Function at 0x140070de8
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xa0
mov rsi, rcx
mov r12, r9
mov rcx, r9
mov rdi, r8
mov rbx, rdx
call fcn.140003aa8
lea r14, [rsi + 0x128]
mov rcx, r14
call fcn.140003aa8
mov al, byte [rbp + 0x7f]
lea r13, [rsi + 0x18]
mov byte [rsi + 8], al
mov rdx, rbx
mov al, byte [rbp + 0x77]
mov rcx, r13
mov byte [rsi + 9], al
call fcn.14000e0a8
lea rbx, [rsi + 0x38]
mov rdx, rdi
mov rcx, rbx
call fcn.14000e0a8
lea r15, [0x1400b64d8]
mov rdx, r15
lea rcx, [rsi + 0xe8]
call fcn.140007cf4
mov eax, dword [rbp + 0x67]
lea rcx, [rbp - 0x21]
mov dword [rsi + 0x14], eax
mov edi, 1
xor eax, eax
mov qword [rsi + 0x108], rdi
mov dword [rsi + 0xc], eax
mov dword [rsi + 0x120], eax
mov byte [rsi + 0x10], dil
call fcn.140009640
lea rcx, [rbp - 0x61]
call fcn.140009640
lea rcx, [rbp - 0x41]
call fcn.140009640
mov eax, dword [rsi + 0x14]
test eax, eax
jns 0x140070ebd
mov ecx, eax
call fcn.14002dd1c
mov dword [rsi + 0x14], eax
mov byte [rsi + 0x10], 0
cmp eax, 4
jne 0x140070ecd
mov rdx, r13
call fcn.14007096c
mov dword [rsi + 0x14], edi
cmp qword [rsi + 0x20], 0
jne 0x140070efe
cmp qword [rsi + 0x40], 0
jne 0x140070efe
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
mov rcx, rsi
call fcn.140071c48
mov rax, qword [rsi]
mov rcx, qword [rax]
mov qword [rbp + 0x47], rcx
mov rcx, r12
jmp 0x14007162b
xor edx, edx
mov rcx, r13
call fcn.140009d84
cmp word [rax], 0x5b
jne 0x140071666
mov rdx, qword [rsi + 0x20]
mov rcx, r13
dec rdx
call fcn.140009d84
cmp word [rax], 0x5d
jne 0x140071666
mov rax, qword [rsi + 0x20]
mov r14d, 0xfffffffe
sub rax, 2
mov qword [rbp - 0x69], rdi
mov qword [rbp + 0x47], rax
lea r9, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x61]
mov rcx, r13
lea rdx, [rbp - 0x21]
lea rbx, str.LAST
call fcn.140070b90
test al, al
je 0x140071657
mov rcx, rbx
call fcn.140028d58
mov rbx, qword [rbp - 0x19]
mov r12, qword [rbp - 0x21]
cmp rbx, rax
jne 0x140070fbc
lea rdx, str.LAST
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070fb2
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400710c9
add rax, 2
sub rcx, rdi
jne 0x140070f96
xor eax, eax
test eax, eax
je 0x140071547
lea rcx, str.ACTIVE
call fcn.140028d58
cmp rbx, rax
jne 0x14007100b
lea rdx, str.ACTIVE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071001
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400710d5
add rax, 2
sub rcx, rdi
jne 0x140070fe5
xor eax, eax
test eax, eax
je 0x1400715a6
lea rcx, [0x1400dc5f0]
call fcn.140028d58
cmp rbx, rax
jne 0x14007105a
lea rdx, [0x1400dc5f0]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071050
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400710e1
add rax, 2
sub rcx, rdi
jne 0x140071034
xor eax, eax
test eax, eax
je 0x1400715f6
lea rcx, str.REGEXPTITLE
call fcn.140028d58
cmp rbx, rax
jne 0x1400710f6
lea rdx, str.REGEXPTITLE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x14007109f
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400710ed
add rax, 2
sub rcx, rdi
jne 0x140071087
xor eax, eax
test eax, eax
jne 0x1400710f6
mov eax, dword [rsi + 0xc]
test dil, al
jne 0x140071636
or eax, 2
lea rcx, [rsi + 0x58]
mov dword [rsi + 0xc], eax
call fcn.1400045c8
lea rcx, [rsi + 0x58]
jmp 0x1400711b3
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070fb4
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071003
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071052
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400710a1
lea rcx, str.CLASS
call fcn.140028d58
cmp rbx, rax
jne 0x140071156
lea rdx, str.CLASS
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071137
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x14007114d
add rax, 2
sub rcx, rdi
jne 0x14007111f
xor eax, eax
test eax, eax
jne 0x140071156
or dword [rsi + 0xc], 8
lea rcx, [rsi + 0xe8]
jmp 0x1400714e5
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071139
lea rcx, str.REGEXPCLASS
call fcn.140028d58
cmp rbx, rax
jne 0x1400711d2
lea rdx, str.REGEXPCLASS
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071197
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400711c9
add rax, 2
sub rcx, rdi
jne 0x14007117f
xor eax, eax
test eax, eax
jne 0x1400711d2
or dword [rsi + 0xc], 0x10
lea rbx, [rsi + 0xa0]
mov rcx, rbx
call fcn.1400045c8
mov rcx, rbx
lea rdx, [rbp - 0x61]
call fcn.140004438
test eax, eax
jne 0x140071731
jmp 0x140071535
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071199
lea rcx, str.XYWH
call fcn.140028d58
cmp rbx, rax
jne 0x14007123b
lea rdx, str.XYWH
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071213
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071232
add rax, 2
sub rcx, rdi
jne 0x1400711fb
xor eax, eax
test eax, eax
jne 0x14007123b
bts dword [rsi + 0xc], 7
mov rcx, qword [rbp - 0x61]
call fcn.14002a80c
mov dword [rsi + 0x110], eax
jmp 0x140071535
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071215
lea rcx, [0x1400dc4c0]
call fcn.140028d58
cmp rbx, rax
jne 0x1400712a4
lea rdx, [0x1400dc4c0]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x14007127c
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x14007129b
add rax, 2
sub rcx, rdi
jne 0x140071264
xor eax, eax
test eax, eax
jne 0x1400712a4
bts dword [rsi + 0xc], 8
mov rcx, qword [rbp - 0x61]
call fcn.14002a80c
mov dword [rsi + 0x114], eax
jmp 0x140071535
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007127e
lea rcx, [0x1400dc4c4]
call fcn.140028d58
cmp rbx, rax
jne 0x14007130d
lea rdx, [0x1400dc4c4]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400712e5
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071304
add rax, 2
sub rcx, rdi
jne 0x1400712cd
xor eax, eax
test eax, eax
jne 0x14007130d
bts dword [rsi + 0xc], 9
mov rcx, qword [rbp - 0x61]
call fcn.14002a80c
mov dword [rsi + 0x118], eax
jmp 0x140071535
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400712e7
lea rcx, [0x1400dc4c8]
call fcn.140028d58
cmp rbx, rax
jne 0x140071376
lea rdx, [0x1400dc4c8]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x14007134e
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x14007136d
add rax, 2
sub rcx, rdi
jne 0x140071336
xor eax, eax
test eax, eax
jne 0x140071376
bts dword [rsi + 0xc], 0xa
mov rcx, qword [rbp - 0x61]
call fcn.14002a80c
mov dword [rsi + 0x11c], eax
jmp 0x140071535
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071350
lea rcx, str.INSTANCE
call fcn.140028d58
cmp rbx, rax
jne 0x1400713de
lea rdx, str.INSTANCE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400713b7
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400713d5
add rax, 2
sub rcx, rdi
jne 0x14007139f
xor eax, eax
test eax, eax
jne 0x1400713de
or dword [rsi + 0xc], 0x20
mov rcx, qword [rbp - 0x61]
call fcn.14002a80c
mov dword [rsi + 0x108], eax
jmp 0x140071535
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400713b9
lea rcx, [0x1400dc5d8]
call fcn.140028d58
cmp rbx, rax
jne 0x14007148a
lea rdx, [0x1400dc5d8]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071423
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071478
add rax, 2
sub rcx, rdi
jne 0x14007140b
xor eax, eax
test eax, eax
jne 0x14007148a
mov rcx, r15
call fcn.140028d58
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x14007164e
mov rax, r15
test rcx, rcx
je 0x140071465
mov r9, qword [rbp - 0x61]
sub r9, r15
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071481
add rax, 2
sub rcx, rdi
jne 0x14007144d
xor eax, eax
test eax, eax
jne 0x14007164e
or dword [rsi + 0xc], 0x40
jmp 0x140071535
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071425
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071467
lea rcx, str.TITLE
call fcn.140028d58
cmp rbx, rax
jne 0x1400714f9
lea rdx, str.TITLE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400714cb
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400714f0
add rax, 2
sub rcx, rdi
jne 0x1400714b3
xor eax, eax
test eax, eax
jne 0x1400714f9
mov eax, dword [rsi + 0xc]
test al, 2
jne 0x140071643
or eax, edi
lea rcx, [rbp - 0x41]
mov dword [rsi + 0xc], eax
lea rdx, [rbp - 0x61]
call fcn.14000e0a8
jmp 0x140071535
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400714cd
mov rcx, r15
call fcn.140028d58
cmp rbx, rax
jne 0x14007164e
mov rax, r15
test rbx, rbx
je 0x14007152b
sub r12, r15
movzx ecx, word [r12 + rax]
movzx edx, word [rax]
cmp cx, dx
jne 0x14007153e
add rax, 2
sub rbx, rdi
jne 0x140071515
xor eax, eax
test eax, eax
jne 0x14007164e
mov rax, qword [rbp + 0x47]
jmp 0x140070f41
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007152d
mov rcx, r15
call fcn.140028d58
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x1400715f1
test rcx, rcx
je 0x14007157c
mov rax, qword [rbp - 0x61]
sub rax, r15
movzx edx, word [rax + r15]
cmp dx, word [r15]
jne 0x14007159d
add r15, 2
sub rcx, rdi
jne 0x140071568
xor eax, eax
test eax, eax
jne 0x1400715f1
mov rax, qword [rsi]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14007161d
xor edi, edi
jmp 0x14007163b
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007157e
mov rcx, r15
call fcn.140028d58
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x1400715f1
test rcx, rcx
je 0x1400715d7
mov rax, qword [rbp - 0x61]
sub rax, r15
movzx edx, word [rax + r15]
cmp dx, word [r15]
jne 0x1400715e8
add r15, 2
sub rcx, rdi
jne 0x1400715c3
xor eax, eax
test eax, eax
jne 0x1400715f1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
jmp 0x140071615
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400715d9
or edi, 0xffffffff
jmp 0x14007163b
mov rcx, qword [rbp - 0x61]
lea rdx, [rbp + 0x47]
call fcn.14007de9c
mov rcx, qword [rbp + 0x47]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140071596
mov rdx, qword [rbp + 0x47]
mov rcx, rsi
call fcn.140071c48
mov rax, qword [rsi]
mov rcx, qword [rax]
mov qword [rbp + 0x47], rcx
mov rcx, qword [rbp + 0x5f]
lea rdx, [rbp + 0x47]
call fcn.140070d38
jmp 0x14007163b
mov edi, 0xfffffffd
mov r14d, edi
jmp 0x140071731
mov r14d, 0xfffffffc
jmp 0x140071731
or r14d, 0xffffffff
jmp 0x140071731
mov r12, qword [rbp + 0x5f]
lea rbx, [rsi + 0x38]
lea r14, [rsi + 0x128]
xor r15d, r15d
cmp qword [rbp - 0x39], r15
je 0x14007167b
lea rdx, [rbp - 0x41]
mov rcx, r13
call fcn.14000e0a8
mov eax, dword [rsi + 0xc]
test eax, eax
cmove eax, edi
or eax, 4
mov dword [rsi + 0xc], eax
cmp byte [rsi + 0x10], r15b
jne 0x1400716a6
mov rcx, rbx
call fcn.14000a7c0
mov edx, dword [rbx + 8]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [rsi + 0xc]
test dil, al
je 0x1400716c7
cmp byte [rsi + 0x10], r15b
jne 0x1400716c7
mov rcx, r13
call fcn.14000a7c0
mov edx, dword [r13 + 8]
mov rcx, qword [r13]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
cmp byte [rbp + 0x6f], r15b
je 0x1400716e8
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r8, rsi
lea rdx, [0x14007176c]
mov rcx, rax
call qword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x1400716f8
mov rdx, rsi
lea rcx, [0x14007176c]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rdx, r14
mov rcx, r12
call fcn.140070874
mov rcx, r14
call fcn.140003aa8
mov r14d, dword [rsi + 0x120]
cmp r14d, edi
jl 0x140071731
mov rax, qword [r12 + 8]
mov rcx, rsi
mov rdx, qword [rax]
mov rdx, qword [rdx]
call fcn.140071c48
mov r14d, dword [rsi + 0x120]
lea rcx, [rbp - 0x41]
call fcn.14000a07c
lea rcx, [rbp - 0x61]
call fcn.14000a07c
lea rcx, [rbp - 0x21]
call fcn.14000a07c
mov rbx, qword [rsp + 0xe8]
mov eax, r14d
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret