Function at 0x14011d000
Capabilities:
Enumerate processes

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x78]
sub rsp, 0x178
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov r14d, edx
xor r15d, r15d
mov r12d, r15d
mov dword [rsp + 0x40], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov qword [rsp + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x14011d49c
mov r13d, r15d
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x14011d493
lea rbx, vtable.ATL::CAtlStringMgr.0
nop dword [rax]
call fcn.140020290
mov rcx, rax
test rax, rax
je 0x14011d488
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, rbx
jne 0x14011d0a7
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
jmp 0x14011d0a9
call rdx
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x6c]
lea rax, [rsp + 0x6c]
test rax, 0xffffffffffff0000
jne 0x14011d0f1
movzx edi, cx
mov ecx, edi
call fcn.14001fc80
test rax, rax
je 0x14011d1d9
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14001f520
mov rbx, qword [rsp + 0x20]
jmp 0x14011d1d9
lea rax, [rsp + 0x6c]
or rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14011d100
test edi, edi
jne 0x14011d121
lea rcx, [rsp + 0x20]
call fcn.14001f980
mov rbx, qword [rsp + 0x20]
jmp 0x14011d1d9
mov r14d, dword [rbx - 0x10]
lea rsi, [rsp + 0x6c]
sub rsi, rbx
test edi, edi
js 0x14011d47d
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14011d157
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.14001f8b0
mov rbx, qword [rsp + 0x20]
cmp rsi, r14
ja 0x14011d1a6
lea rdx, [rsi + rbx]
movsxd rsi, edi
test edi, edi
je 0x14011d1bd
test rdx, rdx
jne 0x14011d17e
call fcn.1400a8024
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
call fcn.1400a5674
jmp 0x14011d1bd
movsxd rax, dword [rbx - 0xc]
cmp rax, rsi
jae 0x14011d199
call fcn.1400a8024
mov dword [rax], Ordinal_35
call fcn.1400a5674
jmp 0x14011d1bd
mov r8, rsi
mov rcx, rbx
call fcn.14009b9a0
jmp 0x14011d1bd
movsxd rsi, edi
movsxd rdx, dword [rbx - 0xc]
mov r9, rsi
lea r8, [rsp + 0x6c]
mov rcx, rbx
call fcn.140020380
cmp edi, dword [rbx - 0xc]
jg 0x14011d472
mov dword [rbx - 0x10], edi
mov byte [rsi + rbx], 0
mov rsi, qword [rsp + 0x30]
mov r14d, dword [rbp + 0xc8]
cmp dword [rbx - 0x10], 0
jl 0x14011d21c
lea rdx, str.winlogon
mov rcx, rbx
call fcn.1400b7498
test rax, rax
je 0x14011d21c
cmp eax, ebx
js 0x14011d21c
mov dword [rbp + 0xc0], r15d
lea rdx, [rbp + 0xc0]
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp dword [rbp + 0xc0], r14d
cmove r13d, dword [rsp + 0x48]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
lea rbx, vtable.ATL::CAtlStringMgr.0
jg 0x14011d25b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rbx
jne 0x14011d258
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14011d25b
call r8
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x14011d080
test r13d, r13d
je 0x14011d493
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x14011d493
lea r15, [rsp + 0x6c]
shr r15, 0x10
nop dword [rax + rax]
call fcn.140020290
mov rcx, rax
test rax, rax
je 0x14011d467
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, rbx
jne 0x14011d2c7
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
jmp 0x14011d2c9
call rdx
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x6c]
test r15, r15
jne 0x14011d309
movzx edi, ax
mov ecx, edi
call fcn.14001fc80
test rax, rax
je 0x14011d3a5
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14001f520
mov rbx, qword [rsp + 0x28]
jmp 0x14011d3a5
lea rax, [rsp + 0x6c]
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x14011d312
test edi, edi
jne 0x14011d330
lea rcx, [rsp + 0x28]
call fcn.14001f980
mov rbx, qword [rsp + 0x28]
jmp 0x14011d3a5
mov r14d, dword [rbx - 0x10]
lea rsi, [rsp + 0x6c]
sub rsi, rbx
test edi, edi
js 0x14011d45c
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14011d366
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.14001f8b0
mov rbx, qword [rsp + 0x28]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
cmp rsi, r14
ja 0x14011d380
lea r8, [rsi + rbx]
mov r9d, edi
call fcn.14001f910
jmp 0x14011d38d
movsxd r9, edi
lea r8, [rsp + 0x6c]
call fcn.140020380
cmp edi, dword [rbx - 0xc]
jg 0x14011d451
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov byte [rax + rbx], 0
mov rsi, qword [rsp + 0x30]
cmp dword [rbx - 0x10], 0
jl 0x14011d3fa
lea rdx, str..scr
mov rcx, rbx
call fcn.1400b7498
test rax, rax
je 0x14011d3fa
cmp eax, ebx
js 0x14011d3fa
mov dword [rbp + 0xd0], 0
lea rdx, [rbp + 0xd0]
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov eax, dword [rbp + 0xc8]
cmp dword [rbp + 0xd0], eax
jne 0x14011d3fa
cmp dword [rsp + 0x60], r13d
mov eax, 1
cmove r12d, eax
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
lea rbx, vtable.ATL::CAtlStringMgr.0
jg 0x14011d439
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rbx
jne 0x14011d436
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14011d439
call r8
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x14011d493
jmp 0x14011d2a0
mov ecx, 0x80070057
call fcn.14001fe40
int3
mov ecx, 0x80070057
call fcn.14001fe40
nop
mov ecx, 0x80004005
call fcn.14001fe40
nop
mov ecx, 0x80070057
call fcn.14001fe40
int3
mov ecx, 0x80070057
call fcn.14001fe40
nop
mov ecx, 0x80004005
call fcn.14001fe40
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret