Function at 0x18000b070
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x348]
sub rsp, 0x420
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x18005d0e0]
xor rax, rsp
mov qword [rbp + 0x310], rax
mov r14, rcx
xor r15d, r15d
mov qword [rsp + 0x48], r15
lea ecx, [r15 + 0x30]
call fcn.18002ff98
test rax, rax
je 0x18000b6d3
mov qword [rsp + 0x40], rax
mov qword [rax], rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x10], rax
mov rax, qword [rsp + 0x40]
mov byte [rax + 0x28], 1
mov rax, qword [rsp + 0x40]
mov byte [rax + 0x29], 1
lea rcx, [rsp + 0x38]
call fcn.18000bbe0
mov r13d, r15d
mov dword [rsp + 0x68], r15d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x18000b228
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rdi]
cmp rbx, rbx
jne 0x18000b1a2
mov rsi, qword [rdi + 8]
mov rbx, rsi
cmp byte [rsi + 0x29], al
jne 0x18000b186
nop
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x38]
call fcn.18000c1d0
mov rbx, qword [rbx]
mov rdx, qword [rsi + 0x20]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000b170
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, rsi
call fcn.18002f934
mov rsi, rbx
cmp byte [rbx + 0x29], 0
je 0x18000b140
mov rdi, qword [rsp + 0x40]
mov qword [rdi + 8], rdi
mov rax, qword [rsp + 0x40]
mov qword [rax], rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x10], rax
mov qword [rsp + 0x48], r15
jmp 0x18000b211
cmp rbx, rdi
je 0x18000b216
mov r8, rbx
cmp byte [rbx + 0x29], 0
jne 0x18000b1fe
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x29], 0
jne 0x18000b1de
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
jne 0x18000b1fe
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
je 0x18000b1d0
jmp 0x18000b1fe
mov rax, qword [rbx + 8]
cmp byte [rax + 0x29], 0
jne 0x18000b1fb
cmp rbx, qword [rax + 0x10]
jne 0x18000b1fb
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], 0
je 0x18000b1e8
mov rbx, rax
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x38]
call fcn.18000be50
cmp rbx, rdi
jne 0x18000b1a7
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call fcn.18002f934
mov eax, 0x64
jmp 0x18000b700
mov dword [rbp - 0x40], 0x130
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x18000b5c0
xor edx, edx
mov r8d, 0x10d
lea rcx, [rbp + 0xf1]
call fcn.1800334b0
mov byte [rbp + 0xf0], 0
mov r8d, dword [rbp - 0x38]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18000b2ae
mov r8d, 0x104
lea rdx, [rbp + 0x200]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameA]
test eax, eax
je 0x18000b2a5
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x200]
call fcn.18000aef0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
mov r8, qword [rsp + 0x40]
mov rax, qword [r8 + 8]
mov rcx, r8
mov edx, dword [rbp - 0x38]
cmp byte [rax + 0x29], 0
jne 0x18000b2f7
nop dword [rax]
cmp dword [rax + 0x18], edx
jae 0x18000b2eb
mov rax, qword [rax + 0x10]
jmp 0x18000b2f1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
je 0x18000b2e0
mov qword [rsp + 0x70], rcx
cmp rcx, r8
je 0x18000b30d
cmp edx, dword [rcx + 0x18]
jb 0x18000b30d
lea rax, [rsp + 0x70]
jmp 0x18000b317
mov qword [rsp + 0x78], r8
lea rax, [rsp + 0x78]
mov rax, qword [rax]
cmp rax, r8
je 0x18000b458
mov r12, qword [rax + 0x20]
lea rcx, [r12 - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x18000b453
cmp dword [rdi + 0x10], 0
jl 0x18000b378
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x18000b378
call fcn.180001790
mov rbx, rax
or ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x18000b36a
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.WS2_32.dll_htonl + 8]
add rbx, 0x18
mov qword [rsp + 0x60], rbx
jmp 0x18000b453
movsxd rsi, dword [r12 - 0x10]
test esi, esi
jne 0x18000b3d8
mov rsi, qword [rdi]
cmp dword [rdi + 8], 0
je 0x18000b453
cmp dword [rdi + 0x10], 0
jge 0x18000b3aa
cmp dword [rbx - 0xc], 0
jl 0x18000b594
mov dword [rbx - 0x10], r15d
mov byte [rbx], 0
jmp 0x18000b453
or eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x18000b3c4
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
jmp 0x18000b453
test r12, r12
je 0x18000b5b5
mov r15d, dword [rbx - 0x10]
mov r13, r12
sub r13, rbx
test esi, esi
js 0x18000b5aa
mov ecx, 1
sub ecx, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
sub eax, esi
or eax, ecx
jge 0x18000b415
mov edx, esi
lea rcx, [rsp + 0x60]
call fcn.180001ef0
mov rbx, qword [rsp + 0x60]
mov rdi, rsi
movsxd rdx, dword [rbx - 0xc]
mov r9, rsi
mov rcx, rbx
cmp r13, r15
ja 0x18000b433
lea r8, [r13 + rbx]
call fcn.18002f970
jmp 0x18000b43b
mov r8, r12
call fcn.18002feb4
cmp esi, dword [rbx - 0xc]
jg 0x18000b59f
mov dword [rbx - 0x10], esi
mov byte [rdi + rbx], 0
mov r13d, dword [rsp + 0x68]
xor r15d, r15d
mov r12, qword [rsp + 0x30]
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov eax, dword [rbp - 0x38]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0xf0]
lea r8, [rbp - 0x14]
lea rdx, str._s_t_s_t_s_t_u_r_n
lea rcx, [rsp + 0x58]
call fcn.180002980
mov rcx, qword [r14 + 8]
lea rax, [rsp + 0x58]
mov rbx, qword [rsp + 0x58]
cmp rax, rcx
jae 0x18000b4ff
mov rax, qword [r14]
lea rdx, [rsp + 0x58]
cmp rax, rdx
ja 0x18000b4ff
lea rdi, [rsp + 0x58]
sub rdi, rax
sar rdi, 3
cmp rcx, qword [r14 + 0x10]
jne 0x18000b4d4
mov rcx, r14
call fcn.180009040
mov rcx, qword [r14]
mov rsi, qword [r14 + 8]
mov qword [rsp + 0x68], rsi
mov qword [rbp - 0x78], rsi
test rsi, rsi
je 0x18000b4fd
mov rcx, qword [rcx + rdi*8]
sub rcx, 0x18
call fcn.180001790
add rax, 0x18
mov qword [rsi], rax
jmp 0x18000b52f
cmp rcx, qword [r14 + 0x10]
jne 0x18000b50d
mov rcx, r14
call fcn.180009040
mov rdi, qword [r14 + 8]
mov qword [rbp - 0x78], rdi
mov qword [rsp + 0x68], rdi
test rdi, rdi
je 0x18000b52f
lea rcx, [rbx - 0x18]
call fcn.180001790
add rax, 0x18
mov qword [rdi], rax
add qword [r14 + 8], 8
mov eax, dword [rbx - 0x10]
lea r13d, [r13 + rax + 0x20]
mov dword [rsp + 0x68], r13d
lea rdx, [rbp - 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32Next]
mov edi, eax
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x18000b56d
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000b58d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test edi, edi
jmp 0x18000b23e
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
nop
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rdi]
cmp rbx, rbx
jne 0x18000b652
mov rsi, qword [rdi + 8]
mov rbx, rsi
cmp byte [rsi + 0x29], 0
jne 0x18000b636
nop word [rax + rax]
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x38]
call fcn.18000c1d0
mov rbx, qword [rbx]
mov rdx, qword [rsi + 0x20]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000b620
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, rsi
call fcn.18002f934
mov rsi, rbx
cmp byte [rbx + 0x29], 0
je 0x18000b5f0
mov rdi, qword [rsp + 0x40]
mov qword [rdi + 8], rdi
mov rax, qword [rsp + 0x40]
mov qword [rax], rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x10], rax
mov qword [rsp + 0x48], r15
jmp 0x18000b6c1
cmp rbx, rdi
je 0x18000b6c6
mov r8, rbx
cmp byte [rbx + 0x29], 0
jne 0x18000b6ae
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x29], 0
jne 0x18000b68e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
jne 0x18000b6ae
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
je 0x18000b680
jmp 0x18000b6ae
mov rax, qword [rbx + 8]
cmp byte [rax + 0x29], 0
jne 0x18000b6ab
cmp rbx, qword [rax + 0x10]
jne 0x18000b6ab
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], 0
je 0x18000b698
mov rbx, rax
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x38]
call fcn.18000be50
cmp rbx, rdi
jne 0x18000b657
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call fcn.18002f934
mov eax, r13d
jmp 0x18000b700
mov qword [rbp - 0x80], r15
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call fcn.18002fa78
lea r11, vtable.std::bad_alloc.0
mov qword [rbp - 0x58], r11
lea rdx, [0x18005ba10]
lea rcx, [rbp - 0x58]
call fcn.1800333cc
int3
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.18002f950
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret