Function at 0x14000b4a0
Capabilities:
Enumerate processes
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x428
mov rax, qword [0x140051088]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xc0], 0
mov dword [rsp + 0xbc], 0xffffffff
xor edi, edi
lea rcx, [rsp + 0x2f0]
mov r8d, 0x130
xor edx, edx
call fcn.140022fe0
call fcn.140020ce0
test rax, rax
je 0x14000bc4e
mov r13, rax
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x14000bbe8
mov r12, rax
mov dword [rsp + 0x2f0], 0x130
lea rdx, [rsp + 0x2f0]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14000bc36
xorpd xmm0, xmm0
movapd xmmword [rsp + 0xa0], xmm0
movapd xmmword [rsp + 0x90], xmm0
movapd xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x80]
mov word [rsp + 0x4e], ax
lea rax, [0x14004a572]
lea rbx, [rsp + 0xbc]
mov rsi, qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov r14, qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r15, [rsp + 0xc0]
lea rbp, [rsp + 0x1e0]
mov qword [rsp + 0x60], rax
mov ecx, dword [rsp + 0x2f8]
mov rdx, rbx
call rsi
mov r8d, dword [rsp + 0x2f8]
mov ecx, 0x400
xor edx, edx
call r14
mov rsi, rax
test rax, rax
je 0x14000b8d0
lea rdi, [0x14004a4a3]
cmp word [rsp + 0x4e], 9
jne 0x14000b623
mov byte [rsp + 0x7f], 0
mov rcx, rsi
lea rdx, [rsp + 0x7f]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp byte [rsp + 0x7f], 0
lea rdi, [0x14004a4a3]
lea rcx, [0x14004a4b9]
cmove rdi, rcx
test eax, eax
je 0x14000b8d0
mov rcx, rsi
mov edx, 8
lea r8, [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000b8f3
mov r14, rdi
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0x20], r15
mov edx, 0x12
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000bc36
mov rbx, qword [rsp + 0xc0]
mov edx, 1
mov rcx, rbx
call fcn.14002c370
test rax, rax
je 0x14000bc36
mov rdi, rax
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0x20], r15
mov edx, 0x12
mov r8, rax
mov r9d, ebx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14000bc29
mov eax, dword [rdi]
add eax, 0xffffffff
cmp eax, 2
ja 0x14000b6d4
cdqe
lea rcx, str.default
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0x20], r15
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov qword [rsp + 0x50], rdi
jne 0x14000b913
mov qword [rsp + 0x58], rsi
mov rbx, qword [rsp + 0xc0]
mov edx, 1
mov rcx, rbx
call fcn.14002c370
test rax, rax
lea rsi, [rsp + 0xd0]
je 0x14000bc2e
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0x20], r15
mov edx, 1
mov r8, rax
mov r9d, ebx
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
mov qword [rsp + 0x40], rdi
je 0x14000b92c
mov r8d, 0x104
mov rcx, rbp
xor edx, edx
call fcn.140022fe0
mov qword [rsp + 0x70], 0x104
mov r8d, 0x104
mov rcx, rsi
xor edx, edx
call fcn.140022fe0
mov qword [rsp + 0x68], 0x104
mov rdx, qword [rdi]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor ecx, ecx
mov r8, rbp
lea r9, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
je 0x14000b92c
mov qword [rsp + 0x20], rbp
xor ecx, ecx
xor edx, edx
lea rdi, str._s__s
mov r8, rdi
mov r9, rsi
call fcn.140006640
add eax, 1
movsxd rbx, eax
mov qword [rsp + 0xc0], rbx
mov edx, 1
mov rcx, rbx
call fcn.14002c370
test rax, rax
je 0x14000bc93
mov rcx, rbp
mov rbp, rax
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call fcn.140006640
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0x20], r15
mov edx, 0x19
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000b937
mov rsi, qword [rsp + 0xc0]
mov edx, 1
mov rcx, rsi
call fcn.14002c370
test rax, rax
je 0x14000bca9
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0x20], r15
mov edx, 0x19
mov r8, rax
mov r9d, esi
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
mov qword [rsp + 0x38], rsi
je 0x14000b93e
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov eax, dword [rax]
cmp eax, 0x1000
mov rsi, qword [rsp + 0x58]
mov rdi, r14
jae 0x14000bb80
lea r15, str.Untrusted
jmp 0x14000b94d
xor eax, eax
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x40], rax
xor ebp, ebp
lea rdi, [0x14004a572]
mov r15, rdi
jmp 0x14000b94d
xor eax, eax
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x40], rax
xor ebp, ebp
lea r15, [0x14004a572]
jmp 0x14000b94d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x40], rax
xor ebp, ebp
lea r15, [0x14004a572]
jmp 0x14000b94a
xor eax, eax
mov qword [rsp + 0x38], rax
xor ebp, ebp
jmp 0x14000b93e
xor eax, eax
mov qword [rsp + 0x38], rax
lea r15, [0x14004a572]
mov rsi, qword [rsp + 0x58]
mov rdi, r14
call fcn.140020ca0
test rax, rax
je 0x14000bbf9
mov r14, rax
lea rcx, [rsp + 0x31c]
call fcn.140020c10
test rax, rax
je 0x14000bbf9
mov rcx, r14
lea rdx, [0x14004a34c]
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x14000bbf9
mov eax, dword [rsp + 0x2f8]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
call fcn.140020b90
test rax, rax
je 0x14000bbf9
mov rcx, r14
lea rdx, [0x14004a3bf]
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x14000bbf9
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [rsp + 0xbc]
call fcn.140020b90
test rax, rax
je 0x14000bbf9
mov rcx, r14
lea rdx, str.session
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x14000bbf9
mov rcx, r15
call fcn.140020c10
test rax, rax
je 0x14000bbf9
mov rcx, r14
lea rdx, str.integrity
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x14000bbf9
mov rcx, qword [rsp + 0x60]
call fcn.140020c10
test rax, rax
je 0x14000bbf9
mov rcx, r14
lea rdx, str.elevated
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x14000bbf9
mov rcx, rdi
call fcn.140020c10
test rax, rax
je 0x14000bbf9
mov rcx, r14
lea rdx, str.arch
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x14000bbf9
test rbp, rbp
mov rcx, rbp
lea rax, [0x14004a572]
cmove rcx, rax
call fcn.140020c10
test rax, rax
je 0x14000bbf9
mov rcx, r14
lea rdx, str.account
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x14000bbf9
mov rcx, r13
mov rdx, r14
call fcn.140020a60
test eax, eax
je 0x14000bbf9
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x14000badb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
lea rbx, [rsp + 0xbc]
mov rcx, rsi
mov rsi, qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov r14, qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r15, [rsp + 0xc0]
mov rdi, qword [rsp + 0x50]
je 0x14000bb0c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xc8], 0
test rbp, rbp
je 0x14000bb25
mov rcx, rbp
call fcn.14002c850
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000bb34
call fcn.14002c850
mov rcx, qword [rsp + 0x38]
test rcx, rcx
lea rbp, [rsp + 0x1e0]
je 0x14000bb4b
call fcn.14002c850
test rdi, rdi
je 0x14000bb58
mov rcx, rdi
call fcn.14002c850
mov dword [rsp + 0xbc], 0xffffffff
mov rcx, r12
lea rdx, [rsp + 0x2f0]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000b5b8
jmp 0x14000bc75
cmp eax, 0x2000
jae 0x14000bb93
lea r15, [0x14004a10d]
jmp 0x14000b94d
cmp eax, 0x2100
jae 0x14000bba6
lea r15, [0x14004a293]
jmp 0x14000b94d
cmp eax, 0x3000
jae 0x14000bbb9
lea r15, str.Medium
jmp 0x14000b94d
cmp eax, 0x4000
jae 0x14000bbcc
lea r15, str.High
jmp 0x14000b94d
cmp eax, 0x5000
lea r15, str.Protected
lea rax, str.System
cmovb r15, rax
jmp 0x14000b94d
mov rcx, r13
call fcn.14001f3e0
mov r12, 0xffffffffffffffff
jmp 0x14000bc43
test rbp, rbp
je 0x14000bc06
mov rcx, rbp
call fcn.14002c850
mov rcx, qword [rsp + 0x40]
test rcx, rcx
mov rdi, qword [rsp + 0x50]
je 0x14000bc1a
call fcn.14002c850
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000bc29
call fcn.14002c850
test rdi, rdi
je 0x14000bc36
mov rcx, rdi
call fcn.14002c850
mov rcx, r13
call fcn.14001f3e0
test r12, r12
je 0x14000bc4c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.140021820
mov rax, rdi
add rsp, 0x428
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call fcn.14001ffc0
mov rdi, rax
mov rcx, r13
call fcn.14001f3e0
jmp 0x14000bc4e
xor eax, eax
mov qword [rsp + 0x38], rax
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
jmp 0x14000bc15
xor eax, eax
mov qword [rsp + 0x38], rax
jmp 0x14000bbfe