Function at 0x140002b80
Capabilities:
Enumerate gui resources
Enumerate processes
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4c8]
sub rsp, 0x5a0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x470], rax
xor ebx, ebx
mov edi, ebx
mov dword [rsp + 0x20], ebx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f8], xmm0
mov r13d, ebx
mov qword [rbp + 0x208], rbx
mov r14d, 7
mov qword [rbp + 0x210], r14
mov word [rbp + 0x1f8], bx
nop
test r13, r13
je 0x14000313e
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14000312b
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e0], xmm1
mov qword [rbp + 0x1f0], rbx
mov qword [rbp - 0x60], 0x238
mov dword [rbp - 0x58], ebx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 0
mov dword [rbp - 0x38], ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x34]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rbp + 0x1d4], eax
lea rdx, [rbp - 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rsi, qword [rbp + 0x1f8]
test eax, eax
je 0x1400030c5
lea rdx, [rbp - 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400030c5
cmp dword [rbp - 0x58], 0
je 0x1400030b0
lea rcx, [rbp - 0x34]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002cb0
test rax, rax
je 0x1400030b0
lea rdx, [rbp - 0x34]
lea rcx, [rbp + 0x218]
call fcn.140003630
nop
mov eax, dword [rbp - 0x58]
mov dword [rbp - 0x78], eax
mov qword [rbp - 0x70], rbx
lea rdx, [rbp - 0x78]
lea rcx, [0x140002a30]
call qword [sym.imp.USER32.dll_EnumWindows]
or edi, 1
mov dword [rsp + 0x20], edi
mov rcx, qword [rbp - 0x70]
test rcx, rcx
jne 0x140002d08
lea rdx, [0x140007678]
jmp 0x140002d22
mov r8d, 0x104
lea rdx, [rbp + 0x260]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x238]
call fcn.140003630
nop
lea r11, [rbp + 0x1f8]
cmp r14, 7
cmova r11, rsi
lea rbx, [rbp + 0x218]
mov r14, qword [rbp + 0x230]
cmp r14, 7
seta r15b
mov rsi, qword [rbp + 0x218]
cmova rbx, rsi
mov rax, qword [rbp + 0x228]
cmp r13, rax
ja 0x14000301f
sub rax, r13
inc rax
lea rdi, [rbx + rax*2]
mov rax, rbx
movzx r10d, word [r11]
mov rcx, rdi
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x140002dac
cmp word [rax], r10w
je 0x140002da9
cmp rcx, 1
je 0x140002dac
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x140002d96
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14000301b
mov r8, r13
mov rdx, r11
test r13, r13
je 0x140002de8
mov r9, rax
sub r9, r11
nop dword [rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x140002e9a
add rdx, 2
sub r8, 1
jne 0x140002dd0
sub rax, rbx
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x14000301b
xorps xmm0, xmm0
movups xmm6, xmmword [rbp + 0x218]
movaps xmmword [rsp + 0x30], xmm6
movups xmm7, xmmword [rbp + 0x228]
movaps xmmword [rsp + 0x40], xmm7
xor ebx, ebx
mov qword [rbp + 0x228], rbx
mov qword [rbp + 0x230], 7
mov word [rbp + 0x218], bx
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
lea r14, [rbp + 0x238]
mov r15, qword [rbp + 0x250]
cmp r15, 7
seta r12b
mov rsi, qword [rbp + 0x238]
cmova r14, rsi
mov rdi, qword [rbp + 0x248]
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
ja 0x14000321f
cmp rdi, 7
ja 0x140002ea3
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x50], xmm0
jmp 0x140002f58
add rax, 2
jmp 0x140002d80
mov rbx, rdi
or rbx, 7
cmp rbx, rax
jbe 0x140002ec2
mov rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140002ef2
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140003225
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002f21
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003225
mov rcx, rax
call fcn.140005528
mov rcx, rax
test rax, rax
je 0x140003192
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002f2f
test rcx, rcx
je 0x140002f2d
call fcn.140005528
jmp 0x140002f2f
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rbx
lea r8, [rdi*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movaps xmm0, xmmword [rsp + 0x50]
xor ebx, ebx
mov eax, dword [rbp - 0x58]
mov dword [rsp + 0x70], eax
mov rdx, qword [rbp + 0x1e8]
cmp rdx, qword [rbp + 0x1f0]
je 0x140002fb6
movups xmmword [rdx], xmm6
movups xmmword [rdx + 0x10], xmm7
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bx
movups xmmword [rdx + 0x20], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rdx + 0x30], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], bx
mov dword [rdx + 0x40], eax
add qword [rbp + 0x1e8], 0x48
jmp 0x140002fc8
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x1e0]
call fcn.140004160
nop
lea rcx, [rsp + 0x30]
call fcn.140002ac0
nop
test r12b, r12b
je 0x14000300e
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003005
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003199
mov rcx, rsi
call fcn.140005520
nop
mov edi, dword [rsp + 0x20]
mov r12, qword [rbp - 0x80]
jmp 0x1400030a2
mov edi, dword [rsp + 0x20]
mov rdx, qword [rbp + 0x250]
cmp rdx, 7
jbe 0x140003066
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x238]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003060
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003199
call fcn.140005520
nop
test r15b, r15b
je 0x1400030a0
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003098
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400031a0
mov rcx, rsi
call fcn.140005520
xor ebx, ebx
mov r14, qword [rbp + 0x210]
mov rsi, qword [rbp + 0x1f8]
lea rdx, [rbp - 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002c92
lea rcx, [0x140075d60]
call fcn.1400037c0
movups xmm0, xmmword [rbp + 0x1e0]
movups xmmword [0x140075d60], xmm0
movsd xmm1, qword [rbp + 0x1f0]
movsd qword [0x140075d70], xmm1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140075d68]
cmp qword [0x140075d60], rax
setne bl
lea rcx, [rbp + 0x1e0]
call fcn.1400037c0
test bl, bl
jne 0x1400031a7
lea rdx, str.No_process_found_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003880
lea rdx, str.Enter_process_name:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003880
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t___std::wcin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rbp + 0x1f8]
mov rcx, rbx
call fcn.140003fb0
mov r13, qword [rbp + 0x208]
mov r14, qword [rbp + 0x210]
xor ebx, ebx
jmp 0x140002bf0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp r14, 7
jbe 0x1400031e5
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400031dd
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400031dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140005520
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.140005500
lea r11, [rsp + 0x5a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011c0
nop
call fcn.140001120
int3