Function at 0x447160
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
sub rsp, 0x2c8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov qword [rax - 0x18], r13
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], r15
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r15, rcx
mov eax, dword [rcx + 0x14]
test eax, eax
je 0x44742b
cmp eax, 0xffffffff
je 0x44742b
lea rcx, [0x00507908]
mov rax, qword [0x00507908]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
lea rcx, [0x00507908]
mov rax, qword [0x00507908]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x28], rdi
lea r14, [r15 + 0x40]
mov rsi, qword [r14 + 8]
cmp rsi, qword [r14 + 0x10]
jbe 0x447203
call fcn.00490fc0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rsi
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov r12, qword [r14 + 0x10]
cmp qword [r14 + 8], r12
jbe 0x447231
call fcn.00490fc0
test rbp, rbp
je 0x44723b
cmp rbp, r14
je 0x447240
call fcn.00490fc0
mov r13d, 0xffffffff
cmp rsi, r12
je 0x447355
test rbp, rbp
jne 0x447259
call fcn.00490fc0
cmp rsi, qword [rbp + 0x10]
jb 0x447264
call fcn.00490fc0
mov r12, qword [rsi]
test r12, r12
je 0x447276
mov eax, dword [r15 + 0x14]
cmp dword [r12], eax
je 0x447287
cmp rsi, qword [rbp + 0x10]
jb 0x447281
call fcn.00490fc0
add rsi, 8
jmp 0x447222
mov rdx, qword [r12 + 0x60]
lea rcx, [rdx - 0x18]
lea rsi, [rbx - 0x18]
cmp rcx, rsi
je 0x4472ee
cmp dword [rsi + 0x10], 0
jl 0x4472db
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x4472db
call fcn.004097c0
mov rbx, rax
mov ecx, r13d
lock xadd dword [rsi + 0x10], ecx
add ecx, r13d
test ecx, ecx
jg 0x4472cb
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
add rbx, 0x18
mov qword [rsp + 0x20], rbx
mov rdi, qword [rsp + 0x28]
jmp 0x4472ee
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.00415b80
mov rbx, qword [rsp + 0x20]
mov rdx, qword [r12 + 0x28]
lea rcx, [rdx - 0x18]
lea rsi, [rdi - 0x18]
cmp rcx, rsi
je 0x447355
cmp dword [rsi + 0x10], 0
jl 0x447342
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x447342
call fcn.004097c0
mov rdi, rax
mov ecx, r13d
lock xadd dword [rsi + 0x10], ecx
add ecx, r13d
test ecx, ecx
jg 0x447332
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
add rdi, 0x18
mov qword [rsp + 0x28], rdi
mov rbx, qword [rsp + 0x20]
jmp 0x447355
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.00415b80
mov rdi, qword [rsp + 0x28]
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov dword [rsp + 0x50], 0x238
cmp rax, 0xffffffffffffffff
je 0x4473c1
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4473b0
lea rdx, [rsp + 0x7c]
mov rcx, rbx
call fcn.00494b50
test eax, eax
je 0x4473a5
lea rdx, [rsp + 0x50]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x4473ac
jmp 0x447381
mov ebx, 1
jmp 0x4473b2
xor ebx, ebx
jmp 0x4473b2
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x4473e8
jmp 0x4473c3
xor ebx, ebx
cmp dword [rdi - 0x10], 0
je 0x4473e0
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x4473e0
mov ebx, 1
jmp 0x4473e8
mov dword [r15 + 0x14], 0xffffffff
lea rdx, [rdi - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x447405
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
add r13d, 0xffffffff
test r13d, r13d
jg 0x447427
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
jmp 0x44742d
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.004902e0
mov rbx, qword [rsp + 0x2d8]
mov rbp, qword [rsp + 0x2e0]
mov rsi, qword [rsp + 0x2e8]
mov rdi, qword [rsp + 0x2c0]
mov r12, qword [rsp + 0x2b8]
mov r13, qword [rsp + 0x2b0]
mov r14, qword [rsp + 0x2a8]
mov r15, qword [rsp + 0x2a0]
add rsp, 0x2c8
ret