Function at 0x48b710
Capabilities:
Create thread
Get geographical location
Get graphical window text
Hide graphical window
Initialize winsock library
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f66d0
mov eax, dword fs:[0]
push eax
sub esp, 0xcec
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x18]
xorps xmm0, xmm0
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc6c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc58], eax
lea eax, [ebp - 0xc44]
push eax
push 0x101
mov dword [ebp - 0xc64], edi
movups xmmword [ebp - 0xa48], xmm0
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x10
push 0x5325f4
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x550358
call esi
push 0x550370
call esi
push 0x550388
call esi
push 0x5503a0
call esi
call fcn.0047bbd0
call fcn.00432a50
mov byte [0x54fef8], al
call fcn.004a8500
push edi
mov byte [0x54fc8f], al
call dword [sym.imp.USER32.dll_GetMenu]
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
mov edi, eax
mov eax, dword [ebp - 0xc64]
push 0x7f02
push 0
mov dword [0x54fea0], eax
call esi
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0x7f00
push 0
mov dword [ebp - 0xc78], eax
call esi
push 0xa
push dword [0x54a9b8]
mov dword [0x54fefc], eax
call esi
push 0x11
mov dword [0x5503c4], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
lea ecx, [ebp - 0xab4]
push ecx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
lea eax, [ebp - 0xab4]
mov byte [ebp - 0xa9f], 1
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0x50ecec
mov dword [0x54af28], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov esi, dword [sym.imp.USER32.dll_GetSubMenu]
push 0xe
push 2
push edi
mov dword [0x54fe9c], eax
call esi
push eax
call esi
mov dword [0x5503cc], eax
push 0x400
push 0
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
test eax, eax
je 0x48b87f
mov eax, dword [0x5503cc]
jmp 0x48b866
mov eax, dword [0x54b6b4]
xor esi, esi
test eax, eax
jle 0x48b91c
nop
imul ecx, esi, 0x5f4
lea edx, [esi + 1]
mov dword [ebp - 0xc50], edx
add ecx, 0x54b6b8
cmp esi, 0xa
jge 0x48b8ca
xor eax, eax
cmp esi, 9
cmovne eax, edx
push eax
push ecx
lea eax, [ebp - 0x628]
push 0x50ec9c
push eax
call fcn.0042fa30
add esp, 0x10
jmp 0x48b8eb
push ecx
lea eax, [ebp - 0x628]
push 0x104
push eax
call fcn.004c913a
mov eax, dword [ebp - 0xc50]
add esp, 0xc
mov dword [ebp - 0xc50], eax
lea eax, [ebp - 0x628]
push eax
lea eax, [esi + 0x9ed9]
push eax
push 0
push dword [0x5503cc]
call dword [sym.imp.USER32.dll_AppendMenuW]
mov esi, dword [ebp - 0xc50]
mov eax, dword [0x54b6b4]
cmp esi, eax
jl 0x48b890
test eax, eax
jne 0x48b933
push 0x50ecb4
push 0
push 2
push dword [0x5503cc]
call dword [sym.imp.USER32.dll_AppendMenuW]
push 0x50ed14
push dword [0x54a9b8]
call dword [sym.imp.USER32.dll_LoadMenuW]
push 0x50ed28
push 0x9cba
push 0x400
push 1
push 0
push edi
mov dword [0x54fef0], eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov esi, dword [sym.imp.USER32.dll_InsertMenuW]
push eax
call esi
inc dword [0x532638]
cmp dword [0x54a9bc], 1
jl 0x48b98b
call fcn.0047d390
test al, al
jne 0x48b9ae
push 0x50ed58
jmp 0x48b990
push 0x50ed8c
push 0x9cb9
push 0x400
push 1
push 0
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call esi
inc dword [0x532638]
push 0x50eda0
push 0x9cbf
push 0
push 0x9cbe
push edi
call esi
push 0x50eda0
push 0x9cbf
push 0
push 0x9cbe
push dword [0x54fef0]
call esi
push 0x50edc4
push 0x9cbd
push 0
push 0x9cbb
push edi
call esi
push 0x50edc4
push 0x9cbd
push 0
push 0x9cbb
push dword [0x54fef0]
call esi
cmp dword [0x54a9bc], 1
jl 0x48ba96
push 0x50ede8
push 0x9cbc
push 0
push 0x9cbb
push edi
call esi
push 0x50ede8
push 0x9cbc
push 0
push 0x9cbb
push dword [0x54fef0]
call esi
cmp dword [0x54a9bc], 1
jl 0x48ba96
call fcn.0047d390
test al, al
jne 0x48ba96
push 0
push 0
push 0xc00
push 3
push 0
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call esi
inc dword [0x532638]
push 0x50ee48
push 0x9f12
push 0x400
push 4
push 0
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call esi
inc dword [0x532638]
jmp 0x48baa8
mov eax, dword [0x5551ac]
test eax, eax
je 0x48baa8
push 1
push 0x7f2
call eax
push 0x50c220
push 0x50ee88
push dword [0x54a9b8]
call dword [sym.imp.USER32.dll_LoadMenuW]
push eax
push 0x10
push 0x9c6e
push edi
call esi
push 0
push 0
push 0x800
push 0x9c6e
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
cmp byte [0x54f261], al
mov ecx, 8
cmovne eax, ecx
push eax
push 0x9cb2
push edi
call esi
xor eax, eax
mov edx, 8
cmp byte [0x54f270], al
cmovne eax, edx
push eax
push 0x9cb3
push edi
call esi
xor eax, eax
cmp byte [0x54f270], al
sete al
push eax
push 0x9f36
push edi
call dword [sym.imp.USER32.dll_EnableMenuItem]
cmp byte [0x54f270], 0
je 0x48bb38
call fcn.004bb940
xor eax, eax
mov ecx, 8
cmp byte [0x54f24a], al
cmovne eax, ecx
push eax
push 0x9ec4
push edi
call esi
xor eax, eax
mov ecx, 8
cmp byte [0x54f24d], al
cmovne eax, ecx
push eax
push 0x9f0f
push edi
call esi
xor eax, eax
mov ecx, 8
cmp byte [0x54f24b], al
cmovne eax, ecx
push eax
push 0x9f16
push edi
call esi
xor eax, eax
mov ecx, 8
cmp byte [0x54f24c], al
cmovne eax, ecx
push eax
push 0x9f17
push edi
call esi
xor eax, eax
mov ecx, 8
cmp byte [0x54f25e], al
cmovne eax, ecx
push eax
push 0x9c83
push edi
call esi
xor eax, eax
mov ecx, 8
cmp byte [0x54f25c], al
cmovne eax, ecx
push eax
push 0x9c75
push edi
call esi
xor eax, eax
mov ecx, 8
cmp byte [0x54f25a], al
cmovne eax, ecx
push eax
push 0x9c99
push edi
call esi
cmp byte [0x54f25d], 0
mov ecx, dword [0x54fea0]
setne al
mov dword [ebp - 0xc48], ecx
movzx esi, al
push ecx
mov byte [0x54f25d], al
shl esi, 3
call dword [sym.imp.USER32.dll_GetMenu]
push esi
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0x9c82
push eax
call esi
cmp byte [0x54f25d], 0
je 0x48bc5d
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0xc48]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x54feb8]
test eax, eax
je 0x48bc94
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x48bc94
mov ecx, dword [0x54feb8]
mov eax, dword [sym.imp.USER32.dll_SetWindowPos]
test ecx, ecx
je 0x48bc80
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push ecx
call eax
mov eax, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [ebp - 0xc48]
call eax
xor eax, eax
mov ecx, 8
cmp byte [0x54f251], al
cmovne eax, ecx
push eax
push 0x9c6d
push edi
call esi
xor eax, eax
mov ecx, 8
cmp byte [0x54f25f], al
cmovne eax, ecx
push eax
push 0x9c96
push edi
call esi
xor eax, eax
mov ecx, 8
cmp byte [0x54f260], al
cmovne eax, ecx
push eax
push 0x9f25
push edi
call esi
xor eax, eax
mov ecx, 8
cmp byte [0x54f264], al
cmovne eax, ecx
push eax
push 0x9f0d
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_InsertMenuW]
push 0x50ee98
push 0x9c7c
push 0
push 0x9c67
push edi
call esi
lea eax, [ebp - 0xc94]
push eax
lea eax, [ebp - 0xc8c]
push eax
call fcn.0045be00
add esp, 8
test al, al
je 0x48be15
push 1
push 1
push 1
call fcn.004590e0
mov dword [0x550ac0], eax
push 0
push 1
mov dword [eax + 0x1c], 4
mov eax, dword [0x550ac0]
push 1
mov dword [eax + 0x38], 0x8080ff
mov eax, dword [0x550ac0]
movsd xmm0, qword [0x50b100]
movsd qword [eax + 0x30], xmm0
call fcn.004590e0
mov dword [0x550ac4], eax
add esp, 0x18
mov dword [eax + 0x1c], 5
mov eax, dword [0x550ac4]
mov dword [eax + 0x38], 0xaaaa
mov ecx, dword [ebp - 0xc8c]
mov eax, ecx
mov edx, dword [ebp - 0xc88]
or eax, edx
movsd xmm0, qword [0x50ae90]
je 0x48bdb2
call fcn.004c3dc0
cvtsd2ss xmm0, xmm0
cvtss2sd xmm0, xmm0
mov eax, dword [0x550ac4]
push 0
push 1
push 1
movsd qword [eax + 0x30], xmm0
call fcn.004590e0
mov dword [0x550ac8], eax
add esp, 0xc
mov dword [eax + 0x1c], 6
mov eax, dword [0x550ac8]
mov dword [eax + 0x38], 0x4080ff
mov ecx, dword [ebp - 0xc94]
mov eax, ecx
mov edx, dword [ebp - 0xc90]
or eax, edx
je 0x48be03
call fcn.004c3dc0
cvtsd2ss xmm0, xmm0
cvtss2sd xmm0, xmm0
jmp 0x48be0b
movsd xmm0, qword [0x50ae90]
mov eax, dword [0x550ac8]
movsd qword [eax + 0x30], xmm0
push 0
push 0
push 0x800
push 0x9c67
push edi
call esi
push 0x50eed4
push 0x9c7b
push 0
push 0x9c75
push edi
call esi
call fcn.0047b940
movzx eax, al
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x9c7b
push edi
call dword [sym.imp.USER32.dll_CheckMenuItem]
cmp dword [0x54a9bc], 1
jl 0x48bfb9
call fcn.0047d390
test al, al
jne 0x48bfb9
mov eax, dword [0x54af08]
mov dword [ebp - 0xc50], eax
call fcn.0043afe0
mov dword [ebp - 0xc54], eax
mov dword [ebp - 0xc68], 0x9c7b
mov dword [ebp - 4], 0
call fcn.0042db70
mov ecx, eax
test ecx, ecx
je 0x48cf7e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov dword [ebp - 0xc5c], eax
mov eax, dword [ebp - 0xc54]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x48bee1
mov ecx, dword [ebp - 0xc50]
push eax
push 0xffffffffffffffff
push dword [ecx + 0x90]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov dword [ebp - 0xc48], eax
jmp 0x48beeb
mov dword [ebp - 0xc48], 0xffffffff
mov eax, dword [ebp - 0xc50]
lea ecx, [ebp - 0xc68]
push 0xa3b3df42
push ecx
add eax, 0x70
lea ecx, [ebp - 0xca0]
push ecx
mov ecx, eax
mov dword [ebp - 0xc54], eax
call fcn.00445ce0
mov eax, dword [eax + 4]
test eax, eax
jne 0x48bf24
mov eax, dword [ebp - 0xc54]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0xc50]
cmp eax, dword [ecx + 0x74]
je 0x48bf3a
mov ecx, dword [ebp - 0xc48]
mov dword [eax + 0x10], ecx
jmp 0x48bf9e
push dword [ebp - 0xc5c]
mov dword [ebp - 0xc84], 0x9c7b
call fcn.00440d70
mov ecx, dword [ebp - 0xc48]
add eax, 0x10
add esp, 4
mov dword [ebp - 0xc80], eax
lea eax, [ebp - 0xc84]
mov dword [ebp - 0xc7c], ecx
mov ecx, dword [ebp - 0xc54]
push eax
lea eax, [ebp - 0xca0]
push eax
call fcn.00466310
mov edx, dword [ebp - 0xc80]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48bf9e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xc5c]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48bfb9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0047b940
test al, al
je 0x48bfd2
push 0
push dword [0x54fea0]
call fcn.0047bd40
add esp, 8
call fcn.0047b670
movzx eax, al
shl eax, 3
push eax
push 0x9f30
push edi
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
mov ecx, 8
cmp byte [0x54f25b], al
cmovne eax, ecx
push eax
push 0x9c77
push edi
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0x50ef00
push 0x9c78
push 0
push 0x9c81
push edi
call esi
push 0
push 0x9c50
push edi
call dword [sym.imp.USER32.dll_DeleteMenu]
push 0x50ef2c
push 0x9c80
push 0
push 0x9c81
push edi
call esi
lea eax, [ebp - 0xc70]
push eax
lea eax, [ebp - 0xc74]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
je 0x48c0bb
cmp dword [ebp - 0xc70], 0
je 0x48c0bb
lea eax, [ebp - 0xcbc]
mov dword [ebp - 0xcbc], 0x1c
push eax
push edi
mov dword [ebp - 0xcb8], reloc.OLEAUT32.dll_SafeArrayGetDim
mov dword [ebp - 0xcb4], 0x8000000
call dword [sym.imp.USER32.dll_SetMenuInfo]
call dword [sym.imp.USER32.dll_CreateMenu]
push 0x50ef58
push eax
push 0x410
push 5
push edi
mov dword [0x5503d8], eax
call esi
push dword [ebp - 0xc74]
inc dword [0x53263c]
call sub.WTSAPI32.dll_WTSFreeMemory
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x104
lea ecx, [ebp - 0xa38]
push ecx
push 0x104
lea ecx, [ebp - 0x830]
push ecx
push 0
push esi
push eax
call fcn.004aa730
add esp, 0x34
cmp word [ebp - 0xa38], 0
je 0x48c112
cmp word [ebp - 0x830], 0
mov eax, 0x4f9dfc
jne 0x48c117
mov eax, 0x4f9d20
lea ecx, [ebp - 0x830]
push ecx
push eax
lea eax, [ebp - 0xa38]
push eax
push 0x50c8bc
push 0x54fc90
call fcn.0042fa30
add esp, 0x14
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x54fea0]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48c160
sub ecx, edx
mov eax, 0x104
sar ecx, 1
push 0x54fc90
sub eax, ecx
push 0x50ef68
push eax
lea eax, [ebp - 0x218]
lea eax, [eax + ecx*2]
push eax
call fcn.00415290
add esp, 0x10
call fcn.0047d390
test al, al
je 0x48c1b5
push 0x50ef74
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004d6355
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push dword [0x54fea0]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x54f698
call fcn.0046d040
push 0x54f6a0
mov dword [0x5503e0], eax
call fcn.0046d040
push 0x54f6a8
mov dword [0x5503e4], eax
call fcn.0046d040
push 0x54f6b0
mov dword [0x5503e8], eax
call fcn.0046d040
push 0x54f6b8
mov dword [0x5503ec], eax
call fcn.0046d040
push 0x54fe98
mov dword [0x5503f0], eax
call fcn.0047d1a0
add esp, 0x18
cmp dword [0x54ff34], 1
jbe 0x48c460
push 0x50ef98
push 0x4a7
push 0x400
push 2
push 3
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
mov esi, dword [sym.imp.USER32.dll_InsertMenuW]
push eax
call esi
xor eax, eax
cmp byte [0x54f262], al
push 8
setne al
add eax, 0x9cb6
push eax
push edi
call dword [sym.imp.USER32.dll_CheckMenuItem]
cmp dword [0x555198], 0
mov dword [ebp - 0xc4c], 0
je 0x48c2ce
call fcn.004a9a60
mov dword [0x550aa4], eax
lea eax, [ebp - 0xc4c]
push eax
push 0
push 0xffff
call dword [0x555198]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x48c31d
push dword [ebp - 0xc4c]
call fcn.004c8d7a
add esp, 4
mov dword [0x550aa8], eax
lea ecx, [ebp - 0xc4c]
push ecx
push eax
push 0xffff
call dword [0x555198]
jmp 0x48c31d
lea eax, [ebp - 0xc4c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x48c31d
push dword [ebp - 0xc4c]
call fcn.004c8d7a
add esp, 4
mov dword [0x550aa8], eax
lea ecx, [ebp - 0xc4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
mov eax, 0xaaaaaaab
mul dword [ebp - 0xc4c]
shr edx, 4
mov dword [0x550aa4], edx
mov eax, dword [0x550aa4]
shl eax, 2
push eax
call fcn.004c8d7a
mov dword [0x550ab0], eax
add esp, 4
xor eax, eax
mov dword [ebp - 0xc48], eax
mov eax, dword [0x550aa4]
test eax, eax
jle 0x48c466
xor esi, esi
nop word [eax + eax]
push 0
push 2
push eax
call fcn.004590e0
mov ecx, dword [0x550ab0]
mov dword [ecx + esi*4], eax
mov eax, dword [0x550ab0]
mov eax, dword [eax + esi*4]
mov dword [eax + 0x880], esi
mov eax, dword [0x550ab0]
mov ecx, dword [eax + esi*4]
lea eax, [ecx + 0x878]
push eax
lea eax, [ecx + 0x87c]
push eax
xor eax, eax
cmp dword [0x555198], eax
push esi
push dword [0x550aa4]
setne al
push eax
push dword [0x550aa8]
call fcn.0047a0c0
mov eax, dword [0x550ab0]
add esp, 0x24
mov eax, dword [eax + esi*4]
mov dword [eax + 0x20], 2
mov eax, dword [0x550ab0]
mov eax, dword [eax + esi*4]
mov dword [eax + 0x1c], 0
mov eax, dword [0x550ab0]
mov eax, dword [eax + esi*4]
mov dword [eax + 0x38], 0x3c943c
mov eax, dword [0x550ab0]
movsd xmm0, qword [0x50b100]
mov eax, dword [eax + esi*4]
movsd qword [eax + 0x30], xmm0
mov eax, dword [0x550ab0]
mov eax, dword [eax + esi*4]
mov dword [eax + 0x50], 0xff
mov eax, dword [0x550ab0]
mov eax, dword [eax + esi*4]
movsd qword [eax + 0x48], xmm0
mov eax, dword [0x550ab0]
mov ecx, dword [eax + esi*4]
mov eax, dword [0x550abc]
mov dword [ecx + 0x884], eax
test esi, esi
je 0x48c44c
mov esi, dword [0x550ab0]
mov eax, dword [esi]
mov ecx, dword [eax + 0x86c]
mov edx, dword [eax + 0x870]
mov eax, dword [ebp - 0xc48]
mov eax, dword [esi + eax*4]
mov esi, dword [ebp - 0xc48]
mov dword [eax + 0x86c], ecx
mov dword [eax + 0x870], edx
mov eax, dword [0x550aa4]
inc esi
mov dword [ebp - 0xc48], esi
cmp esi, eax
jl 0x48c350
mov esi, dword [sym.imp.USER32.dll_InsertMenuW]
call sub.POWRPROF.dll_IsPwrHibernateAllowed
test al, al
je 0x48c483
push 0x50efbc
push 0x9c87
push 0
push 0x9c86
push edi
call esi
call sub.POWRPROF.dll_IsPwrSuspendAllowed
test al, al
je 0x48c4a0
push 0x50efd4
push 0x9c88
push 0
push 0x9c86
push edi
call esi
push 0x50efe8
push 0x9c92
push 0
push 0x9c86
push edi
call esi
push 0x50eff4
push dword [0x54a9b8]
call dword [sym.imp.USER32.dll_LoadMenuW]
xor ecx, ecx
mov dword [0x5503d0], eax
cmp byte [0x54f259], cl
mov edx, 8
cmovne ecx, edx
push ecx
push 0x9c50
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0x50f004
push dword [0x54a9b8]
call dword [sym.imp.USER32.dll_LoadMenuW]
mov ecx, dword [0x54af08]
push ecx
mov dword [0x5503d4], eax
lea edx, [ecx + 0x6c]
mov ecx, esp
mov dword [ecx], eax
mov ecx, edx
call fcn.00466720
xor eax, eax
mov ecx, 8
cmp byte [0x54f252], al
cmovne eax, ecx
push eax
push 0x9c47
push edi
call dword [sym.imp.USER32.dll_CheckMenuItem]
lea eax, [ebp - 0xc60]
push eax
push 0x50f020
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x48c617
xor eax, eax
push eax
push eax
push 0x4f9f5c
mov word [0x54ff48], ax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0xc5c], eax
test eax, eax
je 0x48c65f
lea ecx, [eax*2 + 2]
push ecx
call fcn.004c8d7a
add esp, 4
mov dword [ebp - 0xc54], eax
push dword [ebp - 0xc5c]
push eax
push 0x4f9f5c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x54ff48
push dword [ebp - 0xc5c]
push dword [ebp - 0xc54]
push 0x50f060
call fcn.00479c80
add esp, 0x10
test al, al
je 0x48c5ff
push 0x50f078
push 0x9c64
push 0
push 0x9f22
push edi
call esi
push 0x50f078
push 0x9c60
push 0
push 0x9caf
push dword [0x5503d0]
call esi
push dword [ebp - 0xc54]
mov byte [0x54fef9], 1
call fcn.004c8d5f
add esp, 4
jmp 0x48c65f
push dword [ebp - 0xc54]
xor eax, eax
mov word [0x54ff48], ax
call fcn.004c8d5f
add esp, 4
jmp 0x48c65f
push 0x50f078
push 0x9c64
push 0
push 0x9f22
push edi
mov byte [0x54fef9], 1
call esi
push 0x50f078
push 0x9c60
push 0
push 0x9caf
push dword [0x5503d0]
call esi
push dword [ebp - 0xc60]
xor eax, eax
mov word [0x54ff48], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x5503d0]
mov edx, dword [0x54af08]
push ecx
mov eax, esp
mov dword [eax], ecx
lea ecx, [edx + 0x6c]
call fcn.00466720
lea eax, [ebp - 0xc60]
push eax
push 0x50f0a0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x48c763
lea eax, [ebp - 0xc4c]
mov dword [ebp - 0xc4c], 0x208
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xc98]
push eax
push 0
push 0x4ff9a4
push dword [ebp - 0xc60]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48c757
push 0x104
push 0x550150
call fcn.004c98b5
add esp, 8
cmp word [ebp - 0x420], 0x22
jne 0x48c71a
lea eax, [ebp - 0x41e]
push eax
push 0x104
push 0x550150
call fcn.004c913a
push 0x22
push 0x550150
call fcn.004c56b8
add esp, 0x14
test eax, eax
je 0x48c757
push 0x22
jmp 0x48c745
lea eax, [ebp - 0x420]
push eax
push 0x104
push 0x550150
call fcn.004c913a
push 0x20
push 0x550150
call fcn.004c56b8
add esp, 0x14
test eax, eax
je 0x48c757
push 0x20
push 0x550150
call fcn.004c56b8
add esp, 8
xor ecx, ecx
mov word [eax], cx
push dword [ebp - 0xc60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [0x550150], 0
je 0x48c781
push 0x50f10c
push 0x9c68
push 0
push 0x9f22
push edi
call esi
push 0
push 0x9f22
push edi
call dword [sym.imp.USER32.dll_DeleteMenu]
push 0x67
push dword [ebp - 0xc64]
call fcn.004baf90
add esp, 8
mov dword [0x54feb4], eax
test eax, eax
je 0x48cf60
push 3
push 0
call fcn.0046c9d0
add esp, 8
lea eax, [ebp - 0xa48]
push eax
push dword [0x54feb4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0xa3c]
xorps xmm0, xmm0
sub eax, dword [ebp - 0xa44]
add eax, 2
mov dword [0x5507dc], eax
lea eax, [ebp - 0xa58]
push eax
push 0x52010000
push 0x65
push dword [0x54a9b8]
movups xmmword [ebp - 0xa58], xmm0
push dword [ebp - 0xc6c]
call fcn.00432e80
add esp, 0x14
mov dword [0x54fea4], eax
test eax, eax
je 0x48cf60
push dword [0x54af20]
push eax
call fcn.0046da70
push dword [0x54fea4]
call fcn.00434da0
add esp, 0xc
mov esi, eax
mov ecx, esi
push 0
mov dword [esi + 0xd0], 0x473700
call fcn.00434aa0
push 0x6a
mov dword [esi + 0xd4], 0x473900
push dword [0x54a9b8]
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
mov ecx, esi
call fcn.00438220
push 1
mov ecx, esi
call fcn.00434a90
push 0
mov ecx, esi
call fcn.00438210
push 0
mov ecx, esi
call fcn.00438230
mov ecx, esi
call fcn.004355a0
push eax
call fcn.00479b90
add esp, 4
mov ecx, esi
call fcn.004351c0
push eax
call fcn.00479b90
add esp, 4
mov ecx, esi
call fcn.004351d0
push eax
call fcn.00479b90
push 0x54b0c0
call fcn.00489580
add esp, 8
push 0
push 0
push dword [0x54b2cc]
push 0x54b2d0
push 0x54b390
push dword [0x54fea4]
call fcn.0046f9f0
test eax, eax
je 0x48cf60
push 0
push dword [0x5505f0]
mov ecx, esi
call fcn.004381e0
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push 0xffffffffffffffff
push 0x7f00
push 0
call esi
push eax
mov ecx, 0x5505f0
call fcn.00489640
push 0xffffffffffffffff
push 0x7f00
push 0
call esi
push eax
mov ecx, 0x550420
call fcn.00489640
cmp byte [0x54b2ca], 0
jne 0x48c94b
movzx eax, byte [0x54b514]
push eax
push dword [0x54b510]
push 0xffffffffffffffff
push dword [0x54fea4]
call fcn.00472e10
add esp, 0x10
mov eax, dword [ebp - 0xc58]
push 0x66
push dword [0x54b51c]
push 0x54b520
push 0x54b62c
push 0x40810405
push dword [eax + 4]
call fcn.0046c2d0
mov esi, eax
add esp, 0x18
mov dword [0x54fea8], esi
test esi, esi
je 0x48cf60
mov eax, dword [ebp - 0xc58]
push 0
push 0
push 0x1304
push dword [eax + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x50f11c
push esi
mov esi, dword [ebp - 0xc58]
mov ecx, esi
push eax
call fcn.00476250
movzx eax, byte [0x54b6b0]
push eax
push dword [0x54b6ac]
push 0xffffffffffffffff
push dword [0x54fea8]
call fcn.00472e10
push 0x68
push dword [0x54b5e8]
push 0x54b5ec
push 0x54b560
push 0x40810405
push dword [esi + 4]
call fcn.0046c2d0
mov esi, eax
add esp, 0x28
mov dword [0x54feac], esi
test esi, esi
je 0x48cf60
mov eax, dword [ebp - 0xc58]
push 0
push 0
push 0x1304
push dword [eax + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc58]
push 0
push 1
push 0x50f12c
push esi
push eax
call fcn.00476250
movzx eax, byte [0x54b5e4]
push eax
push dword [0x54b5e0]
push 0xffffffffffffffff
push dword [0x54feac]
call fcn.00472e10
add esp, 0x10
push 0x6a
push dword [0x54fea0]
push 0x4f9d20
push 0x50000000
call dword [sym.imp.COMCTL32.dll_CreateStatusWindowW]
push eax
mov dword [0x54feb0], eax
call fcn.004b9e80
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
add esp, 4
push 0x69
push dword [0x54a9b8]
call esi
mov dword [0x5507e0], eax
test eax, eax
jne 0x48ca98
push 0x7f00
push eax
call esi
mov dword [0x5507e0], eax
push 0x6a
push dword [0x54a9b8]
call esi
mov dword [0x5507e4], eax
test eax, eax
jne 0x48cab8
push 0x7f00
push eax
call esi
mov dword [0x5507e4], eax
xor eax, eax
mov ecx, 8
cmp byte [0x54f259], al
cmovne eax, ecx
push eax
push 0x9c50
push edi
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 5
push dword [0x54fea4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
cmp byte [0x54b2ca], al
sete al
push eax
push 0x9c67
push 0x401
push dword [0x54feb4]
call esi
push dword [0x54fea0]
xor eax, eax
cmp byte [0x54b2ca], al
setne al
mov dword [ebp - 0xc6c], eax
call dword [sym.imp.USER32.dll_GetMenu]
push dword [ebp - 0xc6c]
push 0x9c67
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 1
push 0x9c6c
push dword [0x54fea0]
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x54ff00
push dword [ebp - 0xc64]
mov dword [0x5503b8], eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x54ff04]
mov ecx, dword [0x5507dc]
dec eax
add ecx, eax
mov dword [0x54ff10], 0
mov eax, dword [0x54ff0c]
sub eax, ecx
mov dword [0x54ff04], ecx
mov dword [0x54ff0c], eax
sub eax, ecx
push 0x50f138
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x54b0a8]
cvttsd2si eax, xmm0
add eax, ecx
mov dword [0x54ff14], eax
add eax, 7
mov dword [0x54ff1c], eax
mov eax, dword [0x54ff08]
mov dword [0x54ff18], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x54fc68], eax
call fcn.00454670
push 1
push dword [0x54fea4]
call fcn.004ad7c0
movzx eax, byte [0x54b2ca]
add esp, 8
push eax
push 0x65
push 0x7e8
push dword [0x54fea0]
call esi
push dword [0x54fea4]
call dword [sym.imp.USER32.dll_SetFocus]
lea eax, [ebp - 0xcf8]
mov dword [ebp - 0xce8], 3
push eax
push 0
push 0x102b
push dword [0x54feac]
mov dword [ebp - 0xcec], 3
call esi
lea eax, [ebp - 0xcf8]
mov dword [ebp - 0xce8], 3
push eax
push 0
push 0x102b
push dword [0x54fea8]
mov dword [ebp - 0xcec], 3
call esi
call fcn.0047d390
test al, al
je 0x48cceb
push 1
mov ecx, 0x54aa30
call fcn.0047fc70
mov esi, dword [sym.imp.USER32.dll_InsertMenuW]
test eax, eax
jne 0x48ccf1
push 0x50f158
push 0x9f2a
push eax
push 0x9f16
push edi
call esi
xor eax, eax
mov ecx, 8
cmp byte [0x54f24f], al
cmovne eax, ecx
push eax
push 0x9f2a
push edi
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0x50f174
push 0x9f2b
push 0
push 0x9f16
push edi
call esi
xor eax, eax
mov ecx, 8
cmp byte [0x54f24e], al
cmovne eax, ecx
push eax
push 0x9f2b
push edi
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x48ccf1
mov esi, dword [sym.imp.USER32.dll_InsertMenuW]
cmp dword [0x54a9a0], 0
je 0x48cd2f
push 0x50f198
push 0x9f2c
push 0
push 0x9f16
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
cmp byte [0x54f250], al
mov ecx, 8
cmovne eax, ecx
push eax
push 0x9f2c
push edi
call esi
jmp 0x48cd35
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov dword [0x54fed8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
mov dword [0x54fedc], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov dword [0x5503c0], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
mov dword [0x54fee0], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov dword [0x54fee4], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0x489950
push 0
push 0
mov dword [0x54fee8], eax
call fcn.004d6126
mov dword [0x5503bc], eax
add esp, 0x18
mov eax, dword [0x54b0b8]
cmp eax, 0x7d0
jg 0x48ce41
je 0x48ce38
test eax, eax
je 0x48cdf9
cmp eax, 0x1f4
je 0x48cdf0
cmp eax, 0x3e8
jne 0x48ce7c
push 0
push 0x9c55
jmp 0x48ce5f
push 0
push 0x9c57
jmp 0x48ce5f
push 0
push 0x9c52
push 0x9c57
push 0x9c52
push dword [0x54fea0]
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov eax, dword [0x56a2e0]
mov ecx, dword [0x54af08]
dec eax
push 0
push 0x50f1b4
push eax
call fcn.00477f70
jmp 0x48ce7c
push 0
push 0x9c53
jmp 0x48ce5f
cmp eax, 0x1388
je 0x48ce58
cmp eax, 0x2710
jne 0x48ce7c
push 0
push 0x9c56
jmp 0x48ce5f
push 0
push 0x9c54
push 0x9c57
push 0x9c52
push dword [0x54fea0]
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push 1
push 0
push dword [0x54feb4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [ebp - 0xc78]
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [0x5619bc], 0
jne 0x48ceaf
push 0
push 0x9f0f
push edi
call dword [sym.imp.USER32.dll_DeleteMenu]
call fcn.0048af70
mov ecx, dword [0x54f274]
cmp ecx, 0x64
je 0x48cf28
push 0xffffffffffffffec
push dword [0x54fea0]
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push dword [0x54fea0]
call dword [sym.imp.USER32.dll_SetWindowLongW]
imul ecx, dword [0x54f274], 0xff
mov eax, 0x51eb851f
push 2
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push 0
push dword [0x54fea0]
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0x485
push 0
push 0
push dword [0x54fea0]
call dword [sym.imp.USER32.dll_RedrawWindow]
mov ecx, dword [0x54f274]
mov eax, 0x66666667
imul ecx
push 8
sar edx, 2
mov eax, edx
add edx, 0x9c9d
shr eax, 0x1f
add eax, edx
push eax
push edi
call esi
cmp byte [0x54fc8c], 0
je 0x48cf5c
push dword [0x54fea0]
call fcn.0047baa0
add esp, 4
xor eax, eax
jmp 0x48cf63
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0042d270
int3