Function at 0x464aa8
Capabilities:
Access peb ldr_data
Get graphical window text
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov esi, eax
xor eax, eax
push ebp
push 0x465038
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0xff
mov eax, ebx
call fcn.0040934c
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.0040934c
mov edi, eax
lea eax, [ebp - 8]
push eax
push esi
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 0xc], eax
push ebx
push edi
push esi
call sub.user32.dll_GetClassNameA
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov edx, dword [0x464994]
mov eax, 0x84
call fcn.004055dc
mov ebx, eax
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.00409338
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00404784
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00409338
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 4]
call fcn.00404784
mov dword [ebx + 8], esi
mov eax, dword [ebp - 8]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x10], eax
push 0xfffffffffffffff8
push esi
call sub.user32.dll_GetWindowLongA
mov dword [ebx + 0x14], eax
push 0xfffffffffffffffc
push esi
call sub.user32.dll_GetWindowLongA
mov dword [ebx + 0x18], eax
push 0xfffffffffffffffa
push esi
call sub.user32.dll_GetWindowLongA
mov dword [ebx + 0x1c], eax
push 0xfffffffffffffff4
push esi
call sub.user32.dll_GetWindowLongA
mov dword [ebx + 0x20], eax
push 0xffffffffffffffeb
push esi
call sub.user32.dll_GetWindowLongA
mov dword [ebx + 0x24], eax
push 0xfffffffffffffff0
push esi
call sub.user32.dll_GetWindowLongA
mov dword [ebx + 0x28], eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x30]
push eax
push esi
call sub.user32.dll_GetWindowRect
lea eax, [ebx + 0x40]
push eax
push esi
call sub.user32.dll_GetClientRect
push 0xffffffffffffffe0
push esi
call sub.user32.dll_GetClassLongA
mov dword [ebx + 0x50], eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetClassLongA
mov dword [ebx + 0x54], eax
push 0xffffffffffffffee
push esi
call sub.user32.dll_GetClassLongA
mov dword [ebx + 0x58], eax
push 0xffffffffffffffe8
push esi
call sub.user32.dll_GetClassLongA
mov dword [ebx + 0x5c], eax
push 0xfffffffffffffff0
push esi
call sub.user32.dll_GetClassLongA
mov dword [ebx + 0x60], eax
push 0xfffffffffffffff6
push esi
call sub.user32.dll_GetClassLongA
mov dword [ebx + 0x64], eax
push 0xfffffffffffffff4
push esi
call sub.user32.dll_GetClassLongA
mov dword [ebx + 0x68], eax
push 0xfffffffffffffff2
push esi
call sub.user32.dll_GetClassLongA
mov dword [ebx + 0x6c], eax
push 0xffffffffffffffe6
push esi
call sub.user32.dll_GetClassLongA
mov dword [ebx + 0x70], eax
mov dl, 1
mov eax, dword [0x415c40]
call fcn.004038b8
mov dword [ebx + 0x74], eax
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebx + 0x80], al
test byte [ebx + 0x2e], 0x80
je 0x464c44
mov eax, dword [ebx + 0x74]
mov edx, 0x465050
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2b], 0x40
je 0x464c57
mov eax, dword [ebx + 0x74]
mov edx, 0x465064
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2b], 2
je 0x464c6a
mov eax, dword [ebx + 0x74]
mov edx, 0x465078
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2b], 4
je 0x464c7d
mov eax, dword [ebx + 0x74]
mov edx, 0x465090
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2b], 8
je 0x464c90
mov eax, dword [ebx + 0x74]
mov edx, 0x4650a8
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2a], 0x40
je 0x464ca3
mov eax, dword [ebx + 0x74]
mov edx, 0x4650bc
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2a], 2
je 0x464cb6
mov eax, dword [ebx + 0x74]
mov edx, 0x4650d0
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2a], 0x10
je 0x464cc9
mov eax, dword [ebx + 0x74]
mov edx, 0x4650e4
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2b], 1
je 0x464cdc
mov eax, dword [ebx + 0x74]
mov edx, 0x4650f8
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2a], 1
je 0x464cef
mov eax, dword [ebx + 0x74]
mov edx, 0x46510c
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2b], 0x20
je 0x464d02
mov eax, dword [ebx + 0x74]
mov edx, 0x465124
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2a], 2
je 0x464d15
mov eax, dword [ebx + 0x74]
mov edx, 0x465138
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x28], 0
je 0x464d28
mov eax, dword [ebx + 0x74]
mov edx, 0x465150
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2b], 0x80
je 0x464d3b
mov eax, dword [ebx + 0x74]
mov edx, 0x465168
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2a], 8
je 0x464d4e
mov eax, dword [ebx + 0x74]
mov edx, 0x46517c
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2a], 1
je 0x464d61
mov eax, dword [ebx + 0x74]
mov edx, 0x465190
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2a], 4
je 0x464d74
mov eax, dword [ebx + 0x74]
mov edx, 0x4651a4
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2b], 0x10
je 0x464d87
mov eax, dword [ebx + 0x74]
mov edx, 0x4651bc
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2a], 0x20
je 0x464d9a
mov eax, dword [ebx + 0x74]
mov edx, 0x4651d0
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov dl, 1
mov eax, dword [0x415c40]
call fcn.004038b8
mov esi, eax
mov dword [ebx + 0x78], esi
test byte [ebx + 0x2c], 0x10
je 0x464dbd
mov eax, esi
mov edx, 0x4651e4
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2c], 1
je 0x464dd0
mov eax, dword [ebx + 0x78]
mov edx, 0x465200
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2c], 4
je 0x464de3
mov eax, dword [ebx + 0x78]
mov edx, 0x46521c
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2c], 8
je 0x464df6
mov eax, dword [ebx + 0x78]
mov edx, 0x46523c
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2c], 0x20
je 0x464e09
mov eax, dword [ebx + 0x78]
mov edx, 0x465254
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2c], 0x40
je 0x464e1c
mov eax, dword [ebx + 0x78]
mov edx, 0x465270
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2c], 0x80
je 0x464e2f
mov eax, dword [ebx + 0x78]
mov edx, 0x465288
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2d], 1
je 0x464e42
mov eax, dword [ebx + 0x78]
mov edx, 0x4652a4
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2d], 2
je 0x464e55
mov eax, dword [ebx + 0x78]
mov edx, 0x4652c0
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2d], 4
je 0x464e68
mov eax, dword [ebx + 0x78]
mov edx, 0x4652dc
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2d], 0x10
je 0x464e7d
mov eax, dword [ebx + 0x78]
mov edx, 0x4652f8
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x464e8a
mov eax, dword [ebx + 0x78]
mov edx, 0x46530c
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2d], 0x20
je 0x464e9f
mov eax, dword [ebx + 0x78]
mov edx, 0x465320
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x464eac
mov eax, dword [ebx + 0x78]
mov edx, 0x46533c
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2d], 0x40
je 0x464ec1
mov eax, dword [ebx + 0x78]
mov edx, 0x465358
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x464ece
mov eax, dword [ebx + 0x78]
mov edx, 0x465374
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2e], 1
je 0x464ee1
mov eax, dword [ebx + 0x78]
mov edx, 0x465394
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2e], 2
je 0x464ef4
mov eax, dword [ebx + 0x78]
mov edx, 0x4653b0
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x2e], 4
je 0x464f07
mov eax, dword [ebx + 0x78]
mov edx, 0x4653cc
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov dl, 1
mov eax, dword [0x415c40]
call fcn.004038b8
mov esi, eax
mov dword [ebx + 0x7c], esi
test byte [ebx + 0x71], 0x10
je 0x464f2a
mov eax, esi
mov edx, 0x4653e4
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x70], 1
je 0x464f3d
mov eax, dword [ebx + 0x7c]
mov edx, 0x465400
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x70], 2
je 0x464f50
mov eax, dword [ebx + 0x7c]
mov edx, 0x465414
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x70], 4
je 0x464f63
mov eax, dword [ebx + 0x7c]
mov edx, 0x465428
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x70], 8
je 0x464f76
mov eax, dword [ebx + 0x7c]
mov edx, 0x465440
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x70], 0x20
je 0x464f89
mov eax, dword [ebx + 0x7c]
mov edx, 0x465454
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x70], 0x40
je 0x464f9c
mov eax, dword [ebx + 0x7c]
mov edx, 0x465468
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x70], 0x80
je 0x464faf
mov eax, dword [ebx + 0x7c]
mov edx, 0x46547c
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x71], 1
je 0x464fc2
mov eax, dword [ebx + 0x7c]
mov edx, 0x465490
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x71], 2
je 0x464fd5
mov eax, dword [ebx + 0x7c]
mov edx, 0x4654a4
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x71], 8
je 0x464fe8
mov eax, dword [ebx + 0x7c]
mov edx, 0x4654b8
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x71], 0x20
je 0x464ffb
mov eax, dword [ebx + 0x7c]
mov edx, 0x4654cc
mov ecx, dword [eax]
call dword [ecx + 0x38]
test byte [ebx + 0x71], 0x40
je 0x46500e
mov eax, dword [ebx + 0x7c]
mov edx, 0x4654e8
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
call fcn.00409398
mov eax, edi
call fcn.00409398
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46503f
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404754
ret