Function at 0x140070d1c
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xa0
mov rsi, rcx
mov r12, r9
mov rcx, r9
mov rdi, r8
mov rbx, rdx
call fcn.140002598
lea r14, [rsi + 0x128]
mov rcx, r14
call fcn.140002598
mov al, byte [rbp + 0x7f]
lea r13, [rsi + 0x18]
mov byte [rsi + 8], al
mov rdx, rbx
mov al, byte [rbp + 0x77]
mov rcx, r13
mov byte [rsi + 9], al
call fcn.14000caa8
lea rbx, [rsi + 0x38]
mov rdx, rdi
mov rcx, rbx
call fcn.14000caa8
lea r15, [0x1400b64d8]
mov rdx, r15
lea rcx, [rsi + 0xe8]
call fcn.140006784
mov eax, dword [rbp + 0x67]
lea rcx, [rbp - 0x21]
mov dword [rsi + 0x14], eax
mov edi, 1
xor eax, eax
mov qword [rsi + 0x108], rdi
mov dword [rsi + 0xc], eax
mov dword [rsi + 0x120], eax
mov byte [rsi + 0x10], dil
call fcn.1400080e8
lea rcx, [rbp - 0x61]
call fcn.1400080e8
lea rcx, [rbp - 0x41]
call fcn.1400080e8
mov eax, dword [rsi + 0x14]
test eax, eax
jns 0x140070df1
mov ecx, eax
call fcn.14002dc8c
mov dword [rsi + 0x14], eax
mov byte [rsi + 0x10], 0
cmp eax, 4
jne 0x140070e01
mov rdx, r13
call fcn.1400708a0
mov dword [rsi + 0x14], edi
cmp qword [rsi + 0x20], 0
jne 0x140070e32
cmp qword [rsi + 0x40], 0
jne 0x140070e32
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
mov rcx, rsi
call fcn.140071b8c
mov rax, qword [rsi]
mov rcx, qword [rax]
mov qword [rbp + 0x47], rcx
mov rcx, r12
jmp 0x14007155f
xor edx, edx
mov rcx, r13
call fcn.140008834
cmp word [rax], 0x5b
jne 0x14007159a
mov rdx, qword [rsi + 0x20]
mov rcx, r13
dec rdx
call fcn.140008834
cmp word [rax], 0x5d
jne 0x14007159a
mov rax, qword [rsi + 0x20]
mov r14d, 0xfffffffe
sub rax, 2
mov qword [rbp - 0x69], rdi
mov qword [rbp + 0x47], rax
lea r9, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x61]
mov rcx, r13
lea rdx, [rbp - 0x21]
lea rbx, str.LAST
call fcn.140070ac4
test al, al
je 0x14007158b
mov rcx, rbx
call fcn.140028cc8
mov rbx, qword [rbp - 0x19]
mov r12, qword [rbp - 0x21]
cmp rbx, rax
jne 0x140070ef0
lea rdx, str.LAST
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070ee6
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140070ffd
add rax, 2
sub rcx, rdi
jne 0x140070eca
xor eax, eax
test eax, eax
je 0x14007147b
lea rcx, str.ACTIVE
call fcn.140028cc8
cmp rbx, rax
jne 0x140070f3f
lea rdx, str.ACTIVE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070f35
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071009
add rax, 2
sub rcx, rdi
jne 0x140070f19
xor eax, eax
test eax, eax
je 0x1400714da
lea rcx, [0x1400dc600]
call fcn.140028cc8
cmp rbx, rax
jne 0x140070f8e
lea rdx, [0x1400dc600]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070f84
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071015
add rax, 2
sub rcx, rdi
jne 0x140070f68
xor eax, eax
test eax, eax
je 0x14007152a
lea rcx, str.REGEXPTITLE
call fcn.140028cc8
cmp rbx, rax
jne 0x14007102a
lea rdx, str.REGEXPTITLE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070fd3
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071021
add rax, 2
sub rcx, rdi
jne 0x140070fbb
xor eax, eax
test eax, eax
jne 0x14007102a
mov eax, dword [rsi + 0xc]
test dil, al
jne 0x14007156a
or eax, 2
lea rcx, [rsi + 0x58]
mov dword [rsi + 0xc], eax
call fcn.140003088
lea rcx, [rsi + 0x58]
jmp 0x1400710e7
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070ee8
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070f37
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070f86
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070fd5
lea rcx, str.CLASS
call fcn.140028cc8
cmp rbx, rax
jne 0x14007108a
lea rdx, str.CLASS
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x14007106b
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071081
add rax, 2
sub rcx, rdi
jne 0x140071053
xor eax, eax
test eax, eax
jne 0x14007108a
or dword [rsi + 0xc], 8
lea rcx, [rsi + 0xe8]
jmp 0x140071419
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007106d
lea rcx, str.REGEXPCLASS
call fcn.140028cc8
cmp rbx, rax
jne 0x140071106
lea rdx, str.REGEXPCLASS
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400710cb
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400710fd
add rax, 2
sub rcx, rdi
jne 0x1400710b3
xor eax, eax
test eax, eax
jne 0x140071106
or dword [rsi + 0xc], 0x10
lea rbx, [rsi + 0xa0]
mov rcx, rbx
call fcn.140003088
mov rcx, rbx
lea rdx, [rbp - 0x61]
call fcn.140002f28
test eax, eax
jne 0x140071665
jmp 0x140071469
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400710cd
lea rcx, str.XYWH
call fcn.140028cc8
cmp rbx, rax
jne 0x14007116f
lea rdx, str.XYWH
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071147
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071166
add rax, 2
sub rcx, rdi
jne 0x14007112f
xor eax, eax
test eax, eax
jne 0x14007116f
bts dword [rsi + 0xc], 7
mov rcx, qword [rbp - 0x61]
call fcn.14002a77c
mov dword [rsi + 0x110], eax
jmp 0x140071469
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071149
lea rcx, [0x1400dc4d0]
call fcn.140028cc8
cmp rbx, rax
jne 0x1400711d8
lea rdx, [0x1400dc4d0]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400711b0
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400711cf
add rax, 2
sub rcx, rdi
jne 0x140071198
xor eax, eax
test eax, eax
jne 0x1400711d8
bts dword [rsi + 0xc], 8
mov rcx, qword [rbp - 0x61]
call fcn.14002a77c
mov dword [rsi + 0x114], eax
jmp 0x140071469
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400711b2
lea rcx, [0x1400dc4d4]
call fcn.140028cc8
cmp rbx, rax
jne 0x140071241
lea rdx, [0x1400dc4d4]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071219
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071238
add rax, 2
sub rcx, rdi
jne 0x140071201
xor eax, eax
test eax, eax
jne 0x140071241
bts dword [rsi + 0xc], 9
mov rcx, qword [rbp - 0x61]
call fcn.14002a77c
mov dword [rsi + 0x118], eax
jmp 0x140071469
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007121b
lea rcx, [0x1400dc4d8]
call fcn.140028cc8
cmp rbx, rax
jne 0x1400712aa
lea rdx, [0x1400dc4d8]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071282
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400712a1
add rax, 2
sub rcx, rdi
jne 0x14007126a
xor eax, eax
test eax, eax
jne 0x1400712aa
bts dword [rsi + 0xc], 0xa
mov rcx, qword [rbp - 0x61]
call fcn.14002a77c
mov dword [rsi + 0x11c], eax
jmp 0x140071469
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071284
lea rcx, str.INSTANCE
call fcn.140028cc8
cmp rbx, rax
jne 0x140071312
lea rdx, str.INSTANCE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400712eb
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071309
add rax, 2
sub rcx, rdi
jne 0x1400712d3
xor eax, eax
test eax, eax
jne 0x140071312
or dword [rsi + 0xc], 0x20
mov rcx, qword [rbp - 0x61]
call fcn.14002a77c
mov dword [rsi + 0x108], eax
jmp 0x140071469
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400712ed
lea rcx, [0x1400dc5e8]
call fcn.140028cc8
cmp rbx, rax
jne 0x1400713be
lea rdx, [0x1400dc5e8]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071357
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400713ac
add rax, 2
sub rcx, rdi
jne 0x14007133f
xor eax, eax
test eax, eax
jne 0x1400713be
mov rcx, r15
call fcn.140028cc8
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x140071582
mov rax, r15
test rcx, rcx
je 0x140071399
mov r9, qword [rbp - 0x61]
sub r9, r15
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400713b5
add rax, 2
sub rcx, rdi
jne 0x140071381
xor eax, eax
test eax, eax
jne 0x140071582
or dword [rsi + 0xc], 0x40
jmp 0x140071469
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071359
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007139b
lea rcx, str.TITLE
call fcn.140028cc8
cmp rbx, rax
jne 0x14007142d
lea rdx, str.TITLE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400713ff
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071424
add rax, 2
sub rcx, rdi
jne 0x1400713e7
xor eax, eax
test eax, eax
jne 0x14007142d
mov eax, dword [rsi + 0xc]
test al, 2
jne 0x140071577
or eax, edi
lea rcx, [rbp - 0x41]
mov dword [rsi + 0xc], eax
lea rdx, [rbp - 0x61]
call fcn.14000caa8
jmp 0x140071469
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071401
mov rcx, r15
call fcn.140028cc8
cmp rbx, rax
jne 0x140071582
mov rax, r15
test rbx, rbx
je 0x14007145f
sub r12, r15
movzx ecx, word [r12 + rax]
movzx edx, word [rax]
cmp cx, dx
jne 0x140071472
add rax, 2
sub rbx, rdi
jne 0x140071449
xor eax, eax
test eax, eax
jne 0x140071582
mov rax, qword [rbp + 0x47]
jmp 0x140070e75
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071461
mov rcx, r15
call fcn.140028cc8
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x140071525
test rcx, rcx
je 0x1400714b0
mov rax, qword [rbp - 0x61]
sub rax, r15
movzx edx, word [rax + r15]
cmp dx, word [r15]
jne 0x1400714d1
add r15, 2
sub rcx, rdi
jne 0x14007149c
xor eax, eax
test eax, eax
jne 0x140071525
mov rax, qword [rsi]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140071551
xor edi, edi
jmp 0x14007156f
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400714b2
mov rcx, r15
call fcn.140028cc8
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x140071525
test rcx, rcx
je 0x14007150b
mov rax, qword [rbp - 0x61]
sub rax, r15
movzx edx, word [rax + r15]
cmp dx, word [r15]
jne 0x14007151c
add r15, 2
sub rcx, rdi
jne 0x1400714f7
xor eax, eax
test eax, eax
jne 0x140071525
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
jmp 0x140071549
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007150d
or edi, 0xffffffff
jmp 0x14007156f
mov rcx, qword [rbp - 0x61]
lea rdx, [rbp + 0x47]
call fcn.14007dd8c
mov rcx, qword [rbp + 0x47]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400714ca
mov rdx, qword [rbp + 0x47]
mov rcx, rsi
call fcn.140071b8c
mov rax, qword [rsi]
mov rcx, qword [rax]
mov qword [rbp + 0x47], rcx
mov rcx, qword [rbp + 0x5f]
lea rdx, [rbp + 0x47]
call fcn.140070c6c
jmp 0x14007156f
mov edi, 0xfffffffd
mov r14d, edi
jmp 0x140071665
mov r14d, 0xfffffffc
jmp 0x140071665
or r14d, 0xffffffff
jmp 0x140071665
mov r12, qword [rbp + 0x5f]
lea rbx, [rsi + 0x38]
lea r14, [rsi + 0x128]
xor r15d, r15d
cmp qword [rbp - 0x39], r15
je 0x1400715af
lea rdx, [rbp - 0x41]
mov rcx, r13
call fcn.14000caa8
mov eax, dword [rsi + 0xc]
test eax, eax
cmove eax, edi
or eax, 4
mov dword [rsi + 0xc], eax
cmp byte [rsi + 0x10], r15b
jne 0x1400715da
mov rcx, rbx
call fcn.140009210
mov edx, dword [rbx + 8]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [rsi + 0xc]
test dil, al
je 0x1400715fb
cmp byte [rsi + 0x10], r15b
jne 0x1400715fb
mov rcx, r13
call fcn.140009210
mov edx, dword [r13 + 8]
mov rcx, qword [r13]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
cmp byte [rbp + 0x6f], r15b
je 0x14007161c
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r8, rsi
lea rdx, [0x1400716a0]
mov rcx, rax
call qword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x14007162c
mov rdx, rsi
lea rcx, [0x1400716a0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rdx, r14
mov rcx, r12
call fcn.1400707a8
mov rcx, r14
call fcn.140002598
mov r14d, dword [rsi + 0x120]
cmp r14d, edi
jl 0x140071665
mov rax, qword [r12 + 8]
mov rcx, rsi
mov rdx, qword [rax]
mov rdx, qword [rdx]
call fcn.140071b8c
mov r14d, dword [rsi + 0x120]
lea rcx, [rbp - 0x41]
call fcn.140008b2c
lea rcx, [rbp - 0x61]
call fcn.140008b2c
lea rcx, [rbp - 0x21]
call fcn.140008b2c
mov rbx, qword [rsp + 0xe8]
mov eax, r14d
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret