Function at 0x140070de4
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xa0
mov rsi, rcx
mov r12, r9
mov rcx, r9
mov rdi, r8
mov rbx, rdx
call fcn.140003b9c
lea r14, [rsi + 0x128]
mov rcx, r14
call fcn.140003b9c
mov al, byte [rbp + 0x7f]
lea r13, [rsi + 0x18]
mov byte [rsi + 8], al
mov rdx, rbx
mov al, byte [rbp + 0x77]
mov rcx, r13
mov byte [rsi + 9], al
call fcn.14000e148
lea rbx, [rsi + 0x38]
mov rdx, rdi
mov rcx, rbx
call fcn.14000e148
lea r15, [0x1400b64d8]
mov rdx, r15
lea rcx, [rsi + 0xe8]
call fcn.140007d8c
mov eax, dword [rbp + 0x67]
lea rcx, [rbp - 0x21]
mov dword [rsi + 0x14], eax
mov edi, 1
xor eax, eax
mov qword [rsi + 0x108], rdi
mov dword [rsi + 0xc], eax
mov dword [rsi + 0x120], eax
mov byte [rsi + 0x10], dil
call fcn.1400096d8
lea rcx, [rbp - 0x61]
call fcn.1400096d8
lea rcx, [rbp - 0x41]
call fcn.1400096d8
mov eax, dword [rsi + 0x14]
test eax, eax
jns 0x140070eb9
mov ecx, eax
call fcn.14002dd9c
mov dword [rsi + 0x14], eax
mov byte [rsi + 0x10], 0
cmp eax, 4
jne 0x140070ec9
mov rdx, r13
call fcn.140070968
mov dword [rsi + 0x14], edi
cmp qword [rsi + 0x20], 0
jne 0x140070efa
cmp qword [rsi + 0x40], 0
jne 0x140070efa
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
mov rcx, rsi
call fcn.140071c44
mov rax, qword [rsi]
mov rcx, qword [rax]
mov qword [rbp + 0x47], rcx
mov rcx, r12
jmp 0x140071627
xor edx, edx
mov rcx, r13
call fcn.140009e24
cmp word [rax], 0x5b
jne 0x140071662
mov rdx, qword [rsi + 0x20]
mov rcx, r13
dec rdx
call fcn.140009e24
cmp word [rax], 0x5d
jne 0x140071662
mov rax, qword [rsi + 0x20]
mov r14d, 0xfffffffe
sub rax, 2
mov qword [rbp - 0x69], rdi
mov qword [rbp + 0x47], rax
lea r9, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x61]
mov rcx, r13
lea rdx, [rbp - 0x21]
lea rbx, str.LAST
call fcn.140070b8c
test al, al
je 0x140071653
mov rcx, rbx
call fcn.140028dd8
mov rbx, qword [rbp - 0x19]
mov r12, qword [rbp - 0x21]
cmp rbx, rax
jne 0x140070fb8
lea rdx, str.LAST
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070fae
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400710c5
add rax, 2
sub rcx, rdi
jne 0x140070f92
xor eax, eax
test eax, eax
je 0x140071543
lea rcx, str.ACTIVE
call fcn.140028dd8
cmp rbx, rax
jne 0x140071007
lea rdx, str.ACTIVE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140070ffd
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400710d1
add rax, 2
sub rcx, rdi
jne 0x140070fe1
xor eax, eax
test eax, eax
je 0x1400715a2
lea rcx, [0x1400dc5f0]
call fcn.140028dd8
cmp rbx, rax
jne 0x140071056
lea rdx, [0x1400dc5f0]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x14007104c
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400710dd
add rax, 2
sub rcx, rdi
jne 0x140071030
xor eax, eax
test eax, eax
je 0x1400715f2
lea rcx, str.REGEXPTITLE
call fcn.140028dd8
cmp rbx, rax
jne 0x1400710f2
lea rdx, str.REGEXPTITLE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x14007109b
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400710e9
add rax, 2
sub rcx, rdi
jne 0x140071083
xor eax, eax
test eax, eax
jne 0x1400710f2
mov eax, dword [rsi + 0xc]
test dil, al
jne 0x140071632
or eax, 2
lea rcx, [rsi + 0x58]
mov dword [rsi + 0xc], eax
call fcn.1400046bc
lea rcx, [rsi + 0x58]
jmp 0x1400711af
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070fb0
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140070fff
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007104e
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007109d
lea rcx, str.CLASS
call fcn.140028dd8
cmp rbx, rax
jne 0x140071152
lea rdx, str.CLASS
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071133
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071149
add rax, 2
sub rcx, rdi
jne 0x14007111b
xor eax, eax
test eax, eax
jne 0x140071152
or dword [rsi + 0xc], 8
lea rcx, [rsi + 0xe8]
