Function at 0x140003700
Capabilities:
Enumerate gui resources
Enumerate pe sections

Disassembly:
push rbp
push rdi
push r12
push r13
lea rbp, [rsp - 0x3f]
sub rsp, 0xe8
mov rax, qword [0x140056090]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rax, qword [0x14005bb70]
lea rcx, str.C:Program_FilesBandizipdatalm.x64.dll
mov r13d, edx
mov qword [rbp - 0x71], rax
xor edx, edx
mov r12, r8
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, [rax + 0x1000]
cmp byte [rcx], 0xc3
je 0x140003759
inc rcx
cmp byte [rcx], 0xc3
jne 0x140003751
mov qword [rbp - 0x49], rcx
lea rdx, [rbp - 0x49]
lea rcx, [0x140002ae0]
mov dword [rbp - 0x39], r13d
mov qword [rbp - 0x41], rax
call qword [sym.imp.USER32.dll_EnumWindows]
xor edi, edi
lea rdx, str.C:Program_FilesBandizipdatalm.x64.dll
xorps xmm0, xmm0
mov qword [rbp - 9], rdi
lea rcx, [rbp - 9]
movdqu xmmword [rbp + 7], xmm0
lea r8d, [rdi + 0x29]
call fcn.140003c60
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x1400037d3
mov rcx, qword [rbp - 9]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037ce
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a9e
call fcn.140010fe0
mov qword [rsp + 0xe0], rsi
lea rcx, str.nt_headers:_0x_llx_n
movsxd rsi, dword [r12 + 0x3c]
add rsi, r12
mov qword [rsp + 0xd8], r14
mov rdx, rsi
mov qword [rsp + 0xd0], r15
call fcn.140001480
mov r8d, 8
mov qword [rbp - 0x69], rdi
lea rdx, str.dxgi.dll
mov qword [rbp - 0x59], rdi
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x51], rdi
call fcn.140003c60
mov r8d, dword [rsi + 0x50]
lea r9, [rbp - 0x69]
add r8d, 0x1f4
mov edx, r13d
call fcn.140002470
mov r8d, 0xa
mov qword [rbp - 9], rdi
lea rdx, str.lm.x64.dll
mov qword [rbp + 7], rdi
lea rcx, [rbp - 9]
mov qword [rbp + 0xf], rdi
mov r15, rax
call fcn.140003c60
lea r8, [rbp - 9]
mov edx, r13d
call fcn.140002170
mov r10, rax
movsxd rdx, dword [rax + 0x3c]
lea r8, [rax + 0x18]
add r8, rdx
movzx ecx, word [rdx + rax + 0x14]
movzx r9d, word [rdx + rax + 6]
add r8, rcx
movzx ecx, di
cmp di, r9w
jae 0x1400038b4
cmp dword [r8 + 0x10], edi
je 0x1400038a7
mov eax, dword [r8 + 0x24]
and eax, 0xe0000000
cmp eax, 0xe0000000
je 0x1400038f0
inc cx
add r8, 0x28
cmp cx, r9w
jb 0x140003891
mov r14, qword [rbp - 0x71]
mov qword [rbp - 0x79], r14
test r15, r15
je 0x140003a06
cmp r14, 0xebc0
je 0x140003a06
mov r9, rsi
mov r8, r12
mov rdx, r15
call fcn.140002d30
test al, al
jne 0x1400038f9
lea rcx, str._ERROR_Not_relocate_image____
jmp 0x140003a19
mov r14d, dword [r8 + 0xc]
add r14, r10
jmp 0x1400038b8
lea rcx, str.relocated_image_n
call fcn.140001480
mov r8, rsi
mov rdx, r12
call fcn.140002ec0
test al, al
jne 0x140003920
lea rcx, str._ERROR_Not_resolve_import____
jmp 0x140003a19
lea rcx, str.resolved_imports_n
mov qword [rsp + 0x110], rbx
call fcn.140001480
movzx ebx, word [rsi + 0x14]
xor eax, eax
add rbx, 0x2c
cmp ax, word [rsi + 6]
jae 0x1400039ce
add rbx, rsi
xor r14d, r14d
nop
mov eax, dword [rbx - 8]
lea rcx, [rbp - 0x49]
add rax, r15
mov dword [rbp - 0x2d], r14d
mov qword [rbp - 0x29], rax
mov eax, dword [rbx]
add rax, r12
mov dword [rbp - 0x10], r14d
mov qword [rbp - 0x21], rax
mov eax, dword [rbx - 4]
mov qword [rbp - 0x19], rax
lea rax, [rbp - 0x31]
mov qword [rbp - 0x41], rax
mov rax, qword [0x14005bb68]
mov word [rbp - 0xc], r14w
mov byte [rbp - 0xa], r14b
mov dword [rbp - 0x31], r13d
mov byte [rbp - 0x11], r14b
mov dword [rbp - 0x49], 0x92b
mov dword [rbp - 0x45], 0x139
mov rdx, qword [rax]
call rdx
cmp rax, 0x91a
je 0x1400039bd
lea rcx, str.write_failed_n
call fcn.140001480
inc di
add rbx, 0x28
cmp di, word [rsi + 6]
jb 0x140003950
mov r14, qword [rbp - 0x79]
lea rcx, str.write_sections_n
call fcn.140001480
mov rcx, qword [rbp - 0x71]
mov r9, rsi
mov r8, r15
mov qword [rsp + 0x20], r14
mov edx, r13d
call fcn.140003230
mov rbx, qword [rsp + 0x110]
test al, al
jne 0x140003a52
lea rcx, str._ERROR_Not_vmt_hook____
jmp 0x140003a19
lea rcx, str.invalid_base_n
call fcn.140001480
lea rcx, str._ERROR_invalid_base____
call fcn.140002bd0
mov r14, qword [rsp + 0xd8]
xor al, al
mov rsi, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xd0]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140010fc0
add rsp, 0xe8
pop r13
pop r12
pop rdi
pop rbp
ret
mov r9, rsi
mov r8, r15
mov edx, r13d
call fcn.140003110
lea rcx, str.erased_discardable_section_n
call fcn.140001480
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor r9d, r9d
lea r8, str.vrlt
lea rdx, str.Inject_Success_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.1400178f0
int3
call fcn.14001c9fc
int3