Function at 0x102849f
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x1028770
mov esi, ecx
call edi
push 0x1028744
mov dword [esi + 0x84], eax
call edi
lea edi, [esi + 0x94]
push edi
mov dword [esi + 0x88], eax
call fcn.01028845
test eax, eax
jl 0x1028705
lea eax, [esi + 0x20]
push eax
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_IUnknown_SetSite]
mov eax, dword [edi]
mov ecx, dword [eax]
lea edx, [ebp - 0xac]
push edx
push 0x100eedc
push eax
call dword [ecx]
test eax, eax
jl 0x102852a
push dword [ebp - 0xac]
push dword [esi + 4]
call dword [sym.imp.ole32.dll_RegisterDragDrop]
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [edi]
mov ecx, dword [eax]
push ebx
push 0
push 0
push 0xb
push eax
call dword [ecx + 0x38]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, esi
mov dword [ebp - 0xb0], eax
mov dword [esi + 0x44], 1
call fcn.01020e2d
mov ecx, esi
call fcn.01020cad
mov ecx, esi
call fcn.010282e8
lea ebx, [esi + 0x74]
push ebx
push 0x1017c94
push 1
push 0
push 0x1017ca4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebx]
test eax, eax
je 0x10285b1
mov ecx, dword [eax]
lea edx, [ebp - 0xa8]
push edx
push 0x1017cb4
push eax
call dword [ecx]
test eax, eax
jl 0x10285b1
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
push 2
push 2
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x1028730
call ebx
mov ecx, esi
mov dword [esi + 0x28], eax
call fcn.01026dee
test eax, eax
je 0x10286f7
mov eax, dword [0x10b2198]
mov ecx, dword [0x10b219c]
mov edx, eax
or edx, ecx
je 0x10285f6
push 0x10268d8
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_EventEnabled]
test al, al
jne 0x1060fa9
xor eax, eax
push 3
push dword [esi + 4]
mov dword [esi + 0x98], eax
call dword [sym.imp.SHELL32.dll_Ordinal_181]
push 0x102870c
call ebx
mov dword [esi + 0x2c], eax
push 1
xor ebx, ebx
push ebx
push ebx
mov ecx, esi
call fcn.01014d05
or dword [esi + 0x70], 0xffffffff
mov ecx, esi
call fcn.010271f2
push esi
push 0x1026e95
call dword [sym.imp.USER32.dll_EnumWindows]
lea eax, [ebp - 0xb8]
push eax
push 1
push 0x43a
push 0xc008000
push 0x8002
push dword [esi + 4]
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb8], ebx
call dword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov dword [esi + 0x80], eax
push 0x50
lea eax, [ebp - 0xa4]
push eax
push 0x252
push dword [0x10b10b4]
call dword [sym.imp.USER32.dll_LoadStringW]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp - 0xa4]
push eax
push dword [esi + 4]
call ebx
mov eax, dword [edi]
lea ecx, [ebp - 0xa4]
push ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38]
push eax
call ebx
mov ecx, esi
call fcn.01028789
xor ebx, ebx
cmp dword [esi + 0xb4], ebx
jne 0x10286cb
push ebx
push dword [esi + 0xb0]
push 0xa
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov edi, dword [edi]
push ebx
push dword [ebp - 0xb0]
mov dword [esi + 0x44], ebx
mov eax, dword [edi]
push 0xb
push edi
call dword [eax + 0x38]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100204d
leave
ret
push dword [esi + 4]
call dword [sym.imp.USER32.dll_RegisterShellHookWindow]
jmp 0x1028613
or eax, 0xffffffff
jmp 0x10286e9
xor eax, eax
inc eax
jmp 0x10285f8