Function at 0x447d70
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
sub rsp, 0x528
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
mov qword [rax - 0x30], r15
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rdi, rdx
mov rbx, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x24], r12d
mov dword [rsp + 0x30], r12d
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x30], r12d
jne 0x447dec
xor eax, eax
jmp 0x44878b
mov r8d, 0x104
lea rdx, [rsp + 0x2d0]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rsi, [rbx + 0x40]
mov qword [rsp + 0x28], rsi
mov rdi, qword [rsi + 8]
cmp rdi, qword [rsi + 0x10]
jbe 0x447e1b
call fcn.00490fc0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
mov r15, 0xffffffffffffffff
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov rdi, qword [rsi + 0x10]
cmp qword [rsi + 8], rdi
jbe 0x447e50
call fcn.00490fc0
test r14, r14
je 0x447e5a
cmp r14, rsi
je 0x447e5f
call fcn.00490fc0
cmp r13, rdi
je 0x4481d9
test r14, r14
jne 0x447e72
call fcn.00490fc0
cmp r13, qword [r14 + 0x10]
jb 0x447e7d
call fcn.00490fc0
mov r12, qword [r13]
test r12, r12
je 0x4481b9
lea rbp, [r12 + 8]
mov rdi, qword [rbp + 8]
cmp rdi, qword [rbp + 0x10]
jbe 0x447e9e
call fcn.00490fc0
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rdi
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x60], xmm0
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
nop
mov rdi, qword [rbp + 0x10]
cmp qword [rbp + 8], rdi
jbe 0x447ecf
call fcn.00490fc0
test rsi, rsi
je 0x447ed9
cmp rsi, rbp
je 0x447ede
call fcn.00490fc0
cmp rbx, rdi
je 0x4481a6
test rsi, rsi
jne 0x447ef1
call fcn.00490fc0
cmp rbx, qword [rsi + 0x10]
jb 0x447efc
call fcn.00490fc0
mov rax, qword [rbx]
lea rdi, [rsp + 0x2d0]
sub rdi, rax
nop
nop
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x447f23
add rax, 2
test ecx, ecx
jne 0x447f10
test edx, edx
je 0x447f38
cmp rbx, qword [rsi + 0x10]
jb 0x447f32
call fcn.00490fc0
add rbx, 8
jmp 0x447ec0
mov eax, dword [r12]
mov dword [rsp + 0x24], eax
cmp rbx, qword [rsi + 0x10]
jb 0x447f4b
call fcn.00490fc0
mov rdx, qword [rbx]
lea rbx, [rdx - 0x18]
mov rdi, qword [r12 + 0x28]
sub rdi, 0x18
cmp rbx, rdi
je 0x448009
cmp dword [rdi + 0x10], 0
jl 0x447ffb
mov rcx, qword [rbx]
cmp rcx, qword [rdi]
jne 0x447ffb
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx + 0x10], 0
jl 0x447f98
cmp rax, qword [rbx]
jne 0x447f98
mov rsi, rbx
lock add dword [rbx + 0x10], 1
jmp 0x447fd5
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx + 8]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x4481cd
mov eax, dword [rbx + 8]
mov dword [rsi + 8], eax
mov eax, dword [rbx + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rbx + 0x18]
add rdx, rdx
lea rcx, [rsi + 0x18]
call fcn.00490ae0
mov eax, r15d
lock xadd dword [rdi + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x447ff0
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [r12 + 0x28], rax
jmp 0x448009
mov r8d, dword [rdx - 0x10]
lea rcx, [r12 + 0x28]
call fcn.00415b80
mov rcx, qword [r12 + 0x48]
test rcx, rcx
je 0x44803e
mov rax, qword [r12 + 0x50]
sub rax, rcx
sar rax, 3
je 0x44803e
mov rdi, rcx
cmp rcx, qword [r12 + 0x50]
jbe 0x448030
call fcn.00490fc0
cmp rdi, qword [r12 + 0x50]
jb 0x4480b2
call fcn.00490fc0
jmp 0x4480b2
lea rcx, [0x00507908]
mov rax, qword [0x00507908]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [0x004d0d8c]
test rdx, 0xffffffffffff0000
jne 0x44808b
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.00407f30
test rax, rax
je 0x4480a8
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.00415cf0
jmp 0x4480a8
xor eax, eax
mov rcx, r15
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x48]
call fcn.00415b80
nop
lea rdi, [rsp + 0x48]
or dword [rsp + 0x20], 1
mov rdx, qword [rdi]
lea rbx, [rdx - 0x18]
mov rdi, qword [r12 + 0x60]
sub rdi, 0x18
cmp rbx, rdi
je 0x448171
cmp dword [rdi + 0x10], 0
jl 0x448162
mov rcx, qword [rbx]
cmp rcx, qword [rdi]
jne 0x448162
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx + 0x10], 0
jl 0x4480ff
cmp rax, qword [rbx]
jne 0x4480ff
mov rsi, rbx
lock add dword [rbx + 0x10], 1
jmp 0x44813c
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx + 8]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x4481d3
mov eax, dword [rbx + 8]
mov dword [rsi + 8], eax
mov eax, dword [rbx + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rbx + 0x18]
add rdx, rdx
lea rcx, [rsi + 0x18]
call fcn.00490ae0
mov eax, r15d
lock xadd dword [rdi + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x448157
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [r12 + 0x60], rax
jmp 0x448171
mov r8d, dword [rdx - 0x10]
lea rcx, [r12 + 0x60]
call fcn.00415b80
nop
mov eax, dword [rsp + 0x20]
test al, 1
je 0x4481ad
and dword [rsp + 0x20], 0xfffffffe
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4481b4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x28]
jmp 0x4481b9
mov rsi, qword [rsp + 0x28]
jmp 0x4481b9
mov rsi, qword [rsp + 0x28]
jmp 0x4481b9
mov rsi, qword [rsp + 0x28]
cmp r13, qword [r14 + 0x10]
jb 0x4481c4
call fcn.00490fc0
add r13, 8
jmp 0x447e41
call fcn.00408730
nop
call fcn.00408730
nop
mov r13d, dword [rsp + 0x24]
test r13d, r13d
jne 0x448788
lea rcx, [0x00507908]
mov rax, qword [0x00507908]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
mov dword [rsp + 0x90], 0x238
cmp rax, 0xffffffffffffffff
je 0x448381
lea rdx, [rsp + 0x90]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x448378
nop
nop
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x98], eax
je 0x448267
lea rdx, [rsp + 0x90]
mov rcx, rbp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x448378
jmp 0x448240
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0xbc]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x4482e4
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x448378
cmp dword [rdx + 0x10], eax
jge 0x4482b5
cmp dword [rbx - 0xc], eax
jge 0x4482aa
mov ecx, 0x80070057
call fcn.00407f10
int3
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x448378
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4482cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
jmp 0x448378
mov esi, dword [rbx - 0x10]
lea r12, [rsp + 0xbc]
sub r12, rbx
sar r12, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x448317
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.0040dbb0
mov rbx, qword [rsp + 0x38]
cmp r12, rsi
ja 0x448337
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + r12*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.00490bb0
jmp 0x448354
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xbc]
mov rdx, rsi
mov rcx, rbx
call fcn.00490ae0
test edi, edi
js 0x44836d
cmp edi, dword [rbx - 0xc]
jg 0x44836d
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
mov rsi, qword [rsp + 0x28]
jmp 0x448378
mov ecx, 0x80070057
call fcn.00407f10
int3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbx - 0x10], 0
je 0x44876c
mov rdi, qword [rsi + 8]
cmp rdi, qword [rsi + 0x10]
jbe 0x44839a
call fcn.00490fc0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
nop
nop
mov rdi, qword [rsi + 0x10]
cmp qword [rsi + 8], rdi
jbe 0x4483cf
call fcn.00490fc0
test r15, r15
je 0x4483d9
cmp r15, rsi
je 0x4483de
call fcn.00490fc0
cmp r14, rdi
je 0x448760
test r15, r15
jne 0x4483f1
call fcn.00490fc0
cmp r14, qword [r15 + 0x10]
jb 0x4483fc
call fcn.00490fc0
mov r13, qword [r14]
test r13, r13
je 0x448740
lea r12, [r13 + 0x40]
mov rdi, qword [r12 + 8]
cmp rdi, qword [r12 + 0x10]
jbe 0x44841d
call fcn.00490fc0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rdi
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
nop
mov rbp, qword [r12 + 0x10]
cmp qword [r12 + 8], rbp
jbe 0x448451
call fcn.00490fc0
test rsi, rsi
je 0x44845b
cmp rsi, r12
je 0x448460
call fcn.00490fc0
cmp rdi, rbp
je 0x448734
test rsi, rsi
jne 0x448473
call fcn.00490fc0
cmp rdi, qword [rsi + 0x10]
jb 0x44847e
call fcn.00490fc0
mov rdx, rbx
mov rcx, qword [rdi]
call fcn.00494b50
test eax, eax
je 0x44849e
cmp rdi, qword [rsi + 0x10]
jb 0x448498
call fcn.00490fc0
add rdi, 8
jmp 0x448440
mov eax, dword [r13]
mov dword [rsp + 0x24], eax
cmp rdi, qword [rsi + 0x10]
jb 0x4484b1
call fcn.00490fc0
mov rdx, qword [rdi]
lea rdi, [rdx - 0x18]
mov rsi, qword [r13 + 0x60]
sub rsi, 0x18
cmp rdi, rsi
je 0x448581
cmp dword [rsi + 0x10], 0
jl 0x44856b
mov rcx, qword [rdi]
cmp rcx, qword [rsi]
jne 0x44856b
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi + 0x10], 0
jl 0x4484fd
cmp rax, qword [rdi]
jne 0x4484fd
mov rbx, rdi
lock add dword [rdi + 0x10], 1
jmp 0x44853a
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi + 8]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x448754
mov eax, dword [rdi + 8]
mov dword [rbx + 8], eax
mov eax, dword [rdi + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rdi + 0x18]
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.00490ae0
mov r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rsi + 0x10], eax
add eax, r12d
test eax, eax
jg 0x44855c
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [r13 + 0x60], rax
mov rbx, qword [rsp + 0x38]
jmp 0x448588
mov r8d, dword [rdx - 0x10]
lea rcx, [r13 + 0x60]
call fcn.00415b80
mov r12, 0xffffffffffffffff
jmp 0x448588
mov r12, 0xffffffffffffffff
mov rcx, qword [r13 + 0x10]
test rcx, rcx
je 0x4485b9
mov rax, qword [r13 + 0x18]
sub rax, rcx
sar rax, 3
je 0x4485b9
mov rdi, rcx
cmp rcx, qword [r13 + 0x18]
jbe 0x4485ac
call fcn.00490fc0
cmp rdi, qword [r13 + 0x18]
jb 0x44862d
call fcn.00490fc0
jmp 0x44862d
lea rcx, [0x00507908]
mov rax, qword [0x00507908]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [0x004d0d8c]
test rdx, 0xffffffffffff0000
jne 0x448606
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.00407f30
test rax, rax
je 0x448623
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.00415cf0
jmp 0x448623
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.00415b80
nop
lea rdi, [rsp + 0x40]
or dword [rsp + 0x20], 2
mov rdx, qword [rdi]
lea rdi, [rdx - 0x18]
mov rsi, qword [r13 + 0x28]
sub rsi, 0x18
cmp rdi, rsi
je 0x4486ee
cmp dword [rsi + 0x10], 0
jl 0x4486e0
mov rcx, qword [rdi]
cmp rcx, qword [rsi]
jne 0x4486e0
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi + 0x10], 0
jl 0x448679
cmp rax, qword [rdi]
jne 0x448679
mov rbx, rdi
lock add dword [rdi + 0x10], 1
jmp 0x4486b6
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi + 8]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x44875a
mov eax, dword [rdi + 8]
mov dword [rbx + 8], eax
mov eax, dword [rdi + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rdi + 0x18]
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.00490ae0
mov eax, r12d
lock xadd dword [rsi + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4486d1
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [r13 + 0x28], rax
mov rbx, qword [rsp + 0x38]
jmp 0x4486ee
mov r8d, dword [rdx - 0x10]
lea rcx, [r13 + 0x28]
call fcn.00415b80
nop
mov eax, dword [rsp + 0x20]
test al, 2
je 0x44873b
and dword [rsp + 0x20], 0xfffffffd
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x448728
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x28]
jmp 0x448740
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x28]
jmp 0x448740
mov rsi, qword [rsp + 0x28]
jmp 0x448740
mov rsi, qword [rsp + 0x28]
cmp r14, qword [r15 + 0x10]
jb 0x44874b
call fcn.00490fc0
add r14, 8
jmp 0x4483c0
call fcn.00408730
nop
call fcn.00408730
nop
mov r15, 0xffffffffffffffff
mov r13d, dword [rsp + 0x24]
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r15d
add r15d, 0xffffffff
test r15d, r15d
jg 0x448788
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r13d
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.004902e0
mov rbx, qword [rsp + 0x540]
mov rbp, qword [rsp + 0x548]
mov rsi, qword [rsp + 0x520]
mov rdi, qword [rsp + 0x518]
mov r12, qword [rsp + 0x510]
mov r13, qword [rsp + 0x508]
mov r14, qword [rsp + 0x500]
mov r15, qword [rsp + 0x4f8]
add rsp, 0x528
ret