Function at 0x2100612d0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push r15
mov eax, 0x10178
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.21021b550
sub rsp, rax
mov qword [rsp + 0x101c0], rcx
mov ecx, 2
lea rbp, [rsp + 0x40]
lea rbx, [rsp + 0x170]
mov dword [rsp + 0x101c8], edx
xor edx, edx
call sym.CreateToolhelp32Snapshot
mov rcx, qword [rsp + 0x101c0]
mov r12, rax
call sym.GetProcessId
mov esi, dword [rsp + 0x101c8]
mov dword [rsp + 0x170], eax
and esi, 0x7f
mov dword [rsp + 0x28], esi
mov esi, 1
nop dword [rax + rax]
xor eax, eax
mov ecx, 0x26
mov rdi, rbp
mov rdx, rbp
rep stosq qword [rdi], rax
mov rcx, r12
mov dword [rsp + 0x40], 0x130
call sym.Process32First
test eax, eax
je 0x2100613f1
mov r14d, esi
lea rdi, [rsp + 0x16c]
nop dword [rax + rax]
test r14d, r14d
jle 0x2100613c0
movsxd r13, r14d
mov r8d, dword [rsp + 0x48]
mov r9d, dword [rsp + 0x60]
lea rdx, [r13*4]
lea rcx, [rdi + rdx]
lea rax, [rbx + rdx]
lea edx, [r14 - 1]
shl rdx, 2
sub rcx, rdx
mov edx, dword [rax - 4]
cmp edx, r8d
je 0x2100613c0
cmp edx, r9d
je 0x210061420
sub rax, 4
cmp rcx, rax
jne 0x2100613a5
nop dword [rax + rax]
cmp r14d, 0x4000
je 0x210061480
mov rdx, rbp
mov rcx, r12
call sym.Process32Next
test eax, eax
jne 0x210061378
cmp r14d, esi
mov esi, r14d
je 0x2100613f1
cmp r14d, 0x3fff
jle 0x210061340
mov rcx, r12
call sym.CloseHandle
sub esi, 1
movsxd rbx, esi
jns 0x21006148d
xor r12d, r12d
mov eax, r12d
add rsp, 0x10178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, r8d
call sym.cygwin_winpid_to_pid_1
mov r15d, eax
test eax, eax
jns 0x210061450
mov eax, dword [rsp + 0x48]
lea edx, [r14 + 1]
mov dword [rsp + r13*4 + 0x170], eax
cmp r14d, 0x3fff
je 0x210061480
mov r14d, edx
jmp 0x2100613cd
mov ecx, eax
call sym.getpgid_1
cmp eax, r15d
jne 0x2100613c0
mov edx, dword [rsp + 0x28]
mov ecx, eax
call sym.kill_1
cmp r14d, 0x4000
jne 0x2100613cd
nop dword [rax + rax]
mov rcx, r12
mov ebx, 0x3fff
call sym.CloseHandle
mov rsi, qword [rsp + 0x101c0]
mov r14d, dword [rsp + 0x101c8]
xor r12d, r12d
lea rdi, str.ExitProcess
lea rbp, str.CtrlRoutine
jmp 0x2100614f3
test rsi, rsi
je 0x210061408
mov r15, rsi
xor r13d, r13d
lea rdx, [rsp + 0x3c]
mov rcx, r15
call sym.GetExitCodeProcess
test eax, eax
je 0x210061528
cmp dword [rsp + 0x3c], 0x103
je 0x210061528
test r13b, r13b
je 0x2100614e7
mov rcx, r15
call sym.CloseHandle
sub rbx, 1
test ebx, ebx
js 0x210061408
test ebx, ebx
je 0x2100614b0
mov r13d, dword [rsp + rbx*4 + 0x170]
xor edx, edx
mov ecx, 0x43a
mov r8d, r13d
call sym.OpenProcess
mov r15, rax
test rax, rax
je 0x2100615aa
cmp rsi, r15
setne r13b
jmp 0x2100614bf
mov rcx, r15
call sym.GetProcessId
mov r9d, eax
test r14b, 0x7c
jne 0x210061556
test r14b, 0x7e
jne 0x21006157a
mov edx, r14d
mov rcx, r15
call sym.TerminateProcess
test eax, eax
jne 0x2100614da
mov r12d, 0xffffffff
jmp 0x2100614da
cmp dword [rsp + 0x28], 0xf
jne 0x21006153f
mov r8d, r14d
mov rdx, rdi
mov rcx, r15
call sym.kill_via_console_helper_void__wchar_t__int__unsigned_int_
test eax, eax
je 0x21006153f
mov r12d, 0xffffffff
jmp 0x2100614da
cmp dword [rsp + 0x28], 2
mov rdx, rbp
mov rcx, r15
mov dword [rsp + 0x2c], eax
setne r8b
movzx r8d, r8b
call sym.kill_via_console_helper_void__wchar_t__int__unsigned_int_
mov r9d, dword [rsp + 0x2c]
test eax, eax
je 0x21006155d
mov r12d, 0xffffffff
jmp 0x2100614da
mov r8d, r13d
xor edx, edx
mov ecx, 0x1001
call sym.OpenProcess
mov r15, rax
test rax, rax
je 0x2100614e7
jmp 0x21006151a