Function at 0x140003440
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov eax, 8
mov rbx, rcx
mov qword [rsp + 0xb8], rax
xor r12d, r12d
nop dword [rax]
xor r14d, r14d
cmp dword [r12 + rbx + 0x28], r14d
jbe 0x140003637
lea r13, [rbx + 0x30]
movzx r15d, dx
add r13, r12
nop dword [rax]
mov eax, r14d
imul rsi, rax, 0xb8
lea rdi, [r12 + rsi]
add rdi, rbx
cmp dword [rdi + 0xd0], r15d
jne 0x140003556
mov rdx, qword [rdi + 0xc0]
mov rcx, rbx
call fcn.140002670
test eax, eax
jne 0x140003556
mov rbp, qword [rdi + 0xc0]
lea rdx, str.NtOpenProcess
mov rcx, qword [rbx + 0x20]
mov dword [rbx + 0x174a4], 1
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb0], 0
test rax, rax
je 0x140003556
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0
xorps xmm1, xmm1
mov dword [rsp + 0x48], 0
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], 0
mov edx, 0x1fffff
lea rcx, [rsp + 0xb0]
movdqu xmmword [rsp + 0x38], xmm0
movdqu xmmword [rsp + 0x50], xmm1
call rax
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x140003556
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [rdi + 0xe0], r15d
jne 0x140003619
xor r11d, r11d
lea rdi, [rsi + r13]
xor r8d, r8d
nop dword [rax]
mov r9d, dword [rbx + r8 + 0x28]
xor eax, eax
test r9d, r9d
je 0x1400035a4
mov r10d, dword [rdi + 0xb0]
mov edx, eax
imul rcx, rdx, 0xb8
add rcx, r8
cmp dword [rcx + rbx + 0xe0], r10d
je 0x140003668
inc eax
cmp eax, r9d
jb 0x140003583
inc r11d
add r8, 0x2e08
cmp r11d, 8
jb 0x140003570
xor ecx, ecx
mov dword [rsp + 0x30], ecx
lea rdx, [rsp + 0x30]
lea rcx, [0x140002420]
mov qword [rsp + 0x38], 0
mov word [rsp + 0x41], 0
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [rsp + 0x41], 0
jne 0x1400035fa
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x42], 1
lea rcx, [0x140002420]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rdx, qword [0x140071d58]
mov r8d, 1
mov rcx, rbx
call fcn.1400020e0
mov dword [rbx + 0x174a4], 0
inc r14d
cmp r14d, dword [r12 + rbx + 0x28]
jb 0x140003490
mov rax, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xa8]
add r12, 0x2e08
sub rax, 1
mov qword [rsp + 0xb8], rax
jne 0x140003470
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
imul rdx, rdx, 0xb8
mov eax, r11d
imul rax, rax, 0x2e08
add rax, rbx
mov ecx, dword [rdx + rax + 0xc0]
jmp 0x1400035b6
movzx r8d, dx
lea eax, [r8 - 0x9ca4]
cmp eax, 7
ja 0x1400037e9
add r8, 0xffffffffffff9169
mov rdx, qword [rcx + r8*8]
lea r8, [rcx + r8*8]
test rdx, rdx
je 0x140003888
mov r9, qword [rcx + 0x174b8]
mov eax, dword [r9 + 0x2ed4]
cmp dword [rdx], eax
jne 0x1400036d9
mov byte [r9 + 0x2ed0], 1
mov rdx, qword [r8]
test rdx, rdx
je 0x140003888
mov r9, qword [rcx + 0x174c0]
mov eax, dword [r9 + 0x2ed4]
cmp dword [rdx], eax
jne 0x1400036ff
mov byte [r9 + 0x2ed0], 1
mov rdx, qword [r8]
test rdx, rdx
je 0x140003888
mov r9, qword [rcx + 0x174c8]
mov eax, dword [r9 + 0x2ed4]
cmp dword [rdx], eax
jne 0x140003725
mov byte [r9 + 0x2ed0], 1
mov rdx, qword [r8]
test rdx, rdx
je 0x140003888
mov r9, qword [rcx + 0x174d0]
mov eax, dword [r9 + 0x2ed4]
cmp dword [rdx], eax
jne 0x14000374b
mov byte [r9 + 0x2ed0], 1
mov rdx, qword [r8]
test rdx, rdx
je 0x140003888
mov r9, qword [rcx + 0x174d8]
mov eax, dword [r9 + 0x2ed4]
cmp dword [rdx], eax
jne 0x140003771
mov byte [r9 + 0x2ed0], 1
mov rdx, qword [r8]
test rdx, rdx
je 0x140003888
mov r9, qword [rcx + 0x174e0]
mov eax, dword [r9 + 0x2ed4]
cmp dword [rdx], eax
jne 0x140003797
mov byte [r9 + 0x2ed0], 1
mov rdx, qword [r8]
test rdx, rdx
je 0x140003888
mov r9, qword [rcx + 0x174e8]
mov eax, dword [r9 + 0x2ed4]
cmp dword [rdx], eax
jne 0x1400037bd
mov byte [r9 + 0x2ed0], 1
mov rdx, qword [r8]
test rdx, rdx
je 0x140003888
mov r8, qword [rcx + 0x174f0]
mov eax, dword [r8 + 0x2ed4]
cmp dword [rdx], eax
jne 0x140003888
mov byte [r8 + 0x2ed0], 1
jmp 0x140003888
test r8d, r8d
je 0x14000389b
cmp r8d, 0x9c41
je 0x140003818
cmp r8d, 0x9c42
jbe 0x140003813
mov eax, 0x9c44
cmp r8w, ax
jbe 0x14000389b
jmp 0x140003440
mov rax, qword [rcx + 0x174b8]
mov byte [rax + 0x2ed0], 1
mov rax, qword [rcx + 0x174c0]
mov byte [rax + 0x2ed0], 1
mov rax, qword [rcx + 0x174c8]
mov byte [rax + 0x2ed0], 1
mov rax, qword [rcx + 0x174d0]
mov byte [rax + 0x2ed0], 1
mov rax, qword [rcx + 0x174d8]
mov byte [rax + 0x2ed0], 1
mov rax, qword [rcx + 0x174e0]
mov byte [rax + 0x2ed0], 1
mov rax, qword [rcx + 0x174e8]
mov byte [rax + 0x2ed0], 1
mov rax, qword [rcx + 0x174f0]
mov byte [rax + 0x2ed0], 1
mov byte [rcx + 0x17912], 1
add rcx, 0x174a8
jmp fcn.140004a20
ret