Function at 0x140003bd0
Capabilities:
Enumerate processes
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x14009e7a0]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov rbx, qword [0x14009f408]
mov rdi, qword [0x14009f410]
cmp rbx, rdi
je 0x140003c3f
nop dword [rax + rax]
mov rcx, rbx
call fcn.140003b10
add rbx, 0x48
cmp rbx, rdi
jne 0x140003c20
mov rax, qword [0x14009f408]
mov qword [0x14009f410], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov qword [rsp + 0x30], rax
cmp rax, 0xffffffffffffffff
jne 0x140003c7d
lea rdx, str.Error:_Unable_to_create_snapshot_of_processes.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002870
lea rdx, [0x140004620]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140003cc1
mov dword [rbp - 0x40], 0x238
lea rdx, [rbp - 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140003d00
lea rdx, str.Error:_Unable_to_retrieve_process_information.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002870
lea rdx, [0x140004620]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.14007b5d0
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14000404f
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rbp - 0x38]
cmp dword [rsp + 0x40], ecx
jne 0x140004028
mov r8d, 0x100
lea rdx, [rbp + 0x200]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x48]
call fcn.1400037e0
nop
mov rdi, qword [0x14009f3d0]
mov r9, qword [0x14009f3d8]
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x48]
cmp rdi, r9
je 0x140003ff0
cmp r13, 8
setae byte [rsp + 0x20]
mov r15, qword [rsp + 0x58]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rdi + 0x10]
mov rbx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140003db1
mov rbx, qword [rdi]
lea rsi, [rsp + 0x48]
cmp r13, 8
cmovae rsi, r12
cmp r11, r15
ja 0x140003e5c
mov rax, r15
sub rax, r11
test r11, r11
je 0x140003e77
inc rax
lea r14, [rsi + rax*2]
mov rax, rsi
movzx r10d, word [rbx]
nop dword [rax]
nop dword [rax + rax]
mov rcx, r14
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x140003e1c
cmp word [rax], r10w
je 0x140003e19
cmp rcx, 1
je 0x140003e1c
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x140003e06
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140003e55
mov r8, r11
mov rdx, rbx
test r11, r11
je 0x140003e49
mov r9, rax
sub r9, rbx
movzx ecx, word [rdx + r9]
cmp cx, word [rdx]
jne 0x140003e6e
add rdx, 2
sub r8, 1
jne 0x140003e35
sub rax, rsi
sar rax, 1
cmp rax, 0xffffffffffffffff
jne 0x140003e77
mov r9, qword [0x14009f3d8]
add rdi, 0x20
cmp rdi, r9
je 0x140003feb
jmp 0x140003da0
add rax, 2
jmp 0x140003df0
mov rax, qword [0x14009f408]
mov edx, dword [rbp - 0x38]
mov rcx, qword [0x14009f410]
cmp rax, rcx
je 0x140003ea2
nop dword [rax]
cmp dword [rax + 0x40], edx
je 0x140003feb
add rax, 0x48
cmp rax, rcx
jne 0x140003e90
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor r14d, r14d
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r14w
mov dword [rbp - 0x50], edx
lea r9, [rsp + 0x48]
cmp byte [rsp + 0x20], r14b
cmovne r9, r12
lea rcx, [rbp - 0x70]
cmp r15, 7
ja 0x140003f0a
mov qword [rbp - 0x60], r15
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rbp + rbx - 0x70], r14w
jmp 0x140003f1c
mov rdx, r15
call fcn.140004dd0
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x48]
mov rbx, qword [0x14009f410]
cmp rbx, qword [0x14009f418]
je 0x140003f5c
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140003930
nop
lea rcx, [rbx + 0x20]
lea rdx, [rbp - 0x70]
call fcn.140003930
mov eax, dword [rbp - 0x50]
mov dword [rbx + 0x40], eax
add qword [0x14009f410], 0x48
jmp 0x140003f6a
lea r8, [rsp + 0x70]
mov rdx, rbx
call fcn.140005400
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140003faa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fa5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004069
call fcn.14007b5f0
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140003feb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fe6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004069
call fcn.14007b5f0
mov rbx, qword [rsp + 0x28]
cmp r13, 8
jb 0x140004028
lea rdx, [r13*2 + 2]
mov rax, r12
cmp rdx, 0x1000
jb 0x140004020
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004070
mov rcx, r12
call fcn.14007b5f0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x140003d21
mov rdi, qword [rsp + 0x30]
lea rdx, [rbp - 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140003cb8
jmp 0x140003d00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3