Function at 0x1000d5f0
Capabilities:
Enumerate gui resources
Set global application hook

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
cmp eax, 1
jne 0x1000d74c
mov eax, dword [ebp + 8]
push 0x1008e36c
mov dword [0x1008e390], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.10003aa0
mov edi, eax
cmp edi, 1
jl 0x1000d851
cmp dword [0x1008e388], 0
jne 0x1000d685
push 4
call fcn.1001dcb9
add esp, 4
mov esi, eax
cmp edi, 1
mov dword [ebp + 0xc], esi
setg byte [0x1008e0f8]
push esi
push 0x10002770
mov dword [esi], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esi]
test eax, eax
je 0x1000d67f
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [0x1008e0f4], eax
test eax, eax
je 0x1000d67f
push 0x10002b20
push 0xfffffffffffffffc
push dword [esi]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [0x1008e388], esi
cmp dword [0x1008e384], 0
jne 0x1000d851
push ebx
push 0x24
call fcn.1001dcb9
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
add esp, 4
mov dword [ebp + 0xc], ebx
mov dword [0x1008e394], 0
mov dword [ebx + 0xc], ebx
call edi
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
push dword [0x1008e390]
push 0x10017dd0
push 3
call esi
mov dword [ebx + 4], eax
call edi
push eax
push dword [0x1008e390]
push 0x10017d50
push 4
call esi
cmp dword [ebx + 4], 0
mov ecx, eax
lea eax, [ebx + 4]
mov dword [eax + 4], ecx
je 0x1000d6f9
test ecx, ecx
je 0x1000d6f9
mov dword [0x1008e394], eax
lea esi, [ebx + 0x10]
mov dword [ebx], 0x10086fec
push esi
push 0x1000d360
mov dword [esi], 0
mov byte [ebx + 0x14], 1
mov dword [ebx + 0x18], 0xffffffff
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esi], 0
jne 0x1000d73a
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esi], eax
mov dword [0x1008e384], ebx
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
test eax, eax
jne 0x1000d851
push 0x1008e36c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [0x1008e38c]
test ecx, ecx
je 0x1000d779
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [0x1008e38c], 0
mov esi, dword [0x1008e388]
test esi, esi
je 0x1000d7f3
mov ecx, dword [esi]
test ecx, ecx
je 0x1000d79c
mov eax, dword [0x1008e0f4]
test eax, eax
je 0x1000d79c
push eax
push 0xfffffffffffffffc
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [0x1008e35c]
mov edi, dword [sym.imp.USER32.dll_DestroyMenu]
test eax, eax
je 0x1000d7b8
push eax
call edi
mov dword [0x1008e35c], 0
mov eax, dword [0x1008e360]
test eax, eax
je 0x1000d7ce
push eax
call edi
mov dword [0x1008e360], 0
push 4
push esi
mov dword [esi], 0
mov dword [0x1008e0f4], 0
call fcn.1001d914
add esp, 8
mov dword [0x1008e388], 0
mov esi, dword [0x1008e384]
test esi, esi
je 0x1000d851
mov edi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esi], 0x10086fec
mov eax, dword [esi + 4]
test eax, eax
je 0x1000d81a
push eax
call edi
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x1000d82b
push eax
call edi
mov dword [esi + 8], 0
push 0x24
push esi
mov dword [0x1008e394], 0
mov dword [esi + 0xc], 0
call fcn.1001d914
add esp, 8
mov dword [0x1008e384], 0
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc