Function at 0x140071b10
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xa0
mov rsi, rcx
mov r12, r9
mov rcx, r9
mov rdi, r8
mov rbx, rdx
call fcn.1400018fc
lea r14, [rsi + 0x128]
mov rcx, r14
call fcn.1400018fc
mov al, byte [rbp + 0x7f]
lea r13, [rsi + 0x18]
mov byte [rsi + 8], al
mov rdx, rbx
mov al, byte [rbp + 0x77]
mov rcx, r13
mov byte [rsi + 9], al
call fcn.14000449c
lea rbx, [rsi + 0x38]
mov rdx, rdi
mov rcx, rbx
call fcn.14000449c
lea r15, [0x1400b7438]
mov rdx, r15
lea rcx, [rsi + 0xe8]
call fcn.140004344
mov eax, dword [rbp + 0x67]
lea rcx, [rbp - 0x21]
mov dword [rsi + 0x14], eax
mov edi, 1
xor eax, eax
mov qword [rsi + 0x108], rdi
mov dword [rsi + 0xc], eax
mov dword [rsi + 0x120], eax
mov byte [rsi + 0x10], dil
call fcn.1400053cc
lea rcx, [rbp - 0x61]
call fcn.1400053cc
lea rcx, [rbp - 0x41]
call fcn.1400053cc
mov eax, dword [rsi + 0x14]
test eax, eax
jns 0x140071be5
mov ecx, eax
call fcn.14002e2ac
mov dword [rsi + 0x14], eax
mov byte [rsi + 0x10], 0
cmp eax, 4
jne 0x140071bf5
mov rdx, r13
call fcn.140071694
mov dword [rsi + 0x14], edi
cmp qword [rsi + 0x20], 0
jne 0x140071c26
cmp qword [rsi + 0x40], 0
jne 0x140071c26
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
mov rcx, rsi
call fcn.140072980
mov rax, qword [rsi]
mov rcx, qword [rax]
mov qword [rbp + 0x47], rcx
mov rcx, r12
jmp 0x140072353
xor edx, edx
mov rcx, r13
call fcn.1400056a8
cmp word [rax], 0x5b
jne 0x14007238e
mov rdx, qword [rsi + 0x20]
mov rcx, r13
dec rdx
call fcn.1400056a8
cmp word [rax], 0x5d
jne 0x14007238e
mov rax, qword [rsi + 0x20]
mov r14d, 0xfffffffe
sub rax, 2
mov qword [rbp - 0x69], rdi
mov qword [rbp + 0x47], rax
lea r9, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x61]
mov rcx, r13
lea rdx, [rbp - 0x21]
lea rbx, str.LAST
call fcn.1400718b8
test al, al
je 0x14007237f
mov rcx, rbx
call fcn.1400292e8
mov rbx, qword [rbp - 0x19]
mov r12, qword [rbp - 0x21]
cmp rbx, rax
jne 0x140071ce4
lea rdx, str.LAST
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071cda
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071df1
add rax, 2
sub rcx, rdi
jne 0x140071cbe
xor eax, eax
test eax, eax
je 0x14007226f
lea rcx, str.ACTIVE
call fcn.1400292e8
cmp rbx, rax
jne 0x140071d33
lea rdx, str.ACTIVE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071d29
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071dfd
add rax, 2
sub rcx, rdi
jne 0x140071d0d
xor eax, eax
test eax, eax
je 0x1400722ce
lea rcx, [0x1400dd610]
call fcn.1400292e8
cmp rbx, rax
jne 0x140071d82
lea rdx, [0x1400dd610]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071d78
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071e09
add rax, 2
sub rcx, rdi
jne 0x140071d5c
xor eax, eax
test eax, eax
je 0x14007231e
lea rcx, str.REGEXPTITLE
call fcn.1400292e8
cmp rbx, rax
jne 0x140071e1e
lea rdx, str.REGEXPTITLE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071dc7
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071e15
add rax, 2
sub rcx, rdi
jne 0x140071daf
xor eax, eax
test eax, eax
jne 0x140071e1e
mov eax, dword [rsi + 0xc]
test dil, al
jne 0x14007235e
or eax, 2
lea rcx, [rsi + 0x58]
mov dword [rsi + 0xc], eax
call fcn.14000a674
lea rcx, [rsi + 0x58]
jmp 0x140071edb
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071cdc
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071d2b
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071d7a
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071dc9
lea rcx, str.CLASS
call fcn.1400292e8
cmp rbx, rax
jne 0x140071e7e
lea rdx, str.CLASS
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071e5f
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071e75
add rax, 2
sub rcx, rdi
jne 0x140071e47
xor eax, eax
test eax, eax
jne 0x140071e7e
or dword [rsi + 0xc], 8
lea rcx, [rsi + 0xe8]
jmp 0x14007220d
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071e61
lea rcx, str.REGEXPCLASS
call fcn.1400292e8
cmp rbx, rax
jne 0x140071efa
lea rdx, str.REGEXPCLASS
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071ebf
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071ef1
add rax, 2
sub rcx, rdi
jne 0x140071ea7
xor eax, eax
test eax, eax
jne 0x140071efa
or dword [rsi + 0xc], 0x10
lea rbx, [rsi + 0xa0]
mov rcx, rbx
call fcn.14000a674
mov rcx, rbx
lea rdx, [rbp - 0x61]
call fcn.14000a514
test eax, eax
jne 0x140072459
jmp 0x14007225d
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071ec1
lea rcx, str.XYWH
call fcn.1400292e8
cmp rbx, rax
jne 0x140071f63
lea rdx, str.XYWH
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071f3b
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071f5a
add rax, 2
sub rcx, rdi
jne 0x140071f23
xor eax, eax
test eax, eax
jne 0x140071f63
bts dword [rsi + 0xc], 7
mov rcx, qword [rbp - 0x61]
call fcn.14002ad9c
mov dword [rsi + 0x110], eax
jmp 0x14007225d
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071f3d
lea rcx, [0x1400dd4e0]
call fcn.1400292e8
cmp rbx, rax
jne 0x140071fcc
lea rdx, [0x1400dd4e0]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071fa4
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071fc3
add rax, 2
sub rcx, rdi
jne 0x140071f8c
xor eax, eax
test eax, eax
jne 0x140071fcc
bts dword [rsi + 0xc], 8
mov rcx, qword [rbp - 0x61]
call fcn.14002ad9c
mov dword [rsi + 0x114], eax
jmp 0x14007225d
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071fa6
lea rcx, [0x1400dd4e4]
call fcn.1400292e8
cmp rbx, rax
jne 0x140072035
lea rdx, [0x1400dd4e4]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x14007200d
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x14007202c
add rax, 2
sub rcx, rdi
jne 0x140071ff5
xor eax, eax
test eax, eax
jne 0x140072035
bts dword [rsi + 0xc], 9
mov rcx, qword [rbp - 0x61]
call fcn.14002ad9c
mov dword [rsi + 0x118], eax
jmp 0x14007225d
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007200f
lea rcx, [0x1400dd4e8]
call fcn.1400292e8
cmp rbx, rax
jne 0x14007209e
lea rdx, [0x1400dd4e8]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140072076
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140072095
add rax, 2
sub rcx, rdi
jne 0x14007205e
xor eax, eax
test eax, eax
jne 0x14007209e
bts dword [rsi + 0xc], 0xa
mov rcx, qword [rbp - 0x61]
call fcn.14002ad9c
mov dword [rsi + 0x11c], eax
jmp 0x14007225d
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140072078
lea rcx, str.INSTANCE
call fcn.1400292e8
cmp rbx, rax
jne 0x140072106
lea rdx, str.INSTANCE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400720df
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400720fd
add rax, 2
sub rcx, rdi
jne 0x1400720c7
xor eax, eax
test eax, eax
jne 0x140072106
or dword [rsi + 0xc], 0x20
mov rcx, qword [rbp - 0x61]
call fcn.14002ad9c
mov dword [rsi + 0x108], eax
jmp 0x14007225d
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400720e1
lea rcx, [0x1400dd5f8]
call fcn.1400292e8
cmp rbx, rax
jne 0x1400721b2
lea rdx, [0x1400dd5f8]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x14007214b
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400721a0
add rax, 2
sub rcx, rdi
jne 0x140072133
xor eax, eax
test eax, eax
jne 0x1400721b2
mov rcx, r15
call fcn.1400292e8
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x140072376
mov rax, r15
test rcx, rcx
je 0x14007218d
mov r9, qword [rbp - 0x61]
sub r9, r15
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400721a9
add rax, 2
sub rcx, rdi
jne 0x140072175
xor eax, eax
test eax, eax
jne 0x140072376
or dword [rsi + 0xc], 0x40
jmp 0x14007225d
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007214d
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007218f
lea rcx, str.TITLE
call fcn.1400292e8
cmp rbx, rax
jne 0x140072221
lea rdx, str.TITLE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400721f3
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140072218
add rax, 2
sub rcx, rdi
jne 0x1400721db
xor eax, eax
test eax, eax
jne 0x140072221
mov eax, dword [rsi + 0xc]
test al, 2
jne 0x14007236b
or eax, edi
lea rcx, [rbp - 0x41]
mov dword [rsi + 0xc], eax
lea rdx, [rbp - 0x61]
call fcn.14000449c
jmp 0x14007225d
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400721f5
mov rcx, r15
call fcn.1400292e8
cmp rbx, rax
jne 0x140072376
mov rax, r15
test rbx, rbx
je 0x140072253
sub r12, r15
movzx ecx, word [r12 + rax]
movzx edx, word [rax]
cmp cx, dx
jne 0x140072266
add rax, 2
sub rbx, rdi
jne 0x14007223d
xor eax, eax
test eax, eax
jne 0x140072376
mov rax, qword [rbp + 0x47]
jmp 0x140071c69
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140072255
mov rcx, r15
call fcn.1400292e8
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x140072319
test rcx, rcx
je 0x1400722a4
mov rax, qword [rbp - 0x61]
sub rax, r15
movzx edx, word [rax + r15]
cmp dx, word [r15]
jne 0x1400722c5
add r15, 2
sub rcx, rdi
jne 0x140072290
xor eax, eax
test eax, eax
jne 0x140072319
mov rax, qword [rsi]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140072345
xor edi, edi
jmp 0x140072363
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400722a6
mov rcx, r15
call fcn.1400292e8
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x140072319
test rcx, rcx
je 0x1400722ff
mov rax, qword [rbp - 0x61]
sub rax, r15
movzx edx, word [rax + r15]
cmp dx, word [r15]
jne 0x140072310
add r15, 2
sub rcx, rdi
jne 0x1400722eb
xor eax, eax
test eax, eax
jne 0x140072319
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
jmp 0x14007233d
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140072301
or edi, 0xffffffff
jmp 0x140072363
mov rcx, qword [rbp - 0x61]
lea rdx, [rbp + 0x47]
call fcn.14007ed3c
mov rcx, qword [rbp + 0x47]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400722be
mov rdx, qword [rbp + 0x47]
mov rcx, rsi
call fcn.140072980
mov rax, qword [rsi]
mov rcx, qword [rax]
mov qword [rbp + 0x47], rcx
mov rcx, qword [rbp + 0x5f]
lea rdx, [rbp + 0x47]
call fcn.140071a60
jmp 0x140072363
mov edi, 0xfffffffd
mov r14d, edi
jmp 0x140072459
mov r14d, 0xfffffffc
jmp 0x140072459
or r14d, 0xffffffff
jmp 0x140072459
mov r12, qword [rbp + 0x5f]
lea rbx, [rsi + 0x38]
lea r14, [rsi + 0x128]
xor r15d, r15d
cmp qword [rbp - 0x39], r15
je 0x1400723a3
lea rdx, [rbp - 0x41]
mov rcx, r13
call fcn.14000449c
mov eax, dword [rsi + 0xc]
test eax, eax
cmove eax, edi
or eax, 4
mov dword [rsi + 0xc], eax
cmp byte [rsi + 0x10], r15b
jne 0x1400723ce
mov rcx, rbx
call fcn.14000691c
mov edx, dword [rbx + 8]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [rsi + 0xc]
test dil, al
je 0x1400723ef
cmp byte [rsi + 0x10], r15b
jne 0x1400723ef
mov rcx, r13
call fcn.14000691c
mov edx, dword [r13 + 8]
mov rcx, qword [r13]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
cmp byte [rbp + 0x6f], r15b
je 0x140072410
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r8, rsi
lea rdx, [0x140072494]
mov rcx, rax
call qword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x140072420
mov rdx, rsi
lea rcx, [0x140072494]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rdx, r14
mov rcx, r12
call fcn.14007159c
mov rcx, r14
call fcn.1400018fc
mov r14d, dword [rsi + 0x120]
cmp r14d, edi
jl 0x140072459
mov rax, qword [r12 + 8]
mov rcx, rsi
mov rdx, qword [rax]
mov rdx, qword [rdx]
call fcn.140072980
mov r14d, dword [rsi + 0x120]
lea rcx, [rbp - 0x41]
call fcn.1400054ac
lea rcx, [rbp - 0x61]
call fcn.1400054ac
lea rcx, [rbp - 0x21]
call fcn.1400054ac
mov rbx, qword [rsp + 0xe8]
mov eax, r14d
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret