Function at 0x18000b580
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x180074080]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor r15d, r15d
mov dword [rbp + 0xc0], r15d
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xe0], r15
xor r8d, r8d
lea rdx, [0x180067048]
lea rcx, [rbp + 0xc8]
call fcn.180003360
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], r15
mov qword [rbp + 0x100], r15
xor r8d, r8d
lea rdx, [0x180067048]
lea rcx, [rbp + 0xe8]
call fcn.180003360
mov qword [rbp + 0x108], r15
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
mov dword [rbp + 0x120], r15d
mov qword [rbp + 0x138], r15
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x140], xmm1
mov dword [rbp + 0x128], 0x10000000
mov dword [rbp + 0x12c], 0x80020
mov dword [rbp + 0x124], 0x42b40000
mov byte [rbp + 0x130], 1
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov eax, dword [rbp + 0xc0]
mov dword [rsp + 0x70], eax
lea rdx, [rbp + 0xc8]
lea rcx, [rsp + 0x78]
call fcn.1800141f0
nop
lea rdx, [rbp + 0xe8]
lea rcx, [rbp - 0x68]
call fcn.1800141f0
nop
movups xmm0, xmmword [rbp + 0x108]
movups xmmword [rbp - 0x48], xmm0
mov rax, qword [rbp + 0x118]
mov qword [rbp - 0x38], rax
movss xmm0, dword [rbp + 0x120]
movss dword [rbp - 0x30], xmm0
movss xmm1, dword [rbp + 0x124]
movss dword [rbp - 0x2c], xmm1
mov eax, dword [rbp + 0x128]
mov dword [rbp - 0x28], eax
mov eax, dword [rbp + 0x12c]
mov dword [rbp - 0x24], eax
movzx eax, byte [rbp + 0x130]
mov byte [rbp - 0x20], al
lea rdx, [rbp + 0x138]
lea rcx, [rbp - 0x18]
call fcn.180012460
nop
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x70]
lea rcx, [0x1800060c0]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x58]
call fcn.180012460
nop
lea rcx, [rsp + 0x70]
call fcn.180006500
nop
mov edi, r15d
mov dword [rsp + 0x38], r15d
mov rsi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
sub rsi, r12
sar rsi, 3
mov qword [rsp + 0x40], rsi
test rsi, rsi
je 0x18000bc85
mov ebx, r15d
mov qword [rsp + 0x50], rbx
nop dword [rax + rax]
mov dword [rsp + 0x34], r15d
lea rdx, [rsp + 0x34]
mov rcx, qword [r12 + rbx*8]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [rsp + 0x34]
lea rcx, [rbp + 0x40]
call fcn.180006610
nop
mov r8, qword [rbp + 0x50]
cmp r8, 1
jbe 0x18000bc15
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 7
seta r9b
cmova rdx, qword [rbp + 0x40]
lea r8, [rdx + r8*2]
lea rdx, [rbp + 0x40]
test r9b, r9b
cmovne rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0xa0]
call fcn.180002ee0
nop
mov r14, qword [0x180077680]
mov rbx, qword [0x180077688]
mov qword [rsp + 0x48], rbx
cmp r14, rbx
je 0x18000bac1
nop dword [rax + rax]
mov rdx, r14
lea rcx, [rbp + 0x80]
call fcn.1800141f0
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 3
jbe 0x18000ba69
lea rdi, [rbp + 0x40]
cmp qword [rbp + 0x58], 7
seta cl
mov rbx, qword [rbp + 0x40]
cmova rdi, rbx
lea r8, [rbp + 0x40]
mov rax, qword [rbp + 0x50]
test cl, cl
je 0x18000b837
lea rsi, [rbx + rax*2]
jmp 0x18000b83f
lea rsi, [r8 + rax*2]
lea rbx, [rbp + 0x40]
cmp rbx, rsi
je 0x18000b863
sub rdi, rbx
movzx ecx, word [rbx]
call fcn.18003f884
mov word [rbx + rdi], ax
add rbx, 2
cmp rbx, rsi
jne 0x18000b847
mov rdx, qword [rbp + 0x90]
lea rdi, [rbp + 0x80]
mov r8, qword [rbp + 0x98]
cmp r8, 7
seta al
mov r9, qword [rbp + 0x80]
cmova rdi, r9
lea rcx, [rbp + 0x80]
test al, al
je 0x18000b897
mov rbx, r9
lea rsi, [r9 + rdx*2]
jmp 0x18000b8a2
lea rsi, [rcx + rdx*2]
lea rbx, [rbp + 0x80]
cmp rbx, rsi
je 0x18000b8da
sub rdi, rbx
nop word [rax + rax]
movzx ecx, word [rbx]
call fcn.18003f884
mov word [rdi + rbx], ax
add rbx, 2
cmp rbx, rsi
jne 0x18000b8b0
mov r8, qword [rbp + 0x98]
mov rdx, qword [rbp + 0x90]
mov r9, qword [rbp + 0x80]
lea rax, [rbp + 0x80]
cmp r8, 7
seta cl
cmova rax, r9
lea r8, [rax + rdx*2]
lea rdx, [rbp + 0x80]
test cl, cl
cmovne rdx, r9
lea rcx, [rbp + 0x20]
call fcn.180002ee0
nop
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 7
seta r9b
cmova rdx, qword [rbp + 0x40]
mov rax, qword [rbp + 0x50]
lea r8, [rdx + rax*2]
lea rdx, [rbp + 0x40]
test r9b, r9b
cmovne rdx, qword [rbp + 0x40]
lea rcx, [rbp]
call fcn.180002ee0
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x60]
call fcn.18000b350
lea r9, [rbp + 0x60]
mov r13, qword [rbp + 0x78]
cmp r13, 0xf
seta r12b
mov rdi, qword [rbp + 0x60]
cmova r9, rdi
lea rcx, [rbp]
mov rsi, qword [rbp + 0x18]
cmp rsi, 0xf
seta byte [rsp + 0x30]
mov rbx, qword [rbp]
cmova rcx, rbx
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rbp + 0x10]
call fcn.1800198e0
cmp rax, 0xffffffffffffffff
jne 0x18000bd09
test r12b, r12b
je 0x18000b9d2
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x18000b9c2
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0ed
mov rcx, rdi
call fcn.18002cc24
mov rsi, qword [rbp + 0x18]
mov rbx, qword [rbp]
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
cmp rsi, 0xf
jbe 0x18000ba19
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18000ba11
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0f3
mov rcx, rbx
call fcn.18002cc24
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x18000ba64
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ba5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0f9
call fcn.18002cc24
mov rbx, qword [rsp + 0x48]
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x18000baaf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000baaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c105
call fcn.18002cc24
add r14, 0x20
cmp r14, rbx
jne 0x18000b7f0
mov r12, qword [rsp + 0x58]
mov eax, dword [0x180077518]
inc eax
mov dword [0x180077518], eax
lea rdx, [rbp + 0xa0]
lea rcx, [rbp]
cmp eax, 1
lea rax, [rbp]
jg 0x18000be6f
mov qword [rsp + 0x48], rax
call fcn.180002be0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], 6
mov qword [rbp + 0x38], 0xf
mov ecx, dword [str.Goaway]
mov dword [rbp + 0x20], ecx
movzx ecx, word [0x180067550]
mov word [rbp + 0x24], cx
mov byte [rbp + 0x26], 0
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.1800089d0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, dword [rsp + 0x34]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18000bb6f
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
test eax, eax
jne 0x18000be64
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, dword [rsp + 0x34]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18000bbae
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
test eax, eax
jne 0x18000be64
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x7e4668e], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x18000bc02
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bbfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c11d
call fcn.18002cc24
mov rsi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x58]
mov edi, dword [rsp + 0x38]
mov rbx, qword [rsp + 0x50]
mov qword [rbp + 0x50], r15
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 7
cmova rax, qword [rbp + 0x40]
mov word [rax], r15w
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x18000bc6b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bc66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0db
call fcn.18002cc24
inc edi
mov dword [rsp + 0x38], edi
inc rbx
mov qword [rsp + 0x50], rbx
movsxd rax, edi
cmp rax, rsi
jb 0x18000b770
test r12, r12
je 0x18000bccd
mov rax, qword [rsp + 0x68]
sub rax, r12
sar rax, 3
lea rdx, [rax*8]
mov rax, r12
cmp rdx, 0x1000
jb 0x18000bcc4
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0e7
mov rcx, r12
call fcn.18002cc24
nop
lea rcx, [rbp + 0xc0]
call fcn.180006500
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.18002c850
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rbp + 0x10], r15
lea rax, [rbp]
cmp byte [rsp + 0x30], 0
cmovne rax, rbx
mov byte [rax], 0
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rax, qword [rbp + 0x20]
mov byte [rax], 0
mov qword [rbp + 0x70], r15
lea rax, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rax, qword [rbp + 0x60]
mov byte [rax], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x18000bd7e
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bd79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0ed
call fcn.18002cc24
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x18000bdc9
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bdc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0f3
call fcn.18002cc24
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x18000be15
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000be0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0f9
call fcn.18002cc24
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x18000bbc1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000be5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0ff
call fcn.18002cc24
jmp 0x18000bbc1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000bbc1
mov qword [rsp + 0x40], rax
call fcn.180002be0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], 6
mov qword [rbp + 0x38], 0xf
mov ecx, dword [str.Goaway]
mov dword [rbp + 0x20], ecx
movzx ecx, word [0x180067550]
mov word [rbp + 0x24], cx
mov byte [rbp + 0x26], 0
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.1800089d0
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x20]
call fcn.180002be0
mov rbx, rax
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r15
cmp qword [0x180074d00], 5
jae 0x18000bf05
nop word [rax + rax]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x180074d00], 5
jb 0x18000bef0
mov rdx, rbx
lea rcx, [rbp]
call fcn.180002be0
mov rcx, rax
call fcn.180006d50
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x18000bf54
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x18000bf4f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000c111
mov rcx, r8
call fcn.18002cc24
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
lea r14, [rbp + 0xa0]
mov rsi, qword [rbp + 0xa0]
mov r13, qword [rbp + 0xb8]
cmp r13, 0xf
cmova r14, rsi
movabs rbx, 0x7fffffffffffffff
mov rdi, qword [rbp + 0xb0]
cmp rdi, rbx
ja 0x18000c10b
cmp rdi, 0xf
ja 0x18000bfc8
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rbp], xmm0
jmp 0x18000c054
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x18000c001
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18002c870
test rax, rax
je 0x18000c117
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x18000c039
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000c02c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000c0e1
jmp 0x18000bfe2
test rcx, rcx
je 0x18000c039
call fcn.18002c870
mov r15, rax
mov qword [rbp], r15
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, r15
call fcn.180056760
lea rcx, [rbp]
call fcn.1800084a0
nop
cmp r13, 0xf
jbe 0x18000c096
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x18000c08d
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c11d
mov rcx, rsi
call fcn.18002cc24
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x18000bc85
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c0d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0db
call fcn.18002cc24
jmp 0x18000bc85
call fcn.1800381c0
nop
call fcn.180001520
nop
call fcn.1800381c0
nop
call fcn.1800381c0
nop
call fcn.1800381c0
nop
call fcn.1800381c0
nop
call fcn.1800381c0
int3
call fcn.1800381c0
int3
call fcn.1800015c0
int3
call fcn.1800381c0
int3
call fcn.1800381c0
nop
call fcn.1800381c0
int3