Function at 0x140001000
Capabilities:
Accept command line arguments
Get graphical window text
Terminate process

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x200]
sub rsp, 0x300
xor edi, edi
mov dword [rbp + 0x220], edi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp + 0x220]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, dword [rbp + 0x220]
mov rbx, rax
sub edx, 3
je 0x14000106a
cmp edx, 1
je 0x140001050
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rax + 0x18]
xor edx, edx
lea r8d, [rdx + 0xa]
call qword [sym.imp.ntdll.dll_wcstol]
movsxd rcx, eax
mov qword [0x140003020], rcx
mov rcx, qword [rbx + 8]
xor edx, edx
lea r8d, [rdx + 0xa]
call qword [sym.imp.ntdll.dll_wcstol]
xor edx, edx
mov dword [0x140003008], eax
mov rcx, qword [rbx + 0x10]
lea r8d, [rdx + 0xa]
call qword [sym.imp.ntdll.dll_wcstol]
mov dword [0x14000300c], eax
mov eax, dword [0x140003008]
cmp eax, 0x192e900
je 0x1400010d1
cmp eax, 0x33f5cfbc
je 0x1400010bf
cmp eax, 0x45d37644
je 0x1400010d1
cmp eax, 0xaf97fb59
je 0x1400010c8
cmp eax, 0xf08fb74c
jne 0x1400010ea
lea r8, str.AcrobatSDIWindow
jmp 0x1400010d8
lea r8, str.GHOST_WindowClass
jmp 0x1400010d8
lea r8, str.ConsoleWindowClass
mov edx, 0x50
lea rcx, [0x140003040]
call qword [sym.imp.ntdll.dll_wcscpy_s]
cmp qword [0x140003020], rdi
jne 0x14000110e
call fcn.140001b40
mov qword [0x140003020], rax
test rax, rax
jne 0x14000110e
lea ecx, [rax + 6]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xorps xmm0, xmm0
mov qword [rsp + 0x338], rsi
xor eax, eax
mov dword [rsp + 0x70], 0x50
xor ecx, ecx
mov qword [rbp - 0x4c], rax
movups xmmword [rsp + 0x74], xmm0
mov dword [rbp - 0x44], eax
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, qword [0x140003020]
lea rsi, [0x1400030e0]
mov qword [rbp - 0x78], rax
lea rdx, [0x140003010]
lea rax, [0x1400014d0]
mov qword [rbp - 0x50], rsi
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [0x140003014], eax
mov eax, dword [0x140003008]
cmp eax, 0x33f5cfbc
je 0x140001193
cmp eax, 0xaf97fb59
je 0x140001193
cmp eax, 0xf08fb74c
jne 0x14000119f
mov rcx, qword [0x140003020]
call fcn.140001a10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, dword [0x140003020]
lea rdx, str.VdmHost__d__X
mov r8d, eax
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x1400014b9
mov rcx, qword [0x140003020]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rcx, qword [0x140003020]
lea rdx, [rsp + 0x60]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r8d, dword [rsp + 0x60]
mov rdx, rsi
mov r10d, dword [rsp + 0x64]
mov r9d, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x68]
sub r9d, r10d
mov qword [rsp + 0x58], rdi
sub ecx, r8d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], r9d
mov r9d, 0xcf0000
mov dword [rsp + 0x30], ecx
xor ecx, ecx
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r8d
xor r8d, r8d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, dword [0x140003008]
mov qword [0x140003018], rax
cmp ecx, 0xaf97fb59
je 0x14000126b
cmp ecx, 0xf08fb74c
jne 0x1400012be
mov r9d, 4
mov dword [rbp + 0x228], 1
lea r8, [rbp + 0x228]
mov rcx, rax
lea edx, [r9 + 0x10]
call qword [sym.imp.dwmapi.dll_DwmSetWindowAttribute]
mov rcx, qword [0x140003018]
lea r8, [rbp + 0x230]
mov r9d, 4
mov dword [rbp + 0x230], 0x505050
lea edx, [r9 + 0x1e]
call qword [sym.imp.dwmapi.dll_DwmSetWindowAttribute]
mov rax, qword [0x140003018]
mov rcx, qword [0x140003020]
mov rdx, rax
call qword [sym.imp.USER32.dll_SetParent]
call fcn.140001bc0
mov eax, dword [0x140003008]
cmp eax, 0x192e900
je 0x1400012e7
cmp eax, 0x45d37644
jne 0x1400012f2
call fcn.140001d70
mov eax, dword [0x140003008]
cmp eax, 0x33f5cfbc
je 0x140001307
cmp eax, 0xf08fb74c
je 0x140001307
cmp eax, 0xaf97fb59
jne 0x14000133d
mov eax, dword [0x140003014]
lea r9, [0x140001820]
mov dword [rsp + 0x30], edi
mov edx, 0x8000
mov dword [rsp + 0x28], eax
mov ecx, edx
mov eax, dword [0x140003010]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWinEventHook]
mov qword [0x140003028], rax
mov edx, 3
mov dword [rsp + 0x30], edi
mov ecx, edx
mov dword [rsp + 0x28], edi
lea r9, [0x140001a80]
mov dword [rsp + 0x20], edi
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWinEventHook]
mov dword [rsp + 0x30], edi
lea r9, [0x140001ab0]
mov qword [0x140003030], rax
mov edx, 0x800c
mov eax, dword [0x140003014]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov ecx, edx
mov eax, dword [0x140003010]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWinEventHook]
xor r9d, r9d
lea rdx, [0x140001ca0]
xor r8d, r8d
mov qword [0x140003038], rax
lea ecx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rcx, qword [0x140003020]
lea rdx, [rbp - 0x10]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [0x140003018]
lea rdx, [rbp - 0x10]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [0x140003020]
mov edx, 0xfffffff0
movsxd r8, ebx
and r8, 0xffffffffff38ffff
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov ecx, dword [rsp + 0x6c]
xor r9d, r9d
sub ecx, dword [rsp + 0x64]
xor r8d, r8d
mov eax, dword [rsp + 0x68]
xor edx, edx
sub eax, dword [rsp + 0x60]
mov dword [rsp + 0x30], 0x25
mov dword [rsp + 0x28], ecx
mov rcx, qword [0x140003020]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [0x140003008], 0xaf97fb59
mov edx, 3
mov rcx, qword [0x140003018]
je 0x14000144b
mov edx, dword [0x14000300c]
call qword [sym.imp.USER32.dll_ShowWindow]
cmp dword [section..data], edi
je 0x1400014b9
nop dword [rax]
xor r9d, r9d
lea rcx, [rbp - 0x40]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x14000148a
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov rcx, qword [0x140003020]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400014b1
mov rcx, qword [0x140003018]
lea edx, [rax + 0x10]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [section..data], edi
jne 0x140001460
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]