Function at 0x415810
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447b56
mov eax, dword fs:[0]
push eax
sub esp, 0x4a4
mov eax, dword [0x465074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], 0xfffffff4
jne 0x416aa0
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x18b
je 0x415910
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x188
je 0x415910
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x187
je 0x415910
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x17a
je 0x415910
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x179
je 0x415910
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x178
je 0x415910
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x186
je 0x415910
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x185
je 0x415910
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x184
je 0x415910
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x177
je 0x415910
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x176
je 0x415910
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x175
je 0x415910
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x182
je 0x415910
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x181
je 0x415910
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x17b
jne 0x416a5d
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x444], ecx
mov edx, dword [ebp - 0x444]
cmp dword [edx + 0xc], 1
jne 0x416a5b
push 1
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_SetBkMode]
mov edx, dword [0x4663a8]
push edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x28]
and eax, 1
je 0x415f08
push 0
push 0
push 6
call dword [sym.imp.GDI32.dll_CreatePen]
mov dword [ebp - 0x460], eax
mov ecx, dword [ebp - 0x460]
push ecx
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x478], eax
mov ecx, dword [ebp - 0x444]
push ecx
push 0
push 0x998877
call fcn.004084f0
add esp, 0xc
push eax
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x47c], eax
push 0
push 0
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x20]
push edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_RoundRect]
push 0xdedede
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x18b
jne 0x415a40
push 0x25
mov edx, dword [ebp - 0x444]
add edx, 0x14
push edx
push 0xffffffffffffffff
push str.Options
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x188
jne 0x415a6f
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push str.System
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x187
jne 0x415a9e
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push str.Security
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x186
jne 0x415acd
push 0x25
mov edx, dword [ebp - 0x444]
add edx, 0x14
push edx
push 0xffffffffffffffff
push str.Debug
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x185
jne 0x415afc
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push str.Restart
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x184
jne 0x415b2b
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push str.Shut
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x17b
jne 0x415b99
push 0
push 0
push 0xf0
mov edx, dword [0x466a48]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x415b76
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push str.Export
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x415b99
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push str.Import
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x182
jne 0x415bc8
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x4535a8
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x181
jne 0x415bf7
push 0x25
mov edx, dword [ebp - 0x444]
add edx, 0x14
push edx
push 0xffffffffffffffff
push str.Privacy
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x17a
jne 0x415c26
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x449510
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x179
jne 0x415c55
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x4495e0
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x178
jne 0x415d23
push 0
push 0
push 0xf0
mov edx, dword [0x466a48]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x415cd2
cmp dword [0x465fa0], 0
je 0x415cad
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x449628
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x415cd0
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44964c
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x415d23
cmp dword [0x465f98], 0
je 0x415d00
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x449690
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x415d23
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x4496a4
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x177
jne 0x415d52
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x4496cc
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x175
jne 0x415e53
push 0
push 0
push 0xf0
mov edx, dword [0x466a48]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x415dd2
cmp dword [0x465f58], 0
je 0x415daa
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44973c
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x415dcd
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x449764
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x415e53
call fcn.00426970
cmp eax, 2
jne 0x415e01
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x4497e0
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x415e53
call fcn.00426970
cmp eax, 1
jne 0x415e30
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44987c
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x415e53
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x4498f0
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x176
jne 0x415ec1
push 0
push 0
push 0xf0
mov ecx, dword [0x466a48]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x415e9e
push 0x25
mov edx, dword [ebp - 0x444]
add edx, 0x14
push edx
push 0xffffffffffffffff
push 0x449a7c
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x415ec1
push 0x25
mov edx, dword [ebp - 0x444]
add edx, 0x14
push edx
push 0xffffffffffffffff
push 0x449a8c
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
mov edx, dword [ebp - 0x478]
push edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp - 0x47c]
push edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp - 0x460]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
jmp 0x416f5f
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x28]
and ecx, 0x40
je 0x4164b9
push 0x8b3d48
push 0
push 6
call dword [sym.imp.GDI32.dll_CreatePen]
mov dword [ebp - 0x464], eax
mov edx, dword [ebp - 0x464]
push edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x480], eax
mov edx, dword [ebp - 0x444]
push edx
push 0xe6bb2b
push 0x8b3d48
call fcn.004084f0
add esp, 0xc
push eax
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x484], eax
push 0
push 0
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x20]
push eax
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.GDI32.dll_RoundRect]
push 0
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x18b
jne 0x415ff9
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x449bc4
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x188
jne 0x416028
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x449c5c
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x187
jne 0x416057
push 0x25
mov edx, dword [ebp - 0x444]
add edx, 0x14
push edx
push 0xffffffffffffffff
push 0x449cbc
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x186
jne 0x416086
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x449e04
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x185
jne 0x4160b5
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x449ef8
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x184
jne 0x4160e4
push 0x25
mov edx, dword [ebp - 0x444]
add edx, 0x14
push edx
push 0xffffffffffffffff
push 0x449fbc
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x17b
jne 0x416151
push 0
push 0
push 0xf0
mov eax, dword [0x466a48]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41612e
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x44a11c
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x416151
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x44a134
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x182
jne 0x416180
push 0x25
mov edx, dword [ebp - 0x444]
add edx, 0x14
push edx
push 0xffffffffffffffff
push 0x44a1fc
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x181
jne 0x4161af
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44a320
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x17a
jne 0x4161de
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x44a3f4
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x179
jne 0x41620d
push 0x25
mov edx, dword [ebp - 0x444]
add edx, 0x14
push edx
push 0xffffffffffffffff
push 0x44a4e8
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x178
jne 0x4162da
push 0
push 0
push 0xf0
mov eax, dword [0x466a48]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x416289
cmp dword [0x465fa0], 0
je 0x416264
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x44a7d8
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x416287
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x44a898
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x4162da
cmp dword [0x465f98], 0
je 0x4162b7
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x44a9c4
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x4162da
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x44aaac
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x177
jne 0x416309
push 0x25
mov edx, dword [ebp - 0x444]
add edx, 0x14
push edx
push 0xffffffffffffffff
push 0x44ab80
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x175
jne 0x416409
push 0
push 0
push 0xf0
mov eax, dword [0x466a48]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x416388
cmp dword [0x465f58], 0
je 0x416360
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x44ae58
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x416383
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x44af14
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x416409
call fcn.00426970
cmp eax, 2
jne 0x4163b7
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x44b1b8
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x416409
call fcn.00426970
cmp eax, 1
jne 0x4163e6
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push str.Update
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x416409
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x44b380
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x176
jne 0x416477
push 0
push 0
push 0xf0
mov edx, dword [0x466a48]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x416454
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44b5a0
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x416477
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44b608
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp - 0x480]
push eax
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0x484]
push eax
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0x464]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
jmp 0x416f5f
push 0x404040
push 0
push 6
call dword [sym.imp.GDI32.dll_CreatePen]
mov dword [ebp - 0x468], eax
mov ecx, dword [ebp - 0x468]
push ecx
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x488], eax
mov ecx, dword [ebp - 0x444]
push ecx
push 0
push 0x998877
call fcn.004084f0
add esp, 0xc
push eax
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x48c], eax
push 0
push 0
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x20]
push edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_RoundRect]
push 0xdedede
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x18b
jne 0x416598
push 0x25
mov edx, dword [ebp - 0x444]
add edx, 0x14
push edx
push 0xffffffffffffffff
push 0x44b6ec
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x188
jne 0x4165c7
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44b7fc
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x187
jne 0x4165f6
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x44b908
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x186
jne 0x416625
push 0x25
mov edx, dword [ebp - 0x444]
add edx, 0x14
push edx
push 0xffffffffffffffff
push 0x44b9d8
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x185
jne 0x416654
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44bab8
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x184
jne 0x416683
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x44bbb8
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x17b
jne 0x4166f1
push 0
push 0
push 0xf0
mov edx, dword [0x466a48]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4166ce
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44bdd0
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x4166f1
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44be8c
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x182
jne 0x416720
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x44bfa4
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x181
jne 0x41674f
push 0x25
mov edx, dword [ebp - 0x444]
add edx, 0x14
push edx
push 0xffffffffffffffff
push 0x44c0d8
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0x17a
jne 0x41677e
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push str.Start
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x179
jne 0x4167ad
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push str.Stop
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x178
jne 0x41687b
push 0
push 0
push 0xf0
mov edx, dword [0x466a48]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41682a
cmp dword [0x465fa0], 0
je 0x416805
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44c66c
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x416828
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44c6c0
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x41687b
cmp dword [0x465f98], 0
je 0x416858
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44c7a8
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x41687b
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44c7e8
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x177
jne 0x4168aa
push 0x25
mov ecx, dword [ebp - 0x444]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
push 0x44c884
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 0x175
jne 0x4169ab
push 0
push 0
push 0xf0
mov edx, dword [0x466a48]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41692a
cmp dword [0x465f58], 0
je 0x416902
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push str.Disable
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x416925
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push str.Enable
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x4169ab
call fcn.00426970
cmp eax, 2
jne 0x416959
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push str.Install
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x4169ab
call fcn.00426970
cmp eax, 1
jne 0x416988
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44cbd0
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x4169ab
push 0x25
mov eax, dword [ebp - 0x444]
add eax, 0x14
push eax
push 0xffffffffffffffff
push 0x44cc28
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x176
jne 0x416a19
push 0
push 0
push 0xf0
mov ecx, dword [0x466a48]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4169f6
push 0x25
mov edx, dword [ebp - 0x444]
add edx, 0x14
push edx
push 0xffffffffffffffff
push 0x44cdc4
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x416a19
push 0x25
mov edx, dword [ebp - 0x444]
add edx, 0x14
push edx
push 0xffffffffffffffff
push 0x44ce28
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
mov edx, dword [ebp - 0x488]
push edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp - 0x48c]
push edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp - 0x468]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
jmp 0x416f5f
jmp 0x416a9b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44c], eax
mov ecx, dword [ebp - 0x44c]
cmp dword [ecx + 0xc], 1
jne 0x416a9b
mov edx, dword [0x4663a8]
push edx
mov eax, dword [ebp - 0x44c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
mov edx, dword [ebp - 0x44c]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x416f5d
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 8], 0xffffff94
jne 0x416df3
mov dword [ebp - 0x448], 0
push 0x44cebc
call fcn.0040d580
add esp, 4
cmp eax, 0x2bb
jne 0x416ae5
push 0x44ced0
push 0x44cf18
call fcn.004259e0
add esp, 8
mov dword [ebp - 0x448], eax
jmp 0x416b06
push str.Select_a_Folder_You_Want_to_Protect
push 0x44cf1c
call fcn.0042f6a5
add esp, 4
push eax
call fcn.004259e0
add esp, 8
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
je 0x416dee
mov edx, dword [ebp - 0x448]
push edx
call fcn.0040d580
add esp, 4
cmp eax, 0x2bb
jne 0x416dee
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x448]
push eax
lea ecx, [ebp - 0x428]
call fcn.00403550
mov dword [ebp - 4], 0
push 2
push 0
lea ecx, [ebp - 0x428]
call fcn.004224d0
push 0x44cfac
lea ecx, [ebp - 0x428]
call fcn.00421c30
test eax, eax
je 0x416c2a
mov ecx, 0x466ae8
call fcn.004220c0
movzx ecx, al
test ecx, ecx
je 0x416baf
lea edx, [ebp - 0x428]
push edx
mov ecx, 0x466ae8
call fcn.00424a60
mov dword [ebp - 0x450], 1
jmp 0x416c2a
lea eax, [ebp - 0x4a4]
push eax
mov ecx, 0x466ae8
call fcn.00422270
push eax
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 0x4a8]
push edx
mov ecx, 0x466ae8
call fcn.00422270
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x4ac]
push ecx
mov ecx, 0x466ae8
call fcn.00421770
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x4b0]
push eax
call fcn.004025c0
add esp, 0x10
mov ecx, eax
call fcn.00404f00
movzx ecx, al
test ecx, ecx
je 0x416c0f
jmp 0x416c2a
lea edx, [ebp - 0x428]
push edx
mov ecx, 0x466ae8
call fcn.00424a60
mov dword [ebp - 0x450], 1
cmp dword [ebp - 0x450], 0
je 0x416ddc
push 0
push 0
push 0x1004
mov eax, dword [0x4663f4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x4669b4], eax
mov dword [0x4669b8], 0
lea ecx, [ebp - 0x428]
call fcn.00421840
mov dword [0x4669c4], eax
push 0x4669b0
push 0
push 0x104d
mov ecx, dword [0x4663f4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x44cfd0
lea ecx, [ebp - 0x428]
call fcn.00404df0
mov dword [ebp - 0x46c], 0x466ae8
lea edx, [ebp - 0x454]
push edx
mov ecx, dword [ebp - 0x46c]
call fcn.00421770
lea eax, [ebp - 0x490]
push eax
mov ecx, dword [ebp - 0x46c]
call fcn.00422270
jmp 0x416ccf
lea ecx, [ebp - 0x454]
call fcn.004050c0
lea ecx, [ebp - 0x490]
push ecx
lea ecx, [ebp - 0x454]
call fcn.00404f00
movzx edx, al
test edx, edx
je 0x416d75
lea ecx, [ebp - 0x454]
call fcn.00405080
mov dword [ebp - 0x470], eax
mov ecx, dword [ebp - 0x470]
call fcn.00421840
push eax
call fcn.0042fb85
add esp, 4
mov ecx, dword [ebp - 0x458]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x458], edx
push 0
mov eax, dword [ebp - 0x470]
push eax
lea ecx, [ebp - 0x440]
push ecx
call fcn.004017e0
add esp, 0xc
mov dword [ebp - 0x494], eax
mov edx, dword [ebp - 0x494]
mov dword [ebp - 0x498], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x498]
push eax
lea ecx, [ebp - 0x428]
call fcn.00405180
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x440]
call fcn.004046b0
jmp 0x416cc4
mov dword [ebp - 0x45c], 0
lea ecx, [ebp - 0x45c]
push ecx
mov edx, dword [str.SYSTEMCurrentControlSetServicesCls]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x416ddc
mov eax, dword [ebp - 0x458]
push eax
lea ecx, [ebp - 0x428]
call fcn.00421840
push eax
push 7
push 0
push 0x44cfd4
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x45c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x465f74], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.004046b0
jmp 0x416f5d
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], 0xffffff99
jne 0x416e12
push 0
push 0
mov ecx, dword [0x4663f4]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x416f5d
mov edx, dword [ebp + 0xc]
cmp dword [edx + 8], 0xfffffffb
jne 0x416e85
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0xc], 0xffffffff
je 0x416e80
lea ecx, [ebp - 0x4a0]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp - 0x474], eax
push str.Remove
push 0x180
push 0x400
push 0
mov edx, dword [ebp - 0x474]
push edx
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, dword [ebp - 0x49c]
push ecx
mov edx, dword [ebp - 0x4a0]
push edx
push 0
mov eax, dword [ebp - 0x474]
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
jmp 0x416f5d
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 8], 0xfffffffd
jne 0x416f5d
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0xc], 0xffffffff
je 0x416f5d
mov ax, word [0x44cff0]
mov word [ebp - 0x410], ax
push 0x3fe
push 0
lea ecx, [ebp - 0x40e]
push ecx
call fcn.0042d590
add esp, 0xc
push 0x3c
push 0
push 0x4669b0
call fcn.0042d590
add esp, 0xc
mov dword [0x4669b0], 1
mov dword [0x4669b8], 0
lea edx, [ebp - 0x410]
mov dword [0x4669c4], edx
mov dword [0x4669c8], 0x100
push 1
push 0xffffffffffffffff
push 0x100c
mov eax, dword [0x4663f4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x4669b4], eax
push 0x4669b0
push 1
push 0xffffffffffffffff
push 0x100c
mov ecx, dword [0x4663f4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0x1073
mov edx, dword [0x4663f4]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x40
push 0x44d004
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a2fe
mov esp, ebp
pop ebp
ret