jmp 0x1400714e1
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071135
lea rcx, str.REGEXPCLASS
call fcn.140028dd8
cmp rbx, rax
jne 0x1400711ce
lea rdx, str.REGEXPCLASS
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071193
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400711c5
add rax, 2
sub rcx, rdi
jne 0x14007117b
xor eax, eax
test eax, eax
jne 0x1400711ce
or dword [rsi + 0xc], 0x10
lea rbx, [rsi + 0xa0]
mov rcx, rbx
call fcn.1400046bc
mov rcx, rbx
lea rdx, [rbp - 0x61]
call fcn.14000452c
test eax, eax
jne 0x14007172d
jmp 0x140071531
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071195
lea rcx, str.XYWH
call fcn.140028dd8
cmp rbx, rax
jne 0x140071237
lea rdx, str.XYWH
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x14007120f
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x14007122e
add rax, 2
sub rcx, rdi
jne 0x1400711f7
xor eax, eax
test eax, eax
jne 0x140071237
bts dword [rsi + 0xc], 7
mov rcx, qword [rbp - 0x61]
call fcn.14002a88c
mov dword [rsi + 0x110], eax
jmp 0x140071531
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071211
lea rcx, [0x1400dc4c0]
call fcn.140028dd8
cmp rbx, rax
jne 0x1400712a0
lea rdx, [0x1400dc4c0]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x140071278
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071297
add rax, 2
sub rcx, rdi
jne 0x140071260
xor eax, eax
test eax, eax
jne 0x1400712a0
bts dword [rsi + 0xc], 8
mov rcx, qword [rbp - 0x61]
call fcn.14002a88c
mov dword [rsi + 0x114], eax
jmp 0x140071531
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007127a
lea rcx, [0x1400dc4c4]
call fcn.140028dd8
cmp rbx, rax
jne 0x140071309
lea rdx, [0x1400dc4c4]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400712e1
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071300
add rax, 2
sub rcx, rdi
jne 0x1400712c9
xor eax, eax
test eax, eax
jne 0x140071309
bts dword [rsi + 0xc], 9
mov rcx, qword [rbp - 0x61]
call fcn.14002a88c
mov dword [rsi + 0x118], eax
jmp 0x140071531
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400712e3
lea rcx, [0x1400dc4c8]
call fcn.140028dd8
cmp rbx, rax
jne 0x140071372
lea rdx, [0x1400dc4c8]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x14007134a
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071369
add rax, 2
sub rcx, rdi
jne 0x140071332
xor eax, eax
test eax, eax
jne 0x140071372
bts dword [rsi + 0xc], 0xa
mov rcx, qword [rbp - 0x61]
call fcn.14002a88c
mov dword [rsi + 0x11c], eax
jmp 0x140071531
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007134c
lea rcx, str.INSTANCE
call fcn.140028dd8
cmp rbx, rax
jne 0x1400713da
lea rdx, str.INSTANCE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400713b3
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400713d1
add rax, 2
sub rcx, rdi
jne 0x14007139b
xor eax, eax
test eax, eax
jne 0x1400713da
or dword [rsi + 0xc], 0x20
mov rcx, qword [rbp - 0x61]
call fcn.14002a88c
mov dword [rsi + 0x108], eax
jmp 0x140071531
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400713b5
lea rcx, [0x1400dc5d8]
call fcn.140028dd8
cmp rbx, rax
jne 0x140071486
lea rdx, [0x1400dc5d8]
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x14007141f
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140071474
add rax, 2
sub rcx, rdi
jne 0x140071407
xor eax, eax
test eax, eax
jne 0x140071486
mov rcx, r15
call fcn.140028dd8
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x14007164a
mov rax, r15
test rcx, rcx
je 0x140071461
mov r9, qword [rbp - 0x61]
sub r9, r15
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x14007147d
add rax, 2
sub rcx, rdi
jne 0x140071449
xor eax, eax
test eax, eax
jne 0x14007164a
or dword [rsi + 0xc], 0x40
jmp 0x140071531
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071421
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071463
