Function at 0x140003ba0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140059100]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov rax, qword [0x14005e9f8]
lea rcx, str.C:Program_FilesBandizipdatalm.x64.dll
mov r12d, edx
mov qword [rbp], rax
xor edx, edx
mov r13, r8
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, [rax + 0x1000]
cmp byte [rcx], 0xc3
je 0x140003c09
inc rcx
cmp byte [rcx], 0xc3
jne 0x140003c01
mov qword [rbp + 0x100], rcx
lea rdx, [rbp + 0x100]
lea rcx, [0x1400029e0]
mov dword [rbp + 0x110], r12d
mov qword [rbp + 0x108], rax
call qword [sym.imp.USER32.dll_EnumWindows]
xorps xmm0, xmm0
lea rdx, str.C:Program_FilesBandizipdatalm.x64.dll
xorps xmm1, xmm1
lea rcx, [rbp + 0x158]
mov r8d, 0x29
movups xmmword [rbp + 0x158], xmm0
movdqu xmmword [rbp + 0x168], xmm1
call fcn.140004ca0
mov rdx, qword [rbp + 0x170]
cmp rdx, 0xf
jbe 0x140003ca1
mov rcx, qword [rbp + 0x158]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c9c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000426b
call fcn.1400153f0
movsxd rsi, dword [r13 + 0x3c]
movabs rcx, 0xcc1babd0476c34a8
movdqa xmm0, xmmword [0x140051880]
movabs rax, 0xf9f13768872b67f
movdqu xmmword [rbp + 0x168], xmm0
mov byte [rbp + 0x158], 0
movabs rbx, 0x6648ab869769b8c6
mov qword [rbp + 0x10], rax
add rsi, r13
mov rax, qword [rbp + 0x10]
mov rdx, rsi
mov qword [rbp + 0x60], rax
movabs rax, 0xa6dd3b6b753cbb4
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x68], rax
movabs rax, 0x387174edf85a3fc7
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x78], rax
movabs rax, 0x6afb7213e02dc211
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x387174edf85047ab
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x10], rcx
lea rcx, [rbp + 0x60]
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
vzeroupper
call fcn.140001470
xor edi, edi
lea rdx, str.dxgi.dll
xorps xmm0, xmm0
mov qword [rbp + 0xd0], rdi
lea rcx, [rbp + 0xc0]
mov qword [rbp + 0xd8], rdi
movups xmmword [rbp + 0xc0], xmm0
lea r8d, [rdi + 8]
call fcn.140004ca0
mov r8d, dword [rsi + 0x50]
lea r9, [rbp + 0xc0]
add r8d, 0x1f4
mov edx, r12d
call fcn.1400024e0
xorps xmm0, xmm0
mov qword [rbp + 0xf0], rdi
lea r8d, [rdi + 0xa]
mov qword [rbp + 0xf8], rdi
lea rdx, str.lm.x64.dll
mov r15, rax
lea rcx, [rbp + 0xe0]
movups xmmword [rbp + 0xe0], xmm0
call fcn.140004ca0
lea r8, [rbp + 0xe0]
mov edx, r12d
call fcn.140002200
mov r10, rax
movsxd rdx, dword [rax + 0x3c]
lea r8, [rax + 0x18]
add r8, rdx
movzx ecx, word [rdx + rax + 0x14]
movzx r9d, word [rdx + rax + 6]
add r8, rcx
movzx ecx, di
cmp di, r9w
jae 0x140003e6a
cmp dword [r8 + 0x10], edi
je 0x140003e5d
mov eax, dword [r8 + 0x24]
and eax, 0xe0000000
cmp eax, 0xe0000000
je 0x1400041c5
inc cx
add r8, 0x28
cmp cx, r9w
jb 0x140003e43
mov r14, qword [rbp]
mov qword [rbp + 0x10], r14
test r15, r15
je 0x1400041d1
cmp r14, 0xebc0
je 0x1400041d1
mov r9, rsi
mov r8, r13
mov rdx, r15
call fcn.140002ad0
test al, al
je 0x14000423f
movabs rcx, 0xcc1babd0476c34a8
movabs rax, 0xf8f13708f41a763
mov qword [rbp + 8], rax
movabs rdx, 0x387174edf85047ab
mov rax, qword [rbp + 8]
mov qword [rbp + 0x80], rax
movabs rax, 0x6c2dcce7fa0098a2
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x88], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x90], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x98], rax
movabs rax, 0x6afb7213e02dc211
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 8], rcx
lea rcx, [rbp + 0x80]
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1f8], rax
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
vzeroupper
call fcn.140001470
mov r8, rsi
mov rdx, r13
call fcn.140002c60
test al, al
je 0x14000423f
movabs rcx, 0xcc1babd0476c34a8
movabs rax, 0xe9e047f8f5ea763
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa0], rax
movabs rax, 0x153cd9e9e704d1e6
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa8], rax
movabs rax, 0x387174edf85047a1
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb8], rax
movabs rax, 0x6afb7213e02dc211
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x200], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x208], rax
movabs rax, 0x387174edf85047ab
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x210], rax
mov qword [rbp + 8], rcx
lea rcx, [rbp + 0xa0]
mov rax, qword [rbp + 8]
mov qword [rbp + 0x218], rax
vmovdqu ymm0, ymmword [rbp + 0x200]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm1
vzeroupper
call fcn.140001470
movzx ebx, word [rsi + 0x14]
xor eax, eax
add rbx, 0x2c
cmp ax, word [rsi + 6]
jae 0x14000412c
add rbx, rsi
xor r14d, r14d
nop word [rax + rax]
mov eax, dword [rbx - 8]
lea rcx, [rbp + 0x120]
add rax, r15
mov dword [rbp + 0x134], r14d
mov qword [rbp + 0x138], rax
mov eax, dword [rbx]
add rax, r13
mov dword [rbp + 0x151], r14d
mov qword [rbp + 0x140], rax
mov eax, dword [rbx - 4]
mov qword [rbp + 0x148], rax
lea rax, [rbp + 0x130]
mov qword [rbp + 0x128], rax
mov rax, qword [0x14005e9f0]
mov word [rbp + 0x155], r14w
mov byte [rbp + 0x157], r14b
mov dword [rbp + 0x130], r12d
mov byte [rbp + 0x150], r14b
mov dword [rbp + 0x120], 0x92b
mov dword [rbp + 0x124], 0x139
mov rdx, qword [rax]
call rdx
cmp rax, 0x91a
je 0x140004117
lea rcx, str.write_failed_n
call fcn.140001470
inc di
add rbx, 0x28
cmp di, word [rsi + 6]
jb 0x140004080
mov r14, qword [rbp + 0x10]
movabs rax, 0xf8852769444b066
lea rcx, [rbp + 0x30]
mov qword [rbp + 8], rax
movabs rdi, 0x6afb7213e02dc211
mov rax, qword [rbp + 8]
movabs rbx, 0x6648ab869769b8c6
mov qword [rbp + 0x30], rax
movabs rax, 0x6642d8e8f800cca5
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x180], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
movdqa xmm0, xmmword [rbp + 0x30]
mov qword [rbp + 0x188], rax
xorps xmm0, xmmword [rbp + 0x180]
movdqa xmmword [rbp + 0x30], xmm0
call fcn.140001470
mov rcx, qword [rbp]
mov r9, rsi
mov r8, r15
mov qword [rsp + 0x20], r14
mov edx, r12d
call fcn.140002fd0
test al, al
jne 0x140004271
jmp 0x14000423f
mov r14d, dword [r8 + 0xc]
add r14, r10
jmp 0x140003e6e
movabs rax, 0x4a9f1b7f815bac78
lea rcx, [rbp + 0x20]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x6648ab8cf21ad9a4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x6afb7213e02dc211
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x108], rax
xorps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0x20], xmm0
call fcn.140001470
xor al, al
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.1400153d0
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140021344
int3
mov r9, rsi
mov r8, r15
mov edx, r12d
call fcn.140002eb0
movabs rax, 0xedb1676934cb074
movabs rcx, 0xcc1babd0476c34a8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0x429cff4f60acbaf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x510517888b7022c7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
movabs rax, 0xcc1babd047665ac7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0x387174edf85047ab
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x180]
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0x180], ymm1
vzeroupper
call fcn.140001470
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
movabs rax, 0x6afb72139441b067
lea r8, [rbp + 0x40]
mov qword [rbp], rax
lea rdx, [rbp + 0x20]
mov rax, qword [rbp]
xor r9d, r9d
mov qword [rbp + 0x40], rax
xor ecx, ecx
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp], rbx
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x39db06708547ac58
xorps xmm0, xmmword [rbp + 0x1a0]
movdqa xmmword [rbp + 0x40], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x6669d8f5f20adbb3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x108], rax
xorps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0x20], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.14001c0e8
int3