Function at 0x140002890
Capabilities:
Enumerate processes
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x14008c040]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov qword [rsp + 0x30], rdx
mov r14, rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
xor r12d, r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], r12
mov ecx, 0x10
call fcn.14000e270
mov qword [rax + 8], r12
mov qword [r14], rax
mov qword [rax], r14
mov dword [rsp + 0x20], 1
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x140002de8
mov dword [rbp - 0x80], 0x130
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140002dde
movabs rsi, 0x78652e776176616a
movabs rdi, 0x6578652e6176616a
nop dword [rax]
mov qword [rbp + 0xe0], r12
xorps xmm0, xmm0
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], r12
mov qword [rbp + 0x100], r12
lea rax, [rbp - 0x54]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400029a0
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0xe0]
call fcn.140006020
nop
lea rax, [rbp + 0xe8]
mov rcx, qword [rbp + 0xe8]
mov rdx, qword [rbp + 0x100]
cmp rdx, 0xf
cmova rax, rcx
mov r8, qword [rbp + 0xf8]
cmp r8, 9
jne 0x1400029f0
cmp qword [rax], rsi
jne 0x1400029f0
cmp byte [rax + 8], 0x65
je 0x140002a12
lea rax, [rbp + 0xe8]
cmp rdx, 0xf
cmova rax, rcx
cmp r8, 8
jne 0x140002da5
cmp qword [rax], rdi
jne 0x140002da5
mov esi, dword [rbp - 0x78]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
mov ecx, 0x10
call fcn.14000e270
mov qword [rax + 8], r12
mov qword [rbp + 0xb0], rax
lea rcx, [rbp + 0xb0]
mov qword [rax], rcx
mov r15d, dword [rsp + 0x20]
or r15d, 2
mov dword [rsp + 0x20], r15d
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetTopWindow]
mov rdi, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140002b49
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rbp + 0xd0], esi
jne 0x140002b2a
mov rdx, qword [rbp + 0xc0]
cmp rdx, qword [rbp + 0xc8]
je 0x140002b19
mov qword [rdx], rdi
mov rbx, qword [rbp + 0xc0]
mov edx, 3
lea rcx, [rbp + 0xd4]
call fcn.140008960
mov r8, qword [rbp + 0xb0]
add r8, 8
mov rax, qword [r8]
test rax, rax
je 0x140002b03
mov rcx, rax
nop dword [rax]
cmp qword [rax + 0x10], rbx
jb 0x140002af4
ja 0x140002af4
mov qword [rcx], r12
mov rax, qword [rcx + 8]
mov qword [r8], rax
jmp 0x140002afb
lea r8, [rcx + 8]
mov rax, qword [r8]
mov rcx, rax
test rax, rax
jne 0x140002ae0
lea rcx, [rbp + 0xd4]
call fcn.140008a40
add qword [rbp + 0xc0], 8
jmp 0x140002b2a
lea r8, [rsp + 0x28]
lea rcx, [rbp + 0xb0]
call fcn.140007b10
mov edx, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
mov rdi, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x140002a80
mov r13, qword [rbp + 0xc0]
mov qword [rsp + 0x28], r13
mov r12, qword [rbp + 0xb8]
mov qword [rsp + 0x38], r12
cmp r12, r13
je 0x140002ced
xor edi, edi
nop dword [rax]
mov r8d, pe_nt_image_headers64
lea rdx, [rbp + 0x110]
mov rcx, qword [r12]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov qword [rsp + 0x40], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea rax, [rbp + 0x110]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140002bb0
lea rdx, [rbp + 0x110]
lea rcx, [rsp + 0x40]
call fcn.140006020
mov rax, qword [rsp + 0x30]
mov r14, qword [rax + 8]
cmp r14, qword [rax + 0x10]
je 0x140002cb3
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
