Function at 0x1000195b
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, str.elementclient.exe
push esi
push 0x100908a4
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x10001caa
push 0x10090250
push 1
push 0x10090300
push 0x100909a8
call fcn.10004b57
push 0x10090c80
call fcn.100051b7
add esp, 0x14
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.MSVCRT.dll__getpid]
push eax
push 0x10001782
call dword [sym.imp.USER32.dll_EnumWindows]
xor ebx, ebx
cmp dword [0x10090ab0], ebx
je 0x10001caa
call fcn.100050d2
test eax, eax
je 0x100019dd
push 1
pop eax
jmp 0x10001cac
push edi
call fcn.1000235b
mov edi, eax
call fcn.1000440f
push 0x100017fc
call fcn.10003850
pop ecx
mov ecx, edi
call fcn.100022db
push 1
push 5
lea eax, [ebp - 8]
push 5
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x56
mov byte [ebp - 7], 0x8d
mov byte [ebp - 6], 0x4c
mov byte [ebp - 5], 0x24
mov byte [ebp - 4], 0x4c
call fcn.10002078
cmp eax, ebx
jbe 0x10001a33
push 0x1000137a
push eax
mov ecx, edi
call fcn.10001cff
push 1
push 0xfffffffffffffffb
lea eax, [ebp - 0x14]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x14], 0x8b
mov byte [ebp - 0x13], 0x4c
mov byte [ebp - 0x12], 0x24
mov byte [ebp - 0x11], 0x2c
mov byte [ebp - 0x10], 0x8b
mov byte [ebp - 0xf], 0x10
mov byte [ebp - 0xe], 0x8b
mov byte [ebp - 0xd], 0x52
mov byte [ebp - 0xc], 0x44
call fcn.10002078
cmp eax, ebx
mov dword [ebp - 8], eax
jbe 0x10001aa5
push 0x100013f9
push eax
mov ecx, edi
call fcn.10001cff
mov eax, dword [ebp - 8]
push 0x10001469
add eax, 0x45
mov ecx, edi
push eax
call fcn.10001e05
mov eax, dword [ebp - 8]
push 0x100014cd
add eax, 0x81
mov ecx, edi
push eax
call fcn.10001e05
or byte [ebp - 0xf], 0xff
push 1
push 0xffffffffffffffcd
lea eax, [ebp - 0x10]
push 6
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0xd], 0x83
mov byte [ebp - 0xc], 0xc4
mov byte [ebp - 0xb], 4
call fcn.10002078
cmp eax, ebx
mov dword [ebp - 8], eax
jbe 0x10001b09
push 0x100016b8
push eax
mov ecx, edi
call fcn.10001cff
mov eax, dword [ebp - 8]
push 0x100016dc
add eax, 0x1d
mov ecx, edi
push eax
call fcn.10001cff
mov eax, dword [ebp - 8]
push 0x10001700
add eax, 0x2e
mov ecx, edi
push eax
call fcn.10001ef7
push 1
push 0xffffffffffffffe5
lea eax, [ebp - 0x10]
push 7
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x10], 0x8b
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x24
mov byte [ebp - 0xd], 0x14
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x4d
mov byte [ebp - 0xa], 4
call fcn.10002078
cmp eax, ebx
mov dword [ebp - 8], eax
jbe 0x10001b5e
push 0x10001597
push eax
mov ecx, edi
call fcn.10001e05
mov eax, dword [ebp - 8]
push 0x10001531
add eax, 0x16
mov ecx, edi
push eax
call fcn.10001cff
push 1
push 0xa
lea eax, [ebp - 0x14]
push 0xa
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x14], 0x8b
mov byte [ebp - 0x13], 0x86
mov byte [ebp - 0x12], 0x4c
mov byte [ebp - 0x11], 2
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], 0x52
mov byte [ebp - 0xd], 0x50
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0xce
call fcn.10002078
cmp eax, ebx
jbe 0x10001ba7
push 0x10001616
push eax
mov ecx, edi
call fcn.10001cff
push 1
push 3
lea eax, [ebp - 0x14]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x14], 0x8b
mov byte [ebp - 0x13], 0x41
mov byte [ebp - 0x12], 4
mov byte [ebp - 0x11], 0x8b
mov byte [ebp - 0x10], 0x80
mov byte [ebp - 0xf], 0x60
mov byte [ebp - 0xe], 5
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
call fcn.10002078
cmp eax, ebx
jbe 0x10001bec
push 0x100015cc
push eax
mov ecx, edi
call fcn.10001e05
push 1
push 0x12
lea eax, [ebp - 0x14]
push 0xc
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x14], 0x8b
mov byte [ebp - 0x13], 0x38
mov byte [ebp - 0x12], 0x8b
mov byte [ebp - 0x11], 0xce
mov byte [ebp - 0x10], 0xc7
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x24
mov byte [ebp - 0xd], 0x1c
mov byte [ebp - 0xc], 1
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
call fcn.10002078
cmp eax, ebx
mov dword [ebp - 8], eax
jbe 0x10001c52
push 0x10001658
push eax
mov ecx, edi
call fcn.10001cff
mov eax, dword [ebp - 8]
push 0x10001658
add eax, 0xffffffbd
mov ecx, edi
push eax
call fcn.10001cff
or byte [ebp - 0xf], 0xff
push 1
push 0xc
lea eax, [ebp - 0x14]
push 0xc
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x14], 0x8b
mov byte [ebp - 0x13], 0xc8
mov byte [ebp - 0x12], 0x8b
mov byte [ebp - 0x11], 0x42
mov byte [ebp - 0x10], 0x40
mov byte [ebp - 0xe], 0xd0
mov byte [ebp - 0xd], 0x50
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], 0x8b
mov byte [ebp - 9], 0xce
call fcn.10002078
cmp eax, ebx
jbe 0x10001ca4
push 0x10001683
push eax
mov ecx, edi
call fcn.10001cff
push 1
pop eax
pop edi
jmp 0x10001cac
xor eax, eax
pop esi
pop ebx
leave
ret