Function at 0x140001650
Capabilities:
Check for foreground window switch
Create thread
Enumerate gui resources
Enumerate processes

Disassembly:
push rbp
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x250], rax
call fcn.140001f10
call fcn.140002690
test eax, eax
jne 0x140001691
lea rcx, str.____failed_to_open_ghub_macro_driver_n
call fcn.140001010
jmp 0x140001db4
mov qword [rsp + 0x390], rbx
xor edx, edx
mov qword [rsp + 0x398], rsi
mov qword [rsp + 0x3a0], rdi
xor edi, edi
mov qword [rsp + 0x378], r12
mov qword [rsp + 0x370], r13
mov qword [rsp + 0x368], r14
lea ecx, [rdi + 2]
mov qword [rsp + 0x360], r15
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rsi, str.BestRO.exe
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001727
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001727
nop
mov rdx, rsi
lea rcx, [rbp + 0x3c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140001724
lea rdx, [rbp + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001700
jmp 0x140001727
mov edi, dword [rbp + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [rsp + 0x60], edi
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rcx, [0x140002950]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x140001764
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001764
mov r15, qword [rsp + 0x68]
xor ebx, ebx
jmp 0x140001769
xor ebx, ebx
mov r15d, ebx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov r9, r15
mov qword [rsp + 0x28], rbx
lea r8, [0x140001070]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140001620]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movd xmm0, dword [0x140006704]
lea r8, str.BestRO.exe
cvtdq2pd xmm0, xmm0
mov word [rbp - 0x50], 0x78
mov rdx, rbx
mov byte [rbp - 0x4e], 0x65
divsd xmm0, qword [0x140004670]
mulsd xmm0, qword [0x140004678]
addsd xmm0, qword [0x140004668]
cvttsd2si esi, xmm0
movd xmm0, dword [0x140006718]
cvtdq2pd xmm0, xmm0
lea r14d, [rsi + 5]
divsd xmm0, qword [0x140004670]
mulsd xmm0, qword [0x140004678]
addsd xmm0, qword [0x140004668]
cvttsd2si r13d, xmm0
movdqa xmm0, xmmword [str.BestRO.e]
movdqu xmmword [rbp - 0x60], xmm0
lea r12d, [r13 + 5]
mov dword [rsp + 0x50], r12d
nop
movzx ecx, byte [rdx + r8]
movsx eax, byte [rbp + rdx - 0x60]
cmp ecx, eax
jne 0x140001849
inc rdx
cmp rdx, 0x13
jb 0x140001830
jmp 0x140001850
mov dword [0], ebx
test r15, r15
je 0x140001d63
nop dword [rax]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, r15
jne 0x140001860
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [0x140006660]
xor r9d, r9d
mov dword [rsp + 0x48], ebx
xor r8d, r8d
mov qword [rsp + 0x40], rbx
xor edx, edx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0x38], 8
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov dword [rsp + 0x28], 0x2a200c
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x70], 0x5e0000
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
je 0x1400018ed
mov rcx, qword [0x140006660]
test rcx, rcx
je 0x1400018e8
call qword [sym.imp.ntdll.dll_ZwClose]
mov qword [0x140006660], rbx
call fcn.140002690
mov rcx, qword [0x140006660]
lea rax, [rsp + 0x78]
mov dword [rsp + 0x48], ebx
xor r9d, r9d
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov dword [rsp + 0x38], 8
xor edx, edx
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x38]
mov dword [rsp + 0x28], 0x2a200c
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x78], 0
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
je 0x140001959
mov rcx, qword [0x140006660]
test rcx, rcx
je 0x140001954
call qword [sym.imp.ntdll.dll_ZwClose]
mov qword [0x140006660], rbx
call fcn.140002690
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x140006700], 0
je 0x140001b69
mov r12d, 6
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDC]
mov r8d, 0x39
mov edx, esi
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetPixel]
mov rdx, rdi
mov rcx, r15
mov ebx, eax
mov dword [0x1400066c4], eax
call qword [sym.imp.USER32.dll_ReleaseDC]
test bl, bl
jne 0x140001a02
nop dword [rax]
cmp esi, 0xa7
jge 0x1400019c1
cmp esi, r14d
jg 0x1400019c1
inc esi
jmp 0x1400019cd
cmp esi, 0x2a
jle 0x1400019cd
cmp esi, r14d
jl 0x1400019cd
dec esi
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDC]
mov r8d, 0x39
mov edx, esi
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetPixel]
mov rdx, rdi
mov rcx, r15
mov ebx, eax
mov dword [0x1400066c4], eax
call qword [sym.imp.USER32.dll_ReleaseDC]
test bl, bl
je 0x1400019b0
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDC]
mov r8d, 0x39
mov edx, esi
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetPixel]
mov rdx, rdi
mov rcx, r15
mov ebx, eax
mov dword [0x1400066c4], eax
call qword [sym.imp.USER32.dll_ReleaseDC]
cmp bl, 0xd6
jne 0x140001b58
xor ebx, ebx
cmp dword [0x140006700], ebx
je 0x140001b5a
mov rcx, qword [0x140006660]
lea rax, [rbp - 0x80]
mov dword [rsp + 0x48], ebx
xor r9d, r9d
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov dword [rsp + 0x38], 8
xor edx, edx
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x28]
mov dword [rsp + 0x28], 0x2a200c
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x80], 0x5e0000
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
je 0x140001ab4
mov rcx, qword [0x140006660]
test rcx, rcx
je 0x140001aaf
call qword [sym.imp.ntdll.dll_ZwClose]
mov qword [0x140006660], rbx
call fcn.140002690
mov rcx, qword [0x140006660]
lea rax, [rbp - 0x78]
mov dword [rsp + 0x48], ebx
xor r9d, r9d
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov dword [rsp + 0x38], 8
xor edx, edx
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x18]
mov dword [rsp + 0x28], 0x2a200c
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x78], rbx
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
je 0x140001b1a
mov rcx, qword [0x140006660]
test rcx, rcx
je 0x140001b15
call qword [sym.imp.ntdll.dll_ZwClose]
mov qword [0x140006660], rbx
call fcn.140002690
movsxd r8, dword [0x140006700]
xor r9d, r9d
mov edx, 0x100
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
movsxd r8, dword [0x140006700]
xor r9d, r9d
mov edx, 0x101
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [0x140006714]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001b5a
xor ebx, ebx
sub r12, 1
jne 0x140001977
mov r12d, dword [rsp + 0x50]
cmp dword [0x1400066b0], 0
je 0x140001d53
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDC]
mov r8d, 0x48
mov edx, r13d
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetPixel]
mov rdx, rdi
mov rcx, r15
mov ebx, eax
mov dword [0x1400066c4], eax
call qword [sym.imp.USER32.dll_ReleaseDC]
test bl, bl
jne 0x140001c06
nop dword [rax]
cmp r13d, 0xa7
jge 0x140001bc3
cmp r13d, r12d
jge 0x140001bc3
inc r13d
jmp 0x140001bd0
cmp esi, 0x2a
jle 0x140001bd0
cmp esi, r12d
jle 0x140001bd0
dec r13d
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDC]
mov r8d, 0x48
mov edx, r13d
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetPixel]
mov rdx, rdi
mov rcx, r15
mov ebx, eax
mov dword [0x1400066c4], eax
call qword [sym.imp.USER32.dll_ReleaseDC]
test bl, bl
je 0x140001bb0
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDC]
mov r8d, 0x48
mov edx, r13d
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetPixel]
mov rdx, rdi
mov rcx, r15
mov ebx, eax
mov dword [0x1400066c4], eax
call qword [sym.imp.USER32.dll_ReleaseDC]
cmp bl, 0xd6
jne 0x140001d51
mov rcx, qword [0x140006660]
lea rax, [rbp - 0x70]
xor ebx, ebx
mov qword [rbp - 0x70], 0x5e0000
mov dword [rsp + 0x48], ebx
xor r9d, r9d
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov dword [rsp + 0x38], 8
xor edx, edx
mov qword [rsp + 0x30], rax
lea rax, [rbp - 8]
mov dword [rsp + 0x28], 0x2a200c
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
je 0x140001cad
mov rcx, qword [0x140006660]
test rcx, rcx
je 0x140001ca8
call qword [sym.imp.ntdll.dll_ZwClose]
mov qword [0x140006660], rbx
call fcn.140002690
mov rcx, qword [0x140006660]
lea rax, [rbp - 0x68]
mov dword [rsp + 0x48], ebx
xor r9d, r9d
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov dword [rsp + 0x38], 8
xor edx, edx
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov dword [rsp + 0x28], 0x2a200c
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x68], rbx
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
je 0x140001d13
mov rcx, qword [0x140006660]
test rcx, rcx
je 0x140001d0e
call qword [sym.imp.ntdll.dll_ZwClose]
mov qword [0x140006660], rbx
call fcn.140002690
movsxd r8, dword [0x1400066b0]
xor r9d, r9d
mov edx, 0x100
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
movsxd r8, dword [0x1400066b0]
xor r9d, r9d
mov edx, 0x101
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [0x140006714]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001d53
xor ebx, ebx
cmp qword [rsp + 0x58], r15
je 0x140001876
jmp 0x140001860
mov rcx, qword [0x140006660]
mov r15, qword [rsp + 0x360]
mov r14, qword [rsp + 0x368]
mov r13, qword [rsp + 0x370]
mov r12, qword [rsp + 0x378]
mov rdi, qword [rsp + 0x3a0]
mov rsi, qword [rsp + 0x398]
test rcx, rcx
je 0x140001dac
call qword [sym.imp.ntdll.dll_ZwClose]
mov qword [0x140006660], rbx
mov rbx, qword [rsp + 0x390]
xor eax, eax
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.1400029d0
add rsp, 0x380
pop rbp
ret