Function at 0x140025af0
Capabilities:
Create thread
Get session user name

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x388]
sub rsp, 0x488
mov rsi, rcx
mov qword [rsp + 0x38], rcx
mov rax, qword [0x14017ae30]
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x50], rax
mov qword [rcx + 0x58], rax
lea rdi, [rcx + 0x60]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
xor r14d, r14d
mov dword [rdi], r14d
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r14
xorps xmm0, xmm0
movups xmmword [rdi + 0x18], xmm0
movups xmmword [rdi + 0x28], xmm0
movups xmmword [rdi + 0x38], xmm0
mov qword [rdi + 0x48], r14
lea edx, [rax + 2]
mov rcx, rdi
call fcn.1400d8980
nop
lea rbx, [rdi + 0x50]
mov qword [rsp + 0x58], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
lea ecx, [r14 + 0x30]
call fcn.1400ff088
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rbx, [rdi + 0x60]
mov qword [rsp + 0x60], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
lea ecx, [r14 + 0x28]
call fcn.1400ff088
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rbx, [rdi + 0x70]
mov qword [rsp + 0x68], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
lea ecx, [r14 + 0x38]
call fcn.1400ff088
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rbx, [rdi + 0x80]
mov qword [rsp + 0x40], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
lea ecx, [r14 + 0x30]
call fcn.1400ff088
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov dword [rdi + 0x90], 0x100
mov qword [rsi + 0xf8], r14
mov qword [rsi + 0x100], r14
mov qword [rsi + 0x108], r14
mov qword [rsi + 0x118], r14
mov word [rsi + 0x120], 0x100
mov byte [rsi + 0x122], r14b
lea rbx, [rsi + 0x128]
mov qword [rsp + 0x30], rbx
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x1400267d2
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
movups xmm0, xmmword [0x14013a1f0]
movups xmmword [rsi + 0x130], xmm0
lea rcx, [rsi + 0x140]
call fcn.140026800
nop
lea rcx, [rsi + 0x2d0]
call fcn.14000cd50
nop
lea rbx, [rsi + 0x358]
mov qword [rsp + 0x30], rbx
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x1400267dd
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov qword [rsi + 0x370], r14
mov qword [rsi + 0x378], r14
mov qword [rsi + 0x380], r14
mov qword [rsi + 0x388], r14
lea rbx, [rsi + 0x3c8]
mov qword [rsp + 0x30], rbx
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x1400267e8
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rbx, [rsi + 0x418]
mov qword [rsp + 0x30], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
lea ecx, [r14 + 0x30]
call fcn.1400ff088
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rbx, [rsi + 0x428]
mov qword [rsp + 0x40], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
lea ecx, [r14 + 0x30]
call fcn.1400ff088
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rsi + 0x468], r14
lea rbx, [rsi + 0x4e8]
mov qword [rsp + 0x68], rbx
mov word [rbx], r14w
mov byte [rbx + 2], 1
lea rcx, [rbx + 8]
mov qword [rsp + 0x60], rcx
mov dword [rcx], r14d
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], r14
lea edx, [r14 + 2]
call fcn.1400d8980
nop
lea rcx, [rbx + 0x58]
call fcn.140077090
nop
mov qword [rbx + 0xb8], r14
mov dword [rbx + 0xc0], r14d
mov qword [rbx + 0xc8], r14
mov qword [rbx + 0xd0], r14
mov qword [rbx + 0xd8], r14
mov qword [rbx + 0xe0], r14
mov qword [rbx + 0xe8], r14
mov dword [rbx + 0xf0], 0xffffff
mov dword [rbx + 0xf4], 0xffffff
mov dword [rbx + 0xf8], 0xffffff
mov dword [rbx + 0xfc], 0xffffff
mov dword [rbx + 0x104], 0xffffff
mov qword [rbx + 0x108], r14
mov qword [rbx + 0x110], r14
mov byte [rbx + 0x138], r14b
mov qword [rbx + 0x140], r14
mov qword [rbx + 0x148], r14
mov qword [rbx + 0x150], r14
mov qword [rbx + 0x158], r14
lea rcx, [rbx + 0x160]
lea rdx, str.Node__u
call fcn.14003e820
nop
lea rcx, [rbx + 0x180]
lea rdx, str.__CPU
call fcn.14003e820
nop
lea rcx, [rbx + 0x1a0]
lea rdx, str.Parked
call fcn.14003e820
nop
lea rcx, [rbx + 0x1c0]
lea rdx, str.Efficient
call fcn.14003e820
nop
mov qword [rsi + 0x6c8], r14
mov qword [rsi + 0x6d0], r14
mov qword [rsi + 0x6d8], r14
mov qword [rsi + 0x6e0], r14
mov qword [rsi + 0x6e8], r14
mov qword [rsi + 0x6f0], r14
mov qword [rsi + 0x6f8], r14
mov qword [rsi + 0x700], r14
mov qword [rsi + 0x708], r14
mov qword [rsi + 0x710], r14
mov byte [rsi + 0x718], r14b
mov qword [rsi + 0xd28], r14
mov qword [rsi + 0xd30], r14
mov qword [rsi + 0xd38], r14
mov qword [rsi + 0xd40], r14
lea rbx, [rsi + 0xd70]
mov qword [rsp + 0x58], rbx
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x1400267c7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rcx, [rsi + 0xdb0]
call fcn.140093ec0
nop
lea rcx, [rsi + 0x45b0]
call fcn.1400c7920
nop
lea rcx, [rsi + 0x46e8]
mov qword [rsp + 0x30], rcx
mov dword [rcx], r14d
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], r14
lea edx, [r14 + 2]
call fcn.1400d8980
nop
lea rcx, [rsi + 0x4758]
call fcn.140077090
nop
lea rcx, [rsi + 0x47b8]
call fcn.14000aa40
nop
mov word [rsi + 0x4838], r14w
mov dword [rsi + 0x483c], r14d
mov qword [rsi + 0x4848], r14
mov qword [rsi + 0x4850], r14
mov qword [rsi + 0x4858], r14
mov qword [rsi + 0x4860], r14
mov qword [rsi + 0x4868], r14
mov qword [rsi + 0x4870], r14
mov qword [rsi + 0x4880], r14
mov qword [rsi + 0x4888], r14
mov qword [rsi + 0x4890], r14
mov ebx, 1
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [rsi + 0x28], 0x18
mov dword [rsi + 0x38], r14d
mov qword [rsi + 0x30], rsi
lea r9, str.LocalReloadPLGUI
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14017abf8], rax
lea r9, str.GlobalProcessLasso_ProBalanceEvent9
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x4748], rax
lea r9, str.Global2409cafa_6caa_47e3_9ab6_98710bd57a57
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x118], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0xd98], rax
lea rcx, [rsi + 0x3a0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0x46c0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0x4698]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rsi + 0x40], r14
mov qword [rsi + 0x4898], r14
mov qword [rsi + 0x48a0], r14
mov qword [rsi + 0x48a8], r14
mov dword [rsi + 0x4750], r14d
mov dword [rsi + 0x4840], r14d
mov qword [rsi + 0x4830], r14
mov byte [rsi + 0x4740], r14b
mov qword [rsi + 0x3f0], r14
mov ecx, 0x118
call fcn.1400ff088
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.1400ce530
nop
mov qword [rsi + 0xda0], rax
mov eax, dword [rsi + 0x4770]
mov dword [rsi + 0x4738], eax
mov dword [rbp + 0x3f8], r14d
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
mov eax, dword [rbp + 0x3f8]
inc eax
mov dword [rsi + 0x473c], eax
cmp dword [rsi + 0x4738], r14d
jne 0x140026165
mov dword [rsi + 0x4738], ebx
test eax, eax
jne 0x14002616f
mov dword [rsi + 0x473c], ebx
movabs rcx, 0xbff0000000000000
mov rax, rcx
xchg qword [rsi + 0x48], rax
mov rax, rcx
xchg qword [rsi + 0x50], rax
xchg qword [rsi + 0x58], rcx
mov qword [rsi + 0x3d8], r14
mov qword [rsi + 0x3e0], r14
mov qword [rsi + 0x3e8], r14
mov qword [rsi + 0x400], r14
mov qword [rsi + 0x410], r14
mov qword [rsi + 0x438], r14
mov ecx, 0xe8
call fcn.1400ff088
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.14000e320
nop
mov qword [rsi + 0x110], rax
mov ecx, 0x80
call fcn.1400ff088
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.14008a5c0
nop
mov qword [rsi + 0xd48], rax
lea r9, str.active_column_order
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000001
call fcn.140088840
lea r9, str.active_column_widths
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000001
call fcn.140088840
lea r9, str.active_column_sort_info
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000001
call fcn.140088840
lea r9, str.process_listview_column_order06070003
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000001
call fcn.140088840
lea r9, str.process_listview_column_widths06070003
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000001
call fcn.140088840
lea r9, str.action_log_column_orders
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000001
call fcn.140088840
lea r9, str.action_log_column_widths
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000001
call fcn.140088840
mov rcx, rsi
call fcn.14003b430
lea rax, [rsi + 0x470]
lea rbx, [rsi + 0xd50]
mov qword [rsp + 0x20], rax
lea r9, str.color1
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff81000000
mov rcx, rbx
call fcn.140088a00
lea rax, [rsi + 0x474]
mov qword [rsp + 0x20], rax
lea r9, str.color2
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff81000000
mov rcx, rbx
call fcn.140088a00
lea rax, [rsi + 0x478]
mov qword [rsp + 0x20], rax
lea r9, str.color3
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff81000000
mov rcx, rbx
call fcn.140088a00
lea rax, [rsi + 0x47c]
mov qword [rsp + 0x20], rax
lea r9, str.color4
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff81000000
mov rcx, rbx
call fcn.140088a00
lea rax, [rsi + 0x480]
mov qword [rsp + 0x20], rax
lea r9, str.color5
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff81000000
mov rcx, rbx
call fcn.140088a00
lea rax, [rsi + 0x484]
mov qword [rsp + 0x20], rax
lea r9, str.color6
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff81000000
mov rcx, rbx
call fcn.140088a00
lea r13, [rsi + 0x488]
mov qword [rsp + 0x20], r13
lea r9, str.color7
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff81000000
mov rcx, rbx
call fcn.140088a00
lea r12, [rsi + 0x4a0]
mov qword [rsp + 0x20], r12
lea r9, str.color8
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff81000000
mov rcx, rbx
call fcn.140088a00
lea r15, [rsi + 0x48c]
mov qword [rsp + 0x20], r15
lea r9, str.color9
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff81000000
mov rcx, rbx
call fcn.140088a00
lea r14, [rsi + 0x490]
mov qword [rsp + 0x20], r14
lea r9, str.color10
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff81000000
mov rcx, rbx
call fcn.140088a00
add rsi, 0x494
mov qword [rsp + 0x20], rsi
lea r9, str.color11
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff81000000
mov rcx, rbx
call fcn.140088a00
mov rdi, qword [rsp + 0x38]
add rdi, 0x498
mov qword [rsp + 0x20], rdi
lea r9, str.color12
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff81000000
mov rcx, rbx
call fcn.140088a00
mov rax, qword [rsp + 0x38]
lea rbx, [rax + 0x49c]
mov qword [rsp + 0x20], rbx
lea r9, str.color13
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff81000000
lea rcx, [rax + 0xd50]
call fcn.140088a00
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + 0x470]
mov dword [rcx + 0x4a8], eax
mov eax, dword [rcx + 0x474]
mov dword [rcx + 0x4ac], eax
mov eax, dword [rcx + 0x478]
mov dword [rcx + 0x4b0], eax
mov eax, dword [rcx + 0x47c]
mov dword [rcx + 0x4b4], eax
mov eax, dword [rcx + 0x480]
mov dword [rcx + 0x4b8], eax
mov eax, dword [rcx + 0x484]
mov dword [rcx + 0x4bc], eax
mov eax, dword [r13]
mov r13, rcx
mov dword [rcx + 0x4c4], eax
mov eax, dword [r12]
mov dword [rcx + 0x4c8], eax
mov eax, dword [r15]
mov dword [rcx + 0x4cc], eax
mov eax, dword [r14]
mov dword [rcx + 0x4d0], eax
mov eax, dword [rsi]
mov dword [rcx + 0x4d4], eax
mov eax, dword [rdi]
mov dword [rcx + 0x4d8], eax
mov eax, dword [rbx]
mov dword [rcx + 0x4dc], eax
xor edi, edi
mov dword [rcx + 0x3d4], edi
lea rcx, [rcx + 0x390]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x140026587
lea ecx, [rdi + 1]
jmp 0x1400265a8
mov rcx, qword [r13 + 0x390]
movabs rax, 0x624dd2f1a9fbe77
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
mov qword [r13 + 0x398], rcx
call fcn.14000fc90
mov dword [rbp + 0x3e0], 0x200
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rcx, [r13 + 0x358]
test eax, eax
je 0x140026602
lea rax, [rbp - 0x80]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x1400265e5
lea rdx, [rbp - 0x80]
call fcn.140005a90
mov byte [r13 + 0x360], 1
jmp 0x140026615
mov byte [r13 + 0x360], dil
lea rdx, [0x14017c158]
call fcn.14003f3d0
xorps xmm0, xmm0
movups xmmword [r13 + 0x130], xmm0
xorps xmm1, xmm1
movups xmmword [r13 + 0xd28], xmm1
mov byte [r13 + 0x4741], 1
mov qword [r13 + 0x4878], rdi
mov byte [r13 + 0x4743], dil
lea rdx, str.ProcessLasso_Notification_Window
lea rcx, str.ProcessLasso_Notification_Class
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [r13 + 0x730], rax
mov rax, qword [rsp + 0x50]
mov qword [r13 + 0xd68], rax
lea rcx, [r13 + 0xd70]
mov r8d, InitCommonControls
lea rdx, str.Process_Lasso
call fcn.140005a90
mov rax, qword [rbp + 0x3e8]
mov qword [r13 + 0xd78], rax
mov rax, qword [rbp + 0x3f0]
mov qword [r13 + 0xd80], rax
mov qword [r13 + 0xd88], rdi
mov qword [r13 + 0xd90], rdi
lea rcx, [r13 + 0x738]
xor edx, edx
mov r8d, 0x130
call fcn.14012ce40
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0xc005
lea rcx, [rsp + 0x48]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
jne 0x1400266e4
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
xor r9d, r9d
lea r8, [r13 + 0x460]
lea rdx, str.WriteResponsivenessToRegistry
lea rcx, [0x14017c600]
call fcn.1400734c0
cmp byte [r13 + 0x460], dil
jne 0x14002671d
lea rdx, str.LastResponsinenessMeasurement
lea rcx, [0x14017c600]
call fcn.140074480
lea rdx, str.DisallowBufferReuse
lea rcx, [0x14017c600]
call fcn.140073310
movzx ecx, byte [rax]
mov byte [r13 + 0x4838], cl
mov ecx, 0x188
call fcn.1400ff088
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.14000a930
nop
mov qword [r13 + 0xda8], rax
movzx eax, byte [r13 + 0x45c0]
mov byte [r13 + 0x4742], al
test al, al
je 0x14002677f
lea rdx, [r13 + 0x4880]
lea rcx, [r13 + 0x45b0]
call fcn.1400c80f0
mov dword [rbp + 0x3d8], edi
lea rax, [rbp + 0x3d8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, r13
lea r8, [0x140012b70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r13 + 0x3f8], rax
mov rax, r13
add rsp, 0x488
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002b00
nop
mov ecx, 0x80004005
call fcn.140002b00
nop
mov ecx, 0x80004005
call fcn.140002b00
nop
mov ecx, 0x80004005
call fcn.140002b00
int3