Function at 0x140026240
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov rsi, rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov r15b, 1
call fcn.140002980
mov rcx, rax
test rax, rax
je 0x140026d6e
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x20], rbx
mov rcx, qword [rsi + 0xb0]
mov rax, qword [rsi + 0xb8]
lea r13, str.model
lea r14, str.Controller::ContinueExecution
lea edi, [r12 - 1]
cmp rcx, rax
je 0x1400264da
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140026d79
lea rdx, str.type
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400264da
mov rcx, qword [rsi + 0xb0]
mov rax, qword [rsi + 0xb8]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140026d79
lea rdx, str.view
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400264da
mov ecx, dword [0x1400403d8]
mov eax, dword [0x1400403d4]
add ecx, eax
je 0x14002639f
mov dword [rsp + 0x50], r12d
call fcn.140001f90
mov qword [rsp + 0x48], rax
lock inc dword [rsp + 0x50]
mov dword [rsp + 0x40], 1
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x14002636d
call fcn.140001f90
mov qword [rsp + 0x48], rax
lock inc dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov dword [rbp - 0x28], 0x20
lea rax, str.Controller:_view_instance.
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [0x140000000]
lea r8, [rbp - 0x28]
movsx edx, r12w
call fcn.140001510
nop
mov eax, dword [rsp + 0x40]
test al, 1
je 0x1400263d7
and eax, 0xfffffffe
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], r12
mov eax, edi
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
js 0x1400263d2
call fcn.140002270
mov eax, edi
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
jns 0x1400263c0
lock inc dword [rsp + 0x50]
lea r8, str.Globalcl.bdfvwiz.Controller.RunningEvent._s
lea rdx, str._s.View
lea rcx, [rbp + 0x20]
call fcn.14001ad30
mov rbx, qword [rbp + 0x20]
lea r14, [rbx - 0x18]
cmp dword [r14 + 8], 0
jne 0x14002660e
mov ecx, dword [0x1400403d8]
mov eax, dword [0x1400403d4]
add ecx, eax
je 0x14002647c
mov dword [rsp + 0x70], r12d
call fcn.140001f90
mov qword [rsp + 0x68], rax
lock inc dword [rsp + 0x70]
or dword [rsp + 0x40], 4
mov rax, qword [rsp + 0x68]
test rax, rax
jne 0x140026443
call fcn.140001f90
mov qword [rsp + 0x68], rax
lock inc dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov dword [rbp - 0x20], 8
lea rax, str.Controller:_unknown_instance__not_view_and_not_model_instance.
mov qword [rsp + 0x28], rax
lea rax, str.Controller::ContinueExecution
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x20]
movsx edx, r12w
call fcn.140001510
nop
mov eax, dword [rsp + 0x40]
test al, 4
je 0x1400264b7
and eax, 0xfffffffb
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x68], r12
mov eax, edi
lock xadd dword [rsp + 0x70], eax
cmp eax, 1
js 0x1400264b2
nop dword [rax]
call fcn.140002270
mov eax, edi
lock xadd dword [rsp + 0x70], eax
cmp eax, 1
jns 0x1400264a0
lock inc dword [rsp + 0x70]
xor r15b, r15b
lock xadd dword [r14 + 0x10], edi
sub edi, 1
jg 0x140026d37
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + 8]
jmp 0x140026d37
mov rcx, qword [rsi + 0xb0]
mov rax, qword [rsi + 0xb8]
cmp rcx, rax
je 0x1400263f2
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140026d79
lea rdx, str.type
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400263f2
mov rcx, qword [rsi + 0xb0]
mov rax, qword [rsi + 0xb8]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140026d79
mov rdx, r13
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400263f2
mov ecx, dword [0x1400403d8]
mov eax, dword [0x1400403d4]
add ecx, eax
je 0x1400265c3
mov dword [rsp + 0x60], r12d
call fcn.140001f90
mov qword [rsp + 0x58], rax
lock inc dword [rsp + 0x60]
mov dword [rsp + 0x40], 2
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x140026591
call fcn.140001f90
mov qword [rsp + 0x58], rax
lock inc dword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov dword [rbp - 0x24], 0x20
lea rax, str.Controller:_model_instance.
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [0x140000000]
lea r8, [rbp - 0x24]
movsx edx, r12w
call fcn.140001510
nop
mov eax, dword [rsp + 0x40]
test al, 2
je 0x1400265fb
and eax, 0xfffffffd
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x58], r12
mov eax, edi
lock xadd dword [rsp + 0x60], eax
cmp eax, 1
js 0x1400265f6
call fcn.140002270
mov eax, edi
lock xadd dword [rsp + 0x60], eax
cmp eax, 1
jns 0x1400265e4
lock inc dword [rsp + 0x60]
lea r8, str.Globalcl.bdfvwiz.Controller.RunningEvent._s
lea rdx, str._s.Model
jmp 0x1400263e5
mov edx, 0x28
lea ecx, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r12, rax
test rax, rax
jne 0x1400266ee
mov ecx, dword [0x1400403d8]
mov eax, dword [0x1400403d4]
add ecx, eax
je 0x1400266ae
xor esi, esi
mov dword [rbp - 0x80], esi
call fcn.140001f90
mov qword [rsp + 0x78], rax
lock inc dword [rbp - 0x80]
or dword [rsp + 0x40], 8
mov rax, qword [rsp + 0x78]
test rax, rax
jne 0x140026668
call fcn.140001f90
mov qword [rsp + 0x78], rax
lock inc dword [rbp - 0x80]
mov rbx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x1c], 8
mov dword [rsp + 0x30], eax
lea rax, str.LocalAlloc_failed_to_allocate_SECURITY_DESCRIPTOR:__lu
mov qword [rsp + 0x28], rax
lea rax, str.Controller::ContinueExecution
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x1c]
movsx edx, si
mov rcx, rbx
call fcn.140001510
jmp 0x1400266b0
xor esi, esi
mov eax, dword [rsp + 0x40]
test al, 8
je 0x140026d1f
and eax, 0xfffffff7
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x78], rsi
mov eax, edi
lock xadd dword [rbp - 0x80], eax
cmp eax, 1
js 0x1400266e5
call fcn.140002270
mov eax, edi
lock xadd dword [rbp - 0x80], eax
cmp eax, 1
jns 0x1400266d4
lock inc dword [rbp - 0x80]
jmp 0x140026d1f
mov edx, 1
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x1400267ca
mov ecx, dword [0x1400403d8]
mov eax, dword [0x1400403d4]
add ecx, eax
je 0x140026786
xor esi, esi
mov dword [rbp - 0x70], esi
call fcn.140001f90
mov qword [rbp - 0x78], rax
lock inc dword [rbp - 0x70]
or dword [rsp + 0x40], 0x10
mov rax, qword [rbp - 0x78]
test rax, rax
jne 0x140026741
call fcn.140001f90
mov qword [rbp - 0x78], rax
lock inc dword [rbp - 0x70]
mov rbx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x18], 8
mov dword [rsp + 0x30], eax
lea rax, str.InitializeSecurityDescriptor_failed:__lu
mov qword [rsp + 0x28], rax
lea rax, str.Controller::ContinueExecution
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x18]
movsx edx, si
mov rcx, rbx
call fcn.140001510
jmp 0x140026788
xor esi, esi
mov eax, dword [rsp + 0x40]
test al, 0x10
je 0x140026d15
and eax, 0xffffffef
mov dword [rsp + 0x40], eax
mov qword [rbp - 0x78], rsi
mov eax, edi
lock xadd dword [rbp - 0x70], eax
cmp eax, 1
js 0x1400267c1
nop dword [rax + rax]
call fcn.140002270
mov eax, edi
lock xadd dword [rbp - 0x70], eax
cmp eax, 1
jns 0x1400267b0
lock inc dword [rbp - 0x70]
jmp 0x140026d15
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x1400268aa
mov ecx, dword [0x1400403d8]
mov eax, dword [0x1400403d4]
add ecx, eax
je 0x140026867
xor esi, esi
mov dword [rbp - 0x60], esi
call fcn.140001f90
mov qword [rbp - 0x68], rax
lock inc dword [rbp - 0x60]
or dword [rsp + 0x40], 0x20
mov rax, qword [rbp - 0x68]
test rax, rax
jne 0x140026822
call fcn.140001f90
mov qword [rbp - 0x68], rax
lock inc dword [rbp - 0x60]
mov rbx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x14], 8
mov dword [rsp + 0x30], eax
lea rax, str.SetSecurityDescriptorDacl_failed:__lu
mov qword [rsp + 0x28], rax
lea rax, str.Controller::ContinueExecution
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x14]
movsx edx, si
mov rcx, rbx
call fcn.140001510
jmp 0x140026869
xor esi, esi
mov eax, dword [rsp + 0x40]
test al, 0x20
je 0x140026d15
and eax, 0xffffffdf
mov dword [rsp + 0x40], eax
mov qword [rbp - 0x68], rsi
mov eax, edi
lock xadd dword [rbp - 0x60], eax
cmp eax, 1
js 0x1400268a1
nop dword [rax]
call fcn.140002270
mov eax, edi
lock xadd dword [rbp - 0x60], eax
cmp eax, 1
jns 0x140026890
lock inc dword [rbp - 0x60]
jmp 0x140026d15
xor eax, eax
mov qword [rbp + 8], 0x18
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x10], r12
mov r9, rbx
xor r8d, r8d
lea edx, [rax + 1]
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
jne 0x1400269a2
mov ecx, dword [0x1400403d8]
mov eax, dword [0x1400403d4]
add ecx, eax
je 0x140026963
xor esi, esi
mov dword [rbp - 0x50], esi
call fcn.140001f90
mov qword [rbp - 0x58], rax
lock inc dword [rbp - 0x50]
or dword [rsp + 0x40], 0x40
mov rax, qword [rbp - 0x58]
test rax, rax
jne 0x14002691e
call fcn.140001f90
mov qword [rbp - 0x58], rax
lock inc dword [rbp - 0x50]
mov rbx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x10], 8
mov dword [rsp + 0x30], eax
lea rax, str.CreateEventW_failed:__lu
mov qword [rsp + 0x28], rax
lea rax, str.Controller::ContinueExecution
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x10]
movsx edx, si
mov rcx, rbx
call fcn.140001510
jmp 0x140026965
xor esi, esi
mov eax, dword [rsp + 0x40]
test al, 0x40
je 0x140026d15
and eax, 0xffffffbf
mov dword [rsp + 0x40], eax
mov qword [rbp - 0x58], rsi
mov eax, edi
lock xadd dword [rbp - 0x50], eax
cmp eax, 1
js 0x140026999
call fcn.140002270
mov eax, edi
lock xadd dword [rbp - 0x50], eax
cmp eax, 1
jns 0x140026988
lock inc dword [rbp - 0x50]
jmp 0x140026d15
cmp eax, 0xb7
jne 0x140026bb7
xor r15b, r15b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1400403d8]
mov eax, dword [0x1400403d4]
add ecx, eax
je 0x140026ac7
xor eax, eax
mov dword [rbp - 0x40], eax
call fcn.140001f90
mov qword [rbp - 0x48], rax
lock inc dword [rbp - 0x40]
or dword [rsp + 0x40], 0x80
mov rax, qword [rbp - 0x48]
test rax, rax
jne 0x1400269fd
call fcn.140001f90
mov qword [rbp - 0x48], rax
lock inc dword [rbp - 0x40]
mov rbx, qword [rbp - 0x48]
mov rcx, qword [rsi + 0xb0]
mov rax, qword [rsi + 0xb8]
cmp rcx, rax
je 0x140026a6f
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140026d7f
lea rdx, str.type
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140026a6f
mov rcx, qword [rsi + 0xb0]
mov rax, qword [rsi + 0xb8]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140026d7f
lea rdx, str.view
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140026a6f
mov al, 1
jmp 0x140026a71
xor al, al
test al, al
lea rax, str.view
cmovne r13, rax
mov dword [rbp - 0xc], 8
mov qword [rsp + 0x38], r13
mov rax, qword [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, str.Event__s_already_exists._Another_instance_of_type__s_is_running.
mov qword [rsp + 0x28], rax
lea rax, str.Controller::ContinueExecution
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0xc]
xor r13d, r13d
movsx edx, r13w
mov rcx, rbx
call fcn.140001510
jmp 0x140026aca
xor r13d, r13d
mov eax, dword [rsp + 0x40]
test al, al
jns 0x140026b05
btr eax, 7
mov dword [rsp + 0x40], eax
mov qword [rbp - 0x48], r13
mov eax, edi
lock xadd dword [rbp - 0x40], eax
cmp eax, 1
js 0x140026b01
nop word [rax + rax]
call fcn.140002270
mov eax, edi
lock xadd dword [rbp - 0x40], eax
cmp eax, 1
jns 0x140026af0
lock inc dword [rbp - 0x40]
mov rcx, qword [rsi + 0xb0]
mov rax, qword [rsi + 0xb8]
cmp rcx, rax
je 0x140026d15
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140026d85
lea rdx, str.type
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140026d15
mov rcx, qword [rsi + 0xb0]
mov rax, qword [rsi + 0xb8]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140026d85
lea rdx, str.view
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140026d15
mov qword [rbp], r13
lea rdx, [rbp]
lea rcx, [0x1400261f0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rbp]
test rcx, rcx
je 0x140026d15
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbp]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x140026d15
mov qword [rsi + 0x98], rbx
mov ecx, dword [0x1400403d8]
mov eax, dword [0x1400403d4]
add ecx, eax
je 0x140026cd5
xor eax, eax
mov dword [rbp - 0x30], eax
call fcn.140001f90
mov qword [rbp - 0x38], rax
lock inc dword [rbp - 0x30]
or dword [rsp + 0x40], 0x100
mov rax, qword [rbp - 0x38]
test rax, rax
jne 0x140026c02
call fcn.140001f90
mov qword [rbp - 0x38], rax
lock inc dword [rbp - 0x30]
mov rbx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r15d, eax
mov rcx, qword [rsi + 0xb0]
mov rax, qword [rsi + 0xb8]
cmp rcx, rax
je 0x140026c80
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140026d68
lea rdx, str.type
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140026c80
mov rcx, qword [rsi + 0xb0]
mov rax, qword [rsi + 0xb8]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x140026d68
lea rsi, str.view
mov rdx, rsi
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140026c87
mov al, 1
jmp 0x140026c89
lea rsi, str.view
xor al, al
test al, al
cmovne r13, rsi
mov dword [rbp - 8], 0x20
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r13
lea rax, str.bdfvwiz_instance_of_type_s_pid_lu_is_continuing_execution
mov qword [rsp + 0x28], rax
lea rax, str.Controller::ContinueExecution
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 8]
xor esi, esi
movsx edx, si
mov rcx, rbx
call fcn.140001510
mov r15b, 1
jmp 0x140026cd7
xor esi, esi
mov eax, dword [rsp + 0x40]
bt eax, 8
jae 0x140026d15
btr eax, 8
mov dword [rsp + 0x40], eax
mov qword [rbp - 0x38], rsi
mov eax, edi
lock xadd dword [rbp - 0x30], eax
cmp eax, 1
js 0x140026d11
nop dword [rax]
call fcn.140002270
mov eax, edi
lock xadd dword [rbp - 0x30], eax
cmp eax, 1
jns 0x140026d00
lock inc dword [rbp - 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lock xadd dword [r14 + 0x10], edi
sub edi, 1
jg 0x140026d37
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
call qword [r8 + 8]
movzx eax, r15b
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.14002cae0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400276b0
nop
mov ecx, 0x80004005
call fcn.140003730
nop
call fcn.1400276b0
nop
call fcn.1400276b0
nop
call fcn.1400276b0
int3