Function at 0x140023d30
Capabilities:
Enumerate gui resources
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov r14, rcx
mov qword [rsp + 0x40], rcx
mov qword [rbp - 0x70], rcx
xor r15d, r15d
mov dword [rsp + 0x48], r15d
mov dword [rbp - 0x40], r15d
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], r15
xor r8d, r8d
lea rdx, [0x14009cf60]
lea rcx, [rbp - 0x38]
call fcn.140015dd0
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x20], 0x238
lea rdx, [rbp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rsi, [r15 - 1]
test eax, eax
je 0x140023ee5
lea r12, str.Spotify.exe
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
lea rax, [rbp + 0x4c]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140023e10
lea rdx, [rbp + 0x4c]
lea rcx, [rsp + 0x70]
call fcn.140015dd0
lea r8, [rsp + 0x70]
mov r10, qword [rbp - 0x78]
cmp r10, 7
seta r11b
mov r9, qword [rsp + 0x70]
cmova r8, r9
cmp qword [rbp - 0x80], 0xb
jne 0x140023e6d
mov edx, 0xb
mov rcx, r12
sub r8, r12
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140023e6d
add rcx, 2
sub rdx, 1
jne 0x140023e55
mov bl, 1
jmp 0x140023e6f
xor bl, bl
test r11b, r11b
je 0x140023ea9
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140023ea1
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024428
mov rcx, r9
call fcn.14009016c
test bl, bl
je 0x140023ed0
mov rdx, qword [rbp - 0x10]
cmp rdx, qword [rbp - 8]
je 0x140023ec3
mov eax, dword [rbp + 0x28]
mov dword [rdx], eax
add qword [rbp - 0x10], 4
jmp 0x140023ed0
lea r8, [rbp + 0x28]
lea rcx, [rbp - 0x18]
call fcn.140025bc0
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140023df0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x40]
lea rcx, [0x140023b30]
call qword [sym.imp.USER32.dll_EnumWindows]
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], r15
mov r8d, 0x10
lea rdx, str.Stopped___Paused
mov rcx, r14
call fcn.140003660
mov dword [rsp + 0x48], 1
cmp qword [rbp - 0x28], 0
je 0x14002443d
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rcx, qword [rbp - 0x38]
lea rdx, str.spotify
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x14002443d
lea r8, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova r8, qword [rbp - 0x38]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd r14, eax
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
mov r13, r15
mov qword [rbp + 0x10], r15
mov rbx, r15
movabs rax, 0x7fffffffffffffff
test r14d, r14d
je 0x140024018
cmp r14, rax
ja 0x140024505
cmp r14, 0x1000
jb 0x140023feb
lea rcx, [r14 + 0x27]
cmp rcx, r14
jbe 0x14002450b
call fcn.14008fef0
test rax, rax
je 0x140024428
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140023ff6
mov rcx, r14
call fcn.14008fef0
mov rbx, rax
mov r12, rbx
mov qword [rbp], rbx
lea r13, [rbx + r14]
mov qword [rbp + 0x10], r13
mov r8, r14
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 8], r13
jmp 0x14002401c
mov r12, qword [rbp]
lea r8, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova r8, qword [rbp - 0x38]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r15
nop dword [rax]
inc rsi
cmp byte [rbx + rsi], 0
jne 0x140024060
mov r8, rsi
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.140003660
nop
lea rdi, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rdi, qword [rbp - 0x68]
mov r15d, 0xf
mov r14, qword [rbp - 0x58]
cmp r14, r15
jb 0x140024104
lea rsi, [r14 + rdi]
lea r8, [rsi - 0xe]
sub r8, rdi
lea edx, [r15 + 0x44]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140024104
nop word [rax + rax]
mov r8, r15
lea rdx, str.Spotify_Premium
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400240f7
inc rbx
lea r8, [rsi - 0xe]
sub r8, rbx
mov edx, 0x53
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x1400240c0
jmp 0x140024104
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
jne 0x1400243b9
lea rdi, [rbp - 0x68]
mov rax, qword [rbp - 0x50]
cmp rax, r15
cmova rdi, qword [rbp - 0x68]
cmp r14, 0xc
jb 0x14002418b
lea rsi, [r14 + rdi]
lea r8, [rsi - 0xb]
sub r8, rdi
mov edx, 0x53
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140024187
nop word [rax + rax]
mov r8d, 0xc
lea rdx, str.Spotify_Free
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14002417a
inc rbx
lea r8, [rsi - 0xb]
sub r8, rbx
mov edx, 0x53
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140024140
jmp 0x140024187
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
jne 0x1400243b9
mov rax, qword [rbp - 0x50]
lea rdi, [rbp - 0x68]
cmp rax, r15
cmova rdi, qword [rbp - 0x68]
cmp r14, 7
jb 0x140024207
lea rsi, [r14 + rdi]
lea r8, [rsi - 6]
sub r8, rdi
mov edx, 0x53
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140024207
nop dword [rax]
mov r8d, 7
lea rdx, str.Spotify
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400241fa
inc rbx
lea r8, [rsi - 6]
sub r8, rbx
mov edx, 0x53
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x1400241c0
jmp 0x140024207
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
jne 0x1400243b9
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0xd
jb 0x1400244f9
lea r14, [rbp - 0x68]
cmp qword [rbp - 0x50], r15
cmova r14, qword [rbp - 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov rdx, qword [rbp - 0x58]
lea rsi, [rdx + 0xd]
mov rbx, r15
lea rdi, [rsp + 0x50]
cmp rsi, r15
jbe 0x1400242d0
mov rbx, rsi
or rbx, r15
cmp rbx, rcx
jbe 0x14002428e
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14008fef0
test rax, rax
je 0x1400243ab
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rdx, qword [rbp - 0x58]
jmp 0x1400242cb
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400242b6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400244ff
jmp 0x14002426b
test rcx, rcx
je 0x1400242c9
call fcn.14008fef0
mov rdi, rax
mov rdx, qword [rbp - 0x58]
jmp 0x1400242cb
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
movsd xmm0, qword [str.Now_Playing:]
movsd qword [rdi], xmm0
mov eax, dword [0x14009cf58]
mov dword [rdi + 8], eax
movzx eax, byte [0x14009cf5c]
mov byte [rdi + 0xc], al
lea rcx, [rdi + 0xd]
mov r8, rdx
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
lea rax, [rsp + 0x50]
mov r14, qword [rsp + 0x40]
cmp r14, rax
je 0x140024376
mov rdx, qword [r14 + 0x18]
cmp rdx, r15
jbe 0x140024350
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x14002434b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400243ab
mov rcx, r8
call fcn.14009016c
mov qword [r14 + 0x10], 0
mov byte [r14], 0
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [r14 + 0x10], xmm1
mov byte [rsp + 0x50], 0
jmp 0x14002437b
mov r15, qword [rsp + 0x68]
cmp r15, 0xf
jbe 0x1400243be
lea rdx, [r15 + 1]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400243b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400243b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009016c
jmp 0x1400243be
mov r14, qword [rsp + 0x40]
mov rax, qword [rbp - 0x50]
cmp rax, 0xf
jbe 0x1400243fe
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400243f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400243f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009016c
nop
test r12, r12
je 0x14002443a
sub r13, r12
mov rax, r12
cmp r13, 0x1000
jb 0x14002442f
add r13, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002442f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r13
mov rcx, r12
call fcn.14009016c
xor r15d, r15d
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140024483
mov rdx, qword [rbp - 8]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024472
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400244ba
call fcn.14009016c
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
mov rdx, qword [rbp - 0x20]
cmp rdx, 7
jbe 0x1400244c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400244c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400244c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009016c
mov rax, r14
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.14008fdb0
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001400
int3
call fcn.140001360
nop
call fcn.140003760
int3
call fcn.140001360
int3