Function at 0x420e50
Capabilities:
Get graphical window text
Hide graphical window
Set registry value

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov dword [ebp + 0x3c], eax
mov eax, dword [ebp + 0x30]
push 0x167
push eax
call esi
mov ecx, dword [ebp + 0x30]
push 0x168
push ecx
mov dword [ebp + 8], eax
call esi
mov edx, dword [ebp + 0x30]
push 0x171
push edx
mov dword [ebp + 0xc], eax
call esi
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x30]
push 0x169
push eax
call ebx
mov esi, eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test ah, 8
jne 0x420fed
lea ecx, [esp + 0x11c]
push 0x104
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 0x11c]
push 0
push edx
call fcn.00498c50
add esp, 8
test eax, eax
je 0x420f24
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x40]
push 0
push 0x205
push 0x211
push eax
push ecx
call fcn.0043cea0
add esp, 0x14
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push 0
push 0xb1
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret
mov eax, dword [ebp + 0x4c]
test eax, eax
jle 0x420f60
mov eax, dword [ebp + 0x54]
test eax, eax
je 0x420f40
mov edx, dword [ebp + 0x48]
mov eax, dword [edx]
push eax
call fcn.00498600
add esp, 4
mov ecx, dword [ebp + 0x4c]
xor eax, eax
dec ecx
test ecx, ecx
jle 0x420f5d
mov ecx, dword [ebp + 0x48]
inc eax
mov edx, dword [ecx + eax*4]
mov dword [ecx + eax*4 - 4], edx
mov ecx, dword [ebp + 0x4c]
dec ecx
cmp eax, ecx
jl 0x420f4a
dec dword [ebp + 0x4c]
lea edx, [esp + 0x11c]
push edx
call fcn.0043c610
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
je 0x420fed
mov ecx, dword [ebp + 0x50]
mov esi, dword [ebp + 0x4c]
lea edx, [ecx + 1]
cmp esi, edx
jne 0x420fdd
mov eax, dword [ebp + 0x58]
add eax, ecx
lea ecx, [eax*4 + 4]
push ecx
call fcn.004985f0
mov edx, dword [ebp + 0x50]
mov esi, dword [ebp + 0x48]
mov dword [esp + 0x20], eax
mov edi, eax
lea ecx, [edx*4 + 4]
add esp, 4
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x48]
push ecx
call fcn.00498600
mov eax, dword [ebp + 0x58]
mov ecx, dword [ebp + 0x50]
mov edx, dword [esp + 0x20]
add esp, 4
add ecx, eax
mov eax, dword [esp + 0x14]
mov dword [ebp + 0x48], edx
mov dword [ebp + 0x50], ecx
mov ecx, dword [ebp + 0x4c]
mov edx, dword [ebp + 0x48]
mov dword [edx + ecx*4], eax
mov eax, dword [ebp + 0x4c]
inc eax
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp + 0x30]
push 0x170
push eax
call ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov edi, eax
push 0
push 0x147
push edi
mov dword [esp + 0x30], edi
call esi
test eax, eax
jle 0x421024
lea ecx, [esp + 0x7c]
push ecx
push eax
push 0x148
push edi
call esi
jmp 0x421032
lea edx, [esp + 0x7c]
push 0x50
push edx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov al, byte [esp + 0x7c]
test al, al
je 0x421188
lea eax, [esp + 0x7c]
push eax
push 0xffffffffffffffff
push 0x158
push edi
call esi
test eax, eax
jl 0x42105c
push 0
push eax
push 0x144
push edi
call esi
lea ecx, [esp + 0x7c]
push ecx
push 0
push 0x14a
push edi
call esi
push 0
push 0
push 0x146
push edi
call esi
cmp eax, 0x14
jle 0x421088
push 0
push 0x14
push 0x144
push edi
call esi
push 0
push 0
push 0x14e
push edi
call esi
push 0
push 0
push 0x146
push edi
mov dword [esp + 0x20], 1
call esi
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
jle 0x4210d6
mov edx, dword [esp + 0x20]
push 0
push edi
push 0x149
push edx
call esi
mov ecx, dword [esp + 0x10]
inc edi
lea edx, [ecx + eax + 1]
mov eax, dword [esp + 0x14]
cmp edi, eax
mov dword [esp + 0x10], edx
jl 0x4210b2
mov eax, dword [esp + 0x10]
push eax
call fcn.004985f0
mov dword [esp + 0x28], eax
mov edi, eax
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
mov dword [esp + 0x18], 0
jle 0x421127
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push edi
push ecx
push 0x148
push edx
call esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x14]
lea edi, [edi + eax + 1]
mov eax, dword [esp + 0x18]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x4210f9
lea eax, [esp + 0x28]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push 0x20006
mov byte [edi], 0
mov edx, dword [str.SoftwareACD_SystemsACDSee32]
push 0
push 0x4caf4c
push 0
push edx
push DrawStatusTextA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
push eax
push edi
push 3
push 0
push str.HistFileFilters
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.00498600
add esp, 4
mov eax, dword [ebp + 0x70]
test eax, eax
je 0x4211bb
mov eax, dword [ebp + 0x68]
xor edi, edi
test eax, eax
jle 0x4211bb
cmp edi, eax
jge 0x4211a8
test edi, edi
jl 0x4211a8
mov eax, dword [ebp + 0x64]
mov eax, dword [eax + edi*4]
jmp 0x4211aa
xor eax, eax
push eax
call fcn.00498600
mov eax, dword [ebp + 0x68]
add esp, 4
inc edi
cmp edi, eax
jl 0x42119c
mov ecx, dword [ebp + 0x64]
push ecx
call fcn.00498600
add esp, 4
push 0x80
call fcn.004985f0
lea ecx, [ebp + 0x60]
add esp, 4
mov dword [ecx + 4], eax
mov al, byte [esp + 0x7c]
test al, al
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0x1f
mov dword [ecx + 0x14], 0x40
je 0x421205
lea edx, [esp + 0x7c]
push ecx
push edx
call fcn.00421620
add esp, 8
mov eax, dword [ebp + 0x30]
push 0x16f
push eax
call ebx
push 0
mov edi, eax
push 0
push 0x147
push edi
mov dword [esp + 0x30], edi
call esi
test eax, eax
jle 0x421236
lea ecx, [esp + 0x2c]
push ecx
push eax
push 0x148
push edi
call esi
jmp 0x421244
lea edx, [esp + 0x2c]
push 0x50
push edx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov al, byte [esp + 0x2c]
test al, al
je 0x4213a8
lea eax, [esp + 0x2c]
push eax
push 0xffffffffffffffff
push 0x158
push edi
call esi
test eax, eax
jl 0x42126e
push 0
push eax
push 0x144
push edi
call esi
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0x14a
push edi
call esi
push 0
push 0
push 0x146
push edi
call esi
cmp eax, 0x14
jle 0x42129a
push 0
push 0x14
push 0x144
push edi
call esi
push 0
push 0
push 0x14e
push edi
call esi
push 0
push 0
push 0x146
push edi
mov dword [esp + 0x28], 1
call esi
test eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
jle 0x4212f6
mov edx, dword [esp + 0x10]
push 0
push edx
push 0x149
push edi
call esi
mov ecx, dword [esp + 0x18]
lea edx, [ecx + eax + 1]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
jl 0x4212ca
mov eax, dword [esp + 0x18]
push eax
call fcn.004985f0
mov dword [esp + 0x28], eax
mov edi, eax
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
mov dword [esp + 0x10], 0
jle 0x421347
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
push edi
push ecx
push 0x148
push edx
call esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x14]
lea edi, [edi + eax + 1]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x421319
lea eax, [esp + 0x28]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push 0x20006
mov byte [edi], 0
mov edx, dword [str.SoftwareACD_SystemsACDSee32]
push 0
push 0x4caf4c
push 0
push edx
push DrawStatusTextA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
push eax
push esi
push 3
push 0
push str.HistKeywords
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.00498600
add esp, 4
mov eax, dword [ebp + 0x8c]
lea edi, [ebp + 0x7c]
test eax, eax
je 0x4213e1
mov eax, dword [edi + 8]
xor esi, esi
test eax, eax
jle 0x4213e1
cmp esi, eax
jge 0x4213ce
test esi, esi
jl 0x4213ce
mov eax, dword [edi + 4]
mov eax, dword [eax + esi*4]
jmp 0x4213d0
xor eax, eax
push eax
call fcn.00498600
mov eax, dword [edi + 8]
add esp, 4
inc esi
cmp esi, eax
jl 0x4213c2
mov ecx, dword [edi + 4]
push ecx
call fcn.00498600
add esp, 4
push 0x80
call fcn.004985f0
mov dword [edi + 4], eax
mov al, byte [esp + 0x30]
add esp, 4
mov dword [edi + 8], 0
test al, al
mov dword [edi + 0xc], 0x1f
mov dword [edi + 0x14], 0x40
je 0x421428
lea edx, [esp + 0x2c]
push edi
push edx
call fcn.00421620
add esp, 8
mov eax, dword [ebp + 0x30]
push 0
push 0x170
push eax
call ebx
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
mov ecx, dword [ebp + 0x30]
push 0
push 0x16f
push ecx
call ebx
push eax
call esi
mov edx, dword [ebp + 0x30]
push 0
push 0x169
push edx
call ebx
push eax
call esi
mov eax, dword [ebp + 0x30]
push 0
push 0x167
push eax
call ebx
push eax
call esi
mov ecx, dword [ebp + 0x30]
push 0
push 0x168
push ecx
call ebx
push eax
call esi
mov edx, dword [ebp + 0x30]
push 0
push 0x16e
push edx
call ebx
push eax
call esi
mov eax, dword [ebp + 0x30]
push 0
push 0x172
push eax
call ebx
push eax
call esi
mov edx, dword [ebp + 0x40]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0xcc]
push 0x50
push ecx
push 0x7a
push edx
call edi
mov eax, dword [ebp + 0x30]
push 0x16a
push eax
call ebx
mov ecx, dword [ebp + 0x30]
push 0x16d
push ecx
mov dword [ebp + 0x34], eax
call ebx
mov edx, dword [ebp + 0x34]
push 5
push edx
mov dword [ebp + 0x38], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x38]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp + 0x38]
lea ecx, [esp + 0xcc]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp + 0x40]
lea eax, [esp + 0xcc]
push 0x50
push eax
push 0x96
push ecx
call edi
mov eax, dword [ebp + 0x30]
lea edx, [esp + 0xcc]
push edx
push 0x16c
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, ebp
call fcn.00421760
mov ecx, dword [ebp + 0x30]
push 1
push 0x167
push ecx
mov edi, eax
call ebx
push eax
call esi
mov edx, dword [ebp + 0x30]
push 1
push 0x168
push edx
call ebx
push eax
call esi
mov edx, dword [ebp + 0x4c]
mov ecx, dword [ebp + 0x30]
xor eax, eax
cmp edx, 1
sete al
push eax
push 0x169
push ecx
call ebx
push eax
call esi
mov edx, dword [ebp + 0x30]
push 1
push 0x170
push edx
call ebx
push eax
call esi
mov eax, dword [ebp + 0x30]
push 1
push 0x16f
push eax
call ebx
push eax
call esi
mov ecx, dword [ebp + 0x30]
push 1
push 0x16e
push ecx
call ebx
push eax
call esi
mov eax, dword [ebp + 0x30]
xor edx, edx
test edi, edi
setg dl
push edx
push 0x172
push eax
call ebx
push eax
call esi
mov ecx, dword [ebp + 0x34]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x40]
lea edx, [esp + 0xcc]
push 0x50
push edx
push 0x97
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
mov edx, dword [ebp + 0x30]
lea ecx, [esp + 0xcc]
push ecx
push 0x16c
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
test edi, edi
jle 0x4215ff
mov eax, dword [ebp + 0x30]
push 0x172
push eax
call ebx
mov dword [ebp + 0x3c], eax
mov ecx, dword [ebp + 0x3c]
mov edx, dword [ebp + 0x30]
push 1
push ecx
push 0x28
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret