Function at 0x1000195b
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, str.elementclient.exe
push esi
push 0x100908a4
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x10001cb6
push 0x10090250
push 1
push 0x10090300
push 0x100909a8
call fcn.10004b63
push 0x10090c80
call fcn.100051c3
add esp, 0x14
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.MSVCRT.dll__getpid]
push eax
push 0x10001782
call dword [sym.imp.USER32.dll_EnumWindows]
xor ebx, ebx
cmp dword [0x10090ab0], ebx
je 0x10001cb6
call fcn.100050de
test eax, eax
je 0x100019dd
push 1
pop eax
jmp 0x10001cb8
push edi
call fcn.10002367
mov edi, eax
call fcn.1000441b
push 0x100017fc
call fcn.1000385c
pop ecx
mov ecx, edi
call fcn.100022e7
push 1
push 8
lea eax, [ebp - 0xc]
push 8
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x8d
mov byte [ebp - 0xb], 0x4c
mov byte [ebp - 0xa], 0x24
mov byte [ebp - 9], 0x4c
mov byte [ebp - 8], 0x88
mov byte [ebp - 7], 0x54
mov byte [ebp - 6], 0x24
mov byte [ebp - 5], 0x49
call fcn.10002084
cmp eax, ebx
jbe 0x10001a3f
push 0x1000137a
push eax
mov ecx, edi
call fcn.10001d0b
push 1
push 0xfffffffffffffffb
lea eax, [ebp - 0x10]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x10], 0x8b
mov byte [ebp - 0xf], 0x4c
mov byte [ebp - 0xe], 0x24
mov byte [ebp - 0xd], 0x2c
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x10
mov byte [ebp - 0xa], 0x8b
mov byte [ebp - 9], 0x52
mov byte [ebp - 8], 0x44
call fcn.10002084
cmp eax, ebx
mov dword [ebp - 4], eax
jbe 0x10001ab1
push 0x100013f9
push eax
mov ecx, edi
call fcn.10001d0b
mov eax, dword [ebp - 4]
push 0x10001469
add eax, 0x45
mov ecx, edi
push eax
call fcn.10001e11
mov eax, dword [ebp - 4]
push 0x100014cd
add eax, 0x81
mov ecx, edi
push eax
call fcn.10001e11
or byte [ebp - 0xb], 0xff
push 1
push 0xffffffffffffffcd
lea eax, [ebp - 0xc]
push 6
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x6b
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x83
mov byte [ebp - 8], 0xc4
mov byte [ebp - 7], 4
call fcn.10002084
cmp eax, ebx
mov dword [ebp - 4], eax
jbe 0x10001b15
push 0x100016b8
push eax
mov ecx, edi
call fcn.10001d0b
mov eax, dword [ebp - 4]
push 0x100016dc
add eax, 0x1d
mov ecx, edi
push eax
call fcn.10001d0b
mov eax, dword [ebp - 4]
push 0x10001700
add eax, 0x2e
mov ecx, edi
push eax
call fcn.10001f03
push 1
push 0xffffffffffffffe5
lea eax, [ebp - 0xc]
push 7
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x24
mov byte [ebp - 9], 0x14
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0x4d
mov byte [ebp - 6], 4
call fcn.10002084
cmp eax, ebx
mov dword [ebp - 4], eax
jbe 0x10001b6a
push 0x10001597
push eax
mov ecx, edi
call fcn.10001e11
mov eax, dword [ebp - 4]
push 0x10001531
add eax, 0x16
mov ecx, edi
push eax
call fcn.10001d0b
push 1
push 0xa
lea eax, [ebp - 0x10]
push 0xa
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x10], 0x8b
mov byte [ebp - 0xf], 0x86
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0xd], 2
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], 0x52
mov byte [ebp - 9], 0x50
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0xce
call fcn.10002084
cmp eax, ebx
jbe 0x10001bb3
push 0x10001616
push eax
mov ecx, edi
call fcn.10001d0b
push 1
push 3
lea eax, [ebp - 0x10]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x10], 0x8b
mov byte [ebp - 0xf], 0x41
mov byte [ebp - 0xe], 4
mov byte [ebp - 0xd], 0x8b
mov byte [ebp - 0xc], 0x80
mov byte [ebp - 0xb], 0x54
mov byte [ebp - 0xa], 5
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
call fcn.10002084
cmp eax, ebx
jbe 0x10001bf8
push 0x100015cc
push eax
mov ecx, edi
call fcn.10001e11
push 1
push 0x12
lea eax, [ebp - 0x10]
push 0xc
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x10], 0x8b
mov byte [ebp - 0xf], 0x38
mov byte [ebp - 0xe], 0x8b
mov byte [ebp - 0xd], 0xce
mov byte [ebp - 0xc], 0xc7
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x24
mov byte [ebp - 9], 0x1c
mov byte [ebp - 8], 1
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
call fcn.10002084
cmp eax, ebx
mov dword [ebp - 4], eax
jbe 0x10001c5e
push 0x10001658
push eax
mov ecx, edi
call fcn.10001d0b
mov eax, dword [ebp - 4]
push 0x10001658
add eax, 0xffffffbd
mov ecx, edi
push eax
call fcn.10001d0b
or byte [ebp - 0xb], 0xff
push 1
push 0xc
lea eax, [ebp - 0x10]
push 0xc
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x10], 0x8b
mov byte [ebp - 0xf], 0xc8
mov byte [ebp - 0xe], 0x8b
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0xc], 0x40
mov byte [ebp - 0xa], 0xd0
mov byte [ebp - 9], 0x50
mov byte [ebp - 8], 0x6a
mov byte [ebp - 7], bl
mov byte [ebp - 6], 0x8b
mov byte [ebp - 5], 0xce
call fcn.10002084
cmp eax, ebx
jbe 0x10001cb0
push 0x10001683
push eax
mov ecx, edi
call fcn.10001d0b
push 1
pop eax
pop edi
jmp 0x10001cb8
xor eax, eax
pop esi
pop ebx
leave
ret