Function at 0x7ff744ff54b4
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x480
xor edx, edx
mov dword [rsp + 0x30], 0x238
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
or rsi, 0xffffffffffffffff
mov r12, rax
cmp rax, rsi
je 0x7ff744ff5716
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor r13d, r13d
test eax, eax
je 0x7ff744ff5716
lea rdx, [0x7ff745013d30]
mov edi, r13d
mov rbx, rdx
movsxd rax, edi
mov r14d, r13d
imul r15, rax, 0x208
mov rax, rsi
add r15, rdx
inc rax
cmp word [r15 + rax*2], r13w
jne 0x7ff744ff5536
test rax, rax
je 0x7ff744ff557b
mov rsi, rbx
movzx ecx, word [rsi]
call fcn.7ff744ff7d54
inc r14d
mov word [rsi], ax
lea rsi, [rsi + 2]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r15 + rcx*2], r13w
jne 0x7ff744ff555e
movsxd rax, r14d
cmp rax, rcx
jb 0x7ff744ff5548
or rsi, 0xffffffffffffffff
lea rdx, [0x7ff745013d30]
inc edi
lea rax, [0x7ff745019078]
add rbx, 0x208
cmp rbx, rax
jl 0x7ff744ff5523
lea rdx, [rsp + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x7ff744ff570d
lea r14, [0x7ff745013d30]
mov edi, r13d
lea rcx, [rsp + 0x5c]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r13w
jne 0x7ff744ff55b8
test rax, rax
je 0x7ff744ff55f7
lea rbx, [rsp + 0x5c]
movzx ecx, word [rbx]
call fcn.7ff744ff807c
mov word [rbx], ax
inc edi
lea rbx, [rbx + 2]
mov rcx, rsi
lea rax, [rsp + 0x5c]
inc rcx
cmp word [rax + rcx*2], r13w
jne 0x7ff744ff55e5
movsxd rax, edi
cmp rax, rcx
jb 0x7ff744ff55cc
mov edi, r13d
movsxd rax, edi
mov rcx, rsi
imul rbx, rax, 0x208
add rbx, r14
inc rcx
cmp word [rbx + rcx*2], r13w
jne 0x7ff744ff560a
lea rdx, [rsp + 0x5c]
mov rax, rsi
inc rax
cmp word [rdx + rax*2], r13w
jne 0x7ff744ff561c
cmp rax, rcx
jb 0x7ff744ff565c
mov rdx, rbx
lea rcx, [rsp + 0x5c]
call fcn.7ff744ff6bb4
test rax, rax
jne 0x7ff744ff5669
lea rax, [rsp + 0x5c]
sub rbx, rax
movzx ecx, word [rax]
movzx edx, word [rax + rbx]
sub ecx, edx
jne 0x7ff744ff5658
add rax, 2
test edx, edx
jne 0x7ff744ff5645
test ecx, ecx
je 0x7ff744ff5669
inc edi
cmp edi, 0x28
jge 0x7ff744ff56f7
jmp 0x7ff744ff55fa
movsd xmm0, qword [str._IM]
lea rcx, [rbp + 0x170]
movzx eax, word [0x7ff74500e558]
sub rcx, 2
movsd qword [rbp + 0x170], xmm0
mov word [rbp + 0x178], ax
lea rcx, [rcx + 2]
cmp word [rcx], r13w
jne 0x7ff744ff5692
lea r8, [rsp + 0x5c]
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x7ff744ff56a3
lea rax, [rbp + 0x170]
sub rax, 2
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x7ff744ff56bf
movsd xmm0, qword [0x7ff74500e560]
lea r9, [rbp + 0x170]
mov dword [rsp + 0x28], r13d
lea r8, str.taskkill
xor edx, edx
movsd qword [rax], xmm0
xor ecx, ecx
mov qword [rsp + 0x20], r13
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [rsp + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x7ff744ff55ad
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x480]
mov eax, 1
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret