Function at 0x1000152e
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, str.QQSG.exe
push edi
push esi
push 0x1008fd14
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x1000178a
push 0x1008f6c0
push 1
push 0x1008f770
push 0x1008fe18
call fcn.10004555
push 0x100900f0
call fcn.10004bb5
add esp, 0x14
call dword [sym.imp.MSVCRT.dll__getpid]
mov edi, eax
xor ebx, ebx
cmp dword [0x1008ff20], ebx
jne 0x10001595
push edi
push 0x10001338
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1000157f
call fcn.10004ad0
test eax, eax
jne 0x10001785
call fcn.10001d55
mov edi, eax
call fcn.10003e0d
push 0x100013b2
call fcn.1000324a
pop ecx
lea eax, [ebp - 8]
push 2
push 0xfffffffffffffffb
push 7
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0xd0
mov byte [ebp - 6], 0x83
mov byte [ebp - 5], 0xc4
mov byte [ebp - 4], 8
mov byte [ebp - 3], 0x85
mov byte [ebp - 2], 0xd2
call fcn.10001af7
cmp eax, ebx
jbe 0x100015f8
push 0x10001097
push eax
mov ecx, edi
call fcn.100017e0
or byte [ebp - 7], 0xff
push 1
push 0x27
lea eax, [ebp - 0xc]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0xc1
mov byte [ebp - 0xb], 0xeb
mov byte [ebp - 0xa], 6
mov byte [ebp - 9], 0x81
mov byte [ebp - 8], 0xe3
mov byte [ebp - 6], 1
mov byte [ebp - 5], bl
mov byte [ebp - 4], bl
call fcn.10001af7
cmp eax, ebx
jbe 0x1000163d
push 0x100010ee
push eax
mov ecx, edi
call fcn.100017e0
push 1
push 0x15
lea eax, [ebp - 8]
push 7
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x83
mov byte [ebp - 7], 0xc7
mov byte [ebp - 6], 7
mov byte [ebp - 5], 0x40
mov byte [ebp - 4], 0x83
mov byte [ebp - 3], pe_nt_image_headers32
mov byte [ebp - 2], 2
call fcn.10001af7
cmp eax, ebx
jbe 0x1000167c
push 0x1000111b
push eax
mov ecx, edi
call fcn.100017e0
push 1
push 0x81
lea eax, [ebp - 0xc]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x8c
mov byte [ebp - 0xa], 0xb1
mov byte [ebp - 9], 0x80
mov byte [ebp - 8], 0xc
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], 0x85
mov byte [ebp - 4], 0xc9
call fcn.10001af7
cmp eax, ebx
jbe 0x100016c4
push 0x1000121d
push eax
mov ecx, edi
call fcn.100017e0
push 1
push 7
lea eax, [ebp - 8]
push 7
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x51
mov byte [ebp - 7], 0x8b
mov byte [ebp - 6], 0x4c
mov byte [ebp - 5], 0x24
mov byte [ebp - 4], 0xc
mov byte [ebp - 3], 0x52
mov byte [ebp - 2], 0x51
call fcn.10001af7
cmp eax, ebx
jbe 0x10001703
push 0x10001301
push eax
mov ecx, edi
call fcn.100017e0
push 1
push 0x37
lea eax, [ebp - 0xc]
push 0xc
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x8c
mov byte [ebp - 0xa], 0x24
mov byte [ebp - 9], 0xa0
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], 0x83
mov byte [ebp - 4], 0xc4
mov byte [ebp - 3], 0x10
mov byte [ebp - 2], 0x8b
mov byte [ebp - 1], 0x11
call fcn.10001af7
cmp eax, ebx
jbe 0x10001753
push 0x100011cf
push eax
mov ecx, edi
call fcn.100017e0
or byte [ebp - 5], 0xff
push 1
push 0xffffffffffffffd6
lea eax, [ebp - 8]
push 6
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x6a
mov byte [ebp - 7], bl
mov byte [ebp - 6], 0x6a
mov byte [ebp - 4], 0x6a
mov byte [ebp - 3], 0x9c
call fcn.10001af7
cmp eax, ebx
jbe 0x10001785
mov dword [0x10008ec4], eax
push 1
pop eax
jmp 0x1000178c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret