Function at 0x140385d50
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov r8d, 3
lea rdx, [0x140579ce0]
call fcn.1403931b0
add rsp, 0x38
ret
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov r8d, 4
lea rdx, [0x140579ce0]
call fcn.1403931b0
add rsp, 0x38
ret
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov r8d, 1
lea rdx, [0x140579ce0]
call fcn.1403931b0
add rsp, 0x38
ret
mov r11, rsp
sub rsp, 0x58
mov rax, qword [0x14057c500]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], edx
lea rax, [r11 - 0x38]
mov dword [r11 - 0x30], r8d
lea r9, [r11 - 0x28]
mov qword [r11 - 0x20], rax
lea rdx, [0x140579ce0]
lea rax, [r11 - 0x30]
mov qword [r11 - 0x28], 0
mov r8d, 2
mov qword [r11 - 0x18], rax
call fcn.1403931b0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1404e17d0
add rsp, 0x58
ret
push rbx
sub rsp, 0x20
mov rbx, r9
mov r10, rcx
test edx, edx
jne 0x140385ea6
cmp r8d, 0xe
ja case.default.0x140385d82
lea rcx, [0x140000000]
movsxd rax, r8d
mov edx, dword [rcx + rax*4 + 0x385f7c]
add rdx, rcx
jmp rdx
movzx edx, byte [rsp + 0x38]
mov rcx, r10
add rsp, 0x20
pop rbx
jmp 0x140386b70
mov rax, qword [r9 + 8]
mov rcx, r10
mov edx, dword [rax]
add rsp, 0x20
pop rbx
jmp 0x140385800
mov rcx, qword [r9 + 8]
mov rax, qword [r9 + 0x10]
mov edx, dword [rcx]
mov rcx, r10
mov r8d, dword [rax]
add rsp, 0x20
pop rbx
jmp 0x140385840
mov rax, qword [r9 + 8]
mov rcx, r10
mov edx, dword [rax]
add rsp, 0x20
pop rbx
jmp 0x140385650
mov rax, qword [r9 + 8]
mov rcx, r10
mov edx, dword [rax]
add rsp, 0x20
pop rbx
jmp 0x140385690
mov rax, qword [r9 + 8]
mov rcx, r10
movzx r8d, byte [rsp + 0x38]
mov edx, dword [rax]
add rsp, 0x20
pop rbx
jmp 0x140386bb0
movzx edx, byte [rsp + 0x38]
mov rcx, r10
add rsp, 0x20
pop rbx
jmp fcn.140386020
movzx edx, byte [rsp + 0x38]
mov rcx, r10
add rsp, 0x20
pop rbx
jmp fcn.140385fe0
mov rcx, qword [r10 + 8]
add rsp, 0x20
pop rbx
jmp 0x1404436b0
mov rcx, qword [r10 + 8]
add rsp, 0x20
pop rbx
jmp fcn.140441350
mov rcx, qword [r10 + 8]
lea rdx, [rcx + 0x120]
call fcn.140386d00
mov rcx, qword [rbx]
test rcx, rcx
je case.default.0x140385d82
mov byte [rcx], al
add rsp, 0x20
pop rbx
ret
mov rcx, qword [r10 + 8]
lea rdx, [rcx + 0x158]
jmp 0x140385e4d
mov rcx, qword [r10 + 8]
call fcn.140384c70
jmp 0x140385e52
mov rcx, qword [r10 + 8]
call fcn.140384ef0
jmp 0x140385e52
mov rcx, qword [r10 + 8]
call fcn.140384d30
mov rcx, qword [rbx]
test rcx, rcx
je case.default.0x140385d82
mov byte [rcx], al
add rsp, 0x20
pop rbx
ret
cmp edx, 0xa
jne case.default.0x140385d82
mov rax, qword [r9 + 8]
mov rcx, qword [r9]
mov rdx, qword [rax]
lea rax, [0x140386b70]
cmp rdx, rax
jne 0x140385ed1
mov dword [rcx], 0
add rsp, 0x20
pop rbx
ret
lea rax, [0x140385800]
cmp rdx, rax
jne 0x140385ee9
mov dword [rcx], 1
add rsp, 0x20
pop rbx
ret
lea rax, [0x140385840]
cmp rdx, rax
jne 0x140385f01
mov dword [rcx], 2
add rsp, 0x20
pop rbx
ret
lea rax, [0x140385650]
cmp rdx, rax
jne 0x140385f19
mov dword [rcx], 3
add rsp, 0x20
pop rbx
ret
lea rax, [0x140385690]
cmp rdx, rax
jne 0x140385f31
mov dword [rcx], 4
add rsp, 0x20
pop rbx
ret
lea rax, [0x140386bb0]
cmp rdx, rax
jne 0x140385f49
mov dword [rcx], 5
add rsp, 0x20
pop rbx
ret
lea rax, [fcn.140386020]
cmp rdx, rax
jne 0x140385f61
mov dword [rcx], 6
add rsp, 0x20
pop rbx
ret
lea rax, [fcn.140385fe0]
cmp rdx, rax
jne case.default.0x140385d82
mov dword [rcx], 7
add rsp, 0x20
pop rbx
ret
mov byte [rsp + 0x10], dl
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rdx, [0x140579ce0]
call fcn.1403931b0
add rsp, 0x38
ret
mov r11, rsp
sub rsp, 0x58
mov rax, qword [0x14057c500]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], edx
lea rax, [r11 - 0x30]
mov byte [r11 - 0x38], r8b
lea r9, [r11 - 0x28]
mov qword [r11 - 0x20], rax
lea rdx, [0x140579ce0]
lea rax, [r11 - 0x38]
mov qword [r11 - 0x28], 0
mov r8d, 5
mov qword [r11 - 0x18], rax
call fcn.1403931b0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1404e17d0
add rsp, 0x58
ret
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xd8]
mov rbx, rcx
test rax, rax
je 0x1404436f5
mov edx, dword [rax + 0x10]
lea rcx, [0x1404428c0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbx + 0xd8]
xor r9d, r9d
xor r8d, r8d
mov ecx, dword [rax + 0x14]
lea edx, [r9 + 0x10]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_PostThreadMessageW]
add rsp, 0x20
pop rbx
ret