Function at 0x140051de0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x610]
sub rsp, 0x710
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x760], rbx
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rbp + 0x600], rax
movsxd rsi, r8d
mov r13, rdx
mov qword [rsp + 0x50], rcx
call fcn.1400694ec
mov rcx, rax
xor r12d, r12d
mov r9d, r12d
test rax, rax
setne r9b
test r9d, r9d
jne 0x140051e4d
mov ecx, 0x80004005
call fcn.140011b60
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x58], rax
call fcn.1400694ec
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x140051e7c
mov ecx, 0x80004005
call fcn.140011b60
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.1400694ec
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x140051eae
mov ecx, 0x80004005
call fcn.140011b60
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x30], rax
call fcn.1400694ec
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x140051ee0
mov ecx, 0x80004005
call fcn.140011b60
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea r15, [0x140296e0c]
mov rbx, r15
shr rbx, 0x10
test rbx, rbx
jne 0x140051f27
movzx edi, r15w
mov ecx, edi
call fcn.140068f14
test rax, rax
je 0x140051f38
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140011830
jmp 0x140051f38
xor r8d, r8d
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140011b80
nop
mov r14d, r12d
mov dword [rsp + 0x28], r12d
call fcn.1400694ec
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x140051f60
mov ecx, 0x80004005
call fcn.140011b60
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
test rbx, rbx
jne 0x140051f99
movzx ebx, r15w
mov ecx, ebx
call fcn.140068f14
test rax, rax
je 0x140051faa
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140011830
jmp 0x140051faa
xor r8d, r8d
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.140011b80
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov qword [rsp + 0x68], rax
or r15, 0xffffffffffffffff
cmp rax, r15
je 0x1400524fd
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x7c]
call fcn.1401f7640
mov dword [rbp - 0x80], 0x238
mov r12, rsi
lea rdx, [rbp - 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400524f3
mov edx, dword [rbp - 0x78]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x140052489
xor edx, edx
mov r8d, 0x434
lea rcx, [rbp + 0x1c4]
call fcn.1401f7640
mov dword [rbp + 0x1c0], 0x438
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140052480
xor esi, esi
call fcn.1400694ec
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
je 0x1400524e8
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x1f0]
lea rax, [rbp + 0x1f0]
test rax, 0xffffffffffff0000
jne 0x1400520bc
movzx edi, cx
mov ecx, edi
call fcn.140068f14
test rax, rax
je 0x1400521a2
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140011830
mov rbx, qword [rsp + 0x20]
jmp 0x1400521a2
lea rax, [rbp + 0x1f0]
mov rdi, r15
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400520c6
test edi, edi
jne 0x140052124
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400521a2
cmp dword [rdx + 0x10], 0
jge 0x140052100
cmp dword [rbx - 0xc], 0
jl 0x14005249b
mov dword [rbx - 0x10], esi
mov word [rbx], si
jmp 0x1400521a2
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140052110
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
jmp 0x1400521a2
mov r14d, dword [rbx - 0x10]
lea rsi, [rbp + 0x1f0]
sub rsi, rbx
sar rsi, 1
test edi, edi
js 0x1400524dd
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14005215f
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.140011b00
mov rbx, qword [rsp + 0x20]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, r14
lea r14, [rax + rax]
mov r9, r14
ja 0x140052183
lea r8, [rbx + rsi*2]
call fcn.1401f366c
jmp 0x14005218f
lea r8, [rbp + 0x1f0]
call fcn.1401f3588
cmp edi, dword [rbx - 0xc]
jg 0x1400524d2
mov dword [rbx - 0x10], edi
xor esi, esi
mov word [r14 + rbx], si
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x1400524c7
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or ecx, eax
jge 0x1400521d0
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.140011b00
mov rbx, qword [rsp + 0x20]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.1401f4910