nop dword [rax + rax]
mov rdi, qword [r14 + 0x18]
lea rsi, [r14 + 8]
cmp qword [r14 + 0x20], 0xf
jbe 0x140002c02
mov rsi, qword [rsi]
lea r15, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova r15, qword [rsp + 0x48]
cmp rdi, rax
ja 0x140002c99
sub rax, rdi
test rdi, rdi
je 0x140002e1b
lea r12, [rax + r15]
movsx r13d, byte [rsi]
lea r8, [r12 + 1]
sub r8, r15
mov edx, r13d
mov rcx, r15
call fcn.140069fa0
mov rbx, rax
test rax, rax
je 0x140002c8f
nop dword [rax + rax]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14006a040
test eax, eax
je 0x140002c82
inc rbx
lea r8, [r12 + 1]
sub r8, rbx
mov edx, r13d
mov rcx, rbx
call fcn.140069fa0
mov rbx, rax
test rax, rax
jne 0x140002c50
jmp 0x140002c8f
sub rbx, r15
cmp rbx, 0xffffffffffffffff
jne 0x140002e1b
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
add r14, 0x28
cmp r14, qword [rcx + 0x10]
jne 0x140002bf0
mov r12, qword [rsp + 0x38]
mov r13, qword [rsp + 0x28]
xor edi, edi
lea rcx, [rsp + 0x40]
call fcn.140004cf0
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov edx, 0x10
call fcn.140006bc0
mov r14, qword [rsp + 0x68]
add r12, 8
mov qword [rsp + 0x38], r12
cmp r12, r13
jne 0x140002b70
mov r15d, dword [rsp + 0x20]
and r15d, 0xfffffffd
mov dword [rsp + 0x20], r15d
mov edx, 3
lea rcx, [rbp + 0xdc]
call fcn.140008960
mov rcx, qword [rbp + 0xb0]
xor r12d, r12d
test rcx, rcx
je 0x140002d2f
mov rax, qword [rcx + 8]
mov qword [rcx + 8], r12
test rax, rax
je 0x140002d2f
mov qword [rax], r12
mov rax, qword [rax + 8]
test rax, rax
jne 0x140002d23
lea rcx, [rbp + 0xdc]
call fcn.140008a40
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
je 0x140002d74
mov rdx, qword [rbp + 0xc8]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
call fcn.140006bc0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], r12
mov rcx, qword [rbp + 0xb0]
mov qword [rbp + 0xb0], r12
mov edx, 0x10
call fcn.140006bc0
mov rbx, qword [rsp + 0x70]
movabs rdi, 0x6578652e6176616a
movabs rsi, 0x78652e776176616a
lea rcx, [rbp + 0xe0]
call fcn.140004cf0
mov rcx, qword [rbp + 0xe0]
mov qword [rbp + 0xe0], r12
mov edx, 0x10
call fcn.140006bc0
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140002970
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, r14
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.14000e230
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [rsp + 0x40]
call fcn.140004cf0
mov rcx, qword [rsp + 0x40]
xor edi, edi
mov qword [rsp + 0x40], rdi
mov edx, 0x10
call fcn.140006bc0
mov r14, qword [rsp + 0x68]
mov rdx, qword [r14 + 0x10]
cmp rdx, qword [r14 + 0x18]
je 0x140002eb9
mov eax, dword [rbp - 0x78]
mov dword [rdx], eax
mov rbx, qword [r14 + 0x10]
mov edx, 3
lea rcx, [rbp + 0xd8]
call fcn.140008960
mov r8, qword [r14]
add r8, 8
mov rax, qword [r8]
test rax, rax
je 0x140002e99
mov rcx, rax
cmp qword [rax + 0x10], rbx
jb 0x140002e8a
ja 0x140002e8a
mov qword [rcx], rdi
mov rax, qword [rcx + 8]
mov qword [r8], rax
jmp 0x140002e91
lea r8, [rcx + 8]
mov rax, qword [r8]
mov rcx, rax
test rax, rax
jne 0x140002e76
lea rcx, [rbp + 0xd8]
call fcn.140008a40
add qword [r14 + 0x10], 4
mov r12, qword [rsp + 0x38]
mov r13, qword [rsp + 0x28]
jmp 0x140002cd6
lea r8, [rbp - 0x78]
mov rcx, r14
call fcn.140007960
mov r12, qword [rsp + 0x38]
mov r13, qword [rsp + 0x28]
jmp 0x140002cd6