Function at 0x4029f0
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, esi
mov dword [ebp - 0x78], esi
xor bh, bh
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x402a12
xor eax, eax
sub edi, ecx
mov dword [ebp - 0xd4], 0x44
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0xa
mov dword [ebp - 0xc0], 0xa
mov dword [ebp - 0xbc], 0x190
mov dword [ebp - 0xb8], 0x190
mov dword [ebp - 0xb4], 0x14
mov dword [ebp - 0xb0], 0x14
mov word [ebp - 0xa2], ax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa8], eax
cmp edx, 1
jne 0x402a9e
lea eax, [edx + 2]
jmp 0x402aa5
cmp edx, 2
jne 0x402ab6
xor eax, eax
mov word [ebp - 0xa4], ax
mov dword [ebp - 0xa8], 1
push dword [0x41a390]
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov bl, byte [ebp + 8]
test bl, bl
je 0x402b58
push str.HWNOWAIT
call fcn.00402e41
add esp, 4
test eax, eax
jne 0x402b58
mov eax, 0x63
cmp edi, 0x64
cmovge edi, eax
push edi
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.0040d310
add esp, 0xc
cmp edi, 0x64
jae 0x402ca8
lea eax, [ebp - 0x74]
push eax
mov byte [ebp + edi - 0x74], 0
call fcn.004043d3
lea eax, [ebp - 0x74]
push str.WINWORD.EXE
push eax
call fcn.004035a0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x402b34
add esi, 0xb
cmp byte [esi], 0x22
jne 0x402b30
inc esi
mov bh, 1
jmp 0x402b5b
lea eax, [ebp - 0x74]
push str.SWRITER.EXE
push eax
call fcn.004035a0
mov esi, eax
add esp, 8
test esi, esi
je 0x402b5b
add esi, 0xb
cmp byte [esi], 0x22
jne 0x402b30
inc esi
mov bh, 1
jmp 0x402b5b
mov esi, dword [ebp - 0x7c]
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0xd4]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push dword [ebp - 0x78]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x7c], eax
test eax, eax
je 0x402c79
test bl, bl
je 0x402c79
test bh, bh
je 0x402c58
push edi
push dword [ebp - 0x78]
lea eax, [ebp - 0x74]
push eax
call fcn.0040d310
add esp, 0xc
cmp edi, 0x64
jae 0x402ca8
mov byte [ebp + edi - 0x74], 0
test esi, esi
je 0x402c79
push 0x5c
push esi
call fcn.00404460
add esp, 8
test eax, eax
je 0x402bd3
lea esi, [eax + 1]
push 0x2e
push esi
call fcn.00404460
add esp, 8
test eax, eax
je 0x402be5
mov byte [eax], 0
test esi, esi
je 0x402c79
mov dword [ebp - 0x78], 0
mov ebx, 0x1f4
xor edi, edi
jmp 0x402c00
push esi
push 0x402970
mov dword [0x41a38c], 0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [0x41a38c], 0
jne 0x402c23
test edi, edi
jne 0x402c79
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
jne 0x402c00
cmp dword [0x41a38c], edi
je 0x402c42
mov edi, 1
mov ebx, 0x7d0
jmp 0x402c00
mov eax, dword [ebp - 0x78]
add eax, ebx
mov dword [ebp - 0x78], eax
cmp eax, 0xea60
jl 0x402c00
mov edi, 1
jmp 0x402c00
push 0xffffffffffffffff
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xd8]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x8c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x88]
call esi
mov ecx, dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 0x7c], eax
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.00402cae
mov esp, ebp
pop ebp
ret
call fcn.004034c3
int3