Function at 0x45fdf3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6e95
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x4da064]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x280], edi
xor esi, esi
mov dword [ebp - 0x298], esi
mov dword [ebp - 4], esi
mov eax, dword [edi]
cmp dword [eax - 0xc], esi
jne 0x45f38c
lea eax, [ebp - 0x288]
push eax
call fcn.00462b40
mov byte [ebp - 4], 1
lea esi, [edi + 0xc]
push eax
mov ecx, esi
call fcn.00407fe0
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x288]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45f338
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x148
call fcn.004765fa
add esp, 4
mov dword [ebp - 0x290], eax
mov byte [ebp - 4], 3
mov ecx, eax
push esi
call fcn.0043e870
mov esi, eax
mov byte [ebp - 4], 0
mov ecx, esi
mov dword [ebp - 0x298], esi
call fcn.0043ed00
mov dword [ebp - 0x278], eax
test eax, eax
jne 0x46010b
mov eax, dword [esi + 0x40]
lea ecx, [esi + 0x40]
cmp dword [eax - 0xc], 0
je 0x45f38c
push ecx
mov ecx, edi
call fcn.00407fe0
push 0x18
push str.caphyon_advinst_updater:
lea ecx, [edi + 0x17c]
call fcn.00407090
push 5
push str._Link
lea ecx, [edi + 0x17c]
call fcn.00402030
mov edi, dword [ebp - 0x280]
mov ecx, edi
call fcn.004631a0
mov dword [ebp - 0x278], eax
test eax, eax
jne 0x46010b
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x45f3f9
cmp ecx, 1
je 0x45f3f9
cmp ecx, 2
je 0x45f3f9
cmp ecx, 3
je 0x45f3f9
cmp ecx, 0xb
je 0x45f3f9
cmp ecx, 4
je 0x45f3f9
mov eax, dword [edi + 0xc]
cmp dword [eax - 0xc], 0
je 0x45f3f9
cmp ecx, 0xa
jne 0x45f434
lea eax, [ebp - 0x288]
push eax
call fcn.00462b40
mov byte [ebp - 4], 4
lea ecx, [edi + 0xc]
push eax
call fcn.00407fe0
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x288]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45f434
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x45f4a2
push 0x148
call fcn.004765fa
add esp, 4
mov dword [ebp - 0x290], eax
mov byte [ebp - 4], 6
lea ecx, [edi + 0xc]
push ecx
mov ecx, eax
call fcn.0043e870
mov esi, eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x298], esi
lea ecx, [edi + 0x14]
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
je 0x45f48d
push ecx
lea ecx, [esi + 0x90]
call fcn.00407fe0
mov eax, dword [edi + 0x14]
cmp dword [eax - 0xc], 0
je 0x45f48d
mov byte [esi + 0xd8], 1
mov ecx, esi
call fcn.0043ed00
mov dword [ebp - 0x278], eax
test eax, eax
jg 0x46010b
mov eax, dword [edi + 4]
test eax, eax
je 0x45f4c6
cmp eax, 1
je 0x45f4c6
cmp eax, 2
je 0x45f4c6
cmp eax, 3
je 0x45f4c6
cmp eax, 4
je 0x45f4c6
cmp eax, 0xb
jne 0x45f5c6
call fcn.004039e0
mov ecx, eax
test ecx, ecx
je 0x460156
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x284], eax
mov byte [ebp - 4], 8
lea eax, [ebp - 0x284]
push dword [esi]
push str.SoftwareCaphyonAdvanced_Updater_s
push eax
call fcn.00407380
mov edi, dword [ebp - 0x284]
lea eax, [ebp - 0x28c]
add esp, 0xc
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x45f52d
jmp 0x45f5a4
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [0x4db390]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x290]
push eax
push 0
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x45f598
push 4
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x27c], 0
push eax
push 4
push 0
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
or eax, 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x45f5c0
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x280]
lea eax, [edi + 0x8c]
push eax
lea ecx, [esi + 0x5c]
call fcn.00407fe0
lea eax, [edi + 0x90]
push eax
lea ecx, [esi + 0x60]
call fcn.00407fe0
lea eax, [edi + 0x94]
push eax
lea ecx, [esi + 0x64]
call fcn.00407fe0
lea eax, [edi + 0x98]
push eax
lea ecx, [esi + 0x68]
call fcn.00407fe0
mov eax, dword [edi + 0xa0]
lea ecx, [edi + 0xa0]
cmp dword [eax - 0xc], 0
je 0x45f627
cmp dword [esi + 8], 0
jle 0x460160
push ecx
mov ecx, dword [esi + 4]
call fcn.00407fe0
push esi
mov ecx, edi
call fcn.00465d40
mov al, byte [edi + 0x11c]
lea ecx, [esi + 0x94]
mov byte [esi + 0x84], al
mov al, byte [edi + 0x11d]
mov byte [esi + 0x85], al
lea eax, [edi + 0x160]
push eax
call fcn.00407fe0
mov al, byte [edi + 0x168]
lea ecx, [esi + 0x98]
mov byte [esi + 0x9c], al
lea eax, [edi + 0x164]
push eax
call fcn.00407fe0
mov al, byte [edi + 0x16a]
lea ecx, [edi + 0x170]
mov byte [esi + 0x86], al
mov al, byte [edi + 0x16b]
mov byte [esi + 0x87], al
mov al, byte [edi + 0x16d]
mov byte [esi + 0x88], al
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
je 0x45f6b2
push ecx
lea ecx, [esi + 0x48]
call fcn.00407fe0
lea eax, [esi + 0x18]
push eax
lea ecx, [ebp - 0x29c]
mov dword [ebp - 0x288], eax
call fcn.00402250
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x294]
call fcn.00402250
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x294]
call fcn.0040ca90
push 0xb
push str.updater.log
lea ecx, [ebp - 0x294]
call fcn.00402030
mov eax, dword [esi + 0xdc]
mov dword [ebp - 0x27c], eax
test eax, eax
je 0x45f76a
mov eax, dword [ebp - 0x29c]
mov edx, dword [eax - 0xc]
cmp edx, 2
jb 0x45f76a
test edx, edx
js 0x46016c
cmp word [eax], 0x5c
jne 0x45f73e
cmp edx, 1
jl 0x46016c
movzx ecx, word [eax + 2]
cmp ecx, 0x5c
jne 0x45f747
jmp 0x45f750
cmp edx, 1
jl 0x46016c
movzx ecx, word [eax + 2]
cmp ecx, 0x3a
jne 0x45f76a
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45f76a
push ecx
lea ecx, [ebp - 0x294]
call fcn.0040d510
add esp, 4
call fcn.004262e0
lea ecx, [ebp - 0x294]
push ecx
mov ecx, eax
call fcn.00426450
call fcn.004262e0
mov esi, eax
mov byte [ebp - 0x2a8], 0
mov dword [ebp - 0x2ac], esi
mov cl, byte [esi + 0x18]
test cl, cl
jne 0x45f7a6
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, 1
lea ecx, [esi + 0x18]
xchg byte [ecx], al
push dword [ebp - 0x2ac]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x27c], 0
setne al
mov byte [esi + 0x1c], al
mov byte [ebp - 4], 0xc
mov al, byte [ebp - 0x2a8]
test al, al
jne 0x45f7e7
push dword [ebp - 0x2ac]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
lea ecx, [ebp - 0x2a8]
xchg byte [ecx], al
call fcn.004262e0
mov esi, eax
mov byte [ebp - 0x2b0], 0
mov dword [ebp - 0x2b4], esi
mov cl, byte [esi + 0x18]
test cl, cl
jne 0x45f810
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, 1
lea ecx, [esi + 0x18]
xchg byte [ecx], al
push dword [ebp - 0x2b4]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x27c]
mov dword [esi + 0x20], eax
mov byte [ebp - 4], 0xc
mov al, byte [ebp - 0x2b0]
test al, al
jne 0x45f84d
push dword [ebp - 0x2b4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
lea ecx, [ebp - 0x2b0]
xchg byte [ecx], al
call fcn.004262e0
cmp byte [eax + 0x1c], 0
je 0x45f94b
call fcn.004262e0
test byte [eax + 0x20], 8
je 0x45f94b
call fcn.004262e0
mov esi, eax
call fcn.004039e0
test eax, eax
je 0x460156
mov edx, dword [eax]
mov ecx, eax
mov edx, dword [edx + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x284], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x284]
push 0x17
push str.Running_updater._Mode:
call fcn.00402030
push dword [edi + 4]
lea ecx, [ebp - 0x284]
call fcn.00425f50
mov dword [ebp - 0x27c], eax
call fcn.004039e0
test eax, eax
je 0x460156
mov edx, dword [eax]
mov ecx, eax
mov edx, dword [edx + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x28c], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x28c]
push 0
push 0x4bb6d8
call fcn.00402030
push ecx
push dword [ebp - 0x27c]
lea eax, [ebp - 0x28c]
push ecx
push eax
mov ecx, esi
call fcn.00426590
mov byte [ebp - 4], 0x11
or esi, 0xffffffff
mov edx, dword [ebp - 0x28c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45f92a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
mov eax, esi
mov edx, dword [ebp - 0x284]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45f94b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 4]
mov esi, dword [ebp - 0x298]
cmp eax, 0x15
ja case.0x45f964.5
movzx eax, byte [eax + 0x4601b8]
jmp dword [eax*4 + 0x460180]
cmp byte [edi + 0x168], 0
je 0x45f988
mov eax, dword [edi + 0x160]
cmp dword [eax - 0xc], 0
je 0x45f988
push esi
mov ecx, edi
call fcn.004601d0
push esi
mov ecx, edi
call fcn.00460350
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x45fe65
mov eax, dword [ebp - 0x288]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x45fae5
cmp dword [esi + 8], 0
je 0x45fae5
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x45fae5
mov eax, dword [esi + 0x14]
cmp dword [eax - 0xc], 0
je 0x45fae5
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0x2c0], 0
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x2bc], esi
mov byte [ebp - 0x2b8], 0
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x2c8]
push dword [edi + 4]
lea ecx, [ebp - 0x240]
push eax
push esi
lea eax, [edi + 0x18]
push eax
call fcn.0043b230
mov byte [ebp - 4], 0x1b
lea ecx, [edi + 0xa8]
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
je 0x45fa3d
push ecx
lea ecx, [ebp - 0x224]
call fcn.00407fe0
mov cl, byte [edi + 0x169]
movzx edx, byte [ebp - 0x228]
test cl, cl
movzx eax, cl
lea ecx, [ebp - 0x240]
push 0
cmovne edx, eax
push 0
mov byte [ebp - 0x228], dl
call fcn.0043b2e0
mov dword [ebp - 0x278], eax
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x224]
mov dword [ebp - 0x27c], eax
mov byte [ebp - 4], 0x1c
or eax, 0xffffffff
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45fa9f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x234]
mov dword [ebp - 0x27c], eax
mov byte [ebp - 4], 0x1a
or eax, 0xffffffff
mov edx, dword [ebp - 0x234]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45fad1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2c8]
call fcn.00431e30
jmp case.0x45f964.5
mov ecx, 0xe0000007
mov dword [ebp - 0x278], ecx
jmp 0x45fe65
cmp byte [edi + 0x168], 0
je 0x45fb12
mov eax, dword [edi + 0x160]
cmp dword [eax - 0xc], 0
je 0x45fb12
push esi
mov ecx, edi
call fcn.004601d0
push esi
mov ecx, edi
call fcn.00460670
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x45fe65
sub esp, 8
lea ecx, [ebp - 0x274]
push esi
call fcn.00470b90
mov byte [ebp - 4], 0x21
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x27c], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [edi + 0x84]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x45fb6e
mov eax, dword [edi + 0x84]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x260]
test eax, eax
jne 0x45fb91
call fcn.00474ac6
mov dword [ebp - 0x260], eax
test eax, eax
jne 0x45fb91
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x45fbc9
push 0
push 0
push eax
call fcn.00474bc8
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.00432d90
push 0
push 0x43abe0
push dword [ebp - 0x27c]
push 0x69
push dword [0x4db394]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x274]
call fcn.004474d0
xor ecx, ecx
mov dword [ebp - 0x278], ecx
jmp 0x45fe65
push esi
mov ecx, edi
call fcn.00460ac0
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x45fe65
push esi
mov ecx, edi
call fcn.00460d70
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x45fe65
push esi
mov ecx, edi
call fcn.00461c30
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x45fe65
push esi
mov ecx, edi
call fcn.00461ee0
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x45fe65
mov dword [edi + 0x148], esi
lea ecx, [edi + 0x120]
push dword [edi + 0x178]
call fcn.0044f3a0
test al, al
je 0x45fc8a
lea ecx, [edi + 0x120]
call fcn.0044e890
test al, al
je 0x45fc8a
lea ecx, [edi + 0x120]
call fcn.0044ef10
test al, al
je 0x45fc8a
lea ecx, [edi + 0x120]
call fcn.0044e0f0
xor ecx, ecx
mov dword [ebp - 0x278], ecx
jmp 0x45fe65
mov ecx, 0xe000000b
mov dword [ebp - 0x278], ecx
jmp 0x45fe65
mov eax, dword [edi + 0x14c]
mov dword [ebp - 0x2c0], 0x4bc014
mov dword [ebp - fcn.00418330], 0x4bc008
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x248], 0x4bc8f8
mov dword [ebp - 0x244], 0
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0x220], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x2bc]
movq qword [ebp - 0x230], xmm0
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x248]
movups xmmword [ebp - 0x240], xmm0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [0x4dc2e4], eax
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x27c]
push eax
push 0x60000
push 0xf003f
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x27c], 0
call fcn.0041d670
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x284], eax
cmp eax, ecx
je 0x45fd70
mov edx, dword [ebp - 0x248]
lea ecx, [ebp - 0x248]
call dword [edx + 4]
mov ecx, dword [ebp - 0x284]
mov dword [ebp - 0x244], ecx
test ecx, ecx
jne 0x45fdb6
mov ecx, dword [ebp - 0x27c]
mov dword [ebp - 0x278], ecx
test ecx, ecx
je 0x45fdb6
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x248], 0x4bc8f8
test eax, eax
je 0x45fe65
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x244], 0
jmp case.0x45f964.5
lea eax, [ebp - 0x248]
push eax
call fcn.00461fa0
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x45fd84
push esi
mov ecx, edi
call fcn.00462170
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x45fe65
push esi
mov ecx, edi
call fcn.00462670
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x45fe65
mov eax, dword [edi + 0x180]
xorps xmm0, xmm0
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x254]
push eax
movlpd qword [ebp - 0x250], xmm0
movlpd qword [ebp - 0x240], xmm0
movlpd qword [ebp - 0x234], xmm0
movlpd qword [ebp - 0x22c], xmm0
movlpd qword [ebp - 0x224], xmm0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x254], 0x3c
mov dword [ebp - 0x238], 1
mov dword [ebp - 0x248], str.open
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 0x278]
mov eax, dword [edi + 0x160]
cmp dword [eax - 0xc], 0
je 0x45fe99
cmp byte [edi + 0x168], 0
jne 0x45fe99
cmp byte [edi + 0x15c], 0
jne 0x45fe8b
test ecx, ecx
je 0x4600c7
push esi
mov ecx, edi
call fcn.004601d0
mov ecx, dword [ebp - 0x278]
test ecx, ecx
je 0x4600c7
cmp ecx, 0xe0000011
je 0x4600c7
cmp ecx, 0xe0000027
je 0x4600c7
cmp ecx, 0xe0000008
je 0x4600c7
cmp ecx, 0x4c7
je 0x4600c7
cmp ecx, 0x642
je 0x4600c7
cmp ecx, 0xe0000029
je 0x4600c7
cmp dword [edi + 4], 0
jne 0x4600c7
cmp byte [edi + 0xa4], 0
jne 0x4600c7
call fcn.004039e0
mov ecx, eax
test ecx, ecx
je 0x460176
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 4], 0x27
lea edx, [ebp - 0x2a4]
mov ecx, dword [ebp - 0x278]
call fcn.0043ae40
mov edx, 0x8e
lea ecx, [ebp - 0x280]
call fcn.00408ad0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x280]
push 3
push 0x4c1554
call fcn.00402030
mov edi, dword [ebp - 0x2a4]
lea ecx, [ebp - 0x280]
push dword [edi - 0xc]
push edi
call fcn.00402030
mov eax, dword [ebp - 0x278]
add eax, 0xffffd120
cmp eax, 0xaf
ja 0x46001f
mov eax, dword [esi + 0x144]
mov dword [ebp - 0x27c], eax
cmp dword [eax - 0xc], 0
je 0x46001f
mov edx, 0x43a
lea ecx, [ebp - 0x290]
call fcn.00408ad0
mov byte [ebp - 4], 0x29
push dword [ebp - 0x27c]
push dword [eax]
lea eax, [ebp - 0x2a0]
push eax
call fcn.00402300
add esp, 0xc
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x280]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00402030
mov byte [ebp - 4], 0x29
or eax, 0xffffffff
mov edx, dword [ebp - 0x2a0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45fffd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x28
or eax, 0xffffffff
mov edx, dword [ebp - 0x290]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46001f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esi + 0x34]
push eax
lea ecx, [ebp - 0x288]
call fcn.00402250
mov byte [ebp - 4], 0x2e
call dword [sym.imp.USER32.dll_GetActiveWindow]
push ecx
mov ecx, dword [ebp - 0x288]
mov edx, 0x10
mov dword [ebp - 0x290], eax
mov eax, esp
push ecx
mov dword [eax], ecx
mov ecx, esp
mov eax, dword [ebp - 0x280]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x290]
call fcn.0041c370
add esp, 8
mov byte [ebp - 4], 0x28
or eax, 0xffffffff
mov edx, dword [ebp - 0x288]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x460089
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x27
or eax, 0xffffffff
mov edx, dword [ebp - 0x280]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4600ab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4600c7
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
or eax, 0xffffffff
mov edx, dword [ebp - 0x294]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4600e9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x29c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46010b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x46012b
mov ecx, esi
call fcn.00466410
push 0x148
push esi
call fcn.004765ec
add esp, 8
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x298], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047615e
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402150
push 1
push 0xc000008c
call fcn.00408180
push 0x80070057
call fcn.00402150
push 0x80004005
call fcn.00402150
imul edi, ecx, 0x45
add ch, dh
cli
inc ebp
add byte [edi], ah
sti
inc ebp
add ch, ah
sti
inc ebp
add dl, bh
sti
inc ebp
add byte [edi], cl
cld
inc ebp
add byte [ebp + 0x240045f9], bl
cld
inc ebp
add byte [edx + 0x390045fc], bl
cld
inc ebp
add ah, cl
std
inc ebp
add cl, ah
std
inc ebp
add bl, dh
std
inc ebp
add byte [edi - 2], bl
inc ebp
add byte [eax], al
add dword [ecx], eax
add dword [edx], eax
or eax, 67372035
add eax, 117900806
pop es
or byte [edi], al
or dword [edx], ecx
or ecx, dword [esp + ecx*8]
int3