Function at 0x140005b00
Capabilities:
Enumerate processes
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x590], rax
mov rdi, r9
mov qword [rsp + 0x40], r8
mov r12d, edx
mov rsi, rcx
mov ecx, dword [0x14023e898]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1401f9154], ecx
jg 0x140005f45
xor edx, edx
mov r8d, 0xea0
mov rcx, rdi
call fcn.14012d4b0
mov edx, 0xfffffff0
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov r14, rax
mov edx, 0xffffffec
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov r13, rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor ecx, ecx
test eax, eax
jne 0x140005bd7
mov dword [rdi], ecx
xor al, al
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.14012bda0
mov rbx, qword [rsp + 0x6e8]
add rsp, 0x6a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp dword [rdi], ecx
je 0x140005bab
mov rbx, r14
shr rbx, 0x1c
and bl, 1
je 0x140005c5a
test r14, 0x50000
jne 0x140005bf4
mov bl, cl
jmp 0x140005c5a
mov bl, 1
mov r15d, dword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp r15d, eax
je 0x140005c15
cmp r15d, r12d
je 0x140005c15
bt r14, 0x1e
jb 0x140005c15
test r13b, r13b
jns 0x140005c1b
xor eax, eax
mov bl, al
jmp 0x140005c5a
mov rdx, rsi
mov rcx, qword [0x14022a9e0]
call fcn.1400266c8
xor r15d, r15d
test al, al
je 0x140005c36
mov bl, r15b
jmp 0x140005c5a
mov rax, qword [0x14022a9e0]
mov rcx, qword [rax + 0x3e58]
test rcx, rcx
je 0x140005c5a
mov rdx, rsi
call fcn.140062a80
movzx ebx, bl
test al, al
cmovne ebx, r15d
lea rdx, [rdi + 0x68]
mov r12d, 0x104
mov r8d, r12d
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea r15, [rdi + 0x270]
mov r8d, r12d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r12, [rdi + 0x478]
mov edx, 1
mov rcx, qword [0x14022ab50]
call fcn.14007f158
test eax, eax
je 0x140005cdb
mov qword [rsp + 0x38], r15
lea rax, [rdi + 0x68]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov r9d, esi
mov r8, r12
lea rdx, str.Attach:_s_x_08X_x_08X_x_08X__s___s_
lea rcx, [rsp + 0x70]
call fcn.140004734
lea rcx, [rsp + 0x70]
call fcn.140104174
xor r13d, r13d
test bl, bl
je 0x140005bab
lea rsi, [rdi + 8]
mov r8d, dword [rdi]
lea rdx, [0x140175bf0]
mov rcx, rsi
call fcn.1400011a0
movsd xmm0, qword [str.__32_]
movsd qword [rsp + 0x58], xmm0
mov eax, dword [0x1401771b8]
mov dword [rsp + 0x60], eax
movsd xmm0, qword [str.__64_]
movsd qword [rsp + 0x48], xmm0
mov eax, dword [0x1401771c8]
mov dword [rsp + 0x50], eax
mov r14b, r13b
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140005da5
lea rbx, [rdi + 4]
lea rax, [rdi + 0x680]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x410
mov qword [rsp + 0x20], rax
mov r9d, 0x104
mov r8, r12
mov edx, dword [rdi]
call fcn.140006494
mov r14b, al
test al, al
je 0x140005da5
cmp byte [0x1401f9150], r13b
je 0x140005f18
cmp dword [rbx], r13d
je 0x140005f18
lea r8, [rsp + 0x48]
lea rax, [rsp + 0x58]
cmp dword [rbx], 0x40
cmovne r8, rax
lea edx, [r13 + 0x20]
mov rcx, rsi
call fcn.140001e48
jmp 0x140005f18
xor edx, edx
mov ecx, dword [rdi]
call fcn.140119e1c
mov dword [rdi + 4], eax
mov ebx, 0x20
cmp byte [0x1401f9150], r13b
je 0x140005dde
test eax, eax
je 0x140005dde
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x58]
cmp eax, 0x40
cmovne r8, rcx
mov edx, ebx
mov rcx, rsi
call fcn.140001e48
mov edx, dword [rdi]
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r15, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140005e94
mov dword [rsp + 0x70], 0x438
xor edx, edx
mov r8d, 0x434
lea rcx, [rsp + 0x74]
call fcn.14012d4b0
lea rdx, [rsp + 0x70]
mov rcx, r15
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x140005e70
cmp word [rbp - 0x60], r13w
je 0x140005e33
lea rax, [rbp - 0x60]
jmp 0x140005e3f
lea rcx, [rbp + 0x1a0]
call fcn.140118eac
mov r8d, 0x104
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rcx, [rdi + 0x680]
mov r8d, 0x410
lea rdx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov r14b, 1
jmp 0x140005e89
cmp byte [0x1401f9150], r13b
je 0x140005e89
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, rsi
call fcn.140001e48
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005ea3
lea rdx, [0x140176b20]
mov rcx, r12
call fcn.1400047d8
test r14b, r14b
jne 0x140005f18
mov dword [rsp + 0x70], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x74]
call fcn.14012d4b0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140005f18
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140005f18
mov ecx, dword [rdi]
cmp dword [rsp + 0x78], ecx
je 0x140005f01
lea rdx, [rsp + 0x70]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
jmp 0x140005ee6
lea rcx, [rdi + 0x478]
mov r8d, 0x104
lea rdx, [rbp - 0x64]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rcx, [rdi + 0x68]
call fcn.140119c40
lea rcx, [0x140176ec8]
lea rdx, [0x140176ed0]
test al, al
cmovne rdx, rcx
lea rcx, [rdi + 0x48]
call fcn.14000478c
mov al, 1
jmp 0x140005bad
lea rcx, [0x1401f9154]
call fcn.14012bf4c
cmp dword [0x1401f9154], 0xffffffff
jne 0x140005b65
call fcn.140116890
mov byte [0x1401f9150], al
lea rcx, [0x1401f9154]
call fcn.14012beec
jmp 0x140005b65