Function at 0x14000b210
Capabilities:
Enumerate processes
Enumerate threads

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x208f0
call fcn.14000f5f0
sub rsp, rax
mov rbx, rcx
lea rdi, [rsp + 0x20040]
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x20040], 0x238
movaps xmm0, xmmword [0x14001ba20]
movups xmmword [rsp + 0x20890], xmm0
mov qword [rsp + 0x208a0], 0
mov dword [rsp + 0x208a8], 0
lea rdi, [rsp + 0x42]
xor eax, eax
mov ecx, 0x1fffe
rep stosb byte [rdi], al
lea rdi, [rsp + 0x20688]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x20480]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x20278]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x208e8], 0
mov dword [rsp + 0x208e4], 0
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov rcx, rsi
lea rdx, [rsp + 0x20040]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000b44d
mov eax, dword [0x140022040]
cmp dword [rsp + 0x20048], eax
jne 0x14000b303
jmp 0x14000b31c
mov eax, dword [0x140022040]
cmp dword [rsp + 0x20048], eax
je 0x14000b31c
mov rcx, rsi
lea rdx, [rsp + 0x20040]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000b2f4
jmp 0x14000b44d
lea rcx, [rsp + 0x42]
mov edx, 0x104
lea r8, str.Process_name:__ls
lea r9, [rsp + 0x2006c]
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfb3
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x42]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edi, dword [rsp + 0x20048]
mov ecx, edi
lea rdx, [rsp + 0x20688]
mov r8d, 0xa
call fcn.14000ea10
lea rcx, [rsp + 0x42]
mov edx, 0x104
lea r8, [0x14001bd66]
mov r9, rax
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfb4
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x42]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, edi
lea rdx, [rsp + 0x208e8]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x14000b3fe
mov rcx, rbx
mov edx, 0xfb5
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, str.Session_Id:
call fcn.140002ef0
cmp dword [0x140022040], 0
je 0x14000b44d
mov rcx, rbx
mov edx, 0xfb5
mov r8d, 0x2741
lea r9, [rsp + 0x20278]
call fcn.1400089d0
jmp 0x14000b44d
mov ecx, dword [rsp + 0x208e8]
lea rdx, [rsp + 0x20688]
mov r8d, 0xa
call fcn.14000ea10
lea rcx, [rsp + 0x42]
mov edx, 0x104
lea r8, str.Session_Id:__ls
mov r9, rax
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfb5
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x42]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov rcx, rsi
lea rdx, [rsp + 0x20890]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x14000b695
mov eax, dword [0x140022040]
cmp dword [rsp + 0x2089c], eax
jne 0x14000b49d
jmp 0x14000b4b6
mov eax, dword [0x140022040]
cmp dword [rsp + 0x2089c], eax
je 0x14000b4b6
mov rcx, rsi
lea rdx, [rsp + 0x20890]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x14000b48e
jmp 0x14000b695
mov ecx, dword [rsp + 0x20898]
lea rdx, [rsp + 0x20688]
mov r8d, 0xa
call fcn.14000ea10
lea rcx, [rsp + 0x42]
mov edx, 0x104
lea r8, [0x14001bd0a]
mov r9, rax
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfbb
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x42]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edi, dword [rsp + 0x208a0]
cmp edi, 4
jbe 0x14000b585
lea eax, [edi - 5]
cmp eax, 1
jbe 0x14000b5b8
lea eax, [edi - 7]
cmp eax, 1
jbe 0x14000b5eb
lea eax, [edi - 9]
cmp eax, 1
jbe 0x14000b61b
lea eax, [edi - 0xb]
cmp eax, 0xc
jbe 0x14000b64b
lea eax, [edi - 0x18]
cmp eax, 7
ja 0x14000b679
mov ecx, edi
lea rdx, [rsp + 0x20688]
mov r8d, 0xa
call fcn.14000ea10
lea rcx, [rsp + 0x42]
mov edx, 0x104
lea r8, [0x14001baec]
mov r9, rax
call fcn.14000e950
jmp 0x14000b679
mov ecx, edi
lea rdx, [rsp + 0x20688]
mov r8d, 0xa
call fcn.14000ea10
lea rcx, [rsp + 0x42]
mov edx, 0x104
lea r8, [0x14001bcb8]
mov r9, rax
call fcn.14000e950
jmp 0x14000b679
mov ecx, edi
lea rdx, [rsp + 0x20688]
mov r8d, 0xa
call fcn.14000ea10
lea rcx, [rsp + 0x42]
mov edx, 0x104
lea r8, [0x14001bc56]
mov r9, rax
call fcn.14000e950
jmp 0x14000b679
mov ecx, edi
lea rdx, [rsp + 0x20688]
mov r8d, 0xa
call fcn.14000ea10
lea rcx, [rsp + 0x42]
mov edx, 0x104
lea r8, [0x14001bc00]
mov r9, rax
call fcn.14000e950
jmp 0x14000b679
mov ecx, edi
lea rdx, [rsp + 0x20688]
mov r8d, 0xa
call fcn.14000ea10
lea rcx, [rsp + 0x42]
mov edx, 0x104
lea r8, [0x14001bb9e]
mov r9, rax
call fcn.14000e950
jmp 0x14000b679
mov ecx, edi
lea rdx, [rsp + 0x20688]
mov r8d, 0xa
call fcn.14000ea10
lea rcx, [rsp + 0x42]
mov edx, 0x104
lea r8, [0x14001bb46]
mov r9, rax
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfbe
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x42]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x208d8], 0
mov qword [rsp + 0x208d0], 0
mov qword [rsp + 0x208c8], 0
mov qword [rsp + 0x208c0], 0
mov qword [rsp + 0x208b8], 0
lea rax, [rsp + 0x208d8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x208b8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x208c0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x208c8]
mov qword [rsp + 0x20], rax
mov rcx, qword [0x140022000]
mov edx, 6
mov r8d, 0x1f
lea r9, [rsp + 0x208d0]
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
je 0x14000b8b5
lea rax, [rsp + 0x208d8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x208b8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [0x140022000]
mov edx, 6
mov r8d, 8
xor r9, r9
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
mov esi, eax
test esi, esi
je 0x14000b8b5
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x20278]
mov qword [rsp + 0x20], rax
mov ecx, 0x1200
xor edx, edx
mov r8d, esi
mov r9d, 0x400
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov ecx, esi
lea rdx, [rsp + 0x20688]
mov r8d, 0xa
call fcn.14000ea10
lea rdx, [rsp + 0x20278]
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x42]
mov edx, 0x104
lea r8, str.Security_flags:__Error:__ls___ls
mov r9, rax
call fcn.14000e950
mov ecx, esi
lea rdx, [rsp + 0x20688]
mov r8d, 0xa
call fcn.14000ea10
lea rdx, [rsp + 0x20278]
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x20480]
mov edx, 0x104
lea r8, str.SDDL:__Error:__ls___ls
mov r9, rax
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfb8
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x42]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, rbx
mov edx, 0xfbf
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x20480]
call qword [sym.imp.USER32.dll_SetWindowTextW]
cmp dword [0x140022040], 0
je 0x14000b8ae
mov rcx, rbx
mov edx, 0xfb8
mov r8d, 0x273e
lea r9, [rsp + 0x20278]
call fcn.1400089d0
mov rcx, rbx
mov edx, 0xfbf
mov r8d, 0x273e
lea r9, [rsp + 0x20278]
call fcn.1400089d0
xor eax, eax
jmp 0x14000baea
mov rcx, qword [rsp + 0x208b8]
call qword [sym.imp.ADVAPI32.dll_IsValidAcl]
test eax, eax
je 0x14000b8e3
mov rcx, rbx
mov edx, 0xfb9
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rsp + 0x208c0]
call qword [sym.imp.ADVAPI32.dll_IsValidAcl]
test eax, eax
je 0x14000b911
mov rcx, rbx
mov edx, 0xfba
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
mov qword [rsp + 0x208b0], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x208d8]
mov edx, 1
mov r8d, 0x1f
lea r9, [rsp + 0x208b0]
call qword [sym.imp.ADVAPI32.dll_ConvertSecurityDescriptorToStringSecurityDescriptorW]
test eax, eax
je 0x14000b8ae
cmp qword [rsp + 0x208d8], 0
je 0x14000b97a
lea rcx, [rsp + 0x42]
mov edx, 0xffff
lea r8, [0x14001ba5c]
mov r9, qword [rsp + 0x208b0]
call fcn.14000e950
jmp 0x14000b990
lea rcx, [rsp + 0x42]
mov edx, 0x104
lea r8, str.SDDL:
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfbf
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x42]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov word [rsp + 0x208ee], 0
mov rcx, qword [rsp + 0x208d8]
lea rdx, [rsp + 0x208ee]
lea r8, [rsp + 0x208e4]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
jne 0x14000b9eb
mov rcx, qword [rsp + 0x208d8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000b8ae
mov rcx, qword [rsp + 0x208d8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov si, word [rsp + 0x208ee]
cmp si, 0x8010
je 0x14000ba45
cmp si, 0x8014
je 0x14000ba62
cmp si, 0x8010
jb 0x14000ba9a
cmp si, 0x8810
je 0x14000ba7f
cmp si, 0x8814
jne 0x14000ba9a
mov rcx, rbx
mov edx, 0xfb8
mov r8d, 0x2737
lea r9, [rsp + 0x20278]
call fcn.1400089d0
jmp 0x14000ba9a
mov rcx, rbx
mov edx, 0xfb8
mov r8d, 0x2735
lea r9, [rsp + 0x20278]
call fcn.1400089d0
jmp 0x14000ba9a
mov rcx, rbx
mov edx, 0xfb8
mov r8d, 0x2740
lea r9, [rsp + 0x20278]
call fcn.1400089d0
jmp 0x14000ba9a
mov rcx, rbx
mov edx, 0xfb8
mov r8d, 0x2736
lea r9, [rsp + 0x20278]
call fcn.1400089d0
movzx ecx, si
lea rdx, [rsp + 0x20688]
mov r8d, 0x10
call fcn.14000ea10
lea rcx, [rsp + 0x42]
mov edx, 0x104
lea r8, str.Security_flags:_0x_ls
mov r9, rax
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfb8
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x42]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 1
add rsp, 0x208f0
pop rdi
pop rsi
pop rbx
ret