Function at 0x140168f30
Capabilities:
Access pe header
Enumerate gui resources
Get system information on windows

Disassembly:
push rbp
push rdi
push r13
push r14
lea rbp, [rsp - 0x3f]
sub rsp, 0xe8
mov rax, qword [0x140545d00]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov edi, ecx
mov edx, ecx
lea rcx, [0x140168ed0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [0x1405f98d0]
lea rdx, [rbp - 9]
xor r13d, r13d
mov dword [rbp - 9], r13d
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test edi, edi
je 0x1401691ef
test eax, eax
je 0x1401691ef
mov qword [rsp + 0xe0], r15
mov r15, qword [0x1405f9c08]
test r15, r15
jne 0x140168faa
lea eax, [r13 + 1]
jmp 0x140169055
mov rcx, r15
mov qword [rsp + 0x120], rsi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rsi, rax
test rax, rax
jne 0x140168fcb
lea eax, [rsi + 2]
jmp 0x14016904d
mov eax, dword [0x1405f98c8]
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov qword [rsp + 0x128], r12
movups xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x41], eax
mov ecx, 4
mov eax, dword [rsi + 0x50]
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x39], r13
movups xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x29], eax
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x19], xmm0
call fcn.140168120
test al, al
je 0x1401691e5
mov r12, qword [rbp - 0x31]
test r12, r12
je 0x1401691e5
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140168af0
test eax, eax
jne 0x140169077
mov eax, 4
mov r12, qword [rsp + 0x128]
mov rsi, qword [rsp + 0x120]
mov r15, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140473210
add rsp, 0xe8
pop r14
pop r13
pop rdi
pop rbp
ret
mov r8, rsi
mov rdx, r15
mov ecx, r14d
call fcn.140168c80
test eax, eax
jne 0x140169090
mov eax, 5
jmp 0x140169045
movzx edi, word [rsi + 0x14]
add rdi, 0x2c
mov qword [rsp + 0x118], rbx
movzx ebx, r13w
cmp r13w, word [rsi + 6]
jae 0x1401690d1
add rdi, rsi
nop
mov edx, dword [rdi]
mov ecx, dword [rdi - 8]
add rdx, r15
mov r8d, dword [rdi - 4]
add rcx, r12
call fcn.140168310
inc bx
lea rdi, [rdi + 0x28]
cmp bx, word [rsi + 6]
jb 0x1401690b0
mov r8, rsi
mov rdx, r12
mov ecx, r14d
call fcn.140168760
movzx ebx, word [rsi + 0x14]
movzx r14d, r13w
add rbx, 0x28
cmp r13w, word [rsi + 6]
jae 0x14016914c
add rbx, rsi
mov eax, dword [rbx]
test eax, eax
je 0x14016913d
test dword [rbx + 0x14], 0x2000000
je 0x14016913d
xor ecx, ecx
mov edx, eax
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov ecx, dword [rbx - 4]
mov rdx, rax
mov r8d, dword [rbx]
add rcx, r12
mov rdi, rax
call fcn.140168310
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
inc r14w
add rbx, 0x28
cmp r14w, word [rsi + 6]
jb 0x1401690f5
mov eax, dword [0x1405f98c8]
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov ecx, 6
movups xmmword [rbp - 0x19], xmm0
mov dword [rbp - 0x19], eax
mov qword [rbp - 0x11], r12
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
call fcn.140168120
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
xor ecx, ecx
mov dword [rbp - 9], r13d
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
lea rcx, [rbp - 1]
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov edx, dword [rbp + 3]
lea r9, [rbp - 9]
mov r8d, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov ecx, dword [rbp + 3]
xor eax, eax
mov rbx, qword [rsp + 0x118]
rep stosb byte [rdi], al
mov eax, 6
jmp 0x140169045
mov eax, 3
jmp 0x140169045
xor eax, eax
jmp 0x14016905d