Function at 0x402240
Capabilities:
Enumerate gui resources
Enumerate processes
Get disk information
Get graphical window text
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4a334
call fcn.00415c50
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edi
push 0
push 0
mov edi, ecx
mov dword [ebp - 0x4a2c0], 0
push 0xb
push edi
mov dword [ebp - 0x4a2c8], edi
call esi
push 0x283000
push 0
push 0x41f370
call fcn.00405160
add esp, 0xc
push 0
push 0
push 0x1009
push edi
call esi
test eax, eax
je 0x40281d
xor ebx, ebx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x4a2b0], esi
cmp esi, 0xffffffff
je 0x40281d
lea eax, [ebp - 0x4a2a8]
mov dword [ebp - 0x4a2a8], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x402345
lea edi, [ebp - 0x4a180]
mov dword [ebp - 0x4a2ac], edi
cmp ebx, 0x400
jae 0x40233f
lea eax, [ebp - 0x4a284]
push str.RF_Online.bin
push eax
call fcn.004093cb
add esp, 8
test eax, eax
jne 0x40232d
mov ecx, 0x4a
lea esi, [ebp - 0x4a2a8]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x4a2ac]
inc ebx
mov esi, dword [ebp - 0x4a2b0]
add edi, 0x128
mov dword [ebp - 0x4a2ac], edi
lea eax, [ebp - 0x4a2a8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4022e7
mov edi, dword [ebp - 0x4a2c8]
push esi
mov dword [0x41f36c], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
push 1
push 0x21
push 0x32
call esi
push eax
push 0x31
call esi
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov dword [ebp - 0x4a2ac], eax
mov eax, dword [0x41f36c]
test eax, eax
je 0x40277e
imul ecx, eax, 0x128
lea ebx, [ebp - 0x4a178]
mov esi, 0x41f374
mov dword [ebp - 0x4a2c4], esi
add ebx, ecx
jmp 0x4023a6
mov ebx, dword [ebp - 0x4a2bc]
dec eax
mov dword [ebp - 0x4a2b8], 0
push 0x103
mov dword [ebp - 0x4a310], eax
sub ebx, 0x128
lea eax, [ebp - 0x117]
mov dword [ebp - 0x4a2bc], ebx
push 0
push eax
mov byte [ebp - 0x118], 0
call fcn.00405160
mov eax, dword [ebx]
lea edi, [ebx + 0x1c]
add esp, 0xc
mov byte [ebp - 0x10], 0
lea ecx, [esi + 0x800]
xorps xmm0, xmm0
mov dword [ecx - 0x804], eax
movq qword [ebp - 0xf], xmm0
push edi
push 0x104
push ecx
mov dword [ebp - 0x4a2b0], edi
call fcn.004071d0
mov eax, dword [ebx]
add esp, 0xc
mov dword [ebp - 0x4a318], eax
lea eax, [ebp - 0x4a318]
mov dword [ebp - 0x4a314], 0
push eax
push 0x402200
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x4a314]
test eax, eax
je 0x40244d
push 0x800
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push dword [ebx]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x4a30c], eax
test eax, eax
je 0x402586
push 0x104
lea ecx, [ebp - 0x118]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]
lea eax, [esi + 0x904]
mov dword [ebp - 0x4a308], eax
lea eax, [ebp - 0x180]
push eax
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ebx, eax
xor esi, esi
shr ebx, 2
test ebx, ebx
je 0x40256e
lea edi, [ebp - 0x180]
push 0x103
lea eax, [ebp - 0x4a287]
mov byte [ebp - 0x4a288], 0
push 0
push eax
call fcn.00405160
add esp, 0xc
lea eax, [ebp - 0x4a2b4]
push 2
push edi
push 3
push eax
call fcn.004098a6
add esp, 0x10
lea eax, [ebp - 0x4a288]
push 0x104
push eax
lea eax, [ebp - 0x4a2b4]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
lea eax, [ebp - 0x4a288]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00404b20
lea ecx, [ebp - 0x118]
add esp, 8
cmp eax, ecx
je 0x402524
inc esi
add edi, 4
cmp esi, ebx
jb 0x4024b0
jmp 0x402568
mov esi, dword [ebp - 0x4a308]
lea eax, [ebp - 0x4a2b4]
push eax
push 0x104
push esi
call fcn.004071d0
lea ecx, [ebp - 0x4a288]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402548
sub ecx, edx
lea eax, [ebp - 0x118]
add eax, ecx
push eax
push 0x104
push esi
call fcn.004094af
add esp, 0xc
mov edi, dword [ebp - 0x4a2b0]
push dword [ebp - 0x4a30c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x4a2c4]
mov ebx, dword [ebp - 0x4a2bc]
push 1
lea ecx, [ebp - 0x4a2b8]
push ecx
push 0
lea eax, [esi + 0x904]
push 0
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExA]
push dword [ebp - 0x4a2b8]
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 0x4a2ac]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push dword [ebp - 0x4a2b8]
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [ebp - 0x4a2c0]
xorps xmm0, xmm0
mov dword [ebp - 0x4a2fc], 0
movlpd qword [ebp - 0x4a2f0], xmm0
movlpd qword [ebp - 0x4a2e8], xmm0
movlpd qword [ebp - 0x4a2e0], xmm0
movlpd qword [ebp - 0x4a2d8], xmm0
movlpd qword [ebp - 0x4a2d0], xmm0
mov dword [ebp - 0x4a304], 7
mov dword [ebp - 0x4a2f8], 0
mov dword [ebp - 0x4a2f4], 0
mov dword [ebp - 0x4a300], eax
test esi, esi
jle 0x40263a
push dword [ebp - 0x4a2ac]
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
dec eax
mov dword [ebp - 0x4a2e8], eax
jmp 0x402644
mov dword [ebp - 0x4a2e8], 0xffffffff
mov eax, dword [ebx]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x4a2e4], eax
lea eax, [ebp - 0x4a304]
push eax
push 0
mov dword [ebp - 0x4a2f0], edi
mov edi, dword [ebp - 0x4a2c8]
push 0x1007
push edi
mov dword [ebp - 0x4a2fc], 0
mov dword [ebp - 0x4a2ec], 0x104
call ebx
cmp eax, 0xffffffff
je 0x40281d
mov eax, dword [ebp - 0x4a2bc]
mov dword [ebp - 0x4a304], 1
mov dword [ebp - 0x4a2fc], 1
push dword [eax]
lea eax, [ebp - 0x10]
push str._08X
push 9
push eax
call fcn.00401010
add esp, 0x10
mov dword [ebp - 0x4a2ec], 9
lea eax, [ebp - 0x10]
mov dword [ebp - 0x4a2f0], eax
lea eax, [ebp - 0x4a304]
push eax
push 0
push 0x1006
push edi
call ebx
cmp eax, 0xffffffff
je 0x40281d
mov esi, dword [ebp - 0x4a2c4]
lea eax, [ebp - 0x4a304]
push eax
push 0
push 0x1006
push edi
mov dword [ebp - 0x4a2fc], 2
mov dword [ebp - 0x4a2f0], esi
mov dword [ebp - 0x4a2ec], 0x800
call ebx
cmp eax, 0xffffffff
je 0x40281d
lea eax, [esi + 0x904]
mov dword [ebp - 0x4a2fc], 3
mov dword [ebp - 0x4a2f0], eax
lea eax, [ebp - 0x4a304]
push eax
push 0
push 0x1006
push edi
mov dword [ebp - 0x4a2ec], 0x104
call ebx
cmp eax, 0xffffffff
je 0x40281d
inc dword [ebp - 0x4a2c0]
add esi, 0xa0c
mov eax, dword [ebp - 0x4a310]
mov dword [ebp - 0x4a2c4], esi
test eax, eax
jne 0x4023a0
jmp 0x402784
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x4a2ac]
push 1
push 0x1003
push edi
call ebx
cmp dword [0x6a2d7c], 0
je 0x4027fe
mov eax, dword [0x6a2370]
xorps xmm0, xmm0
movups xmmword [ebp - 0x4a330], xmm0
mov dword [ebp - 0x4a328], eax
lea eax, [ebp - 0x4a330]
push eax
push 0xffffffffffffffff
push 0x100d
push edi
movq qword [ebp - 0x4a320], xmm0
mov dword [ebp - 0x4a330], 1
call ebx
cmp eax, 0xffffffff
je 0x4027fe
lea ecx, [ebp - 0x4a304]
mov dword [ebp - 0x4a2f4], 3
push ecx
push eax
push 0x102b
push edi
mov dword [ebp - 0x4a2f8], 3
call ebx
push 0
push 1
push 0xb
push edi
call ebx
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403e69
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403e69
mov esp, ebp
pop ebp
ret