Function at 0x140035140
Capabilities:
Enumerate processes
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov rax, qword [0x1400a4040]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
xor r14d, r14d
mov dword [rsp + 0x60], r14d
cmp byte [0x1400a70e7], r14b
jne 0x14003519d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400351ed
lea rdx, str.hl2.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x1400353bb
lea rdx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400351c3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1400a7100], r14d
nop dword [rax]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [rsp + 0x60]
cmp dword [0x1400a7100], eax
jne 0x140035200
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x1400a7180], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [0x1400a7178], rax
lea rdx, [rbp - 0x78]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp - 0x70]
mov edx, dword [rbp - 0x78]
sub eax, edx
mov dword [0x1400a7168], eax
mov eax, dword [rbp - 0x6c]
mov ecx, dword [rbp - 0x74]
sub eax, ecx
mov dword [0x1400a716c], eax
mov dword [0x1400a7174], edx
mov dword [0x1400a7170], ecx
mov r8d, 0x104
lea rdx, [rbp + 0xd0]
mov rcx, qword [0x1400a7178]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov r8d, 0x104
lea rdx, [rbp + 0x1e0]
mov rcx, qword [0x1400a7178]
call qword [sym.imp.USER32.dll_GetClassNameA]
mov r9d, 0x104
lea r8, [rbp - 0x60]
xor edx, edx
mov rcx, qword [0x1400a7180]
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
mov r8d, dword [0x1400a7100]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400a70e8], rax
mov dword [rsp + 0x64], 0x104
lea r9, [rsp + 0x64]
lea rbx, [0x1400a6fe0]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r14b
jne 0x140035306
sub rax, 7
cmp rax, 0x104
jae 0x14003559d
mov byte [rax + rbx], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
mov dword [rsp + 0x60], 1
mov ebx, 0xa
movabs rdi, 0x842108421084211
lea rsi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
nop dword [rax + rax]
call fcn.1400648b8
movsxd rcx, eax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
movzx r9d, byte [rcx + rsi]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x80]
cmp rcx, rdx
jae 0x1400353cf
lea rax, [rcx + 1]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x68]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400353e0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x58]
mov dword [0x1400a7100], eax
jmp 0x140035200
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x68]
call fcn.140035f80
sub rbx, 1
jne 0x140035360
lea rax, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rax, qword [rsp + 0x68]
mov qword [0x1400a7108], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov rsi, rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rbx, rax
mov rdi, qword [0x1400a7108]
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [0x1400a7110], 0x50
lea rcx, [0x140034fe0]
mov qword [0x1400a7118], rcx
mov qword [0x1400a7120], r14
mov qword [0x1400a7128], r14
mov qword [0x1400a7130], rsi
mov qword [0x1400a7138], rbx
xorps xmm0, xmm0
movdqa xmmword [0x1400a7140], xmm0
mov qword [0x1400a7150], rdi
mov qword [0x1400a7158], rax
lea rcx, [0x1400a7110]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rcx, qword [0x1400a7178]
test rcx, rcx
je 0x1400354ef
lea rdx, [0x1400a7878]
call qword [sym.imp.USER32.dll_GetClientRect]
lea rdx, [0x1400a78c8]
mov rcx, qword [0x1400a7178]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [0x1400a78c8]
mov dword [0x1400a7878], eax
mov eax, dword [0x1400a78cc]
mov dword [0x1400a787c], eax
mov eax, dword [0x1400a7880]
mov dword [0x1400a7168], eax
mov ecx, dword [0x1400a7884]
mov dword [0x1400a716c], ecx
jmp 0x1400354fb
mov eax, dword [0x1400a7168]
mov ecx, dword [0x1400a716c]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], eax
mov eax, dword [0x1400a7170]
mov dword [rsp + 0x28], eax
mov eax, dword [0x1400a7174]
mov dword [rsp + 0x20], eax
mov r9d, 0x90000000
mov rdx, qword [0x1400a7108]
mov r8, rdx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1400a7160], rax
lea rdx, [0x1400a4d08]
mov rcx, rax
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 0xffffffec
mov r8d, 0x80020
mov rcx, qword [0x1400a7160]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, 5
mov rcx, qword [0x1400a7160]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400a7160]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.140034ca0
call fcn.140034910
jmp 0x140035596
call fcn.140051130
int3