Function at 0x1400feb00
Capabilities:
Enumerate gui resources
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
xor esi, esi
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
movdqa xmm1, xmmword [0x14033ba70]
movdqu xmmword [rbp - 0x48], xmm1
mov word [rbp - 0x58], si
movups xmmword [rbp - 0x38], xmm0
movdqu xmmword [rbp - 0x28], xmm1
mov word [rbp - 0x38], si
mov qword [rbp + 0x60], rsi
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
lea r12d, [rsi + 1]
movdqu xmmword [rsp + 0x70], xmm0
mov r14d, esi
mov qword [rbp - 0x80], rsi
mov qword [rbp + 0x68], rsi
cmp qword [rcx + 0x18], 8
jb 0x1400feb78
mov rcx, qword [rcx]
lea r8, [rbp + 0x68]
lea rdx, [0x14033b650]
call fcn.1402c64c4
mov rdi, qword [rsp + 0x78]
test rax, rax
je 0x1400fec68
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400febb0
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000b0f0
nop
cmp rdi, r14
je 0x1400febf4
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rdi + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x50], si
add rdi, 0x20
mov qword [rsp + 0x78], rdi
jmp 0x1400fec14
lea r8, [rsp + 0x50]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.14010dbc0
mov r14, qword [rbp - 0x80]
mov rdi, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400fec51
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fec4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fef1d
call fcn.14022d284
lea r8, [rbp + 0x68]
lea rdx, [0x14033b650]
xor ecx, ecx
call fcn.1402c64c4
jmp 0x1400feb8d
lea rdx, [rbp - 0x58]
mov ecx, 9
call fcn.1401069e0
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rdx, qword [rbp - 0x58]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r15, qword [rsp + 0x70]
test eax, eax
jne 0x1400fee5b
cmp r15, rdi
je 0x1400fed38
mov rbx, r15
nop dword [rax + rax]
cmp qword [rbx + 0x10], 0
je 0x1400fed2f
mov r9d, 0xa
lea r8d, [r9 + 0x16]
lea rdx, [rbp - 0x10]
mov ecx, r12d
call fcn.1402c4270
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400fecfa
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x10]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400fee5b
inc r12d
add rbx, 0x20
cmp rbx, rdi
jne 0x1400fecd0
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
movdqa xmm1, xmmword [0x14033ba70]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], si
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], si
lea rdx, [rbp - 0x78]
mov ecx, listen
call fcn.1401069e0
lea rdx, [rsp + 0x50]
mov ecx, recvfrom
call fcn.1401069e0
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rcx, qword [rbp - 0x78]
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rax, qword [rsp + 0x50]
mov qword [rbp - 0x80], reloc.WS2_32.dll_recv
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x70]
lea rcx, [0x140106e20]
call qword [sym.imp.USER32.dll_EnumWindows]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400fee03
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fedfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fef23
call fcn.14022d284
movdqa xmm0, xmmword [0x14033ba70]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], si
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x1400fee56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fee51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fef29
call fcn.14022d284
mov esi, 1
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x1400fee6b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test r15, r15
je 0x1400feebd
mov rbx, r15
cmp r15, rdi
je 0x1400fee89
mov rcx, rbx
call fcn.140007d80
add rbx, 0x20
cmp rbx, rdi
jne 0x1400fee78
sub r14, r15
and r14, 0xffffffffffffffe0
mov rax, r15
cmp r14, 0x1000
jb 0x1400feeb1
add r14, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fef2f
mov rdx, r14
mov rcx, r15
call fcn.14022d284
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x1400feef9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400feef4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fef17
call fcn.14022d284
mov eax, esi
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1402c2874
nop
call fcn.1402c2874
nop
call fcn.1402c2874
nop
call fcn.1402c2874
nop
call fcn.1402c2874
int3