Function at 0x1400088b0
Capabilities:
Enumerate processes

Disassembly:
mov r11, rsp
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [r11 - 0x358]
sub rsp, 0x430
mov rax, qword [0x14008d558]
xor rax, rsp
mov qword [rbp + 0x310], rax
mov qword [r11 - 0x30], r13
mov r13, rdx
mov qword [r11 - 0x38], r14
mov r14, rcx
lea rsi, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_assist.c
mov r15d, 1
lea rdi, str.get_foreground_app_ratio
test rcx, rcx
jne 0x140008909
mov ebx, 0x8fc
jmp 0x140008d3e
mov qword [rsp + 0x470], r12
lea rcx, [rbp + 0x200]
xor edx, edx
mov r8d, 0x104
xor r12b, r12b
call fcn.1400158a0
cmp dword [0x14008d0b0], 3
jl 0x140008951
test dword [0x14008d114], 0x400000
je 0x140008951
mov edx, 3
mov ecx, 0x400000
mov ebx, r15d
call fcn.14000b080
jmp 0x140008966
mov edx, 3
mov ecx, 0x400000
call fcn.14000b080
xor ebx, ebx
test eax, eax
je 0x140008999
lea rcx, str.Entering_Function...
mov r9d, 3
mov qword [rsp + 0x38], rcx
mov r8d, 0x400000
mov dword [rsp + 0x30], 0x932
mov edx, eax
mov qword [rsp + 0x28], rsi
mov ecx, ebx
mov qword [rsp + 0x20], rdi
call fcn.14000b530
xorps xmm0, xmm0
mov dword [rsp + 0x60], 0x48
xor eax, eax
mov dword [rbp - 0x50], 0x104
lea rdx, [rsp + 0x60]
mov dword [rbp - 0x5c], eax
xor ecx, ecx
mov dword [rsp + 0x50], eax
movups xmmword [rsp + 0x64], xmm0
mov qword [rbp - 0x48], rax
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
jne 0x1400089e4
mov ebx, 0x3f0
mov edi, ebx
jmp 0x140008a49
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov ecx, 0x1000
mov dword [0x14008f85c], r8d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x140008a1e
mov ebx, 0x8fc
mov edi, ebx
jmp 0x140008a49
lea r9, [rbp - 0x50]
xor edx, edx
lea r8, [rbp - 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
jne 0x140008ae4
mov ebx, 0x3f0
mov rcx, rsi
mov edi, ebx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x14008d0b0], 2
jl 0x140008a75
test dword [0x14008d0fc], 0x10000
je 0x140008a75
mov edx, 2
mov ecx, 0x10000
mov esi, r15d
call fcn.14000b080
mov r10d, eax
jmp 0x140008a91
mov edx, 2
mov ecx, 0x10000
call fcn.14000b080
xor esi, esi
mov r10d, eax
test eax, eax
je 0x140008d28
mov ecx, edi
call fcn.140003af0
mov qword [rsp + 0x40], rax
lea rdi, str.get_foreground_app_ratio
lea rax, str.ERROR:_Unable_to_get_foreground_process_name._Error_code___s._n
mov r9d, 2
mov qword [rsp + 0x38], rax
mov r8d, 0x10000
lea rax, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_assist.c
mov dword [rsp + 0x30], 0x936
mov qword [rsp + 0x28], rax
mov edx, r10d
mov ecx, esi
mov qword [rsp + 0x20], rdi
call fcn.14000b530
jmp 0x140008d2f
lea r9, [rbp - 0x40]
mov qword [rsp + 0x20], 0x104
mov r8d, 0x104
lea rdx, [rbp + 0x200]
lea rcx, [rbp - 0x48]
call fcn.1400246e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r10, [r14 + 0x70]
xor ebx, ebx
lea r8, [rbp + 0x200]
mov rax, r10
sub r8, r10
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140008b36
inc rax
test ecx, ecx
jne 0x140008b23
test edx, edx
je 0x140008bf3
mov r9, 0xffffffffffffffff
lea r8, [rbp + 0x200]
mov edx, 0x104
mov rcx, r10
movzx r12d, r15b
call fcn.140025d24
lea rcx, [r14 + 0x174]
mov dword [r14 + 0x11cc], ebx
xor edx, edx
mov r8d, 0x1040
call fcn.1400158a0
mov rcx, qword [r14 + 0x68]
test rcx, rcx
je 0x140008b8d
lea rdx, [0x140003810]
call fcn.1400012b0
mov ecx, 0x104
call fcn.140001150
xor edx, edx
mov qword [r14 + 0x68], rax
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
test rax, rax
je 0x140008bf3
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x40], 0x238
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140008bea
mov eax, dword [0x14008f85c]
cmp dword [rbp - 0x38], eax
je 0x140008be1
lea rdx, [rbp - 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140008bc4
jmp 0x140008bea
mov eax, dword [rbp - 0x20]
mov dword [0x14008f860], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x14008d0b0], 4
jl 0x140008c1c
test dword [0x14008d12c], 0x10000
je 0x140008c1c
mov edx, 4
mov ecx, 0x10000
mov edi, r15d
call fcn.14000b080
jmp 0x140008c31
mov edx, 4
mov ecx, 0x10000
call fcn.14000b080
xor edi, edi
test eax, eax
je 0x140008c80
lea rcx, [rbp + 0x200]
mov r9d, 4
mov qword [rsp + 0x40], rcx
lea rsi, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_assist.c
lea rcx, str.Foreground_name___s_n
mov r8d, 0x10000
mov qword [rsp + 0x38], rcx
mov edx, eax
lea rcx, str.get_foreground_app_ratio
mov dword [rsp + 0x30], 0x941
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
mov ecx, edi
call fcn.14000b530
jmp 0x140008c87
lea rsi, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_assist.c
cmp dword [0x14008d0b0], 4
jl 0x140008cb2
test dword [0x14008d12c], 0x10000
je 0x140008cb2
mov edx, 4
mov ecx, 0x10000
mov edi, r15d
call fcn.14000b080
mov edx, eax
jmp 0x140008cc9
mov edx, 4
mov ecx, 0x10000
call fcn.14000b080
xor edi, edi
mov edx, eax
test eax, eax
je 0x140008d09
movzx eax, r12b
mov r9d, 4
mov dword [rsp + 0x40], eax
mov r8d, 0x10000
lea rax, str.New_app___d_n
mov ecx, edi
mov qword [rsp + 0x38], rax
lea rax, str.get_foreground_app_ratio
mov dword [rsp + 0x30], 0x942
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.14000b530
mov r9, r13
lea rdx, [rbp + 0x200]
movzx r8d, r12b
mov rcx, r14
call fcn.140006d90
lea rdi, str.get_foreground_app_ratio
jmp 0x140008d36
lea rdi, str.get_foreground_app_ratio
lea rsi, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_assist.c
mov r12, qword [rsp + 0x470]
cmp dword [0x14008d0b0], 3
mov r14, qword [rsp + 0x420]
mov r13, qword [rsp + 0x428]
jl 0x140008d74
test dword [0x14008d114], 0x400000
je 0x140008d74
mov edx, 3
mov ecx, 0x400000
call fcn.14000b080
jmp 0x140008d8a
mov edx, 3
mov ecx, 0x400000
call fcn.14000b080
xor r15d, r15d
test eax, eax
je 0x140008dc2
mov dword [rsp + 0x40], ebx
lea rdx, str.Exiting_function:_Exit_code__0x_08X...
mov qword [rsp + 0x38], rdx
mov r9d, 3
mov dword [rsp + 0x30], 0x947
mov r8d, 0x400000
mov qword [rsp + 0x28], rsi
mov edx, eax
mov ecx, r15d
mov qword [rsp + 0x20], rdi
call fcn.14000b530
mov eax, ebx
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.140014190
add rsp, 0x430
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret