Function at 0x1400050c8
Capabilities:
Enumerate gui resources
Find taskbar

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x78]
sub rsp, 0x178
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rsi, r9
mov rbx, r8
mov r14d, edx
mov r12, rcx
cmp edx, 0x110
mov edx, 0x10
jne 0x140005119
mov rdi, r9
mov qword [r9], rcx
mov r8, r9
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
jmp 0x140005122
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rdi, rax
xor r13d, r13d
test rdi, rdi
je 0x140005b06
mov r9, rsi
mov r8, rbx
mov edx, r14d
mov rcx, r12
call fcn.14002b324
mov eax, r14d
lea r15d, [r13 + 2]
sub eax, r15d
je 0x140005af8
sub eax, 3
je 0x1400058d5
sub eax, 0xb
je 0x1400058c8
sub eax, 0x14
je 0x140005798
sub eax, 0x2a
je 0x140005712
sub eax, 0xc2
je 0x1400052a2
cmp eax, 1
je 0x1400051b0
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140005b06
mov qword [rsp + 0x20], rsi
mov r9, rbx
mov r8d, r14d
mov rdx, r12
call fcn.14004801c
test al, al
je 0x140005b06
jmp 0x140005298
mov rax, rbx
shr rax, 0x10
test ax, ax
jne 0x140005b06
movzx ecx, bx
sub ecx, 1
je 0x140005290
sub ecx, 1
je 0x140005286
sub ecx, 6
je 0x140005286
sub ecx, 0xd
je 0x140005290
cmp ecx, 0x6db
jne 0x140005b06
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14d, 0x830
mov ecx, r14d
call fcn.14011ff78
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14000522a
mov rcx, rax
call fcn.140004c44
jmp 0x14000522d
mov rax, r13
mov qword [rdi + 0x30], rax
mov rdx, rdi
lea rcx, [0x140004ea8]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [rdi + 0x30]
test rbx, rbx
je 0x140005280
mov rcx, qword [rbx + 0x800]
test rcx, rcx
je 0x140005262
call fcn.14012008c
mov qword [rbx + 0x800], r13
mov rcx, qword [rbx + 0x818]
test rcx, rcx
je 0x140005275
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rdx, r14
mov rcx, rbx
call fcn.140139990
mov qword [rdi + 0x30], r13
jmp 0x140005298
mov rcx, rdi
call fcn.14000626c
jmp 0x140005298
mov rcx, rdi
call fcn.140006cf0
mov eax, 1
jmp 0x140005b08
mov rcx, qword [0x14021c5d8]
call fcn.14001c6d8
mov edx, 5
mov rcx, r12
call fcn.14004fa74
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400052d7
mov r9, qword [rdi + 0x18]
mov r8, qword [0x14021c5e0]
mov rdx, r12
call fcn.1400476cc
mov edx, 0xffffffec
mov rcx, qword [0x14021c5e0]
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
test al, 8
je 0x140005312
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
mov rcx, r12
call qword [sym.imp.USER32.dll_SetWindowPos]
mov r9, qword [0x14021c730]
mov esi, 1
mov r8d, esi
lea ebx, [rsi + 0x7f]
mov edx, ebx
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [0x14021c738]
xor r8d, r8d
mov edx, ebx
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, qword [0x14021c730]
lea edx, [rsi - 0xf]
mov rcx, r12
call qword [sym.imp.USER32.dll_SetClassLongPtrW]
mov eax, 0x501
mov ebx, r13d
cmp word [0x1401e30e4], ax
setae bl
mov edx, 0x965
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.USER32.dll_EnableWindow]
mov r8d, esi
mov edx, 0xc06
mov rcx, r12
call qword [sym.imp.USER32.dll_CheckDlgButton]
mov edx, 0x6ee
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r15, rax
mov qword [rdi + 8], rax
mov qword [rsp + 0x40], 7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x50], rax
lea r8d, [rsi + 0x1f]
mov r9d, r8d
mov ebx, 0x1036
mov edx, ebx
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8d, 0x4400
mov r9d, r8d
mov edx, ebx
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rdi + 0x38]
neg eax
sbb edx, edx
and edx, 0xf
add edx, 0x3c
xor r9d, r9d
lea r14d, [rsi + 0x11]
mov r8d, r14d
mov rcx, qword [0x14021c748]
call int.14008b2a8
mov dword [rsp + 0x48], eax
lea rdx, [0x1401695d0]
lea rcx, [rbp - 0x20]
call fcn.140004b68
lea r9, [rsp + 0x40]
xor r8d, r8d
lea r13d, [rbx + 0x2b]
mov edx, r13d
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov r8d, r14d
lea edx, [rsi + 0x2c]
mov rcx, qword [0x14021c748]
call int.14008b2a8
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x44], 2
lea rdx, str.Type
lea rcx, [rbp - 0x20]
call fcn.140004b68
lea r9, [rsp + 0x40]
mov r8d, esi
mov edx, r13d
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov r8d, r14d
mov ebx, 0xc8
mov edx, ebx
mov rcx, qword [0x14021c748]
call int.14008b2a8
mov dword [rsp + 0x48], eax
and dword [rsp + 0x44], 0
lea rdx, str.Title
lea rcx, [rbp - 0x20]
call fcn.140004b68
lea r9, [rsp + 0x40]
lea r8d, [rsi + 1]
mov edx, r13d
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov r8d, r14d
lea edx, [rsi + 0x77]
mov rcx, qword [0x14021c748]
call int.14008b2a8
mov dword [rsp + 0x48], eax
lea rdx, str.Image_name
lea rcx, [rbp - 0x20]
call fcn.140004b68
lea r9, [rsp + 0x40]
lea r8d, [rsi + 2]
mov edx, r13d
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov r8d, r14d
mov edx, ebx
mov rcx, qword [0x14021c748]
call int.14008b2a8
mov dword [rsp + 0x48], eax
lea rdx, str.Image_path
lea rcx, [rbp - 0x20]
call fcn.140004b68
lea r9, [rsp + 0x40]
lea r8d, [rsi + 3]
mov edx, r13d
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov r8d, r14d
lea edx, [rsi + 0x59]
mov rcx, qword [0x14021c748]
call int.14008b2a8
mov dword [rsp + 0x48], eax
lea rdx, str.HWND
lea rcx, [rbp - 0x20]
call fcn.140004b68
lea r9, [rsp + 0x40]
lea r8d, [rsi + 4]
mov edx, r13d
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov r8d, r14d
mov edx, ebx
mov rcx, qword [0x14021c748]
call int.14008b2a8
mov dword [rsp + 0x48], eax
lea rdx, str.Class
lea rcx, [rbp - 0x20]
call fcn.140004b68
lea r9, [rsp + 0x40]
lea r8d, [rsi + 5]
mov edx, r13d
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14d, 0x830
mov ecx, r14d
call fcn.14011ff78
mov qword [rsp + 0x78], rax
xor r13d, r13d
test rax, rax
je 0x1400055ef
mov rcx, rax
call fcn.140004c44
jmp 0x1400055f2
mov rax, r13
mov qword [rdi + 0x30], rax
lea rcx, str.CAttachDlg::AttachDlgEnumWin::Begin
call fcn.140110564
xor r9d, r9d
lea r8, str.Shell_TrayWnd
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
je 0x14000562a
lea rdx, [rdi + 0x3c]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x14000562e
mov dword [rdi + 0x3c], r13d
mov rdx, rdi
lea rcx, [0x140004ea8]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rcx, str.CAttachDlg::AttachDlgEnumWin::End
call fcn.140110564
mov rbx, qword [rdi + 0x30]
test rbx, rbx
je 0x140005689
mov rcx, qword [rbx + 0x800]
test rcx, rcx
je 0x14000566b
call fcn.14012008c
mov qword [rbx + 0x800], r13
mov rcx, qword [rbx + 0x818]
test rcx, rcx
je 0x14000567e
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rdx, r14
mov rcx, rbx
call fcn.140139990
mov qword [rdi + 0x30], r13
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
mov rcx, r12
call fcn.1400050c8
lea rdx, [rbp - 0x70]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowRect]
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x30], xmm0
mov r8, qword [0x14021c5e0]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.140028928
movups xmm0, xmmword [rax]
mov edx, dword [rbp - 0x64]
sub edx, dword [rbp - 0x6c]
mov r9d, dword [rbp - 0x68]
sub r9d, dword [rbp - 0x70]
movq r8, xmm0
shr r8, 0x20
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edx
movd edx, xmm0
mov rcx, r12
call qword [sym.imp.USER32.dll_MoveWindow]
mov edx, esi
mov rcx, r12
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r15
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x140005b06
test rsi, rsi
je 0x140005b06
cmp qword [rsi + 8], 0x6ee
jne 0x140005b06
cmp dword [rsi + 0x10], 0xfffffffd
jne 0x140005b06
xor r9d, r9d
mov edx, 0x111
lea r8d, [r9 + 0x15]
mov rcx, r12
call qword [sym.imp.USER32.dll_PostMessageW]
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rbp - 0x30]
mov rcx, qword [0x14021c5e0]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x140005b06
xor r9d, r9d
mov edx, 0x200
lea r8d, [rdx + 2]
mov rcx, qword [0x14021c5d8]
call fcn.140022b58
jmp 0x140005b06
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x60], xmm1
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rsp + 0x78], xmm1
mov edx, 0x15
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, rax
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, r15d
lea r8, [rbp - 0x70]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, 0x965
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, rax
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, r15d
lea r8, [rbp - 0x40]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, 0xc06
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, rax
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, r15d
lea r8, [rsp + 0x78]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, 0x6ee
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, r15d
lea r8, [rbp - 0x60]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x30], xmm1
lea rdx, [rbp - 0x50]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rbp - 0x30]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp - 0x60]
lea ecx, [rax + rax*8]
mov eax, dword [rbp - 0x68]
lea edx, [rcx + rax*4]
sub edx, dword [rbp - 0x28]
sub edx, dword [rbp - 0x50]
add edx, dword [rbp - 0x80]
add edx, dword [rbp - 0x38]
add edx, dword [rbp - 0x48]
mov dword [rsi + 0x18], edx
mov ecx, dword [rbp - 0x64]
mov eax, dword [rbp - 0x5c]
lea ecx, [rax + rcx*2]
lea eax, [rcx + rcx*2]
mov dword [rsi + 0x1c], eax
jmp 0x140005b06
mov rcx, rdi
call fcn.14000626c
jmp 0x140005b06
lea rdx, [rbp - 0x70]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetClientRect]
mov edx, 0x6ee
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdi, rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, r15d
lea r8, [rbp - 0x60]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, 0x15
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, rax
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, r15d
lea r8, [rsp + 0x78]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, 0x965
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r14, rax
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, r15d
lea r8, [rbp - 0x50]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, 0xc06
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r15, rax
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, 2
lea r8, [rbp - 0x40]
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov esi, dword [rbp - 0x60]
mov r8d, dword [rbp - 0x5c]
lea ecx, [r8 + r8*2]
mov edx, dword [rbp - 0x64]
sub edx, ecx
sub edx, dword [rbp - 0x7c]
lea eax, [rsi + rsi]
mov r9d, dword [rbp - 0x68]
sub r9d, eax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edx
mov edx, esi
mov rcx, rdi
call qword [sym.imp.USER32.dll_MoveWindow]
mov ebx, dword [rbp - 0x64]
sub ebx, dword [rbp - 0x7c]
sub ebx, dword [rbp - 0x5c]
mov edx, 0x6f0
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov dword [rsp + 0x28], r13d
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x80]
mov r8d, ebx
mov edx, esi
call qword [sym.imp.USER32.dll_MoveWindow]
mov edi, dword [rbp - 0x68]
sub edi, dword [rbp - 0x80]
sub edi, esi
mov ebx, dword [rbp - 0x64]
sub ebx, dword [rbp - 0x7c]
sub ebx, dword [rbp - 0x5c]
mov edx, 2
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov dword [rsp + 0x28], r13d
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x80]
mov r8d, ebx
mov edx, edi
call qword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [rbp - 0x80]
add ecx, esi
sub edi, ecx
mov ebx, dword [rbp - 0x64]
sub ebx, dword [rbp - 0x7c]
sub ebx, dword [rbp - 0x5c]
mov edx, 0x15
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov dword [rsp + 0x28], r13d
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x80]
mov r8d, ebx
mov edx, edi
call qword [sym.imp.USER32.dll_MoveWindow]
mov r9d, dword [rbp - 0x48]
lea eax, [r9 + rsi]
sub edi, eax
mov eax, dword [rbp - 0x7c]
mov ecx, dword [rbp - 0x44]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
sub ebx, dword [rbp - 0x7c]
sub ebx, dword [rbp - 0x5c]
add ebx, dword [rbp - 0x64]
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], ecx
mov r8d, ebx
mov edx, edi
mov rcx, r14
call qword [sym.imp.USER32.dll_MoveWindow]
mov r9d, dword [rbp - 0x38]
sub edi, r9d
sub edi, esi
mov dword [rsp + 0x28], r13d
mov eax, dword [rbp - 0x34]
mov dword [rsp + 0x20], eax
mov r8d, ebx
mov edx, edi
mov rcx, r15
call qword [sym.imp.USER32.dll_MoveWindow]
mov r9d, 0x485
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x140005b06
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140005b06
call fcn.140047a98
xor eax, eax
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140139b10
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret