Function at 0x404950
Capabilities:
Enumerate gui resources
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x418008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x124], 0
call fcn.004061c0
movzx esi, ax
mov dword [ebp - 0x12c], esi
cmp esi, 0xd
je 0x404c5c
mov ebx, dword [sym.imp.user32.dll_GetDesktopWindow]
add edi, 4
mov dword [ebp - 0x128], edi
mov edi, dword [sym.imp.kernel32.dll_GetCurrentProcess]
jmp 0x4049b6
mov esi, dword [ebp - 0x12c]
cmp dword [0x44c9c8], 0
je 0x404bbe
call ebx
mov dword [ebp - 0x120], eax
call dword [sym.imp.user32.dll_GetForegroundWindow]
mov dword [ebp - 0x11c], eax
call dword [sym.imp.user32.dll_GetShellWindow]
mov dword [ebp - 0x118], eax
call dword [sym.imp.user32.dll_GetCapture]
mov dword [ebp - 0x114], eax
call dword [sym.imp.user32.dll_GetClipboardOwner]
mov dword [ebp - 0x110], eax
call dword [sym.imp.user32.dll_GetOpenClipboardWindow]
mov dword [ebp - 0x10c], eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebp - 0x108], eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [ebp - 0x104], eax
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x100], eax
call dword [sym.imp.user32.dll_GetFocus]
mov dword [ebp - 0xfc], eax
call dword [sym.imp.user32.dll_GetActiveWindow]
mov dword [ebp - 0xf8], eax
call dword [sym.imp.user32.dll_GetKBCodePage]
mov dword [ebp - 0xf4], eax
call dword [sym.imp.user32.dll_GetCursor]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.user32.dll_GetLastActivePopup]
mov dword [ebp - 0xec], eax
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push 0x4bf
mov dword [ebp - 0xe8], eax
call dword [sym.imp.user32.dll_GetQueueStatus]
mov dword [ebp - 0xe4], eax
call dword [sym.imp.user32.dll_GetInputState]
mov dword [ebp - 0xe0], eax
call dword [sym.imp.user32.dll_GetMessageTime]
mov dword [ebp - 0xdc], eax
call dword [sym.imp.kernel32.dll_GetOEMCP]
lea ecx, [ebp - 0xd4]
push ecx
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], 0x14
mov dword [ebp - 0x70], 0x40
mov dword [ebp - 0x30], 0x28
call dword [sym.imp.user32.dll_GetCursorInfo]
lea edx, [ebp - 0xc0]
push edx
call dword [sym.imp.user32.dll_GetCaretPos]
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0xa8]
push ecx
lea edx, [ebp - 0xb0]
push edx
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.kernel32.dll_GetThreadTimes]
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x98]
push ecx
call edi
push eax
call dword [sym.imp.kernel32.dll_GetProcessTimes]
push 0x28
lea edx, [ebp - 0x30]
push edx
call edi
push eax
call dword [sym.imp.psapi.dll_GetProcessMemoryInfo]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
lea ecx, [ebp - 0x70]
push ecx
call dword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
mov eax, dword [0x41a5a4]
xor esi, esi
jmp 0x404b60
mov dl, byte [ebp + esi - 0x120]
mov ecx, dword [0x41a5a8]
mov byte [eax + ecx], dl
inc eax
mov dword [0x41a5a4], eax
cmp eax, 0x2000
jne 0x404b87
call fcn.00403d00
mov eax, dword [0x41a5a4]
inc esi
cmp esi, 0x118
jl 0x404b60
mov ecx, 0x118
lea eax, [ebp - 0x120]
jmp 0x404ba0
mov byte [eax], 0
inc eax
dec ecx
jne 0x404ba0
push ecx
push 0x403df0
call dword [sym.imp.user32.dll_EnumWindows]
call fcn.00403d00
mov esi, dword [ebp - 0x12c]
cmp si, 8
jne 0x404bf2
cmp dword [ebp - 0x124], 0
jbe 0x404be4
push 8
call fcn.00406317
dec dword [ebp - 0x124]
add esp, 4
sub dword [ebp - 0x128], 2
push 0x20
call fcn.00406317
add esp, 4
push 8
jmp 0x404c37
test si, si
je 0x404c01
mov edx, 0xe0
cmp si, dx
jne 0x404c06
call fcn.004061c0
lea eax, [esi - 0x20]
cmp ax, 0x5e
ja 0x404c3f
cmp dword [ebp - 0x124], 0x80
je 0x404c3f
mov eax, dword [ebp - 0x128]
inc dword [ebp - 0x124]
movzx ecx, si
mov word [eax], si
add eax, 2
mov dword [ebp - 0x128], eax
push ecx
call fcn.00406317
add esp, 4
call fcn.004061c0
movzx eax, ax
mov dword [ebp - 0x12c], eax
cmp eax, 0xd
jne 0x4049b0
mov edi, dword [ebp - 0x130]
push 0xa
call fcn.00406317
mov edx, dword [ebp - 0x124]
mov ecx, dword [ebp - 4]
add esp, 4
lea eax, [edx + edx]
mov dword [edi], eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405c9f
mov esp, ebp
pop ebp
ret