Function at 0xbeef8ec0
Capabilities:
Compress data via winapi
Enumerate gui resources

Disassembly:
push rbp
push r12
lea rbp, [rsp - 0x398]
sub rsp, 0x498
cmp qword [0xbef01758], 0
mov r12d, ecx
je 0xbeef9289
mov rcx, qword [0xbef01d50]
xor edx, edx
mov r8d, PostQuitMessage
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x40], rax
test rax, rax
je 0xbeef9289
mov r8, qword [0xbef01728]
lea rdx, str._s_t_u_r_n
mov qword [rsp + 0x4b0], rbx
mov r9d, r12d
mov qword [rsp + 0x490], rsi
mov rcx, rax
mov qword [rsp + 0x488], rdi
mov qword [rsp + 0x480], r13
call qword [sym.imp.USER32.dll_wsprintfA]
mov dword [rsp + 0x4c], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
lea rdx, [rbp + 0x3c0]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rbp + 0x3c0]
lea rdi, str._u_t
test eax, eax
mov qword [rsp + 0x50], 8
mov edx, 0xffffffff
cmove ecx, edx
xor r13d, r13d
mov dword [rbp + 0x3c0], ecx
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x58], 0x4000000
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x50]
mov rax, qword [0xbef017a8]
lea r8d, [r9 + 0x18]
lea ecx, [r9 + 0x58]
call rax
test eax, eax
jne 0xbeef90b1
movzx eax, word [rsp + 0x58]
test ax, ax
je 0xbeef90b1
mov ecx, dword [rsp + 0x4c]
xor edx, edx
mov r8, qword [rsp + 0x40]
add ecx, 0x20
shr rax, 1
lea r9, [rax + rax*2]
add r9, rcx
mov rcx, qword [0xbef01d50]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0xbeef90cb
mov ecx, dword [rbp + 0x3c0]
lea rdx, [0xbeefe70c]
mov r8, qword [rsp + 0x50]
cmp r8, rcx
mov qword [rsp + 0x40], rax
mov ecx, dword [rsp + 0x4c]
cmove rdx, rdi
add rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [rsp + 0x4c]
movzx r9d, word [rsp + 0x58]
add ecx, eax
mov r8, qword [rsp + 0x60]
mov edx, ecx
add rdx, qword [rsp + 0x40]
mov qword [rsp + 0x38], r13
shr r9d, 1
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x4c], ecx
mov ecx, 0xfde9
lea eax, [r9 + r9*2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add dword [rsp + 0x4c], eax
lea rdx, [rsp + 0x40]
mov eax, dword [rsp + 0x50]
lea rcx, [0xbeef8d50]
mov dword [rsp + 0x48], eax
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [rsp + 0x4c]
mov rax, qword [rsp + 0x40]
mov byte [rcx + rax], reloc.WS2_32.dll_listen
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
mov ecx, eax
mov rax, qword [rsp + 0x40]
mov byte [rcx + rax], 0xa
inc dword [rsp + 0x4c]
mov rax, qword [rsp + 0x50]
add rax, 4
mov qword [rsp + 0x50], rax
cmp rax, 0x40000
jb 0xbeef8f90
mov eax, dword [rsp + 0x4c]
xor edx, edx
mov rcx, qword [0xbef01d50]
lea esi, [rax + rax]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0xbeef9255
mov rax, qword [0xbef01d98]
mov qword [rsp + 0x478], r14
mov r14d, dword [rsp + 0x4c]
mov qword [rsp + 0x470], r15
mov r15, qword [rsp + 0x40]
test rax, rax
jne 0xbeef912a
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0xbef01d98], rax
cmp qword [0xbef01dc0], r13
jne 0xbeef9151
lea rdx, str.RtlCompressBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01dc0], rax
mov rax, qword [0xbef01d98]
mov r9, qword [0xbef01dd0]
test r9, r9
jne 0xbeef9177
lea rdx, str.RtlGetCompressionWorkSpaceSize
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
mov qword [0xbef01dd0], rax
mov ecx, 2
mov dword [rbp + 0x3b8], r13d
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x3c8]
call r9
test eax, eax
jne 0xbeef920c
mov r8d, dword [rbp + 0x3c8]
xor edx, edx
mov rcx, qword [0xbef01d50]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0xbeef920c
mov r10, qword [0xbef01dc0]
mov r9, rbx
mov qword [rsp + 0x38], rax
mov r8d, r14d
lea rax, [rbp + 0x3b8]
mov rdx, r15
mov qword [rsp + 0x30], rax
mov cx, 2
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], esi
call r10
mov ecx, dword [rbp + 0x3b8]
test eax, eax
mov r8, rdi
cmovne ecx, r13d
xor edx, edx
mov dword [rbp + 0x3b8], ecx
mov rcx, qword [0xbef01d50]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r9d, dword [rbp + 0x3b8]
mov r15, qword [rsp + 0x470]
mov r14, qword [rsp + 0x478]
test r9d, r9d
je 0xbeef9243
mov rcx, qword [0xbef01758]
lea rdx, [0xbef017f8]
mov r8d, r12d
mov qword [rsp + 0x20], rbx
call fcn.beefae40
mov rcx, qword [0xbef01d50]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, qword [0xbef01d50]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13, qword [rsp + 0x480]
mov rdi, qword [rsp + 0x488]
mov rsi, qword [rsp + 0x490]
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x498
pop r12
pop rbp
ret