Function at 0x14001c6e0
Capabilities:
Enumerate processes
Enumerate processes on remote desktop session host
Terminate process

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x320], rbx
mov rax, qword [0x14014c228]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rdi, rdx
mov rcx, qword [rcx]
sub rcx, 0x18
call fcn.14000c440
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
mov rcx, qword [rdi]
sub rcx, 0x18
call fcn.14000c440
add rax, 0x18
mov qword [rsp + 0x58], rax
mov edx, 0x5c
mov rcx, rbx
call fcn.1400adf44
mov rcx, rax
mov r15, 0xffffffffffffffff
test rax, rax
je 0x14001c771
sub rcx, rbx
sar rcx, 1
cmp ecx, r15d
jne 0x14001c790
mov edx, 0x2f
mov rcx, rbx
call fcn.1400adf44
test rax, rax
jne 0x14001c788
mov ecx, r15d
jmp 0x14001c790
sub rax, rbx
sar rax, 1
mov ecx, eax
inc ecx
movsxd rsi, dword [rbx - 0x10]
mov eax, esi
sub eax, ecx
mov r13d, 0
mov edi, r13d
cmovns edi, eax
lea r12, [rbx - 0x18]
cmp edi, esi
jl 0x14001c7c4
mov rcx, r12
call fcn.14000c440
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
jmp 0x14001c85c
mov rcx, qword [r12]
test rcx, rcx
je 0x14001c7db
mov rax, qword [rcx]
call qword [rax + 0x20]
mov r9, rax
test rax, rax
jne 0x14001c7ec
call fcn.14000ce10
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r9, rax
movsxd r14, edi
mov rcx, rsi
sub rcx, r14
lea rsi, [rbx + rcx*2]
test r9, r9
je 0x14001caca
test rsi, rsi
jne 0x14001c80f
test edi, edi
jne 0x14001cad5
mov rax, qword [r9]
mov r8d, 2
mov edx, edi
mov rcx, r9
call qword [rax]
test rax, rax
je 0x14001cab9
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
test edi, edi
js 0x14001cabf
cmp edi, dword [rbx - 0xc]
jg 0x14001cabf
mov dword [rbx - 0x10], edi
lea rdx, [r14 + r14]
mov word [rdx + rbx], r13w
mov r9, rdx
mov r8, rsi
mov rcx, rbx
call fcn.140018b60
mov dword [rsp + 0x38], r13d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
je 0x14001ca3a
mov r13, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14001cb60
test al, al
je 0x14001ca3a
xor r14d, r14d
cmp dword [rsp + 0x38], r14d
jbe 0x14001ca32
mov rax, qword [rsp + 0x30]
nop
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rcx
mov esi, dword [rax]
mov dword [rbp - 0x80], 0x238
mov ecx, 8
call fcn.1400a72cc
mov rdi, rax
test rax, rax
je 0x14001c8e0
mov qword [rax], 0
jmp 0x14001c8e2
xor edi, edi
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rdi], rax
cmp rax, r15
jne 0x14001c8fc
mov rcx, r15
jmp 0x14001ca03
lea rdx, [rbp - 0x80]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14001c9fb
lea rax, [rbp - 0x54]
mov r8, rbx
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14001c934
add rax, 2
test ecx, ecx
jne 0x14001c920
test edx, edx
jne 0x14001c950
lea rdx, [rsp + 0x3c]
mov ecx, dword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x14001c950
cmp dword [rsp + 0x3c], esi
je 0x14001c95e
lea rdx, [rbp - 0x80]
mov rcx, qword [rdi]
call sub.KERNEL32.dll_Process32NextW
jmp 0x14001c908
mov r8d, dword [rbp - 0x78]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x40], rax
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001c982
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
mov rcx, rdi
call fcn.1400a7308
mov qword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
mov edx, 0xf01ff
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14001ca16
lea r9, [rsp + 0x48]
mov r8, qword [rsp + 0x50]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call fcn.14001cd20
mov r9d, 0xfa0
mov r8d, 1
lea rdx, [rsp + 0x40]
lea ecx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
jne 0x14001ca16
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x14001ca16
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001ca09
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
mov rcx, rdi
call fcn.1400a7308
mov rax, qword [rsp + 0x30]
add rax, 0x18
mov qword [rsp + 0x30], rax
inc r14d
cmp r14d, dword [rsp + 0x38]
jb 0x14001c8b0
mov rcx, r13
call sub.WTSAPI32.dll_WTSFreeMemory
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001ca55
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001ca75
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lock xadd dword [r12 + 0x10], r15d
sub r15d, 1
jg 0x14001ca8f
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1400a79f0
mov rbx, qword [rsp + 0x320]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140010030
nop
mov ecx, 0x80070057
call fcn.14000c310
int3
mov ecx, 0x80004005
call fcn.14000c310
int3
mov ecx, 0x80070057
call fcn.14000c310
int3