Function at 0x422840
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x517a80
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x572c40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x13c]
push eax
push 0x421d30
mov dword [ebp - 0x13c], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x134], eax
test eax, eax
jne 0x4228a7
mov eax, 1
jmp 0x422c08
lea ecx, [ebp - 0x148]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x148]
push 0
push 0x438
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x138], esi
test esi, esi
je 0x422977
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 4
push 0x1000
push 0x74
push 0
push esi
call edi
mov dword [ebp - 0x120], eax
test eax, eax
je 0x422970
push 0x74
push 1
call fcn.0048deaf
add esp, 8
mov dword [ebp - 0x124], eax
test eax, eax
jne 0x422931
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
push dword [ebp - 0x120]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, 2
jmp 0x422c08
push 4
push 0x1000
push 0x10c
push 0
push esi
call edi
mov edi, eax
mov dword [ebp - 0x144], edi
test edi, edi
jne 0x422981
mov ecx, dword [ebp - 0x124]
push ecx
call fcn.00484ef8
add esp, 4
push 0x8000
push edi
push dword [ebp - 0x120]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 2
jmp 0x422c08
push 0x10c
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.00483290
mov ecx, dword [ebp - 0x124]
add esp, 0xc
cmp byte [0xb64be0], 0
je 0x4229b1
mov dword [ecx + 0x20], 0x104
mov eax, edi
jmp 0x4229b9
mov dword [ecx + 0x14], edi
mov eax, 0x104
mov dword [ecx + 0x18], eax
lea ecx, [ebp - 0x160]
call fcn.004145b0
mov dword [ebp - 4], 0
cmp ebx, 0x40
ja 0x422a4c
push 0
lea eax, [ebp - 0x12c]
push eax
push ebx
push str.DesktopIcons
call fcn.004321c0
mov ecx, eax
add esp, 0x10
mov eax, 0x7a44c6b
mul ecx
mov edi, edx
shr edi, 3
mov dword [ebp - 0x128], edi
test edi, edi
je 0x422a41
mov eax, dword [ebp - 0x15c]
mov ebx, dword [ebp - 0x12c]
mov dword [ebp - 0x140], ebx
test eax, eax
je 0x422a21
push eax
call fcn.00484ef8
add esp, 4
lea eax, [ebp - 0x160]
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x160], edi
mov dword [ebp - 0x154], edi
mov dword [ebp - 0x130], eax
jmp 0x422a6c
mov ebx, dword [ebp - 0x15c]
jmp 0x422baf
mov ebx, dword [ebx + 0xea0]
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x140], eax
mov edi, dword [ebx]
mov dword [ebp - 0x128], edi
push 0
push 0
push 0x1004
push dword [ebp - 0x134]
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, 2
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x12c], edx
xor ebx, ebx
test eax, eax
jle 0x422b9a
nop dword [eax]
push 0
push 0x74
push dword [ebp - 0x124]
push dword [ebp - 0x120]
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push dword [ebp - 0x120]
push ebx
push 0x102d
push dword [ebp - 0x134]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x10c
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x144]
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor esi, esi
test edi, edi
jle 0x422b7f
xor edi, edi
nop word [eax + eax]
mov eax, dword [ebp - 0x130]
mov eax, dword [eax + 4]
add eax, edi
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00484da1
add esp, 8
test eax, eax
je 0x422b30
inc esi
add edi, 0x10c
cmp esi, dword [ebp - 0x128]
jl 0x422b00
jmp 0x422b79
mov eax, dword [ebp - 0x130]
imul ecx, esi, 0x10c
add ecx, dword [eax + 4]
movzx eax, word [ecx + 0x108]
sub ax, word [0xb6393c]
movzx edx, ax
movzx eax, word [ecx + 0x104]
sub ax, word [0xb63938]
shl edx, 0x10
movzx eax, ax
or edx, eax
push edx
push ebx
push 0x100f
push dword [ebp - 0x134]
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [ebp - 0x128]
mov eax, dword [ebp - 0x14c]
inc ebx
mov esi, dword [ebp - 0x138]
cmp ebx, eax
jl 0x422aa0
mov edx, dword [ebp - 0x12c]
sub edx, 1
mov dword [ebp - 0x12c], edx
jne 0x422a92
mov ebx, dword [ebp - 0x140]
push 0x8000
push 0
push dword [ebp - 0x144]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call esi
mov edi, dword [ebp - 0x138]
push 0x8000
push 0
push dword [ebp - 0x120]
push edi
call esi
push dword [ebp - 0x124]
call fcn.00484ef8
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x422c06
cmp byte [ebp - 0x150], 0
jne 0x422c06
push ebx
call fcn.00484ef8
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00481761
mov esp, ebp
pop ebp
ret 4