Function at 0x140009c30
Capabilities:
Check for time delay via gettickcount
Enumerate gui resources
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe20]
sub rsp, 0xf20
mov rax, qword [0x14005b178]
xor rax, rsp
mov qword [rbp + 0xe10], rax
mov rsi, rcx
mov r15, rdx
lea rcx, [rbp + 0x901]
xor r13d, r13d
xor edx, edx
mov r8d, 0x503
mov byte [rbp + 0x900], r13b
call fcn.140018a40
lea rcx, [rbp + 0x501]
xor edx, edx
mov r8d, 0x3ff
mov byte [rbp + 0x500], r13b
call fcn.140018a40
lea rcx, [rbp + 0x3f1]
xor edx, edx
mov r8d, 0x104
mov byte [rbp + 0x3f0], r13b
call fcn.140018a40
mov edi, r13d
mov r12d, r13d
test rsi, rsi
je 0x140009f70
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rsi + rax], r13b
jne 0x140009cd0
test rax, rax
je 0x140009f70
test r15, r15
je 0x140009f70
lea rcx, [0x1400a1b40]
mov rax, rbx
inc rax
cmp byte [rcx + rax], r13b
jne 0x140009cf5
test rax, rax
jne 0x140009d10
call fcn.140009894
test eax, eax
je 0x140009f70
lea rax, [0x1400a1a30]
inc rbx
cmp byte [rax + rbx], r13b
jne 0x140009d17
test rbx, rbx
jne 0x140009d32
call fcn.1400099e0
test eax, eax
je 0x140009f70
mov rcx, rsi
call fcn.140009b8c
test eax, eax
je 0x140009d58
mov r14d, 0x400
lea rcx, [rbp + 0x500]
mov r8, rsi
mov edx, r14d
call fcn.1400130d8
jmp 0x140009d99
lea rdx, [rbp + 0x3f0]
lea rcx, str.j0f__j
mov r8d, 0x105
call fcn.14000fe00
mov r14d, 0x400
lea r9, [rbp + 0x3f0]
lea r8, str._s_s
lea rcx, [rbp + 0x500]
mov edx, r14d
mov qword [rsp + 0x20], rsi
call fcn.140012eb8
lea rax, [rbp + 0x500]
lea r9, [0x1400a1b40]
lea r8, str._s___s_
lea rcx, [rbp + 0x900]
mov edx, 0x504
mov qword [rsp + 0x20], rax
call fcn.140012eb8
mov ebx, 0x68
lea rcx, [rsp + 0x70]
mov r8d, ebx
xor edx, edx
call fcn.140018a40
xor eax, eax
lea rcx, [0x1400a1a20]
mov dword [rsp + 0x70], ebx
mov dword [rbp - 0x54], 1
mov word [rbp - 0x50], r13w
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0x58]
lea rdx, [rbp + 0x900]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x28], r13d
call fcn.14000747c
test eax, eax
je 0x140009f3a
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov edx, 0xbb8
mov dword [0x1400a08d4], eax
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [rsp + 0x6c]
lea r8, [rbp + 0x500]
lea rcx, [rbp - 0x1c]
mov rdx, r14
mov dword [rbp - 0x20], eax
call fcn.1400130d8
mov dword [rbp + 0x3e4], r13d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, 0xffffffff
mov ebx, eax
lea rdx, [rbp - 0x20]
lea rcx, [0x1400096f8]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp dword [rbp + 0x3e4], r13d
jne 0x140009ec4
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
cmp rdi, rbx
jae 0x140009eb8
add rdi, r12
sub rdi, rbx
cmp rdi, 0xea60
jb 0x140009e83
mov r12d, r13d
cmp rdi, 0xea60
jae 0x140009f12
mov edi, 0xffffffff
mov rdx, r15
mov rcx, rsi
call fcn.140009f9c
test eax, eax
jne 0x140009f0c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
cmp rax, rbx
jae 0x140009eff
add rax, rdi
sub rax, rbx
cmp rax, 0xea60
jb 0x140009ed5
jmp 0x140009f12
mov r12d, 1
mov rbx, r13
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x140009f3a
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
cmp rbx, 5
jb 0x140009f15
lea rcx, [rbp + 0x3f0]
mov edx, 0x105
call fcn.140010a84
lea rcx, [rbp + 0x900]
mov edx, 0x504
call fcn.140010a84
lea rcx, [rbp + 0x500]
mov rdx, r14
call fcn.140010a84
mov eax, r12d
jmp 0x140009f72
xor eax, eax
mov rcx, qword [rbp + 0xe10]
xor rcx, rsp
call fcn.140012b40
mov rbx, qword [rsp + 0xf70]
add rsp, 0xf20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret