Function at 0x140178010
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [0x1401e1010]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x28], rax
xor edi, edi
cmp rax, 0xffffffffffffffff
je 0x140178340
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140178336
xorps xmm0, xmm0
movups xmmword [rsp + 0x280], xmm0
mov qword [rsp + 0x290], rdi
mov qword [rsp + 0x298], rdi
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1401780b0
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x280]
call fcn.14017e300
mov r11, qword [r12 + 0x10]
mov rbx, r12
cmp qword [r12 + 0x18], 8
jb 0x1401780e1
mov rbx, qword [r12]
lea rdi, [rsp + 0x280]
mov r13, qword [rsp + 0x298]
cmp r13, 8
setae bpl
mov byte [rsp + 0x20], bpl
mov r14, qword [rsp + 0x280]
cmovae rdi, r14
mov rsi, qword [rsp + 0x290]
cmp r11, rsi
ja 0x1401781cd
mov rax, rsi
sub rax, r11
test r11, r11
je 0x140178294
lea rbp, [rdi + 2]
lea rbp, [rbp + rax*2]
mov rcx, rdi
movzx r10d, word [rbx]
nop word [rax + rax]
mov rax, rbp
sub rax, rcx
sar rax, 1
mov r8d, 0
mov edx, r8d
je 0x140178176
cmp word [rcx], r10w
je 0x140178173
nop word [rax + rax]
cmp rax, 1
je 0x140178176
dec rax
add rcx, 2
cmp word [rcx], r10w
jne 0x140178160
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140178319
mov r8, r11
mov rdx, rbx
test r11, r11
je 0x1401781b8
mov r9, rcx
sub r9, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x140178310
add rdx, 2
sub r8, 1
jne 0x1401781a0
sub rcx, rdi
sar rcx, 1
movzx ebp, byte [rsp + 0x20]
cmp rcx, 0xffffffffffffffff
jne 0x140178294
xor r8d, r8d
mov r11, qword [r15 + 0x10]
mov rbx, r15
cmp qword [r15 + 0x18], 8
jb 0x1401781e1
mov rbx, qword [r15]
lea rdi, [rsp + 0x280]
test bpl, bpl
cmovne rdi, r14
cmp r11, rsi
ja 0x1401782c0
sub rsi, r11
test r11, r11
je 0x140178294
inc rsi
lea rsi, [rdi + rsi*2]
mov rax, rdi
movzx r10d, word [rbx]
nop dword [rax]
nop word [rax + rax]
mov rcx, rsi
sub rcx, rax
sar rcx, 1
mov rdx, r8
je 0x14017824a
cmp word [rax], r10w
je 0x140178247
cmp rcx, 1
je 0x14017824a
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x140178234
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1401782c0
mov r8, r11
mov rdx, rbx
test r11, r11
je 0x140178288
mov r9, rax
sub r9, rbx
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdx + r9]
cmp cx, word [rdx]
jne 0x140178323
add rdx, 2
sub r8, 1
jne 0x140178270
sub rax, rdi
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x1401782c0
mov r8d, dword [rsp + 0x48]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1401782c0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bpl, bpl
je 0x1401782f6
lea rdx, [r13*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x1401782ee
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017832f
mov rcx, r14
call fcn.1401c9cec
lea rdx, [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
xor edi, edi
jmp 0x14017807e
add rcx, 2
jmp 0x140178140
movzx ebp, byte [rsp + 0x20]
jmp 0x1401781d0
add rax, 2
xor r8d, r8d
jmp 0x140178220
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [r12 + 0x18]
cmp rdx, 8
jb 0x140178381
mov rcx, qword [r12]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14017837c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14017840a
mov rcx, r8
call fcn.1401c9cec
mov qword [r12 + 0x10], rdi
mov qword [r12 + 0x18], 7
mov word [r12], di
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x1401783cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x1401783ca
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140178411
mov rcx, r8
call fcn.1401c9cec
mov qword [r15 + 0x10], rdi
mov qword [r15 + 0x18], 7
mov word [r15], di
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1401c9a40
mov rbx, qword [rsp + 0x300]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3