Function at 0x49dee0
Capabilities:
Check for unmoving mouse cursor
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5795ff
mov eax, dword fs:[0]
push eax
sub esp, 0xb58
mov eax, dword [0x5fc150]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0xb54], ebx
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
cmp dword [ebx + 0x484], ecx
je 0x49df6c
cmp dword [ebx + 0x31c], ecx
je 0x49df6c
xor dl, dl
mov byte [ebp - 0xb42], dl
mov byte [ebp - 0xb41], dl
mov byte [ebp - 0xb59], dl
cmp dword [ebx + 0x42c], ecx
je 0x49df5d
cmp dword [ebx + 0x3a0], ecx
je 0x49df5d
xor dh, dh
xor esi, esi
mov eax, 0x394
jmp 0x49df8d
mov dh, 1
lea esi, [ebx + 0x420]
mov eax, 0x394
jmp 0x49df8d
mov dl, 1
mov byte [ebp - 0xb42], dl
mov byte [ebp - 0xb41], dl
mov byte [ebp - 0xb59], dl
xor dh, dh
lea esi, [ebx + 0x478]
mov eax, 0x310
mov dword [ebp - 0xb4c], esi
mov byte [ebp - 0xb43], dh
add eax, ebx
mov dword [ebp - 0xb58], eax
mov eax, dword [edi + 8]
cmp eax, 0xfffffcb7
ja 0x49ec8c
je 0x49ebeb
sub eax, 0x7d1
cmp eax, 0x50
ja case.default.0x49ecd5
movzx eax, byte [eax + 0x4a0238]
jmp dword [eax*4 + 0x4a0204]
test esi, esi
je case.default.0x49ecd5
test byte [edi + 0x18], 3
je 0x49e014
push dword [edi + 0x20]
push dword [edi + 0xc]
mov al, byte [edi + 0x18]
and al, 1
movzx eax, al
push eax
mov ecx, dword [ebx + 0x580]
call fcn.004decf0
mov byte [0x61017c], 1
mov byte [ebx + 0x689b4], 1
push 1
push 0
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
test byte [edi + 0x18], 0x63
je 0x49e02a
mov eax, dword [ebx + 0x580]
mov eax, dword [eax + 0x20]
mov byte [eax + 0xb0], 1
mov eax, dword [edi + 0x18]
test al, 8
je 0x49e05a
cmp byte [0x61017c], 0
je case.default.0x49ecd5
push dword [edi + 0x3c]
push dword [edi + 0x38]
push dword [edi + 0x34]
mov ecx, esi
call fcn.004d8140
mov byte [0x61017c], 0
jmp case.default.0x49ecd5
test al, 3
jne case.default.0x49ecd5
mov byte [0x61017c], 0
jmp case.default.0x49ecd5
test dl, dl
je 0x49e07a
mov esi, dword [ebx + 0x498]
jmp 0x49e0d2
test dh, dh
je 0x49e086
mov esi, dword [ebx + 0x440]
jmp 0x49e0d2
cmp ecx, dword [ebx + 0x4dc]
jne 0x49e096
lea ecx, [ebx + 0x4d0]
jmp 0x49e0a8
cmp ecx, dword [ebx + 0x534]
jne case.default.0x49ecd5
lea ecx, [ebx + 0x528]
push 0
push 0
push 0x935
call fcn.0040d9f0
push eax
call fcn.00439ba0
mov ecx, eax
call fcn.0041b110
mov esi, eax
test esi, esi
je case.default.0x49ecd5
call fcn.00439ba0
mov edi, dword [edi + 8]
cmp edi, 0x7d3
sete byte [ebp - 0xb48]
call fcn.0040baa0
lea ecx, [eax + 0x54]
call fcn.00483140
test al, al
je 0x49e12a
cmp edi, 0x7d3
je 0x49e12a
push 0
push 0
push 0x87e
mov ecx, dword [ebx + 0x580]
call fcn.0040d9f0
cmp eax, 1
je 0x49e12a
cmp byte [esi + 0xb1], 0
je 0x49e12a
cmp byte [esi + 0x30], 0
je 0x49e12a
mov byte [ebp - 0xb48], 1
push dword [ebp - 0xb48]
mov ecx, esi
call fcn.0041cba0
jmp case.default.0x49ecd5
cmp ecx, dword [ebx + 0x484]
jne 0x49e148
push 0
jmp 0x49e152
cmp ecx, dword [ebx + 0x42c]
jne 0x49e159
push 1
mov ecx, ebx
call fcn.0047ba00
push 0
push dword [edi + 0xc]
push 0x876
mov ecx, dword [ebx + 0x580]
call fcn.0040d9f0
mov esi, eax
mov eax, dword [edi + 0x40]
cmp eax, dword [0x5bddb0]
jne 0x49e1dd
push dword [edi + 0x14]
push dword [edi + 0xc]
mov ecx, dword [ebx + 0x580]
call fcn.004d9e40
cmp dword [ebx + 0x68fec], 0
je 0x49e1b1
push esi
mov ecx, dword [ebx + 0x580]
call fcn.0049dea0
movzx eax, al
push eax
push esi
mov ecx, dword [ebx + 0x68fec]
call fcn.0043a0a0
movzx eax, byte [ebp - 0xb42]
neg eax
sbb eax, eax
and eax, 0xffffffa8
add eax, 0x478
add eax, ebx
push eax
push dword [ebx + 0x580]
lea ecx, [ebx + 0x2fc]
call fcn.004e7440
jmp case.default.0x49ecd5
cmp eax, dword [0x5bddac]
jne case.default.0x49ecd5
cmp dword [edi + 0x14], 0
jne case.default.0x49ecd5
push esi
mov ecx, dword [ebx + 0x580]
call fcn.004da0e0
test al, al
jne case.default.0x49ecd5
push esi
mov ecx, ebx
call fcn.0048e5a0
jmp case.default.0x49ecd5
cmp ecx, dword [ebx + 0x484]
je 0x49e228
cmp ecx, dword [ebx + 0x42c]
jne 0x49f3b6
mov esi, dword [edi + 0x34]
cmp byte [ebx + 0x689b5], 0
jne 0x49e250
call fcn.0040baa0
mov eax, dword [eax + 0xc8]
cmp eax, 1
je 0x49e249
cmp eax, 2
jne 0x49e250
mov ecx, ebx
call fcn.00469430
cmp dword [ebx + 0x68fec], 0
je 0x49f3b6
push esi
mov ecx, dword [ebx + 0x580]
call fcn.0049dea0
movzx eax, al
push eax
push esi
mov ecx, dword [ebx + 0x68fec]
call fcn.0043a0a0
mov eax, 1
jmp 0x4a01e4
cmp byte [ebx + 0x68980], 0
jne case.default.0x49ecd5
cmp byte [ebx + 0x68981], 0
jne case.default.0x49ecd5
call fcn.0040baa0
mov esi, eax
cmp byte [esi + 0x9e], 0
je 0x49e2b9
movzx ecx, word [edi + 0x10]
push ecx
mov ecx, ebx
call fcn.00476090
movzx eax, byte [ebp - 0xb42]
neg eax
sbb eax, eax
and eax, 0xffffff44
add eax, 0x240
add eax, ebx
mov dword [ebp - 0xb48], eax
push 0
push 0
push 0xa0a
mov ecx, dword [ebx + 0x580]
call fcn.0040d9f0
cmp eax, 1
setg bl
add esi, 0x240
mov ecx, esi
call fcn.0049de60
test al, al
je 0x49e325
test bl, bl
jne 0x49e325
push esi
push dword [edi + 0x10]
mov esi, dword [ebp - 0xb48]
mov ecx, esi
call fcn.004105a0
push dword [edi + 0x10]
mov ecx, esi
call fcn.00412430
jmp case.default.0x49ecd5
mov esi, dword [ebp - 0xb48]
push dword [edi + 0x10]
mov ecx, esi
call fcn.00412430
jmp case.default.0x49ecd5
test esi, esi
je case.default.0x49ecd5
cmp dword [edi + 0x14], 2
jne case.default.0x49ecd5
call fcn.0040baa0
mov dword [ebp - 0xb54], eax
mov dword [ebp - 0xb18], 0
mov dword [ebp - 0xb14], 0
mov dword [ebp - 0xb14], 0xf
mov dword [ebp - 0xb18], 0
mov byte [ebp - 0xb28], 0
mov dword [ebp - 4], 0x26
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0xb48], ecx
cmp ecx, 0xffffffff
je 0x49e39f
mov ebx, ecx
jmp 0x49e3c1
push 0
push 0
push 0x7d8
mov ecx, dword [ebx + 0x580]
call fcn.0040d9f0
mov ebx, eax
mov dword [ebp - 0xb48], ebx
mov eax, dword [ebp - 0xb54]
push 0
mov ecx, esi
push 0
cmp byte [eax + 0xab], 0
je 0x49e3fe
push 0x7d6
call fcn.0040d9f0
lea esi, [eax + 1]
push esi
call fcn.0052bd85
add esp, 4
mov ebx, eax
push ebx
push esi
push 0x886
mov edi, dword [ebp - 0xb4c]
mov ecx, edi
call fcn.0040d9f0
jmp 0x49e454
push 0x7eb
call fcn.0040d9f0
mov esi, eax
lea ecx, [esi + 1]
push ecx
call fcn.0052bd85
add esp, 4
mov dword [ebp - 0xb58], eax
push eax
push esi
push 0x7eb
mov edi, dword [ebp - 0xb4c]
mov ecx, edi
call fcn.0040d9f0
push 0
mov ecx, edi
call fcn.00482f00
push eax
push 0x877
mov ecx, edi
call fcn.0040d9f0
sub ebx, eax
mov dword [ebp - 0xb48], ebx
mov ebx, dword [ebp - 0xb58]
push ebx
lea ecx, [ebp - 0xb28]
call fcn.0049db20
push ebx
call fcn.0052bd8e
add esp, 4
mov dword [ebp - 0xb50], 0xffffffff
or ebx, 0xffffffff
mov esi, dword [ebp - 0xb54]
mov al, byte [esi + 0xaa]
cmp al, byte [esi + 0xa9]
jne 0x49e57f
mov eax, dword [ebp - 0xb48]
mov esi, eax
test eax, eax
js 0x49e6de
mov ebx, dword [ebp - 0xb54]
push esi
lea ecx, [ebp - 0xb28]
call fcn.0049dd70
mov cl, byte [ebx + 0xa9]
cmp byte [eax], cl
jne 0x49e4d7
cmp cl, 0x22
jne 0x49e4f3
test esi, esi
jle 0x49e4f3
lea eax, [esi - 1]
push eax
lea ecx, [ebp - 0xb28]
call fcn.0049dd70
cmp byte [eax], 0x5c
jne 0x49e4f3
sub esi, 1
jns 0x49e4a4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb28]
call fcn.00403840
jmp case.default.0x49ecd5
mov dword [ebp - 0xb50], esi
cmp esi, 0xffffffff
je 0x49e6de
mov eax, dword [ebp - 0xb48]
mov ebx, eax
cmp eax, dword [ebp - 0xb18]
jae 0x49e6de
mov esi, dword [ebp - 0xb54]
lea esp, [esp]
push ebx
lea ecx, [ebp - 0xb28]
call fcn.0049dd70
mov cl, byte [esi + 0xaa]
cmp byte [eax], cl
jne 0x49e55f
cmp cl, 0x22
jne 0x49e671
test ebx, ebx
je 0x49e671
lea eax, [ebx - 1]
push eax
lea ecx, [ebp - 0xb28]
call fcn.0049dd70
cmp byte [eax], 0x5c
jne 0x49e671
inc ebx
cmp ebx, dword [ebp - 0xb18]
jb 0x49e520
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb28]
call fcn.00403840
jmp case.default.0x49ecd5
lea ecx, [ebp - 0xad8]
call fcn.00461b60
mov byte [ebp - 4], 0x28
mov dword [ebp - 0xb60], 0
cmp dword [ebp - 0xb18], 0
jbe 0x49e662
xor edi, edi
jmp 0x49e5b0
push edi
lea ecx, [ebp - 0xb28]
call fcn.0049dd70
mov al, byte [eax]
cmp al, byte [esi + 0xa9]
jne 0x49e5da
lea eax, [ebp - 0xb60]
push eax
lea ecx, [ebp - 0xad8]
call fcn.004a02a0
jmp 0x49e649
push edi
lea ecx, [ebp - 0xb28]
call fcn.0049dd70
mov al, byte [eax]
cmp al, byte [esi + 0xaa]
jne 0x49e649
mov esi, dword [ebp - 0xac8]
test esi, esi
je 0x49e643
lea ecx, [ebp - 0xad8]
call fcn.004a0340
mov ecx, dword [eax]
dec esi
mov dword [ebp - 0xac8], esi
neg esi
sbb esi, esi
and esi, dword [ebp - 0xacc]
mov dword [ebp - 0xacc], esi
mov eax, dword [ebp - 0xb48]
cmp ecx, eax
ja 0x49e643
cmp edi, eax
jb 0x49e643
mov eax, dword [ebp - 0xb50]
cmp eax, 0xffffffff
je 0x49e63b
cmp ecx, eax
jbe 0x49e643
mov dword [ebp - 0xb50], ecx
mov ebx, edi
mov esi, dword [ebp - 0xb54]
inc edi
mov dword [ebp - 0xb60], edi
cmp edi, dword [ebp - 0xb18]
jb 0x49e5b0
mov edi, dword [ebp - 0xb4c]
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xad8]
call fcn.0049dab0
cmp ebx, 0xffffffff
je 0x49e6de
cmp dword [ebp - 0xb50], 0xffffffff
je 0x49e6de
push 0
mov ecx, edi
cmp byte [esi + 0xab], 0
je 0x49e6a0
push ebx
push 0x85d
call fcn.0040d9f0
mov eax, dword [ebp - 0xb50]
inc eax
jmp 0x49e6cf
call fcn.00482f00
push eax
push 0x877
mov ecx, edi
call fcn.0040d9f0
mov esi, eax
push 0
lea ecx, [esi + ebx]
push ecx
push 0x85d
mov ecx, edi
call fcn.0040d9f0
mov eax, dword [ebp - 0xb50]
inc eax
add eax, esi
push 0
push eax
push 0x7ea
mov ecx, edi
call fcn.0040d9f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb28]
call fcn.00403840
jmp case.default.0x49ecd5
test esi, esi
je case.default.0x49ecd5
call fcn.0040baa0
mov ecx, eax
mov dword [ebp - 0xb48], ecx
test byte [edi + 0x58], 4
je 0x49e732
call fcn.0040baa0
mov eax, dword [eax + 0xc8]
cmp eax, 1
je 0x49e725
cmp eax, 2
jne 0x49e72c
mov ecx, ebx
call fcn.00469430
mov ecx, dword [ebp - 0xb48]
cmp byte [ecx + 8], 0
jne case.default.0x49ecd5
mov edx, dword [ebx + 0x580]
mov eax, dword [edx + 0xc]
cmp dword [edi], eax
je 0x49e7ba
cmp byte [ecx + 0xa3], 0
je case.default.0x49ecd5
mov eax, dword [edx + 0x1c]
cmp eax, dword [esi + 0x1c]
je case.default.0x49ecd5
push 0
push 0x400
lea eax, [ebp - 0xaac]
push eax
mov ecx, edx
call fcn.004d8800
lea eax, [ebp - 0xaac]
push eax
lea ecx, [ebp - 0xaf4]
call fcn.004029a0
mov dword [ebp - 4], 0x29
lea eax, [ebp - 0xaf4]
push eax
push esi
lea ecx, [ebx + 0x2fc]
call fcn.004e76c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf4]
call fcn.004038c0
jmp case.default.0x49ecd5
mov ecx, ebx
call fcn.0046aa30
mov edi, dword [ebp - 0xb48]
cmp byte [edi + 0xa5], 0
je 0x49e7ef
mov eax, dword [ebx + 0x580]
mov dword [ebp - 0xb58], eax
movzx eax, byte [edi + 0xa6]
push eax
lea ecx, [ebp - 0xb58]
call fcn.0050da40
cmp byte [edi + 0x9f], 0
je 0x49e82c
cmp byte [edi + 0xa4], 0
je 0x49e80a
mov byte [edi + 0xa4], 0
jmp 0x49e82c
movzx eax, byte [ebp - 0xb42]
neg eax
sbb eax, eax
and eax, 0xffffffa8
add eax, 0x478
add eax, ebx
push eax
push esi
lea ecx, [ebx + 0x2fc]
call fcn.004e7440
mov ecx, ebx
call fcn.0047cfe0
mov ecx, dword [ebx + 0x68ff0]
test ecx, ecx
je 0x49e859
cmp byte [ecx + 0x60], 0
jne 0x49e859
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x49e859
mov ecx, dword [ebx + 0x68ff0]
call fcn.00452780
movzx eax, byte [ebp - 0xb42]
neg eax
sbb eax, eax
and eax, 0xffffff44
lea ecx, [ebx + 0x240]
push 0
lea ecx, [ecx + eax]
call fcn.00412430
jmp case.default.0x49ecd5
test esi, esi
je case.default.0x49ecd5
movzx eax, dl
neg eax
sbb eax, eax
and eax, 0xffffffa8
add eax, 0x478
add eax, ebx
push eax
push esi
lea ecx, [ebx + 0x2fc]
call fcn.004e7440
jmp case.default.0x49ecd5
push 0
push 0
push 0x859
mov ecx, dword [ebx + 0x580]
call fcn.0040d9f0
push eax
push dword [edi + 0x30]
push dword [edi + 0x2c]
push dword [edi + 0x28]
lea ecx, [ebp - 0xb04]
call fcn.004df910
mov dword [ebp - 4], 0x2d
push eax
lea ecx, [ebx + 0x68974]
call fcn.00486960
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb04]
call fcn.0043ec40
jmp case.default.0x49ecd5
test esi, esi
je case.default.0x49ecd5
lea ecx, [ebx + 0x478]
call fcn.004da600
lea ecx, [ebx + 0x420]
call fcn.004da600
cmp byte [ebx + 0x4a1], 0
je 0x49e935
lea ecx, [ebx + 0x478]
call fcn.004da6b0
mov byte [ebx + 0x4a1], 0
cmp byte [ebx + 0x449], 0
je 0x49e950
lea ecx, [ebx + 0x420]
call fcn.004da6b0
mov byte [ebx + 0x449], 0
mov ecx, esi
call fcn.004ded50
lea ecx, [ebx + 0x689c0]
call fcn.0049de20
test al, al
je 0x49e96f
push dword [edi]
mov ecx, ebx
call fcn.0046d770
call fcn.0040baa0
cmp byte [ebx + 0x689b4], 0
je 0x49e983
cmp byte [eax + 8], 0
je 0x49e98c
cmp dword [edi + 0x2c], 0x62b
jne 0x49e9af
call fcn.0040baa0
mov eax, dword [eax + 0xc8]
cmp eax, 1
je 0x49e9a1
cmp eax, 2
jne 0x49e9a8
mov ecx, ebx
call fcn.00469430
mov byte [ebx + 0x689b4], 0
mov ecx, dword [ebx + 0x68fec]
test ecx, ecx
je case.default.0x49ecd5
cmp byte [ecx + 0x60], 0
jne case.default.0x49ecd5
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
call eax
test al, al
je case.default.0x49ecd5
mov ecx, dword [ebx + 0x68fec]
cmp byte [ecx + 0x9c], 0
jne case.default.0x49ecd5
push 0
call fcn.0043ac20
mov ecx, dword [ebx + 0x68fec]
call fcn.0043a800
jmp case.default.0x49ecd5
test esi, esi
je case.default.0x49ecd5
push 0
push dword [edi + 0xc]
push 0x7da
mov ecx, esi
call fcn.0040d9f0
mov byte [ebp - 0xb43], al
push 0
movzx ecx, al
push ecx
push 0x9bd
mov ecx, esi
call fcn.0040d9f0
test eax, eax
je case.default.0x49ecd5
mov eax, dword [edi + 0xc]
cdq
mov edi, eax
mov dword [ebp - 0xab0], edi
mov eax, edx
mov dword [ebp - 0xb4c], eax
mov dword [ebp - 0xb48], edi
push 0
push 0
push 0x7d6
mov ecx, esi
call fcn.0040d9f0
cdq
mov ecx, eax
mov dword [ebp - 0xb50], ecx
mov dword [ebp - 0xb60], edx
mov eax, dword [ebp - 0xb4c]
test eax, eax
jl 0x49eace
jg 0x49ea82
test edi, edi
je 0x49eace
mov ebx, edi
mov edi, eax
push 0
lea eax, [ebx - 1]
push eax
push 0x7da
mov ecx, esi
call fcn.0040d9f0
cmp al, byte [ebp - 0xb43]
jne 0x49eab0
add ebx, 0xffffffff
adc edi, 0xffffffff
test edi, edi
jg 0x49ea86
jl 0x49eab0
test ebx, ebx
jne 0x49ea86
mov dword [ebp - 0xb48], ebx
mov ebx, dword [ebp - 0xb54]
mov edi, dword [ebp - 0xab0]
mov eax, dword [ebp - 0xb4c]
mov ecx, dword [ebp - 0xb50]
cmp eax, dword [ebp - 0xb60]
jg 0x49eb17
jl 0x49eadc
cmp edi, ecx
jae 0x49eb17
mov ebx, dword [ebp - 0xb4c]
push 0
push edi
push 0x7da
mov ecx, esi
call fcn.0040d9f0
cmp al, byte [ebp - 0xb43]
jne 0x49eb11
add edi, 1
adc ebx, 0
cmp ebx, dword [ebp - 0xb60]
jl 0x49eae2
jg 0x49eb11
cmp edi, dword [ebp - 0xb50]
jb 0x49eae2
mov ebx, dword [ebp - 0xb54]
push 0
push dword [ebp - 0xb48]
push 0x7ea
mov ecx, esi
call fcn.0040d9f0
push 0
push edi
push 0x85d
mov ecx, esi
call fcn.0040d9f0
push edi
push dword [ebp - 0xb48]
lea eax, [ebp - 0xaf4]
push eax
mov ecx, esi
call fcn.004d89a0
mov dword [ebp - 4], 0x2e
push 0
push 0
push 0x202
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0x7d8
mov ecx, esi
call fcn.0040d9f0
push eax
push eax
push 0x870
mov ecx, esi
call fcn.0040d9f0
cmp dword [ebp - 0xae0], 8
mov ecx, dword [ebp - 0xaf4]
jae 0x49eb9b
lea ecx, [ebp - 0xaf4]
mov eax, dword [ebx]
push 5
push 0
push 0
push ecx
push str.open
push dword [eax + 0xc]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf4]
call fcn.004038c0
jmp case.default.0x49ecd5
movzx eax, dl
neg eax
sbb eax, eax
and eax, 0xffffff44
lea ecx, [ebx + 0x240]
push dword [edi + 0xc]
lea ecx, [ecx + eax]
call fcn.0040fab0
jmp case.default.0x49ecd5
lea esi, [ebx + 0x760]
cmp dword [ebx + 0x788], ecx
jne 0x49ebff
lea esi, [ebx + 0x77c]
cmp dword [edi + 0x10], 0
jne 0x49ec48
mov eax, dword [edi + 0x18]
mov dword [ebp - 0xab4], eax
mov eax, dword [edi + 0x24]
mov dword [ebp - 0xab0], eax
lea eax, [ebp - 0xab4]
push eax
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 0xab0]
push dword [ebp - 0xab4]
lea ecx, [ebx + 0x65c]
call fcn.004f6190
mov eax, 1
jmp 0x4a01e4
push 0x50
push 0
lea eax, [ebp - 0x64]
push eax
call fcn.00544020
add esp, 0xc
mov dword [ebp - 0x64], 0x50
mov dword [ebp - 0x60], 0x10
lea eax, [ebp - 0x64]
push eax
push dword [edi + 0xc]
push 0x41c
push dword [esi + 0xc]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
push edi
push 0
push 0x4e
push dword [ebp - 0x44]
call esi
jmp case.default.0x49ecd5
cmp eax, 0xfffffdcb
ja 0x49ecb6
je case.0x49ecd5.563
cmp eax, 0xfffffcc1
jne case.default.0x49ecd5
push 0
push 0
push 5
mov eax, dword [ebx]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x49ecd5
cmp eax, 0xfffffdd9
ja 0x49f494
je 0x49f40b
add eax, 0x234
cmp eax, 4
ja case.default.0x49ecd5
jmp dword [eax*4 + 0x4a028c]
call fcn.0040baa0
mov cl, byte [eax + 0x73e]
mov byte [ebp - 0xb41], cl
cmp byte [eax + 0x73d], 0
je 0x49edec
cmp byte [ebp - 0xb42], 0
je 0x49ed0b
lea eax, [ebx + 0x310]
jmp 0x49ed1e
cmp byte [ebp - 0xb43], 0
je 0x49edec
lea eax, [ebx + 0x394]
mov dword [ebp - 0xb48], eax
test eax, eax
je 0x49edec
push dword [edi + 0xc]
mov ecx, eax
call fcn.00439b00
mov dword [ebp - 0xab0], eax
call fcn.00439ba0
mov esi, dword [ebx + 0x498]
mov eax, dword [ebx + 0x440]
mov dword [ebp - 0xb58], eax
lea eax, [ebp - 0xad4]
push eax
push dword [edi + 0xc]
push 0x130a
mov eax, dword [ebp - 0xb48]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0xb64], eax
mov eax, dword [ebp - 0xac8]
mov dword [ebp - 0xb60], eax
lea eax, [ebp - 0xb64]
push eax
mov eax, dword [ebp - 0xb48]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_ClientToScreen]
mov ecx, dword [ebp - 0xab0]
cmp ecx, esi
je 0x49edd7
cmp ecx, dword [ebp - 0xb58]
je 0x49edd7
mov eax, dword [ebp - 0xb48]
push dword [eax + 0x80]
push ecx
push dword [ebp - 0xb60]
push dword [ebp - 0xb64]
lea ecx, [ebx + 0x688ac]
call fcn.00413740
jmp 0x49ede6
push 0
push 0
lea ecx, [ebx + 0x688ac]
call fcn.004e92f0
mov esi, dword [ebp - 0xb4c]
cmp byte [ebp - 0xb41], 0
je case.default.0x49ecd5
mov ecx, dword [ebx + 0x68fec]
test ecx, ecx
je case.default.0x49ecd5
cmp byte [ecx + 0x60], 0
jne case.default.0x49ecd5
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
call eax
test al, al
je case.default.0x49ecd5
cmp byte [ebp - 0xb42], 0
je 0x49ee31
lea ecx, [ebx + 0x310]
jmp 0x49ee44
cmp byte [ebp - 0xb43], 0
je case.default.0x49ecd5
lea ecx, [ebx + 0x394]
test ecx, ecx
je case.default.0x49ecd5
push dword [edi + 0xc]
call fcn.00439b00
mov edi, eax
call fcn.00439ba0
cmp edi, dword [ebx + 0x498]
je 0x49ee7a
cmp edi, dword [ebx + 0x440]
je 0x49ee7a
push esi
push edi
mov ecx, dword [ebx + 0x68fec]
call fcn.0043ab80
jmp 0x49ee85
mov ecx, dword [ebx + 0x68fec]
call fcn.0043a250
mov ecx, dword [ebx + 0x68fec]
call fcn.0043ab50
mov eax, dword [ebx + 0x68fec]
mov byte [eax + 0x9c], 1
jmp case.default.0x49ecd5
call fcn.0040baa0
mov cl, byte [eax + 0x73e]
mov byte [ebp - 0xb41], cl
cmp byte [eax + 0x73d], 0
je 0x49eed1
push 0
push 0
lea ecx, [ebx + 0x688ac]
call fcn.004e92f0
mov cl, byte [ebp - 0xb41]
test cl, cl
je case.default.0x49ecd5
mov ecx, dword [ebx + 0x68fec]
test ecx, ecx
je case.default.0x49ecd5
cmp byte [ecx + 0x60], 0
jne case.default.0x49ecd5
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
call eax
test al, al
je case.default.0x49ecd5
mov ecx, dword [ebx + 0x68fec]
call fcn.0043a250
mov ecx, dword [ebx + 0x68fec]
call fcn.0043ab50
mov eax, dword [ebx + 0x68fec]
mov byte [eax + 0x9c], 0
jmp case.default.0x49ecd5
mov esi, dword [edi + 4]
mov dword [ebp - 0xab0], esi
push 0xa2
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x1f
and eax, 0xffffff01
mov dword [ebp - 0xb48], eax
cmp dword [edi + 8], 0xfffffdcf
jne 0x49f3a8
mov eax, dword [esi + 0x48]
mov dword [ebp - 0xb50], eax
mov dword [ebp - 0xb64], eax
mov eax, dword [esi + 0x4c]
mov dword [ebp - 0xb4c], eax
mov dword [ebp - 0xb60], eax
push eax
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov edi, eax
mov ecx, dword [ebx + 0x580]
cmp edi, dword [ecx + 0xc]
jne 0x49f0c9
cmp dword [ebx + 0x638], 0
jne 0x49f0b2
mov ecx, 9
mov esi, 0x5b1e34
lea edi, [ebp - 0xa4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
mov dword [ebp - 0x7e], eax
mov dword [ebp - 0x7a], eax
mov dword [ebp - 0x76], eax
mov dword [ebp - 0x72], eax
mov dword [ebp - 0x6e], eax
mov dword [ebp - 0x6a], eax
mov word [ebp - 0x66], ax
mov ecx, 0xa
mov esi, 0x5b1e5c
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xb14], eax
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0xa4]
push eax
push 0x2711
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0xb1c]
call fcn.00446390
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
lea eax, [ebp - 0x54]
push eax
push 0x2712
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xb1c]
call fcn.00446390
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb10]
call fcn.004655b0
mov eax, dword [ebx]
push dword [ebx + 0x68934]
lea ecx, [ebp - 0xb1c]
push ecx
push dword [eax + 0xc]
lea ecx, [ebx + 0x634]
call fcn.004282f0
push dword [ebx + 0x638]
lea ecx, [ebx + 0x300]
call fcn.0045e8a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb1c]
call fcn.00468d00
mov esi, dword [ebp - 0xab0]
lea eax, [ebp - 0xb64]
push eax
lea ecx, [ebx + 0x634]
call fcn.00482e60
jmp 0x49f3a8
mov eax, dword [ebx + 0x41c]
cmp edi, dword [eax + 0xc]
je 0x49f394
mov eax, dword [ebx + 0x584]
cmp edi, dword [eax + 0xc]
je 0x49f394
mov eax, dword [ebx]
lea ecx, [ebp - 0xad4]
push ecx
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0xb50]
cmp eax, dword [ebp - 0xad4]
jl 0x49f129
cmp eax, dword [ebp - 0xacc]
jg 0x49f129
mov eax, dword [ebp - 0xb4c]
cmp eax, dword [ebp - 0xad0]
jl 0x49f129
cmp eax, dword [ebp - 0xac8]
jle 0x49f3b6
push 0x593ed8
lea ecx, [ebp - 0xb40]
call fcn.004029a0
mov dword [ebp - 4], 3
mov eax, dword [ebx + 0x580]
mov eax, dword [eax + 0x20]
add eax, 0x74
cmp dword [eax + 0x14], 8
jb 0x49f154
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xb40]
call fcn.0040a2e0
push 0x593ed8
lea ecx, [ebp - 0xb40]
call fcn.0040a2e0
mov dword [ebp - 0xb1c], 2
cmp dword [ebp - 0xb2c], 8
mov eax, dword [ebp - 0xb40]
jae 0x49f18f
lea eax, [ebp - 0xb40]
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0xb30]
lea eax, [eax*2 + 2]
mov dword [ebp - 0xb18], eax
push edi
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0xb60], eax
push 0x104
lea ecx, [ebp - 0x2ac]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0x5ae798
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x49f360
mov eax, dword [ebx]
mov edx, dword [ebp - 0xb60]
cmp edx, dword [eax + 0xc]
je 0x49f360
mov ecx, dword [ebx + 0x418]
call fcn.00482f30
push eax
mov ecx, dword [ebp - 0xb58]
call fcn.00439b00
mov dword [ebp - 0xb4c], eax
call fcn.00439ba0
movzx eax, byte [ebp - 0xb59]
xor eax, 1
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp - 0xb4c]
mov cl, byte [eax + 0x30]
test cl, cl
je 0x49f2ec
mov dword [ebp - 0xae4], 0
mov dword [ebp - 0xae0], 0
mov dword [ebp - 0xae0], 7
mov dword [ebp - 0xae4], 0
xor eax, eax
mov word [ebp - 0xaf4], ax
mov byte [ebp - 4], 4
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xab0], 7
mov dword [ebp - 0xab4], eax
mov word [ebp - 0xac4], ax
mov byte [ebp - 4], 5
mov eax, dword [ebx]
push 0
push 0
push 0
push str.Move_to_new_Notepad_Instance
push str.Document_is_modified__save_it_then_try_again.
push dword [eax + 0xc]
push str.CannotMoveDoc
lea ecx, [ebx + 0x300]
call fcn.004607b0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xac4]
call fcn.004038c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xaf4]
call fcn.004038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb40]
call fcn.004038c0
jmp 0x49f3a8
push edi
push 0
push 0x416
mov edi, dword [ebp - 0xb60]
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx]
lea ecx, [ebp - 0xb1c]
push ecx
push dword [eax + 4]
push 0x4a
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
call edi
cmp byte [ebp - 0xb48], 0
jne 0x49f380
push dword [ebp - 0xab0]
push dword [ebp - 0xb4c]
mov ecx, ebx
call fcn.004990a0
mov ecx, ebx
call fcn.00476bf0
test al, al
je 0x49f380
mov eax, dword [ebx]
push 0
push 0
push 0x10
push dword [eax + 0xc]
call edi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb40]
call fcn.004038c0
jmp 0x49f3a8
push dword [ebp - 0xb4c]
push dword [ebp - 0xb50]
xor eax, eax
cmp byte [ebp - 0xb48], al
sete al
inc eax
push eax
mov ecx, ebx
call fcn.0046dba0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb40]
call fcn.004038c0
jmp 0x49f3a8
xor eax, eax
cmp byte [ebp - 0xb48], al
sete al
inc eax
push eax
mov ecx, ebx
call fcn.0046da10
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov eax, 1
jmp 0x4a01e4
push dword [edi + 0xc]
mov ecx, dword [ebp - 0xb58]
call fcn.00439b00
mov edi, eax
call fcn.00439ba0
movzx esi, byte [ebp - 0xb41]
xor esi, 1
cmp byte [edi + 0x30], 0
je 0x49f3ee
push esi
push edi
mov ecx, ebx
call fcn.00468f20
push esi
push edi
mov ecx, ebx
call fcn.004990a0
test al, al
je case.default.0x49ecd5
mov ecx, ebx
call fcn.0046ae20
jmp case.default.0x49ecd5
cmp ecx, dword [ebx + 0x31c]
jne 0x49f417
xor esi, esi
jmp 0x49f428
cmp ecx, dword [ebx + 0x3a0]
jne case.default.0x49ecd5
mov esi, 1
push dword [ebx + 0x580]
lea ecx, [ebx + 0x688ac]
call fcn.00413850
push esi
mov ecx, ebx
call fcn.0047ba00
mov eax, dword [ebx + 0x418]
push 0
push 0
push 0x130b
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ecx, dword [ebx + 0x418]
call fcn.00439b00
test eax, eax
je 0x49f480
mov byte [ebx + 0x689b5], 1
push esi
push eax
mov ecx, ebx
call fcn.00468f20
mov byte [ebx + 0x689b5], 0
push 0
push 0
lea ecx, [ebx + 0x688ac]
call fcn.004e92f0
jmp case.default.0x49ecd5
cmp eax, 0xfffffffd
ja 0x4a00fc
je 0x49ffc7
cmp eax, 0xfffffdee
je 0x49fe53
cmp eax, 0xfffffffb
jne case.default.0x49ecd5
lea eax, [ebp - 0xb64]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [edi]
cmp eax, dword [ebx + 0x31c]
jne 0x49fb8e
push 0
mov ecx, ebx
call fcn.0047ba00
cmp dword [ebx + 0x624], 0
jne 0x49fb13
mov dword [ebp - 0xab8], 0
mov dword [ebp - 0xab4], 0
mov dword [ebp - 0xab0], 0
mov dword [ebp - 4], 9
push 0
push 0x5945b4
push 0xa02b
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push str.Close_All_BUT_This
push 0xa02d
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0x5b1fc4
push 0xa031
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0x5b1ff0
push 0xa03a
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0x5b2020
push 0xa040
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0x5ada54
push 0xa02e
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0x5b2048
push 0xa030
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0x5b2060
push 0xa039
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0x5b2070
push 0xa038
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push str.Reload
push 0xa036
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push str.Print
push 0xa032
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0
push 0
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0x5b2098
push 0xa03b
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push str.Open_Containing_Folder_in_cmd
push 0xa03c
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0
push 0
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0x5b211c
push 0xa03f
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0
push 0
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push str.Read_Only
push 0xa42c
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0x5b2160
push 0xa431
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0
push 0
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x1d
