Function at 0x4882f0
Capabilities:
Get session user name
Hide graphical window
List user accounts

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4bf600
push eax
mov dword fs:[0], esp
sub esp, 0xaa0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 0x110
jne 0x488333
push ebx
push 8
push esi
mov dword [ebp + 0xc], ebx
mov dword [ebx], esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x48833f
push 8
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp + 0xc], eax
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4896b1
cmp edi, 0x138
ja 0x489275
je 0x48922a
mov eax, edi
sub eax, 0x110
je 0x48894a
sub eax, 1
je 0x48840c
sub eax, 1
jne 0x4896b1
mov eax, 0xabb6
cmp word [ebp + 0x10], ax
jne 0x4896b1
mov ecx, dword [0x50b3a4]
push esi
call fcn.00450d40
test al, al
je 0x4883e9
push 0x5f7
push esi
call fcn.00420d20
add esp, 8
push 0
push 0
push 0x14b
push 0x5f7
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0
push 0
push 0x47a
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test ebx, ebx
je 0x4883e9
push ebx
push 0x5f7
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push ebx
call fcn.00441300
add esp, 4
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shr eax, 0x10
test ax, ax
jne 0x4888fe
movzx eax, cx
cmp eax, 0x60b
jg 0x4887cd
je 0x488730
cmp eax, 0x5f5
jg 0x4886d6
je 0x4886a8
sub eax, 2
je 0x48867d
sub eax, 0x5f2
jne 0x4896b1
mov ebx, dword [edx + 8]
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x488470
push eax
call fcn.00441300
add esp, 4
mov dword [ebx + 0x24], 0
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x488487
push eax
call fcn.00441300
add esp, 4
mov dword [ebx + 0x28], 0
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0
push 0
push pe_nt_image_headers32
push 0x679
push esi
call edi
test eax, eax
je 0x488502
push 0x674
xor edi, edi
push esi
mov dword [ebx + 0x20], edi
call fcn.00420d20
add esp, 8
mov dword [ebx + 0x24], eax
cmp eax, edi
je 0x488518
push 0x675
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov ecx, ebx
call fcn.0046c650
test eax, eax
jne 0x488518
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
push 0x10
push eax
push str.Invalid_user_name_or_password_was_specified_
call fcn.004200b0
add esp, 0x14
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
push pe_nt_image_headers32
push 0x672
push esi
call edi
mov dword [ebx + 0x20], eax
xor edi, edi
mov eax, dword [ebx + 0x10]
cmp eax, edi
je 0x48852b
push eax
call fcn.00441300
add esp, 4
mov dword [ebx + 0x10], edi
push 0x5f7
push esi
call fcn.00420d20
add esp, 8
mov dword [ebx + 0x10], eax
cmp eax, edi
je 0x48854c
mov ecx, dword [0x50b3a0]
push eax
call fcn.00447fd0
mov eax, dword [ebx + 0x14]
cmp eax, edi
je 0x48855f
push eax
call fcn.00441300
add esp, 4
mov dword [ebx + 0x14], edi
push 0x643
push esi
call fcn.00420d20
mov edi, eax
add esp, 8
test edi, edi
je 0x488676
push 0x25
push edi
call fcn.004b03ac
add esp, 8
test eax, eax
je 0x488676
push edi
call fcn.004ad370
add esp, 4
mov ecx, eax
test eax, eax
jne 0x48859b
mov ecx, edi
mov dword [ebx + 0x14], ecx
test eax, eax
je 0x4885af
test edi, edi
je 0x4885af
push edi
call fcn.00441300
add esp, 4
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0
push 0
push pe_nt_image_headers32
push 0x60b
push esi
call edi
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x268]
cmp eax, 1
je 0x4885f7
cmp eax, 3
je 0x4885f7
push 0
push 0
push pe_nt_image_headers32
push 0x91a
push esi
call edi
neg eax
sbb eax, eax
and eax, 2
mov dword [ebx + 0x268], eax
mov eax, dword [ebx + 0x268]
test eax, eax
je 0x488606
cmp eax, 3
jne 0x488648
cmp dword [ebx + 0x25c], 0
je 0x488648
push 0
lea ecx, [ebp + 0x14]
push ecx
push 0x98c
push esi
mov dword [ebp + 0x14], 0
call dword [sym.imp.USER32.dll_GetDlgItemInt]
cmp dword [ebp + 0x14], 0
je 0x488648
lea edx, [eax - 1]
cmp edx, 0x62
ja 0x488648
mov ecx, 0x64
sub ecx, eax
lea eax, [ecx + ecx*4]
add eax, eax
mov dword [ebx + 0x260], eax
mov ecx, dword [ebp + 0xc]
push 0x5f4
push esi
mov dword [ecx + 4], 0x5f4
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
jmp 0x488599
mov edx, dword [ebp + 0xc]
push 2
push esi
mov dword [edx + 4], 2
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0xc]
push 0x5f5
push esi
mov dword [eax + 4], 0x5f5
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x5f8
jne 0x4896b1
push 0
push 0
push 1
push 0x4db704
push esi
push 0
push str.Choose_program_to_run
call fcn.00421f50
mov ebx, eax
add esp, 0x1c
test ebx, ebx
je 0x488718
push ebx
push 0x5f7
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push ebx
call fcn.00441300
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0
push 0
push pe_nt_image_headers32
push 0x60b
push esi
call edi
cmp dword [0x50b3c4], 6
mov ebx, eax
jb 0x48877e
test ebx, ebx
je 0x48876c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
cmp dword [edx + 0x268], 3
je 0x48876c
mov eax, 1
jmp 0x48876e
xor eax, eax
push eax
push 0
push 0x160c
push 0x5f4
push esi
call edi
test ebx, ebx
je 0x4887b5
push 0x678
push 0x679
push 0x678
push esi
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0
push 0x672
push esi
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 0
push 0
push 0x479
push esi
call fcn.004882f0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x679
jg 0x48885c
cmp eax, 0x678
jge 0x4887f2
mov ecx, eax
sub ecx, 0x642
je 0x4887f7
sub ecx, 0x30
jne 0x4896b1
push 0
push eax
jmp 0x4887aa
push 0x643
push esi
call fcn.00420d20
push 0
push 0
mov edi, eax
push esi
push edi
push str.Choose_startup_directory
call fcn.00421d90
mov ebx, eax
add esp, 0x1c
test ebx, ebx
je 0x488833
push ebx
push 0x643
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push ebx
call fcn.00441300
add esp, 4
test edi, edi
je 0x488718
push edi
call fcn.00441300
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [eax - 0x989]
cmp ecx, 2
ja 0x4896b1
sub eax, 0x989
mov ebx, dword [edx + 8]
je 0x488897
sub eax, 1
je 0x48888b
sub eax, 1
jne 0x4888a1
mov dword [ebx + 0x25c], 2
jmp 0x4888a1
mov dword [ebx + 0x25c], 1
jmp 0x4888a1
mov dword [ebx + 0x25c], 0
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
cmp dword [ebx + 0x25c], edx
setne dl
push edx
push 0x98c
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
cmp dword [ebx + 0x25c], eax
setne al
push eax
push 0x98d
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebx + 0x25c], 0
je 0x4887b5
push 0x98c
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x4887b5
mov edx, 0x100
cmp ax, dx
jne 0x4896b1
test ebx, ebx
je 0x4896b1
movzx eax, cx
cmp eax, 0x675
je 0x488929
cmp eax, 0x98c
jne 0x4896b1
push 0
push 0
push 0xe
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0
push 0xb1
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4896b1
mov eax, dword [0x50b3a8]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 1
push 0x80
push esi
mov dword [ebp - 0x20], 0
call ebx
mov ecx, dword [0x50b3ac]
push ecx
push 0
push 0x80
push esi
call ebx
push 0
push esi
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0
push 0x800
push 0x400
mov edi, eax
push 0
push edi
call dword [sym.imp.USER32.dll_InsertMenuW]
mov edx, dword [0x50bb90]
push str.Clear_history...
push 0xabb6
push 0xffffffffffffffec
push edx
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 8
or eax, 0x400
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push 0x30
push 0x675
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0
push 1
push 0x47a
push esi
call ebx
lea ecx, [ebp - 0x14]
call fcn.004a4720
mov ecx, dword [0x50b39c]
push 0
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.004065f0
test eax, eax
jl 0x488a29
lea ecx, [ebp - 0x14]
call fcn.004a4800
mov dword [ebp - 0x10], eax
test eax, eax
je 0x488a30
mov ecx, eax
call fcn.004a4a70
mov ecx, eax
mov dword [ebp + 0x14], ecx
jmp 0x488a3a
mov dword [ebp - 0x10], 0
mov dword [ebp + 0x14], 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 8]
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x488a4b
mov edi, eax
jmp 0x488a5a
test ecx, ecx
je 0x488a58
call fcn.004786d0
mov edi, eax
jmp 0x488a5a
xor edi, edi
mov ecx, dword [0x50b3a0]
push 0
call fcn.00447c50
cmp dword [ebx + 0x268], 1
jne 0x488b08
push edi
push 0x5f7
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x488a8f
call fcn.00478700
jmp 0x488a94
mov eax, 0x4c1318
push eax
push 0x643
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x988
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x989
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x98a
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x98b
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x98d
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x98c
jmp 0x488bc5
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x488b11
mov eax, ecx
push eax
push 0x5f7
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x488b2a
mov eax, 0x4c1318
push eax
push 0x643
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, 0x3e8
sub ecx, dword [ebx + 0x260]
mov eax, 0xcccccccd
mul ecx
push 0
shr edx, 3
push edx
push 0x98c
push esi
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov edx, dword [ebx + 0x25c]
add edx, 0x989
push edx
push 0x98b
push 0x989
push esi
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
cmp dword [ebx + 0x25c], eax
setne al
push eax
push 0x98c
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
xor ecx, ecx
cmp dword [ebx + 0x25c], ecx
setne cl
push ecx
push 0x98d
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebx + 0x268], 3
jne 0x488bcf
push 0
push 0x91a
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebx + 0x24]
mov dword [ebp + 8], edx
mov eax, dword [ebx + 0x28]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x20]
lea edx, [ebp - 0x1c]
add eax, 0x10
push edx
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp + 0x14], 0x678
mov dword [ebp - 0x1c], 0x209
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x488c0f
mov eax, dword [ebp + 0xc]
xor ecx, ecx
add eax, 0x10
mov word [eax], cx
push 0x4dfd20
lea edx, [ebp - 0xaac]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
lea eax, [ebp - 0xaac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0xaac]
push ecx
push 0x678
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
xor edx, edx
mov word [ebp - 0x494], dx
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x488c5d
cmp word [eax], dx
jne 0x488c96
cmp dword [ebx + 0x268], 1
jne 0x488de2
cmp dword [ebp - 0x10], edx
je 0x488de2
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 0x10]
lea edx, [ebp + 8]
push edx
call fcn.004a4a70
mov ecx, eax
call fcn.00478740
test eax, eax
je 0x488de2
cmp dword [ebp - 0x18], 0
mov dword [ebp + 0x14], 0x679
je 0x488cbc
push 1
push 0x672
push esi
call dword [sym.imp.USER32.dll_CheckDlgButton]
lea eax, [ebp - 0x494]
jmp 0x488de7
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x488cd8
cmp word [eax], 0
je 0x488cd8
push 0x209
push eax
lea eax, [ebp - 0x494]
push eax
jmp 0x488ceb
mov eax, dword [ebp + 0xc]
push 0x209
add eax, 0x10
push eax
lea ecx, [ebp - 0x494]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x488db4
push 0x2e
push eax
call fcn.004b03ac
add esp, 8
push 0x104
test eax, eax
je 0x488d62
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x494]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x4dfd1c
push 0x209
lea ecx, [ebp - 0x494]
push ecx
call fcn.00401880
lea eax, [ebp - 0x494]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x488d40
sub eax, edx
mov edx, dword [ebp + 0x10]
push 0x104
sar eax, 1
push edx
lea eax, [ebp + eax*2 - 0x494]
push eax
jmp 0x488dc4
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x494]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x4c9860
push 0x209
lea eax, [ebp - 0x494]
push eax
call fcn.00401880
lea eax, [ebp - 0x494]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x488d92
mov ecx, dword [ebp + 8]
sub eax, edx
push 0x104
sar eax, 1
push ecx
lea edx, [ebp + eax*2 - 0x494]
push edx
jmp 0x488dc4
mov eax, dword [ebp + 8]
push 0x209
push eax
lea ecx, [ebp - 0x494]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [ebx + 0x2c]
push edx
push 0x675
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
lea eax, [ebp - 0x494]
jmp 0x488de7
mov eax, 0x4c1318
push eax
push 0x674
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [ebp + 0x14]
push eax
push 0x679
push 0x678
push esi
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0
push 0
push 0x479
push esi
call fcn.004882f0
cmp dword [0x50b3c4], 6
jae 0x488e71
push str.Run_as...
push 0x60b
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea ecx, [ebp - 0x30]
push ecx
push 0x60b
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push 6
push edx
cdq
sub eax, edx
sar eax, 1
push eax
push 0
push 0
push 0
push 0x60b
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x488ed0
mov eax, dword [0x50b39c]
cmp dword [eax + 0x4388], 0
jne 0x488e85
cmp dword [ebx + 0x1c], 0
je 0x488ed0
push 1
push 0x60b
push esi
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov ecx, dword [0x50b39c]
cmp dword [ecx + 0x4388], 0
je 0x488eb5
push 0
push 0x60b
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x488ed0
cmp dword [0x50b3c4], 6
jae 0x488ed0
push 0
push 0x60b
push 0x111
push esi
call fcn.004882f0
mov edx, dword [0x50b3a8]
push edx
push 0xfffffffffffffff2
push esi
call dword [sym.imp.USER32.dll_SetClassLongW]
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
cmp dword [ebx + 0x268], 1
jne 0x488f59
push str.About_to_restart_console
push 0x5f9
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
push 0x7f03
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push 0x170
push 0x5f3
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
lea eax, [ebp - 0x40]
push eax
push 0x5f4
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
push 0x91a
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x20], 1
jmp 0x489064
push 0x4dfce0
push 0x5f9
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp dword [ebx + 0x268], 2
je 0x488f86
mov ecx, dword [0x50b3a0]
cmp byte [ecx + 0x11406], 0
je 0x488f86
xor eax, eax
jmp 0x488f8b
mov eax, 1
push eax
push 0x91a
push esi
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov edx, dword [0x50b3a0]
movzx eax, byte [edx + 0x11406]
push eax
push 0x91a
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push 0x170
push 0x5f3
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 1
lea ecx, [ebp - 0x28]
push ecx
push esi
xor eax, eax
push 0x5f5
push esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
call edi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0x5f5
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
push 5
push 0
push 0
push edx
push eax
push 0
push 0x5f4
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [ebx + 0x268], 3
mov eax, str.Save
je 0x489035
mov eax, str.Start
push eax
push 0x5f4
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x5fa
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ecx, [ebp - 0x40]
push ecx
push 0x5f4
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [ebp - 0x40], 0
je 0x4890c6
push 2
lea edx, [ebp - 0x40]
push edx
push esi
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x30]
push eax
push 0x60b
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
sub eax, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x28]
add eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x40]
lea ecx, [ecx + edx - 5]
cdq
push 5
push 0
sub eax, edx
push 0
sar eax, 1
add eax, dword [ebp - 0x3c]
push eax
push ecx
push 0
push 0x60b
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebx + 0x268]
cmp eax, 1
je 0x48912c
cmp eax, 3
je 0x48912c
xor eax, eax
push 1
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
push esi
push 0x60b
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea ecx, [ebp - 0x80]
push ecx
push 0x91a
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x80]
sub eax, dword [ebp - 0x78]
mov edx, dword [ebp - 0x24]
add eax, dword [ebp - 0x28]
push 1
push 0
push 0
push edx
push eax
push 0
push 0x91a
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
lea ecx, [ebp - 0x60]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
lea edx, [ebp - 0x70]
push edx
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x58]
push 1
add eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x70]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x54]
sar ecx, 1
add eax, dword [ebp - 0x64]
mov dword [ebp - 0x50], ecx
add eax, dword [ebp - 0x6c]
sub ecx, dword [ebp - 0x60]
cdq
add ecx, dword [ebp - 0x58]
sub eax, edx
sar eax, 1
xor edx, edx
mov dword [ebp - 0x4c], eax
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x48], edx
add eax, dword [ebp - 0x54]
mov dword [ebp - 0x44], edx
push edx
lea edx, [ebp - 0x50]
mov dword [ebp - 0x48], ecx
mov ecx, dword [0x50b39c]
push edx
mov dword [ebp - 0x44], eax
call fcn.00414d70
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
push 0
sub ecx, eax
push ecx
mov ecx, dword [ebp - 0x50]
sub edx, ecx
push edx
push eax
push ecx
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
push 0
push 0x8001
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [ebx + 0x268], 1
jne 0x4891db
push 0x5f4
jmp 0x4891fb
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x4891f6
cmp word [eax], 0
je 0x4891f6
cmp word [ebx + 0x2c], 0
jne 0x4891f6
push 0x675
jmp 0x4891fb
push 0x5f7
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.004a4770
mov eax, dword [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
push 0x5fa
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, ebx
jne 0x4896b1
mov esi, dword [ebp + 0x10]
push 0xff
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0xf
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 1
push esi
mov edi, eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
sub edi, 0x479
je 0x48945a
sub edi, 1
je 0x4892a3
sub edi, 0x7b87
jne 0x4896b1
mov ecx, dword [0x50b39c]
push edi
call fcn.00406f10
jmp 0x4896b1
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x1c], edi
call fcn.004a4720
push 0
lea ecx, [ebp + 0xc]
push ecx
mov ecx, dword [0x50b39c]
mov dword [ebp - 4], 1
call fcn.004065f0
test eax, eax
jl 0x4892e5
lea ecx, [ebp + 0xc]
call fcn.004a4800
test eax, eax
je 0x4892e5
mov ecx, eax
call fcn.004a4a70
jmp 0x4892e7
xor eax, eax
mov ebx, dword [edi + 0x10]
test ebx, ebx
jne 0x489302
test eax, eax
je 0x4892fd
mov ecx, eax
call fcn.004786d0
mov ebx, eax
jmp 0x489302
mov ebx, 0x4c1318
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push ebx
push 0xffffffffffffffff
push 0x158
push 0x5f7
push esi
call edi
cmp word [ebx], 0
je 0x489332
test eax, eax
jge 0x489332
push ebx
push 0
push 0x14a
push 0x5f7
push esi
call edi
mov ecx, dword [0x50b3a0]
push 0
call fcn.00447c50
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x489388
test eax, eax
je 0x489388
push ebx
mov edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x489388
mov ebx, dword [ebp + 8]
push ebx
push 0xffffffffffffffff
push 0x158
push 0x5f7
push esi
call edi
test eax, eax
jge 0x489388
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x10]
push ebx
neg ecx
sbb ecx, ecx
push ecx
push 0x14a
push 0x5f7
push esi
call edi
cmp dword [ebp + 0x10], 0
je 0x4893ea
mov ecx, dword [0x50b3a0]
call fcn.004429e0
mov ebx, eax
test ebx, ebx
je 0x4893ea
cmp word [ebx], 0
je 0x4893ea
push ebx
push 0xffffffffffffffff
push 0x158
push 0x5f7
push esi
call edi
test eax, eax
jge 0x4893c9
push ebx
push 0xffffffffffffffff
push 0x14a
push 0x5f7
push esi
call edi
mov eax, ebx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4893d0
sub eax, edx
sar eax, 1
cmp word [ebx + eax*2 + 2], cx
lea ebx, [ebx + eax*2 + 2]
jne 0x4893a5
mov ecx, dword [0x50b3a0]
push 0
mov dword [ebp + 0x10], 0
call fcn.00443590
mov ebx, eax
test ebx, ebx
je 0x489446
mov edx, dword [ebx + 4]
inc dword [ebp + 0x10]
push edx
push 0xffffffffffffffff
push 0x158
push 0x5f7
push esi
call edi
test eax, eax
jge 0x489431
mov eax, dword [ebx + 4]
push eax
push 0xffffffffffffffff
push 0x14a
push 0x5f7
push esi
call edi
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [0x50b3a0]
call fcn.00443590
mov ebx, eax
test ebx, ebx
jne 0x489404
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004a4770
jmp 0x4896b1
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ebx, ebx
push ebx
push ebx
push pe_nt_image_headers32
push 0x678
push esi
call edi
test eax, eax
je 0x4894ad
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push 0x672
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 0
push 0x674
push esi
call edi
push eax
call ebx
push 0
push 0x675
push esi
call edi
push eax
call ebx
jmp 0x489699
push ebx
push ebx
push 0x146
push 0x674
push esi
call edi
test eax, eax
jne 0x489666
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0xffffffffffffffff
lea edx, [ebp + 8]
push edx
push 2
push 3
push ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp + 8], ebx
call sub.NETAPI32.dll_NetUserEnum
test eax, eax
jne 0x489651
xor ebx, ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x14], ebx
jbe 0x4895e6
mov eax, dword [ebp + 8]
mov edi, edi
test byte [ebx + eax + 0x18], 2
jne 0x4895cb
mov ecx, dword [ebx + eax]
test ecx, ecx
je 0x4895cb
cmp word [ecx], 0
je 0x4895cb
push ecx
push 0
push 0x143
push 0x674
push esi
call edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebx + eax + 0xc]
cmp ecx, 2
jne 0x489596
cmp dword [ebp + 0x14], 0
jne 0x48956a
cmp dword [ebx + eax + 0x60], 0x1f4
jne 0x48956a
mov eax, dword [ebx + eax]
push eax
call fcn.00441380
mov dword [ebp + 0x14], eax
jmp 0x4895c5
cmp dword [ebp - 0x10], 0
jne 0x4895cb
mov ecx, dword [ebx + eax]
mov edx, dword [ebp + 0xc]
push ecx
add edx, 0x10
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4895c8
mov eax, dword [ebp + 8]
mov ecx, dword [ebx + eax]
push ecx
call fcn.00441380
mov dword [ebp - 0x10], eax
jmp 0x4895c5
cmp dword [ebp - 0x18], 0
jne 0x4895cb
cmp ecx, 1
jne 0x4895cb
mov edx, dword [ebx + eax]
mov eax, dword [ebp + 0xc]
push edx
add eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4895c8
mov ecx, dword [ebp + 8]
mov edx, dword [ebx + ecx]
push edx
call fcn.00441380
mov dword [ebp - 0x18], eax
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
inc ecx
add ebx, 0x74
mov dword [ebp - 0x20], ecx
cmp ecx, dword [ebp - 0x14]
jb 0x489510
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp + 0x14]
jmp 0x4895e8
mov edi, ebx
push 0x674
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jne 0x489629
test edi, edi
je 0x489607
mov eax, edi
jmp 0x48961c
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x48961c
test ebx, ebx
je 0x489616
mov eax, ebx
jmp 0x48961c
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
push 0x674
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [ebp + 8]
push eax
call sub.NETAPI32.dll_NetApiBufferFree
test edi, edi
je 0x48963f
push edi
call fcn.00441300
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x489666
push eax
call fcn.00441300
add esp, 4
jmp 0x489666
mov ecx, dword [ebp + 0xc]
add ecx, 0x10
push ecx
push ebx
push 0x143
push 0x674
push esi
call edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x672
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 1
push 0x674
push esi
call edi
push eax
call ebx
push 1
push 0x675
push esi
call edi
push eax
call ebx
cmp dword [ebp + 0x10], 0x679
jne 0x4896b1
push 0x674
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10