Function at 0x1400530c0
Capabilities:
Enumerate gui resources
Enumerate processes
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x340]
sub rsp, 0x440
mov rax, qword [0x140095040]
xor rax, rsp
mov qword [rbp + 0x330], rax
mov r15, r8
mov rbx, rdx
mov qword [rsp + 0x28], rdx
mov qword [rbp + 0x1d0], r8
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x140053520
mov dword [rbp + 0x1e0], 0x130
lea rdx, [rbp + 0x1e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140053520
cmp dword [rbp + 0x1e8], r12d
jne 0x140053162
lea rdx, [rbp + 0x1e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
xor r12d, r12d
mov rdx, qword [rbx + r12*8]
lea rcx, [rbp + 0x20c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140053360
mov ecx, 0x410
call fcn.140072ba8
mov rsi, rax
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x1e8]
mov dword [rbp + 0x1c0], eax
mov qword [rbp + 0x1c8], 0
lea rdx, [rbp + 0x1c0]
lea rcx, [0x140053060]
call qword [sym.imp.USER32.dll_EnumWindows]
mov r8d, 0x208
mov rdx, rsi
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rdx, rsi
lea rcx, [rbp + 0x310]
call fcn.1400535b0
nop
mov r8, qword [r15 + 0x10]
cmp qword [r15 + 0x18], 0xf
jbe 0x1400531f4
add r8, qword [r15]
mov rdx, qword [r15]
jmp 0x1400531fa
add r8, r15
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140053700
mov r10, rax
mov r11, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140053215
mov r10, qword [rax]
lea rdi, [rbp + 0x310]
mov r14, qword [rbp + 0x310]
mov r13, qword [rbp + 0x328]
cmp r13, 7
cmova rdi, r14
mov rax, qword [rbp + 0x320]
cmp r11, rax
ja 0x1400532d1
test r11, r11
jne 0x14005324e
xor ebx, ebx
jmp 0x1400532d8
sub rax, r11
lea rsi, [rdi + 2]
lea rsi, [rsi + rax*2]
mov rbx, rdi
movzx r9d, word [r10]
mov rax, rsi
sub rax, rbx
sar rax, 1
mov ecx, 0
je 0x14005328c
cmp word [rbx], r9w
je 0x140053289
cmp rax, 1
je 0x14005328c
dec rax
add rbx, 2
cmp word [rbx], r9w
jne 0x140053276
mov rcx, rbx
mov rbx, rcx
test rcx, rcx
je 0x1400532cc
mov rdx, r11
mov rcx, r10
test r11, r11
je 0x1400532b9
mov r8, rbx
sub r8, r10
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x1400532c6
add rcx, 2
sub rdx, 1
jne 0x1400532a5
sub rbx, rdi
sar rbx, 1
mov rsi, qword [rsp + 0x30]
jmp 0x1400532d8
add rbx, 2
jmp 0x140053260
mov rsi, qword [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14005331a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053315
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053512
call fcn.140072944
cmp rbx, 0xffffffffffffffff
jne 0x140053399
cmp r13, 7
jbe 0x14005335b
lea rdx, [r13*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140053353
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053519
mov rcx, r14
call fcn.140072944
mov rbx, qword [rsp + 0x28]
inc r12
cmp r12, 2
jl 0x140053165
mov r12d, dword [rsp + 0x20]
lea rdx, [rbp + 0x1e0]
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140053520
mov rbx, qword [rsp + 0x28]
jmp 0x140053162
mov r12d, dword [rbp + 0x1e8]
mov dword [rsp + 0x20], r12d
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x1e0]
mov edx, 2
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x1400533c0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
lea ecx, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r10, rax
lea rax, [rbp + 0x90]
lea rcx, [rsp + 0x60]
mov edx, 2
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140053450
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
lea r9, [rbp + 0x90]
mov r8, rsi
lea rdx, str.Title:__S__Process:_0x_lX_n
mov rcx, r10
call fcn.140053010
nop
cmp r13, 7
jbe 0x140053372
lea rdx, [r13*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140053505
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053519
mov rcx, r14
call fcn.140072944
jmp 0x140053372
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140053560
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x14005355b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400535a1
mov rcx, r8
call fcn.140072944
mov qword [r15 + 0x10], 0
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov eax, r12d
mov rcx, qword [rbp + 0x330]
xor rcx, rsp
call fcn.140072530
mov rbx, qword [rsp + 0x480]
add rsp, 0x440
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3