Function at 0x14005d1a0
Capabilities:
Enumerate processes

Disassembly:
push rdi
sub rsp, 0x2c0
mov rax, qword [0x1401c1050]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdi, rcx
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x14005d1d8
mov rcx, rdi
call fcn.14005cd20
test al, al
je 0x14005d88d
mov qword [rsp + 0x2d8], rbx
mov rcx, rdi
mov qword [rsp + 0x2e0], rbp
mov qword [rsp + 0x2e8], rsi
call fcn.14005d8b0
xor edx, edx
mov esi, eax
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14005d2ad
test rdi, rdi
je 0x14005d230
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Standard_user.Unable_to_get_list_of_processes._ErrorCode:__d_.
jmp 0x14005d747
cmp qword [0x1401cde08], 0
je 0x14005d284
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea r8, [0x14018bd54]
lea rax, str.In_changeThreadContextToExplorerContext._Standard_user.Unable_to_get_list_of_processes._ErrorCode:__d_.
mov ecx, 0x32
mov qword [rsp + 0x28], rax
lea rdx, str.OOBEUtils
mov rax, qword [0x1401cde08]
mov r9, r8
mov qword [rsp + 0x20], r8
lea r8, str.ProcessUtils
call qword [case.0x14004792d.0]
jmp 0x14005d873
mov rbx, qword [0x1401cde10]
test rbx, rbx
je 0x14005d873
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Standard_user.Unable_to_get_list_of_processes._ErrorCode:__d_.
jmp 0x14005d6ed
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x14005d366
test rdi, rdi
je 0x14005d2e9
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Standard_user._Unable_to_initialize_first_process._ErrorCode:__d_.
jmp 0x14005d747
cmp qword [0x1401cde08], 0
je 0x14005d33d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea r8, [0x14018bd54]
lea rax, str.In_changeThreadContextToExplorerContext._Standard_user._Unable_to_initialize_first_process._ErrorCode:__d_.
mov ecx, 0x32
mov qword [rsp + 0x28], rax
lea rdx, str.OOBEUtils
mov rax, qword [0x1401cde08]
mov r9, r8
mov qword [rsp + 0x20], r8
lea r8, str.ProcessUtils
call qword [case.0x14004792d.0]
jmp 0x14005d873
mov rbx, qword [0x1401cde10]
test rbx, rbx
je 0x14005d873
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Standard_user._Unable_to_initialize_first_process._ErrorCode:__d_.
jmp 0x14005d6ed
xor ebp, ebp
nop dword [rax + rax]
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x9c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14005d3a6
mov ecx, dword [rsp + 0x78]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], ebp
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x14005d3a6
cmp dword [rsp + 0x50], esi
je 0x14005d3cc
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14005d370
test rdi, rdi
je 0x14005d7f9
mov rax, qword [rdi]
mov rcx, rdi
jmp 0x14005d84a
mov esi, dword [rsp + 0x78]
test esi, esi
je 0x14005d3b8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14005d48f
test rdi, rdi
je 0x14005d413
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Unable_to_open_process_token._ErrorCode:__d_.
jmp 0x14005d747
cmp qword [0x1401cde08], rbp
je 0x14005d466
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea r8, [0x14018bd54]
lea rax, str.In_changeThreadContextToExplorerContext._Unable_to_open_process_token._ErrorCode:__d_.
mov ecx, 0x32
mov qword [rsp + 0x28], rax
lea rdx, str.OOBEUtils
mov rax, qword [0x1401cde08]
mov r9, r8
mov qword [rsp + 0x20], r8
lea r8, str.ProcessUtils
call qword [case.0x14004792d.0]
jmp 0x14005d873
mov rbx, qword [0x1401cde10]
test rbx, rbx
je 0x14005d873
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Unable_to_open_process_token._ErrorCode:__d_.
jmp 0x14005d6ed
lea r8, [rsp + 0x5c]
mov dword [rsp + 0x58], 1
lea rdx, str.SeIncreaseQuotaPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor edx, edx
mov dword [rsp + 0x64], 2
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14005d588
test rdi, rdi
je 0x14005d513
mov rcx, qword [rdi]
lea rdx, str.In_changeThreadContextToExplorerContext._Unable_to_adjust_token_privileges._ErrorCode:__d_.
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rdx
mov rax, qword [rcx + 0x68]
mov rcx, rdi
jmp 0x14005d753
mov rax, qword [0x1401cde08]
test rax, rax
je 0x14005d55c
lea r8, [0x14018bd54]
mov dword [rsp + 0x30], ebp
lea rdx, str.In_changeThreadContextToExplorerContext._Unable_to_adjust_token_privileges._ErrorCode:__d_.
mov r9, r8
mov qword [rsp + 0x28], rdx
mov ecx, 0x32
mov qword [rsp + 0x20], r8
lea rdx, str.OOBEUtils
lea r8, str.ProcessUtils
call qword [case.0x14004792d.0]
jmp 0x14005d873
mov rcx, qword [0x1401cde10]
test rcx, rcx
je 0x14005d873
mov rax, qword [rcx]
lea rdx, str.In_changeThreadContextToExplorerContext._Unable_to_adjust_token_privileges._ErrorCode:__d_.
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rdx
mov rax, qword [rax + 0x68]
jmp 0x14005d6fd
mov r8d, esi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x14005d63c
test rdi, rdi
je 0x14005d5bf
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Cant_open_process_handle._ErrorCode:__d_.
jmp 0x14005d747
cmp qword [0x1401cde08], 0
je 0x14005d613
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea r8, [0x14018bd54]
lea rax, str.In_changeThreadContextToExplorerContext._Cant_open_process_handle._ErrorCode:__d_.
mov ecx, 0x32
mov qword [rsp + 0x28], rax
lea rdx, str.OOBEUtils
mov rax, qword [0x1401cde08]
mov r9, r8
mov qword [rsp + 0x20], r8
lea r8, str.ProcessUtils
call qword [case.0x14004792d.0]
jmp 0x14005d873
mov rbx, qword [0x1401cde10]
test rbx, rbx
je 0x14005d873
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Cant_open_process_handle._ErrorCode:__d_.
jmp 0x14005d6ed
lea r8, [rsp + 0x48]
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14005d71b
test rdi, rdi
je 0x14005d675
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Cant_open_processToken._ErrorCode:__d_.
jmp 0x14005d747
cmp qword [0x1401cde08], 0
je 0x14005d6c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea r8, [0x14018bd54]
lea rax, str.In_changeThreadContextToExplorerContext._Cant_open_processToken._ErrorCode:__d_.
mov ecx, 0x32
mov qword [rsp + 0x28], rax
lea rdx, str.OOBEUtils
mov rax, qword [0x1401cde08]
mov r9, r8
mov qword [rsp + 0x20], r8
lea r8, str.ProcessUtils
call qword [case.0x14004792d.0]
jmp 0x14005d873
mov rbx, qword [0x1401cde10]
test rbx, rbx
je 0x14005d873
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Cant_open_processToken._ErrorCode:__d_.
mov rcx, qword [0x1401cde10]
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 0x68]
mov edx, 0x32
lea r8, [0x14018bd54]
lea r9, str.ProcessUtils
call qword [case.0x14004792d.0]
jmp 0x14005d873
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x14005d7f5
test rdi, rdi
je 0x14005d771
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Cant_ImpersonateLoggedOnUser._ErrorCode:__d_.
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 0x68]
lea r9, str.ProcessUtils
mov edx, 0x32
lea r8, [0x14018bd54]
call qword [case.0x14004792d.0]
jmp 0x14005d873
cmp qword [0x1401cde08], 0
je 0x14005d7c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea r8, [0x14018bd54]
lea rax, str.In_changeThreadContextToExplorerContext._Cant_ImpersonateLoggedOnUser._ErrorCode:__d_.
mov ecx, 0x32
mov qword [rsp + 0x28], rax
lea rdx, str.OOBEUtils
mov rax, qword [0x1401cde08]
mov r9, r8
mov qword [rsp + 0x20], r8
lea r8, str.ProcessUtils
call qword [case.0x14004792d.0]
jmp 0x14005d873
mov rbx, qword [0x1401cde10]
test rbx, rbx
je 0x14005d873
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1401cde10]
mov dword [rsp + 0x28], eax
lea rax, str.In_changeThreadContextToExplorerContext._Cant_ImpersonateLoggedOnUser._ErrorCode:__d_.
jmp 0x14005d74a
mov al, 1
jmp 0x14005d875
mov rax, qword [0x1401cde08]
test rax, rax
je 0x14005d83b
lea r8, [0x14018bd54]
mov ecx, 0x32
lea rdx, str.In_changeThreadContextToExplorerContext._Unable_to_find_explorer_processID
mov r9, r8
mov qword [rsp + 0x28], rdx
lea rdx, str.OOBEUtils
mov qword [rsp + 0x20], r8
lea r8, str.ProcessUtils
call qword [case.0x14004792d.0]
jmp 0x14005d873
mov rcx, qword [0x1401cde10]
test rcx, rcx
je 0x14005d873
mov rax, qword [rcx]
mov rax, qword [rax + 0x68]
lea rdx, str.In_changeThreadContextToExplorerContext._Unable_to_find_explorer_processID
mov qword [rsp + 0x20], rdx
lea r9, str.ProcessUtils
mov edx, 0x32
lea r8, [0x14018bd54]
call qword [case.0x14004792d.0]
xor al, al
mov rbp, qword [rsp + 0x2e0]
mov rbx, qword [rsp + 0x2d8]
mov rsi, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14007bb60
add rsp, 0x2c0
pop rdi
ret