Function at 0x4ec87e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x6d70
call fcn.00401c4e
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x9d6d
jg 0x4eba5b
cmp dword [ebp - 4], 0x9d6d
je 0x4ed01f
mov edx, dword [ebp - 4]
sub edx, 0x9c41
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0xd7
ja case.default.0x4ebae7
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x4edc28]
jmp dword [ecx*4 + 0x4edba0]
cmp dword [ebp - 4], 0x9e35
jg 0x4eba91
cmp dword [ebp - 4], 0x9e35
je 0x4ed10e
mov edx, dword [ebp - 4]
sub edx, 0x9d6e
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 3
ja case.default.0x4ebae7
mov eax, dword [ebp - 4]
jmp dword [eax*4 + 0x4edd00]
cmp dword [ebp - 4], 0xa411
jg 0x4ebace
cmp dword [ebp - 4], 0xa411
je 0x4ed4fd
mov ecx, dword [ebp - 4]
sub ecx, 0xa000
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x33
ja case.default.0x4ebae7
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x4edd40]
jmp dword [eax*4 + 0x4edd10]
mov ecx, dword [ebp - 4]
sub ecx, 0xa412
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0xc
ja case.default.0x4ebae7
mov edx, dword [ebp - 4]
jmp dword [edx*4 + 0x4edd74]
mov eax, dword [ebp + 0xc]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 3
je 0x4ebb10
cmp dword [ebp - 0x34], 8
je 0x4ebb1c
jmp 0x4ebb98
mov dword [0x5fac1c], 0xa000
jmp 0x4ebb98
push 1
push 0x40
lea edx, [ebp - 0x3d4]
push edx
mov eax, dword [0x600ed4]
push eax
call fcn.004059c0
add esp, 0x10
test eax, eax
je 0x4ebb8b
lea ecx, [ebp - 0x3d4]
push ecx
push 0x60270c
call dword [sym.imp.SHLWAPI.dll_PathIsSameRootW]
test eax, eax
jne 0x4ebb8b
push 1
lea edx, [ebp - 0x3d4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040477d
add esp, 0xc
test eax, eax
jne 0x4ebb8b
push 0xc350
push 2
call fcn.0040392c
add esp, 8
push 0x60270c
mov ecx, dword [0x600ed4]
push ecx
call fcn.00405eed
add esp, 8
mov edx, dword [0x600ed0]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.default.0x4ebae7
mov dword [ebp - 0xaf4], 7
mov ax, word [0x5fe748]
mov word [ebp - 0xaf0], ax
push 0x206
push 0
lea ecx, [ebp - 0xaee]
push ecx
call fcn.00402dec
add esp, 0xc
mov dx, word [0x5fe74c]
mov word [ebp - 0x8e8], dx
push 0x206
push 0
lea eax, [ebp - 0x8e6]
push eax
call fcn.00402dec
add esp, 0xc
mov dword [ebp - 0x6e0], 0
lea ecx, [ebp - 0xaf4]
push ecx
push 0xffffffffffffffff
mov edx, dword [0x600ed0]
push edx
call fcn.00404a6b
add esp, 0xc
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
je 0x4ebc2a
cmp dword [ebp - 0x38], 2
je 0x4ebc57
jmp 0x4ebd0e
push 1
lea ecx, [ebp - 0xaf0]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040477d
add esp, 0xc
test eax, eax
jne 0x4ebc52
push 0xc350
push 2
call fcn.0040392c
add esp, 8
jmp 0x4ebd0e
call fcn.00401b0e
lea eax, [ebp - 0xaf0]
push eax
call fcn.004041d3
add esp, 4
test eax, eax
jne 0x4ebc85
push 0
lea ecx, [ebp - 0xaf0]
push ecx
call fcn.00404c19
add esp, 8
jmp 0x4ebd09
push 0x104
lea edx, [ebp - 0x2364]
push edx
lea eax, [ebp - 0xaf0]
push eax
call fcn.004037ab
add esp, 0xc
test eax, eax
je 0x4ebcfa
push 0x104
lea ecx, [ebp - 0x2364]
push ecx
call fcn.0040376f
add esp, 8
lea edx, [ebp - 0x2364]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
je 0x4ebcd6
mov eax, dword [ebp - 0x3c]
and eax, 0x10
je 0x4ebce7
lea ecx, [ebp - 0xaf0]
push ecx
call fcn.00405d8f
add esp, 4
jmp 0x4ebcf8
push 0
lea edx, [ebp - 0x2364]
push edx
call fcn.00404c19
add esp, 8
jmp 0x4ebd09
lea eax, [ebp - 0xaf0]
push eax
call fcn.00405d8f
add esp, 4
call fcn.004029d7
jmp case.default.0x4ebae7
mov dword [ebp - 0x2d94], 7
lea ecx, [ebp - 0x2d94]
push ecx
push 0xffffffffffffffff
mov edx, dword [0x600ed0]
push edx
call fcn.00404a6b
add esp, 0xc
cmp dword [ebp - 0x2980], 2
jne 0x4ebdfb
call fcn.00401b0e
lea eax, [ebp - 0x2d90]
push eax
call fcn.004041d3
add esp, 4
test eax, eax
jne 0x4ebd70
push 1
lea ecx, [ebp - 0x2d90]
push ecx
call fcn.00404c19
add esp, 8
jmp 0x4ebdf4
push 0x104
lea edx, [ebp - 0x256c]
push edx
lea eax, [ebp - 0x2d90]
push eax
call fcn.004037ab
add esp, 0xc
test eax, eax
je 0x4ebde5
push 0x104
lea ecx, [ebp - 0x256c]
push ecx
call fcn.0040376f
add esp, 8
lea edx, [ebp - 0x256c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffff
je 0x4ebdc1
mov eax, dword [ebp - 0x40]
and eax, 0x10
je 0x4ebdd2
lea ecx, [ebp - 0x2d90]
push ecx
call fcn.00405d8f
add esp, 4
jmp 0x4ebde3
push 1
lea edx, [ebp - 0x256c]
push edx
call fcn.00404c19
add esp, 8
jmp 0x4ebdf4
lea eax, [ebp - 0x2d90]
push eax
call fcn.00405d8f
add esp, 4
call fcn.004029d7
jmp 0x4ebe03
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp case.default.0x4ebae7
mov ecx, dword [ebp + 8]
push ecx
call fcn.004027ca
add esp, 4
jmp case.default.0x4ebae7
mov edx, dword [0x600ed0]
push edx
call fcn.0040435e
add esp, 4
test eax, eax
jne 0x4ebe3b
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
jmp 0x4edb9a
mov dword [ebp - 0x6128], 1
lea eax, [ebp - 0x6128]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x600ed0]
push ecx
call fcn.00404a6b
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4ebe67
jmp case.default.0x4ebae7
push 0x3c
push 0
lea edx, [ebp - 0x110]
push edx
call fcn.00402dec
add esp, 0xc
mov dword [ebp - 0x110], 0x3c
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], 0
lea ecx, [ebp - 0x6124]
mov dword [ebp - 0x100], ecx
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0x60270c
mov dword [ebp - 0xf4], 1
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.default.0x4ebae7
push 0x208
push 0
lea eax, [ebp - 0x130c]
push eax
call fcn.00402dec
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0xefc]
push ecx
call fcn.00402dec
add esp, 0xc
mov edx, dword [0x600ed0]
push edx
call fcn.0040435e
add esp, 4
test eax, eax
jne 0x4ebf2b
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
jmp 0x4edb9a
mov dword [ebp - 0x42b0], 1
lea eax, [ebp - 0x42b0]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x600ed0]
push ecx
call fcn.00404a6b
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4ebf57
jmp case.default.0x4ebae7
lea edx, [ebp - 0x42ac]
push edx
call fcn.004041d3
add esp, 4
test eax, eax
je 0x4ebfa4
push 0x104
lea eax, [ebp - 0xefc]
push eax
lea ecx, [ebp - 0x42ac]
push ecx
call fcn.004037ab
add esp, 0xc
test eax, eax
je 0x4ebfa4
push 0x104
lea edx, [ebp - 0xefc]
push edx
lea eax, [ebp - 0xefc]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
jmp 0x4ebfbd
push 0x104
lea ecx, [ebp - 0xefc]
push ecx
lea edx, [ebp - 0x42ac]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0x602b6c
call fcn.004046fb
add esp, 4
test eax, eax
jne 0x4ebffc
push 0x104
push 0x602b6c
lea eax, [ebp - 0x130c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push 0x104
push 0x5fadfc
lea ecx, [ebp - 0x130c]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push 0x104
lea edx, [ebp - 0xefc]
push edx
lea eax, [ebp - 0x130c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push 0x3c
push 0
lea ecx, [ebp - 0x14c]
push ecx
call fcn.00402dec
add esp, 0xc
mov dword [ebp - 0x14c], 0x3c
mov dword [ebp - 0x148], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0x602964
lea eax, [ebp - 0x130c]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], 0x60270c
mov dword [ebp - 0x130], 1
lea ecx, [ebp - 0x14c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.default.0x4ebae7
push 0
push 0
push 0x1032
mov edx, dword [0x600ed0]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x4ec0b4
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
jmp 0x4edb9a
mov dword [ebp - 0x6540], 1
lea eax, [ebp - 0x6540]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x600ed0]
push ecx
call fcn.00404a6b
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4ec0e0
jmp case.default.0x4ebae7
lea edx, [ebp - 0x6540]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402b58
add esp, 8
jmp case.default.0x4ebae7
mov ecx, dword [ebp + 8]
push ecx
call fcn.00405461
add esp, 4
jmp case.default.0x4ebae7
push 0x5fe750
lea edx, [ebp - 0x1104]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x80
lea eax, [ebp - 0xbf4]
push eax
push 0x2afc
call fcn.00403797
add esp, 0xc
lea ecx, [ebp - 0xbf4]
push ecx
call fcn.00405268
add esp, 4
push 0x20
lea edx, [ebp - 0x354]
push edx
push 0x2afb
call fcn.00403797
add esp, 0xc
push 0x58
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.00402dec
add esp, 0xc
mov dword [ebp - 0x208], 0x58
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x204], ecx
lea edx, [ebp - 0xbf4]
mov dword [ebp - 0x1fc], edx
lea eax, [ebp - 0x1104]
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1e8], 0x104
lea ecx, [ebp - 0x354]
mov dword [ebp - 0x1d8], ecx
mov dword [ebp - 0x1dc], 0x60270c
mov dword [ebp - 0x1d4], 0x210080e
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
jne 0x4ec1d7
jmp case.default.0x4ebae7
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x1104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffff
je 0x4ec2bf
push 0x2b4
push 0
lea ecx, [ebp - 0x3e98]
push ecx
call fcn.00402dec
add esp, 0xc
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1104]
push eax
lea ecx, [ebp - 0x2f9c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [ebp - 0x2f9c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x2f9c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0
push 0x19d0d
push 0x111
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x200
push 0x2b4
lea edx, [ebp - 0x3e98]
push edx
push 0
lea eax, [ebp - 0x1104]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 0x1104]
push ecx
lea edx, [ebp - 0x3e8c]
push edx
mov eax, dword [0x600ed0]
push eax
call fcn.004017c6
add esp, 0xc
test eax, eax
jne 0x4ec2bd
push 0
push 0
push 0x1013
mov ecx, dword [0x600ed0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4ec2ce
push 0xc352
push 2
call fcn.0040392c
add esp, 8
jmp case.default.0x4ebae7
lea edx, [ebp - 0x52f0]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004024f5
add esp, 8
test eax, eax
je 0x4ec30c
push 0
lea ecx, [ebp - 0x52f0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4ec30c
push 0xc353
push 2
call fcn.0040392c
add esp, 8
jmp case.default.0x4ebae7
mov dword [ebp - 0x6958], 1
lea edx, [ebp - 0x6958]
push edx
push 0xffffffffffffffff
mov eax, dword [0x600ed0]
push eax
call fcn.00404a6b
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4ec33c
jmp case.default.0x4ebae7
push 0
push 0
lea ecx, [ebp - 0x54f8]
push ecx
push 0x2b02
mov edx, dword [ebp + 8]
push edx
call fcn.00405740
add esp, 0x14
test eax, eax
je 0x4ec385
lea eax, [ebp - 0x6954]
push eax
lea ecx, [ebp - 0x54f8]
push ecx
call fcn.0040514b
add esp, 8
test eax, eax
jne 0x4ec385
push 0xc35d
push 2
call fcn.0040392c
add esp, 8
jmp case.default.0x4ebae7
mov dword [ebp - 0x1c], 0
mov edx, dword [0x600ed0]
push edx
call fcn.0040435e
add esp, 4
test eax, eax
jne 0x4ec3b3
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
jmp 0x4edb9a
mov dword [ebp - 0x33b4], 7
lea eax, [ebp - 0x33b4]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x600ed0]
push ecx
call fcn.00404a6b
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4ec3df
jmp case.default.0x4ebae7
lea edx, [ebp - 0x33b0]
push edx
lea eax, [ebp - 0x1514]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x80
lea ecx, [ebp - 0xcf4]
push ecx
push 0x2afc
call fcn.00403797
add esp, 0xc
lea edx, [ebp - 0xcf4]
push edx
call fcn.00405268
add esp, 4
push 0x58
push 0
lea eax, [ebp - 0x260]
push eax
call fcn.00402dec
add esp, 0xc
mov dword [ebp - 0x260], 0x58
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
lea edx, [ebp - 0xcf4]
mov dword [ebp - 0x254], edx
lea eax, [ebp - 0x1514]
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], 0x104
mov dword [ebp - 0x22c], 0x210080e
lea ecx, [ebp - 0x260]
push ecx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
jne 0x4ec483
jmp case.default.0x4ebae7
call fcn.00401b0e
lea edx, [ebp - 0x31a8]
push edx
push 0x2713
push 0x104
lea eax, [ebp - 0x44b8]
push eax
call fcn.00404002
add esp, 0x10
lea ecx, [ebp - 0x44b8]
push ecx
push 0xff
mov edx, dword [0x5fe720]
push edx
call fcn.00403576
add esp, 0xc
push 0
push 1
push 0x409
mov eax, dword [0x5fe720]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0
mov ecx, dword [0x5fe720]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [0x5fe720]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
lea eax, [ebp - 0x1514]
push eax
lea ecx, [ebp - 0x33b0]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4ec52b
lea edx, [ebp - 0x31a8]
push edx
push 0xc354
push 2
call fcn.0040392c
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x4ec57f
cmp dword [0x602648], 0
je 0x4ec57f
lea eax, [ebp - 0x1514]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
and ecx, 1
je 0x4ec57f
mov edx, dword [ebp - 0x18]
and edx, 0xfffffffe
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1514]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x4ec57f
push 0xc355
push 2
call fcn.0040392c
add esp, 8
push 0
push 0
push 0x409
mov edx, dword [0x5fe720]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.004029d7
jmp case.default.0x4ebae7
push 0
push 0
push 0x1032
mov eax, dword [0x600ed0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4ec5cb
push 0x5fac20
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040230b
add esp, 8
jmp 0x4ec5d3
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp case.default.0x4ebae7
mov dword [ebp - 0x6d70], 7
lea edx, [ebp - 0x6d70]
push edx
push 0xffffffffffffffff
mov eax, dword [0x600ed0]
push eax
call fcn.00404a6b
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4ec607
jmp case.default.0x4ebae7
push 0x1e
push 0
lea ecx, [ebp - 0xa8]
push ecx
call fcn.00402dec
add esp, 0xc
push 0x400
push 0
lea edx, [ebp - 0x5d10]
push edx
call fcn.00402dec
add esp, 0xc
lea eax, [ebp - 0x6d6c]
push eax
lea ecx, [ebp - 0x5d10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp + 8]
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0xa4], 3
lea eax, [ebp - 0x5d10]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], 0
cmp dword [0x602674], 0
je 0x4ec696
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
movzx edx, cx
cmp edx, 0x9c4e
je 0x4ec696
mov eax, 0x40
mov word [ebp - 0x98], ax
cmp dword [0x602678], 0
jne 0x4ec6b3
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
movzx edx, cx
cmp edx, 0x9c4f
jne 0x4ec6c4
movzx eax, word [ebp - 0x98]
or eax, 0x10
mov word [ebp - 0x98], ax
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 0
mov edx, dword [0x5fd410]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4ec7ab
push 0
push 0x19d0d
push 0x111
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x14], 0
jle 0x4ec70d
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
push 0
push 0
push 0x1004
mov edx, dword [0x600ed0]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
sub eax, 1
cmp dword [ebp - 0x14], eax
jge 0x4ec733
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
jmp 0x4ec74f
push 0
push 0
push 0x1004
mov ecx, dword [0x600ed0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
sub eax, 1
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x2c8], 1
mov dword [ebp - 0x2cc], 1
lea eax, [ebp - 0x2d8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0x102b
mov edx, dword [0x600ed0]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov eax, dword [ebp - 0x14]
push eax
push 0x1013
mov ecx, dword [0x600ed0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [0x5fd410]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
jmp case.default.0x4ebae7
push 0
push 0
push 0x1032
mov eax, dword [0x600ed0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4ec7d7
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403887
add esp, 4
jmp 0x4ec7df
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp case.default.0x4ebae7
push 0
push 0
push 0x1032
mov edx, dword [0x600ed0]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x4ec808
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x4ec818
push 0xffffffffffffffff
mov eax, dword [0x600ed0]
push eax
call fcn.00404ebc
add esp, 8
jmp case.default.0x4ebae7
push 0
push 0
lea ecx, [ebp - 0x46c0]
push ecx
push 0x2afe
mov edx, dword [ebp + 8]
push edx
call fcn.00405740
add esp, 0x14
test eax, eax
je 0x4ec865
push 1
lea eax, [ebp - 0x46c0]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040477d
add esp, 0xc
test eax, eax
jne 0x4ec865
push 0xc350
push 2
call fcn.0040392c
add esp, 8
jmp case.default.0x4ebae7
mov edx, dword [0x600ed4]
push edx
call fcn.00403c33
add esp, 4
jmp case.default.0x4ebae7
push 0x104
lea eax, [ebp - 0x48c8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x60270c
lea ecx, [ebp - 0x6dc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [ebp - 0x6dc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push 0x5fb104
lea eax, [ebp - 0x6dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x5fd418
call fcn.004046fb
add esp, 4
test eax, eax
jne 0x4ec90c
push 0x5fb10c
lea ecx, [ebp - 0x6dc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x5fd418
lea edx, [ebp - 0x6dc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x5fb114
lea eax, [ebp - 0x6dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x4ec91e
push 0x5fb118
lea ecx, [ebp - 0x6dc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x5fb11c
lea edx, [ebp - 0x6dc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [ebp - 0xd4], 0x2c
lea eax, [ebp - 0xd4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 2
lea edx, [ebp - 0xb8]
push edx
call dword [sym.imp.USER32.dll_MonitorFromRect]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x1b0], 0x28
lea eax, [ebp - 0x1b0]
push eax
mov ecx, dword [ebp - 0x78]
push ecx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov edx, dword [ebp - 0xb8]
add edx, 0xa
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0xb4]
add eax, 0xa
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xb0]
sub ecx, dword [ebp - 0xb8]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0xac]
sub edx, dword [ebp - 0xb4]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x194]
jg 0x4ec9ca
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 0x190]
jle 0x4ec9dc
mov edx, dword [ebp - 0x1ac]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 0x50]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
push 0x5fb124
lea edx, [ebp - 0x454]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x6dc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 1
push 0
lea edx, [ebp - 0x6dc]
push edx
lea eax, [ebp - 0x48c8]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.default.0x4ebae7
mov edx, dword [0x602700]
and edx, 0x20
je 0x4eca52
mov eax, dword [0x602700]
and eax, 0xffffffdf
mov dword [0x602700], eax
jmp 0x4eca61
mov ecx, dword [0x602700]
or ecx, 0x20
mov dword [0x602700], ecx
push 0
push 0x19d0d
push 0x111
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1013
mov eax, dword [0x600ed0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x4ebae7
mov ecx, dword [0x602700]
and ecx, 0x40
je 0x4ecaad
mov edx, dword [0x602700]
and edx, 0xffffffbf
mov dword [0x602700], edx
jmp 0x4ecaba
mov eax, dword [0x602700]
or eax, 0x40
mov dword [0x602700], eax
push 0
push 0x19d0d
push 0x111
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1013
mov edx, dword [0x600ed0]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x4ebae7
mov eax, dword [0x602700]
and eax, 0x80
je 0x4ecb0b
mov ecx, dword [0x602700]
and ecx, 0xffffff7f
mov dword [0x602700], ecx
jmp 0x4ecb1d
mov edx, dword [0x602700]
or edx, 0x80
mov dword [0x602700], edx
push 0
push 0x19d0d
push 0x111
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1013
mov ecx, dword [0x600ed0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x4ebae7
mov edx, dword [ebp + 8]
push edx
call fcn.00401c71
add esp, 4
test eax, eax
je 0x4ecbe3
mov dword [ebp - 0x37cc], 7
mov dword [ebp - 0x33b8], 0
lea eax, [ebp - 0x37cc]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x600ed0]
push ecx
call fcn.00404a6b
add esp, 0xc
push 0
push 0x19d0d
push 0x111
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x33b8], 0
je 0x4ecbe3
lea eax, [ebp - 0x37c8]
push eax
lea ecx, [ebp - 0x35c0]
push ecx
mov edx, dword [0x600ed0]
push edx
call fcn.004017c6
add esp, 0xc
test eax, eax
jne 0x4ecbe3
push 0
push 0
push 0x1013
mov eax, dword [0x600ed0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x5fb144
push 0x603b9c
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4ecc09
cmp dword [0x60269c], 0
jne 0x4ecc09
mov dword [ebp - 0x54], 0xe
jmp 0x4ecc10
mov dword [ebp - 0x54], 0xd
mov ecx, dword [ebp - 0x54]
push ecx
push 0xa41e
mov edx, dword [0x5fe724]
push edx
call fcn.00404b97
add esp, 0xc
jmp case.default.0x4ebae7
push 0x5fb14c
push 0x603b9c
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4ecc4e
cmp dword [0x60269c], 0
je 0x4ecce9
push 0x5fb154
push 0x603b9c
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [0x60269c], 0
mov dword [ebp - 0x3be4], 7
mov dword [ebp - 0x37d0], 0
lea eax, [ebp - 0x3be4]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x600ed0]
push ecx
call fcn.00404a6b
add esp, 0xc
push 0
push 0x19d0d
push 0x111
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x37d0], 0
je 0x4ecce9
lea eax, [ebp - 0x3be0]
push eax
lea ecx, [ebp - 0x39d8]
push ecx
mov edx, dword [0x600ed0]
push edx
call fcn.004017c6
add esp, 0xc
test eax, eax
jne 0x4ecce9
push 0
push 0
push 0x1013
mov eax, dword [0x600ed0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xe
push 0xa41e
mov ecx, dword [0x5fe724]
push ecx
call fcn.00404b97
add esp, 0xc
jmp case.default.0x4ebae7
push 1
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.0040477d
add esp, 0xc
jmp case.default.0x4ebae7
push 0xc35a
push 0x602d74
call fcn.00405b00
add esp, 8
jmp case.default.0x4ebae7
push 0x3c
push 0
lea eax, [ebp - 0x188]
push eax
call fcn.00402dec
add esp, 0xc
mov dword [ebp - 0x188], 0x3c
mov dword [ebp - 0x184], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0x602d74
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 1
lea edx, [ebp - 0x188]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.default.0x4ebae7
cmp dword [0x60267c], 0
jne 0x4ecdb6
mov dword [ebp - 0x58], 1
jmp 0x4ecdbd
mov dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x58]
mov dword [0x60267c], eax
cmp dword [0x60267c], 0
je 0x4ecdd7
mov dword [ebp - 0x5c], 5
jmp 0x4ecdde
mov dword [ebp - 0x5c], 0
mov ecx, dword [ebp - 0x5c]
push ecx
mov edx, dword [0x5fe728]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 8]
push eax
call fcn.004050a1
add esp, 4
jmp case.default.0x4ebae7
push 0
push 0
push 0x41b
mov ecx, dword [0x5fe724]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x4ebae7
cmp dword [0x602680], 0
je 0x4ece3f
push 0
mov edx, dword [0x5fe720]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x602680], 0
jmp 0x4ece57
push 5
mov eax, dword [0x5fe720]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x602680], 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.004050a1
add esp, 4
jmp case.default.0x4ebae7
cmp dword [0x602684], 0
je 0x4eceac
push 0
mov edx, dword [0x600ed4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x602684], 0
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp eax, 0xa000
jne 0x4eceaa
mov eax, dword [0x600ed0]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x4ecec5
push 5
mov ecx, dword [0x600ed4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x602684], 1
mov edx, dword [ebp + 8]
push edx
call fcn.004050a1
add esp, 4
jmp case.default.0x4ebae7
mov dword [ebp - 0x60], 0
push 0x5fd418
call fcn.004046fb
add esp, 4
test eax, eax
je 0x4ecf48
push 0x5fd620
call fcn.004046fb
add esp, 4
test eax, eax
jne 0x4ecf43
push 0x5fd620
push 0x5fd418
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
call fcn.00402932
test eax, eax
je 0x4ecf2a
push 0x5fe754
push 0x5fd620
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4ecf41
push 0x5fe758
push 0x5fd418
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x60], 1
jmp 0x4ecf48
jmp case.default.0x4ebae7
cmp dword [ebp - 0x60], 0
jne 0x4ecfc1
push 0x5fb15c
push str.WriteTest
push str.Settings
push 0x5fd418
call fcn.004054c5
add esp, 0x10
test eax, eax
je 0x4ecfb0
push 0x200
push 0x603184
push 0xa411
mov eax, dword [0x5fe724]
push eax
call fcn.00405b23
add esp, 0x10
call fcn.00401b0e
push 1
call fcn.00401ba4
add esp, 4
call fcn.004029d7
push 0x2b03
push 0
call fcn.0040392c
add esp, 8
jmp 0x4ecfbf
push 0xc364
push 2
call fcn.0040392c
add esp, 8
jmp 0x4ecfd0
push 0xc363
push 2
call fcn.0040392c
add esp, 8
jmp case.default.0x4ebae7
push 0
push 0x402ab8
mov ecx, dword [ebp + 8]
push ecx
push 0x6c
mov edx, dword [0x5fd3fc]
push edx
call fcn.004054d4
add esp, 0x14
jmp case.default.0x4ebae7
mov eax, dword [0x5fd3fc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040142e
add esp, 8
push 0x602964
call fcn.0040338c
add esp, 4
mov dword [0x5fda3c], eax
jmp case.default.0x4ebae7
mov dword [0x602704], 0
mov edx, dword [0x602708]
push edx
mov eax, dword [0x602704]
push eax
mov ecx, dword [0x600ed0]
push ecx
call fcn.00402608
add esp, 0xc
jmp case.default.0x4ebae7
mov dword [0x602704], 1
mov edx, dword [0x602708]
push edx
mov eax, dword [0x602704]
push eax
mov ecx, dword [0x600ed0]
push ecx
call fcn.00402608
add esp, 0xc
jmp case.default.0x4ebae7
mov dword [0x602704], 2
mov edx, dword [0x602708]
push edx
mov eax, dword [0x602704]
push eax
mov ecx, dword [0x600ed0]
push ecx
call fcn.00402608
add esp, 0xc
jmp case.default.0x4ebae7
mov dword [0x602704], 3
mov edx, dword [0x602708]
push edx
mov eax, dword [0x602704]
push eax
mov ecx, dword [0x600ed0]
push ecx
call fcn.00402608
add esp, 0xc
jmp case.default.0x4ebae7
cmp dword [0x602708], 0
jne 0x4ed0dd
mov dword [ebp - 0x64], 1
jmp 0x4ed0e4
mov dword [ebp - 0x64], 0
mov edx, dword [ebp - 0x64]
mov dword [0x602708], edx
mov eax, dword [0x602708]
push eax
mov ecx, dword [0x602704]
push ecx
mov edx, dword [0x600ed0]
push edx
call fcn.00402608
add esp, 0xc
jmp case.default.0x4ebae7
mov dword [ebp - 0x5910], 1
lea eax, [ebp - 0x5910]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x600ed0]
push ecx
call fcn.00404a6b
add esp, 0xc
lea edx, [ebp - 0x590c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x7c], eax
lea edx, [ebp - 0x590c]
push edx
mov eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4ed19e
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp - 0x28]
push eax
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp case.default.0x4ebae7
push 0
push 0
push 0x157
mov ecx, dword [0x600ed4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4ed1d5
push 0
push 0
push 0x14f
mov edx, dword [0x600ed4]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4ed20f
cmp dword [0x602660], 1
jne 0x4ed1f6
push 0
push 0xf020
push 0x112
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4ed20f
cmp dword [0x602660], 2
jne 0x4ed20f
push 0
push 0
push 0x10
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x4ebae7
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
cmp eax, 0xa02a
jne 0x4ed252
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0xa001
jle 0x4ed250
mov dword [ebp - 0xc], 0xa000
jmp 0x4ed26b
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0xa000
jge 0x4ed26b
mov dword [ebp - 0xc], 0xa001
cmp dword [ebp - 0xc], 0xa000
jne 0x4ed284
cmp dword [0x602684], 0
jne 0x4ed284
mov dword [ebp - 0xc], 0xa001
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.default.0x4ebae7
cmp dword [0x602664], 0
je 0x4ed2b3
mov dword [0x602664], 0
jmp 0x4ed2bd
mov dword [0x602664], 1
jmp case.default.0x4ebae7
cmp dword [0x60266c], 0
jne 0x4ed2d4
mov dword [ebp - 0x68], 1
jmp 0x4ed2db
mov dword [ebp - 0x68], 0
mov edx, dword [ebp - 0x68]
mov dword [0x60266c], edx
mov eax, dword [0x600ed8]
push eax
mov ecx, dword [0x60266c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040375b
add esp, 0xc
jmp case.default.0x4ebae7
mov dword [ebp - 0x1d44], 7
mov ax, word [0x5fe75c]
mov word [ebp - 0x1d40], ax
push 0x206
push 0
lea ecx, [ebp - 0x1d3e]
push ecx
call fcn.00402dec
add esp, 0xc
mov dx, word [0x5fe760]
mov word [ebp - 0x1b38], dx
push 0x206
push 0
lea eax, [ebp - 0x1b36]
push eax
call fcn.00402dec
add esp, 0xc
mov dword [ebp - 0x1930], 0
lea ecx, [ebp - 0x1d44]
push ecx
push 0xffffffffffffffff
mov edx, dword [0x600ed0]
push edx
call fcn.00404a6b
add esp, 0xc
cmp dword [ebp - 0x1930], 2
jne 0x4ed475
lea eax, [ebp - 0x1d40]
push eax
call fcn.004041d3
add esp, 4
test eax, eax
je 0x4ed475
push 0x104
lea ecx, [ebp - 0x297c]
push ecx
lea edx, [ebp - 0x1d40]
push edx
call fcn.004037ab
add esp, 0xc
test eax, eax
je 0x4ed475
lea eax, [ebp - 0x297c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ed475
lea ecx, [ebp - 0x297c]
push ecx
lea edx, [ebp - 0x2774]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x5c
push 0
lea eax, [ebp - 0x2774]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x4ed475
xor ecx, ecx
mov edx, dword [ebp - 0x2c]
mov word [edx + 2], cx
lea eax, [ebp - 0x2774]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x4ed421
xor ecx, ecx
mov edx, dword [ebp - 0x2c]
mov word [edx], cx
lea eax, [ebp - 0x2774]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0
push 0x19d0d
push 0x111
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [ebp - 0x297c]
push edx
push 0
mov eax, dword [0x600ed0]
push eax
call fcn.004017c6
add esp, 0xc
test eax, eax
jne 0x4ed475
push 0
push 0
push 0x1013
mov ecx, dword [0x600ed0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x4ebae7
push 0
push 0x402ab8
mov edx, dword [ebp + 8]
push edx
push 0x6c
mov eax, dword [0x5fd3fc]
push eax
call fcn.004054d4
add esp, 0x14
jmp case.default.0x4ebae7
push 1
push 0x5fe764
call fcn.00404c19
add esp, 8
jmp case.default.0x4ebae7
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040538f
add esp, 4
jmp case.default.0x4ebae7
mov edx, dword [ebp + 8]
push edx
call fcn.00403a3a
add esp, 4
jmp case.default.0x4ebae7
push 0x5fd418
call fcn.004046fb
add esp, 4
test eax, eax
jne 0x4ed4f8
call fcn.00402932
push 0xc362
push 0x5fd418
call fcn.00405b00
add esp, 8
jmp case.default.0x4ebae7
push 0x600e00
call fcn.004043f9
add esp, 4
test eax, eax
je 0x4ed551
push 0x104
lea eax, [ebp - 0x4ad0]
push eax
push 0x600e00
call fcn.00403dc8
add esp, 0xc
push 0
lea ecx, [ebp - 0x4ad0]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040477d
add esp, 0xc
test eax, eax
jne 0x4ed54f
push 0xc350
push 2
call fcn.0040392c
add esp, 8
jmp 0x4ed559
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
push 0xa412
push 0xa411
mov eax, dword [0x5fe724]
push eax
push 0x600e00
call fcn.00404f16
add esp, 0x10
jmp case.default.0x4ebae7
push 0x600e00
call fcn.0040475a
add esp, 4
test eax, eax
je 0x4ed5cf
push 0x104
lea ecx, [ebp - 0x4cd8]
push ecx
push 0x600e00
call fcn.00403ea4
add esp, 0xc
push 0
lea edx, [ebp - 0x4cd8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040477d
add esp, 0xc
test eax, eax
jne 0x4ed5cd
push 0xc350
push 2
call fcn.0040392c
add esp, 8
jmp 0x4ed5d7
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
push 0xa412
push 0xa411
mov ecx, dword [0x5fe724]
push ecx
push 0x600e00
call fcn.00404f16
add esp, 0x10
jmp case.default.0x4ebae7
push 0x60270c
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x4ed631
push 1
push 0x5fb18c
mov edx, dword [ebp + 8]
push edx
call fcn.0040477d
add esp, 0xc
test eax, eax
jne 0x4ed62f
push 0xc350
push 2
call fcn.0040392c
add esp, 8
jmp 0x4ed639
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp case.default.0x4ebae7
push 0x60270c
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x4ed675
push 1
push str.A_R_H_S_
mov eax, dword [ebp + 8]
push eax
call fcn.0040477d
add esp, 0xc
test eax, eax
jne 0x4ed673
push 0xc350
push 2
call fcn.0040392c
add esp, 8
jmp 0x4ed67d
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp case.default.0x4ebae7
push 0
push 0x19d0e
push 0x111
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x4ebae7
push 1
push 0xffffffffffffffff
push 0x100c
mov edx, dword [0x600ed0]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x1d48], 0
mov dword [ebp - 0x215c], 5
push 0
push 0
push 0x1032
mov eax, dword [0x600ed0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4ed6ec
mov dword [ebp - 0x6c], 1
jmp 0x4ed6f3
mov dword [ebp - 0x6c], 0
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x80], ecx
mov edx, dword [ebp - 0x70]
add edx, dword [ebp - 0x80]
mov dword [ebp - 0x10], edx
jmp 0x4ed70d
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x215c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x600ed0]
push eax
call fcn.00404a6b
add esp, 0xc
cmp eax, 0xffffffff
je 0x4ed757
cmp dword [ebp - 0x1d48], 2
jne 0x4ed755
push 0x104
lea ecx, [ebp - 0x4ee0]
push ecx
lea edx, [ebp - 0x2158]
push edx
call fcn.0040328d
add esp, 0xc
test eax, eax
jne 0x4ed755
jmp 0x4ed757
jmp 0x4ed704
cmp dword [ebp - 0x1d48], 2
je 0x4ed7c0
mov dword [ebp - 0x10], 0
jmp 0x4ed772
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x70]
jg 0x4ed7c0
lea edx, [ebp - 0x215c]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [0x600ed0]
push ecx
call fcn.00404a6b
add esp, 0xc
cmp dword [ebp - 0x1d48], 2
jne 0x4ed7be
push 0x104
lea edx, [ebp - 0x4ee0]
push edx
lea eax, [ebp - 0x2158]
push eax
call fcn.0040328d
add esp, 0xc
test eax, eax
jne 0x4ed7be
jmp 0x4ed7c0
jmp 0x4ed769
cmp dword [ebp - 0x1d48], 2
jne 0x4ed841
mov dword [ebp - 0x304], 3
mov dword [ebp - 0x308], 3
lea ecx, [ebp - 0x314]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x102b
mov eax, dword [0x600ed0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push 0x1013
mov edx, dword [0x600ed0]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0x102a
mov ecx, dword [0x600ed0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x19c41
push 0x111
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4ed849
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp case.default.0x4ebae7
push 1
push 0xffffffffffffffff
push 0x100c
mov eax, dword [0x600ed0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1518], 0
mov dword [ebp - 0x192c], 5
push 0
push 0
push 0x1032
mov ecx, dword [0x600ed0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x4ed8a3
cmp dword [ebp - 0x30], 0
je 0x4ed8a3
mov dword [ebp - 0x74], 0
jmp 0x4ed8aa
mov dword [ebp - 0x74], 1
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x84]
mov dword [ebp - 8], eax
jmp 0x4ed8ca
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xffffffff
jle 0x4ed916
lea edx, [ebp - 0x192c]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [0x600ed0]
push ecx
call fcn.00404a6b
add esp, 0xc
cmp dword [ebp - 0x1518], 2
jne 0x4ed914
push 0x104
lea edx, [ebp - 0x50e8]
push edx
lea eax, [ebp - 0x1928]
push eax
call fcn.0040328d
add esp, 0xc
test eax, eax
jne 0x4ed914
jmp 0x4ed916
jmp 0x4ed8c1
cmp dword [ebp - 0x1518], 2
je 0x4ed993
push 0
push 0
push 0x1004
mov ecx, dword [0x600ed0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x4ed946
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x30]
jl 0x4ed993
lea ecx, [ebp - 0x192c]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [0x600ed0]
push eax
call fcn.00404a6b
add esp, 0xc
cmp dword [ebp - 0x1518], 2
jne 0x4ed991
push 0x104
lea ecx, [ebp - 0x50e8]
push ecx
lea edx, [ebp - 0x1928]
push edx
call fcn.0040328d
add esp, 0xc
test eax, eax
jne 0x4ed991
jmp 0x4ed993
jmp 0x4ed93d
cmp dword [ebp - 0x1518], 2
jne 0x4eda14
mov dword [ebp - 0x28c], 3
mov dword [ebp - 0x290], 3
lea eax, [ebp - 0x29c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0x102b
mov edx, dword [0x600ed0]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov eax, dword [ebp - 8]
push eax
push 0x1013
mov ecx, dword [0x600ed0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov edx, dword [ebp - 8]
push edx
push 0x102a
mov eax, dword [0x600ed0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x19c41
push 0x111
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4eda1c
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp case.default.0x4ebae7
push 0
push 0x19c43
push 0x111
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x4ebae7
mov eax, dword [0x600ed0]
push eax
call fcn.0040435e
add esp, 4
test eax, eax
je 0x4eda66
push 0
push 0x19c45
push 0x111
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4eda6e
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp case.default.0x4ebae7
mov edx, dword [0x600ed0]
push edx
call fcn.0040435e
add esp, 4
test eax, eax
je 0x4eda9e
push 0
push 0x19c4b
push 0x111
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4edaa6
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp case.default.0x4ebae7
push 0
push 0
push 0x1032
mov ecx, dword [0x600ed0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4edadd
push 0
push 0x19c4c
push 0x111
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4edae5
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp case.default.0x4ebae7
push 0
push 0
push 0x1032
mov eax, dword [0x600ed0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4edb3c
mov ecx, dword [0x602674]
mov dword [ebp - 0x88], ecx
mov dword [0x602674], 1
push 0
push 0x19c4d
push 0x111
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x88]
mov dword [0x602674], eax
jmp 0x4edb44
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp case.default.0x4ebae7
push 0
push 0
push 0x1032
mov ecx, dword [0x600ed0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4edb78
push 0
push 0x19c4e
push 0x111
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4edb80
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp case.default.0x4ebae7
push 0
push 0x19d10
push 0x111
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov esp, ebp
pop ebp
ret