Function at 0x1401d2670
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd8]
sub rsp, 0x1d8
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov eax, dword [rbp + 0x148]
xor edi, edi
mov r14, rdx
mov dword [rsp + 0x44], eax
mov rdx, qword [0x14045b528]
mov r13, r9
mov dword [rsp + 0x40], edi
mov r12, r8
mov qword [rsp + 0x48], rdi
mov rsi, rcx
test rdx, rdx
je 0x1401d27cd
call fcn.14001d4c4
test eax, eax
jne 0x1401d27cd
mov rcx, r14
cmp dword [rbp + 0x140], edi
je 0x1401d27c1
call fcn.140065640
mov rdi, rax
test r12, r12
je 0x1401d279b
test rax, rax
jne 0x1401d2784
lea rcx, str.E449:_Invalid_expression_received
call qword [case.0x1400407ae.0]
mov rbx, 0xffffffffffffffff
mov rsi, rax
mov rcx, rbx
nop
cmp byte [r14 + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1401d2720
nop dword [rax]
cmp byte [rax + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x1401d2730
lea r15, [rcx + rbx]
mov edx, 1
lea rcx, [r15 + 5]
call fcn.140032b90
mov rbx, rax
test rax, rax
je 0x1401d2787
mov r9, rsi
mov qword [rsp + 0x20], r14
lea r8, str._s:___s_
mov rcx, rax
lea rdx, [r15 + 5]
call fcn.14028ab80
neg rdi
mov qword [r12], rbx
sbb edi, edi
neg edi
dec edi
mov eax, edi
jmp 0x1401d28c5
mov rbx, rdi
neg rdi
mov qword [r12], rbx
sbb edi, edi
neg edi
dec edi
mov eax, edi
jmp 0x1401d28c5
test rdi, rdi
je 0x1401d27b1
cmp dword [0x14045b3f8], 0
jne 0x1401d27b1
mov rcx, rdi
call fcn.140005660
neg rdi
sbb edi, edi
neg edi
dec edi
mov eax, edi
jmp 0x1401d28c5
call fcn.140065730
mov eax, edi
jmp 0x1401d28c5
mov rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rsi + rax], dil
jne 0x1401d27d7
cmp rax, 1
jbe 0x1401d2815
mov rax, rbx
nop dword [rax]
cmp byte [rsi + rax + 1], dil
lea rax, [rax + 1]
jne 0x1401d27f0
movzx ecx, byte [rax + rsi - 1]
cmp cl, 0x30
jb 0x1401d280a
cmp cl, 0x39
jbe 0x1401d2815
lea rax, [rbp - 0x50]
mov qword [0x140461dd0], rax
lea rax, [0x1401cf230]
mov byte [rbp - 0x50], dil
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rsi
lea rcx, [0x1401cf0b0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x50], rdi
call qword [sym.imp.USER32.dll_EnumWindows]
mov r15, qword [rsp + 0x50]
mov qword [0x140461dd0], rdi
test r15, r15
jne 0x1401d28e8
cmp byte [rbp - 0x50], dil
je 0x1401d28a3
lea rax, [rbp - 0x50]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rax
lea rdx, [rbp - 0x80]
lea rax, [0x1401cf230]
mov qword [rbp - 0x80], rax
lea rcx, [0x1401cf0b0]
lea rax, [rsp + 0x60]
mov qword [rbp - 0x78], rax
call qword [sym.imp.USER32.dll_EnumWindows]
mov r15, qword [rsp + 0x60]
test r15, r15
jne 0x1401d28e8
cmp dword [rbp + 0x150], edi
jne 0x1401d28c3
lea rcx, str.E247:_No_registered_server_named___s_
call qword [case.0x1400407ae.0]
mov rcx, rax
mov rdx, rsi
call fcn.1401860c0
mov eax, ebx
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.140001200
add rsp, 0x1d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
test r13, r13
je 0x1401d28f1
mov qword [r13], r15
mov esi, dword [rbp + 0x140]
mov eax, esi
neg eax
mov rax, rbx
sbb rcx, rcx
and ecx, 0xa
mov qword [rbp - 0x70], rcx
nop dword [rax + rax]
inc rax
cmp byte [r14 + rax], dil
jne 0x1401d2910
inc eax
mov qword [rbp - 0x60], r14
mov rcx, r15
mov dword [rbp - 0x68], eax
call fcn.1401cf8d0
test eax, eax
js 0x1401d28c3
mov r8, qword [0x14045ba00]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x70]
mov dword [rsp + 0x28], 0x1388
mov edx, 0x4a
mov rcx, r15
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutA]
test rax, rax
je 0x1401d28c3
cmp qword [rsp + 0x48], rdi
je 0x1401d28c3
test esi, esi
je 0x1401d299a
mov eax, dword [rsp + 0x44]
lea rdx, [rsp + 0x40]
mov r9d, 1
mov dword [rsp + 0x20], eax
mov r8d, r9d
mov rcx, r15
call fcn.1401d29e0
mov rdi, rax
test r12, r12
jne 0x1401d29be
test rdi, rdi
je 0x1401d29c2
cmp dword [0x14045b3f8], r12d
jne 0x1401d29c2
mov rcx, rdi
call fcn.140005660
mov eax, dword [rsp + 0x40]
jmp 0x1401d28c5
mov qword [r12], rdi
mov eax, dword [rsp + 0x40]
jmp 0x1401d28c5