Function at 0x563930
Capabilities:
Check mutex on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a7318
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5f300c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
movzx edi, ax
test eax, 0x10000
je 0x563978
mov dword [esi + 0x1260], 0
xor eax, eax
jmp 0x56397e
mov eax, dword [esi + 0x1260]
mov ebx, dword [ebp + 0xc]
cmp ebx, dword [esi + 0x7f4]
jne 0x563995
mov dword [esi + 0x1260], 0
jmp 0x56399d
test eax, eax
jne 0x563a47
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 0x7c0]
je 0x563a47
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 0x7d4]
je 0x563a47
call dword [sym.imp.USER32.dll_GetFocus]
mov edx, eax
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x28]
call fcn.00573090
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
jb 0x5639e0
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x18], 4
jne 0x563a3f
push 4
mov edx, 0x5d6f0c
call fcn.00436670
add esp, 4
test eax, eax
jne 0x563a3f
mov eax, edi
sub eax, 0xc9
je 0x563a20
sub eax, 2
je 0x563a15
sub eax, 1
jne 0x563a3f
push eax
push eax
push 0x301
jmp 0x563a29
push 0
push 0
push 0x300
jmp 0x563a29
push 0
push 0
push 0xc7
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x28]
call fcn.0040ab30
jmp 0x563d76
lea ecx, [ebp - 0x28]
call fcn.0040ab30
cmp edi, 0x3c0
ja 0x563c6d
je 0x563c1f
mov eax, edi
sub eax, 0x131
je 0x563be1
sub eax, 0xf
je 0x563b10
sub eax, 0x5d
jne 0x563c84
mov edx, dword [esi + 0x12ec]
add esi, 0x12ec
mov cl, byte [edx + 0x88c]
test cl, cl
sete al
mov byte [edx + 0x88c], al
test cl, cl
jne 0x563af8
cmp dword [esi + 0x20], 8
lea eax, [esi + 0xc]
jb 0x563aa4
mov eax, dword [eax]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 8], eax
call edi
cmp eax, 0xb7
je 0x563ac8
call edi
cmp eax, 5
jne 0x563b01
push esi
push 0x577f70
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esi + 0x28]
test eax, eax
je 0x563b01
push 1
push 0
push dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x174]
jmp 0x563d76
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x174]
jmp 0x563d76
test ebx, ebx
jne 0x563c13
push ebx
push str.save.on.deactivate
lea ecx, [esi + 0xb0c]
call fcn.00528190
test eax, eax
je 0x563d76
mov ecx, esi
call fcn.00543010
mov eax, dword [esi + 0xbb0]
xor edi, edi
mov dword [ebp - 0x48], eax
cmp dword [esi + 0xbd4], edi
jle 0x563bd2
nop
mov eax, dword [esi + 0xbc4]
cmp byte [eax + ebx + 0x2c], 0
je 0x563bc0
lea edx, [eax + 4]
mov eax, dword [edx + ebx + 0x10]
add edx, ebx
mov ecx, edx
cmp dword [edx + 0x14], 8
jb 0x563b70
mov ecx, dword [edx]
test eax, eax
je 0x563bc0
dec eax
cmp eax, 0xffffffff
jb 0x563b7d
or eax, 0xffffffff
cmp word [ecx + eax*2], 0x5c
lea eax, [ecx + eax*2]
je 0x563b94
cmp eax, ecx
je 0x563bc0
sub eax, 2
cmp word [eax], 0x5c
jne 0x563b87
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x563bc0
cmp dword [edx + 0x14], 8
jb 0x563ba5
mov edx, dword [edx]
cmp word [edx + eax*2 + 2], 0
je 0x563bc0
push 1
push edi
mov ecx, esi
call fcn.00542d70
push 1
mov ecx, esi
call fcn.00550ed0
inc edi
add ebx, 0xa0
cmp edi, dword [esi + 0xbd4]
jl 0x563b50
mov eax, dword [ebp - 0x48]
push 1
push eax
mov ecx, esi
call fcn.00542d70
jmp 0x563d76
xor cl, cl
lea eax, [esi + 0xa4b]
xchg byte [eax], cl
cmp byte [esi + 0x894], 0
je 0x563bfe
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x184]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x174]
lea ecx, [esi + 0xa14]
call fcn.0051dd30
mov ecx, esi
call fcn.0054f9d0
jmp 0x563d76
mov cl, byte [esi + 0x848]
test cl, cl
push 3
sete al
push 0
mov byte [esi + 0x848], al
xor eax, eax
push 0
test cl, cl
push 0
sete al
push 0
add eax, 0xfffffffe
push eax
push dword [esi + 0x7b0]
call dword [sym.imp.USER32.dll_SetWindowPos]
movzx eax, byte [esi + 0x848]
mov ecx, esi
mov edx, dword [esi]
push eax
push 0x3c0
call dword [edx + 0x168]
jmp 0x563d76
mov eax, edi
sub eax, 0x3c1
je 0x563d6f
sub eax, 1
je 0x563cad
sub eax, 1
je 0x563c97
push dword [esi + 0x1260]
mov ecx, esi
push edi
call fcn.00539b00
jmp 0x563d76
mov eax, ebx
mov ecx, esi
shr eax, 0x10
push eax
movzx eax, bx
push eax
call fcn.00546e70
jmp 0x563d76
mov eax, dword [esi + 0xbb0]
cmp ebx, eax
jne 0x563cf2
push 1
push 0
mov ecx, esi
call fcn.0054fed0
cmp eax, 1
je 0x563d76
push 0
push 0
push 1
mov ecx, esi
call fcn.00546710
push 0
push 0
push 0x960
push dword [esi + 0x7c0]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x563d76
lea ecx, [eax + eax*4]
shl ecx, 5
lea eax, [ebp - 0x44]
add ecx, dword [esi + 0xbc4]
push eax
call fcn.00518c80
push 1
push ebx
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00542d70
push 1
push 0
mov ecx, esi
call fcn.0054fed0
cmp eax, 1
je 0x563d65
push 0
push 0
push 1
mov ecx, esi
call fcn.00546710
push 0
push 0
push 0x960
push dword [esi + 0x7c0]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0
lea eax, [ebp - 0x44]
push eax
lea ecx, [esi + 0xbb0]
call fcn.00542580
push eax
mov ecx, esi
call fcn.00542d70
lea ecx, [ebp - 0x40]
call fcn.0040ab30
jmp 0x563d76
mov ecx, esi
call fcn.00563750
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059df64
mov esp, ebp
pop ebp
ret 8