Function at 0x1400011a0
Capabilities:
Enumerate processes
Enumerate threads
Get process image filename

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r14
push r15
sub rsp, 0x4d0
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
xor edx, edx
mov r15, rcx
xor r14d, r14d
mov qword [rsp + 0x30], r14
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000147e
mov qword [rsp + 0x4f8], rbp
lea rdx, [rsp + 0x70]
mov rcx, rax
mov qword [rsp + 0x500], rdi
mov dword [rsp + 0x70], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000142d
nop dword [rax]
nop dword [rax + rax]
lea rdx, str.RobloxPlayerBeta.exe
lea rcx, [rsp + 0x9c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140001250
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001220
jmp 0x140001463
mov edi, dword [rsp + 0x78]
xor edx, edx
mov r8d, edi
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x14000141e
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400013dd
mov r8d, 0x104
mov dword [rsp + 0x58], 4
lea rdx, [rsp + 0x2b0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x1400012e1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.The_process_name_for_the_elevated_thread_is:
call fcn.140001a30
mov rcx, rax
lea rdx, [rsp + 0x2b0]
call fcn.140001a30
mov rcx, rax
lea rdx, [0x140001c10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r14
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14000138e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001463
xorps xmm0, xmm0
mov dword [rsp + 0x38], 0x1c
xor eax, eax
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x4c], rax
movups xmmword [rsp + 0x3c], xmm0
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x140001380
cmp dword [rsp + 0x44], edi
je 0x14000137b
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140001355
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001463
mov r14d, dword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001463
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_enable_all_privileges_for_the_process_token._Error:
mov ebx, eax
call fcn.140001c50
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001463
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_open_process_token._Error:
mov ebx, eax
call fcn.140001c50
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001463
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_open_target_process._Error:
jmp 0x14000143a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Process32First_failed._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov ebx, eax
call fcn.140001c50
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x500]
mov rbp, qword [rsp + 0x4f8]
jmp 0x1400014b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.CreateToolhelp32Snapshot_failed._Error:
mov ebx, eax
call fcn.140001c50
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x30]
mov rax, r15
mov qword [r15 + 8], rcx
mov dword [r15], r14d
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.140001eb0
mov rbx, qword [rsp + 0x508]
add rsp, 0x4d0
pop r15
pop r14
pop rsi
ret