Function at 0x4af684
Capabilities:
Enumerate gui resources
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1d
push 0
push 0
dec ecx
jne 0x4af68c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4afefe
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40ed14]
call fcn.00402e6c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x4af5b0
call sub.user32.dll_EnumWindows
xor eax, eax
mov dword [ebp - 0x18], eax
call fcn.0040a22c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xc8]
mov eax, 0x4aff14
call fcn.0040ae40
mov edx, dword [ebp - 0xc8]
lea eax, [ebp - 0x28]
mov ecx, 0x4aff24
call fcn.00403e90
call fcn.0040a22c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2c]
call fcn.0040ae14
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4afeae
inc eax
mov dword [ebp - 0x30], eax
xor esi, esi
push 0x7f
lea eax, [ebp - 0xb4]
push eax
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00410778
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle case.0x4af93d.0
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb4]
mov ecx, 0x80
call fcn.00403df4
push 0x7f
lea eax, [ebp - 0xb4]
push eax
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00410778
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x4af8ab
lea eax, [ebp - 0x24]
lea edx, [ebp - 0xb4]
mov ecx, 0x80
call fcn.00403df4
cmp byte [0x4c9335], 0
jne 0x4af7d5
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
call fcn.00404130
dec eax
jne 0x4af7d5
mov edx, dword [ebp - 0x24]
mov eax, 0x4aff30
call fcn.00404130
dec eax
jne 0x4af7d5
push 0
push 0
push 0x10
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00410778
push eax
call sub.user32.dll_PostMessageA
mov edx, 5
mov eax, 0x4aff58
call fcn.004b3964
cmp byte [0x4c9336], 0
je 0x4af821
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
call fcn.00404130
dec eax
jne 0x4af821
mov edx, dword [ebp - 0x24]
mov eax, 0x4aff70
call fcn.00404130
dec eax
jne 0x4af821
push 0
push 0
push 0x10
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00410778
push eax
call sub.user32.dll_PostMessageA
mov edx, 5
mov eax, 0x4aff8c
call fcn.004b3964
mov eax, dword [ebp - 0x24]
mov edx, 0x4affa8
call fcn.00403f54
je 0x4af83f
mov eax, dword [ebp - 0x24]
mov edx, 0x4affb8
call fcn.00403f54
jne 0x4af8ab
mov eax, dword [ebp - 0x10]
call fcn.00403e44
mov ebx, eax
test ebx, ebx
jle 0x4af872
mov eax, dword [ebp - 0x10]
mov al, byte [eax + ebx - 1]
call fcn.00457408
test al, al
jne 0x4af86d
mov eax, dword [ebp - 0x10]
mov al, byte [eax + ebx - 1]
call fcn.00457418
test al, al
je 0x4af872
dec ebx
test ebx, ebx
jg 0x4af84d
test ebx, ebx
jne 0x4af8ab
push 0x4affc4
push 0x4affd8
push 0
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00410778
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4af8ab
push 0x4bc6b4
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00410778
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x10]
call fcn.004af2e0
test al, al
je case.0x4af93d.0
lea eax, [ebp - 8]
push eax
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00410778
push eax
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [ebp - 0x18], 0
jne 0x4af92c
mov eax, dword [0x4bc52c]
mov edx, dword [ebp - 0x10]
call fcn.00403f54
je 0x4af92c
mov eax, 0x4bc52c
mov edx, dword [ebp - 0x10]
call fcn.00403c18
cmp dword [0x4c9524], 0
jl 0x4af903
cmp dword [0x4c9524], 3
jle 0x4af90c
cmp dword [0x4c9524], 9
jne 0x4af92c
push 0
push 0
mov eax, dword [0x4bc52c]
push eax
push 0
push 0
mov ecx, 3
mov edx, 0x91
mov eax, dword [ebp - 4]
call fcn.004a1ab4
inc dword [ebp - 0x18]
mov eax, dword [0x4c9524]
cmp eax, 9
ja case.0x4af93d.0
jmp dword [eax*4 + 0x4af944]
mov eax, dword [0x4bcca0]
mov edx, dword [eax + 4]
mov eax, dword [eax]
cmp edx, dword [0x4bc3e4]
jne 0x4af98c
cmp eax, dword [0x4bc3e0]
jae case.0x4af93d.0
jmp 0x4af992
jge case.0x4af93d.0
lea eax, [ebp - 0xcc]
mov edx, dword [0x4bc754]
mov edx, dword [edx]
mov edx, dword [edx + 0x74]
call fcn.00403d7c
mov ecx, dword [ebp - 0xcc]
mov dx, word [0x4affe0]
mov al, 1
call fcn.00491870
jmp case.0x4af93d.0
mov edx, 5
mov eax, dword [0x4c9494]
call fcn.004b3964
jmp case.0x4af93d.0
lea edx, [ebp - 0xd0]
mov eax, dword [ebp - 0x10]
call fcn.00408954
mov eax, dword [ebp - 0xd0]
call fcn.004af548
test al, al
je 0x4afb22
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetCursorPos
lea eax, [ebp - 0xc4]
push eax
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00410778
push eax
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0xc4]
test eax, eax
jge 0x4afa30
sub dword [ebp - 0xbc], eax
xor eax, eax
mov dword [ebp - 0xc4], eax
jmp 0x4afa70
mov eax, dword [0x4bce38]
mov eax, dword [eax]
call fcn.0042fe6c
cmp eax, dword [ebp - 0xbc]
jge 0x4afa70
mov eax, dword [0x4bce38]
mov eax, dword [eax]
call fcn.0042fe6c
mov edx, dword [ebp - 0xbc]
sub edx, eax
sub dword [ebp - 0xc4], edx
mov eax, dword [0x4bce38]
mov eax, dword [eax]
call fcn.0042fe6c
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xc0]
test eax, eax
jge 0x4afa8a
sub dword [ebp - 0xb8], eax
xor eax, eax
mov dword [ebp - 0xc0], eax
jmp 0x4afaca
mov eax, dword [0x4bce38]
mov eax, dword [eax]
call fcn.0042fe60
cmp eax, dword [ebp - 0xb8]
jge 0x4afaca
mov eax, dword [0x4bce38]
mov eax, dword [eax]
call fcn.0042fe60
mov edx, dword [ebp - 0xb8]
sub edx, eax
sub dword [ebp - 0xc0], edx
mov eax, dword [0x4bce38]
mov eax, dword [eax]
call fcn.0042fe60
mov dword [ebp - 0xb8], eax
push 0x40
mov eax, dword [ebp - 0xb8]
mov edi, dword [ebp - 0xc0]
sub eax, edi
push eax
mov eax, dword [ebp - 0xbc]
mov ebx, dword [ebp - 0xc4]
sub eax, ebx
push eax
push edi
push ebx
push 0xffffffffffffffff
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00410778
push eax
call sub.user32.dll_SetWindowPos
mov edx, dword [ebp - 0xc0]
add edx, 0xc
mov eax, dword [ebp - 0xbc]
sub eax, 0xf
call fcn.004af250
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_SetCursorPos
push 0
push 0
push 0x10
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00410778
push eax
call sub.user32.dll_PostMessageA
cmp dword [0x4bc494], 0
je case.0x4af93d.0
push 0
push 0x4affe4
lea eax, [ebp - 0xd4]
mov edx, dword [0x4bc754]
mov edx, dword [edx]
mov edx, dword [edx + 0xb8]
call fcn.00403d7c
lea eax, [ebp - 0xd4]
mov edx, dword [0x4bc52c]
call fcn.00403e4c
mov eax, dword [ebp - 0xd4]
call fcn.00404008
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp case.0x4af93d.0
mov eax, dword [ebp - 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov edi, eax
mov eax, edi
xor edx, edx
cmp edx, 0xffffffff
jne 0x4afba9
cmp eax, 0xffffffff
je 0x4afbbf
test edi, edi
je 0x4afbbf
push 0x31
push edi
call sub.kernel32.dll_TerminateProcess
push edi
call sub.kernel32.dll_CloseHandle_1
jmp 0x4afc31
cmp byte [0x4bc69c], 0
je 0x4afbee
push 0x43
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00410778
push eax
call sub.user32.dll_SetWindowPos
mov eax, 0x14
call fcn.004572d8
push 0
push 0
push 0x10
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00410778
push eax
call sub.user32.dll_PostMessageA
cmp byte [0x4bc69c], 0
je 0x4afc31
mov eax, 0x14
call fcn.004572d8
push 0
push 0
push 0
push 0x59
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x59
call sub.user32.dll_keybd_event
cmp dword [0x4bc494], 0
je case.0x4af93d.0
push 0
push 0x4affe4
lea eax, [ebp - 0xd8]
mov edx, dword [0x4bc754]
mov edx, dword [edx]
mov edx, dword [edx + 0xb8]
call fcn.00403d7c
lea eax, [ebp - 0xd8]
mov edx, dword [0x4bc52c]
call fcn.00403e4c
mov eax, dword [ebp - 0xd8]
call fcn.00404008
push eax
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, dword [0x4c92fc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4afea4
push 0x7f
lea eax, [ebp - 0xb4]
push eax
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00410778
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x4afea4
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xb4]
mov ecx, 0x80
call fcn.00403df4
mov eax, dword [0x4c92fc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4afea4
inc eax
mov dword [ebp - 0x34], eax
xor ebx, ebx
lea eax, [ebp - 0xdc]
push eax
lea ecx, [ebp - 0xe0]
mov edx, ebx
mov eax, dword [0x4c92fc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xe0]
mov ecx, 0x400
mov edx, 4
call fcn.0040404c
mov edx, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x14]
call fcn.00403f54
jne case.0x4afd67.0
test ebx, ebx
jne 0x4afd35
or edx, 0xffffffff
mov eax, dword [ebp - 0x10]
call fcn.00408dbc
inc eax
je 0x4afea4
lea ecx, [ebp - 0xe4]
mov edx, ebx
mov eax, dword [0x4c92fc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xe4]
movzx eax, byte [eax + 1]
sub eax, 0x30
mov dword [0x4c9524], eax
mov eax, dword [0x4c9524]
cmp eax, 7
ja case.0x4afd67.0
jmp dword [eax*4 + 0x4afd6e]
mov eax, dword [0x4bcca0]
mov edx, dword [eax + 4]
mov eax, dword [eax]
cmp edx, dword [0x4bc3e4]
jne 0x4afdae
cmp eax, dword [0x4bc3e0]
jae case.0x4afd67.0
jmp 0x4afdb4
jge case.0x4afd67.0
lea eax, [ebp - 0xe8]
mov edx, dword [0x4bc754]
mov edx, dword [edx]
mov edx, dword [edx + 0x74]
call fcn.00403d7c
mov ecx, dword [ebp - 0xe8]
mov dx, word [0x4affe0]
mov al, 1
call fcn.00491870
jmp case.0x4afd67.0
mov edx, 5
mov eax, dword [0x4c9494]
call fcn.004b3964
jmp case.0x4afd67.0
mov eax, dword [ebp - 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov edi, eax
mov eax, edi
xor edx, edx
cmp edx, 0xffffffff
jne 0x4afe12
cmp eax, 0xffffffff
je 0x4afe28
test edi, edi
je 0x4afe28
push 0x31
push edi
call sub.kernel32.dll_TerminateProcess
push edi
call sub.kernel32.dll_CloseHandle_1
jmp case.0x4afd67.0
cmp byte [0x4bc69c], 0
je 0x4afe57
push 0x43
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00410778
push eax
call sub.user32.dll_SetWindowPos
mov eax, 0x14
call fcn.004572d8
push 0
push 0
push 0x10
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00410778
push eax
call sub.user32.dll_PostMessageA
cmp byte [0x4bc69c], 0
je case.0x4afd67.0
mov eax, 0x14
call fcn.004572d8
push 0
push 0
push 0
push 0x59
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x59
call sub.user32.dll_keybd_event
inc ebx
dec dword [ebp - 0x34]
jne 0x4afcdd
inc esi
dec dword [ebp - 0x30]
jne 0x4af721
cmp dword [ebp - 0x18], 0
jne 0x4afebe
mov eax, 0x4bc52c
call fcn.00403bc4
mov eax, dword [ebp - 0xc]
call fcn.00402e9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aff05
lea eax, [ebp - 0xe8]
mov edx, 9
call fcn.00403be8
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00403be8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403be8
ret