Function at 0x14000beb0
Capabilities:
Enumerate processes
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [0x14007b100]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, rdx
mov qword [rsp + 0x30], rcx
mov r15, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
xor edx, edx
mov ecx, 2
mov dword [rsp + 0x20], ebp
mov rsi, r8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000c0ec
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000bf60
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x8c]
call fcn.14003fd14
test eax, eax
je 0x14000bf58
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14000bf30
jmp 0x14000bf60
mov ebp, dword [rsp + 0x68]
mov dword [rsp + 0x20], ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x14000c0ec
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
mov rcx, rax
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x3c]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x3c], ebp
jne 0x14000c0de
mov r8d, 0x104
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextA]
xorps xmm0, xmm0
mov qword [rsp + 0x50], 0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14000bfe0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.14000ab20
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14000c000
mov r13, qword [rsp + 0x58]
lea r14, [rsp + 0x40]
mov rbp, qword [rsp + 0x40]
cmp r13, 0xf
mov rax, qword [rsp + 0x50]
cmova r14, rbp
cmp rbx, rax
ja 0x14000c0a3
sub rax, rbx
test rbx, rbx
je 0x14000c143
movsx r12d, byte [rsi]
lea r15, [rax + r14]
lea r8, [r15 + 1]
mov edx, r12d
sub r8, r14
mov rcx, r14
call fcn.140057590
mov rdi, rax
test rax, rax
je 0x14000c09e
nop dword [rax + rax]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140057630
test eax, eax
je 0x14000c091
inc rdi
lea r8, [r15 + 1]
sub r8, rdi
mov rcx, rdi
mov edx, r12d
call fcn.140057590
mov rdi, rax
test rax, rax
jne 0x14000c060
jmp 0x14000c09e
sub rdi, r14
cmp rdi, 0xffffffffffffffff
jne 0x14000c143
mov rdi, qword [rsp + 0x28]
cmp r13, 0xf
jbe 0x14000c0da
lea rdx, [r13 + 1]
mov rax, rbp
cmp rdx, 0x1000
jb 0x14000c0d2
mov rbp, qword [rbp - 8]
add rdx, 0x27
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c16d
mov rcx, rbp
call fcn.14002f190
mov ebp, dword [rsp + 0x20]
test rdi, rdi
jne 0x14000bf73
mov r15, qword [rsp + 0x30]
xorps xmm0, xmm0
lea rdx, [0x140065acd]
movups xmmword [r15], xmm0
xor r8d, r8d
mov qword [r15 + 0x10], 0
mov rcx, r15
mov qword [r15 + 0x18], 0
call fcn.14000ab20
mov rax, r15
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14002f170
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r15, qword [rsp + 0x30]
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
mov qword [r15 + 0x10], 0
mov qword [r15 + 0x18], 0
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm1
jmp 0x14000c115
call fcn.14003f25c
int3