Function at 0x140011e97
Capabilities:
Enumerate processes
Terminate process

Disassembly:
jmp 0x140022c20
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x960
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x190
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x988]
mov rax, qword [0x140041040]
xor rax, rbp
mov qword [rbp + 0x938], rax
mov dword [rbp + 0x844], 0
lea rcx, [0x14004a106]
call fcn.140011d9d
nop
mov edx, 0x18
lea rcx, [rbp + 8]
call fcn.14001158c
lea rdx, str.backgroundtaskhost.exe
lea rcx, [rbp + 0x870]
call fcn.140011483
nop
lea rdx, str.reducememory_x64.exe
lea rcx, [rbp + 0x898]
call fcn.140011483
nop
lea rdx, str.useroobebroker.exe
lea rcx, [rbp + 0x8c0]
call fcn.140011483
nop
lea rax, [rbp + 0x8e8]
mov r8, rax
lea rdx, [rbp + 0x870]
lea rcx, [rbp + 0x688]
call fcn.140011636
lea rcx, [rbp + 0x820]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0x820]
lea rcx, [rbp + 8]
call fcn.140011c3a
nop
lea r9, [fcn.140011be0]
mov r8d, 3
mov edx, 0x28
lea rcx, [rbp + 0x870]
call fcn.14001137f
nop
lea rcx, [rbp + 0x40]
call fcn.1400115cd
nop
mov rax, qword [rbp + 0x968]
movzx eax, byte [rax]
test eax, eax
je 0x140023110
mov dword [rbp + 0xb0], 0x238
xor edx, edx
mov ecx, 2
call fcn.140011668
mov qword [rbp + 0x308], rax
cmp qword [rbp + 0x308], 0xffffffffffffffff
jne 0x140022d95
lea rdx, str.Failed_to_create_process_snapshot._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001118b
nop
lea rcx, [rbp + 8]
call fcn.14001141f
nop
jmp 0x14002311a
lea rdx, [rbp + 0xb0]
mov rcx, qword [rbp + 0x308]
call fcn.14001184d
test eax, eax
je 0x1400230d7
lea rdx, [rbp + 0xdc]
lea rcx, [rbp + 0x6b8]
call fcn.140011483
nop
lea rdx, [rbp + 0x6b8]
lea rcx, [rbp + 0x328]
call fcn.140011654
nop
lea rcx, [rbp + 0x6b8]
call fcn.140011be0
nop
lea rdx, [rbp + 0x748]
mov rcx, qword [rbp + 0x960]
call fcn.140011cda
mov qword [rbp + 0x8f8], rax
mov rax, qword [rbp + 0x8f8]
mov qword [rbp + 0x900], rax
mov eax, dword [rbp + 0x844]
or eax, 1
mov dword [rbp + 0x844], eax
lea r8, [rbp + 0xb8]
lea rdx, [rbp + 0x718]
mov rcx, qword [rbp + 0x960]
call fcn.1400119c9
mov qword [rbp + 0x908], rax
mov rax, qword [rbp + 0x908]
mov qword [rbp + 0x910], rax
mov eax, dword [rbp + 0x844]
or eax, 2
mov dword [rbp + 0x844], eax
mov rdx, qword [rbp + 0x900]
mov rcx, qword [rbp + 0x910]
call fcn.140011988
movzx eax, al
test eax, eax
je 0x140022eff
lea rdx, [rbp + 0x7a8]
lea rcx, [rbp + 8]
call fcn.140011069
mov qword [rbp + 0x918], rax
mov rax, qword [rbp + 0x918]
mov qword [rbp + 0x920], rax
mov eax, dword [rbp + 0x844]
or eax, 4
mov dword [rbp + 0x844], eax
lea r8, [rbp + 0x328]
lea rdx, [rbp + 0x778]
lea rcx, [rbp + 8]
call fcn.140011203
mov qword [rbp + 0x928], rax
mov eax, dword [rbp + 0x844]
or eax, 8
mov dword [rbp + 0x844], eax
mov rdx, qword [rbp + 0x920]
mov rcx, qword [rbp + 0x928]
call fcn.1400116db
movzx eax, al
test eax, eax
je 0x140022eff
mov dword [rbp + 0x930], 1
jmp 0x140022f09
mov dword [rbp + 0x930], 0
movzx eax, byte [rbp + 0x930]
mov byte [rbp + 0x6f4], al
mov eax, dword [rbp + 0x844]
and eax, 8
test eax, eax
je 0x140022f37
and dword [rbp + 0x844], 0xfffffff7
lea rcx, [rbp + 0x778]
call fcn.140011311
nop
mov eax, dword [rbp + 0x844]
and eax, 4
test eax, eax
je 0x140022f58
and dword [rbp + 0x844], 0xfffffffb
lea rcx, [rbp + 0x7a8]
call fcn.140011311
nop
mov eax, dword [rbp + 0x844]
and eax, 2
test eax, eax
je 0x140022f79
and dword [rbp + 0x844], 0xfffffffd
lea rcx, [rbp + 0x718]
call fcn.140011b5e
nop
mov eax, dword [rbp + 0x844]
and eax, 1
test eax, eax
je 0x140022f9a
and dword [rbp + 0x844], 0xfffffffe
lea rcx, [rbp + 0x748]
call fcn.140011b5e
nop
movzx eax, byte [rbp + 0x6f4]
test eax, eax
je 0x1400230af
lea rdx, str.Attempting_to_terminate_process:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400116e5
lea rdx, [rbp + 0x328]
mov rcx, rax
call fcn.1400117bc
lea rdx, str.__PID:
mov rcx, rax
call fcn.1400116e5
mov edx, dword [rbp + 0xb8]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140039800]
mov rcx, rax
call fcn.1400116e5
nop
mov r8d, dword [rbp + 0xb8]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x368], rax
cmp qword [rbp + 0x368], 0
je 0x1400230af
xor edx, edx
mov rcx, qword [rbp + 0x368]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp + 0x368]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
movzx eax, byte [rbp + 0x970]
test eax, eax
je 0x14002305f
mov rdx, qword [rbp + 0x980]
mov rcx, qword [rbp + 0x978]
call fcn.1400115d7
nop
lea rdx, str.Terminated:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400116e5
lea rdx, [rbp + 0x328]
mov rcx, rax
call fcn.1400117bc
lea rdx, str.__PID:
mov rcx, rax
call fcn.1400116e5
mov edx, dword [rbp + 0xb8]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140039800]
mov rcx, rax
call fcn.1400116e5
nop
lea rcx, [rbp + 0x328]
call fcn.140011be0
nop
lea rdx, [rbp + 0xb0]
mov rcx, qword [rbp + 0x308]
call fcn.140011bef
test eax, eax
jne 0x140022db0
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rbp + 0x7f4], 0x32
lea rdx, [rbp + 0x7f4]
lea rcx, [rbp + 0x7d8]
call fcn.140011a1e
mov rcx, rax
call fcn.140011b63
nop
jmp 0x140022d39
lea rcx, [rbp + 8]
call fcn.14001141f
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x140037710]
call fcn.140011b7c
mov rcx, qword [rbp + 0x938]
xor rcx, rbp
call fcn.14001168b
lea rsp, [rbp + 0x940]
pop rdi
pop rsi
pop rbp
ret