Function at 0x140036cb0
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
mov r10, rcx
test edx, edx
jne 0x140036e06
cmp r8d, 0xe
ja case.default.0x140036ce2
lea rcx, [0x140000000]
movsxd rax, r8d
mov edx, dword [rcx + rax*4 + 0x36edc]
add rdx, rcx
jmp rdx
movzx edx, byte [rsp + 0x38]
mov rcx, r10
add rsp, 0x20
pop rbx
jmp 0x140039830
mov rax, qword [r9 + 8]
mov rcx, r10
mov edx, dword [rax]
add rsp, 0x20
pop rbx
jmp 0x140038470
mov rcx, qword [r9 + 8]
mov rax, qword [r9 + 0x10]
mov edx, dword [rcx]
mov rcx, r10
mov r8d, dword [rax]
add rsp, 0x20
pop rbx
jmp fcn.1400384b0
mov rax, qword [r9 + 8]
mov rcx, r10
mov edx, dword [rax]
add rsp, 0x20
pop rbx
jmp 0x1400382b0
mov rax, qword [r9 + 8]
mov rcx, r10
mov edx, dword [rax]
add rsp, 0x20
pop rbx
jmp 0x1400382f0
mov rax, qword [r9 + 8]
mov rcx, r10
movzx r8d, byte [rsp + 0x38]
mov edx, dword [rax]
add rsp, 0x20
pop rbx
jmp 0x140039870
movzx edx, byte [rsp + 0x38]
mov rcx, r10
add rsp, 0x20
pop rbx
jmp fcn.140038b10
movzx edx, byte [rsp + 0x38]
mov rcx, r10
add rsp, 0x20
pop rbx
jmp fcn.140038ad0
mov rcx, qword [r10 + 8]
add rsp, 0x20
pop rbx
jmp 0x1400878a0
mov rcx, qword [r10 + 8]
add rsp, 0x20
pop rbx
jmp fcn.1400855e0
mov rcx, qword [r10 + 8]
lea rdx, [rcx + 0x138]
call fcn.1400399c0
mov rcx, qword [rbx]
test rcx, rcx
je case.default.0x140036ce2
mov byte [rcx], al
add rsp, 0x20
pop rbx
ret
mov rcx, qword [r10 + 8]
lea rdx, [rcx + 0x170]
jmp 0x140036dad
mov rcx, qword [r10 + 8]
call fcn.1400377c0
jmp 0x140036db2
mov rcx, qword [r10 + 8]
call fcn.1400379f0
jmp 0x140036db2
mov rcx, qword [r10 + 8]
call fcn.140037880
mov rcx, qword [rbx]
test rcx, rcx
je case.default.0x140036ce2
mov byte [rcx], al
add rsp, 0x20
pop rbx
ret
cmp edx, 0xa
jne case.default.0x140036ce2
mov rax, qword [r9 + 8]
mov rcx, qword [r9]
mov rdx, qword [rax]
lea rax, [0x140039830]
cmp rdx, rax
jne 0x140036e31
mov dword [rcx], 0
add rsp, 0x20
pop rbx
ret
lea rax, [0x140038470]
cmp rdx, rax
jne 0x140036e49
mov dword [rcx], 1
add rsp, 0x20
pop rbx
ret
lea rax, [fcn.1400384b0]
cmp rdx, rax
jne 0x140036e61
mov dword [rcx], 2
add rsp, 0x20
pop rbx
ret
lea rax, [0x1400382b0]
cmp rdx, rax
jne 0x140036e79
mov dword [rcx], 3
add rsp, 0x20
pop rbx
ret
lea rax, [0x1400382f0]
cmp rdx, rax
jne 0x140036e91
mov dword [rcx], 4
add rsp, 0x20
pop rbx
ret
lea rax, [0x140039870]
cmp rdx, rax
jne 0x140036ea9
mov dword [rcx], 5
add rsp, 0x20
pop rbx
ret
lea rax, [fcn.140038b10]
cmp rdx, rax
jne 0x140036ec1
mov dword [rcx], 6
add rsp, 0x20
pop rbx
ret
lea rax, [fcn.140038ad0]
cmp rdx, rax
jne case.default.0x140036ce2
mov dword [rcx], 7
add rsp, 0x20
pop rbx
ret
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov r8d, 3
lea rdx, [0x1401733f0]
call fcn.14005d320
add rsp, 0x38
ret
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov r8d, 4
lea rdx, [0x1401733f0]
call fcn.14005d320
add rsp, 0x38
ret
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov r8d, 1
lea rdx, [0x1401733f0]
call fcn.14005d320
add rsp, 0x38
ret
mov byte [rsp + 0x10], dl
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rdx, [0x1401733f0]
call fcn.14005d320
add rsp, 0x38
ret
mov r11, rsp
sub rsp, 0x58
mov rax, qword [0x1402f1140]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], edx
lea rax, [r11 - 0x30]
mov byte [r11 - 0x38], r8b
lea r9, [r11 - 0x28]
mov qword [r11 - 0x20], rax
lea rdx, [0x1401733f0]
lea rax, [r11 - 0x38]
mov qword [r11 - 0x28], 0
mov r8d, 5
mov qword [r11 - 0x18], rax
call fcn.14005d320
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14010a180
add rsp, 0x58
ret
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xf0]
mov rbx, rcx
test rax, rax
je 0x1400878e5
mov edx, dword [rax + 0x10]
lea rcx, [0x140086ab0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbx + 0xf0]
xor r9d, r9d
xor r8d, r8d
mov ecx, dword [rax + 0x14]
lea edx, [r9 + 0x10]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_PostThreadMessageW]
add rsp, 0x20
pop rbx
ret