lea rcx, str.TITLE
call fcn.140028dd8
cmp rbx, rax
jne 0x1400714f5
lea rdx, str.TITLE
mov rcx, rbx
mov rax, rdx
test rbx, rbx
je 0x1400714c7
mov r9, r12
sub r9, rdx
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400714ec
add rax, 2
sub rcx, rdi
jne 0x1400714af
xor eax, eax
test eax, eax
jne 0x1400714f5
mov eax, dword [rsi + 0xc]
test al, 2
jne 0x14007163f
or eax, edi
lea rcx, [rbp - 0x41]
mov dword [rsi + 0xc], eax
lea rdx, [rbp - 0x61]
call fcn.14000e148
jmp 0x140071531
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400714c9
mov rcx, r15
call fcn.140028dd8
cmp rbx, rax
jne 0x14007164a
mov rax, r15
test rbx, rbx
je 0x140071527
sub r12, r15
movzx ecx, word [r12 + rax]
movzx edx, word [rax]
cmp cx, dx
jne 0x14007153a
add rax, 2
sub rbx, rdi
jne 0x140071511
xor eax, eax
test eax, eax
jne 0x14007164a
mov rax, qword [rbp + 0x47]
jmp 0x140070f3d
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x140071529
mov rcx, r15
call fcn.140028dd8
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x1400715ed
test rcx, rcx
je 0x140071578
mov rax, qword [rbp - 0x61]
sub rax, r15
movzx edx, word [rax + r15]
cmp dx, word [r15]
jne 0x140071599
add r15, 2
sub rcx, rdi
jne 0x140071564
xor eax, eax
test eax, eax
jne 0x1400715ed
mov rax, qword [rsi]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140071619
xor edi, edi
jmp 0x140071637
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x14007157a
mov rcx, r15
call fcn.140028dd8
mov rcx, qword [rbp - 0x59]
cmp rcx, rax
jne 0x1400715ed
test rcx, rcx
je 0x1400715d3
mov rax, qword [rbp - 0x61]
sub rax, r15
movzx edx, word [rax + r15]
cmp dx, word [r15]
jne 0x1400715e4
add r15, 2
sub rcx, rdi
jne 0x1400715bf
xor eax, eax
test eax, eax
jne 0x1400715ed
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
jmp 0x140071611
sbb eax, eax
and eax, r14d
add eax, edi
jmp 0x1400715d5
or edi, 0xffffffff
jmp 0x140071637
mov rcx, qword [rbp - 0x61]
lea rdx, [rbp + 0x47]
call fcn.14007dfb0
mov rcx, qword [rbp + 0x47]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140071592
mov rdx, qword [rbp + 0x47]
mov rcx, rsi
call fcn.140071c44
mov rax, qword [rsi]
mov rcx, qword [rax]
mov qword [rbp + 0x47], rcx
mov rcx, qword [rbp + 0x5f]
lea rdx, [rbp + 0x47]
call fcn.140070d34
jmp 0x140071637
mov edi, 0xfffffffd
mov r14d, edi
jmp 0x14007172d
mov r14d, 0xfffffffc
jmp 0x14007172d
or r14d, 0xffffffff
jmp 0x14007172d
mov r12, qword [rbp + 0x5f]
lea rbx, [rsi + 0x38]
lea r14, [rsi + 0x128]
xor r15d, r15d
cmp qword [rbp - 0x39], r15
je 0x140071677
lea rdx, [rbp - 0x41]
mov rcx, r13
call fcn.14000e148
mov eax, dword [rsi + 0xc]
test eax, eax
cmove eax, edi
or eax, 4
mov dword [rsi + 0xc], eax
cmp byte [rsi + 0x10], r15b
jne 0x1400716a2
mov rcx, rbx
call fcn.14000a860
mov edx, dword [rbx + 8]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [rsi + 0xc]
test dil, al
je 0x1400716c3
cmp byte [rsi + 0x10], r15b
jne 0x1400716c3
mov rcx, r13
call fcn.14000a860
mov edx, dword [r13 + 8]
mov rcx, qword [r13]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
cmp byte [rbp + 0x6f], r15b
je 0x1400716e4
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r8, rsi
lea rdx, [0x140071768]
mov rcx, rax
call qword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x1400716f4
mov rdx, rsi
lea rcx, [0x140071768]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rdx, r14
mov rcx, r12
call fcn.140070870
mov rcx, r14
call fcn.140003b9c
mov r14d, dword [rsi + 0x120]
cmp r14d, edi
jl 0x14007172d
mov rax, qword [r12 + 8]
mov rcx, rsi
mov rdx, qword [rax]
mov rdx, qword [rdx]
call fcn.140071c44
mov r14d, dword [rsi + 0x120]
lea rcx, [rbp - 0x41]
call fcn.14000a11c
lea rcx, [rbp - 0x61]
call fcn.14000a11c
lea rcx, [rbp - 0x21]
call fcn.14000a11c
mov rbx, qword [rsp + 0xe8]
mov eax, r14d
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret