Function at 0x44e6af
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
mov eax, 0x45ef98
call fcn.0045cfc0
mov eax, 0x2010
call fcn.0045cf90
push ebx
push esi
mov ebx, ecx
push edi
push 1
mov ecx, 0x474d58
call fcn.00429f00
push 2
mov ecx, 0x45f130
call fcn.0041186f
and byte [ebp - 0x201c], 0
mov esi, 0x1ff
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x201b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
cmp eax, 0x7701
jl 0x44e728
cmp eax, 0x7800
jg 0x44e728
push 1
add eax, 0xffff88ff
pop ecx
mov dword [0x473928], eax
push eax
mov dword [0x473670], ecx
push ecx
mov ecx, ebx
jmp 0x44f20a
cmp eax, 0x3501
jl 0x44e748
cmp eax, 0x7700
jg 0x44e748
add eax, 0xffffcaff
mov ecx, ebx
push eax
call fcn.00452550
jmp case.0x44f276.32857
cmp eax, 0x2700
jl 0x44e763
cmp eax, 0x2999
jg 0x44e763
push eax
mov ecx, ebx
call fcn.00452592
jmp case.0x44f276.32857
cmp eax, 0x7801
jl 0x44e786
cmp eax, 0x7901
jg 0x44e786
add eax, 0xffff87ff
mov ecx, 0x497860
push eax
call fcn.00443df1
jmp case.0x44f276.32857
cmp eax, 0x2650
jl 0x44e7a9
cmp eax, 0x2699
jg 0x44e7a9
add eax, 0xffffd9b0
mov ecx, 0x495668
push eax
call fcn.00438abe
jmp case.0x44f276.32857
mov ecx, 0x3001
cmp eax, ecx
jg 0x44e962
je 0x44e807
add eax, 0xffffe890
cmp eax, 0xb
ja case.0x44f276.32857
jmp dword [eax*4 + 0x44fae3]
push 0
mov ecx, ebx
call fcn.00454ff1
jmp case.0x44f276.32857
push 1
jmp 0x44e7cf
push 2
jmp 0x44e7cf
push 3
jmp 0x44e7cf
push 4
jmp 0x44e7cf
push 5
jmp 0x44e7cf
push 6
jmp 0x44e7cf
push 7
jmp 0x44e7cf
push 8
jmp 0x44e7cf
push 9
jmp 0x44e7cf
push 0xa
jmp 0x44e7cf
push 0xb
jmp 0x44e7cf
and byte [ebp - 0xcac], 0
mov ecx, 0x218
xor eax, eax
lea edi, [ebp - 0xcab]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xcac]
push 0x863
push eax
push dword [ebx + 0xb20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
lea eax, [ebp - 0xcac]
push 0x41096c
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x44e94b
lea eax, [ebp - 0xcac]
push 0x410968
push eax
call edi
pop ecx
mov dword [ebp + 8], eax
test eax, eax
pop ecx
je 0x44e94b
lea edi, [ebp - 0xcac]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x181c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40b0d4
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x181c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xcac]
mov edi, 0x41095c
sub eax, ecx
or ecx, 0xffffffff
and byte [ebp + eax - 0x181c], 0
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
add eax, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
je 0x44e922
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x181c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x181c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xcac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea eax, [ebp - 0xcac]
push 0
push eax
mov ecx, ebx
call fcn.00453862
jmp case.0x44f276.32857
mov ecx, LoadLibraryExA
cmp eax, ecx
jg 0x44f24a
je 0x44f239
mov ecx, 0x7fa5
cmp eax, ecx
jg 0x44ed34
je case.0x44f276.32898
mov ecx, 0x3068
cmp eax, ecx
jg 0x44ebd2
je 0x44ebc3
add ecx, 0xfffffff1
cmp eax, ecx
jg 0x44eb1f
je 0x44eae7
mov ecx, 0x3052
cmp eax, ecx
jg 0x44ea3b
je case.0x44f276.32918
sub eax, 0x3002
je case.0x44f276.32854
dec eax
je 0x44e9fa
dec eax
dec eax
je 0x44e9eb
dec eax
je 0x44e9dc
sub eax, 0x4b
jmp 0x44ed1b
mov ecx, 0x496d18
call fcn.00454c0f
jmp case.0x44f276.32857
mov ecx, 0x496d18
call fcn.00454eef
jmp case.0x44f276.32857
mov al, byte [0x45f128]
mov ecx, esi
mov byte [ebp - 0xc48], al
xor eax, eax
lea edi, [ebp - 0xc47]
push 0x800
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc48]
push eax
push dword [ebx + 0xb20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0
lea eax, [ebp - 0xc48]
jmp 0x44fa4e
sub eax, 0x3053
je case.0x44f276.32919
dec eax
je 0x44ead8
dec eax
je case.0x44ed4d.32680
dec eax
je case.0x44f276.32927
dec eax
dec eax
jne case.0x44f276.32857
cmp dword [0x4736fc], 0
je 0x44ea9c
mov ecx, 0x532500
call fcn.00430029
test eax, eax
je case.0x44f276.32857
mov esi, 0x495688
push 1
push 1
mov ecx, esi
call fcn.0041be57
push 0
mov ecx, esi
call fcn.0041bc41
jmp case.0x44f276.32857
push 0x3058
lea ecx, [ebx + 0xae4]
call fcn.00447ede
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push dword [ebx + 0xae8]
mov ecx, ebx
push 0x3eb
call fcn.0045107a
lea eax, [ebp - 0x14]
mov ecx, 0x532500
push eax
call fcn.0042f949
jmp case.0x44f276.32857
mov ecx, 0x475a08
call fcn.004160d5
jmp case.0x44f276.32857
push ecx
lea ecx, [ebx + 0xae4]
call fcn.00447ede
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push dword [ebx + 0xae8]
mov ecx, ebx
push 0x3eb
call fcn.0045107a
lea eax, [ebp - 0x14]
mov ecx, 0x532500
push eax
call fcn.0042fa7e
jmp case.0x44f276.32857
lea ecx, [eax - 0x305b]
cmp ecx, 0xc
ja case.0x44f276.32857
jmp dword [ecx*4 + 0x44fb13]
push 0xffffffffffffffff
push dword [ebx + 4]
mov ecx, ebx
call fcn.0044e4d1
jmp case.0x44f276.32857
push eax
lea ecx, [ebx + 0xae4]
call fcn.00447ede
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push dword [ebx + 0xae8]
mov ecx, ebx
push 0x3eb
call fcn.0045107a
push dword [ebp - 0x10]
mov ecx, ebx
push dword [ebp - 0x14]
call fcn.004509fd
jmp case.0x44f276.32857
push eax
lea ecx, [ebx + 0xae4]
call fcn.00447ede
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push dword [ebx + 0xae8]
mov ecx, ebx
push 0x3eb
call fcn.0045107a
push dword [ebp - 0x10]
mov ecx, ebx
push dword [ebp - 0x14]
call fcn.00450ac4
jmp case.0x44f276.32857
mov ecx, 0x475a08
call fcn.00419aa9
jmp case.0x44f276.32857
mov ecx, 0x496d18
call fcn.00453ddd
jmp case.0x44f276.32857
mov ecx, 0x7955
cmp eax, ecx
jg 0x44ecaf
je 0x44eca9
mov ecx, 0x306e
cmp eax, ecx
jg 0x44ec62
je case.0x44ed4d.32820
sub eax, 0x3069
je 0x44f9ef
dec eax
je case.0x44ed4d.32794
dec eax
je 0x44ec53
dec eax
je 0x44ec1a
dec eax
jne case.0x44f276.32857
mov ecx, ebx
jmp 0x44f542
push 0x306c
lea ecx, [ebx + 0xae4]
call fcn.00447ede
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push dword [ebx + 0xae8]
mov ecx, ebx
push 0x3eb
call fcn.0045107a
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00454f93
jmp case.0x44f276.32857
mov ecx, 0x496d18
call fcn.00454b1b
jmp case.0x44f276.32857
sub eax, reloc.VERSION.dll_GetFileVersionInfoSizeA
je 0x44ec91
dec eax
je 0x44ec8b
dec eax
je 0x44ec85
dec eax
je 0x44ec7f
dec eax
jne case.0x44f276.32857
push 0
push 0x22
jmp 0x44ec95
push 0
push 0x27
jmp 0x44ec95
push 0
push 0x25
jmp 0x44ec95
push 0
push 0x28
jmp 0x44ec95
push 0
push 0x26
push 0x100
mov ecx, 0x475a08
call fcn.004180a2
jmp case.0x44f276.32857
push 0
push 0x21
jmp 0x44ec95
mov ecx, 0x795b
cmp eax, ecx
jg 0x44ed03
je case.0x44f276.32933
sub eax, 0x7956
je 0x44ecfd
dec eax
je 0x44ecf2
dec eax
je 0x44ecec
dec eax
je 0x44ece6
dec eax
jne case.0x44f276.32857
push 1
mov ecx, 0x475a08
call fcn.00418d4d
jmp case.0x44f276.32857
push 0
push 0x24
jmp 0x44ec95
push 0
push 0x23
jmp 0x44ec95
push 0
push 7
push 0x114
jmp 0x44ec9a
push 0
push 6
jmp 0x44ecf6
sub eax, 0x7f9f
je case.0x44ed4d.32679
dec eax
je 0x44ed26
sub eax, 3
je 0x44f533
dec eax
je case.0x44f276.32925
jmp case.0x44f276.32857
mov edi, 0x475a08
mov ecx, edi
call fcn.004162a1
jmp 0x44ed60
lea ecx, [eax - 0x7fa6]
cmp ecx, 0xae
ja case.0x44f276.32857
movzx ecx, byte [ecx + 0x44fbef]
jmp dword [ecx*4 + 0x44fb47]
mov edi, 0x475a08
mov ecx, edi
call fcn.0041627f
push 0
mov ecx, edi
call fcn.00417f9a
jmp case.0x44f276.32857
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
mov dword [ebp - 0x34], 0x100
mov dword [ebp - 0x30], 0x79
call fcn.0045206e
jmp case.0x44f276.32857
xor eax, eax
push 1
cmp dword [0x532dd8], eax
mov ecx, 0x532500
sete al
push eax
mov dword [0x532dd8], eax
call fcn.0042fc0b
jmp case.0x44f276.32857
push 4
jmp 0x44fab0
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x240]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x240]
push 0x103
push eax
push 0x91
push dword [0x532da0]
call edi
mov esi, 0x104
lea eax, [ebp - 0x448]
push esi
push eax
push 0x90
push dword [0x532da0]
call edi
lea eax, [ebp - 0x240]
push eax
call fcn.00425711
pop ecx
lea eax, [ebp - 0x13c]
push esi
mov esi, 0x497860
push eax
mov ecx, esi
call fcn.00443f80
lea eax, [ebp - 0x13c]
push eax
call fcn.00426566
mov eax, dword [0x410958]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push SysReAllocString
lea eax, [ebp - 0x30]
push 0x14
push eax
mov edi, 0x410748
push 0x41094c
push edi
call fcn.00424191
lea eax, [ebx + 0x99c]
push eax
lea eax, [ebp - 0x30]
push 0x80802
push eax
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x448]
push eax
push dword [ebx + 4]
push dword [0x532da0]
call fcn.00425857
add esp, 0x38
test eax, eax
je case.0x44f276.32857
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x13c]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
mov dword [ebp + 8], eax
test eax, eax
pop ecx
je 0x44ef75
push 0x40e0ec
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x44eee6
push 0x40e0e4
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x44eeed
mov dword [ebp - 0x1c], 1
push 0x40abf8
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x44ef08
mov dword [ebp - 0x18], 1
mov eax, dword [ebp + 8]
push SysReAllocString
inc eax
push 0xffffffffffffffff
push eax
push 0x41094c
push edi
call fcn.004242ff
add esp, 0x14
cmp dword [ebp - 0x1c], 0
je 0x44ef6f
mov al, byte [0x45f128]
mov ecx, 0x1ff
mov byte [ebp - 0xc48], al
xor eax, eax
lea edi, [ebp - 0xc47]
push 0x800
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc48]
mov ecx, esi
push eax
call fcn.00443fbb
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0xc48]
push eax
call fcn.00426196
pop ecx
pop ecx
jmp 0x44efc9
cmp dword [ebp - 0x18], 0
jne 0x44efb8
mov ecx, 0x4606c8
call fcn.00428f62
test eax, eax
jne 0x44efb8
push 0x4010
push 0x40a37c
push 0xc1
mov dword [0x461540], 0xc3
call fcn.00424a93
pop ecx
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
and dword [0x461540], 0
jmp case.0x44f276.32857
lea eax, [ebp - 0x13c]
mov ecx, 0x475a08
push eax
call fcn.00419c3f
test eax, eax
jne 0x44efee
push 0x10
push 0x40a37c
push 0x92
call fcn.00424a93
pop ecx
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp case.0x44f276.32857
lea eax, [ebp - 0x13c]
push eax
push 0x99
call fcn.00424a93
pop ecx
push eax
lea eax, [ebp - 0xfb8]
push 0x208
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0xfb8]
push 0x40
push 0x40a37c
jmp 0x44efdf
mov ecx, 0x497860
call fcn.00442720
jmp case.0x44f276.32857
mov ecx, 0x497860
call fcn.00442820
jmp case.0x44f276.32857
push 0
mov ecx, 0x475a08
call fcn.0041789d
jmp case.0x44f276.32857
add eax, 0xffff7ff2
mov ecx, 0x475a08
push eax
call fcn.00417960
jmp case.0x44f276.32857
call fcn.00425992
jmp case.0x44f276.32857
push 0x410934
mov ecx, 0x475a08
call fcn.00417ddb
jmp case.0x44f276.32857
push 0x410924
jmp 0x44f078
push 0x410918
jmp 0x44f078
push 0x410904
jmp 0x44f078
push 0x4108f4
jmp 0x44f078
push 0x4108dc
jmp 0x44f078
push 0x4108d0
jmp 0x44f078
push 0x17
jmp 0x44fab0
push 2
jmp 0x44fa5a
mov ecx, 0x475a08
call fcn.004186d1
jmp case.0x44f276.32857
push 3
jmp 0x44fa5a
xor esi, esi
cmp dword [0x473678], esi
je 0x44f10f
push esi
push esi
push 0x93
call fcn.00424a93
pop ecx
mov edi, 0x45f150
push eax
mov ecx, edi
call fcn.00411c78
push dword [ebx + 4]
mov ecx, edi
call fcn.00411ce8
mov ecx, edi
call fcn.00411cd4
mov dword [0x473678], eax
push esi
push esi
push esi
push 1
push 0x4108b0
jmp 0x44f2e9
mov ecx, 0x496d18
call fcn.004514a3
jmp case.0x44f276.32857
push 1
jmp 0x44f13c
cmp dword [ebx + 0x8e4], 0
je 0x44f14b
push 0
mov ecx, 0x497860
call fcn.0044417a
jmp case.0x44f276.32857
mov ecx, 0x497860
call fcn.0044416e
jmp case.0x44f276.32857
xor eax, eax
cmp dword [0x471e28], eax
sete al
mov dword [0x471e28], eax
push 0
mov ecx, 0x4960b0
call fcn.00441b23
jmp case.0x44f276.32857
xor eax, eax
cmp dword [0x471e34], eax
sete al
mov dword [0x471e34], eax
jmp 0x44f16a
xor eax, eax
push 1
cmp dword [0x473660], eax
sete al
push eax
call fcn.00447a33
jmp 0x44f680
xor eax, eax
cmp dword [0x473688], eax
sete al
mov dword [0x473688], eax
jmp case.0x44f276.32857
push dword [ebx + 4]
call fcn.0044668e
jmp 0x44f561
mov esi, 0x532500
mov ecx, esi
call fcn.0042dada
mov ecx, esi
call fcn.00430195
jmp case.0x44f276.32857
push 7
jmp 0x44eb37
cmp dword [0x473670], 0
je case.0x44f276.32857
and dword [0x473670], 0
or dword [0x473928], 0xffffffff
push 0xffffffffffffffff
push 0
mov ecx, 0x496d18
call fcn.00451cc5
jmp case.0x44f276.32857
push 1
push 0x3ec
mov ecx, ebx
call fcn.004523bb
jmp case.0x44f276.32857
push 1
push 0x3eb
jmp 0x44f21b
push 1
push 0x3ea
jmp 0x44f21b
xor eax, eax
push eax
push eax
push eax
push 1
push 0xa3
jmp 0x44f605
mov ecx, 0x80fe
cmp eax, ecx
jg 0x44f9c3
je 0x44f9bc
lea ecx, reloc.KERNEL32.dll_LoadLibraryExA
cmp ecx, 0x89
ja case.0x44f276.32857
movzx ecx, byte [ecx + 0x44fdd6]
jmp dword [ecx*4 + 0x44fc9e]
xor eax, eax
cmp dword [0x473684], eax
je 0x44f292
push 1
mov ecx, ebx
call fcn.0044e5f6
jmp 0x44f2a7
push eax
push eax
push 1
push 1
push 0x40a71c
mov ecx, 0x475a08
call fcn.00415cb4
mov ecx, ebx
call fcn.004503ba
jmp case.0x44f276.32857
push 1
mov ecx, 0x475a08
call fcn.00415f36
jmp case.0x44f276.32857
lea eax, [ebp - 0x201c]
push 0x800
push eax
mov ecx, 0x497860
call fcn.00443fbb
push 0
push 0
push 1
push 1
lea eax, [ebp - 0x201c]
push eax
mov ecx, 0x475a08
call fcn.00415cb4
jmp case.0x44f276.32857
push 0
mov ecx, ebx
call fcn.0044e5f6
jmp case.0x44f276.32857
mov ecx, 0x475a08
call fcn.0041607f
jmp case.0x44f276.32857
mov ecx, 0x475a08
call fcn.00416029
jmp case.0x44f276.32857
mov ecx, 0x475a08
call fcn.0041612a
jmp case.0x44f276.32857
mov ecx, 0x475a08
call fcn.00419a2c
jmp case.0x44f276.32857
push 0
mov ecx, 0x475a08
call fcn.00419857
jmp case.0x44f276.32857
push 1
jmp 0x44f344
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x240]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x240]
push 0x103
push eax
push 0x6f
push dword [0x532da0]
call edi
lea eax, [ebp - 0x448]
push 0x104
push eax
push 0x6e
push dword [0x532da0]
call edi
lea eax, [ebp - 0x240]
push eax
call fcn.00425711
mov al, byte [0x45f128]
push 0x40
mov byte [ebp - 0x13c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x13b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [esp], 0x81800
lea eax, [ebp - 0x13c]
push 0x4108ac
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x448]
push eax
push dword [ebx + 4]
push dword [0x532da0]
call fcn.00425790
add esp, 0x1c
test eax, eax
je case.0x44f276.32857
xor eax, eax
push eax
push eax
push eax
push 2
lea eax, [ebp - 0x13c]
jmp 0x44f2e8
mov esi, 0x497860
mov ecx, esi
call fcn.00444e2e
push eax
mov ecx, esi
call fcn.00445179
jmp case.0x44f276.32857
push 0
mov ecx, 0x475a08
call fcn.00418fca
jmp case.0x44f276.32857
mov ecx, 0x475a08
call fcn.00418e29
jmp case.0x44f276.32857
lea eax, [ebp - 0x344]
push 0x104
push eax
call fcn.004478dc
lea eax, [ebp - 0x344]
push eax
push dword [0x532504]
call fcn.00424ff4
add esp, 0x10
jmp case.0x44f276.32857
lea eax, [ebp - 0x344]
push 0x104
push eax
call fcn.004478dc
pop ecx
lea eax, [ebp - 0x344]
pop ecx
push 0xa
push 0
push 0
push eax
push 0x40a890
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.0x44f276.32857
push 0
mov ecx, 0x475a08
call fcn.00418ac5
jmp case.0x44f276.32857
push 7
jmp 0x44fab0
mov ecx, 0x497860
call fcn.0044524b
jmp case.0x44f276.32857
mov ecx, 0x497860
call fcn.004446dc
jmp case.0x44f276.32857
mov ecx, 0x475a08
call fcn.00419923
jmp case.0x44f276.32857
xor ebx, ebx
mov edi, 0x475a08
cmp dword [0x532dd8], ebx
je 0x44f503
push 1
push ebx
mov ecx, 0x532500
call fcn.0042fc0b
jmp 0x44f50a
mov ecx, edi
call fcn.004160d5
mov ecx, 0x4615d8
call fcn.004338c3
mov eax, dword [0x474d48]
cmp eax, ebx
je 0x44f52a
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x474d48], ebx
push 0xffffffffffffffff
mov ecx, edi
call fcn.00415adf
mov ecx, 0x496d18
jmp 0x44f2a9
mov ecx, 0x496d18
call fcn.00454bb8
jmp case.0x44f276.32857
mov ecx, 0x475a08
call fcn.00416258
jmp case.0x44f276.32857
push eax
call fcn.00452e1a
pop ecx
jmp case.0x44f276.32857
push 0
call fcn.0043d882
neg eax
sbb eax, eax
inc eax
push eax
push dword [ebx + 4]
call fcn.0043daf0
add esp, 0xc
jmp case.0x44f276.32857
mov dword [0x473eac], 1
call fcn.004468a3
jmp case.0x44f276.32857
call fcn.00414cb2
test eax, eax
je 0x44f5d0
push 0x24
push 0x40a37c
push 0xad
call fcn.00424a93
pop ecx
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne case.0x44f276.32857
call fcn.00414da3
jmp case.0x44f276.32857
push 0x40
push 0x40a37c
push 0xb0
call fcn.00424a93
pop ecx
push eax
push dword [ebx + 4]
jmp 0x44efe3
xor eax, eax
push eax
push eax
push eax
push 1
push 0xa0
jmp 0x44f605
xor eax, eax
push eax
push eax
push eax
push 1
push 0x9f
call fcn.00424a93
pop ecx
jmp 0x44f2e8
xor eax, eax
push eax
push eax
push eax
push 1
push 0x410894
jmp 0x44f2e9
xor eax, eax
mov ecx, 0x4960b0
cmp dword [0x473668], eax
sete al
mov dword [0x473668], eax
call fcn.0044180c
jmp case.0x44f276.32857
xor eax, eax
cmp dword [0x471e40], eax
sete al
mov dword [0x471e40], eax
jmp case.0x44f276.32857
xor eax, eax
cmp dword [0x471e54], eax
sete al
mov dword [0x471e54], eax
jmp case.0x44f276.32857
push 0
push dword [ebx + 4]
call fcn.0043e7f1
jmp 0x44f680
push 0
push dword [ebx + 4]
call fcn.0043ead3
pop ecx
jmp 0x44f561
xor eax, eax
cmp dword [0x473d80], eax
sete al
mov dword [0x473d80], eax
jmp case.0x44f276.32857
push 2
pop eax
cmp dword [0x473670], eax
je case.0x44f276.32857
or dword [0x473928], 0xffffffff
push 0xffffffffffffffff
mov dword [0x473670], eax
push eax
jmp 0x44f205
push 1
push 0x3e9
jmp 0x44f21b
push 1
push 0x3ed
jmp 0x44f21b
mov ecx, 0x532500
call fcn.00430029
jmp case.0x44f276.32857
mov ecx, 0x532500
call fcn.0042ffd3
jmp case.0x44f276.32857
push 0
lea ecx, [ebx + 0xae4]
mov dword [ebx + 0xafc], 0xba
call fcn.00447f46
mov esi, 0x497860
mov ecx, esi
call fcn.00444e2e
push eax
mov ecx, esi
call fcn.00443e0d
mov ecx, 0x496d18
call fcn.00452aea
jmp case.0x44f276.32857
mov dword [ebx + 0xae0], 0x78
and dword [ebx + 0xadc], 0
push 0
lea ecx, [ebx + 0xac8]
call fcn.00447f46
jmp case.0x44f276.32857
mov dword [ebx + 0xb18], 0x78
and dword [ebx + 0xb14], 0
push 0
lea ecx, [ebx + 0xb00]
jmp 0x44f747
xor eax, eax
mov ecx, ebx
cmp dword [0x471e00], eax
sete al
mov dword [0x471e00], eax
call fcn.00448d2d
jmp case.0x44f276.32857
push 0
push 0x41088c
mov ecx, 0x475a08
call fcn.00418bde
jmp case.0x44f276.32857
push 0
push 0x410884
jmp 0x44f78f
push 0
push 0x41087c
jmp 0x44f78f
push 0
push 0x40a824
jmp 0x44f78f
push 0
push 0x410870
jmp 0x44f78f
push 0
push 0x410864
jmp 0x44f78f
push 0
push 0x410858
jmp 0x44f78f
push 0
push 0x41084c
jmp 0x44f78f
push 0xffffffffffffffff
jmp 0x44ecd7
push 2
mov ecx, 0x532500
call fcn.0045c078
jmp case.0x44f276.32857
push 3
jmp 0x44f7e6
call fcn.0041208f
jmp case.0x44f276.32857
push 0
jmp 0x44f809
push 1
call fcn.00411f4f
jmp 0x44f561
push dword [ebx + 4]
call fcn.004134b2
jmp 0x44f561
mov ecx, ebx
call fcn.0044e490
test byte [0x473658], 1
je 0x44f83c
and dword [0x473658], 0xfffffffe
jmp case.0x44f276.32857
or dword [0x473658], 1
jmp case.0x44f276.32857
mov ecx, ebx
call fcn.0044e490
test byte [0x473658], 4
je 0x44f864
and dword [0x473658], 0xfffffffb
jmp case.0x44f276.32857
or dword [0x473658], 4
jmp case.0x44f276.32857
mov ecx, ebx
call fcn.0044e490
test byte [0x473658], 8
je 0x44f88c
and dword [0x473658], 0xfffffff7
jmp case.0x44f276.32857
or dword [0x473658], 8
jmp case.0x44f276.32857
mov ecx, ebx
call fcn.0044e490
test byte [0x473658], 2
je 0x44f8b4
and dword [0x473658], 0xfffffffd
jmp case.0x44f276.32857
or dword [0x473658], 2
jmp case.0x44f276.32857
mov ecx, ebx
call fcn.0044e490
test byte [0x473658], 0x10
je 0x44f8dc
and dword [0x473658], 0xffffffef
jmp case.0x44f276.32857
or dword [0x473658], 0x10
jmp case.0x44f276.32857
push 0
mov ecx, 0x475a08
call fcn.00416151
jmp case.0x44f276.32857
push dword [0x473b58]
lea eax, [ebp - 0xdb0]
push 0x410848
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0xdb0]
lea ecx, [ebp + 8]
push eax
call fcn.0042bc85
and dword [ebp - 4], 0
push 0xb9
call fcn.00424a93
pop ecx
push eax
lea ecx, [ebp + 8]
push dword [ebx + 4]
call fcn.0042bd7a
cmp eax, 1
jne 0x44f95d
lea ecx, [ebp + 8]
call fcn.0042bd9b
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [0x473b58], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0042bcde
jmp case.0x44f276.32857
push 4
jmp 0x44eb37
push 0
push 0
push 0x410824
mov ecx, ebx
call fcn.0044fed5
jmp case.0x44f276.32857
push 0
push 0
push 0x4107f8
jmp 0x44f97e
push 0
push 0
push 0x4107d0
jmp 0x44f97e
push 0
push 0
push 0x4107ac
jmp 0x44f97e
push 0x410824
mov ecx, ebx
call fcn.0044fe60
jmp case.0x44f276.32857
push 0xa
jmp 0x44fab0
mov ecx, 0xe124
cmp eax, ecx
jg 0x44fa66
je 0x44fa04
sub eax, 0xe106
je 0x44f9fd
dec eax
je case.0x44eb2e.12387
sub eax, 0x1b
je 0x44f9ef
dec eax
jne case.0x44f276.32857
push 0xb
jmp 0x44fab0
push 0xc
jmp 0x44fab0
push 6
jmp 0x44fab0
push 8
jmp 0x44fab0
mov ecx, 0x496d18
call fcn.00451113
test eax, eax
je 0x44fa58
mov al, byte [0x45f128]
mov ecx, esi
mov byte [ebp - 0xc48], al
xor eax, eax
lea edi, [ebp - 0xc47]
push 0x800
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc48]
push eax
push dword [ebx + 0xb20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0
lea eax, [ebp - 0xc48]
push eax
mov ecx, ebx
call fcn.00450ce9
jmp case.0x44f276.32857
push 1
mov ecx, 0x475a08
call fcn.004177df
jmp case.0x44f276.32857
sub eax, 0xe125
je 0x44faae
sub eax, 5
je 0x44faaa
sub eax, 0x16
je 0x44fa99
dec eax
jne case.0x44f276.32857
xor esi, esi
push esi
push esi
push 0x1f
push dword [0x497604]
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
mov ecx, 0x532500
call fcn.0042ff34
jmp case.0x44f276.32857
push 0x4107a0
mov ecx, 0x532500
call fcn.0042fbb3
jmp case.0x44f276.32857
push 0x11
jmp 0x44fab0
push 0xd
mov ecx, 0x475a08
call fcn.0041787f
push 0
mov ecx, 0x45f130
call fcn.0041186f
push 0
mov ecx, 0x474d58
call fcn.00429f00
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4