Function at 0x40934f
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push ebp
nop
mov ebp, esp
nop
sub esp, 0x54
nop
push ebx
nop
push esi
nop
push edi
nop
push 0
nop
call dword [sym.imp.USER32.dll_GetDC]
push dword [0x406148]
nop
mov ebx, dword [sym.imp.msvcrt.dll_malloc]
nop
push eax
pop edi
nop
call ebx
push dword [0x406148]
nop
mov dword [ebp - 0x10], eax
nop
call ebx
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
nop
and dword [ebp - 0xc], 0
nop
pop ecx
nop
pop ecx
nop
mov dword [ebp - 4], eax
nop
sub eax, eax
nop
inc eax
nop
push 8
nop
push edi
nop
mov dword [0x406144], eax
nop
mov dword [0x40613c], eax
nop
mov dword [0x40611c], 0xc8
nop
call esi
push 0xa
nop
push edi
nop
mov dword [0x406104], eax
nop
mov dword [0x406074], eax
nop
call esi
push edi
nop
push 0
nop
mov dword [0x40606c], eax
nop
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x40606c]
nop
sub eax, dword [0x40611c]
nop
push dword [ebp + 8]
nop
sub eax, 0x44
nop
mov dword [0x40610c], eax
nop
call fcn.00408b4e
pop ecx
nop
mov ecx, dword [0x406068]
nop
push eax
pop esi
nop
mov al, byte [esi]
nop
inc esi
nop
mov byte [ecx], al
nop
inc ecx
nop
test al, al
nop
jne 0x40940e
mov esi, dword [0x406068]
nop
push 8
nop
mov edi, str.blocked
nop
pop ecx
nop
sub eax, eax
nop
repe cmpsb byte [esi], byte es:[edi]
nop
jne 0x409441
push 0x63
nop
pop eax
nop
jmp 0x40969f
push 0x44
nop
lea eax, [ebp - 0x54]
nop
push 0
nop
push eax
nop
call sub.msvcrt.dll_memset
push 0x10
nop
call ebx
add esp, 0x10
nop
cmp dword [0x406038], 0
nop
push 3
nop
mov dword [ebp - 8], eax
nop
pop eax
nop
mov dword [ebp - 0x28], 1
nop
mov word [ebp - 0x24], ax
nop
jne 0x40949e
push dword [0x406148]
nop
call ebx
mov dword [ebp - 0x4c], eax
nop
mov esi, str.WndSt1Default
nop
push eax
pop edi
nop
movsd dword es:[edi], dword [esi]
nop
movsd dword es:[edi], dword [esi]
nop
movsd dword es:[edi], dword [esi]
nop
movsw word es:[edi], word [esi]
nop
pop ecx
nop
movsb byte es:[edi], byte [esi]
nop
mov ebx, dword [ebp - 0x10]
nop
mov ecx, dword [0x406068]
nop
mov dword [ebp - 0x54], 0x44
nop
push ebx
pop edx
nop
mov al, byte [ecx]
nop
inc ecx
nop
mov byte [edx], al
nop
inc edx
nop
test al, al
nop
jne 0x4094b4
push ebx
pop edi
nop
dec edi
nop
mov al, byte [edi + 1]
nop
inc edi
nop
test al, al
nop
jne 0x4094c8
mov esi, 0x405288
nop
movsw word es:[edi], word [esi]
nop
mov eax, dword [0x406060]
nop
push eax
pop edx
nop
mov cl, byte [eax]
nop
inc eax
nop
test cl, cl
nop
jne 0x4094e5
push ebx
pop edi
nop
sub eax, edx
nop
dec edi
nop
mov cl, byte [edi + 1]
nop
inc edi
nop
test cl, cl
nop
jne 0x4094f7
push eax
pop ecx
nop
shr ecx, 2
nop
push edx
pop esi
nop
mov edx, dword [ebp - 4]
nop
rep movsd dword es:[edi], dword [esi]
nop
push eax
pop ecx
nop
and ecx, 3
nop
rep movsb byte es:[edi], byte [esi]
nop
push ebx
pop eax
nop
sub edx, ebx
nop
mov cl, byte [eax]
nop
mov byte [edx + eax], cl
nop
inc eax
nop
test cl, cl
nop
jne 0x409523
push dword [ebp - 8]
nop
sub esi, esi
nop
lea eax, [ebp - 0x54]
nop
push eax
nop
push esi
nop
push esi
nop
push 0x80
nop
push esi
nop
push esi
nop
push esi
nop
push dword [ebp - 4]
nop
push esi
nop
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
or eax, eax
nop
je 0x40964b
push dword [0x406034]
nop
mov edi, dword [ebp - 8]
nop
push dword [edi]
nop
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
nop
push 0x401c79
nop
mov dword [0x406130], edi
nop
mov dword [0x40603c], esi
nop
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x40603c]
nop
cmp eax, esi
nop
jne 0x4095b3
push 8
nop
push 0x3c
nop
call fcn.00408d33
pop ecx
nop
pop ecx
nop
mov dword [0x40603c], eax
nop
push dword [0x40610c]
nop
mov dword [0x406030], eax
nop
call fcn.00408098
add eax, dword [0x40611c]
nop
pop ecx
nop
push eax
nop
push dword [0x406074]
nop
push 1
nop
call fcn.00408053
pop ecx
nop
pop ecx
nop
push eax
nop
push dword [0x40603c]
nop
call fcn.00408d53
add esp, 0xc
nop
mov dword [0x406050], eax
nop
cmp eax, esi
nop
jne 0x409653
mov eax, 0x176
nop
push eax
nop
push eax
nop
push dword [0x40603c]
nop
call fcn.00408d53
add esp, 0xc
nop
mov dword [0x406050], eax
nop
cmp eax, esi
nop
jne 0x409653
push dword [0x40604c]
nop
push dword [0x406048]
nop
push dword [0x40603c]
nop
call fcn.00408d53
add esp, 0xc
nop
mov dword [0x406050], eax
nop
jmp 0x409653
mov dword [ebp - 0xc], 6
nop
push dword [0x4060e0]
nop
fld qword [0x405280]
nop
sub esp, 0x10
nop
fstp qword [esp + 8]
nop
fld qword [0x405278]
nop
fstp qword [esp]
nop
call fcn.00408000
add esp, 0x14
nop
push eax
nop
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 4]
nop
mov esi, dword [sym.imp.msvcrt.dll_free]
nop
call esi
push ebx
nop
call esi
mov eax, dword [ebp - 0xc]
nop
pop ecx
nop
pop ecx
nop
pop edi
nop
pop esi
nop
pop ebx
nop
leave
nop
ret