Function at 0x180010860
Capabilities:
Enumerate gui resources

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18009c160]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rsi, rcx
mov qword [rsp + 0x88], rcx
cmp dword [rcx + 8], 0
je 0x180010f41
xor edi, edi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x2c], edi
mov dword [rsp + 0x28], edi
call fcn.18002fa50
test eax, eax
je 0x180010903
mov rcx, qword [rsi + 0x10]
test rcx, rcx
jne 0x1800108ef
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x180010f41
call fcn.1800190d0
jmp 0x180010f41
lea r8, [rsp + 0x20]
lea rdx, [0x180010760]
call qword [sym.imp.USER32.dll_EnumDesktopsW]
jmp 0x180010980
mov word [rsp + 0xa0], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xa2]
call fcn.18001ab30
xor r11d, r11d
mov qword [rsp + 0x2a8], r11
mov r8d, 0x103
lea rdx, str.Default
lea rcx, [rsp + 0xa0]
call fcn.1800194ec
movsxd rbx, dword [rsp + 0x28]
lea edx, [rbx + 1]
or r8d, 0xffffffff
lea rcx, [rsp + 0x20]
call fcn.180011740
mov rcx, rbx
imul rcx, rcx, 0x210
mov rax, qword [rsp + 0x20]
add rcx, rax
lea rdx, [rsp + 0xa0]
mov r8d, 0x210
call fcn.18001a450
mov edx, dword [rsp + 0x28]
cmp edx, dword [rsi + 0x28]
jne 0x180010a3c
mov r12d, edi
test edx, edx
jle 0x1800109ec
mov ebx, edi
cmp dword [rsi + 0x28], ebx
jle 0x180010a3c
movsxd rbp, r12d
imul rbp, rbp, 0x210
nop dword [rax]
movsxd rdx, ebx
imul rdx, rdx, 0x210
add rdx, qword [rsi + 0x20]
mov rcx, qword [rsp + 0x20]
add rcx, rbp
call fcn.180019458
test eax, eax
je 0x1800109d8
inc ebx
cmp ebx, dword [rsi + 0x28]
jge 0x1800109e6
jmp 0x1800109b0
inc r12d
mov edx, dword [rsp + 0x28]
cmp r12d, edx
jge 0x1800109ec
jmp 0x180010994
mov edx, dword [rsp + 0x28]
jmp 0x180010a3c
cmp dword [rsi + 0x38], 0
je 0x180010a24
mov dword [rsi + 0x38], edi
cmp dword [rsi + 0x28], 0
jle 0x180010a24
mov rbx, rdi
nop
mov rax, qword [rsi + 0x20]
mov rcx, qword [rbx + rax + 0x208]
test rcx, rcx
je 0x180010a16
call fcn.180011160
inc edi
add rbx, 0x210
cmp edi, dword [rsi + 0x28]
jl 0x180010a00
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x180010f41
call fcn.1800190d0
jmp 0x180010f41
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x64], edi
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x80], edi
mov dword [rsp + 0x7c], edi
mov r15d, edi
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], edi
or r8d, 0xffffffff
lea rcx, [rsp + 0x58]
call fcn.180011740
mov ebx, dword [rsp + 0x28]
mov rbp, qword [rsp + 0x20]
mov r12, qword [rsp + 0x58]
test ebx, ebx
je 0x180010ac4
nop word [rax + rax]
mov rcx, r12
mov rdx, rbp
mov r8d, 0x210
call fcn.18001a450
add r12, 0x210
add rbp, 0x210
sub ebx, 1
jne 0x180010aa0
or r8d, 0xffffffff
mov edx, dword [rsi + 0x28]
lea rcx, [rsp + 0x38]
call fcn.180011740
mov ebx, dword [rsi + 0x28]
mov rbp, qword [rsi + 0x20]
mov rcx, qword [rsp + 0x38]
mov r12, rcx
test ebx, ebx
je 0x180010b19
nop dword [rax + rax]
mov rcx, r12
mov rdx, rbp
mov r8d, 0x210
call fcn.18001a450
add r12, 0x210
add rbp, 0x210
sub ebx, 1
jne 0x180010af0
mov rcx, qword [rsp + 0x38]
mov r13d, dword [rsp + 0x60]
lea r14d, [r13 - 1]
test r14d, r14d
js 0x180010c8d
movsxd r13, r14d
imul r13, r13, 0x210
mov rdx, qword [rsp + 0x58]
add r13, rdx
lea eax, [r14 + 1]
cdqe
imul rax, rax, 0x210
add rax, rdx
mov qword [rsp + 0x50], rax
mov ebp, dword [rsp + 0x40]
mov esi, dword [rsp + 0x60]
jmp 0x180010b65
mov rcx, qword [rsp + 0x38]
mov ebx, edi
mov r12, rdi
test ebp, ebp
jle 0x180010c62
nop word [rax + rax]
movsxd rdx, ebx
imul rdx, rdx, 0x210
add rdx, rcx
mov rcx, r13
call fcn.180019458
test eax, eax
je 0x180010bb1
inc ebx
inc r12
cmp ebx, ebp
mov rcx, qword [rsp + 0x38]
jl 0x180010b80
mov rax, qword [rsp + 0x50]
jmp 0x180010c62
imul r12, r12, 0x210
add r12, qword [rsp + 0x38]
lea edx, [r15 + 1]
or r8d, 0xffffffff
lea rcx, [rsp + 0x70]
call fcn.180011740
movsxd rcx, r15d
imul rcx, rcx, 0x210
mov rax, qword [rsp + 0x70]
add rcx, rax
mov rdx, r12
mov r8d, 0x210
call fcn.18001a450
mov r11d, esi
sub r11d, r14d
sub r11d, 1
je 0x180010c12
movsxd r8, r11d
imul r8, r8, 0x210
mov rdx, qword [rsp + 0x50]
mov rcx, r13
call fcn.18001a450
dec esi
mov dword [rsp + 0x60], esi
mov eax, ebp
sub eax, ebx
sub eax, 1
je 0x180010c52
movsxd r8, eax
imul r8, r8, 0x210
lea eax, [rbx + 1]
movsxd rdx, eax
imul rdx, rdx, 0x210
mov rax, qword [rsp + 0x38]
add rdx, rax
movsxd rcx, ebx
imul rcx, rcx, 0x210
add rcx, rax
call fcn.18001a450
dec ebp
mov dword [rsp + 0x40], ebp
mov r15d, dword [rsp + 0x78]
mov rax, qword [rsp + 0x50]
sub rax, 0x210
mov qword [rsp + 0x50], rax
sub r13, 0x210
sub r14d, 1
jns 0x180010b60
mov rsi, qword [rsp + 0x88]
mov r13d, dword [rsp + 0x60]
jmp 0x180010c91
mov ebp, dword [rsp + 0x40]
test r13d, r13d
jne 0x180010c9e
test ebp, ebp
je 0x180010ebf
lea eax, [rbp - 1]
movsxd rbp, eax
test eax, eax
js 0x180010cf8
mov rax, rbp
imul rax, rax, 0x210
mov rcx, qword [rsp + 0x38]
lea r12, [rax + rcx + 0x208]
nop
mov rbx, qword [r12]
test rbx, rbx
je 0x180010ceb
mov rcx, rbx
call fcn.1800177c0
mov rcx, rbx
call fcn.180017850
test rbx, rbx
je 0x180010ceb
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
sub r12, 0x210
sub rbp, 1
jns 0x180010cc0
lea r14, [rsi + 0x20]
mov rcx, qword [r14]
test rcx, rcx
je 0x180010d0c
call fcn.1800190d0
mov qword [r14], rdi
mov dword [r14 + 0xc], edi
mov dword [r14 + 8], edi
movsxd rbx, edi
lea edx, [r15 + rbx]
or r8d, 0xffffffff
mov rcx, r14
call fcn.180011740
mov r12, qword [rsp + 0x70]
mov rbp, r12
imul rbx, rbx, 0x210
add rbx, qword [r14]
test r15d, r15d
je 0x180010d65
nop
mov rcx, rbx
mov rdx, rbp
mov r8d, 0x210
call fcn.18001a450
add rbx, 0x210
add rbp, 0x210
sub r15d, 1
jne 0x180010d40
mov word [rsp + 0xa0], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xa2]
call fcn.18001ab30
xor r11d, r11d
mov qword [rsp + 0x2a8], r11
test r13d, r13d
jle 0x180010ecf
mov r15, qword [rsp + 0x58]
mov rbp, r15
lea r12, vtable.CDesktopMgr::CDesktopThread.0
mov ecx, 0x280
call fcn.180019688
mov rbx, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x180010e31
mov rcx, rax
call fcn.180017730
mov qword [rbx], r12
mov qword [rbx + 0x250], rdi
mov dword [rbx + 0x260], edi
mov dword [rbx + 0x25c], edi
mov dword [rbx + 0x258], edi
mov qword [rbx + 0x268], rdi
mov dword [rbx + 0x278], edi
mov dword [rbx + 0x274], edi
mov dword [rbx + 0x270], edi
mov qword [rbx + 0x40], rsi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbx + 0x48]
call fcn.18001ab30
test rbp, rbp
je 0x180010e28
mov r8d, 0x103
mov rdx, rbp
lea rcx, [rbx + 0x48]
call fcn.1800194ec
lea r12, vtable.CDesktopMgr::CDesktopThread.0
jmp 0x180010e34
mov rbx, rdi
test rbx, rbx
je 0x180010ea7
xor edx, edx
mov r8d, 0x210
lea rcx, [rsp + 0xa0]
call fcn.18001ab30
mov rcx, rbx
call fcn.1800179f0
mov qword [rsp + 0x2a8], rbx
mov r8d, 0x103
mov rdx, rbp
lea rcx, [rsp + 0xa0]
call fcn.1800194ec
movsxd rbx, dword [r14 + 8]
lea edx, [rbx + 1]
or r8d, 0xffffffff
mov rcx, r14
call fcn.180011740
mov rcx, rbx
imul rcx, rcx, 0x210
add rcx, qword [r14]
lea rdx, [rsp + 0xa0]
mov r8d, 0x210
call fcn.18001a450
add rbp, 0x210
sub r13, 1
jne 0x180010da5
mov r12, qword [rsp + 0x70]
jmp 0x180010ed4
lea r14, [rsi + 0x20]
mov r15, qword [rsp + 0x58]
mov r12, qword [rsp + 0x70]
jmp 0x180010ed4
mov r15, qword [rsp + 0x58]
mov dword [rsi + 0x38], edi
cmp dword [rsi + 0x28], 0
jle 0x180010f03
mov rbx, rdi
mov rax, qword [r14]
mov rcx, qword [rbx + rax + 0x208]
test rcx, rcx
je 0x180010ef5
call fcn.180011160
inc edi
add rbx, 0x210
cmp edi, dword [rsi + 0x28]
jl 0x180010ee0
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x180010f16
mov rcx, rax
call fcn.1800190d0
nop
test r12, r12
je 0x180010f24
mov rcx, r12
call fcn.1800190d0
nop
test r15, r15
je 0x180010f32
mov rcx, r15
call fcn.1800190d0
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x180010f41
call fcn.1800190d0
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1800190b0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret