Function at 0x140037380
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140098010]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov rsi, rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov byte [rsp + 0x44], 1
call fcn.140003450
mov rcx, rax
test rax, rax
je 0x140037fc2
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x20], rbx
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
lea r14, str.Controller::ContinueExecution
lea edi, [r12 - 1]
lea r15, str.model
lea r13, str.view
cmp rcx, rax
je 0x140037461
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fcd
lea rdx, str.type
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140037461
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fcd
mov rdx, r13
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400374d7
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
cmp rcx, rax
je 0x140037689
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fcd
lea rdx, str.type
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140037689
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fcd
lea rdx, str.systray
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140037689
mov ecx, dword [0x14009c6fc]
mov eax, dword [0x14009c6f8]
add ecx, eax
je 0x14003754e
mov dword [rsp + 0x50], r12d
call fcn.140002930
mov qword [rsp + 0x48], rax
lock inc dword [rsp + 0x50]
mov dword [rsp + 0x40], 1
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x14003751c
call fcn.140002930
mov qword [rsp + 0x48], rax
lock inc dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov dword [rbp - 0x28], 0x20
lea rax, str.Controller:_view_instance.
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [0x140000000]
lea r8, [rbp - 0x28]
movsx edx, r12w
call fcn.140001eb0
nop
mov eax, dword [rsp + 0x40]
test al, 1
je 0x140037587
and eax, 0xfffffffe
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], r12
mov eax, edi
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
js 0x140037582
nop
call fcn.140002cc0
mov eax, edi
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
jns 0x140037570
lock inc dword [rsp + 0x50]
lea r8, str.Globalcl.bdtpwiz.Controller.RunningEvent._s
lea rdx, str._s.View
lea rcx, [rbp + 0x20]
call fcn.140024f40
mov rbx, qword [rbp + 0x20]
lea r14, [rbx - 0x18]
cmp dword [r14 + 8], 0
jne 0x1400377bd
mov ecx, dword [0x14009c6fc]
mov eax, dword [0x14009c6f8]
add ecx, eax
je 0x14003762c
mov dword [rsp + 0x70], r12d
call fcn.140002930
mov qword [rsp + 0x68], rax
lock inc dword [rsp + 0x70]
or dword [rsp + 0x40], 4
mov rax, qword [rsp + 0x68]
test rax, rax
jne 0x1400375f3
call fcn.140002930
mov qword [rsp + 0x68], rax
lock inc dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov dword [rbp - 0x20], 8
lea rax, str.Controller:_unknown_instance__not_view_and_not_model_instance.
mov qword [rsp + 0x28], rax
lea rax, str.Controller::ContinueExecution
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x20]
movsx edx, r12w
call fcn.140001eb0
nop
mov eax, dword [rsp + 0x40]
test al, 4
je 0x140037667
and eax, 0xfffffffb
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x68], r12
mov eax, edi
lock xadd dword [rsp + 0x70], eax
cmp eax, 1
js 0x140037662
nop dword [rax]
call fcn.140002cc0
mov eax, edi
lock xadd dword [rsp + 0x70], eax
cmp eax, 1
jns 0x140037650
lock inc dword [rsp + 0x70]
xor bl, bl
lock xadd dword [r14 + 0x10], edi
sub edi, 1
jg 0x140037f8c
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + 8]
jmp 0x140037f8c
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
cmp rcx, rax
je 0x1400375a2
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fcd
lea rdx, str.type
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400375a2
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fcd
mov rdx, r15
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400375a2
mov ecx, dword [0x14009c6fc]
mov eax, dword [0x14009c6f8]
add ecx, eax
je 0x140037772
mov dword [rsp + 0x60], r12d
call fcn.140002930
mov qword [rsp + 0x58], rax
lock inc dword [rsp + 0x60]
mov dword [rsp + 0x40], 2
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x140037740
call fcn.140002930
mov qword [rsp + 0x58], rax
lock inc dword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov dword [rbp - 0x24], 0x20
lea rax, str.Controller:_model_instance.
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [0x140000000]
lea r8, [rbp - 0x24]
movsx edx, r12w
call fcn.140001eb0
nop
mov eax, dword [rsp + 0x40]
test al, 2
je 0x1400377aa
and eax, 0xfffffffd
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x58], r12
mov eax, edi
lock xadd dword [rsp + 0x60], eax
cmp eax, 1
js 0x1400377a5
call fcn.140002cc0
mov eax, edi
lock xadd dword [rsp + 0x60], eax
cmp eax, 1
jns 0x140037793
lock inc dword [rsp + 0x60]
lea r8, str.Globalcl.bdtpwiz.Controller.RunningEvent._s
lea rdx, str._s.Model
jmp 0x140037595
mov edx, 0x28
lea ecx, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r12, rax
test rax, rax
jne 0x14003789d
mov ecx, dword [0x14009c6fc]
mov eax, dword [0x14009c6f8]
add ecx, eax
je 0x14003785d
xor esi, esi
mov dword [rbp - 0x80], esi
call fcn.140002930
mov qword [rsp + 0x78], rax
lock inc dword [rbp - 0x80]
or dword [rsp + 0x40], 8
mov rax, qword [rsp + 0x78]
test rax, rax
jne 0x140037817
call fcn.140002930
mov qword [rsp + 0x78], rax
lock inc dword [rbp - 0x80]
mov rbx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x1c], 8
mov dword [rsp + 0x30], eax
lea rax, str.LocalAlloc_failed_to_allocate_SECURITY_DESCRIPTOR:__lu
mov qword [rsp + 0x28], rax
lea rax, str.Controller::ContinueExecution
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x1c]
movsx edx, si
mov rcx, rbx
call fcn.140001eb0
jmp 0x14003785f
xor esi, esi
mov eax, dword [rsp + 0x40]
test al, 8
je 0x140037f6f
and eax, 0xfffffff7
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x78], rsi
mov eax, edi
lock xadd dword [rbp - 0x80], eax
cmp eax, 1
js 0x140037894
call fcn.140002cc0
mov eax, edi
lock xadd dword [rbp - 0x80], eax
cmp eax, 1
jns 0x140037883
lock inc dword [rbp - 0x80]
jmp 0x140037f6f
mov edx, 1
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x14003797a
mov ecx, dword [0x14009c6fc]
mov eax, dword [0x14009c6f8]
add ecx, eax
je 0x140037935
xor esi, esi
mov dword [rbp - 0x70], esi
call fcn.140002930
mov qword [rbp - 0x78], rax
lock inc dword [rbp - 0x70]
or dword [rsp + 0x40], 0x10
mov rax, qword [rbp - 0x78]
test rax, rax
jne 0x1400378f0
call fcn.140002930
mov qword [rbp - 0x78], rax
lock inc dword [rbp - 0x70]
mov rbx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x18], 8
mov dword [rsp + 0x30], eax
lea rax, str.InitializeSecurityDescriptor_failed:__lu
mov qword [rsp + 0x28], rax
lea rax, str.Controller::ContinueExecution
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x18]
movsx edx, si
mov rcx, rbx
call fcn.140001eb0
jmp 0x140037937
xor esi, esi
mov eax, dword [rsp + 0x40]
test al, 0x10
je 0x140037f65
and eax, 0xffffffef
mov dword [rsp + 0x40], eax
mov qword [rbp - 0x78], rsi
mov eax, edi
lock xadd dword [rbp - 0x70], eax
cmp eax, 1
js 0x140037971
nop word [rax + rax]
call fcn.140002cc0
mov eax, edi
lock xadd dword [rbp - 0x70], eax
cmp eax, 1
jns 0x140037960
lock inc dword [rbp - 0x70]
jmp 0x140037f65
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x140037a5a
mov ecx, dword [0x14009c6fc]
mov eax, dword [0x14009c6f8]
add ecx, eax
je 0x140037a17
xor esi, esi
mov dword [rbp - 0x60], esi
call fcn.140002930
mov qword [rbp - 0x68], rax
lock inc dword [rbp - 0x60]
or dword [rsp + 0x40], 0x20
mov rax, qword [rbp - 0x68]
test rax, rax
jne 0x1400379d2
call fcn.140002930
mov qword [rbp - 0x68], rax
lock inc dword [rbp - 0x60]
mov rbx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x14], 8
mov dword [rsp + 0x30], eax
lea rax, str.SetSecurityDescriptorDacl_failed:__lu
mov qword [rsp + 0x28], rax
lea rax, str.Controller::ContinueExecution
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x14]
movsx edx, si
mov rcx, rbx
call fcn.140001eb0
jmp 0x140037a19
xor esi, esi
mov eax, dword [rsp + 0x40]
test al, 0x20
je 0x140037f65
and eax, 0xffffffdf
mov dword [rsp + 0x40], eax
mov qword [rbp - 0x68], rsi
mov eax, edi
lock xadd dword [rbp - 0x60], eax
cmp eax, 1
js 0x140037a51
nop dword [rax]
call fcn.140002cc0
mov eax, edi
lock xadd dword [rbp - 0x60], eax
cmp eax, 1
jns 0x140037a40
lock inc dword [rbp - 0x60]
jmp 0x140037f65
xor eax, eax
mov qword [rbp + 8], 0x18
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x10], r12
mov r9, rbx
xor r8d, r8d
lea edx, [rax + 1]
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
jne 0x140037b52
mov ecx, dword [0x14009c6fc]
mov eax, dword [0x14009c6f8]
add ecx, eax
je 0x140037b13
xor esi, esi
mov dword [rbp - 0x50], esi
call fcn.140002930
mov qword [rbp - 0x58], rax
lock inc dword [rbp - 0x50]
or dword [rsp + 0x40], 0x40
mov rax, qword [rbp - 0x58]
test rax, rax
jne 0x140037ace
call fcn.140002930
mov qword [rbp - 0x58], rax
lock inc dword [rbp - 0x50]
mov rbx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x10], 8
mov dword [rsp + 0x30], eax
lea rax, str.CreateEventW_failed:__lu
mov qword [rsp + 0x28], rax
lea rax, str.Controller::ContinueExecution
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x10]
movsx edx, si
mov rcx, rbx
call fcn.140001eb0
jmp 0x140037b15
xor esi, esi
mov eax, dword [rsp + 0x40]
test al, 0x40
je 0x140037f65
and eax, 0xffffffbf
mov dword [rsp + 0x40], eax
mov qword [rbp - 0x58], rsi
mov eax, edi
lock xadd dword [rbp - 0x50], eax
cmp eax, 1
js 0x140037b49
call fcn.140002cc0
mov eax, edi
lock xadd dword [rbp - 0x50], eax
cmp eax, 1
jns 0x140037b38
lock inc dword [rbp - 0x50]
jmp 0x140037f65
cmp eax, 0xb7
jne 0x140037db5
mov byte [rsp + 0x44], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x14009c6fc]
mov eax, dword [0x14009c6f8]
add ecx, eax
je 0x140037ccf
xor eax, eax
mov dword [rbp - 0x40], eax
call fcn.140002930
mov qword [rbp - 0x48], rax
lock inc dword [rbp - 0x40]
or dword [rsp + 0x40], 0x80
mov rax, qword [rbp - 0x48]
test rax, rax
jne 0x140037baf
call fcn.140002930
mov qword [rbp - 0x48], rax
lock inc dword [rbp - 0x40]
mov rbx, qword [rbp - 0x48]
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
cmp rcx, rax
je 0x140037c19
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fd3
lea rdx, str.type
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140037c19
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fd3
mov rdx, r13
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140037c83
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
cmp rcx, rax
je 0x140037c86
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fd3
lea rdx, str.type
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140037c86
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fd3
lea rdx, str.systray
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140037c86
mov r15, r13
mov dword [rbp - 0xc], 8
mov qword [rsp + 0x38], r15
mov rax, qword [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, str.Event__s_already_exists._Another_instance_of_type__s_is_running.
mov qword [rsp + 0x28], rax
lea rax, str.Controller::ContinueExecution
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0xc]
xor r15d, r15d
movsx edx, r15w
mov rcx, rbx
call fcn.140001eb0
jmp 0x140037cd2
xor r15d, r15d
mov eax, dword [rsp + 0x40]
test al, al
jns 0x140037d07
btr eax, 7
mov dword [rsp + 0x40], eax
mov qword [rbp - 0x48], r15
mov eax, edi
lock xadd dword [rbp - 0x40], eax
cmp eax, 1
js 0x140037d03
call fcn.140002cc0
mov eax, edi
lock xadd dword [rbp - 0x40], eax
cmp eax, 1
jns 0x140037cf2
lock inc dword [rbp - 0x40]
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
cmp rcx, rax
je 0x140037f65
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fd9
lea rdx, str.type
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140037f65
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fd9
mov rdx, r13
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140037f65
mov qword [rbp], r15
lea rdx, [rbp]
lea rcx, [0x140037330]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rbp]
test rcx, rcx
je 0x140037f65
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbp]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x140037f65
mov qword [rsi + 0x98], rbx
mov ecx, dword [0x14009c6fc]
mov eax, dword [0x14009c6f8]
add ecx, eax
je 0x140037f27
xor eax, eax
mov dword [rbp - 0x30], eax
call fcn.140002930
mov qword [rbp - 0x38], rax
lock inc dword [rbp - 0x30]
or dword [rsp + 0x40], 0x100
mov rax, qword [rbp - 0x38]
test rax, rax
jne 0x140037e00
call fcn.140002930
mov qword [rbp - 0x38], rax
lock inc dword [rbp - 0x30]
mov rbx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r15d, eax
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
cmp rcx, rax
je 0x140037e73
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fbc
lea rdx, str.type
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140037e73
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fbc
mov rdx, r13
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140037ee4
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
cmp rcx, rax
je 0x140037edd
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fbc
lea rdx, str.type
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140037edd
mov rcx, qword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140037fbc
lea rdx, str.systray
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140037ee4
lea r13, str.model
mov dword [rbp - 8], 0x20
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r13
lea rax, str.bdtpwiz_instance_of_type_s_pid_lu_is_continuing_execution
mov qword [rsp + 0x28], rax
lea rax, str.Controller::ContinueExecution
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 8]
xor esi, esi
movsx edx, si
mov rcx, rbx
call fcn.140001eb0
jmp 0x140037f29
xor esi, esi
mov eax, dword [rsp + 0x40]
bt eax, 8
jae 0x140037f65
btr eax, 8
mov dword [rsp + 0x40], eax
mov qword [rbp - 0x38], rsi
mov eax, edi
lock xadd dword [rbp - 0x30], eax
cmp eax, 1
js 0x140037f61
nop dword [rax + rax]
call fcn.140002cc0
mov eax, edi
lock xadd dword [rbp - 0x30], eax
cmp eax, 1
jns 0x140037f50
lock inc dword [rbp - 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lock xadd dword [r14 + 0x10], edi
sub edi, 1
jg 0x140037f87
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
call qword [r8 + 8]
movzx ebx, byte [rsp + 0x44]
movzx eax, bl
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.14003edb0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400395d0
nop
mov ecx, 0x80004005
call fcn.140004200
nop
call fcn.1400395d0
nop
call fcn.1400395d0
nop
call fcn.1400395d0
int3