Function at 0x4dac80
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
xor edx, edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00405388
xor eax, eax
push ebp
push 0x4daf79
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
push ebp
push 0x4daf31
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x533688]
push dword [eax]
push 0x4daf90
push dword [ebp - 8]
push 0x4dafa0
push dword [ebp - 8]
push 0x4dafac
lea eax, [ebp - 0x10]
mov edx, 6
call fcn.00405258
mov eax, dword [ebp - 0x10]
call fcn.0040a36c
test al, al
je 0x4dadb8
xor eax, eax
push ebp
push 0x4dadb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x43be08]
call fcn.0043beb8
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4dafbc
mov edx, 0x4dafd0
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx]
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4dafe0
mov edx, 0x4dafd0
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx]
mov eax, dword [0x533688]
push dword [eax]
push 0x4daf90
push dword [ebp - 8]
push 0x4dafa0
push dword [ebp - 0x18]
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00405258
mov eax, dword [0x533688]
push dword [eax]
push 0x4daf90
push dword [ebp - 8]
push 0x4dafa0
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00405258
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dae0a
mov eax, dword [ebp - 0x14]
call fcn.00403f6c
ret
mov eax, dword [0x533688]
push dword [eax]
push 0x4daf90
push dword [ebp - 8]
push 0x4dafa0
push dword [ebp - 8]
push 0x4daff4
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00405258
mov eax, dword [0x533688]
push dword [eax]
push 0x4daf90
push dword [ebp - 8]
push 0x4dafa0
push dword [ebp - 8]
push 0x4db008
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00405258
cmp dword [ebp - 0x1c], 0
je 0x4dae37
mov eax, dword [ebp - 0x1c]
call fcn.0040a36c
test al, al
je 0x4dae37
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 0x1c]
call fcn.00405774
mov eax, dword [ebp - 0x11c]
xor edx, edx
call fcn.004d8648
cmp dword [ebp - 0x18], 0
je 0x4daf23
mov eax, dword [ebp - 0x18]
call fcn.0040a36c
test al, al
je 0x4daf23
push 0
push 0x4db01c
push dword [ebp - 0x18]
push 0x4db084
lea eax, [ebp - 0x120]
mov edx, 3
call fcn.00405258
mov eax, dword [ebp - 0x120]
call fcn.00405398
push eax
call sub.kernel32.dll_WinExec
push 2
call sub.kernel32.dll_Sleep_1
push 0x4db088
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
push 0xffffffffffffffff
push 0xe10
push 0xdac
push 0xbb8
push 0xbb8
push ebx
call sub.user32.dll_MoveWindow
push 0x4db094
push 0x4db09c
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0xfb
lea eax, [ebp - 0x117]
push eax
push ebx
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x117]
push eax
push 0xfb
push 0xd
push ebx
call sub.user32.dll_SendMessageA
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
movzx eax, word [ebp - 2]
push eax
push 1
push 0x201
push ebx
call sub.user32.dll_SendMessageA
movzx eax, word [ebp - 2]
push eax
push 1
push 0x202
push ebx
call sub.user32.dll_SendMessageA
push 2
call sub.kernel32.dll_Sleep_1
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4daf38
ret