Function at 0x1400303c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x1400d33c0]
xor rax, rsp
mov qword [rbp + 0x560], rax
mov r13d, edx
xor edx, edx
xor r15d, r15d
mov dword [rsp + 0x50], r15d
mov rbx, rcx
lea r14, [0x1400c53a0]
lea ecx, [rdx + 2]
mov esi, r15d
mov r12b, 1
mov qword [rbp + 0x2e0], r14
mov qword [rbp + 0x530], r8
mov byte [rbp + 0x2f0], sil
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdi, [0x1400c51d8]
lea rcx, [rbp + 0x538]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
mov qword [rbp + 0x2e8], rax
mov qword [rbp + 0x2e0], rdi
mov qword [rbp + 0x550], 7
mov qword [rbp + 0x548], r15
mov word [rbp + 0x538], r15w
call fcn.140007850
lea rcx, [rbp + 0x2f8]
xor edx, edx
mov r8d, 0x238
call fcn.140091cf0
cmp byte [rbp + 0x2f0], 0
mov rcx, qword [rbp + 0x2e8]
mov dword [rbp + 0x2f8], 0x238
lea rdx, [rbp + 0x2f8]
jne 0x1400304b4
mov byte [rbp + 0x2f0], 1
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x1400304ba
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
setne al
test al, al
je 0x1400309dd
mov rax, qword [rbp + 0x2e0]
lea rcx, [rbp + 0x2e0]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test al, al
je 0x140030470
mov r8d, dword [rbp + 0x300]
xor edx, edx
mov ecx, 0x100401
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x48], r15
mov rbx, rax
test rax, rax
je 0x140030568
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x48]
mov edi, eax
call fcn.14000ee20
cmp rbx, 0xffffffffffffffff
je 0x140030560
mov qword [rsp + 0x48], rbx
call fcn.14001f8a0
mov rcx, qword [0x1400d7778]
mov r15, qword [rbp + 0x5a8]
mov r14, rax
test rcx, rcx
jne 0x140030546
call fcn.14001f8b0
mov rcx, qword [0x1400d7778]
mov r10, qword [rcx]
lea r8, [rsp + 0x48]
mov r9, r15
mov rdx, rbx
mov qword [rsp + 0x20], r14
call qword [r10 + reloc.OLEAUT32.dll_VariantClear]
xor r15d, r15d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rbx, rax
jne 0x140030581
cmp byte [0x1400d77dc], 0
jne 0x140030a64
int3
test sil, 1
je 0x140030596
lea rcx, [rbp + 0x190]
and esi, 0xfffffffe
call fcn.140009830
movzx eax, byte [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rdi, r15
mov byte [rsp + 0x30], al
lea rax, [rbx - 1]
mov qword [rsp + 0x48], r15
cmp rax, 0xfffffffffffffffd
ja 0x1400305f9
call fcn.14001f8a0
mov rcx, qword [0x1400d7778]
mov r14, qword [rbp + 0x5a8]
mov rdi, rax
test rcx, rcx
jne 0x1400305dd
call fcn.14001f8b0
mov rcx, qword [0x1400d7778]
mov r10, qword [rcx]
lea r8, [rsp + 0x48]
mov r9, r14
mov rdx, rbx
mov qword [rsp + 0x20], rdi
call qword [r10 + 0x10]
mov rdi, qword [rsp + 0x48]
mov qword [rsp + 0x38], r15
test rbx, rbx
je 0x14003066e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x38]
mov edi, eax
call fcn.14000ee20
cmp rbx, 0xffffffffffffffff
je 0x140030661
mov qword [rsp + 0x38], rbx
call fcn.14001f8a0
mov rcx, qword [0x1400d7778]
mov r15, qword [rbp + 0x5a8]
mov r14, rax
test rcx, rcx
jne 0x140030647
call fcn.14001f8b0
mov rcx, qword [0x1400d7778]
mov r10, qword [rcx]
lea r8, [rsp + 0x38]
mov r9, r15
mov rdx, rbx
mov qword [rsp + 0x20], r14
call qword [r10 + reloc.OLEAUT32.dll_VariantClear]
xor r15d, r15d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x48]
lea rax, [rdi - 1]
mov byte [rsp + 0x40], 0
cmp rax, 0xfffffffffffffffd
ja 0x1400306e5
call fcn.14001f8a0
mov rcx, qword [0x1400d7778]
mov r14, qword [rbp + 0x5a8]
mov rbx, rax
test rcx, rcx
jne 0x1400306a4
call fcn.14001f8b0
mov rcx, qword [0x1400d7778]
mov r10, qword [rcx]
lea r8, [rsp + 0x48]
mov r9, r14
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [r10 + 0x10]
mov rcx, qword [0x1400d7778]
mov rbx, qword [rsp + 0x48]
test rcx, rcx
jne 0x1400306d8
call fcn.14001f8b0
mov rcx, qword [0x1400d7778]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
mov qword [rsp + 0x48], r15
lea rcx, [rsp + 0x48]
call fcn.14000ee20
movzx eax, byte [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov byte [rsp + 0x58], al
lea rax, [rbx - 1]
mov rdi, r15
mov qword [rsp + 0x38], r15
cmp rax, 0xfffffffffffffffd
ja 0x140030752
call fcn.14001f8a0
mov rcx, qword [0x1400d7778]
mov r14, qword [rbp + 0x5a8]
mov rdi, rax
test rcx, rcx
jne 0x140030736
call fcn.14001f8b0
mov rcx, qword [0x1400d7778]
mov r10, qword [rcx]
lea r8, [rsp + 0x38]
mov r9, r14
mov rdx, rbx
mov qword [rsp + 0x20], rdi
call qword [r10 + 0x10]
mov rdi, qword [rsp + 0x38]
mov qword [rsp + 0x60], r15
test rbx, rbx
je 0x1400307c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x60]
mov edi, eax
call fcn.14000ee20
cmp rbx, 0xffffffffffffffff
je 0x1400307ba
mov qword [rsp + 0x60], rbx
call fcn.14001f8a0
mov rcx, qword [0x1400d7778]
mov r15, qword [rbp + 0x5a8]
mov r14, rax
test rcx, rcx
jne 0x1400307a0
call fcn.14001f8b0
mov rcx, qword [0x1400d7778]
mov r10, qword [rcx]
lea r8, [rsp + 0x60]
mov r9, r15
mov rdx, rbx
mov qword [rsp + 0x20], r14
call qword [r10 + reloc.OLEAUT32.dll_VariantClear]
xor r15d, r15d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x38]
lea rax, [rdi - 1]
mov byte [rsp + 0x30], 0
cmp rax, 0xfffffffffffffffd
ja 0x14003083e
call fcn.14001f8a0
mov rcx, qword [0x1400d7778]
mov r14, qword [rbp + 0x5a8]
mov rbx, rax
test rcx, rcx
jne 0x1400307fd
call fcn.14001f8b0
mov rcx, qword [0x1400d7778]
mov r10, qword [rcx]
lea r8, [rsp + 0x38]
mov r9, r14
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [r10 + 0x10]
mov rcx, qword [0x1400d7778]
mov rbx, qword [rsp + 0x38]
test rcx, rcx
jne 0x140030831
call fcn.14001f8b0
mov rcx, qword [0x1400d7778]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
mov qword [rsp + 0x38], r15
lea rcx, [rsp + 0x38]
call fcn.14000ee20
test sil, 8
je 0x14003085d
lea rcx, [rbp + 0x190]
and esi, 0xfffffff7
call fcn.140009830
cmp byte [rsp + 0x58], 0
je 0x14003086c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x140030871
mov rax, qword [rsp + 0x60]
mov edx, r13d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne dil
test dil, dil
je 0x14003093c
cmp byte [rsp + 0x58], 0
je 0x14003089b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x1400308a0
mov rax, qword [rsp + 0x60]
mov edx, 0xea60
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400309cb
test sil, 0x10
je 0x1400309cb
mov edx, dword [rsp + 0x70]
lea rcx, [rbp + 0x298]
and esi, 0xffffffef
call fcn.140009dd0
lea rdx, [0x1400c3e34]
lea rcx, [rbp - 0x80]
mov rbx, rax
call fcn.140008810
mov rdx, rbx
mov rcx, rax
call fcn.14000c400
cmp qword [rbp + 0x2b0], 0x10
jb 0x140030907
mov rcx, qword [rbp + 0x298]
call fcn.1400910f4
mov eax, dword [rsp + 0x70]
lea rcx, [rsp + 0x68]
mov qword [rbp + 0x2b0], 0xf
mov qword [rbp + 0x2a8], r15
mov byte [rbp + 0x298], 0
mov dword [rsp + 0x68], eax
call fcn.14002b8b0
lea rcx, [rsp + 0x78]
jmp 0x1400309c6
test sil, 0x20
je 0x1400309cb
mov edx, dword [rbp + 0x80]
lea rcx, [rbp + 0x2b8]
and esi, 0xffffffdf
call fcn.140009dd0
lea rdx, [0x1400c3e34]
lea rcx, [rbp + 0x90]
mov rbx, rax
call fcn.140008810
mov rdx, rbx
mov rcx, rax
call fcn.14000c400
cmp qword [rbp + 0x2d0], 0x10
jb 0x140030992
mov rcx, qword [rbp + 0x2b8]
call fcn.1400910f4
mov eax, dword [rbp + 0x80]
lea rcx, [rsp + 0x50]
mov qword [rbp + 0x2d0], 0xf
mov qword [rbp + 0x2c8], r15
mov byte [rbp + 0x2b8], 0
mov dword [rsp + 0x50], eax
call fcn.14002b8b0
lea rcx, [rbp + 0x88]
call fcn.140009830
lea rcx, [rsp + 0x60]
and r12b, dil
call fcn.14000ee20
jmp 0x140030470
cmp qword [rbp + 0x550], 8
lea rax, [0x1400c51d8]
mov qword [rbp + 0x2e0], rax
jb 0x140030a01
mov rcx, qword [rbp + 0x538]
call fcn.1400910f4
mov rcx, qword [rbp + 0x2e8]
lea rax, [0x1400c53a0]
mov qword [rbp + 0x550], 7
mov qword [rbp + 0x2e0], rax
mov qword [rbp + 0x548], r15
mov word [rbp + 0x538], r15w
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r12b
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.140091a70
mov rbx, qword [rsp + 0x6c0]
add rsp, 0x670
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 1
call fcn.14009400c
int3