Function at 0x14009e940
Capabilities:
Enumerate gui resources
Hide graphical window
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1f8
lea rbp, [rsp + 0x80]
and rsp, 0xffffffffffffffe0
mov r14, rdx
mov r12, rcx
mov rax, qword [0x140114500]
xor rax, rbp
mov qword [rsp + 0x1f0], rax
movabs rax, 0xa5506180a847d99c
mov qword [rsp + 0x180], rax
movabs rax, 0xba22c1fadeefb4aa
mov qword [rsp + 0x188], rax
movabs r13, 0xc17e53b3da22aae9
mov qword [rsp + 0x120], r13
movabs rbx, 0xba22c1fadeefd8c6
mov qword [rsp + 0x128], rbx
lea rsi, [rsp + 0x120]
mov rax, rsi
vmovaps xmm0, xmmword [rsp + 0x180]
vxorps xmm0, xmm0, xmmword [rax]
vmovaps xmmword [rsp + 0x180], xmm0
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14009ec9b
movabs rcx, 0xa82936c7bb47d8aa
mov qword [rsp + 0x180], rcx
movabs rcx, 0xdb60afb3a980bca8
mov qword [rsp + 0x188], rcx
movabs rcx, 0xfcb384d53ce6330d
mov qword [rsp + 0x190], rcx
movabs rdi, 0x7534e1f4c76e7108
mov qword [rsp + 0x198], rdi
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x128], rbx
movabs rcx, 0xfcb384d53ce65763
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x138], rdi
mov rcx, rsi
vmovdqa ymm0, ymmword [rsp + 0x180]
vpxor ymm0, ymm0, ymmword [rcx]
vmovdqa ymmword [rsp + 0x180], ymm0
lea rdx, [rsp + 0x180]
mov rcx, rax
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
mov r15, qword [0x1401145c0]
cmp qword [r14 + 0x18], 8
mov qword [rsp + 0x70], r12
jb 0x14009eab6
mov r14, qword [r14]
mov qword [rsp + 0x90], r14
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0x90]
mov rcx, r15
call fcn.1400a0ae0
test eax, eax
je 0x14009ed4a
mov r12d, eax
mov qword [rsp + 0x120], 0
mov dword [rsp + 0x128], eax
lea rcx, [0x1400a09d0]
lea r14, [rsp + 0x120]
mov rdx, r14
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x14009ef63
movabs rax, 0x845e27d6bd46c3be
mov qword [rsp + 0xa0], rax
movabs rax, 0xba22c1faac80aab4
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x128], rbx
mov rax, r14
vmovaps xmm0, xmmword [rsp + 0xa0]
vxorps xmm0, xmm0, xmmword [rax]
vmovaps xmmword [rsp + 0xa0], xmm0
movabs rax, 0xb55e37d6b64bcbaf
mov qword [rsp + 0x180], rax
movabs rax, 0xd256e18ebb88f8a9
mov qword [rsp + 0x188], rax
movabs rax, 0x8ed6e0bb59947706
mov qword [rsp + 0x190], rax
movabs rax, 0x1478f9de7091f61
mov qword [rsp + 0x198], rax
movabs rax, 0xe03f5ce30e9578cc
mov qword [rsp + 0x1a0], rax
movabs rax, 0x7ee0b296dc79d1af
mov qword [rsp + 0x1a8], rax
movabs rax, 0xa7e2f8d801da70e7
mov qword [rsp + 0x1b0], rax
movabs rax, 0x747f2a508d63256c
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x128], rbx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x138], rdi
movabs rcx, 0x8c4f7ccf6bf616ad
mov qword [rsp + 0x140], rcx
movabs rcx, 0x792c6b6b90ab0ca
mov qword [rsp + 0x148], rcx
movabs rcx, 0xa7cc96b160bd11c7
mov qword [rsp + 0x150], rcx
mov qword [rsp + 0x158], rax
vmovaps ymm0, ymmword [rsp + 0x180]
vxorps ymm0, ymm0, ymmword [r14]
vmovaps ymmword [rsp + 0x180], ymm0
vmovdqa ymm0, ymmword [rsp + 0x1a0]
vpxor ymm0, ymm0, ymmword [r14 + 0x20]
vmovdqa ymmword [rsp + 0x1a0], ymm0
xor r14d, r14d
lea rdx, [rsp + 0x180]
jmp 0x14009ef26
movabs rax, 0x845e27d6bd46c3be
mov qword [rsp + 0x180], rax
movabs rax, 0xba22c1faac80aab4
mov qword [rsp + 0x188], rax
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x128], rbx
mov rax, rsi
vmovaps xmm0, xmmword [rsp + 0x180]
vxorps xmm0, xmm0, xmmword [rax]
vmovaps xmmword [rsp + 0x180], xmm0
movabs rax, 0x8e2c01f6fa65e8ad
mov qword [rsp + 0xa0], rax
movabs rax, 0xba22c1caf3cfe294
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x128], rbx
vmovdqa xmm0, xmmword [rsp + 0xa0]
vpxor xmm0, xmm0, xmmword [rsi]
vmovdqa xmmword [rsp + 0xa0], xmm0
xor r14d, r14d
lea rdx, [rsp + 0xa0]
lea r8, [rsp + 0x180]
jmp 0x14009ef2e
movabs rax, 0x845e27d6bd46c3be
mov qword [rsp + 0xa0], rax
movabs rax, 0xba22c1faac80aab4
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x128], rbx
vmovaps xmm0, xmmword [rsp + 0xa0]
vxorps xmm0, xmm0, xmmword [rsi]
vmovaps xmmword [rsp + 0xa0], xmm0
movabs rax, 0xb55e37d6b64bcbaf
mov qword [rsp + 0x120], rax
movabs rax, 0xdb02a594b789f8a9
mov qword [rsp + 0x128], rax
movabs rax, 0x9bddedbb52932543
mov qword [rsp + 0x130], rax
movabs rax, 0x194187d4a3001028
mov qword [rsp + 0x138], rax
movabs rax, 0xac2119bf04d66fc1
mov qword [rsp + 0x140], rax
movabs rax, 0x69fbb196dc67d1ad
mov qword [rsp + 0x148], rax
movabs rax, 0xc2a0e6914cca7ea3
mov qword [rsp + 0x150], rax
movabs rax, 0x54065824ad06560d
mov qword [rsp + 0x158], rax
movabs rax, 0x83aa9ec5808038b0
mov qword [rsp + 0x160], rax
movabs rax, 0x98ea6c52b44de4ae
mov qword [rsp + 0x168], rax
mov qword [rsp + 0x180], r13
mov qword [rsp + 0x188], rbx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x190], rcx
mov qword [rsp + 0x198], rdi
movabs rcx, 0x8c4f7ccf6bf616ad
mov qword [rsp + 0x1a0], rcx
movabs rcx, 0x792c6b6b90ab0ca
mov qword [rsp + 0x1a8], rcx
movabs rcx, 0xa7cc96b160bd11c7
mov qword [rsp + 0x1b0], rcx
movabs rcx, 0x747f2a508d63256c
mov qword [rsp + 0x1b8], rcx
movabs rcx, 0x83aab0abe9e15fd1
mov qword [rsp + 0x1c0], rcx
mov qword [rsp + 0x1c8], rax
lea rax, [rsp + 0x180]
vmovaps ymm0, ymmword [rsp + 0x120]
vxorps ymm0, ymm0, ymmword [rax]
vmovaps ymmword [rsp + 0x120], ymm0
vmovaps ymm0, ymmword [rsp + 0x140]
vxorps ymm0, ymm0, ymmword [rax + 0x20]
vmovaps ymmword [rsp + 0x140], ymm0
vmovdqa xmm0, xmmword [rsp + 0x160]
vpxor xmm0, xmm0, xmmword [rax + 0x40]
vmovdqa xmmword [rsp + 0x160], xmm0
xor r14d, r14d
lea rdx, [rsp + 0x120]
lea r8, [rsp + 0xa0]
xor ecx, ecx
xor r9d, r9d
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x1f0]
xor rcx, rbp
call fcn.1400a1e40
mov eax, r14d
lea rsp, [rbp + 0x178]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x14009eb1c
mov r15, qword [rsp + 0x120]
test r15, r15
je 0x14009eb1c
lea rdx, [rsp + 0x100]
mov r8, r15
call fcn.14009f7b0
cmp qword [rsp + 0x110], 0
je 0x14009f2bf
mov ecx, 4
call fcn.1400a1c64
mov dword [rax], 0
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rdx]
mov qword [rdx], rax
test rcx, rcx
je 0x14009efc7
call fcn.1400a1ca0
lea rsi, [rsp + 0x120]
mov rcx, rsi
call fcn.14009f8d0
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x120], 0
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rdx + 8]
mov qword [rdx + 8], rax
test rcx, rcx
je 0x14009f014
call fcn.1400a1ca0
mov rcx, qword [rsp + 0x120]
test rcx, rcx
je 0x14009f014
call fcn.1400a1ca0
mov rax, qword [rsp + 0x70]
mov dword [rax + 0xb8], r12d
mov r12, rax
mov qword [rax + 0xc0], r15
mov rcx, qword [rax + 8]
call fcn.1400a0a30
xor r14d, r14d
cmp qword [r12], 0
je 0x14009f5c2
cmp qword [r12 + 8], 0
je 0x14009f5c2
lea rdx, [r12 + 0x78]
mov rcx, qword [r12 + 0xc0]
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x14009f434
vmovq xmm0, qword [r12 + 0x80]
vmovq xmm1, qword [r12 + 0x78]
vpsubd xmm0, xmm0, xmm1
vpsrld xmm1, xmm0, 0x1f
vpaddd xmm1, xmm0, xmm1
vpsrad xmm1, xmm1, 1
vpunpcklqdq xmm1, xmm0, xmm1
vmovdqu xmmword [r12 + 0xd0], xmm1
mov rax, qword [0x1401145e0]
vmovd dword [rax + 0x138], xmm0
mov ecx, dword [r12 + 0xd4]
mov dword [rax + 0x13c], ecx
mov ecx, dword [r12 + 0xd0]
mov edx, ecx
shr edx, 0x1f
add edx, ecx
sar edx, 1
mov dword [rax + 0x140], edx
mov ecx, dword [r12 + 0xd4]
mov edx, ecx
shr edx, 0x1f
add edx, ecx
sar edx, 1
mov dword [rax + 0x144], edx
movabs rax, 0x4000000050
mov qword [rsp + 0x120], rax
lea rax, [0x14009fa50]
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x138], rax
vpxor xmm0, xmm0, xmm0
vmovdqu ymmword [rsp + 0x140], ymm0
lea r15, [rsp + 0x180]
mov qword [rsp + 0x160], r15
mov qword [rsp + 0x168], 0
lea rcx, [rsp + 0x120]
vzeroupper
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rcx, qword [rsp + 0x138]
mov edx, dword [r12 + 0xd0]
mov r8d, dword [r12 + 0xd4]
mov qword [rsp + 0x50], rcx
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400b2400]
mov ecx, 0x8080008
mov edx, eax
mov r9d, 0x80000000
call qword [rsp + pe_nt_image_headers64]
mov r14, rax
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rsi, qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, r14
mov edx, 0xffffffec
mov r8d, 0x800a0
call rsi
mov rcx, r14
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x20
mov rcx, r14
mov edx, 0xffffffec
mov r8d, eax
call rsi
mov r9d, dword [r12 + 0xd0]
mov eax, dword [r12 + 0xd4]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov rcx, r14
xor edx, edx
xor r8d, r8d
call qword [sym.imp.USER32.dll_MoveWindow]
vpcmpeqd xmm0, xmm0, xmm0
vmovdqa xmmword [rsp + 0x80], xmm0
lea rdx, [rsp + 0x80]
mov rcx, r14
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, r14
xor edx, edx
mov r8b, 0xff
mov r9d, 2
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, r14
mov rdx, 0xffffffffffffffff
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, r14
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [r12 + 0xc8], r14
mov rcx, qword [r12 + 0x10]
call fcn.14000ab50
test al, al
je 0x14009f614
mov r14b, 1
jmp 0x14009f5c2
movabs rax, 0x845e27d6bd46c3be
mov qword [rsp + 0xa0], rax
movabs rax, 0xba22c1faac80aab4
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x128], rbx
mov rax, r14
vmovaps xmm0, xmmword [rsp + 0xa0]
vxorps xmm0, xmm0, xmmword [rax]
vmovaps xmmword [rsp + 0xa0], xmm0
movabs rax, 0xb55e37d6b64bcbaf
mov qword [rsp + 0x180], rax
movabs rax, 0xd256e18ebb88f8a9
mov qword [rsp + 0x188], rax
movabs rax, 0x8ed6e0bb59947706
mov qword [rsp + 0x190], rax
movabs rax, 0x1478f9de7091f61
mov qword [rsp + 0x198], rax
movabs rax, 0xe12e12ef0e9578cc
mov qword [rsp + 0x1a0], rax
movabs rax, 0x74f3a3dac92a9caf
mov qword [rsp + 0x1a8], rax
movabs rax, 0xc0adb6c812c931a2
mov qword [rsp + 0x1b0], rax
movabs rax, 0x747f2a50a30d4c0d
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x128], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rdi
movabs rax, 0x8c4f7ccf6bf616ad
mov qword [rsp + 0x140], rax
movabs rax, 0x792c6b6b90ab0ca
mov qword [rsp + 0x148], rax
movabs rax, 0xa7cc96b160bd11c7
mov qword [rsp + 0x150], rax
movabs rax, 0x747f2a508d63256c
mov qword [rsp + 0x158], rax
vmovaps ymm0, ymmword [rsp + 0x180]
vxorps ymm0, ymm0, ymmword [r14]
vmovaps ymmword [rsp + 0x180], ymm0
vmovdqa ymm0, ymmword [rsp + 0x1a0]
vpxor ymm0, ymm0, ymmword [r14 + 0x20]
jmp 0x14009f598
movabs rax, 0x845e27d6bd46c3be
mov qword [rsp + 0xa0], rax
movabs rax, 0xba22c1faac80aab4
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x128], rbx
mov rax, rsi
vmovaps xmm0, xmmword [rsp + 0xa0]
vxorps xmm0, xmm0, xmmword [rax]
vmovaps xmmword [rsp + 0xa0], xmm0
movabs rax, 0xb55e37d6b64bcbaf
mov qword [rsp + 0x180], rax
movabs rax, 0xdb02a594b789f8a9
mov qword [rsp + 0x188], rax
movabs rax, 0x8e93fdb950933143
mov qword [rsp + 0x190], rax
movabs rax, 0x3314869aae001f7d
mov qword [rsp + 0x198], rax
movabs rax, 0xac2a08a6058264c2
mov qword [rsp + 0x1a0], rax
movabs rax, 0x62f1a8d7cd79dea3
mov qword [rsp + 0x1a8], rax
movabs rax, 0xa7cc96b160bd11e9
mov qword [rsp + 0x1b0], rax
movabs rax, 0x747f2a508d63256c
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x128], rbx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x138], rdi
movabs rcx, 0x8c4f7ccf6bf616ad
mov qword [rsp + 0x140], rcx
movabs rcx, 0x792c6b6b90ab0ca
mov qword [rsp + 0x148], rcx
movabs rcx, 0xa7cc96b160bd11c7
mov qword [rsp + 0x150], rcx
mov qword [rsp + 0x158], rax
vmovaps ymm0, ymmword [rsp + 0x180]
vxorps ymm0, ymm0, ymmword [rsi]
vmovaps ymmword [rsp + 0x180], ymm0
vmovdqa ymm0, ymmword [rsp + 0x1a0]
vpxor ymm0, ymm0, ymmword [rsi + 0x20]
vmovdqa ymmword [rsp + 0x1a0], ymm0
xor r14d, r14d
lea rdx, [rsp + 0x180]
lea r8, [rsp + 0xa0]
xor ecx, ecx
xor r9d, r9d
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword [rsp + 0x118]
cmp rax, 0x10
jb 0x14009ef3c
mov rcx, qword [rsp + 0x100]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14009f604
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14009f60e
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400a1ca8
jmp 0x14009ef3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
movabs rax, 0xa03673d6a957c5a4
mov qword [rsp + 0xf0], rax
movabs rax, 0xba22c188bb83bca8
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x180], r13
mov qword [rsp + 0x188], rbx
mov rax, r15
vmovaps xmm0, xmmword [rsp + 0xf0]
vxorps xmm0, xmm0, xmmword [rax]
vmovaps xmmword [rsp + 0xf0], xmm0
movabs rax, 0xb55e37d6b64bcbaf
mov qword [rsp + 0xa0], rax
movabs rax, 0xce02a488b789f8a9
mov qword [rsp + 0xa8], rax
movabs rax, 0x99c0f1ba51c6320b
mov qword [rsp + 0xb0], rax
movabs rax, 0x165a8080b4001828
mov qword [rsp + 0xb8], rax
movabs rax, 0xff2e19a31bd63ac8
mov qword [rsp + 0xc0], rax
movabs rax, 0x60f3e6cfcb7e90af
mov qword [rsp + 0xc8], rax
movabs rax, 0xa7cc96b14ed378a6
mov qword [rsp + 0xd0], rax
movabs rax, 0x747f2a508d63256c
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0x180], r13
mov qword [rsp + 0x188], rbx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x190], rcx
mov qword [rsp + 0x198], rdi
movabs rcx, 0x8c4f7ccf6bf616ad
mov qword [rsp + 0x1a0], rcx
movabs rcx, 0x792c6b6b90ab0ca
mov qword [rsp + 0x1a8], rcx
movabs rcx, 0xa7cc96b160bd11c7
mov qword [rsp + 0x1b0], rcx
mov qword [rsp + 0x1b8], rax
vmovaps ymm0, ymmword [rsp + 0xa0]
vxorps ymm0, ymm0, ymmword [r15]
vmovaps ymmword [rsp + 0xa0], ymm0
vmovaps ymm0, ymmword [rsp + 0xc0]
vxorps ymm0, ymm0, ymmword [r15 + 0x20]
vmovaps ymmword [rsp + 0xc0], ymm0
lea rdx, [rsp + 0xa0]
lea r8, [rsp + 0xf0]
xor ecx, ecx
xor r9d, r9d
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3