Function at 0x4ab7c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push r15
mov eax, 0x10178
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rax, qword [sym.imp.libssp_0.dll___stack_chk_guard]
xor edx, edx
mov ebp, 1
mov rbx, qword [rax]
mov qword [rsp + 0x10168], rbx
xor ebx, ebx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rcx, rsi
lea r15, [rsp + 0x30]
lea rsi, [rsp + 0x160]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x160], eax
nop word cs:[rax + rax]
xor eax, eax
mov ecx, 0x26
mov rdi, r15
mov rdx, r15
rep stosq qword [rdi], rax
mov rcx, rbx
mov dword [rsp + 0x30], 0x130
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4ab8f1
mov r14d, ebp
lea r12d, [rbp - 1]
lea rdi, [rsp + 0x15c]
nop word [rax + rax]
mov r13d, r12d
test r12d, r12d
js 0x4ab8cc
movsxd rcx, r14d
mov r9d, r12d
mov r8d, dword [rsp + 0x38]
mov r10d, dword [rsp + 0x50]
shl rcx, 2
shl r9, 2
lea rax, [rsi + rcx]
add rcx, rdi
sub rcx, r9
jmp 0x4ab8bd
cmp edx, r10d
jne 0x4ab8b4
movsxd rdx, r14d
add r14d, 1
mov dword [rsp + rdx*4 + 0x160], r8d
sub rax, 4
cmp rax, rcx
je 0x4ab8c5
mov edx, dword [rax - 4]
cmp edx, r8d
jne 0x4ab8a0
lea r12d, [r14 - 1]
mov r13d, r12d
cmp r14d, 0x3fff
jg 0x4ab8f5
mov rdx, r15
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4ab870
cmp ebp, r14d
je 0x4ab8f5
mov ebp, r14d
jmp 0x4ab830
lea r13d, [rbp - 1]
test r13d, r13d
jle 0x4ab9bc
movsxd rax, r13d
mov rsi, qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r12d, r12d
mov rbp, qword [sym.imp.KERNEL32.dll_TerminateProcess]
shl rax, 2
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [rsp + rax + 0x15c]
lea r14, [rsp + rax + 0x160]
lea eax, [r13 - 1]
mov r13d, 0xffffffff
shl rax, 2
sub rbx, rax
nop
mov r8d, dword [r14]
xor edx, edx
mov ecx, 1
call rsi
mov r15, rax
test rax, rax
je 0x4ab969
mov rcx, rax
mov edx, 0x8f
call rbp
mov rcx, r15
test eax, eax
cmove r12d, r13d
call rdi
sub r14, 4
cmp r14, rbx
jne 0x4ab940
mov rsi, qword [rsp + 0x28]
mov edx, 0x8f
mov rcx, rsi
call rbp
mov rcx, rsi
test eax, eax
mov eax, 0xffffffff
cmove r12d, eax
call rdi
mov rax, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rsi, qword [rsp + 0x10168]
xor rsi, qword [rax]
jne 0x4ab9cf
mov eax, r12d
add rsp, 0x10178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rbp, qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12d, r12d
jmp 0x4ab972
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r13, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [r13]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rax, qword [0x005ab200]
mov rsi, rcx
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
movzx eax, byte [rcx]
test al, al
je 0x4abc48
mov rdi, qword [str._________AA__A__________________]
mov rbx, rcx
mov r14, rcx
movabs r12, 0x400000020000121
lea rbp, [rsp + 0x20]
jmp 0x4aba8c
cmp r14, rbx
je 0x4aba66
mov r8, rbx
mov rdx, r14
mov rcx, rbp
sub r8, r14
call fcn.00472fb0
movzx eax, byte [rbx]
cmp al, 0x5c
je 0x4abb18
mov r14, rbx
cmp al, 0x22
je 0x4abb18
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x4abb62
movzx edx, al
lea ecx, [rax - 0x22]
mov r8d, 1
movzx edx, byte [rdi + rdx]
not edx
and edx, 1
cmp cl, 0x3a
ja 0x4abab3
mov r8, r12
shr r8, cl
not r8
and r8d, 1
cmp al, 0x7b
setne cl
cmp al, 0x7e
setne al
and eax, ecx
test al, dl
je 0x4abac8
test r8b, r8b
jne 0x4aba7c
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x4aba50
cmp qword [rsp + 0x20], 1
ja 0x4abaf0
mov edx, 1
mov rcx, rbp
call fcn.004727c0
mov rax, qword [rsp + 0x28]
lea rdx, [rax + 1]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x30]
mov byte [rdx + rax], 0x22
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov byte [rdx + rax], 0
jmp 0x4aba50
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x4abb98
mov rax, qword [rsp + 0x28]
sub rdx, rax
cmp rdx, 1
je 0x4abb98
lea rdx, [rax + 1]
mov r14, rbx
add rbx, 1
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x30]
mov byte [rdx + rax], 0x5c
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov byte [rdx + rax], 0
movzx eax, byte [rbx]
test al, al
jne 0x4aba8c
cmp rsi, rbx
je 0x4abc24
cmp qword [rsp + 0x28], 0
mov rax, rsi
jne 0x4abbb0
mov rsi, qword [rsp + 0x38]
xor rsi, qword [r13]
jne 0x4abc84
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, 1
mov rcx, rbp
call fcn.004727c0
mov rax, qword [rsp + 0x28]
jmp 0x4abb30
lea r12, [rsp + 0x20]
sub rbx, r14
mov rdx, r14
mov r8, rbx
mov rcx, r12
call fcn.00472fb0
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x4abc10
mov rax, qword [rsp + 0x28]
sub rdx, rax
cmp rdx, 1
je 0x4abc10
lea rdx, [rax + 1]
mov rcx, r12
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x30]
mov byte [rdx + rax], 0x22
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov byte [rdx + rax], 0
xor edx, edx
call fcn.004728a0
jmp 0x4abb76
mov edx, 1
mov rcx, r12
call fcn.004727c0
mov rax, qword [rsp + 0x28]
jmp 0x4abbde
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x4abc48
mov rax, qword [rsp + 0x28]
lea r12, [rsp + 0x20]
sub rdx, rax
cmp rdx, 1
jne 0x4abc5f
nop dword [rax]
lea r12, [rsp + 0x20]
mov edx, 1
mov rcx, r12
call fcn.004727c0
mov rax, qword [rsp + 0x28]
lea rdx, [rax + 1]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x30]
mov byte [rdx + rax], 0x22
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov byte [rdx + rax], 0
jmp 0x4abbc6
call sub.libssp_0.dll___stack_chk_fail
nop
nop word [rax + rax]
push rbx
sub rsp, 0x20
mov rbx, rdx
mov rdx, rcx
mov rcx, rbx
call qword [0x00578a30]
test eax, eax
mov eax, 0
cmove rax, rbx
add rsp, 0x20
pop rbx
ret