Function at 0x180009650
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
sub rsp, 0x2b0
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1800f2040]
xor rax, rsp
mov qword [rbp + 0x260], rax
movabs rax, 0x28384edcf0f673a7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x54bad28bc422e7d5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x9d9fd63beed02c46
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xe9cbe0a53d6d6c9f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x73a0d39d7a8f2d2f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x492fc20d29a0e3a7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xd65d5cd09d212bff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xa4e469d8559bba44
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0x501841662fdb46ba
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rcx, 0xfd5011d7bfb8b118
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x285b4eaef09373f7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0x54d3d2ffc452e7b0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0x9df6d668eebe2c29
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rax, 0xe9aae0c93d186cf2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
movabs rax, 0x73ced3f27ae62d5b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0x495bc26329cfe3e4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0xd6385cbc9d4e2b8d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
movabs rax, 0xa49c69bd55b5ba36
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
movabs rax, 0x501841662fdb46df
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x220]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqa xmm0, xmmword [rbp + 0x60]
vxorps xmm0, xmm0, xmmword [rbp + 0x240]
vmovdqa xmmword [rbp + 0x60], xmm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x1d0], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x1e0], xmm1
lea rax, [rbp + 0x20]
mov r8, 0xffffffffffffffff
vzeroupper
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1800098b0
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x1d0]
call fcn.18001a520
nop
lea rdx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 7
cmova rdx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x1e0]
lea r14, [rdx + rax*2]
lea rdi, [rbp + 0x1d0]
cmova rdi, qword [rbp + 0x1d0]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
movabs rbx, 0x7fffffffffffffff
mov qword [rbp + 0x1c0], 0
mov qword [rbp + 0x1c8], 0xf
cmp rdi, r14
jne 0x180009938
mov byte [rbp + 0x1b0], 0
jmp 0x180009a3f
sub r14, rdi
sar r14, 1
cmp r14, rbx
ja 0x180009c94
mov esi, 0xf
cmp r14, rsi
jbe 0x1800099f6
mov rsi, r14
or rsi, 0xf
cmp rsi, rbx
jbe 0x1800099a2
mov rsi, rbx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1800b75f8
mov rcx, rax
test rax, rax
je 0x180009bf4
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1c8], rsi
jmp 0x1800099fd
mov eax, 0x16
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
test rcx, rcx
jne 0x1800099c9
xor eax, eax
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1c8], rsi
jmp 0x1800099fd
cmp rcx, 0x1000
jb 0x1800099e1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180009c9a
jmp 0x180009972
call fcn.1800b75f8
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1c8], rsi
jmp 0x1800099fd
mov rax, qword [rbp + 0x1b0]
lea r8, [rbp + 0x1b0]
cmp rsi, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, r14
test r14, r14
je 0x180009a33
nop word [rax + rax]
movzx eax, byte [rdi]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rdi, [rdi + 2]
sub rdx, 1
jne 0x180009a20
mov qword [rbp + 0x1c0], r14
mov byte [r8 + r14], 0
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x80], 0x130
lea rdx, [rbp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x180009ae8
nop dword [rax]
lea rdx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 0xf
cmova rdx, qword [rbp + 0x1b0]
lea rcx, [rbp + 0xac]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x180009acc
mov r8d, dword [rbp + 0x88]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x180009acc
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
test eax, eax
jne 0x180009ae2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180009a70
jmp 0x180009ae8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp]
call fcn.180005730
mov rax, qword [rbp]
mov rcx, rax
movabs rdx, 0x7ffffffed5fa0dff
cmp rax, rdx
jge 0x180009b1d
movabs rbx, 0x12a05f200
add rbx, rax
movabs rdi, 0x4e94914f0000
movabs rsi, 0x431bde82d7b634db
mov r14d, 0xff
lea rcx, [rbp]
call fcn.180005730
mov rax, qword [rbp]
cmp rbx, rax
je 0x180009bbc
mov ecx, 1
cmovl ecx, r14d
test cl, cl
jle 0x180009bbc
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jne 0x180009b7e
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x180009b37
jl 0x180009b8e
mov edx, 0x5265c00
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x180009b37
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x180009bb0
inc edx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x180009b37
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x180009c00
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009bfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180009bfb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800b75f0
mov qword [rbp + 0x1c0], 0
mov qword [rbp + 0x1c8], 0xf
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 7
jbe 0x180009c66
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009c61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180009c61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800b75f0
xor eax, eax
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1800b75d0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.180004930
nop
call fcn.180004890
int3