Function at 0x140039d80
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xab0
mov rax, qword [0x1400bdbf0]
xor rax, rsp
mov qword [rsp + 0xaa0], rax
mov qword [rsp + 0x278], 0
mov qword [rsp + 0x270], 0
mov dword [rsp + 0x280], 0
mov dword [rsp + 0x284], 0
mov dword [rsp + CPropertySet::GetByteOrder], 0
xor eax, eax
mov word [rsp + 0x290], ax
lea rdi, [rsp + 0x292]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0x288], 0
mov dword [rsp + 0x30], reloc.mfc90u.dll_CSemaphore::CSemaphore
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.14003da00
test eax, eax
je 0x140039e4f
cmp dword [rsp + 0xad0], 1
jne 0x140039e4f
lea r8, str.winlogon.exe
mov edx, CDHtmlElementEventSink::AddRef
lea rcx, [rsp + 0x290]
call entry0
jmp 0x140039e68
lea r8, str.explorer.exe
mov edx, CDHtmlElementEventSink::AddRef
lea rcx, [rsp + 0x290]
call entry0
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x278], rax
cmp qword [rsp + 0x278], 0xffffffffffffffff
jne 0x140039e9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x284], eax
jmp 0x140039ffb
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x278]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x140039ecb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x284], eax
jmp 0x140039ffb
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.MSVCR90.dll__wcsicmp]
test eax, eax
jne 0x140039f27
mov dword [rsp + CPropertySet::GetByteOrder], 0
lea rdx, [rsp + 0xa94]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov eax, dword [rsp + 0xa94]
cmp dword [rsp + 0xac8], eax
jne 0x140039f27
mov eax, dword [rsp + 0x38]
mov dword [rsp + COleSafeArray::GetByteArray], eax
mov dword [rsp + 0x288], 1
jmp 0x140039f3d
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x278]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140039ecb
cmp dword [rsp + 0x288], 0
jne 0x140039f87
xor r8d, r8d
lea rdx, str..AhnSessionHelper.cpp
lea rcx, [0x1400cb7f0]
call fcn.14002d870
lea r8, [rsp + 0x290]
lea rdx, str._CAhnSessionHelper::GetSessionProcessToken__Cant_find_the_process__s_
lea rcx, [0x1400cb7f0]
call fcn.14002d9a0
mov dword [rsp + 0x284], 2
jmp 0x140039ffb
mov r8d, dword [rsp + 0xa90]
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x270], rax
cmp qword [rsp + 0x270], 0
jne 0x140039fc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x284], eax
jmp 0x140039ffb
mov r8, qword [rsp + 0xad8]
mov edx, 0x201eb
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140039ff0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x284], eax
jmp 0x140039ffb
mov dword [rsp + 0x280], 1
cmp dword [rsp + 0x284], 2
jne 0x14003a0b4
mov dword [rsp + COleServerDoc::XDataObject::GetCanonicalFormatEtc], 0
lea r8, [rsp + 0xa98]
mov edx, 2
lea rcx, str.SeTcbPrivilege
call fcn.140043b40
test eax, eax
jne 0x14003a063
xor r8d, r8d
lea rdx, str..AhnSessionHelper.cpp
lea rcx, [0x1400cb7f0]
call fcn.14002d870
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str._CAhnSessionHelper::GetSessionProcessToken__CAhnKeObjHelper::EnableNTPrivilege_SE_TCB_NAME__Failed__u_
lea rcx, [0x1400cb7f0]
call fcn.14002da20
mov r8, qword [rsp + 0xad8]
mov edx, dword [rsp + 0xac8]
mov rcx, qword [rsp + 0xac0]
call fcn.1400399d0
cmp eax, 1
jne 0x14003a09c
mov dword [rsp + 0x280], 1
mov dword [rsp + 0x284], 0
jmp 0x14003a0b4
mov dword [rsp + 0x280], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x284], eax
cmp qword [rsp + 0x270], 0
je 0x14003a0cd
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x278], 0xffffffffffffffff
je 0x14003a0e6
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x284]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x280]
mov rcx, qword [rsp + 0xaa0]
xor rcx, rsp
call fcn.14004d770
add rsp, 0xab0
pop rdi
ret