Function at 0x180001910
Capabilities:
Decode data using base64 via winapi
Enumerate processes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x190
mov rax, qword [0x180045028]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r14, rdx
mov rbx, rcx
xor edx, edx
mov ebp, r9d
mov rsi, r8
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180001961
lea rcx, str.Error_creating_process_snapshot
call fcn.180013b6c
jmp 0x180001a0f
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x130
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x180001990
lea rcx, str.Error_getting_first_process
call fcn.180013b6c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Process_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800019b1
mov edx, dword [rsp + 0x48]
lea rcx, str.Process_ID:__lu_n
call fcn.180001120
lea rcx, str.Parent_Process_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800019d2
mov edx, dword [rsp + 0x60]
lea rcx, str.Parent_Process_ID:__lu_n
call fcn.180001120
lea rcx, str.Process_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800019f4
lea rdx, [rsp + 0x6c]
lea rcx, str.Process_Name:__s_n
call fcn.180001120
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180001990
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.La_paz_os_dejo__mi_paz_os_doy._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001a2c
lea rcx, str.La_paz_os_dejo__mi_paz_os_doy._n
call fcn.180001120
lea rcx, str.The_surface_area_of_the_cuboid_with_length__lf__width__lf__and_height__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001a74
movsd xmm1, qword [0x18003f158]
lea rcx, str.The_surface_area_of_the_cuboid_with_length__lf__width__lf__and_height__lf_is:__lf_n
movsd xmm0, qword [0x18003f178]
movaps xmm3, xmm1
movq r9, xmm1
movsd qword [rsp + 0x20], xmm0
movaps xmm2, xmm1
movq r8, xmm1
movq rdx, xmm1
call fcn.180001120
mov qword [rsp + 0x188], r15
test rsi, rsi
je 0x180001c10
xor r15d, r15d
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov edx, ebp
mov qword [rsp + 0x28], r15
mov rcx, rsi
mov qword [rsp + 0x20], r14
lea r8d, [r15 + 1]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x180001c10
mov ecx, dword [r14]
inc ecx
call fcn.180015bf4
lea rcx, str.Je_suis_le_chemin__la_vrit_et_la_vie._n
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001adb
lea rcx, str.Je_suis_le_chemin__la_vrit_et_la_vie._n
call fcn.180001120
lea rcx, str.____n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001af8
lea rcx, str.____n
call fcn.180001120
lea rcx, [0x18003dc50]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001b15
lea rcx, [0x18003dc50]
call fcn.180001120
mov rdi, qword [rbx]
test rdi, rdi
je 0x180001c10
mov ecx, dword [r14]
xor eax, eax
inc ecx
rep stosb byte [rdi], al
lea rcx, str._c_is_a_lowercase_letter._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001b4c
mov edx, 0x65
lea rcx, str._c_is_a_lowercase_letter._n
call fcn.180001120
lea rcx, str.Y_he_aqu__yo_estoy_con_vosotros_todos_los_das__hasta_el_fin_del_mundo._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001b69
lea rcx, str.Y_he_aqu__yo_estoy_con_vosotros_todos_los_das__hasta_el_fin_del_mundo._n
call fcn.180001120
lea rcx, str.Follow_me__and_I_will_make_you_fishers_of_men._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001b86
lea rcx, str.Follow_me__and_I_will_make_you_fishers_of_men._n
call fcn.180001120
mov r9, qword [rbx]
mov r8d, 1
mov qword [rsp + 0x30], r15
mov edx, ebp
mov qword [rsp + 0x28], r15
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x180001c38
mov rcx, qword [rbx]
call fcn.180015bec
lea rcx, str.___________n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001bd6
lea rcx, str.___________n
call fcn.180001120
lea rcx, str.Je_suis_le_chemin__la_vrit_et_la_vie._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001bf3
lea rcx, str.Je_suis_le_chemin__la_vrit_et_la_vie._n
call fcn.180001120
lea rcx, [0x18003de30]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001c10
lea rcx, [0x18003de30]
call fcn.180001120
xor al, al
mov r15, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18000eae0
add rsp, 0x190
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov al, 1
jmp 0x180001c12