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push str.Full_File_Path_to_Clipboard
push 0xa42d
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push str.Filename_to_Clipboard
push 0xa42e
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0x5b21f0
push 0xa42f
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0
push 0
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0x5b1e34
push 0x2711
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x22
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0x5b1e5c
push 0x2712
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0x5b2230
push 0x2713
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x24
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push 0x5b225c
push 0x2714
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 0x25
push eax
lea ecx, [ebp - 0xab8]
call fcn.00446390
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb10]
call fcn.004655b0
mov eax, dword [ebx]
push 0
lea ecx, [ebp - 0xab8]
push ecx
push dword [eax + 0xc]
lea ecx, [ebx + 0x620]
call fcn.004282f0
push dword [ebx + 0x624]
lea ecx, [ebx + 0x300]
call fcn.0045e7b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xab8]
call fcn.00468d00
push 0
push 0xa02e
push dword [ebx + 0x68934]
call dword [sym.imp.USER32.dll_GetMenuState]
shr eax, 1
not al
and al, 1
mov byte [ebp - 0xab0], al
lea edi, [ebx + 0x620]
push dword [ebp - 0xab0]
push 0xa02e
mov ecx, edi
call fcn.0049de40
mov eax, dword [ebx + 0x580]
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xb58], ebx
movzx eax, byte [ebx + 0x3c]
push eax
push 0xa42c
mov ecx, edi
call fcn.0049dda0
mov al, byte [ebx + 0x70]
mov byte [ebp - 0xab0], al
test al, al
jne 0x49fd69
cmp byte [ebx + 0xb8], al
jne 0x49fd69
mov al, 1
jmp 0x49fd6b
cmp eax, dword [ebx + 0x3a0]
jne 0x49fb9d
push 1
jmp 0x49f4d4
cmp eax, dword [ebx + 0x730]
jne 0x49fc4e
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x49fbe6
push 5
push dword [ebx + 0x68934]
call dword [sym.imp.USER32.dll_GetSubMenu]
push 0
mov ecx, dword [ebx]
push dword [ecx + 0xc]
push 0
push dword [ebp - 0xb60]
push dword [ebp - 0xb64]
push 0
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov eax, 1
jmp 0x4a01e4
cmp eax, 3
jne 0x49f3b6
push 0x5b1f34
call fcn.004600b0
add esp, 4
mov esi, eax
push dword [esi]
push dword [ebx + 0x68934]
mov edi, dword [sym.imp.USER32.dll_GetSubMenu]
call edi
test eax, eax
je 0x49f3b6
push dword [esi + 4]
push eax
call edi
mov ecx, eax
test ecx, ecx
je 0x49f3b6
push 0
mov eax, dword [ebx]
push dword [eax + 0xc]
push 0
push dword [ebp - 0xb60]
push dword [ebp - 0xb64]
push 0
push ecx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov eax, 1
jmp 0x4a01e4
mov ecx, dword [ebx + 0x68fd8]
test ecx, ecx
je 0x49f3b6
cmp eax, dword [ecx + 0xc]
jne 0x49f3b6
call fcn.0049dec0
cmp eax, 1
jle 0x49f4db
cmp dword [ebx + 0x64c], 0
jne 0x49fd4d
mov dword [ebp - 0xb1c], 0
mov dword [ebp - 0xb18], 0
mov dword [ebp - 0xb14], 0
mov dword [ebp - 4], 6
push 0
push str.Close_Selected_files
push 0xa9ed
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0xb1c]
call fcn.00446390
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xb10]
call fcn.004655b0
push 0
push str.Close_others_files
push 0xa9ee
lea ecx, [ebp - 0xb10]
call fcn.004280e0
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0xb1c]
call fcn.00446390
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xb10]
call fcn.004655b0
mov eax, dword [ebx]
push 0
lea ecx, [ebp - 0xb1c]
push ecx
push dword [eax + 0xc]
lea ecx, [ebx + 0x648]
call fcn.004282f0
push dword [ebx + 0x64c]
lea ecx, [ebx + 0x300]
call fcn.0045e7b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb1c]
call fcn.00468d00
lea eax, [ebp - 0xb64]
push eax
lea ecx, [ebx + 0x648]
call fcn.00482e60
mov eax, 1
jmp 0x4a01e4
xor al, al
push eax
push 0xa42c
mov ecx, edi
call fcn.0049de40
push dword [ebp - 0xab0]
push 0xa431
mov ecx, edi
call fcn.0049de40
add ebx, 0x74
cmp dword [ebx + 0x14], 8
jb 0x49fd97
mov eax, dword [ebx]
jmp 0x49fd99
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne byte [ebp - 0xab0]
mov esi, dword [ebp - 0xab0]
push esi
push 0xa038
mov ecx, edi
call fcn.0049de40
push esi
push 0xa03b
mov ecx, edi
call fcn.0049de40
push esi
push 0xa03c
mov ecx, edi
call fcn.0049de40
cmp dword [ebx + 0x14], 8
jb 0x49fdde
mov ebx, dword [ebx]
push ebx
call fcn.00426170
add esp, 4
movzx eax, al
push eax
push 0xa03f
mov ecx, edi
call fcn.0049de40
mov eax, dword [ebp - 0xb58]
mov bl, byte [eax + 0x30]
mov esi, dword [eax + 0x64]
test bl, bl
jne 0x49fe10
cmp esi, 2
je 0x49fe10
mov al, 1
jmp 0x49fe12
xor al, al
push eax
push 0x2713
mov ecx, edi
call fcn.0049de40
test bl, bl
jne 0x49fe2c
cmp esi, 2
je 0x49fe2c
mov al, 1
jmp 0x49fe2e
xor al, al
push eax
push 0x2714
mov ecx, edi
call fcn.0049de40
lea eax, [ebp - 0xb64]
push eax
mov ecx, edi
call fcn.00482e60
mov eax, 1
jmp 0x4a01e4
mov dword [ebp - 4], 0x2a
mov dword [edi + 0xb0], 0
lea eax, [ebp - 0xab4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebx]
lea ecx, [ebp - 0xab4]
push ecx
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebx]
push dword [ebp - 0xab0]
push dword [ebp - 0xab4]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_RealChildWindowFromPoint]
mov esi, eax
xor eax, eax
mov word [0x610180], ax
push 0x5883b8
lea ecx, [ebp - 0xadc]
call fcn.004029a0
mov byte [ebp - 4], 0x2b
mov ecx, dword [edi + 4]
cmp esi, dword [ebx + 0x76c]
jne 0x49ff2d
lea eax, [ebp - 0xadc]
push eax
push ecx
call fcn.004e01d0
add esp, 8
cmp dword [ebp - 0xacc], 0x50
jb 0x49fef0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xadc]
call fcn.004038c0
jmp case.default.0x49ecd5
cmp dword [ebp - 0xac8], 8
mov eax, dword [ebp - 0xadc]
jae 0x49ff05
lea eax, [ebp - 0xadc]
push eax
push 0x50
lea eax, [edi + 0x10]
push eax
call fcn.0054bd88
add esp, 0xc
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xadc]
call fcn.004038c0
mov eax, 1
jmp 0x4a01e4
cmp esi, dword [ebx + 0x31c]
jne 0x49ffa0
push ecx
lea ecx, [ebx + 0x310]
call fcn.00439b00
mov esi, eax
call fcn.00439ba0
add esi, 0x74
cmp dword [esi + 0x14], 8
jb 0x49ff53
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0xadc]
call fcn.00403ef0
cmp dword [ebp - 0xacc], 0x400
jae 0x49fedc
mov eax, dword [ebp - 0xadc]
cmp dword [ebp - 0xac8], 8
jae 0x49ff84
lea eax, [ebp - 0xadc]
push eax
push 0x400
push 0x610180
call fcn.0054bd88
mov dword [edi + 0xc], 0x610180
jmp 0x49ff11
cmp esi, dword [ebx + 0x3a0]
jne 0x49fedc
push ecx
lea ecx, [ebx + 0x394]
jmp 0x49ff3c
cmp ecx, dword [ebx + 0x730]
jne case.default.0x49ecd5
mov eax, dword [edi + 0xc]
cmp eax, 2
jne 0x4a0034
mov eax, dword [ebx + 0x1434]
lea ecx, [ebx + 0x1434]
mov eax, dword [eax + 0x34]
call eax
test al, al
sete byte [ebp - 0xb41]
movzx eax, byte [ebx + 0x308]
push eax
lea ecx, [ebx + 0x1434]
call fcn.00495060
cmp byte [ebp - 0xb41], 0
je case.default.0x49ecd5
push 0
push 0
push str.GoToLine
push dword [ebx + 0x1440]
lea ecx, [ebx + 0x300]
call fcn.0045e090
jmp case.default.0x49ecd5
cmp eax, 1
jne 0x4a004a
push 0xac11
mov ecx, ebx
call fcn.0048e6c0
jmp case.default.0x49ecd5
test eax, eax
jne 0x4a008c
lea eax, [ebp - 0xab4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 5
push dword [ebx + 0x68934]
call dword [sym.imp.USER32.dll_GetSubMenu]
push 0
mov ecx, dword [ebx]
push dword [ecx + 0xc]
push 0
push dword [ebp - 0xab0]
push dword [ebp - 0xab4]
push 0
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
jmp case.default.0x49ecd5
cmp eax, 3
jne case.default.0x49ecd5
lea eax, [ebp - 0xab4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x5b1f34
call fcn.004600b0
add esp, 4
mov esi, eax
push dword [esi]
push dword [ebx + 0x68934]
mov edi, dword [sym.imp.USER32.dll_GetSubMenu]
call edi
test eax, eax
je 0x49f3b6
push dword [esi + 4]
push eax
call edi
mov ecx, eax
test ecx, ecx
je 0x49f3b6
push 0
mov eax, dword [ebx]
push dword [eax + 0xc]
push 0
push dword [ebp - 0xab0]
push dword [ebp - 0xab4]
push 0
push ecx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
jmp case.default.0x49ecd5
cmp eax, 0xfffffffe
jne case.default.0x49ecd5
cmp ecx, dword [ebx + 0x730]
jne 0x4a0179
cmp dword [edi + 0xc], 5
jne case.default.0x49ecd5
push 0
push 0
push 0
push 0x88b
mov ecx, dword [ebx + 0x580]
call fcn.0040d9f0
neg eax
sbb eax, eax
neg eax
xor eax, 1
push eax
push 0x88a
mov ecx, dword [ebx + 0x580]
call fcn.0040d9f0
push 0
push 0
push 0x88b
mov ecx, dword [ebx + 0x580]
call fcn.0040d9f0
test eax, eax
mov eax, 0x5ae108
jne 0x4a0169
mov eax, 0x5ae110
push 5
push eax
lea ecx, [ebx + 0x724]
call fcn.004e9cb0
jmp case.default.0x49ecd5
cmp ecx, dword [ebx + 0x31c]
jne 0x4a01ab
cmp dword [ebx + 0x68ff8], 1
jne 0x4a01ab
call fcn.0040baa0
lea ecx, [eax + 0x54]
call fcn.00483140
test al, al
je 0x4a01a7
call fcn.00439ba0
mov ecx, eax
call fcn.00419820
push 0
jmp 0x4a01db
cmp ecx, dword [ebx + 0x3a0]
jne case.default.0x49ecd5
cmp dword [ebx + 0x68ff8], 0
jne case.default.0x49ecd5
call fcn.0040baa0
lea ecx, [eax + 0x54]
call fcn.00483140
test al, al
je 0x4a01d9
call fcn.00439ba0
mov ecx, eax
call fcn.00419820
push 1
mov ecx, ebx
call fcn.0047ba00
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 4