Function at 0x406660
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push esi
push edi
mov dword [ebp - 4], eax
push dword [0x49f454]
call sub.USER32.DLL_IsWindow
test eax, eax
jne 0x406f64
push 0
push 0x406600
call sub.USER32.DLL_EnumWindows
test eax, eax
jne 0x406f28
lea eax, [ebp - 8]
push eax
push dword [0x49f454]
call sub.USER32.DLL_GetWindowThreadProcessId
push dword [ebp - 8]
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
test eax, eax
je 0x406f64
push 4
push 0x1000
push 0x100000
push 0
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_VirtualAllocEx
mov dword [0x49f458], eax
xor ecx, ecx
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
push 0
push 4
lea edx, [ebp - 0xc]
push edx
push 0x5b3d18
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0x90909090
sete al
and eax, 1
test al, al
je 0x406735
mov dword [ebp - 0x10], 0x205
mov edx, dword [ebp - 4]
mov dword [edx + 0x4101], 0x6d2c08
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x4105], 0xb
jmp 0x4068f5
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0x654498
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0x90909090
sete cl
and ecx, 1
test cl, cl
je 0x406781
mov dword [ebp - 0x10], 0x801
mov eax, dword [ebp - 4]
mov dword [eax + 0x4101], 0xdde688
mov edx, dword [ebp - 4]
mov byte [edx + 0x4105], 0xd
jmp 0x4068f5
push 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push 0x6557a8
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0x90909090
sete dl
and edx, 1
test dl, dl
je 0x4067cd
mov dword [ebp - 0x10], 0x907
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x4101], 0x7a75f0
mov eax, dword [ebp - 4]
mov byte [eax + 0x4105], 0xd
jmp 0x4068f5
push 0
push 4
lea edx, [ebp - 0xc]
push edx
push 0x67bafc
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0x90909090
sete al
and eax, 1
test al, al
je 0x406819
mov dword [ebp - 0x10], 0x90226
mov edx, dword [ebp - 4]
mov dword [edx + 0x4101], 0x7e8dc0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x4105], 0x11
jmp 0x4068f5
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0x67bb6c
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0x90909090
sete cl
and ecx, 1
test cl, cl
je 0x406865
mov dword [ebp - 0x10], 0x90301
mov eax, dword [ebp - 4]
mov dword [eax + 0x4101], 0x7e8db0
mov edx, dword [ebp - 4]
mov byte [edx + 0x4105], 0x11
jmp 0x4068f5
push 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push 0x67bb7c
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0x90909090
sete dl
and edx, 1
test dl, dl
je 0x4068ae
mov dword [ebp - 0x10], 0x90302
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x4101], 0x7e6e00
mov eax, dword [ebp - 4]
mov byte [eax + 0x4105], 0x11
jmp 0x4068f5
push 0
push 4
lea edx, [ebp - 0xc]
push edx
push 0x6962bc
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0x90909090
sete al
and eax, 1
test al, al
je 0x4068f5
mov dword [ebp - 0x10], 0x90428
mov edx, dword [ebp - 4]
mov dword [edx + 0x4101], 0x7fa56c
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x4105], 0x11
mov eax, dword [ebp - 0x10]
cmp eax, 0x90226
jg 0x40692b
je 0x406d35
sub eax, 0x205
je 0x406eac
sub eax, 0x5fc
je 0x406e2f
sub eax, 0x106
je 0x406db2
jmp 0x406f64
sub eax, 0x90301
je 0x406bdc
dec eax
je 0x406a92
sub eax, 0x126
jne 0x406f64
mov eax, dword [ebp - 4]
call fcn.00406374
push 0
push 4
lea edx, [ebp - 0xc]
push edx
push 0x5bf291
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0xb9836a74
jne 0x406990
mov dword [ebp - 0xc], 0x1000000
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0x5bf296
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
push 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push 0x5bf348
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0xba835f74
jne 0x4069d0
mov dword [ebp - 0xc], 0x1000000
push 0
push 4
lea edx, [ebp - 0xc]
push edx
push 0x5bf34d
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0x69535c
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0x40c0674
jne 0x406a10
mov dword [ebp - 0xc], 0xc0674
push 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push 0x69535c
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
mov dword [ebp - 0xc], 0x680eeb10
push 0
push 4
lea edx, [ebp - 0xc]
push edx
push 0x696014
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
mov esi, 0x4971c0
lea edi, [ebp - 0x34]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x4971e1]
mov dword [ebp - 0x3c], eax
mov ax, word [0x4971e5]
mov word [ebp - 0x38], ax
lea edx, [ebp - 0x27]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov dword [edx], eax
push 0
push 0x22
lea edx, [ebp - 0x34]
push edx
push 0x73af70
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
push 0
push 6
lea eax, [ebp - 0x3c]
push eax
push 0x6962c0
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
jmp 0x406f64
mov eax, dword [ebp - 4]
call fcn.00406374
push 0
push 4
lea edx, [ebp - 0xc]
push edx
push 0x5a850a
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0xb9836a74
jne 0x406ada
mov dword [ebp - 0xc], 0x1000000
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0x5a850f
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
push 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push 0x5a85c1
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0xba835f74
jne 0x406b1a
mov dword [ebp - 0xc], 0x1000000
push 0
push 4
lea edx, [ebp - 0xc]
push edx
push 0x5a85c6
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0x67b21c
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0x40c0674
jne 0x406b5a
mov dword [ebp - 0xc], 0xc0674
push 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push 0x67b21c
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
mov dword [ebp - 0xc], 0x680eeb10
push 0
push 4
lea edx, [ebp - 0xc]
push edx
push 0x67bed4
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
mov esi, 0x4971e7
lea edi, [ebp - 0x60]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x497208]
mov dword [ebp - 0x68], eax
mov ax, word [0x49720c]
mov word [ebp - 0x64], ax
lea edx, [ebp - 0x53]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov dword [edx], eax
push 0
push 0x22
lea edx, [ebp - 0x60]
push edx
push 0x71aea0
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
push 0
push 6
lea eax, [ebp - 0x68]
push eax
push 0x67c180
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
jmp 0x406f64
mov eax, dword [ebp - 4]
call fcn.00406374
push 0
push 4
lea edx, [ebp - 0xc]
push edx
push 0x5a7fc6
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0xb9836a74
jne 0x406c24
mov dword [ebp - 0xc], 0x1000000
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0x5a7fcb
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
push 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push 0x5a807d
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0xba835f74
jne 0x406c64
mov dword [ebp - 0xc], 0x1000000
push 0
push 4
lea edx, [ebp - 0xc]
push edx
push 0x5a8082
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0x67ac0c
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0xc], 0x40c0674
jne 0x406ca4
mov dword [ebp - 0xc], 0xc0674
push 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push 0x67ac0c
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
mov dword [ebp - 0xc], 0x900eeb10
push 0
push 4
lea edx, [ebp - 0xc]
push edx
push 0x67b8c4
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
mov esi, 0x49720e
lea edi, [ebp - 0x8c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x49722f]
mov dword [ebp - 0x94], eax
mov ax, word [0x497233]
mov word [ebp - 0x90], ax
lea edx, [ebp - 0x7f]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov dword [edx], eax
push 0
push 0x22
lea edx, [ebp - 0x8c]
push edx
push 0x71aea0
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
push 0
push 6
lea eax, [ebp - 0x94]
push eax
push 0x67bb70
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
jmp 0x406f64
mov eax, dword [ebp - 4]
call fcn.00406374
mov esi, 0x497235
lea edi, [ebp - 0xb8]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x497256]
mov dword [ebp - 0xc0], eax
mov ax, word [0x49725a]
mov word [ebp - 0xbc], ax
lea edx, [ebp - 0xab]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov dword [edx], eax
push 0
push 0x22
lea edx, [ebp - 0xb8]
push edx
push 0x71ae50
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
push 0
push 6
lea eax, [ebp - 0xc0]
push eax
push 0x67bb00
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
jmp 0x406f64
mov eax, dword [ebp - 4]
call fcn.00406374
mov esi, 0x49725c
lea edi, [ebp - 0xe4]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x49727d]
mov dword [ebp - 0xec], eax
mov ax, word [0x497281]
mov word [ebp - 0xe8], ax
lea edx, [ebp - 0xd7]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov dword [edx], eax
push 0
push 0x22
lea edx, [ebp - 0xe4]
push edx
push 0x6e3500
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
push 0
push 6
lea eax, [ebp - 0xec]
push eax
push 0x6557b0
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
jmp 0x406f64
mov eax, dword [ebp - 4]
call fcn.00406374
mov esi, 0x497283
lea edi, [ebp - 0x110]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x4972a4]
mov dword [ebp - 0x118], eax
mov ax, word [0x4972a8]
mov word [ebp - 0x114], ax
lea edx, [ebp - 0x103]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov dword [edx], eax
push 0
push 0x22
lea edx, [ebp - 0x110]
push edx
push 0x6db400
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
push 0
push 6
lea eax, [ebp - 0x118]
push eax
push 0x6544a0
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
jmp 0x406f64
mov eax, dword [ebp - 4]
call fcn.00406374
mov esi, 0x4972aa
lea edi, [ebp - 0x13c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x4972cb]
mov dword [ebp - 0x144], eax
mov ax, word [0x4972cf]
mov word [ebp - 0x140], ax
lea edx, [ebp - 0x12f]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov dword [edx], eax
push 0
push 0x22
lea edx, [ebp - 0x13c]
push edx
push 0x63cf80
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
push 0
push 6
lea eax, [ebp - 0x144]
push eax
push 0x5b3d20
mov edx, dword [ebp - 4]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_WriteProcessMemory
jmp 0x406f64
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x406f64
push 0x8000
push 0
push dword [0x49f458]
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
call sub.KERNEL32.DLL_VirtualFreeEx
xor edx, edx
mov dword [0x49f458], edx
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x10], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret