Function at 0x40b520
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x476ae8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x49f008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], 0
call fcn.004067b0
mov ecx, eax
test ecx, ecx
jne 0x40b569
push 0x80004005
call fcn.004064f0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
cmp byte [ebx + 0x14], 0
je 0x40b5c5
add esi, 0xfffffff0
mov ecx, esi
call fcn.004087c0
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [edi], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40b5af
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
push 0x58
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00412cb0
lea eax, [ebp - 0x48]
push eax
push 0x40b3e0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x44]
xor edx, edx
mov ecx, dword [ebp - 0x48]
or edi, 0xffffffff
sub eax, ecx
mov dword [ebp - 0x18], edx
sar eax, 2
test eax, eax
je 0x40b85c
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, dword [ecx + edx*4]
lea eax, [ebp - 0x10]
push eax
push ebx
mov dword [ebp - 0x10], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ecx + 0xc]
lea ecx, [ebp - 0x24]
cmovne eax, edx
mov edx, ebx
mov dword [ebp - 0x10], eax
call fcn.0040b460
mov esi, eax
mov edx, ebx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.0040b4c0
mov byte [ebp - 4], 3
push dword [esi]
push dword [eax]
push 0xffffffffffffffeb
push ebx
call edi
push eax
push 0xfffffffffffffff4
push ebx
call edi
push eax
push 0xfffffffffffffff8
push ebx
call edi
push eax
push 0xfffffffffffffffa
push ebx
call edi
push eax
push 0xfffffffffffffffc
push ebx
call edi
push eax
push 0xfffffffffffffff0
push ebx
call edi
push eax
push 0xffffffffffffffec
push ebx
call edi
push eax
push ebx
lea eax, [ebp - 0x14]
push str.TopLevelHwnd__p:_p__p__p__p__p__p__p______s__s_r_n
push eax
call fcn.00415050
mov byte [ebp - 4], 2
or esi, 0xffffffff
mov edx, dword [ebp - 0x20]
add esp, 0x30
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b6bd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b6db
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x10], 0
je 0x40b83c
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
push 0x58
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 4
call fcn.00412cb0
lea eax, [ebp - 0x3c]
push eax
push 0x40b3e0
push ebx
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
cmp ecx, edx
sete al
test al, al
je 0x40b740
lea eax, [ebp - 0x14]
push str.___ChildHwnd_EMPTY_r_n
push eax
call fcn.00415050
mov ecx, dword [ebp - 0x3c]
add esp, 8
jmp 0x40b810
sub edx, ecx
xor ebx, ebx
sar edx, 2
test edx, edx
je 0x40b810
nop
mov edi, dword [ecx + ebx*4]
mov edx, edi
lea ecx, [ebp - 0x2c]
call fcn.0040b460
mov esi, eax
mov edx, edi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
call fcn.0040b4c0
mov byte [ebp - 4], 6
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [eax]
push 0xffffffffffffffeb
push edi
call esi
push eax
push 0xfffffffffffffff4
push edi
call esi
push eax
push 0xfffffffffffffff8
push edi
call esi
push eax
push 0xfffffffffffffffa
push edi
call esi
push eax
push 0xfffffffffffffffc
push edi
call esi
push eax
push 0xfffffffffffffff0
push edi
call esi
push eax
push 0xffffffffffffffec
push edi
call esi
push eax
push edi
lea eax, [ebp - 0x14]
push str.___ChildHwnd__p:_p__p__p__p__p__p__p______s__s_r_n
push eax
call fcn.00415050
mov byte [ebp - 4], 5
or esi, 0xffffffff
mov edx, dword [ebp - 0x28]
add esp, 0x30
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b7d8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov ecx, esi
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40b7f6
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x38]
inc ebx
mov ecx, dword [ebp - 0x3c]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x40b750
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x40b83c
mov eax, dword [ebp - 0x34]
sub eax, ecx
sar eax, 2
push eax
push ecx
call fcn.004139f0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x48]
inc edx
sub eax, ecx
mov dword [ebp - 0x18], edx
sar eax, 2
cmp edx, eax
jb 0x40b618
mov esi, dword [ebp - 0x14]
or edi, 0xffffffff
add esi, 0xfffffff0
mov ecx, esi
call fcn.004087c0
mov ebx, dword [ebp + 8]
add eax, 0x10
mov ecx, dword [ebp - 0x48]
mov dword [ebx], eax
test ecx, ecx
je 0x40b899
mov eax, dword [ebp - 0x40]
sub eax, ecx
sar eax, 2
push eax
push ecx
call fcn.004139f0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x40b8b2
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4