Function at 0x180029b90
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5d0]
sub rsp, 0x6d0
mov rsi, rcx
mov r15d, edx
imul ecx, edx, 0xa32
mov dword [rsp + 0x40], ecx
cmp edx, ecx
ja 0x18002a2e0
mov rbx, qword [rsp + 0x68]
xor edi, edi
mov r13d, dword [rbp + 0x618]
mov r11d, 0xfa5
mov r14d, dword [rbp + 0x618]
mov r12, qword [rsp + 0x70]
lea eax, [rdi + 0x33]
lea edx, [rdi + 0x6c]
lea r10d, [rdi + 1]
nop
cmp r15d, 0xb9f0
ja 0x180029f4c
je 0x18002a2e0
cmp r15d, 0x125
ja 0x180029e29
je 0x180029da1
mov eax, r15d
sub eax, 0x67
je 0x180029d8b
sub eax, 0x1f
je 0x180029d76
cmp eax, 0x8a
jne 0x18002a27f
mov rax, qword [rsi]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xe4
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], rdi
call fcn.180016290
xor r12d, r12d
cmp eax, 0x1a
jne 0x180029cee
mov edi, 0x33
nop
cmp edi, 0x33
je 0x180029ca8
cmp edi, 0x58
jne 0x180029cd2
movzx eax, word [rsp + 0x6e]
sub ax, word [rsp + 0x6a]
mov word [rsp + 0x66], ax
movzx eax, word [rsp + 0x6c]
sub ax, bx
mov word [rsp + 0x64], ax
jmp 0x180029cd2
mov rax, qword [rsi]
lea rcx, [rsp + 0x58]
mov r9d, 0x14e
mov qword [rsp + 0x58], rax
xor r8d, r8d
xor edx, edx
call fcn.18000b3b0
mov rbx, rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], r12d
add edi, 0x25
cmp edi, 0x7d
jb 0x180029c80
mov rax, qword [rsp + 0x60]
mov r12, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
jmp 0x18002a279
mov edi, 0x102
mov eax, edi
sub eax, 0x102
je 0x180029d1d
cmp eax, 0x79
jne 0x180029d57
lea rax, [rsp + 0x60]
mov ecx, 0xfffffd35
lea rdx, [rbp - 0x20]
mov dword [rbp + 0x53c], eax
call qword [0x1800d5910]
jmp 0x180029d57
mov rax, qword [rsi]
mov r9d, 0x4e
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rax, [rsp + 0x58]
xor edx, edx
mov qword [rsp + 0x38], rax
xor ecx, ecx
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call fcn.180018cf0
mov qword [rbp + 0x532], rax
add edi, 0x79
cmp edi, 0x1f4
jb 0x180029cf3
mov rax, qword [rsp + 0x60]
mov r12, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
jmp 0x18002a279
mov eax, 0x72
mov dword [rbp - 0x78], 0x65006b
mov word [rbp - 0x74], ax
jmp 0x18002a27f
mov rax, qword [rsi]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov ecx, dword [rsp + 0x40]
mov qword [rbp - 0x30], rax
jmp 0x18002a27f
mov eax, dword [r8]
mov r8d, dword [rsi + 8]
mov dword [rbp - 0x48], eax
mov dword [rbp - 0x44], eax
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x78], rax
shr rax, 0x20
cmp eax, r8d
jae 0x180029dec
mov r9, qword [rsi]
mov ecx, dword [rsp + 0x7c]
nop word [rax + rax]
mov eax, ecx
movzx edx, byte [rax + r9]
cmp dl, 0xd
je 0x180029dec
cmp dl, 0xa
je 0x180029dec
inc ecx
mov dword [rsp + 0x7c], ecx
cmp ecx, r8d
jb 0x180029dd0
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], r10d
mov r8, rsi
mov dword [rsp + 0x48], r10d
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x20], 0xb3
lea rcx, [rsp + 0x48]
call fcn.180030df0
mov ecx, dword [rsp + 0x40]
mov r13d, eax
test eax, eax
jns 0x18002a27f
jmp 0x18002a0d0
cmp r15d, 0x4669
je 0x180029e78
cmp r15d, 0x5b9a
je 0x180029e58
cmp r15d, 0xb6ae
jne 0x18002a27f
mov dword [rbp - 0x66], 0x6c0064
mov word [rbp - 0x62], dx
jmp 0x18002a27f
mov edx, 0x6e
mov dword [rbp - 0x70], 0x6c0065
mov word [rbp - 0x72], dx
mov word [rbp - 0x6c], ax
mov dword [rbp - 0x6a], 0x2e0032
jmp 0x18002a27f
mov rax, qword [rbp - 0x30]
movzx eax, word [rax]
cmp ax, 6
je 0x180029f3f
cmp ax, 0x19
je 0x180029f3f
mov r12, qword [rbp + 0x628]
mov edi, 0xed
xor ebx, ebx
cmp edi, 0xed
je 0x180029edd
cmp edi, 0x4749
je 0x180029ed1
cmp edi, 0x8da5
jne 0x180029f1e
mov ecx, 0xfffffd36
mov dword [rbp + 0x540], r12d
lea rdx, [rbp - 0x20]
call qword [0x1800d5910]
jmp 0x180029f17
movsx eax, byte [r8]
mov dword [rbp + 0x53c], eax
jmp 0x180029f1e
mov rax, qword [rsi]
mov r9d, 0x4e
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x48]
xor edx, edx
mov qword [rsp + 0x38], rax
xor ecx, ecx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.180018cf0
mov qword [rbp + 0x532], rax
mov r8, qword [rbp + 0x620]
add edi, 0x465c
cmp edi, 0xd314
jbe 0x180029ea1
mov rbx, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
jmp 0x18002a279
mov word [0x1800d5918], r11w
jmp 0x18002a27f
cmp r15d, 0x18f71
ja 0x18002a1ad
je 0x18002a12b
cmp r15d, 0xc84b
je 0x18002a0b8
cmp r15d, 0x111c2
je 0x180029fed
cmp r15d, 0x16cd6
jne 0x18002a27f
mov rax, qword [rsi]
lea r9, [rsp + 0x50]
xor edx, edx
mov word [rsp + 0x50], r10w
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x20], rdi
lea r8d, [rdx + 0x28]
call fcn.180068730
cdqe
lea r9, [rsp + 0x50]
mov qword [rbp - 0x80], rax
lea rcx, [rsp + 0x48]
xor edx, edx
mov qword [rsp + 0x20], rdi
mov eax, 2
mov word [rsp + 0x50], ax
mov rax, qword [rsi]
lea r8d, [rdx + 0x28]
mov qword [rsp + 0x48], rax
call fcn.180068730
mov ecx, dword [rsp + 0x40]
cmp eax, 1
mov r14d, edi
sete r14b
jmp 0x18002a27f
mov word [rbp - 0x60], di
mov edi, 0xe1
mov eax, edi
sub eax, 0xe1
je 0x18002a06c
sub eax, 0x23
je 0x18002a01c
sub eax, 0x721f
je 0x18002a0a1
cmp eax, 0x11e9
je 0x18002a0a1
jmp 0x18002a08f
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
movsxd rcx, eax
sub rcx, 0x471
je 0x18002a045
cmp rcx, 0xf
jne 0x18002a05e
test qword [0x1800d57d0], 0x4000
jmp 0x18002a050
test qword [0x1800d57d0], 0x100
je 0x18002a05e
mov rcx, qword [rbp - 0x78]
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov edi, 0x104
mov dword [rbp - 0x40], 1
jmp 0x18002a08f
xor r8d, r8d
lea rcx, [rbp - 0x78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
lea rdx, str.OpenProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x40], rax
add edi, 0x7242
cmp edi, 0x1c908
jbe 0x180029ff6
mov r12, qword [rbp - 0x40]
xor edi, edi
mov ecx, dword [rsp + 0x40]
mov r14d, edi
mov qword [rsp + 0x70], r12
jmp 0x18002a27f
cmp dword [rsi + 0x1c8], 0
jl 0x18002a0d0
test r9, r9
je 0x18002a0cd
mov eax, dword [rsp + 0x7c]
mov dword [r9], eax
mov r13d, r10d
mov edi, dword [rsi + 0x190]
mov r15d, 0xc84b
test edi, edi
js 0x18002a27d
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x48], edi
lea r8, [rsp + 0x48]
mov rdx, rsi
mov ecx, 0xa4
call fcn.180059880
mov rcx, rax
call fcn.180073cf4
mov eax, edi
lea rcx, [rax + rax*4]
mov rax, qword [rsi + 0x80]
mov edi, dword [rax + rcx*4 + 0xc]
test edi, edi
jns 0x18002a0f0
jmp 0x18002a279
mov ecx, 0x105
mov eax, ecx
sub eax, 0x105
je 0x18002a150
sub eax, 1
je 0x18002a149
cmp eax, 1
je 0x18002a2e0
jmp 0x18002a15b
mov dword [rsp + 0x58], r13d
jmp 0x18002a15b
mov qword [rsi + 0x190], 0xffffffffffffffff
inc ecx
cmp ecx, 0x108
jb 0x18002a130
mov ecx, dword [rsp + 0x40]
test r14d, r14d
jne 0x18002a27f
mov rcx, qword [rbp - 0x38]
mov edx, r10d
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x18002a1df
mov rax, qword [rsi]
lea rdx, [rsp + 0x48]
mov r8d, 0x92
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x48], edi
call fcn.18004ff10
mov ecx, dword [rsp + 0x40]
jmp 0x18002a27f
cmp r15d, 0x1c7ea
je 0x18002a208
cmp r15d, 0x222fe
je 0x18002a169
cmp r15d, 0x27e12
jne 0x18002a27f
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x40]
jmp 0x18002a27f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x58], eax
mov r8d, 0x92
mov rax, qword [rsi]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x50], rax
call fcn.18004ff10
mov ecx, dword [rsp + 0x40]
jmp 0x18002a27f
mov r8d, dword [rbp - 0x80]
xor edx, edx
mov ecx, 0x100001
call r12
mov qword [rbp - 0x38], rax
mov rdi, rax
test rax, rax
je 0x18002a2b7
test r14d, r14d
je 0x18002a279
mov rdx, qword [rbp - 0x80]
lea rcx, [0x18003b770]
call qword [sym.imp.USER32.dll_EnumWindows]
mov edx, 0x1f4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18002a279
mov rax, qword [rsi]
lea rdx, [rsp + 0x48]
mov r8d, 0x92
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x48], 0xffffffff
mov r14d, 1
call fcn.18004ff10
mov ecx, dword [rsp + 0x40]
xor edi, edi
imul eax, dword [rbp + 0x618], 0xae
mov r11d, 0xfa5
mov r9, qword [rbp + 0x628]
mov r8, qword [rbp + 0x620]
add r15d, eax
mov eax, 0x33
lea edx, [rax + 0x39]
lea r10d, [rax - 0x32]
cmp r15d, ecx
jbe 0x180029c00
jmp 0x18002a2e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x618], eax
mov r8d, 0x92
mov rax, qword [rsi]
lea rdx, [rbp + 0x618]
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x50], rax
call fcn.18004ff10
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x710]
add rsp, 0x6d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret