Function at 0x140003b90
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140057090]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov rax, qword [0x14005c868]
lea rcx, str.C:Program_FilesBandizipdatalm.x64.dll
mov r12d, edx
mov qword [rbp], rax
xor edx, edx
mov r13, r8
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, [rax + 0x1000]
cmp byte [rcx], 0xc3
je 0x140003bf9
inc rcx
cmp byte [rcx], 0xc3
jne 0x140003bf1
mov qword [rbp + 0x120], rcx
lea rdx, [rbp + 0x120]
lea rcx, [0x140002a00]
mov dword [rbp + 0x130], r12d
mov qword [rbp + 0x128], rax
call qword [sym.imp.USER32.dll_EnumWindows]
xor edi, edi
lea rdx, str.C:Program_FilesBandizipdatalm.x64.dll
xorps xmm0, xmm0
mov qword [rbp + 0x178], rdi
lea rcx, [rbp + 0x178]
movdqu xmmword [rbp + 0x188], xmm0
lea r8d, [rdi + 0x29]
call fcn.1400045d0
mov rdx, qword [rbp + 0x190]
cmp rdx, 0x10
jb 0x140003c8e
mov rcx, qword [rbp + 0x178]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c89
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004251
call fcn.1400118f0
movsxd rsi, dword [r13 + 0x3c]
movabs rcx, 0xd5cf3310cf498028
movdqa xmm0, xmmword [0x1400506b0]
movabs rax, 0xd3e3d4c2ffb9a97f
movdqu xmmword [rbp + 0x188], xmm0
mov byte [rbp + 0x178], dil
movabs rbx, 0xe8f02e4e7ce340e6
mov qword [rbp + 0x10], rax
add rsi, r13
mov rax, qword [rbp + 0x10]
mov rdx, rsi
mov qword [rbp + 0x60], rax
movabs rax, 0x84d5567e5cd93394
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x68], rax
movabs rax, 0x92f5e57156ff8bff
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x78], rax
movabs rax, 0xb687b5a797e6dd11
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x92f5e57156f5f393
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x10], rcx
lea rcx, [rbp + 0x60]
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
vzeroupper
call fcn.1400013a0
mov r8d, 8
mov qword [rbp + 0xe0], rdi
lea rdx, str.dxgi.dll
mov qword [rbp + 0xf0], rdi
lea rcx, [rbp + 0xe0]
mov qword [rbp + 0xf8], rdi
call fcn.1400045d0
mov r8d, dword [rsi + 0x50]
lea r9, [rbp + 0xe0]
add r8d, 0x1f4
mov edx, r12d
call fcn.140002390
mov r8d, 0xa
mov qword [rbp + 0x100], rdi
lea rdx, str.lm.x64.dll
mov qword [rbp + 0x110], rdi
lea rcx, [rbp + 0x100]
mov qword [rbp + 0x118], rdi
mov r15, rax
call fcn.1400045d0
lea r8, [rbp + 0x100]
mov edx, r12d
call fcn.140002090
mov r10, rax
movsxd rdx, dword [rax + 0x3c]
lea r8, [rax + 0x18]
add r8, rdx
movzx ecx, word [rdx + rax + 0x14]
movzx r9d, word [rdx + rax + 6]
add r8, rcx
cmp di, r9w
movzx ecx, di
jae 0x140003e58
cmp dword [r8 + 0x10], edi
je 0x140003e42
mov eax, dword [r8 + 0x24]
and eax, 0xe0000000
cmp eax, 0xe0000000
je 0x140003e4f
inc cx
add r8, 0x28
cmp cx, r9w
jmp 0x140003e2a
mov r14d, dword [r8 + 0xc]
add r14, r10
jmp 0x140003e5c
mov r14, qword [rbp]
mov qword [rbp + 0x10], r14
test r15, r15
je 0x1400041b6
cmp r14, 0xebc0
je 0x1400041b6
mov r9, rsi
mov r8, r13
mov rdx, r15
call fcn.140002af0
test al, al
je 0x140004225
movabs rcx, 0xd5cf3310cf498028
movabs rax, 0xd3f3d4c4f88ab863
mov qword [rbp + 8], rax
movabs rdx, 0x92f5e57156f5f393
mov rax, qword [rbp + 8]
mov qword [rbp + 0x80], rax
movabs rax, 0xe295492f118a6082
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x88], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x90], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x98], rax
movabs rax, 0xb687b5a797e6dd11
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 8], rcx
lea rcx, [rbp + 0x80]
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1f8], rax
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
vzeroupper
call fcn.1400013a0
mov r8, rsi
mov rdx, r13
call fcn.140002c80
test al, al
je 0x140004225
movabs rcx, 0xd5cf3310cf498028
movabs rax, 0xd2e2c3cbf895b863
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa0], rax
movabs rax, 0x9b845c210c8e29c6
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa8], rax
movabs rax, 0x92f5e57156f5f399
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb8], rax
movabs rax, 0xb687b5a797e6dd11
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x200], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x208], rax
movabs rax, 0x92f5e57156f5f393
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x210], rax
mov qword [rbp + 8], rcx
lea rcx, [rbp + 0xa0]
mov rax, qword [rbp + 8]
mov qword [rbp + 0x218], rax
vmovdqu ymm0, ymmword [rbp + 0x200]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm1
vzeroupper
call fcn.1400013a0
movzx ebx, word [rsi + 0x14]
xor eax, eax
add rbx, 0x2c
cmp ax, word [rsi + 6]
jae 0x14000411c
add rbx, rsi
xor r14d, r14d
nop word [rax + rax]
mov eax, dword [rbx - 8]
lea rcx, [rbp + 0x140]
add rax, r15
mov dword [rbp + 0x154], r14d
mov qword [rbp + 0x158], rax
mov eax, dword [rbx]
add rax, r13
mov dword [rbp + 0x171], r14d
mov qword [rbp + 0x160], rax
mov eax, dword [rbx - 4]
mov qword [rbp + 0x168], rax
lea rax, [rbp + 0x150]
mov qword [rbp + 0x148], rax
mov rax, qword [0x14005c860]
mov word [rbp + 0x175], r14w
mov byte [rbp + 0x177], r14b
mov dword [rbp + 0x150], r12d
mov byte [rbp + 0x170], r14b
mov dword [rbp + 0x140], 0x92b
mov dword [rbp + 0x144], 0x139
mov rdx, qword [rax]
call rdx
cmp rax, 0x91a
je 0x140004107
lea rcx, str.write_failed_n
call fcn.1400013a0
inc di
add rbx, 0x28
cmp di, word [rsi + 6]
jb 0x140004070
mov r14, qword [rbp + 0x10]
movabs rax, 0xd3f495c2e38faf66
lea rcx, [rbp + 0x30]
mov qword [rbp + 8], rax
movabs rdi, 0xb687b5a797e6dd11
mov rax, qword [rbp + 8]
movabs rbx, 0xe8f02e4e7ce340e6
mov qword [rbp + 0x30], rax
movabs rax, 0xe8fa5d20138a3485
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
movdqa xmm0, xmmword [rbp + 0x30]
mov qword [rbp + 0x1a8], rax
pxor xmm0, xmmword [rbp + 0x1a0]
movdqa xmmword [rbp + 0x30], xmm0
call fcn.1400013a0
mov rcx, qword [rbp]
mov r9, rsi
mov r8, r15
mov qword [rsp + 0x20], r14
mov edx, r12d
call fcn.140002ff0
test al, al
jne 0x140004257
jmp 0x140004225
movabs rax, 0x96e3dccbf690b378
lea rcx, [rbp + 0x20]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xe8f02e4419902184
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xb687b5a797e6dd11
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x128], rax
pxor xmm0, xmmword [rbp + 0x120]
movdqa xmmword [rbp + 0x20], xmm0
call fcn.1400013a0
xor al, al
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.1400118d0
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14001d30c
int3
mov r9, rsi
mov r8, r15
mov edx, r12d
call fcn.140002ed0
movabs rax, 0xd2a7d1c2e487af74
movabs rcx, 0xd5cf3310cf498028
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x8a914a3c1d80338f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xfb81861425d596ff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0xd5cf3310cf43ee47
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0x92f5e57156f5f393
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0xc0]
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0xc0], ymm1
vzeroupper
call fcn.1400013a0
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
movabs rax, 0xb687b5a7e38aaf67
lea r8, [rbp + 0x40]
mov qword [rbp], rax
lea rdx, [rbp + 0x20]
mov rax, qword [rbp]
xor r9d, r9d
mov qword [rbp + 0x40], rax
xor ecx, ecx
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp], rbx
mov qword [rbp + 0x1b0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x1b8], rax
movabs rax, 0xe5a7c1c4f28cb358
pxor xmm0, xmmword [rbp + 0x1b0]
movdqa xmmword [rbp + 0x40], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xe8d15d3d19802393
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x128], rax
pxor xmm0, xmmword [rbp + 0x120]
movdqa xmmword [rbp + 0x20], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.140018200
int3