Function at 0x140002184
Capabilities:
Enumerate process modules
Get graphical window text
Get keyboard layout

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1260]
mov eax, 0x13c0
call fcn.140139ab0
sub rsp, rax
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x1250], rax
mov rax, r8
mov qword [rbp - 0x48], rax
mov r12, rdx
mov qword [rbp - 0x40], rdx
mov r13, rcx
mov qword [rbp - 0x60], rcx
xor esi, esi
test rcx, rcx
je 0x14000321d
cmp qword [rcx], 0xb50
jb 0x14000321d
mov ebx, 0x100
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x930]
call fcn.14013b230
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x800]
call fcn.14013b230
call fcn.140123504
movzx edi, al
xor edx, edx
lea r8d, [rbx + 0x18]
lea rcx, [rbp + 0x464]
call fcn.14013b230
mov dword [rbp + 0x460], 0x11c
lea rcx, [rbp + 0x460]
call fcn.1401229cc
lea rcx, [rbp + 0x474]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rbx, [rbp + 0x474]
lea rbx, [rbx + rcx*2]
mov qword [rbp - 0x78], rbx
lea rax, [rbx + 0x14]
lea rcx, [rbp + 0x574]
cmp rax, rcx
jae 0x14000227c
lea rax, [rbx + 2]
cmp word [rax], si
cmovne rbx, rax
mov qword [rbp - 0x78], rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x30], rsi
xor edx, edx
lea r8d, [rdx + 0x40]
lea rcx, [rbp + 0x7c0]
call fcn.14013b230
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x28]
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x140002367
mov qword [rbp - 0x70], rsi
xorps xmm0, xmm0
movups xmmword [rbp + 0x440], xmm0
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x140002367
lea rdx, [rbp + 0x440]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x140002367
movzx eax, word [rbp + 0x44e]
movzx ecx, word [rbp + 0x44c]
movzx edx, word [rbp + 0x44a]
movzx r10d, word [rbp + 0x448]
movzx r11d, word [rbp + 0x446]
movzx r9d, word [rbp + 0x442]
movzx r8d, word [rbp + 0x440]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
lea rdx, str._u__02u__02u__02u:_02u:_02u._03u
lea rcx, [rbp + 0x7c0]
call fcn.140001190
lea eax, [rdi + 1]
shl eax, 5
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x46c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x468]
mov r8d, dword [rbp + 0x464]
lea rdx, str._u._u._u.x_u
lea rcx, [rbp + 0x800]
call fcn.1400011e8
cmp dword [rbp + 0x464], 6
jne 0x1400023cf
cmp dword [rbp + 0x468], 3
jne 0x1400023cf
call fcn.1401230bc
test al, al
je 0x1400023cf
lea r8, str.__Win10_
mov edx, 0x80
lea rcx, [rbp + 0x800]
call fcn.140001f38
xorps xmm0, xmm0
movups xmmword [rbp + 0x6f0], xmm0
mov r8d, 8
lea rdi, [0x14015a140]
mov rdx, rdi
lea rcx, [rbp + 0x6f0]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp word [rbp + 0x6f0], si
je 0x14000240f
cmp word [rbp + 0x6f2], si
lea rax, [0x140167eec]
jne 0x140002412
mov rax, rdi
lea rcx, [rbp + 0x6f0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x12
mov r9d, 0xc
lea r8d, [r9 + 0xa]
lea rdx, [0x140167ef0]
lea rcx, [rbp + 0x900]
call fcn.140001164
movzx eax, byte [rbp + 0x57a]
lea rcx, [rbp + 0x700]
cmp al, 1
jne 0x140002463
lea rdx, str.workstation
jmp 0x14000247b
cmp al, 3
jne 0x140002470
lea rdx, str.server
jmp 0x14000247b
cmp al, 2
jne 0x140002482
lea rdx, str.domain
call fcn.140001240
jmp 0x140002491
mov r8d, eax
lea rdx, [0x140167f50]
call fcn.140001138
lea rdx, [rbp + 0x460]
lea rcx, [rbp - 0x18]
call fcn.140001358
nop
movzx ebx, word [rbx]
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
movzx r15d, byte [rbp + 0x57b]
lea rax, [0x140167e00]
mov r14, rdi
test bx, bx
cmovne r14, rax
lea rax, [0x140167f58]
cmovne rdi, rax
lea rdx, [0x14015a140]
lea rcx, [rbp - 0x18]
call fcn.140121ccc
mov rdx, rax
movzx r8d, word [rbp + 0x578]
movzx r10d, word [rbp + 0x576]
movzx r11d, word [rbp + 0x574]
lea rax, [rbp + 0x7c0]
mov qword [rsp + 0xc0], rax
mov ecx, dword [r13 + 0x220]
mov dword [rsp + 0xb8], ecx
mov ecx, dword [r13 + 0x234]
mov dword [rsp + 0xb0], ecx
mov ecx, dword [r13 + 0x230]
mov dword [rsp + 0xa8], ecx
mov ecx, dword [r13 + 0x210]
mov dword [rsp + 0xa0], ecx
mov ecx, dword [r13 + 0x22c]
mov dword [rsp + 0x98], ecx
mov eax, dword [r13 + 0x228]
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x88], esi
mov eax, dword [r13 + 0x21c]
mov dword [rsp + 0x80], eax
mov eax, dword [r13 + 0x218]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x70], r15d
mov qword [rsp + 0x68], r14
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rdi
mov eax, dword [r13 + 0x224]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r11d
lea rax, [rbp + 0x700]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x800]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rbp + 0x900]
lea rdx, str.ConEmu__s___u__Startup_Info_r_n__OsVer:__s__Product:__s__SP:__u._u__Suite:_0x_X_r_n__Build:__s__ReactOS:__u_s_s_s__Rsrv:__u__WINE:__u__PE:__u__R2:__u_r_n__DBCS:__u__IMM:__u__Remote:__u__ACP:__u__OEMCP:__u__Admin:__u_r_n__StartTime:__s_r_n
lea rcx, [rbp + 0xa30]
call fcn.1400011bc
xor r9d, r9d
mov r8b, 1
mov r15, qword [rbp - 0x48]
mov rdx, r15
lea rcx, [rbp + 0xa30]
call r12
lea rcx, [rbp - 0x18]
call fcn.1401214e4
xor r14d, r14d
mov dword [rbp - 0x80], r14d
mov dword [rbp - 0x78], r14d
call fcn.1401233dc
test al, al
je 0x140002731
lea rdx, str.UxTheme.dll
lea rcx, [rbp + 0x440]
call fcn.1401238d8
nop
mov rcx, qword [rbp + 0x440]
test rcx, rcx
je 0x1400026a4
lea rdx, str.IsAppThemed
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400026a4
mov dword [rbp + 0x44c], r14d
mov rcx, qword [rbp + 0x440]
test rcx, rcx
je 0x1400026a4
lea rdx, str.IsThemeActive
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400026a4
mov dword [rbp + 0x44c], r14d
call rdi
test eax, eax
je 0x1400026b0
call rbx
test eax, eax
je 0x1400026b0
mov dword [rbp - 0x78], 1
jmp 0x1400026b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x44c], eax
mov dword [rbp - 0x78], r14d
mov dword [rbp - 0x80], r14d
call fcn.140123174
test al, al
je 0x140002725
lea rdx, str.dwmapi.dll
lea rcx, [rbp - 0x70]
call fcn.1401238d8
nop
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14000270e
lea rdx, str.DwmIsCompositionEnabled
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000270e
mov dword [rbp - 0x64], r14d
mov dword [rbp - 0x80], r14d
lea rcx, [rbp - 0x80]
call rax
test eax, eax
jne 0x140002717
cmp dword [rbp - 0x80], r14d
je 0x140002717
mov dword [rbp - 0x80], 1
jmp 0x14000271b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x64], eax
mov dword [rbp - 0x80], r14d
lea rcx, [rbp - 0x70]
call fcn.14012390c
nop
lea rcx, [rbp + 0x440]
call fcn.14012390c
lea rbx, str._NULL_
mov rdx, rbx
cmp qword [r13 + 0x18], r14
cmovne rdx, qword [r13 + 0x18]
mov r8d, 0x80
lea rcx, [rbp + 0x930]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rdx, rbx
cmp qword [r13 + 0x20], r14
cmovne rdx, qword [r13 + 0x20]
mov r8d, 0x80
lea rcx, [rbp + 0x800]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rax, [0x1401681a8]
lea rsi, [0x14015a140]
cmp qword [r13 + 0x20], r14
cmovne rsi, rax
lea r14, [0x14015a140]
xor r9d, r9d
cmp qword [r13 + 0x18], r9
cmovne r14, rax
movzx ebx, word [r13 + 0x48]
call fcn.14012b598
mov edi, eax
call fcn.14012b674
mov rdx, rax
mov ecx, dword [r13 + 0x68]
mov dword [rsp + 0xd0], ecx
mov ecx, dword [r13 + 0x60]
mov dword [rsp + 0xc8], ecx
mov ecx, dword [r13 + 0x58]
mov dword [rsp + 0xc0], ecx
mov dword [rsp + 0xb8], 8
mov dword [rsp + 0xb0], 4
mov dword [rsp + 0xa8], 4
mov dword [rsp + 0xa0], 2
mov dword [rsp + 0x98], 1
mov rax, qword [rbp - 0x58]
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x88], ebx
mov eax, dword [r13 + 0x44]
mov dword [rsp + 0x80], eax
mov eax, dword [r13 + 0x34]
mov dword [rsp + 0x78], eax
mov eax, dword [r13 + 0x30]
mov dword [rsp + 0x70], eax
mov eax, dword [r13 + 0x2c]
mov dword [rsp + 0x68], eax
mov eax, dword [r13 + 0x28]
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x58], rsi
lea rax, [rbp + 0x800]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov eax, dword [rbp - 0x80]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x930]
mov r8, r14
lea rdx, str.__Desktop:__s_s_s__SessionId:__s__ConsoleSessionId:__u__Theming:__u__DWM:__u_r_n__Title:__s_s_s_r_n__Size:__u__u__u__u_r_n__Flags:_0x_08X__ShowWindow:__u__ConHWnd:_0x_08X_r_n__char:__u__short:__u__int:__u__long:__u__u64:__u_r_n__Handles:_0x_08X__0x_08X__0x_08X_r_n
lea rcx, [rbp + 0xa30]
call fcn.1400011bc
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp + 0xa30]
call r12
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r12, rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r15, rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r14, rax
xor eax, eax
mov dword [rbp - 0x78], eax
mov dword [rbp - 0x80], eax
mov dword [rbp - 0x70], eax
lea rdx, [rbp - 0x78]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov esi, eax
lea rdx, [rbp - 0x80]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edi, eax
lea rdx, [rbp - 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov ebx, eax
mov r9d, dword [rbp - 0x78]
lea r8, [0x1401683b8]
mov edx, 0x14
lea rcx, [rbp + 0x730]
call fcn.140120394
mov r9d, dword [rbp - 0x80]
lea r8, [0x1401683b8]
mov edx, 0x14
lea rcx, [rbp + 0x798]
call fcn.140120394
mov r9d, dword [rbp - 0x70]
lea r8, [0x1401683b8]
mov edx, 0x14
lea rcx, [rbp + 0x770]
call fcn.140120394
lea r8, [0x1401683c0]
lea rdx, [rbp + 0x770]
test ebx, ebx
cmove rdx, r8
lea rcx, [rbp + 0x798]
test edi, edi
cmove rcx, r8
lea rax, [rbp + 0x730]
test esi, esi
cmove rax, r8
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, str.__StdFlags:_Inx_X__Mode_s__Outx_X__Mode_s__Errx_X__Mode_s__r_n
mov edx, 0x410
lea rcx, [rbp + 0xa30]
call fcn.140120394
xor r9d, r9d
xor r8d, r8d
mov rsi, qword [rbp - 0x48]
mov rdx, rsi
lea rcx, [rbp + 0xa30]
mov rdi, qword [rbp - 0x40]
call rdi
xor r12d, r12d
cmp qword [rbp - 0x58], r12
je 0x140002a8d
mov word [rbp + 0xa30], r12w
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002a55
lea rdx, str.GetConsoleKeyboardLayoutNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140002a55
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x800]
call fcn.14013b230
lea rcx, [rbp + 0x800]
call rbx
test eax, eax
je 0x140002a55
lea r8, [rbp + 0x800]
lea rdx, str.__Active_console_layout_name:__s
lea rcx, [rbp + 0xa30]
call fcn.1400011bc
cmp word [rbp + 0xa30], r12w
jne 0x140002a7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.__Active_console_layout:_Unknown__code_u
lea rcx, [rbp + 0xa30]
call fcn.1400011bc
mov r9b, 1
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0xa30]
call rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov r9d, ebx
lea rdx, str.__Current_PID:__u__TID:__u
lea rcx, [rbp + 0xa30]
call fcn.1400011bc
mov r9b, 1
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0xa30]
call rdi
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x5f8]
call fcn.14013b230
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rbp + 0x5f0], rax
mov r8, rax
shr r8, 0x20
mov r9d, eax
lea rdx, str.__Active_HKL:_0x_08X_08X
lea rcx, [rbp + 0xa30]
call fcn.1400011bc
mov r9b, 1
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0xa30]
call rdi
lea rdx, [rbp + 0x5f0]
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov ebx, eax
lea ecx, [rbx - 1]
cmp ecx, 0x1f
ja 0x140002bad
lea rdx, str.__GetKeyboardLayoutList:
lea rcx, [rbp + 0xa30]
call fcn.1400012d8
lea rcx, [rbp + 0xa30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r15, eax
test ebx, ebx
je 0x140002bc9
lea r14, [rbp + 0x5f0]
mov r12d, ebx
lea rbx, [rbp + 0xa30]
lea rbx, [rbx + r15*2]
mov r9, qword [r14]
shr r9, 0x20
mov eax, dword [r14]
mov dword [rsp + 0x20], eax
lea r8, str._0x_08X_08X
mov edx, 0x12
mov rcx, rbx
call fcn.14012091c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
add r15, rcx
lea r14, [r14 + 8]
sub r12, 1
jne 0x140002b65
jmp 0x140002bc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.__GetKeyboardLayoutList_failed__code_u
lea rcx, [rbp + 0xa30]
call fcn.1400011bc
mov r9b, 1
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0xa30]
call rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
lea rcx, str.CmdLine:
call rdi
mov rax, qword [r13 + 0x1e8]
lea rbx, str._NULL_
mov rcx, rbx
test rax, rax
cmovne rcx, rax
mov r9b, 1
xor r8d, r8d
mov rdx, rsi
call rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
lea rcx, str.ExecMod:
call rdi
mov rax, qword [r13 + 0x1f0]
mov rcx, rbx
test rax, rax
cmovne rcx, rax
mov r9b, 1
xor r8d, r8d
mov rdx, rsi
call rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
lea rcx, str.WorkDir:
call rdi
mov rax, qword [r13 + 0x1f8]
mov rcx, rbx
test rax, rax
cmovne rcx, rax
mov r9b, 1
xor r8d, r8d
mov rdx, rsi
call rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
lea rcx, str.PathEnv:
call rdi
mov rax, qword [r13 + 0x200]
mov rcx, rbx
test rax, rax
cmovne rcx, rax
mov r9b, 1
xor r8d, r8d
mov rdx, rsi
call rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
lea rcx, str.ConFont:
call rdi
mov rax, qword [r13 + 0xb40]
test rax, rax
cmovne rbx, rax
mov r9b, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call rdi
mov r9b, 1
xor r8d, r8d
mov rdx, rsi
cmp qword [r13 + 0xb48], r12
jne 0x140002ce3
lea rcx, str.CMDs_AutoRuns:_not_defined
jmp 0x140002cfc
lea rcx, str.CMDs_AutoRuns:
call rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [r13 + 0xb48]
call rdi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x450], xmm0
test rax, rax
je 0x140002d54
lea rdx, [rbp + 0x450]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r14d, 0x7f
mov r8d, r14d
lea rdx, [rbp + 0x930]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
mov r8d, r14d
lea rdx, [rbp + 0x800]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x140002d64
mov word [rbp + 0x930], r12w
mov word [rbp + 0x800], r12w
lea rax, [rbp + 0x800]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x930]
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0x45c]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x458]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x454]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x450]
mov r8d, ebx
lea rdx, str.Foreground:_x_08X__i__i__i__i__s____s
lea rcx, [rbp + 0xa30]
call fcn.1400011bc
mov r9b, 1
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0xa30]
call rdi
mov qword [rbp - 0x50], r12
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
xor edx, edx
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.USER32.dll_MonitorFromPoint]
mov r14, rax
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp + 0x584]
call fcn.14013b230
mov dword [rbp + 0x580], 0x68
mov rbx, qword [r13 + 0x70]
test rbx, rbx
je 0x140002e1f
lea rdx, [rbp + 0x580]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
jne 0x140002e22
mov rbx, r12
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r14d
mov r9d, dword [rbp - 0x4c]
mov r8d, dword [rbp - 0x50]
lea rdx, str.MouseCursor:__i__i_MouseMonitor:__08X_StartMonitor:__08X
lea rcx, [rbp + 0xa30]
call fcn.1400011bc
mov r9b, 1
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0xa30]
call rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov r13, rax
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, qword [rbp - 0x60]
mov dword [rcx + 0x214], eax
mov edx, 0xe
mov rcx, r13
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov r12d, eax
mov edx, 0x77
mov rcx, r13
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov r15d, eax
mov edx, 0x74
mov rcx, r13
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov r14d, eax
mov edx, 0x78
mov rcx, r13
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
mov edx, 0x26
mov rcx, r13
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
mov edx, 0x58
mov rcx, r13
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
mov edx, 0x5a
mov rcx, r13
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, qword [rbp - 0x60]
mov ecx, dword [rcx + 0x238]
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r15d
mov r9d, r12d
mov r15, qword [rbp - 0x60]
mov r8d, dword [r15 + 0x214]
lea rdx, str.Display:_bpp_i__planes_i__align_i__vrefr_i__shadex_08X__rastx_08X__dpi_ix_i__per_mon_dpi_u
lea rcx, [rbp + 0xa30]
call fcn.1400011bc
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov r9b, 1
xor r8d, r8d
mov rdi, qword [rbp - 0x48]
mov rdx, rdi
lea rcx, [rbp + 0xa30]
mov rbx, qword [rbp - 0x40]
call rbx
mov r9b, 1
xor r8d, r8d
mov rdx, rdi
lea rcx, str.Monitors__dpi:_WholeDesktop__Effective__Angular__RAW_:
call rbx
xor r14d, r14d
mov qword [rbp - 0x58], r14
cmp dword [r15 + 0x23c], r14d
jbe 0x140003135
mov r13d, r14d
mov qword [rbp - 0x70], r14
movzx eax, r14w
mov word [rbp + 0x930], ax
lea rbx, [r13 + 0x270]
add rbx, r15
mov edi, 4
mov r8d, dword [rbx - 4]
test r8d, r8d
jne 0x140002faf
cmp dword [rbx], r14d
je 0x140002ff2
lea rcx, [0x140168940]
lea rdx, [0x140168958]
test ax, ax
cmovne rdx, rcx
mov r9d, dword [rbx]
lea rcx, [rbp + 0x730]
call fcn.140001190
lea r8, [rbp + 0x730]
mov edx, 0x80
lea rcx, [rbp + 0x930]
call fcn.140001f38
movzx eax, word [rbp + 0x930]
add rbx, 8
sub rdi, 1
jne 0x140002fa1
mov edi, dword [r15 + r13 + 0x264]
mov r14d, dword [r15 + r13 + 0x25c]
mov ebx, dword [r15 + r13 + 0x260]
mov esi, dword [r15 + r13 + 0x258]
mov r12d, dword [r15 + r13 + 0x254]
mov r13d, dword [r15 + r13 + 0x24c]
mov rdx, qword [rbp - 0x70]
mov r15d, dword [r15 + rdx + 0x250]
mov rax, qword [rbp - 0x60]
mov r9d, dword [rax + rdx + 0x248]
test byte [rax + rdx + 0x268], 1
lea r8, str.____Primary
lea rcx, [0x14015a140]
cmovne rcx, r8
add rax, 0x28c
add rax, rdx
mov r8d, edi
sub r8d, r14d
mov edx, ebx
sub edx, esi
mov r11d, r12d
sub r11d, r13d
mov r10d, r15d
sub r10d, r9d
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x80], rax
lea rax, [rbp + 0x930]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], r8d
mov dword [rsp + 0x68], edx
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r13d
mov r15, qword [rbp - 0x60]
mov r13, qword [rbp - 0x70]
mov r8d, dword [r15 + r13 + 0x240]
lea rdx, str.___08X:__i__i__i__i___ix_i___Working:__i__i__i__i___ix_i___dpi:__s___s__s
lea rcx, [rbp + 0xa30]
call fcn.1400011bc
mov r9b, 1
xor r8d, r8d
mov rdi, qword [rbp - 0x48]
mov rdx, rdi
lea rcx, [rbp + 0xa30]
mov rbx, qword [rbp - 0x40]
call rbx
mov rcx, qword [rbp - 0x58]
inc rcx
mov qword [rbp - 0x58], rcx
add r13, 0x90
mov qword [rbp - 0x70], r13
mov eax, dword [r15 + 0x23c]
cmp rcx, rax
mov r14d, 0
jb 0x140002f87
mov r9b, 1
xor r8d, r8d
mov rdx, rdi
lea rcx, str.Modules:
call rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov dword [rbp], 0x438
xor edx, edx
mov r8d, 0x434
lea rcx, [rbp + 4]
call fcn.14013b230
lea rcx, [rsi - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140003212
lea rdx, [rbp]
mov rcx, rsi
call sub.KERNEL32.dll_Module32FirstW
jmp 0x140003204
mov r8d, dword [rbp + 0x20]
mov eax, r8d
lea edx, [r8 - 1]
neg eax
sbb ecx, ecx
and edx, ecx
mov rcx, qword [rbp + 0x18]
add rdx, rcx
mov rax, rdx
shr rax, 0x20
shr rcx, 0x20
lea r9, [rbp + 0x230]
mov qword [rsp + 0x38], r9
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x18]
mov r8d, ecx
lea rdx, str.___08X_08X__08X_08X__8X__s
lea rcx, [rbp + 0xa30]
call fcn.1400011bc
mov r9b, 1
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0xa30]
call rbx
lea rdx, [rbp]
mov rcx, rsi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x140003190
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x18]
call fcn.140120ddc
jmp 0x140003230
mov r9b, 1
mov r8b, r9b
mov rdx, rax
lea rcx, str.LogStartEnv_failed__invalid_apStartEnv
call r12
mov rcx, qword [rbp + 0x1250]
xor rcx, rsp
call fcn.140139b10
mov rbx, qword [rsp + 0x1418]
add rsp, 0x13c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret