Function at 0x4a74f0
Capabilities:
Enumerate gui resources

Disassembly:
push 0xffffffffffffffff
push 0x4f3582
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2c]
push eax
mov ecx, 0x10dd3a4
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [0x10d7c90]
xor ebp, ebp
mov dword [0x10d7c98], ebp
cmp eax, ebp
je 0x4a7553
cmp dword [0x10d7c94], ebp
je 0x4a7553
mov ebx, dword [esp + 0x30]
push ebx
push 0x494e30
push eax
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
jmp 0x4a7563
mov ebx, dword [esp + 0x30]
push ebx
push 0x494e30
call dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0x24], ebp
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x24], 1
mov al, byte [0x53ea40]
test al, 1
je 0x4a75b5
lea ecx, [esp + 0x14]
test al, 8
je 0x4a75a3
push str.OK_EZ_MS
call dword [sym.imp.mfc90.dll_Ordinal_820]
push str.FAIL_EZ_MS
jmp 0x4a7613
push str.OK_MS_MS
call dword [sym.imp.mfc90.dll_Ordinal_820]
push str.FAIL_MS_MS
jmp 0x4a7613
test al, 2
je 0x4a75e5
lea ecx, [esp + 0x14]
test al, 8
je 0x4a75d3
push str.OK_EZ_EZ
call dword [sym.imp.mfc90.dll_Ordinal_820]
push str.FAIL_EZ_EZ
jmp 0x4a7613
push str.OK_MS_EZ
call dword [sym.imp.mfc90.dll_Ordinal_820]
push str.FAIL_MS_EZ
jmp 0x4a7613
test al, 4
je 0x4a761d
lea ecx, [esp + 0x14]
test al, 8
je 0x4a7603
push str.OK_EZ_MH
call dword [sym.imp.mfc90.dll_Ordinal_820]
push str.FAIL_EZ_MH
jmp 0x4a7613
push str.OK_MS_MH
call dword [sym.imp.mfc90.dll_Ordinal_820]
push str.FAIL_MS_MH
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [esp + 0x14]
push ebp
push ecx
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
mov edx, dword [esp + 0x28]
push ebp
push edx
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, eax
call fcn.00491d40
add esp, 0x20
push str.OK_EZ_MS
lea ecx, [esp + 0x18]
mov esi, eax
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
jne 0x4a766f
lea eax, [esi + edi + 1]
mov dword [0x10d7ca8], eax
jmp 0x4a7707
push str.OK_MS_MS
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
jne 0x4a768e
lea ecx, [esi + edi + 1]
mov dword [0x10d7cac], ecx
jmp 0x4a7707
push str.OK_EZ_EZ
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
jne 0x4a76ad
lea edx, [esi + edi + 1]
mov dword [0x10d7cb0], edx
jmp 0x4a7707
push str.OK_MS_EZ
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
jne 0x4a76cb
lea eax, [esi + edi + 1]
mov dword [0x10d7cb4], eax
jmp 0x4a7707
push str.OK_EZ_MH
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
jne 0x4a76ea
lea ecx, [esi + edi + 1]
mov dword [0x10d7cb8], ecx
jmp 0x4a7707
push str.OK_MS_MH
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
jne 0x4a7707
lea edx, [esi + edi + 1]
mov dword [0x10d7cbc], edx
mov eax, dword [0x10d7c98]
cmp eax, ebp
je 0x4a77b3
push ebp
push ebp
mov ebp, dword [sym.imp.USER32.dll_PostMessageA]
push 0x12
push eax
call ebp
mov eax, dword [0x10d7c98]
push 0
push 0
push 0x10
push eax
call ebp
mov ecx, dword [0x10d7c98]
push 0
push 0
push 2
push ecx
call ebp
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 0x34], 0
jne 0x4a775e
push ebx
call fcn.00494cc0
add esp, 4
jmp 0x4a77ee
cmp dword [0x10d7ca4], 0
je 0x4a7770
mov edx, dword [esp + 0x14]
inc edi
push edi
push edx
jmp 0x4a7777
mov eax, dword [esp + 0x18]
inc esi
push esi
push eax
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [0x10d7ca4]
mov edx, dword [esp + 0x3c]
inc dword [0x10d7c9c]
add esp, 0x10
push ecx
push edx
push ebx
push str.CheckExeOK__d___s__PostMessage_OK__IsHooKed__d_
push 8
call fcn.0043d500
push ebx
call fcn.00494cc0
add esp, 0x18
jmp 0x4a77ee
push ebx
call fcn.00494cc0
add esp, 4
cmp byte [esp + 0x34], 0
je 0x4a77ee
mov eax, dword [esp + 0x18]
inc esi
push esi
push eax
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esp + 0x3c]
push ecx
push ebx
push str.CheckExeOK__d___s__g_hAutoWnd__0
push 8
call fcn.0043d500
add esp, 0x20
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret