Function at 0x140002bb0
Capabilities:
Enumerate gui resources
Enumerate processes
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4b8]
sub rsp, 0x590
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x460], rax
xor ebx, ebx
mov r13d, ebx
mov dword [rsp + 0x20], ebx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e8], xmm0
mov r12d, ebx
mov qword [rbp + 0x1f8], rbx
mov r14d, 7
mov qword [rbp + 0x200], r14
mov word [rbp + 0x1e8], bx
test r12, r12
je 0x140003165
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140003152
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1d0], xmm1
mov qword [rbp + 0x1e0], rbx
mov qword [rbp - 0x70], 0x238
mov dword [rbp - 0x68], ebx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], 0
mov qword [rbp - 0x50], 0
mov dword [rbp - 0x48], ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x44]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rbp + 0x1c4], eax
lea rdx, [rbp - 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rsi, qword [rbp + 0x1e8]
test eax, eax
je 0x1400030ec
lea rdx, [rbp - 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400030ec
cmp dword [rbp - 0x68], 0
je 0x1400030d7
lea rcx, [rbp - 0x44]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002ce0
test rax, rax
je 0x1400030d7
lea rdx, [rbp - 0x44]
lea rcx, [rbp + 0x208]
call fcn.140003660
nop
mov eax, dword [rbp - 0x68]
mov dword [rbp - 0x80], eax
mov qword [rbp - 0x78], rbx
lea rdx, [rbp - 0x80]
lea rcx, [0x140002a60]
call qword [sym.imp.USER32.dll_EnumWindows]
or r13d, 1
mov rcx, qword [rbp - 0x78]
test rcx, rcx
jne 0x140002d35
lea rdx, [0x140007678]
jmp 0x140002d4f
mov r8d, 0x104
lea rdx, [rbp + 0x250]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x228]
call fcn.140003660
nop
lea r11, [rbp + 0x1e8]
cmp r14, 7
cmova r11, rsi
lea rbx, [rbp + 0x208]
mov rsi, qword [rbp + 0x208]
mov r14, qword [rbp + 0x220]
cmp r14, 7
cmova rbx, rsi
mov rax, qword [rbp + 0x218]
cmp r12, rax
ja 0x140003045
sub rax, r12
inc rax
lea rdi, [rbx + rax*2]
mov rax, rbx
movzx r10d, word [r11]
nop dword [rax]
mov rcx, rdi
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x140002ddc
cmp word [rax], r10w
je 0x140002dd9
cmp rcx, 1
je 0x140002ddc
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x140002dc6
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140003040
mov r8, r12
mov rdx, r11
test r12, r12
je 0x140002e18
mov r9, rax
sub r9, r11
nop dword [rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x140002ec6
add rdx, 2
sub r8, 1
jne 0x140002e00
sub rax, rbx
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x140003040
xorps xmm0, xmm0
movups xmm6, xmmword [rbp + 0x208]
movaps xmmword [rsp + 0x30], xmm6
movups xmm7, xmmword [rbp + 0x218]
movaps xmmword [rsp + 0x40], xmm7
xor ebx, ebx
mov qword [rbp + 0x218], rbx
mov qword [rbp + 0x220], 7
mov word [rbp + 0x208], bx
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
lea r14, [rbp + 0x228]
mov rsi, qword [rbp + 0x228]
mov r15, qword [rbp + 0x240]
cmp r15, 7
cmova r14, rsi
mov rdi, qword [rbp + 0x238]
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
ja 0x140003246
cmp rdi, 7
ja 0x140002ecf
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x50], xmm0
jmp 0x140002f7f
add rax, 2
jmp 0x140002db0
mov rbx, rdi
or rbx, 7
cmp rbx, rax
jbe 0x140002f24
mov rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x140002f51
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000324c
mov rcx, rax
call fcn.140005518
mov rcx, rax
test rax, rax
je 0x1400031b9
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002f56
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000324c
add rcx, rcx
jne 0x140002eec
xor eax, eax
jmp 0x140002f56
call fcn.140005518
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rbx
lea r8, [rdi*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movaps xmm0, xmmword [rsp + 0x50]
xor ebx, ebx
mov eax, dword [rbp - 0x68]
mov dword [rsp + 0x70], eax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, qword [rbp + 0x1e0]
je 0x140002fdd
movups xmmword [rdx], xmm6
movups xmmword [rdx + 0x10], xmm7
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bx
movups xmmword [rdx + 0x20], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rdx + 0x30], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], bx
mov dword [rdx + 0x40], eax
add qword [rbp + 0x1d8], 0x48
jmp 0x140002fef
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x1d0]
call fcn.140004160
nop
lea rcx, [rsp + 0x30]
call fcn.140002af0
nop
cmp r15, 7
jbe 0x140003036
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000302d
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400031c0
mov rcx, rsi
call fcn.140005510
nop
mov rdi, qword [rsp + 0x20]
jmp 0x1400030c9
mov rdi, qword [rsp + 0x20]
mov rdx, qword [rbp + 0x240]
cmp rdx, 7
jbe 0x14000308c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x228]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003086
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400031c0
call fcn.140005510
nop
cmp r14, 7
jbe 0x1400030c7
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400030bf
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400031c7
mov rcx, rsi
call fcn.140005510
xor ebx, ebx
mov r14, qword [rbp + 0x200]
mov rsi, qword [rbp + 0x1e8]
lea rdx, [rbp - 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002cc5
lea rcx, [0x140826160]
call fcn.1400037e0
movups xmm0, xmmword [rbp + 0x1d0]
movups xmmword [0x140826160], xmm0
movsd xmm1, qword [rbp + 0x1e0]
movsd qword [0x140826170], xmm1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x1e0], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140826168]
cmp qword [0x140826160], rax
setne bl
lea rcx, [rbp + 0x1d0]
call fcn.1400037e0
test bl, bl
jne 0x1400031ce
lea rdx, str.No_process_found_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400038a0
lea rdx, str.Enter_process_name:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400038a0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t___std::wcin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rbp + 0x1e8]
mov rcx, rbx
call fcn.140003fb0
mov r12, qword [rbp + 0x1f8]
mov r14, qword [rbp + 0x200]
xor ebx, ebx
jmp 0x140002c20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp r14, 7
jbe 0x14000320c
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003204
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003204
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140005510
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.1400054f0
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011c0
nop
call fcn.140001120
int3