Function at 0x140008b70
Capabilities:
Get explorer pid

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax - 8], rsi
mov esi, ecx
mov qword [rax - 0x10], rdi
lea rcx, [0x140008aa0]
mov qword [rax - 0x18], r14
mov r14, rdx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, str.___nmd_mapper_n
call fcn.140008a50
mov ebp, 1
mov edi, ebp
cmp esi, ebp
jle 0x140008c52
lea rbx, [r14 + 8]
nop dword [rax]
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008bd0
cmp rax, 5
jne 0x140008bfd
add rcx, 2
lea rdx, str.free
call fcn.140013808
test eax, eax
jne 0x140008bfd
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x140008c52
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008c10
cmp rax, 6
jne 0x140008c44
add rcx, 4
lea rdx, str.free
call fcn.140013808
test eax, eax
jne 0x140008c44
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x140008c44
cmp word [rax + 2], 0x2d
je 0x140008c52
inc edi
add rbx, 8
cmp edi, esi
jl 0x140008bc0
mov edi, ebp
cmp esi, ebp
jle 0x140008cf2
lea rbx, [r14 + 8]
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008c70
cmp rax, 4
jne 0x140008c9d
add rcx, 2
lea rdx, [0x140043c08]
call fcn.140013808
test eax, eax
jne 0x140008c9d
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x140008cf2
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008cb0
cmp rax, 5
jne 0x140008ce4
add rcx, 4
lea rdx, [0x140043c08]
call fcn.140013808
test eax, eax
jne 0x140008ce4
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x140008ce4
cmp word [rax + 2], 0x2d
je 0x140008cf2
inc edi
add rbx, 8
cmp edi, esi
jl 0x140008c60
mov edi, ebp
cmp esi, ebp
jle 0x140008d92
lea rbx, [r14 + 8]
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008d10
cmp rax, 9
jne 0x140008d3d
add rcx, 2
lea rdx, str.indPages
call fcn.140013808
test eax, eax
jne 0x140008d3d
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x140008d92
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008d50
cmp rax, 0xa
jne 0x140008d84
add rcx, 4
lea rdx, str.indPages
call fcn.140013808
test eax, eax
jne 0x140008d84
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x140008d84
cmp word [rax + 2], 0x2d
je 0x140008d92
inc edi
add rbx, 8
cmp edi, esi
jl 0x140008d00
mov rdi, qword [rsp + 0x58]
cmp esi, ebp
jle 0x140008e32
lea rbx, [r14 + 8]
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008db0
cmp rax, 0x12
jne 0x140008ddd
add rcx, 2
lea rdx, str.PassAllocationPtr
call fcn.140013808
test eax, eax
jne 0x140008ddd
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x140008e32
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008df0
cmp rax, 0x13
jne 0x140008e24
add rcx, 4
lea rdx, str.PassAllocationPtr
call fcn.140013808
test eax, eax
jne 0x140008e24
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x140008e24
cmp word [rax + 2], 0x2d
je 0x140008e32
inc ebp
add rbx, 8
cmp ebp, esi
jl 0x140008da3
call fcn.140002040
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
mov qword [0x14004cd70], rax
cmp rax, 0xffffffffffffffff
je 0x140008e71
call fcn.14000a1c0
mov rcx, qword [0x14004cd70]
test rax, rax
jne 0x140008ea7
call fcn.140002be0
mov dword [rsp + 0x70], 0
call qword [sym.imp.USER32.dll_GetShellWindow]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call fcn.140008ac0
cmp eax, dword [rsp + 0x70]
jne 0x140008e9d
call fcn.140008ef0
mov eax, 0xffffffff
add rsp, 0x68
ret
call fcn.140002be0
test al, al
jne 0x140008edc
mov dword [rsp + 0x70], 0
call qword [sym.imp.USER32.dll_GetShellWindow]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call fcn.140008ac0
cmp eax, dword [rsp + 0x70]
jne 0x140008edc
call fcn.140008ef0
xor eax, eax
add rsp, 0x68
ret