Function at 0x180004c00
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push r13
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov r13, rdx
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x60], rax
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x180004c3e
add rsp, 0x110
pop r14
pop r13
pop rbp
ret
mov ecx, 0x130
mov qword [rsp + 0x130], rbx
call main
mov rbx, rax
test rax, rax
je 0x180004c6b
lea rcx, [rax + 4]
xor edx, edx
mov r8d, 0x12c
call sub.msvcrt.dll_memset
jmp 0x180004c6d
xor ebx, ebx
lea rcx, [rbx + 4]
xor edx, edx
mov r8d, 0x12c
call sub.msvcrt.dll_memset
mov rdx, rbx
mov dword [rbx], 0x130
mov rcx, r14
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x180004cb3
mov edx, 0x130
mov rcx, rbx
call fcn.180011174
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x180005027
mov qword [rsp + 0x108], rsi
mov qword [rsp + 0x100], rdi
mov edi, 0x1000
mov qword [rsp + 0xf8], r12
mov qword [rsp + 0xf0], r15
mov r15d, dword [rbp + 0x48]
nop dword [rax]
mov rcx, qword [0x18001c158]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov r8d, dword [rbx + 8]
mov ecx, 0x400
cmp al, 6
cmovae ecx, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, 0x400
mov rsi, rax
call sub.msvcrt.dll_malloc
xor r12b, r12b
mov rdi, rax
test rsi, rsi
je 0x180004f7e
xor eax, eax
lea r8, str.kernel
xor r15d, r15d
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
mov dword [rbp + 0x40], r15d
mov qword [rsp + 0x78], rax
lea edx, [rax + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
call fcn.18000cfc0
lea r8, [0x180012b14]
lea edx, [r15 + 0x40]
lea rcx, [rsp + 0x70]
call fcn.18000cfc0
xor eax, eax
lea r8, [0x180012b24]
lea rcx, [rsp + 0x70]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
lea edx, [rax + 0x40]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
call fcn.18000cfc0
lea r8, [0x180012b28]
lea edx, [r15 + 0x40]
lea rcx, [rsp + 0x70]
call fcn.18000cfc0
lea r8, [0x180012b18]
lea edx, [r15 + 0x40]
lea rcx, [rsp + 0x70]
call fcn.18000cfc0
lea r8, str.Process
lea edx, [r15 + 0x40]
lea rcx, [rsp + 0x70]
call fcn.18000cfc0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180004e12
lea rdx, [rbp + 0x40]
mov rcx, rsi
call rax
test eax, eax
je 0x180004e1a
cmp dword [rbp + 0x40], 1
sete r12b
mov ecx, dword [rbx + 8]
lea rdx, [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov eax, dword [rsp + 0x44]
xor edx, edx
mov r8d, 0x400
mov dword [rbp + 0x48], eax
mov rcx, rdi
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x50]
mov edx, 8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, 1
jne 0x180004f7a
mov ecx, 0x200
mov dword [rbp + 0x40], 0x200
mov dword [rsp + 0x40], 0x200
mov dword [rsp + 0x48], r15d
call sub.msvcrt.dll_malloc
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
mov r14, rax
call sub.msvcrt.dll_memset
mov ecx, dword [rbp + 0x40]
call sub.msvcrt.dll_malloc
mov r8d, dword [rbp + 0x40]
xor edx, edx
mov rcx, rax
mov r15, rax
call sub.msvcrt.dll_memset
mov ecx, 0x1000
call sub.msvcrt.dll_malloc
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
mov r13, rax
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov r9d, 0x1000
mov qword [rsp + 0x20], rax
mov r8, r13
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, 1
jne 0x180004f4e
mov rdx, qword [r13]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
lea rax, [rbp + 0x40]
mov r8, r14
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
cmp eax, 1
jne 0x180004f4e
mov r8, r14
mov edx, 0x400
mov rcx, rdi
call fcn.18000cfc0
lea r8, [0x180012b38]
mov edx, 0x400
mov rcx, rdi
call fcn.18000cfc0
mov r8, r15
mov edx, 0x400
mov rcx, rdi
call fcn.18000cfc0
mov rcx, r14
call fcn.180009e3a
mov rcx, r15
call fcn.180009e3a
mov rcx, r13
call fcn.180009e3a
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x60]
mov r13, qword [rbp + 0x38]
mov r15d, dword [rbp + 0x48]
mov r10, qword [r13]
lea rax, [rbx + 0x2c]
mov r9d, dword [rbx + 8]
test rsi, rsi
mov qword [rsp + 0x38], rdi
mov r8d, r15d
mov qword [rsp + 0x30], rax
setne dl
mov eax, dword [rbx + 0x20]
mov rcx, r13
mov byte [rsp + 0x28], r12b
mov dword [rsp + 0x20], eax
call qword [r10]
mov rcx, rdi
call fcn.180009e3a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 4]
xor edx, edx
mov r8d, 0x12c
call sub.msvcrt.dll_memset
mov rdx, rbx
mov dword [rbx], 0x130
mov rcx, r14
call sub.KERNEL32.dll_Process32Next
mov edi, 0x1000
test eax, eax
jne 0x180004ce0
mov edx, 0x130
mov rcx, rbx
call fcn.180011174
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0xf0]
xor eax, eax
mov r12, qword [rsp + 0xf8]
mov rdi, qword [rsp + 0x100]
mov rsi, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x130]
add rsp, 0x110
pop r14
pop r13
pop rbp
ret