Function at 0x4af314
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x15
push 0
push 0
dec ecx
jne 0x4af31d
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4afa92
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00409530
test al, al
jne 0x4af377
push 0x4afaac
push esi
push 0x4afac8
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.00404a28
mov ecx, dword [ebp - 0x7c]
mov dl, 1
mov eax, dword [0x407d40]
call fcn.0040cdb0
call fcn.00404060
push 0x4afad4
push esi
push 0x4afaf0
push dword [ebp - 4]
push 0x4afb04
lea eax, [ebp - 0x80]
mov edx, 5
call fcn.00404a28
mov edx, dword [ebp - 0x80]
mov eax, ebx
call fcn.004ae4dc
mov byte [0x4b919d], 1
mov eax, 0x4b9198
mov edx, esi
call fcn.004046fc
push 0
push 0x4af1ac
call sub.user32.dll_EnumWindows
lea eax, [ebp - 0x34]
xor ecx, ecx
mov edx, 0x10
call fcn.00403180
lea eax, [ebp - 0x78]
xor ecx, ecx
mov edx, 0x44
call fcn.00403180
mov dword [ebp - 0x78], 0x44
mov dword [ebp - 0x4c], 1
mov word [ebp - 0x48], 5
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
mov eax, esi
call fcn.00404b68
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xea61
cmp byte [0x4b91a8], 0
jne 0x4afa74
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4af5cf
cmp dword [ebp - 0x1c], 0x103
je 0x4af5cf
cmp dword [ebp - 0x1c], 0x20
jne 0x4af4af
push 0x4afb14
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x88]
call fcn.00409114
push dword [ebp - 0x88]
push 0x4afb30
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00404a28
mov eax, dword [ebp - 0x84]
call fcn.004adfac
jmp 0x4af5cf
cmp dword [ebp - 0x1c], 1
jne 0x4af4f7
push 0x4afb3c
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x90]
call fcn.00409114
push dword [ebp - 0x90]
push 0x4afb30
lea eax, [ebp - 0x8c]
mov edx, 3
call fcn.00404a28
mov eax, dword [ebp - 0x8c]
call fcn.004adfac
jmp 0x4af5cf
cmp dword [ebp - 0x1c], 0
jne 0x4af541
push 0x4afb64
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x98]
call fcn.00409114
push dword [ebp - 0x98]
push 0x4afb30
lea eax, [ebp - 0x94]
mov edx, 3
call fcn.00404a28
mov edx, dword [ebp - 0x94]
mov eax, ebx
call fcn.004ae4dc
jmp 0x4afa74
cmp dword [ebp - 0x1c], 0x642
jne 0x4af592
push 0x4afb7c
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa0]
call fcn.00409114
push dword [ebp - 0xa0]
push 0x4afb30
lea eax, [ebp - 0x9c]
mov edx, 3
call fcn.00404a28
mov edx, dword [ebp - 0x9c]
mov eax, ebx
call fcn.004ae4dc
mov byte [ebp - 5], 1
jmp 0x4afa74
push 0x4afb14
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa8]
call fcn.00409114
push dword [ebp - 0xa8]
push 0x4afb30
lea eax, [ebp - 0xa4]
mov edx, 3
call fcn.00404a28
mov eax, dword [ebp - 0xa4]
call fcn.004adfac
push 0x4afb94
push 0x4afba0
call sub.user32.dll_FindWindowA
mov edi, eax
test edi, edi
jbe 0x4af6d2
cmp dword [ebp - 0x18], 0
ja 0x4af6d2
push 0x4afbb4
push 0x4afbe4
push 0
push edi
call sub.user32.dll_FindWindowExA
mov dword [ebp - 0x14], eax
mov edx, 0x4afbf4
mov eax, ebx
call fcn.004ae4dc
cmp dword [ebp - 0x14], 0
jbe 0x4af6d2
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0xc8
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0x4afc0c
push 0x4afc14
push 0
push edi
call sub.user32.dll_FindWindowExA
mov dword [ebp - 0x18], eax
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
mov edx, 0x32
mov eax, dword [ebx + 0x310]
call fcn.004a7000
cmp dword [ebp - 0x18], 0
jbe 0x4af6c9
mov edx, 0x4afc24
mov eax, ebx
call fcn.004ae4dc
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0xc8
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0
push 0
push 0xf5
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_PostMessageA
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0x64
call sub.kernel32.dll_Sleep_1
mov byte [ebp - 5], 1
jmp 0x4afa74
test esi, esi
ja 0x4af812
push 0x4afc38
push 0x4afba0
call sub.user32.dll_FindWindowA
mov esi, eax
mov edx, 0x37
mov eax, dword [ebx + 0x310]
call fcn.004a7000
test esi, esi
jbe 0x4afa6b
mov edx, 0x4afc54
mov eax, ebx
call fcn.004ae4dc
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0x320
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
lea edx, [ebp - 0xac]
mov eax, dword [ebp - 4]
call fcn.00408c08
cmp dword [ebp - 0xac], 0
je 0x4af7ae
push 0x4afc68
push 0x4afc14
push 0
push esi
call sub.user32.dll_FindWindowExA
mov edi, eax
test edi, edi
jbe 0x4afa6b
push 0x4afc84
push dword [ebp - 4]
push 0x4afb30
lea eax, [ebp - 0xb0]
mov edx, 3
call fcn.00404a28
mov edx, dword [ebp - 0xb0]
mov eax, ebx
call fcn.004ae4dc
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0
push 0
push 0xf5
push edi
call sub.user32.dll_PostMessageA
push 0x64
call sub.kernel32.dll_Sleep_1
push 0x4afc98
push 0x4afc14
push 0
push esi
call sub.user32.dll_FindWindowExA
mov edi, eax
test edi, edi
jbe 0x4afa6b
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov edx, 0x4afcac
mov eax, ebx
call fcn.004ae4dc
mov edx, 0x3c
mov eax, dword [ebx + 0x310]
call fcn.004a7000
push 0
push 0
push 0xf5
push edi
call sub.user32.dll_PostMessageA
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0x4afccc
push 0x4afba0
call sub.user32.dll_FindWindowA
mov edi, eax
test edi, edi
jbe 0x4af935
cmp byte [ebp - 0x21], 0
jne 0x4af935
mov edx, 0x4afce8
mov eax, ebx
call fcn.004ae4dc
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0xc8
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0x4afcfc
push 0x4afc14
push 0
push edi
call sub.user32.dll_FindWindowExA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4af8f9
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0x3e8
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0
push 0
push 0xf5
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_PostMessageA
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0
push 0
push 0xf5
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_PostMessageA
push 0xc8
call sub.kernel32.dll_Sleep_1
mov edx, 0x4afd0c
mov eax, ebx
call fcn.004ae4dc
mov byte [ebp - 5], 1
jmp 0x4afa74
push 0x4afd1c
push 0
push 0
push edi
call sub.user32.dll_FindWindowExA
test eax, eax
jbe 0x4af935
push 0
push 0
push 0xf5
push eax
call sub.user32.dll_PostMessageA
push 0xc8
call sub.kernel32.dll_Sleep_1
mov edx, 0x4afd2c
mov eax, ebx
call fcn.004ae4dc
mov byte [ebp - 0x21], 1
push 0x4afccc
push 0x4afd3c
call sub.user32.dll_FindWindowA
mov edi, eax
test edi, edi
jbe 0x4afa06
mov edx, 0x4afd4c
mov eax, ebx
call fcn.004ae4dc
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0xc8
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0x4afd70
push 0x4afc14
push 0
push edi
call sub.user32.dll_FindWindowExA
mov edi, eax
test edi, edi
jbe 0x4afa06
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0x3e8
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0
push 0
push 0xf5
push edi
call sub.user32.dll_PostMessageA
mov eax, dword [0x4b626c]
mov eax, dword [eax]
call fcn.0045dd60
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0
push 0
push 0xf5
push edi
call sub.user32.dll_PostMessageA
push 0xc8
call sub.kernel32.dll_Sleep_1
mov edx, 0x4afd84
mov eax, ebx
call fcn.004ae4dc
mov byte [ebp - 5], 1
jmp 0x4afa74
cmp dword [ebp - 0x10], 0
ja 0x4afa6b
push 0x4afd94
push 0x4afba0
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x4afa6b
push 0x4afdac
push 0x4afc14
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_FindWindowExA
mov edi, eax
test edi, edi
jbe 0x4afa6b
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov edx, 0x4afdc4
mov eax, ebx
call fcn.004ae4dc
push 0
push 0
push 0xf5
push edi
call sub.user32.dll_PostMessageA
push 0x64
call sub.kernel32.dll_Sleep_1
dec dword [ebp - 0x20]
jne 0x4af425
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afa99
lea eax, [ebp - 0xb0]
mov edx, 0xe
call fcn.004046cc
ret