Function at 0x18001a6a0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x2f0], rbx
mov rax, qword [0x180050b58]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rsi, r8
mov r13, rdx
mov qword [rsp + 0x28], rdx
xor r14b, r14b
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r15, rax
xor ebx, ebx
test rax, rax
je 0x18001a8ee
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18001a8e4
or r12, 0xffffffffffffffff
nop word [rax + rax]
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
xor eax, eax
mov rcx, r12
lea rdi, [rbp - 0x74]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x74]
lea rcx, [rsp + 0x30]
call fcn.180007510
nop
lea r12, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
cmp rcx, 8
cmovae r12, rdx
lea rax, [rsp + 0x30]
cmovae rax, rdx
mov r8, qword [rsp + 0x40]
lea rdi, [rax + r8*2]
lea rbx, [rsp + 0x30]
cmovae rbx, rdx
cmp rbx, rdi
je 0x18001a7bc
sub r12, rbx
nop
movzx ecx, word [rbx]
call qword [sym.imp.MSVCR100.dll_tolower]
mov word [r12 + rbx], ax
add rbx, 2
cmp rbx, rdi
jne 0x18001a7a0
mov r8, qword [rsp + 0x40]
mov r9, qword [r13 + 0x10]
cmp qword [r13 + 0x18], 8
jb 0x18001a7cd
mov rdx, qword [r13]
jmp 0x18001a7d0
mov rdx, r13
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
mov rdi, r9
cmp r8, r9
cmovb rdi, r8
test rdi, rdi
je 0x18001a81e
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18001a807
add rcx, 2
add rdx, 2
dec rdi
jne 0x18001a7f0
jmp 0x18001a81e
mov edi, 1
cmp word [rcx], ax
mov r12, 0xffffffffffffffff
cmovb edi, r12d
xor ebx, ebx
jmp 0x18001a826
xor ebx, ebx
mov edi, ebx
or r12, 0xffffffffffffffff
movsxd rax, edi
test edi, edi
jne 0x18001a83f
cmp r8, r9
jae 0x18001a837
mov eax, r12d
jmp 0x18001a83f
mov eax, ebx
cmp r8, r9
setne al
test eax, eax
sete al
test al, al
je 0x18001a8bd
mov rax, qword [rsi + 8]
lea rcx, [rsp + 0x68]
cmp rcx, rax
jae 0x18001a893
mov rcx, qword [rsi]
lea rdx, [rsp + 0x68]
cmp rcx, rdx
ja 0x18001a893
lea rdi, [rsp + 0x68]
sub rdi, rcx
sar rdi, 2
cmp rax, qword [rsi + 0x10]
jne 0x18001a882
mov edx, 1
mov rcx, rsi
call fcn.18001a4b0
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x18001a8b5
mov eax, dword [rax + rdi*4]
jmp 0x18001a8b3
cmp rax, qword [rsi + 0x10]
jne 0x18001a8a6
mov edx, 1
mov rcx, rsi
call fcn.18001a4b0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x18001a8b5
mov eax, dword [rsp + 0x68]
mov dword [rcx], eax
add qword [rsi + 8], 4
mov r14b, 1
cmp qword [rsp + 0x48], 8
jb 0x18001a8cf
mov rcx, qword [rsp + 0x30]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
lea rdx, [rsp + 0x60]
mov rcx, r15
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x18001a730
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [r13 + 0x18], 8
jb 0x18001a8fe
mov rcx, qword [r13]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [r13 + 0x18], 7
mov qword [r13 + 0x10], rbx
mov word [r13], bx
movzx eax, r14b
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.18002f870
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret