Function at 0x4170a4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov eax, 0x566b64
call fcn.0054c220
mov dword [ebp - 0x28], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.00557d90
inc dword [ebp - 0x28]
mov word [ebp - 0x34], 8
mov word [ebp - 0x34], 0x14
mov word [ebp - 0x34], 0x2c
mov edx, 0x56623e
lea eax, [ebp - 4]
call fcn.00557d58
inc dword [ebp - 0x28]
mov word [ebp - 0x34], 0x20
mov edx, dword [ebp + 8]
dec edx
je 0x417109
dec edx
je 0x417165
dec edx
je 0x4171a3
jmp 0x417224
mov word [ebp - 0x34], 0x38
mov edx, str.___Microsoft_Word
lea eax, [ebp - 8]
call fcn.00557d58
inc dword [ebp - 0x28]
lea edx, [ebp - 8]
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
inc dword [ebp - 0x28]
lea eax, [ebp + 0xc]
call fcn.00557f10
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00557ee8
dec dword [ebp - 0x28]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00557eb8
dec dword [ebp - 0x28]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00557eb8
jmp 0x417224
mov word [ebp - 0x34], 0x44
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x10]
inc dword [ebp - 0x28]
lea edx, [ebp + 0xc]
mov eax, str.Microsoft_Excel__
call fcn.005583ec
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00557ee8
dec dword [ebp - 0x28]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00557eb8
jmp 0x417224
mov word [ebp - 0x34], 0x50
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
inc dword [ebp - 0x28]
lea edx, [ebp + 0xc]
mov eax, str.___Microsoft_PowerPoint____
call fcn.005583ec
lea eax, [ebp - 0x14]
push eax
mov edx, 0x566280
lea eax, [ebp - 0x18]
call fcn.00557d58
inc dword [ebp - 0x28]
lea edx, [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1c]
inc dword [ebp - 0x28]
pop eax
call fcn.00557f10
lea edx, [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00557ee8
dec dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00557eb8
dec dword [ebp - 0x28]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00557eb8
dec dword [ebp - 0x28]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00557eb8
mov word [ebp - 0x34], 0x5c
xor ecx, ecx
mov dword [ebp - 0x20], ecx
lea edx, [ebp - 0x20]
inc dword [ebp - 0x28]
lea eax, [ebp - 4]
call fcn.00558154
lea edx, [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.00557ee8
dec dword [ebp - 0x28]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00557eb8
lea edx, [ebp - 4]
mov eax, 0x564fb4
call fcn.00557ee8
xor ecx, ecx
mov dword [0x564fb8], ecx
xor eax, eax
mov dword [ebp - 0x48], eax
mov word [ebp - 0x34], 0x20
push dword [ebp - 0x48]
push 0x419908
call sub.USER32.DLL_EnumWindows
cmp dword [0x564fb8], 0
je 0x4172d9
push 4
push dword [0x564fb8]
call sub.USER32.DLL_ShowWindow
push dword [0x564fb8]
call sub.USER32.DLL_SetForegroundWindow
mov al, 1
push eax
dec dword [ebp - 0x28]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00557eb8
dec dword [ebp - 0x28]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00557eb8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x41739b
mov ecx, dword [ebp + 8]
dec ecx
je 0x4172e7
dec ecx
je 0x417304
dec ecx
je 0x417321
jmp 0x41733c
cmp dword [ebp + 0xc], 0
je 0x4172f2
mov eax, dword [ebp + 0xc]
jmp 0x4172f7
mov eax, 0x566282
push eax
push 1
call fcn.004173a4
add esp, 8
jmp 0x41733c
cmp dword [ebp + 0xc], 0
je 0x41730f
mov edx, dword [ebp + 0xc]
jmp 0x417314
mov edx, 0x566283
push edx
push 2
call fcn.004173a4
add esp, 8
jmp 0x41733c
cmp dword [ebp + 0xc], 0
je 0x41732c
mov eax, dword [ebp + 0xc]
jmp 0x417331
mov eax, 0x566284
push eax
push 3
call fcn.004173a4
add esp, 8
mov al, 1
push eax
dec dword [ebp - 0x28]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00557eb8
dec dword [ebp - 0x28]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00557eb8
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x41739b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret