Function at 0x140011479
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400169f0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0xcb0
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x224
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xcd8]
mov rax, qword [0x140025018]
xor rax, rbp
mov qword [rbp + 0xc48], rax
lea rcx, [0x14002b0f5]
call fcn.140011681
mov dword [rbp + 0x10], 0x238
xor edx, edx
mov ecx, 2
call fcn.140011316
mov qword [rbp + 0x268], rax
lea rax, [rbp + 0x288]
lea rcx, str.netflix_x86_64.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x26
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.140011401
cmp eax, 1
jne 0x140017163
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400115b9
cmp eax, 1
jne 0x140017163
lea rdx, [rbp + 0x288]
lea rcx, [rbp + 0x3c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x14001715e
lea rdx, str.got_cheat
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c3
mov r8d, dword [rbp + 0x18]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x2c8], rax
lea rax, [rbp + 0x2e8]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov qword [rbp + 0x328], 0
mov qword [rbp + 0x348], 0
mov byte [rbp + 0x364], 0
mov byte [rbp + 0x365], 0
mov byte [rbp + 0x366], 0
mov byte [rbp + 0x367], 0
mov byte [rbp + 0x368], 0
mov byte [rbp + 0x369], 1
mov edx, 1
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x140016bed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x798]
call fcn.14001123a
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
mov r8, qword [rbp + 0xc30]
lea rdx, [0x140021614]
lea rcx, [rbp + 0x7d8]
call fcn.1400116b3
mov qword [rbp + 0xc38], rax
mov rax, qword [rbp + 0xc38]
mov qword [rbp + 0xc40], rax
mov rdx, qword [rbp + 0xc40]
lea rcx, [rbp + 0x768]
call fcn.14001125d
lea rdx, [0x140024cd8]
lea rcx, [rbp + 0x768]
call fcn.140011721
nop
lea rcx, [rbp + 0x7d8]
call fcn.14001113b
lea rcx, [rbp + 0x798]
call fcn.14001113b
nop
lea rax, [rbp + 0x328]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x364]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140016cde
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x848]
call fcn.14001123a
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
mov r8, qword [rbp + 0xc30]
lea rdx, [0x140021618]
lea rcx, [rbp + 0x888]
call fcn.1400116b3
mov qword [rbp + 0xc38], rax
mov rax, qword [rbp + 0xc38]
mov qword [rbp + 0xc40], rax
mov rdx, qword [rbp + 0xc40]
lea rcx, [rbp + 0x818]
call fcn.14001125d
lea rdx, [0x140024cd8]
lea rcx, [rbp + 0x818]
call fcn.140011721
nop
lea rcx, [rbp + 0x888]
call fcn.14001113b
lea rcx, [rbp + 0x848]
call fcn.14001113b
nop
mov dword [rbp + 0x384], 8
mov eax, dword [rbp + 0x384]
add rax, 8
mov dword [rbp + 0x384], eax
mov rcx, qword [rbp + 0x328]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [rbp + 0x384]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x384], eax
mov eax, dword [rbp + 0x384]
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x348], rax
cmp qword [rbp + 0x348], 0
jne 0x140016de2
mov rcx, qword [rbp + 0x328]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x8f8]
call fcn.14001123a
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
mov r8, qword [rbp + 0xc30]
lea rdx, [0x14002161c]
lea rcx, [rbp + 0x938]
call fcn.1400116b3
mov qword [rbp + 0xc38], rax
mov rax, qword [rbp + 0xc38]
mov qword [rbp + 0xc40], rax
mov rdx, qword [rbp + 0xc40]
lea rcx, [rbp + 0x8c8]
call fcn.14001125d
lea rdx, [0x140024cd8]
lea rcx, [rbp + 0x8c8]
call fcn.140011721
nop
lea rcx, [rbp + 0x938]
call fcn.14001113b
lea rcx, [rbp + 0x8f8]
call fcn.14001113b
nop
mov r8d, 2
mov edx, dword [rbp + 0x384]
mov rcx, qword [rbp + 0x348]
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x140016eb5
mov rcx, qword [rbp + 0x348]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x328]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x9a8]
call fcn.14001123a
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
mov r8, qword [rbp + 0xc30]
lea rdx, [0x140021620]
lea rcx, [rbp + 0x9e8]
call fcn.1400116b3
mov qword [rbp + 0xc38], rax
mov rax, qword [rbp + 0xc38]
mov qword [rbp + 0xc40], rax
mov rdx, qword [rbp + 0xc40]
lea rcx, [rbp + 0x978]
call fcn.14001125d
lea rdx, [0x140024cd8]
lea rcx, [rbp + 0x978]
call fcn.140011721
nop
lea rcx, [rbp + 0x9e8]
call fcn.14001113b
lea rcx, [rbp + 0x9a8]
call fcn.14001113b
nop
mov r9, qword [rbp + 0x328]
mov r8d, 0x1fffff
mov edx, 2
mov rcx, qword [rbp + 0x348]
call qword [sym.imp.ADVAPI32.dll_AddAccessDeniedAce]
test eax, eax
jne 0x140016f8e
mov rcx, qword [rbp + 0x348]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x328]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0xa58]
call fcn.14001123a
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
mov r8, qword [rbp + 0xc30]
lea rdx, [0x140021624]
lea rcx, [rbp + 0xa98]
call fcn.1400116b3
mov qword [rbp + 0xc38], rax
mov rax, qword [rbp + 0xc38]
mov qword [rbp + 0xc40], rax
mov rdx, qword [rbp + 0xc40]
lea rcx, [rbp + 0xa28]
call fcn.14001125d
lea rdx, [0x140024cd8]
lea rcx, [rbp + 0xa28]
call fcn.140011721
nop
lea rcx, [rbp + 0xa98]
call fcn.14001113b
lea rcx, [rbp + 0xa58]
call fcn.14001113b
nop
xor r9d, r9d
mov r8, qword [rbp + 0x348]
mov edx, 1
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x140017064
mov rcx, qword [rbp + 0x348]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x328]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0xb08]
call fcn.14001123a
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
mov r8, qword [rbp + 0xc30]
lea rdx, [0x140021628]
lea rcx, [rbp + 0xb48]
call fcn.1400116b3
mov qword [rbp + 0xc38], rax
mov rax, qword [rbp + 0xc38]
mov qword [rbp + 0xc40], rax
mov rdx, qword [rbp + 0xc40]
lea rcx, [rbp + 0xad8]
call fcn.14001125d
lea rdx, [0x140024cd8]
lea rcx, [rbp + 0xad8]
call fcn.140011721
nop
lea rcx, [rbp + 0xb48]
call fcn.14001113b
lea rcx, [rbp + 0xb08]
call fcn.14001113b
nop
lea r8, [rbp + 0x2e8]
mov edx, 4
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
test eax, eax
jne 0x140017137
mov rcx, qword [rbp + 0x348]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x328]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0xbb8]
call fcn.14001123a
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
mov r8, qword [rbp + 0xc30]
lea rdx, [0x14002162c]
lea rcx, [rbp + 0xbf8]
call fcn.1400116b3
mov qword [rbp + 0xc38], rax
mov rax, qword [rbp + 0xc38]
mov qword [rbp + 0xc40], rax
mov rdx, qword [rbp + 0xc40]
lea rcx, [rbp + 0xb88]
call fcn.14001125d
lea rdx, [0x140024cd8]
lea rcx, [rbp + 0xb88]
call fcn.140011721
nop
lea rcx, [rbp + 0xbf8]
call fcn.14001113b
lea rcx, [rbp + 0xbb8]
call fcn.14001113b
nop
mov rcx, qword [rbp + 0x348]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x328]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140016a8b
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x1400210c0]
call fcn.14001156e
mov rax, rdi
mov rcx, qword [rbp + 0xc48]
xor rcx, rbp
call fcn.140011334
lea rsp, [rbp + 0xc50]
pop rdi
pop rsi
pop rbp
ret