Function at 0x18000a1e0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rbp - 0x48], rcx
mov qword [rcx + 0x10], 0
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov ecx, 0x238
call fcn.18000bdb4
mov rbx, rax
mov dword [rax], 0x238
mov rcx, rdi
mov rdx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18000a48d
mov r14, rbx
add r14, 0x2c
mov rcx, r14
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
movabs r13, 0x911717f0ddb0bfe1
movabs r12, 0x9ebafaa9eff27d5e
test eax, eax
jne 0x18000a363
movabs rcx, 0xa8c0b5d20ec624bc
mov qword [rbp - 0x20], rcx
mov rax, qword [rbp - 0x20]
movabs rdx, 0xf2607c47b4d5cff0
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x10], r13
mov rax, qword [rbp - 0x10]
mov qword [rbp - 8], r12
mov rax, qword [rbp - 8]
movabs rax, 0xa8a5b5ba0ea524ef
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
movabs rax, 0xf2057c2bb4a0cf94
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x40], r13
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x38], r12
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x20], rcx
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x10], r13
mov rax, qword [rbp - 0x10]
mov qword [rbp - 8], r12
mov rax, qword [rbp - 8]
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
xorps xmm0, xmmword [rbp - 0x30]
movaps xmmword [rbp - 0x20], xmm0
xorps xmm1, xmmword [rbp - 0x40]
movaps xmmword [rbp - 0x10], xmm1
lea rcx, [rbp - 0x20]
call fcn.18000a060
cmp eax, dword [rbx + 8]
jne 0x18000a363
mov dword [rbp - 0x20], 0
lea rdx, [rbp - 0x20]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp dword [rbp - 0x20], 0
jne 0x18000a363
mov eax, dword [rbx + 8]
mov dword [rbp - 0x30], eax
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x18000a35a
mov dword [rdx], eax
add qword [rcx + 8], 4
jmp 0x18000a363
lea r8, [rbp - 0x30]
call fcn.18000b570
mov r15, qword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop word [rax + rax]
mov rcx, rdi
mov rdx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x18000a48d
mov rcx, r14
mov rdx, rsi
call r15
test eax, eax
jne 0x18000a370
movabs rcx, 0xa8c0b5d20ec624bc
mov qword [rbp - 0x20], rcx
mov rax, qword [rbp - 0x20]
movabs rdx, 0xf2607c47b4d5cff0
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x10], r13
mov rax, qword [rbp - 0x10]
mov qword [rbp - 8], r12
mov rax, qword [rbp - 8]
movabs rax, 0xa8a5b5ba0ea524ef
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
movabs rax, 0xf2057c2bb4a0cf94
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x40], r13
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x38], r12
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x20], rcx
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x10], r13
mov rax, qword [rbp - 0x10]
mov qword [rbp - 8], r12
mov rax, qword [rbp - 8]
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
xorps xmm0, xmmword [rbp - 0x30]
movaps xmmword [rbp - 0x20], xmm0
xorps xmm1, xmmword [rbp - 0x40]
movaps xmmword [rbp - 0x10], xmm1
lea rcx, [rbp - 0x20]
call fcn.18000a060
cmp eax, dword [rbx + 8]
jne 0x18000a370
mov dword [rbp - 0x20], 0
mov ecx, eax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp dword [rbp - 0x20], 0
jne 0x18000a370
mov eax, dword [rbx + 8]
mov dword [rbp - 0x30], eax
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x18000a47f
mov dword [rdx], eax
add qword [rcx + 8], 4
jmp 0x18000a370
lea r8, [rbp - 0x30]
call fcn.18000b570
jmp 0x18000a370
mov rcx, rbx
call fcn.18000bdf0
mov rax, qword [rbp - 0x48]
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret