Function at 0x140002840
Capabilities:
Enumerate process modules
Enumerate processes
Get file system object information

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x540
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x14027dea0]
xor rax, rsp
mov qword [rsp + 0x530], rax
mov rdi, rcx
call fcn.14000d648
call fcn.14000f368
mov rcx, rax
xor r14d, r14d
mov edx, r14d
test rax, rax
setne dl
test edx, edx
jne 0x1400028a0
mov ecx, 0x80004005
call fcn.140001980
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x180], r14
xor edx, edx
mov r8d, 0x160
lea rcx, [rsp + 0x188]
call fcn.14016c790
mov r9d, reloc.WLDAP32.dll_Ordinal_33
xor r8d, r8d
mov edx, 0x1036
mov rcx, qword [rdi + 0x158]
call qword [sym.imp.USER32.dll_SendMessageA]
lea rbp, [rdi + 0x118]
or r12d, 0xffffffff
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1401d8d34]
xor edx, edx
mov rcx, rbp
call fcn.1400254d4
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1401d8d30]
lea edx, [r12 + 2]
mov rcx, rbp
call fcn.1400254d4
mov r9d, 0x154
xor r8d, r8d
mov edx, 0x101e
mov rcx, qword [rdi + 0x158]
call qword [sym.imp.USER32.dll_SendMessageA]
mov edx, 0x101e
lea r9d, [r12 + 0x29]
lea r8d, [r12 + 2]
mov rcx, qword [rdi + 0x158]
call qword [sym.imp.USER32.dll_SendMessageA]
mov r9, qword [rdi + 0x200]
test r9, r9
jne 0x140002979
mov r9, r14
jmp 0x14000297d
mov r9, qword [r9 + 8]
mov edx, 0x1003
mov r8d, 1
mov rcx, qword [rdi + 0x158]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, rax
call fcn.140025b5c
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, [0x1401d8d28]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbp
call fcn.140025540
lea r9, [0x1401d8d24]
mov r8d, 1
mov edx, eax
mov rcx, rbp
call fcn.140025028
mov dword [rsp + 0x50], 0x130
xor edx, edx
mov r8d, Ordinal_301
lea rcx, [rsp + 0x54]
call fcn.14016c790
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13, rax
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140002b54
nop word [rax + rax]
cmp dword [rsp + 0x58], 0
jbe 0x140002b3f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [rsp + 0x58]
cmp edx, eax
je 0x140002b3f
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov dword [rsp + 0x2f0], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x2f4]
call fcn.14016c790
lea rdx, [rsp + 0x2f0]
mov rcx, rsi
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x140002b3f
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x420]
call fcn.14016c234
test rax, rax
je 0x140002b27
mov dword [rsp + 0x20], 0x4000
mov r9d, 0x168
lea r8, [rsp + 0x180]
xor edx, edx
lea rcx, [rsp + 0x420]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov qword [rsp + 0x38], r14
mov eax, dword [rsp + 0x188]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, [rsp + 0x420]
xor r8d, r8d
lea edx, [r8 + 3]
mov rcx, rbp
call fcn.140025540
mov edi, eax
mov r8d, dword [rsp + 0x2f8]
lea rdx, [0x1401d8d20]
lea rcx, [rsp + 0x40]
call fcn.140002810
mov rbx, qword [rsp + 0x40]
mov r9, rbx
mov r8d, 1
mov edx, edi
mov rcx, rbp
call fcn.140025028
lea rdx, [rsp + 0x2f0]
mov rcx, rsi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x140002a82
lea rdx, [rsp + 0x50]
mov rcx, r13
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140002a20
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140002b70
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, 1
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14016c130
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret