Function at 0x1400f33a0
Capabilities:
Enumerate processes
Get graphical window text

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x7e8]
sub rsp, 0x8e8
xor r15d, r15d
mov rdi, rcx
mov qword [rbp + 0x830], r15
test rcx, rcx
je 0x1400f33cd
mov dword [rcx], r15d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov dword [rsp + 0x30], 0x48
mov rcx, rax
mov r14, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rdx, [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
mov rcx, r15
test eax, eax
cmovne rcx, qword [rsp + 0x40]
test rcx, rcx
cmovne r14, rcx
xor ecx, ecx
call fcn.1400f1590
cmp eax, 0xb
jl 0x1400f3443
cmp qword [0x140298a30], r15
jne 0x1400f3443
xor edx, edx
lea rax, [0x140298a30]
lea r9, [0x140156f70]
lea r8d, [rdx + 1]
lea rcx, [0x140156f60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
lea rdx, [rbp + 0x820]
mov rcx, r14
mov dword [rbp + 0x820], r15d
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [rbp + 0x820]
xor edx, edx
lea ecx, [rdx + 2]
mov word [rbp - 0x80], r15w
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [rbp + 0x180], 0x238
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400f34d3
lea rdx, [rbp + 0x180]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400f34ca
cmp dword [rbp + 0x188], esi
je 0x1400f34b2
lea rdx, [rbp + 0x180]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400f3495
jmp 0x1400f34ca
lea r8, [rbp + 0x1ac]
lea rcx, [rbp + 0x3c0]
mov edx, 0x104
call fcn.1400fbc74
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x5d0]
mov r8d, 0x104
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rbp - 0x80]
mov r8d, 0x100
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, [rbp - 0x80]
lea rcx, [0x140162070]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400f357d
lea rdx, [rbp - 0x80]
lea rcx, str.MultitaskingViewFrame
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400f357d
lea rdx, [rbp - 0x80]
lea rcx, str.Windows.UI.Core.CoreWindow
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1400f356b
lea rdx, [rbp + 0x3c0]
lea rcx, str.explorer.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1400f356b
lea rdx, [rbp + 0x5d0]
lea rcx, str.Task_View
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400f357d
xor al, al
add rsp, 0x8e8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
test rdi, rdi
je 0x1400f3685
mov rcx, qword [0x140298a30]
test rcx, rcx
je 0x1400f3685
mov rax, qword [rcx]
lea r8, [rbp + 0x830]
mov rdx, r14
call qword [rax + 0x30]
test eax, eax
js 0x1400f3685
mov rcx, qword [rbp + 0x830]
test rcx, rcx
je 0x1400f3685
mov dword [rbp + 0x828], r15d
mov rax, qword [rcx]
lea rdx, [rbp + 0x828]
call qword [rax + 0x130]
mov rcx, qword [rbp + 0x830]
cmp dword [rbp + 0x828], r15d
jne 0x1400f367f
test rcx, rcx
je 0x1400f3685
mov rax, qword [rcx]
lea rdx, [rbp + 0x838]
call qword [rax + 0xf0]
mov rdx, qword [rbp + 0x838]
lea rcx, [rbp + 0x828]
call fcn.1400b9910
mov rcx, qword [rbp + 0x828]
test rcx, rcx
je 0x1400f3626
call fcn.14003c270
lea rcx, str.New_desktop
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r8, qword [rbp + 0x830]
mov rcx, qword [0x140298a30]
lea r9, [rbp + 0x828]
mov rdx, rax
mov qword [rbp + 0x828], r15
call fcn.1400f0fc0
mov rcx, qword [rbp + 0x828]
test eax, eax
js 0x1400f366d
test rcx, rcx
je 0x1400f3678
mov dword [rdi], 1
test rcx, rcx
je 0x1400f3678
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x830]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov al, 1
add rsp, 0x8e8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret