Function at 0x4014b0
Capabilities:
Check if file exists
Copy file
Create process on windows
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value

Disassembly:
mov eax, 0x12c8
call fcn.0040a520
mov eax, dword [esp + 0x12cc]
mov ecx, dword [0x437518]
push ebx
push ebp
movdqu xmm1, xmmword [eax]
xor ebx, ebx
mov dword [esp + 8], ecx
movq xmm0, qword [eax + 0x10]
mov eax, dword [eax + 0x18]
movq qword [esp + 0x24], xmm0
movdqa xmm0, xmm1
push esi
psrldq xmm0, 4
push edi
movd edi, xmm0
movdqa xmm0, xmm1
mov dword [esp + 0x4c], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
psrldq xmm0, 8
mov ebp, edi
movd edx, xmm0
mov dword [0x40e104], eax
movd eax, xmm1
mov esi, edx
shl ebp, 0xc
shl esi, 0xc
add ebp, section..ndata
mov dword [esp + 0x3c], eax
add esi, section..ndata
add eax, 0xfffffffe
mov dword [esp + 0x14], ebx
mov dword [esp + 0x38], esi
movdqu xmmword [esp + 0x1c], xmm1
mov dword [esp + 0x24], edx
cmp eax, 0xc6
ja case.0x40154f.65
movzx eax, byte [eax + 0x403bdc]
jmp dword [eax*4 + 0x403ad8]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c8
ret 4
push 0
push edi
call fcn.00407ab0
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x12c8
ret 4
inc dword [0x43750c]
test ecx, ecx
je 0x401591
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x12c8
ret 4
push edi
call fcn.00403e80
dec eax
push 0
push eax
call fcn.004013c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c8
ret 4
push 0
push edi
call fcn.00407ab0
xor ebx, ebx
add dword [0x439608], ebx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c8
ret 4
push 0
call fcn.00403ce0
add esp, 4
mov dword [esp + 0x50], edx
mov ecx, 1
cmp eax, ecx
cmovg ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x40154f.65
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x40154f.65
cmp dword [esp + 0x28], ebx
jne 0x401639
mov eax, dword [edi*4 + 0x439600]
push 1
mov dword [edi*4 + 0x4395c0], eax
call fcn.00403ce0
mov ecx, eax
mov dword [esp + 0x54], edx
mov eax, dword [esp + 0x24]
add esp, 4
mov dword [eax*4 + 0x439600], ecx
jmp case.0x40154f.65
mov eax, dword [edi*4 + 0x4395c0]
mov dword [edi*4 + 0x439600], eax
jmp case.0x40154f.65
mov esi, dword [esp + 0x28]
xor eax, eax
pop edi
mov edx, dword [esi*4 + 0x439600]
test edx, edx
sete al
mov ecx, dword [esp + eax*4 + 0x1c]
mov eax, dword [esp + 0x28]
and eax, edx
mov dword [esi*4 + 0x439600], eax
mov eax, ecx
pop esi
pop ebp
pop ebx
add esp, 0x12c8
ret 4
push dword [edx*4 + 0x439600]
push ebp
call fcn.004084e0
jmp case.0x40154f.65
mov eax, dword [0x437504]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x4016a7
push edx
push eax
call esi
mov edi, dword [esp + 0x20]
mov eax, dword [0x437508]
test eax, eax
je case.0x40154f.65
push edi
push eax
call esi
jmp case.0x40154f.65
mov eax, 0xfffffff0
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407c50
mov esi, eax
push esi
call fcn.00408db0
push dword [esp + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne case.0x40154f.65
mov ebx, 1
jmp 0x4015c9
mov eax, 0xfffffff0
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407c50
mov edi, eax
push edi
call fcn.00408db0
push edi
call fcn.00408c50
mov esi, eax
test esi, esi
je 0x4017a2
push 0x5c
push esi
call fcn.004084a0
mov esi, eax
xor eax, eax
movzx ebp, word [esi]
mov word [esi], ax
test bp, bp
jne 0x401772
cmp dword [esp + 0x28], eax
je 0x401772
call fcn.00408300
test eax, eax
je 0x401772
push edi
call fcn.00407bc0
jmp 0x401778
push edi
call fcn.00407ba0
test eax, eax
je 0x40178f
cmp eax, 0xb7
jne 0x40178e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x40178f
inc ebx
mov word [esi], bp
add esi, 2
test bp, bp
jne 0x401744
mov dword [esp + 0x14], ebx
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x24], 0
push 0x40f108
je 0x4017d5
push 0xffffffffffffffe6
call fcn.00407ab0
push edi
push 0x451000
call fcn.00408b90
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x4017dc
inc ebx
mov dword [esp + 0x14], ebx
jmp 0x4015c9
push 0xfffffffffffffff5
call fcn.00407ab0
mov ebx, dword [esp + 0x14]
jmp 0x4015c9
xor eax, eax
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407c50
push eax
call fcn.00408470
mov ecx, dword [esp + 0x28]
test eax, eax
pop edi
cmovne ecx, dword [esp + 0x20]
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x12c8
ret 4
mov eax, 0xffffffd0
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407c50
mov edi, eax
push edi
call fcn.00408db0
mov eax, 0xffffffdf
cdq
mov esi, eax
mov eax, dword [0x40e104]
xor esi, edx
sub esi, edx
mov ecx, esi
sar esi, 4
and ecx, 0xf
shl esi, 0xc
add esi, 0x40e108
push dword [eax + ecx*4]
push esi
call fcn.00407c50
mov ebx, eax
push ebx
call fcn.00408db0
mov eax, 0x13
cdq
mov esi, eax
mov eax, dword [0x40e104]
xor esi, edx
sub esi, edx
mov ecx, esi
sar esi, 4
and ecx, 0xf
shl esi, 0xc
add esi, 0x40e108
push dword [eax + ecx*4]
push esi
call fcn.00407c50
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4018ce
push 0x40f108
push 0xffffffffffffffe3
jmp 0x4015c2
cmp dword [esp + 0x28], 0
je 0x4016ff
push edi
call fcn.00408470
test eax, eax
je 0x4016ff
push ebx
push edi
call fcn.00407ff0
push 0x40f108
push 0xffffffffffffffe4
jmp 0x4015c2
xor eax, eax
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407c50
mov edi, eax
lea eax, [esp + 0x18]
push eax
push esi
push 0x800
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x401942
xor eax, eax
mov ebx, 1
mov word [esi], ax
jmp 0x401968
mov eax, dword [esp + 0x18]
cmp eax, edi
jbe 0x401966
cmp word [eax], bx
je 0x401966
push edi
call fcn.00408470
test eax, eax
je 0x401936
add eax, 0x2c
push eax
push dword [esp + 0x1c]
call fcn.00408b90
xor ebx, ebx
cmp dword [esp + 0x28], 0
jne 0x4015c9
push 0x800
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
jmp 0x4015c9
or eax, 0xffffffff
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407c50
mov esi, eax
push esi
call fcn.00408db0
lea eax, [esp + 0x4c]
push eax
push ebp
push 0x800
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne case.0x40154f.65
xor eax, eax
mov ebx, 1
mov word [ebp], ax
jmp 0x4015c9
mov eax, 0xffffffef
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407c50
mov esi, eax
push esi
call fcn.00408db0
push esi
push ebp
call fcn.00408a80
test eax, eax
jne case.0x40154f.65
lea ebx, [eax + 1]
jmp 0x4015c9
mov eax, 0x31
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407c50
mov esi, dword [esp + 0x20]
mov ebx, eax
push ebx
mov dword [esp + 0x1c], ebx
and esi, 7
call fcn.00408ec0
push ebx
test eax, eax
je 0x401a71
push 0x40e108
call fcn.00408b90
jmp 0x401a8c
push 0x451000
push 0x40e108
call fcn.00408b90
push eax
call fcn.004083d0
push eax
call sub.KERNEL32.dll_lstrcatW
push 0x40e108
call fcn.00408db0
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea esp, [esp]
cmp esi, 3
jl 0x401ad6
push 0x40e108
call fcn.00408470
xor ecx, ecx
test eax, eax
je 0x401ac6
lea ecx, [esp + 0x2c]
add eax, 0x14
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov ecx, eax
add esi, 0xfffffffd
or esi, 0x80000000
and esi, ecx
neg esi
sbb esi, esi
inc esi
test esi, esi
jne 0x401ae4
push 0x40e108
call fcn.00408c20
xor eax, eax
cmp esi, 1
setne al
inc eax
push eax
push 0x40000000
push 0x40e108
mov dword [esp + 0x48], eax
call fcn.00408920
mov edi, eax
cmp edi, 0xffffffff
jne 0x401cbf
push 0x40e108
call sub.KERNEL32.dll_lstrlenW
push 0xffe
mov ebx, eax
lea eax, [esp + 0x2de]
push 0
push eax
call fcn.0040a550
add esp, 0xc
mov eax, 0x7fe
cmp ebx, 0x7fe
cmova ebx, eax
xor eax, eax
xor edi, edi
mov word [esp + 0x2d8], ax
test ebx, ebx
je 0x401b96
lea ecx, [ecx]
cmp word [edi*2 + 0x40e108], 0x5c
jne 0x401b77
lea eax, [esp + 0x2d8]
push eax
call ebp
cmp eax, 0xffffffff
jne 0x401b77
lea eax, [esp + 0x2d8]
push eax
call fcn.00407ba0
mov ax, word [edi*2 + 0x40e108]
mov word [esp + edi*2 + 0x2d8], ax
xor eax, eax
mov word [esp + edi*2 + 0x2da], ax
inc edi
cmp edi, ebx
jb 0x401b50
push dword [esp + 0x3c]
push 0x40000000
push 0x40e108
call fcn.00408920
mov edi, eax
cmp edi, 0xffffffff
jne 0x401cbf
test esi, esi
jne 0x401ca3
push section..ndata
push str.C:UsersADMINI1AppDataLocalTemp_nslEC03.tmp
call fcn.00408b90
push 0x40e108
push section..ndata
call fcn.00408b90
push esi
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], esi
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401c26
push 0x40c300
push section..ndata
call sub.KERNEL32.dll_lstrcatW
push dword [esp + 0x10]
push section..ndata
call sub.KERNEL32.dll_lstrcatW
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [esp + 0x34]
mov dword [esp + 0x14], 0
push 0x40f108
call fcn.00407c50
push str.C:UsersADMINI1AppDataLocalTemp_nslEC03.tmp
push section..ndata
call fcn.00408b90
mov eax, dword [esp + 0x20]
sar eax, 3
push eax
push 0x40f108
call fcn.00408b00
sub eax, 4
je 0x401aa0
dec eax
je 0x401c8e
push 0x40e108
push 0xfffffffffffffffa
call fcn.00407ab0
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x12c8
ret 4
inc dword [0x439608]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c8
ret 4
push dword [esp + 0x18]
push 0xffffffffffffffe2
call fcn.00407ab0
cmp esi, 2
jne case.0x40154f.65
lea ebx, [esi - 1]
jmp 0x4015c9
mov ebx, dword [esp + 0x18]
push ebx
push 0xffffffffffffffea
call fcn.00407ab0
inc dword [0x439634]
push 0
push 0
push edi
push dword [esp + 0x34]
call fcn.004042c0
dec dword [0x439634]
mov esi, eax
cmp dword [esp + 0x2c], 0xffffffff
jne 0x401cf5
cmp dword [esp + 0x30], 0xffffffff
je 0x401d04
lea eax, [esp + 0x2c]
push eax
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jns 0x401dd2
cmp esi, 0xfffffffe
jne 0x401d8b
push 0xffffffffffffffe9
push 0x40e108
call fcn.00407c50
push ebx
push 0x40e108
call sub.KERNEL32.dll_lstrcatW
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401d82
push 0x40c300
push 0x40e108
call sub.KERNEL32.dll_lstrcatW
push dword [esp + 0x10]
push 0x40e108
call sub.KERNEL32.dll_lstrcatW
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x401d97
push 0xffffffffffffffee
push 0x40e108
call fcn.00407c50
push 0x40c308
push 0x40e108
call sub.KERNEL32.dll_lstrcatW
push ebx
push 0x40e108
call sub.KERNEL32.dll_lstrcatW
push 0x200010
push 0x40e108
call fcn.00408b00
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x12c8
ret 4
cmp dword [0x413174], 0
je case.0x40154f.65
mov edx, dword [0x439574]
xor eax, eax
test edx, edx
jle case.0x40154f.65
mov ebx, dword [0x439570]
xor ecx, ecx
mov ebp, dword [esp + 0x28]
jmp 0x401e00
cmp dword [ebx + ecx], 0xc9
jne 0x401e17
mov esi, dword [ebx + ecx + 0x14]
mov edi, dword [ebx + ecx + 0x18]
cmp dword [ebx + ecx + 0x10], ebp
je 0x401e24
inc eax
add ecx, 0x1c
cmp eax, edx
jl 0x401e00
jmp case.0x40154f.65
test esi, esi
je case.0x40154f.65
cmp edi, 0xc9
jne case.0x40154f.65
push 0x40e108
call fcn.00409050
add esp, 4
cmp esi, eax
je case.0x40154f.65
xor eax, eax
push 0xffe
push eax
mov word [esp + 0x2e0], ax
lea eax, [esp + 0x2e2]
push eax
call fcn.0040a550
add esp, 0xc
lea eax, [esp + 0x2d8]
push 0x40c30c
push eax
call fcn.00408b90
push 0x40e108
lea eax, [esp + 0x2dc]
push eax
call sub.KERNEL32.dll_lstrcatW
push 0x40c32c
lea eax, [esp + 0x2dc]
push eax
call sub.KERNEL32.dll_lstrcatW
push 0x21
lea eax, [esp + 0x2dc]
push eax
call fcn.00408b00
cmp eax, 2
jne case.0x40154f.65
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x12c8
ret 4
xor eax, eax
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407c50
push dword [esp + 0x24]
push eax
call fcn.004086b0
jmp case.0x40154f.65
mov eax, 0x31
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407c50
push dword [esp + 0x20]
push eax
call fcn.00408b00
test eax, eax
je 0x4016ff
cmp eax, dword [esp + 0x28]
jne 0x401f50
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c8
ret 4
cmp eax, dword [esp + 0x30]
jne case.0x40154f.65
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c8
ret 4
mov eax, 0xfffffff0
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407c50
mov esi, eax
push esi
call fcn.00408db0
push dword [esp + 0x24]
push esi
call fcn.004086b0
jmp case.0x40154f.65
mov eax, 1
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407c50
push eax
call sub.KERNEL32.dll_lstrlenW
push eax
push ebp
call fcn.004084e0
jmp case.0x40154f.65
push 2
call fcn.00403ce0
push 3
mov ebx, eax
mov edi, edx
call fcn.00403ce0
mov dword [esp + 0x44], eax
add esp, 8
mov dword [esp + 0x50], edx
mov eax, 1
cdq
mov esi, eax
mov eax, dword [0x40e104]
xor esi, edx
sub esi, edx
mov ecx, esi
sar esi, 4
and ecx, 0xf
shl esi, 0xc
add esi, 0x40e108
push dword [eax + ecx*4]
push esi
call fcn.00407c50
mov esi, eax
push esi
call sub.KERNEL32.dll_lstrlenW
mov ecx, eax
xor eax, eax
test edi, edi
mov word [ebp], ax
cmove ebx, ecx
test ebx, ebx
je case.0x40154f.65
mov eax, dword [esp + 0x3c]
test eax, eax
jns 0x402057
add eax, ecx
js case.0x40154f.65
cmp eax, ecx
cmovg eax, ecx
lea eax, [esi + eax*2]
push eax
push ebp
call fcn.00408b90
test ebx, ebx
jns 0x402082
push ebp
call sub.KERNEL32.dll_lstrlenW
add ebx, eax
jns 0x402082
xor ebx, ebx
xor eax, eax
mov word [ebp + ebx*2], ax
jmp case.0x40154f.65
cmp ebx, 0x800
jge case.0x40154f.65
xor eax, eax
mov word [ebp + ebx*2], ax
jmp case.0x40154f.65
mov eax, 0x20
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407c50
mov edi, eax
mov eax, 0x31
cdq
mov esi, eax
mov eax, dword [0x40e104]
xor esi, edx
sub esi, edx
mov ecx, esi
sar esi, 4
and ecx, 0xf
shl esi, 0xc
add esi, 0x40e108
push dword [eax + ecx*4]
push esi
call fcn.00407c50
push eax
push edi
cmp dword [esp + 0x38], ebx
jne 0x402115
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x401f3f
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c8
ret 4
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x401f3f
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c8
ret 4
mov eax, 1
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407c50
push 0x800
mov esi, eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x402180
cmp dword [esp + 0x28], ebx
je 0x402197
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x402197
xor eax, eax
mov ebx, 1
mov word [ebp], ax
mov word [ebp + 0xffe], ax
jmp 0x4015c9
xor ebx, ebx
xor eax, eax
mov word [ebp + 0xffe], ax
jmp 0x4015c9
push 0
call fcn.00403ce0
push 1
mov esi, eax
mov dword [esp + 0x58], edx
call fcn.00403ce0
add esp, 8
mov dword [esp + 0x50], edx
cmp dword [esp + 0x34], ebx
jne 0x4021e7
cmp esi, eax
jl 0x401f3f
jle 0x402104
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c8
ret 4
cmp esi, eax
jb 0x401f3f
jbe 0x402104
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c8
ret 4
push 1
call fcn.00403ce0
push 2
mov esi, eax
mov dword [esp + 0x58], edx
call fcn.00403ce0
mov ecx, eax
mov dword [esp + 0x58], edx
mov eax, dword [esp + 0x34]
add esp, 8
cmp eax, 0xc
ja case.default.0x402230
jmp dword [eax*4 + 0x403ca4]
add esi, ecx
xor ebx, ebx
push esi
push ebp
call fcn.004084e0
jmp 0x4015c9
sub esi, ecx
xor ebx, ebx
push esi
push ebp
call fcn.004084e0
jmp 0x4015c9
imul esi, ecx
xor ebx, ebx
push esi
push ebp
call fcn.004084e0
jmp 0x4015c9
test ecx, ecx
je 0x402281
mov eax, esi
xor ebx, ebx
cdq
idiv ecx
mov esi, eax
push esi
push ebp
call fcn.004084e0
jmp 0x4015c9
xor esi, esi
push esi
push ebp
lea ebx, [esi + 1]
call fcn.004084e0
jmp 0x4015c9
or esi, ecx
xor ebx, ebx
push esi
push ebp
call fcn.004084e0
jmp 0x4015c9
and esi, ecx
xor ebx, ebx
push esi
push ebp
call fcn.004084e0
jmp 0x4015c9
xor esi, ecx
xor ebx, ebx
push esi
push ebp
call fcn.004084e0
jmp 0x4015c9
xor eax, eax
test esi, esi
sete al
xor ebx, ebx
mov esi, eax
push esi
push ebp
call fcn.004084e0
jmp 0x4015c9
test esi, esi
jne 0x4022f9
test ecx, ecx
jne 0x4022f9
xor esi, esi
xor ebx, ebx
push esi
push ebp
call fcn.004084e0
jmp 0x4015c9
test esi, esi
je 0x4022e1
test ecx, ecx
je 0x4022e1
mov esi, 1
xor ebx, ebx
push esi
push ebp
call fcn.004084e0
jmp 0x4015c9
test ecx, ecx
je 0x402281
mov eax, esi
xor ebx, ebx
cdq
idiv ecx
mov esi, edx
push esi
push ebp
call fcn.004084e0
jmp 0x4015c9
shl esi, cl
xor ebx, ebx
push esi
push ebp
call fcn.004084e0
jmp 0x4015c9
sar esi, cl
push esi
push ebp
xor ebx, ebx
call fcn.004084e0
jmp 0x4015c9
mov eax, 1
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl ecx, 0xc
add ecx, 0x40e108
push dword [esp + eax*4 + 0x20]
push ecx
call fcn.00407c50
push 2
mov esi, eax
call fcn.00403ce0
push eax
push esi
push ebp
mov dword [esp + 0x60], edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp case.0x40154f.65
mov eax, dword [esp + 0x28]
mov esi, dword [0x40e100]
test eax, eax
je 0x40240a
lea esp, [esp]
dec eax
test esi, esi
je 0x4023e4
mov esi, dword [esi]
test eax, eax
jne 0x4023a0
test esi, esi
je 0x4023e4
add esi, 4
push esi
push 0x40e108
call fcn.00408b90
mov eax, dword [0x40e100]
add eax, 4
push eax
push esi
call fcn.00408b90
mov eax, dword [0x40e100]
push 0x40e108
add eax, 4
push eax
call fcn.00408b90
jmp case.0x40154f.65
push 0x200010
push 0xffffffffffffffe8
push 0
call fcn.00407c50
push eax
call fcn.00408b00
pop edi
pop esi
pop ebp
mov eax, 0x7fffffff
pop ebx
add esp, 0x12c8
ret 4
test edx, edx
je 0x402433
test esi, esi
je 0x4016ff
lea eax, [esi + 4]
push eax
push ebp
call fcn.00408b90
mov eax, dword [esi]
push esi
mov dword [0x40e100], eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x40154f.65
push 0x1004
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push dword [esp + 0x20]
mov esi, eax
lea eax, [esi + 4]
push eax
call fcn.00407c50
mov eax, dword [0x40e100]
mov dword [esi], eax
mov dword [0x40e100], esi
jmp case.0x40154f.65
push 3
call fcn.00403ce0
push 4
mov ebx, eax
mov dword [esp + 0x58], edx
call fcn.00403ce0
mov edi, eax
mov dword [esp + 0x58], edx
mov al, byte [esp + 0x3c]
add esp, 8
test al, 1
je 0x4024b7
mov eax, 0x33
cdq
mov esi, eax
mov eax, dword [0x40e104]
xor esi, edx
sub esi, edx
mov ecx, esi
sar esi, 4
and ecx, 0xf
shl esi, 0xc
add esi, 0x40e108
push dword [eax + ecx*4]
push esi
call fcn.00407c50
mov ebx, eax
mov al, byte [esp + 0x34]
test al, 2
je 0x4024e8
mov eax, 0x44
cdq
mov esi, eax
mov eax, dword [0x40e104]
xor esi, edx
sub esi, edx
mov ecx, esi
sar esi, 4
and ecx, 0xf
shl esi, 0xc
add esi, 0x40e108
push dword [eax + ecx*4]
push esi
call fcn.00407c50
mov edi, eax
cmp dword [esp + 0x1c], 0x21
jne 0x402542
push 1
call fcn.00403ce0
push 2
mov esi, eax
mov dword [esp + 0x58], edx
call fcn.00403ce0
mov ecx, dword [esp + 0x3c]
add esp, 8
sar ecx, 2
mov dword [esp + 0x50], edx
test ecx, ecx
je 0x402536
lea edx, [esp + 0x38]
push edx
push ecx
push 0
push edi
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
neg eax
sbb ebx, ebx
mov eax, dword [esp + 0x38]
inc ebx
mov dword [esp + 0x14], ebx
jmp 0x4025b4
push edi
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4025b0
mov ecx, dword [0x40e104]
mov eax, 1
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
mov ecx, dword [0x40e104]
mov esi, eax
mov eax, 0x12
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
xor ecx, ecx
cmp word [eax], cx
cmovne ecx, eax
xor eax, eax
cmp word [esi], ax
push ecx
cmovne eax, esi
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [esp + 0x38], eax
cmp dword [esp + 0x20], 0
jl 0x4017dc
push eax
push ebp
call fcn.004084e0
mov ebx, dword [esp + 0x14]
jmp 0x4015c9
push 0
call fcn.00403ce0
add esp, 4
mov dword [esp + 0x50], edx
push eax
call dword [sym.imp.USER32.dll_IsWindow]
mov ecx, dword [esp + 0x28]
test eax, eax
pop edi
cmovne ecx, dword [esp + 0x20]
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x12c8
ret 4
push 2
call fcn.00403ce0
push 1
mov esi, eax
mov dword [esp + 0x58], edx
call fcn.00403ce0
add esp, 8
mov dword [esp + 0x50], edx
push esi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push ebp
call fcn.004084e0
jmp case.0x40154f.65
mov esi, dword [0x439588]
push 0
add esi, edx
call fcn.00403ce0
add esp, 4
mov dword [esp + 0x50], edx
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp case.0x40154f.65
push edx
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
lea eax, [esp + 0x4c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [0x40e104]
xor eax, eax
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
mov ecx, dword [esp + 0x58]
imul ecx, dword [esp + 0x28]
push 0x10
push ecx
mov ecx, dword [esp + 0x5c]
imul ecx, dword [esp + 0x30]
push ecx
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 0
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je case.0x40154f.65
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.0x40154f.65
push ecx
call dword [sym.imp.USER32.dll_GetDC]
push 2
mov edi, eax
call fcn.00403ce0
add esp, 4
mov dword [esp + 0x50], edx
mov esi, eax
push 0x48
push 0x5a
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [0x413108], eax
mov eax, dword [esp + 0x10]
push edi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 3
call fcn.00403ce0
mov cl, byte [esp + 0x34]
add esp, 4
mov dword [0x413118], eax
mov al, cl
and al, 1
mov dword [esp + 0x50], edx
mov byte [0x41311c], al
mov al, cl
push dword [esp + 0x24]
and al, 2
mov byte [0x41311f], 1
and cl, 4
mov byte [0x41311d], al
push 0x413124
mov byte [0x41311e], cl
call fcn.00407c50
push 0x413108
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
push ebp
call fcn.004084e0
jmp case.0x40154f.65
push 0
call fcn.00403ce0
push 1
mov esi, eax
mov dword [esp + 0x58], edx
call fcn.00403ce0
add esp, 8
mov dword [esp + 0x50], edx
push eax
push esi
cmp dword [esp + 0x34], ebx
jne 0x40279d
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x40154f.65
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.0x40154f.65
xor eax, eax
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
mov ecx, dword [0x40e104]
mov ebx, eax
mov eax, 0x31
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
mov ecx, dword [0x40e104]
mov edi, eax
mov eax, 0x22
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
mov ecx, dword [0x40e104]
mov esi, eax
mov eax, 0x15
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
push 0x40f108
push 0xffffffffffffffec
call fcn.00407ab0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x68], eax
xor eax, eax
mov dword [esp + 0x4c], 0x3c
cmp word [ebx], ax
mov dword [esp + 0x5c], edi
cmovne eax, ebx
mov dword [esp + 0x58], eax
xor eax, eax
cmp word [esi], ax
mov dword [esp + 0x64], 0x451000
cmovne eax, esi
mov dword [esp + 0x70], 0
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4016ff
test byte [esp + 0x50], 0x40
je case.0x40154f.65
push dword [esp + 0x84]
call fcn.00408340
push dword [esp + 0x84]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40154f.65
xor eax, eax
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
mov esi, eax
push esi
push 0xffffffffffffffeb
call fcn.00407ab0
push esi
call fcn.00408650
mov esi, eax
test esi, esi
je 0x4016ff
cmp dword [esp + 0x28], ebx
je 0x402953
push esi
call fcn.00408340
cmp dword [esp + 0x24], ebx
jl 0x402945
push eax
push dword [esp + 0x3c]
call fcn.004084e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x14]
jmp 0x4015c9
test eax, eax
mov ecx, 1
cmovne ebx, ecx
mov dword [esp + 0x14], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x14]
jmp 0x4015c9
mov eax, 2
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
push eax
call fcn.00408470
mov edi, eax
test edi, edi
je 0x4029aa
push dword [edi + 0x14]
push esi
call fcn.004084e0
push dword [edi + 0x18]
push ebp
call fcn.004084e0
jmp case.0x40154f.65
xor eax, eax
mov word [ebp], ax
mov word [esi], ax
lea ebx, [eax + 1]
jmp 0x4015c9
mov eax, 0xffffffee
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
mov ebx, eax
push ebx
mov dword [esp + 0x48], ebx
call fcn.00408db0
lea eax, [esp + 0x4c]
push eax
push ebx
push 8
call fcn.004088e0
call eax
xor ecx, ecx
mov dword [esp + 0x3c], eax
mov word [ebp], cx
mov word [esi], cx
lea ebx, [ecx + 1]
test eax, eax
je 0x4015c9
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4015c9
push 9
call fcn.004088e0
push 0xa
mov esi, eax
call fcn.004088e0
push edi
push dword [esp + 0x40]
mov dword [esp + 0x50], eax
push 0
push dword [esp + 0x50]
call esi
test eax, eax
je 0x402a81
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x40c368
push edi
call dword [esp + 0x58]
test eax, eax
je 0x402a81
mov eax, dword [esp + 0x18]
push dword [eax + 8]
push ebp
call fcn.004084e0
mov eax, dword [esp + 0x18]
push dword [eax + 0xc]
push dword [esp + 0x3c]
call fcn.004084e0
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4015c9
cmp dword [0x4395a0], 0
mov ebx, 1
jl 0x402ba5
mov eax, 0xfffffff0
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
mov edi, eax
push edi
call fcn.00408db0
mov ecx, dword [0x40e104]
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
cmp dword [esp + 0x30], 0
mov ebp, eax
je 0x402b07
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x402b18
push 8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x402b94
push ebp
push esi
call fcn.00408020
mov edi, eax
test edi, edi
je 0x402b67
mov eax, dword [esp + 0x28]
xor ebx, ebx
test eax, eax
je 0x402b47
push 0x40f108
push eax
call fcn.00407ab0
call edi
test eax, eax
je 0x402b6f
mov ebx, 1
jmp 0x402b6f
mov eax, dword [esp + 0x10]
push section..data
push 0x40e100
push section..ndata
push 0x800
push eax
call edi
add esp, 0x14
jmp 0x402b6f
push ebp
push 0xfffffffffffffff7
call fcn.00407ab0
cmp dword [esp + 0x2c], 0
jne 0x4015c9
push esi
call fcn.00405760
test eax, eax
je 0x4015c9
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4015c9
push 0x40f108
push 0xfffffffffffffff6
call fcn.00407ab0
jmp 0x4015c9
push 0x40f108
push 0xffffffffffffffe7
call fcn.00407ab0
jmp 0x4015c9
mov eax, 0xfffffff0
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
push eax
mov dword [esp + 0x50], eax
call fcn.00408db0
mov ecx, dword [0x40e104]
mov eax, 0xffffffdf
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
mov esi, eax
push esi
mov dword [esp + 0x40], esi
call fcn.00408db0
mov ecx, dword [0x40e104]
mov eax, 2
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
mov ecx, dword [0x40e104]
mov dword [esp + 0x48], eax
mov eax, 0xffffffcd
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
mov ebx, eax
push ebx
call fcn.00408db0
mov ecx, dword [0x40e104]
mov eax, 0x45
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov eax, ebp
and eax, 0xfff
mov dword [esp + 0x38], eax
mov eax, ebp
mov edi, ebp
and eax, 0x8000
sar edi, 0xc
sar ebp, 0x10
and edi, 7
push esi
mov dword [esp + 0x48], eax
and ebp, 0xffff
call fcn.00408ec0
test eax, eax
jne 0x402d02
mov ecx, dword [0x40e104]
mov eax, 0x21
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
lea eax, [esp + 0x14]
push eax
push 0x40cc3c
push 1
push 0
push 0x40cc5c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x402e01
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push 0x40cc4c
push eax
mov ecx, dword [eax]
mov eax, dword [ecx]
call eax
mov esi, eax
test esi, esi
js 0x402de5
mov eax, dword [esp + 0x14]
push dword [esp + 0x3c]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x50]
call eax
cmp dword [esp + 0x44], 0
mov esi, eax
jne 0x402d6c
mov eax, dword [esp + 0x14]
push 0x451000
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x24]
call eax
test edi, edi
je 0x402d7d
mov eax, dword [esp + 0x14]
push edi
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x3c]
call eax
mov eax, dword [esp + 0x14]
push ebp
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x34]
call eax
cmp word [ebx], 0
je 0x402da1
mov eax, dword [esp + 0x14]
push dword [esp + 0x38]
push ebx
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x44]
call eax
mov eax, dword [esp + 0x14]
push dword [esp + 0x48]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x2c]
call eax
mov eax, dword [esp + 0x14]
push dword [esp + 0x10]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x1c]
call eax
test esi, esi
js 0x402dd9
mov eax, dword [esp + 0x18]
push 1
push dword [esp + 0x50]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x18]
call eax
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
test esi, esi
js 0x402e01
push 0x40f108
push 0xfffffffffffffff4
jmp 0x4015c2
push 0x40f108
push 0xfffffffffffffff0
mov ebx, 1
call fcn.00407ab0
jmp 0x4015c9
xor eax, eax
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
mov ecx, dword [0x40e104]
mov esi, eax
mov eax, 0x11
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
mov ecx, dword [0x40e104]
mov edi, eax
mov eax, 0x23
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
push esi
mov ebx, eax
call fcn.00408470
test eax, eax
je 0x402ef4
mov eax, dword [esp + 0x10]
push esi
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], 2
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
push edi
mov word [esi + eax*2 + 2], cx
call sub.KERNEL32.dll_lstrlenW
xor ecx, ecx
push ebx
push ecx
mov word [edi + eax*2 + 2], cx
mov ax, word [esp + 0x30]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], edi
mov dword [esp + 0x6e], ebx
mov word [esp + 0x64], ax
call fcn.00407ab0
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je case.0x40154f.65
push 0
push 0xfffffffffffffff9
call fcn.00407ab0
mov ebx, 1
jmp 0x4015c9
cmp edi, 0xbadf00d
jne 0x4023e4
inc dword [0x439614]
jmp case.0x40154f.65
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x18], ebx
test edi, edi
je 0x402f51
xor eax, eax
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
mov edx, dword [esp + 0x24]
mov ebx, eax
test edx, edx
je 0x402f80
mov eax, 0x11
cdq
xor eax, edx
sub eax, edx
mov edx, dword [0x40e104]
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [edx + ecx*4]
push eax
call fcn.00407c50
mov ebp, eax
cmp dword [esp + 0x30], 0
je 0x402fb4
mov eax, 0x22
cdq
xor eax, edx
sub eax, edx
mov edx, dword [0x40e104]
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [edx + ecx*4]
push eax
call fcn.00407c50
mov dword [esp + 0x18], eax
mov eax, 0xffffffcd
cdq
xor eax, edx
sub eax, edx
mov edx, dword [0x40e104]
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [edx + ecx*4]
push eax
call fcn.00407c50
mov esi, eax
push esi
call fcn.00408db0
push esi
push dword [esp + 0x1c]
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
jne case.0x40154f.65
lea ebx, [eax + 1]
jmp 0x4015c9
mov eax, 1
mov dword [esp + 0x4c], 0xa
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
mov ecx, dword [0x40e104]
mov ebx, eax
mov eax, 0x12
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
mov ecx, dword [0x40e104]
mov edi, eax
mov eax, 0xffffffdd
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
mov esi, eax
push esi
call fcn.00408db0
push esi
push 0x7ff
push ebp
lea eax, [esp + 0x58]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp], 0xa
jmp 0x4019ca
cmp dword [esp + 0x30], ebx
jne 0x4030fd
push 2
call fcn.00403e10
mov esi, eax
test esi, esi
je 0x4016ff
mov ecx, dword [0x40e104]
mov eax, 0x33
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x403148
mov eax, 0x22
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
mov ecx, dword [esp + 0x24]
mov edx, eax
test ecx, ecx
jne 0x403137
mov ecx, dword [0x439604]
add ecx, 0x80000001
mov eax, dword [esp + 0x30]
and eax, 2
push eax
push edx
push ecx
call fcn.00403d10
mov edi, eax
test edi, edi
je case.0x40154f.65
mov ebx, 1
jmp 0x4015c9
test edi, edi
jne 0x40316a
mov edi, dword [0x439604]
add edi, 0x80000001
mov esi, dword [esp + 0x30]
mov eax, 2
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
mov ecx, dword [0x40e104]
mov ebp, eax
mov eax, 0x11
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
push 0
lea ecx, [esp + 0x1c]
mov ebx, 1
push ecx
mov ecx, dword [0x439630]
push 0
or ecx, 2
push ecx
push 0
push 0
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4015c9
cmp esi, ebx
jne 0x40322b
mov ecx, dword [0x40e104]
mov eax, 0x23
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
push str.C:UsersADMINI1AppDataLocalTemp_nslEC03.tmp
call sub.KERNEL32.dll_lstrlenW
lea eax, [eax*2 + 2]
jmp 0x403261
cmp esi, 4
jne 0x403247
push 3
call fcn.00403ce0
mov dword [str.C:UsersADMINI1AppDataLocalTemp_nslEC03.tmp], eax
add esp, 4
mov dword [esp + 0x40], edx
mov eax, esi
jmp 0x403261
cmp esi, 3
jne 0x403261
push 0x3000
push str.C:UsersADMINI1AppDataLocalTemp_nslEC03.tmp
push 0
push dword [esp + 0x38]
call fcn.004042c0
push eax
push str.C:UsersADMINI1AppDataLocalTemp_nslEC03.tmp
push dword [esp + 0x54]
push 0
push ebp
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x18]
neg eax
sbb eax, eax
and ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4015c9
push 0x20019
call fcn.00403e10
mov ecx, dword [0x40e104]
mov esi, eax
mov eax, 0x33
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
xor ecx, ecx
mov word [ebp], cx
test esi, esi
je 0x4016ff
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], 0x1000
push ecx
push ebp
lea ecx, [esp + 0x44]
push ecx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40333b
mov eax, dword [esp + 0x3c]
cmp eax, 4
je 0x40331d
cmp eax, 1
je 0x403304
cmp eax, 2
jne 0x40333b
mov ebx, dword [esp + 0x30]
xor eax, eax
push esi
mov word [ebp + 0xffe], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4015c9
push dword [ebp]
xor ebx, ebx
cmp dword [esp + 0x34], ebx
push ebp
sete bl
call fcn.004084e0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4015c9
xor eax, eax
push esi
mov word [ebp], ax
lea ebx, [eax + 1]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4015c9
push 0x20019
call fcn.00403e10
push 3
mov esi, eax
call fcn.00403ce0
xor ecx, ecx
mov dword [esp + 0x54], edx
add esp, 4
mov word [ebp], cx
test esi, esi
je 0x4016ff
mov dword [esp + 0x4c], 0x7ff
cmp dword [esp + 0x30], ecx
je 0x403396
push 0x7ff
push ebp
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x4033b4
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x5c]
push ecx
push ebp
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4016ff
xor eax, eax
push esi
mov word [ebp + 0xffe], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40154f.65
push ebp
call fcn.00408cd0
test eax, eax
je case.0x40154f.65
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40154f.65
mov eax, 0xffffffed
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
mov esi, eax
push esi
call fcn.00408db0
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
call fcn.00408920
cmp eax, 0xffffffff
jne 0x401fd6
xor eax, eax
mov word [ebp], ax
lea ebx, [eax + 1]
jmp 0x4015c9
mov eax, dword [esp + 0x3c]
xor ebx, ebx
mov ecx, dword [esp + 0x28]
cmp eax, 0x38
mov dword [esp + 0x4c], ecx
sete bl
test ecx, ecx
je 0x40346e
push 1
call fcn.00403ce0
add esp, 4
mov dword [esp + 0x40], edx
mov esi, ebx
mov word [0x40f108], ax
neg esi
sbb esi, esi
add esi, 2
jmp 0x4034f3
cmp eax, 0x38
jne 0x4034c5
mov eax, 0x21
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
push 0
push 0
push 0x800
push 0x40f108
push 0xffffffffffffffff
push str.C:UsersADMINI1AppDataLocalTemp_nslEC03.tmp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x40f108
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
jmp 0x4034f3
mov eax, 0x11
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
push eax
call sub.KERNEL32.dll_lstrlenW
mov esi, eax
add esi, esi
cmp word [ebp], 0
je 0x4016ff
push ebp
call fcn.00408cd0
or ebx, dword [esp + 0x4c]
mov edi, eax
jne 0x403521
cmp dword [esp + 0x2c], ebx
je 0x403521
push edi
push edi
call fcn.00408230
test eax, eax
js 0x4016ff
push esi
push 0x40f108
push edi
call fcn.00408a20
test eax, eax
jne case.0x40154f.65
lea ebx, [eax + 1]
jmp 0x4015c9
mov edi, 2
mov dword [esp + 0x18], ebx
push edi
call fcn.00403ce0
add esp, 4
mov dword [esp + 0x50], edx
cmp eax, 1
jl case.0x40154f.65
mov ecx, 0x7ff
cmp eax, ecx
cmovg eax, ecx
mov dword [esp + 0x3c], eax
cmp word [ebp], bx
je 0x40368e
xor edx, edx
push ebp
mov dword [esp + 0x48], edx
call fcn.00408cd0
cmp dword [esp + 0x3c], 0
mov ebx, eax
jle 0x40368e
mov ecx, dword [esp + 0x2c]
xor ebp, ebp
cmp dword [esp + 0x1c], 0x39
jne 0x4036a8
push 0
lea eax, [esp + 0x4c]
push eax
mov eax, 2
sub eax, ecx
push eax
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40368e
mov edi, dword [esp + 0x48]
test edi, edi
je 0x40368e
cmp dword [esp + 0x2c], 0
movzx eax, byte [esp + 0x14]
mov dword [esp + 0x10], eax
jne 0x4036fe
push 1
lea eax, [esp + 0x14]
push eax
push edi
lea eax, [esp + 0x20]
push eax
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x4036cc
mov esi, edi
neg esi
jmp 0x403610
dec dword [esp + 0x48]
mov eax, 0xfffd
mov dword [esp + 0x10], eax
je 0x40364f
push 1
push 0
inc esi
dec edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x50]
lea eax, [esp + 0x20]
push eax
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x403610
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jne 0x4036fe
mov edx, dword [esp + 0x44]
cmp dx, 0xd
je 0x4036d2
cmp dx, 0xa
je 0x4036d2
mov word [esi + ebp*2], ax
inc ebp
movzx edx, ax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x44], edx
test ax, ax
je 0x40368e
cmp ebp, dword [esp + 0x3c]
jl 0x403593
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov word [esi + eax*2], cx
test eax, eax
jne case.0x40154f.65
lea ebx, [ecx + 1]
jmp 0x4015c9
test ecx, ecx
jne 0x4036bb
test ebp, ebp
jne 0x4036bb
push ebp
push ebx
call fcn.00408230
test eax, eax
js 0x40368e
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00408950
test eax, eax
je 0x40368e
mov eax, dword [esp + 0x10]
jmp 0x403653
cmp dx, ax
je 0x4036ee
cmp ax, 0xd
je 0x4036e3
cmp ax, 0xa
jne 0x4036ee
mov word [esi + ebp*2], ax
inc ebp
mov dword [esp + 0x18], ebp
jmp 0x40368e
push 1
push 0
neg edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x40368e
movzx eax, ax
push eax
push esi
call fcn.004084e0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x12c8
ret 4
cmp word [ebp], bx
je case.0x40154f.65
push 2
call fcn.00403ce0
add esp, 4
mov dword [esp + 0x50], edx
push dword [esp + 0x2c]
push 0
push eax
push ebp
call fcn.00408cd0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x24], ebx
jl case.0x40154f.65
push eax
push esi
call fcn.004084e0
jmp case.0x40154f.65
push ebp
call fcn.00408cd0
test eax, eax
je case.0x40154f.65
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x40154f.65
push esi
call fcn.00408cd0
test eax, eax
je 0x4019d0
lea ecx, [esp + 0x88]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4019d0
lea eax, [esp + 0xb4]
push eax
push ebp
call fcn.00408b90
jmp case.0x40154f.65
mov eax, 2
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
lea ecx, [esp + 0x88]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x4037f4
xor eax, eax
mov word [esi], ax
mov word [ebp], ax
lea ebx, [eax + 1]
jmp 0x4015c9
push eax
push esi
call fcn.004084e0
lea eax, [esp + 0xb4]
push eax
push ebp
call fcn.00408b90
jmp case.0x40154f.65
mov eax, 0xfffffff0
mov ebx, 0xfffffd66
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
sar eax, 4
and ecx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [esp + ecx*4 + 0x20]
push eax
call fcn.00407c50
mov ebp, eax
push ebp
call fcn.00408db0
push ebp
call fcn.00408ec0
test eax, eax
jne 0x403878
mov ecx, dword [0x40e104]
mov eax, 0xffffffed
cdq
xor eax, edx
sub eax, edx
mov edx, eax
sar eax, 4
and edx, 0xf
shl eax, 0xc
add eax, 0x40e108
push dword [ecx + edx*4]
push eax
call fcn.00407c50
push eax
call fcn.00408db0
push ebp
call fcn.00408c20
push 2
push 0x40000000
push ebp
call fcn.00408920
mov esi, eax
mov dword [esp + 0x4c], esi
cmp esi, 0xffffffff
je 0x40394b
mov edi, dword [0x43953c]
push edi
push 0x40
mov dword [esp + 0x4c], edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40393f
push 0
call fcn.00403f80
push edi
push ebx
call fcn.00403eb0
push dword [esp + 0x28]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [esp + 0x3c], edi
test edi, edi
je 0x40391b
push dword [esp + 0x28]
push edi
push 0
push dword [esp + 0x30]
call fcn.004042c0
cmp byte [edi], 0
je 0x40390d
mov esi, dword [edi]
mov eax, dword [edi + 4]
add edi, 8
push esi
push edi
add eax, ebx
push eax
call fcn.00408620
add edi, esi
cmp byte [edi], 0
jne 0x4038f0
mov esi, dword [esp + 0x4c]
push dword [esp + 0x3c]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call edi
jmp 0x403921
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x44]
push ebx
push esi
call fcn.00408a20
push ebx
call edi
push 0
push 0
push esi
push 0xffffffffffffffff
call fcn.004042c0
mov ebx, eax
jmp 0x403944
mov ebx, 0xfffffd66
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0xfffffff3
test ebx, ebx
jns 0x403973
push ebp
mov esi, 0xffffffef
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x40f108
push esi
lea ebx, [esi + 0x12]
call fcn.00407ab0
jmp 0x4015c9
push 0x40f108
push esi
xor ebx, ebx
call fcn.00407ab0
jmp 0x4015c9
push 0
call fcn.00403ce0
mov ebx, eax
mov dword [esp + 0x54], edx
add esp, 4
cmp ebx, dword [0x43956c]
jae 0x4016ff
mov ecx, dword [esp + 0x28]
imul edi, ebx, 0x1018
add edi, dword [0x439568]
test ecx, ecx
js 0x4039cd
mov eax, dword [edi + ecx*4]
jne 0x40374d
lea eax, [edi + 0x18]
push eax
push esi
call fcn.00408b90
jmp case.0x40154f.65
or eax, 0xffffffff
sub eax, ecx
mov dword [esp + 0x28], eax
je 0x4039ee
push 1
call fcn.00403ce0
mov ecx, eax
mov dword [esp + 0x54], edx
add esp, 4
mov dword [esp + 0x24], ecx
jmp 0x403a06
push dword [esp + 0x30]
lea eax, [edi + 0x18]
push eax
call fcn.00407c50
or dword [edi + 8], 0x100
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [edi + eax*4], ecx
cmp dword [esp + 0x2c], 0
je case.0x40154f.65
push ebx
call fcn.00401240
jmp case.0x40154f.65
push 0
call fcn.00403ce0
mov edi, eax
mov dword [esp + 0x54], edx
add esp, 4
cmp edi, 0x20
jae 0x4016ff
cmp dword [esp + 0x2c], ebx
je 0x403a6f
cmp dword [esp + 0x28], ebx
je 0x403a5c
push edi
call fcn.004012b0
push 0
push 0
call fcn.00401300
jmp case.0x40154f.65
push 0
call fcn.004011b0
push eax
push esi
call fcn.004084e0
jmp case.0x40154f.65
mov eax, dword [0x439544]
cmp dword [esp + 0x28], ebx
je 0x403a8a
mov ecx, dword [esp + 0x24]
mov dword [eax + edi*4 + 0x94], ecx
jmp case.0x40154f.65
push dword [eax + edi*4 + 0x94]
push esi
call fcn.00407c50
jmp case.0x40154f.65
mov eax, dword [0x428238]
push 0
and eax, edi
push eax
push 0xb
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x20], ebx
je case.0x40154f.65
mov eax, dword [esp + 0x10]
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x40154f.65
push edi
call fcn.00403ed0
jmp case.0x40154f.65