Function at 0x414500
Capabilities:
Create process on windows
Create thread

Disassembly:
mov eax, 0x1a94
call fcn.004a5e30
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x1a8c], eax
push ebx
push ebp
push esi
push edi
cmp ecx, 0x2990
jg 0x414e97
je 0x414e8d
add ecx, 0xffffd84f
cmp ecx, 0x46
ja case.0x413f94.10176
movzx eax, byte [ecx + 0x414ffc]
jmp dword [eax*4 + 0x414f64]
push 0xc
push 0xf
push 0x4de958
push dword [0x4def88]
call fcn.00401149
jmp case.0x413f94.10176
push 0xe
jmp 0x413f9d
push 0xf
jmp 0x413f9d
push 0
push 0x462f50
push dword [0x4def88]
push str.IDD_SEARCH
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x413f94.10176
push 0
push 0x463210
jmp 0x413fc3
cmp dword [0x4c5194], 0
je case.0x413f94.10176
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x27b7
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 5
push 0x4f61
push dword [0x4def88]
call edi
push eax
call esi
mov dword [0x4c5194], 0
jmp case.0x413f94.10176
mov eax, dword [0x4dde94]
cmp eax, 1
jne 0x414061
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x413f94.10176
cmp eax, 0x156
jl 0x41406f
cmp eax, 0x158
jle 0x41408d
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push 1
push 0
push 0x1013
push 0x27c0
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x4232b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x413f94.10176
mov eax, dword [0x4dde94]
cmp eax, 1
je 0x41403e
cmp eax, 0x156
jl 0x4140ea
cmp eax, 0x158
jle 0x414108
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x4238f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x413f94.10176
lea eax, [esp + 0x88]
mov dword [0x4c5190], 1
push eax
push 0
push 0
push 0x423f90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x413f94.10176
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push 0x27b1
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 0
push 0x27b2
push dword [0x4def88]
call edi
push eax
call esi
mov dword [0x4c5190], 0
jmp case.0x413f94.10176
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x424fb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x413f94.10176
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x425570
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x413f94.10176
push 0
push 0x41a950
push dword [0x4def88]
push 0x4ade44
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x413f94.10176
push 0
push 0x41ac90
push dword [0x4def88]
push 0x4ade44
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x413f94.10176
mov edx, str.EXCLUDEREGISTRY
mov ecx, 0x27f2
call fcn.00401380
jmp case.0x413f94.10176
mov edx, str.EXCLUDEREGISTRYLNK
mov ecx, 0x27f3
call fcn.00401380
jmp case.0x413f94.10176
push 0x4ded80
push 0
push str.Confirm
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x4ded80
test eax, eax
je 0x414266
push 0x4ad0e0
jmp 0x41426b
push 0x4ad0a4
push str.Confirm
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.0x413f94.10176
push 0x4ded80
push 0
push str.Undo
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x4ded80
test eax, eax
je 0x4142ba
push 0x4ad0e0
push str.Undo
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.0x413f94.10176
push 0x4ad0a4
push str.Undo
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.0x413f94.10176
push 0x4ded80
push 0
push str.Exclude
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x4ded80
test eax, eax
je 0x41430e
push 0x4ad0e0
push str.Exclude
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.0x413f94.10176
push 0x4ad0a4
push str.Exclude
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.0x413f94.10176
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.00477440
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push eax
lea eax, [esp + 0x94]
push eax
call esi
lea eax, [esp + 0x90]
mov edx, 0x4ad0e0
push 0x24
push eax
mov ecx, 0x4ad9cc
call fcn.00477440
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
push eax
push dword [0x4def88]
call edi
cmp eax, 6
jne case.0x413f94.10176
push 0x4def98
lea eax, [esp + 0xa9c]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0xa98]
push str._bkup_
push eax
call esi
lea eax, [esp + 0xa98]
push eax
call fcn.00492383
mov ax, word [0x4ae3c8]
add esp, 4
movups xmm0, xmmword [str._e_BkUp_]
mov word [esp + 0x2a8], ax
lea eax, [esp + 0x2aa]
push 0x7ee
push 0
push eax
movups xmmword [esp + 0x2a4], xmm0
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0xa98]
push 0xa
push 0x64
push eax
push 0
call fcn.004927cc
add esp, 4
push eax
call fcn.0048f70e
add esp, 0x10
lea eax, [esp + 0xa98]
push eax
lea eax, [esp + 0x29c]
push eax
call esi
push 0x4ae3cc
lea eax, [esp + 0x29c]
push eax
call esi
push str.__HKEY_LOCAL_MACHINESOFTWARE_
lea eax, [esp + 0x29c]
push eax
call esi
lea eax, [esp + 0x298]
mov dword [esp + 0x10], 0x3c
xorps xmm0, xmm0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
movlpd qword [esp + 0x34], xmm0
push eax
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
mov dword [esp + 0x18], 0x40
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], str.regedit.exe
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 5
mov dword [esp + 0x34], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x29e]
mov edx, 0x4ad374
push eax
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0xaa0]
push 0x400
push eax
call fcn.0040a3c0
add esp, 0x10
call fcn.0041b180
push 0x40
mov edx, 0x4ad370
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0xaa0]
push eax
push dword [0x4def88]
call edi
jmp case.0x413f94.10176
push 0x7fc
lea eax, [esp + 0xaa0]
mov dword [esp + 0xa9c], 0
push 0
push eax
call fcn.0048e880
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
lea eax, [esp + 0xaa4]
add esp, 0xc
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x54], 0
mov dword [esp + 0x64], 0x400
push eax
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27e1
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push eax
push 0x1073
push 0x27e1
push dword [0x4def88]
call edi
push eax
call esi
cmp word [esp + 0xa98], 0
jne 0x4145d1
mov edx, 0x4ad08c
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4ad378
lea eax, [esp + 0x90]
mov ecx, 0x4ad9cc
push 0x30
push eax
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x413f94.10176
push 0x4def98
lea eax, [esp + 0x29c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str._bkup_
lea eax, [esp + 0x29c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x298]
push eax
call fcn.00492383
add esp, 4
mov dword [esp + 0x10], 0x3c
lea eax, [esp + 0xa98]
mov dword [esp + 0x14], 0x40
xorps xmm0, xmm0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
movlpd qword [esp + 0x34], xmm0
push eax
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], str.regedit.exe
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 5
mov dword [esp + 0x34], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.0041bae0
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x41c810
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x413f94.10176
call fcn.0041b370
jmp case.0x413f94.10176
push 0x27e1
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x7fc
mov edi, eax
mov dword [esp + 0x29c], 0
lea eax, [esp + 0x2a0]
push 0
push eax
call fcn.0048e880
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x2a4]
add esp, 0xc
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x54], 0
mov dword [esp + 0x64], 0x400
push eax
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call ebx
push eax
push 0x1073
push edi
call ebx
cmp word [esp + 0x298], 0
jne 0x414750
mov edx, 0x4ad08c
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4ad0a0
jmp 0x4145ab
push 0x4ded80
push 3
lea eax, [esp + 0x90]
push eax
push 0
push str.Confirm
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x88], 0x31
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
jne 0x4147cb
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x94]
push eax
call esi
lea eax, [esp + 0x90]
mov edx, 0x4ad0d0
push 0x24
push eax
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x413f94.10176
push 0x4def98
lea eax, [esp + 0x129c]
push eax
call esi
push str._bkup_
lea eax, [esp + 0x129c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x1298]
push eax
call fcn.00492383
add esp, 4
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je case.0x413f94.10176
mov ebp, 0x414
nop dword [eax]
lea eax, [esp + 0xa98]
mov dword [esp + 0x54], 0
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
push eax
push esi
push 0x1073
push edi
mov dword [esp + 0x74], 0x400
call ebx
xorps xmm0, xmm0
mov dword [esp + 0x28], 0
lea eax, [esp + 0xa98]
movq qword [esp + 0x20], xmm0
push eax
movups xmmword [esp + 0x14], xmm0
mov word [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
cmp word [esp + eax*2 + 0xa96], 0x5c
jne 0x41488b
mov word [esp + eax*2 + 0xa96], cx
jmp 0x414893
mov word [esp + eax*2 + 0xa9a], cx
mov eax, dword [0x4def88]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xa98]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], 0
mov word [esp + 0x24], bp
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 0
push esi
push 0x1008
push edi
call ebx
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 2
lea eax, [esi - 1]
push eax
push 0x100c
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x414820
jmp case.0x413f94.10176
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x41b530
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x413f94.10176
push 0x27e2
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
push 0
push 0
push 0x1004
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x41496a
mov edx, 0x4ad0dc
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4ad0cc
jmp 0x4145ab
push 0x4ded80
push 1
push str.Confirm
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
test eax, eax
je 0x4149d4
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x94]
push eax
call ebp
lea eax, [esp + 0x90]
mov edx, 0x4ad0d4
push 0x24
push eax
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x413f94.10176
push 0x4def98
lea eax, [esp + 0x129c]
push eax
call ebp
push str.undo_
lea eax, [esp + 0x129c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x1298]
push eax
call fcn.00492383
add esp, 4
xor eax, eax
mov word [esp + 0x298], ax
push 0x7fe
push eax
lea eax, [esp + 0x2a2]
push eax
call fcn.0048e880
mov ebp, dword [sym.imp.SHELL32.dll_SHFileOperationW]
add esp, 0xc
nop dword [eax]
lea eax, [esp + 0x298]
mov dword [esp + 0x54], 0
mov dword [esp + 0x60], eax
dec esi
lea eax, [esp + 0x4c]
mov dword [esp + 0x64], 0x400
push eax
push esi
push 0x1073
push edi
call ebx
xorps xmm0, xmm0
mov dword [esp + 0x28], 0
lea eax, [esp + 0x298]
movq qword [esp + 0x20], xmm0
push eax
movups xmmword [esp + 0x14], xmm0
mov word [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
cmp word [esp + eax*2 + 0x296], 0x5c
jne 0x414a9c
mov word [esp + eax*2 + 0x296], cx
jmp 0x414aa4
mov word [esp + eax*2 + 0x29a], cx
mov eax, dword [0x4def88]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x298]
mov dword [esp + 0x18], eax
mov eax, 0x454
mov word [esp + 0x20], ax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], 0
call ebp
push 0
push esi
push 0x1008
push edi
call ebx
test esi, esi
jne 0x414a30
jmp case.0x413f94.10176
call fcn.0041b940
jmp case.0x413f94.10176
push 0x27e2
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x7fc
mov edi, eax
mov dword [esp + 0xa9c], 0
lea eax, [esp + 0xaa0]
push 0
push eax
call fcn.0048e880
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0xaa4]
add esp, 0xc
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x54], 0
mov dword [esp + 0x64], 0x400
push eax
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call ebx
push eax
push 0x1073
push edi
call ebx
cmp word [esp + 0xa98], 0
jne 0x414b9e
mov edx, 0x4ad08c
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4ad3dc
jmp 0x4145ab
push 0x4ded80
push 1
push str.Confirm
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
cmp eax, 1
jne 0x414c09
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x94]
push eax
call esi
lea eax, [esp + 0x90]
mov edx, 0x4ad0d4
push 0x24
push eax
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x413f94.10176
push 0x4def98
lea eax, [esp + 0x129c]
push eax
call esi
push str.undo_
lea eax, [esp + 0x129c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x1298]
push eax
call fcn.00492383
add esp, 4
xor eax, eax
mov word [esp + 0x298], ax
push 0x7fe
push eax
lea eax, [esp + 0x2a2]
push eax
call fcn.0048e880
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je case.0x413f94.10176
mov ebp, 0x414
nop word [eax + eax]
lea eax, [esp + 0x298]
mov dword [esp + 0x54], 0
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
push eax
push esi
push 0x1073
push edi
mov dword [esp + 0x74], 0x400
call ebx
xorps xmm0, xmm0
mov dword [esp + 0x28], 0
lea eax, [esp + 0x298]
movq qword [esp + 0x20], xmm0
push eax
movups xmmword [esp + 0x14], xmm0
mov word [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
cmp word [esp + eax*2 + 0x296], 0x5c
jne 0x414ceb
mov word [esp + eax*2 + 0x296], cx
jmp 0x414cf3
mov word [esp + eax*2 + 0x29a], cx
mov eax, dword [0x4def88]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x298]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], 0
mov word [esp + 0x24], bp
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 0
push esi
push 0x1008
push edi
call ebx
push 2
lea eax, [esi - 1]
push eax
push 0x100c
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x414c80
jmp case.0x413f94.10176
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movaps xmm0, xmmword [0x4c1440]
push eax
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x4c
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], str.appwiz.cpl
movups xmmword [esp + 0x28], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.0x413f94.10176
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27c4
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
call fcn.0041d770
jmp case.0x413f94.10176
lea eax, [esp + 0x88]
push eax
push 0
push 0
push fcn.0041bae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x413f94.10176
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27c9
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
call fcn.0041dc70
jmp case.0x413f94.10176
push 0x27c0
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov ecx, eax
call fcn.0041df10
jmp case.0x413f94.10176
push 0x27d2
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 1
mov ecx, eax
call fcn.0041df10
jmp case.0x413f94.10176
call fcn.0041e270
call fcn.0041a4f0
jmp case.0x413f94.10176
call fcn.0041e6d0
call fcn.0041a5c0
jmp case.0x413f94.10176
call fcn.0041e9c0
jmp case.0x413f94.10176
call fcn.0041b180
jmp case.0x413f94.10176
sub ecx, 0x2991
je 0x414f40
sub ecx, 0x3b
je case.0x413f94.10222
sub ecx, 0x2595
jne case.0x413f94.10176
mov eax, dword [0x4dde94]
cmp eax, 0x156
jl 0x414ecb
cmp eax, 0x158
jle 0x414ee9
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x4f61
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 5
push 0x27b7
push dword [0x4def88]
call edi
push eax
call esi
lea eax, [esp + 0x88]
mov dword [0x4c5194], 1
push eax
push 0
push 0
push 0x41ee20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x413f94.10176
call fcn.0041ae70
mov ecx, dword [esp + 0x1a9c]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d925
add esp, 0x1a94
ret