Function at 0x7ff7871335f0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc8
mov r15, r9
mov rdi, r8
mov rcx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x7ff78713362f
mov rcx, qword [r8]
call fcn.7ff78712e530
mov esi, eax
test eax, eax
je 0x7ff787133be1
mov r12d, 0xffffffff
movdqa xmm1, xmmword [0x7ff78744dd60]
movdqu xmmword [rsp + 0x20], xmm1
mov dl, 0x36
mov r8b, 0x2b
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x21], al
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rbp - 0x80], cl
xor byte [rbp - 0x7f], cl
xor byte [rbp - 0x7e], cl
xor byte [rbp - 0x7d], cl
xor byte [rbp - 0x7c], cl
xor byte [rbp - 0x7b], cl
xor byte [rbp - 0x7a], cl
xor dl, cl
mov byte [rbp - 0x79], dl
xor r8b, cl
mov byte [rbp - 0x78], r8b
xor r9b, cl
mov byte [rbp - 0x77], r9b
mov byte [rbp - 0x76], 0
lea rcx, [rsp + 0x21]
mov r14, 0xffffffffffffffff
mov rax, r14
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x7ff7871336d0
mov r8, qword [rdi + 0x10]
mov rcx, rdi
mov rbx, qword [rdi + 0x18]
cmp rbx, 0xf
jbe 0x7ff7871336ed
mov rcx, qword [rdi]
cmp r8, rax
jne 0x7ff78713380f
lea rdx, [rsp + 0x21]
call sub.vcruntime140.dll_memcmp
test eax, eax
jne 0x7ff78713380f
mov rax, rdi
cmp rbx, 0xf
jbe 0x7ff787133714
mov rax, qword [rdi]
mov qword [0x7ff787495a98], rax
lea rax, [0x7ff78743a0c8]
mov qword [0x7ff787495a90], rax
xor edx, edx
lea rcx, [0x7ff78712e5d0]
call qword [sym.imp.user32.dll_EnumWindows]
mov esi, dword [0x7ff787495aa0]
cmp esi, r12d
jne 0x7ff787133759
mov ecx, 0xa
call qword [sym.imp.kernel32.dll_Sleep]
mov esi, dword [0x7ff787495aa0]
cmp esi, r12d
je 0x7ff787133743
test esi, esi
jne 0x7ff78713380b
movdqa xmm1, xmmword [0x7ff78744d920]
movdqu xmmword [rsp + 0x20], xmm1
mov dl, 0x14
mov r8b, 0x48
mov r9b, 0x4d
mov r10b, 0x1b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x21], al
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rbp - 0x80], cl
xor byte [rbp - 0x7f], cl
xor byte [rbp - 0x7e], cl
xor byte [rbp - 0x7d], cl
xor byte [rbp - 0x7c], cl
xor byte [rbp - 0x7b], cl
xor byte [rbp - 0x7a], cl
xor dl, cl
mov byte [rbp - 0x79], dl
xor r8b, cl
mov byte [rbp - 0x78], r8b
xor r9b, cl
mov byte [rbp - 0x77], r9b
xor r10b, cl
mov byte [rbp - 0x76], r10b
mov byte [rbp - 0x75], sil
lea rdx, [0x7ff78743a0b8]
lea rcx, [rsp + 0x21]
call fcn.7ff787135370
nop
mov rcx, rdi
call fcn.7ff78711d510
nop
mov rcx, r15
call fcn.7ff78711d510
lea eax, [rsi + 3]
jmp 0x7ff787133c81
mov rbx, qword [rdi + 0x18]
movdqa xmm1, xmmword [0x7ff78744db60]
movdqu xmmword [rsp + 0x20], xmm1
mov dl, 0x2d
mov r8b, 0x30
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x21], al
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rbp - 0x80], cl
xor byte [rbp - 0x7f], cl
xor byte [rbp - 0x7e], cl
xor byte [rbp - 0x7d], cl
xor byte [rbp - 0x7c], cl
xor byte [rbp - 0x7b], cl
xor byte [rbp - 0x7a], cl
xor dl, cl
mov byte [rbp - 0x79], dl
xor r8b, cl
mov byte [rbp - 0x78], r8b
xor r9b, cl
mov byte [rbp - 0x77], r9b
mov byte [rbp - 0x76], 0
lea rcx, [rsp + 0x21]
mov rax, r14
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x7ff787133890
mov r13, qword [rdi + 0x10]
mov rcx, rdi
cmp rbx, 0xf
jbe 0x7ff7871338a9
mov rcx, qword [rdi]
cmp r13, rax
jne 0x7ff7871338c3
mov r8, r13
lea rdx, [rsp + 0x21]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x7ff787133995
movdqa xmm1, xmmword [0x7ff78744dc30]
movdqu xmmword [rsp + 0x20], xmm1
mov dl, 0x34
mov r8b, 0x36
mov r9b, 0x2c
mov r10b, 0x67
mov r11b, 0x7a
movzx ebx, r10b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x21], al
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rbp - 0x80], cl
xor byte [rbp - 0x7f], cl
xor byte [rbp - 0x7e], cl
xor byte [rbp - 0x7d], cl
xor byte [rbp - 0x7c], cl
xor byte [rbp - 0x7b], cl
xor byte [rbp - 0x7a], cl
xor dl, cl
mov byte [rbp - 0x79], dl
xor r8b, cl
mov byte [rbp - 0x78], r8b
xor r9b, cl
mov byte [rbp - 0x77], r9b
xor r10b, cl
mov byte [rbp - 0x76], r10b
xor r11b, cl
mov byte [rbp - 0x75], r11b
xor bl, cl
mov byte [rbp - 0x74], bl
mov byte [rbp - 0x73], 0
lea rax, [rsp + 0x21]
nop word [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x7ff787133960
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x7ff787133977
mov rcx, qword [rdi]
cmp r13, r14
jne 0x7ff787133a50
mov r8, r13
lea rdx, [rsp + 0x21]
call sub.vcruntime140.dll_memcmp
test eax, eax
jne 0x7ff787133a50
mov ecx, esi
call fcn.7ff78712f3f0
test al, al
jne 0x7ff787133a50
movdqa xmm1, xmmword [0x7ff78744d7a0]
movdqu xmmword [rsp + 0x20], xmm1
mov dl, 0x65
mov r8b, 0x39
mov r9b, 0x3c
mov r10b, 0x6a
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x21], al
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rbp - 0x80], cl
xor byte [rbp - 0x7f], cl
xor byte [rbp - 0x7e], cl
xor byte [rbp - 0x7d], cl
xor byte [rbp - 0x7c], cl
xor byte [rbp - 0x7b], cl
xor byte [rbp - 0x7a], cl
xor dl, cl
mov byte [rbp - 0x79], dl
xor r8b, cl
mov byte [rbp - 0x78], r8b
xor r9b, cl
mov byte [rbp - 0x77], r9b
xor r10b, cl
mov byte [rbp - 0x76], r10b
mov byte [rbp - 0x75], 0
lea rdx, [0x7ff78743a118]
lea rcx, [rsp + 0x21]
call fcn.7ff787135370
nop
mov rcx, rdi
call fcn.7ff78711d510
nop
mov rcx, r15
call fcn.7ff78711d510
mov eax, 4
jmp 0x7ff787133c81
cmp qword [rbp + 0x67], 0
je 0x7ff787133b38
mov r13, qword [rbp + 0x6f]
test r13, r13
je 0x7ff787133b38
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
lea rdx, [0x7ff7874bbea8]
cmp qword [0x7ff7874bbec0], 0xf
cmova rdx, qword [0x7ff7874bbea8]
mov rbx, qword [r15 + 0x10]
mov rcx, r15
mov r14, qword [r15 + 0x18]
cmp r14, 0xf
jbe 0x7ff787133a9a
mov rcx, qword [r15]
mov r12d, 1
cmp rbx, qword [0x7ff7874bbeb8]
jne 0x7ff787133ab5
mov r8, rbx
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x7ff787133af4
lea rdx, [0x7ff7874d34c8]
cmp qword [0x7ff7874d34e0], 0xf
cmova rdx, qword [0x7ff7874d34c8]
mov rcx, r15
cmp r14, 0xf
jbe 0x7ff787133ad8
mov rcx, qword [r15]
cmp rbx, qword [0x7ff7874d34d8]
jne 0x7ff787133af4
mov r8, rbx
call sub.vcruntime140.dll_memcmp
mov ecx, dword [rbp - 9]
test eax, eax
cmove ecx, r12d
jmp 0x7ff787133af7
mov ecx, dword [rbp - 9]
xor edx, edx
mov qword [rbp - 0x69], rdx
mov qword [rbp - 0x51], rdx
mov qword [rbp - 0x35], rdx
mov dword [rbp - 0x2d], edx
mov rax, qword [rbp + 0x67]
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x59], r13
mov dword [rbp - 0x49], esi
mov dword [rbp - 0x45], edx
mov dword [rbp - 0x41], ecx
mov dword [rbp - 0x3d], r12d
mov eax, dword [rbp - 1]
mov dword [rbp - 0x39], eax
lea rcx, [rbp - 0x69]
call fcn.7ff78718b7c0
mov r12d, eax
jmp 0x7ff787133bc1
movdqa xmm1, xmmword [0x7ff78744d420]
movdqu xmmword [rsp + 0x20], xmm1
mov dl, 0x5a
mov r8b, 6
mov r9b, 3
mov r10b, 0x55
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x21], al
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rbp - 0x80], cl
xor byte [rbp - 0x7f], cl
xor byte [rbp - 0x7e], cl
xor byte [rbp - 0x7d], cl
xor byte [rbp - 0x7c], cl
xor byte [rbp - 0x7b], cl
xor byte [rbp - 0x7a], cl
xor dl, cl
mov byte [rbp - 0x79], dl
xor r8b, cl
mov byte [rbp - 0x78], r8b
xor r9b, cl
mov byte [rbp - 0x77], r9b
xor r10b, cl
mov byte [rbp - 0x76], r10b
mov byte [rbp - 0x75], 0
lea rcx, [rsp + 0x21]
call fcn.7ff787135370
neg r12d
sbb ebx, ebx
and ebx, 5
mov rcx, rdi
call fcn.7ff78711d510
nop
mov rcx, r15
call fcn.7ff78711d510
mov eax, ebx
jmp 0x7ff787133c81
movdqa xmm1, xmmword [0x7ff78744dcc0]
movdqu xmmword [rsp + 0x20], xmm1
mov dl, 0x2b
mov r8b, 0x77
mov r9b, 0x72
mov r10b, 0x24
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x21], al
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rbp - 0x80], cl
xor byte [rbp - 0x7f], cl
xor byte [rbp - 0x7e], cl
xor byte [rbp - 0x7d], cl
xor byte [rbp - 0x7c], cl
xor byte [rbp - 0x7b], cl
xor byte [rbp - 0x7a], cl
xor dl, cl
mov byte [rbp - 0x79], dl
xor r8b, cl
mov byte [rbp - 0x78], r8b
xor r9b, cl
mov byte [rbp - 0x77], r9b
xor r10b, cl
mov byte [rbp - 0x76], r10b
mov byte [rbp - 0x75], 0
lea rcx, [rsp + 0x21]
call fcn.7ff787135370
nop
mov rcx, rdi
call fcn.7ff78711d510
nop
mov rcx, r15
call fcn.7ff78711d510
mov eax, 6
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret