Function at 0x1800047d0
Capabilities:
Enumerate gui resources

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0xb0
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r13, rcx
cmp dword [0x1800acaa0], 0
je 0x180004827
mov eax, dword [rcx + 0x78]
mov dword [rsp + 0x20], eax
lea r9, str.CTDesktopMgr::TraceCheckDesktop__tick:__08x_
lea r8, [0x180078c50]
or edx, 0xffffffff
lea rcx, [0x1800ac1b8]
call fcn.18002d570
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov ecx, dword [r13 + 0x78]
test ecx, ecx
je 0x180004849
test eax, eax
je 0x180004849
add ecx, 0x7530
cmp ecx, eax
ja 0x180004b88
cmp dword [0x1800acaa0], 0
je 0x18000486f
lea r9, str.CTDesktopMgr::TraceCheckDesktop_______
lea r8, [0x180078c50]
or edx, 0xffffffff
lea rcx, [0x1800ac1b8]
call fcn.18002d570
mov dword [r13 + 0x78], ebx
cmp qword [r13 + 0x80], 0
jne 0x180004899
xor edx, edx
mov r8d, 0x101
lea rcx, str.WinSta0
call qword [sym.imp.USER32.dll_OpenWindowStationA]
mov qword [r13 + 0x80], rax
mov rbx, qword [r13 + 0x80]
test rbx, rbx
jne 0x1800048d3
cmp dword [0x1800acaa0], ebx
je 0x180004b88
lea r9, str.CTDesktopMgr::TraceCheckDesktop_____OpenWindowStation_Failed_
lea r8, [0x180078c50]
or edx, 0xffffffff
lea rcx, [0x1800ac1b8]
call fcn.18002d570
jmp 0x180004b88
lea rcx, [rsp + 0x60]
call fcn.180001900
nop
lea r8, [rsp + 0x60]
lea rdx, [0x180003b90]
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnumDesktopsW]
lea rcx, [rsp + 0x78]
call fcn.180001900
nop
lea rdx, [r13 + 0xa8]
mov r8d, 1
lea rcx, [rsp + 0x90]
call fcn.180029850
nop
lea rdx, [r13 + 0xe0]
lea rcx, [rsp + 0x78]
call fcn.1800037e0
nop
lea rcx, [rsp + 0x90]
call fcn.1800298d0
lea rcx, [rsp + 0x78]
call fcn.180001920
mov esi, eax
lea rcx, [rsp + 0x60]
call fcn.180001920
xor r12d, r12d
cmp eax, esi
jne 0x1800049ce
mov ebp, r12d
test eax, eax
jle 0x1800049b4
nop dword [rax]
mov edi, r12d
test esi, esi
jle 0x1800049ce
nop word [rax + rax]
mov edx, edi
lea rcx, [rsp + 0x78]
call fcn.180002190
mov rbx, rax
mov edx, ebp
lea rcx, [rsp + 0x60]
call fcn.180002190
lea rdx, [rbx + 0x10]
lea rcx, [rax + 0x10]
call fcn.1800306ec
test eax, eax
je 0x1800049a4
inc edi
cmp edi, esi
jge 0x1800049ce
jmp 0x180004970
inc ebp
lea rcx, [rsp + 0x60]
call fcn.180001920
cmp ebp, eax
jl 0x180004960
lea rcx, [rsp + 0x78]
call fcn.180002210
nop
lea rcx, [rsp + 0x60]
call fcn.180002210
jmp 0x180004b88
lea rcx, [rsp + 0x48]
call fcn.180001900
nop
lea rcx, [rsp + 0x90]
call fcn.180001900
nop
lea rcx, [rsp + 0x30]
call fcn.180001900
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.1800037e0
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.1800037e0
lea rcx, [rsp + 0x48]
call fcn.180001920
mov esi, eax
sub esi, 1
js 0x180004ac0
nop word [rax + rax]
mov ebx, r12d
lea rcx, [rsp + 0x30]
call fcn.180001920
mov edi, eax
test eax, eax
jle 0x180004ab7
mov edx, esi
lea rcx, [rsp + 0x48]
call fcn.180002190
lea rbp, [rax + 0x10]
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.180002190
lea rdx, [rax + 0x10]
mov rcx, rbp
call fcn.1800306ec
test eax, eax
je 0x180004a77
inc ebx
cmp ebx, edi
jl 0x180004a53
jmp 0x180004ab7
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.180002190
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1800037c0
mov r8d, 1
mov edx, esi
lea rcx, [rsp + 0x48]
call fcn.1800021a0
mov r8d, 1
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1800021a0
sub esi, 1
jns 0x180004a30
lea rcx, [rsp + 0x48]
call fcn.180001920
mov edi, eax
lea rcx, [rsp + 0x30]
call fcn.180001920
mov esi, eax
lea ebx, [rax - 1]
test ebx, ebx
js 0x180004afc
nop
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.180002190
mov rdx, rax
mov rcx, r13
call fcn.1800042b0
sub ebx, 1
jns 0x180004ae0
test edi, edi
jle 0x180004b20
mov edx, r12d
lea rcx, [rsp + 0x48]
call fcn.180002190
mov rdx, rax
mov rcx, r13
call fcn.180003c80
inc r12d
cmp r12d, edi
jl 0x180004b00
cmp dword [0x1800acaa0], 0
je 0x180004b4f
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
lea r9, str.CTDesktopMgr::TraceCheckDesktop_____Add:__d___Del:__d_
lea r8, [0x180078c50]
or edx, 0xffffffff
lea rcx, [0x1800ac1b8]
call fcn.18002d570
nop
lea rcx, [rsp + 0x30]
call fcn.180002210
nop
lea rcx, [rsp + 0x90]
call fcn.180002210
nop
lea rcx, [rsp + 0x48]
call fcn.180002210
nop
lea rcx, [rsp + 0x78]
call fcn.180002210
nop
lea rcx, [rsp + 0x60]
call fcn.180002210
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret