Function at 0x18001de80
Capabilities:
Enumerate gui resources

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4b8]
sub rsp, 0x590
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800b44b0]
xor rax, rsp
mov qword [rbp + 0x480], rax
mov r13, rcx
mov qword [rsp + 0x70], rcx
mov qword [rbp - 0x38], rcx
call fcn.18001c8c0
mov qword [rbp - 0x80], rax
lea rcx, [rbp - 0x60]
call fcn.18001aa00
nop
call fcn.18001f120
mov ebx, eax
xor edi, edi
mov word [rbp + 0x70], di
xor edx, edx
mov r8d, 0x1f2
lea rcx, [rbp + 0x72]
call fcn.180021c80
cmp qword [r13 + 0x18], 8
jb 0x18001df09
mov r9, qword [r13]
jmp 0x18001df0c
mov r9, r13
mov dword [rsp + 0x28], ebx
lea rax, str.SessionId
mov qword [rsp + 0x20], rax
lea r8, str.Name
lea rdx, str._s____s__and__s___d
lea rcx, [rbp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rdi
mov word [rbp - 0x30], di
or r12, 0xffffffffffffffff
cmp word [rbp + 0x70], di
jne 0x18001df5b
mov r8, rdi
jmp 0x18001df6c
lea rax, [rbp + 0x70]
mov r8, r12
inc r8
cmp word [rax + r8*2], di
jne 0x18001df62
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.1800046a0
nop
mov qword [rbp], rdi
mov qword [rbp + 8], rdi
mov qword [rbp + 8], 7
mov qword [rbp], rdi
mov word [rbp - 0x10], di
mov r8d, 9
lea rdx, str.ProcessId
lea rcx, [rbp - 0x10]
call fcn.1800046a0
nop
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x28], 7
mov qword [rbp + 0x20], rdi
mov word [rbp + 0x10], di
mov r8d, 0xe
lea rdx, str.ExecutablePath
lea rcx, [rbp + 0x10]
call fcn.1800046a0
nop
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdi
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.18001c210
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
movzx eax, byte [rsp + 0x30]
lea r9, [rbp + 0x30]
lea r8, [rbp - 0x10]
lea rcx, [rsp + 0x38]
mov byte [rsp + 0x20], al
call fcn.18001a850
nop
lea r9, [rbp - 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x60]
call fcn.18001b0e0
nop
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsi]
mov qword [rsi], rsi
mov qword [rsi + 8], rsi
mov qword [rsp + 0x40], rdi
cmp rbx, rsi
je 0x18001e086
xor r15d, r15d
nop dword [rax]
mov rdi, qword [rbx]
cmp qword [rbx + 0x28], 8
jb 0x18001e063
mov rcx, qword [rbx + 0x10]
call fcn.180022e04
mov qword [rbx + 0x28], 7
mov qword [rbx + 0x20], r15
mov word [rbx + 0x10], r15w
mov rcx, rbx
call fcn.180022e04
mov rbx, rdi
cmp rdi, rsi
jne 0x18001e050
xor edi, edi
mov rcx, rsi
call fcn.180022e04
nop
lea r9, [fcn.18005da90]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rbp - 0x10]
call fcn.180025370
nop
cmp qword [rbp - 0x18], 8
jb 0x18001e0b9
mov rcx, qword [rbp - 0x30]
call fcn.180022e04
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rdi
mov word [rbp - 0x30], di
xor r15b, r15b
mov dword [rsp + 0x48], r15d
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x68], 7
mov qword [rbp + 0x60], rdi
mov word [rbp + 0x50], di
xor r8d, r8d
lea rdx, [0x1800831e8]
lea rcx, [rbp + 0x50]
call fcn.1800046a0
nop
mov r14, qword [rsp + 0x50]
mov qword [rbp - 0x68], r14
mov rsi, qword [r14]
cmp rsi, r14
je 0x18001e714
lea rdx, [rsi + 0x10]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.18001a920
nop
test r15b, r15b
jne 0x18001e439
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x48], 7
mov qword [rbp + 0x40], rdi
mov word [rbp + 0x30], di
mov r8d, 9
lea rdx, str.ProcessId
lea rcx, [rbp + 0x30]
call fcn.1800046a0
nop
mov r13, qword [rsp + 0x38]
mov r9, qword [r13 + 8]
mov rbx, r13
mov rdi, qword [rbp + 0x48]
mov r11, qword [rbp + 0x40]
mov r15, qword [rbp + 0x30]
cmp byte [r9 + 0x19], 0
jne 0x18001e229
xor r13d, r13d
lea r14d, [r13 + 1]
nop dword [rax + rax]
lea rcx, [r9 + 0x20]
lea rdx, [rbp + 0x30]
cmp rdi, 8
cmovae rdx, r15
mov r10, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x18001e1ae
mov rcx, qword [rcx]
mov r8, r11
cmp r10, r11
cmovb r8, r10
test r8, r8
jmp 0x18001e1e1
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18001e1d5
add rcx, 2
add rdx, 2
dec r8
jmp 0x18001e1e1
mov r8d, r14d
cmp word [rcx], ax
cmovb r8d, r12d
jmp 0x18001e1e6
jne 0x18001e1c0
mov r8d, r13d
movsxd rax, r8d
test r8d, r8d
jne 0x18001e201
cmp r10, r11
jae 0x18001e1f8
mov eax, r12d
jmp 0x18001e201
mov eax, r13d
cmp r10, r11
setne al
test eax, eax
sets al
test al, al
je 0x18001e210
mov r9, qword [r9 + 0x10]
jmp 0x18001e216
mov rbx, r9
mov r9, qword [r9]
cmp byte [r9 + 0x19], r13b
je 0x18001e190
mov r14, qword [rbp - 0x68]
mov r13, qword [rsp + 0x38]
cmp rbx, r13
je 0x18001e2b3
lea rcx, [rbx + 0x20]
mov r9, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x18001e244
mov rcx, qword [rcx]
lea rdx, [rbp + 0x30]
cmp rdi, 8
cmovae rdx, r15
mov r8, r9
cmp r11, r9
cmovb r8, r11
test r8, r8
jmp 0x18001e287
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x18001e275
add rdx, 2
add rcx, 2
dec r8
jmp 0x18001e287
mov r8d, 1
cmp word [rdx], ax
cmovb r8d, r12d
xor r15d, r15d
jmp 0x18001e28f
jne 0x18001e260
xor r15d, r15d
mov r8d, r15d
movsxd rax, r8d
test r8d, r8d
jne 0x18001e2aa
cmp r11, r9
jae 0x18001e2a1
mov eax, r12d
jmp 0x18001e2aa
mov eax, r15d
cmp r11, r9
setne al
test eax, eax
sets al
test al, al
je 0x18001e2f5
lea rax, [rbp + 0x30]
mov qword [rsp + 0x68], rax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x68]
lea rdx, [0x1800ba8c7]
lea rcx, [rsp + 0x38]
call fcn.1800197a0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x38]
call fcn.18001a0f0
mov rbx, qword [rbp - 0x48]
mov eax, dword [rbx + 0x44]
xor edi, edi
mov qword [rbp - 0x78], rdi
mov dword [rbp - 0x70], eax
lea rdx, [rbp - 0x78]
lea rcx, [0x1800194c0]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x18001e32a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x18001e32a
mov rbx, qword [rbp - 0x78]
test rbx, rbx
jne 0x18001e32d
mov rbx, rdi
cmp qword [rbp + 0x48], 8
jb 0x18001e33d
mov rcx, qword [rbp + 0x30]
call fcn.180022e04
mov qword [rbp + 0x48], 7
mov qword [rbp + 0x40], rdi
mov word [rbp + 0x30], di
test rbx, rbx
je 0x18001e439
mov word [rbp + 0x270], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x272]
call fcn.180021c80
mov r8d, 0x104
lea rdx, [rbp + 0x270]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rdi
mov word [rbp - 0x30], di
cmp word [rbp + 0x270], 0
jne 0x18001e3ae
mov r8, rdi
jmp 0x18001e3cb
lea rax, [rbp + 0x270]
mov r8, r12
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001e3c0
lea rdx, [rbp + 0x270]
lea rcx, [rbp - 0x30]
call fcn.1800046a0
nop
mov qword [rsp + 0x20], 0x12
lea r9, str.Chrome_WidgetWin_1
mov r8, qword [rbp - 0x20]
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.180011f50
test eax, eax
sete bl
cmp qword [rbp - 0x18], 8
jb 0x18001e410
mov rcx, qword [rbp - 0x30]
call fcn.180022e04
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rdi
mov word [rbp - 0x30], di
mov r15d, dword [rsp + 0x48]
movzx r15d, r15b
test bl, bl
mov eax, 1
cmovne r15d, eax
mov dword [rsp + 0x48], r15d
cmp qword [rbp + 0x60], 0
jne 0x18001e64a
mov qword [rbp], rdi
mov qword [rbp + 8], rdi
mov qword [rbp + 8], 7
mov qword [rbp], rdi
mov word [rbp - 0x10], di
mov r8d, 0xe
lea rdx, str.ExecutablePath
lea rcx, [rbp - 0x10]
call fcn.1800046a0
nop
mov r13, qword [rsp + 0x38]
mov r9, qword [r13 + 8]
mov rbx, r13
mov rdi, qword [rbp + 8]
mov r11, qword [rbp]
mov r15, qword [rbp - 0x10]
cmp byte [r9 + 0x19], 0
jne 0x18001e539
xor r13d, r13d
lea r14d, [r13 + 1]
nop dword [rax]
lea rcx, [r9 + 0x20]
lea rdx, [rbp - 0x10]
cmp rdi, 8
cmovae rdx, r15
mov r10, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x18001e4be
mov rcx, qword [rcx]
mov r8, r11
cmp r10, r11
cmovb r8, r10
test r8, r8
jmp 0x18001e4f1
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18001e4e5
add rcx, 2
add rdx, 2
dec r8
jmp 0x18001e4f1
mov r8d, r14d
cmp word [rcx], ax
cmovb r8d, r12d
jmp 0x18001e4f6
jne 0x18001e4d0
mov r8d, r13d
movsxd rax, r8d
test r8d, r8d
jne 0x18001e511
cmp r10, r11
jae 0x18001e508
mov eax, r12d
jmp 0x18001e511
mov eax, r13d
cmp r10, r11
setne al
test eax, eax
sets al
test al, al
je 0x18001e520
mov r9, qword [r9 + 0x10]
jmp 0x18001e526
mov rbx, r9
mov r9, qword [r9]
cmp byte [r9 + 0x19], r13b
je 0x18001e4a0
mov r14, qword [rbp - 0x68]
mov r13, qword [rsp + 0x38]
cmp rbx, r13
je 0x18001e5c5
lea rcx, [rbx + 0x20]
mov r9, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x18001e554
mov rcx, qword [rcx]
lea rdx, [rbp - 0x10]
cmp rdi, 8
cmovae rdx, r15
mov r8, r9
cmp r11, r9
cmovb r8, r11
test r8, r8
jmp 0x18001e597
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x18001e585
add rdx, 2
add rcx, 2
dec r8
jmp 0x18001e597
mov r8d, 1
cmp word [rdx], ax
cmovb r8d, r12d
xor r15d, r15d
jmp 0x18001e59f
jne 0x18001e570
xor r15d, r15d
mov r8d, r15d
movsxd rax, r8d
test r8d, r8d
jne 0x18001e5ba
cmp r11, r9
jae 0x18001e5b1
mov eax, r12d
jmp 0x18001e5ba
mov eax, r15d
cmp r11, r9
setne al
test eax, eax
sets al
test al, al
je 0x18001e60c
jmp 0x18001e5c8
xor r15d, r15d
lea rax, [rbp - 0x10]
mov qword [rsp + 0x68], rax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x68]
lea rdx, [0x1800ba8c7]
lea rcx, [rsp + 0x38]
call fcn.1800197a0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.18001a0f0
mov rbx, qword [rsp + 0x78]
lea rdx, [rbx + 0x48]
lea rax, [rbp + 0x50]
cmp rax, rdx
je 0x18001e629
mov r9, r12
xor r8d, r8d
lea rcx, [rbp + 0x50]
call fcn.180004550
nop
cmp qword [rbp + 8], 8
jb 0x18001e639
mov rcx, qword [rbp - 0x10]
call fcn.180022e04
mov qword [rbp + 8], 7
mov qword [rbp], r15
mov word [rbp - 0x10], r15w
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rdi]
cmp rbx, rbx
jne 0x18001e688
mov rdx, qword [rdi + 8]
lea rcx, [rsp + 0x38]
call fcn.18001c450
mov rax, qword [rsp + 0x38]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x38]
mov qword [rax], rax
mov rax, qword [rsp + 0x38]
mov qword [rax + 0x10], rax
xor edi, edi
mov qword [rsp + 0x40], rdi
jmp 0x18001e6f4
cmp rbx, rdi
je 0x18001e6f2
nop dword [rax]
mov r8, rbx
cmp byte [rbx + 0x19], 0
jne 0x18001e6de
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x18001e6be
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x18001e6de
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x18001e6b0
jmp 0x18001e6de
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x18001e6db
cmp rbx, qword [rax + 0x10]
jne 0x18001e6db
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x18001e6c8
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.18001ca50
cmp rbx, rdi
jne 0x18001e690
xor edi, edi
mov rcx, qword [rsp + 0x38]
call fcn.180022e04
mov rsi, qword [rsi]
cmp rsi, r14
mov r15d, dword [rsp + 0x48]
jne 0x18001e112
mov r13, qword [rsp + 0x70]
cmp qword [rbp + 0x60], 0
je 0x18001eb0d
xor r14b, r14b
mov ebx, edi
lea rax, [rbp - 0x30]
mov qword [rsp + 0x60], rax
nop dword [rax]
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rdi
mov word [rbp - 0x30], di
mov r9, r12
xor r8d, r8d
mov rdx, r13
lea rcx, [rbp - 0x30]
call fcn.180004550
nop
lea rcx, [rbp - 0x30]
call fcn.18001bd50
test al, al
je 0x18001e774
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 4
jl 0x18001e730
jmp 0x18001e782
mov r14b, 1
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rdi
mov word [rbp - 0x30], di
cmp word [rbp + 0x70], 0
jne 0x18001e7a6
mov r12, rdi
jmp 0x18001e7bb
lea rax, [rbp + 0x70]
nop word [rax + rax]
inc r12
cmp word [rax + r12*2], 0
jne 0x18001e7b0
mov r8, r12
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.1800046a0
nop
mov qword [rbp], rdi
mov qword [rbp + 8], rdi
mov qword [rbp + 8], 7
mov qword [rbp], rdi
mov word [rbp - 0x10], di
mov r8d, 9
lea rdx, str.ProcessId
lea rcx, [rbp - 0x10]
call fcn.1800046a0
nop
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdi
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.18001c210
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
movzx eax, byte [rsp + 0x30]
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x10]
lea rcx, [rsp + 0x38]
mov byte [rsp + 0x20], al
call fcn.18001a850
nop
lea r9, [rbp - 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x60]
call fcn.18001b0e0
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x18001e887
lea rcx, [rsp + 0x50]
call fcn.18001c7a0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rbx]
mov qword [rsp + 0x50], rcx
mov qword [rbx], rdx
mov rcx, qword [rsp + 0x58]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x58], rax
mov qword [rbx + 8], rcx
lea rcx, [rbp - 0x78]
call fcn.18001c7a0
nop
mov rcx, qword [rbp - 0x78]
call fcn.180022e04
nop
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rdi]
mov qword [rdi], rdi
mov qword [rdi + 8], rdi
xor r12d, r12d
mov qword [rsp + 0x40], r12
cmp rbx, rdi
je 0x18001e8f4
nop word [rax + rax]
mov rsi, qword [rbx]
cmp qword [rbx + 0x28], 8
jb 0x18001e8d3
mov rcx, qword [rbx + 0x10]
call fcn.180022e04
mov qword [rbx + 0x28], 7
mov qword [rbx + 0x20], r12
mov word [rbx + 0x10], r12w
mov rcx, rbx
call fcn.180022e04
mov rbx, rsi
cmp rsi, rdi
jne 0x18001e8c0
mov rcx, rdi
call fcn.180022e04
nop
lea r9, [fcn.18005da90]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbp - 0x10]
call fcn.180025370
nop
cmp qword [rbp - 0x18], 8
jb 0x18001e927
mov rcx, qword [rbp - 0x30]
call fcn.180022e04
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r12
mov word [rbp - 0x30], r12w
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x18001ea60
nop dword [rax]
lea rdx, [rdi + 0x10]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.18001a920
nop
mov qword [rbp], r12
mov qword [rbp + 8], r12
mov qword [rbp + 8], 7
mov qword [rbp], r12
mov word [rbp - 0x10], r12w
mov r8d, 9
lea rdx, str.ProcessId
lea rcx, [rbp - 0x10]
call fcn.1800046a0
nop
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x38]
call fcn.18001c580
mov rbx, rax
cmp rax, qword [rsp + 0x38]
je 0x18001e9bd
lea rdx, [rax + 0x20]
lea rcx, [rbp - 0x10]
call fcn.18001c830
test eax, eax
jns 0x18001ea01
lea rax, [rbp - 0x10]
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x70]
lea rdx, [0x1800ba8c7]
lea rcx, [rsp + 0x38]
call fcn.1800197a0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.18001a0f0
mov rbx, qword [rsp + 0x78]
mov edx, dword [rbx + 0x44]
lea rcx, [rbp - 0x60]
call fcn.18001bea0
nop
cmp qword [rbp + 8], 8
jb 0x18001ea1e
mov rcx, qword [rbp - 0x10]
call fcn.180022e04
mov qword [rbp + 8], 7
mov qword [rbp], r12
mov word [rbp - 0x10], r12w
mov r8, qword [rsp + 0x38]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.18001c950
nop
mov rcx, qword [rsp + 0x38]
call fcn.180022e04
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x18001e950
test r14b, r14b
je 0x18001ea6d
cmp qword [rsp + 0x58], 0
je 0x18001ea78
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdi, qword [rbp - 0x80]
test r15b, r15b
je 0x18001eb14
mov ebx, r12d
nop dword [rax + rax]
mov edx, 0x3e8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18001eaab
inc ebx
cmp ebx, 0x1e
jl 0x18001ea90
jmp 0x18001eb14
lea rax, [rbp - 0x10]
mov qword [rsp + 0x60], rax
lea r8, [rbp + 0x50]
lea rdx, [0x18008690c]
lea rcx, [rbp - 0x30]
call fcn.180019610
nop
lea r8, str.____restore_last_session
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.180002f40
nop
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.18001aec0
nop
cmp qword [rbp - 0x18], 8
jb 0x18001eafa
mov rcx, qword [rbp - 0x30]
call fcn.180022e04
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r12
mov word [rbp - 0x30], r12w
jmp 0x18001eb14
mov rdi, qword [rbp - 0x80]
xor r12d, r12d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x68], 8
jb 0x18001eb2e
mov rcx, qword [rbp + 0x50]
call fcn.180022e04
mov qword [rbp + 0x68], 7
mov qword [rbp + 0x60], r12
mov word [rbp + 0x50], r12w
lea rcx, [rsp + 0x50]
call fcn.18001c7a0
nop
mov rcx, qword [rsp + 0x50]
call fcn.180022e04
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18001eb64
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x18001eb73
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
cmp qword [r13 + 0x18], 8
jb 0x18001eb8a
mov rcx, qword [r13]
call fcn.180022e04
mov qword [r13 + 0x18], 7
mov qword [r13 + 0x10], r12
mov word [r13], r12w
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.180022a00
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret