Function at 0x1400d0b80
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r12, r8
mov r14, rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], r8
xor al, al
mov byte [rsp + 0x20], al
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x1400d0c03
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400d0c40
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, r14
call fcn.140024c50
nop
mov rcx, r12
call fcn.140024c50
xor al, al
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14036fcc0
mov rbx, qword [rsp + 0x310]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r15d, r15d
mov r8d, 0xa
movabs rdx, 0x7fffffffffffffff
movabs rcx, 0x7ffffffffffffffe
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x1b8], 7
mov word [rbp + 0x1a0], r15w
lea rax, [rsp + 0x6c]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400d0c83
cmp rbx, 7
ja 0x1400d0cc3
mov qword [rbp + 0x1b0], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x6c]
lea rcx, [rbp + 0x1a0]
call fcn.14038e7d0
mov word [rbp + rbx + 0x1a0], r15w
mov rsi, qword [rbp + 0x1a0]
jmp 0x1400d0d2d
cmp rbx, rcx
ja 0x1400d1058
mov rdi, rbx
or rdi, 7
cmp rdi, rcx
jbe 0x1400d0ce0
mov rdi, rcx
mov rcx, rdx
jmp 0x1400d0cf5
cmp rdi, 0xa
cmovb rdi, r8
lea rcx, [rdi + 1]
cmp rcx, rdx
ja 0x1400d1052
add rcx, rcx
call fcn.140004a40
mov rsi, rax
mov qword [rbp + 0x1b0], rbx
mov qword [rbp + 0x1b8], rdi
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x6c]
mov rcx, rax
call fcn.14038e7d0
mov word [rbx + rsi], r15w
mov qword [rbp + 0x1a0], rsi
lea rcx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rcx, rsi
mov rax, qword [rbp + 0x1b0]
lea rdi, [rcx + rax*2]
lea rbx, [rbp + 0x1a0]
cmovae rbx, rsi
mov qword [rbp + 0x190], r15
mov qword [rbp + 0x198], 0xf
mov byte [rbp + 0x180], 0
mov rdx, rdi
sub rdx, rbx
sar rdx, 1
lea rcx, [rbp + 0x180]
call fcn.140042000
mov r8, rdi
mov rdx, rbx
lea rcx, [rbp + 0x180]
call fcn.140042180
mov rdi, qword [r14]
mov rbx, qword [r14 + 8]
mov r14, qword [rbp + 0x198]
mov r15, qword [rbp + 0x190]
mov rsi, qword [rbp + 0x180]
cmp rdi, rbx
je 0x1400d0e10
nop word [rax + rax]
lea rdx, [rbp + 0x180]
cmp r14, 0x10
cmovae rdx, rsi
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400d0ddc
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, r15
jne 0x1400d0dee
call fcn.14038e6d0
test eax, eax
je 0x1400d0df7
add rdi, 0x20
cmp rdi, rbx
jne 0x1400d0dc0
cmp rdi, rbx
je 0x1400d0e10
mov byte [rsp + 0x20], 1
mov rax, qword [r12 + 8]
cmp qword [r12], rax
je 0x1400d0f52
mov rdi, qword [r12]
mov rbx, qword [r12 + 8]
cmp rdi, rbx
je 0x1400d0e99
nop
lea rdx, [rbp + 0x180]
cmp r14, 0x10
cmovae rdx, rsi
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400d0e3c
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, r15
jne 0x1400d0e4e
call fcn.14038e6d0
test eax, eax
je 0x1400d0e57
add rdi, 0x20
cmp rdi, rbx
jne 0x1400d0e20
cmp rdi, rbx
je 0x1400d0e99
mov r8d, dword [rsp + 0x48]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400d0e8b
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rbp + 0x180]
mov r14, qword [rbp + 0x198]
cmp r14, 0x10
jb 0x1400d0ed0
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400d0ec8
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d105e
mov rcx, rsi
call fcn.14036fd20
xor r15d, r15d
mov qword [rbp + 0x190], r15
mov qword [rbp + 0x198], 0xf
mov byte [rbp + 0x180], r15b
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 8
jb 0x1400d0f32
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d0f2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d1064
call fcn.14036fd20
lea rdx, [rsp + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400d102b
mov r14, qword [rsp + 0x28]
jmp 0x1400d0c43
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x198]
cmp rdx, 0x10
jb 0x1400d0f9c
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d0f97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d105e
call fcn.14036fd20
xor ebx, ebx
mov qword [rbp + 0x190], rbx
mov qword [rbp + 0x198], 0xf
mov byte [rbp + 0x180], bl
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 8
jb 0x1400d0ff8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d0ff3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d1064
call fcn.14036fd20
mov qword [rbp + 0x1b0], rbx
mov qword [rbp + 0x1b8], 7
mov word [rbp + 0x1a0], bx
mov rcx, qword [rsp + 0x28]
call fcn.140024c50
nop
mov rcx, r12
call fcn.140024c50
mov al, 1
jmp 0x1400d0c16
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0x28]
call fcn.140024c50
nop
mov rcx, r12
call fcn.140024c50
movzx eax, byte [rsp + 0x20]
jmp 0x1400d0c16
call fcn.140004800
int3
call fcn.140008ce0
nop
call fcn.1403933ec
nop
call fcn.1403933ec
int3