Function at 0x42ec60
Capabilities:
Enumerate gui resources
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x74b5cc], 0
push esi
push edi
mov edi, ecx
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], 0
je 0x42eca4
mov dword [edi + 8], 0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 3
mov dword [0x74d620], edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetAncestor]
mov dword [0x74d650], eax
test eax, eax
je 0x42ecd7
push 0xc
push 0x74d76c
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
mov eax, dword [0x74d650]
jmp 0x42ece0
xor ecx, ecx
mov word [0x74d76c], cx
mov esi, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push eax
call esi
push 0xffffffffffffffec
push dword [0x74d650]
mov dword [ebp - 0x10], eax
call esi
push 0xb
push str.Multitaskin
push 0x74d76c
mov dword [ebp - 0xc], eax
call fcn.005cf8f5
add esp, 0xc
test eax, eax
je 0x42ed32
push 0xb
push str.XamlExplore
push 0x74d76c
call fcn.005cf8f5
add esp, 0xc
test eax, eax
je 0x42ed32
xor al, al
mov byte [ebp - 1], al
jmp 0x42ed36
mov byte [ebp - 1], 1
push 0xb
push str.Windows.UI.
push 0x74d76c
call fcn.005cf8f5
add esp, 0xc
mov esi, eax
test dword [ebp - 0x10], 0x800f0000
je 0x42ed5b
test byte [ebp - 0xc], 0x80
je 0x42ed9a
cmp byte [edi], 0
mov al, byte [ebp - 1]
jne 0x42ed6b
test al, al
jne 0x42ed9d
test esi, esi
je 0x42ed9d
mov byte [ebp - 1], 0
cmp byte [edi], 0
je 0x42eda3
test al, al
jne 0x42ed7c
test esi, esi
jne 0x42eda3
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov al, byte [ebp - 1]
mov byte [ebp - 1], 1
jmp 0x42ed6f
push dword [0x74d650]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x42ee23
push dword [0x74d650]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x42ee23
push 5
push 0x721674
push 0x74d76c
call fcn.005cf8f5
add esp, 0xc
test eax, eax
je 0x42ee23
push 7
push str.WorkerW
push 0x74d76c
call fcn.005cf8f5
add esp, 0xc
test eax, eax
je 0x42ee23
push 7
push str.Progman
push 0x74d76c
call fcn.005cf8f5
add esp, 0xc
test eax, eax
je 0x42ee23
cmp byte [edi], 0
je 0x42ee14
test esi, esi
je 0x42ee23
mov ecx, dword [0x74d650]
call fcn.0042dea0
test al, al
je 0x42ee25
mov al, 1
cmp byte [ebp - 1], 0
je 0x42ef91
test al, al
jne 0x42ef95
push 2
push dword [0x74d650]
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov dword [ebp - 0x10], eax
mov ecx, 0x74d630
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0042fa40
mov esi, dword [ebp - 0xc]
cmp esi, dword [0x74d634]
je 0x42efa6
cmp byte [edi + 1], 0
jne 0x42ee81
mov ecx, dword [esi + 0xc]
mov eax, 1
shl eax, cl
mov dword [edi + 8], eax
jmp 0x42efa6
lea eax, [ebp - 0x14]
push eax
push dword [0x74d650]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [edi + 4]
mov edx, dword [ebp - 0x14]
mov ecx, dword [esi + 0xc]
mov dword [ebp - 8], eax
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ecx
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [ebp - 0xc], edx
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x10]
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004301e0
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
test ecx, ecx
jne 0x42ef06
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
cmp ecx, dword [eax + 0x4c]
je 0x42ef7d
add ecx, 0xc
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [eax + 0x68]
call fcn.004dc820
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x6c]
cmp dword [eax], ecx
je 0x42ef46
mov eax, dword [ebp - 0xc]
sub esp, 0x18
add eax, 0xc
mov ecx, esp
push eax
call fcn.004137f0
mov ecx, dword [ebp - 8]
push 1
push dword [ebp - 0x18]
call fcn.004ded20
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
add eax, 0xc
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ecx + 0x1c]
call fcn.004dc820
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ecx + 0x20]
je 0x42ef7d
mov ecx, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
cmp ecx, eax
je 0x42ef7d
cmp dword [ecx], 1
je 0x42ef9f
add ecx, 8
cmp ecx, eax
jne 0x42ef71
mov ecx, dword [esi + 0xc]
mov edx, 8
mov eax, 1
shl eax, cl
mov dword [edx + edi], eax
jmp 0x42efa6
test al, al
je 0x42ef9f
mov dword [0x74d650], 0
mov dword [edi + 8], 0
push 0x74d620
push fcn.0042ded0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x74d650]
test eax, eax
je 0x42efca
push 0x74d620
push eax
call fcn.0042ded0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret