8e
mov edx, 0xbaa
call fcn.140003470
mov ecx, eax
call sub.msvcrt.dll_exit
mov ecx, 2
call qword [fcn.1401bee20]
mov r8d, 0xc
mov edx, 1
lea rcx, str.Alarm_clock_n
mov r9, rax
call sub.msvcrt.dll_fwrite
jmp 0x1400b920f