Function at 0x44e610
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
sub rsp, 0x2c8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov qword [rax - 0x18], r13
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], r15
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r15, rcx
mov eax, dword [rcx + 0x14]
test eax, eax
je 0x44e8db
cmp eax, 0xffffffff
je 0x44e8db
lea rcx, [0x00522a28]
mov rax, qword [0x00522a28]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
lea rcx, [0x00522a28]
mov rax, qword [0x00522a28]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x28], rdi
lea r14, [r15 + 0x40]
mov rsi, qword [r14 + 8]
cmp rsi, qword [r14 + 0x10]
jbe 0x44e6b3
call fcn.004a7de0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rsi
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov r12, qword [r14 + 0x10]
cmp qword [r14 + 8], r12
jbe 0x44e6e1
call fcn.004a7de0
test rbp, rbp
je 0x44e6eb
cmp rbp, r14
je 0x44e6f0
call fcn.004a7de0
mov r13d, 0xffffffff
cmp rsi, r12
je 0x44e805
test rbp, rbp
jne 0x44e709
call fcn.004a7de0
cmp rsi, qword [rbp + 0x10]
jb 0x44e714
call fcn.004a7de0
mov r12, qword [rsi]
test r12, r12
je 0x44e726
mov eax, dword [r15 + 0x14]
cmp dword [r12], eax
je 0x44e737
cmp rsi, qword [rbp + 0x10]
jb 0x44e731
call fcn.004a7de0
add rsi, 8
jmp 0x44e6d2
mov rdx, qword [r12 + 0x60]
lea rcx, [rdx - 0x18]
lea rsi, [rbx - 0x18]
cmp rcx, rsi
je 0x44e79e
cmp dword [rsi + 0x10], 0
jl 0x44e78b
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x44e78b
call fcn.0040b0c0
mov rbx, rax
mov ecx, r13d
lock xadd dword [rsi + 0x10], ecx
add ecx, r13d
test ecx, ecx
jg 0x44e77b
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
add rbx, 0x18
mov qword [rsp + 0x20], rbx
mov rdi, qword [rsp + 0x28]
jmp 0x44e79e
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.00416fd0
mov rbx, qword [rsp + 0x20]
mov rdx, qword [r12 + 0x28]
lea rcx, [rdx - 0x18]
lea rsi, [rdi - 0x18]
cmp rcx, rsi
je 0x44e805
cmp dword [rsi + 0x10], 0
jl 0x44e7f2
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x44e7f2
call fcn.0040b0c0
mov rdi, rax
mov ecx, r13d
lock xadd dword [rsi + 0x10], ecx
add ecx, r13d
test ecx, ecx
jg 0x44e7e2
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
add rdi, 0x18
mov qword [rsp + 0x28], rdi
mov rbx, qword [rsp + 0x20]
jmp 0x44e805
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.00416fd0
mov rdi, qword [rsp + 0x28]
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov dword [rsp + 0x50], 0x238
cmp rax, 0xffffffffffffffff
je 0x44e871
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x44e860
lea rdx, [rsp + 0x7c]
mov rcx, rbx
call fcn.004aae90
test eax, eax
je 0x44e855
lea rdx, [rsp + 0x50]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x44e85c
jmp 0x44e831
mov ebx, 1
jmp 0x44e862
xor ebx, ebx
jmp 0x44e862
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x44e898
jmp 0x44e873
xor ebx, ebx
cmp dword [rdi - 0x10], 0
je 0x44e890
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x44e890
mov ebx, 1
jmp 0x44e898
mov dword [r15 + 0x14], 0xffffffff
lea rdx, [rdi - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x44e8b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
add r13d, 0xffffffff
test r13d, r13d
jg 0x44e8d7
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
jmp 0x44e8dd
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.004a7100
mov rbx, qword [rsp + 0x2d8]
mov rbp, qword [rsp + 0x2e0]
mov rsi, qword [rsp + 0x2e8]
mov rdi, qword [rsp + 0x2c0]
mov r12, qword [rsp + 0x2b8]
mov r13, qword [rsp + 0x2b0]
mov r14, qword [rsp + 0x2a8]
mov r15, qword [rsp + 0x2a0]
add rsp, 0x2c8
ret