Function at 0x140004990
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14009a080]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rax, qword [0x14009dbd8]
lea rcx, str.C:AarSvcd.dll
mov r14d, edx
mov qword [rbp + 8], rax
xor edx, edx
mov r15, r8
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, [rax + 0x1000]
cmp byte [rcx], 0xc3
je 0x1400049f9
inc rcx
cmp byte [rcx], 0xc3
jne 0x1400049f1
mov qword [rbp + 0xe0], rcx
lea rdx, [rbp + 0xe0]
lea rcx, [0x1400037d0]
mov dword [rbp + 0xf0], r14d
mov qword [rbp + 0xe8], rax
call qword [sym.imp.USER32.dll_EnumWindows]
xorps xmm0, xmm0
lea rdx, str.C:AarSvcd.dll
xorps xmm1, xmm1
lea rcx, [rbp + 0x138]
mov r8d, reloc.WS2_32.dll_ntohl
movups xmmword [rbp + 0x138], xmm0
movdqu xmmword [rbp + 0x148], xmm1
call fcn.140006c10
mov rdx, qword [rbp + 0x150]
cmp rdx, 0xf
jbe 0x140004a94
mov rcx, qword [rbp + 0x138]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a8f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004a8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400722dc
movsxd rsi, dword [r15 + 0x3c]
movabs rcx, 0x5e01f3961c335e88
movdqa xmm0, xmmword [0x14008d3f0]
movabs rax, 0xc4e5735834ce703b
movdqu xmmword [rbp + 0x148], xmm0
mov byte [rbp + 0x138], 0
movabs rbx, 0xa181123d5c910455
mov qword [rbp], rax
add rsi, r15
mov rax, qword [rbp]
mov rdx, rsi
mov qword [rbp + 0x40], rax
movabs rax, 0xe66d42a8e9c83874
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xa40662b959ce98b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0x8a483a98c9f24b06
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0xa40662b959691e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x40]
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
vmovdqu ymm0, ymmword [rbp + 0x1a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call fcn.140001aa0
xor edi, edi
lea rdx, str.dxgi.dll
xorps xmm0, xmm0
mov qword [rbp + 0xb0], rdi
lea rcx, [rbp + 0xa0]
mov qword [rbp + 0xb8], rdi
movups xmmword [rbp + 0xa0], xmm0
lea r8d, [rdi + 8]
call fcn.140006c10
mov r8d, dword [rsi + 0x50]
lea r9, [rbp + 0xa0]
add r8d, 0x1f4
mov edx, r14d
call fcn.140002770
xorps xmm0, xmm0
mov qword [rbp + 0xd0], rdi
lea r8d, [rdi + 0xb]
mov qword [rbp + 0xd8], rdi
lea rdx, str.AarSvcd.dll
mov r12, rax
lea rcx, [rbp + 0xc0]
movups xmmword [rbp + 0xc0], xmm0
call fcn.140006c10
lea r8, [rbp + 0xc0]
mov edx, r14d
call fcn.140002490
lea r13, [rax + 0x1000]
mov qword [rbp + 0x10], r13
test r12, r12
je 0x140005056
cmp r13, 0xebc0
je 0x140005056
mov r9, rsi
mov r8, r15
mov rdx, r12
call fcn.1400038c0
test al, al
je 0x1400050d3
movabs rcx, 0x5e01f3961c335e88
movabs rax, 0xc4f5735e33fd6127
mov qword [rbp], rax
movabs rdx, 0xa40662b959691e7
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x802d5df9a49b6b62
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x8a483a98c9f24b06
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x60]
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
vzeroupper
call fcn.140001aa0
mov r8, rsi
mov rdx, r15
call fcn.140003a50
test al, al
je 0x1400050d3
movabs rcx, 0x5e01f3961c335e88
movabs rax, 0xc5e4645133e26127
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xf93c48f7b99f2226
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0xa40662b959691ed
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x8a483a98c9f24b06
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rax, 0xa40662b959691e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x80]
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
vzeroupper
call fcn.140001aa0
movzx ebx, word [rsi + 0x14]
xor eax, eax
add rbx, 0x2c
cmp ax, word [rsi + 6]
jae 0x140004ebc
add rbx, rsi
xor r13d, r13d
nop dword [rax]
mov eax, dword [rbx - 8]
lea rcx, [rbp + 0x100]
add rax, r12
mov dword [rbp + 0x114], r13d
mov qword [rbp + 0x118], rax
mov eax, dword [rbx]
add rax, r15
mov dword [rbp + 0x131], r13d
mov qword [rbp + 0x120], rax
mov eax, dword [rbx - 4]
mov qword [rbp + 0x128], rax
lea rax, [rbp + 0x110]
mov qword [rbp + 0x108], rax
mov rax, qword [0x14009db70]
mov word [rbp + 0x135], r13w
mov byte [rbp + 0x137], r13b
mov dword [rbp + 0x110], r14d
mov byte [rbp + 0x130], r13b
mov dword [rbp + 0x100], 0x92b
mov dword [rbp + 0x104], 0x139
mov rdx, qword [rax]
call rdx
cmp rax, 0x91a
je 0x140004ea7
lea rcx, str.write_failed_n
call fcn.140001aa0
inc di
add rbx, 0x28
cmp di, word [rsi + 6]
jb 0x140004e10
mov r13, qword [rbp + 0x10]
movabs rax, 0xc4f2325828f87622
lea rcx, [rbp + 0x20]
mov qword [rbp + 0x10], rax
movabs rbx, 0xa181123d5c910455
mov rax, qword [rbp + 0x10]
movabs rdi, 0x8a483a98c9f24b06
mov qword [rbp + 0x20], rax
movabs rax, 0x8a4249f6a69b3f65
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x10], rdi
mov rax, qword [rbp + 0x10]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x188], rax
xorps xmm0, xmmword [rbp + 0x180]
movdqa xmmword [rbp + 0x20], xmm0
call fcn.140001aa0
mov rcx, qword [rbp + 8]
mov r9, rsi
mov r8, r12
mov qword [rsp + 0x20], r13
mov edx, r14d
call fcn.140003dc0
test al, al
je 0x1400050d3
mov r9, rsi
mov r8, r12
mov edx, r14d
call fcn.140003ca0
movabs rax, 0xc5a176582ff07630
movabs rcx, 0x5e01f3961c335e88
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xe0], rax
movabs rax, 0xe8295eeaa891386f
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xe8], rax
movabs rax, 0x6334054ee6b6f48b
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xf0], rax
movabs rax, 0x5e01f3961c3930e7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x160], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x168], rax
movabs rax, 0xa40662b959691e7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x170], rax
mov qword [rbp + 8], rcx
lea rcx, [rbp + 0xe0]
mov rax, qword [rbp + 8]
mov qword [rbp + 0x178], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0xe0], ymm1
vzeroupper
call fcn.140001aa0
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movabs rax, 0x81e57b513de76a3c
lea rcx, [rbp + 0x160]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x160], rax
movabs rax, 0x8a483a92ac812a64
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x168], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xe0], rax
movabs rax, 0x8a483a98c9f24b06
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movdqa xmm0, xmmword [rbp + 0x160]
mov qword [rbp + 0xe8], rax
xorps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0x160], xmm0
call fcn.140001aa0
xor al, al
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140071f20
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret