Function at 0x140005df0
Capabilities:
Enumerate processes
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x590], rax
mov rdi, r9
mov qword [rsp + 0x40], r8
mov r12d, edx
mov rsi, rcx
mov ecx, dword [0x140230448]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1401ead24], ecx
jg 0x140006235
xor edx, edx
mov r8d, 0xea0
mov rcx, rdi
call fcn.14013b230
mov edx, 0xfffffff0
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov r14, rax
mov edx, 0xffffffec
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov r13, rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor ecx, ecx
test eax, eax
jne 0x140005ec7
mov dword [rdi], ecx
xor al, al
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.140139b10
mov rbx, qword [rsp + 0x6e8]
add rsp, 0x6a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp dword [rdi], ecx
je 0x140005e9b
mov rbx, r14
shr rbx, 0x1c
and bl, 1
je 0x140005f4a
test r14, 0x50000
jne 0x140005ee4
mov bl, cl
jmp 0x140005f4a
mov bl, 1
mov r15d, dword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp r15d, eax
je 0x140005f05
cmp r15d, r12d
je 0x140005f05
bt r14, 0x1e
jb 0x140005f05
test r13b, r13b
jns 0x140005f0b
xor eax, eax
mov bl, al
jmp 0x140005f4a
mov rdx, rsi
mov rcx, qword [0x14021c5d8]
call fcn.140027c0c
xor r15d, r15d
test al, al
je 0x140005f26
mov bl, r15b
jmp 0x140005f4a
mov rax, qword [0x14021c5d8]
mov rcx, qword [rax + 0x3fc0]
test rcx, rcx
je 0x140005f4a
mov rdx, rsi
call fcn.140066e84
movzx ebx, bl
test al, al
cmovne ebx, r15d
lea rdx, [rdi + 0x68]
mov r12d, 0x104
mov r8d, r12d
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea r15, [rdi + 0x270]
mov r8d, r12d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r12, [rdi + 0x478]
mov edx, 1
mov rcx, qword [0x14021c740]
call fcn.140087888
test eax, eax
je 0x140005fcb
mov qword [rsp + 0x38], r15
lea rax, [rdi + 0x68]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov r9d, esi
mov r8, r12
lea rdx, str.Attach:_s_x_08X_x_08X_x_08X__s___s_
lea rcx, [rsp + 0x70]
call fcn.140004a2c
lea rcx, [rsp + 0x70]
call fcn.140110564
xor r13d, r13d
test bl, bl
je 0x140005e9b
lea rsi, [rdi + 8]
mov r8d, dword [rdi]
lea rdx, [0x140167f50]
mov rcx, rsi
call fcn.140001190
movsd xmm0, qword [str.__32_]
movsd qword [rsp + 0x58], xmm0
mov eax, dword [0x1401695b8]
mov dword [rsp + 0x60], eax
movsd xmm0, qword [str.__64_]
movsd qword [rsp + 0x48], xmm0
mov eax, dword [0x1401695c8]
mov dword [rsp + 0x50], eax
mov r14b, r13b
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140006095
lea rbx, [rdi + 4]
lea rax, [rdi + 0x680]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x410
mov qword [rsp + 0x20], rax
mov r9d, 0x104
mov r8, r12
mov edx, dword [rdi]
call fcn.140006780
mov r14b, al
test al, al
je 0x140006095
cmp byte [0x1401ead20], r13b
je 0x140006208
cmp dword [rbx], r13d
je 0x140006208
lea r8, [rsp + 0x48]
lea rax, [rsp + 0x58]
cmp dword [rbx], 0x40
cmovne r8, rax
lea edx, [r13 + 0x20]
mov rcx, rsi
call fcn.140001f38
jmp 0x140006208
xor edx, edx
mov ecx, dword [rdi]
call fcn.140126f14
mov dword [rdi + 4], eax
mov ebx, 0x20
cmp byte [0x1401ead20], r13b
je 0x1400060ce
test eax, eax
je 0x1400060ce
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x58]
cmp eax, 0x40
cmovne r8, rcx
mov edx, ebx
mov rcx, rsi
call fcn.140001f38
mov edx, dword [rdi]
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r15, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140006184
mov dword [rsp + 0x70], 0x438
xor edx, edx
mov r8d, 0x434
lea rcx, [rsp + 0x74]
call fcn.14013b230
lea rdx, [rsp + 0x70]
mov rcx, r15
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x140006160
cmp word [rbp - 0x60], r13w
je 0x140006123
lea rax, [rbp - 0x60]
jmp 0x14000612f
lea rcx, [rbp + 0x1a0]
call fcn.140125c18
mov r8d, 0x104
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rcx, [rdi + 0x680]
mov r8d, 0x410
lea rdx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov r14b, 1
jmp 0x140006179
cmp byte [0x1401ead20], r13b
je 0x140006179
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, rsi
call fcn.140001f38
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006193
lea rdx, [0x140168f20]
mov rcx, r12
call fcn.140004ad0
test r14b, r14b
jne 0x140006208
mov dword [rsp + 0x70], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x74]
call fcn.14013b230
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140006208
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140006208
mov ecx, dword [rdi]
cmp dword [rsp + 0x78], ecx
je 0x1400061f1
lea rdx, [rsp + 0x70]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
jmp 0x1400061d6
lea rcx, [rdi + 0x478]
mov r8d, 0x104
lea rdx, [rbp - 0x64]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rcx, [rdi + 0x68]
call fcn.140126814
lea rcx, [0x1401692c8]
lea rdx, [0x1401692d0]
test al, al
cmovne rdx, rcx
lea rcx, [rdi + 0x48]
call fcn.140004a84
mov al, 1
jmp 0x140005e9d
lea rcx, [0x1401ead24]
call fcn.140139cb8
cmp dword [0x1401ead24], 0xffffffff
jne 0x140005e55
call fcn.140123504
mov byte [0x1401ead20], al
lea rcx, [0x1401ead24]
call fcn.140139c58
jmp 0x140005e55