Function at 0x49cfc4
Capabilities:
Enumerate gui resources
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff30
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0xcc], edx
mov dword [ebp - 0xc4], edx
mov dword [ebp - 0xc8], edx
mov dword [ebp - 0xc0], edx
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49d61e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40ea34]
call fcn.00402e48
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x49cfac
call sub.user32.dll_EnumWindows
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x49d5db
inc eax
mov dword [ebp - 0x24], eax
xor esi, esi
push 0x7f
lea eax, [ebp - 0xa8]
push eax
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0041031c
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle case.0x49d10a.0
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xa8]
mov ecx, 0x80
call fcn.00403dd0
mov eax, dword [ebp - 0x10]
call fcn.0049ccdc
test al, al
je case.0x49d10a.0
lea eax, [ebp - 8]
push eax
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0041031c
push eax
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [ebp - 0x18], 0
jne 0x49d0f9
mov eax, dword [0x4bd6bc]
mov edx, dword [ebp - 0x10]
call fcn.00403f30
je 0x49d0f9
mov eax, 0x4bd6bc
mov edx, dword [ebp - 0x10]
call fcn.00403bf4
cmp dword [0x4c9038], 0
jl 0x49d0d0
cmp dword [0x4c9038], 3
jle 0x49d0d9
cmp dword [0x4c9038], 9
jne 0x49d0f9
push 0
push 0
mov eax, dword [0x4bd6bc]
push eax
push 0
push 0
mov ecx, 3
mov edx, 0x91
mov eax, dword [ebp - 4]
call fcn.004948a8
inc dword [ebp - 0x18]
mov eax, dword [0x4c9038]
cmp eax, 9
ja case.0x49d10a.0
jmp dword [eax*4 + 0x49d111]
mov eax, dword [0x4bdb78]
mov edx, dword [eax + 4]
mov eax, dword [eax]
cmp edx, dword [0x4bd640]
jne 0x49d159
cmp eax, dword [0x4bd63c]
jae case.0x49d10a.0
jmp 0x49d15f
jge case.0x49d10a.0
lea eax, [ebp - 0xbc]
mov edx, dword [0x4bd798]
mov edx, dword [edx]
mov edx, dword [edx + 0x74]
call fcn.00403d58
mov ecx, dword [ebp - 0xbc]
mov dl, byte [0x49d62c]
mov al, 1
call fcn.00487b8c
jmp case.0x49d10a.0
mov edx, 3
mov eax, dword [0x4c8fb4]
call fcn.0049e6e4
jmp case.0x49d10a.0
lea edx, [ebp - 0xc0]
mov eax, dword [ebp - 0x10]
call fcn.00408818
mov eax, dword [ebp - 0xc0]
call fcn.0049cf44
test al, al
je 0x49d2ee
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetCursorPos
lea eax, [ebp - 0xb8]
push eax
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0041031c
push eax
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0xb8]
test eax, eax
jge 0x49d1fc
sub dword [ebp - 0xb0], eax
xor eax, eax
mov dword [ebp - 0xb8], eax
jmp 0x49d23c
mov eax, dword [0x4bdcb8]
mov eax, dword [eax]
call fcn.0042f240
cmp eax, dword [ebp - 0xb0]
jge 0x49d23c
mov eax, dword [0x4bdcb8]
mov eax, dword [eax]
call fcn.0042f240
mov edx, dword [ebp - 0xb0]
sub edx, eax
sub dword [ebp - 0xb8], edx
mov eax, dword [0x4bdcb8]
mov eax, dword [eax]
call fcn.0042f240
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb4]
test eax, eax
jge 0x49d256
sub dword [ebp - 0xac], eax
xor eax, eax
mov dword [ebp - 0xb4], eax
jmp 0x49d296
mov eax, dword [0x4bdcb8]
mov eax, dword [eax]
call fcn.0042f234
cmp eax, dword [ebp - 0xac]
jge 0x49d296
mov eax, dword [0x4bdcb8]
mov eax, dword [eax]
call fcn.0042f234
mov edx, dword [ebp - 0xac]
sub edx, eax
sub dword [ebp - 0xb4], edx
mov eax, dword [0x4bdcb8]
mov eax, dword [eax]
call fcn.0042f234
mov dword [ebp - 0xac], eax
push 0x40
mov eax, dword [ebp - 0xac]
mov edi, dword [ebp - 0xb4]
sub eax, edi
push eax
mov eax, dword [ebp - 0xb0]
mov ebx, dword [ebp - 0xb8]
sub eax, ebx
push eax
push edi
push ebx
push 0xffffffffffffffff
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0041031c
push eax
call sub.user32.dll_SetWindowPos
mov edx, dword [ebp - 0xb4]
add edx, 0xc
mov eax, dword [ebp - 0xb0]
sub eax, 0xf
call fcn.0049cc4c
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_SetCursorPos
push 0
push 0
push 0x10
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0041031c
push eax
call sub.user32.dll_PostMessageA
jmp case.0x49d10a.0
mov eax, dword [ebp - 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov edi, eax
mov eax, edi
xor edx, edx
cmp edx, 0xffffffff
jne 0x49d324
cmp eax, 0xffffffff
je 0x49d33a
test edi, edi
je 0x49d33a
push 0x31
push edi
call sub.kernel32.dll_TerminateProcess
push edi
call sub.kernel32.dll_CloseHandle_1
jmp case.0x49d10a.0
cmp byte [0x4bd748], 0
je 0x49d369
push 0x43
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0041031c
push eax
call sub.user32.dll_SetWindowPos
mov eax, 0x14
call fcn.00454ea4
push 0
push 0
push 0x10
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0041031c
push eax
call sub.user32.dll_PostMessageA
cmp byte [0x4bd748], 0
je case.0x49d10a.0
mov eax, 0x14
call fcn.00454ea4
push 0
push 0
push 0
push 0x59
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x59
call sub.user32.dll_keybd_event
mov eax, dword [0x4c8ed0]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x49d5d1
push 0x7f
lea eax, [ebp - 0xa8]
push eax
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0041031c
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x49d5d1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xa8]
mov ecx, 0x80
call fcn.00403dd0
mov eax, dword [0x4c8ed0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x49d5d1
inc eax
mov dword [ebp - 0x28], eax
xor ebx, ebx
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0xc8]
mov edx, ebx
mov eax, dword [0x4c8ed0]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc8]
mov ecx, 0x400
mov edx, 4
call fcn.00404028
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x14]
call fcn.00403f30
jne case.0x49d495.0
test ebx, ebx
jne 0x49d463
or edx, 0xffffffff
mov eax, dword [ebp - 0x10]
call fcn.00408c80
inc eax
je 0x49d5d1
lea ecx, [ebp - 0xcc]
mov edx, ebx
mov eax, dword [0x4c8ed0]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xcc]
movzx eax, byte [eax + 1]
sub eax, 0x30
mov dword [0x4c9038], eax
mov eax, dword [0x4c9038]
cmp eax, 7
ja case.0x49d495.0
jmp dword [eax*4 + 0x49d49c]
mov eax, dword [0x4bdb78]
mov edx, dword [eax + 4]
mov eax, dword [eax]
cmp edx, dword [0x4bd640]
jne 0x49d4dc
cmp eax, dword [0x4bd63c]
jae case.0x49d495.0
jmp 0x49d4e2
jge case.0x49d495.0
lea eax, [ebp - 0xd0]
mov edx, dword [0x4bd798]
mov edx, dword [edx]
mov edx, dword [edx + 0x74]
call fcn.00403d58
mov ecx, dword [ebp - 0xd0]
mov dl, byte [0x49d62c]
mov al, 1
call fcn.00487b8c
jmp case.0x49d495.0
mov edx, 3
mov eax, dword [0x4c8fb4]
call fcn.0049e6e4
jmp case.0x49d495.0
mov eax, dword [ebp - 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov edi, eax
mov eax, edi
xor edx, edx
cmp edx, 0xffffffff
jne 0x49d53f
cmp eax, 0xffffffff
je 0x49d555
test edi, edi
je 0x49d555
push 0x31
push edi
call sub.kernel32.dll_TerminateProcess
push edi
call sub.kernel32.dll_CloseHandle_1
jmp case.0x49d495.0
cmp byte [0x4bd748], 0
je 0x49d584
push 0x43
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0041031c
push eax
call sub.user32.dll_SetWindowPos
mov eax, 0x14
call fcn.00454ea4
push 0
push 0
push 0x10
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0041031c
push eax
call sub.user32.dll_PostMessageA
cmp byte [0x4bd748], 0
je case.0x49d495.0
mov eax, 0x14
call fcn.00454ea4
push 0
push 0
push 0
push 0x59
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x59
call sub.user32.dll_keybd_event
inc ebx
dec dword [ebp - 0x28]
jne 0x49d40b
inc esi
dec dword [ebp - 0x24]
jne 0x49d044
cmp dword [ebp - 0x18], 0
jne 0x49d5eb
mov eax, 0x4bd6bc
call fcn.00403ba0
mov eax, dword [ebp - 0xc]
call fcn.00402e78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d625
lea eax, [ebp - 0xd0]
mov edx, 6
call fcn.00403bc4
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403bc4
ret