Function at 0x1800018e0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x1800d7040]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rax
movabs rax, 0xebc7746dd913c599
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x50811b93a3eacaae
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
movabs rbx, 0x8fb41802b667a8ef
mov qword [rsp + 0x20], rbx
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x190], rax
movabs rdi, 0x50811b93c692af80
mov qword [rsp + 0x20], rdi
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x198], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x190]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800019c0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
call fcn.1800017e0
nop
movabs rax, 0xf9c67d71ce08ca99
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
movabs rax, 0x50e463f6e8f7cce9
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x1a0], rax
mov qword [rsp + 0x20], rdi
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x1a8], rax
movdqa xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp + 0x1a0]
movdqa xmmword [rsp + 0x40], xmm0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180001a60
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x40]
call fcn.1800017e0
nop
movabs rax, 0xea9a7b74c414c599
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
movabs rax, 0x50811b93c692caf8
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], rbx
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x1b0], rax
mov qword [rsp + 0x20], rdi
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x1b8], rax
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp + 0x1b0]
movdqa xmmword [rsp + 0x50], xmm0
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180001b00
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x20]
call fcn.1800017e0
nop
movabs rax, 0xe6c26a67c509cd97
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x60], rax
movabs rax, 0x50817eeba3bccae3
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rbx
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x1c0], rax
mov qword [rsp + 0x20], rdi
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x1c8], rax
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp + 0x1c0]
movdqa xmmword [rsp + 0x60], xmm0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180001ba0
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.1800017e0
nop
movabs rax, 0xa1d57f2fc30acd9e
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x70], rax
movabs rax, 0x50811b93c6f7d7e5
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x20], rbx
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x1d0], rax
mov qword [rsp + 0x20], rdi
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x1d8], rax
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rsp + 0x70], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180001c40
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x20]
call fcn.1800017e0
nop
lea rax, [rbp - 0x60]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x40]
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x40]
call fcn.1800023c0
nop
lea r9, [fcn.180002580]
mov edx, 0x20
lea r8d, [rdx - 0x1b]
lea rcx, [rbp - 0x60]
call fcn.1800037b8
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x180001cb0
mov ecx, 0xffffffe2
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [rbp + 0x60], 0x130
lea rdx, [rbp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x180001daf
xor r13d, r13d
nop
mov rbx, qword [rbp + 0x40]
mov r15, qword [rbp + 0x48]
cmp rbx, r15
je 0x180001d9a
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x8c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r13b
jne 0x180001d00
lea rdx, [rbp + 0x8c]
lea rcx, [rbp - 0x80]
call fcn.1800017e0
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180001d26
mov rdx, qword [rbx]
lea rcx, [rbp - 0x80]
mov rdi, qword [rbp - 0x80]
mov rsi, qword [rbp - 0x68]
cmp rsi, 0xf
cmova rcx, rdi
mov r8, qword [rbp - 0x70]
cmp r8, qword [rbx + 0x10]
jne 0x180001d52
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180001d52
mov r14b, 1
jmp 0x180001d55
xor r14b, r14b
cmp rsi, 0xf
jbe 0x180001d88
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180001d80
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001dc4
mov rcx, rdi
call fcn.180003c00
test r14b, r14b
jne 0x180001daf
add rbx, 0x20
cmp rbx, r15
jne 0x180001ce1
lea rdx, [rbp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180001cd0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xffffffe2
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3