Function at 0x1400015a0
Capabilities:
Enumerate gui resources
Enumerate processes
Get graphical window text

Disassembly:
push rbp
push r13
push r14
sub rsp, 0x500
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
xor edx, edx
mov r14, rcx
xor r13d, r13d
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400019cc
mov qword [rsp + 0x4f8], r12
lea rcx, [rsp + 0xa4]
xor edx, edx
mov qword [rsp + 0x4f0], r15
mov r8d, 0x234
call fcn.140018830
lea rdx, [rsp + 0xa0]
mov dword [rsp + 0xa0], 0x238
mov rcx, rbp
mov r12d, r13d
mov r15d, r13d
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x1400019c7
lea rdx, [rsp + 0xa0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x1400019c7
mov qword [rsp + 0x530], rdi
lea edi, [rax + 3]
mov qword [rsp + 0x520], rbx
mov qword [rsp + 0x528], rsi
lea rax, [rsp + 0xcc]
mov r8, r14
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140001684
add rax, 2
test ecx, ecx
jne 0x140001670
test edx, edx
jne 0x140001731
mov rsi, r13
test r12, r12
je 0x1400016ae
lea r9d, [rdx + 0x30]
xor edx, edx
lea r8, [rsp + 0x40]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov rsi, qword [rsp + 0x58]
test rdi, rdi
je 0x1400016f9
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rdi
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test r12, r12
je 0x140001717
test rax, rax
je 0x140001701
test rsi, rsi
je 0x140001701
cmp rdi, rsi
mov r8, rdi
mov rdx, r12
mov rcx, rax
cmovae r8, rsi
call fcn.140018bf0
jmp 0x140001701
mov rbx, r13
test r12, r12
je 0x140001717
xor r8d, r8d
mov r9d, 0x8000
mov rdx, r12
lea rcx, [r8 - 1]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test rbx, rbx
je 0x14000174b
mov eax, dword [rsp + 0xa8]
inc r15
mov dword [rdi + rbx - 4], eax
mov r12, rbx
add rdi, 4
lea rdx, [rsp + 0xa0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140001662
mov qword [rsp + 0x38], r15
test r12, r12
je 0x1400019c2
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
lea rcx, [rdx - 1]
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
jne 0x140001787
mov r15, r13
jmp 0x140001964
mov rbp, qword [rsp + 0x38]
xorps xmm0, xmm0
mov dword [rsp + 0x30], r13d
mov esi, r13d
movups xmmword [rax], xmm0
test rbp, rbp
je 0x140001964
mov ebx, dword [r12 + r13*4]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
lea rcx, [rdx - 1]
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x140001964
xorps xmm0, xmm0
lea rcx, [0x140001490]
movups xmmword [rdi], xmm0
xor eax, eax
mov rdx, rdi
mov qword [rdi + 0x10], rax
mov dword [rdi], ebx
call qword [sym.imp.USER32.dll_EnumWindows]
xor ebx, ebx
cmp qword [rdi + 0x10], rbx
jbe 0x140001922
nop dword [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x2e0]
mov r8d, 0x200
call fcn.140018830
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x2e0]
mov r8d, 0x200
mov rcx, qword [rcx + rbx*8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x14000184e
lea rdx, str.Minecraft_1.8
lea rcx, [rsp + 0x2e0]
call fcn.140003560
test rax, rax
jne 0x14000185c
inc rbx
cmp rbx, qword [rdi + 0x10]
jb 0x140001800
jmp 0x140001922
mov rax, qword [r15 + 8]
xor ebp, ebp
mov rsi, qword [r15]
lea r14, [rax*4 + 4]
test rsi, rsi
je 0x14000188f
lea r9d, [rbp + 0x30]
xor edx, edx
lea r8, [rsp + 0x70]
lea rcx, [rbp - 1]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov rbp, qword [rsp + 0x88]
test r14, r14
je 0x1400018da
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, r14
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rsi, rsi
je 0x1400018f7
test rax, rax
je 0x1400018e1
test rbp, rbp
je 0x1400018e1
cmp r14, rbp
mov rdx, rsi
mov rcx, rax
cmovb rbp, r14
mov r8, rbp
call fcn.140018bf0
jmp 0x1400018e1
xor ebx, ebx
test rsi, rsi
je 0x140001914
xor r8d, r8d
mov r9d, 0x8000
mov rdx, rsi
lea rcx, [r8 - 1]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test rbx, rbx
je 0x140001914
mov rcx, qword [r15 + 8]
mov esi, dword [rsp + 0x30]
mov qword [r15], rbx
mov eax, dword [r12 + r13*4]
mov dword [rbx + rcx*4], eax
inc qword [r15 + 8]
jmp 0x14000191d
mov esi, 1
mov dword [rsp + 0x30], esi
mov rbp, qword [rsp + 0x38]
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x14000193e
xor r8d, r8d
mov r9d, 0x8000
lea rcx, [r8 - 1]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor r8d, r8d
mov r9d, 0x8000
mov rdx, rdi
lea rcx, [r8 - 1]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test esi, esi
jne 0x140001964
inc r13
cmp r13, rbp
jb 0x1400017a3
xor r8d, r8d
mov r9d, 0x8000
mov rdx, r12
lea rcx, [r8 - 1]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rax, r15
mov rsi, qword [rsp + 0x528]
mov rbx, qword [rsp + 0x520]
mov rdi, qword [rsp + 0x530]
mov r12, qword [rsp + 0x4f8]
mov r15, qword [rsp + 0x4f0]
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.140002450
add rsp, 0x500
pop r14
pop r13
pop rbp
ret
mov rax, r13
jmp 0x14000197d
mov rax, r13
jmp 0x140001995
mov rax, r13
jmp 0x1400019a5