Function at 0x140070c54
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xa0
mov rsi, rcx
mov r12, r9
mov rcx, r9
mov rdi, r8
mov rbx, rdx
call fcn.140002c0c
lea r14, [rsi + 0x158]
mov rcx, r14
call fcn.140002c0c
mov al, byte [rbp + 0x7f]
lea r13, [rsi + 0x18]
mov byte [rsi + 8], al
mov rdx, rbx
mov al, byte [rbp + 0x77]
mov rcx, r13
mov byte [rsi + 9], al
call fcn.14000ca70
lea rbx, [rsi + 0x38]
mov rdx, rdi
mov rcx, rbx
call fcn.14000ca70
lea r15, [0x1400b6538]
mov rdx, r15
lea rcx, [rsi + 0x118]
call fcn.140005d7c
mov eax, dword [rbp + 0x67]
lea rcx, [rbp - 0x21]
mov dword [rsi + 0x14], eax
mov edi, 1
xor eax, eax
mov qword [rsi + 0x138], rdi
mov dword [rsi + 0xc], eax
mov dword [rsi + 0x150], eax
mov byte [rsi + 0x10], dil
call fcn.14000717c
lea rcx, [rbp - 0x61]
call fcn.14000717c
lea rcx, [rbp - 0x41]
call fcn.14000717c
mov eax, dword [rsi + 0x14]
test eax, eax
jns 0x140070d29
mov ecx, eax
call fcn.14002dc8c
mov dword [rsi + 0x14], eax
mov byte [rsi + 0x10], 0
cmp eax, 4
jne 0x140070d39
mov rdx, r13
call fcn.1400707d8
mov dword [rsi + 0x14], edi
cmp qword [rsi + 0x20], 0
jne 0x140070d6a
cmp qword [rsi + 0x40], 0
jne 0x140070d6a
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
mov rcx, rsi
call fcn.140071ad0
mov rax, qword [rsi]
mov rcx, qword [rax]
mov qword [rbp + 0x47], rcx
mov rcx, r12
jmp 0x140071497
xor edx, edx
mov rcx, r13
call fcn.140008794
cmp word [rax], 0x5b
jne 0x1400714d2
mov rdx, qword [rsi + 0x20]
mov rcx, r13
dec rdx
call fcn.140008794
cmp word [rax], 0x5d
jne 0x1400714d2
mov rax, qword [rsi + 0x20]
mov r14d, 0xfffffffe
sub rax, 2
mov qword [rbp - 0x69], rdi
mov qword [rbp + 0x47], rax
lea r9, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x61]
mov rcx, r13
lea rdx, [rbp - 0x21]
lea rbx, str.LAST
call fcn.1400709fc
test al, al
je 0x1400714c3
mov rcx, rbx
call fcn.140028cc8
mov rbx, qword [rbp - 0x19]
mov r12, qword [rbp - 0x21]
cmp rbx, rax
jne 0x140070e28
lea rdx, str.LAST
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070e1e
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140070f35
add rax, 2
sub rcx, rdi
jne 0x140070e02
xor eax, eax
test eax, eax
je 0x1400713b3
lea rcx, str.ACTIVE
call fcn.140028cc8
cmp rbx, rax
jne 0x140070e77
lea rdx, str.ACTIVE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070e6d
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140070f41
add rax, 2
sub rcx, rdi
jne 0x140070e51
xor eax, eax
test eax, eax
je 0x140071412
lea rcx, [0x1400dc600]
call fcn.140028cc8
cmp rbx, rax
jne 0x140070ec6
lea rdx, [0x1400dc600]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070ebc
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140070f4d
add rax, 2
sub rcx, rdi
jne 0x140070ea0
xor eax, eax
test eax, eax
je 0x140071462
lea rcx, str.REGEXPTITLE
call fcn.140028cc8
cmp rbx, rax
jne 0x140070f62
lea rdx, str.REGEXPTITLE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070f0b
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140070f59
add rax, 2
sub rcx, rdi
jne 0x140070ef3
xor eax, eax
test eax, eax
jne 0x140070f62
mov eax, dword [rsi + 0xc]
test dil, al
jne 0x1400714a2
or eax, 2
lea rcx, [rsi + 0x58]
mov dword [rsi + 0xc], eax
call fcn.140008040
lea rcx, [rsi + 0x58]
jmp 0x14007101f
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070e20
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070e6f
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070ebe
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070f0d
lea rcx, str.CLASS
call fcn.140028cc8
cmp rbx, rax
jne 0x140070fc2
lea rdx, str.CLASS
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070fa3
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140070fb9
add rax, 2
sub rcx, rdi
jne 0x140070f8b
xor eax, eax
test eax, eax
jne 0x140070fc2
or dword [rsi + 0xc], 8
lea rcx, [rsi + 0x118]
jmp 0x140071351
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070fa5
lea rcx, str.REGEXPCLASS
call fcn.140028cc8
cmp rbx, rax
jne 0x14007103e
lea rdx, str.REGEXPCLASS
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071003
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071035
add rax, 2
sub rcx, rdi
jne 0x140070feb
xor eax, eax
test eax, eax
jne 0x14007103e
or dword [rsi + 0xc], 0x10
lea rbx, [rsi + 0xb8]
mov rcx, rbx
call fcn.140008040
mov rcx, rbx
lea rdx, [rbp - 0x61]
call fcn.140007ee0
test eax, eax
jne 0x14007159d
jmp 0x1400713a1
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071005
lea rcx, str.XYWH
call fcn.140028cc8
cmp rbx, rax
jne 0x1400710a7
lea rdx, str.XYWH
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x14007107f
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x14007109e
add rax, 2
sub rcx, rdi
jne 0x140071067
xor eax, eax
test eax, eax
jne 0x1400710a7
bts dword [rsi + 0xc], 7
mov rcx, qword [rbp - 0x61]
call fcn.14002a77c
mov dword [rsi + 0x140], eax
jmp 0x1400713a1
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071081
lea rcx, [0x1400dc4d0]
call fcn.140028cc8
cmp rbx, rax
jne 0x140071110
lea rdx, [0x1400dc4d0]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400710e8
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071107
add rax, 2
sub rcx, rdi
jne 0x1400710d0
xor eax, eax
test eax, eax
jne 0x140071110
bts dword [rsi + 0xc], 8
mov rcx, qword [rbp - 0x61]
call fcn.14002a77c
mov dword [rsi + 0x144], eax
jmp 0x1400713a1
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400710ea
lea rcx, [0x1400dc4d4]
call fcn.140028cc8
cmp rbx, rax
jne 0x140071179
lea rdx, [0x1400dc4d4]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071151
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071170
add rax, 2
sub rcx, rdi
jne 0x140071139
xor eax, eax
test eax, eax
jne 0x140071179
bts dword [rsi + 0xc], 9
mov rcx, qword [rbp - 0x61]
call fcn.14002a77c
mov dword [rsi + 0x148], eax
jmp 0x1400713a1
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071153
lea rcx, [0x1400dc4d8]
call fcn.140028cc8
cmp rbx, rax
jne 0x1400711e2
lea rdx, [0x1400dc4d8]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400711ba
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400711d9
add rax, 2
sub rcx, rdi
jne 0x1400711a2
xor eax, eax
test eax, eax
jne 0x1400711e2
bts dword [rsi + 0xc], 0xa
mov rcx, qword [rbp - 0x61]
call fcn.14002a77c
mov dword [rsi + 0x14c], eax
jmp 0x1400713a1
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400711bc
lea rcx, str.INSTANCE
call fcn.140028cc8
cmp rbx, rax
jne 0x14007124a
lea rdx, str.INSTANCE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071223
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071241
add rax, 2
sub rcx, rdi
jne 0x14007120b
xor eax, eax
test eax, eax
jne 0x14007124a
or dword [rsi + 0xc], 0x20
mov rcx, qword [rbp - 0x61]
call fcn.14002a77c
mov dword [rsi + 0x138], eax
jmp 0x1400713a1
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071225
lea rcx, [0x1400dc5e8]
call fcn.140028cc8
cmp rbx, rax
jne 0x1400712f6
lea rdx, [0x1400dc5e8]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x14007128f
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400712e4
add rax, 2
sub rcx, rdi
jne 0x140071277
xor eax, eax
test eax, eax
jne 0x1400712f6
mov rcx, r15
call fcn.140028cc8
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x1400714ba
mov rax, r15
test rcx, rcx
je 0x1400712d1
mov r9, qword [rbp - 0x61]
sub r9, r15
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400712ed
add rax, 2
sub rcx, rdi
jne 0x1400712b9
xor eax, eax
test eax, eax
jne 0x1400714ba
or dword [rsi + 0xc], 0x40
jmp 0x1400713a1
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071291
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400712d3
lea rcx, str.TITLE
call fcn.140028cc8
cmp rbx, rax
jne 0x140071365
lea rdx, str.TITLE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071337
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x14007135c
add rax, 2
sub rcx, rdi
jne 0x14007131f
xor eax, eax
test eax, eax
jne 0x140071365
mov eax, dword [rsi + 0xc]
test al, 2
jne 0x1400714af
or eax, edi
lea rcx, [rbp - 0x41]
mov dword [rsi + 0xc], eax
lea rdx, [rbp - 0x61]
call fcn.14000ca70
jmp 0x1400713a1
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071339
mov rcx, r15
call fcn.140028cc8
cmp rbx, rax
jne 0x1400714ba
mov rax, r15
test rbx, rbx
je 0x140071397
sub r12, r15
movzx ecx, word [r12 + rax]
movzx edx, word [rax]
cmp cx, dx
jne 0x1400713aa
add rax, 2
sub rbx, rdi
jne 0x140071381
xor eax, eax
test eax, eax
jne 0x1400714ba
mov rax, qword [rbp + 0x47]
jmp 0x140070dad
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071399
mov rcx, r15
call fcn.140028cc8
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x14007145d
test rcx, rcx
je 0x1400713e8
mov rax, qword [rbp - 0x61]
sub rax, r15
movzx edx, word [rax + r15]
cmp dx, word [r15]
jne 0x140071409
add r15, 2
sub rcx, rdi
jne 0x1400713d4
xor eax, eax
test eax, eax
jne 0x14007145d
mov rax, qword [rsi]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140071489
xor edi, edi
jmp 0x1400714a7
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400713ea
mov rcx, r15
call fcn.140028cc8
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x14007145d
test rcx, rcx
je 0x140071443
mov rax, qword [rbp - 0x61]
sub rax, r15
movzx edx, word [rax + r15]
cmp dx, word [r15]
jne 0x140071454
add r15, 2
sub rcx, rdi
jne 0x14007142f
xor eax, eax
test eax, eax
jne 0x14007145d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
jmp 0x140071481
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071445
or edi, 0xffffffff
jmp 0x1400714a7
mov rcx, qword [rbp - 0x61]
lea rdx, [rbp + 0x47]
call fcn.14007dcb0
mov rcx, qword [rbp + 0x47]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140071402
mov rdx, qword [rbp + 0x47]
mov rcx, rsi
call fcn.140071ad0
mov rax, qword [rsi]
mov rcx, qword [rax]
mov qword [rbp + 0x47], rcx
mov rcx, qword [rbp + 0x5f]
lea rdx, [rbp + 0x47]
call fcn.140070ba4
jmp 0x1400714a7
mov edi, 0xfffffffd
mov r14d, edi
jmp 0x14007159d
mov r14d, 0xfffffffc
jmp 0x14007159d
or r14d, 0xffffffff
jmp 0x14007159d
mov r12, qword [rbp + 0x5f]
lea rbx, [rsi + 0x38]
lea r14, [rsi + 0x158]
xor r15d, r15d
cmp qword [rbp - 0x39], r15
je 0x1400714e7
lea rdx, [rbp - 0x41]
mov rcx, r13
call fcn.14000ca70
mov eax, dword [rsi + 0xc]
test eax, eax
cmove eax, edi
or eax, 4
mov dword [rsi + 0xc], eax
cmp byte [rsi + 0x10], r15b
jne 0x140071512
mov rcx, rbx
call fcn.140009170
mov edx, dword [rbx + 8]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [rsi + 0xc]
test dil, al
je 0x140071533
cmp byte [rsi + 0x10], r15b
jne 0x140071533
mov rcx, r13
call fcn.140009170
mov edx, dword [r13 + 8]
mov rcx, qword [r13]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
cmp byte [rbp + 0x6f], r15b
je 0x140071554
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r8, rsi
lea rdx, [0x1400715d8]
mov rcx, rax
call qword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x140071564
mov rdx, rsi
lea rcx, [0x1400715d8]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rdx, r14
mov rcx, r12
call fcn.1400706e0
mov rcx, r14
call fcn.140002c0c
mov r14d, dword [rsi + 0x150]
cmp r14d, edi
jl 0x14007159d
mov rax, qword [r12 + 8]
mov rcx, rsi
mov rdx, qword [rax]
mov rdx, qword [rdx]
call fcn.140071ad0
mov r14d, dword [rsi + 0x150]
lea rcx, [rbp - 0x41]
call fcn.140008a8c
lea rcx, [rbp - 0x61]
call fcn.140008a8c
lea rcx, [rbp - 0x21]
call fcn.140008a8c
mov rbx, qword [rsp + 0xe8]
mov eax, r14d
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret