Function at 0x7ff6fba654b4
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x480
xor edx, edx
mov dword [rsp + 0x30], 0x238
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
or rsi, 0xffffffffffffffff
mov r12, rax
cmp rax, rsi
je 0x7ff6fba65716
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor r13d, r13d
test eax, eax
je 0x7ff6fba65716
lea rdx, [0x7ff6fba83d30]
mov edi, r13d
mov rbx, rdx
movsxd rax, edi
mov r14d, r13d
imul r15, rax, 0x208
mov rax, rsi
add r15, rdx
inc rax
cmp word [r15 + rax*2], r13w
jne 0x7ff6fba65536
test rax, rax
je 0x7ff6fba6557b
mov rsi, rbx
movzx ecx, word [rsi]
call fcn.7ff6fba67d54
inc r14d
mov word [rsi], ax
lea rsi, [rsi + 2]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r15 + rcx*2], r13w
jne 0x7ff6fba6555e
movsxd rax, r14d
cmp rax, rcx
jb 0x7ff6fba65548
or rsi, 0xffffffffffffffff
lea rdx, [0x7ff6fba83d30]
inc edi
lea rax, [0x7ff6fba89078]
add rbx, 0x208
cmp rbx, rax
jl 0x7ff6fba65523
lea rdx, [rsp + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x7ff6fba6570d
lea r14, [0x7ff6fba83d30]
mov edi, r13d
lea rcx, [rsp + 0x5c]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r13w
jne 0x7ff6fba655b8
test rax, rax
je 0x7ff6fba655f7
lea rbx, [rsp + 0x5c]
movzx ecx, word [rbx]
call fcn.7ff6fba6807c
mov word [rbx], ax
inc edi
lea rbx, [rbx + 2]
mov rcx, rsi
lea rax, [rsp + 0x5c]
inc rcx
cmp word [rax + rcx*2], r13w
jne 0x7ff6fba655e5
movsxd rax, edi
cmp rax, rcx
jb 0x7ff6fba655cc
mov edi, r13d
movsxd rax, edi
mov rcx, rsi
imul rbx, rax, 0x208
add rbx, r14
inc rcx
cmp word [rbx + rcx*2], r13w
jne 0x7ff6fba6560a
lea rdx, [rsp + 0x5c]
mov rax, rsi
inc rax
cmp word [rdx + rax*2], r13w
jne 0x7ff6fba6561c
cmp rax, rcx
jb 0x7ff6fba6565c
mov rdx, rbx
lea rcx, [rsp + 0x5c]
call fcn.7ff6fba66bb4
test rax, rax
jne 0x7ff6fba65669
lea rax, [rsp + 0x5c]
sub rbx, rax
movzx ecx, word [rax]
movzx edx, word [rax + rbx]
sub ecx, edx
jne 0x7ff6fba65658
add rax, 2
test edx, edx
jne 0x7ff6fba65645
test ecx, ecx
je 0x7ff6fba65669
inc edi
cmp edi, 0x28
jge 0x7ff6fba656f7
jmp 0x7ff6fba655fa
movsd xmm0, qword [str._IM]
lea rcx, [rbp + 0x170]
movzx eax, word [0x7ff6fba7e558]
sub rcx, 2
movsd qword [rbp + 0x170], xmm0
mov word [rbp + 0x178], ax
lea rcx, [rcx + 2]
cmp word [rcx], r13w
jne 0x7ff6fba65692
lea r8, [rsp + 0x5c]
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x7ff6fba656a3
lea rax, [rbp + 0x170]
sub rax, 2
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x7ff6fba656bf
movsd xmm0, qword [0x7ff6fba7e560]
lea r9, [rbp + 0x170]
mov dword [rsp + 0x28], r13d
lea r8, str.taskkill
xor edx, edx
movsd qword [rax], xmm0
xor ecx, ecx
mov qword [rsp + 0x20], r13
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [rsp + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x7ff6fba655ad
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x480]
mov eax, 1
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret