Function at 0x140007b10
Capabilities:
Enumerate processes
Enumerate threads

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x8e0
mov rbx, rcx
lea rdi, [rsp + 0x40]
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0x238
movaps xmm0, xmmword [0x140017990]
movups xmmword [rsp + 0x890], xmm0
mov qword [rsp + 0x8a0], 0
mov dword [rsp + 0x8a8], 0
lea rdi, [rsp + 0x688]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x480]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x278]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x8d0], 0
mov dword [rsp + 0x8cc], 0
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov rcx, rsi
lea rdx, [rsp + 0x40]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140007d33
mov eax, dword [0x14001e280]
cmp dword [rsp + 0x48], eax
jne 0x140007be0
jmp 0x140007bf6
mov eax, dword [0x14001e280]
cmp dword [rsp + 0x48], eax
je 0x140007bf6
mov rcx, rsi
lea rdx, [rsp + 0x40]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140007bd4
jmp 0x140007d33
lea rcx, [rsp + 0x688]
mov edx, 0x104
lea r8, str.Process_name:__ls
lea r9, [rsp + 0x6c]
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfb3
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x688]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edi, dword [rsp + 0x48]
mov ecx, edi
lea rdx, [rsp + 0x480]
mov r8d, 0xa
call fcn.14000af40
lea rcx, [rsp + 0x688]
mov edx, 0x104
lea r8, [0x140017c88]
mov r9, rax
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfb4
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x688]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, edi
lea rdx, [rsp + 0x8d0]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x140007cde
mov rcx, rbx
mov edx, 0xfb5
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, str.Session_Id:
call fcn.140001120
cmp dword [0x14001e280], 0
je 0x140007d33
mov rcx, rbx
mov edx, 0xfb5
mov r8d, 0x2741
lea r9, [rsp + 0x278]
call fcn.140005600
jmp 0x140007d33
mov ecx, dword [rsp + 0x8d0]
lea rdx, [rsp + 0x480]
mov r8d, 0xa
call fcn.14000af40
lea rcx, [rsp + 0x688]
mov edx, 0x104
lea r8, str.Session_Id:__ls
mov r9, rax
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfb5
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x688]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov rcx, rsi
lea rdx, [rsp + 0x890]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x140007f96
mov eax, dword [0x14001e280]
cmp dword [rsp + 0x89c], eax
jne 0x140007d83
jmp 0x140007d9c
mov eax, dword [0x14001e280]
cmp dword [rsp + 0x89c], eax
je 0x140007d9c
mov rcx, rsi
lea rdx, [rsp + 0x890]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x140007d74
jmp 0x140007f96
mov ecx, dword [rsp + 0x898]
lea rdx, [rsp + 0x480]
mov r8d, 0xa
call fcn.14000af40
lea rcx, [rsp + 0x688]
mov edx, 0x104
lea r8, [0x140017c2c]
mov r9, rax
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfbb
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x688]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edi, dword [rsp + 0x8a0]
cmp edi, 4
jbe 0x140007e74
lea eax, [edi - 5]
cmp eax, 1
jbe 0x140007eaa
lea eax, [edi - 7]
cmp eax, 1
jbe 0x140007ee0
lea eax, [edi - 9]
cmp eax, 1
jbe 0x140007f13
lea eax, [edi - 0xb]
cmp eax, 0xc
jbe 0x140007f46
lea eax, [edi - 0x18]
cmp eax, 7
ja 0x140007f77
mov ecx, edi
lea rdx, [rsp + 0x480]
mov r8d, 0xa
call fcn.14000af40
lea rcx, [rsp + 0x688]
mov edx, 0x104
lea r8, [0x140017a0e]
mov r9, rax
call fcn.14000b010
jmp 0x140007f77
mov ecx, edi
lea rdx, [rsp + 0x480]
mov r8d, 0xa
call fcn.14000af40
lea rcx, [rsp + 0x688]
mov edx, 0x104
lea r8, [0x140017bda]
mov r9, rax
call fcn.14000b010
jmp 0x140007f77
mov ecx, edi
lea rdx, [rsp + 0x480]
mov r8d, 0xa
call fcn.14000af40
lea rcx, [rsp + 0x688]
mov edx, 0x104
lea r8, [0x140017b78]
mov r9, rax
call fcn.14000b010
jmp 0x140007f77
mov ecx, edi
lea rdx, [rsp + 0x480]
mov r8d, 0xa
call fcn.14000af40
lea rcx, [rsp + 0x688]
mov edx, 0x104
lea r8, [0x140017b22]
mov r9, rax
call fcn.14000b010
jmp 0x140007f77
mov ecx, edi
lea rdx, [rsp + 0x480]
mov r8d, 0xa
call fcn.14000af40
lea rcx, [rsp + 0x688]
mov edx, 0x104
lea r8, [0x140017ac0]
mov r9, rax
call fcn.14000b010
jmp 0x140007f77
mov ecx, edi
lea rdx, [rsp + 0x480]
mov r8d, 0xa
call fcn.14000af40
lea rcx, [rsp + 0x688]
mov edx, 0x104
lea r8, [0x140017a68]
mov r9, rax
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfbe
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x688]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x8c0], 0
mov qword [rsp + 0x8b8], 0
mov qword [rsp + 0x8b0], 0
lea rax, [rsp + 0x8b0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x8b8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x8c0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, qword [0x14001e000]
mov edx, 6
mov r8d, 0xc
xor r9, r9
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
je 0x14000812a
lea rax, [rsp + 0x8b0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x8b8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [0x14001e000]
mov edx, 6
mov r8d, 8
xor r9, r9
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
mov esi, eax
test esi, esi
je 0x14000812a
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x278]
mov qword [rsp + 0x20], rax
mov ecx, 0x1200
xor edx, edx
mov r8d, esi
mov r9d, 0x400
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov ecx, esi
lea rdx, [rsp + 0x480]
mov r8d, 0xa
call fcn.14000af40
lea rdx, [rsp + 0x278]
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x688]
mov edx, 0x104
lea r8, str.Security_flags:__Error:__ls___ls
mov r9, rax
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfb8
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x688]
call qword [sym.imp.USER32.dll_SetWindowTextW]
cmp dword [0x14001e280], 0
je 0x140008123
mov rcx, rbx
mov edx, 0xfb8
mov r8d, 0x273e
lea r9, [rsp + 0x278]
call fcn.140005600
xor eax, eax
jmp 0x14000832f
xor eax, eax
jmp 0x14000832f
mov word [rsp + 0x8d6], 0
mov rcx, qword [rsp + 0x8b0]
lea rdx, [rsp + 0x8d6]
lea r8, [rsp + 0x8cc]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
je 0x14000831f
mov rcx, qword [rsp + 0x8b0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov si, word [rsp + 0x8d6]
cmp si, 0x8010
je 0x1400081ff
cmp si, 0x8014
je 0x14000823b
cmp si, 0x8010
jb 0x1400082c7
cmp si, 0x8810
je 0x140008290
cmp si, 0x8814
jne 0x1400082c7
mov rcx, rbx
mov edx, 0xfb8
mov r8d, 0x2737
lea r9, [rsp + 0x278]
call fcn.140005600
mov rcx, rbx
mov edx, 0xfb9
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, rbx
mov edx, 0xfba
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
jmp 0x1400082c7
mov rcx, rbx
mov edx, 0xfb8
mov r8d, 0x2735
lea r9, [rsp + 0x278]
call fcn.140005600
mov rcx, rbx
mov edx, 0xfb9
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
jmp 0x1400082c7
mov rcx, rbx
mov edx, 0xfb8
mov r8d, 0x2740
lea r9, [rsp + 0x278]
call fcn.140005600
mov rcx, rbx
mov edx, 0xfb9
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, rbx
mov edx, 0xfba
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
jmp 0x1400082c7
mov rcx, rbx
mov edx, 0xfb8
mov r8d, 0x2736
lea r9, [rsp + 0x278]
call fcn.140005600
mov rcx, rbx
mov edx, 0xfb9
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
movzx ecx, si
lea rdx, [rsp + 0x480]
mov r8d, 0x10
call fcn.14000af40
lea rcx, [rsp + 0x688]
mov edx, 0x104
lea r8, str.Security_flags:_0x_ls
mov r9, rax
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfb8
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x688]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 1
jmp 0x14000832f
mov rcx, qword [rsp + 0x8b0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x8e0
pop rdi
pop rsi
pop rbx
ret