cmp edi, dword [rbx - 0xc]
jg 0x1400524bc
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], si
mov r8d, 4
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140030460
mov rdx, qword [rax]
mov rcx, rsi
lea r8, str..exe
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140052229
cmp rcx, 5
jne 0x140052210
mov eax, esi
jmp 0x14005222e
sbb eax, eax
or eax, 1
test eax, eax
sete bl
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005224c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x140052440
mov r14, rsi
test r12, r12
jle 0x140052440
mov rdi, qword [rsp + 0x20]
mov rdx, qword [r13 + r14*8]
test rdx, rdx
jne 0x140052273
mov eax, esi
jmp 0x140052280
mov rax, r15
inc rax
cmp word [rdx + rax*2], 0
jne 0x140052276
mov r8d, eax
lea rcx, [rsp + 0x38]
call fcn.140011b80
mov rbx, qword [rsp + 0x38]
movsxd rsi, dword [rbx - 0x10]
test esi, esi
js 0x1400524b1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x1400522c0
mov edx, esi
lea rcx, [rsp + 0x38]
call fcn.140011b00
mov rbx, qword [rsp + 0x38]
lea eax, [rsi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.1401f4910
cmp esi, dword [rbx - 0xc]
jg 0x1400524a6
mov dword [rbx - 0x10], esi
mov rax, rsi
xor esi, esi
mov word [rbx + rax*2], si
cmp dword [rbx - 0x10], esi
jl 0x140052302
mov rdx, rdi
mov rcx, rbx
call fcn.1401f4218
test rax, rax
je 0x140052302
sub rax, rbx
sar rax, 1
test eax, eax
jg 0x140052313
inc r14
cmp r14, r12
jge 0x140052445
jmp 0x140052265
mov r8d, dword [rbp - 0x78]
lea rdx, [0x1400525b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDesktopWindows]
mov r14d, dword [rsp + 0x28]
mov r8d, r14d
lea rdx, str.Files.In.Use.Proc._d
lea rcx, [rsp + 0x30]
call fcn.140011640
mov r8d, dword [rbp - 0x78]
lea rdx, [0x14029709c]
lea rcx, [rsp + 0x40]
call fcn.140011640
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.140053590
mov r8d, r14d
lea rdx, str.Files.In.Use.Exe._d
lea rcx, [rsp + 0x30]
call fcn.140011640
mov r8, rbx
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.140053590
mov rax, qword [0x140315718]
movzx ecx, word [rax]
cmp cx, word [0x140296e0c]
jne 0x1400523a5
xor ecx, ecx
jmp 0x1400523aa
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x14005240a
lea rcx, [rbx - 0x18]
lea rsi, [rax - 0x18]
cmp rcx, rsi
je 0x14005240a
cmp dword [rsi + 0x10], 0
jl 0x1400523f7
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x1400523f7
call fcn.1400116e0
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x1400523e5
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x140315718], rax
mov rdi, qword [rsp + 0x20]
jmp 0x14005240a
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x140315718]
call fcn.140011b80
mov r8d, r14d
lea rdx, str.Files.In.Use.DisplayName._d
lea rcx, [rsp + 0x30]
call fcn.140011640
mov r8, qword [0x140315718]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.140053590
inc r14d
mov dword [rsp + 0x28], r14d
xor esi, esi
jmp 0x14005244a
mov rdi, qword [rsp + 0x20]
mov r14d, dword [rsp + 0x28]
lea rdx, [rdi - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005245e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rbp + 0x1c0]
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140052052
mov rdi, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140051ff2
mov ecx, 0x80070057
call fcn.140011b60
nop
mov ecx, 0x80070057
call fcn.140011b60
int3
mov ecx, 0x80070057
call fcn.140011b60
int3
mov ecx, 0x80070057
call fcn.140011b60
int3
mov ecx, 0x80070057
call fcn.140011b60
nop
mov ecx, 0x80070057
call fcn.140011b60
int3
mov ecx, 0x80070057
call fcn.140011b60
nop
mov ecx, 0x80004005
call fcn.140011b60
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140052517
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140052531
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005254b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140052565
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005257f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, r14d
mov rcx, qword [rbp + 0x600]
xor rcx, rsp
call fcn.1401f2f70
mov rbx, qword [rsp + 0x760]
add rsp, 0x710
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret