Function at 0x10002990
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000f408
mov eax, dword fs:[0]
push eax
sub esp, 0x520
mov eax, dword [0x10017008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x2c
lea eax, [ebp - 0x524]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.10004860
add esp, 0xc
mov dword [ebp - 0x4e4], 0
lea eax, [ebp - 0x4e4]
push eax
push 0x10002720
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x4ec], eax
test eax, eax
jne 0x10002a1b
push 0x2c
lea eax, [ebp - 0x524]
push 0
push eax
call fcn.10004860
add esp, 0xc
jmp 0x10002eac
lea ecx, [ebp - 0x4e8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x4e8]
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10002a03
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 4
push 0x1000
push 8
push 0
push edi
call esi
mov dword [ebp - 0x528], eax
test eax, eax
je 0x10002a03
push 4
push 0x1000
push 0x10
push 0
push edi
call esi
mov dword [ebp - 0x4f0], eax
test eax, eax
je 0x10002a03
push 4
push 0x1000
push 0x48
push 0
push edi
call esi
mov dword [ebp - 0x4f8], eax
test eax, eax
je 0x10002a03
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.10004860
add esp, 0xc
push 0
push 0
push 0x1004
push dword [ebp - 0x4ec]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x52c], eax
test eax, eax
je 0x10002a03
push 4
push 0x1000
push 0x400
push 0
push edi
call esi
mov dword [ebp - 0x4f4], eax
test eax, eax
je 0x10002a03
xor esi, esi
cmp dword [ebp - 0x52c], esi
jbe 0x10002e5f
nop word [eax + eax]
push dword [ebp - 0x528]
push esi
push 0x1010
push dword [ebp - 0x4ec]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 8
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x528]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0x10
lea eax, [ebp - 0x428]
mov dword [ebp - 0x428], 0
push eax
push dword [ebp - 0x4f0]
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push dword [ebp - 0x4f0]
push esi
push 0x100e
push dword [ebp - 0x4ec]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x10
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 0x4f0]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0x10
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 1
push eax
push dword [ebp - 0x4f0]
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push dword [ebp - 0x4f0]
push esi
push 0x100e
push dword [ebp - 0x4ec]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x10
lea eax, [ebp - 0x438]
push eax
push dword [ebp - 0x4f0]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x10014da8
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002c95
lea ecx, [ebp - 0x4e0]
push ecx
call eax
mov ax, word [ebp - 0x4e0]
cmp ax, 9
je 0x10002c13
cmp ax, 6
jne 0x10002c95
mov eax, dword [ebp - 0x4f4]
xorps xmm0, xmm0
cdq
mov dword [ebp - 0x468], eax
lea eax, [ebp - 0x480]
mov dword [ebp - 0x47c], 0
movlpd qword [ebp - 0x474], xmm0
mov dword [ebp - 0x46c], 0
movlpd qword [ebp - 0x45c], xmm0
movlpd qword [ebp - 0x454], xmm0
movlpd qword [ebp - 0x44c], xmm0
movlpd qword [ebp - 0x444], xmm0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x480], 1
mov dword [ebp - 0x460], 0x200
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x464], edx
jmp 0x10002cfa
mov eax, dword [ebp - 0x4f4]
xorps xmm0, xmm0
mov dword [ebp - 0x4a8], eax
lea eax, [ebp - 0x4bc]
mov dword [ebp - 0x4b8], 0
movlpd qword [ebp - 0x4b0], xmm0
movlpd qword [ebp - 0x4a0], xmm0
movlpd qword [ebp - 0x498], xmm0
movlpd qword [ebp - 0x490], xmm0
movlpd qword [ebp - 0x488], xmm0
mov dword [ebp - 0x4a4], 0x200
mov dword [ebp - 0x4bc], 1
mov dword [ebp - 0x4b4], 0
push 0
push 0x3c
push eax
push dword [ebp - 0x4f8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push dword [ebp - 0x4f8]
push esi
push 0x1073
push dword [ebp - 0x4ec]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x400
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x4f4]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x410]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10002d6e
test dx, dx
je 0x10002d6a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10002d6e
add eax, 4
add ecx, 4
test dx, dx
jne 0x10002d48
xor eax, eax
jmp 0x10002d73
sbb eax, eax
or eax, 1
test eax, eax
je 0x10002dba
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.10004860
add esp, 0xc
lea eax, [ebp - 0x410]
push 0
push 0x400
push eax
push dword [ebp - 0x4f4]
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc esi
cmp esi, dword [ebp - 0x52c]
jb 0x10002b00
jmp 0x10002e5f
call fcn.10002800
movd xmm1, dword [ebp - 0x418]
cvtdq2pd xmm1, xmm1
mov esi, dword [ebp - 0x4ec]
divsd xmm1, xmm0
cvttsd2si eax, xmm1
movd xmm1, dword [ebp - 0x414]
cvtdq2pd xmm1, xmm1
mov dword [ebp - 0x418], eax
divsd xmm1, xmm0
cvttsd2si eax, xmm1
mov dword [ebp - 0x414], eax
lea eax, [ebp - 0x418]
push eax
push esi
call dword [sym.imp.USER32.dll_ClientToScreen]
lea edx, [ebp - 0x428]
mov ecx, esi
call fcn.10002860
lea edx, [ebp - 0x438]
mov ecx, esi
call fcn.10002860
movups xmm0, xmmword [ebp - 0x428]
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x520], eax
mov eax, dword [ebp - 0x414]
movups xmmword [ebp - 0x518], xmm0
mov dword [ebp - 0x524], 1
movups xmm0, xmmword [ebp - 0x438]
mov dword [ebp - 0x51c], eax
movups xmmword [ebp - 0x508], xmm0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [ebp - 0x4f0]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x528]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x4f8]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x4f4]
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10002ece
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 8]
movups xmm0, xmmword [ebp - 0x524]
mov ecx, dword [ebp - 0x4fc]
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x514]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x504]
movq qword [eax + 0x20], xmm0
mov dword [eax + 0x28], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000302f
mov esp, ebp
pop ebp
ret