Function at 0x140048430
Capabilities:
Enumerate processes
Get file system object information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x970
mov rax, qword [0x1402cf910]
xor rax, rsp
mov qword [rsp + 0x960], rax
mov esi, edx
mov r15, rcx
xor r12d, r12d
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
call fcn.14006e454
mov rcx, rax
test rax, rax
je 0x1400486e3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 1
mov edx, 0x16f
lea rcx, [rsp + 0x30]
call fcn.140003220
lea rbp, [r15 + 0x21c]
mov r9d, esi
mov rbx, qword [rsp + 0x30]
mov r8, rbx
lea rdx, str._s__d
mov rcx, rbp
call fcn.14002b0d0
nop
lea rdx, [rbx - 0x18]
mov rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400484e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, esi
xor edx, edx
mov ecx, 0x1010
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x140048550
mov dword [rsp + 0x38], 0x104
lea rdi, [r15 + 0x14]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x140048535
lea r8, [rsp + 0x40]
mov edx, 0x104
mov rcx, rdi
call fcn.1401fa754
mov r8, rdi
mov edx, 0x104
mov rcx, rbp
call fcn.1401fa754
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400485c5
mov edx, esi
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, rbx
je 0x1400485b1
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400485a8
cmp dword [rsp + 0x48], esi
je 0x140048595
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x14004857b
lea rcx, [r15 + 0x14]
lea r8, [rsp + 0x6c]
mov edx, 0x104
call fcn.140002ed0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [r15 + 0x14]
mov r8, rdi
mov edx, 0x104
mov rcx, rbp
call fcn.1401fa754
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x1400485d0
test rax, rax
jne 0x1400485e6
mov eax, ebx
jmp 0x1400486b7
mov dword [rsp + 0x20], 0x101
mov r9d, 0x2b8
lea r8, [rsp + 0x280]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
cmovne r12d, dword [rsp + 0x288]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x540]
call fcn.1401f0eb0
lea r9, [r15 + 0x524]
lea rdx, [r15 + 0x424]
lea r8, [rsp + 0x540]
mov rcx, rdi
call fcn.140048200
test al, al
je 0x140048677
lea rax, [rsp + 0x540]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140048652
cmp rbx, 1
jbe 0x140048677
lea r8, [rsp + 0x540]
mov edx, 0x104
mov rcx, rbp
call fcn.1401fa754
mov edx, 0x5c
mov rcx, rbp
call fcn.1401f003c
test rax, rax
je 0x1400486b4
lea r8, [rax + 2]
mov edx, 0x104
lea rcx, [rsp + 0x750]
call fcn.1401fa754
lea r8, [rsp + 0x750]
mov edx, 0x104
mov rcx, rbp
call fcn.1401fa754
mov eax, r12d
mov rcx, qword [rsp + 0x960]
xor rcx, rsp
call fcn.1401ee030
lea r11, [rsp + 0x970]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.1400037e0
int3