Function at 0x140178e40
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [0x140189010]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x28], rax
xor edi, edi
cmp rax, 0xffffffffffffffff
je 0x140179170
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140179166
xorps xmm0, xmm0
movups xmmword [rsp + 0x280], xmm0
mov qword [rsp + 0x290], rdi
mov qword [rsp + 0x298], rdi
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140178ee0
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x280]
call fcn.14017f130
mov r11, qword [r12 + 0x10]
mov rbx, r12
cmp qword [r12 + 0x18], 8
jb 0x140178f11
mov rbx, qword [r12]
lea rdi, [rsp + 0x280]
mov r13, qword [rsp + 0x298]
cmp r13, 8
setae bpl
mov byte [rsp + 0x20], bpl
mov r14, qword [rsp + 0x280]
cmovae rdi, r14
mov rsi, qword [rsp + 0x290]
cmp r11, rsi
ja 0x140178ffd
mov rax, rsi
sub rax, r11
test r11, r11
je 0x1401790c4
lea rbp, [rdi + 2]
lea rbp, [rbp + rax*2]
mov rcx, rdi
movzx r10d, word [rbx]
nop word [rax + rax]
mov rax, rbp
sub rax, rcx
sar rax, 1
mov r8d, 0
mov edx, r8d
je 0x140178fa6
cmp word [rcx], r10w
je 0x140178fa3
nop word [rax + rax]
cmp rax, 1
je 0x140178fa6
dec rax
add rcx, 2
cmp word [rcx], r10w
jne 0x140178f90
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140179149
mov r8, r11
mov rdx, rbx
test r11, r11
je 0x140178fe8
mov r9, rcx
sub r9, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x140179140
add rdx, 2
sub r8, 1
jne 0x140178fd0
sub rcx, rdi
sar rcx, 1
movzx ebp, byte [rsp + 0x20]
cmp rcx, 0xffffffffffffffff
jne 0x1401790c4
xor r8d, r8d
mov r11, qword [r15 + 0x10]
mov rbx, r15
cmp qword [r15 + 0x18], 8
jb 0x140179011
mov rbx, qword [r15]
lea rdi, [rsp + 0x280]
test bpl, bpl
cmovne rdi, r14
cmp r11, rsi
ja 0x1401790f0
sub rsi, r11
test r11, r11
je 0x1401790c4
inc rsi
lea rsi, [rdi + rsi*2]
mov rax, rdi
movzx r10d, word [rbx]
nop dword [rax]
nop word [rax + rax]
mov rcx, rsi
sub rcx, rax
sar rcx, 1
mov rdx, r8
je 0x14017907a
cmp word [rax], r10w
je 0x140179077
cmp rcx, 1
je 0x14017907a
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x140179064
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1401790f0
mov r8, r11
mov rdx, rbx
test r11, r11
je 0x1401790b8
mov r9, rax
sub r9, rbx
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdx + r9]
cmp cx, word [rdx]
jne 0x140179153
add rdx, 2
sub r8, 1
jne 0x1401790a0
sub rax, rdi
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x1401790f0
mov r8d, dword [rsp + 0x48]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1401790f0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bpl, bpl
je 0x140179126
lea rdx, [r13*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14017911e
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017915f
mov rcx, r14
call fcn.1401813ec
lea rdx, [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
xor edi, edi
jmp 0x140178eae
add rcx, 2
jmp 0x140178f70
movzx ebp, byte [rsp + 0x20]
jmp 0x140179000
add rax, 2
xor r8d, r8d
jmp 0x140179050
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [r12 + 0x18]
cmp rdx, 8
jb 0x1401791b1
mov rcx, qword [r12]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1401791ac
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14017923a
mov rcx, r8
call fcn.1401813ec
mov qword [r12 + 0x10], rdi
mov qword [r12 + 0x18], 7
mov word [r12], di
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x1401791ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x1401791fa
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140179241
mov rcx, r8
call fcn.1401813ec
mov qword [r15 + 0x10], rdi
mov qword [r15 + 0x18], 7
mov word [r15], di
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140181140
mov rbx, qword [rsp + 0x300]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3