Function at 0x140097ba9
Capabilities:
Enumerate gui resources
Enumerate processes
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x228
lea rdx, [0x14029b52a]
lea rsi, [rsp + 0x30]
mov r8d, 9
mov rcx, rsi
call fcn.140094255
mov rdx, qword [rsi + 8]
mov rdi, qword [rsi + 0x10]
lea rbx, [rsp + 0xf0]
mov rcx, rbx
mov r8, rdi
call fcn.140048270
cmp qword [rbx], 0
movabs r14, 0x8000000000000000
je 0x140097c5c
mov rdi, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x30]
movups xmm0, xmmword [rsi + 8]
movaps xmmword [rsp + 0x50], xmm0
cmp rdx, r14
je 0x140097c66
movaps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0xf0]
mov qword [rcx], rdx
movups xmmword [rcx + 8], xmm0
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rax
call fcn.140091792
mov rbx, rax
lea rsi, [0x14029ac58]
jmp 0x1400982a5
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rdi
lea rdx, [0x14029b52a]
lea rdi, [rsp + 0x30]
mov r8d, 9
mov rcx, rdi
call fcn.140094255
mov rdx, qword [rdi + 8]
mov rdi, qword [rdi + 0x10]
lea rbx, [rsp + 0xf0]
mov rcx, rbx
mov r8, rdi
call fcn.140048270
cmp qword [rbx], 0
je 0x140097d11
mov rdi, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x30]
movups xmm0, xmmword [rsi + 8]
movaps xmmword [rsp + 0x50], xmm0
cmp rdx, r14
je 0x140097d1b
movaps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0xf0]
mov qword [rcx], rdx
movups xmmword [rcx + 8], xmm0
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rax
call fcn.140091792
mov rbx, rax
lea rsi, [0x14029ac58]
jmp 0x140098283
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rdi
lea rdx, [0x14029b54c]
lea rdi, [rsp + 0x30]
mov r8d, 0xb
mov rcx, rdi
call fcn.140094255
mov rdx, qword [rdi + 8]
mov rdi, qword [rdi + 0x10]
lea rbx, [rsp + 0xf0]
mov rcx, rbx
mov r8, rdi
call fcn.140048270
cmp qword [rbx], 0
je 0x140097dc6
mov rdi, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x30]
movups xmm0, xmmword [rsi + 8]
movaps xmmword [rsp + 0x50], xmm0
cmp rdx, r14
je 0x140097dd0
movaps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0xe0], xmm0
lea rcx, [rsp + 0xf0]
mov qword [rcx], rdx
movups xmmword [rcx + 8], xmm0
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rax
call fcn.140091792
mov rbx, rax
lea rsi, [0x14029ac58]
jmp 0x140098261
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], rdi
lea rdx, [0x14029b541]
lea rdi, [rsp + 0x30]
mov r8d, 0xb
mov rcx, rdi
call fcn.140094255
mov rdx, qword [rdi + 8]
mov rdi, qword [rdi + 0x10]
lea rbx, [rsp + 0xf0]
mov rcx, rbx
mov r8, rdi
call fcn.140048270
cmp qword [rbx], 0
je 0x140097e7b
mov rdi, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x30]
movups xmm0, xmmword [rsi + 8]
movaps xmmword [rsp + 0x50], xmm0
cmp rdx, r14
je 0x140097e85
movaps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0xe0], xmm0
lea rcx, [rsp + 0xf0]
mov qword [rcx], rdx
movups xmmword [rcx + 8], xmm0
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rax
call fcn.140091792
mov rbx, rax
lea rsi, [0x14029ac58]
jmp 0x14009823f
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov al, byte [0x140353270]
mov edx, 0x10
xor ecx, ecx
call fcn.140190370
test rax, rax
je 0x140098318
mov r13, rax
lea rax, [rsp + 0x80]
mov qword [r13], rax
lea rax, [rsp + 0x50]
mov qword [r13 + 8], rax
mov al, byte [0x140353270]
mov edx, 0x10
xor ecx, ecx
call fcn.140190370
test rax, rax
je 0x140098318
mov rdi, rax
lea rax, [rsp + 0xc0]
mov qword [rdi], rax
lea rax, [rsp + 0xa0]
mov qword [rdi + 8], rax
lea rsi, [rsp + 0xf0]
lea r14, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x78], r13
mov rax, qword [r13 + rbx]
mov r13, qword [rax + 8]
mov rbp, qword [rax + 0x10]
mov r8d, 0x130
mov rcx, rsi
xor edx, edx
call fcn.140230bc0
mov dword [rsp + 0xf0], 0x130
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
test rax, rax
je 0x1400980c5
mov r12, rax
mov qword [rsp + 0x70], rbx
mov rcx, rax
mov rdx, rsi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1400980af
mov bl, byte [rsp + 0x11c]
test bl, bl
je 0x140097ff2
mov al, byte [0x140353270]
mov edx, 8
xor ecx, ecx
call fcn.140190370
test rax, rax
je 0x140098309
mov byte [rax], bl
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 1
xor ebx, ebx
mov r15b, byte [rsp + rbx + 0x11d]
mov rcx, qword [rsp + 0x30]
test r15b, r15b
je 0x140097ffd
lea rsi, [rbx + 1]
cmp rsi, rcx
je 0x140097fda
mov byte [rax + rbx + 1], r15b
add rbx, 2
mov qword [rsp + 0x40], rbx
mov rbx, rsi
cmp rsi, 0x103
jne 0x140097fa3
jmp 0x140098002
mov r8d, 1
mov rcx, r14
mov rdx, rsi
call fcn.14023de27
mov rax, qword [rsp + 0x38]
jmp 0x140097fbe
mov eax, 1
xor ecx, ecx
xor ebx, ebx
jmp 0x140098011
inc rbx
jmp 0x14009800c
mov ebx, 0x104
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rcx, r14
call fcn.14003f210
mov rsi, rax
mov rbx, rdx
lea r8, [rdx - 1]
mov rcx, r14
mov rdx, rax
call fcn.140048270
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
test rax, rax
jne 0x140098053
mov rdx, qword [rsp + 0x40]
jmp 0x140098055
xor edx, edx
cmp rdx, rbp
jne 0x140098079
test rax, rax
mov eax, 1
cmovne rcx, rax
mov rdx, r13
mov r8, rbp
call fcn.140230ac0
test eax, eax
je 0x14009815e
mov rcx, r12
lea rdx, [rsp + 0xf0]
call sub.KERNEL32.dll_Process32Next
mov r15d, eax
mov byte [rsi], 0
test rbx, rbx
je 0x1400980a6
mov rcx, qword [0x1403531b0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r15d, r15d
jne 0x140097f5e
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rsi, [rsp + 0xf0]
mov rbx, qword [rsp + 0x70]
add rbx, 8
cmp rbx, 0x10
mov r13, qword [rsp + 0x78]
jne 0x140097f06
xor ebx, ebx
movabs r12, 0x8000000000000000
mov rbp, qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rdi + rbx]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov rcx, r14
call fcn.14003f110
cmp qword [rsp + 0x30], r12
jne 0x1400982ca
mov rsi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x40]
lea rcx, [0x140098328]
mov rdx, rsi
call sub.user32.dll_EnumWindows
mov byte [rsi], 0
test r15, r15
je 0x140098139
mov rcx, qword [0x1403531b0]
xor edx, edx
mov r8, rsi
call rbp
add rbx, 8
cmp rbx, 0x10
jne 0x1400980eb
mov ecx, 1
xor edx, edx
call fcn.140176400
xor ebx, ebx
lea rsi, [rsp + 0xf0]
jmp 0x140097f06
mov ebp, dword [rsp + 0xf8]
mov byte [rsi], 0
test rbx, rbx
je 0x14009817f
mov rcx, qword [0x1403531b0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
lea rsi, [rsp + 0xf0]
mov rbx, qword [rsp + 0x70]
je 0x1400980c5
mov ecx, 1
xor edx, edx
mov r8d, ebp
call sub.KERNEL32.dll_OpenProcess
test rax, rax
je 0x1400981e1
mov rsi, rax
mov rcx, rax
mov edx, 1
call sub.KERNEL32.dll_TerminateProcess
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
mov rbx, qword [rsp + 0x70]
lea rsi, [rsp + 0xf0]
jne 0x1400980c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
lea rcx, [rax + 2]
call fcn.140113b93
mov rbx, rax
mov rcx, qword [0x1403531b0]
xor edx, edx
mov r8, rdi
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
call rsi
mov rcx, qword [0x1403531b0]
xor edx, edx
mov r8, qword [rsp + 0x78]
call rsi
lea rsi, fcn.1400747f0
cmp qword [rsp + 0x50], 0
je 0x14009823f
mov r8, qword [rsp + 0x58]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x80], 0
je 0x140098261
mov r8, qword [rsp + 0x88]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0xc0], 0
je 0x140098283
mov r8, qword [rsp + 0xc8]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0xa0], 0
je 0x1400982a5
mov r8, qword [rsp + 0xa8]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x1400982b5
mov rcx, rbx
mov rdx, rsi
call fcn.1400052a4
nop
add rsp, 0x228
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
lea r8, [rsp + 0xf0]
movaps xmmword [r8 + 0x10], xmm1
movaps xmmword [r8], xmm0
lea rax, str.srckillproc.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__valueC:Usersdiddy.cargo_registry_srcindex.crates.io_6f17d22bba15001fzopfli_0.8.1_srccache.rs
lea r9, [0x14029add8]
mov edx, 0x2b
call fcn.1402320b0
mov ecx, 1
mov edx, 8
call fcn.140231690
mov ecx, 8
mov edx, 0x10
call fcn.1402316b0
int3