Function at 0x14006ffbc
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x90
mov rdi, rcx
mov r13, r9
mov rcx, r9
mov rbx, r8
mov rsi, rdx
call fcn.14000403c
lea rcx, [rdi + 0x158]
call fcn.14000403c
movzx eax, byte [rbp + 0x7f]
lea r15, [rdi + 0x18]
mov byte [rdi + 8], al
movzx eax, byte [rbp + 0x77]
mov byte [rdi + 9], al
cmp r15, rsi
je 0x14007001a
mov rdx, rsi
mov rcx, r15
call fcn.140009694
lea r12, [rdi + 0x38]
cmp r12, rbx
je 0x14007002e
mov rdx, rbx
mov rcx, r12
call fcn.140009694
lea r14, [0x1400b52d0]
mov rdx, r14
lea rcx, [rdi + 0x118]
call fcn.1400092ac
mov eax, dword [rbp + 0x67]
lea rcx, [rbp - 0x19]
mov dword [rdi + 0x14], eax
mov esi, 1
xor eax, eax
mov qword [rdi + 0x138], rsi
mov dword [rdi + 0xc], eax
mov dword [rdi + 0x150], eax
mov byte [rdi + 0x10], sil
call fcn.140008ce8
lea rcx, [rbp - 0x59]
call fcn.140008ce8
lea rcx, [rbp - 0x39]
call fcn.140008ce8
mov eax, dword [rdi + 0x14]
test eax, eax
jns 0x140070095
mov ecx, eax
call fcn.1400364dc
mov dword [rdi + 0x14], eax
mov byte [rdi + 0x10], 0
cmp eax, 4
jne 0x1400700a5
mov rdx, r15
call fcn.14006fbdc
mov dword [rdi + 0x14], esi
cmp qword [rdi + 0x20], 0
jne 0x1400700b7
cmp qword [rdi + 0x40], 0
je 0x140070220
xor edx, edx
mov rcx, r15
call fcn.1400090b8
cmp word [rax], 0x5b
jne 0x1400706f4
mov rdx, qword [rdi + 0x20]
mov rcx, r15
dec rdx
call fcn.1400090b8
cmp word [rax], 0x5d
jne 0x1400706f4
mov rax, qword [rdi + 0x20]
sub rax, 2
mov qword [rbp + 0x4f], rsi
mov qword [rbp + 0x47], rax
lea r9, [rbp + 0x4f]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x59]
mov rcx, r15
lea rdx, [rbp - 0x19]
lea rbx, str.LAST
call fcn.14006fe20
test al, al
je 0x1400706f0
mov rcx, rbx
call fcn.1400272dc
mov rbx, qword [rbp - 0x11]
mov r12, qword [rbp - 0x19]
cmp rbx, rax
jne 0x1400701ab
lea rax, str.LAST
mov rdx, rbx
mov rcx, rax
test rbx, rbx
je 0x14007015c
mov r8, r12
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400701ab
add rcx, 2
sub rdx, rsi
jne 0x140070149
mov rcx, r14
call fcn.1400272dc
mov rcx, qword [rbp - 0x51]
cmp rcx, rax
jne 0x1400706e8
test rcx, rcx
je 0x140070195
mov rdx, qword [rbp - 0x59]
sub rdx, r14
movzx eax, word [r14]
cmp word [rdx + r14], ax
jne 0x1400706e8
add r14, 2
sub rcx, rsi
jne 0x14007017d
mov rax, qword [rdi]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14007029a
xor esi, esi
jmp 0x1400707d2
lea rcx, str.ACTIVE
call fcn.1400272dc
cmp rbx, rax
jne 0x14007022b
lea rax, str.ACTIVE
mov rdx, rbx
mov rcx, rax
test rbx, rbx
je 0x1400701e7
mov r8, r12
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x14007022b
add rcx, 2
sub rdx, rsi
jne 0x1400701d4
mov rcx, r14
call fcn.1400272dc
mov rcx, qword [rbp - 0x51]
cmp rcx, rax
jne 0x1400706e8
test rcx, rcx
je 0x140070220
mov rdx, qword [rbp - 0x59]
sub rdx, r14
movzx eax, word [r14]
cmp word [rdx + r14], ax
jne 0x1400706e8
add r14, 2
sub rcx, rsi
jne 0x140070208
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
jmp 0x14007028c
lea rcx, [0x1400db310]
call fcn.1400272dc
cmp rbx, rax
jne 0x1400702af
lea rax, [0x1400db310]
mov rdx, rbx
mov rcx, rax
test rbx, rbx
je 0x140070267
mov r8, r12
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400702af
add rcx, 2
sub rdx, rsi
jne 0x140070254
mov rcx, qword [rbp - 0x59]
lea rdx, [rbp + 0x47]
call fcn.14007ccf4
mov rbx, qword [rbp + 0x47]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400701a4
mov rdx, rbx
mov rcx, rdi
call fcn.140070d28
mov rax, qword [rdi]
mov rcx, qword [rax]
mov qword [rbp + 0x47], rcx
lea rdx, [rbp + 0x47]
mov rcx, r13
call fcn.1400768f0
jmp 0x1400707d2
lea rcx, str.REGEXPTITLE
call fcn.1400272dc
cmp rbx, rax
jne 0x140070325
lea rax, str.REGEXPTITLE
mov rdx, rbx
mov rcx, rax
test rbx, rbx
je 0x1400702eb
mov r8, r12
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140070325
add rcx, 2
sub rdx, rsi
jne 0x1400702d8
mov eax, dword [rdi + 0xc]
test sil, al
jne 0x1400706d4
or eax, 2
lea rcx, [rdi + 0x58]
mov dword [rdi + 0xc], eax
call fcn.140008530
lea rdx, [rbp - 0x59]
lea rcx, [rdi + 0x58]
call fcn.1400085c4
test eax, eax
je 0x14007068f
mov esi, 0xfffffffe
jmp 0x1400707d2
lea rcx, str.CLASS
call fcn.1400272dc
cmp rbx, rax
jne 0x140070385
lea rax, str.CLASS
mov rdx, rbx
mov rcx, rax
test rbx, rbx
je 0x140070361
mov r8, r12
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140070385
add rcx, 2
sub rdx, rsi
jne 0x14007034e
or dword [rdi + 0xc], 8
lea rax, [rbp - 0x59]
lea rbx, [rdi + 0x118]
cmp rbx, rax
mov rax, qword [rbp + 0x47]
je 0x1400700f4
mov rcx, rbx
jmp 0x140070686
lea rcx, str.REGEXPCLASS
call fcn.1400272dc
cmp rbx, rax
jne 0x1400703f2
lea rax, str.REGEXPCLASS
mov rdx, rbx
mov rcx, rax
test rbx, rbx
je 0x1400703c1
mov r8, r12
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400703f2
add rcx, 2
sub rdx, rsi
jne 0x1400703ae
or dword [rdi + 0xc], 0x10
lea rcx, [rdi + 0xb8]
call fcn.140008530
lea rdx, [rbp - 0x59]
lea rcx, [rdi + 0xb8]
call fcn.1400085c4
test eax, eax
jne 0x14007031b
mov rax, qword [rbp + 0x47]
jmp 0x1400700f4
lea rcx, str.XYWH
call fcn.1400272dc
cmp rbx, rax
jne 0x14007044d
lea rax, str.XYWH
mov rdx, rbx
mov rcx, rax
test rbx, rbx
je 0x14007042e
mov r8, r12
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x14007044d
add rcx, 2
sub rdx, rsi
jne 0x14007041b
or dword [rdi + 0xc], 0x80
mov rcx, qword [rbp - 0x59]
call fcn.140028d90
mov dword [rdi + 0x140], eax
mov rax, qword [rbp + 0x47]
jmp 0x1400700f4
lea rcx, [0x1400db1e0]
call fcn.1400272dc
cmp rbx, rax
jne 0x1400704a8
lea rax, [0x1400db1e0]
mov rdx, rbx
mov rcx, rax
test rbx, rbx
je 0x140070489
mov r8, r12
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400704a8
add rcx, 2
sub rdx, rsi
jne 0x140070476
or dword [rdi + 0xc], 0x100
mov rcx, qword [rbp - 0x59]
call fcn.140028d90
mov dword [rdi + 0x144], eax
mov rax, qword [rbp + 0x47]
jmp 0x1400700f4
lea rcx, [0x1400db1e4]
call fcn.1400272dc
cmp rbx, rax
jne 0x140070503
lea rax, [0x1400db1e4]
mov rdx, rbx
mov rcx, rax
test rbx, rbx
je 0x1400704e4
mov r8, r12
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140070503
add rcx, 2
sub rdx, rsi
jne 0x1400704d1
or dword [rdi + 0xc], 0x200
mov rcx, qword [rbp - 0x59]
call fcn.140028d90
mov dword [rdi + 0x148], eax
mov rax, qword [rbp + 0x47]
jmp 0x1400700f4
lea rcx, [0x1400db1e8]
call fcn.1400272dc
cmp rbx, rax
jne 0x14007055e
lea rax, [0x1400db1e8]
mov rdx, rbx
mov rcx, rax
test rbx, rbx
je 0x14007053f
mov r8, r12
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x14007055e
add rcx, 2
sub rdx, rsi
jne 0x14007052c
or dword [rdi + 0xc], 0x400
mov rcx, qword [rbp - 0x59]
call fcn.140028d90
mov dword [rdi + 0x14c], eax
mov rax, qword [rbp + 0x47]
jmp 0x1400700f4
lea rcx, str.INSTANCE
call fcn.1400272dc
cmp rbx, rax
jne 0x1400705b6
lea rax, str.INSTANCE
mov rdx, rbx
mov rcx, rax
test rbx, rbx
je 0x14007059a
mov r8, r12
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400705b6
add rcx, 2
sub rdx, rsi
jne 0x140070587
or dword [rdi + 0xc], 0x20
mov rcx, qword [rbp - 0x59]
call fcn.140028d90
mov dword [rdi + 0x138], eax
mov rax, qword [rbp + 0x47]
jmp 0x1400700f4
lea rcx, [0x1400db2f8]
call fcn.1400272dc
cmp rbx, rax
jne 0x14007063a
lea rax, [0x1400db2f8]
mov rdx, rbx
mov rcx, rax
test rbx, rbx
je 0x1400705f2
mov r8, r12
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x14007063a
add rcx, 2
sub rdx, rsi
jne 0x1400705df
mov rcx, r14
call fcn.1400272dc
mov rdx, qword [rbp - 0x51]
cmp rdx, rax
jne 0x1400706e8
mov rcx, r14
test rdx, rdx
je 0x14007062d
mov r8, qword [rbp - 0x59]
sub r8, r14
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400706e8
add rcx, 2
sub rdx, rsi
jne 0x140070616
or dword [rdi + 0xc], 0x40
mov rax, qword [rbp + 0x47]
jmp 0x1400700f4
lea rcx, str.TITLE
call fcn.1400272dc
cmp rbx, rax
jne 0x140070698
lea rax, str.TITLE
mov rdx, rbx
mov rcx, rax
test rbx, rbx
je 0x140070676
mov r8, r12
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140070698
add rcx, 2
sub rdx, rsi
jne 0x140070663
mov eax, dword [rdi + 0xc]
test al, 2
jne 0x1400706de
or eax, esi
lea rcx, [rbp - 0x39]
mov dword [rdi + 0xc], eax
lea rdx, [rbp - 0x59]
call fcn.140009694
mov rax, qword [rbp + 0x47]
jmp 0x1400700f4
mov rcx, r14
call fcn.1400272dc
cmp rbx, rax
jne 0x1400706e8
mov rax, qword [rbp + 0x47]
mov rcx, r14
test rbx, rbx
je 0x1400700f4
sub r12, r14
movzx eax, word [rcx]
cmp word [r12 + rcx], ax
jne 0x1400706e8
add rcx, 2
sub rbx, rsi
jne 0x1400706b8
mov rax, qword [rbp + 0x47]
jmp 0x1400700f4
mov esi, 0xfffffffd
jmp 0x1400707d2
mov esi, 0xfffffffc
jmp 0x1400707d2
or esi, 0xffffffff
jmp 0x1400707d2
lea r12, [rdi + 0x38]
cmp qword [rbp - 0x31], 0
je 0x140070710
lea rax, [rbp - 0x39]
cmp r15, rax
je 0x140070710
lea rdx, [rbp - 0x39]
mov rcx, r15
call fcn.140009694
mov eax, dword [rdi + 0xc]
test eax, eax
jne 0x14007071c
mov dword [rdi + 0xc], esi
mov eax, esi
or eax, 4
cmp byte [rdi + 0x10], 0
mov dword [rdi + 0xc], eax
jne 0x140070742
mov rcx, r12
call fcn.14000958c
mov edx, dword [r12 + 8]
mov rcx, qword [r12]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [rdi + 0xc]
test sil, al
je 0x140070762
cmp byte [rdi + 0x10], 0
jne 0x140070762
mov rcx, r15
call fcn.14000958c
mov edx, dword [r15 + 8]
mov rcx, qword [r15]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
cmp byte [rbp + 0x6f], 0
je 0x140070783
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r8, rdi
lea rdx, [0x14007080c]
mov rcx, rax
call qword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x140070793
mov rdx, rdi
lea rcx, [0x14007080c]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rdi + 0x158]
mov rcx, r13
call fcn.14006fb18
lea rcx, [rdi + 0x158]
call fcn.14000403c
mov eax, dword [rdi + 0x150]
cmp eax, esi
jl 0x1400707d0
mov rax, qword [r13 + 8]
mov rcx, rdi
mov rdx, qword [rax]
mov rdx, qword [rdx]
call fcn.140070d28
mov eax, dword [rdi + 0x150]
mov esi, eax
lea rcx, [rbp - 0x39]
call fcn.1400079ac
lea rcx, [rbp - 0x59]
call fcn.1400079ac
lea rcx, [rbp - 0x19]
call fcn.1400079ac
mov rbx, qword [rsp + 0xe0]
mov eax, esi
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret