Function at 0x1106f0e0
Capabilities:
Enumerate gui resources
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111dd837
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1106f3dc
mov ecx, dword [0x1127aa68]
push 0
push 0
push str.ExitMetroDelay
push str.Client
call fcn.110bbc00
lea edi, [ebp - 0x218]
mov dword [ebp - 0x22c], eax
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1106f150
mov ecx, 7
mov esi, str.Explorer.exe
push 0x18
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x224], 1
call fcn.111709c0
add esp, 4
mov dword [ebp - 0x228], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x1106f193
mov ecx, eax
call fcn.110f30e0
jmp 0x1106f195
xor eax, eax
or esi, 0xffffffff
push 0x18
mov dword [ebp - 4], esi
mov dword [ebp - 0x220], eax
call fcn.111709c0
add esp, 4
mov dword [ebp - 0x228], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x1106f1c5
mov ecx, eax
call fcn.110f30e0
jmp 0x1106f1c7
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [ebp - 0x224]
push ecx
push 0x1106ddb0
mov dword [ebp - 4], esi
mov dword [ebp - 0x21c], eax
call ebx
lea edx, [ebp - 0x218]
push edx
push 0
call fcn.111bb510
add esp, 4
push eax
push str.__sNSMExec.exe___s
call fcn.111be4a0
add esp, 0xc
mov dword [ebp - 0x228], eax
mov ecx, dword [0x1127b21c]
mov edx, dword [ecx]
push 0
push eax
mov eax, dword [edx + 0xa8]
mov dword [ebp - 4], 2
call eax
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x224], 0
xor esi, esi
lea ecx, [ebp - 0x224]
push ecx
push 0x1106ddb0
call ebx
mov edx, dword [ebp - 0x21c]
cmp dword [edx + 0x10], 0
jne 0x1106f259
push 0x14
call edi
inc esi
cmp esi, 0xfa
jl 0x1106f232
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x10], 0
jne 0x1106f272
push str.No_new_explorer_wnd_n
call fcn.111bd7b0
add esp, 4
mov eax, dword [ebp - 0x22c]
xor ebx, ebx
mov dword [ebp - 0x238], ebx
test eax, eax
je 0x1106f289
push eax
call edi
jmp 0x1106f2a3
xor esi, esi
jmp 0x1106f290
call fcn.11065780
test eax, eax
je 0x1106f2a3
push 0xa
call edi
inc esi
cmp esi, 0x64
jl 0x1106f290
mov edi, dword [ebp - 0x21c]
lea ecx, [ebp - 0x244]
push ecx
mov ecx, edi
call fcn.110cd3b0
mov ecx, dword [eax]
test ecx, ecx
je 0x1106f2cd
mov ecx, dword [ecx]
test ecx, ecx
je 0x1106f2cd
mov edx, dword [ecx]
mov dword [ebp - 0x238], edx
mov ebx, edx
mov esi, dword [eax + 8]
lea eax, [ebp - 0x244]
push eax
mov ecx, edi
call fcn.111be310
cmp esi, dword [eax + 8]
je 0x1106f37b
jmp 0x1106f2f6
mov ebx, dword [ebp - 0x238]
test ebx, ebx
jne 0x1106f2fe
xor edx, edx
jmp 0x1106f300
mov edx, dword [ebx]
mov ecx, dword [edx + 8]
mov ebx, esi
shr ebx, 2
mov edi, esi
mov eax, ebx
and edi, 3
cmp ecx, eax
ja 0x1106f315
sub eax, ecx
mov ecx, dword [edx + 4]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + edi*4]
push eax
push str.close_new_explorer_wnd_x_x_n
call fcn.111bd7b0
mov eax, dword [ebp - 0x238]
add esp, 8
test eax, eax
jne 0x1106f33a
xor ecx, ecx
jmp 0x1106f33c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
mov eax, ebx
cmp edx, eax
ja 0x1106f347
sub eax, edx
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + edi*4]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [ebp - 0x21c]
lea ecx, [ebp - 0x244]
push ecx
mov ecx, edi
inc esi
call fcn.111be310
cmp esi, dword [eax + 8]
jne 0x1106f2f0
mov ecx, dword [ebp - 0x220]
mov esi, ecx
test ecx, ecx
je 0x1106f3a9
call fcn.11036920
mov edx, dword [esi]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
push esi
mov dword [esi], 0
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
mov edi, dword [ebp - 0x21c]
add esp, 8
mov esi, edi
test edi, edi
je 0x1106f3cd
mov ecx, edi
call fcn.11036920
mov eax, dword [esi]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
push esi
mov dword [esi], 0
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 8
mov ecx, dword [ebp - 0x228]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret