Function at 0x44f220
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
sub rsp, 0x528
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
mov qword [rax - 0x30], r15
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rdi, rdx
mov rbx, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x24], r12d
mov dword [rsp + 0x30], r12d
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x30], r12d
jne 0x44f29c
xor eax, eax
jmp 0x44fc5b
mov r8d, 0x104
lea rdx, [rsp + 0x2d0]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rsi, [rsp + 0x2d0]
lea rdi, str.SynShapedFrameWindowClass
mov ecx, 0x1a
repe cmpsw word [rsi], word [rdi]
jne 0x44f2d6
mov eax, 0xffffffff
jmp 0x44fc5b
add rbx, 0x40
mov qword [rsp + 0x28], rbx
mov rdi, qword [rbx + 8]
cmp rdi, qword [rbx + 0x10]
jbe 0x44f2ee
call fcn.004a7de0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
mov r15, 0xffffffffffffffff
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov rdi, qword [rbx + 0x10]
cmp qword [rbx + 8], rdi
jbe 0x44f323
call fcn.004a7de0
test r14, r14
je 0x44f32d
cmp r14, rbx
je 0x44f332
call fcn.004a7de0
cmp r13, rdi
je 0x44f6a9
test r14, r14
jne 0x44f345
call fcn.004a7de0
cmp r13, qword [r14 + 0x10]
jb 0x44f350
call fcn.004a7de0
mov r12, qword [r13]
test r12, r12
je 0x44f689
lea rbp, [r12 + 8]
mov rdi, qword [rbp + 8]
cmp rdi, qword [rbp + 0x10]
jbe 0x44f371
call fcn.004a7de0
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rdi
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x60], xmm0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rbp + 0x10]
cmp qword [rbp + 8], rdi
jbe 0x44f39f
call fcn.004a7de0
test rbx, rbx
je 0x44f3a9
cmp rbx, rbp
je 0x44f3ae
call fcn.004a7de0
cmp rsi, rdi
je 0x44f676
test rbx, rbx
jne 0x44f3c1
call fcn.004a7de0
cmp rsi, qword [rbx + 0x10]
jb 0x44f3cc
call fcn.004a7de0
mov rax, qword [rsi]
lea rdi, [rsp + 0x2d0]
sub rdi, rax
nop
nop
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x44f3f3
add rax, 2
test ecx, ecx
jne 0x44f3e0
test edx, edx
je 0x44f408
cmp rsi, qword [rbx + 0x10]
jb 0x44f402
call fcn.004a7de0
add rsi, 8
jmp 0x44f390
mov eax, dword [r12]
mov dword [rsp + 0x24], eax
cmp rsi, qword [rbx + 0x10]
jb 0x44f41b
call fcn.004a7de0
mov rdx, qword [rsi]
lea rsi, [rdx - 0x18]
mov rdi, qword [r12 + 0x28]
sub rdi, 0x18
cmp rsi, rdi
je 0x44f4d9
cmp dword [rdi + 0x10], 0
jl 0x44f4cb
mov rcx, qword [rsi]
cmp rcx, qword [rdi]
jne 0x44f4cb
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rsi + 0x10], 0
jl 0x44f468
cmp rax, qword [rsi]
jne 0x44f468
mov rbx, rsi
lock add dword [rsi + 0x10], 1
jmp 0x44f4a5
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rsi + 8]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x44f69d
mov eax, dword [rsi + 8]
mov dword [rbx + 8], eax
mov eax, dword [rsi + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rsi + 0x18]
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.004a7900
mov eax, r15d
lock xadd dword [rdi + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x44f4c0
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [r12 + 0x28], rax
jmp 0x44f4d9
mov r8d, dword [rdx - 0x10]
lea rcx, [r12 + 0x28]
call fcn.00416fd0
mov rcx, qword [r12 + 0x48]
test rcx, rcx
je 0x44f50e
mov rax, qword [r12 + 0x50]
sub rax, rcx
sar rax, 3
je 0x44f50e
mov rdi, rcx
cmp rcx, qword [r12 + 0x50]
jbe 0x44f500
call fcn.004a7de0
cmp rdi, qword [r12 + 0x50]
jb 0x44f582
call fcn.004a7de0
jmp 0x44f582
lea rcx, [0x00522a28]
mov rax, qword [0x00522a28]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [0x004e7dfc]
test rdx, 0xffffffffffff0000
jne 0x44f55b
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.00409680
test rax, rax
je 0x44f578
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.00417140
jmp 0x44f578
xor eax, eax
mov rcx, r15
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x48]
call fcn.00416fd0
nop
lea rdi, [rsp + 0x48]
or dword [rsp + 0x20], 1
mov rdx, qword [rdi]
lea rsi, [rdx - 0x18]
mov rdi, qword [r12 + 0x60]
sub rdi, 0x18
cmp rsi, rdi
je 0x44f641
cmp dword [rdi + 0x10], 0
jl 0x44f632
mov rcx, qword [rsi]
cmp rcx, qword [rdi]
jne 0x44f632
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rsi + 0x10], 0
jl 0x44f5cf
cmp rax, qword [rsi]
jne 0x44f5cf
mov rbx, rsi
lock add dword [rsi + 0x10], 1
jmp 0x44f60c
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rsi + 8]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x44f6a3
mov eax, dword [rsi + 8]
mov dword [rbx + 8], eax
mov eax, dword [rsi + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rsi + 0x18]
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.004a7900
mov eax, r15d
lock xadd dword [rdi + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x44f627
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [r12 + 0x60], rax
jmp 0x44f641
mov r8d, dword [rdx - 0x10]
lea rcx, [r12 + 0x60]
call fcn.00416fd0
nop
mov eax, dword [rsp + 0x20]
test al, 1
je 0x44f67d
and dword [rsp + 0x20], 0xfffffffe
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x44f684
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x28]
jmp 0x44f689
mov rbx, qword [rsp + 0x28]
jmp 0x44f689
mov rbx, qword [rsp + 0x28]
jmp 0x44f689
mov rbx, qword [rsp + 0x28]
cmp r13, qword [r14 + 0x10]
jb 0x44f694
call fcn.004a7de0
add r13, 8
jmp 0x44f314
call fcn.004050e0
nop
call fcn.004050e0
nop
mov r13d, dword [rsp + 0x24]
test r13d, r13d
jne 0x44fc58
lea rcx, [0x00522a28]
mov rax, qword [0x00522a28]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x38], rsi
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
mov dword [rsp + 0x90], 0x238
cmp rax, 0xffffffffffffffff
je 0x44f851
lea rdx, [rsp + 0x90]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x44f848
nop
nop
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x98], eax
je 0x44f737
lea rdx, [rsp + 0x90]
mov rcx, rbp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x44f848
jmp 0x44f710
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0xbc]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x44f7b4
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x44f848
cmp dword [rdx + 0x10], eax
jge 0x44f785
cmp dword [rsi - 0xc], eax
jge 0x44f77a
mov ecx, 0x80070057
call fcn.00404e30
int3
mov dword [rsi - 0x10], eax
mov word [rsi], ax
jmp 0x44f848
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x44f79d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x38], rsi
jmp 0x44f848
mov ebx, dword [rsi - 0x10]
lea r12, [rsp + 0xbc]
sub r12, rsi
sar r12, 1
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x44f7e7
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.00405890
mov rsi, qword [rsp + 0x38]
cmp r12, rbx
ja 0x44f807
movsxd rax, edi
lea rbx, [rax + rax]
lea r8, [rsi + r12*2]
mov r9, rbx
mov rdx, rbx
mov rcx, rsi
call fcn.004a79d0
jmp 0x44f824
movsxd rax, edi
lea rbx, [rax + rax]
mov r9, rbx
lea r8, [rsp + 0xbc]
mov rdx, rbx
mov rcx, rsi
call fcn.004a7900
test edi, edi
js 0x44f83d
cmp edi, dword [rsi - 0xc]
jg 0x44f83d
mov dword [rsi - 0x10], edi
mov word [rbx + rsi], 0
mov rbx, qword [rsp + 0x28]
jmp 0x44f848
mov ecx, 0x80070057
call fcn.00404e30
int3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsi - 0x10], 0
je 0x44fc3c
mov rdi, qword [rbx + 8]
cmp rdi, qword [rbx + 0x10]
jbe 0x44f86a
call fcn.004a7de0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
nop
nop
mov rdi, qword [rbx + 0x10]
cmp qword [rbx + 8], rdi
jbe 0x44f89f
call fcn.004a7de0
test r15, r15
je 0x44f8a9
cmp r15, rbx
je 0x44f8ae
call fcn.004a7de0
cmp r14, rdi
je 0x44fc30
test r15, r15
jne 0x44f8c1
call fcn.004a7de0
cmp r14, qword [r15 + 0x10]
jb 0x44f8cc
call fcn.004a7de0
mov r13, qword [r14]
test r13, r13
je 0x44fc10
lea r12, [r13 + 0x40]
mov rdi, qword [r12 + 8]
cmp rdi, qword [r12 + 0x10]
jbe 0x44f8ed
call fcn.004a7de0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rdi
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
nop
mov rbp, qword [r12 + 0x10]
cmp qword [r12 + 8], rbp
jbe 0x44f921
call fcn.004a7de0
test rbx, rbx
je 0x44f92b
cmp rbx, r12
je 0x44f930
call fcn.004a7de0
cmp rdi, rbp
je 0x44fc04
test rbx, rbx
jne 0x44f943
call fcn.004a7de0
cmp rdi, qword [rbx + 0x10]
jb 0x44f94e
call fcn.004a7de0
mov rdx, rsi
mov rcx, qword [rdi]
call fcn.004aae90
test eax, eax
je 0x44f96e
cmp rdi, qword [rbx + 0x10]
jb 0x44f968
call fcn.004a7de0
add rdi, 8
jmp 0x44f910
mov eax, dword [r13]
mov dword [rsp + 0x24], eax
cmp rdi, qword [rbx + 0x10]
jb 0x44f981
call fcn.004a7de0
mov rdx, qword [rdi]
lea rdi, [rdx - 0x18]
mov rbx, qword [r13 + 0x60]
sub rbx, 0x18
cmp rdi, rbx
je 0x44fa51
cmp dword [rbx + 0x10], 0
jl 0x44fa3b
mov rcx, qword [rdi]
cmp rcx, qword [rbx]
jne 0x44fa3b
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi + 0x10], 0
jl 0x44f9cd
cmp rax, qword [rdi]
jne 0x44f9cd
mov rsi, rdi
lock add dword [rdi + 0x10], 1
jmp 0x44fa0a
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi + 8]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x44fc24
mov eax, dword [rdi + 8]
mov dword [rsi + 8], eax
mov eax, dword [rdi + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rdi + 0x18]
add rdx, rdx
lea rcx, [rsi + 0x18]
call fcn.004a7900
mov r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rbx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x44fa2c
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [r13 + 0x60], rax
mov rsi, qword [rsp + 0x38]
jmp 0x44fa58
mov r8d, dword [rdx - 0x10]
lea rcx, [r13 + 0x60]
call fcn.00416fd0
mov r12, 0xffffffffffffffff
jmp 0x44fa58
mov r12, 0xffffffffffffffff
mov rcx, qword [r13 + 0x10]
test rcx, rcx
je 0x44fa89
mov rax, qword [r13 + 0x18]
sub rax, rcx
sar rax, 3
je 0x44fa89
mov rdi, rcx
cmp rcx, qword [r13 + 0x18]
jbe 0x44fa7c
call fcn.004a7de0
cmp rdi, qword [r13 + 0x18]
jb 0x44fafd
call fcn.004a7de0
jmp 0x44fafd
lea rcx, [0x00522a28]
mov rax, qword [0x00522a28]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [0x004e7dfc]
test rdx, 0xffffffffffff0000
jne 0x44fad6
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.00409680
test rax, rax
je 0x44faf3
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.00417140
jmp 0x44faf3
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.00416fd0
nop
lea rdi, [rsp + 0x40]
or dword [rsp + 0x20], 2
mov rdx, qword [rdi]
lea rdi, [rdx - 0x18]
mov rbx, qword [r13 + 0x28]
sub rbx, 0x18
cmp rdi, rbx
je 0x44fbbe
cmp dword [rbx + 0x10], 0
jl 0x44fbb0
mov rcx, qword [rdi]
cmp rcx, qword [rbx]
jne 0x44fbb0
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi + 0x10], 0
jl 0x44fb49
cmp rax, qword [rdi]
jne 0x44fb49
mov rsi, rdi
lock add dword [rdi + 0x10], 1
jmp 0x44fb86
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi + 8]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x44fc2a
mov eax, dword [rdi + 8]
mov dword [rsi + 8], eax
mov eax, dword [rdi + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rdi + 0x18]
add rdx, rdx
lea rcx, [rsi + 0x18]
call fcn.004a7900
mov eax, r12d
lock xadd dword [rbx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x44fba1
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [r13 + 0x28], rax
mov rsi, qword [rsp + 0x38]
jmp 0x44fbbe
mov r8d, dword [rdx - 0x10]
lea rcx, [r13 + 0x28]
call fcn.00416fd0
nop
mov eax, dword [rsp + 0x20]
test al, 2
je 0x44fc0b
and dword [rsp + 0x20], 0xfffffffd
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x44fbf8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
jmp 0x44fc10
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
jmp 0x44fc10
mov rbx, qword [rsp + 0x28]
jmp 0x44fc10
mov rbx, qword [rsp + 0x28]
cmp r14, qword [r15 + 0x10]
jb 0x44fc1b
call fcn.004a7de0
add r14, 8
jmp 0x44f890
call fcn.004050e0
nop
call fcn.004050e0
nop
mov r15, 0xffffffffffffffff
mov r13d, dword [rsp + 0x24]
lea rdx, [rsi - 0x18]
lock xadd dword [rdx + 0x10], r15d
add r15d, 0xffffffff
test r15d, r15d
jg 0x44fc58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r13d
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.004a7100
mov rbx, qword [rsp + 0x540]
mov rbp, qword [rsp + 0x548]
mov rsi, qword [rsp + 0x520]
mov rdi, qword [rsp + 0x518]
mov r12, qword [rsp + 0x510]
mov r13, qword [rsp + 0x508]
mov r14, qword [rsp + 0x500]
mov r15, qword [rsp + 0x4f8]
add rsp, 0x528
ret