Function at 0x46e120
Capabilities:
Create process on windows
Inspect load icon resource
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f57e0
push 0x4e3808
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x77c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [0x597e78], eax
push 0x7e8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x59174c], eax
test eax, eax
je 0x46e211
push 0x7e8
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test eax, eax
je 0x46e211
call fcn.00474290
push 0x104
push dword [0x59174c]
push 0
call dword [0x595e30]
push 1
mov eax, dword [0x59174c]
push eax
add eax, 0x258
push eax
call fcn.00481b90
push 0
mov eax, dword [0x59174c]
push eax
add eax, 0x12c
push eax
call fcn.00481670
add esp, 0x18
mov eax, dword [0x59174c]
lea ecx, [eax + 0x12c]
lea edx, [eax + 0x384]
nop
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x46e1e0
call fcn.0046ddb0
test al, al
jne 0x46e22d
push 0x30
mov eax, dword [0x59174c]
add eax, 0x258
push eax
push str.This_program_requires_Windows_10_or_higher
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x10]
call fcn.0046cf50
test eax, eax
jns 0x46e246
mov ecx, dword [0x59174c]
call fcn.0044fbf0
jmp 0x46e211
push 0x1f48
push 0
push 0x595f00
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, 0x20
mov word [0x5967b8], ax
mov ecx, dword [0x59174c]
mov edx, 0x59629c
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x46e270
or dword [0x595f04], 0x78200
push 0x595f00
call fcn.004a0440
add esp, 4
push 0x597e60
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.004961f0
call fcn.004a2440
call fcn.00480e50
mov ecx, 0x44f150
call fcn.00404aa0
mov ecx, 0x44f190
call fcn.00404aa0
mov ecx, 0x44f1d0
call fcn.00404aa0
mov ecx, 0x44f210
call fcn.00404aa0
push str._s_s__.reg
mov ecx, dword [0x59174c]
lea eax, [ecx + 0x258]
push eax
lea eax, [ecx + 0x384]
push eax
push 0x2ace
push str.Main.c
push str._s_s__.reg
push 0x12c
lea eax, [ebp - 0x534]
push eax
call fcn.00482bc0
lea ecx, [ebp - 0x534]
call fcn.00450330
push str._s_s.cfg
mov ecx, dword [0x59174c]
lea eax, [ecx + 0x258]
push eax
lea eax, [ecx + 0x384]
push eax
push 0x2ad2
push str.Main.c
push str._s_s.cfg
push 0x12c
lea eax, [ecx + 0x5dc]
push eax
call fcn.00482bc0
add esp, 0x40
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
mov eax, dword [0x59174c]
add eax, 0x5dc
push eax
call fcn.0047da90
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x46e50f
push str._sRdpHelper.reg
mov eax, dword [0x59174c]
add eax, 0x384
push eax
push 0x2ada
push str.Main.c
push str._sRdpHelper.reg
push 0x12c
lea eax, [ebp - 0x19c]
push eax
call fcn.00482bc0
lea eax, [ebp - 0x19c]
push eax
call fcn.0047e360
push str._sRdpHelper.exe
mov eax, dword [0x59174c]
add eax, 0x384
push eax
push 0x2adc
push str.Main.c
push str._sRdpHelper.exe
push 0x12c
lea eax, [ebp - 0x19c]
push eax
call fcn.00482bc0
lea eax, [ebp - 0x19c]
push eax
call fcn.0047e360
add esp, 0x40
push str._sRdpHelper.7z
mov eax, dword [0x59174c]
add eax, 0x384
push eax
push 0x2ade
push str.Main.c
push str._sRdpHelper.7z
push 0x12c
lea eax, [ebp - 0x19c]
push eax
call fcn.00482bc0
lea eax, [ebp - 0x19c]
push eax
call fcn.0047e360
push str._s.cfg
mov eax, dword [0x59174c]
add eax, 0x384
push eax
push 0x2ae1
push str.Main.c
push str._s.cfg
push 0x12c
lea eax, [ebp - 0x660]
push eax
call fcn.00482bc0
add esp, 0x3c
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x660]
push eax
call dword [0x595e44]
mov esi, eax
cmp esi, 0xffffffff
je 0x46e516
nop dword [eax + eax]
test byte [ebp - 0x408], 0x10
je 0x46e4b4
lea eax, [ebp - 0x408]
push eax
push esi
call dword [0x595ecc]
test eax, eax
jne 0x46e490
push esi
call dword [0x595e94]
jmp 0x46e516
push 0x4f166c
lea eax, [ebp - 0x3dc]
push eax
mov eax, dword [0x59174c]
add eax, 0x384
push eax
push 0x2ae5
push str.Main.c
push 0x4f166c
push 0x12c
lea eax, [ebp - 0x78c]
push eax
call fcn.00482bc0
add esp, 0x20
mov eax, dword [0x59174c]
add eax, 0x5dc
push eax
lea eax, [ebp - 0x78c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push esi
call dword [0x595e94]
jmp 0x46e516
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x591f68]
test eax, eax
je 0x46f05a
cmp dword [eax], 0
je 0x46f05a
push ecx
mov ecx, dword [0x59174c]
lea ecx, [ecx + 0x258]
call fcn.0046c0c0
add esp, 4
test eax, eax
je 0x46e239
push 0
push 0
call fcn.004c5890
add esp, 8
call fcn.004b6630
call fcn.0046c000
call fcn.00453350
call fcn.004543c0
lea eax, [ebp - 0x50]
push eax
call dword [0x595ed0]
push 1
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_MonitorFromPoint]
mov ecx, eax
call fcn.00454400
mov ecx, dword [0x59174c]
mov dword [ecx + 0x7cc], eax
push str.WAVE
push 0x69
push dword [0x597e78]
call dword [0x595eac]
mov esi, eax
test esi, esi
je 0x46e6cd
push esi
push dword [0x597e78]
call dword [0x595e1c]
mov dword [ebp + 8], eax
push esi
push dword [0x597e78]
call dword [0x595ed4]
mov esi, eax
test esi, esi
je 0x46e6cd
push esi
call dword [0x595e88]
mov edi, eax
test edi, edi
je 0x46e6c6
push 0x3e0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov ecx, eax
mov eax, dword [0x59174c]
mov dword [eax + 0x7d4], ecx
test ecx, ecx
je 0x46e622
push 0x3e0
push 0
mov eax, dword [0x59174c]
push dword [eax + 0x7d4]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov edx, dword [0x59174c]
mov edx, dword [edx + 0x7d4]
call fcn.0042edb0
test eax, eax
jne 0x46e655
sub esp, 8
push dword [ebp + 8]
mov edx, edi
call fcn.0046d650
add esp, 0xc
mov ecx, dword [0x59174c]
mov dword [ecx + 0x7d8], eax
jmp 0x46e6c6
mov eax, dword [0x59174c]
lea ecx, [eax + 0x7d8]
cmp dword [ecx], 0
je 0x46e693
push ecx
call fcn.0047e900
mov eax, dword [0x59174c]
push dword [eax + 0x7d8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 8
mov eax, dword [0x59174c]
mov dword [eax + 0x7d8], 0
mov eax, dword [0x59174c]
add eax, 0x7d4
cmp dword [eax], 0
je 0x46e6c6
push eax
call fcn.0047e900
mov eax, dword [0x59174c]
push dword [eax + 0x7d4]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 8
mov eax, dword [0x59174c]
mov dword [eax + 0x7d4], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
call fcn.004c4ef0
push 0
push 1
call fcn.0047bab0
push eax
push str.LogThread
push 0
push 0
push 0x472de0
call fcn.0047c040
add esp, 0x1c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x597cf0]
mov dword [ebp + 8], eax
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0x50dfb8
lea eax, [ebp + 8]
push eax
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
lea eax, [ebp - 0x40]
push eax
push 0x8002
push dword [0x597e78]
call dword [0x595e68]
mov eax, dword [0x597e78]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], 0x4f36b0
push 0x65
push eax
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
call esi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x40]
push eax
call dword [0x595ea4]
test ax, ax
je 0x46f05a
mov eax, dword [0x597e78]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], str.KeyClass
push 0x67
push eax
call esi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x40]
push eax
call dword [0x595ea4]
test ax, ax
je 0x46f05a
mov eax, dword [0x597e78]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], 0x4f36e0
push 0x66
push eax
call esi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x40]
push eax
call dword [0x595ea4]
test ax, ax
je 0x46f05a
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x30], xmm0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x3c], 0x46d9b0
mov eax, dword [0x597e78]
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
call esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], str.TransparentWindowClass
lea eax, [ebp - 0x40]
push eax
call dword [0x595ea4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x30], xmm0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x3c], 0x452e80
mov eax, dword [0x597e78]
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
call esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], str.DummyRdpWindowClass
lea eax, [ebp - 0x40]
push eax
call dword [0x595ea4]
mov dword [ebp - 0x3c], 0x44fe50
mov eax, dword [0x597e78]
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
call esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], str.FreezeWindowClass
lea eax, [ebp - 0x40]
push eax
call dword [0x595ea4]
mov dword [ebp - 0x3c], 0x4602f0
mov eax, dword [0x597e78]
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
call esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], str.PinOrOtpDialogClass
lea eax, [ebp - 0x40]
push eax
call dword [0x595ea4]
mov dword [ebp - 0x40], 0x20000
mov dword [ebp - 0x3c], 0x45fc50
mov eax, dword [0x597e78]
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
call esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], str.PinOrOtpShadowClass
lea eax, [ebp - 0x40]
push eax
call dword [0x595ea4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x30], xmm0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x3c], 0x4537c0
mov eax, dword [0x597e78]
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
call esi
mov dword [ebp - 0x28], eax
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], str.VirtualDesktopInfoClass
lea eax, [ebp - 0x40]
push eax
call dword [0x595ea4]
push 0
push dword [0x597e78]
push 0
push 0
push 0x64
push 0x64
push 0
push 0
push 0x90000000
push 0x4eb673
push str.TransparentWindowClass
push 0x80000
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x54], esi
push 0x2b76
push str.Main.c
mov ecx, dword [0x59174c]
push dword [ecx + 0x7d8]
push str.SND_
push esi
call fcn.004a06f0
add esp, 0x14
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0x200
mov eax, dword [0x59174c]
add eax, 0x708
push eax
call fcn.00481a00
add esp, 0xc
mov ecx, dword [0x59174c]
add ecx, 0x5dc
call fcn.00450bc0
test eax, eax
jg 0x46e9e9
push ecx
jne 0x46e9cc
push 0x46c1b0
push esi
mov edx, str.NewPinDialog
call fcn.00406d50
add esp, 0xc
test eax, eax
je 0x46f05a
mov ecx, dword [0x59174c]
lea ecx, [ecx + 0x5dc]
xor edx, edx
call fcn.00450f10
jmp 0x46e984
push 0x46c870
push esi
mov edx, str.PinDialog
call fcn.00406d50
add esp, 0xc
test eax, eax
je 0x46f05a
jmp 0x46e984
mov eax, dword [0x59174c]
lea ecx, [eax + 0x768]
cmp dword [ecx], 0
je 0x46ea27
push ecx
call fcn.0047e900
mov eax, dword [0x59174c]
push dword [eax + 0x768]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 8
mov eax, dword [0x59174c]
mov dword [eax + 0x768], 0
mov eax, dword [0x59174c]
mov edi, 0x4eb673
test byte [eax + 0x710], 0x20
je 0x46ea75
mov eax, dword [eax + 0x774]
mov ecx, edi
test eax, eax
cmovne ecx, eax
cmp byte [ecx], 0
je 0x46ea75
push ecx
push 0x4656d0
push esi
mov edx, str.OtpDialog
call fcn.00406d50
add esp, 0xc
test eax, eax
je 0x46f05a
mov eax, dword [0x59174c]
cmp dword [eax + 0x778], 0
je 0x46f05a
xor eax, eax
mov dword [ebp - 0x48], eax
xor edx, edx
xor ecx, ecx
call fcn.00455390
mov esi, eax
test esi, esi
je 0x46eab2
lea ecx, [esi + 0x3c]
cmp byte [ecx], 0
jne 0x46ea9d
call fcn.0046cec0
mov dword [ebp - 0x48], 1
mov edx, 1
mov ecx, esi
call fcn.00454580
mov edx, 1
mov ecx, esi
jmp 0x46ea7e
cmp dword [ebp - 0x48], 0
je 0x46eacb
mov ecx, dword [0x59174c]
add ecx, 0x5dc
xor edx, edx
call fcn.00450f10
call fcn.004706c0
call fcn.0046d2d0
test eax, eax
je 0x46eaf9
push 0
push ecx
mov ecx, str..rdp
call fcn.00471bb0
add esp, 8
push 0
push ecx
mov ecx, 0x4f2724
call fcn.00471bb0
add esp, 8
mov eax, dword [0x59174c]
cmp dword [eax + 0x760], 0
jne 0x46eb49
push 0x10
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov ecx, dword [0x59174c]
mov dword [ecx + 0x760], eax
test eax, eax
je 0x46eb33
xorps xmm0, xmm0
mov eax, dword [0x59174c]
mov eax, dword [eax + 0x760]
movups xmmword [eax], xmm0
mov edx, dword [0x59174c]
mov ecx, dword [0x591728]
call fcn.0044faf0
mov dword [0x591728], eax
push 0x10
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x591f60], eax
test eax, eax
je 0x46eb63
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov ecx, dword [0x591728]
call fcn.0045f940
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x59174c]
lea ecx, [eax + 0x733]
lea edx, [eax + 0x71f]
nop dword [eax]
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x46eb90
push 0x4f3530
push dword [0x59174c]
call fcn.00480290
add esp, 8
test eax, eax
cmovne edi, eax
mov ecx, dword [0x59174c]
add ecx, 0x733
mov al, byte [edi]
mov byte [ecx], al
lea edi, [edi + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x46ebc2
mov edi, dword [sym.imp.VCRUNTIME140.dll_strrchr]
nop word [eax + eax]
push 0x2e
mov eax, dword [0x59174c]
add eax, 0x733
push eax
call edi
add esp, 8
mov esi, eax
test esi, esi
je 0x46ec48
mov edx, 0x4f374c
mov ecx, esi
nop
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x46ec20
test al, al
je 0x46ec1c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x46ec20
add ecx, 2
add edx, 2
test al, al
jne 0x46ec00
xor eax, eax
jmp 0x46ec25
sbb eax, eax
or eax, 1
test eax, eax
jne 0x46ec48
push 0x2e
mov eax, dword [0x59174c]
add eax, 0x733
push eax
call dword [sym.imp.VCRUNTIME140.dll_strchr]
add esp, 8
cmp eax, esi
jae 0x46ec48
mov byte [esi], 0
jmp 0x46ebe0
mov esi, dword [0x59174c]
lea ecx, [esi + 0x733]
lea eax, [esi + 0x71f]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x46ec80
test dl, dl
je 0x46ec7c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x46ec80
add eax, 2
add ecx, 2
test dl, dl
jne 0x46ec60
xor eax, eax
jmp 0x46ec85
sbb eax, eax
or eax, 1
push eax
push 1
lea eax, [esi + 0x708]
push eax
call fcn.00481a00
add esp, 0xc
mov eax, dword [0x59174c]
test byte [eax + 0x708], 1
je 0x46ecd3
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0
push str.cmd__c_ie4uinit.exe__ClearIconCache
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
call esi
push 0
push str.cmd__c_ie4uinit.exe__show
call esi
mov eax, dword [0x59174c]
add eax, 0x384
push eax
push str._sIconsRdp.ico
call fcn.0046fee0
add esp, 8
test eax, eax
jne 0x46ed18
mov eax, dword [0x59174c]
add eax, 0x384
push eax
push str._sIconsRdp.png
call fcn.0046fee0
add esp, 8
test eax, eax
jne 0x46ed18
push str.RdpBmp
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
call esi
add esp, 4
jmp 0x46ed5a
push str.RdpBmp_sIconsRdp
mov eax, dword [0x59174c]
add eax, 0x384
push eax
push 0x2bb8
push str.Main.c
push str.RdpBmp_sIconsRdp
push 0x12c
lea eax, [ebp - 0x2c8]
push eax
call fcn.00482bc0
lea eax, [ebp - 0x2c8]
push eax
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
call esi
add esp, 0x20
mov ecx, dword [0x59174c]
mov dword [ecx + 0x7e0], eax
mov eax, dword [0x59174c]
add eax, 0x384
push eax
push str._sIconsEdit.ico
call fcn.0046fee0
add esp, 8
test eax, eax
jne 0x46edaa
mov eax, dword [0x59174c]
add eax, 0x384
push eax
push str._sIconsEdit.png
call fcn.0046fee0
add esp, 8
test eax, eax
jne 0x46edaa
push str.EditBmp
call esi
add esp, 4
jmp 0x46ede6
push str.EditBmp_sIconsEdit
mov eax, dword [0x59174c]
add eax, 0x384
push eax
push 0x2bbf
push str.Main.c
push str.EditBmp_sIconsEdit
push 0x12c
lea eax, [ebp - 0x2c8]
push eax
call fcn.00482bc0
lea eax, [ebp - 0x2c8]
push eax
call esi
add esp, 0x20
mov ecx, dword [0x59174c]
mov dword [ecx + 0x7e4], eax
push 0
push dword [0x597e78]
push 0
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
call esi
push eax
push 0x64
push 0x64
push 0
push 0
push 0x40000000
push 0
push str.VirtualDesktopInfoClass
push 0x8000004
mov edi, dword [sym.imp.USER32.dll_CreateWindowExA]
call edi
mov ecx, dword [0x59174c]
mov dword [ecx + 0x758], eax
push 3
push 0xc0
push 0xff00ff
mov eax, dword [0x59174c]
push dword [eax + 0x758]
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0
push dword [0x597e78]
push 0
call esi
push eax
push 0x64
push 0x64
push 0
push 0
push 0x40000000
push 0
push str.FreezeWindowClass
push 0x8000084
call edi
mov ecx, dword [0x59174c]
mov dword [ecx + 0x75c], eax
call fcn.0044f0a0
push 0
push 0x466bd0
push 0
push str.RdpZapperDialog
push dword [0x597e78]
mov edi, dword [sym.imp.USER32.dll_CreateDialogParamA]
call edi
mov ecx, dword [0x59174c]
mov dword [ecx + 0x748], eax
mov eax, dword [0x59174c]
mov esi, dword [eax + 0x748]
call fcn.00493410
mov dword [eax + 0xdb4], esi
push 0
push 0x473d50
mov eax, dword [0x59174c]
push dword [eax + 0x748]
push str.RdpMessageDialog
push dword [0x597e78]
call edi
mov ecx, dword [0x59174c]
mov dword [ecx + 0x74c], eax
mov eax, dword [0x59174c]
push dword [eax + 0x748]
call dword [sym.imp.USER32.dll_SetFocus]
call fcn.00460fd0
call fcn.00461aa0
call fcn.00493410
test eax, eax
je 0x46ef82
call fcn.00493410
cmp dword [eax], 0
je 0x46ef82
mov eax, dword [0x52e820]
test eax, eax
je 0x46ef30
mov esi, dword [eax + 0x190]
jmp 0x46ef36
mov esi, dword [0x52e824]
call fcn.00493410
test eax, eax
je 0x46ef48
call fcn.00493410
mov edx, dword [eax]
jmp 0x46ef4a
xor edx, edx
push str._s_ver__s_started
mov ecx, dword [0x59174c]
lea eax, [ecx + 0x733]
push eax
lea eax, [ecx + 0x258]
push eax
push str._s_ver__s_started
push dword [0x52e820]
push esi
push 0
push 0x2bd4
push str.Main.c
push 0
call edx
add esp, 0x28
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
nop
push 0
push 0
push 0
lea eax, [ebp - 0x70]
push eax
call esi
test eax, eax
je 0x46efc2
lea eax, [ebp - 0x70]
push eax
call fcn.004978e0
add esp, 4
test eax, eax
jne 0x46ef90
lea eax, [ebp - 0x70]
push eax
call edi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x46ef90
push 0x405
mov eax, dword [0x59174c]
push dword [eax + 0x748]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, eax
call fcn.00461bc0
mov ecx, dword [0x59174c]
mov ecx, dword [ecx + 0x760]
call fcn.0045f5b0
call fcn.00470b20
mov dword [0x596cb4], 0
push 1
push 0x4f20b4
mov eax, dword [0x59174c]
add eax, 0x258
push eax
push 0x4f20b4
push 0
push 0
call fcn.0047f200
add esp, 0x14
push eax
call fcn.0049efa0
add esp, 8
mov eax, dword [0x59174c]
push dword [eax + 0x748]
mov esi, dword [sym.imp.USER32.dll_DestroyWindow]
call esi
mov eax, dword [0x59174c]
mov dword [eax + 0x748], 0
mov eax, dword [0x59174c]
push dword [eax + 0x758]
call esi
mov ecx, dword [0x59174c]
mov ecx, dword [ecx + 0x7d8]
call fcn.0046d880
mov eax, dword [0x59174c]
mov ecx, dword [eax + 0x7d4]
test ecx, ecx
je 0x46f07f
call fcn.0042f870
mov eax, dword [0x59174c]
add eax, 0x7d4
cmp dword [eax], 0
je 0x46f0b7
push eax
call fcn.0047e900
mov eax, dword [0x59174c]
push dword [eax + 0x7d4]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 8
mov eax, dword [0x59174c]
mov dword [eax + 0x7d4], 0
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x46f0c5
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x597cf0]
test eax, eax
je 0x46f0d5
push eax
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov eax, dword [0x59174c]
mov eax, dword [eax + 0x7d0]
test eax, eax
je 0x46f0eb
push eax
call dword [0x595ea8]
mov dword [0x5939d8], 0
push 0x597e60
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10