Function at 0x140089934
Capabilities:
Enumerate process modules
Get process image filename
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x12f8
call fcn.140115de0
sub rsp, rax
mov qword [rsp + 0x28], r9
mov r13, r8
mov qword [rsp + 0x48], rdx
mov ebp, ecx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x12f0], rax
lea rcx, str.Microsoft.WebApp.IdentityProxy.Deployment
mov edx, 6
mov r8d, 0x1f
call fcn.1400c47b0
call fcn.140164df0
test al, al
je 0x140089993
call fcn.14017dae0
cmp ebp, 2
sete r12b
cmp ebp, 4
sete r15b
cmp ebp, 4
je 0x1400899af
cmp ebp, 2
jne 0x140089b6b
lea rsi, [rsp + 0x2f0]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.140117f60
lea r8, [rsp + 0xc0]
mov dword [r8], 0
mov rcx, rsi
mov edx, 0x1000
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x140089b6b
mov qword [rsp + 0x38], r13
mov byte [rsp + 0x33], r15b
mov edi, dword [rsp + 0xc0]
shr rdi, 2
lea rcx, [rsp + 0xe0]
mov r8d, 0x208
xor edx, edx
call fcn.140117f60
test rdi, rdi
je 0x140089b61
xor r13d, r13d
mov r15, qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rsi, [rsp + 0xe0]
movabs rax, 0x7fffffffffffffef
add rax, 0x11
mov qword [rsp + 0x40], rax
mov r8d, dword [rsp + r13*4 + 0x2f0]
test r8d, r8d
je 0x140089a77
mov ecx, 0x401
xor edx, edx
call r15
test rax, rax
je 0x140089a77
mov rbx, rax
mov rcx, rax
mov rdx, rsi
mov r8d, 0x104
call sub.KERNEL32.dll_K32GetProcessImageFileNameW
test eax, eax
jne 0x140089a84
inc r13
cmp rdi, r13
jne 0x140089a43
jmp 0x140089b61
mov rcx, rsi
call fcn.1401124ec
mov r14, rax
movabs rax, 0x7fffffffffffffef
cmp r14, rax
ja 0x14008a411
mov byte [rsp + 0x32], r12b
mov dword [rsp + 0x34], ebp
cmp r14, 0xb
jae 0x140089ac8
mov byte [rsp + 0xdf], r14b
lea r12, [rsp + 0xc8]
test r14, r14
jne 0x140089afb
jmp 0x140089b0c
lea rbp, [r14 + 8]
and rbp, 0xfffffffffffffff8
mov rcx, rbp
add rcx, rbp
call fcn.140112048
mov r12, rax
mov qword [rsp + 0xc8], rax
or rbp, qword [rsp + 0x40]
mov qword [rsp + 0xd8], rbp
mov qword [rsp + 0xd0], r14
mov r8, r14
add r8, r14
mov rcx, r12
mov rdx, rsi
call fcn.1401178b0
mov word [r12 + r14*2], 0
lea rcx, [rsp + 0xc8]
mov rdx, qword [rsp + 0x38]
call fcn.1401f9dfb
mov r14d, eax
cmp byte [rsp + 0xdf], 0
jns 0x140089b3f
mov rcx, qword [rsp + 0xc8]
call fcn.140112038
test r14b, r14b
mov ebp, dword [rsp + 0x34]
mov r12b, byte [rsp + 0x32]
je 0x140089a77
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140089a77
mov r15b, byte [rsp + 0x33]
mov r13, qword [rsp + 0x38]
lea rcx, [rsp + 0xc8]
mov qword [rcx], 0
call fcn.14008a428
test eax, eax
js 0x140089bf2
mov qword [rsp + 0xc0], 0
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x2f0]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [0x1402ae190]
movaps xmmword [rsi], xmm0
lea rax, str.Windows.Foundation.Uri
lea rdx, [rsp + 0xe0]
mov qword [rdx], rax
mov qword [rdx + 8], 0x16
mov rcx, rsi
call fcn.14017dc60
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140089c2d
lea rdx, [0x1402b2c10]
lea r8, [rsp + 0xc0]
call fcn.14017daa0
mov esi, eax
jmp 0x140089c32
lea rdx, [rsp + 0xe0]
mov dword [rdx + 4], 0
mov dword [rdx], eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
lea rsi, [rsp + 0x2f0]
mov qword [rsi], rcx
mov qword [rax], 0
call qword [rcx + 8]
mov rcx, rsi
call fcn.1400c40e0
jmp 0x14008a2e8
mov esi, 0x80004005
lea r14, [0x1402aa1c8]
mov qword [rsp + 0x2f0], r14
cmp byte [rsp + 0x300], 0
jne 0x14008a40e
mov rcx, qword [rsp + 0x2f8]
test rcx, rcx
je 0x140089c61
call fcn.14017da00
test esi, esi
js 0x140089d60
lea rbx, [rsp + 0xb8]
mov qword [rbx], 0
mov rdi, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0x48]
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0xa8]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x2f0]
mov rcx, rsi
call fcn.14017dc60
mov rdx, qword [rsi + 8]
mov rax, qword [rdi]
mov rcx, rdi
mov r8, rbx
call qword [rax + 0x30]
mov qword [rsi], r14
cmp byte [rsi + 0x10], 0
jne 0x14008a41e
mov ebx, eax
mov rcx, qword [rsp + 0x2f8]
test rcx, rcx
je 0x140089ce7
call fcn.14017da00
test ebx, ebx
js 0x140089d9b
xor eax, eax
mov qword [rsp + 0xa0], rax
lea r8, [rsp + 0x98]
mov qword [r8], rax
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rcx]
lea rdx, [0x1402b6a40]
call qword [rax]
test eax, eax
js 0x140089dd6
xor eax, eax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x2f0], xmm0
mov qword [rsp + 0x300], rax
mov qword [rsp + 0x90], rax
cmp ebp, 4
jne 0x140089e11
lea rdx, str.Windows.Management.Deployment.StagePackageOptions
lea rcx, [rsp + 0x2f0]
mov r8d, 0x31
jmp 0x140089e26
lea rdx, [rsp + 0xe0]
mov dword [rdx + 4], 0
mov dword [rdx], esi
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
lea rsi, [rsp + 0x2f0]
mov qword [rsi], rcx
mov qword [rax], 0
call qword [rcx + 8]
mov rcx, rsi
call fcn.1400c40e0
jmp 0x14008a2c9
lea rdx, [rsp + 0xe0]
mov dword [rdx + 4], 0
mov dword [rdx], ebx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
lea rsi, [rsp + 0x2f0]
mov qword [rsi], rcx
mov qword [rax], 0
call qword [rcx + 8]
mov rcx, rsi
call fcn.1400c40e0
jmp 0x14008a2aa
lea rdx, [rsp + 0xe0]
mov dword [rdx + 4], 0
mov dword [rdx], eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
lea rsi, [rsp + 0x2f0]
mov qword [rsi], rcx
mov qword [rax], 0
call qword [rcx + 8]
mov rcx, rsi
call fcn.1400c40e0
jmp 0x14008a26c
lea rdx, str.Windows.Management.Deployment.AddPackageOptions
lea rcx, [rsp + 0x2f0]
mov r8d, 0x2f
call fcn.140010098
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140089e4a
mov qword [rsp + 0x90], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
movzx eax, byte [rsp + 0x307]
test al, al
cmovs rsi, qword [rsp + 0x2f0]
lea rdx, [rsp + 0x80]
mov qword [rdx], rsi
cmovs rax, qword [rsp + 0x2f8]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0xe0]
mov rcx, rdi
call fcn.14017dc60
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x90]
call fcn.1401cff30
mov qword [rdi], r14
cmp byte [rdi + 0x10], 0
jne 0x14008a421
mov esi, eax
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x140089eb7
call fcn.14017da00
test esi, esi
js 0x140089ff4
cmp ebp, 4
je 0x140089ecd
cmp ebp, 2
jne 0x14008a02c
lea rsi, [rsp + 0x78]
mov qword [rsi], 0
mov rdi, qword [rsp + 0xc0]
movzx eax, byte [r13 + 0x17]
test al, al
mov rcx, qword [r13]
cmovns rcx, r13
lea rdx, [rsp + 0x68]
mov qword [rdx], rcx
cmovs rax, qword [r13 + 8]
mov qword [rdx + 8], rax
lea rbx, [rsp + 0xe0]
mov rcx, rbx
call fcn.14017dc60
mov rdx, qword [rbx + 8]
mov rax, qword [rdi]
mov rcx, rdi
mov r8, rsi
call qword [rax + 0x30]
mov qword [rbx], r14
cmp byte [rbx + 0x10], 0
jne 0x14008a424
mov esi, eax
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x140089f42
call fcn.14017da00
test esi, esi
js 0x14008a104
lea rcx, str.Microsoft.WebApp.IdentityProxy.Deployment
cmp ebp, 4
jne 0x14008a13c
mov edx, 0xd
mov r8d, 0x1f
call fcn.1400c47b0
lea r8, [rsp + 0x60]
mov qword [r8], 0
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
lea rdx, [0x1402b6a50]
call qword [rax]
test eax, eax
js 0x14008a32a
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x68]
test eax, eax
js 0x14008a1d1
mov rsi, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140089fd1
mov qword [rsp + 0xa0], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0xb8]
mov rax, qword [rsi]
lea r9, [rsp + 0xa0]
mov rcx, rsi
call qword [rax + 0x40]
jmp 0x14008a1c9
lea rdx, [rsp + 0x78]
mov dword [rdx + 4], 0
mov dword [rdx], esi
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
lea rsi, [rsp + 0xe0]
mov qword [rsi], rcx
mov qword [rax], 0
call qword [rcx + 8]
mov rcx, rsi
call fcn.1400c40e0
jmp 0x14008a236
lea rcx, str.Microsoft.WebApp.IdentityProxy.Deployment
mov edx, 0xe
mov r8d, 0x1f
call fcn.1400c47b0
lea r8, [rsp + 0x78]
mov qword [r8], 0
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
lea rdx, [0x1402b69e0]
call qword [rax]
test eax, eax
js 0x14008a0f4
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov dl, 1
call qword [rax + 0x108]
test eax, eax
js 0x14008a0f4
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov dl, 1
call qword [rax + 0x118]
test eax, eax
js 0x14008a0f4
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov dl, 1
call qword [rax + 0xb8]
test eax, eax
js 0x14008a0f4
mov rsi, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14008a0ce
mov qword [rsp + 0xa0], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0xb8]
mov rax, qword [rsi]
lea r9, [rsp + 0xa0]
mov rcx, rsi
call qword [rax + 0x38]
test eax, eax
jns 0x14008a3b8
lea rdx, [rsp + 0x60]
mov dword [rdx + 4], 0
mov dword [rdx], eax
jmp 0x14008a112
lea rdx, [rsp + 0x60]
mov dword [rdx + 4], 0
mov dword [rdx], esi
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
lea rsi, [rsp + 0xe0]
mov qword [rsi], rcx
mov qword [rax], 0
call qword [rcx + 8]
mov rcx, rsi
call fcn.1400c40e0
jmp 0x14008a21d
mov edx, 0xc
mov r8d, 0x1f
call fcn.1400c47b0
lea r8, [rsp + 0x60]
mov qword [r8], 0
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
lea rdx, [0x1402b69e0]
call qword [rax]
test eax, eax
js 0x14008a1d1
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x68]
test eax, eax
js 0x14008a1d1
mov rsi, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14008a1ab
mov qword [rsp + 0xa0], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0xb8]
mov rax, qword [rsi]
lea r9, [rsp + 0xa0]
mov rcx, rsi
call qword [rax + 0x38]
test eax, eax
jns 0x14008a39f
lea rdx, [rsp + 0x58]
mov dword [rdx + 4], 0
mov dword [rdx], eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
lea rsi, [rsp + 0xe0]
mov qword [rsi], rcx
mov qword [rax], 0
call qword [rcx + 8]
mov rcx, rsi
call fcn.1400c40e0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14008a21d
mov qword [rsp + 0x60], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14008a236
mov qword [rsp + 0x78], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14008a255
mov qword [rsp + 0x90], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [rsp + 0x307], 0
jns 0x14008a26c
mov rcx, qword [rsp + 0x2f0]
call fcn.140112038
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14008a28b
mov qword [rsp + 0x98], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14008a2aa
mov qword [rsp + 0xa0], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14008a2c9
mov qword [rsp + 0xb8], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x14008a2e8
mov qword [rsp + 0xc0], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x14008a2fb
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x28]
call fcn.1400c40e0
mov rcx, qword [rsp + 0x12f0]
xor rcx, rsp
call fcn.140115e50
nop
add rsp, 0x12f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x58], 0
mov rsi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14008a354
mov qword [rsp + 0x60], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rsi]
lea rdx, [0x1402b6a50]
lea rdi, [rsp + 0x60]
mov rcx, rsi
mov r8, rdi
call qword [rax]
lea rdx, [rsp + 0x58]
mov dword [rdx], eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
lea rsi, [rsp + 0xe0]
mov qword [rsi], rcx
mov qword [rax], 0
call qword [rcx + 8]
mov rcx, rsi
call fcn.1400c40e0
mov rcx, qword [rdi]
jmp 0x14008a209
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14008a3b8
mov qword [rsp + 0x60], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14008a3d1
mov qword [rsp + 0x78], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
or r12b, r15b
cmp ebp, 4
sete r9b
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
mov qword [rdx], rax
mov qword [rcx], 0
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rdx
mov dl, 1
mov r8d, r12d
call fcn.1401f9b4a
jmp 0x14008a236
int3
lea rcx, [rsp + 0xc8]
call fcn.1401573b4
int3
int3
int3