Function at 0x425d40
Capabilities:
Check for time delay via gettickcount
Delete file
Empty the recycle bin
Find taskbar
Move file
Print debug messages
Resolve function by parsing pe exports
Set current directory
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc88
push ebx
push ebp
push esi
mov esi, dword [0x4d78c8]
push edi
mov edi, ecx
mov cl, byte [edi]
movzx eax, cl
add eax, 0xfffffff9
cmp eax, 0x52
ja case.0x425d69.8
jmp dword [eax*4 + 0x427a50]
xor edx, edx
mov eax, 2
cmp cl, 0x22
push 0
push dword [esi + 0x88]
cmove edx, eax
mov ecx, dword [0x4dcca0]
call fcn.0040eaa0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [esi + 0x88], 3
push 0
sete al
xor edx, edx
lea eax, [eax*2 + 1]
push eax
jmp 0x425d85
push 0
push 2
xor edx, edx
jmp 0x425d85
push 0
push 0
xor edx, edx
jmp 0x425d85
cmp byte [edi + 1], 1
jbe 0x425e1e
xor eax, eax
xor esi, esi
mov word [esp + 0x498], ax
nop dword [eax]
push dword [esi*4 + 0x4dcca0]
lea eax, [esp + 0x49c]
push 0x4cbd20
push 0x400
push eax
call fcn.0047a830
movzx eax, byte [edi + 1]
inc esi
add esp, 0x10
cmp esi, eax
jl 0x425de0
lea ecx, [esp + 0x498]
call fcn.004108f0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4dcca0]
call fcn.004108f0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4b431c
push 0x4b431c
push dword [0x4dccb8]
push dword [0x4dccb4]
push dword [0x4dccb0]
push dword [0x4dccac]
push dword [0x4dcca8]
mov edx, dword [0x4dcca0]
push dword [0x4dcca4]
call fcn.00410b50
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x4dccb4]
push dword [0x4dccac]
push dword [0x4dccb8]
push dword [0x4dccb0]
push 0x4b431c
push 0x4b431c
jmp 0x425e53
push 0x4b431c
push 0x4b431c
push dword [0x4dccac]
mov edx, 0x4b431c
push dword [0x4dcca8]
push 0x4b431c
push 0x4b431c
push dword [0x4dcca4]
push dword [0x4dcca0]
call fcn.00410b50
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x4dcca4]
mov ecx, edi
push dword [0x4dcca0]
call fcn.00452ec0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4dcca0]
test eax, eax
je 0x425f0a
push ecx
push eax
mov ecx, 0x4dd448
call fcn.00450bb0
mov eax, dword [0x4dcca4]
test eax, eax
je 0x425f1f
push ecx
push eax
mov ecx, 0x4dd454
call fcn.00450bb0
mov eax, dword [0x4dcca8]
test eax, eax
je case.0x42753a.3
push ecx
push eax
mov ecx, 0x4dd460
call fcn.00450bb0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x1a3
jmp 0x425f55
push 0
push 0x1a0
push 0x111
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [0x4d78c8]
mov ecx, dword [eax + 0x64]
cmp ecx, 0xffffffff
jle case.0x42753a.3
mov edx, 1
call fcn.00401950
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4dcca0]
mov ebx, 0x10
cmp word [eax], 0
je 0x426013
push 0x4cbd28
push eax
call fcn.004979b3
add esp, 8
test eax, eax
je 0x426013
cmp byte [edi + 1], 0
ja 0x425fcd
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov ebx, dword [esp + 0x10]
jmp 0x425ff1
mov eax, dword [edi + 8]
cmp byte [eax + 1], 0
jne 0x425fe4
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x425fe4
call fcn.0044f5c0
jmp 0x425fef
mov ecx, dword [0x4dcca0]
call fcn.0047b060
mov ebx, eax
test ebx, ebx
jne 0x426013
mov byte [esi + 0x96], bl
mov al, 1
mov ebx, 5
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x53], al
lea eax, [ebx - 4]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x96], 1
xor al, al
mov dword [esi + 0x44], 0xffffffff
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x53], al
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [0x4dcca0]
test ebx, ebx
je case.0x42753a.3
cmp word [ebx], 0
je case.0x42753a.3
push str.Priority
push ebx
call fcn.004979b3
add esp, 8
test eax, eax
jne 0x4260c3
cmp byte [edi + 1], 1
ja 0x426083
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
mov dword [esi + 0x3c], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
cmp byte [eax + 0x1d], 0
jne 0x4260a8
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0x4260a8
call fcn.0044f5c0
mov dword [esi + 0x3c], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4dcca4]
call fcn.0047b060
mov dword [esi + 0x3c], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push str.Interrupt
push ebx
call fcn.004979b3
add esp, 8
test eax, eax
jne 0x426191
mov ecx, dword [0x4dcca4]
cmp word [ecx], ax
je 0x42611c
cmp byte [edi + 1], 1
ja 0x4260f9
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
jmp 0x426117
mov eax, dword [edi + 8]
cmp byte [eax + 0x1d], 0
jne 0x426112
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x426112
mov ecx, eax
call fcn.0044f5c0
jmp 0x426117
call fcn.0047b060
mov dword [0x4dd440], eax
mov edx, dword [0x4dcca8]
cmp word [edx], 0
je case.0x42753a.3
cmp byte [edi + 1], 2
ja 0x426151
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
mov dword [0x4dd43c], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
cmp byte [eax + 0x39], 0
jne 0x426178
mov ecx, dword [eax + 0x48]
test ecx, ecx
je 0x426178
call fcn.0044f5c0
mov dword [0x4dd43c], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.0047b060
mov dword [0x4dd43c], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push str.NoTimers
push ebx
call fcn.004979b3
add esp, 8
test eax, eax
jne case.0x42753a.3
mov edx, dword [0x4dcca4]
cmp word [edx], ax
je 0x4261ef
cmp byte [edi + 1], 1
jbe 0x4261da
mov eax, dword [edi + 8]
cmp byte [eax + 0x1d], 0
jne 0x4261cf
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0x4261cf
call fcn.0044f5c0
jmp 0x4261d6
mov ecx, edx
call fcn.0047b060
or eax, edx
jne 0x4261ef
mov al, 1
mov byte [esi + 0x95], al
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov byte [esi + 0x95], al
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push dword [0x4dcca0]
mov ecx, 0x4dcd68
call fcn.0041f7d0
test eax, eax
je case.0x425d69.8
push dword [0x4dccb0]
mov ecx, eax
push dword [0x4dccac]
push dword [0x4dcca8]
push dword [0x4dcca4]
call fcn.004809f0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [0x4dcca0]
cmp word [ebx], 0
je 0x42627d
mov esi, dword [0x4dcda4]
test esi, esi
je 0x42627d
nop dword [eax + eax]
push ebx
push dword [esi + 4]
call fcn.004979b3
add esp, 8
test eax, eax
je 0x4262ab
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x426260
mov ebx, dword [0x4dcca0]
test ebx, ebx
mov ecx, 0x4b431c
cmovne ecx, ebx
cmp byte [0x4dd434], 0
je 0x4262ec
push edi
push 9
push ecx
push str.Parameter_1_invalid.
mov ecx, 0x4dcd68
call fcn.00428b60
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4dcca4]
cmp word [eax], 0
je 0x4262da
push 0x4c6d58
push eax
call fcn.004979b3
add esp, 8
test eax, eax
jne 0x4262da
mov al, 1
mov ecx, esi
push eax
call fcn.00480ff0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, esi
push eax
call fcn.00480ff0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x4dd437], 0
je 0x426317
push dword [edi + 4]
movzx eax, word [edi + 2]
push eax
push ecx
mov ecx, 0x4dcd68
push str.Parameter_1_invalid.
call fcn.00428a60
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push ecx
push 9
push str.Parameter_1_invalid.
mov ecx, 0x4dcd68
call fcn.00428bd0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [0x4dcca0]
cmp word [ebx], 0
je 0x42627d
mov esi, dword [0x4dcda4]
mov dword [esp + 0x1c], esi
test esi, esi
je 0x42627d
push ebx
push dword [esi + 4]
call fcn.004979b3
add esp, 8
test eax, eax
je 0x426374
mov esi, dword [esi + 0x10]
mov dword [esp + 0x1c], esi
test esi, esi
jne 0x426354
jmp 0x426277
mov eax, dword [0x4dcca4]
cmp word [eax], 0
je 0x4263ca
push 0x4cbd30
push eax
call fcn.004979b3
add esp, 8
test eax, eax
jne 0x4263a8
push eax
push 5
mov ecx, esi
call fcn.00480d50
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4dcca4]
cmp word [eax], 0
je 0x4263ca
push 0x4c6d58
push eax
call fcn.004979b3
add esp, 8
mov byte [esp + 0x18], 1
test eax, eax
je 0x4263cf
mov byte [esp + 0x18], 0
cmp dword [esi + 8], 0
je case.0x42753a.3
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
mov ecx, esi
mov eax, dword [0x4d78c8]
add eax, 0x58
push eax
push edi
call fcn.00481200
cmp byte [esi], 0
mov dword [esp + 0x20], eax
je 0x426404
test eax, eax
jne 0x42640c
jmp 0x426498
test eax, eax
jne 0x426498
test edi, edi
je 0x426498
push 0
push 0
push 0x10
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov edx, 1
mov dword [esp + 0x10], eax
mov ecx, 0x8000012f
call fcn.00401950
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push edi
call ebp
test eax, eax
je 0x42647d
mov eax, dword [esp + 0x10]
add eax, 0x1f4
mov dword [esp + 0x10], eax
mov esi, eax
call ebx
mov ecx, esi
sub ecx, eax
cmp ecx, 5
jle 0x426479
mov edx, 1
mov ecx, 0x8000012f
call fcn.00401950
push edi
call ebp
test eax, eax
jne 0x426458
mov esi, dword [esp + 0x1c]
mov eax, dword [0x4d78c8]
mov ecx, dword [eax + 0x64]
cmp ecx, 0xffffffff
jle 0x426494
mov edx, 1
call fcn.00401950
mov eax, dword [esp + 0x20]
cmp byte [esi], 0
mov ecx, esi
je 0x4264bb
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x20]
call fcn.00480e00
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esp + 0x18]
call fcn.00480ff0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4dcca4]
cmp word [ecx], 0
je 0x426516
cmp byte [edi + 1], 1
ja 0x4264f2
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov esi, dword [esp + 0x10]
jmp 0x42651b
mov eax, dword [edi + 8]
cmp byte [eax + 0x1d], 0
jne 0x42650d
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x42650d
mov ecx, eax
call fcn.0044f5c0
mov esi, eax
jmp 0x42651b
call fcn.0047b060
mov esi, eax
jmp 0x42651b
mov esi, 0x96
mov edx, dword [0x4dcca0]
cmp word [edx], 0
je 0x426595
cmp byte [edi + 1], 0
ja 0x42654f
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_Beep]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
cmp byte [eax + 1], 0
jne 0x426579
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x426579
call fcn.0044f5c0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_Beep]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.0047b060
push esi
push eax
call dword [sym.imp.KERNEL32.dll_Beep]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x20b
push esi
push eax
call dword [sym.imp.KERNEL32.dll_Beep]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4dcca4]
cmp word [eax], 0
je 0x4265d1
push 0x4cbd34
push eax
call fcn.004979b3
add esp, 8
test eax, eax
je 0x4265fb
mov eax, dword [0x4dcca4]
push 0x4c6414
push eax
call fcn.004979b3
add esp, 8
test eax, eax
je 0x4265fb
xor al, al
mov ecx, edi
push eax
push dword [0x4dcca0]
call fcn.0043c4c0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, edi
push eax
push dword [0x4dcca0]
call fcn.0043c4c0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ebp, dword [0x4dcca0]
movzx eax, word [ebp]
test ax, ax
jne 0x426678
cmp byte [0x4dd434], 0
mov ecx, 0x4dcd68
je 0x42664a
push edi
push 9
push 0x4b431c
push str.Parameter_1_invalid.
call fcn.00428b60
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x4dd437], 0
je 0x426ccc
push dword [edi + 4]
movzx eax, word [edi + 2]
push eax
push 0x4b431c
push str.Parameter_1_invalid.
call fcn.00428a60
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, ebp
mov esi, eax
nop dword [eax]
mov ecx, 0x4ce26c
mov edx, 0x3f
nop word [eax + eax]
cmp si, dx
je 0x4266ed
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x426690
movzx eax, word [ebx + 2]
add ebx, 2
mov esi, eax
test ax, ax
jne 0x426680
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov ecx, eax
mov eax, dword [0x4d78c8]
mov dword [eax + 0x38], ecx
jne case.0x42753a.3
push ecx
mov ecx, 0x4dcd68
call fcn.00428850
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x43dfd0
push 0
push 1
push ebp
mov ecx, edi
call fcn.0043e560
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4dcca0]
test eax, eax
je 0x4267dc
cmp word [eax], 0
je 0x4267dc
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0xdc]
push ecx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [esp + 0xd8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426742
sub ecx, edx
sar ecx, 1
je 0x426768
cmp word [esp + ecx*2 + 0xd6], 0x5c
jne 0x426768
xor eax, eax
mov word [esp + ecx*2 + 0xd6], ax
lea ecx, [esp + 0xd8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426772
xor eax, eax
mov dword [esp + 0x2c], 3
sub ecx, edx
mov dword [esp + 0x3e], eax
sar ecx, 1
mov dword [esp + 0x42], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x28], eax
mov word [esp + ecx*2 + 0xda], ax
mov dword [esp + 0x34], eax
lea eax, [esp + 0xd8]
mov dword [esp + 0x30], eax
mov eax, 0x4054
mov word [esp + 0x38], ax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je case.0x42753a.3
push 0
push edi
push 0x4b431c
jmp 0x426907
cmp byte [0x4dd434], 0
mov ecx, 0x4dcd68
je 0x426804
push edi
push 9
push 0x4b431c
push str.Parameter_1_required
call fcn.00428b60
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x4dd437], 0
je 0x42682e
push dword [edi + 4]
movzx eax, word [edi + 2]
push eax
push 0x4b431c
push str.Parameter_1_required
call fcn.00428a60
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0x4b431c
push 9
push str.Parameter_1_required
call fcn.00428bd0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4dcca0]
xor ecx, ecx
push 7
cmp word [eax], cx
cmovne ecx, eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
jmp 0x4267c7
push dword [0x4dcca8]
mov ecx, edi
push dword [0x4dcca4]
push dword [0x4dcca0]
call fcn.0043dfe0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi + 1], 2
ja 0x42689b
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov ecx, dword [esp + 0x10]
jmp 0x4268bf
mov eax, dword [edi + 8]
cmp byte [eax + 0x39], 0
jne 0x4268b2
mov ecx, dword [eax + 0x48]
test ecx, ecx
je 0x4268b2
call fcn.0044f5c0
jmp 0x4268bd
mov ecx, dword [0x4dcca8]
call fcn.0047b060
mov ecx, eax
cmp byte [edi], 0x3d
lea eax, [esi + 0x38]
mov edx, dword [0x4dcca4]
push eax
sete al
cmp ecx, 1
mov ecx, dword [0x4dcca0]
movzx eax, al
push eax
sete al
movzx eax, al
push eax
call fcn.00454280
add esp, 0xc
test eax, eax
je case.0x42753a.3
push 0xa
lea ecx, [esp + 0x2c]
push ecx
push eax
call fcn.0049993e
add esp, 0xc
push 0
push edi
push eax
push 0
push str.Failed
mov ecx, 0x4dcd68
call fcn.004287a0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi + 1], 2
ja 0x426935
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov ecx, dword [esp + 0x10]
jmp 0x426959
mov eax, dword [edi + 8]
cmp byte [eax + 0x39], 0
jne 0x42694c
mov ecx, dword [eax + 0x48]
test ecx, ecx
je 0x42694c
call fcn.0044f5c0
jmp 0x426957
mov ecx, dword [0x4dcca8]
call fcn.0047b060
mov ecx, eax
xor eax, eax
cmp ecx, 1
push 0
sete al
mov edx, dword [0x4dcca4]
mov ecx, dword [0x4dcca0]
push eax
call fcn.00453f00
add esp, 8
test al, al
jne case.0x42753a.3
push 0
push edi
push 0x4b431c
jmp 0x426907
mov edx, dword [0x4dcca8]
movzx eax, word [edx]
mov ebx, eax
test eax, 0xffffff80
je 0x4269a3
xor esi, esi
jmp 0x4269b4
push eax
call fcn.00498650
mov edx, dword [0x4dcca8]
add esp, 4
mov esi, eax
mov eax, ebx
and eax, 0xffdf
test esi, esi
movzx ecx, ax
mov eax, ebx
cmove ecx, eax
cmp cx, 0x52
jne 0x4269f1
push dword [0x4dcca4]
push dword [0x4dcca0]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne case.0x42753a.3
push eax
push edi
push 0x4b431c
jmp 0x426907
cmp byte [edi + 1], 2
ja 0x426a0b
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
push 1
jmp 0x426963
mov eax, dword [edi + 8]
cmp byte [eax + 0x39], 0
jne 0x426a27
mov ecx, dword [eax + 0x48]
test ecx, ecx
je 0x426a27
call fcn.0044f5c0
push 1
jmp 0x426963
mov ecx, edx
call fcn.0047b060
push 1
jmp 0x426963
mov ecx, dword [0x4dcca0]
xor edx, edx
call fcn.0043d1d0
mov bl, al
call dword [sym.imp.KERNEL32.dll_GetLastError]
test bl, bl
jmp 0x4266ca
mov eax, dword [0x4dcca0]
cmp word [eax], 0
je 0x4267cf
cmp byte [edi + 1], 1
ja 0x426a75
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
jmp 0x426a97
mov eax, dword [edi + 8]
cmp byte [eax + 0x1d], 0
jne 0x426a8c
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0x426a8c
call fcn.0044f5c0
jmp 0x426a97
mov ecx, dword [0x4dcca4]
call fcn.0047b060
mov ecx, dword [0x4dcca0]
cmp eax, 1
sete dl
call fcn.00454180
test al, al
je 0x4267cf
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4dcca8]
call fcn.00414230
mov ecx, dword [0x4dcca4]
mov edx, eax
cmp word [ecx], 0
jne 0x426ae8
mov eax, dword [esi + 8]
lea ecx, [eax + 0x250]
test eax, eax
jne 0x426ae8
mov ecx, 0x4b431c
mov eax, edx
and edx, 0xfffffffb
shr eax, 2
and al, 1
movzx eax, al
push eax
push edx
push ecx
push dword [0x4dcca0]
mov ecx, edi
call fcn.0043e290
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4dccac]
call fcn.00414230
mov ebx, dword [0x4dcca4]
mov ebp, eax
cmp word [ebx], 0
jne 0x426b3a
mov ebx, dword [esi + 8]
test ebx, ebx
je 0x426b35
add ebx, 0x250
jmp 0x426b3a
mov ebx, 0x4b431c
mov eax, dword [0x4dcca8]
push 0x3f
movzx esi, word [eax]
mov eax, dword [0x4dcca0]
push eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x60]
push eax
call fcn.0049fc44
xor eax, eax
mov word [esp + 0x5c], si
add esp, 0xc
mov word [esp + 0xd6], ax
cmp word [esp + 0x58], ax
je 0x426bbd
push eax
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x5c]
call fcn.0047a3d0
add esp, 4
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x426baa
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
jne 0x426bc8
mov eax, dword [esp + 0x10]
mov ecx, 0x4b431c
test eax, eax
cmovne ecx, eax
jmp 0x426287
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp word [ebx], 0
jne 0x426c3a
cmp byte [0x4dd434], 0
mov ecx, 0x4dcd68
je 0x426bf6
push edi
push 9
push 0x4b431c
push str.Parameter_2_invalid.
call fcn.00428b60
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x4dd437], 0
je 0x426c20
push dword [edi + 4]
movzx eax, word [edi + 2]
push eax
push 0x4b431c
push str.Parameter_2_invalid.
call fcn.00428a60
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0x4b431c
push 9
push str.Parameter_2_invalid.
call fcn.00428bd0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
mov ecx, edi
push eax
mov eax, ebp
and ebp, 0xfffffffb
shr eax, 2
push 0x43ed20
and al, 1
movzx eax, al
push eax
push ebp
push ebx
call fcn.0043e560
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x4dcca0]
movzx eax, word [esi]
test ax, ax
je 0x426c9c
cmp word [esi + 2], 0x3a
jne 0x426c9c
cmp word [esi + 4], 0
jne 0x426c9c
mov word [esp + 0x10], ax
lea esi, [esp + 0x10]
xor eax, eax
mov dword [esp + 0x12], 0x5c003a
mov word [esp + 0x16], ax
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x426622
cmp byte [0x4dd434], 0
je case.0x42753a.3
mov ecx, esi
call fcn.0043c6c0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0x4b431c
push 9
push str.Parameter_1_invalid.
call fcn.00428bd0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x4dccc0]
mov ecx, edi
push dword [0x4dccbc]
push dword [0x4dccb8]
push dword [0x4dccb4]
push dword [0x4dccb0]
push dword [0x4dccac]
push dword [0x4dcca8]
push dword [0x4dcca4]
push dword [0x4dcca0]
call fcn.00453b30
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
xor dl, dl
mov ecx, 4
call fcn.00435f40
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4dcca0]
cmp word [ecx], 0
jne 0x426d5f
xor dl, dl
mov ecx, 1
call fcn.00435f40
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi + 0x9a], 0
je 0x426d89
mov eax, dword [0x4dc01c]
test eax, eax
jle 0x426d74
dec eax
jmp 0x426d79
mov eax, 0x18f
mov dword [0x4dc01c], eax
mov dword [eax*4 + 0x4dc660], 0
call fcn.0044f2e0
test eax, eax
setne al
mov byte [esi + 0x9a], al
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
xor dl, dl
mov ecx, 2
call fcn.00435f40
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
xor dl, dl
mov ecx, 3
call fcn.00435f40
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x4dccac]
mov ecx, edi
push dword [0x4dcca8]
push dword [0x4dcca4]
push dword [0x4dcca0]
call fcn.0042be70
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [0x4dcca4]
lea eax, [esp + 0xe8]
mov esi, dword [0x4dcca0]
push 0x3ac
push 0
push eax
call fcn.004956d0
mov eax, dword [0x4dbc70]
lea edx, [esp + 0xe4]
mov ecx, dword [0x4dcca8]
add esp, 0xc
mov dword [esp + 0xd8], 0x3bc
mov dword [esp + 0xe0], 0x404
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe4], 0x10
call fcn.0042c200
test eax, eax
je case.0x425d69.8
cmp word [edi], 0
je 0x426e73
cmp word [esi], 0
mov eax, 0x4cc164
cmovne eax, esi
mov esi, eax
mov al, byte [esp + 0x47c]
test al, 4
je 0x426ea6
test al, 0x20
je 0x426e8f
mov ecx, dword [0x4dbcb4]
mov eax, dword [0x4dd46c]
jmp 0x426e9a
mov ecx, dword [0x4dbd58]
mov eax, dword [0x4dd470]
test eax, eax
cmovne ecx, eax
mov dword [esp + 0x490], ecx
push 0x3f
lea eax, [esp + 0x400]
push edi
push eax
call fcn.0049fc44
add esp, 0xc
xor eax, eax
mov word [esp + 0x47a], ax
lea eax, [esp + 0x1f8]
push 0xff
push esi
push eax
call fcn.0049fc44
mov esi, dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
add esp, 0xc
xor eax, eax
mov word [esp + 0x3f6], ax
lea eax, [esp + 0xd8]
push eax
push 1
call esi
test eax, eax
jne case.0x42753a.3
test byte [esp + 0x47c], 4
je case.0x42753a.3
and dword [esp + 0x47c], 0xfffffffb
lea eax, [esp + 0xd8]
push eax
push 1
call esi
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4dcca4]
mov edx, str.Screen
mov ecx, dword [0x4dcca0]
cmp word [eax], 0
cmovne edx, eax
call fcn.00437d30
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi + 1], 0
ja 0x426f65
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
jmp 0x426f87
mov eax, dword [edi + 8]
cmp byte [eax + 1], 0
jne 0x426f7c
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x426f7c
call fcn.0044f5c0
jmp 0x426f87
mov ecx, dword [0x4dcca0]
call fcn.0047b060
mov byte [esi + 0x97], al
cmp al, 0x64
jbe case.0x42753a.3
mov byte [esi + 0x97], 2
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4dcca0]
call fcn.00437e40
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi + 1], 0
ja 0x426fe4
mov edx, dword [0x4dcca0]
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
mov ecx, eax
call fcn.00437f10
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
cmp byte [eax + 1], 0
jne 0x42700e
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x42700e
call fcn.0044f5c0
mov edx, dword [0x4dcca0]
mov ecx, eax
call fcn.00437f10
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4dcca0]
call fcn.0047b060
mov edx, dword [0x4dcca0]
mov ecx, eax
call fcn.00437f10
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push str.Play
push dword [0x4dcca8]
call fcn.004979b3
mov ecx, dword [0x4dcca0]
add esp, 8
test eax, eax
jne 0x4270f8
cmp word [ecx], ax
je 0x427089
cmp byte [edi + 1], al
ja 0x427068
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
jmp 0x427086
mov eax, dword [edi + 8]
cmp byte [eax + 1], 0
jne 0x427081
mov eax, dword [eax + 0x10]
test eax, eax
je 0x427081
mov ecx, eax
call fcn.0044f5c0
jmp 0x427086
call fcn.0047b060
mov dword [esi + 0x70], eax
mov edx, dword [0x4dcca4]
cmp word [edx], 0
je case.0x42753a.3
cmp byte [edi + 1], 1
ja 0x4270bc
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
mov dword [esi + 0x78], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
cmp byte [eax + 0x1d], 0
jne 0x4270e1
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0x4270e1
call fcn.0044f5c0
mov dword [esi + 0x78], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.0047b060
mov dword [esi + 0x78], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp word [ecx], 0
je 0x427134
cmp byte [edi + 1], 0
ja 0x427113
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
jmp 0x427131
mov eax, dword [edi + 8]
cmp byte [eax + 1], 0
jne 0x42712c
mov eax, dword [eax + 0x10]
test eax, eax
je 0x42712c
mov ecx, eax
call fcn.0044f5c0
jmp 0x427131
call fcn.0047b060
mov dword [esi + 0x6c], eax
mov edx, dword [0x4dcca4]
cmp word [edx], 0
je case.0x42753a.3
cmp byte [edi + 1], 1
ja 0x427167
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
mov dword [esi + 0x74], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
cmp byte [eax + 0x1d], 0
jne 0x42718c
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0x42718c
call fcn.0044f5c0
mov dword [esi + 0x74], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.0047b060
mov dword [esi + 0x74], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push str.Play
push dword [0x4dcca4]
call fcn.004979b3
mov cl, byte [edi + 1]
add esp, 8
test eax, eax
jne 0x427227
test cl, cl
jne 0x4271e1
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
mov dword [esi + 0x80], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
cmp byte [eax + 1], 0
jne 0x427209
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x427209
call fcn.0044f5c0
mov dword [esi + 0x80], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4dcca0]
call fcn.0047b060
mov dword [esi + 0x80], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
test cl, cl
jne 0x427248
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
mov dword [esi + 0x7c], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
cmp byte [eax + 1], 0
jne 0x42726d
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x42726d
call fcn.0044f5c0
mov dword [esi + 0x7c], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4dcca0]
call fcn.0047b060
mov dword [esi + 0x7c], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi + 1], 0
ja 0x4272ab
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
mov dword [esi + 0x64], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
cmp byte [eax + 1], 0
jne 0x4272d0
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4272d0
call fcn.0044f5c0
mov dword [esi + 0x64], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4dcca0]
call fcn.0047b060
mov dword [esi + 0x64], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi + 1], 0
ja 0x42730e
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
mov dword [esi + 0x68], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
cmp byte [eax + 1], 0
jne 0x427333
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x427333
call fcn.0044f5c0
mov dword [esi + 0x68], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4dcca0]
call fcn.0047b060
mov dword [esi + 0x68], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x4dcca0]
test esi, esi
je 0x4273a9
cmp word [esi], 0
je 0x4273a9
push ecx
push 0
push 1
mov edx, 1
mov ecx, esi
call fcn.0047a5e0
add esp, 0xc
test eax, eax
je 0x4273bb
mov ecx, esi
call fcn.0047b060
cmp eax, 0xffffffff
je 0x4273a9
test eax, eax
je 0x42738d
cmp eax, 1
jne 0x4273bb
jmp 0x427392
mov eax, 2
xor ecx, ecx
cmp eax, 1
movzx eax, byte [0x4dbea0]
sete cl
cmp ecx, eax
je case.0x42753a.3
call fcn.00428480
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4dcca0]
mov ecx, 0x4b431c
test eax, eax
cmovne ecx, eax
jmp 0x426287
mov esi, dword [0x4dcca0]
test esi, esi
je 0x4274e7
cmp word [esi], 0
je 0x4274e7
push ecx
push 0
push 1
mov edx, 1
mov ecx, esi
call fcn.0047a5e0
add esp, 0xc
test eax, eax
je 0x427487
mov ecx, esi
call fcn.0047b060
mov ecx, dword [0x4d78c8]
mov ebx, dword [0x4dbc48]
cmp eax, 0xffffffff
je 0x42742d
test eax, eax
je 0x427426
cmp eax, 1
jne 0x427487
jmp 0x427442
mov eax, 2
jmp 0x427442
mov eax, 5
cmp ecx, ebx
jbe 0x427442
cmp byte [ecx - 0x50], 0
mov edx, 2
cmovne eax, edx
cmp eax, 2
setne dl
cmp ecx, ebx
jbe case.0x42753a.3
cmp byte [ecx - 0x50], dl
je case.0x42753a.3
mov byte [ecx - 0x50], dl
cmp eax, 2
je 0x427474
inc dword [0x4dbc50]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
dec dword [0x4dbc50]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x4dd434], 0
mov ecx, 0x4dcd68
je 0x4274ab
push edi
push 9
push esi
push str.Parameter_1_invalid.
call fcn.00428b60
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x4dd437], 0
je 0x4274d1
push dword [edi + 4]
movzx eax, word [edi + 2]
push eax
push esi
push str.Parameter_1_invalid.
call fcn.00428a60
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push esi
push 9
push str.Parameter_1_invalid.
call fcn.00428bd0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00409e30
mov eax, dword [0x4d78c8]
mov ecx, 0x4dcd68
inc dword [0x4dbc50]
push 0
mov byte [eax + 0x50], 1
call fcn.00415750
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x4dcca0]
mov ecx, esi
call fcn.00409d00
mov ecx, eax
test ecx, ecx
je 0x427579
lea eax, [ecx - 1]
cmp eax, 0xb
ja case.0x42753a.3
movzx eax, byte [eax + 0x427bb4]
jmp dword [eax*4 + 0x427b9c]
push 1
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4dbcb0], 1
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4dbcb0], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push str.Send
push esi
call fcn.004979b3
add esp, 8
test eax, eax
jne 0x4275a1
mov ecx, 7
mov dword [0x4d7d40], ecx
lea eax, [ecx - 6]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push str.Mouse
push esi
call fcn.004979b3
add esp, 8
test eax, eax
jne 0x4275c9
mov ecx, 8
mov dword [0x4d7d40], ecx
lea eax, [ecx - 7]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push str.SendAndMouse
push esi
call fcn.004979b3
add esp, 8
test eax, eax
jne 0x4275f1
mov ecx, 9
mov dword [0x4d7d40], ecx
lea eax, [ecx - 8]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push str.Default
push esi
call fcn.004979b3
add esp, 8
test eax, eax
jne 0x42761b
mov ecx, 0xa
mov dword [0x4d7d40], ecx
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push str.MouseMove
push esi
call fcn.004979b3
add esp, 8
test eax, eax
jne 0x42767e
mov cl, byte [0x4dbebf]
or cl, 2
mov byte [0x4dbc7f], 1
cmp dword [0x4dbeac], 0
mov byte [0x4dbebf], cl
jne case.0x42753a.3
movzx eax, byte [0x4dbffe]
movzx edx, word [0x4dbffc]
push eax
movzx eax, cl
mov ecx, dword [0x4dbfec]
push eax
call fcn.004086b0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push str.MouseMoveOff
push esi
call fcn.004979b3
add esp, 8
test eax, eax
jne case.0x42753a.3
mov byte [0x4dbc7f], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x4dcca0]
mov edx, 0x4d7d4c
mov cl, 0x90
call fcn.0043f110
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x4dcca0]
mov edx, 0x4d7d48
mov cl, 0x14
call fcn.0043f110
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x4dcca0]
mov edx, 0x4d7d44
mov cl, 0x91
call fcn.0043f110
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
push 0
push 1
push dword [0x4dbc84]
mov ecx, 0x4dcd68
push str._restart
push dword [0x4dd428]
call fcn.0042a880
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi + 1], 0
ja 0x42775f
xorps xmm0, xmm0
mov edx, 1
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
mov ecx, eax
call fcn.00401950
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
cmp byte [eax + 1], 0
jne 0x42778d
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x42778d
call fcn.0044f5c0
mov edx, 1
mov ecx, eax
call fcn.00401950
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4dcca0]
call fcn.0047b060
mov edx, 1
mov ecx, eax
call fcn.00401950
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x4dccac]
mov ecx, edi
push dword [0x4dcca8]
push dword [0x4dcca4]
push dword [0x4dcca0]
call fcn.00476e70
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4dcca8]
xor ecx, ecx
cmp byte [edi + 1], 3
cmovb eax, ecx
push eax
push dword [0x4dcca4]
push dword [0x4dcca0]
call fcn.00477040
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x4dcca0]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi + 1], 0
ja 0x42782e
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov esi, dword [esp + 0x10]
jmp 0x427856
mov eax, dword [edi + 8]
cmp byte [eax + 1], 0
jne 0x427845
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x427845
call fcn.0044f5c0
jmp 0x427850
mov ecx, dword [0x4dcca0]
call fcn.0047b060
mov dword [esp + 0x14], edx
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je case.0x425d69.8
lea eax, [esp + 0x4c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [esp + 0x54]
mov dword [esp + 0x54], 1
push eax
push 0
push dword [esp + 0x24]
mov dword [esp + 0x6c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne case.0x425d69.8
push eax
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x4dbc60], 1
jg 0x427a34
mov ecx, 0x4dcd68
call fcn.00415d40
test al, al
jne 0x427a34
cmp byte [edi + 1], 0
ja 0x427903
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edi, dword [esp + 0x10]
jmp 0x427927
mov eax, dword [edi + 8]
cmp byte [eax + 1], 0
jne 0x42791a
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x42791a
call fcn.0044f5c0
jmp 0x427925
mov ecx, dword [0x4dcca0]
call fcn.0047b060
mov edi, eax
cmp dword [0x4dd3c0], 0
mov dword [0x4dd3ec], 7
je 0x427a41
cmp byte [0x4dbc41], 0
jne 0x427a41
mov esi, dword [0x4d78c8]
inc dword [0x4dbc60]
add esi, 0xa0
mov eax, dword [0x4dbc48]
mov dword [0x4d78c8], esi
test eax, eax
je 0x427971
add eax, 0x58
jmp 0x427973
xor eax, eax
test esi, esi
je 0x42797c
lea ecx, [esi + 0x58]
jmp 0x42797e
xor ecx, ecx
movups xmm0, xmmword [eax]
push 0x58
push 0
movups xmmword [ecx], xmm0
push esi
movups xmm0, xmmword [eax + 0x10]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [eax + 0x30]
movups xmmword [ecx + 0x30], xmm0
mov eax, dword [eax + 0x40]
mov dword [ecx + 0x40], eax
call fcn.004956d0
add esp, 0xc
mov byte [esi + 0x53], 1
mov ecx, 0x4dcd68
mov dword [esi + 0x3c], 0
push 0
call fcn.00415750
mov esi, dword [0x4d78c0]
mov eax, edi
push 0
cdq
mov ecx, 0x4dd3b8
push 1
mov dword [esp + 0x40], eax
lea eax, [esp + 0x30]
push 2
push eax
mov dword [0x4d78c0], 0
mov byte [0x4dbc41], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0x4b497c
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x50], 1
mov dword [esp + 0x4c], edx
call fcn.00474bb0
cmp eax, 3
jne 0x427a41
mov dword [0x4d78c0], esi
call fcn.00404340
mov byte [0x4dbc41], 0
pop edi
mov eax, 8
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 7
mov ecx, 0x4dcd68
call fcn.00416020
nop
iretd