Function at 0x140019380
Capabilities:
Enumerate processes
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
movups xmm0, xmmword [str.explorer.exe]
lea rcx, [rsp + 0x4a]
xor eax, eax
movsd xmm1, qword [0x140064cd0]
xor edx, edx
mov qword [rbp + 0x160], rax
mov r8d, 0x1ee
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x170], rax
movzx eax, word [0x140064cd8]
mov word [rsp + 0x48], ax
mov dword [rbp + 0x15c], 0x104
mov dword [rbp + 0x160], 0x18
movaps xmmword [rsp + 0x30], xmm0
movsd qword [rsp + 0x40], xmm1
call fcn.140026cc0
xor esi, esi
mov dword [rbp + 0x180], 0x238
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
xor edx, edx
lea ecx, [rsi + 2]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0x180]
mov dword [rbp + 0x158], esi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x1400194d0
lea rdx, [rbp + 0x180]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x1400194d0
nop dword [rax + rax]
lea rax, [rbp + 0x1ac]
lea r8, [rsp + 0x30]
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140019494
add rax, 2
test ecx, ecx
jne 0x140019480
test edx, edx
jne 0x1400194b3
mov ecx, dword [rbp + 0x188]
lea rdx, [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp dword [rbp + 0x158], edi
je 0x1400194ca
lea rdx, [rbp + 0x180]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140019470
jmp 0x1400194d0
mov esi, dword [rbp + 0x188]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x14001951a
lea rdx, str.not_found_winlogon
lea rcx, [0x140077e88]
call fcn.1400042c0
xor al, al
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.140023e40
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov r8d, esi
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x1400194f0
lea r8, [rbp + 0x148]
mov edx, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140019551
lea rdx, str.OpenProcessToken_fail
jmp 0x1400194e4
mov rcx, qword [rbp + 0x148]
lea rax, [rbp + 0x140]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x160]
mov r9d, 1
mov dword [rsp + 0x20], 1
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1400194f0
mov rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x150]
mov r8d, 1
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x1400195cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.WTSQueryUserToken__lx
lea rcx, [0x140077e88]
call fcn.1400042c0
jmp 0x1400194f0
mov rcx, qword [rbp + 0x140]
lea r8, [rbp + 0x15c]
lea rdx, [0x140077120]
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x14001960b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.GetUserProfileDirectory__lx
lea rcx, [0x140077e88]
call fcn.1400042c0
jmp 0x1400194f0
mov al, 1
jmp 0x1400194f2