Function at 0x40bcf0
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43fc1f
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4540fc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0
call fcn.00409200
mov ecx, eax
test ecx, ecx
je 0x40c158
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0xc]
cmp dword [ebx + 4], 7
jne 0x40c00b
mov ecx, dword [ebx + 0x244]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], edx
cmp dword [ecx - 0xc], 0
jle 0x40bee3
movzx eax, word [ecx]
test ax, ax
jne 0x40be8d
test edx, edx
je 0x40be8d
call fcn.00409200
mov ecx, eax
test ecx, ecx
je 0x40c16c
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp + 0xc], esi
mov byte [ebp - 4], 1
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, eax
add ebx, 1
js 0x40c162
mov ecx, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
sub ecx, ebx
or edx, ecx
jge 0x40bdc6
push ebx
lea ecx, [ebp + 0xc]
call fcn.004080b0
mov esi, dword [ebp + 0xc]
cmp ebx, dword [esi - 8]
jg 0x40c162
xor eax, eax
mov dword [esi - 0xc], ebx
mov word [esi + ebx*2], ax
cmp dword [esi - 4], 1
jle 0x40bdec
push dword [esi - 0xc]
lea ecx, [ebp + 0xc]
call fcn.00408150
mov esi, dword [ebp + 0xc]
push ebx
push esi
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push ecx
mov ebx, esp
lea ecx, [esi - 0x10]
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x10], ecx
call fcn.00407e40
add eax, 0x10
mov dword [ebx], eax
call fcn.0040c1d0
test al, al
je 0x40be6f
lea ecx, [edi - 0x10]
lea ebx, [esi - 0x10]
mov dword [ebp + 0x10], ecx
cmp ebx, ecx
je 0x40be72
cmp dword [ecx + 0xc], 0
lea edi, [ecx + 0xc]
jl 0x40be5e
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x40be5e
mov ecx, ebx
call fcn.00407e40
mov dword [ebp - 0x1c], eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x40be56
mov esi, dword [ebp + 0x10]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x1c]
lea edi, [eax + 0x10]
mov dword [ebp - 0x10], edi
jmp 0x40be72
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
push esi
call fcn.00407f30
mov edi, dword [ebp - 0x10]
jmp 0x40be72
mov ebx, dword [ebp + 0x10]
mov byte [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x40bee3
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40bee3
push ecx
mov esi, esp
add ecx, 0xfffffff0
mov dword [ebp + 0x10], esi
call fcn.00407e40
add eax, 0x10
mov dword [esi], eax
call fcn.0040c1d0
test al, al
je 0x40bee3
lea eax, [ebp - 0x14]
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x248]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
push 0x40c190
call dword [sym.imp.USER32.dll_EnumWindows]
cmp byte [ebp - 0x20], 0
je 0x40bee3
lea eax, [ebx + 0x244]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040c500
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], 0
jne 0x40c00b
cmp dword [ebp - 0x14], 0
je 0x40c00b
call fcn.00409200
mov ecx, eax
test ecx, ecx
je 0x40c16c
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp + 0x10], esi
mov byte [ebp - 4], 2
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, eax
add ebx, 1
js 0x40c162
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
sub ecx, ebx
or ecx, eax
jge 0x40bf46
push ebx
lea ecx, [ebp + 0x10]
call fcn.004080b0
mov esi, dword [ebp + 0x10]
cmp ebx, dword [esi - 8]
jg 0x40c162
xor eax, eax
mov dword [esi - 0xc], ebx
mov word [esi + ebx*2], ax
cmp dword [esi - 4], 1
jle 0x40bf6c
push dword [esi - 0xc]
lea ecx, [ebp + 0x10]
call fcn.00408150
mov esi, dword [ebp + 0x10]
push ebx
push esi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push ecx
mov ebx, esp
lea ecx, [esi - 0x10]
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0xc], ecx
call fcn.00407e40
add eax, 0x10
mov dword [ebx], eax
call fcn.0040c1d0
test al, al
je 0x40bfef
lea ecx, [edi - 0x10]
lea ebx, [esi - 0x10]
mov dword [ebp + 0xc], ecx
cmp ebx, ecx
je 0x40bff2
cmp dword [ecx + 0xc], 0
lea edi, [ecx + 0xc]
jl 0x40bfde
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x40bfde
mov ecx, ebx
call fcn.00407e40
mov dword [ebp - 0x1c], eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x40bfd6
mov esi, dword [ebp + 0xc]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x1c]
lea edi, [eax + 0x10]
mov dword [ebp - 0x10], edi
jmp 0x40bff2
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
push esi
call fcn.00407f30
mov edi, dword [ebp - 0x10]
jmp 0x40bff2
mov ebx, dword [ebp + 0xc]
mov byte [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x40c00b
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, str.Control_Panel
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c038
test dx, dx
je 0x40c034
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c038
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c012
xor eax, eax
jmp 0x40c03d
sbb eax, eax
or eax, 1
test eax, eax
je 0x40c092
mov ecx, str.File_Explorer
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c06e
test dx, dx
je 0x40c06a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c06e
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c048
xor eax, eax
jmp 0x40c073
sbb eax, eax
or eax, 1
test eax, eax
je 0x40c092
lea ecx, [edi - 0x10]
call fcn.00407e40
lea esi, [eax + 0x10]
mov dword [ebp + 0x10], esi
mov byte [ebp - 4], 3
mov ebx, 1
mov eax, esi
jmp 0x40c0bb
call fcn.00409200
mov ecx, eax
test ecx, ecx
je 0x40c176
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x10], eax
mov dword [ebp - 4], 4
mov ebx, 2
mov esi, dword [ebp + 0x10]
lea ecx, [eax - 0x10]
mov dword [ebp - 0x18], ebx
call fcn.00407e40
mov ecx, dword [ebp + 8]
add eax, 0x10
or ebx, 4
mov dword [ebp - 4], 3
mov dword [ecx], eax
test bl, 2
je 0x40c0fe
mov edx, dword [ebp + 0x10]
and ebx, 0xfffffffd
mov dword [ebp - 0x18], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c0fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
test bl, 1
je 0x40c122
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40c122
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40c141
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00408fe0
push 0x80070057
call fcn.00408fe0
push 0x80004005
call fcn.00408fe0
push 0x80004005
call fcn.00408fe0
int3