Function at 0x140003380
Capabilities:
Enumerate gui resources
Enumerate process modules
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1170]
mov eax, 0x1270
call fcn.140006280
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1160], rax
call fcn.1400030e0
test eax, eax
sete sil
test eax, eax
je 0x1400035db
xor ebx, ebx
mov qword [rsp + 0x40], 0x8004
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x4c], ebx
lea rcx, [0x140002570]
mov byte [rsp + 0x50], bl
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x140003411
mov edi, ebx
nop dword [rax]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400030e0
test eax, eax
sete sil
test eax, eax
je 0x140003411
inc edi
cmp edi, 0x14
jl 0x1400033f0
test sil, sil
jne 0x1400035db
xor edx, edx
lea rcx, [0x140002160]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp eax, 1
jne 0x14000355f
mov qword [rsp + 0x1290], r14
lea r8, [rsp + 0x24]
mov edx, 0x1000
lea rcx, [rbp + 0x160]
mov r14d, ebx
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x14000354f
mov edi, dword [rsp + 0x24]
mov esi, ebx
shr edi, 2
mov dword [rsp + 0x24], edi
test edi, edi
je 0x14000354f
mov qword [rsp + 0x1298], r15
mov r15d, 1
nop
movups xmm0, xmmword [str._unknown_]
mov eax, dword [0x140008618]
lea rcx, [rsp + 0x54]
xor edx, edx
mov dword [rsp + 0x50], eax
mov r8d, 0x1f4
movaps xmmword [rsp + 0x40], xmm0
call sub.VCRUNTIME140.dll_memset
mov eax, esi
mov r8d, dword [rbp + rax*4 + 0x160]
test r8d, r8d
je 0x14000353d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14000352b
lea r9, [rsp + 0x28]
mov r8d, 8
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x14000352b
mov rdx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x104
mov rcx, rdi
call sub.KERNEL32.dll_K32GetModuleBaseNameW
lea rdx, [0x140008620]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000352b
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
cmovne r14d, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
jne 0x140003547
mov edi, dword [rsp + 0x24]
inc esi
cmp esi, edi
jb 0x140003480
mov r15, qword [rsp + 0x1298]
test r14d, r14d
mov eax, ebx
mov r14, qword [rsp + 0x1290]
sete al
test eax, eax
jne 0x1400035d4
mov edi, ebx
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400030e0
test eax, eax
sete cl
test eax, eax
je 0x140003585
inc edi
cmp edi, 0x14
jl 0x140003565
test cl, cl
je 0x1400035d4
mov byte [rsp + 0x20], bl
xor dil, dil
lea rdx, [rsp + 0x20]
lea rcx, [0x140002420]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [rsp + 0x20], 0
jne 0x1400035ca
call fcn.1400030e0
test eax, eax
sete dil
test eax, eax
je 0x1400035ca
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x14
jl 0x140003590
test dil, dil
je 0x1400035d4
call fcn.140003610
mov eax, 0xffffffff
jmp 0x1400035e0
call fcn.140001d30
mov rcx, qword [rbp + 0x1160]
xor rcx, rsp
call fcn.1400062f0
mov rbx, qword [rsp + 0x12a0]
add rsp, 0x1270
pop rdi
pop rsi
pop rbp
ret