Function at 0x11031820
Capabilities:
Enumerate gui resources
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111803b7
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KeRneL32.DLl_GetWindowsDirectoryA]
test eax, eax
je 0x11031b2c
mov ecx, dword [0x111ee100]
xor esi, esi
push esi
push esi
push 0x1119c028
push 0x111a0f40
call fcn.1105e820
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x114]
or edi, 0xffffffff
add eax, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x11031892
mov ecx, dword [0x1119bd84]
mov edx, dword [0x1119bd88]
mov dword [eax], ecx
mov ecx, dword [0x1119bd8c]
mov dword [eax + 4], edx
mov dx, word [0x1119bd90]
mov dword [eax + 8], ecx
push 0x18
mov word [eax + 0xc], dx
mov byte [ebp - 0x120], 1
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x124], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x110318e6
mov ecx, eax
call fcn.11050ae0
jmp 0x110318e8
xor eax, eax
push 0x18
mov dword [ebp - 4], edi
mov dword [ebp - 0x11c], eax
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x124], eax
mov dword [ebp - 4], 1
cmp eax, esi
je 0x11031915
mov ecx, eax
call fcn.11050ae0
jmp 0x11031917
xor eax, eax
mov ebx, dword [sym.imp.uSEr32.dll_EnumWindows]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x120]
push eax
push 0x11030850
mov dword [ebp - 4], edi
call ebx
lea ecx, [ebp - 0x114]
push ecx
push esi
call fcn.111457a0
add esp, 4
push eax
push 0x1119c014
call fcn.11147ad0
add esp, 0xc
mov dword [ebp - 0x124], eax
mov ecx, dword [0x111ee308]
mov edx, dword [ecx]
push esi
push eax
mov eax, dword [edx + 0xa8]
mov dword [ebp - 4], 2
call eax
mov edi, dword [sym.imp.KeRneL32.DLl_Sleep]
mov byte [ebp - 0x120], 0
mov edi, edi
lea ecx, [ebp - 0x120]
push ecx
push 0x11030850
call ebx
mov edx, dword [ebp - 0x118]
cmp dword [edx + 0x10], 0
jne 0x110319a7
push 0x14
call edi
inc esi
cmp esi, 0xfa
jl 0x11031980
mov eax, dword [ebp - 0x118]
cmp dword [eax + 0x10], 0
jne 0x110319c0
push 0x1119bffc
call fcn.11147060
add esp, 4
mov eax, dword [ebp - 0x128]
xor ebx, ebx
mov dword [ebp - 0x134], ebx
test eax, eax
je 0x110319d7
push eax
call edi
jmp 0x110319f3
xor esi, esi
lea esp, [esp]
call fcn.11028450
test eax, eax
je 0x110319f3
push 0xa
call edi
inc esi
cmp esi, 0x64
jl 0x110319e0
mov edi, dword [ebp - 0x118]
lea ecx, [ebp - 0x140]
push ecx
mov ecx, edi
call fcn.1114f6e0
mov ecx, dword [eax]
test ecx, ecx
je 0x11031a1d
mov ecx, dword [ecx]
test ecx, ecx
je 0x11031a1d
mov edx, dword [ecx]
mov dword [ebp - 0x134], edx
mov ebx, edx
mov esi, dword [eax + 8]
lea eax, [ebp - 0x140]
push eax
mov ecx, edi
call fcn.110351a0
cmp esi, dword [eax + 8]
je 0x11031acb
jmp 0x11031a46
mov ebx, dword [ebp - 0x134]
test ebx, ebx
jne 0x11031a4e
xor edx, edx
jmp 0x11031a50
mov edx, dword [ebx]
mov ecx, dword [edx + 8]
mov ebx, esi
shr ebx, 2
mov edi, esi
mov eax, ebx
and edi, 3
cmp ecx, eax
ja 0x11031a65
sub eax, ecx
mov ecx, dword [edx + 4]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + edi*4]
push eax
push 0x1119bfe0
call fcn.11147060
mov eax, dword [ebp - 0x134]
add esp, 8
test eax, eax
jne 0x11031a8a
xor ecx, ecx
jmp 0x11031a8c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
mov eax, ebx
cmp edx, eax
ja 0x11031a97
sub eax, edx
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + edi*4]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.uSEr32.dll_SendMessageA]
mov edi, dword [ebp - 0x118]
lea ecx, [ebp - 0x140]
push ecx
mov ecx, edi
inc esi
call fcn.110351a0
cmp esi, dword [eax + 8]
jne 0x11031a40
mov ecx, dword [ebp - 0x11c]
mov esi, ecx
test ecx, ecx
je 0x11031af9
call fcn.1102ead0
mov edx, dword [esi]
push edx
call fcn.11162777
push esi
mov dword [esi], 0
call fcn.11162777
mov edi, dword [ebp - 0x118]
add esp, 8
mov esi, edi
test edi, edi
je 0x11031b1d
mov ecx, edi
call fcn.1102ead0
mov eax, dword [esi]
push eax
call fcn.11162777
push esi
mov dword [esi], 0
call fcn.11162777
add esp, 8
mov ecx, dword [ebp - 0x124]
push ecx
call fcn.11162777
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret