Function at 0x6e8b20
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x3b0
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x128], rbp
nop
mov qword [rbp + 0x388], 0
call sub.user32.dll_GetProcessWindowStation
mov qword [rbp + 0x390], rax
call sub.kernel32.dll_GetCurrentProcessId
mov ecx, eax
call fcn.006e7b30
mov dword [rbp + 0x380], eax
cmp dword [rbp + 0x380], 0
jne 0x6e8cc6
mov cx, 1
lea rdx, [0x006e9fac]
call fcn.0047cfa0
jmp 0x6e9e5d
mov ecx, 0x100000
xor rdx, rdx
mov r8d, dword [rbp + 0x380]
call sub.kernel32.dll_OpenProcess
mov qword [rbp + 0x3a0], rax
cmp qword [rbp + 0x3a0], 0
jne 0x6e8d38
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x384], eax
lea rcx, [rbp + 0x118]
mov edx, dword [rbp + 0x384]
call fcn.00435d20
lea rcx, [rbp + 0x120]
lea rdx, [0x006e9fe0]
mov r8, qword [rbp + 0x118]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x120]
call fcn.0047cfa0
jmp 0x6e9e5d
call fcn.0047d380
mov dword [rbp + 0x37c], eax
lea rcx, [rbp + 0x15e]
mov edx, 0x20a
xor r8, r8
call fcn.00408d50
lea rcx, [rbp + 0x15e]
mov rax, qword [0x00a8dff0]
mov rdx, qword [rax]
lea r8, [rbp + 0x37c]
call sub.user32.dll_wvsprintfW
mov ecx, 0x100000
xor rdx, rdx
or r8d, 0xffffffff
lea r9, [rbp + 0x15e]
call fcn.005eeff0
mov qword [rbp + 0x398], rax
cmp qword [rbp + 0x398], 0
jne 0x6e8df7
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x384], eax
lea rcx, [rbp + 0x108]
mov edx, dword [rbp + 0x384]
call fcn.00435d20
lea rcx, [rbp + 0x110]
lea rdx, [0x006ea018]
mov r8, qword [rbp + 0x108]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x110]
call fcn.0047cfa0
mov rcx, qword [rbp + 0x3a0]
call sub.kernel32.dll_CloseHandle_1
jmp 0x6e9e5d
mov ecx, 7
call fcn.00406550
mov dword [rbp + 0x148], eax
mov ecx, 7
call fcn.00406550
mov dword [rbp + 0x14c], eax
mov ecx, 7
call fcn.00406550
mov dword [rbp + 0x150], eax
mov ecx, 7
call fcn.00406550
mov dword [rbp + 0x154], eax
mov ecx, 7
call fcn.00406550
mov dword [rbp + 0x158], eax
lea rcx, [rbp + 0x140]
lea rdx, [0x006ea050]
xor r8, r8
call fcn.00486b10
lea rcx, [0x00a9a268]
mov rdx, qword [0x006e7ab0]
mov r8d, 1
mov r9d, 8
call fcn.00411ea0
mov dword [rbp + 0x368], 0
movsxd rax, dword [rbp + 0x368]
add rax, rax
add rax, rax
add rax, rax
mov rcx, qword [0x00a9a268]
add rcx, rax
mov rdx, qword [0x006e7a70]
mov r8d, 1
mov r9d, 8
call fcn.00411ea0
mov dword [rbp + 0x36c], 0
mov eax, dword [rbp + 0x368]
cmp eax, 4
jg 0x6e8f0a
cmp eax, 4
je 0x6e90a6
sub eax, 1
cmp eax, 0xffffffff
je 0x6e8f30
test eax, eax
je 0x6e8f9c
sub eax, 1
test eax, eax
je 0x6e8fe3
sub eax, 1
test eax, eax
jne 0x6e91de
jmp 0x6e9041
sub eax, 5
test eax, eax
je 0x6e90f6
sub eax, 1
test eax, eax
je 0x6e9146
sub eax, 1
test eax, eax
jne 0x6e91de
jmp 0x6e9193
lea rcx, [rbp + 0x100]
mov rdx, qword [rbp + 0x140]
mov r8d, dword [rbp + 0x36c]
add r8d, r8d
add r8d, r8d
add r8d, 1
mov r9d, 4
call fcn.00410500
lea rcx, [rbp + 0xf8]
mov rdx, qword [rbp + 0x100]
call fcn.00410060
mov rcx, qword [rbp + 0xf8]
call fcn.00485ea0
mov rcx, qword [0x00a9a268]
movsxd rdx, dword [rbp + 0x368]
mov rcx, qword [rcx + rdx*8]
movsxd rdx, dword [rbp + 0x36c]
mov word [rcx + rdx*2], ax
jmp 0x6e91de
mov rax, qword [0x00a9a268]
movsxd rcx, dword [rbp + 0x368]
mov rax, qword [rax + rcx*8]
movsxd rcx, dword [rbp + 0x36c]
mov rdx, qword [0x00a9a268]
mov rdx, qword [rdx]
movsxd r8, dword [rbp + 0x36c]
mov r9, qword [0x00a9a268]
mov r9, qword [r9]
movzx rdx, word [rdx + r8*2]
xor dx, word [r9 + 0xe]
mov word [rax + rcx*2], dx
jmp 0x6e91de
mov rax, qword [0x00a9a268]
movsxd rcx, dword [rbp + 0x368]
mov r8, qword [rax + rcx*8]
movsxd r9, dword [rbp + 0x36c]
mov rax, qword [0x00a9a268]
mov rcx, qword [rax]
movsxd r10, dword [rbp + 0x36c]
mov rax, qword [0x00a9a268]
mov rax, qword [rax]
movsxd rdx, dword [rbp + 0x36c]
movzx eax, word [rax + rdx*2]
mov r11d, 0x10
xor edx, edx
div r11d
movzx rax, word [rcx + r10*2]
mov ecx, edx
shl eax, cl
mov word [r8 + r9*2], ax
jmp 0x6e91de
mov rax, qword [0x00a9a268]
movsxd rcx, dword [rbp + 0x368]
mov r8, qword [rax + rcx*8]
movsxd r9, dword [rbp + 0x36c]
mov rax, qword [0x00a9a268]
mov rax, qword [rax]
movsxd rcx, dword [rbp + 0x36c]
movzx r10d, word [rax + rcx*2]
mov ecx, 0x10
mov rax, qword [0x00a9a268]
mov rax, qword [rax]
movsxd rdx, dword [rbp + 0x36c]
movzx eax, word [rax + rdx*2]
mov r11d, 0x10
xor edx, edx
div r11d
sub ecx, edx
shr r10d, cl
mov word [r8 + r9*2], r10w
jmp 0x6e91de
mov rax, qword [0x00a9a268]
movsxd rcx, dword [rbp + 0x368]
mov rax, qword [rax + rcx*8]
movsxd rcx, dword [rbp + 0x36c]
mov rdx, qword [0x00a9a268]
mov rdx, qword [rdx + 8]
movsxd r8, dword [rbp + 0x36c]
mov r9, qword [0x00a9a268]
mov r9, qword [r9 + 0x18]
movsxd r10, dword [rbp + 0x36c]
movzx rdx, word [rdx + r8*2]
xor dx, word [r9 + r10*2]
mov word [rax + rcx*2], dx
jmp 0x6e91de
mov rax, qword [0x00a9a268]
movsxd rcx, dword [rbp + 0x368]
mov rax, qword [rax + rcx*8]
movsxd rcx, dword [rbp + 0x36c]
mov rdx, qword [0x00a9a268]
mov rdx, qword [rdx + 0x10]
movsxd r8, dword [rbp + 0x36c]
mov r9, qword [0x00a9a268]
mov r9, qword [r9 + 0x20]
movsxd r10, dword [rbp + 0x36c]
movzx rdx, word [rdx + r8*2]
xor dx, word [r9 + r10*2]
mov word [rax + rcx*2], dx
jmp 0x6e91de
mov rax, qword [0x00a9a268]
movsxd rcx, dword [rbp + 0x368]
mov rax, qword [rax + rcx*8]
movsxd rcx, dword [rbp + 0x36c]
mov rdx, qword [0x00a9a268]
mov rdx, qword [rdx + 0x18]
movsxd r8, dword [rbp + 0x36c]
mov r9, qword [0x00a9a268]
mov r9, qword [r9 + 0x28]
movsxd r10, dword [rbp + 0x36c]
movzx rdx, word [rdx + r8*2]
xor dx, word [r9 + r10*2]
mov word [rax + rcx*2], dx
jmp 0x6e91de
mov rax, qword [0x00a9a268]
movsxd rcx, dword [rbp + 0x368]
mov rax, qword [rax + rcx*8]
movsxd rcx, dword [rbp + 0x36c]
mov rdx, qword [0x00a9a268]
mov rdx, qword [rdx + 0x20]
movsxd r8, dword [rbp + 0x36c]
mov r9, qword [0x00a9a268]
mov r9, qword [r9 + 0x30]
movsxd r10, dword [rbp + 0x36c]
movzx rdx, word [rdx + r8*2]
xor dx, word [r9 + r10*2]
mov word [rax + rcx*2], dx
add dword [rbp + 0x36c], 1
cmp dword [rbp + 0x36c], 8
jne 0x6e8ecb
nop
add dword [rbp + 0x368], 1
cmp dword [rbp + 0x368], 8
jne 0x6e8e8d
nop
mov rax, qword [0x00a9a268]
mov rax, qword [rax + 0x18]
mov rcx, qword [0x00a9a268]
mov rcx, qword [rcx + 0x18]
movzx rax, word [rax + 6]
or ax, word [rcx + 8]
and ax, 0xffff
mov rcx, qword [0x00a9a268]
mov rcx, qword [rcx + 0x20]
xor ax, word [rcx + 0xa]
mov rcx, qword [0x00a9a268]
mov rcx, qword [rcx + 0x30]
xor ax, word [rcx + 0xa]
movzx eax, ax
mov ecx, 2
xor edx, edx
div ecx
test edx, edx
jne 0x6e9286
mov rcx, qword [0x0045caf0]
mov dl, 1
call fcn.0046e750
mov qword [0x00a9a258], rax
mov rcx, qword [0x0045caf0]
mov dl, 1
call fcn.0046e750
mov qword [0x00a9a250], rax
jmp 0x6e92b0
mov rcx, qword [0x0045caf0]
mov dl, 1
call fcn.0046e750
mov qword [0x00a9a250], rax
mov rcx, qword [0x0045caf0]
mov dl, 1
call fcn.0046e750
mov qword [0x00a9a258], rax
mov rax, qword [0x00a9a268]
mov rax, qword [rax + 0x28]
mov rcx, qword [0x00a9a268]
mov rcx, qword [rcx + 0x28]
movzx rax, word [rax + 0xa]
or ax, word [rcx + 8]
and ax, 0xffff
mov rcx, qword [0x00a9a268]
mov rcx, qword [rcx + 0x18]
xor ax, word [rcx + 0xc]
mov rcx, qword [0x00a9a268]
mov rcx, qword [rcx + 0x30]
xor ax, word [rcx + 2]
movzx eax, ax
mov ecx, 2
xor edx, edx
div ecx
test edx, edx
jne 0x6e932e
mov rcx, qword [0x00457e40]
mov dl, 1
call fcn.0040ad50
mov qword [0x00a9a260], rax
mov rcx, qword [0x006e18c8]
mov dl, 1
call fcn.006e1a00
mov qword [rbp + 0x3a8], rax
jmp 0x6e9358
mov rcx, qword [0x006e18c8]
mov dl, 1
call fcn.006e1a00
mov qword [rbp + 0x3a8], rax
mov rcx, qword [0x00457e40]
mov dl, 1
call fcn.0040ad50
mov qword [0x00a9a260], rax
mov qword [rbp + 0x370], 0
lea rcx, [0x006ea064]
mov dl, 1
call fcn.00486c50
mov byte [rbp + 0x15d], al
nop
mov rcx, qword [rbp + 0x3a8]
add rcx, 0x40
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8dfe0]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x3a8]
add rcx, 0x48
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8dfe0]
mov r8, qword [rax]
call fcn.004102f0
mov rax, qword [rbp + 0x3a8]
mov dword [rax + 0x50], 0x64
mov rax, qword [rbp + 0x3a8]
mov dword [rax + 0x54], 0x3e8
mov rax, qword [rbp + 0x3a8]
mov byte [rax + 0x58], 1
mov rax, qword [rbp + 0x3a8]
mov byte [rax + 0x59], 1
mov rax, qword [rbp + 0x3a8]
mov byte [rax + 0x5a], 0
mov rax, qword [rbp + 0x3a8]
mov rcx, qword [rax + 0x70]
mov dx, 0x7c
call fcn.0046d930
lea rcx, [rbp + 0xf0]
lea rdx, [0x006ea078]
xor r8, r8
call fcn.00486b10
mov rax, qword [rbp + 0x3a8]
mov rcx, qword [rax + 0x70]
mov rdx, qword [rbp + 0xf0]
call fcn.0046d530
mov rcx, qword [rbp + 0x3a8]
call fcn.006e1c10
mov rax, qword [0x00a9a268]
movsxd rcx, dword [rbp + 0x14c]
mov rax, qword [rax + rcx*8]
movsxd rcx, dword [rbp + 0x148]
mov rdx, qword [0x00a9a268]
movsxd r8, dword [rbp + 0x150]
mov rdx, qword [rdx + r8*8]
movsxd r8, dword [rbp + 0x14c]
mov r9, qword [0x00a9a268]
movsxd r10, dword [rbp + 0x154]
mov r9, qword [r9 + r10*8]
movsxd r10, dword [rbp + 0x14c]
movzx rdx, word [rdx + r8*2]
or dx, word [r9 + r10*2]
and dx, 0xffff
mov r8, qword [0x00a9a268]
movsxd r9, dword [rbp + 0x158]
mov r8, qword [r8 + r9*8]
movsxd r9, dword [rbp + 0x158]
xor dx, word [r8 + r9*2]
mov r8, qword [0x00a9a268]
movsxd r9, dword [rbp + 0x148]
mov r8, qword [r8 + r9*8]
movsxd r9, dword [rbp + 0x150]
xor dx, word [r8 + r9*2]
cmp word [rax + rcx*2], dx
jne 0x6e9516
mov byte [0x009bb658], 0
mov ecx, 2
lea rdx, [rbp + 0x398]
xor r8, r8
mov r9d, 0x3e8
call sub.kernel32.dll_WaitForMultipleObjects
cmp eax, 0x102
jne 0x6e9c5a
jmp 0x6e9545
mov ecx, 2
lea rdx, [rbp + 0x398]
xor r8, r8
mov r9d, 0x3e8
call sub.kernel32.dll_WaitForMultipleObjects
cmp eax, 0x102
jne 0x6e9c5a
mov byte [0x009bb658], 0
lea rcx, [0x006e8a00]
xor rdx, rdx
call sub.user32.dll_EnumWindowStationsW
test eax, eax
setne al
test al, al
jne 0x6e95a9
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x384], eax
lea rcx, [rbp + 0xe0]
mov edx, dword [rbp + 0x384]
call fcn.00435d20
lea rcx, [rbp + 0xe8]
lea rdx, [0x006ea09c]
mov r8, qword [rbp + 0xe0]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0xe8]
call fcn.0047cfa0
jmp 0x6e944a
cmp byte [0x009bb658], 1
jne 0x6e96ad
cmp byte [0x009bb659], 0
jne 0x6e97f4
cmp qword [rbp + 0x388], 0
jne 0x6e95ea
lea rcx, [0x006ea0c6]
xor rdx, rdx
mov r8d, 0x2000000
call sub.user32.dll_OpenWindowStationW
mov qword [rbp + 0x388], rax
cmp qword [rbp + 0x388], 0
jne 0x6e9640
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x384], eax
lea rcx, [rbp + 0xd0]
mov edx, dword [rbp + 0x384]
call fcn.00435d20
lea rcx, [rbp + 0xd8]
lea rdx, [0x006ea0e4]
mov r8, qword [rbp + 0xd0]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0xd8]
call fcn.0047cfa0
jmp 0x6e944a
mov rcx, qword [rbp + 0x388]
call sub.user32.dll_SetProcessWindowStation
test eax, eax
setne al
test al, al
jne 0x6e96a1
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x384], eax
lea rcx, [rbp + 0xc0]
mov edx, dword [rbp + 0x384]
call fcn.00435d20
lea rcx, [rbp + 0xc8]
lea rdx, [0x006ea118]
mov r8, qword [rbp + 0xc0]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0xc8]
call fcn.0047cfa0
jmp 0x6e944a
mov byte [0x009bb659], 1
jmp 0x6e97f4
cmp byte [0x009bb659], 1
jne 0x6e944a
mov byte [0x009bb659], 0
mov rcx, qword [0x00a9a258]
mov rax, qword [0x00a9a258]
mov rax, qword [rax]
call qword [rax + 0x28]
xor rcx, rcx
mov ebx, eax
sub ebx, 1
mov dword [rbp + 0x36c], ecx
cmp dword [rbp + 0x36c], ebx
jg 0x6e972b
add ebx, 1
mov rcx, qword [0x00a9a258]
lea rdx, [rbp + 0xb8]
mov r8d, dword [rbp + 0x36c]
mov rax, qword [0x00a9a258]
mov rsi, qword [rax]
call qword [rsi + 0x18]
mov rcx, qword [rbp + 0xb8]
call fcn.006e8860
add dword [rbp + 0x36c], 1
cmp dword [rbp + 0x36c], ebx
jne 0x6e96ee
nop
mov rcx, qword [rbp + 0x390]
call sub.user32.dll_SetProcessWindowStation
test eax, eax
setne al
test al, al
jne 0x6e9788
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x384], eax
lea rcx, [rbp + 0xa8]
mov edx, dword [rbp + 0x384]
call fcn.00435d20
lea rcx, [rbp + 0xb0]
lea rdx, [0x006ea15c]
mov r8, qword [rbp + 0xa8]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0xb0]
call fcn.0047cfa0
mov rcx, qword [rbp + 0x388]
call sub.user32.dll_CloseWindowStation
test eax, eax
setne al
test al, al
jne 0x6e97e4
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x384], eax
lea rcx, [rbp + 0x98]
mov edx, dword [rbp + 0x384]
call fcn.00435d20
lea rcx, [rbp + 0xa0]
lea rdx, [0x006ea1a0]
mov r8, qword [rbp + 0x98]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0xa0]
call fcn.0047cfa0
mov qword [rbp + 0x388], 0
jmp 0x6e944a
mov ecx, 9
call fcn.00406550
mov rcx, qword [0x00a9a268]
mov rcx, qword [rcx + 0x28]
mov rdx, qword [0x00a9a268]
mov rdx, qword [rdx + 0x18]
movzx rcx, word [rcx + 4]
or cx, word [rdx + 0xc]
and cx, 0xffff
mov rdx, qword [0x00a9a268]
mov rdx, qword [rdx]
xor cx, word [rdx + 0xc]
mov rdx, qword [0x00a9a268]
mov rdx, qword [rdx + 0x20]
xor cx, word [rdx + 0xc]
movzx ecx, cx
mov r8d, eax
add r8d, 1
mov eax, ecx
cdq
idiv r8d
test edx, edx
jne 0x6e986c
mov rcx, qword [0x00a9a250]
mov rax, qword [0x00a9a250]
mov rbx, qword [rax]
call qword [rbx + 0x88]
jmp 0x6e9883
mov rcx, qword [0x00a9a250]
mov rax, qword [0x00a9a250]
mov rbx, qword [rax]
call qword [rbx + 0x88]
mov rcx, qword [rbp + 0x388]
lea rdx, [0x006e8aa0]
xor r8, r8
call sub.user32.dll_EnumDesktopsW
mov rcx, qword [0x00a9a258]
mov rax, qword [0x00a9a258]
mov rax, qword [rax]
call qword [rax + 0x28]
xor rcx, rcx
mov ebx, eax
sub ebx, 1
mov dword [rbp + 0x36c], ecx
cmp dword [rbp + 0x36c], ebx
jg 0x6e9a29
add ebx, 1
mov rcx, qword [0x00a9a258]
lea rdx, [rbp + 0x90]
mov r8d, dword [rbp + 0x36c]
mov rax, qword [0x00a9a258]
mov rsi, qword [rax]
call qword [rsi + 0x18]
mov rcx, qword [0x00a9a250]
mov rdx, qword [rbp + 0x90]
mov rax, qword [0x00a9a250]
mov rax, qword [rax]
call qword [rax + 0xa8]
cmp eax, 0xffffffff
jne 0x6e9a16
mov rcx, qword [0x00a9a258]
lea rdx, [rbp + 0x88]
mov r8d, dword [rbp + 0x36c]
mov rax, qword [0x00a9a258]
mov rsi, qword [rax]
call qword [rsi + 0x18]
mov rcx, qword [rbp + 0x88]
lea rdx, [0x006ea1d8]
call fcn.0042af30
test eax, eax
jne 0x6e996d
cmp qword [rbp + 0x370], 0
je 0x6e996d
mov rcx, qword [rbp + 0x370]
call fcn.0040ae10
mov qword [rbp + 0x370], 0
mov rax, qword [0x00a9a268]
mov rax, qword [rax + 0x28]
mov rcx, qword [0x00a9a268]
mov rcx, qword [rcx + 8]
movzx rax, word [rax + 0xa]
or ax, word [rcx + 0xe]
and ax, 0xffff
mov rcx, qword [0x00a9a268]
mov rcx, qword [rcx + 0x20]
xor ax, word [rcx + 0xc]
mov rcx, qword [0x00a9a268]
mov rcx, qword [rcx + 8]
xor ax, word [rcx]
movzx eax, ax
mov ecx, 2
xor edx, edx
div ecx
test edx, edx
jne 0x6e99ee
mov rcx, qword [0x00a9a258]
lea rdx, [rbp + 0x80]
mov r8d, dword [rbp + 0x36c]
mov rax, qword [0x00a9a258]
mov rsi, qword [rax]
call qword [rsi + 0x18]
mov rcx, qword [rbp + 0x80]
call fcn.006e8860
jmp 0x6e9a16
mov rcx, qword [0x00a9a258]
lea rdx, [rbp + 0x78]
mov r8d, dword [rbp + 0x36c]
mov rax, qword [0x00a9a258]
mov rsi, qword [rax]
call qword [rsi + 0x18]
mov rcx, qword [rbp + 0x78]
call fcn.006e8860
add dword [rbp + 0x36c], 1
cmp dword [rbp + 0x36c], ebx
jne 0x6e98ca
nop
mov rcx, qword [0x00a9a250]
mov rax, qword [0x00a9a250]
mov rax, qword [rax]
call qword [rax + 0x28]
xor rcx, rcx
mov ebx, eax
sub ebx, 1
mov dword [rbp + 0x36c], ecx
cmp dword [rbp + 0x36c], ebx
jg 0x6e9bc8
add ebx, 1
mov rcx, qword [0x00a9a250]
lea rdx, [rbp + 0x70]
mov r8d, dword [rbp + 0x36c]
mov rax, qword [0x00a9a250]
mov rsi, qword [rax]
call qword [rsi + 0x18]
mov rcx, qword [0x00a9a258]
mov rdx, qword [rbp + 0x70]
mov rax, qword [0x00a9a258]
mov rax, qword [rax]
call qword [rax + 0xa8]
cmp eax, 0xffffffff
jne 0x6e9bb5
mov ecx, 9
call fcn.00406550
mov rcx, qword [0x00a9a268]
mov rcx, qword [rcx + 0x38]
mov rdx, qword [0x00a9a268]
mov rdx, qword [rdx + 0x10]
movzx rcx, word [rcx]
or cx, word [rdx]
and cx, 0xffff
mov rdx, qword [0x00a9a268]
mov rdx, qword [rdx + 0x10]
xor cx, word [rdx + 2]
mov rdx, qword [0x00a9a268]
mov rdx, qword [rdx + 0x10]
xor cx, word [rdx + 6]
movzx ecx, cx
mov r8d, eax
add r8d, 1
mov eax, ecx
cdq
idiv r8d
test edx, edx
jne 0x6e9b26
mov rcx, qword [0x00a9a250]
lea rdx, [rbp + 0x68]
mov r8d, dword [rbp + 0x36c]
mov rax, qword [0x00a9a250]
mov rsi, qword [rax]
call qword [rsi + 0x18]
mov rcx, qword [rbp + 0x68]
call fcn.006e7f50
jmp 0x6e9b4e
mov rcx, qword [0x00a9a250]
lea rdx, [rbp + 0x60]
mov r8d, dword [rbp + 0x36c]
mov rax, qword [0x00a9a250]
mov rsi, qword [rax]
call qword [rsi + 0x18]
mov rcx, qword [rbp + 0x60]
call fcn.006e7f50
cmp byte [rbp + 0x15d], 1
jne 0x6e9bb5
mov rcx, qword [0x00a9a250]
lea rdx, [rbp + 0x58]
mov r8d, dword [rbp + 0x36c]
mov rax, qword [0x00a9a250]
mov rsi, qword [rax]
call qword [rsi + 0x18]
mov rcx, qword [rbp + 0x58]
lea rdx, [0x006ea1d8]
call fcn.0042af30
test eax, eax
jne 0x6e9bb5
cmp qword [rbp + 0x370], 0
jne 0x6e9bb5
mov rcx, qword [0x0068f900]
mov dl, 1
call fcn.0068fa50
mov qword [rbp + 0x370], rax
mov rcx, qword [rbp + 0x370]
call fcn.0068fbd0
add dword [rbp + 0x36c], 1
cmp dword [rbp + 0x36c], ebx
jne 0x6e9a5b
nop
mov rax, qword [0x00a9a268]
mov rax, qword [rax + 0x28]
mov rcx, qword [0x00a9a268]
mov rcx, qword [rcx + 0x28]
movzx rax, word [rax + 0xa]
or ax, word [rcx]
and ax, 0xffff
mov rcx, qword [0x00a9a268]
mov rcx, qword [rcx + 0x18]
xor ax, word [rcx + 4]
mov rcx, qword [0x00a9a268]
mov rcx, qword [rcx + 0x18]
xor ax, word [rcx + 4]
movzx eax, ax
mov ecx, 2
xor edx, edx
div ecx
test edx, edx
jne 0x6e9c3a
mov rcx, qword [0x00a9a258]
mov rdx, qword [0x00a9a250]
mov rax, qword [0x00a9a258]
mov rbx, qword [rax]
call qword [rbx + 0x10]
jmp 0x6e944a
mov rcx, qword [0x00a9a258]
mov rdx, qword [0x00a9a250]
mov rax, qword [0x00a9a258]
mov rbx, qword [rax]
call qword [rbx + 0x10]
jmp 0x6e944a
nop
cmp qword [rbp + 0x370], 0
je 0x6e9c71
mov rcx, qword [rbp + 0x370]
call fcn.0040ae10
mov rcx, qword [0x00a9a258]
mov rax, qword [0x00a9a258]
mov rax, qword [rax]
call qword [rax + 0x28]
xor rcx, rcx
mov ebx, eax
sub ebx, 1
mov dword [rbp + 0x36c], ecx
cmp dword [rbp + 0x36c], ebx
jg 0x6e9d64
add ebx, 1
mov ecx, 9
call fcn.00406550
mov rcx, qword [0x00a9a268]
mov rcx, qword [rcx + 8]
mov rdx, qword [0x00a9a268]
mov rdx, qword [rdx + 8]
movzx rcx, word [rcx + 4]
or cx, word [rdx]
and cx, 0xffff
mov rdx, qword [0x00a9a268]
mov rdx, qword [rdx + 0x10]
xor cx, word [rdx]
mov rdx, qword [0x00a9a268]
mov rdx, qword [rdx + 0x18]
xor cx, word [rdx]
movzx ecx, cx
mov r8d, eax
add r8d, 1
mov eax, ecx
cdq
idiv r8d
test edx, edx
jne 0x6e9d29
mov rcx, qword [0x00a9a258]
lea rdx, [rbp + 0x50]
mov r8d, dword [rbp + 0x36c]
mov rax, qword [0x00a9a258]
mov rsi, qword [rax]
call qword [rsi + 0x18]
mov rcx, qword [rbp + 0x50]
call fcn.006e8860
jmp 0x6e9d51
mov rcx, qword [0x00a9a258]
lea rdx, [rbp + 0x48]
mov r8d, dword [rbp + 0x36c]
mov rax, qword [0x00a9a258]
mov rsi, qword [rax]
call qword [rsi + 0x18]
mov rcx, qword [rbp + 0x48]
call fcn.006e8860
add dword [rbp + 0x36c], 1
cmp dword [rbp + 0x36c], ebx
jne 0x6e9ca2
nop
cmp qword [rbp + 0x388], 0
je 0x6e9e13
mov rcx, qword [rbp + 0x390]
call sub.user32.dll_SetProcessWindowStation
test eax, eax
setne al
test al, al
jne 0x6e9dc3
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x384], eax
lea rcx, [rbp + 0x38]
mov edx, dword [rbp + 0x384]
call fcn.00435d20
lea rcx, [rbp + 0x40]
lea rdx, [0x006ea15c]
mov r8, qword [rbp + 0x38]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x40]
call fcn.0047cfa0
mov rcx, qword [rbp + 0x388]
call sub.user32.dll_CloseWindowStation
test eax, eax
setne al
test al, al
jne 0x6e9e13
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x384], eax
lea rcx, [rbp + 0x28]
mov edx, dword [rbp + 0x384]
call fcn.00435d20
lea rcx, [rbp + 0x30]
lea rdx, [0x006ea1a0]
mov r8, qword [rbp + 0x28]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x30]
call fcn.0047cfa0
nop
mov rcx, qword [rbp + 0x3a8]
call fcn.0040ae10
mov rcx, qword [0x00a9a250]
call fcn.0040ae10
mov rcx, qword [0x00a9a258]
call fcn.0040ae10
mov rcx, qword [0x00a9a260]
call fcn.0040ae10
mov rcx, qword [rbp + 0x398]
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [rbp + 0x3a0]
call sub.kernel32.dll_CloseHandle_1
nop
lea rcx, [rbp + 0x28]
mov edx, 0x1a
call fcn.0040e160
lea rcx, [rbp + 0xf8]
call fcn.0040e120
lea rcx, [rbp + 0x100]
mov edx, 5
call fcn.0040e160
lea rcx, [rbp + 0x140]
call fcn.0040e080
lea rsp, [rbp + 0x3b0]
pop rbx
pop rsi
pop rbp
ret