Function at 0x10001649
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, str.elementclient.exe
push esi
push 0x1009081c
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x10001921
push 0x100901c8
push 1
pop ebx
push ebx
push 0x10090278
push 0x10090920
call fcn.100046d8
push 0x10090bf8
call fcn.10004d38
add esp, 0x14
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.MSVCRT.dll__getpid]
push eax
push 0x10001463
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [0x10090a28], 0
je 0x10001921
call fcn.10004c53
test eax, eax
je 0x100016cb
mov eax, ebx
jmp 0x10001923
push edi
call fcn.10001edc
mov edi, eax
call fcn.10003f90
push 0x100014dd
call fcn.100033d1
pop ecx
mov ecx, edi
call fcn.10001e5c
push ebx
push 0xffffffffffffffed
lea eax, [ebp - 0x10]
push 0xa
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x10], 0x8b
mov byte [ebp - 0xf], 0x54
mov byte [ebp - 0xe], 0x24
mov byte [ebp - 0xd], 0x48
mov byte [ebp - 0xc], 0x8d
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x24
mov byte [ebp - 9], 0x14
mov byte [ebp - 8], 0x52
mov byte [ebp - 7], 0x50
call fcn.10001bf9
test eax, eax
mov dword [ebp - 4], eax
jbe 0x1000174a
push 0x10001096
push eax
mov ecx, edi
call fcn.10001976
mov eax, dword [ebp - 4]
push 0x100010de
add eax, 0x33
mov ecx, edi
push eax
call fcn.10001976
push ebx
push 0xfffffffffffffffb
lea eax, [ebp - 0x10]
push 8
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x10], 0x8d
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 0xe], 0x24
mov byte [ebp - 0xd], 0x8d
mov byte [ebp - 0xc], 0x4c
mov byte [ebp - 0xb], 0x24
mov byte [ebp - 0xa], 0x5c
mov byte [ebp - 9], 0x50
call fcn.10001bf9
test eax, eax
jbe 0x1000178c
push 0x100010fb
push eax
mov ecx, edi
call fcn.10001976
and byte [ebp - 9], 0
and byte [ebp - 8], 0
push ebx
push 3
lea eax, [ebp - 0x10]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x10], 0x8b
mov byte [ebp - 0xf], 0x41
mov byte [ebp - 0xe], 4
mov byte [ebp - 0xd], 0x8b
mov byte [ebp - 0xc], 0x80
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 3
call fcn.10001bf9
test eax, eax
jbe 0x100017d2
push 0x10001179
push eax
mov ecx, edi
call fcn.10001a7c
push ebx
push 0x10
lea eax, [ebp - 0x10]
push 8
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x10], 0x8b
mov byte [ebp - 0xf], 0x38
mov byte [ebp - 0xe], 0x88
mov byte [ebp - 0xd], 0x4c
mov byte [ebp - 0xc], 0x24
mov byte [ebp - 0xb], 8
mov byte [ebp - 0xa], 0x8b
mov byte [ebp - 9], 0xce
call fcn.10001bf9
test eax, eax
jbe 0x10001814
push 0x10001201
push eax
mov ecx, edi
call fcn.10001976
push ebx
push 0x26
lea eax, [ebp - 0xc]
push 6
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0x83
mov byte [ebp - 0xa], 0xc1
mov byte [ebp - 9], 0x41
mov byte [ebp - 8], 0x52
mov byte [ebp - 7], 0x51
call fcn.10001bf9
test eax, eax
mov dword [ebp - 4], eax
jbe 0x10001877
push 0x10001261
push eax
mov ecx, edi
call fcn.10001a7c
mov eax, dword [ebp - 4]
push 0x100012d1
add eax, 0x38
mov ecx, edi
push eax
call fcn.10001a7c
mov eax, dword [ebp - 4]
push 0x10001335
add eax, 0x70
mov ecx, edi
push eax
call fcn.10001a7c
push ebx
push 0xffffffffffffffc6
lea eax, [ebp - 0xc]
push 6
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x8d
mov byte [ebp - 0xb], 0xc
mov byte [ebp - 0xa], 0x8a
mov byte [ebp - 9], 0x8d
mov byte [ebp - 8], 0xc
mov byte [ebp - 7], 0x89
call fcn.10001bf9
test eax, eax
mov dword [ebp - 4], eax
jbe 0x100018da
push 0x10001399
push eax
mov ecx, edi
call fcn.10001976
mov eax, dword [ebp - 4]
push 0x100013bd
add eax, 0x1d
mov ecx, edi
push eax
call fcn.10001976
mov eax, dword [ebp - 4]
push 0x100013e1
add eax, 0x37
mov ecx, edi
push eax
call fcn.10001a7c
or byte [ebp - 0x10], 0xff
and byte [ebp - 0xb], 0
push ebx
push 8
lea eax, [ebp - 0x10]
push 8
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xf], 0x52
mov byte [ebp - 0xe], 0x40
mov byte [ebp - 0xd], 0x50
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 0xa], 0x8b
mov byte [ebp - 9], 0xce
call fcn.10001bf9
test eax, eax
jbe 0x1000191c
push 0x1000122c
push eax
mov ecx, edi
call fcn.10001976
mov eax, ebx
pop edi
jmp 0x10001923
xor eax, eax
pop esi
pop ebx
leave
ret