Function at 0x406620
Capabilities:
Get common file path
Get graphical window text
Log keystrokes via polling
Terminate thread

Disassembly:
sub esp, 0x180
push ebx
push esi
mov ebx, dword [esp + 0x190]
push edi
cmp ebx, 5
push ebp
mov eax, ebx
ja 0x40667f
je 0x406852
cmp eax, 1
je 0x406745
mov edi, dword [esp + 0x19c]
mov ebp, dword [esp + 0x1a0]
mov esi, dword [esp + 0x194]
push ebp
push edi
push ebx
push esi
call fcn.00405330
add esp, 0x10
test eax, eax
jne 0x406843
push ebp
push edi
push ebx
push esi
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x406845
cmp eax, 0x20
ja 0x40669e
je 0x4069e9
cmp eax, 0xf
je 0x406874
cmp eax, 0x10
je 0x4068a8
jmp case.0x40673e.519
cmp eax, 0x39
ja 0x4066c6
je 0x406a7e
cmp eax, 0x2b
je 0x406a0f
cmp eax, 0x2c
je 0x406a34
cmp eax, 0x2f
je 0x406a59
jmp case.0x40673e.519
cmp eax, 0x111
ja 0x4066e3
je 0x406acc
cmp eax, 0x100
je 0x406aa3
jmp case.0x40673e.519
cmp eax, 0x115
ja 0x406700
je 0x407c6a
cmp eax, 0x112
je 0x407c1f
jmp case.0x40673e.519
cmp eax, 0x138
ja 0x406728
je 0x407ca0
cmp eax, 0x133
jb case.0x40673e.519
cmp eax, 0x136
jbe 0x407ca0
jmp case.0x40673e.519
sub eax, 0x200
cmp eax, 0x33
ja case.0x40673e.519
xor ecx, ecx
mov cl, byte [eax + 0x407e64]
jmp dword [ecx*4 + 0x407e44]
mov eax, dword [0x438580]
push eax
call fcn.0040c180
add esp, 4
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [0x437018], eax
mov eax, dword [0x437a64]
push eax
call esi
push 0x808080
mov dword [0x42fab0], eax
call esi
push 0x14
mov dword [0x42fab4], eax
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call esi
push 0xff
mov dword [0x42fabc], eax
call esi
mov esi, dword [esp + 0x194]
mov dword [0x42fab8], eax
mov eax, dword [0x438580]
push eax
push esi
call fcn.0040f590
add esp, 8
push esi
call fcn.0041f910
add esp, 4
push esi
call fcn.0041ea00
add esp, 4
push 1
push esi
call fcn.00417970
add esp, 8
push 0
push 0x1fa4
push 0x111
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x437020
push 0x81
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x438990
mov esi, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0
push 0x42fc2c
push 0x437020
call esi
push 0x437850
push 0
push 0x42fc28
push 0x437020
call esi
push 0x438990
call fcn.0042b810
add esp, 4
push 1
mov eax, dword [0x4376f8]
mov edi, dword [sym.imp.SHELL32.dll_DragAcceptFiles]
push eax
call edi
push 1
mov ecx, dword [0x437710]
push ecx
call edi
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x180
ret 0x10
mov ebp, dword [esp + 0x1a0]
mov edi, dword [esp + 0x19c]
mov esi, dword [esp + 0x194]
push ebp
push edi
push esi
call fcn.0040f0a0
add esp, 0xc
jmp 0x406843
mov esi, dword [esp + 0x194]
cmp esi, dword [0x437824]
jne 0x40688e
push esi
call fcn.0040f1f0
add esp, 4
jmp 0x406843
mov ebp, dword [esp + 0x1a0]
mov edi, dword [esp + 0x19c]
push ebp
push edi
push ebx
push esi
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x406845
mov esi, dword [esp + 0x194]
cmp esi, dword [0x437824]
jne 0x4069c8
mov eax, dword [0x42f868]
cmp eax, 0xffffffff
je 0x4068ce
push eax
call fcn.004160f0
add esp, 4
cmp dword [0x42f86c], 0xffffffff
mov dword [0x42f868], eax
je 0x4068ea
push eax
call fcn.004160f0
add esp, 4
mov dword [0x42f86c], eax
mov eax, dword [0x42f864]
cmp eax, 0xffffffff
je 0x406915
push str.QUIT
push eax
call fcn.00415e20
add esp, 8
mov eax, dword [0x42f864]
push eax
call fcn.004160f0
add esp, 4
mov dword [0x42f864], eax
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
call fcn.00403850
call fcn.0040c1e0
mov eax, dword [0x42fab0]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
push eax
call edi
mov ecx, dword [0x42fab4]
push ecx
call edi
mov eax, dword [0x42fabc]
push eax
call edi
mov eax, dword [0x42fab8]
push eax
call edi
push 0x438990
call fcn.0042b810
add esp, 4
push 0x437850
call fcn.0042b810
add esp, 4
mov eax, dword [0x437710]
mov edi, dword [sym.imp.SHELL32.dll_DragAcceptFiles]
push 0
push eax
call edi
push 0
mov ecx, dword [0x4376f8]
push ecx
call edi
push 0
mov eax, dword [0x43781c]
push 2
push eax
push esi
call dword [sym.imp.USER32.dll_WinHelpA]
call fcn.0040c140
test eax, eax
je 0x4069b4
push 1
mov eax, dword [0x4367ec]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
call fcn.0040c100
add esp, 4
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [0x42fbe0], 1
jmp 0x4069cf
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x43034c], 0
push 0x4367f0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp 0x406843
mov ebp, dword [esp + 0x1a0]
mov edi, dword [esp + 0x19c]
mov esi, dword [esp + 0x194]
push ebp
push edi
push ebx
push esi
call fcn.0040c710
add esp, 0x10
jmp 0x406845
mov ebp, dword [esp + 0x1a0]
mov edi, dword [esp + 0x19c]
mov esi, dword [esp + 0x194]
push ebp
push edi
push esi
call fcn.0041d160
add esp, 0xc
jmp 0x406845
mov ebp, dword [esp + 0x1a0]
mov edi, dword [esp + 0x19c]
mov esi, dword [esp + 0x194]
push ebp
push edi
push esi
call fcn.0041dac0
add esp, 0xc
jmp 0x406845
mov ebp, dword [esp + 0x1a0]
mov edi, dword [esp + 0x19c]
mov esi, dword [esp + 0x194]
push ebp
push edi
push esi
call fcn.00406460
add esp, 0xc
jmp 0x406845
mov ebp, dword [esp + 0x1a0]
mov edi, dword [esp + 0x19c]
mov esi, dword [esp + 0x194]
push ebp
push edi
push esi
call fcn.0041d6f0
add esp, 0xc
jmp 0x406845
mov edi, dword [esp + 0x19c]
cmp di, 0x70
je 0x406aba
cmp di, 0x71
jne 0x406843
push 0x8c
call fcn.00410aa0
add esp, 4
jmp 0x406843
mov edi, dword [esp + 0x19c]
cmp di, 0x2349
jne 0x406b44
mov dword [0x430e80], 0
mov eax, 1
mov dword [0x42f330], eax
mov dword [0x42fbd4], eax
call sub.WSOCK32.dll_WSAIsBlocking
test eax, eax
je 0x406b01
call sub.WSOCK32.dll_WSACancelBlockingCall
mov eax, dword [0x42f868]
cmp eax, 0xffffffff
je 0x406b19
push eax
call fcn.004160f0
add esp, 4
mov dword [0x42f868], eax
mov eax, dword [0x42f86c]
cmp eax, 0xffffffff
je 0x406b31
push eax
call fcn.004160f0
add esp, 4
mov dword [0x42f86c], eax
mov eax, dword [0x42f864]
push eax
call fcn.0040b950
add esp, 4
jmp 0x406843
cmp dword [0x42f7e0], 0
je 0x406cf2
cmp di, 0x2348
je 0x406b71
cmp di, 0x2352
je 0x406b71
cmp di, 0x529
je 0x406b71
cmp di, 0x640
jne 0x406cf2
mov dword [0x430e80], 0
cmp dword [0x431318], 0
mov esi, 1
mov dword [0x42f330], esi
jne 0x406843
mov dword [0x431318], esi
call fcn.0040c140
test eax, eax
je 0x406bed
lea eax, [esp + 0x10]
push pe_nt_image_headers32
push eax
mov ecx, dword [0x438580]
push 0x36b1
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
push ecx
call ebx
lea ecx, [esp + 0x10]
push ecx
push str.___s
call fcn.0040cf50
add esp, 8
mov eax, dword [0x4367ec]
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
push eax
call ebp
push 0
call fcn.0040c100
add esp, 4
jmp 0x406bf3
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
mov eax, dword [0x42f868]
cmp eax, 0xffffffff
je 0x406c0b
push eax
call fcn.004160f0
add esp, 4
mov dword [0x42f868], eax
mov eax, dword [0x42f86c]
cmp eax, 0xffffffff
je 0x406c23
push eax
call fcn.004160f0
add esp, 4
mov dword [0x42f86c], eax
mov eax, dword [0x42f864]
cmp eax, 0xffffffff
je 0x406c58
push str.QUIT
push eax
call fcn.00415e20
add esp, 8
mov eax, dword [0x42f864]
push eax
call fcn.004160f0
add esp, 4
mov dword [0x42f864], eax
mov dword [0x42f7dc], 0
call fcn.00403930
mov esi, dword [esp + 0x194]
push str.WS_FTP_LE
push esi
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [0x431318], 0
call ebp
lea eax, [esp + 0x10]
push pe_nt_image_headers32
push eax
mov ecx, dword [0x438580]
push 0x2328
push ecx
call ebx
lea ecx, [esp + 0x10]
mov edx, dword [0x437650]
push ecx
push edx
call ebp
mov ecx, dword [0x437710]
push ecx
push esi
call fcn.004140d0
add esp, 8
mov ecx, dword [0x437710]
push ecx
push esi
call fcn.00414190
add esp, 8
cmp di, 0x640
je 0x406ce0
cmp di, 0x2352
je 0x406ce0
push 1
push esi
call fcn.00417970
add esp, 8
jmp 0x406843
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x406843
movzx eax, di
cmp eax, 0x4b0
jg 0x406d1b
je 0x4072f3
sub eax, 0x39b
cmp eax, 0x30
ja case.0x406e12.9012
xor ecx, ecx
mov cl, byte [eax + 0x407f20]
jmp dword [ecx*4 + 0x407e98]
cmp eax, 0x515
jg 0x406d39
je 0x4074df
sub eax, 0x4b1
cmp eax, 7
ja case.0x406e12.9012
jmp dword [eax*4 + 0x407f54]
cmp eax, 0x5dc
jg 0x406d57
je case.0x406e12.9005
sub eax, 0x517
cmp eax, 0x12
ja case.0x406e12.9012
jmp dword [eax*4 + 0x407f74]
cmp eax, 0x73b
jg 0x406da0
je case.0x406e12.9001
cmp eax, 0x640
je case.0x406e12.9008
mov ebp, dword [esp + 0x1a0]
mov esi, dword [esp + 0x194]
push ebp
push edi
push ebx
push esi
call fcn.00405330
add esp, 0x10
test eax, eax
jne 0x406843
push ebp
push edi
push ebx
push esi
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x406845
cmp eax, 0xa28
jg 0x406dc5
je 0x4078d3
cmp eax, 0x73c
je case.0x406e12.9002
cmp eax, 0x73d
je case.0x406e12.9003
jmp case.0x406e12.9012
cmp eax, 0x15b5
jg 0x406ddf
je 0x40795d
cmp eax, 0x140a
je case.0x406e12.9004
jmp case.0x406e12.9012
cmp eax, 0x1fa4
jg 0x406dfc
je 0x407875
cmp eax, 0x1de6
je 0x407978
jmp case.0x406e12.9012
sub eax, 0x2328
cmp eax, 0x2f
ja case.0x406e12.9012
xor ecx, ecx
mov cl, byte [eax + 0x407ff4]
jmp dword [ecx*4 + 0x407fc0]
mov eax, dword [0x438580]
mov esi, dword [esp + 0x194]
push eax
push esi
call fcn.00401070
add esp, 8
jmp 0x406843
shr edi, 0x10
cmp di, 2
je case.0x406d14.928
cmp di, 4
jne 0x406e4d
push 0
push 1
jmp 0x406e57
cmp di, 5
jne 0x406e65
push 0
push 0
push 6
mov eax, dword [0x4376f8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, dword [esp + 0x1a0]
mov esi, dword [esp + 0x194]
push ebp
push esi
call fcn.004140c0
add esp, 8
jmp 0x406845
shr edi, 0x10
cmp di, 2
je 0x406ea8
mov ebp, dword [esp + 0x1a0]
mov esi, dword [esp + 0x194]
push ebp
push esi
call fcn.00414120
add esp, 8
jmp 0x406845
mov eax, dword [0x4376f8]
mov esi, dword [esp + 0x194]
push eax
push 0
push esi
call fcn.00414450
add esp, 0xc
test eax, eax
jne 0x406edc
mov eax, dword [0x42f840]
cmp eax, 2
je 0x406edc
cmp eax, 1
je 0x407b93
jmp 0x407acf
mov ebp, dword [esp + 0x1a0]
push ebp
push esi
call fcn.00414120
add esp, 8
jmp 0x406845
shr edi, 0x10
cmp di, 2
je case.0x406d14.929
mov ebp, dword [esp + 0x1a0]
mov esi, dword [esp + 0x194]
push ebp
push esi
call fcn.004140d0
add esp, 8
jmp 0x406845
shr edi, 0x10
cmp di, 2
je 0x406f42
mov ebp, dword [esp + 0x1a0]
mov esi, dword [esp + 0x194]
push ebp
push esi
call fcn.00414190
add esp, 8
jmp 0x406845
mov eax, dword [0x437710]
mov esi, dword [esp + 0x194]
push eax
push 1
push esi
call fcn.00414450
add esp, 0xc
test eax, eax
jne 0x406f76
mov eax, dword [0x42f840]
cmp eax, 2
je 0x406f76
cmp eax, 1
je 0x407bbe
jmp 0x407b31
mov ebp, dword [esp + 0x1a0]
push ebp
push esi
call fcn.00414190
add esp, 8
jmp 0x406845
mov esi, dword [esp + 0x194]
push 0
push esi
call fcn.00414750
add esp, 8
jmp 0x406843
call fcn.0040c140
test eax, eax
jne 0x406843
mov esi, dword [esp + 0x194]
push 1
push esi
call fcn.00414750
add esp, 8
jmp 0x406843
mov eax, dword [0x4376f8]
mov esi, dword [esp + 0x194]
push eax
push 0
push esi
call fcn.00414850
add esp, 0xc
jmp 0x406843
call fcn.0040c140
test eax, eax
jne 0x406843
mov eax, dword [0x437710]
mov esi, dword [esp + 0x194]
push eax
push 1
push esi
call fcn.00414850
add esp, 0xc
jmp 0x406843
push 0xd
mov eax, dword [0x437488]
push 0x42f7b0
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, dword [esp + 0x194]
push 0
push esi
call fcn.00414e30
add esp, 8
jmp 0x406843
push 0x14
mov eax, dword [0x437560]
push 0x42f798
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
call fcn.0040c140
test eax, eax
jne 0x406843
mov esi, dword [esp + 0x194]
push 1
push esi
call fcn.00414e30
add esp, 8
mov eax, dword [0x430354]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x406843
mov eax, dword [0x4376f8]
mov esi, dword [esp + 0x194]
push eax
push 0
push esi
call fcn.00414ea0
add esp, 0xc
jmp 0x406843
call fcn.0040c140
test eax, eax
jne 0x406843
mov eax, dword [0x437710]
mov esi, dword [esp + 0x194]
push eax
push 1
push esi
call fcn.00414ea0
add esp, 0xc
jmp 0x406843
mov eax, dword [0x4376f8]
mov esi, dword [esp + 0x194]
push eax
push 0
push esi
call fcn.004151e0
add esp, 0xc
jmp 0x406843
call fcn.0040c140
test eax, eax
jne 0x406843
mov eax, dword [0x437710]
mov esi, dword [esp + 0x194]
push eax
push 1
push esi
call fcn.004151e0
add esp, 0xc
jmp 0x406843
mov eax, dword [0x4376f8]
mov esi, dword [esp + 0x194]
push eax
push 0
push esi
call fcn.00415650
add esp, 0xc
jmp 0x406843
mov eax, dword [0x437710]
mov esi, dword [esp + 0x194]
push eax
push 1
push esi
call fcn.00415650
add esp, 0xc
jmp 0x406843
mov ebp, dword [esp + 0x1a0]
mov esi, dword [esp + 0x194]
push ebp
push edi
push esi
call fcn.00411480
add esp, 0xc
jmp 0x406843
mov ebp, dword [esp + 0x1a0]
mov esi, dword [esp + 0x194]
push ebp
push edi
push esi
call fcn.00411350
add esp, 0xc
jmp 0x406843
mov eax, dword [0x4376f8]
push eax
call fcn.00404a00
add esp, 4
jmp 0x406843
mov eax, dword [0x437710]
push eax
call fcn.00404a00
add esp, 4
jmp 0x406843
mov esi, dword [esp + 0x194]
push esi
call fcn.0040bf60
add esp, 4
jmp 0x406843
mov eax, dword [0x42f864]
mov ecx, dword [0x437710]
push eax
push ecx
call fcn.0040cdf0
add esp, 8
jmp 0x406843
mov eax, dword [0x4376f8]
mov esi, dword [esp + 0x194]
push eax
push 0
push esi
call fcn.00415400
add esp, 0xc
jmp 0x406843
call fcn.0040c140
test eax, eax
jne 0x406843
mov eax, dword [0x437710]
mov esi, dword [esp + 0x194]
push eax
push 1
push esi
call fcn.00415400
add esp, 0xc
jmp 0x406843
call fcn.0040c140
test eax, eax
jne 0x406843
push 0x11
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x42fbdc], 1
call edi
test ah, 0x90
jne 0x407256
push 0x10
call edi
test ah, 0x90
jne 0x407256
mov dword [0x42fbd8], 0
jmp 0x407260
mov dword [0x42fbd8], 1
mov eax, dword [0x4376f8]
mov esi, dword [esp + 0x194]
push eax
push esi
call fcn.00414a50
add esp, 8
mov eax, dword [0x430354]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x406843
call fcn.0040c140
test eax, eax
jne 0x406843
push 0x11
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x42fbdc], 1
call edi
test ah, 0x90
jne 0x4072c2
push 0x10
call edi
test ah, 0x90
jne 0x4072c2
mov dword [0x42fbd8], 0
jmp 0x4072cc
mov dword [0x42fbd8], 1
mov eax, dword [0x437710]
mov esi, dword [esp + 0x194]
push eax
push esi
call fcn.00414ab0
add esp, 8
mov eax, dword [0x430354]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x406843
mov eax, dword [0x42fa34]
test al, 0x10
je 0x407304
and eax, 0xffffffef
or eax, 0x20
jmp 0x407310
test al, 0x20
je 0x40730d
and eax, 0xffffffcf
jmp 0x407310
or eax, 0x10
push 0
mov dword [0x42fa34], eax
call fcn.004044d0
add esp, 4
jmp 0x406843
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, 0xf000f000
mov eax, dword [0x42fa34]
mov ecx, eax
je 0x407352
and cl, 7
cmp cl, 2
jne 0x40734a
xor eax, 8
jmp 0x407363
and eax, 0x30
add eax, 2
jmp 0x407363
and cl, 7
cmp cl, 1
jne 0x40735f
xor eax, 8
jmp 0x407363
and eax, 0x30
inc eax
push 0
mov dword [0x42fa34], eax
call fcn.004044d0
add esp, 4
jmp 0x406843
mov eax, dword [0x42fa34]
mov ecx, eax
and cl, 7
cmp cl, 3
jne 0x40738b
xor eax, 8
jmp 0x407391
and eax, 0x30
add eax, 0xb
push 0
mov dword [0x42fa34], eax
call fcn.004044d0
add esp, 4
jmp 0x406843
mov eax, dword [0x42fa34]
mov ecx, eax
and cl, 7
cmp cl, 4
jne 0x4073b9
xor eax, 8
jmp 0x4073bf
and eax, 0x30
add eax, 4
push 0
mov dword [0x42fa34], eax
call fcn.004044d0
add esp, 4
jmp 0x406843
mov eax, dword [0x42fa30]
test al, 0x10
je 0x4073e4
and eax, 0xffffffef
or eax, 0x20
jmp 0x4073f0
test al, 0x20
je 0x4073ed
and eax, 0xffffffcf
jmp 0x4073f0
or eax, 0x10
push 1
mov dword [0x42fa30], eax
call fcn.004044d0
add esp, 4
jmp 0x406843
push 0x12
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
movsx eax, ax
test eax, 0xf000f000
je 0x407434
mov eax, dword [0x42fa30]
mov ecx, eax
and cl, 7
cmp cl, 5
jne 0x40742c
xor eax, 8
jmp 0x40746f
and eax, 0x30
add eax, 5
jmp 0x40746f
push 0x11
call edi
movsx eax, ax
test eax, 0xf000f000
mov eax, dword [0x42fa30]
mov ecx, eax
je 0x40745e
and cl, 7
cmp cl, 2
jne 0x407456
xor eax, 8
jmp 0x40746f
and eax, 0x30
add eax, 2
jmp 0x40746f
and cl, 7
cmp cl, 1
jne 0x40746b
xor eax, 8
jmp 0x40746f
and eax, 0x30
inc eax
push 1
mov dword [0x42fa30], eax
call fcn.004044d0
add esp, 4
jmp 0x406843
mov eax, dword [0x42fa30]
mov ecx, eax
and cl, 7
cmp cl, 3
jne 0x407497
xor eax, 8
jmp 0x40749d
and eax, 0x30
add eax, 0xb
push 1
mov dword [0x42fa30], eax
call fcn.004044d0
add esp, 4
jmp 0x406843
mov eax, dword [0x42fa30]
mov ecx, eax
and cl, 7
cmp cl, 4
jne 0x4074c5
xor eax, 8
jmp 0x4074cb
and eax, 0x30
add eax, 4
push 1
mov dword [0x42fa30], eax
call fcn.004044d0
add esp, 4
jmp 0x406843
lea eax, [esp + 0x90]
push 0x100
push eax
mov ecx, dword [0x438580]
mov dword [0x42f844], 0xb4
push 0x3787
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x90]
push ecx
push 0
call fcn.00411820
add esp, 8
test eax, eax
je 0x406843
push 0x42f538
mov eax, dword [0x42f864]
push eax
call fcn.004161e0
add esp, 8
jmp 0x406843
push str.HELP
mov eax, dword [0x42f864]
push eax
call fcn.00415e20
add esp, 8
jmp 0x406843
push str.SYST
mov eax, dword [0x42f864]
push eax
call fcn.00415e20
add esp, 8
jmp 0x406843
lea eax, [esp + 0x90]
push 0x100
push eax
mov ecx, dword [0x438580]
mov dword [0x42f844], 0x2bc
push 0x378a
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x90]
push ecx
push 0
call fcn.00411820
add esp, 8
test eax, eax
je 0x406843
push 0x42f538
mov eax, dword [0x42f864]
push str.SITE__s
push eax
call fcn.00415e20
add esp, 0xc
jmp 0x406843
push str.LIST
mov eax, dword [0x42f864]
push eax
call fcn.00416520
add esp, 8
cmp eax, 2
jne 0x406843
push 0
push 0
push 0x438990
call fcn.00402d10
add esp, 0xc
jmp 0x406843
lea eax, [esp + 0x90]
push 0x100
push eax
mov ecx, dword [0x438580]
mov dword [0x42f844], 0x28a
push 0x3787
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x90]
push ecx
push 0
call fcn.00411820
add esp, 8
test eax, eax
je 0x406843
cmp di, 0x520
jne 0x40765e
push 0x42f538
mov eax, dword [0x42f864]
push eax
call fcn.00416430
add esp, 8
jmp 0x406843
cmp di, 0x51b
jne 0x406843
push 0x42f538
mov eax, dword [0x42f864]
push eax
call fcn.004163e0
add esp, 8
jmp 0x406843
push str.NLST
mov eax, dword [0x42f864]
push eax
call fcn.00416520
add esp, 8
cmp eax, 2
jne 0x406843
push 0
push 0
push 0x438990
call fcn.00402d10
add esp, 0xc
jmp 0x406843
mov eax, dword [0x42f864]
push eax
call fcn.00416340
add esp, 4
jmp 0x406843
lea eax, [esp + 0x90]
push 0x100
push eax
mov ecx, dword [0x438580]
mov dword [0x42f844], 0x2c6
push 0x3789
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x90]
push ecx
push 0
call fcn.00411820
add esp, 8
test eax, eax
je 0x406843
push 0x42f538
mov eax, dword [0x42f864]
push eax
call fcn.004164b0
add esp, 8
jmp 0x406843
push 0x104
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x406843
lea eax, [esp + 0x10]
push pe_nt_image_headers32
push eax
mov ecx, dword [0x438580]
push 0x3704
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
mov dword [0x42f844], 0x280
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.00411820
add esp, 8
test eax, eax
je 0x407781
push 0
push 1
push 0
push 0
push esi
call fcn.00401770
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x406843
push 0x104
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x406843
lea eax, [esp + 0x10]
push pe_nt_image_headers32
push eax
mov ecx, dword [0x438580]
push 0x3702
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
mov dword [0x42f844], 0x276
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.00411820
add esp, 8
test eax, eax
je 0x4077ed
push 0
push 1
push 0
push 0
push esi
call fcn.004121f0
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x406843
mov ebp, dword [esp + 0x1a0]
mov esi, dword [esp + 0x194]
push ebp
push edi
push esi
call fcn.004061d0
mov dword [0x42fbd0], 1
add esp, 0xc
jmp 0x406843
mov esi, dword [esp + 0x194]
push esi
call fcn.00406180
add esp, 4
jmp 0x406845
mov esi, dword [esp + 0x194]
push esi
call sub.wsftp32.dll_Ordinal_500
add esp, 4
jmp 0x406843
mov esi, dword [esp + 0x194]
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x406843
mov byte [str.IANS], 0x41
mov dword [0x42f7fc], 0
push 0
mov al, byte [str.IANS]
sub al, 0x41
mov ecx, dword [0x437608]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
cmp al, 1
sbb eax, eax
neg eax
push eax
push 0xf1
push ecx
call esi
mov al, byte [str.IANS]
cmp al, 0x4c
je 0x407bef
cmp al, 0x49
je 0x407bef
xor eax, eax
jmp 0x407bf4
mov byte [str.IANS], 0x49
jmp 0x40786b
cmp dword [0x42f7fc], 0
jne 0x40786b
mov dword [0x42f7fc], 1
jmp 0x407875
mov esi, dword [sym.imp.USER32.dll_GetFocus]
call esi
cmp eax, dword [0x4376f8]
jne 0x407902
mov esi, dword [esp + 0x194]
push 0
push 0x3b1
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x406843
call esi
cmp eax, dword [0x437710]
jne 0x406843
mov esi, dword [esp + 0x194]
push 0
push 0x3b2
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x406843
mov eax, dword [0x438580]
mov esi, dword [esp + 0x194]
push eax
push esi
call fcn.00413360
add esp, 8
push 0
push 0x1fa4
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x406843
mov eax, dword [0x438580]
mov esi, dword [esp + 0x194]
push eax
push esi
call fcn.00402ae0
add esp, 8
jmp 0x406843
mov esi, dword [esp + 0x194]
push 0x437130
push esi
call fcn.0041cf00
add esp, 8
cmp eax, 2
je 0x406843
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x406843
mov esi, dword [esp + 0x194]
push esi
call fcn.00404a00
add esp, 4
jmp 0x406843
push 0
call fcn.00410aa0
add esp, 4
jmp 0x406843
push 0
mov eax, dword [0x4376f8]
mov esi, dword [esp + 0x198]
push eax
push 0
push esi
call fcn.00414b10
add esp, 0x10
mov ecx, dword [0x430354]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x406843
call fcn.0040c140
test eax, eax
jne 0x406843
push 0
mov eax, dword [0x437710]
mov esi, dword [esp + 0x198]
push eax
push 1
push esi
call fcn.00414b10
add esp, 0x10
mov ecx, dword [0x430354]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x406843
mov eax, dword [0x438580]
mov esi, dword [esp + 0x194]
push eax
push esi
call fcn.00402ae0
add esp, 8
jmp 0x406843
push 0xd
mov eax, dword [0x437488]
push 0x42f7b0
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [0x4376f8]
mov esi, dword [esp + 0x194]
push ecx
push 0
push esi
call fcn.00414580
add esp, 0xc
jmp 0x406843
call fcn.0040c140
test eax, eax
jne 0x406843
push 0x14
mov eax, dword [0x437560]
push 0x42f798
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [0x437710]
mov esi, dword [esp + 0x194]
push ecx
push 1
push esi
call fcn.00414580
add esp, 0xc
mov ecx, dword [0x430354]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x406843
mov esi, dword [esp + 0x194]
call fcn.0040c140
test eax, eax
jne 0x406843
push 0x11
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
test ah, 0x90
jne 0x407b00
push 0x10
call edi
test ah, 0x90
jne 0x407b00
mov dword [0x42fbd8], 0
jmp 0x407b0a
mov dword [0x42fbd8], 1
mov eax, dword [0x4376f8]
push eax
push esi
call fcn.00414a50
add esp, 8
mov eax, dword [0x430354]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x406843
mov esi, dword [esp + 0x194]
call fcn.0040c140
test eax, eax
jne 0x406843
push 0x11
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
test ah, 0x90
jne 0x407b62
push 0x10
call edi
test ah, 0x90
jne 0x407b62
mov dword [0x42fbd8], 0
jmp 0x407b6c
mov dword [0x42fbd8], 1
mov eax, dword [0x437710]
push eax
push esi
call fcn.00414ab0
add esp, 8
mov eax, dword [0x430354]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x406843
mov esi, dword [esp + 0x194]
push 1
mov eax, dword [0x4376f8]
push eax
push 0
push esi
call fcn.00414b10
add esp, 0x10
mov eax, dword [0x430354]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x406843
mov esi, dword [esp + 0x194]
call fcn.0040c140
test eax, eax
jne 0x406843
push 1
mov eax, dword [0x437710]
push eax
push 1
push esi
call fcn.00414b10
add esp, 0x10
mov eax, dword [0x430354]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x406843
mov eax, 1
push 0
push eax
push 0xf1
mov eax, dword [0x437620]
push eax
call esi
push 0
mov eax, dword [0x42f7fc]
push eax
mov ecx, dword [0x437638]
push 0xf1
push ecx
call esi
jmp 0x406843
mov edi, dword [esp + 0x19c]
cmp edi, 0x234d
jne 0x407c43
mov esi, dword [esp + 0x194]
push esi
call sub.wsftp32.dll_Ordinal_500
add esp, 4
jmp 0x406843
cmp edi, 0x15b5
jne 0x40664e
mov eax, dword [0x438580]
mov esi, dword [esp + 0x194]
push eax
push esi
call fcn.00402ae0
add esp, 8
jmp 0x406843
mov eax, dword [esp + 0x19c]
and eax, 0xffff
je 0x407c82
cmp eax, 1
je 0x407c91
jmp 0x406843
push 0xffffffffffffffff
call fcn.00402420
add esp, 4
jmp 0x406843
push 1
call fcn.00402420
add esp, 4
jmp 0x406843
mov ebp, dword [esp + 0x1a0]
mov edi, dword [esp + 0x19c]
mov esi, dword [esp + 0x194]
push ebp
push edi
push ebx
push esi
call fcn.004120f0
add esp, 0x10
jmp 0x406845
mov ebp, dword [esp + 0x1a0]
mov edi, dword [esp + 0x19c]
mov esi, dword [esp + 0x194]
push ebp
push edi
push ebx
push esi
call fcn.0040c570
add esp, 0x10
jmp 0x406845
mov ebp, dword [esp + 0x1a0]
mov edi, dword [esp + 0x19c]
mov esi, dword [esp + 0x194]
push ebp
push edi
push ebx
push esi
call fcn.0040c210
add esp, 0x10
jmp 0x406845
mov ebp, dword [esp + 0x1a0]
mov edi, dword [esp + 0x19c]
mov esi, dword [esp + 0x194]
push ebp
push edi
push ebx
push esi
call fcn.0040c460
add esp, 0x10
jmp 0x406845
mov esi, dword [esp + 0x194]
cmp esi, dword [0x437824]
jne 0x406843
mov ebp, dword [esp + 0x1a0]
movzx ecx, bp
shr ebp, 0x10
movzx eax, bp
cmp eax, dword [0x4365d0]
jle 0x406843
cmp eax, dword [0x436594]
jge 0x406843
cmp ecx, dword [0x4365b8]
jle 0x406843
cmp ecx, dword [0x436590]
jge 0x406843
mov eax, dword [0x438580]
push eax
push esi
call fcn.00402ae0
add esp, 8
jmp 0x406843
mov ebp, dword [esp + 0x1a0]
lea ecx, [esp + 0x10]
mov esi, dword [esp + 0x194]
push ecx
movzx eax, bp
shr ebp, 0x10
push esi
mov dword [esp + 0x18], eax
movzx eax, bp
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [esp + 0x14]
push 0
mov ecx, dword [esp + 0x14]
push esi
push 0
push eax
push ecx
push 6
push esi
call fcn.00411960
add esp, 4
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
jmp 0x406843
mov ebp, dword [esp + 0x1a0]
mov edi, dword [esp + 0x19c]
mov esi, dword [esp + 0x194]
push ebp
push edi
push esi
call fcn.004065d0
add esp, 0xc
jmp 0x406845
mov eax, dword [0x42f7d0]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x406843
mov edi, dword [esp + 0x19c]
mov eax, dword [0x437710]
push edi
push eax
call fcn.0041b100
add esp, 8
jmp 0x406843