Function at 0x14008f9f0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x2c8], rbx
mov rbp, rcx
mov eax, dword [rcx + 0x14]
inc eax
test eax, 0xfffffffe
jne 0x14008fa2a
xor eax, eax
jmp 0x14008fdd6
xor r13d, r13d
call fcn.140004fc0
mov rcx, rax
mov eax, r13d
test rcx, rcx
setne al
test eax, eax
jne 0x14008fa4d
mov ecx, 0x80004005
call fcn.140004f70
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x2b8], rdi
call fcn.140004fc0
mov rcx, rax
mov eax, r13d
test rcx, rcx
setne al
test eax, eax
jne 0x14008fa7f
mov ecx, 0x80004005
call fcn.140004f70
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x2b0], rbx
call fcn.140004fc0
mov rcx, rax
mov eax, r13d
test rcx, rcx
setne al
test eax, eax
jne 0x14008fab1
mov ecx, 0x80004005
call fcn.140004f70
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x2c0], rax
mov rax, qword [rbp + 0x60]
cmp rax, qword [rbp + 0x68]
je 0x14008fc22
mov rsi, qword [rax]
test rsi, rsi
je 0x14008fae1
mov ecx, dword [rbp + 0x14]
cmp dword [rsi + 8], ecx
je 0x14008fae7
add rax, 8
jmp 0x14008fac7
mov rdx, qword [rsi + 0xd8]
lea rcx, [rdx - 0x18]
lea r14, [rdi - 0x18]
cmp rcx, r14
je 0x14008fb55
cmp dword [r14 + 0x10], 0
jl 0x14008fb3c
mov rax, qword [r14]
cmp qword [rcx], rax
jne 0x14008fb3c
call fcn.1400112f0
mov rdi, rax
lock add dword [r14 + 0x10], 0xffffffff
jg 0x14008fb26
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 0x18
mov qword [rsp + 0x2b8], rdi
mov rbx, qword [rsp + 0x2b0]
jmp 0x14008fb55
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x2b8]
call fcn.140011790
mov rdi, qword [rsp + 0x2b8]
mov rdx, qword [rsi + 0x28]
lea rcx, [rdx - 0x18]
lea rsi, [rbx - 0x18]
cmp rcx, rsi
je 0x14008fbbe
cmp dword [rsi + 0x10], 0
jl 0x14008fba5
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x14008fba5
call fcn.1400112f0
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x14008fb8f
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x2b0], rbx
mov rdi, qword [rsp + 0x2b8]
jmp 0x14008fbbe
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x2b0]
call fcn.140011790
mov rbx, qword [rsp + 0x2b0]
lea rcx, [rbx - 0x18]
mov rsi, qword [rbp + 0x20]
sub rsi, 0x18
cmp rcx, rsi
je 0x14008fc22
cmp dword [rsi + 0x10], 0
jl 0x14008fc12
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x14008fc12
call fcn.1400112f0
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x14008fbf8
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rbp + 0x20], rax
mov rdi, qword [rsp + 0x2b8]
mov rbx, qword [rsp + 0x2b0]
jmp 0x14008fc22
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.140011790
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
mov dword [rsp + 0x30], 0x238
cmp rax, 0xffffffffffffffff
je 0x14008fcea
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14008fcd8
lea rdx, [rsp + 0x5c]
mov rcx, rdi
call fcn.140126394
test eax, eax
je 0x14008fc76
lea rdx, [rsp + 0x30]
mov rcx, r14
call sub.KERNEL32.dll_Process32NextW
jmp 0x14008fc4e
mov r13d, 1
lea rcx, [rdi - 0x18]
mov rsi, qword [rbp + 0x20]
sub rsi, 0x18
cmp rcx, rsi
je 0x14008fcd8
cmp dword [rsi + 0x10], 0
jl 0x14008fcc8
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x14008fcc8
call fcn.1400112f0
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x14008fcb6
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rbp + 0x20], rax
mov rbx, qword [rsp + 0x2b0]
jmp 0x14008fcd8
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rbp + 0x20]
call fcn.140011790
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13d, r13d
jne 0x14008fd7c
cmp dword [rbx - 0x10], 0
je 0x14008fd75
lea r8, str.Verify_that_finding_app_by_class_name_works__n
xor edx, edx
lea rcx, str.CSynOSD::CheckLastNonSystemAppID
call fcn.14011a490
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14008fd75
lea rcx, [rbx - 0x18]
mov rdi, qword [rbp + 0x20]
sub rdi, 0x18
cmp rcx, rdi
je 0x14008fd6d
cmp dword [rdi + 0x10], 0
jl 0x14008fd5d
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14008fd5d
call fcn.1400112f0
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14008fd53
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rbp + 0x20], rax
jmp 0x14008fd6d
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.140011790
mov r13d, 1
jmp 0x14008fd7c
mov dword [rbp + 0x14], 0xffffffff
mov rdx, qword [rsp + 0x2c0]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14008fd99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x2b0]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14008fdb6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x2b8]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14008fdd3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, r13d
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret