Function at 0x404f55
Capabilities:
Create process on windows
Enumerate gui resources
Hide graphical window

Disassembly:
mov eax, 0x4168
call fcn.00406c40
push ebx
push ebp
mov ebp, ecx
mov edx, dword [ebp + 0x198]
dec edx
mov eax, edx
mov dword [ebp + 0x198], edx
test eax, eax
jle 0x404e3e
pop ebp
xor eax, eax
pop ebx
add esp, 0x4168
ret 0x10
push 0x412a1c
lea ecx, [ebp + 0x1a0]
mov byte [ebp + 0x160], 0
call fcn.00405490
mov eax, dword [ebp + 0x15c]
mov ecx, dword [ebp + 0x158]
cmp eax, ecx
je 0x404e80
push 1
push 0x412a00
mov ecx, ebp
call fcn.00403ba0
pop ebp
xor eax, eax
pop ebx
add esp, 0x4168
ret 0x10
mov eax, 0x415b40
cmp dword [eax], 0
jne 0x404e65
add eax, 0x224
cmp eax, 0x4163d0
jl 0x404e85
mov eax, dword [ebp + 0x44]
test eax, eax
jne 0x404ea2
mov eax, 0x410280
lea ecx, [ebp + 0x50]
push eax
push ecx
lea edx, [esp + 0x74]
push str._s_s
push edx
call fcn.00406b75
lea eax, [esp + 0x7c]
push 0x41205c
push eax
call fcn.00405d6c
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x404ed9
pop ebp
pop ebx
add esp, 0x4168
ret 0x10
push esi
push edi
mov edi, 0x415c50
push 0x4129f4
push edi
call fcn.00405d6c
mov esi, eax
add esp, 8
test esi, esi
je 0x404f4a
test byte [esi + 0xc], 0x10
jne 0x404f2a
push esi
push 0x4000
lea ecx, [esp + 0x180]
push 1
push ecx
call fcn.00406e9e
push ebx
push eax
lea edx, [esp + 0x190]
push 1
push edx
call fcn.00405c02
mov al, byte [esi + 0xc]
add esp, 0x20
test al, 0x10
je 0x404efa
push esi
call fcn.00405b85
push edi
call fcn.00406c9d
mov byte [edi], 0
add edi, 0x224
add esp, 8
cmp edi, 0x4164e0
jl 0x404ee0
push ebx
call fcn.00405b85
add esp, 4
mov ecx, ebp
push 1
push 0x4129d4
call fcn.00403ba0
mov eax, dword [str._PostData_Down.aspx]
mov ecx, ebp
push eax
call fcn.00404bf0
mov ecx, dword [ebp + 4]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x404f8a
mov edx, dword [ebp + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x404fa0
mov eax, dword [ebp + 4]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 6
push eax
call esi
mov ecx, dword [ebp + 4]
push 0
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
xor edx, edx
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x30]
mov dword [esp + 0x10], edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], edx
lea eax, [esp + 0x20]
mov dword [esp + 0x18], edx
push eax
mov dword [esp + 0x34], 0x44
mov dword [esp + 0x20], edx
call ebx
lea ecx, [esp + 0x10]
lea edx, [esp + 0x30]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x90]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x404fac
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
call fcn.00404570
test al, al
jne 0x40503d
mov eax, dword [ebp + 4]
push 0x34
push 0x4129c8
push 0x4129a8
push eax
call esi
cmp eax, 7
je 0x4050b7
jmp 0x404fac
mov ecx, dword [str._PostData_Install.aspx]
push ecx
mov ecx, ebp
call fcn.00404bf0
mov al, byte [0x416428]
test al, al
je 0x40507f
mov eax, dword [0x416410]
test eax, eax
jbe 0x40507f
mov eax, dword [0x41640c]
test eax, eax
jne 0x40506b
mov eax, 0x410280
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, ebp
call fcn.00404160
push 0
push 0x402c20
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [ebp + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4168
ret 0x10
mov eax, dword [ebp + 4]
push 9
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4168
ret 0x10