Function at 0x4655d8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
call fcn.004118a0
lea esi, [ebx + 0xbc]
call fcn.004118a0
mov edx, dword [ebp + 0xc]
mov al, byte [ebp + 0x24]
mov cl, byte [ebp + 0x20]
lea edi, [ebx + 0x14]
push edx
mov esi, edi
mov byte [ebx + 4], al
mov byte [ebx + 5], cl
call fcn.0040ee30
mov eax, dword [ebp + 0x10]
lea esi, [ebx + 0x24]
push eax
call fcn.0040ee30
lea eax, [ebx + 0x8c]
push 0x47f878
call fcn.00401b00
mov ecx, dword [ebp + 0x18]
xor eax, eax
mov dword [ebx + 0x10], ecx
lea ecx, [esp + 0x10]
mov dword [ebx + 0x9c], 1
mov byte [ebx + 0xc], 1
mov dword [ebx + 8], eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xb4], eax
call fcn.00407c30
lea ecx, [esp + 0x20]
call fcn.00407c30
mov eax, dword [ebx + 0x10]
test eax, eax
jge 0x46567e
push eax
call fcn.0041490c
add esp, 4
mov dword [ebx + 0x10], eax
mov byte [ebx + 0xc], 0
cmp dword [ebx + 0x10], 4
jne 0x465691
push edi
call fcn.004555da
mov dword [ebx + 0x10], 1
push edi
call fcn.004373d7
test al, al
je 0x4656e8
push esi
call fcn.004373d7
test al, al
je 0x4656e8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
push ebx
call fcn.0044dbf9
mov edx, dword [ebx]
mov eax, dword [edx]
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], eax
push edx
call fcn.00435c32
lea ecx, [esp + 0x20]
call fcn.0040c3f0
lea ecx, [esp + 0x10]
call fcn.0040c3f0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
xor edi, edi
lea esi, [ebx + 0x14]
call fcn.0040f750
cmp word [eax], 0x5b
jne 0x465ac7
mov eax, dword [ebx + 0x18]
lea edi, [eax - 1]
lea esi, [ebx + 0x14]
call fcn.0040f750
cmp word [eax], 0x5d
jne 0x465ac7
mov edi, dword [ebx + 0x18]
mov dword [esp + 0xc], 1
sub edi, 2
lea ebx, [ebx]
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1c]
push edx
lea esi, [ebx + 0x14]
push esi
call fcn.00455931
test al, al
je 0x465ac7
lea eax, [esp + 0x10]
push str.LAST
push eax
call fcn.004373e5
add esp, 8
test al, al
jne 0x4659f8
lea ecx, [esp + 0x10]
push str.ACTIVE
push ecx
call fcn.004373e5
add esp, 8
test al, al
jne 0x465a45
lea edx, [esp + 0x10]
push 0x47fb14
push edx
call fcn.004373e5
add esp, 8
test al, al
jne 0x465a64
lea eax, [esp + 0x10]
push str.REGEXPTITLE
push eax
call fcn.004373e5
add esp, 8
test al, al
je 0x4657f9
mov eax, dword [ebx + 8]
test al, 1
jne 0x465a8b
or eax, 2
lea esi, [ebx + 0x34]
mov dword [ebx + 8], eax
call fcn.0040e900
lea ecx, [esp + 0x20]
push ecx
push esi
call fcn.00465546
test eax, eax
je 0x465728
lea ecx, [esp + 0x20]
call fcn.0040c3f0
lea ecx, [esp + 0x10]
call fcn.0040c3f0
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
lea edx, [esp + 0x10]
push str.CLASS
push edx
call fcn.004373e5
add esp, 8
test al, al
je 0x465828
or dword [ebx + 8], 8
lea eax, [esp + 0x20]
push eax
lea esi, [ebx + 0x8c]
call fcn.0040ee30
jmp 0x465728
lea ecx, [esp + 0x10]
push str.REGEXPCLASS
push ecx
call fcn.004373e5
add esp, 8
test al, al
je 0x465854
or dword [ebx + 8], 0x10
lea esi, [ebx + 0x60]
call fcn.0040e900
lea edx, [esp + 0x20]
push edx
jmp 0x4657cb
lea eax, [esp + 0x10]
push str.XYWH
push eax
call fcn.004373e5
add esp, 8
test al, al
je 0x465889
mov ecx, dword [esp + 0x20]
or dword [ebx + 8], 0x80
push ecx
call fcn.004145db
add esp, 4
mov dword [ebx + 0xa4], eax
jmp 0x465728
lea edx, [esp + 0x10]
push 0x47fa08
push edx
call fcn.004373e5
add esp, 8
test al, al
je 0x4658be
mov eax, dword [esp + 0x20]
or dword [ebx + 8], 0x100
push eax
call fcn.004145db
add esp, 4
mov dword [ebx + 0xa8], eax
jmp 0x465728
lea ecx, [esp + 0x10]
push 0x47fa0c
push ecx
call fcn.004373e5
add esp, 8
test al, al
je 0x4658f3
mov edx, dword [esp + 0x20]
or dword [ebx + 8], 0x200
push edx
call fcn.004145db
add esp, 4
mov dword [ebx + 0xac], eax
jmp 0x465728
lea eax, [esp + 0x10]
push 0x47fa10
push eax
call fcn.004373e5
add esp, 8
test al, al
je 0x465928
mov ecx, dword [esp + 0x20]
or dword [ebx + 8], 0x400
push ecx
call fcn.004145db
add esp, 4
mov dword [ebx + 0xb0], eax
jmp 0x465728
lea edx, [esp + 0x10]
push 0x47fa14
push edx
call fcn.004373e5
add esp, 8
test al, al
je 0x46595a
mov eax, dword [esp + 0x20]
or dword [ebx + 8], 0x20
push eax
call fcn.004145db
add esp, 4
mov dword [ebx + 0x9c], eax
jmp 0x465728
lea ecx, [esp + 0x10]
push 0x47fafc
push ecx
call fcn.004373e5
add esp, 8
test al, al
je 0x46598f
lea edx, [esp + 0x20]
push 0x47f878
push edx
call fcn.004373e5
add esp, 8
test al, al
je 0x4659da
or dword [ebx + 8], 0x40
jmp 0x465728
lea eax, [esp + 0x10]
push str.TITLE
push eax
call fcn.004373e5
add esp, 8
test al, al
je 0x4659c5
mov eax, dword [ebx + 8]
lea ecx, [esp + 0x20]
test al, 2
jne 0x465aab
or eax, 1
push ecx
mov dword [ebx + 8], eax
call fcn.0040ee30
jmp 0x465728
lea edx, [esp + 0x10]
push edx
call fcn.0043a858
add esp, 4
test al, al
je 0x465728
lea ecx, [esp + 0x20]
call fcn.0040c3f0
lea ecx, [esp + 0x10]
call fcn.0040c3f0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
lea eax, [esp + 0x20]
push 0x47f878
push eax
call fcn.004373e5
add esp, 8
test al, al
je 0x4659da
mov ebx, dword [ebx]
test ebx, ebx
je 0x465a28
mov ecx, dword [ebx]
mov eax, dword [ebp + 0x14]
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], ecx
push eax
jmp 0x4656c3
lea ecx, [esp + 0x20]
call fcn.0040c3f0
lea ecx, [esp + 0x10]
call fcn.0040c3f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
lea ecx, [esp + 0x20]
push 0x47f878
push ecx
call fcn.004373e5
add esp, 8
test al, al
je 0x4659da
jmp 0x4656a5
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push eax
push ecx
call fcn.0043775d
mov esi, dword [esp + 0x14]
add esp, 8
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x465a28
push esi
jmp 0x4656ac
lea ecx, [esp + 0x20]
call fcn.0040c3f0
lea ecx, [esp + 0x10]
call fcn.0040c3f0
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
call fcn.0040c3f0
lea ecx, [esp + 0x10]
call fcn.0040c3f0
mov eax, 0xfffffffc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
cmp dword [ebx + 8], 0
jne 0x465ad4
mov dword [ebx + 8], 1
or dword [ebx + 8], 4
cmp byte [ebx + 0xc], 0
jne 0x465ae7
lea eax, [ebx + 0x24]
push eax
call fcn.0044bee4
test byte [ebx + 8], 1
je 0x465afc
cmp byte [ebx + 0xc], 0
jne 0x465afc
lea eax, [ebx + 0x14]
push eax
call fcn.0044bee4
cmp byte [ebp + 0x1c], 0
push ebx
push 0x44db80
je 0x465b17
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x465b1d
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [ebp + 0x14]
lea esi, [ebx + 0xbc]
push esi
push edi
call fcn.0044681a
call fcn.004118a0
cmp dword [ebx + 0xb4], 1
jl 0x465b49
mov eax, dword [edi + 4]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
push ebx
call fcn.0044dbf9
mov ebx, dword [ebx + 0xb4]
lea ecx, [esp + 0x20]
call fcn.0040c3f0
lea ecx, [esp + 0x10]
call fcn.0040c3f0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x20