Function at 0x18003a2e0
Capabilities:
Enumerate processes
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x180113040]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov r13, rcx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x18003a51e
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18003a515
xor edi, edi
mov r14, qword [r13]
mov r8d, 0xa
mov r15, qword [r13 + 8]
movabs rdx, 0x7fffffffffffffff
movabs rcx, 0x7ffffffffffffffe
cmp r14, r15
je 0x18003a4ff
xorps xmm0, xmm0
mov qword [rsp + 0x30], rdi
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x6c]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18003a3a0
cmp rbx, rcx
ja 0x18003a636
cmp rbx, 7
ja 0x18003a3e6
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0x6c]
add rbx, rbx
mov qword [rsp + 0x38], 7
mov r8, rbx
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x20], di
jmp 0x18003a47c
mov rsi, rbx
or rsi, 7
cmp rsi, rcx
jbe 0x18003a3fb
mov rsi, rcx
lea rcx, [rdx + rdx]
jmp 0x18003a415
cmp rsi, 0xa
cmovb rsi, r8
lea rcx, [rsi + 1]
cmp rcx, rdx
ja 0x18003a63c
add rcx, rcx
je 0x18003a452
cmp rcx, 0x1000
jb 0x18003a44a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18003a63c
mov rcx, rax
call fcn.1800a3aa0
test rax, rax
je 0x18003a61b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18003a452
call fcn.1800a3aa0
mov rdi, rax
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0x6c]
add rbx, rbx
mov qword [rsp + 0x20], rdi
mov r8, rbx
mov qword [rsp + 0x38], rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov word [rbx + rdi], ax
xor edi, edi
mov rdx, r14
lea rcx, [rsp + 0x20]
call fcn.18003aed0
mov rdx, qword [rsp + 0x38]
mov rbx, rax
cmp rdx, 7
jbe 0x18003a4ce
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003a4c9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003a61b
call fcn.1800a3ae4
cmp rbx, 0xffffffffffffffff
jne 0x18003a622
add r14, 0x20
movabs rcx, 0x7ffffffffffffffe
movabs rdx, 0x7fffffffffffffff
mov r8d, 0xa
cmp r14, r15
jne 0x18003a380
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18003a355
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetTopWindow]
mov r14, rax
test rax, rax
je 0x18003a5e9
nop dword [rax]
nop word [rax + rax]
mov r8d, 0x100
lea rdx, [rbp + 0x180]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rbx, qword [r13]
mov rsi, qword [r13 + 8]
cmp rbx, rsi
je 0x18003a5cf
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x20]
call fcn.18003afd0
mov rdx, rbx
mov rcx, rax
call fcn.18003aed0
mov rdx, qword [rsp + 0x38]
mov rdi, rax
cmp rdx, 7
jbe 0x18003a5c0
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003a5bb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003a62f
call fcn.1800a3ae4
cmp rdi, 0xffffffffffffffff
jne 0x18003a62b
add rbx, 0x20
cmp rbx, rsi
jne 0x18003a563
mov edx, 2
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindow]
mov r14, rax
test rax, rax
jne 0x18003a540
xor al, al
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1800a3a80
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x18003a5eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180001360
int3
call fcn.1800012c0
int3