Function at 0x1400083d0
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x360
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rsp + 0x398], rbx
mov rax, qword [0x1400230b0]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov rax, r8
mov rbp, rdx
mov rsi, rcx
mov qword [rsp + 0x60], rcx
xor edi, edi
test r8, r8
je 0x1400085ee
mov qword [rsp + 0x60], rdi
lea r8, [rsp + 0x60]
lea edx, [rdi + 0xb]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400085d5
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9d, [rdi + 1]
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1400085c5
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x78], eax
lea ebx, [rdi + 0x30]
mov qword [rsp + 0x68], rdi
lea r9d, [rdi + 4]
lea r8, [rsp + 0x78]
lea edx, [rdi + 0xc]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
lea r8d, [rdi + 1]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x68]
call qword [0x14001c490]
test eax, eax
je 0x1400084b6
mov ebx, 0x430
jmp 0x1400084bb
mov qword [rsp + 0x68], rdi
test rbp, rbp
je 0x1400084e3
mov qword [rsp + 0x20], rbp
mov r9, rsi
lea r8, str.__s___s
mov edx, 0x208
lea rcx, [rsp + 0x110]
call fcn.140004000
jmp 0x1400084ff
mov r9, rsi
lea r8, str.__s_
mov edx, 0x208
lea rcx, [rsp + 0x110]
call fcn.140004000
mov dword [rsp + 0xa0], 0x68
mov qword [rsp + 0xa8], rdi
lea rax, str.winsta0default
mov qword [rsp + 0xb0], rax
xor edx, edx
lea r8d, [rdx + 0x50]
lea rcx, [rsp + 0xb8]
call fcn.14000c470
mov qword [rsp + 0x80], rdi
xor eax, eax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rsp + 0x110]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [0x14001c498]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400085d5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400086d2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400086d2
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140008686
mov dword [rsp + 0x110], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x114]
call fcn.14000c470
lea rdx, [rsp + 0x110]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140008686
nop
nop
lea rdx, str.winlogon.exe
lea rcx, [rsp + 0x13c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000866f
lea rdx, [rsp + 0x110]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x140008686
jmp 0x140008640
mov esi, dword [rsp + 0x118]
test rbx, rbx
je 0x140008696
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140008696
test rbx, rbx
je 0x140008694
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
mov r8d, esi
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400086d2
mov r8, rax
mov rdx, rbp
mov rcx, qword [rsp + 0x60]
call fcn.1400083d0
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x1400086d4
mov eax, edi
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.14000a6e0
mov rbx, qword [rsp + 0x398]
add rsp, 0x360
pop rdi
pop rsi
pop rbp
ret