Function at 0x1400704f8
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xa0
mov rsi, rcx
mov r12, r9
mov rcx, r9
mov rdi, r8
mov rbx, rdx
call fcn.140004bc4
lea r14, [rsi + 0x158]
mov rcx, r14
call fcn.140004bc4
mov al, byte [rbp + 0x7f]
lea r13, [rsi + 0x18]
mov byte [rsi + 8], al
mov rdx, rbx
mov al, byte [rbp + 0x77]
mov rcx, r13
mov byte [rsi + 9], al
call fcn.14000de48
lea rbx, [rsi + 0x38]
mov rdx, rdi
mov rcx, rbx
call fcn.14000de48
lea r15, [0x1400b5590]
mov rdx, r15
lea rcx, [rsi + 0x118]
call fcn.14000c614
mov eax, dword [rbp + 0x67]
lea rcx, [rbp - 0x21]
mov dword [rsi + 0x14], eax
mov edi, 1
xor eax, eax
mov qword [rsi + 0x138], rdi
mov dword [rsi + 0xc], eax
mov dword [rsi + 0x150], eax
mov byte [rsi + 0x10], dil
call fcn.14000c970
lea rcx, [rbp - 0x61]
call fcn.14000c970
lea rcx, [rbp - 0x41]
call fcn.14000c970
mov eax, dword [rsi + 0x14]
test eax, eax
jns 0x1400705cd
mov ecx, eax
call fcn.14002d51c
mov dword [rsi + 0x14], eax
mov byte [rsi + 0x10], 0
cmp eax, 4
jne 0x1400705dd
mov rdx, r13
call fcn.14007007c
mov dword [rsi + 0x14], edi
cmp qword [rsi + 0x20], 0
jne 0x14007060e
cmp qword [rsi + 0x40], 0
jne 0x14007060e
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
mov rcx, rsi
call fcn.140071370
mov rax, qword [rsi]
mov rcx, qword [rax]
mov qword [rbp + 0x47], rcx
mov rcx, r12
jmp 0x140070d36
xor edx, edx
mov rcx, r13
call fcn.140008530
cmp word [rax], 0x5b
jne 0x140070d71
mov rdx, qword [rsi + 0x20]
mov rcx, r13
dec rdx
call fcn.140008530
cmp word [rax], 0x5d
jne 0x140070d71
mov rax, qword [rsi + 0x20]
mov r14d, 0xfffffffe
sub rax, 2
mov qword [rbp - 0x69], rdi
mov qword [rbp + 0x47], rax
lea r9, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x61]
mov rcx, r13
lea rdx, [rbp - 0x21]
lea rbx, str.LAST
call fcn.1400702a0
test al, al
je 0x140070d62
mov rcx, rbx
call fcn.140028558
mov rbx, qword [rbp - 0x19]
mov r12, qword [rbp - 0x21]
cmp rbx, rax
jne 0x1400706cc
lea rdx, str.LAST
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400706c2
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400707d9
add rax, 2
sub rcx, rdi
jne 0x1400706a6
xor eax, eax
test eax, eax
je 0x140070c57
lea rcx, str.ACTIVE
call fcn.140028558
cmp rbx, rax
jne 0x14007071b
lea rdx, str.ACTIVE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070711
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400707e5
add rax, 2
sub rcx, rdi
jne 0x1400706f5
xor eax, eax
test eax, eax
je 0x140070cb1
lea rcx, [0x1400db5e0]
call fcn.140028558
cmp rbx, rax
jne 0x14007076a
lea rdx, [0x1400db5e0]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070760
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400707f1
add rax, 2
sub rcx, rdi
jne 0x140070744
xor eax, eax
test eax, eax
je 0x140070d01
lea rcx, str.REGEXPTITLE
call fcn.140028558
cmp rbx, rax
jne 0x140070806
lea rdx, str.REGEXPTITLE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400707af
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400707fd
add rax, 2
sub rcx, rdi
jne 0x140070797
xor eax, eax
test eax, eax
jne 0x140070806
mov eax, dword [rsi + 0xc]
test dil, al
jne 0x140070d41
or eax, 2
lea rcx, [rsi + 0x58]
mov dword [rsi + 0xc], eax
call fcn.1400081dc
lea rcx, [rsi + 0x58]
jmp 0x1400708c3
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400706c4
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070713
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070762
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400707b1
lea rcx, str.CLASS
call fcn.140028558
cmp rbx, rax
jne 0x140070866
lea rdx, str.CLASS
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070847
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x14007085d
add rax, 2
sub rcx, rdi
jne 0x14007082f
xor eax, eax
test eax, eax
jne 0x140070866
or dword [rsi + 0xc], 8
lea rcx, [rsi + 0x118]
jmp 0x140070bf5
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070849
lea rcx, str.REGEXPCLASS
call fcn.140028558
cmp rbx, rax
jne 0x1400708e2
lea rdx, str.REGEXPCLASS
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400708a7
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400708d9
add rax, 2
sub rcx, rdi
jne 0x14007088f
xor eax, eax
test eax, eax
jne 0x1400708e2
or dword [rsi + 0xc], 0x10
lea rbx, [rsi + 0xb8]
mov rcx, rbx
call fcn.1400081dc
mov rcx, rbx
lea rdx, [rbp - 0x61]
call fcn.140007f04
test eax, eax
jne 0x140070e3c
jmp 0x140070c45
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400708a9
lea rcx, str.XYWH
call fcn.140028558
cmp rbx, rax
jne 0x14007094b
lea rdx, str.XYWH
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070923
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140070942
add rax, 2
sub rcx, rdi
jne 0x14007090b
xor eax, eax
test eax, eax
jne 0x14007094b
bts dword [rsi + 0xc], 7
mov rcx, qword [rbp - 0x61]
call fcn.14002a00c
mov dword [rsi + 0x140], eax
jmp 0x140070c45
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070925
lea rcx, [0x1400db4b0]
call fcn.140028558
cmp rbx, rax
jne 0x1400709b4
lea rdx, [0x1400db4b0]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x14007098c
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400709ab
add rax, 2
sub rcx, rdi
jne 0x140070974
xor eax, eax
test eax, eax
jne 0x1400709b4
bts dword [rsi + 0xc], 8
mov rcx, qword [rbp - 0x61]
call fcn.14002a00c
mov dword [rsi + 0x144], eax
jmp 0x140070c45
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007098e
lea rcx, [0x1400db4b4]
call fcn.140028558
cmp rbx, rax
jne 0x140070a1d
lea rdx, [0x1400db4b4]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400709f5
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140070a14
add rax, 2
sub rcx, rdi
jne 0x1400709dd
xor eax, eax
test eax, eax
jne 0x140070a1d
bts dword [rsi + 0xc], 9
mov rcx, qword [rbp - 0x61]
call fcn.14002a00c
mov dword [rsi + 0x148], eax
jmp 0x140070c45
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400709f7
lea rcx, [0x1400db4b8]
call fcn.140028558
cmp rbx, rax
jne 0x140070a86
lea rdx, [0x1400db4b8]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070a5e
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140070a7d
add rax, 2
sub rcx, rdi
jne 0x140070a46
xor eax, eax
test eax, eax
jne 0x140070a86
bts dword [rsi + 0xc], 0xa
mov rcx, qword [rbp - 0x61]
call fcn.14002a00c
mov dword [rsi + 0x14c], eax
jmp 0x140070c45
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070a60
lea rcx, str.INSTANCE
call fcn.140028558
cmp rbx, rax
jne 0x140070aee
lea rdx, str.INSTANCE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070ac7
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140070ae5
add rax, 2
sub rcx, rdi
jne 0x140070aaf
xor eax, eax
test eax, eax
jne 0x140070aee
or dword [rsi + 0xc], 0x20
mov rcx, qword [rbp - 0x61]
call fcn.14002a00c
mov dword [rsi + 0x138], eax
jmp 0x140070c45
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070ac9
lea rcx, [0x1400db5c8]
call fcn.140028558
cmp rbx, rax
jne 0x140070b9a
lea rdx, [0x1400db5c8]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070b33
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140070b88
add rax, 2
sub rcx, rdi
jne 0x140070b1b
xor eax, eax
test eax, eax
jne 0x140070b9a
mov rcx, r15
call fcn.140028558
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x140070d59
mov rax, r15
test rcx, rcx
je 0x140070b75
mov r9, qword [rbp - 0x61]
sub r9, r15
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140070b91
add rax, 2
sub rcx, rdi
jne 0x140070b5d
xor eax, eax
test eax, eax
jne 0x140070d59
or dword [rsi + 0xc], 0x40
jmp 0x140070c45
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070b35
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070b77
lea rcx, str.TITLE
call fcn.140028558
cmp rbx, rax
jne 0x140070c09
lea rdx, str.TITLE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070bdb
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140070c00
add rax, 2
sub rcx, rdi
jne 0x140070bc3
xor eax, eax
test eax, eax
jne 0x140070c09
mov eax, dword [rsi + 0xc]
test al, 2
jne 0x140070d4e
or eax, edi
lea rcx, [rbp - 0x41]
mov dword [rsi + 0xc], eax
lea rdx, [rbp - 0x61]
call fcn.14000de48
jmp 0x140070c45
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070bdd
mov rcx, r15
call fcn.140028558
cmp rbx, rax
jne 0x140070d59
mov rax, r15
test rbx, rbx
je 0x140070c3b
sub r12, r15
movzx ecx, word [r12 + rax]
movzx edx, word [rax]
cmp cx, dx
jne 0x140070c4e
add rax, 2
sub rbx, rdi
jne 0x140070c25
xor eax, eax
test eax, eax
jne 0x140070d59
mov rax, qword [rbp + 0x47]
jmp 0x140070651
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070c3d
mov rcx, r15
call fcn.140028558
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x140070cfc
test rcx, rcx
je 0x140070c8c
mov rax, qword [rbp - 0x61]
sub rax, r15
movzx edx, word [rax + r15]
cmp dx, word [r15]
jne 0x140070ca8
add r15, 2
sub rcx, rdi
jne 0x140070c78
xor eax, eax
test eax, eax
jne 0x140070cfc
mov rax, qword [rsi]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140070d2e
xor edi, edi
jmp 0x140070d46
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070c8e
mov rcx, r15
call fcn.140028558
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x140070cfc
test rcx, rcx
je 0x140070ce2
mov rax, qword [rbp - 0x61]
sub rax, r15
movzx edx, word [rax + r15]
cmp dx, word [r15]
jne 0x140070cf3
add r15, 2
sub rcx, rdi
jne 0x140070cce
xor eax, eax
test eax, eax
jne 0x140070cfc
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
jmp 0x140070d20
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070ce4
or edi, 0xffffffff
jmp 0x140070d46
mov rcx, qword [rbp - 0x61]
lea rdx, [rbp + 0x47]
call fcn.14007d550
mov rcx, qword [rbp + 0x47]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140070ca1
mov rdx, qword [rbp + 0x47]
mov rcx, rsi
call fcn.140071370
mov rax, qword [rsi]
mov rcx, qword [rax]
mov qword [rbp + 0x47], rcx
mov rcx, qword [rbp + 0x5f]
lea rdx, [rbp + 0x47]
call fcn.140070448
jmp 0x140070d46
mov edi, 0xfffffffd
mov r14d, edi
jmp 0x140070e3c
mov r14d, 0xfffffffc
jmp 0x140070e3c
or r14d, 0xffffffff
jmp 0x140070e3c
mov r12, qword [rbp + 0x5f]
lea rbx, [rsi + 0x38]
lea r14, [rsi + 0x158]
xor r15d, r15d
cmp qword [rbp - 0x39], r15
je 0x140070d86
lea rdx, [rbp - 0x41]
mov rcx, r13
call fcn.14000de48
mov eax, dword [rsi + 0xc]
test eax, eax
cmove eax, edi
or eax, 4
mov dword [rsi + 0xc], eax
cmp byte [rsi + 0x10], r15b
jne 0x140070db1
mov rcx, rbx
call fcn.140009ae4
mov edx, dword [rbx + 8]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [rsi + 0xc]
test dil, al
je 0x140070dd2
cmp byte [rsi + 0x10], r15b
jne 0x140070dd2
mov rcx, r13
call fcn.140009ae4
mov edx, dword [r13 + 8]
mov rcx, qword [r13]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
cmp byte [rbp + 0x6f], r15b
je 0x140070df3
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r8, rsi
lea rdx, [0x140070e78]
mov rcx, rax
call qword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x140070e03
mov rdx, rsi
lea rcx, [0x140070e78]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rdx, r14
mov rcx, r12
call fcn.14006ff84
mov rcx, r14
call fcn.140004bc4
mov r14d, dword [rsi + 0x150]
cmp r14d, edi
jl 0x140070e3c
mov rax, qword [r12 + 8]
mov rcx, rsi
mov rdx, qword [rax]
mov rdx, qword [rdx]
call fcn.140071370
mov r14d, dword [rsi + 0x150]
lea rcx, [rbp - 0x41]
call fcn.140009250
lea rcx, [rbp - 0x61]
call fcn.140009250
lea rcx, [rbp - 0x21]
call fcn.140009250
mov rbx, qword [rsp + 0xe8]
mov eax, r14d
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret