Function at 0x473390
Capabilities:
Create process on windows
Get common file path
Get program files directory
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b113a
mov eax, dword fs:[0]
push eax
sub esp, 0x348
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x340], eax
push ebx
push esi
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x358]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00555692
xor ecx, ecx
xor esi, esi
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x4733ee
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 8]
cmp eax, 0x810e
mov dword [esp + 0x360], esi
jne 0x473477
lea ecx, [esp + 0x3c]
push ecx
call fcn.0042f000
lea ecx, [esp + 0x3c]
mov byte [esp + 0x360], 1
call fcn.005612bf
cmp dword [esp + 0xb0], esi
je 0x473461
mov edx, dword [ebx + 0x20]
push esi
push esi
push 0x10
push edx
mov dword [ebx + 0x7658], esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [0x63c65c]
push 5
push esi
push str._rerun
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x360], 0
call fcn.0042f0b0
jmp 0x4745e7
cmp eax, 0x80d4
jne 0x4734b3
cmp dword [ebx + 0xe8], 2
je 0x473490
push 2
mov ecx, ebx
call fcn.00463a10
mov ebx, dword [ebx + 0x5120]
cmp ebx, esi
je 0x4745e7
push 0xffffffffffffffff
push 1
push esi
push 1
push esi
push esi
push esi
push ebx
call fcn.004d5b30
jmp 0x4745e7
cmp eax, 0x80da
jne 0x4734d4
push 2
mov ecx, ebx
call fcn.00463a10
add ebx, 0xf50
push ebx
call fcn.004825b0
jmp 0x4745e7
cmp eax, 0x800f
jne 0x4738fd
push 0x5efaf0
lea ecx, [esp + 0x20]
call fcn.004023b0
push esi
push ebx
mov byte [esp + 0x368], 2
mov ecx, dword [esp + 0x24]
push ecx
push 0x201200
push esi
push esi
push 1
lea ecx, [esp + 0x58]
call fcn.00561f56
lea ecx, [esp + 0x3c]
mov byte [esp + 0x360], 3
call fcn.00561e27
cmp eax, 1
jne 0x4738b6
lea ecx, [esp + 0x3c]
call fcn.005582b3
lea ecx, [esp + 0x18]
call fcn.00402700
lea ecx, [esp + 0x10]
call fcn.00402700
lea ecx, [esp + 0x20]
mov byte [esp + 0x360], 5
call fcn.0055d17f
lea ecx, [esp + 0x3c]
mov byte [esp + 0x360], 6
call fcn.00561b4b
mov eax, dword [eax + 0x1c]
cmp eax, esi
mov dword [esp + 0x34], eax
je 0x4735c8
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.00562213
mov byte [esp + 0x360], 7
mov ecx, dword [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.0055d4af
mov byte [esp + 0x360], 6
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4735c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x34], esi
jne 0x473570
cmp dword [esp + 0x28], esi
mov dword [esp + 0x14], esi
jle 0x47373a
lea ecx, [esp + 0x18]
call fcn.00402180
mov eax, dword [esp + 0x14]
test eax, eax
jl 0x4738f8
cmp eax, dword [esp + 0x28]
jge 0x4738f8
mov ecx, dword [esp + 0x24]
mov edx, eax
mov eax, dword [ecx + edx*4]
lea ecx, [esp + 0x18]
push ecx
push eax
xor ecx, ecx
xor edi, edi
xor esi, esi
call fcn.0044b470
mov edx, dword [esp + 0x20]
push str..htm
push edx
call fcn.00577334
add esp, 0x10
test eax, eax
je 0x47365f
mov esi, dword [esp + 0x18]
push str..html
push esi
call fcn.00577334
add esp, 8
test eax, eax
je 0x47365f
push str..mht
push esi
call fcn.00577334
add esp, 8
test eax, eax
je 0x47365f
push str..flv
push esi
call fcn.00577334
add esp, 8
test eax, eax
jne 0x4736a9
cmp dword [ebx + 0x5120], 0
je 0x473671
push 2
mov ecx, ebx
call fcn.00463a10
mov ecx, dword [ebx + 0x5120]
test ecx, ecx
je 0x473723
mov esi, dword [esp + 0x14]
cmp esi, dword [esp + 0x28]
jge 0x4738f8
mov eax, dword [esp + 0x24]
mov eax, dword [eax + esi*4]
push 0xffffffffffffffff
push 1
push 0
push 1
push 0
push 0
push eax
push ecx
call fcn.004d5b30
jmp 0x473727
push str..url
push esi
call fcn.00577334
add esp, 8
test eax, eax
jne 0x473723
mov esi, dword [esp + 0x14]
cmp esi, dword [esp + 0x28]
jge 0x4738f8
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + esi*4]
lea edx, [esp + 0x18]
push edx
push eax
call fcn.004540a0
mov edi, dword [esp + 0x20]
add esp, 8
cmp dword [edi - 0xc], 0
je 0x473719
cmp dword [ebx + 0x5120], 0
je 0x4736fa
push 2
mov ecx, ebx
call fcn.00463a10
mov eax, dword [ebx + 0x5120]
test eax, eax
je 0x473727
push 0xffffffffffffffff
push 1
push 0
push 1
push 0
push 0
push edi
push eax
call fcn.004d5b30
jmp 0x473727
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x473727
mov esi, dword [esp + 0x14]
add esi, 1
cmp esi, dword [esp + 0x28]
mov dword [esp + 0x14], esi
jl 0x4735d6
xor esi, esi
lea ecx, [esp + 0x10]
call fcn.00402180
xor ebx, ebx
cmp dword [esp + 0x28], esi
jle 0x473809
nop
lea ecx, [esp + 0x18]
call fcn.00402180
test ebx, ebx
jl 0x4738f8
cmp ebx, dword [esp + 0x28]
jge 0x4738f8
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + ebx*4]
lea edx, [esp + 0x18]
push edx
push eax
xor ecx, ecx
xor edi, edi
xor esi, esi
call fcn.0044b470
mov eax, dword [esp + 0x20]
push str..mp3
push eax
call fcn.00577334
add esp, 0x10
test eax, eax
je 0x4737c1
mov esi, dword [esp + 0x18]
push str..wav
push esi
call fcn.00577334
add esp, 8
test eax, eax
je 0x4737c1
push str..wma
push esi
call fcn.00577334
add esp, 8
test eax, eax
jne 0x4737fa
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 0xc], 0
je 0x4737db
push 2
push 0x5efc2c
lea ecx, [esp + 0x18]
call fcn.004044f0
cmp ebx, dword [esp + 0x28]
jge 0x4738f8
mov edx, dword [esp + 0x24]
mov eax, dword [edx + ebx*4]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.004044f0
add ebx, 1
cmp ebx, dword [esp + 0x28]
jl 0x473750
xor esi, esi
mov edi, dword [esp + 0x10]
mov eax, dword [edi - 0xc]
cmp eax, esi
je 0x473859
xor ecx, ecx
add eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00555176
mov esi, eax
add esp, 4
mov ecx, edi
sub esi, edi
movzx edx, word [ecx]
mov word [ecx + esi], dx
add ecx, 2
test dx, dx
jne 0x473836
push 0
push eax
mov eax, dword [0x63c45c]
push 0x5cf
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [esp + 0x20]
mov byte [esp + 0x360], 5
call fcn.0055d21d
add edi, 0xfffffff0
mov byte [esp + 0x360], 4
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47388e
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov byte [esp + 0x360], 3
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4738b6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x360], 2
call fcn.00561f15
mov byte [esp + 0x360], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4745e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4745e7
call fcn.00555520
cmp eax, 0x802f
jne 0x47392d
mov ecx, dword [ebx + 0x5120]
cmp ecx, esi
je 0x4745e7
cmp dword [ebx + 0xe8], 2
jne 0x4745e7
push esi
push esi
push 4
call fcn.004d9d80
jmp 0x4745e7
cmp eax, 0x8032
jne 0x4739e1
lea ecx, [esp + 0x14]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push closesocket
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x47396e
push esi
call dword [sym.imp.USER32.dll_MessageBeep]
lea ecx, [esp + 0x38]
call fcn.00401f20
jmp 0x474612
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x14]
push eax
push esi
push esi
push str.GlobalUserOffline
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4739c6
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
push ecx
push 4
mov edx, 1
sub edx, dword [esp + 0x1c]
push esi
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x24]
push str.GlobalUserOffline
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
cmp dword [esp + 0x10], esi
setne al
mov dword [0x63c93c], eax
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
push 0x27
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
jmp 0x4745e7
cmp eax, 0x8047
jne 0x473a11
mov ecx, dword [ebx + 0x5120]
cmp ecx, esi
je 0x4745e7
cmp dword [ebx + 0xe8], 2
jne 0x4745e7
push esi
push esi
push 8
call fcn.004d9d80
jmp 0x4745e7
cmp eax, 0x8031
jne 0x473a41
mov ecx, dword [ebx + 0x5120]
cmp ecx, esi
je 0x4745e7
cmp dword [ebx + 0xe8], 2
jne 0x4745e7
push esi
push esi
push 7
call fcn.004d9d80
jmp 0x4745e7
cmp eax, 0x8030
jne 0x473a71
mov ecx, dword [ebx + 0x5120]
cmp ecx, esi
je 0x4745e7
cmp dword [ebx + 0xe8], 2
jne 0x4745e7
push esi
push esi
push 6
call fcn.004d9d80
jmp 0x4745e7
cmp eax, 0x8077
jne 0x473abc
lea ecx, [esp + 0x10]
call fcn.00402700
mov byte [esp + 0x360], 8
mov edx, dword [0x63c094]
push edx
lea eax, [esp + 0x14]
push 0x5efcd8
push eax
call fcn.00404650
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push esi
push esi
push ecx
call fcn.0055e834
lea ecx, [esp + 0x10]
call fcn.00401f20
jmp 0x4745e7
cmp eax, 0x8107
jne 0x473b00
mov eax, dword [ebx + 0x5120]
mov ecx, dword [eax + 0xa50]
mov edx, dword [eax + 0xa64]
add edx, ecx
test edx, edx
jle 0x4745e7
mov eax, dword [eax + 0xa78]
push 0x13af
lea ecx, [ebx + 0xf50]
mov dword [ebx + 0x18d4], eax
call fcn.00482e50
jmp 0x4745e7
cmp eax, 0x810d
jne 0x473b44
mov eax, dword [ebx + 0x5120]
mov ecx, dword [eax + 0xa50]
mov edx, dword [eax + 0xa64]
add edx, ecx
test edx, edx
jle 0x4745e7
mov eax, dword [eax + 0xa78]
push 0x13b0
lea ecx, [ebx + 0xf50]
mov dword [ebx + 0x18d4], eax
call fcn.00482e50
jmp 0x4745e7
cmp eax, 0x8108
jne 0x473b88
mov eax, dword [ebx + 0x5120]
mov ecx, dword [eax + 0xa50]
mov edx, dword [eax + 0xa64]
add edx, ecx
test edx, edx
jle 0x4745e7
mov eax, dword [eax + 0xa78]
push 0x13b5
lea ecx, [ebx + 0xf50]
mov dword [ebx + 0x18d4], eax
call fcn.00482e50
jmp 0x4745e7
cmp eax, 0x8109
jne 0x473bcc
mov eax, dword [ebx + 0x5120]
mov ecx, dword [eax + 0xa50]
mov edx, dword [eax + 0xa64]
add edx, ecx
test edx, edx
jle 0x4745e7
mov eax, dword [eax + 0xa78]
push 0x13b6
lea ecx, [ebx + 0xf50]
mov dword [ebx + 0x18d4], eax
call fcn.00482e50
jmp 0x4745e7
cmp eax, 0x810a
jne 0x473be3
mov esi, dword [ebx + 0x5120]
call fcn.004d4140
jmp 0x4745e7
cmp eax, 0x805a
jne 0x473c03
mov edx, dword [ebx + 0x5120]
mov edi, dword [edx + 0xa78]
push ebx
xor ebx, ebx
call fcn.0046b770
jmp 0x4745e7
cmp eax, 0x8068
jne 0x473c14
push 0x55f2
jmp 0x4745e0
cmp eax, 0x8069
jne 0x473c25
push 0x55f3
jmp 0x4745e0
cmp eax, 0x8081
jne 0x473c66
mov edx, dword [ebx + 0x5120]
cmp edx, esi
je 0x474340
cmp dword [ebx + 0xe8], 2
jne 0x474340
mov ecx, dword [edx + 0xa78]
call fcn.004da4e0
cmp eax, esi
je 0x474340
mov ecx, eax
call fcn.004ab940
jmp 0x4745e7
cmp eax, 0x80e1
jne 0x473cd6
lea eax, [esp + 0x3c]
push eax
call fcn.0042d320
lea ecx, [esp + 0x3c]
mov byte [esp + 0x360], 9
call fcn.005612bf
cmp dword [esp + 0xb8], esi
je 0x473cc0
mov ecx, dword [ebx + 0x20]
push esi
push esi
push 0x10
push ecx
mov dword [ebx + 0x7658], esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [0x63c65c]
push 5
push esi
push str._rerun
push edx
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x360], 0
call fcn.0042d3e0
jmp 0x4745e7
cmp eax, 0x807f
jne 0x473d11
lea esi, [esp + 0x3c]
call fcn.00419390
mov ecx, esi
mov byte [esp + 0x360], 0xa
call fcn.005612bf
mov byte [esp + 0x360], 0
mov ecx, esi
mov dword [esp + 0x3c], vtable.CDlgClearLog.0
call fcn.00560b89
jmp 0x4745e7
cmp eax, 0x80e5
jne 0x473d49
lea eax, [esp + 0x3c]
push eax
call fcn.0041a6d0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x360], 0xb
call fcn.005612bf
lea ecx, [esp + 0x3c]
mov byte [esp + 0x360], 0
call fcn.0041a7c0
jmp 0x4745e7
cmp eax, 0x8011
jne 0x473d5a
call fcn.005163f0
jmp 0x4745e7
cmp eax, 0x8038
jne 0x473d7b
mov ebx, dword [ebx + 0x5120]
cmp ebx, esi
je 0x4745e7
mov esi, ebx
call fcn.004d9680
jmp 0x4745e7
cmp eax, 0x804f
jne 0x473db3
lea ecx, [esp + 0x3c]
push ecx
call fcn.0042f910
lea ecx, [esp + 0x3c]
mov byte [esp + 0x360], 0xc
call fcn.005612bf
lea ecx, [esp + 0x3c]
mov byte [esp + 0x360], 0
call fcn.0042fa40
jmp 0x4745e7
cmp eax, 0x80e0
jne 0x473dc6
mov ecx, ebx
call fcn.0046cb60
jmp 0x4745e7
cmp eax, 0x80de
jne 0x473e2f
mov ebx, dword [ebx + 0x5120]
cmp ebx, esi
je 0x4745e7
mov ecx, dword [ebx + 0xa78]
mov edx, ebx
call fcn.004da4e0
mov esi, eax
test esi, esi
je 0x473e81
xor edx, edx
cmp dword [esi + 0x1a0], edx
mov ecx, esi
sete dl
push edx
call fcn.004f0a30
xor eax, eax
cmp dword [esi + 0x1a0], eax
mov ecx, esi
sete al
mov edi, eax
call fcn.004f0670
xor ecx, ecx
cmp dword [esi + 0x1a0], ecx
sete cl
mov dword [esi + 0x1a0], ecx
jmp 0x4745e7
cmp eax, 0x80fc
jne 0x473e8e
mov ebx, dword [ebx + 0x5120]
cmp ebx, esi
je 0x4745e7
mov ecx, dword [ebx + 0xa78]
mov edx, ebx
call fcn.004da4e0
mov esi, eax
test esi, esi
je 0x473e81
xor edx, edx
cmp dword [esi + 0x1a4], edx
mov ecx, esi
sete dl
mov edi, edx
call fcn.004f0940
xor eax, eax
cmp dword [esi + 0x1a4], eax
sete al
mov dword [esi + 0x1a4], eax
jmp 0x4745e7
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x4745e7
cmp eax, 0x8048
jne 0x473f02
cmp dword [ebx + 0x71ec], esi
jne 0x473ee4
push 0x1ac
call fcn.0055514b
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, esi
mov byte [esp + 0x360], 0xd
je 0x473ec2
push eax
call fcn.00458d00
jmp 0x473ec4
xor eax, eax
mov byte [esp + 0x360], 0
mov dword [ebx + 0x71ec], eax
mov edx, dword [eax]
push ebx
mov ecx, eax
mov eax, dword [edx + 0x134]
push 0xdf
call eax
mov ecx, dword [ebx + 0x71ec]
push esi
call fcn.00557a7a
mov ecx, dword [ebx + 0x71ec]
push 1
call fcn.0055c1c8
jmp 0x4745e7
cmp eax, 0x8053
jne 0x473f97
lea ecx, [esp + 0x10]
call fcn.00402700
mov byte [esp + 0x360], 0xe
mov ecx, dword [0x63c094]
push ecx
lea edx, [esp + 0x14]
push 0x5efd88
push edx
call fcn.00404650
mov eax, dword [esp + 0x1c]
add esp, 0xc
push esi
push 4
push eax
call fcn.0055e834
cmp eax, 6
jne 0x473f89
push str.TangoBrowser
lea ecx, [esp + 0x20]
call fcn.004023b0
mov byte [esp + 0x360], 0xf
mov ecx, dword [0x63c094]
mov edx, dword [0x63c65c]
push ecx
push edx
push eax
call fcn.00498590
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.00401f20
mov dword [0x63c0dc], 1
lea ecx, [esp + 0x10]
call fcn.00401f20
jmp 0x4745e7
cmp eax, 0x8056
jne 0x474034
push esi
push 4
push 0x5efdc0
call fcn.0055e834
cmp eax, 6
jne 0x4745e7
push esi
push 0x26
lea eax, [esp + 0x44]
push eax
push esi
mov word [esp + 0x4c], si
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x473ffc
lea eax, [esp + 0x3c]
add eax, 0xfffffffe
jmp 0x473fe0
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x473fe0
mov edi, eax
mov ecx, 0x10
mov esi, str.internet_exploreriexplore.exe
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push str.TangoBrowser
lea ecx, [esp + 0x20]
call fcn.004023b0
lea ecx, [esp + 0x3c]
push ecx
push eax
mov byte [esp + 0x368], 0x10
call fcn.004999b0
add esp, 8
lea ecx, [esp + 0x1c]
call fcn.00401f20
mov dword [0x63c0dc], esi
jmp 0x4745e7
cmp eax, 0x807d
jne 0x474045
push 0x5627
jmp 0x4745e0
cmp eax, 0x8073
jne 0x474056
push 0x5609
jmp 0x4745e0
cmp eax, 0x80d0
jne 0x474067
push 0x5687
jmp 0x4745e0
cmp eax, 0x8092
jne 0x474078
push 0x5640
jmp 0x4745e0
cmp eax, 0x8093
jne 0x474089
push 0x5642
jmp 0x4745e0
cmp eax, 0x8094
jne 0x47409a
push 0x5645
jmp 0x4745e0
cmp eax, 0x8095
jne 0x4740ab
push 0x5646
jmp 0x4745e0
cmp eax, 0x8096
jne 0x4740bc
push 0x5641
jmp 0x4745e0
cmp eax, 0x8097
jne 0x4740cd
push 0x5644
jmp 0x4745e0
cmp eax, 0x80ea
jne 0x4740de
push 0x59e2
jmp 0x4745e0
cmp eax, 0x80eb
jne 0x4740ef
push 0x59e3
jmp 0x4745e0
cmp eax, 0x80ec
jne 0x474100
push 0x59e4
jmp 0x4745e0
cmp eax, 0x80ed
jne 0x474111
push 0x59e5
jmp 0x4745e0
cmp eax, 0x80ee
jne 0x474122
push 0x59e6
jmp 0x4745e0
cmp eax, 0x80ef
jne 0x474133
push 0x59e7
jmp 0x4745e0
cmp eax, 0x80f1
jne 0x474144
push 0x59e9
jmp 0x4745e0
cmp eax, 0x80f0
jne 0x474155
push 0x59e8
jmp 0x4745e0
cmp eax, 0x80f2
jne 0x474166
push 0x59ea
jmp 0x4745e0
cmp eax, 0x80f3
jne 0x474177
push 0x59eb
jmp 0x4745e0
cmp eax, 0x80f4
jne 0x474188
push 0x59ec
jmp 0x4745e0
cmp eax, 0x80f6
jne 0x474199
push 0x5617
jmp 0x4745e0
cmp eax, 0x80f7
jne 0x4741aa
push 0x5615
jmp 0x4745e0
cmp eax, 0x80f8
jne 0x4741bb
push 0x5616
jmp 0x4745e0
cmp eax, 0x80f9
jne 0x4741cc
push 0x561a
jmp 0x4745e0
cmp eax, 0x80fa
jne 0x4741dd
push 0x5618
jmp 0x4745e0
cmp eax, 0x80fb
jne 0x4741ee
push 0x5619
jmp 0x4745e0
cmp eax, 0x80cf
jne 0x47425c
lea esi, [esp + 0x3c]
call fcn.004186e0
mov ecx, esi
mov byte [esp + 0x360], 0x11
call fcn.005612bf
cmp eax, 1
jne 0x47423e
push ebx
call fcn.004632e0
lea eax, [ebx + 0xf50]
call fcn.0047ec30
mov edx, dword [ebx + 0x2360]
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebx + 0x1ff4], 0
mov byte [esp + 0x360], 0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x3c], vtable.CDlgButtonView.0
call fcn.00560b89
jmp 0x4745e7
cmp eax, 0x80ce
jne 0x47429a
xor eax, eax
cmp dword [0x63c114], esi
sete al
mov dword [0x63c114], eax
cmp dword [ebx + 0xe8], 2
jne 0x4745e7
push ebx
call fcn.004632e0
mov ecx, dword [ebx + 0x2360]
push esi
push esi
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4745e7
cmp eax, 0x810f
jne 0x4742ab
push 0x568a
jmp 0x4745e0
cmp eax, 0x8064
jne 0x4742c2
push ebx
mov ecx, 4
call fcn.00474730
jmp 0x4745e7
cmp eax, 0x80dc
jne 0x4742ec
mov edi, dword [ebx + 0x5120]
cmp edi, esi
je 0x4745e7
xor ebx, ebx
cmp dword [0x63c154], ebx
sete bl
call fcn.004d76d0
jmp 0x4745e7
cmp eax, 0x80fe
jne 0x4742fd
push 0x59da
jmp 0x4745e0
cmp eax, 0x80ff
jne 0x47430e
push 0x59db
jmp 0x4745e0
cmp eax, 0x80e7
jne 0x47434c
mov eax, dword [ebx + 0x5120]
cmp eax, esi
je 0x474340
cmp dword [ebx + 0xe8], 2
jne 0x474340
xor edx, edx
cmp dword [0x63c618], esi
push eax
sete dl
mov eax, edx
call fcn.004dcdb0
jmp 0x4745e7
push esi
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x4745e7
cmp eax, 0x8065
jne 0x474363
push ebx
mov ecx, 3
call fcn.00474730
jmp 0x4745e7
cmp eax, 0x8044
jne 0x474374
push 0x560e
jmp 0x4745e0
cmp eax, 0x805f
jne 0x474385
push 0x560f
jmp 0x4745e0
cmp eax, 0x8061
jne 0x474396
push 0x5610
jmp 0x4745e0
cmp eax, 0x8062
jne 0x4743a7
push 0x5611
jmp 0x4745e0
cmp eax, 0x80a9
jne 0x4743b8
push 0x564d
jmp 0x4745e0
cmp eax, 0x80d8
jne 0x4743dc
mov eax, dword [0x63c450]
mov ecx, dword [eax + 0x5120]
cmp ecx, esi
je 0x4745e7
call fcn.004da560
jmp 0x4745e7
cmp eax, 0x8049
jne 0x4743fa
push 3
push 4
lea ecx, [esp + 0x28]
call fcn.005650c4
mov byte [esp + 0x360], 0x12
jmp 0x47446f
cmp eax, 0x804a
jne 0x474418
push 3
push 3
lea ecx, [esp + 0x28]
call fcn.005650c4
mov byte [esp + 0x360], 0x13
jmp 0x47446f
cmp eax, 0x804d
jne 0x474436
push 3
push 2
lea ecx, [esp + 0x28]
call fcn.005650c4
mov byte [esp + 0x360], 0x14
jmp 0x47446f
cmp eax, 0x804c
jne 0x474454
push 3
push 1
lea ecx, [esp + 0x28]
call fcn.005650c4
mov byte [esp + 0x360], 0x15
jmp 0x47446f
cmp eax, 0x804b
jne 0x4744a0
push 3
push esi
lea ecx, [esp + 0x28]
call fcn.005650c4
mov byte [esp + 0x360], 0x16
mov ecx, dword [ebx + 0x5120]
cmp ecx, esi
je 0x474490
cmp dword [ebx + 0xe8], 2
jne 0x474490
lea edx, [esp + 0x20]
push edx
push 2
push 0x13
call fcn.004d9d80
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x4745e7
cmp eax, 0x8015
jne 0x4744e9
lea ecx, [esp + 0x3c]
push ecx
call fcn.00414de0
push 0x63c094
lea ecx, [esp + 0xb4]
mov byte [esp + 0x364], 0x17
call fcn.00402330
lea ecx, [esp + 0x3c]
call fcn.005612bf
lea ecx, [esp + 0x3c]
mov byte [esp + 0x360], 0
call fcn.00414eb0
jmp 0x4745e7
cmp eax, 0x805d
jne 0x4744fa
push 0x55fc
jmp 0x4745e0
cmp eax, 0x8075
jne 0x47450b
push 0x560a
jmp 0x4745e0
cmp eax, 0x8012
jne 0x47452b
mov edx, dword [ebx + 0x20]
push esi
push esi
push 0x10
push edx
mov dword [ebx + 0x7658], esi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4745e7
cmp eax, 0x805e
jne 0x474556
xor eax, eax
cmp dword [0x63c1ac], esi
push esi
sete al
push esi
mov dword [0x63c1ac], eax
mov ecx, dword [ebx + 0x3b88]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4745e7
cmp eax, 0x80c4
jne 0x474564
push 0x5624
jmp 0x4745e0
cmp eax, 0x80c5
jne 0x474572
push 0x5625
jmp 0x4745e0
cmp eax, 0x80c6
jne 0x474580
push 0x5620
jmp 0x4745e0
cmp eax, 0x80c7
jne 0x47458e
push 0x561f
jmp 0x4745e0
cmp eax, 0x80c8
jne 0x47459c
push 0x561e
jmp 0x4745e0
cmp eax, 0x80c9
jne 0x4745aa
push 0x561d
jmp 0x4745e0
cmp eax, 0x80ca
jne 0x4745b8
push 0x561c
jmp 0x4745e0
cmp eax, 0x80cb
jne 0x4745c6
push 0x5621
jmp 0x4745e0
cmp eax, 0x80cc
jne 0x4745d4
push 0x5622
jmp 0x4745e0
cmp eax, 0x80cd
jne 0x4745e7
push 0x5623
mov ecx, ebx
call fcn.0046d6a0
mov dword [esp + 0x360], 0xffffffff
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x474612
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x358]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x340]
xor ecx, esp
call fcn.00577139
mov esp, ebp
pop ebp
ret 4