Function at 0x180015300
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push r12
push r15
lea rbp, [rsp - 0xf8]
sub rsp, 0x1f8
mov rax, qword [0x1800680c0]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov r12, r8
mov r15, rdx
mov rbx, rcx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180015337
test rax, rax
je 0x1800157ec
mov qword [rsp + 0x1f0], rdi
xorps xmm0, xmm0
xorps xmm1, xmm1
mov qword [rsp + 0x1e8], r13
xor r13d, r13d
mov r8, 0xffffffffffffffff
movups xmmword [rsp + 0x58], xmm0
movdqu xmmword [rsp + 0x68], xmm1
inc r8
cmp byte [rdx + r8], r13b
jne 0x180015374
lea rcx, [rsp + 0x58]
call fcn.180004610
lea rdx, str.__:25_0_5_2_0_4__0_9__01___0_9__0_9___.__:25_0_5_2_0_4__0_9__01___0_9__0_9___.__:25_0_5_2_0_4__0_9__01___0_9__0_9___.__:25_0_5_2_0_4__0_9__01___0_9__0_9____
lea rcx, [rsp + 0x30]
call fcn.1800074d0
cmp qword [rsp + 0x70], 0xf
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x58]
cmova r8, qword [rsp + 0x58]
lea r9, [rsp + 0x30]
cmova rcx, qword [rsp + 0x58]
add rdx, r8
mov dword [rsp + 0x20], 0x10
call fcn.1800083c0
lea rcx, [rsp + 0x30]
movzx edi, al
call fcn.180007770
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800153fd
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x1800153fd
mov rax, qword [rax]
mov edx, 1
call qword [rax]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x18001543a
mov rcx, qword [rsp + 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015435
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001580f
call fcn.18002368c
mov qword [rsp + 0x238], rsi
mov qword [rsp + 0x1e0], r14
test dil, dil
je 0x1800157c9
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x58], xmm0
mov r8, 0xffffffffffffffff
movdqu xmmword [rsp + 0x68], xmm1
nop dword [rax + rax]
inc r8
cmp byte [r12 + r8], r13b
jne 0x180015470
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.180004610
lea rdx, str.___0_9A_Fa_f_1_4:_7_0_9A_Fa_f_1_4__0_9A_Fa_f_1_4:_1_7:__0_9A_Fa_f_1_4:_1_6:_0_9A_Fa_f_1_4__0_9A_Fa_f_1_4:_1_5_:_0_9A_Fa_f_1_4_1_2__0_9A_Fa_f_1_4:_1_4_:_0_9A_Fa_f_1_4_1_3__0_9A_Fa_f_1_4:_1_3_:_0_9A_Fa_f_1_4_1_4__0_9A_Fa_f_1_4:_1_2_:_0_9A_Fa_f_1_4_1_5_0_9A_Fa_f_1_4::__0_9A_Fa_f_1_4:_1_6:__:_0_9A_Fa_f_1_4_1_7:_::__
lea rcx, [rsp + 0x30]
call fcn.1800074d0
cmp qword [rsp + 0x70], 0xf
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x58]
cmova r8, qword [rsp + 0x58]
lea r9, [rsp + 0x30]
cmova rcx, qword [rsp + 0x58]
add rdx, r8
mov dword [rsp + 0x20], 0x10
call fcn.1800083c0
lea rcx, [rsp + 0x30]
movzx edi, al
call fcn.180007770
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800154fc
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x1800154fc
mov rax, qword [rax]
mov edx, 1
call qword [rax]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x180015539
mov rcx, qword [rsp + 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015534
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015815
call fcn.18002368c
test dil, dil
jne 0x180015556
lea r8, [0x1800595a3]
mov edx, 0x80
lea rcx, [0x18006b5d0]
call fcn.180030008
xor edx, edx
mov ecx, 0x40000002
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1800157c9
xor edx, edx
mov dword [rbp - 0x60], 0x130
mov r8d, 0x12c
lea rcx, [rbp - 0x5c]
call fcn.18004c430
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x80], xmm0
mov r8, 0xffffffffffffffff
movdqu xmmword [rbp - 0x70], xmm1
nop
inc r8
cmp byte [rbx + r8], r13b
jne 0x1800155a0
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.180004610
movdqa xmm1, xmmword [0x18005e2d0]
lea r8, [rsp + 0x30]
xorps xmm0, xmm0
lea rdx, [rbp - 0x80]
movups xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x58]
mov word [rsp + 0x30], 0x2c
movdqu xmmword [rsp + 0x40], xmm1
call fcn.1800067a0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x180015620
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001561b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001581b
call fcn.18002368c
lea rdx, [rbp - 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x180015775
mov rbx, qword [rsp + 0x58]
movabs r8, 0x7ffffffffffffff
mov rsi, qword [rsp + 0x60]
cmp rbx, rsi
je 0x180015763
lea rax, [rbp - 0x34]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x180015660
nop dword [rax]
cmp qword [rbx + 0x18], 0xf
mov rcx, rbx
jbe 0x18001567d
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x10]
cmp r8, rdi
jne 0x180015693
lea rdx, [rbp - 0x34]
call fcn.18004c290
test eax, eax
je 0x18001569c
add rbx, 0x20
cmp rbx, rsi
jne 0x180015670
movabs r8, 0x7ffffffffffffff
cmp rbx, rsi
je 0x180015763
mov rdi, qword [0x18006ba10]
xor edx, edx
mov ebx, dword [rbp - 0x58]
mov r13d, 1
mov dword [rbp - 0x78], edx
mov rcx, rdi
mov rax, qword [rdi + 8]
mov qword [rbp - 0x80], rax
cmp byte [rax + 0x19], dl
jne 0x1800156f5
mov qword [rbp - 0x80], rax
cmp dword [rax + 0x1c], ebx
jge 0x1800156e6
mov rax, qword [rax + 0x10]
mov dword [rbp - 0x78], edx
jmp 0x1800156f0
mov rcx, rax
mov dword [rbp - 0x78], r13d
mov rax, qword [rax]
cmp byte [rax + 0x19], dl
je 0x1800156d4
cmp byte [rcx + 0x19], dl
jne 0x1800156ff
cmp ebx, dword [rcx + 0x1c]
jge 0x180015748
cmp qword [0x18006ba18], r8
je 0x180015821
mov ecx, 0x20
call fcn.180023694
movups xmm0, xmmword [rbp - 0x80]
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [0x18006ba10]
mov dword [rax + 0x1c], ebx
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov word [rax + 0x18], 0
movaps xmmword [rbp - 0x80], xmm0
call fcn.180019af0
mov ebx, dword [rbp - 0x58]
mov ecx, ebx
call fcn.180005bd0
mov r8d, dword [rbp - 0x58]
mov r9, r15
mov edx, r13d
mov qword [rsp + 0x20], r12
call fcn.180014900
lea rdx, [rbp - 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x18001562d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800157c9
mov rdx, qword [rsp + 0x60]
call fcn.180007e00
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rax, rcx
sub rdx, rcx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x1800157c4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015809
call fcn.18002368c
mov rsi, qword [rsp + 0x238]
mov eax, r13d
mov r13, qword [rsp + 0x1e8]
mov r14, qword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x1f0]
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.180023640
add rsp, 0x1f8
pop r15
pop r12
pop rbx
pop rbp
ret
call fcn.1800299a4
int3
call fcn.1800299a4
int3
call fcn.1800299a4
int3
call fcn.1800299a4
int3
call fcn.180019da0
int3