Function at 0x1000151d
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, str.asktao.mod
push esi
push 0x1008f804
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x1000180e
push 0x1008f1b0
push 1
push 0x1008f260
push 0x1008f908
call fcn.10004543
push 0x1008fbe0
call fcn.10004ba3
add esp, 0x14
call fcn.10004abe
test eax, eax
jne 0x1000180e
push ebx
push edi
call dword [sym.imp.MSVCRT.dll__getpid]
push eax
push 0x1000135f
call dword [sym.imp.USER32.dll_EnumWindows]
call fcn.10001d43
mov edi, eax
call fcn.10003dfb
push 0x100013c1
call fcn.10003238
pop ecx
lea eax, [ebp - 0x1c]
push 1
push 0x12
push 0xb
xor ebx, ebx
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x1c], 0x50
mov byte [ebp - 0x1b], 0x8d
mov byte [ebp - 0x1a], 0x94
mov byte [ebp - 0x19], 0x24
mov byte [ebp - 0x18], 0x1c
mov byte [ebp - 0x17], 2
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0x52
mov byte [ebp - 0x13], 0x8b
mov byte [ebp - 0x12], 0xcf
call fcn.10001ae5
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x10001601
push 0x100010fc
push eax
mov ecx, edi
call fcn.10001862
mov eax, dword [ebp - 8]
push 0x100010fc
add eax, 0x245
mov ecx, edi
push eax
call fcn.10001862
push 2
push 0xfffffffffffffff2
lea eax, [ebp - 0xc]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 0xb], 0x7f
mov byte [ebp - 0xa], 0x8d
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x24
mov byte [ebp - 7], 0x11
mov byte [ebp - 6], 0x6a
mov byte [ebp - 5], bl
mov byte [ebp - 4], 0x50
call fcn.10001ae5
cmp eax, ebx
je 0x10001647
push 0x100012a1
push eax
mov ecx, edi
call fcn.10001862
push 1
push 6
lea eax, [ebp - 8]
push 6
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x8d
mov byte [ebp - 7], 0x54
mov byte [ebp - 6], 0x24
mov byte [ebp - 5], 0x58
mov byte [ebp - 4], 0x52
mov byte [ebp - 3], 0x57
call fcn.10001ae5
cmp eax, ebx
je 0x10001682
push 0x1000108b
push eax
mov ecx, edi
call fcn.10001862
push 1
push 0xffffffffffffffe2
lea eax, [ebp - 0x1c]
push 0xb
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x1c], 0x83
mov byte [ebp - 0x1b], 0xc4
mov byte [ebp - 0x1a], 0x14
mov byte [ebp - 0x19], 0x8d
mov byte [ebp - 0x18], 0x8c
mov byte [ebp - 0x17], 0x24
mov byte [ebp - 0x16], 0x48
mov byte [ebp - 0x15], 3
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x12], 0x51
call fcn.10001ae5
cmp eax, ebx
je 0x100016cf
push 0x10001119
push eax
mov ecx, edi
call fcn.10001968
push 2
push 0x2a
lea eax, [ebp - 0x1c]
push 0xe
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x1c], 0x8b
mov byte [ebp - 0x1b], 0x86
mov byte [ebp - 0x1a], 0xb8
mov byte [ebp - 0x19], 2
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x8b
mov byte [ebp - 0x15], 0xc
mov byte [ebp - 0x14], 0xb8
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0x12], bl
mov byte [ebp - 0x11], 0x8d
mov byte [ebp - 0x10], 4
mov byte [ebp - 0xf], 0xb8
call fcn.10001ae5
cmp eax, ebx
je 0x10001727
push 0x10001185
push eax
mov ecx, edi
call fcn.10001862
push 3
push 0xfffffffffffffff5
lea eax, [ebp - 0xc]
push 8
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x24
mov byte [ebp - 9], 0x4c
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0x4c
mov byte [ebp - 6], 0x24
mov byte [ebp - 5], 0x38
call fcn.10001ae5
cmp eax, ebx
je 0x1000176a
push 0x100011a2
push eax
mov ecx, edi
call fcn.10001968
push 1
push 0xffffffffffffffe3
lea eax, [ebp - 0xc]
push 0xa
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x83
mov byte [ebp - 0xb], 0xc4
mov byte [ebp - 0xa], 0xc
mov byte [ebp - 9], 0x83
mov byte [ebp - 8], 0xbe
mov byte [ebp - 7], 0x2c
mov byte [ebp - 6], 2
mov byte [ebp - 5], bl
mov byte [ebp - 4], bl
mov byte [ebp - 3], bl
call fcn.10001ae5
cmp eax, ebx
je 0x100017b2
push 0x10001276
push eax
mov ecx, edi
call fcn.10001862
mov esi, str.gbits.dll
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x100017cc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100017b7
push 1
push 6
lea eax, [ebp - 8]
push 6
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 0x24
mov byte [ebp - 5], 0x28
mov byte [ebp - 4], 0x8a
mov byte [ebp - 3], 6
call fcn.10001ae5
cmp eax, ebx
je 0x10001807
push 0x100012d3
push eax
mov ecx, edi
call fcn.10001968
push 1
pop eax
pop edi
pop ebx
jmp 0x10001810
xor eax, eax
pop esi
leave
ret