Function at 0x14003e470
Capabilities:
Enumerate processes
Set console window title

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
sub rsp, 0x370
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14005d040]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov rdi, rcx
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
lea rcx, [0x140051cae]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movabs rax, 0xb05a4e0fc14beee6
xor edx, edx
mov qword [rbp], rax
movabs r14, 0x846a763ff5799989
mov rax, qword [rbp]
movabs r15, 0x5a8dfa0eb10aff86
mov qword [rbp + 0x30], rax
movabs rax, 0x5a8dfa0ed4729aa8
mov qword [rbp], rax
lea ecx, [rdx + 2]
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x2d0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x30]
mov qword [rbp + 0x2d8], rax
xorps xmm0, xmmword [rbp + 0x2d0]
movdqa xmmword [rbp + 0x30], xmm0
mov dword [rbp + 0x190], 0x130
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003e597
lea rdx, [rbp + 0x190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14003e58e
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x1bc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, rbx
test eax, eax
je 0x14003e63d
lea rdx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14003e561
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
movabs rax, 0xd44a125a9910f8cf
lea rcx, [rbp + 0x10]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x5a87da7adf6f8de7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x2c0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x2c8], rax
xorps xmm0, xmmword [rbp + 0x2c0]
movdqa xmmword [rbp + 0x10], xmm0
call fcn.140001f10
xor al, al
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.140049880
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rcx, 0xeb702d48606163c8
movabs rax, 0xa40e135a961aecda
mov qword [rbp], rax
movabs rdx, 0x1f0270c1edbe089b
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x50ad8e60d4789ed6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x300], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x308], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x310], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x40]
mov rax, qword [rbp]
mov qword [rbp + 0x318], rax
vmovdqu ymm0, ymmword [rbp + 0x300]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call fcn.140001f10
movabs rax, 0xe71e1748871cefc6
lea rcx, [rbp + 0x64]
mov qword [rbp], rax
xor edx, edx
mov rax, qword [rbp]
mov r8d, 0x12c
mov qword [rbp + 0x20], rax
xor esi, esi
movabs rax, 0x5a8dfa6bc96fd1ee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x2e0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x2e8], rax
xorps xmm0, xmmword [rbp + 0x2e0]
movdqa xmmword [rbp + 0x20], xmm0
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rbp + 0x60], 0x130
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp + 0x60]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14003e812
nop dword [rax]
movzx ecx, byte [rbp + 0x8c]
lea r10, [rbp + 0x20]
test cl, cl
je 0x14003e7e6
lea r11, [rbp + 0x8c]
lea rax, [rbp + 0x20]
sub r11, rax
nop dword [rax]
movsx r9d, byte [r10]
movsx edx, cl
lea eax, [rdx - 0x41]
cmp eax, 0x19
lea r8d, [rdx + 0x20]
lea eax, [r9 - 0x41]
cmova r8d, edx
cmp eax, 0x19
lea edx, [r9 + 0x20]
cmova edx, r9d
cmp r8d, edx
jne 0x14003e7e6
movzx ecx, byte [r11 + r10 + 1]
inc r10
test cl, cl
jne 0x14003e7b0
cmp cl, byte [r10]
je 0x14003e7fe
lea rdx, [rbp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14003e790
jmp 0x14003e812
mov r8d, dword [rbp + 0x68]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rsi
lea rcx, [rbp + 0x10]
movabs rax, 0xe0041f689e17f8dd
xor edx, edx
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x5afe896fdd4988e9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x2c0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x2c8], rax
xorps xmm0, xmmword [rbp + 0x2c0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, qword [rdi]
mov qword [rdi + 8], rax
call fcn.140049710
test rax, rax
mov qword [rdi + 0x10], rax
setne al
jmp 0x14003e611