Function at 0x1400046f8
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x14001c1c8]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r15, [rcx + 0x58]
mov rdi, rcx
mov rcx, r15
mov r14d, 1
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
nop dword [rax + rax]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
nop dword [rax + rax]
lea rbp, [rdi + 0x48]
mov rcx, rbp
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
movabs rax, 0x346dc5d63886594b
sub rcx, qword [rsp + 0x40]
mul rcx
mov eax, dword [rdi + 0x40]
shr rdx, 0xb
cmp rdx, rax
jbe 0x140004933
mov esi, dword [rdi + 0x3c]
xor bl, bl
test esi, esi
jne 0x1400048f3
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x30], bl
lea rcx, [0x1400031f0]
call qword [sym.imp.USER32.dll_EnumWindows]
nop dword [rax + rax]
mov bl, byte [rsp + 0x30]
test bl, bl
jne 0x1400048f3
mov rax, qword [0x14001caf8]
test rax, rax
je 0x140004801
movabs r10, 0xd43837ae10dbc970
call qword [vtable.H_MA8HI.0]
test eax, eax
jne 0x1400048f3
mov rax, qword [0x14001caf8]
xor r14d, r14d
lea rdi, [0x14001c048]
test rax, rax
je 0x1400048bc
mov rcx, qword [0x14001c048]
cmp rcx, rdi
je 0x140004841
test byte [rcx + 0x1c], 2
je 0x140004841
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 0xf]
lea r8, [0x140017c80]
call fcn.140004af4
mov rcx, qword [0x14001c048]
mov rbx, qword [0x14001c180]
xor eax, eax
mov rdx, qword [0x14001c188]
cmp rbx, rdx
jae 0x14000488c
test eax, eax
jne 0x140004885
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000487c
mov ecx, dword [rcx + 0x28]
test ecx, ecx
je 0x14000487c
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoRevokeClassObject]
nop dword [rax + rax]
mov rdx, qword [0x14001c188]
add rbx, 8
cmp rbx, rdx
jb 0x140004856
mov rcx, qword [0x14001c048]
mov rax, qword [0x14001cb08]
test rax, rax
je 0x1400048c3
and qword [0x14001cb00], r14
mov rcx, rax
and qword [0x14001caf8], r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
and qword [0x14001cb08], r14
mov rcx, qword [0x14001c048]
cmp rcx, rdi
je 0x1400048e3
test byte [rcx + 0x1c], 2
je 0x1400048e3
mov rcx, qword [rcx + 0x10]
lea r8, [0x140017c80]
mov edx, 0x10
call fcn.140004af4
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcMgmtStopServerListening]
nop dword [rax + rax]
jmp 0x140004933
mov rcx, qword [0x14001c048]
lea rdi, [0x14001c048]
cmp rcx, rdi
je 0x140004924
test byte [rcx + 0x1c], 2
je 0x140004924
and dword [rsp + 0x28], 0
mov r9d, esi
mov rcx, qword [rcx + 0x10]
movzx edx, bl
mov dword [rsp + 0x20], edx
call fcn.140004b20
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
nop dword [rax + rax]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, r14d
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001670
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret