Function at 0x45c010
Capabilities:
Check if file exists
Create process on windows
Delete registry key
Get file attributes
Get graphical window text
Open clipboard
Persist via image file execution options registry key
Read .ini file
Set file attributes
Set registry value
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2070
call fcn.00520ea0
mov eax, dword [0x53a090]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, edx
movzx esi, di
mov eax, esi
mov ebx, ecx
mov dword [ebp - 0x2068], esi
cmp eax, 0x9c40
jg 0x45d1e7
je 0x45d019
sub eax, 0x4e20
cmp eax, 0x23
ja case.default.0x45c058
jmp dword [eax*4 + 0x4617f0]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x835
push dword [0x56e17c]
call esi
mov eax, dword [0x56d204]
cmp eax, 1
jne 0x45c0a2
push 0
push 0xf020
push 0x112
push ebx
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne case.default.0x45c058
push 0
push 0
push 0x10
push ebx
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
xor edx, edx
push 0
push 0
lea ecx, [edx + 1]
call fcn.00466da0
add esp, 8
test eax, eax
je case.default.0x45c058
push 0
push 0
push 0x10
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [0x56d218], eax
push 0
sete al
push 0
push 0x919
push dword [0x56e17c]
mov dword [0x56d218], eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
cmp dword [0x56d218], eax
sete al
mov dword [0x56d218], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x7d8
push dword [0x56e17c]
call ebx
push 0
push 0
push 0x7d9
push dword [0x56e17c]
mov esi, eax
mov dword [ebp - 0x2064], esi
call ebx
push 0
push esi
push 0x876
push dword [0x56e17c]
mov edi, eax
call ebx
push 0
mov esi, eax
push esi
push 0x877
push dword [0x56e17c]
call ebx
push 0
push esi
push 0x850
push dword [0x56e17c]
mov dword [ebp - 0x206c], eax
call ebx
mov ecx, eax
mov eax, dword [ebp - 0x2064]
cmp eax, edi
je 0x45c1e0
push eax
push eax
push 0x870
push dword [0x56e17c]
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push 0
push 0
cmp eax, dword [ebp - 0x206c]
jne 0x45c20c
push 0x916
push dword [0x56e17c]
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
cmp eax, ecx
jg 0x45c230
push 0x95b
push dword [0x56e17c]
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push 0x91f
push dword [0x56e17c]
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x7d8
push dword [0x56e17c]
call ebx
push 0
push 0
push 0x7d9
push dword [0x56e17c]
mov esi, eax
mov dword [ebp - 0x2064], esi
call ebx
push 0
push esi
push 0x876
push dword [0x56e17c]
mov edi, eax
call ebx
push 0
mov esi, eax
push esi
push 0x877
push dword [0x56e17c]
call ebx
push 0
push esi
push 0x858
push dword [0x56e17c]
mov dword [ebp - 0x206c], eax
call ebx
mov ecx, eax
mov eax, dword [ebp - 0x2064]
cmp eax, edi
jne 0x45c1be
push 0
push 0
cmp dword [ebp - 0x206c], ecx
je 0x45c2f6
push 0x920
push dword [0x56e17c]
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push 0x922
push dword [0x56e17c]
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x8d4
push dword [0x56e17c]
call esi
push 0
push 1
push 0x84c
push dword [0x56e17c]
call esi
push 0
push 0
push 0x917
push dword [0x56e17c]
call esi
xor eax, eax
cmp dword [0x56e938], eax
push 0
sete al
push eax
push 0x84c
push dword [0x56e17c]
call esi
push 0
push dword [0x56e224]
push 0x8d4
push dword [0x56e17c]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push 0x56e260
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.default.0x45c058
mov eax, dword [0x56e1b8]
cmp eax, 2
jne 0x45c3bb
mov dword [0x53d358], 4
jmp 0x45c3e0
cmp eax, 3
jne 0x45c3cc
mov dword [0x53d358], 5
jmp 0x45c3e0
mov dword [0x53d358], 6
cmp eax, 7
je 0x45c3e0
mov dword [0x53d358], eax
push 0x56e260
lea eax, [ebp - 0xf94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xf94]
push eax
push ecx
push 1
xor edx, edx
xor ecx, ecx
call fcn.00466600
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push 0x56e260
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.default.0x45c058
push 0x56e260
lea eax, [ebp - 0xf94]
push eax
mov dword [0x53d358], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xf94]
push eax
push ecx
push 1
xor edx, edx
xor ecx, ecx
call fcn.00466600
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push 0x56e260
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.default.0x45c058
push 0x56e260
lea eax, [ebp - 0xf94]
push eax
mov dword [0x53d358], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xf94]
push eax
push ecx
push 1
xor edx, edx
xor ecx, ecx
call fcn.00466600
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
mov esi, dword [0x56e22c]
push 0x56e260
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.default.0x45c058
push 0x56e260
lea eax, [ebp - 0xf94]
push eax
mov dword [0x56e22c], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xf94]
push eax
push ecx
push 1
xor edx, edx
xor ecx, ecx
call fcn.00466600
add esp, 0xc
mov dword [0x56e22c], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push 0x56e260
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.default.0x45c058
mov esi, dword [0x565b24]
mov edi, dword [0x56e930]
push 0x56e260
lea eax, [ebp - 0xf94]
push eax
mov dword [0x565b24], 1
mov dword [0x56e930], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xf94]
push eax
push ecx
push 1
xor edx, edx
xor ecx, ecx
call fcn.00466600
add esp, 0xc
mov dword [0x565b24], esi
mov dword [0x56e930], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
mov edx, dword [0x5581d0]
jmp 0x45fe32
mov esi, dword [0x56e17c]
mov edx, 1
mov ecx, 0x40d174
call fcn.0046bcd0
mov edx, eax
mov ecx, esi
call fcn.0046a390
call fcn.00465fd0
call fcn.004663d0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
mov esi, dword [0x56e17c]
mov edx, 1
mov ecx, 0x40da30
call fcn.0046bcd0
mov edx, eax
mov ecx, esi
call fcn.0046a390
call fcn.00465fd0
call fcn.004663d0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x2d4], ax
lea eax, [ebp - 0x2d2]
push eax
call fcn.00518020
add esp, 0xc
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x4e4], ax
lea eax, [ebp - 0x4e2]
push eax
call fcn.00518020
mov al, byte [0x408071]
add esp, 0xc
mov byte [ebp - 0x205c], al
push 0x1ff
lea eax, [ebp - 0x205b]
push 0
push eax
call fcn.00518020
mov al, byte [0x408071]
add esp, 0xc
mov byte [ebp - 0x1e5c], al
push 0x1ff
lea eax, [ebp - 0x1e5b]
push 0
push eax
call fcn.00518020
mov al, byte [0x408071]
add esp, 0xc
mov byte [ebp - 0x1c5c], al
push 0x5ff
lea eax, [ebp - 0x1c5b]
push 0
push eax
call fcn.00518020
mov al, byte [0x408071]
add esp, 0xc
mov byte [ebp - 0x165c], al
push 0x5ff
lea eax, [ebp - 0x165b]
push 0
push eax
call fcn.00518020
mov eax, dword [0x56e17c]
add esp, 0xc
mov dword [ebp - 0x1044], eax
push 0x565908
push 0x100
lea eax, [ebp - 0x2d4]
push eax
push 0x40a758
push 0x40a7b4
push 0x408a0c
mov dword [ebp - 0x105c], 0x200000
mov dword [ebp - 0x1058], 0
mov dword [ebp - 0x1054], 0
mov dword [ebp - 0x1050], 0
mov dword [ebp - 0x104c], 0
mov dword [ebp - 0x1048], 0
mov dword [ebp - 0x1040], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x7c
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
test esi, esi
je 0x45c78c
lea ecx, [esi + 2]
push ecx
lea eax, [ebp - 0x4e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov word [esi], ax
mov esi, dword [sym.imp.SHLWAPI.dll_StrTrimW]
push 0x407fb8
lea eax, [ebp - 0x2d4]
push eax
call esi
push 0x407fb8
lea eax, [ebp - 0x4e4]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x2d4]
push eax
call esi
test eax, eax
je case.default.0x45c058
lea eax, [ebp - 0x4e4]
push eax
call esi
test eax, eax
je case.default.0x45c058
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x98]
mov dword [ebp - 0x38], eax
movzx eax, word [ebp - 0x9a]
mov dword [ebp - 0x34], eax
movzx eax, word [ebp - 0x9c]
mov dword [ebp - 0x30], eax
movzx eax, word [ebp - 0x9e]
mov dword [ebp - 0x2c], eax
movzx eax, word [ebp - 0xa2]
dec eax
mov dword [ebp - 0x28], eax
movzx eax, word [ebp - 0xa4]
sub eax, 0x76c
mov dword [ebp - 0x24], eax
movzx eax, word [ebp - 0xa0]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x18], 0xffffffff
call fcn.0050fef4
add esp, 4
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x4e4]
push eax
lea eax, [ebp - 0x6e4]
push 0x100
push eax
call fcn.00510b29
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x10
push 0
push 0
push 0x859
push dword [0x56e17c]
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0x200
mov edi, eax
lea eax, [ebp - 0x205c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x2d4]
push eax
push 0
push edi
call esi
push 0
push 0
push 0x200
lea eax, [ebp - 0x1e5c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x6e4]
push eax
push 0
push edi
call esi
push 0
push 0
push 0x861
push dword [0x56e17c]
call ebx
push 0
push 0
push 0x85f
push dword [0x56e17c]
mov esi, eax
call ebx
lea edx, [ebp - 0x205c]
cmp eax, esi
je 0x45c90d
mov ecx, dword [0x56e17c]
push 1
call fcn.00451d30
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push ecx
mov ecx, dword [0x56e17c]
call fcn.004518b0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push 0x1ff
lea eax, [ebp - 0x2d3]
push 0
push eax
mov byte [ebp - 0x2d4], 0
call fcn.00518020
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xf94], ax
lea eax, [ebp - 0xf92]
push eax
call fcn.00518020
mov eax, 0x4e2f
add esp, 0xc
cmp di, ax
mov eax, 0x40a7c8
je 0x45c97e
mov eax, 0x40a7e4
push 0x565908
push 0x100
lea ecx, [ebp - 0x6e4]
push ecx
push 0x407d38
push eax
push 0x408a0c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je case.default.0x45c058
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x861
push dword [0x56e17c]
call edi
push 0
push 0
push 0x85f
push dword [0x56e17c]
mov esi, eax
call edi
sub esi, eax
lea ecx, [esi - 1]
cmp ecx, 0x1f3
ja case.default.0x45c058
push 0
push 0
push 0x871
push dword [0x56e17c]
call edi
cmp eax, 0x200
jae case.default.0x45c058
lea eax, [ebp - 0x2d4]
push eax
push 0
push 0x871
push dword [0x56e17c]
call edi
cmp esi, 0x200
jae 0x4617ea
push 0xd
lea eax, [ebp - 0x2d4]
mov byte [ebp + esi - 0x2d4], 0
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrA]
push eax
call esi
test eax, eax
je 0x45ca41
mov byte [eax], 0
push 0xa
lea eax, [ebp - 0x2d4]
push eax
call esi
test eax, eax
je 0x45ca53
mov byte [eax], 0
push 9
lea eax, [ebp - 0x2d4]
push eax
call esi
test eax, eax
je 0x45ca65
mov byte [eax], 0
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je case.default.0x45c058
push 0
push 0
push 0x859
push dword [0x56e17c]
call edi
push 0x200
sub eax, 0xfde9
neg eax
lea ecx, [ebp - 0xcf4]
push ecx
push 0xffffffffffffffff
sbb eax, eax
lea ecx, [ebp - 0x2d4]
push ecx
and eax, 0xffff0217
add eax, 0xfde9
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x848
push 0x40
call edi
mov ebx, eax
lea eax, [ebp - 0xcf4]
push eax
lea eax, [ebp - 0x6e4]
push eax
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalSize]
add esp, 0xc
push ebx
call esi
shr eax, 1
mov edx, eax
mov ecx, ebx
call fcn.00456860
push ebx
call esi
push eax
push 0x40
call edi
mov edi, eax
push edi
mov edx, ebx
mov ecx, ebx
call fcn.00456750
add esp, 4
push 0x56e260
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x45cb3e
push 0x56e260
lea eax, [ebp - 0xf94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xf94]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x3c
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.00518020
lea eax, [ebp - 0xf94]
add esp, 0xc
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x800000
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call esi
push edi
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
cmp dword [0x56daac], 0
jne 0x45cbd8
push 0
push 0x19dd5
push 0x111
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
mov eax, 0x4e33
cmp di, ax
mov eax, dword [0x56e194]
jne 0x45cbea
inc eax
jmp 0x45cbeb
dec eax
mov dword [0x56e194], eax
cmp eax, 0x1000
jge 0x45cbff
test eax, eax
jg 0x45cc09
xor eax, eax
jmp 0x45cc04
mov eax, 0x1000
mov dword [0x56e194], eax
push 0
push eax
push 0x939
push dword [0x56e17c]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.00465fd0
mov eax, dword [0x56e194]
mov dword [0x56e190], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push 0x40a610
mov edx, 0x40a610
call fcn.0044cc40
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push 0x40a568
mov edx, 0x40a568
call fcn.0044cc40
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push 0x40a800
mov edx, 0x40a804
call fcn.0044cc40
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push 0x409c28
mov edx, 0x40a808
call fcn.0044cc40
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push 0x40a644
mov edx, 0x40a648
call fcn.0044cc40
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push 0x40a80c
mov edx, 0x40a80c
call fcn.0044cc40
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
mov edx, 1
call fcn.0044a570
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
xor edx, edx
call fcn.0044a570
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x977
push ebx
call esi
cmp eax, 1
je case.default.0x45c058
push 0
push 0
push 0x7d9
push dword [0x56e17c]
call esi
push 0
push 0
push 0x7d8
push dword [0x56e17c]
mov edi, eax
call esi
cmp eax, edi
jle case.default.0x45c058
push edi
push eax
push 0x870
push dword [0x56e17c]
call esi
push 0
push 0
push 0x95f
push dword [0x56e17c]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x977
push ebx
call esi
cmp eax, 1
je case.default.0x45c058
push 0
push 0
push 0x7d9
push dword [0x56e17c]
call esi
push 0
push 0
push 0x7d8
push dword [0x56e17c]
mov edi, eax
call esi
cmp eax, edi
jge case.default.0x45c058
jmp 0x45cd9b
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x56e260
call edi
test eax, eax
je 0x45ce2f
mov esi, 0x56e260
jmp 0x45ce4f
push 0x20
lea eax, [ebp - 0x94]
push eax
push 0x2713
push dword [0x56e6cc]
call dword [sym.imp.USER32.dll_LoadStringW]
lea esi, [ebp - 0x94]
push ebx
mov dword [ebp - 0x2068], esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.default.0x45c058
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
call edi
lea eax, [eax*2 + 2]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
shr eax, 1
push eax
push dword [ebp - 0x2068]
push esi
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x40]
push eax
push dword [0x56e928]
mov dword [ebp - 0x40], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
push dword [0x56e928]
mov dword [ebp - 0x206c], eax
mov dword [ebp - 0x2064], ecx
sub esi, eax
sub edi, ecx
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x45cf11
test byte [ebp - 0x3c], 2
je 0x45cf16
mov eax, 1
push eax
push edi
push esi
push dword [ebp - 0x2064]
lea eax, [ebp - 0x2d4]
push dword [ebp - 0x206c]
push 0x40a810
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x45e3b9
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
shr eax, 1
push eax
lea eax, [ebp - 0x2d4]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
call fcn.00465df0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
call fcn.00468140
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push 0x565908
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.default.0x45c058
mov ecx, 0x565908
call fcn.00465d50
push 0x565908
push ecx
push 0
xor edx, edx
xor ecx, ecx
call fcn.00466600
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xf94], ax
lea eax, [ebp - 0xf92]
push eax
call fcn.00518020
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x6ec], ax
lea eax, [ebp - 0x6ea]
push eax
call fcn.00518020
add esp, 0xc
mov edx, 1
push 0
push 0
xor ecx, ecx
call fcn.00466da0
add esp, 8
test eax, eax
je case.default.0x45c058
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x407d38
push 0x56e260
call esi
push 0x56e260
push 0xfb05
push dword [0x56e928]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0xfb06
push dword [0x56e928]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
cmp dword [0x567280], 0
jne 0x45d0c7
push 0x407d38
push 0x565f48
call esi
push 0x56e1c0
xor edx, edx
xor ecx, ecx
call fcn.00453cd0
mov ecx, dword [0x56e17c]
add esp, 4
mov edx, 0x408071
push 0
call fcn.004470f0
mov ecx, dword [0x56e17c]
add esp, 4
xor edx, edx
call fcn.0046a390
call fcn.004663d0
mov eax, dword [0x56e178]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [eax*4 + 0x53d348]
push 0
push eax
push 0x7ef
push dword [0x56e17c]
mov dword [0x56d210], 0
mov dword [0x567b48], 0
mov dword [0x56a9ac], eax
call esi
mov eax, dword [0x56e1b8]
mov dword [0x56d450], eax
mov dword [0x56d448], eax
test eax, eax
mov eax, dword [0x56e1b4]
je 0x45d157
mov eax, 0xfde9
push 0
push eax
push 0x7f5
push dword [0x56e17c]
call esi
mov ecx, dword [0x56e17c]
push 0
mov edx, 0x408071
call fcn.004470f0
add esp, 4
cmp dword [0x56d210], 0
jne 0x45d196
mov eax, dword [0x56d450]
cmp eax, dword [0x56d448]
jne 0x45d196
xor eax, eax
jmp 0x45d19b
mov eax, 1
mov edx, dword [0x53d35c]
sub esp, 0xc
push eax
push ecx
mov ecx, dword [0x56e928]
push 0x56e260
sub esp, 8
call fcn.00454d10
mov eax, dword [0x56e914]
add esp, 0x20
neg eax
sbb eax, eax
not eax
and dword [0x56e240], eax
xor ecx, ecx
call fcn.00468470
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
sub eax, 0x9c41
cmp eax, 0x2d3
ja case.default.0x45c058
movzx eax, byte [eax + 0x461b50]
jmp dword [eax*4 + 0x461880]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
cmp dword [0x56d210], 0
jne 0x45d7a1
mov eax, dword [0x56d450]
cmp eax, dword [0x56d448]
jne 0x45d7a1
xor eax, eax
jmp 0x45d7a6
mov eax, 1
mov edx, dword [0x53d35c]
sub esp, 0xc
push eax
push ecx
push 0x56e260
sub esp, 8
mov ecx, ebx
call fcn.00454d10
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
call fcn.00465df0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x56e17c]
mov edx, 0x566048
call fcn.00450af0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x56e17c]
mov edx, 0x566048
call fcn.00450cf0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x56e17c]
call fcn.0046a390
call fcn.00465fd0
call fcn.004663d0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret
push ecx
call fcn.0044f2f0
add esp, 4
jmp 0x45d787
push 0
push 0
push 0x861
push dword [0x56e17c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x85f
push dword [0x56e17c]
mov edi, eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub edi, eax
jne 0x46112b
push edi
push 0x19d77
push 0x111
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
call ebx
push edi
push edi
push 0x861
push dword [0x56e17c]
call ebx
push 0
push 0
push 0x85f
push dword [0x56e17c]
mov edi, eax
call ebx
sub edi, eax
jmp 0x461131
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [edi - 1]
cmp eax, 0x1f3
ja case.default.0x45c058
push 0
push 0
push 0x871
push dword [0x56e17c]
call ebx
cmp eax, 0x200
jge case.default.0x45c058
lea eax, [ebp - 0x2d4]
push eax
push 0
push 0x871
push dword [0x56e17c]
call ebx
cmp edi, 0x200
jae 0x4617ea
push 0xa
lea eax, [ebp - 0x2d4]
mov byte [ebp + edi - 0x2d4], 0
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrA]
push eax
call edi
test eax, eax
je 0x46119d
mov byte [eax], 0
push 0xd
lea eax, [ebp - 0x2d4]
push eax
call edi
test eax, eax
je 0x4611af
mov byte [eax], 0
push 0
push 0
push 0x859
push dword [0x56e17c]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [0x565b1c], eax
lea eax, [ebp - 0x2d4]
push eax
push 0x566048
call edi
mov eax, dword [0x565b1c]
cmp eax, 0xfde9
je 0x461229
push 0x200
lea ecx, [ebp - 0xcf4]
push ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x2d4]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0x600
push 0x566448
push 0xffffffffffffffff
lea eax, [ebp - 0xcf4]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x461237
lea eax, [ebp - 0x2d4]
push eax
push 0x566448
call edi
and dword [0x567048], 0xff9fffff
mov dword [0x56704c], 0
sub esi, 0x4e31
je 0x461261
dec esi
jne case.default.0x45c058
push 0
jmp 0x45fd4d
push 0
jmp 0x45fd25
call fcn.0050f29e
nop
pop edi
rol byte [ebp], 199
rol byte [ebp], 0
rol dword [ebp], 0x48
rol dword [ebp], 0x50
ret 0x45