Function at 0x140007630
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x300
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1401ba600]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
movabs rax, 0xbd40879433bc7480
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x6a4b729bfc2ec3f4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x6eceb6ebe5d1e6f4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x9d88b070d465fc1d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs r12, 0xde33aaff50d501f1
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rsi, 0x92e00b6924ba686
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rdi, 0x16ab989980b5949b
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs r14, 0x9d88b070d465fc78
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x20], ymm1
movabs rax, 0xf11c908c20a17599
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rax, 0x684d2ec5f727cfe0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
movabs rax, 0x73c4f5b7f8daf6ef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
movabs rax, 0xb3eed609e15d8557
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
movabs rax, 0x55a6b32b36a31ab7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
movabs r15, 0x15b8ebc2349a873a
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x268], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
movabs r13, 0x55a6b32b36cd73d5
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
vmovdqu ymm0, ymmword [rbp + 0x240]
vpxor ymm1, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x240], ymm1
vmovdqa xmm0, xmmword [rbp + 0x260]
vxorps xmm0, xmm0, xmmword [rbp + 0x220]
vmovdqa xmmword [rbp + 0x260], xmm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x200], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x210], xmm1
lea rax, [rbp + 0x240]
mov rbx, 0xffffffffffffffff
mov r8, rbx
vzeroupper
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140007890
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x200]
call fcn.1400139c0
nop
movabs rax, 0xac54c58d00893bb2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x7a4b6cdfd46bcbe7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x458bf3fae9c0c5c7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xf8da901eb1008e1b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0x24fac14e52bf1cb6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x67db98ef5ff9ee4f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xed0d11c78c150c2a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x670467f2046adb7e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rdx, 0x69b29ce76aa57579
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rcx, 0x1ab8a11e7936248e
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x268], rax
movabs rax, 0x826e74b5a17b694f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x270], rax
movabs rax, 0x27c02dc760fbf0c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x278], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x240]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x260]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqa xmm0, xmmword [rbp + 0x80]
vxorps xmm0, xmm0, xmmword [rbp + 0x280]
vmovdqa xmmword [rbp + 0x80], xmm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x1d0], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x1e0], xmm1
lea rax, [rbp + 0x40]
vzeroupper
inc rbx
cmp byte [rax + rbx], 0
jne 0x140007a95
mov r8, rbx
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x1d0]
call fcn.1400139c0
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140007b67
mov dword [rbp + 0xa0], 0x130
lea rdx, [rbp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140007b5e
nop dword [rax]
lea rax, [rbp + 0xcc]
lea r8, [rbp + 0x20]
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140007b13
inc rax
test ecx, ecx
jne 0x140007b00
test edx, edx
jne 0x140007b31
mov r8d, dword [rbp + 0xa8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140007b47
lea rdx, [rbp + 0xa0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140007af0
jmp 0x140007b5e
mov edx, 9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400c8fc0
mov rbx, rax
test rax, rax
je 0x140007c5a
movabs rax, 0xde33aaff50d56386
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x10], rcx
mov qword [rbp], rsi
mov rcx, qword [rbp]
mov qword [rbp + 0x18], rcx
mov qword [rbp], r12
mov rcx, qword [rbp]
mov qword [rbp + 0x2a0], rcx
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x2a8], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x2a0]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0xf
cmova rcx, qword [rbp + 0x1d0]
lea rdx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
mov rcx, rbx
test rax, rax
jne 0x140007bfc
call fcn.1400c8f90
jmp 0x140007c5a
lea r8, [rbp + 0x200]
cmp qword [rbp + 0x218], 0xf
cmova r8, qword [rbp + 0x200]
mov edx, 0x2712
call fcn.1400cbf60
lea r8, [0x140007620]
mov edx, 0x4e2b
mov rcx, rbx
call fcn.1400cbf60
mov r8, rdi
mov edx, 0x2711
mov rcx, rbx
call fcn.1400cbf60
mov rcx, rbx
call fcn.1400c9030
mov rcx, rbx
call fcn.1400c8f90
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x140007c9e
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007c99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007c99
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14013fd60
movdqa xmm0, xmmword [0x14019e2b0]
movdqu xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x140007cf9
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007cf4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007cf4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14013fd60
xor eax, eax
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.14013fd40
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret