Function at 0x180001008
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3b8]
sub rsp, 0x4b8
xor ebx, ebx
mov r15, rdx
mov dword [rdx], ebx
call fcn.180001b9c
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x3e80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rdx, [rbp + 0x410]
mov dword [rbp + 0x410], 0x3e8
mov rcx, rax
mov qword [rsp + 0x60], rax
mov r13, rax
call fcn.18000213c
test eax, eax
je 0x180001333
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x180001333
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180001325
mov esi, dword [rbp + 0x410]
mov dword [rsp + 0x48], esi
mov eax, dword [r15]
lea rdx, [rbp - 0x64]
imul rdi, rax, 0x634
add rdi, qword [rbp + 0x400]
inc eax
mov dword [r15], eax
mov eax, dword [rsp + 0x78]
lea rcx, [rdi + 4]
mov dword [rdi], eax
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov ecx, dword [rsp + 0x78]
lea r8, [rdi + 0x20c]
mov edx, 1
call fcn.180002538
mov ecx, dword [rsp + 0x78]
lea rdx, [rbp + 0x418]
call fcn.1800023c8
test eax, eax
je 0x180001121
mov eax, dword [rbp + 0x418]
neg eax
sbb ecx, ecx
and ecx, 0x20
add ecx, 0x20
jmp 0x180001124
or ecx, 0xffffffff
mov dword [rdi + 0x414], ecx
lea rsi, [rdi + 0x418]
or dword [rsi], 0xffffffff
xor edx, edx
mov r8d, dword [rsp + 0x78]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x180001271
mov rdx, rsi
mov rcx, rax
call fcn.180002460
lea r8, [rsp + 0x50]
mov dword [rsp + 0x44], 0x100
mov edx, 8
mov rcx, r15
mov r13d, ebx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000125c
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x410]
xor r9d, r9d
mov dword [rbp + 0x410], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x18000124c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18000124c
mov edx, dword [rbp + 0x410]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x18000124c
mov r9d, dword [rbp + 0x410]
lea rax, [rbp + 0x410]
mov rcx, qword [rsp + 0x50]
mov r8, rsi
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x180001243
mov rdx, qword [rsi]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea r8, [rdi + 0x41c]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x1b0]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov r13d, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13d, r13d
jne 0x180001263
mov word [rdi + 0x41c], bx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x60]
mov esi, dword [rsp + 0x48]
mov ecx, ebx
test esi, esi
je 0x1800012d7
mov r8d, 1
mov eax, dword [rsp + 0x78]
mov edx, ecx
add rdx, rdx
cmp dword [r13 + rdx*8], eax
je 0x18000129a
add ecx, r8d
cmp ecx, esi
jb 0x180001281
jmp 0x1800012d7
movzx eax, word [r13 + rdx*8 + 4]
mov ecx, 0x7277
cmp ax, cx
jne 0x1800012b3
mov dword [rdi + 0x624], r8d
jmp 0x1800012d7
mov ecx, 0x7273
cmp ax, cx
jne 0x1800012c6
mov dword [rdi + 0x628], r8d
jmp 0x1800012d7
mov ecx, 0x7268
cmp ax, cx
jne 0x1800012d7
mov dword [rdi + 0x62c], r8d
mov rax, qword [r14 + 8]
mov edx, ebx
mov r8d, dword [rax]
test r8d, r8d
je 0x180001300
mov r9, qword [rax + 8]
mov eax, dword [rsp + 0x78]
mov ecx, edx
cmp dword [r9 + rcx*4], eax
je 0x1800013c2
inc edx
cmp edx, r8d
jb 0x1800012e9
mov eax, ebx
lea rdx, [rsp + 0x70]
mov dword [rdi + 0x630], eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov r15, qword [rbp + 0x408]
test eax, eax
jne 0x1800010bc
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
mov rcx, qword [r14]
call fcn.180001b0c
mov rcx, qword [r14 + 8]
call fcn.180001854
mov rcx, qword [r14 + 0x10]
call fcn.180001b0c
mov rcx, qword [r14 + 0x18]
call fcn.180001b0c
mov rcx, qword [r14 + 0x20]
call fcn.180001b0c
mov rcx, qword [r14 + 0x28]
call fcn.180001854
mov rcx, qword [r14 + 0x30]
call fcn.180001854
mov rcx, qword [r14 + 0x38]
call fcn.180001854
xor eax, eax
mov rdi, r14
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
add rsp, 0x4b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, 1
jmp 0x180001302