Function at 0xc9a550
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rbx
sub rsp, 0xb8
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], 0
nop
lea rcx, [0x00c840d0]
call fcn.00414eb0
nop
call fcn.00406f90
cmp eax, 2
jl 0xc9a868
lea rcx, [rbp + 0xa0]
mov edx, 1
call fcn.00407020
lea rcx, [rbp + 0xa8]
mov rdx, qword [rbp + 0xa0]
call fcn.0042fef0
lea rcx, [0x00d609d8]
mov rdx, qword [rbp + 0xa8]
call fcn.0040e970
lea rcx, [0x00d609e0]
mov edx, 2
call fcn.00407020
lea rcx, [rbp + 0x98]
lea rdx, [0x00c9ae8c]
call fcn.0042fef0
mov rcx, qword [0x00d609d8]
mov rdx, qword [rbp + 0x98]
call fcn.00410620
test eax, eax
jne 0xc9a6f2
mov rcx, qword [0x00d609e0]
call fcn.00bdfa20
test al, al
jne 0xc9a6ae
lea rcx, [0x00c9aeb4]
lea rdx, [0x00c9af54]
xor r8, r8
call fcn.004449b0
jmp 0xc9a6de
lea rcx, [rbp + 0x90]
lea rdx, [0x00c9af7c]
mov r8, qword [0x00d609e0]
call fcn.00410420
mov rcx, qword [rbp + 0x90]
lea rdx, [0x00c9afe8]
xor r8, r8
call fcn.00444890
mov rax, qword [0x00d516f0]
mov rcx, qword [rax]
call fcn.006f3ae0
jmp 0xc9a95c
lea rcx, [rbp + 0x88]
lea rdx, [0x00c9b01c]
call fcn.0042fef0
mov rcx, qword [0x00d609d8]
mov rdx, qword [rbp + 0x88]
call fcn.00410620
test eax, eax
jne 0xc9a788
mov rcx, qword [0x00d609e0]
call fcn.00bdfce0
test al, al
jne 0xc9a744
lea rcx, [0x00c9aeb4]
lea rdx, [0x00c9af54]
xor r8, r8
call fcn.004449b0
jmp 0xc9a774
lea rcx, [rbp + 0x80]
lea rdx, [0x00c9af7c]
mov r8, qword [0x00d609e0]
call fcn.00410420
mov rcx, qword [rbp + 0x80]
lea rdx, [0x00c9afe8]
xor r8, r8
call fcn.00444890
mov rax, qword [0x00d516f0]
mov rcx, qword [rax]
call fcn.006f3ae0
jmp 0xc9a95c
lea rcx, [rbp + 0x78]
lea rdx, [0x00c9b04c]
call fcn.0042fef0
mov rcx, qword [0x00d609d8]
mov rdx, qword [rbp + 0x78]
call fcn.00410620
test eax, eax
jne 0xc9a7f6
mov rcx, qword [0x00d609e0]
call fcn.00bdffe0
lea rcx, [rbp + 0x70]
lea rdx, [0x00c9b078]
mov r8, qword [0x00d609e0]
call fcn.00410420
mov rcx, qword [rbp + 0x70]
lea rdx, [0x00c9afe8]
xor r8, r8
call fcn.00444890
mov rax, qword [0x00d516f0]
mov rcx, qword [rax]
call fcn.006f3ae0
jmp 0xc9a95c
lea rcx, [rbp + 0x68]
lea rdx, [0x00c9b0ec]
call fcn.0042fef0
mov rcx, qword [0x00d609d8]
mov rdx, qword [rbp + 0x68]
call fcn.00410620
test eax, eax
jne 0xc9a95c
mov rcx, qword [0x00d609e0]
call fcn.00be0220
lea rcx, [rbp + 0x60]
lea rdx, [0x00c9b078]
mov r8, qword [0x00d609e0]
call fcn.00410420
mov rcx, qword [rbp + 0x60]
lea rdx, [0x00c9afe8]
xor r8, r8
call fcn.00444890
mov rax, qword [0x00d516f0]
mov rcx, qword [rax]
call fcn.006f3ae0
jmp 0xc9a95c
call fcn.00406f90
cmp eax, 1
jne 0xc9a95c
lea rcx, [rbp + 0x50]
mov edx, 1
call fcn.00407020
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.0042fef0
lea rcx, [0x00d609d8]
mov rdx, qword [rbp + 0x58]
call fcn.0040e970
lea rcx, [rbp + 0x48]
lea rdx, [0x00c9b124]
call fcn.0042fef0
mov rcx, qword [0x00d609d8]
mov rdx, qword [rbp + 0x48]
call fcn.00410620
test eax, eax
jne 0xc9a90e
call fcn.00bdf900
test al, al
jne 0xc9a8e7
lea rcx, [0x00c9b150]
lea rdx, [0x00c9af54]
xor r8, r8
call fcn.004449b0
jmp 0xc9a8fd
lea rcx, [0x00c9b1f0]
lea rdx, [0x00c9afe8]
xor r8, r8
call fcn.00444890
mov rax, qword [0x00d516f0]
mov rcx, qword [rax]
call fcn.006f3ae0
jmp 0xc9a95c
lea rcx, [rbp + 0x40]
lea rdx, [0x00c9b240]
call fcn.0042fef0
mov rcx, qword [0x00d609d8]
mov rdx, qword [rbp + 0x40]
call fcn.00410620
test eax, eax
jne 0xc9a95c
call fcn.00bdf890
lea rcx, [0x00c9b270]
lea rdx, [0x00c9afe8]
xor r8, r8
call fcn.00444890
mov rax, qword [0x00d516f0]
mov rcx, qword [rax]
call fcn.006f3ae0
xor rcx, rcx
xor rdx, rdx
lea r8, [0x00c9b2bc]
call fcn.0041ab40
mov rcx, qword [0x00d510d0]
mov qword [rcx], rax
mov rax, qword [0x00d510d0]
cmp qword [rax], 0
je 0xc9a996
call sub.kernel32.dll_GetLastError_2
cmp eax, 0xb7
jne 0xc9aa89
mov ecx, 0x1f4
call sub.kernel32.dll_Sleep_2
lea rcx, [rbp + 0x38]
mov edx, 1
call fcn.00407020
cmp qword [rbp + 0x38], 0
je 0xc9aa84
mov qword [0x00d609e8], 0
lea rcx, [0x00c83ef0]
xor rdx, rdx
call sub.user32.dll_EnumWindows
cmp qword [0x00d609e8], 0
je 0xc9aa84
lea rcx, [0x00d609f0]
mov edx, 1
call fcn.00407020
mov rcx, qword [0x00d609e8]
call sub.user32.dll_SetForegroundWindow
xor rax, rax
cmp qword [0x00d609f0], 0
je 0xc9aa18
mov rax, qword [0x00d609f0]
mov eax, dword [rax - 4]
lea rcx, [0x00d609f0]
mov edx, eax
add edx, edx
call fcn.00410250
mov qword [0x00d609f8], 0
xor rax, rax
cmp qword [0x00d609f0], 0
je 0xc9aa4a
mov rax, qword [0x00d609f0]
mov eax, dword [rax - 4]
add eax, eax
mov dword [0x00d60a00], eax
mov rcx, qword [0x00d609f0]
call fcn.0040ffc0
mov qword [0x00d60a08], rax
mov rcx, qword [0x00d609e8]
mov edx, 0x4a
xor r8, r8
lea r9, [0x00d609f8]
movsxd r9, r9d
call sub.user32.dll_SendMessageW
call fcn.0040de20
call fcn.00406f90
cmp eax, 1
jle 0xc9ab01
lea rcx, [rbp + 0x28]
mov edx, 1
call fcn.00407020
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
call fcn.00432c50
lea rcx, [0x00d609f0]
mov rdx, qword [rbp + 0x30]
call fcn.0040e970
lea rcx, [0x00c9b300]
mov dl, 1
call fcn.00c0c410
test al, al
je 0xc9ab01
mov rcx, qword [0x00d609f0]
mov dl, 1
call fcn.00431ee0
test al, al
je 0xc9ab01
mov rcx, qword [0x00d513c8]
mov rdx, qword [0x00d609f0]
call fcn.0040e970
mov rax, qword [0x00d513c8]
mov byte [rax + 8], 1
mov rax, qword [0x00d51ef0]
mov qword [rax], 0
mov rax, qword [0x00d516f0]
mov rcx, qword [rax]
call fcn.006f3730
mov rax, qword [0x00d516f0]
mov rcx, qword [rax]
mov dl, 1
call fcn.006f6230
mov rax, qword [0x00d516f0]
mov rcx, qword [rax]
mov rdx, qword [0x00c4f530]
mov r8, qword [0x00d50df8]
call fcn.006f3760
mov rax, qword [0x00d516f0]
mov rcx, qword [rax]
mov rdx, qword [0x00bff700]
mov r8, qword [0x00d512a8]
call fcn.006f3760
mov rax, qword [0x00d51ef0]
cmp qword [rax], 0
jne 0xc9ab93
mov rax, qword [0x00d516f0]
mov rcx, qword [rax]
mov rdx, qword [0x00be31b0]
mov r8, qword [0x00d51ef0]
call fcn.006f3760
mov rax, qword [0x00d516f0]
mov rcx, qword [rax]
mov rdx, qword [0x00bee420]
mov r8, qword [0x00d51518]
call fcn.006f3760
mov rax, qword [0x00d50cf8]
cmp qword [rax], 0
je 0xc9abf3
mov rax, qword [0x00d51ce8]
mov rcx, qword [rax + 0xc8]
mov dl, 1
call fcn.00431ee0
test al, al
je 0xc9abf3
mov rax, qword [0x00d50cf8]
mov rcx, qword [rax]
mov rax, qword [0x00d51ce8]
mov rdx, qword [rax + 0xc8]
call fcn.0074d890
mov rax, qword [0x00d50df8]
mov rcx, qword [rax]
call fcn.00c5e710
mov rax, qword [0x00d51518]
mov rcx, qword [rax]
call fcn.00bf1010
mov rax, qword [0x00d51e90]
cmp qword [rax], 0
je 0xc9ac2d
mov rax, qword [0x00d51e90]
mov rcx, qword [rax]
call fcn.00a64e70
mov rax, qword [0x00d51b60]
cmp qword [rax], 0
je 0xc9ac49
mov rax, qword [0x00d51b60]
mov rcx, qword [rax]
call fcn.00a65fd0
mov rax, qword [0x00d51e80]
cmp qword [rax], 0
je 0xc9ac65
mov rax, qword [0x00d51e80]
mov rcx, qword [rax]
call fcn.00bac830
mov rax, qword [0x00d51790]
cmp qword [rax], 0
je 0xc9ac81
mov rax, qword [0x00d51790]
mov rcx, qword [rax]
call fcn.00bd47e0
mov rax, qword [0x00d51ef0]
mov rcx, qword [rax]
call fcn.00be3940
mov rax, qword [0x00d512a8]
mov rcx, qword [rax]
call fcn.00c01d70
mov rax, qword [0x00d51e60]
cmp qword [rax], 0
je 0xc9acbb
mov rax, qword [0x00d51e60]
mov rcx, qword [rax]
call fcn.00bce3e0
mov rax, qword [0x00d50c70]
cmp qword [rax], 0
je 0xc9acd7
mov rax, qword [0x00d50c70]
mov rcx, qword [rax]
call fcn.00be41b0
mov rax, qword [0x00d50938]
cmp qword [rax], 0
je 0xc9acf3
mov rax, qword [0x00d50938]
mov rcx, qword [rax]
call fcn.00bee0f0
mov rax, qword [0x00d513c8]
cmp byte [rax + 8], 0
je 0xc9adfd
mov rax, qword [0x00d50df8]
mov rax, qword [rax]
mov rax, qword [rax + 0x7b8]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x2b0]
test eax, eax
jle 0xc9adfd
mov rax, qword [0x00d50df8]
mov rcx, qword [rax]
mov rax, qword [0x00d513c8]
mov rdx, qword [rax]
call fcn.00c722d0
mov dword [0x00d60a10], eax
cmp dword [0x00d60a10], 0
jl 0xc9adfd
call fcn.00c05540
mov rax, qword [0x00d50df8]
mov rax, qword [rax]
mov rax, qword [rax + 0x7b8]
mov rcx, rax
mov edx, dword [0x00d60a10]
mov rbx, qword [rax]
call qword [rbx + 0x3d8]
mov rax, qword [0x00d51e80]
mov rax, qword [rax]
mov rax, qword [rax + 0xc58]
mov rcx, rax
mov dl, 1
mov rbx, qword [rax]
call qword [rbx + 0xe0]
mov rax, qword [0x00d51e80]
mov rax, qword [rax]
mov rax, qword [rax + 0xc58]
mov rcx, rax
mov dl, 1
mov rbx, qword [rax]
call qword [rbx + 0x110]
mov rax, qword [0x00d51e80]
mov rcx, qword [rax]
call fcn.006ec2a0
mov rax, qword [0x00d51e80]
mov rcx, qword [rax]
mov edx, dword [0x00d60a10]
call fcn.00badd30
mov rax, qword [0x00d50df8]
mov rcx, qword [rax]
call fcn.006ec2a0
mov rax, qword [0x00d50df8]
mov rcx, qword [rax]
call fcn.00c6eab0
mov rax, qword [0x00d516f0]
mov rcx, qword [rax]
call fcn.006f3980
nop
lea rcx, [rbp + 0x28]
mov edx, 0x11
call fcn.0040e420
call fcn.0040de20
jmp 0xc9ae2b
lea rsp, [rbp + 0xb8]
pop rbx
pop rbp
ret