Function at 0x1400446e0
Capabilities:
Enumerate processes

Disassembly:
push rdi
sub rsp, 0x2c0
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdi, rcx
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x140044718
mov rcx, rdi
call fcn.140043c50
test al, al
je 0x140044dcd
mov qword [rsp + 0x2d8], rbx
mov rcx, rdi
mov qword [rsp + 0x2e0], rbp
mov qword [rsp + 0x2e8], rsi
call fcn.140044df0
xor edx, edx
mov esi, eax
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400447ed
test rdi, rdi
je 0x140044770
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Standard_user.Unable_to_get_list_of_processes._ErrorCode:__d_.
jmp 0x140044c87
cmp qword [0x1400ed810], 0
je 0x1400447c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea r8, [0x1400c3148]
lea rax, str.In_changeThreadContextToExplorerContext._Standard_user.Unable_to_get_list_of_processes._ErrorCode:__d_.
mov ecx, PathResolve
mov qword [rsp + 0x28], rax
lea rdx, str.OOBEUtils
mov rax, qword [0x1400ed810]
mov r9, r8
mov qword [rsp + 0x20], r8
lea r8, str.ProcessUtils
call qword [case.0x140049d6d.0]
jmp 0x140044db3
mov rbx, qword [0x1400ed818]
test rbx, rbx
je 0x140044db3
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Standard_user.Unable_to_get_list_of_processes._ErrorCode:__d_.
jmp 0x140044c2d
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400448a6
test rdi, rdi
je 0x140044829
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Standard_user._Unable_to_initialize_first_process._ErrorCode:__d_.
jmp 0x140044c87
cmp qword [0x1400ed810], 0
je 0x14004487d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea r8, [0x1400c3148]
lea rax, str.In_changeThreadContextToExplorerContext._Standard_user._Unable_to_initialize_first_process._ErrorCode:__d_.
mov ecx, PathResolve
mov qword [rsp + 0x28], rax
lea rdx, str.OOBEUtils
mov rax, qword [0x1400ed810]
mov r9, r8
mov qword [rsp + 0x20], r8
lea r8, str.ProcessUtils
call qword [case.0x140049d6d.0]
jmp 0x140044db3
mov rbx, qword [0x1400ed818]
test rbx, rbx
je 0x140044db3
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Standard_user._Unable_to_initialize_first_process._ErrorCode:__d_.
jmp 0x140044c2d
xor ebp, ebp
nop dword [rax + rax]
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x9c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400448e6
mov ecx, dword [rsp + 0x78]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], ebp
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x1400448e6
cmp dword [rsp + 0x50], esi
je 0x14004490c
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400448b0
test rdi, rdi
je 0x140044d39
mov rax, qword [rdi]
mov rcx, rdi
jmp 0x140044d8a
mov esi, dword [rsp + 0x78]
test esi, esi
je 0x1400448f8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400449cf
test rdi, rdi
je 0x140044953
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Unable_to_open_process_token._ErrorCode:__d_.
jmp 0x140044c87
cmp qword [0x1400ed810], rbp
je 0x1400449a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea r8, [0x1400c3148]
lea rax, str.In_changeThreadContextToExplorerContext._Unable_to_open_process_token._ErrorCode:__d_.
mov ecx, PathResolve
mov qword [rsp + 0x28], rax
lea rdx, str.OOBEUtils
mov rax, qword [0x1400ed810]
mov r9, r8
mov qword [rsp + 0x20], r8
lea r8, str.ProcessUtils
call qword [case.0x140049d6d.0]
jmp 0x140044db3
mov rbx, qword [0x1400ed818]
test rbx, rbx
je 0x140044db3
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Unable_to_open_process_token._ErrorCode:__d_.
jmp 0x140044c2d
lea r8, [rsp + 0x5c]
mov dword [rsp + 0x58], 1
lea rdx, str.SeIncreaseQuotaPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor edx, edx
mov dword [rsp + 0x64], 2
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140044ac8
test rdi, rdi
je 0x140044a53
mov rcx, qword [rdi]
lea rdx, str.In_changeThreadContextToExplorerContext._Unable_to_adjust_token_privileges._ErrorCode:__d_.
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rdx
mov rax, qword [rcx + 0x68]
mov rcx, rdi
jmp 0x140044c93
mov rax, qword [0x1400ed810]
test rax, rax
je 0x140044a9c
lea r8, [0x1400c3148]
mov dword [rsp + 0x30], ebp
lea rdx, str.In_changeThreadContextToExplorerContext._Unable_to_adjust_token_privileges._ErrorCode:__d_.
mov r9, r8
mov qword [rsp + 0x28], rdx
mov ecx, PathResolve
mov qword [rsp + 0x20], r8
lea rdx, str.OOBEUtils
lea r8, str.ProcessUtils
call qword [case.0x140049d6d.0]
jmp 0x140044db3
mov rcx, qword [0x1400ed818]
test rcx, rcx
je 0x140044db3
mov rax, qword [rcx]
lea rdx, str.In_changeThreadContextToExplorerContext._Unable_to_adjust_token_privileges._ErrorCode:__d_.
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rdx
mov rax, qword [rax + 0x68]
jmp 0x140044c3d
mov r8d, esi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x140044b7c
test rdi, rdi
je 0x140044aff
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Cant_open_process_handle._ErrorCode:__d_.
jmp 0x140044c87
cmp qword [0x1400ed810], 0
je 0x140044b53
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea r8, [0x1400c3148]
lea rax, str.In_changeThreadContextToExplorerContext._Cant_open_process_handle._ErrorCode:__d_.
mov ecx, PathResolve
mov qword [rsp + 0x28], rax
lea rdx, str.OOBEUtils
mov rax, qword [0x1400ed810]
mov r9, r8
mov qword [rsp + 0x20], r8
lea r8, str.ProcessUtils
call qword [case.0x140049d6d.0]
jmp 0x140044db3
mov rbx, qword [0x1400ed818]
test rbx, rbx
je 0x140044db3
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Cant_open_process_handle._ErrorCode:__d_.
jmp 0x140044c2d
lea r8, [rsp + 0x48]
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140044c5b
test rdi, rdi
je 0x140044bb5
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Cant_open_processToken._ErrorCode:__d_.
jmp 0x140044c87
cmp qword [0x1400ed810], 0
je 0x140044c09
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea r8, [0x1400c3148]
lea rax, str.In_changeThreadContextToExplorerContext._Cant_open_processToken._ErrorCode:__d_.
mov ecx, PathResolve
mov qword [rsp + 0x28], rax
lea rdx, str.OOBEUtils
mov rax, qword [0x1400ed810]
mov r9, r8
mov qword [rsp + 0x20], r8
lea r8, str.ProcessUtils
call qword [case.0x140049d6d.0]
jmp 0x140044db3
mov rbx, qword [0x1400ed818]
test rbx, rbx
je 0x140044db3
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Cant_open_processToken._ErrorCode:__d_.
mov rcx, qword [0x1400ed818]
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 0x68]
mov edx, PathResolve
lea r8, [0x1400c3148]
lea r9, str.ProcessUtils
call qword [case.0x140049d6d.0]
jmp 0x140044db3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x140044d35
test rdi, rdi
je 0x140044cb1
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Cant_ImpersonateLoggedOnUser._ErrorCode:__d_.
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 0x68]
lea r9, str.ProcessUtils
mov edx, PathResolve
lea r8, [0x1400c3148]
call qword [case.0x140049d6d.0]
jmp 0x140044db3
cmp qword [0x1400ed810], 0
je 0x140044d05
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea r8, [0x1400c3148]
lea rax, str.In_changeThreadContextToExplorerContext._Cant_ImpersonateLoggedOnUser._ErrorCode:__d_.
mov ecx, PathResolve
mov qword [rsp + 0x28], rax
lea rdx, str.OOBEUtils
mov rax, qword [0x1400ed810]
mov r9, r8
mov qword [rsp + 0x20], r8
lea r8, str.ProcessUtils
call qword [case.0x140049d6d.0]
jmp 0x140044db3
mov rbx, qword [0x1400ed818]
test rbx, rbx
je 0x140044db3
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400ed818]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Cant_ImpersonateLoggedOnUser._ErrorCode:__d_.
jmp 0x140044c8a
mov al, 1
jmp 0x140044db5
mov rax, qword [0x1400ed810]
test rax, rax
je 0x140044d7b
lea r8, [0x1400c3148]
mov ecx, PathResolve
lea rdx, str.In_changeThreadContextToExplorerContext._Unable_to_find_explorer_processID
mov r9, r8
mov qword [rsp + 0x28], rdx
lea rdx, str.OOBEUtils
mov qword [rsp + 0x20], r8
lea r8, str.ProcessUtils
call qword [case.0x140049d6d.0]
jmp 0x140044db3
mov rcx, qword [0x1400ed818]
test rcx, rcx
je 0x140044db3
mov rax, qword [rcx]
mov rax, qword [rax + 0x68]
lea rdx, str.In_changeThreadContextToExplorerContext._Unable_to_find_explorer_processID
mov qword [rsp + 0x20], rdx
lea r9, str.ProcessUtils
mov edx, PathResolve
lea r8, [0x1400c3148]
call qword [case.0x140049d6d.0]
xor al, al
mov rbp, qword [rsp + 0x2e0]
mov rbx, qword [rsp + 0x2d8]
mov rsi, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140079b50
add rsp, 0x2c0
pop rdi
ret