Function at 0x14001c900
Capabilities:
Enumerate processes
Enumerate processes on remote desktop session host
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140041008]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov qword [rsp + 0x2d8], r15
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov rdx, r14
lea rcx, str.dol_start_:_CLOSE_AT_TREE_:__s_n
call fcn.14001de10
lea rdx, str.sam.exe
mov rcx, r14
call fcn.1400221fc
xor r12d, r12d
test eax, eax
jne 0x14001ca74
lea rdx, str.S_1_5_18
lea rcx, str.dol_start_:_CLOSE_AT_TREE_:_Found_SAM_with__s__n
call fcn.14001de10
mov r15d, dword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x30], r12d
xor ecx, ecx
mov qword [rsp + 0x38], r12
lea r8d, [r12 + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
test eax, eax
je 0x14001ca62
mov edx, dword [rsp + 0x30]
mov edi, r12d
test edx, edx
je 0x14001ca57
nop word [rax + rax]
mov eax, edi
lea rcx, [rax + rax*2]
mov rax, qword [rsp + 0x38]
lea rsi, [rcx*8]
cmp dword [rsi + rax], r15d
jne 0x14001ca4d
mov rcx, qword [rsi + rax + 8]
mov rdx, r14
call fcn.1400221fc
test eax, eax
jne 0x14001ca49
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], r12
mov ebx, r12d
mov rcx, qword [rsi + rcx + 0x10]
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001ca49
lea rdx, str.S_1_5_18
call fcn.1400221fc
test eax, eax
jne 0x14001ca3a
mov rax, qword [rsp + 0x38]
mov ebx, dword [rsi + rax + 4]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
jne 0x14001ca67
mov edx, dword [rsp + 0x30]
inc edi
cmp edi, edx
jb 0x14001c9d0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov ebx, r12d
jmp 0x14001ca82
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
jmp 0x14001ca82
mov edx, dword [rsp + 0x40]
mov rcx, r14
call fcn.14001be50
mov ebx, eax
mov r15, qword [rsp + 0x2d8]
mov edi, r12d
test ebx, ebx
je 0x14001cb75
xor edx, edx
lea rcx, [rsp + 0x54]
mov r8d, 0x234
call fcn.14001fd60
xor edx, edx
mov dword [rsp + 0x50], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14001cb75
cmp dword [rsp + 0x70], ebx
jne 0x14001cb19
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14001cb19
mov rdx, r14
lea rcx, str.dol_start_:_CLOSE_AT_TREE_:_Terminating_child_process_n
call fcn.14001de10
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14001cad3
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov edi, r12d
test rax, rax
je 0x14001cb75
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14001cb6c
mov rdx, r14
lea rcx, str.dol_start_:_CLOSE_AT_TREE_:_Terminating_parent_process_n
call fcn.14001de10
mov edi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, r14
lea rcx, str.dol_start_:_CLOSE_AT_TREE_:_Finished_n
call fcn.14001de10
mov eax, edi
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14001e3f0
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2a0
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret