Function at 0x180028eb0
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x150], rax
call fcn.180028770
test al, al
je 0x18002912d
lea rcx, [0x1800ec6b0]
call fcn.1800585d0
test al, al
jne 0x180028f78
lea rcx, [0x1800ec650]
call fcn.1800585d0
test al, al
je 0x180028f15
call fcn.180058230
test al, al
sete al
jmp 0x180028f5e
lea rcx, [0x1800ec770]
call fcn.1800585d0
test al, al
je 0x180028f31
call fcn.180058280
test al, al
sete al
jmp 0x180028f5e
lea rcx, [0x1800ec710]
call fcn.1800585d0
test al, al
je 0x180028f64
lea rcx, [rsp + 0x90]
call fcn.180011860
mov qword [rsp + 0x70], rax
cmp dword [rax + 0xc], 7
je 0x180028f78
call fcn.180058230
mov byte [rsp + 0x20], al
jmp 0x180028f70
lea rcx, [0x1800ec7d0]
call fcn.1800585d0
test al, al
je 0x18002912d
lea rcx, [0x1800ec650]
call fcn.1800585d0
test al, al
je 0x180028f93
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
call fcn.180029170
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
or rdi, 0xffffffffffffffff
cmp word [rax], bx
jne 0x180028fdf
mov r8d, ebx
jmp 0x180028fec
mov r8, rdi
inc r8
cmp word [rax + r8*2], bx
jne 0x180028fe2
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1800125e0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.180071da0
nop
cmp qword [rsp + 0x48], 8
jb 0x18002901f
mov rcx, qword [rsp + 0x30]
call fcn.18008b860
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
lea rcx, [rsp + 0xb0]
call fcn.180011a60
nop
call fcn.1800480e0
mov dl, 1
mov ecx, 0x2718
call fcn.18002a6e0
lea rcx, [0x1800ec650]
call fcn.1800585d0
test al, al
je 0x18002907f
xor edx, edx
lea rcx, [0x180059540]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x180059540]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x180029096
mov rcx, rbx
mov qword [rsp + 0x50], rbx
jmp 0x18002909e
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.1800491e0
nop
cmp qword [rsp + 0xc8], 8
jb 0x1800290c5
mov rcx, qword [rsp + 0xb0]
call fcn.18008b860
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0xb0], bx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x18002912d
mov qword [rsp + 0x28], rcx
mov eax, edi
lock xadd dword [rcx + 8], eax
dec eax
jne 0x18002912d
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x18002912d
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
call fcn.180061eb0
mov rcx, qword [0x1800ec5b8]
test rcx, rcx
je 0x180029147
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800ad850
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret