Function at 0x401520
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.0040ac00
lea esp, [esp]
cmp eax, 0xa02
jb 0x401586
push str.MainThread
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], 0
push eax
mov dword [ebp - 0x10c], 0
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 8
lea eax, [ebp - 0x110]
push eax
push 0x26
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 8
push eax
mov dword [ebp - 0x114], 3
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, 0x7ffffffe
mov eax, 0x42ce1c
cmp word [eax], 0
je 0x4015bf
add eax, 2
sub ecx, 1
jne 0x4015b1
lea eax, [ecx + ecx]
mov dword [ebp - 0x10c], 0x42ce1c
mov esi, 0xfffffffc
mov ecx, esi
sub ecx, eax
movzx eax, cx
mov word [ebp - 0x110], ax
add eax, 2
mov word [ebp - 0x10e], ax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.ntdll.dll_LdrSetDllDirectory]
push 0x8001
call dword [sym.imp.ntdll.dll_RtlSetSearchPathMode]
push 0xc00
call dword [sym.imp.ntdll.dll_LdrSetDefaultDllDirectories]
push 0
push 4
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0
push eax
push 0xc
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x401651
and dword [ebp - 0x10c], 0xffff7ffc
lea eax, [ebp - 0x10c]
push 4
push eax
push 0xc
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
push 0x401120
call dword [sym.imp.ntdll.dll_RtlSetUnhandledExceptionFilter]
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x40167c
push 0
push 0
push ecx
push eax
mov edx, str.COM_library_initialization_failed_
xor ecx, ecx
call fcn.00405dc0
mov eax, dword fs:[0x18]
push 0x42ce3c
mov eax, dword [eax + 0x30]
push dword [eax + 0x1d4]
lea eax, [ebp - 0x108]
push str.Sessions_uBaseNamedObjects_s
push 0x80
push eax
call fcn.00409bc0
add esp, 0x14
lea eax, [ebp - 0x108]
mov ecx, 0x7ffffffe
cmp word [eax], 0
je 0x4016c5
add eax, 2
sub ecx, 1
jne 0x4016b4
lea eax, ds:[ecx + ecx]
mov dword [ebp - 0x138], 0x18
mov ecx, esi
mov dword [ebp - 0x134], 0
sub ecx, eax
mov dword [ebp - 0x12c], 0x40
lea eax, [ebp - 0x108]
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x114], eax
movzx eax, cx
mov word [ebp - 0x118], ax
add eax, 2
mov word [ebp - 0x116], ax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x138]
push eax
push 1
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x124], 0
push eax
call dword [sym.imp.ntdll.dll_NtOpenMutant]
test eax, eax
js 0x4017a9
push dword [ebp - 0x10c]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, 0x7ffffffe
mov eax, 0x42ce20
cmp word [eax], 0
je 0x40176e
add eax, 2
sub ecx, 1
jne 0x401760
lea eax, [ecx + ecx]
mov dword [ebp - 0x11c], 0x42ce20
sub esi, eax
lea eax, [ebp - 0x120]
push eax
push 0x40e5c0
mov dword [ebp - 0x120], esi
call dword [sym.imp.USER32.dll_EnumWindows]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414c55
mov esp, ebp
pop ebp
ret
call fcn.00401320
mov edx, 0x433474
mov ecx, 0x42ce3c
call fcn.00407cc0
push 0
push 4
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0
push eax
push 0x1a
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
lea esp, [esp]
test eax, eax
js 0x401837
cmp dword [ebp - 0x10c], 0
setne al
test al, al
je 0x401837
mov eax, dword fs:[0x18]
mov edx, str.nowow64
push ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x44]
call fcn.0040aa80
test al, al
jne 0x401837
push str.This_application_was_not_designed_to_run_under_WoW64._Do_not_run_32_bit_executables_r_non_64_bit_system_because_of_performance_loss_and_increased_memory_consumption._r_n_r_nNote:_Add___nowow64__argument_to_avoid_this_warning_and_take_responsibility_for_the_consequences.
push str.WoW64_warning_
mov edx, 0x40030
xor ecx, ecx
call fcn.00406100
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414c55
mov esp, ebp
pop ebp
ret
call fcn.004012a0
lea esp, [esp]
test al, al
jne 0x401849
call fcn.00401b80
mov eax, dword fs:[0x18]
mov edx, str.help
push ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x44]
call fcn.0040aa80
test al, al
jne 0x401795
mov eax, dword fs:[0x18]
mov edx, str.clean
push ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x44]
call fcn.0040aa80
test al, al
jne 0x401795
mov eax, dword fs:[0x18]
mov edx, str.install
push ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x44]
call fcn.0040aa80
test al, al
jne 0x401795
mov eax, dword fs:[0x18]
mov edx, str.uninstall
push ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x44]
call fcn.0040aa80
mov ecx, dword [ebp - 4]
test al, al
pop esi
sete al
xor ecx, ebp
call fcn.00414c55
mov esp, ebp
pop ebp
ret