Function at 0x18000718c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x790
mov r14, rdx
xor edx, edx
mov rsi, r8
lea ecx, [rdx + 2]
mov dword [rsp + 0x50], 0x238
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1800071e4
xor edi, edi
mov r13d, 0x700
mov word [rsi + 4], r13w
mov word [rsi + 8], di
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov word [rsi + 0xe], ax
jmp 0x180007443
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
xor edi, edi
mov r13d, 0x700
cmp eax, edi
je 0x180007428
lea rbx, [rsi + 0x1c]
mov ecx, dword [rsp + 0x58]
mov eax, dword [rsp + 0x70]
lea rdx, [rsi + 0x18]
mov dword [rsi + 0x10], ecx
mov dword [rsi + 0x14], eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp eax, edi
jne 0x180007224
mov dword [rsi + 0x18], edi
lea r8, [rsp + 0x7c]
lea rdx, [0x18001d4d8]
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [rsp + 0x58]
call fcn.180002564
mov r8d, ebx
xor edx, edx
mov ecx, 0x410
mov r12d, edi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
cmp rax, rdi
jne 0x180007268
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x180007295
lea r8, [rsi + 0x11c]
xor edx, edx
mov r9d, 0x104
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExW
cmp eax, edi
jne 0x18000728c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r12d, edi
je 0x1800072ae
lea rcx, [rsi + 0x11c]
lea rdx, [0x18001d7f0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r8d, dword [rsi + 0x10]
mov r12d, 0x200
xor edx, edx
mov ecx, 0x400
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x7e0], 0x100
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x7e8], r12d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
cmp rax, rdi
je 0x1800073ab
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, edi
je 0x1800073ab
mov r9d, dword [rsp + 0x7e0]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x7e0]
lea r8, [rsp + 0x290]
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, edi
je 0x1800073ab
mov rdx, qword [rsp + 0x290]
lea rax, [rsp + 0x4c]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x7e8]
lea r8, [rsp + 0x590]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x390]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
cmp eax, edi
je 0x1800073e8
lea r9, [rsp + 0x590]
lea r8, [rsp + 0x390]
lea rdx, str._s_s
lea rcx, [rsi + 0x9c]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x1800073e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rbx, rdi
je 0x1800073bf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
cmp rcx, rdi
je 0x1800073d4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x40], rdi
lea rdx, [0x18001d7f0]
lea rcx, [rsi + 0x9c]
call qword [sym.imp.USER32.dll_wsprintfW]
mov eax, 0x314
mov r8d, 0x7530
mov rdx, rsi
mov rcx, r14
mov word [rsi + 4], r13w
mov word [rsi + 0xe], di
mov word [rsi + 8], ax
call fcn.180006c30
cmp eax, edi
jne 0x180007428
lea rdx, [rsp + 0x50]
mov rcx, rbp
call sub.KERNEL32.dll_Process32NextW
lea rbx, [rsi + 0x1c]
cmp eax, edi
jne 0x180007205
cmp rbp, rdi
je 0x180007436
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov word [rsi + 4], r13w
mov word [rsi + 8], di
mov word [rsi + 0xe], di
mov r8d, 0x7530
mov rdx, rsi
mov rcx, r14
call fcn.180006c30
mov rbx, qword [rsp + 0x7d0]
add rsp, 0x790
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret