Function at 0x14004dd50
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x14022b800]
xor rax, rsp
mov qword [rbp + 0x90], rax
movzx r15d, r8b
movzx r12d, dl
mov rsi, rcx
xor r13d, r13d
mov edi, r13d
mov dword [rsp + 0x40], r13d
cmp byte [rcx + 0x18], r13b
je 0x14004e115
lea rdx, str.Gif_replay_stop_request_received
lea ecx, [r13 + 6]
call fcn.140083970
cmp byte [rsi + 0x19], dil
je 0x14004de01
mov word [rsi + 0x18], di
mov rcx, qword [rsi + 8]
call fcn.14002fbe0
mov rbx, rax
mov edi, dword [rax + 0x30]
test edi, edi
je 0x14004e115
call fcn.1400616f0
mov rcx, rax
mov r9, qword [rbx]
mov r8d, edi
lea edx, [r13 + 6]
call fcn.140057a80
call fcn.1400616f0
mov rcx, rax
mov edx, dword [rbx + 0x30]
call fcn.1400582a0
mov dword [rbx + 0x30], r13d
jmp 0x14004e115
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r13w
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x80], 7
mov word [rbp + 0x68], r13w
mov dword [rbp + 0x20], 5
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
mov dword [rbp - 0x70], 5
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x68]
call fcn.140006b00
nop
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x48]
call fcn.140006b00
nop
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x28]
call fcn.140006b00
mov eax, dword [rbp + 0x88]
mov dword [rbp - 8], eax
mov rcx, qword [rsi + 8]
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov rcx, qword [rcx + 0x58]
call fcn.1400cdde0
test eax, eax
jne 0x14004e0e5
mov rcx, qword [rsi + 8]
call fcn.14002fbe0
cmp qword [rax + 8], 0
je 0x14004df04
mov rcx, qword [rsi + 8]
call fcn.14002fbe0
mov rdx, qword [rax + 8]
add rdx, 0x38
lea rcx, [rbp]
call fcn.140006b00
mov edi, 4
mov dword [rsp + 0x40], edi
lea r8, [rbp]
cmp qword [rbp + 0x18], 8
cmovae r8, qword [rbp]
lea rdx, str.Gif_replay_stopped_for_desktop__s
lea ecx, [rdi + 2]
call fcn.140083970
nop
lea rcx, [rbp]
call fcn.140004ff0
jmp 0x14004df15
lea rdx, str.Gif_replay_stopped._No_desktop.
mov ecx, 6
call fcn.140083970
mov byte [rsi + 0x18], 0
mov rcx, qword [rsi + 8]
call fcn.14002fcf0
test al, al
jne 0x14004df33
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx + 0x58]
call fcn.1400cd510
mov rcx, qword [rsi + 8]
call fcn.14002fbe0
mov rbx, rax
mov r14d, dword [rax + 0x30]
test r14d, r14d
je 0x14004df74
call fcn.1400616f0
mov rcx, rax
mov r9, qword [rbx]
mov r8d, r14d
mov edx, 6
call fcn.140057a80
call fcn.1400616f0
mov rcx, rax
mov edx, dword [rbx + 0x30]
call fcn.1400582a0
mov dword [rbx + 0x30], r13d
test r12b, r12b
je 0x14004e0bd
lea ebx, [r15*2 + 0xad]
test r15b, r15b
je 0x14004dfc1
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r13w
xor r8d, r8d
lea rdx, [0x1401c16d8]
lea rcx, [rsp + 0x50]
call fcn.140005060
lea rax, [rsp + 0x50]
or edi, 1
jmp 0x14004dfdc
call fcn.1400623a0
mov rcx, rax
mov r8d, 0x75
lea rdx, [rsp + 0x70]
call fcn.140060b50
or edi, 2
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
test dil, 2
je 0x14004e00f
and edi, 0xfffffffd
lea rcx, [rsp + 0x70]
call fcn.140004ff0
nop
test dil, 1
je 0x14004e01f
lea rcx, [rsp + 0x50]
call fcn.140004ff0
lea r14, [rbp]
cmp qword [rbp + 0x18], 8
cmovae r14, qword [rbp]
mov r15, qword [rsi + 8]
mov rdi, qword [r15 + 0x20]
test rdi, rdi
jne 0x14004e06e
mov ecx, 0xa8
call fcn.14014f310
mov rdi, rax
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0xa8
mov rcx, rax
call fcn.140152140
mov rdx, r15
mov rcx, rdi
call fcn.140040750
mov rdi, rax
mov qword [r15 + 0x20], rax
mov rax, qword [rdi + 0x70]
cmp byte [rax + 0x51], 0
jne 0x14004e087
xor edx, edx
call fcn.140037880
mov rax, qword [rdi + 0x70]
mov byte [rax + 0x51], 1
call fcn.140061c90
mov rcx, rax
call fcn.140020330
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov r9d, eax
mov r8, r14
mov edx, ebx
mov rcx, rdi
call fcn.140040930
nop
lea rcx, [rbp]
call fcn.140004ff0
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0x130]
mov rax, qword [rcx]
test rax, rax
je 0x14004e0fa
mov byte [rax + 4], 0
xor edx, edx
lea rcx, [0x14002ec70]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x14004e0fa
mov r8d, eax
lea rdx, str.Gif_Replay:_Failed_to_stop_capturing_pipline__d
mov ecx, 6
call fcn.1400838f0
nop
lea rcx, [rbp + 0x68]
call fcn.140004ff0
lea rcx, [rbp + 0x48]
call fcn.140004ff0
lea rcx, [rbp + 0x28]
call fcn.140004ff0
mov rcx, qword [rsi + 8]
call fcn.14002fbe0
cmp byte [rax + 0x18], 0
je 0x14004e14c
mov rcx, qword [rsi + 8]
call fcn.14002fbe0
mov rcx, rax
call fcn.14002c790
test al, al
jne 0x14004e14c
mov rcx, qword [rsi + 8]
call fcn.14002fbe0
mov rcx, rax
mov dl, 1
call fcn.14002c610
mov rcx, qword [rsi + 8]
call fcn.14002fbe0
mov rcx, rax
call fcn.14002d660
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.14014f2f0
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret