Function at 0x14001ca38
Capabilities:
Acquire debug privileges
Enumerate processes
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x20], r9d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3f0
xor ebx, ebx
movaps xmmword [rax - 0x48], xmm6
mov rbp, r8
mov eax, r9d
mov edi, edx
mov r15, rcx
cmp edx, ebx
jne 0x14001ca84
cmp r8, rbx
jne 0x14001ca84
cmp eax, ebx
jne 0x14001ca84
cmp dword [rsp + 0x450], ebx
jne 0x14001ca84
call fcn.140011d5c
mov r15, rax
mov eax, edi
mov r12d, edi
mov r13d, edi
mov r14d, edi
and eax, 0x10000
and edi, 1
and r12d, 2
and r13d, 0x10
mov dword [rsp + 0x440], eax
and r14d, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x438], eax
cmp qword [0x1400f1d78], rbx
jne 0x14001cae4
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400f1d78], rax
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11b, byte [0x1400f2ccc]
test r11b, 4
jne 0x14001cb1f
cmp rbp, rbx
je 0x14001cb1f
or r11b, 8
lea rcx, str.SeDebugPrivilege
mov edx, 2
mov byte [0x1400f2ccc], r11b
call fcn.140016130
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x78]
mov edx, 0x46e7
mov esi, ebx
call fcn.14004bedc
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x60], rax
add rax, 0xa0
xor ecx, ecx
mov qword [rsp + 0x88], rax
add rax, 0x64
lea r8d, [rcx + 0x24]
lea rbx, [rax + 0x8c]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbx + 0xc1e]
lea rdx, [rbx + 0x80a]
mov word [rax], cx
mov word [rbx + 0x80a], cx
mov qword [rsp + 0x50], rax
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rcx, [rbx + 0x80a]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rax, [rbx + rcx*2 + 0x80a]
mov qword [rsp + 0x98], rax
xor eax, eax
cmp rbp, rax
je 0x14001cc79
lea r8d, [rax + 0x1c]
lea rcx, [rsp + 0xc4]
xor edx, edx
mov dword [rsp + 0xc0], eax
call fcn.1400b93b0
lea rcx, [rsp + 0x174]
xor edx, edx
mov r8d, 0x134
call fcn.1400b93b0
mov ebx, 0x138
lea rcx, [rsp + 0x2a8]
mov r8, rbx
xor edx, edx
call fcn.1400b93b0
xor eax, eax
cmp byte [0x1400ef008], 1
mov qword [rsp + 0x170], rax
mov eax, 0x270
lea rdx, [rsp + 0xc0]
cmove ebx, eax
xor r9d, r9d
lea r8d, [r9 + 0x20]
lea ecx, [r9 + 3]
call qword [0x1400f1d78]
xor r9d, r9d
lea rdx, [rsp + 0x170]
lea ecx, [r9 + 2]
mov r8d, ebx
call qword [0x1400f1d78]
mov rbx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x170]
mov rcx, rbx
call fcn.1400a9350
mov rdx, qword [rsp + 0xc8]
lea rcx, [rbx + 0xa0]
call fcn.1400a9350
xor eax, eax
jmp 0x14001cc7e
mov rbx, qword [rsp + 0x60]
cmp edi, eax
jne 0x14001cd6f
cmp word [r15], ax
jne 0x14001cd6f
mov rdx, rbx
mov rcx, rbp
call fcn.1400589a0
lea rdx, [0x1400df1e0]
mov rcx, rbp
call fcn.14004bfa8
lea rdx, [rbx + 0xa0]
mov rcx, rbp
call fcn.14004bfa8
mov r11b, byte [0x1400f190f]
xor eax, eax
cmp r11b, al
ja 0x14001ccd3
call fcn.140005084
mov r11b, byte [0x1400f190f]
lea rdx, str._t_d_t
lea rcx, [rsp + 0xf0]
movzx r8d, r11b
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0xf0]
mov rcx, rbp
call fcn.14004bfa8
mov rdx, qword [0x1400f1a08]
lea rcx, [rsp + 0xf0]
call fcn.1400a9350
lea rdx, [rsp + 0xf0]
mov rcx, rbp
call fcn.14004bfa8
lea rcx, [rsp + 0x40]
movsd xmm6, qword [0x1400d9260]
pxor xmm5, xmm5
cvtsi2sd xmm5, qword [0x1400f1a08]
divsd xmm6, xmm5
call fcn.14004be6c
lea r8, str._t_lf
lea rcx, [rsp + 0x40]
movapd xmm1, xmm6
call fcn.1400a92a8
mov rdx, qword [rsp + 0x40]
mov rcx, rbp
call fcn.14004bfa8
lea rcx, [rsp + 0x40]
call fcn.140044f24
mov rcx, r15
call fcn.1400b9a24
mov edx, dword [rsp + 0x450]
mov ecx, 2
mov rbx, rax
mov qword [rsp + 0x40], rax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rcx, rsi
cmp rax, 0xffffffffffffffff
lea rdx, [rsp + 0x170]
cmove rax, rcx
movsxd rcx, ebx
mov dword [rsp + 0x170], 0x238
mov qword [rsp + 0x80], rcx
movsxd rcx, r12d
movsxd r12, edi
movsxd rdi, r13d
mov qword [rsp + 0x90], rcx
movsxd r13, r14d
mov rcx, rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x68], rdi
call sub.KERNEL32.dll_Process32FirstW
xor edx, edx
cmp eax, edx
je 0x14001ceec
mov r14d, dword [rsp + 0x440]
mov eax, dword [rsp + 0x448]
cmp eax, edx
je 0x14001ce16
cmp eax, dword [rsp + 0x190]
jne 0x14001d2ae
mov ecx, dword [rsp + 0x450]
mov eax, dword [rsp + 0x178]
cmp ecx, edx
je 0x14001ce30
cmp ecx, eax
jne 0x14001d2ae
cmp r13, rdx
jne 0x14001cf34
cmp qword [rsp + 0x90], rdx
je 0x14001d08b
cmp r12, rdx
je 0x14001ce79
cmp ebx, edx
je 0x14001d109
lea rcx, [rsp + 0x19c]
mov r9d, r14d
mov r8d, ebx
mov rdx, r15
call fcn.14001446c
xor edx, edx
cmp al, dl
je 0x14001d2ae
jmp 0x14001d102
cmp ebx, edx
jne 0x14001ce90
cmp word [rsp + 0x19c], dx
jne 0x14001d2ae
jmp 0x14001cf34
cmp r14d, edx
jne 0x14001ceac
lea rcx, [rsp + 0x19c]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edx, edx
cmp eax, edx
je 0x14001cec7
lea rcx, [rsp + 0x19c]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
xor edx, edx
cmp eax, edx
jne 0x14001d2ae
cmp rbp, rdx
jne 0x14001cf2b
cmp rdi, rdx
je 0x14001cee5
mov eax, dword [rsp + 0x438]
cmp eax, dword [rsp + 0x178]
je 0x14001d2ae
mov esi, dword [rsp + 0x178]
mov rax, qword [rsp + 0x70]
cmp rax, rdx
je 0x14001ceff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x78]
call fcn.140044f24
lea r11, [rsp + 0x3f0]
mov eax, esi
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [rsp + 0x178]
inc esi
mov rbx, rdx
mov r12d, edx
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r13d, r13d
mov rdi, rax
cmp rax, r13
je 0x14001d015
lea r8, [0x1400f1ba8]
lea rdx, str.PSAPI.DLL
lea rcx, str.GetProcessMemoryInfo
xor r9d, r9d
call fcn.140046024
lea r12d, [r13 + 0x48]
lea r8d, [r13 + 0x40]
lea rcx, [rsp + 0xf8]
xor edx, edx
mov dword [rsp + 0xf0], r12d
mov dword [rsp + 0xf4], r13d
call fcn.1400b93b0
mov r11, qword [0x1400f1ba8]
cmp r11, r13
je 0x14001cfba
lea rdx, [rsp + 0xf0]
mov r8d, r12d
mov rcx, rdi
call r11
mov r12, qword [rsp + 0x100]
lea rax, [rsp + 0xb0]
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0xe0]
mov rcx, rdi
shr r12, 0xa
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
cmp eax, r13d
je 0x14001d00c
mov rcx, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa8]
add rbx, rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x178]
add r13, 0xaa0
mov rdx, r13
mov rdi, r13
call fcn.140005110
mov ecx, 0x5c
cmp cx, word [r13]
jne 0x14001d12b
lea eax, [rcx - 0x1d]
cmp ax, word [r13 + 2]
jne 0x14001d12b
cmp ax, word [r13 + 4]
jne 0x14001d12b
cmp cx, word [r13 + 6]
jne 0x14001d12b
xor ecx, ecx
cmp word [r13 + 8], cx
je 0x14001d12b
lea ecx, [rax - 5]
cmp cx, word [r13 + 0xa]
jne 0x14001d12b
lea rdi, [r13 + 8]
jmp 0x14001d165
cmp r12, rdx
je 0x14001d0b0
cmp ebx, edx
je 0x14001d109
lea rcx, [rsp + 0x19c]
mov r9d, r14d
mov r8d, ebx
mov rdx, r15
call fcn.14001446c
xor edx, edx
cmp al, dl
jne 0x14001d102
cmp ebx, edx
je 0x14001d2ae
lea rcx, [rsp + 0x19c]
mov r9d, r14d
mov r8d, ebx
mov rdx, r15
call fcn.14001446c
xor edx, edx
cmp al, dl
je 0x14001d2ae
cmp r12, rdx
jne 0x14001d2ae
mov rax, qword [rsp + 0x80]
movzx eax, word [rsp + rax*2 + 0x19c]
cmp ax, dx
je 0x14001d102
lea ecx, [rdx + 0x2e]
cmp cx, ax
jne 0x14001d2ae
mov eax, dword [rsp + 0x178]
cmp rbp, rdx
jne 0x14001cf32
cmp rdi, rdx
je 0x14001d124
cmp dword [rsp + 0x438], eax
je 0x14001d2ae
mov esi, eax
jmp 0x14001ceec
lea rcx, str.SystemRoot_
mov r8d, 0xc
mov rdx, r13
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
xor ecx, ecx
cmp eax, ecx
jne 0x14001d165
mov rcx, qword [rsp + 0x98]
lea rdx, [r13 + 0x16]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdi, qword [rsp + 0x48]
add rdi, 0x896
mov r13, qword [rsp + 0xa0]
xor eax, eax
cmp r13, rax
je 0x14001d1cf
cmp r14d, eax
jne 0x14001d18b
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edx, edx
cmp eax, edx
je 0x14001d1a1
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
xor edx, edx
cmp eax, edx
jne 0x14001d29f
cmp rbp, rdx
jne 0x14001d1cd
mov rdi, qword [rsp + 0x68]
cmp rdi, rdx
je 0x14001cee5
mov eax, dword [rsp + 0x438]
cmp eax, dword [rsp + 0x178]
jne 0x14001cee5
jmp 0x14001d2a4
inc esi
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x178]
mov r8d, 0x8000
call fcn.140008368
mov rax, qword [rsp + 0x50]
xor ecx, ecx
mov word [rax + 0x8000], cx
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
call fcn.1400a9350
mov rcx, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x178]
mov r11, qword [rsp + 0x60]
mov r9d, dword [rsp + 0x190]
xor eax, eax
cmp r8d, eax
mov rax, qword [rsp + 0x88]
lea rbx, [rcx + 0x8c]
cmovne r11, rcx
mov qword [rsp + 0x30], rax
lea rdx, str._lu_t_lu_t_lu_t_s_t_s_t
mov qword [rsp + 0x28], r11
mov rcx, rbx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_wsprintfW]
mov r11, qword [rbp]
xor eax, eax
cmp word [r11], ax
je 0x14001d26d
lea rdx, [0x1400d91e8]
mov rcx, rbp
call fcn.14004bfa8
mov rdx, rbx
mov rcx, rbp
call fcn.14004bfa8
mov rdx, rdi
mov rcx, rbp
call fcn.14004bfa8
lea rdx, [0x1400df1e0]
mov rcx, rbp
call fcn.14004bfa8
mov rdx, qword [rsp + 0x50]
mov rcx, rbp
call fcn.14004bfa8
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x170]
call sub.KERNEL32.dll_Process32NextW
xor edx, edx
cmp eax, edx
je 0x14001ceec
jmp 0x14001cdfe