Function at 0x49a108
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff97c
push ebx
xor ecx, ecx
mov dword [ebp - 0x684], ecx
mov dword [ebp - 0x67c], ecx
mov dword [ebp - 0x680], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49a453
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4269fc]
call fcn.00404f18
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
push 0x49a0b8
call sub.user32.dll_EnumWindows
call sub.KERNEL32.DLL_GetCurrentProcessId
xor ecx, ecx
mov edx, eax
mov eax, dword [ebp - 0x1c]
call fcn.00432ae4
xor edx, edx
mov eax, 2
call fcn.004402fc
mov dword [ebp - 0x10], eax
call fcn.004978dc
test al, al
je 0x49a19d
push 0x49a460
push 0x49a498
call sub.KERNEL32.DLL_LoadLibraryW
push eax
call fcn.0040b2c0
mov dword [ebp - 0x24], eax
jmp 0x49a1a2
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x49a426
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x250], 0x22c
lea edx, [ebp - 0x250]
mov eax, dword [ebp - 0x10]
call fcn.0044031c
test eax, eax
je 0x49a407
mov edx, dword [ebp - 0x248]
mov eax, 8
call fcn.004402fc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x49a31c
xor eax, eax
push ebp
push 0x49a315
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x1c]
call fcn.00432944
test eax, eax
jge 0x49a217
call fcn.00405bd0
jmp 0x49a3f1
mov dword [ebp - 0x678], 0x428
lea eax, [ebp - 4]
xor edx, edx
call fcn.004070b4
xor ebx, ebx
lea edx, [ebp - 0x678]
mov eax, dword [ebp - 0x14]
call fcn.0044035c
test eax, eax
je 0x49a2d9
lea eax, [ebp - 0x67c]
lea edx, [ebp - 0x658]
mov ecx, pe_nt_image_headers32
call fcn.00407260
mov eax, dword [ebp - 0x67c]
push eax
lea eax, [ebp - 0x680]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00407260
mov eax, dword [ebp - 0x680]
pop edx
call fcn.00410a38
test al, al
je 0x49a299
lea eax, [ebp - 4]
lea edx, [ebp - 0x458]
mov ecx, 0x104
call fcn.00407260
lea eax, [ebp - 0x684]
lea edx, [ebp - 0x458]
mov ecx, 0x104
call fcn.00407260
mov edx, dword [ebp - 0x684]
mov eax, dword [ebp - 8]
call fcn.0040ba14
test al, al
je 0x49a2c3
mov bl, 1
lea edx, [ebp - 0x678]
mov eax, dword [ebp - 0x14]
call fcn.0044037c
test eax, eax
jne 0x49a243
cmp dword [ebp - 4], 0
setne al
test al, bl
je 0x49a2fe
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jge 0x49a2fe
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a3f1
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
ret
cmp dword [ebp - 0x24], 0
je 0x49a3f1
mov edx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x1c]
call fcn.00432944
test eax, eax
jl 0x49a3f1
mov eax, dword [ebp - 0x248]
push eax
push 0
push 0x1000
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x49a3f1
xor eax, eax
push ebp
push 0x49a3ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x104
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x20]
call fcn.004073d0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.004070ec
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [ebp - 0x24]
test eax, eax
je 0x49a3d3
cmp dword [ebp - 0x20], 0x104
jg 0x49a3d3
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x20]
call fcn.004073d0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0040ba14
test al, al
je 0x49a3d3
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jge 0x49a3d3
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a3f1
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
ret
lea edx, [ebp - 0x250]
mov eax, dword [ebp - 0x10]
call fcn.0044033c
test eax, eax
jne 0x49a1d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a42d
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x1c]
call fcn.00404f48
ret