Function at 0x18002f1b0
Capabilities:
Enumerate processes
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x660]
sub rsp, 0x760
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rbp + 0x650], rax
xor edi, edi
mov qword [rsp + 0x60], rdx
test byte [rcx], 0x10
mov r15, 0xffffffffffffffff
mov esi, 1
mov qword [rsp + 0x70], rcx
mov r12, rdx
mov dword [rsp + 0x54], edi
mov r14, rcx
mov dword [rsp + 0x50], edi
mov r13d, edi
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x5c], edi
mov dword [rsp + 0x58], esi
je 0x18002f299
add rcx, 4
call fcn.180034490
mov rdi, rax
test rax, rax
jne 0x18002f239
call qword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
jmp 0x18002f735
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x120116
mov r8d, esi
mov dword [rsp + 0x20], 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x68], rax
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x18002f289
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
neg ebx
call fcn.1800a4108
mov eax, ebx
jmp 0x18002f735
xor esi, esi
mov rcx, rdi
mov dword [rsp + 0x58], esi
call fcn.1800a4108
xor edi, edi
lea rcx, str.iphlpapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp - 0x78], rax
test rax, rax
je 0x18002f2c2
lea rdx, str.GetExtendedTcpTable
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test r12, r12
je 0x18002f62a
xor ecx, ecx
lea rdx, [rsp + 0x54]
mov r8d, 1
test r13, r13
je 0x18002f2f2
mov dword [rsp + 0x28], edi
lea r9d, [r8 + 1]
mov dword [rsp + 0x20], 5
call r13
jmp 0x18002f2f7
call sub.IPHLPAPI.DLL_GetTcpTable
cmp eax, 0x7a
jne 0x18002f62a
mov ecx, dword [rsp + 0x54]
call fcn.1800a411c
mov qword [rsp + 0x78], rax
mov rbx, rax
test rax, rax
je 0x18002f62a
lea rdx, [rsp + 0x54]
mov r8d, 1
mov rcx, rax
test r13, r13
je 0x18002f342
mov dword [rsp + 0x28], edi
lea r9d, [r8 + 1]
mov dword [rsp + 0x20], 5
call r13
jmp 0x18002f347
call sub.IPHLPAPI.DLL_GetTcpTable
test eax, eax
jne 0x18002f62a
test r13, r13
je 0x18002f434
xor edx, edx
lea ecx, [rax + 2]
call fcn.1800a1abb
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18002f434
xor edx, edx
lea rcx, [rbp - 0x6c]
mov r8d, 0x234
call fcn.1800a3140
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x238
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18002f42b
xor r15d, r15d
nop
lea rcx, [rbp - 0x44]
call fcn.1800343f0
mov rbx, rax
test rax, rax
je 0x18002f412
mov ecx, 0x18
call fcn.1800a411c
mov rdx, rax
test rax, rax
je 0x18002f412
mov qword [rax + 8], rbx
mov ecx, dword [rbp - 0x68]
mov dword [rax], ecx
mov rax, qword [0x1800f3e80]
test rax, rax
je 0x18002f407
mov qword [rdx + 0x10], rax
mov rcx, qword [0x1800f3e80]
cmp qword [rcx + 0x10], r15
je 0x18002f401
nop dword [rax]
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov rcx, rax
cmp qword [rax + 0x10], r15
jne 0x18002f3f0
mov qword [rcx + 0x10], rdx
jmp 0x18002f40e
mov qword [0x1800f3e80], rdx
mov qword [rdx + 0x10], r15
lea rdx, [rbp - 0x70]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x18002f3a0
mov rbx, qword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.18002c530
xor esi, esi
cmp dword [rbx], esi
jbe 0x18002f638
lea r15, [0x1800f3080]
test r13, r13
mov eax, reloc.WS2_32.dll_sendto
mov edi, 0x18
cmove edi, eax
mov eax, esi
imul rdi, rax
mov eax, dword [r14]
add rdi, rbx
mov ecx, dword [rdi + 4]
sub ecx, 1
je 0x18002f487
cmp ecx, 1
je 0x18002f482
test al, 2
jmp 0x18002f489
and eax, 1
jmp 0x18002f489
test al, 4
je 0x18002f61f
xorps xmm0, xmm0
lea rcx, [rbp + 0x250]
xor edx, edx
mov r8d, 0x400
movups xmmword [rbp + 0x1d0], xmm0
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x1f0], xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
call fcn.1800a3140
mov eax, dword [rdi + 4]
movzx ecx, word [rdi + 0xc]
mov r14, qword [r15 + rax*8]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rdi + 0x14]
movzx r15d, ax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx r12d, ax
test r13, r13
je 0x18002f53c
mov rcx, qword [0x1800f3e80]
mov ebx, dword [rdi + 0x18]
test rcx, rcx
je 0x18002f541
cmp dword [rcx], ebx
je 0x18002f524
mov rcx, qword [rcx + 0x10]
test rcx, rcx
jne 0x18002f515
jmp 0x18002f541
mov rdx, qword [rcx + 8]
test rdx, rdx
je 0x18002f541
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x18002f541
mov ebx, 0xffffffff
mov ecx, dword [rsp + 0x58]
mov r9d, r15d
mov eax, dword [rdi + 0x10]
mov edx, 0x400
mov r8d, dword [rdi + 8]
mov dword [rsp + 0x48], ecx
lea rcx, [rbp + 0x1d0]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x250]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], eax
call fcn.18002c360
lea rcx, [rbp + 0x250]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [rsp + 0x50]
add eax, ecx
mov r14, qword [rsp + 0x70]
cmp eax, 0x100000
jle 0x18002f5ea
lea rcx, [r14 + 4]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r12, qword [rsp + 0x60]
test eax, eax
jle 0x18002f5e2
mov r15, qword [rsp + 0x68]
cmp r15, 0xffffffffffffffff
je 0x18002f5e2
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x5c]
mov rdx, r12
mov qword [rsp + 0x20], 0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002f62a
xor ecx, ecx
mov dword [rsp + 0x50], ecx
jmp 0x18002f5ef
mov r12, qword [rsp + 0x60]
movsxd rcx, ecx
lea rdx, [rbp + 0x250]
add rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbp + 0x250]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rbx, qword [rsp + 0x78]
lea r15, [0x1800f3080]
add dword [rsp + 0x50], eax
inc esi
cmp esi, dword [rbx]
jae 0x18002f638
jmp 0x18002f455
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
neg edi
test edi, edi
jne 0x18002f67e
lea rcx, [r14 + 4]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r15, qword [rsp + 0x68]
test eax, eax
jle 0x18002f67a
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x5c]
mov rdx, r12
mov qword [rsp + 0x20], 0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18002f67a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
neg edi
jne 0x18002f67e
mov edi, dword [rsp + 0x50]
test r13, r13
je 0x18002f715
mov rax, qword [0x1800f3e80]
mov rbx, rax
test rax, rax
je 0x18002f715
nop word [rax + rax]
mov rsi, qword [rbx + 0x10]
cmp rax, rbx
jne 0x18002f6af
mov rdx, qword [rax + 0x10]
jmp 0x18002f6e7
mov rcx, qword [rax + 0x10]
mov rdx, rax
test rcx, rcx
je 0x18002f6d8
nop dword [rax + rax]
cmp rcx, rbx
je 0x18002f6d8
mov rax, rcx
mov qword [0x1800f3e80], rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
jne 0x18002f6c0
cmp qword [rax + 0x10], 0
je 0x18002f6e7
mov rcx, qword [rbx + 0x10]
mov qword [rax + 0x10], rcx
mov qword [0x1800f3e80], rdx
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18002f6fc
call fcn.1800a4108
mov rcx, rbx
call fcn.1800a4108
mov rbx, rsi
test rsi, rsi
je 0x18002f715
mov rax, qword [0x1800f3e80]
jmp 0x18002f6a0
cmp r15, 0xffffffffffffffff
je 0x18002f724
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x18002f733
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rcx, qword [rbp + 0x650]
xor rcx, rsp
call fcn.1800a1bf0
mov rbx, qword [rsp + 0x7b0]
add rsp, 0x760
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret