Function at 0x18002ba30
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x150], rax
call fcn.18002b2f0
test al, al
je 0x18002bcad
lea rcx, [0x1800edec0]
call fcn.18005b3a0
test al, al
jne 0x18002baf8
lea rcx, [0x1800ede60]
call fcn.18005b3a0
test al, al
je 0x18002ba95
call fcn.18005b000
test al, al
sete al
jmp 0x18002bade
lea rcx, [0x1800edf80]
call fcn.18005b3a0
test al, al
je 0x18002bab1
call fcn.18005b050
test al, al
sete al
jmp 0x18002bade
lea rcx, [0x1800edf20]
call fcn.18005b3a0
test al, al
je 0x18002bae4
lea rcx, [rsp + 0x90]
call fcn.180011880
mov qword [rsp + 0x70], rax
cmp dword [rax + 0xc], 7
je 0x18002baf8
call fcn.18005b000
mov byte [rsp + 0x20], al
jmp 0x18002baf0
lea rcx, [0x1800edfe0]
call fcn.18005b3a0
test al, al
je 0x18002bcad
lea rcx, [0x1800ede60]
call fcn.18005b3a0
test al, al
je 0x18002bb13
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
call fcn.18002bcf0
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
or rdi, 0xffffffffffffffff
cmp word [rax], bx
jne 0x18002bb5f
mov r8d, ebx
jmp 0x18002bb6c
mov r8, rdi
inc r8
cmp word [rax + r8*2], bx
jne 0x18002bb62
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180012800
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.180072fc0
nop
cmp qword [rsp + 0x48], 8
jb 0x18002bb9f
mov rcx, qword [rsp + 0x30]
call fcn.18008cab0
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
lea rcx, [rsp + 0xb0]
call fcn.180011be0
nop
call fcn.18004af40
mov dl, 1
mov ecx, 0x2718
call fcn.18002d480
lea rcx, [0x1800ede60]
call fcn.18005b3a0
test al, al
je 0x18002bbff
xor edx, edx
lea rcx, [0x18005c480]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x18005c480]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x18002bc16
mov rcx, rbx
mov qword [rsp + 0x50], rbx
jmp 0x18002bc1e
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.18004c040
nop
cmp qword [rsp + 0xc8], 8
jb 0x18002bc45
mov rcx, qword [rsp + 0xb0]
call fcn.18008cab0
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0xb0], bx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x18002bcad
mov qword [rsp + 0x28], rcx
mov eax, edi
lock xadd dword [rcx + 8], eax
dec eax
jne 0x18002bcad
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x18002bcad
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
call fcn.180063080
mov rcx, qword [0x1800eddc8]
test rcx, rcx
je 0x18002bcc7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800aeb50
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret