Function at 0x140004dd0
Capabilities:
Enumerate gui resources
Find taskbar

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x78]
sub rsp, 0x178
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rsi, r9
mov rbx, r8
mov r14d, edx
mov r12, rcx
mov r15d, 0x10
cmp edx, 0x110
mov edx, r15d
jne 0x140004e25
mov rdi, r9
mov qword [r9], rcx
mov r8, r9
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
jmp 0x140004e2e
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rdi, rax
xor r13d, r13d
test rdi, rdi
je 0x140005813
mov r9, rsi
mov r8, rbx
mov edx, r14d
mov rcx, r12
call fcn.140029a18
mov eax, r14d
sub eax, 2
je 0x140005805
sub eax, 3
je 0x1400055e2
sub eax, 0xb
je 0x1400055d5
sub eax, 0x14
je 0x1400054a0
sub eax, 0x2a
je 0x14000541a
sub eax, 0xc2
je 0x140004faa
cmp eax, 1
je 0x140004eb8
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140005813
mov qword [rsp + 0x20], rsi
mov r9, rbx
mov r8d, r14d
mov rdx, r12
call fcn.140044fe0
test al, al
je 0x140005813
jmp 0x140004fa0
mov rax, rbx
shr rax, 0x10
test ax, ax
jne 0x140005813
movzx ecx, bx
sub ecx, 1
je 0x140004f98
sub ecx, 1
je 0x140004f8e
sub ecx, 6
je 0x140004f8e
sub ecx, 0xd
je 0x140004f98
cmp ecx, 0x6db
jne 0x140005813
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14d, 0x830
mov ecx, r14d
call fcn.140113d08
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140004f32
mov rcx, rax
call fcn.14000494c
jmp 0x140004f35
mov rax, r13
mov qword [rdi + 0x30], rax
mov rdx, rdi
lea rcx, [0x140004bb0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [rdi + 0x30]
test rbx, rbx
je 0x140004f88
mov rcx, qword [rbx + 0x800]
test rcx, rcx
je 0x140004f6a
call fcn.140113e18
mov qword [rbx + 0x800], r13
mov rcx, qword [rbx + 0x818]
test rcx, rcx
je 0x140004f7d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rdx, r14
mov rcx, rbx
call fcn.14012bc14
mov qword [rdi + 0x30], r13
jmp 0x140004fa0
mov rcx, rdi
call fcn.140005f7c
jmp 0x140004fa0
mov rcx, rdi
call fcn.140006a08
mov eax, 1
jmp 0x140005815
mov rcx, qword [0x14022a9e0]
call fcn.14001afe4
mov edx, 5
mov rcx, r12
call fcn.14004c800
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140004fdf
mov r9, qword [rdi + 0x18]
mov r8, qword [0x14022a9e8]
mov rdx, r12
call fcn.140044724
mov edx, 0xffffffec
mov rcx, qword [0x14022a9e8]
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
test al, 8
je 0x14000501a
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
mov rcx, r12
call qword [sym.imp.USER32.dll_SetWindowPos]
mov r9, qword [0x14022ab40]
mov esi, 1
mov r8d, esi
lea ebx, [rsi + 0x7f]
mov edx, ebx
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [0x14022ab48]
xor r8d, r8d
mov edx, ebx
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, qword [0x14022ab40]
lea edx, [rsi - 0xf]
mov rcx, r12
call qword [sym.imp.USER32.dll_SetClassLongPtrW]
mov eax, 0x501
mov ebx, r13d
cmp word [0x1401f11c0], ax
setae bl
mov edx, 0x965
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.USER32.dll_EnableWindow]
mov r8d, esi
mov edx, 0xc06
mov rcx, r12
call qword [sym.imp.USER32.dll_CheckDlgButton]
mov edx, 0x6ee
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r13, rax
mov qword [rdi + 8], rax
mov dword [rsp + 0x40], 7
and dword [rsp + 0x44], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x50], rax
lea r8d, [rsi + 0x1f]
mov r9d, r8d
mov ebx, 0x1036
mov edx, ebx
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8d, 0x4400
mov r9d, r8d
mov edx, ebx
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rdi + 0x38]
neg eax
sbb edx, edx
and edx, 0xf
add edx, 0x3c
xor r9d, r9d
mov r8d, r15d
mov rcx, qword [0x14022ab58]
call fcn.140082d40
mov dword [rsp + 0x48], eax
lea rdx, [0x1401771d0]
lea rcx, [rbp - 0x20]
call fcn.140004870
lea r9, [rsp + 0x40]
xor r8d, r8d
lea r14d, [rbx + 0x2b]
mov edx, r14d
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov r8d, r15d
lea edx, [rsi + 0x2c]
mov rcx, qword [0x14022ab58]
call fcn.140082d40
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x44], 2
lea rdx, str.Type
lea rcx, [rbp - 0x20]
call fcn.140004870
lea r9, [rsp + 0x40]
mov r8d, esi
mov edx, r14d
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov r8d, r15d
mov ebx, 0xc8
mov edx, ebx
mov rcx, qword [0x14022ab58]
call fcn.140082d40
mov dword [rsp + 0x48], eax
and dword [rsp + 0x44], 0
lea rdx, str.Title
lea rcx, [rbp - 0x20]
call fcn.140004870
lea r9, [rsp + 0x40]
lea r8d, [rsi + 1]
mov edx, r14d
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov r8d, r15d
lea edx, [rsi + 0x77]
mov rcx, qword [0x14022ab58]
call fcn.140082d40
mov dword [rsp + 0x48], eax
lea rdx, str.Image_name
lea rcx, [rbp - 0x20]
call fcn.140004870
lea r9, [rsp + 0x40]
lea r8d, [rsi + 2]
mov edx, r14d
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov r8d, r15d
mov edx, ebx
mov rcx, qword [0x14022ab58]
call fcn.140082d40
mov dword [rsp + 0x48], eax
lea rdx, str.Image_path
lea rcx, [rbp - 0x20]
call fcn.140004870
lea r9, [rsp + 0x40]
lea r8d, [rsi + 3]
mov edx, r14d
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov r8d, r15d
lea edx, [rsi + 0x59]
mov rcx, qword [0x14022ab58]
call fcn.140082d40
mov dword [rsp + 0x48], eax
lea rdx, str.HWND
lea rcx, [rbp - 0x20]
call fcn.140004870
lea r9, [rsp + 0x40]
lea r8d, [rsi + 4]
mov edx, r14d
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov r8d, r15d
mov edx, ebx
mov rcx, qword [0x14022ab58]
call fcn.140082d40
mov dword [rsp + 0x48], eax
lea rdx, str.Class
lea rcx, [rbp - 0x20]
call fcn.140004870
lea r9, [rsp + 0x40]
lea r8d, [rsi + 5]
mov edx, r14d
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14d, 0x830
mov ecx, r14d
call fcn.140113d08
mov qword [rsp + 0x78], rax
xor r15d, r15d
test rax, rax
je 0x1400052f7
mov rcx, rax
call fcn.14000494c
jmp 0x1400052fa
mov rax, r15
mov qword [rdi + 0x30], rax
lea rcx, str.CAttachDlg::AttachDlgEnumWin::Begin
call fcn.140104174
xor r9d, r9d
lea r8, str.Shell_TrayWnd
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
je 0x140005332
lea rdx, [rdi + 0x3c]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x140005336
mov dword [rdi + 0x3c], r15d
mov rdx, rdi
lea rcx, [0x140004bb0]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rcx, str.CAttachDlg::AttachDlgEnumWin::End
call fcn.140104174
mov rbx, qword [rdi + 0x30]
test rbx, rbx
je 0x140005391
mov rcx, qword [rbx + 0x800]
test rcx, rcx
je 0x140005373
call fcn.140113e18
mov qword [rbx + 0x800], r15
mov rcx, qword [rbx + 0x818]
test rcx, rcx
je 0x140005386
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rdx, r14
mov rcx, rbx
call fcn.14012bc14
mov qword [rdi + 0x30], r15
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
mov rcx, r12
call fcn.140004dd0
lea rdx, [rbp - 0x70]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowRect]
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x30], xmm0
mov r8, qword [0x14022a9e8]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.140027274
movups xmm0, xmmword [rax]
mov edx, dword [rbp - 0x64]
sub edx, dword [rbp - 0x6c]
mov r9d, dword [rbp - 0x68]
sub r9d, dword [rbp - 0x70]
movq r8, xmm0
shr r8, 0x20
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], edx
movd edx, xmm0
mov rcx, r12
call qword [sym.imp.USER32.dll_MoveWindow]
mov edx, esi
mov rcx, r12
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r13
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x140005813
test rsi, rsi
je 0x140005813
cmp qword [rsi + 8], 0x6ee
jne 0x140005813
cmp dword [rsi + 0x10], 0xfffffffd
jne 0x140005813
xor r9d, r9d
mov edx, 0x111
lea r8d, [r9 + 0x15]
mov rcx, r12
call qword [sym.imp.USER32.dll_PostMessageW]
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rbp - 0x30]
mov rcx, qword [0x14022a9e8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x140005813
xor r9d, r9d
mov edx, 0x200
lea r8d, [rdx + 2]
mov rcx, qword [0x14022a9e0]
call fcn.1400218cc
jmp 0x140005813
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x60], xmm1
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rsp + 0x78], xmm1
mov edx, 0x15
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, rax
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edi, 2
mov r9d, edi
lea r8, [rbp - 0x70]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, 0x965
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, rax
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, edi
lea r8, [rbp - 0x40]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, 0xc06
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, rax
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, edi
lea r8, [rsp + 0x78]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, 0x6ee
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, edi
lea r8, [rbp - 0x60]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x30], xmm1
lea rdx, [rbp - 0x50]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rbp - 0x30]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp - 0x60]
lea ecx, [rax + rax*8]
mov eax, dword [rbp - 0x68]
lea edx, [rcx + rax*4]
sub edx, dword [rbp - 0x28]
sub edx, dword [rbp - 0x50]
add edx, dword [rbp - 0x80]
add edx, dword [rbp - 0x38]
add edx, dword [rbp - 0x48]
mov dword [rsi + 0x18], edx
mov ecx, dword [rbp - 0x64]
mov eax, dword [rbp - 0x5c]
lea ecx, [rax + rcx*2]
lea eax, [rcx + rcx*2]
mov dword [rsi + 0x1c], eax
jmp 0x140005813
mov rcx, rdi
call fcn.140005f7c
jmp 0x140005813
lea rdx, [rbp - 0x70]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetClientRect]
mov edx, 0x6ee
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdi, rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov esi, 2
mov r9d, esi
lea r8, [rbp - 0x60]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
lea edx, [rsi + 0x13]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, rax
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, esi
lea r8, [rsp + 0x78]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, 0x965
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r14, rax
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, esi
lea r8, [rbp - 0x50]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, 0xc06
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r15, rax
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, esi
lea r8, [rbp - 0x40]
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov esi, dword [rbp - 0x60]
mov r8d, dword [rbp - 0x5c]
lea ecx, [r8 + r8*2]
mov edx, dword [rbp - 0x64]
sub edx, ecx
sub edx, dword [rbp - 0x7c]
lea eax, [rsi + rsi]
mov r9d, dword [rbp - 0x68]
sub r9d, eax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edx
mov edx, esi
mov rcx, rdi
call qword [sym.imp.USER32.dll_MoveWindow]
mov ebx, dword [rbp - 0x64]
sub ebx, dword [rbp - 0x7c]
sub ebx, dword [rbp - 0x5c]
mov edx, 0x6f0
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov dword [rsp + 0x28], r13d
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x80]
mov r8d, ebx
mov edx, esi
call qword [sym.imp.USER32.dll_MoveWindow]
mov edi, dword [rbp - 0x68]
sub edi, dword [rbp - 0x80]
sub edi, esi
mov ebx, dword [rbp - 0x64]
sub ebx, dword [rbp - 0x7c]
sub ebx, dword [rbp - 0x5c]
mov edx, 2
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov dword [rsp + 0x28], r13d
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x80]
mov r8d, ebx
mov edx, edi
call qword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [rbp - 0x80]
add ecx, esi
sub edi, ecx
mov ebx, dword [rbp - 0x64]
sub ebx, dword [rbp - 0x7c]
sub ebx, dword [rbp - 0x5c]
mov edx, 0x15
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov dword [rsp + 0x28], r13d
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x80]
mov r8d, ebx
mov edx, edi
call qword [sym.imp.USER32.dll_MoveWindow]
mov r9d, dword [rbp - 0x48]
lea eax, [r9 + rsi]
sub edi, eax
mov eax, dword [rbp - 0x7c]
mov ecx, dword [rbp - 0x44]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
sub ebx, dword [rbp - 0x7c]
sub ebx, dword [rbp - 0x5c]
add ebx, dword [rbp - 0x64]
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], ecx
mov r8d, ebx
mov edx, edi
mov rcx, r14
call qword [sym.imp.USER32.dll_MoveWindow]
mov r9d, dword [rbp - 0x38]
sub edi, r9d
sub edi, esi
mov dword [rsp + 0x28], r13d
mov eax, dword [rbp - 0x34]
mov dword [rsp + 0x20], eax
mov r8d, ebx
mov edx, edi
mov rcx, r15
call qword [sym.imp.USER32.dll_MoveWindow]
mov r9d, 0x485
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x140005813
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140005813
call fcn.140044ae0
xor eax, eax
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.14012bda0
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret