Function at 0x464498
Capabilities:
Create process on windows
Enumerate gui resources
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5074a8
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x5466b0]
xor eax, esp
mov dword [esp + 0x2d8], eax
push ebx
push esi
push edi
mov eax, dword [0x5466b0]
xor eax, esp
push eax
lea eax, [esp + 0x2f0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor edx, edx
inc edx
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x38], edx
cmp eax, edx
jne 0x4648b5
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2f8], edi
cmp eax, edi
je 0x464529
push edi
push 2
call fcn.00431050
jmp 0x46452b
xor eax, eax
or dword [esp + 0x2f8], 0xffffffff
push eax
mov ecx, ebx
call fcn.0040ed50
cmp dword [ebx + 4], edi
je 0x46573b
cmp dword [ebp + 0x10], 1
jb 0x46573b
cmp dword [esp + 0x18], 0
je 0x46573b
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x18]
push edi
push eax
call fcn.0046405d
pop ecx
pop ecx
mov dword [esp + 0x2f8], 1
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.http:__
push dword [esp + 0x1c]
call esi
test eax, eax
jne 0x46474f
push str.https:__
push dword [esp + 0x1c]
call esi
test eax, eax
jne 0x46474f
push 4
push str.www.
push dword [esp + 0x20]
call fcn.004cdd39
add esp, 0xc
test eax, eax
je 0x46474f
lea ecx, [esp + 0x14]
call fcn.00408850
cmp dword [ebp + 0x10], 2
mov byte [esp + 0x2f8], 5
jb 0x46463c
add edi, 0xc
lea eax, [esp + 0x20]
push edi
push eax
call fcn.0046405d
pop ecx
pop ecx
mov byte [esp + 0x2f8], 6
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x46462b
cmp dword [esi + 0xc], 0
jl 0x46461e
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x46461e
call fcn.00408780
mov edi, eax
mov eax, esi
call fcn.00408830
add edi, 0x10
mov dword [esp + 0x14], edi
jmp 0x46462b
mov ebx, dword [ecx - 0xc]
push ecx
lea eax, [esp + 0x18]
call fcn.00408500
lea ecx, [esp + 0x20]
mov byte [esp + 0x2f8], 5
call fcn.004087f0
push 0x25
push dword [esp + 0x1c]
call fcn.004cc1f7
pop ecx
pop ecx
test eax, eax
je 0x4646d9
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
call fcn.0046719d
mov byte [esp + 0x2f8], 7
push dword [esp + 0x1c]
call fcn.00405490
pop ecx
test eax, eax
je 0x4646b2
push str.uninst.exe
xor esi, esi
push esi
push dword [esp + 0x24]
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
test eax, eax
jne 0x4646ce
push 5
push esi
push dword [esp + 0x1c]
push dword [esp + 0x28]
push 0x514be8
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cdq
push edx
push eax
mov eax, dword [esp + 0x2c]
mov esi, dword [eax + 4]
call fcn.0040c130
jmp 0x4646ce
push dword [esp + 0x1c]
push 0x51b78c
call fcn.00401f50
mov edx, str.objapp
mov ecx, eax
call fcn.00401fd0
pop ecx
pop ecx
lea ecx, [esp + 0x1c]
call fcn.004087f0
jmp 0x464741
push dword [esp + 0x18]
call fcn.00405490
pop ecx
test eax, eax
je 0x464725
push str.uninst.exe
xor esi, esi
push esi
push dword [esp + 0x20]
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
test eax, eax
jne 0x464741
push 5
push esi
push dword [esp + 0x1c]
push dword [esp + 0x24]
push 0x514be8
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cdq
push edx
push eax
mov eax, dword [esp + 0x2c]
mov esi, dword [eax + 4]
call fcn.0040c130
jmp 0x464741
push dword [esp + 0x18]
push 0x51b78c
call fcn.00401f50
mov edx, str.objapp
mov ecx, eax
call fcn.00401fd0
pop ecx
pop ecx
lea ecx, [esp + 0x14]
call fcn.004087f0
jmp 0x464d24
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.00408780
lea edi, [eax + 0x10]
mov dword [esp + 0x20], edi
lea ecx, [esp + 0x14]
call fcn.00408850
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x2fc], 3
call fcn.0045f790
pop ecx
test eax, eax
je 0x464819
mov ebx, dword [esp + 0x14]
push ebx
call fcn.00405490
pop ecx
test eax, eax
je 0x464819
lea eax, [esp + 0x1c]
push eax
mov ecx, str.__sepro
call fcn.004085e0
mov byte [esp + 0x2f8], 4
push dword [edi - 0xc]
lea eax, [esp + 0x20]
push edi
push eax
call fcn.00404990
push dword [esp + 0x1c]
call fcn.0046421b
cmp eax, 0x20
pop ecx
jle 0x464808
cdq
push edx
push eax
mov eax, dword [esp + 0x2c]
mov esi, dword [eax + 4]
call fcn.0040c130
lea ecx, [esp + 0x1c]
call fcn.004087f0
lea ecx, [esp + 0x14]
call fcn.004087f0
lea ecx, [esp + 0x20]
call fcn.004087f0
lea ecx, [esp + 0x18]
call fcn.004087f0
xor eax, eax
inc eax
jmp 0x46573f
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2f8], 3
call fcn.004087f0
lea eax, [esp + 0x14]
push eax
call fcn.0045f8ae
pop ecx
test eax, eax
je 0x464877
mov ebx, dword [esp + 0x14]
push ebx
call fcn.00405490
pop ecx
test eax, eax
je 0x464877
push edi
call fcn.0046421b
cmp eax, 0x20
pop ecx
jle 0x464877
cdq
push edx
push eax
mov eax, dword [esp + 0x2c]
mov esi, dword [eax + 4]
call fcn.0040c130
lea ecx, [esp + 0x14]
call fcn.004087f0
xor esi, esi
inc esi
lea ecx, [esp + 0x20]
call fcn.004087f0
lea ecx, [esp + 0x18]
call fcn.004087f0
mov eax, esi
jmp 0x46573f
mov byte [esp + 0x2f8], 2
lea ecx, [esp + 0x14]
call fcn.004087f0
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx + 4]
push 0
push edi
call fcn.0045fdb8
pop ecx
cdq
pop ecx
push edx
push eax
call fcn.0040c130
mov eax, dword [ebx + 4]
xor esi, esi
cmp dword [eax + 0xc], esi
jl 0x46485e
jg 0x46485b
cmp dword [eax + 8], 0x20
jbe 0x46485e
jmp 0x46485b
push 8
pop esi
cmp eax, esi
jne 0x464b78
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2f8], esi
cmp eax, edi
je 0x4648e7
push edi
push 2
call fcn.00431050
jmp 0x4648e9
xor eax, eax
or dword [esp + 0x2f8], 0xffffffff
push eax
mov ecx, ebx
call fcn.0040ed50
cmp dword [ebx + 4], edi
je 0x46573b
cmp dword [ebp + 0x10], 1
jb 0x46573b
cmp dword [esp + 0x18], 0
je 0x46573b
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x18]
push esi
push eax
call fcn.0046405d
pop ecx
pop ecx
mov dword [esp + 0x2f8], 9
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.http:__
push dword [esp + 0x1c]
call edi
test eax, eax
jne 0x464ab2
push str.https:__
push dword [esp + 0x1c]
call edi
test eax, eax
jne 0x464ab2
push 4
push str.www.
push dword [esp + 0x20]
call fcn.004cdd39
add esp, 0xc
test eax, eax
je 0x464ab2
lea ecx, [esp + 0x14]
call fcn.00408850
cmp dword [ebp + 0x10], 2
mov byte [esp + 0x2f8], 0xd
jb 0x4649fa
add esi, 0xc
lea eax, [esp + 0x20]
push esi
push eax
call fcn.0046405d
pop ecx
pop ecx
mov byte [esp + 0x2f8], 0xe
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x4649e9
cmp dword [esi + 0xc], 0
jl 0x4649dc
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x4649dc
call fcn.00408780
mov edi, eax
mov eax, esi
call fcn.00408830
add edi, 0x10
mov dword [esp + 0x14], edi
jmp 0x4649e9
mov ebx, dword [ecx - 0xc]
push ecx
lea eax, [esp + 0x18]
call fcn.00408500
lea ecx, [esp + 0x20]
mov byte [esp + 0x2f8], 0xd
call fcn.004087f0
push 0x25
push dword [esp + 0x1c]
call fcn.004cc1f7
pop ecx
pop ecx
test eax, eax
je 0x464a69
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
call fcn.0046719d
mov byte [esp + 0x2f8], 0xf
push dword [esp + 0x1c]
call fcn.00405490
pop ecx
test eax, eax
je 0x4646b2
push str.uninst.exe
push 0
push dword [esp + 0x24]
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
test eax, eax
jne 0x4646ce
push dword [esp + 0x14]
mov eax, dword [esp + 0x28]
push dword [esp + 0x20]
mov esi, dword [eax + 4]
call fcn.004642ea
pop ecx
cdq
pop ecx
push edx
push eax
jmp 0x4646ab
push dword [esp + 0x18]
call fcn.00405490
pop ecx
test eax, eax
je 0x464725
push str.uninst.exe
push 0
push dword [esp + 0x20]
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
test eax, eax
jne 0x464741
push dword [esp + 0x14]
mov eax, dword [esp + 0x28]
push dword [esp + 0x1c]
mov esi, dword [eax + 4]
call fcn.004642ea
pop ecx
cdq
pop ecx
push edx
push eax
jmp 0x46471e
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.00408780
lea edi, [eax + 0x10]
mov dword [esp + 0x20], edi
lea ecx, [esp + 0x14]
call fcn.00408850
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x2fc], 0xb
call fcn.0045f790
pop ecx
test eax, eax
je 0x464b3d
mov ebx, dword [esp + 0x14]
push ebx
call fcn.00405490
pop ecx
test eax, eax
je 0x464b3d
lea eax, [esp + 0x1c]
push eax
mov ecx, str.__sepro
call fcn.004085e0
mov byte [esp + 0x2f8], 0xc
push dword [edi - 0xc]
lea eax, [esp + 0x20]
push edi
push eax
call fcn.00404990
push dword [esp + 0x1c]
call fcn.0046421b
cmp eax, 0x20
pop ecx
jg 0x4647cd
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2f8], 0xb
call fcn.004087f0
lea eax, [esp + 0x14]
push eax
call fcn.0045f8ae
pop ecx
test eax, eax
je 0x464b6b
mov ebx, dword [esp + 0x14]
push ebx
call fcn.00405490
pop ecx
test eax, eax
je 0x464b6b
push edi
call fcn.0046421b
cmp eax, 0x20
pop ecx
jg 0x464843
mov byte [esp + 0x2f8], 0xa
jmp 0x46487f
cmp eax, 7
jne 0x464d2d
push 0x54cfe0
push 0x10
pop esi
push esi
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2f8], esi
cmp eax, edi
je 0x464baa
push edi
push 2
call fcn.00431050
jmp 0x464bac
xor eax, eax
or dword [esp + 0x2f8], 0xffffffff
push eax
mov ecx, ebx
call fcn.0040ed50
cmp dword [ebx + 4], edi
je 0x46573b
cmp dword [ebp + 0x10], 1
jb 0x46573b
cmp dword [esp + 0x18], 0
je 0x46573b
push dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
call fcn.0046405d
pop ecx
pop ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x2f8], 0x11
call fcn.00408850
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x2fc], 0x12
call fcn.0045f790
pop ecx
test eax, eax
je 0x464c8e
mov ebx, dword [esp + 0x14]
push ebx
call fcn.00405490
pop ecx
test eax, eax
je 0x464c8e
lea eax, [esp + 0x1c]
push eax
mov ecx, str.__sepro
call fcn.004085e0
mov byte [esp + 0x2f8], 0x13
mov eax, dword [esp + 0x18]
push dword [eax - 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00404990
push dword [esp + 0x1c]
call fcn.0046421b
cmp eax, 0x20
pop ecx
jle 0x464c7d
cdq
push edx
push eax
mov eax, dword [esp + 0x2c]
mov esi, dword [eax + 4]
call fcn.0040c130
lea ecx, [esp + 0x1c]
call fcn.004087f0
lea ecx, [esp + 0x14]
jmp 0x4647f2
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2f8], 0x12
call fcn.004087f0
lea eax, [esp + 0x14]
push eax
call fcn.0045f8ae
pop ecx
test eax, eax
je 0x464ccc
mov ebx, dword [esp + 0x14]
push ebx
call fcn.00405490
pop ecx
test eax, eax
je 0x464ccc
push dword [esp + 0x18]
call fcn.0046421b
cmp eax, 0x20
pop ecx
jle 0x464ccc
cdq
push edx
push eax
mov eax, dword [esp + 0x2c]
mov esi, dword [eax + 4]
call fcn.0040c130
jmp 0x464c74
lea ecx, [esp + 0x14]
mov byte [esp + 0x2f8], 0x11
call fcn.004087f0
mov edi, dword [esp + 0x24]
mov esi, dword [edi + 4]
push 0
push dword [esp + 0x1c]
call fcn.0045fdb8
pop ecx
cdq
pop ecx
push edx
push eax
call fcn.0040c130
mov ecx, dword [edi + 4]
call fcn.0040c5b0
test edx, edx
jg 0x464d24
jl 0x464d0c
cmp eax, 0x20
ja 0x464d24
mov esi, dword [edi + 4]
push 0
push dword [esp + 0x1c]
call fcn.0047f274
pop ecx
cdq
pop ecx
push edx
push eax
call fcn.0040c130
lea ecx, [esp + 0x18]
jmp 0x465296
cmp eax, 6
jne 0x464ef5
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2f8], 0x14
cmp eax, edi
je 0x464d61
push edi
push 2
call fcn.00431050
jmp 0x464d63
xor eax, eax
or dword [esp + 0x2f8], 0xffffffff
push eax
mov ecx, ebx
call fcn.0040ed50
cmp dword [esp + 0x18], edi
je 0x46573b
lea ecx, [esp + 0x1c]
call fcn.00408850
cmp dword [ebp + 0x10], 2
mov dword [esp + 0x2f8], 0x15
mov edi, dword [esp + 0x18]
jb 0x464e0a
cmp dword [edi + 0x10], 0
je 0x464e0a
lea eax, [edi + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0046405d
pop ecx
pop ecx
mov byte [esp + 0x2f8], 0x16
mov ecx, dword [eax]
mov esi, dword [esp + 0x1c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x464df9
cmp dword [esi + 0xc], 0
jl 0x464dec
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x464dec
call fcn.00408780
mov ebx, eax
mov eax, esi
call fcn.00408830
add ebx, 0x10
mov dword [esp + 0x1c], ebx
jmp 0x464df9
mov ebx, dword [ecx - 0xc]
push ecx
lea eax, [esp + 0x20]
call fcn.00408500
lea ecx, [esp + 0x20]
mov byte [esp + 0x2f8], 0x15
call fcn.004087f0
lea eax, [esp + 0x14]
push edi
push eax
call fcn.0046405d
mov byte [esp + 0x300], 0x17
push 0x25
push dword [esp + 0x20]
call fcn.004cc1f7
add esp, 0x10
test eax, eax
je 0x464e95
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
call fcn.0046719d
mov byte [esp + 0x2f8], 0x18
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x464e84
cmp dword [esi + 0xc], 0
jl 0x464e77
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x464e77
call fcn.00408780
mov ebx, eax
mov eax, esi
call fcn.00408830
add ebx, 0x10
mov dword [esp + 0x14], ebx
jmp 0x464e84
mov ebx, dword [ecx - 0xc]
push ecx
lea eax, [esp + 0x18]
call fcn.00408500
lea ecx, [esp + 0x20]
mov byte [esp + 0x2f8], 0x17
call fcn.004087f0
mov esi, dword [sym.imp.SHLWAPI.dll_StrRStrIW]
push str.uninst.exe
xor edi, edi
push edi
push dword [esp + 0x1c]
call esi
test eax, eax
je 0x464ebd
push 0x51b7a4
push edi
push dword [esp + 0x1c]
call esi
test eax, eax
jne 0x464ee3
push 5
push edi
push dword [esp + 0x24]
push dword [esp + 0x20]
push 0x514be8
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cdq
push edx
push eax
mov eax, dword [esp + 0x2c]
mov esi, dword [eax + 4]
call fcn.0040c130
lea ecx, [esp + 0x14]
call fcn.004087f0
lea ecx, [esp + 0x1c]
jmp 0x465296
push 2
pop edx
cmp eax, edx
jne 0x464fd0
mov esi, dword [ebp + 0x10]
cmp esi, edi
jbe 0x46573b
test ecx, ecx
je 0x46573b
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2f8], 0x19
test eax, eax
je 0x464f3f
push 0
push 1
call fcn.00431050
jmp 0x464f41
xor eax, eax
mov ecx, dword [esp + 0x24]
or dword [esp + 0x2f8], 0xffffffff
push eax
call fcn.0040ed50
test esi, esi
jbe 0x46573b
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x2c], esi
lea eax, [esp + 0x5c]
push eax
call fcn.0046585a
lea eax, [esp + 0x20]
push ebx
push eax
mov dword [esp + 0x300], 0x1a
call fcn.0046405d
pop ecx
pop ecx
lea ecx, [esp + 0x5c]
lea esi, [esp + 0x20]
mov byte [esp + 0x2f8], 0x1b
call fcn.0047f1a3
test eax, eax
je 0x464fa7
lea edi, [esp + 0x5c]
call fcn.0047f127
lea ecx, [esp + 0x20]
call fcn.004087f0
or dword [esp + 0x2f8], 0xffffffff
lea eax, [esp + 0x5c]
push eax
call fcn.00465890
add ebx, 0xc
dec dword [esp + 0x2c]
jne 0x464f63
jmp 0x46573b
cmp eax, 3
jne 0x46509a
cmp dword [ebp + 0x10], edi
jbe 0x46573b
test ecx, ecx
je 0x46573b
xor edi, edi
mov dword [esp + 0x30], edi
cmp dword [ebp + 0x10], edi
jbe 0x465061
mov ebx, ecx
lea eax, [esp + 0x5c]
push eax
call fcn.0046585a
lea eax, [esp + 0x20]
push ebx
push eax
mov dword [esp + 0x300], 0x1c
call fcn.0046405d
pop ecx
pop ecx
lea ecx, [esp + 0x5c]
lea esi, [esp + 0x20]
mov byte [esp + 0x2f8], 0x1d
call fcn.0047f1a3
test eax, eax
je 0x46503d
xor eax, eax
inc eax
mov ecx, edi
shl eax, cl
or dword [esp + 0x30], eax
lea ecx, [esp + 0x20]
call fcn.004087f0
or dword [esp + 0x2f8], 0xffffffff
lea eax, [esp + 0x5c]
push eax
call fcn.00465890
inc edi
add ebx, 0xc
cmp edi, dword [ebp + 0x10]
jb 0x464ff7
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2f8], 0x1e
test eax, eax
je 0x46508f
push 0
push dword [esp + 0x34]
call fcn.00431050
jmp 0x465091
xor eax, eax
mov ecx, dword [esp + 0x24]
jmp 0x465570
cmp eax, 4
jne 0x465193
cmp dword [ebp + 0x10], edx
jb 0x46573b
mov esi, ecx
lea eax, [esp + 0x20]
push esi
push eax
call fcn.0046405d
pop ecx
pop ecx
mov dword [esp + 0x2f8], 0x1f
mov edx, dword [eax]
lea ecx, [esp + 0x2c]
call fcn.0046719d
lea ecx, [esp + 0x20]
call fcn.004087f0
cmp dword [ebp + 0x10], 3
mov dword [esp + 0x20], 8
jb 0x4650f4
mov ecx, dword [esi + 0x1c]
call fcn.0040c5b0
mov dword [esp + 0x20], eax
cmp dword [ebp + 0x10], 4
mov ebx, 0x7530
jb 0x465109
mov ecx, dword [esi + 0x28]
call fcn.0040c5b0
mov ebx, eax
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x30], eax
mov byte [esp + 0x2f8], 0x22
test eax, eax
je 0x465172
add esi, 0xc
lea eax, [esp + 0x14]
push esi
push eax
call fcn.0046405d
mov byte [esp + 0x300], 0x23
mov edi, dword [esp + 0x34]
mov esi, dword [eax]
push edi
mov dword [esp + 0x28], 1
call fcn.00405490
add esp, 0xc
test eax, eax
je 0x465164
push ebx
push dword [esp + 0x24]
push esi
push edi
call fcn.0046576a
cdq
push edx
push eax
mov eax, dword [esp + 0x38]
call fcn.00431050
jmp 0x465174
xor eax, eax
mov ecx, dword [esp + 0x24]
push eax
mov dword [esp + 0x2fc], 0x24
call fcn.0040ed50
test byte [esp + 0x1c], 1
jmp 0x465287
cmp eax, 5
jne 0x4652a0
cmp dword [ebp + 0x10], edx
jb 0x46573b
mov esi, ecx
lea eax, [esp + 0x20]
push esi
push eax
call fcn.0046405d
pop ecx
pop ecx
mov dword [esp + 0x2f8], 0x25
mov edx, dword [eax]
lea ecx, [esp + 0x2c]
call fcn.0046719d
lea ecx, [esp + 0x20]
call fcn.004087f0
cmp dword [ebp + 0x10], 3
mov dword [esp + 0x20], 8
jb 0x4651ed
mov ecx, dword [esi + 0x1c]
call fcn.0040c5b0
mov dword [esp + 0x20], eax
cmp dword [ebp + 0x10], 4
mov ebx, 0x7530
jb 0x465202
mov ecx, dword [esi + 0x28]
call fcn.0040c5b0
mov ebx, eax
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x30], eax
mov byte [esp + 0x2f8], 0x28
test eax, eax
je 0x46526b
add esi, 0xc
lea eax, [esp + 0x14]
push esi
push eax
call fcn.0046405d
mov byte [esp + 0x300], 0x29
mov edi, dword [esp + 0x34]
mov esi, dword [eax]
push edi
mov dword [esp + 0x28], 2
call fcn.00405490
add esp, 0xc
test eax, eax
je 0x46525d
push ebx
push dword [esp + 0x24]
push esi
push edi
call fcn.004657e2
cdq
push edx
push eax
mov eax, dword [esp + 0x38]
call fcn.00431050
jmp 0x46526d
xor eax, eax
mov ecx, dword [esp + 0x24]
push eax
mov dword [esp + 0x2fc], 0x2a
call fcn.0040ed50
test byte [esp + 0x1c], 2
je 0x465292
lea ecx, [esp + 0x14]
call fcn.004087f0
lea ecx, [esp + 0x2c]
call fcn.004087f0
jmp 0x46573b
cmp eax, 9
jne 0x465583
push edi
push edx
mov dword [esp + 0x24], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x46553e
push 0x228
lea eax, [esp + 0xbc]
push edi
push eax
call fcn.004d7710
add esp, 0xc
lea eax, [esp + 0xb4]
push eax
push dword [esp + 0x24]
mov dword [esp + 0xbc], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x465534
jmp 0x4652ff
xor edi, edi
mov dword [esp + 0x30], edi
cmp dword [ebp + 0x10], edi
jbe 0x465515
mov eax, dword [esp + 0x18]
add eax, 4
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x1c], 0
jne 0x46552e
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx]
cmp dword [eax], 5
jne 0x465452
mov edi, dword [eax + 8]
test edi, edi
je 0x465497
mov eax, dword [edi]
and dword [esp + 0x14], 0
mov ecx, edi
call dword [eax + 0x5c]
test eax, eax
jbe 0x465497
push dword [esp + 0x14]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x4c]
lea esi, [esp + 0x3c]
call fcn.0040ea10
mov dword [esp + 0x2f8], 0x2b
cmp dword [esp + 0x40], 0
je 0x4653b7
mov eax, esi
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0046405d
pop ecx
pop ecx
push eax
lea ecx, [esp + 0xdc]
mov byte [esp + 0x2fc], 0x2c
call fcn.004047b0
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [esp + 0x34]
inc bl
mov byte [esp + 0x2f8], 0x2b
call fcn.004087f0
test bl, bl
jne 0x4653ea
or dword [esp + 0x2f8], 0xffffffff
lea ecx, [esp + 0x3c]
mov dword [esp + 0x3c], vtable.os::script_shared_ptr_class__variant__.0
call fcn.0040ea60
mov eax, dword [edi]
inc dword [esp + 0x14]
mov ecx, edi
call dword [eax + 0x5c]
cmp dword [esp + 0x14], eax
jb 0x465350
jmp 0x465497
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x24], 1
call fcn.0046405d
pop ecx
pop ecx
lea ecx, [esp + 0xd8]
push ecx
mov byte [esp + 0x2fc], 0x2d
push dword [eax]
push str._s_cmp__s_ok
call fcn.00401f50
mov edx, 0x51b7d4
mov ecx, eax
call fcn.00401fd0
add esp, 0xc
lea ecx, [esp + 0x54]
call fcn.004087f0
or dword [esp + 0x2f8], 0xffffffff
lea ecx, [esp + 0x3c]
mov dword [esp + 0x3c], vtable.os::script_shared_ptr_class__variant__.0
call fcn.0040ea60
jmp 0x465497
add ecx, 0xfffffffc
push ecx
lea eax, [esp + 0x5c]
push eax
call fcn.0046405d
pop ecx
pop ecx
push eax
lea ecx, [esp + 0xdc]
mov dword [esp + 0x2fc], 0x2e
call fcn.004047b0
