Function at 0x180025910
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x260
cmp byte [rcx], 0
mov rdi, rcx
jne 0x180025b85
cmp qword [rcx + 8], 0
mov qword [rax + 0x20], rsi
jne 0x180025abd
mov qword [rax + 0x10], rbx
mov rax, qword [0x1800a0258]
test rax, rax
jne 0x180025973
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.WTSGetActiveConsoleSessionId
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800a0258], rax
test rax, rax
jne 0x180025973
xor ebx, ebx
jmp 0x180025977
call rax
mov ebx, eax
lea rcx, str.Wtsapi32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x18002599b
lea rcx, str.Wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x1800259db
mov rax, qword [0x1800a0250]
test rax, rax
jne 0x1800259cb
lea rcx, str.Wtsapi32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.WTSQueryUserToken
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800a0250], rax
lea rdx, [rdi + 8]
mov ecx, ebx
call rax
test eax, eax
jne 0x180025ab5
mov qword [rsp + 0x280], rbp
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x234
mov ebp, 0xffffffff
call fcn.18004b570
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180025aad
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180025aad
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x4c]
call fcn.18005062c
test eax, eax
je 0x180025a59
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180025a30
jmp 0x180025a5d
mov ebp, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, 0xffffffff
je 0x180025aad
mov r8d, ebp
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x270], rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
mov rcx, rax
ja 0x180025aa7
lea r8, [rdi + 8]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x280]
mov rbx, qword [rsp + 0x278]
mov rcx, qword [rdi + 8]
mov rsi, qword [rsp + 0x288]
test rcx, rcx
je 0x180025ae4
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x180025aef
lea rcx, str.ImpersonateLoggedOnUser__r_n
call fcn.1800258c0
xor al, al
add rsp, 0x260
pop rdi
ret
lea rdx, [rsp + 0x270]
mov qword [rsp + 0x270], 0
mov ecx, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x180025b29
lea rcx, str.RegOpenCurrentUser__r_n
call fcn.1800258c0
xor al, al
add rsp, 0x260
pop rdi
ret
mov rdx, qword [rsp + 0x270]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
test eax, eax
je 0x180025b59
lea rcx, str.RegOverridePredefKey__r_n
call fcn.1800258c0
xor al, al
add rsp, 0x260
pop rdi
ret
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x180025b82
lea rcx, str.RegCloseKey__r_n
call fcn.1800258c0
xor al, al
add rsp, 0x260
pop rdi
ret
mov byte [rdi], 1
mov al, 1
add rsp, 0x260
pop rdi
ret