Function at 0x140001560
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2b8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x220], xmm6
mov qword [rbp + 0x218], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x58]
mov r8d, 0x238
xor edx, edx
call fcn.140115f90
mov dword [rbp - 0x58], 0x238
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x1ec], eax
cmp rdi, 0xffffffffffffffff
je 0x14000185b
lea rdx, [rbp - 0x58]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140001837
lea r12, [rbp - 0x2c]
xorps xmm6, xmm6
movabs r15, 0x7fffffffffffffff
lea r14, [rbp - 0x58]
mov qword [rbp + 0x1e0], rsi
jmp 0x140001625
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055204
mov rcx, rdi
mov rdx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x140001837
movaps xmmword [rbp + 0x200], xmm6
movaps xmmword [rbp + 0x1f0], xmm6
mov rcx, r12
call fcn.1400e6a74
cmp rax, r15
jae 0x140001892
mov r13, rax
cmp rax, 7
ja 0x140001690
mov qword [rbp + 0x200], r13
mov qword [rbp + 0x208], 7
lea r8, [r13*2]
lea rcx, [rbp + 0x1f0]
mov rdx, r12
call fcn.1401158f0
lea rax, [r13*2 + 0x1f0]
add rax, rbp
jmp 0x14000172f
mov rsi, rdi
mov rdi, r12
mov r14, r15
mov r12, r13
or r12, 7
mov rcx, 0xfffffffffffffffe
movabs rax, 0x7ffffffffffffffe
mov r15, rax
cmp r12, rax
ja 0x1400016da
cmp r12, 0xb
mov eax, 0xa
cmovb r12, rax
lea rcx, [r12*2 + 2]
cmp r12, 0x7ff
jb 0x1400016e7
mov r15, r12
call fcn.1400075a0
mov rbx, rax
mov r12, r15
jmp 0x1400016ef
call fcn.1400551c0
mov rbx, rax
mov qword [rbp + 0x1f0], rbx
mov qword [rbp + 0x200], r13
mov qword [rbp + 0x208], r12
lea r8, [r13*2]
mov rcx, rbx
mov r12, rdi
mov rdx, rdi
call fcn.1401158f0
lea rax, [rbx + r13*2]
mov r15, r14
mov rdi, rsi
mov rsi, qword [rbp + 0x1e0]
lea r14, [rbp - 0x58]
mov word [rax], 0
mov rax, qword [rsi + 0x10]
cmp qword [rbp + 0x200], rax
jne 0x1400017f0
test rax, rax
je 0x140001794
cmp qword [rsi + 0x18], 8
mov rcx, rsi
jb 0x140001757
mov rcx, qword [rsi]
cmp qword [rbp + 0x208], 8
lea rdx, [rbp + 0x1f0]
jb 0x14000176f
mov rdx, qword [rbp + 0x1f0]
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, word [rdx + r8*2]
cmp r9w, word [rcx + r8*2]
jne 0x1400017f0
inc r8
cmp rax, r8
jne 0x140001780
mov r9d, dword [rbp - 0x50]
cmp dword [rbp + 0x1ec], r9d
je 0x1400017f0
lea rcx, [rbp + 0x217]
mov edx, 0xfdf5e6
lea r8, str.Should_Terminate:__d
call fcn.140055720
mov r8d, dword [rbp - 0x50]
mov ecx, 1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x1400017f0
mov rbx, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word cs:[rax + rax]
mov rax, qword [rbp + 0x208]
cmp rax, 8
jb 0x140001612
mov rcx, qword [rbp + 0x1f0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000160d
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jb 0x140001600
call fcn.1400d5e54
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movaps xmm6, xmmword [rbp + 0x220]
add rsp, 0x2b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [0x140164d90]
lea rdx, str.CreateToolhelp32Snapshot_failed
call fcn.140001cc0
mov rcx, rax
mov dl, 0xa
movaps xmm6, xmmword [rbp + 0x220]
add rsp, 0x2b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.1400018f0
call fcn.140007580
int3