Function at 0x1400b39d0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub rsp, 0x168
mov rax, qword [0x14063b600]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rdx, [0x140b08458]
lea rcx, [rsp + 0xd0]
call fcn.14006b7c0
nop
lea rdx, [0x1404a60b8]
lea rcx, [rsp + 0x80]
call fcn.1400b3d10
mov r8, rax
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xb0]
call fcn.1400b3d40
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1400b3970
mov byte [rsp + 0x31], al
lea rcx, [rsp + 0xb0]
call fcn.14006b6e0
movzx eax, byte [rsp + 0x31]
test eax, eax
je 0x1400b3ce8
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [0x140ad4e78], rax
mov dword [0x140ad4c40], 0x238
lea rdx, [0x140ad4c40]
mov rcx, qword [0x140ad4e78]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov byte [rsp + 0x30], 0
mov dword [0x140ad4c3c], 1
cmp dword [0x140ad4c3c], 0
je 0x1400b3c90
lea rdx, [0x140ad4c40]
mov rcx, qword [0x140ad4e78]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [0x140ad4c3c], eax
lea rcx, [rsp + 0xd0]
call fcn.14006b350
inc eax
mov dword [rsp + 0x38], eax
lea rcx, [rsp + 0xd0]
call fcn.14006b650
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x38]
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x34], eax
movsxd rax, dword [rsp + 0x34]
mov qword [rsp + 0x68], rax
mov eax, 2
mov rcx, qword [rsp + 0x68]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1403a859c
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0xd0]
call fcn.14006b650
mov ecx, dword [rsp + 0x34]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0x38]
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x110]
call fcn.14006b4d0
nop
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.1403a7fac
cmp qword [rsp + 0x48], 0
jne 0x1400b3bb4
mov qword [rsp + 0x78], 0
jmp 0x1400b3bc7
mov qword [rsp + 0x40], 0x8123
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x110]
call fcn.14006b360
mov rdx, rax
lea rcx, [0x140ad4c6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400b3c7e
mov byte [rsp + 0x30], 1
mov r8d, dword [0x140ad4c48]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x50], rax
mov edx, 1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1404a60f0]
lea rcx, [rsp + 0x90]
call fcn.1400b3d10
mov r8, rax
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xf0]
call fcn.1400b3d40
lea rcx, [rsp + 0xf0]
call fcn.14006b650
mov rcx, rax
call fcn.1403c257c
mov dword [0x140ad4c3c], 0
lea rcx, [rsp + 0xf0]
call fcn.14006b6e0
nop
lea rcx, [rsp + 0x110]
call fcn.14006b440
jmp 0x1400b3aa2
movzx eax, byte [rsp + 0x30]
test eax, eax
jne 0x1400b3ce8
lea rdx, [0x1404a60d8]
lea rcx, [rsp + 0xa0]
call fcn.1400b3d10
mov r8, rax
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x130]
call fcn.1400b3d40
lea rcx, [rsp + 0x130]
call fcn.14006b650
mov rcx, rax
call fcn.1403c257c
lea rcx, [rsp + 0x130]
call fcn.14006b6e0
nop
lea rcx, [rsp + 0xd0]
call fcn.14006b6e0
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1403a7f50
add rsp, 0x168
ret