Function at 0x14001fa20
Capabilities:
Enumerate processes
Get session information

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rbp + 0x280], rax
xor ebx, ebx
mov r13d, r9d
mov qword [rbp - 0x78], rbx
mov r12, r8
mov qword [rsp + 0x68], rbx
mov r14, rdx
mov r15d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
xor edx, edx
lea ecx, [rbx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001fa9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateToolhelp32Snapshot_Error:__u_n
call fcn.140020f50
mov eax, edi
jmp 0x14001fed2
lea rdx, [rbp + 0x40]
mov dword [rbp + 0x40], 0x238
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x14001fad8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Process32First_Error:__u_n
call fcn.140020f50
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x14001fed2
mov qword [rsp + 0x3d0], rsi
mov esi, dword [rsp + 0x60]
nop dword [rax]
nop dword [rax + rax]
lea rdx, str.winlogon.exe
lea rcx, [rbp + 0x6c]
call fcn.1400c3768
test eax, eax
jne 0x14001fb68
mov ecx, dword [rbp + 0x48]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], ebx
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x14001fb68
mov esi, dword [rbp + 0x48]
lea rdx, str.winlogon.exe
mov r9d, dword [rsp + 0x60]
lea rcx, str.Found__s_..._PID____d__Session__d__n
mov r8d, esi
call fcn.1400213c0
mov edx, dword [rsp + 0x60]
lea rax, [rsp + 0x78]
lea r9, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r8d, 8
mov qword [rbp - 0x80], rbx
xor ecx, ecx
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x14001fb68
mov rcx, qword [rbp - 0x80]
cmp word [rcx], bx
je 0x14001fb7e
lea rdx, [rbp + 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14001faf0
jmp 0x14001fb98
mov r15d, dword [rsp + 0x60]
call sub.WTSAPI32.dll_WTSFreeMemory
mov edx, dword [rsp + 0x60]
lea rcx, str.winlogonSessId___d__is_active_n
call fcn.1400213c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov qword [rsp + 0x70], rbx
lea rcx, [rbp - 0x40]
lea r8d, [rdx + 0x68]
call fcn.1400c0ac0
lea rax, str.winsta0default
mov dword [rbp - 0x40], 0x68
mov qword [rbp - 0x30], rax
mov eax, 1
mov dword [rbp - 4], eax
mov word [rbp], ax
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
cmp r15d, 0xffffffff
je 0x14001fd4e
lea rdx, [rbp - 0x78]
mov ecx, r15d
call sub.WTSAPI32.dll_WTSQueryUserToken
mov r8d, esi
xor edx, edx
mov ecx, 0x2000000
mov edi, gethostbyaddr
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r8, [rbp - 0x70]
mov edx, 0x201eb
mov rcx, rax
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14001fc39
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Process_token_open_Error:__u_n
call fcn.140020f50
lea r8, [rbp - 0x68]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14001fc64
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LaunchExeInLoggedOnSession:_Failure_at_LookupPrivilegeValue:__u_n
call fcn.140020f50
mov rax, qword [rbp - 0x68]
mov r9d, 1
mov rcx, qword [rbp - 0x70]
xor r8d, r8d
mov qword [rbp + 0x34], rax
mov edx, 0x2000000
lea rax, [rsp + 0x68]
mov dword [rbp + 0x30], 1
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov dword [rbp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x68]
mov edx, recv
mov r8d, r15d
lea r9d, [rdx - 8]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov rcx, qword [rsp + 0x68]
lea r8, [rbp + 0x30]
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14001fcfa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LaunchExeInLoggedOnSession:_Failure_at_AdjustTokenPrivileges:__u_n
call fcn.140020f50
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x14001fd13
lea rcx, str.Token_does_not_have_the_provilege_n
call fcn.140020f50
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r8d, 1
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x14001fd33
mov edi, 0x430
jmp 0x14001fd56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LaunchExeInLoggedOnSession:_Failure_at_CreateEnvironmentBlock:__u
call fcn.1400213c0
mov qword [rsp + 0x70], rbx
jmp 0x14001fd56
mov edi, dword [rsp + 0x78]
mov rsi, qword [rbp - 0x68]
mov rdx, qword [rsp + 0x68]
lea rcx, str.hUserTokenDup___d__n
call fcn.1400213c0
cmp qword [rsp + 0x68], rbx
je 0x14001fdbe
lea rcx, str.use_CreateProcessAsUserW___n
call fcn.1400213c0
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rax, [rbp - 0x40]
mov r8, r12
mov qword [rsp + 0x48], rax
mov rdx, r14
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x14001fe05
lea rcx, str.use_CreateProcessW___n
call fcn.1400213c0
lea rax, [rbp - 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x40]
mov rdx, r12
mov qword [rsp + 0x40], rax
mov rcx, r14
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14001fe5b
mov rdx, r14
lea rcx, str.CreateProcessAsUser_succeed___s__n
call fcn.1400213c0
mov dword [rsp + 0x60], ebx
test r13d, r13d
je 0x14001fe45
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp - 0x60]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x60], 0x103
je 0x14001fe21
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001fe74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, r14
lea rcx, str.LaunchExeInLoggedOnSession:_CreateProcessAsUser_failed___u___s__n
mov edx, eax
mov ebx, eax
call fcn.1400213c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14001fe8c
mov edx, eax
lea rcx, str.LaunchExeInLoggedOnSession:_last_error_before_cleanup__u
call fcn.1400213c0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14001fe9b
call sub.USERENV.dll_DestroyEnvironmentBlock
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
mov rsi, qword [rsp + 0x3d0]
test rcx, rcx
je 0x14001febb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.140027790
add rsp, 0x390
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret