Function at 0x41040550
Capabilities:
Enumerate processes

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
sub rsp, 0x740
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0x730], rax
mov rbp, rcx
xor r12d, r12d
mov dword [r11 - 0x688], r12d
xor edx, edx
mov r8d, 0x234
lea rcx, [r11 - 0x684]
call fcn.412121c0
mov word [rsp + 0x310], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x312]
call fcn.412121c0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x410405df
xor eax, eax
jmp 0x41040988
mov dword [rsp + 0xd0], 0x238
lea rdx, [rsp + 0xd0]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4104097a
lea r13, str.chrome.exe
nop
nop
mov rcx, r12
nop
nop
nop
nop
movzx eax, word [rsp + rcx + 0xfc]
mov word [rsp + rcx + 0x310], ax
add rcx, 2
test ax, ax
jne 0x41040620
lea rcx, [rsp + 0x310]
call fcn.41212d20
mov edi, r12d
mov rbx, r13
nop
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0xa8]
call fcn.4103afe0
cmp qword [rsp + 0xc0], r12
je 0x41040695
lea rcx, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae rcx, qword [rsp + 0xb0]
mov rdx, qword [rbx]
call fcn.41213c60
test eax, eax
je 0x410406d6
cmp qword [rsp + 0xc8], 8
jb 0x410406ad
mov rcx, qword [rsp + 0xb0]
call fcn.41210d60
add edi, 1
add rbx, 8
cmp edi, 0xf
jb 0x41040650
lea rdx, [rsp + 0xd0]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x4104097a
jmp 0x41040610
cmp qword [rsp + 0xc8], 8
jb 0x410406ee
mov rcx, qword [rsp + 0xb0]
call fcn.41210d60
mov word [rsp + 0x520], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x522]
call fcn.412121c0
mov r8d, dword [rsp + 0xd8]
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x104
lea r8, [rsp + 0x520]
xor edx, edx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExW
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x48], rdx
mov edx, 7
mov qword [rsp + 0x40], rdx
mov r8, r12
mov qword [rsp + 0x38], r12
mov word [rsp + 0x28], r8w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x520]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
movabs rsi, 0x7ffffffffffffffe
cmp rcx, rsi
jbe 0x41040794
call fcn.4120fbc0
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
cmp rdx, rbx
jae 0x410407ad
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.41022ab0
mov rdx, qword [rsp + 0x40]
jmp 0x410407cc
test rbx, rbx
jne 0x410407cc
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x28]
cmp rdx, 8
cmovae rax, qword [rsp + 0x28]
mov word [rax], r12w
jmp 0x41040812
test rbx, rbx
je 0x41040812
lea rcx, [rsp + 0x28]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x28]
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x520]
call fcn.412118b0
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rax, qword [rsp + 0x28]
mov word [rdi + rax], r12w
mov edx, 7
mov qword [rsp + 0xc8], rdx
mov r8, r12
mov qword [rsp + 0xc0], r12
mov word [rsp + 0xb0], r8w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x310]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
cmp rcx, rsi
jbe 0x41040868
call fcn.4120fbc0
mov rdx, qword [rsp + 0xc8]
mov r8, qword [rsp + 0xc0]
cmp rdx, rbx
jae 0x41040887
mov rdx, rbx
lea rcx, [rsp + 0xa8]
call fcn.41022ab0
mov rdx, qword [rsp + 0xc8]
jmp 0x410408ae
test rbx, rbx
jne 0x410408ae
mov qword [rsp + 0xc0], r12
lea rax, [rsp + 0xb0]
cmp rdx, 8
cmovae rax, qword [rsp + 0xb0]
mov word [rax], bx
jmp 0x41040907
test rbx, rbx
je 0x41040907
lea rcx, [rsp + 0xb0]
cmp rdx, 8
cmovae rcx, qword [rsp + 0xb0]
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x310]
call fcn.412118b0
mov qword [rsp + 0xc0], rbx
lea rax, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae rax, qword [rsp + 0xb0]
mov word [rdi + rax], 0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x58]
call fcn.41039b90
nop
mov rdx, rax
mov rcx, rbp
call fcn.41040240
nop
cmp qword [rsp + 0xa0], 8
jb 0x41040943
mov rcx, qword [rsp + 0x88]
call fcn.41210d60
mov qword [rsp + 0xa0], 7
mov qword [rsp + 0x98], r12
mov word [rsp + 0x88], 0
cmp qword [rsp + 0x78], 8
jb 0x41040973
mov rcx, qword [rsp + 0x60]
call fcn.41210d60
mov eax, 1
jmp 0x41040988
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x730]
xor rcx, rsp
call fcn.41211b80
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret