Function at 0xbef04040
Capabilities:
Compress data via winapi
Enumerate gui resources

Disassembly:
push rbp
push r12
lea rbp, [rsp - 0x398]
sub rsp, 0x498
cmp qword [0xbef0de88], 0
mov r12d, ecx
je 0xbef0449d
mov rcx, qword [0xbef0e4e0]
xor edx, edx
mov r8d, 0x10000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x40], rax
test rax, rax
je 0xbef0449d
mov r8, qword [0xbef0de40]
lea rdx, [0xbeef49d0]
mov qword [rsp + 0x4b0], rbx
mov r9d, r12d
mov qword [rsp + 0x490], rsi
mov rcx, rax
mov qword [rsp + 0x488], rdi
mov qword [rsp + 0x480], r13
call qword [sym.imp.USER32.dll_wsprintfA]
mov dword [rsp + 0x4c], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
lea rdx, [rbp + 0x3c0]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
jne 0xbef040e9
mov dword [rbp + 0x3c0], 0xffffffff
mov qword [rsp + 0x50], 8
lea rdi, [0xbeef49f4]
xor r13d, r13d
nop dword [rax]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x58], 0x4000000
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x50]
mov rax, qword [0xbef0def8]
xor r9d, r9d
mov r8d, 0x18
mov ecx, 0x58
call rax
test eax, eax
jne 0xbef04224
movzx eax, word [rsp + 0x58]
test ax, ax
je 0xbef04224
mov ecx, dword [rsp + 0x4c]
xor edx, edx
mov r8, qword [rsp + 0x40]
add ecx, 0x20
shr rax, 1
lea r9, [rax + rax*2]
add r9, rcx
mov rcx, qword [0xbef0e4e0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0xbef044a8
mov ecx, dword [rbp + 0x3c0]
lea rdx, [0xbeef49fc]
mov r8, qword [rsp + 0x50]
cmp r8, rcx
mov qword [rsp + 0x40], rax
mov ecx, dword [rsp + 0x4c]
cmove rdx, rdi
add rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [rsp + 0x4c]
movzx r9d, word [rsp + 0x58]
add ecx, eax
mov r8, qword [rsp + 0x60]
mov edx, ecx
add rdx, qword [rsp + 0x40]
mov qword [rsp + 0x38], r13
shr r9d, 1
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x4c], ecx
mov ecx, 0xfde9
lea eax, [r9 + r9*2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add dword [rsp + 0x4c], eax
lea rdx, [rsp + 0x40]
mov eax, dword [rsp + 0x50]
lea rcx, [0xbef017b0]
mov dword [rsp + 0x48], eax
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [rsp + 0x4c]
mov rax, qword [rsp + 0x40]
mov byte [rcx + rax], reloc.WS2_32.dll_listen
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
mov ecx, eax
mov rax, qword [rsp + 0x40]
mov byte [rcx + rax], 0xa
inc dword [rsp + 0x4c]
mov rax, qword [rsp + 0x50]
add rax, 4
mov qword [rsp + 0x50], rax
cmp rax, 0x40000
jb 0xbef04100
lea r8, [rsp + 0x40]
lea rdx, [0xbeef4a00]
lea rcx, [0xbeef1a70]
call fcn.bef03cb0
lea r8, [rsp + 0x40]
lea rdx, [0xbeef4a10]
lea rcx, [0xbeef1a60]
call fcn.bef03cb0
mov eax, dword [rsp + 0x4c]
mov ecx, 0x100000
cmp eax, ecx
cmova eax, ecx
mov dword [rsp + 0x4c], eax
mov rcx, qword [0xbef0e4e0]
lea esi, [rax + rax]
mov r8d, esi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0xbef04469
mov rbx, qword [0xbef0e548]
mov qword [rsp + 0x478], r14
mov r14d, dword [rsp + 0x4c]
mov qword [rsp + 0x470], r15
mov r15, qword [rsp + 0x40]
test rbx, rbx
jne 0xbef042de
lea rcx, [0xbeef1f80]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
mov qword [0xbef0e548], rax
cmp qword [0xbef0e598], r13
jne 0xbef0433a
mov rax, qword [0xbef0e568]
lea rcx, [0xbeef57b8]
test rax, rax
je 0xbef04320
cmp rcx, qword [0xbef0dab0]
jb 0xbef04320
cmp rcx, qword [0xbef0dab8]
ja 0xbef04320
mov rdx, rcx
mov rcx, rbx
call rax
test rax, rax
jne 0xbef0432c
lea rcx, [0xbeef57b8]
mov rdx, rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [0xbef0e548]
mov qword [0xbef0e598], rax
mov rax, qword [0xbef0e5a8]
test rax, rax
jne 0xbef04392
mov rax, qword [0xbef0e568]
lea rcx, [0xbeef57d0]
test rax, rax
je 0xbef0437f
cmp rcx, qword [0xbef0dab0]
jb 0xbef0437f
cmp rcx, qword [0xbef0dab8]
ja 0xbef0437f
mov rdx, rcx
mov rcx, rbx
call rax
test rax, rax
jne 0xbef0438b
lea rcx, [0xbeef57d0]
mov rdx, rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef0e5a8], rax
mov ecx, 2
mov dword [rbp + 0x3b8], r13d
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x3c8]
call rax
test eax, eax
jne 0xbef04420
mov r8d, dword [rbp + 0x3c8]
xor edx, edx
mov rcx, qword [0xbef0e4e0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0xbef04420
mov r10, qword [0xbef0e598]
mov ecx, 2
mov qword [rsp + 0x38], rax
mov r9, rdi
lea rax, [rbp + 0x3b8]
mov r8d, r14d
mov qword [rsp + 0x30], rax
mov rdx, r15
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], esi
call r10
test eax, eax
je 0xbef0440e
mov dword [rbp + 0x3b8], r13d
mov rcx, qword [0xbef0e4e0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r9d, dword [rbp + 0x3b8]
mov r15, qword [rsp + 0x470]
mov r14, qword [rsp + 0x478]
test r9d, r9d
je 0xbef04457
mov rcx, qword [0xbef0de88]
lea rdx, [0xbef0df48]
mov r8d, r12d
mov qword [rsp + 0x20], rdi
call fcn.bef08320
mov rcx, qword [0xbef0e4e0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, qword [0xbef0e4e0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13, qword [rsp + 0x480]
mov rdi, qword [rsp + 0x488]
mov rsi, qword [rsp + 0x490]
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x498
pop r12
pop rbp
ret
mov eax, dword [rsp + 0x4c]
jmp 0xbef04280