Function at 0x18000f5a0
Capabilities:
Check os version
Enumerate processes

Disassembly:
push rsi
push r12
push r13
push r14
sub rsp, 0x328
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov r13d, r8d
mov r12, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x201]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x200], 0
mov r14d, eax
call fcn.1800f4fb0
lea rcx, [rsp + 0x160]
mov dword [rsp + 0x160], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x18000f840
lea rdx, [0x180259350]
mov qword [rsp + 0x360], rbp
mov rcx, r12
sub rdx, r12
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x18000f630
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x130
mov rcx, rax
mov rbp, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x18000f838
lea rdx, [rsp + 0x30]
mov rcx, rbp
mov dword [rsp + 0x30], 0x130
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x18000f82f
mov qword [rsp + 0x350], rbx
mov qword [rsp + 0x320], rdi
nop word [rax + rax]
mov edi, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18000f802
cmp edi, 0xa
jb 0x18000f7f9
cmp r14d, edi
je 0x18000f7f9
lea rcx, [rsp + 0x200]
xor edx, edx
mov r8d, 0x104
call fcn.1800f4fb0
lea r8, [rsp + 0x200]
mov rdx, rbx
mov rcx, rsi
call fcn.18000f170
lea rdx, [rsp + 0x200]
lea rcx, str._DGCLIENT.EXE_DGCORESERVICE.EXE_DGINJECTSERVICE64.EXE_DGLOCALLOGSERVICE.EXE_DGLOCALUPDATESERVICE.EXE_HTLOCALUPDATESERVICE.EXE_HTLUPDATESECSERVICE.EXE_LOCALSECSERVICE.EXE_
call fcn.1800f4d08
test rax, rax
je 0x18000f721
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000f802
lea rdx, str.prthook64.dll
lea rcx, str.PRThook.dll
call fcn.18010b680
test eax, eax
jne 0x18000f758
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.18000dd20
test eax, eax
jne 0x18000f758
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000f802
cmp r13d, 2
jne 0x18000f79d
lea rcx, [rsp + 0x200]
xor edx, edx
mov r8d, 0x104
call fcn.1800f4fb0
lea r8, [rsp + 0x200]
mov rdx, rbx
mov rcx, rsi
call fcn.18000f170
mov r9, r12
xor r8d, r8d
mov edx, edi
mov rcx, rsi
mov dword [rsp + 0x20], r13d
call fcn.18000e580
jmp 0x18000f7e3
lea rcx, [rsp + 0x200]
xor edx, edx
mov r8d, 0x104
call fcn.1800f4fb0
lea r8, [rsp + 0x200]
mov rdx, rbx
mov rcx, rsi
call fcn.18000f170
test eax, eax
jne 0x18000f7e3
lea r8, [rsp + 0x200]
mov r9, r12
mov edx, edi
mov rcx, rsi
mov dword [rsp + 0x20], r13d
call fcn.18000e580
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18000f802
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x30]
mov rcx, rbp
mov dword [rsp + 0x30], 0x130
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x18000f6a0
mov rdi, qword [rsp + 0x320]
mov rbx, qword [rsp + 0x350]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x360]
xor eax, eax
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x328
pop r14
pop r13
pop r12
pop rsi
ret