Function at 0x1403a9480
Capabilities:
Enumerate gui resources
Find taskbar
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x145ef49b8]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor edi, edi
lea rcx, [0x1403a9150]
xor edx, edx
mov dword [0x145f4deb4], edi
call qword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [rdi + 2]
call fcn.1403a9980
test eax, eax
je 0x1403a9758
lea rcx, str.MOM.exe
call fcn.1403a92d0
lea rcx, str.CCC.exe
call fcn.1403a92d0
lea rcx, str.RadeonSettings.exe
call fcn.1403a92d0
lea rcx, str.cnext.exe
call fcn.1403a92d0
lea ecx, [rdi + 0x64]
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1403a95d6
xor r9d, r9d
lea r8, str.TrayNotifyWnd
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExA]
test rax, rax
je 0x1403a95d6
xor r9d, r9d
lea r8, str.SysPager
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExA]
mov rbx, rax
test rax, rax
je 0x1403a95d6
lea r9, str.Notification_Area
xor edx, edx
lea r8, str.ToolbarWindow32
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExA]
test rax, rax
je 0x1403a9576
mov rcx, rax
call fcn.1403a93d0
lea r9, str.User_Promoted_Notification_Area
xor edx, edx
lea r8, str.ToolbarWindow32
mov rcx, rbx
call qword [sym.imp.USER32.dll_FindWindowExA]
test rax, rax
je 0x1403a959c
mov rcx, rax
call fcn.1403a93d0
xor edx, edx
lea rcx, str.NotifyIconOverflowWindow
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1403a95d6
lea r9, str.Overflow_Notification_Area
xor edx, edx
lea r8, str.ToolbarWindow32
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExA]
test rax, rax
je 0x1403a95d6
mov rcx, rax
call fcn.1403a93d0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
lea rdx, str.Stopped_driver
lea rcx, [0x145fdd430]
call fcn.140085720
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.1400c9320
movzx edx, al
mov rcx, rbx
call fcn.1400c72a0
mov rcx, rbx
call fcn.140089b00
mov ecx, 1
call fcn.1403a9980
test eax, eax
je 0x1403a9758
lea rcx, str.ShellExperienceHost.exe
call fcn.1403a92d0
lea rcx, str.SearchUI.exe
call fcn.1403a92d0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [0x145f4deb4], edi
jbe 0x1403a96ed
lea rbx, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rbx + rdi*8 + 0x5f4dec0]
mov eax, edi
imul rcx, rax, 0x2c
cmp dword [rcx + rbx + 0x5f61748], 1
jne 0x1403a96d0
movups xmm0, xmmword [rcx + rbx + 0x5f6175c]
mov dword [rsp + 0x30], 0x4000
mov rcx, r10
movq r8, xmm0
psrldq xmm0, 8
movq rdx, xmm0
mov r9, r8
mov rax, rdx
shr r9, 0x20
sub edx, r8d
shr rax, 0x20
sub eax, r9d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x1403a96e3
lea rdx, [rbx + 0x5f61740]
add rdx, rcx
mov rcx, r10
call qword [sym.imp.USER32.dll_SetWindowPlacement]
inc edi
cmp edi, dword [0x145f4deb4]
jb 0x1403a9670
movups xmm0, xmmword [str.cncmd.exe_restart]
mov eax, dword [reloc.WS2_32.dll_WSACleanup]
lea rcx, str.ProgramFiles
movups xmm1, xmmword [0x140936448]
mov dword [rsp + 0x60], eax
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
call fcn.140587c24
test rax, rax
je 0x1403a9746
mov rcx, rax
call fcn.1405891c0
test eax, eax
jne 0x1403a9746
lea rcx, str.AMDCNextCNext
call fcn.1405891c0
test eax, eax
jne 0x1403a9746
lea rcx, [rsp + 0x40]
call fcn.1403a9780
mov ecx, 0x64
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, 1
jmp 0x1403a975a
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140567130
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret