Function at 0x180021ab0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18005d0e0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r13, rcx
mov qword [rsp + 0x38], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xor edx, edx
lea ecx, [rbp + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
test rax, rax
jne 0x180021b32
mov rdx, qword [r13]
sub rdx, 0x18
or rsi, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x180021b2b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
jmp 0x180021d87
mov dword [rsp + 0x40], 0x130
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
mov rcx, r14
test eax, eax
jne 0x180021b58
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x180021b0b
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32First]
or rsi, 0xffffffffffffffff
test eax, eax
je 0x180021d5f
lea r15, [rsp + 0x6c]
shr r15, 0x10
lea rdi, [rsp + 0x6c]
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
test r15, r15
jne 0x180021bc9
movzx edi, di
mov ecx, edi
call fcn.180001110
test rax, rax
je 0x180021ca6
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180001a00
mov rbx, qword [rsp + 0x28]
jmp 0x180021ca6
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x6c]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x180021c34
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x180021ca6
cmp dword [rdx + 0x10], eax
jge 0x180021c0a
cmp dword [rbx - 0xc], eax
jl 0x180021d33
mov dword [rbx - 0x10], eax
mov byte [rbx], al
jmp 0x180021ca6
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180021c20
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
jmp 0x180021ca6
mov r12d, dword [rbx - 0x10]
lea rbp, [rsp + 0x6c]
sub rbp, rbx
test ecx, ecx
js 0x180021d54
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x180021c6a
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.180001ef0
mov rbx, qword [rsp + 0x28]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
cmp rbp, r12
movsxd r12, edi
mov r9, r12
ja 0x180021c87
lea r8, [rbx + rbp]
call fcn.18002f970
jmp 0x180021c91
lea r8, [rsp + 0x6c]
call fcn.18002feb4
cmp edi, dword [rbx - 0xc]
jg 0x180021d49
mov dword [rbx - 0x10], edi
mov byte [r12 + rbx], 0
mov ebp, dword [rsp + 0x20]
mov rdx, qword [r13]
xor eax, eax
test rdx, rdx
setne al
test eax, eax
je 0x180021d3e
mov rcx, rbx
call fcn.180030ab0
test eax, eax
sete al
test al, al
je 0x180021d00
mov r8d, dword [rsp + 0x48]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x180021d00
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, 1
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
mov edi, eax
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180021d2a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test edi, edi
je 0x180021d5f
jmp 0x180021b78
mov ecx, 0x80070057
call fcn.180001050
nop
mov ecx, 0x80004005
call fcn.180001050
nop
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x180021d85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, ebp
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18002f950
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret