Function at 0x180028ec0
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x150], rax
call fcn.180028780
test al, al
je 0x18002913d
lea rcx, [0x1800ec5c0]
call fcn.1800585a0
test al, al
jne 0x180028f88
lea rcx, [0x1800ec560]
call fcn.1800585a0
test al, al
je 0x180028f25
call fcn.180058200
test al, al
sete al
jmp 0x180028f6e
lea rcx, [0x1800ec680]
call fcn.1800585a0
test al, al
je 0x180028f41
call fcn.180058250
test al, al
sete al
jmp 0x180028f6e
lea rcx, [0x1800ec620]
call fcn.1800585a0
test al, al
je 0x180028f74
lea rcx, [rsp + 0x90]
call fcn.180011870
mov qword [rsp + 0x70], rax
cmp dword [rax + 0xc], 7
je 0x180028f88
call fcn.180058200
mov byte [rsp + 0x20], al
jmp 0x180028f80
lea rcx, [0x1800ec6e0]
call fcn.1800585a0
test al, al
je 0x18002913d
lea rcx, [0x1800ec560]
call fcn.1800585a0
test al, al
je 0x180028fa3
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
call fcn.180029180
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
or rdi, 0xffffffffffffffff
cmp word [rax], bx
jne 0x180028fef
mov r8d, ebx
jmp 0x180028ffc
mov r8, rdi
inc r8
cmp word [rax + r8*2], bx
jne 0x180028ff2
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1800125f0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.180071c20
nop
cmp qword [rsp + 0x48], 8
jb 0x18002902f
mov rcx, qword [rsp + 0x30]
call fcn.18008b820
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
lea rcx, [rsp + 0xb0]
call fcn.180011a70
nop
call fcn.1800480b0
mov dl, 1
mov ecx, 0x2718
call fcn.18002a6f0
lea rcx, [0x1800ec560]
call fcn.1800585a0
test al, al
je 0x18002908f
xor edx, edx
lea rcx, [0x180059510]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x180059510]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x1800290a6
mov rcx, rbx
mov qword [rsp + 0x50], rbx
jmp 0x1800290ae
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.1800491b0
nop
cmp qword [rsp + 0xc8], 8
jb 0x1800290d5
mov rcx, qword [rsp + 0xb0]
call fcn.18008b820
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0xb0], bx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x18002913d
mov qword [rsp + 0x28], rcx
mov eax, edi
lock xadd dword [rcx + 8], eax
dec eax
jne 0x18002913d
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x18002913d
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
call fcn.180061c60
mov rcx, qword [0x1800ec4c8]
test rcx, rcx
je 0x180029157
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800ad750
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret