Function at 0x140001000
Capabilities:
Accept command line arguments
Get graphical window text
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
xor esi, esi
mov dword [rbp + 0x230], esi
call qword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp + 0x230]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, dword [rbp + 0x230]
lea edi, [rsi + 0xa]
mov rbx, rax
sub edx, 3
je 0x140001074
cmp edx, 1
je 0x14000105b
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
mov rcx, qword [rax + 0x18]
mov r8d, edi
xor edx, edx
call qword [sym.imp.ntdll.dll_wcstol]
movsxd rcx, eax
mov qword [0x140003020], rcx
mov rcx, qword [rbx + 8]
mov r8d, edi
xor edx, edx
call qword [sym.imp.ntdll.dll_wcstol]
mov dword [0x140003008], eax
mov r8d, edi
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [sym.imp.ntdll.dll_wcstol]
mov dword [0x14000300c], eax
mov ebx, 0x50
mov eax, dword [0x140003008]
mov r14d, 0xf08fb74c
mov r15d, 0xaf97fb59
cmp eax, 0x192e900
je 0x1400010ed
cmp eax, 0x1e34b00
je 0x1400010ed
cmp eax, 0x33f5cfbc
je 0x1400010db
cmp eax, 0x45d37644
je 0x1400010ed
cmp eax, r15d
je 0x1400010e4
cmp eax, r14d
jne 0x140001104
lea r8, str.AcrobatSDIWindow
jmp 0x1400010f4
lea r8, str.GHOST_WindowClass
jmp 0x1400010f4
lea r8, str.ConsoleWindowClass
mov rdx, rbx
lea rcx, [0x140003040]
call qword [sym.imp.ntdll.dll_wcscpy_s]
cmp qword [0x140003020], rsi
jne 0x140001128
call fcn.140001ab4
mov qword [0x140003020], rax
test rax, rax
jne 0x140001128
lea ecx, [rax + 6]
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
xor edx, edx
mov dword [rsp + 0x70], ebx
lea rcx, [rsp + 0x74]
lea r8d, [rdx + 0x4c]
call sub.ntdll.dll_memset
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov rcx, qword [0x140003020]
lea rdi, [0x1400030e0]
mov qword [rbp - 0x78], rax
lea rdx, [0x140003010]
lea rax, [0x1400014b0]
mov qword [rbp - 0x50], rdi
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [0x140003014], eax
mov eax, dword [0x140003008]
cmp eax, 0x33f5cfbc
je 0x140001190
cmp eax, r15d
je 0x140001190
cmp eax, r14d
jne 0x14000119c
mov rcx, qword [0x140003020]
call fcn.140001830
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov r9, qword [0x140003020]
lea rdx, str.VdmHost__d__p
mov r8d, eax
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x1400014a4
mov rcx, qword [0x140003020]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rcx, qword [0x140003020]
lea rdx, [rsp + 0x60]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, dword [rsp + 0x64]
mov edx, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x68]
sub r8d, r9d
mov qword [rsp + 0x58], rsi
sub ecx, edx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], r8d
xor r8d, r8d
mov dword [rsp + 0x30], ecx
xor ecx, ecx
mov dword [rsp + 0x28], r9d
mov r9d, 0xcf0000
mov dword [rsp + 0x20], edx
mov rdx, rdi
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, dword [0x140003008]
mov qword [0x140003018], rax
cmp ecx, r15d
je 0x14000125f
cmp ecx, r14d
jne 0x1400012af
mov edi, 4
mov dword [rbp + 0x238], 1
mov r9d, edi
lea r8, [rbp + 0x238]
mov rcx, rax
lea edx, [rdi + 0x10]
call qword [sym.imp.dwmapi.dll_DwmSetWindowAttribute]
mov rcx, qword [0x140003018]
lea r8, [rbp + 0x240]
mov r9d, edi
mov dword [rbp + 0x240], 0x505050
lea edx, [rdi + 0x1e]
call qword [sym.imp.dwmapi.dll_DwmSetWindowAttribute]
mov rax, qword [0x140003018]
mov rcx, qword [0x140003020]
mov rdx, rax
call qword [sym.imp.USER32.dll_SetParent]
call fcn.140001b88
mov eax, dword [0x140003008]
cmp eax, 0x192e900
je 0x1400012df
cmp eax, 0x45d37644
je 0x1400012df
cmp eax, 0x1e34b00
jne 0x1400012ea
call fcn.140001cc0
mov eax, dword [0x140003008]
cmp eax, 0x33f5cfbc
je 0x1400012fb
cmp eax, r14d
je 0x1400012fb
cmp eax, r15d
jne 0x140001331
mov eax, dword [0x140003014]
lea r9, [0x1400017c8]
mov dword [rsp + 0x30], esi
mov ecx, 0x8000
mov dword [rsp + 0x28], eax
mov edx, ecx
mov eax, dword [0x140003010]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWinEventHook]
mov qword [0x140003028], rax
xor r8d, r8d
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
lea r9, [0x1400019d4]
mov dword [rsp + 0x20], esi
lea edx, [r8 + 3]
mov ecx, edx
call qword [sym.imp.USER32.dll_SetWinEventHook]
mov dword [rsp + 0x30], esi
lea r9, [0x1400019fc]
mov qword [0x140003030], rax
mov ecx, 0x800c
mov eax, dword [0x140003014]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov edx, ecx
mov eax, dword [0x140003010]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWinEventHook]
xor r9d, r9d
lea rdx, [0x140001c00]
xor r8d, r8d
mov qword [0x140003038], rax
lea ecx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rcx, qword [0x140003020]
lea rdx, [rbp - 0x10]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [0x140003018]
lea rdx, [rbp - 0x10]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [0x140003020]
and rbx, 0xffffffffff38ffff
mov r8, rbx
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov ecx, dword [rsp + 0x6c]
xor r9d, r9d
sub ecx, dword [rsp + 0x64]
xor r8d, r8d
mov eax, dword [rsp + 0x68]
xor edx, edx
sub eax, dword [rsp + 0x60]
mov dword [rsp + 0x30], 0x25
mov dword [rsp + 0x28], ecx
mov rcx, qword [0x140003020]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [0x140003008], r15d
mov edx, 3
mov rcx, qword [0x140003018]
je 0x14000143b
mov edx, dword [0x14000300c]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [section..data], 1
xor r9d, r9d
lea rcx, [rbp - 0x40]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140001475
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov rcx, qword [0x140003020]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14000149c
mov rcx, qword [0x140003018]
lea edx, [rax + 0x10]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [section..data], esi
jne 0x14000144b
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]