mov ebx, eax
neg ebx
sbb bl, bl
or dword [esp + 0x2f8], 0xffffffff
lea ecx, [esp + 0x58]
inc bl
call fcn.004087f0
test bl, bl
jne 0x4654af
inc dword [esp + 0x30]
mov eax, dword [esp + 0x30]
add dword [esp + 0x2c], 0xc
cmp eax, dword [ebp + 0x10]
jb 0x465317
jmp 0x46550e
mov eax, dword [esp + 0x30]
imul eax, eax, 0xc
add eax, dword [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0046405d
pop ecx
pop ecx
lea ecx, [esp + 0xd8]
push ecx
mov dword [esp + 0x2fc], 0x2f
push dword [eax]
push str._s_cmp__s_ok
call fcn.00401f50
mov edx, 0x51b7d4
mov ecx, eax
call fcn.00401fd0
or dword [esp + 0x304], 0xffffffff
add esp, 0xc
lea ecx, [esp + 0x28]
call fcn.004087f0
mov dword [esp + 0x1c], 1
cmp dword [esp + 0x1c], 0
jne 0x46552e
lea eax, [esp + 0xb4]
push eax
push dword [esp + 0x24]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4652fd
mov ebx, dword [esp + 0x24]
xor edi, edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov ecx, eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2f8], 0x30
cmp ecx, edi
je 0x46556c
mov eax, dword [esp + 0x1c]
call fcn.0040c000
jmp 0x46556e
xor eax, eax
mov ecx, ebx
or dword [esp + 0x2f8], 0xffffffff
push eax
call fcn.0040ed50
jmp 0x46573b
cmp eax, 0xa
jne 0x465728
push 0x20
call fcn.004cb80b
pop ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2f8], 0x31
cmp eax, edi
je 0x4655b2
mov esi, eax
call fcn.00460b7c
mov esi, eax
jmp 0x4655b4
xor esi, esi
or dword [esp + 0x2f8], 0xffffffff
cmp esi, edi
je 0x46573b
xor eax, eax
lea edi, [esp + 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 7
pop eax
xor edi, edi
xor ecx, ecx
mov dword [esp + 0x50], esi
mov dword [esp + 0xb0], eax
mov dword [esp + 0xac], edi
mov word [esp + 0x9c], cx
mov dword [esp + 0x2f8], 0x32
mov dword [esp + 0x94], eax
xor eax, eax
mov dword [esp + 0x90], edi
mov word [esp + 0x80], ax
cmp dword [ebp + 0x10], 1
mov byte [esp + 0x2f8], 0x33
jb 0x46565d
cmp dword [esp + 0x18], edi
je 0x46565d
push dword [esp + 0x18]
lea eax, [esp + 0x2c]
push eax
call fcn.0046405d
pop ecx
pop ecx
lea ecx, [esp + 0x98]
mov byte [esp + 0x2f8], 0x34
mov eax, dword [eax]
push ecx
call fcn.00437f30
lea ecx, [esp + 0x28]
mov byte [esp + 0x2f8], 0x33
call fcn.004087f0
cmp dword [ebp + 0x10], 2
jb 0x4656a0
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x4656a0
add eax, 0xc
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0046405d
pop ecx
pop ecx
lea ecx, [esp + 0x7c]
mov byte [esp + 0x2f8], 0x35
mov eax, dword [eax]
push ecx
call fcn.00437f30
lea ecx, [esp + 0x34]
mov byte [esp + 0x2f8], 0x33
call fcn.004087f0
cmp dword [esp + 0xb0], 8
mov eax, dword [esp + 0x9c]
jae 0x4656b8
lea eax, [esp + 0x9c]
cmp dword [esp + 0x94], 8
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x80]
jae 0x4656d4
lea eax, [esp + 0x80]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x48]
push eax
push 0x463ea6
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
cmp eax, edi
je 0x465705
mov dword [eax + 8], esi
mov dword [eax], 5
jmp 0x465707
xor eax, eax
mov ecx, dword [esp + 0x24]
push eax
call fcn.0040ed50
lea esi, [esp + 0x7c]
call fcn.00437f00
lea esi, [esp + 0x98]
call fcn.00437f00
jmp 0x46573b
push ebx
push dword [ebp + 0x10]
push ecx
mov ecx, dword [esp + 0x34]
push eax
call fcn.0046626b
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x2f0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2d8]
xor ecx, esp
call fcn.004cb38b
mov esp, ebp
pop ebp
ret 0x10