Function at 0x180008e60
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x18004b058]
xor rax, rsp
mov qword [rbp + 0x250], rax
xor esi, esi
xor r15b, r15b
mov qword [rbp + 0x230], rsi
mov qword [rbp + 0x240], rsi
mov qword [rbp + 0x248], 0xf
mov byte [rbp + 0x230], sil
lea r8d, [rsi + 0xc]
lea rdx, str.MpDlpCmd.exe
lea rcx, [rbp + 0x230]
call fcn.18000d3c0
nop
mov dword [rbp - 0x50], 0x238
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov r12, qword [rbp + 0x230]
cmp eax, 1
jne 0x180009302
lea rdx, [rbp - 0x50]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x180009302
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r14d, [rsi + 1]
nop dword [rax]
mov qword [rbp + 0x210], rsi
mov qword [rbp + 0x220], rsi
mov qword [rbp + 0x228], 7
mov word [rbp + 0x210], si
lea rax, [rbp - 0x24]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180008f60
lea rcx, [rbp + 0x210]
cmp rdx, 7
ja 0x180008f98
mov qword [rbp + 0x220], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rbp - 0x24]
call fcn.180013540
mov word [rbp + rbx + 0x210], si
jmp 0x180008fa5
lea r9, [rbp - 0x24]
xor r8d, r8d
call fcn.18000e870
nop
lea rdx, [rbp + 0x210]
cmp qword [rbp + 0x228], 8
setae r8b
cmovae rdx, qword [rbp + 0x210]
mov rax, qword [rbp + 0x220]
lea rdi, [rdx + rax*2]
lea rbx, [rbp + 0x210]
test r8b, r8b
cmovne rbx, qword [rbp + 0x210]
mov qword [rbp + 0x1f0], rsi
mov qword [rbp + 0x200], rsi
mov qword [rbp + 0x208], 0xf
mov byte [rbp + 0x1f0], 0
mov rdx, rdi
sub rdx, rbx
sar rdx, 1
lea rcx, [rbp + 0x1f0]
call fcn.18000ca60
nop
cmp rbx, rdi
je 0x18000907b
nop dword [rax + rax]
movzx r9d, byte [rbx]
mov rcx, qword [rbp + 0x200]
mov rdx, qword [rbp + 0x208]
cmp rcx, rdx
jae 0x180009060
lea rax, [rcx + 1]
mov qword [rbp + 0x200], rax
lea rax, [rbp + 0x1f0]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x1f0]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180009072
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp + 0x1f0]
call fcn.18000eb90
add rbx, 2
cmp rbx, rdi
jne 0x180009020
lea r8, [rbp + 0x1f0]
mov r9, qword [rbp + 0x1f0]
mov r10, qword [rbp + 0x208]
cmp r10, 0x10
cmovae r8, r9
lea rax, [rbp + 0x230]
cmp qword [rbp + 0x248], 0x10
cmovae rax, r12
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800090c3
inc rax
test ecx, ecx
jne 0x1800090b0
test edx, edx
jne 0x180009256
lea rcx, [rbp - 0x78]
call fcn.180004b10
nop
mov r8d, 6
lea rdx, str.en_EN
mov rcx, rax
call fcn.18000d520
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov edx, dword [rbp - 0x48]
lea rcx, [rsp + 0x28]
call fcn.1800072e0
lea rdx, [rsp + 0x68]
movups xmm0, xmmword [rsp + 0x48]
psrldq xmm0, 8
movq rsi, xmm0
cmp rsi, 0x10
setae r14b
mov rbx, qword [rsp + 0x58]
cmovae rdx, rbx
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x180009154
mov rax, qword [rax]
cmp r8, qword [rsp + 0x78]
jne 0x18000916c
mov rcx, rax
call fcn.180014010
test eax, eax
jne 0x18000916c
mov dil, 1
jmp 0x18000916f
xor dil, dil
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800091ac
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800091a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000937d
call fcn.1800115b0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], 0
test r14b, r14b
je 0x1800091fa
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800091f1
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009383
mov rcx, rbx
call fcn.1800115b0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x180009235
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009230
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009389
call fcn.1800115b0
movzx r15d, r15b
test dil, dil
mov r14d, 1
cmovne r15d, r14d
mov r10, qword [rbp + 0x208]
mov r9, qword [rbp + 0x1f0]
xor esi, esi
cmp r10, 0x10
jb 0x18000928d
lea rdx, [r10 + 1]
mov rax, r9
cmp rdx, 0x1000
jb 0x180009285
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000938f
mov rcx, r9
call fcn.1800115b0
mov qword [rbp + 0x200], rsi
mov qword [rbp + 0x208], 0xf
mov byte [rbp + 0x1f0], 0
mov rdx, qword [rbp + 0x228]
cmp rdx, 8
jb 0x1800092ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800092e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009371
call fcn.1800115b0
lea rdx, [rbp - 0x50]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x180008f30
mov rax, qword [rbp + 0x248]
cmp rax, 0x10
jb 0x18000933d
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x180009335
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009377
mov rcx, r12
call fcn.1800115b0
movzx eax, r15b
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.180011590
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
int3