Function at 0x464972
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov ecx, esi
call fcn.0041ab47
lea ecx, [edi + 0xd4]
call fcn.0041ab47
mov al, byte [ebp + 0x20]
lea ebx, [edi + 0x14]
mov byte [edi + 4], al
mov al, byte [ebp + 0x1c]
mov byte [edi + 5], al
mov eax, dword [ebp + 8]
cmp ebx, eax
je 0x4649b3
push eax
mov ecx, ebx
call fcn.0040478a
mov eax, dword [ebp + 0xc]
lea ecx, [edi + 0x24]
cmp ecx, eax
je 0x4649c3
push eax
call fcn.0040478a
lea ecx, [edi + 0xa4]
push 0x49c9dc
call fcn.004043ee
mov eax, dword [ebp + 0x14]
lea ecx, [esp + 0x28]
mov dword [edi + 0xb4], 1
mov dword [edi + 0x10], eax
mov byte [edi + 0xc], 1
mov dword [edi + 8], 0
mov dword [edi + 0xb8], 0
mov dword [edi + 0xcc], 0
call fcn.00403f6a
lea ecx, [esp + 0x18]
call fcn.00403f6a
lea ecx, [esp + 0x38]
call fcn.00403f6a
mov eax, dword [edi + 0x10]
test eax, eax
jns 0x464a34
push eax
call fcn.00428bf4
add esp, 4
mov dword [edi + 0x10], eax
mov byte [edi + 0xc], 0
cmp eax, 4
jne 0x464a46
push ebx
call fcn.00464667
mov dword [edi + 0x10], 1
cmp dword [edi + 0x18], 0
jne 0x464a73
cmp dword [edi + 0x28], 0
jne 0x464a73
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
mov ecx, edi
call fcn.0046419f
mov eax, dword [edi]
mov ecx, esi
mov eax, dword [eax]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
jmp 0x464bff
push 0
mov ecx, ebx
call fcn.0040426f
cmp word [eax], 0x5b
jne 0x464f9b
mov eax, dword [edi + 0x18]
mov ecx, ebx
dec eax
push eax
call fcn.0040426f
cmp word [eax], 0x5d
jne 0x464f9b
mov eax, dword [edi + 0x18]
sub eax, 2
mov dword [esp + 0x14], 1
mov dword [esp + 0xc], eax
lea esp, [esp]
push eax
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x34]
call fcn.0046482a
add esp, 0xc
test al, al
je 0x464f9b
push str.LAST
call fcn.0042462e
mov esi, dword [esp + 0x30]
add esp, 4
cmp esi, eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
jne 0x464b3f
mov edx, esi
mov ecx, str.LAST
test edx, edx
je 0x464b13
mov ebx, eax
sub ebx, ecx
lea ecx, [ecx]
mov ax, word [ebx + ecx]
cmp ax, word [ecx]
jne 0x464b3c
add ecx, 2
sub edx, 1
jne 0x464b02
mov edx, 0x49c9dc
lea ecx, [esp + 0x18]
call fcn.00401291
test al, al
je 0x464f93
mov eax, dword [edi]
mov eax, dword [eax]
test eax, eax
jne 0x464bf4
xor esi, esi
jmp 0x46505a
lea ebx, [edi + 0x14]
push str.ACTIVE
call fcn.0042462e
add esp, 4
cmp esi, eax
jne 0x464b95
mov edx, esi
mov ecx, str.ACTIVE
test edx, edx
je 0x464b73
mov ebx, dword [esp + 0x10]
sub ebx, ecx
nop
mov ax, word [ebx + ecx]
cmp ax, word [ecx]
jne 0x464b92
add ecx, 2
sub edx, 1
jne 0x464b62
mov edx, 0x49c9dc
lea ecx, [esp + 0x18]
call fcn.00401291
test al, al
je 0x464f93
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
jmp 0x464be9
lea ebx, [edi + 0x14]
push 0x4c5b50
call fcn.0042462e
add esp, 4
cmp esi, eax
jne 0x464c12
mov edx, esi
mov ecx, 0x4c5b50
test edx, edx
je 0x464bc8
mov ebx, dword [esp + 0x10]
sub ebx, ecx
mov ax, word [ebx + ecx]
cmp ax, word [ecx]
jne 0x464c0f
add ecx, 2
sub edx, 1
jne 0x464bb7
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x14]
call fcn.0046f372
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x464b35
push esi
mov ecx, edi
call fcn.0046419f
mov eax, dword [edi]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
call fcn.0048b4f2
mov esi, 1
jmp 0x46505a
lea ebx, [edi + 0x14]
push str.REGEXPTITLE
call fcn.0042462e
add esp, 4
cmp esi, eax
jne 0x464c6d
mov edx, esi
mov ecx, str.REGEXPTITLE
test edx, edx
je 0x464c48
mov ebx, dword [esp + 0x10]
sub ebx, ecx
mov ax, word [ebx + ecx]
cmp ax, word [ecx]
jne 0x464c6a
add ecx, 2
sub edx, 1
jne 0x464c34
lea ebx, [edi + 0x14]
mov eax, dword [edi + 8]
test al, 1
jne 0x464f75
or eax, 2
lea ecx, [edi + 0x34]
mov dword [edi + 8], eax
call fcn.004117da
push ecx
lea ecx, [edi + 0x34]
jmp 0x464d1c
lea ebx, [edi + 0x14]
push str.CLASS
call fcn.0042462e
add esp, 4
cmp esi, eax
jne 0x464cd6
mov edx, esi
mov ecx, str.CLASS
test edx, edx
je 0x464ca6
mov ebx, dword [esp + 0x10]
sub ebx, ecx
lea ecx, [ecx]
mov ax, word [ebx + ecx]
cmp ax, word [ecx]
jne 0x464cd3
add ecx, 2
sub edx, 1
jne 0x464c92
lea ebx, [edi + 0x14]
or dword [edi + 8], 8
lea eax, [esp + 0x18]
lea ecx, [edi + 0xa4]
cmp ecx, eax
mov eax, dword [esp + 0xc]
je 0x464ab2
lea eax, [esp + 0x18]
push eax
call fcn.0040478a
mov eax, dword [esp + 0xc]
jmp 0x464ab2
lea ebx, [edi + 0x14]
push str.REGEXPCLASS
call fcn.0042462e
add esp, 4
cmp esi, eax
jne 0x464d3a
mov edx, esi
mov ecx, str.REGEXPCLASS
test edx, edx
je 0x464d0c
mov ebx, dword [esp + 0x10]
sub ebx, ecx
mov ax, word [ebx + ecx]
cmp ax, word [ecx]
jne 0x464d37
add ecx, 2
sub edx, 1
jne 0x464cf8
lea ebx, [edi + 0x14]
or dword [edi + 8], 0x10
lea ecx, [edi + 0x6c]
call fcn.004117da
push ecx
lea ecx, [edi + 0x6c]
lea eax, [esp + 0x1c]
push eax
call fcn.00411d87
test eax, eax
jne 0x464f7f
mov eax, dword [esp + 0xc]
jmp 0x464ab2
lea ebx, [edi + 0x14]
push str.XYWH
call fcn.0042462e
add esp, 4
cmp esi, eax
jne 0x464d9b
mov edx, esi
mov ecx, str.XYWH
test edx, edx
je 0x464d76
mov ebx, dword [esp + 0x10]
sub ebx, ecx
lea ebx, [ebx]
mov ax, word [ebx + ecx]
cmp ax, word [ecx]
jne 0x464d98
add ecx, 2
sub edx, 1
jne 0x464d62
lea ebx, [edi + 0x14]
push dword [esp + 0x18]
or dword [edi + 8], 0x80
call fcn.00425f0c
mov dword [edi + 0xbc], eax
add esp, 4
mov eax, dword [esp + 0xc]
jmp 0x464ab2
lea ebx, [edi + 0x14]
push 0x4c5a40
call fcn.0042462e
add esp, 4
cmp esi, eax
jne 0x464dfb
mov edx, esi
mov ecx, 0x4c5a40
test edx, edx
je 0x464dd6
mov ebx, dword [esp + 0x10]
sub ebx, ecx
jmp 0x464dc2
mov ax, word [ebx + ecx]
cmp ax, word [ecx]
jne 0x464df8
add ecx, 2
sub edx, 1
jne 0x464dc2
lea ebx, [edi + 0x14]
push dword [esp + 0x18]
or dword [edi + 8], 0x100
call fcn.00425f0c
mov dword [edi + 0xc0], eax
add esp, 4
mov eax, dword [esp + 0xc]
jmp 0x464ab2
lea ebx, [edi + 0x14]
push 0x4c5a44
call fcn.0042462e
add esp, 4
cmp esi, eax
jne 0x464e5b
mov edx, esi
mov ecx, 0x4c5a44
test edx, edx
je 0x464e36
mov ebx, dword [esp + 0x10]
sub ebx, ecx
jmp 0x464e22
mov ax, word [ebx + ecx]
cmp ax, word [ecx]
jne 0x464e58
add ecx, 2
sub edx, 1
jne 0x464e22
lea ebx, [edi + 0x14]
push dword [esp + 0x18]
or dword [edi + 8], 0x200
call fcn.00425f0c
mov dword [edi + 0xc4], eax
add esp, 4
mov eax, dword [esp + 0xc]
jmp 0x464ab2
lea ebx, [edi + 0x14]
mov edx, 0x4c5a48
lea ecx, [esp + 0x28]
call fcn.00401291
test al, al
je 0x464e8f
push dword [esp + 0x18]
or dword [edi + 8], 0x400
call fcn.00425f0c
mov dword [edi + 0xc8], eax
add esp, 4
mov eax, dword [esp + 0xc]
jmp 0x464ab2
mov edx, str.INSTANCE
lea ecx, [esp + 0x28]
call fcn.00401291
test al, al
je 0x464ec0
push dword [esp + 0x18]
or dword [edi + 8], 0x20
call fcn.00425f0c
mov dword [edi + 0xb4], eax
add esp, 4
mov eax, dword [esp + 0xc]
jmp 0x464ab2
mov edx, 0x4c5b38
lea ecx, [esp + 0x28]
call fcn.00401291
test al, al
je 0x464ef5
mov edx, 0x49c9dc
lea ecx, [esp + 0x18]
call fcn.00401291
test al, al
je 0x464f93
or dword [edi + 8], 0x40
mov eax, dword [esp + 0xc]
jmp 0x464ab2
mov edx, str.TITLE
lea ecx, [esp + 0x28]
call fcn.00401291
test al, al
je 0x464f2b
mov eax, dword [edi + 8]
test al, 2
jne 0x464f89
or eax, 1
lea ecx, [esp + 0x38]
mov dword [edi + 8], eax
lea eax, [esp + 0x18]
push eax
call fcn.0040478a
mov eax, dword [esp + 0xc]
jmp 0x464ab2
push 0x49c9dc
call fcn.0042462e
add esp, 4
cmp esi, eax
jne 0x464f93
mov eax, dword [esp + 0xc]
mov ecx, 0x49c9dc
test esi, esi
je 0x464ab2
mov eax, dword [esp + 0x10]
sub eax, ecx
mov dword [esp + 0x10], eax
mov ax, word [eax + ecx]
cmp ax, word [ecx]
jne 0x464f93
mov eax, dword [esp + 0x10]
add ecx, 2
sub esi, 1
jne 0x464f57
mov eax, dword [esp + 0xc]
jmp 0x464ab2
mov esi, 0xfffffffd
jmp 0x46505a
mov esi, 0xfffffffe
jmp 0x46505a
mov esi, 0xfffffffc
jmp 0x46505a
or esi, 0xffffffff
jmp 0x46505a
cmp dword [esp + 0x3c], 0
je 0x464fb2
lea eax, [esp + 0x38]
cmp ebx, eax
je 0x464fb2
push eax
mov ecx, ebx
call fcn.0040478a
mov eax, dword [edi + 8]
test eax, eax
jne 0x464fc5
mov dword [edi + 8], 1
mov eax, 1
mov esi, dword [sym.imp.USER32.dll_CharUpperBuffW]
or eax, 4
cmp byte [edi + 0xc], 0
mov dword [edi + 8], eax
jne 0x464fea
lea ecx, [edi + 0x24]
call fcn.00404663
push dword [edi + 0x28]
push dword [edi + 0x24]
call esi
mov eax, dword [edi + 8]
test al, 1
je 0x465002
cmp byte [edi + 0xc], 0
jne 0x465002
mov ecx, ebx
call fcn.00404663
push dword [ebx + 4]
push dword [ebx]
call esi
cmp byte [ebp + 0x18], 0
push edi
push 0x465080
je 0x46501d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x465023
call dword [sym.imp.USER32.dll_EnumWindows]
mov ebx, dword [ebp + 0x10]
lea esi, [edi + 0xd4]
push esi
mov ecx, ebx
call fcn.004645a8
mov ecx, esi
call fcn.0041ab47
mov esi, dword [edi + 0xcc]
cmp esi, 1
jl 0x46505a
mov eax, dword [ebx + 4]
mov ecx, edi
mov eax, dword [eax]
push dword [eax]
call fcn.0046419f
mov esi, dword [edi + 0xcc]
lea ecx, [esp + 0x38]
call fcn.004020f8
lea ecx, [esp + 0x18]
call fcn.004020f8
lea ecx, [esp + 0x28]
call fcn.004020f8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c