Function at 0x417f90
Capabilities:
Copy file
Get keyboard layout
Query environment variable
Query or enumerate registry value
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d81a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4fc
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x38], ebx
call fcn.00437100
lea edi, [ebx + 0x94]
xor esi, esi
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.004ac790
lea ecx, [ebx + 0xb0]
mov byte [ebp - 4], 1
call fcn.00437ab0
lea ecx, [ebx + 0xe8]
mov byte [ebp - 4], 2
call fcn.00438c20
lea ecx, [ebx + 0x118]
mov byte [ebp - 4], 3
call fcn.0042c060
mov dword [ebx], fcn.00409d80
mov dword [edi], 0x4e8920
mov dword [ebx + 0xb0], 0x4e8910
mov dword [ebx + 0xe8], 0x4e88f4
mov dword [ebx + 0x118], 0x4e88f0
or eax, 0xffffffff
xor ecx, ecx
xor edx, edx
mov dword [ebx + 0x3644], esi
mov dword [ebx + 0x364c], esi
mov dword [ebx + 0x3648], esi
mov dword [ebx + 0x3650], eax
mov word [ebx + 0x3654], cx
mov word [ebx + 0x3758], dx
mov dword [ebx + 0x3754], esi
mov dword [ebx + 0x3b74], eax
xor eax, eax
mov dword [ebx + 0x3b68], esi
mov dword [ebx + 0x3b70], esi
mov dword [ebx + 0x3b6c], esi
mov word [ebx + 0x3b78], ax
mov word [ebx + 0x3c7c], cx
mov dword [ebx + 0x3c78], esi
lea ecx, [ebx + 0x485c]
mov byte [ebp - 4], 6
call fcn.00439b70
mov dword [0x52fe2c], ebx
mov byte [ebp - 4], 7
mov byte [ebx + 0x1629], 0
mov dword [ebx + 0x162c], 0xff
call fcn.004b5800
call fcn.00425f40
lea edx, [ebx + 0x40b4]
push edx
mov dword [ebx + 0x40b0], esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
push 8
push 0x4e5034
lea ecx, [ebp - 0x34]
push ecx
mov word [ebp - 0x34], ax
mov dword [ebp - 0x32], eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov word [ebp - 0x26], ax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp word [ebp - 0x34], si
je 0x418101
mov eax, 0x4e9c34
cmp word [ebp - 0x32], si
jne 0x418106
mov eax, 0x4e5034
lea edx, [ebp - 0x34]
push edx
push eax
push 7
push 7
push 0xe
lea edi, [ebx + 0x194]
push str._02u_02u_02u_s_s
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x4e5034
push 0x20
push edi
lea eax, [ebx + 0x154]
push str.ConEmu__s___i_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x6c
call fcn.0044c4d0
add esp, 0x34
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 8
cmp eax, esi
je 0x41815b
mov ecx, eax
call fcn.00449480
jmp 0x41815d
xor eax, eax
push 0xc2b8
mov byte [ebp - 4], 7
mov dword [ebx + 0x409c], eax
mov dword [ebx + 0x40a0], esi
mov dword [ebx + 0x40ac], esi
call fcn.0044c4d0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 9
cmp eax, esi
je 0x418194
mov ecx, eax
call fcn.004a47e0
jmp 0x418196
xor eax, eax
push 0x94
mov byte [ebp - 4], 7
mov dword [ebx + 0x40a8], eax
call fcn.0044c4d0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xa
cmp eax, esi
je 0x4181c1
mov ecx, eax
call fcn.004312e0
jmp 0x4181c3
xor eax, eax
push 4
mov byte [ebp - 4], 7
mov dword [ebx + 0x40cc], eax
mov dword [ebx + 0x40a4], esi
call fcn.0044c4d0
add esp, 4
cmp eax, esi
je 0x4181e5
mov dword [eax], esi
jmp 0x4181e7
xor eax, eax
push 0x44
mov dword [ebx + 0x40d0], eax
call fcn.0044c4d0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xb
cmp eax, esi
je 0x41820b
mov ecx, eax
call fcn.0049a850
jmp 0x41820d
xor eax, eax
xor ecx, ecx
mov byte [ebp - 4], 7
mov dword [ebx + 0x40d4], eax
mov word [ebx + 0x765c], cx
mov dword [ebx + 0x7864], esi
mov dword [ebx + 0x7868], esi
mov byte [ebx + 0x786c], cl
mov dword [ebx + 0x7870], esi
mov dword [ebx + 0x7874], esi
mov byte [ebx + 0x7878], cl
mov dword [ebx + 0x787c], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x601
mov dword [ebx + 0x78b8], eax
cmp word [0x510260], dx
jne 0x418271
lea eax, [ebx + 0x7a08]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebx + 0x4144], esi
mov dword [ebx + 0x4094], esi
mov byte [ebx + 0x7a20], 0
mov dword [ebx + 0x40e4], 0x51f
mov byte [ebx + 0x40e0], 0
mov dword [ebx + 0x40e8], 0xffffffff
mov byte [ebx + 0x4130], 0
mov byte [ebx + 0x4131], 0
mov byte [ebx + 0x4132], 0
mov byte [ebx + 0x4133], 0
mov byte [ebx + 0x4090], 1
mov byte [ebx + 0x4098], 0
mov byte [ebx + 0x4099], 0
mov ecx, dword [0x52fe30]
mov edx, dword [ecx + 0x113ec]
mov dword [ebx + 0x4128], edx
mov eax, dword [0x52fe30]
mov ecx, dword [eax + 0x113f0]
mov dword [ebx + 0x412c], ecx
mov esi, dword [0x52fe30]
add esi, 0x113b0
lea edi, [ebx + 0x40f0]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov esi, dword [0x52fe30]
add esi, 0x113cc
lea edi, [ebx + 0x410c]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebx + 0x408c], esi
mov byte [ebx + 0x4134], 0
mov byte [ebx + 0x4135], 0
mov byte [ebx + 0x4136], 0
mov byte [ebx + 0x4137], 0
mov byte [ebx + 0x4138], 0
mov byte [ebx + 0x4139], 0
mov byte [ebx + 0x413a], 0
mov dword [ebx + 0x413c], esi
mov dword [ebx + 0x5550], esi
mov dword [ebx + 0x5554], esi
mov dword [ebx + 0x5558], esi
mov dword [ebx + 0x555c], esi
push esi
lea edx, [ebp - 0x20]
push esi
push edx
mov byte [ebx + 0x40ed], 0
mov byte [ebx + 0x40ee], 0
mov dword [ebx + 0x4140], esi
mov byte [ebx + 0x47cc], 0
mov byte [ebx + 0x47cd], 0
mov dword [ebx + 0x47d0], esi
call fcn.00425070
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x47dc], ecx
mov dword [ebx + 0x47e0], edx
mov dword [ebx + 0x47e4], edi
mov dword [ebx + 0x47e8], eax
mov eax, esi
mov edi, 1
mov ecx, esi
xor edx, edx
mov byte [ebx + 0x47d4], 0
mov dword [ebx + 0x47d8], esi
mov dword [ebx + 0x47ec], esi
mov dword [ebx + 0x47f0], esi
mov dword [ebx + 0x47f4], edi
mov dword [ebx + 0x47f8], esi
mov dword [ebx + 0x47fc], esi
mov dword [ebx + 0x4800], eax
mov dword [ebx + 0x4804], ecx
mov dword [ebx + 0x4848], esi
mov word [ebx + 0x4a68], dx
mov word [ebx + 0x53e8], ax
mov byte [ebx + 0x54ea], al
mov dword [ebx + 0x4820], esi
mov byte [ebx + 0x54eb], al
mov byte [ebx + 0x54ec], al
mov byte [ebx + 0x4808], al
mov byte [ebx + 0x4809], al
mov dword [ebx + 0x480c], esi
mov dword [ebx + 0x4810], esi
mov dword [ebx + 0x4814], esi
push 0x2c
mov dword [ebx + 0x4818], esi
lea ecx, [ebx + 0x5514]
mov dword [ebx + 0x481c], esi
push esi
push ecx
mov byte [ebx + 0x7659], al
mov byte [ebx + 0x765a], al
call fcn.004c9b50
mov dword [ebx + 0x5540], esi
mov dword [ebx + 0x5544], esi
mov dword [ebx + 0x5548], esi
mov dword [ebx + 0x554c], esi
mov dword [ebx + 0x5560], esi
mov byte [ebx + 0x7880], 0
mov dword [ebx + 0x7888], esi
mov dword [ebx + 0x788c], esi
mov dword [ebx + 0x7884], esi
mov dword [ebx + 0x7890], esi
mov dword [ebx + 0x7894], esi
mov dword [ebx + 0x78ac], esi
mov dword [ebx + 0x78a8], esi
mov dword [ebx + 0x78a0], esi
mov dword [ebx + 0x789c], esi
mov dword [ebx + 0x7898], esi
mov dword [ebx + 0x78a4], 0xffffffff
mov dword [ebx + 0x78b4], esi
mov dword [ebx + 0x78b0], esi
mov dword [ebx + 0x5500], esi
add esp, 0x18
mov dword [ebx + 0x5504], edi
mov dword [ebx + 0x5508], esi
push 0x7f02
mov dword [ebx + 0x550c], esi
push esi
mov dword [ebx + 0x5510], esi
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f00
push esi
mov dword [ebx + 0x4828], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f86
push esi
mov dword [ebx + 0x482c], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f01
push esi
mov dword [ebx + 0x4834], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f8a
mov dword [ebx + 0x4838], eax
push esi
mov dword [ebx + 0x4844], esi
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7c
push esi
mov dword [ebx + 0x4830], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7d
push esi
mov dword [ebx + 0x483c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x6c
lea edx, [ebx + 0x4148]
push esi
push edx
mov dword [ebx + 0x4840], eax
call fcn.004c9b50
add esp, 0xc
or eax, 0xffffffff
mov dword [ebx + 0x417c], eax
mov dword [ebx + 0x4180], eax
lea eax, [ebx + 0x4170]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x618
lea ecx, [ebx + 0x41b4]
push esi
push ecx
call fcn.004c9b50
push 0x2000
lea edx, [ebx + 0x5658]
push esi
push edx
call fcn.004c9b50
mov eax, dword [ebx + 0x78b8]
add esp, 0x18
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push pe_nt_image_headers32
lea ecx, [ebx + 0x5568]
push esi
push ecx
mov dword [ebx + 0x5564], eax
call fcn.004c9b50
push 0x15ae
lea eax, [ebx + 0x2094]
push esi
push eax
mov byte [ebx + 0x7658], 0
call fcn.004c9b50
mov dword [ebx + 0x2094], 0x15ae
mov byte [ebx + 0x484c], 0
mov byte [ebx + 0x484d], 0
mov dword [ebx + 0x4850], esi
mov byte [ebx + 0x4855], 0
mov byte [ebx + 0x4854], 0
push 0x78
mov dword [ebx + 0x4858], esi
lea edx, [ebx + 0x7964]
push esi
mov byte [ebx + 0x4856], 0
push edx
mov byte [ebx + 0x1628], 0
call fcn.004c9b50
mov dword [ebx + 0x79dc], esi
mov dword [ebx + 0x79e0], esi
mov dword [ebx + 0x79e4], esi
mov dword [ebx + 0x79e8], esi
add esp, 0x24
mov dword [ebx + 0x79ec], esi
mov dword [ebx + 0x79f0], esi
push str.user32.dll
mov dword [ebx + 0xbe4], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, esi
je 0x4186d5
push str.GetLayeredWindowAttributes
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x4186d7
xor eax, eax
mov dword [ebx + 0x79f4], eax
mov dword [ebx + 0x79f8], esi
mov dword [ebx + 0x79fc], esi
mov dword [ebx + 0x7a00], esi
mov eax, 0x501
mov dword [ebx + 0x7a04], esi
cmp word [0x510260], ax
jb 0x418797
push str.Imm32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 0x79f8], eax
cmp eax, esi
je 0x418797
push str.ImmSetCompositionFontW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0x79fc], eax
mov ecx, dword [ebx + 0x79f8]
push str.ImmSetCompositionWindow
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0x7a00], eax
mov edx, dword [ebx + 0x79f8]
push str.ImmGetContext
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0x7a04], eax
cmp dword [ebx + 0x79fc], esi
je 0x418772
cmp dword [ebx + 0x7a00], esi
je 0x418772
cmp eax, esi
jne 0x418797
mov dword [ebx + 0x79fc], esi
mov dword [ebx + 0x7a00], esi
mov dword [ebx + 0x7a04], esi
mov eax, dword [ebx + 0x79f8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebx + 0x79f8], esi
lea edx, [ebp - 0x24]
push edx
push 0x20019
push esi
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
xor ecx, ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov word [ebx + 0x9dc], cx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4187f8
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebx + 0x9dc]
push eax
push esi
push esi
push str.ComSpec
push ecx
mov dword [ebp - 0x10], 0x206
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4187ee
xor edx, edx
mov word [ebx + 0x9dc], dx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebx + 0x9dc], si
lea eax, [ebx + 0x9dc]
jne 0x418816
push esi
push 0x104
push eax
call fcn.004c7f00
add esp, 0xc
mov dword [ebx + 0x2090], esi
xor ecx, ecx
mov word [ebx + 0x7d2], cx
xor edx, edx
mov word [ebx + 0x5c8], dx
xor eax, eax
mov word [ebx + 0x3be], ax
mov word [ebx + 0x1b4], cx
lea eax, [ebx + 0x1b4]
mov word [ebx + 0x1e70], dx
push 0x104
mov word [ebx + 0x1c50], cx
mov word [ebx + 0x1a46], dx
push eax
mov word [ebx + 0x183c], cx
push esi
mov word [ebx + 0x1632], dx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x419571
lea eax, [ebx + 0x1b4]
push 0x5c
push eax
call fcn.004ca94c
add esp, 8
test eax, eax
je 0x419571
lea eax, [ebx + 0x1b4]
push eax
lea eax, [ebx + 0x3be]
push eax
call fcn.004128d0
lea eax, [ebx + 0x3be]
push 0x5c
push eax
call fcn.004ca94c
xor ecx, ecx
add esp, 0x10
mov word [eax], cx
push esi
mov ecx, ebx
call fcn.00412fe0
lea eax, [ebx + 0x3be]
push eax
lea edx, [ebp - 0x300]
push edx
mov dword [ebx + 0xbec], esi
call fcn.00402ef0
lea eax, [ebp - 0x300]
push 0x5c
push eax
call fcn.004ca94c
add esp, 0x10
cmp eax, esi
je 0x4188f9
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x300]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x418902
push str.msys1.0_bin_sh.exe
sub eax, edx
push 0x144
lea edx, [ebp - 0x300]
sar eax, 1
push edx
mov dword [ebp - 0x10], eax
call fcn.004017b0
lea eax, [ebp - 0x300]
push esi
push eax
call fcn.004c5850
add esp, 8
test al, al
jne 0x418975
mov edx, dword [ebp - 0x10]
push str._bin_sh.exe
push 0x144
lea eax, [ebp - 0x300]
xor ecx, ecx
push eax
mov word [ebp + edx*2 - 0x300], cx
call fcn.004017b0
lea ecx, [ebp - 0x300]
push esi
push ecx
call fcn.004c5850
add esp, 8
test al, al
je 0x41897f
or dword [ebx + 0xbec], 0x1000
lea eax, [ebx + 0x3be]
push eax
lea eax, [ebx + 0x5c8]
push eax
call fcn.004128d0
add esp, 8
push str.ConEmu
push 0x105
lea eax, [ebx + 0x5c8]
push eax
call fcn.004017b0
mov ecx, ebx
call fcn.00408f60
test al, al
jne 0x418a74
lea eax, [ebx + 0x3be]
push eax
lea eax, [ebx + 0x5c8]
push eax
call fcn.004128d0
add esp, 8
mov ecx, ebx
call fcn.00408f60
test al, al
jne 0x418a74
lea eax, [ebx + 0x3be]
push 0x5c
push eax
call fcn.004ca94c
add esp, 8
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x418a74
push str._bin
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x418a74
mov eax, dword [ebp - 0x10]
sub eax, ebx
sub eax, 0x3be
sar eax, 1
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebx + 0x3be]
push eax
lea eax, [ebx + 0x5c8]
push eax
call fcn.004087d0
mov eax, dword [ebp - 0x10]
xor edx, edx
mov word [ebx + eax*2 + 0x5c8], dx
lea eax, [ebx + 0x5c8]
push str.libexecConEmu
push eax
call fcn.00412930
add esp, 0x14
mov ecx, ebx
call fcn.00408f60
test al, al
je 0x418a5e
or dword [ebx + 0xbec], edi
jmp 0x418a74
lea eax, [ebx + 0x3be]
push eax
lea eax, [ebx + 0x5c8]
push eax
call fcn.004128d0
add esp, 8
mov eax, dword [ebx + 0xbec]
test al, 1
je 0x418a91
test eax, 0x1000
je 0x418a91
mov ecx, dword [0x52fe34]
push esi
call fcn.0046a5e0
test byte [ebx + 0xbec], 1
jne 0x418be3
mov dword [ebp - 0x18], str...AppInfoLauncherConEmuPortable.ini
mov dword [ebp - 0x14], str...DefaultData_settingsConEmu.xml
mov dword [ebp - 0x10], esi
nop
lea eax, [ebx + 0x3be]
push eax
lea ecx, [ebp - 0x300]
push ecx
call fcn.00402ef0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + edx*4 - 0x18]
add esp, 8
push eax
push 0x144
lea ecx, [ebp - 0x300]
push ecx
call fcn.004017b0
lea edx, [ebp - 0x300]
push esi
push edx
call fcn.004c5850
add esp, 8
test al, al
je 0x418be3
mov eax, dword [ebp - 0x10]
add eax, edi
mov dword [ebp - 0x10], eax
cmp eax, 2
jb 0x418ab0
lea eax, [ebx + 0x3be]
push eax
lea eax, [ebx + 0x1632]
push eax
call fcn.004128d0
lea eax, [ebx + 0x1632]
push 0x5c
push eax
call fcn.004ca94c
add esp, 0x10
cmp eax, esi
je 0x418be3
xor ecx, ecx
mov word [eax], cx
lea eax, [ebx + 0x1632]
push 0x5c
push eax
call fcn.004ca94c
add esp, 8
cmp eax, esi
je 0x418bd1
xor edx, edx
push 0x4e99a0
mov word [eax], dx
push 0x105
lea eax, [ebx + 0x1632]
push eax
call fcn.004017b0
lea eax, [ebx + 0x1632]
push eax
call fcn.004c5ac0
add esp, 4
test al, al
jne 0x418b8b
lea eax, [ebx + 0x1632]
push eax
call fcn.004c5c00
add esp, 4
push str.ConEmu.xml
push 0x105
lea eax, [ebx + 0x1632]
push eax
call fcn.004017b0
lea eax, [ebx + 0x1632]
push esi
push eax
call fcn.004c5850
add esp, 8
test al, al
jne 0x418bca
push esi
lea eax, [ebx + 0x1632]
push eax
lea eax, [ebp - 0x300]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
or dword [ebx + 0xbec], 2
test byte [ebx + 0xbec], 2
jne 0x418be3
xor ecx, ecx
mov word [ebx + 0x1632], cx
mov byte [ebx + 0x1630], 0
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x418c23
push 0x20
lea edx, [ebp - 0x78]
push edx
push str.ConEmuBlockChildDebuggers
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x418c23
push 0x4e9958
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
sete cl
mov byte [ebx + 0x1630], cl
push esi
push str.ConEmuBlockChildDebuggers
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebx + 0x3be]
push eax
push str.ConEmuDir
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebx + 0x5c8]
push eax
push str.ConEmuBaseDir
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebx + 0x194]
push eax
push str.ConEmuBuild
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x4e5034
push str.ConEmuConfig
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x104
lea edx, [ebp - 0x508]
push edx
lea eax, [ebx + 0x3be]
push eax
call fcn.00406cf0
add esp, 0xc
push eax
push str.ConEmuDrive
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, ebx
call fcn.00413850
mov ecx, ebx
call fcn.00413940
lea eax, [ebx + 0x5c8]
push eax
lea eax, [ebx + 0x1a46]
push eax
call fcn.004128d0
add esp, 8
push str.ConEmu.chm
lea eax, [ebx + 0x1a46]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebx + 0x1a46]
push esi
push eax
call fcn.004c5850
add esp, 8
test al, al
jne 0x418d4e
lea eax, [ebx + 0x3be]
push eax
lea eax, [ebx + 0x5c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x418d45
lea eax, [ebx + 0x3be]
push eax
lea eax, [ebx + 0x1a46]
push eax
call fcn.004128d0
add esp, 8
push str.ConEmu.chm
lea eax, [ebx + 0x1a46]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebx + 0x1a46]
push esi
push eax
call fcn.004c5850
add esp, 8
test al, al
jne 0x418d4e
xor eax, eax
mov word [ebx + 0x1a46], ax
jmp 0x418d4e
xor ecx, ecx
mov word [ebx + 0x1a46], cx
lea eax, [ebx + 0x5c8]
push eax
lea eax, [ebx + 0x1c50]
push eax
call fcn.00412950
add esp, 8
push 0x4e4db8
push 0x110
lea eax, [ebx + 0x1c50]
push eax
call fcn.004017b0
call fcn.004c6070
test al, al
je 0x418de6
lea eax, [ebx + 0x5c8]
push eax
lea eax, [ebx + 0x1e70]
push eax
call fcn.00412950
add esp, 8
push 0x4e4dd4
push 0x110
lea eax, [ebx + 0x1e70]
push eax
call fcn.004017b0
lea eax, [ebx + 0x1e70]
push esi
push eax
call fcn.004c5850
add esp, 8
test al, al
lea eax, [ebx + 0x1c50]
je 0x418dec
push esi
push eax
call fcn.004c5850
add esp, 8
test al, al
jne 0x418dfc
lea eax, [ebx + 0x1e70]
push eax
lea eax, [ebx + 0x1c50]
jmp 0x418df3
lea eax, [ebx + 0x1c50]
push eax
lea eax, [ebx + 0x1e70]
push eax
call fcn.00412950
add esp, 8
mov ecx, ebx
call fcn.00414900
mov dword [ebx + 0xbe8], eax
mov dword [ebx + 0xbf0], esi
xor edx, edx
mov word [ebx + 0x1210], dx
xor eax, eax
mov word [ebx + 0xdfc], ax
xor ecx, ecx
mov word [ebx + 0xbf4], cx
mov word [ebx + 0x1004], dx
mov dword [ebx + 0x1418], esi
mov word [ebx + 0x141c], ax
mov dword [ebx + 0x1624], esi
mov dword [ebx + 0x120c], esi
cmp dword [0x52fe5c], 6
jb 0x418e63
call fcn.004c5e00
movzx ecx, al
mov dword [ebx + 0x4824], ecx
jmp 0x418e69
mov dword [ebx + 0x4824], esi
mov dword [ebx + 0x54f0], esi
mov dword [ebx + 0x54f4], esi
mov dword [ebx + 0x54f8], esi
xor eax, eax
mov dword [ebx + 0x78bc], 0x800a
lea esi, [ebx + 0x78c0]
push 0xc
mov dword [esi], eax
push 0x80
mov dword [esi + 4], eax
call fcn.0044c490
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x418eae
mov dword [esi + 4], 0x80
add dword [ebx + 0x78bc], edi
mov edx, dword [ebx + 0x78bc]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.PostCreate
mov dword [ebp - 0x10], edx
call fcn.0040d260
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x78c8], edx
add dword [ebx + 0x78bc], edi
mov eax, dword [ebx + 0x78bc]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.PostCopy
mov dword [ebp - 0x10], eax
call fcn.0040d260
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x78cc], eax
add dword [ebx + 0x78bc], edi
mov ecx, dword [ebx + 0x78bc]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x14], str.MyDestroy
call fcn.0040d260
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x78d0], ecx
add dword [ebx + 0x78bc], edi
mov edx, dword [ebx + 0x78bc]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.UpdateSizes
mov dword [ebp - 0x10], edx
call fcn.0040d260
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x78d4], edx
add dword [ebx + 0x78bc], edi
mov eax, dword [ebx + 0x78bc]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.UpdateCursorInfo
mov dword [ebp - 0x10], eax
call fcn.0040d260
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x78d8], eax
add dword [ebx + 0x78bc], edi
mov ecx, dword [ebx + 0x78bc]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x14], str.SetWindowMode
call fcn.0040d260
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x78dc], ecx
add dword [ebx + 0x78bc], edi
mov edx, dword [ebx + 0x78bc]
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
push ecx
mov dword [ebp - 0x14], str.UpdateTitle
mov dword [ebp - 0x10], edx
mov ecx, esi
call fcn.0040d260
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x78e0], edx
add dword [ebx + 0x78bc], edi
mov eax, dword [ebx + 0x78bc]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.SrvStarted
mov dword [ebp - 0x10], eax
call fcn.0040d260
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x78e4], eax
add dword [ebx + 0x78bc], edi
mov ecx, dword [ebx + 0x78bc]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x14], str.UpdateScrollInfo
call fcn.0040d260
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x78e8], ecx
add dword [ebx + 0x78bc], edi
mov edx, dword [ebx + 0x78bc]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.UpdateTabs
mov dword [ebp - 0x10], edx
call fcn.0040d260
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x78ec], edx
add dword [ebx + 0x78bc], edi
mov eax, dword [ebx + 0x78bc]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.OldCmdVer
mov dword [ebp - 0x10], eax
call fcn.0040d260
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x78f0], eax
mov dword [ebx + 0x78f4], 0
add dword [ebx + 0x78bc], edi
mov ecx, dword [ebx + 0x78bc]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x14], str.TabCommand
call fcn.0040d260
mov ecx, dword [ebp - 0x10]
push str.ConEmuMain::SwitchCon
mov dword [ebx + 0x78f8], ecx
mov dword [ebp - 0x14], str.CONEMUMSG_SWITCHCON
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.0040d260
mov ecx, dword [ebp - 0x10]
push str.ConEmuMain::HookedKey
mov dword [ebx + 0x78fc], ecx
mov dword [ebp - 0x14], str.CONEMUMSG_HOOKEDKEY
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.0040d260
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x7900], ecx
add dword [ebx + 0x78bc], edi
mov edx, dword [ebx + 0x78bc]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.PostConsoleResize
mov dword [ebp - 0x10], edx
call fcn.0040d260
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x7908], edx
add dword [ebx + 0x78bc], edi
mov eax, dword [ebx + 0x78bc]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.ConsoleLangChanged
mov dword [ebp - 0x10], eax
call fcn.0040d260
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x790c], eax
add dword [ebx + 0x78bc], edi
mov ecx, dword [ebx + 0x78bc]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x14], str.PostOnBufferHeight
call fcn.0040d260
mov ecx, dword [ebp - 0x10]
push str.ConEmuMain::FlashWindow
mov dword [ebx + 0x7910], ecx
mov dword [ebp - 0x14], str.CONEMUMSG_FLASHWINDOW
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.0040d260
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x791c], ecx
add dword [ebx + 0x78bc], edi
mov edx, dword [ebx + 0x78bc]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.PostAltF9
mov dword [ebp - 0x10], edx
call fcn.0040d260
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x7914], edx
add dword [ebx + 0x78bc], edi
mov eax, dword [ebx + 0x78bc]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.InitInactiveDC
mov dword [ebp - 0x10], eax
call fcn.0040d260
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x7918], eax
add dword [ebx + 0x78bc], edi
mov dword [ebp - 0x14], str.UpdateProcDisplay
mov ecx, dword [ebx + 0x78bc]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
call fcn.0040d260
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x7920], ecx
add dword [ebx + 0x78bc], edi
mov edx, dword [ebx + 0x78bc]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.AutoSizeFont
mov dword [ebp - 0x10], edx
call fcn.0040d260
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x7924], edx
add dword [ebx + 0x78bc], edi
mov eax, dword [ebx + 0x78bc]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.DisplayRConError
mov dword [ebp - 0x10], eax
call fcn.0040d260
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x7928], eax
add dword [ebx + 0x78bc], edi
mov ecx, dword [ebx + 0x78bc]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x14], str.MacroFontSetName
call fcn.0040d260
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x792c], ecx
add dword [ebx + 0x78bc], edi
mov edx, dword [ebx + 0x78bc]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.CreateViewWindow
mov dword [ebp - 0x10], edx
call fcn.0040d260
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x7930], edx
add dword [ebx + 0x78bc], edi
mov eax, dword [ebx + 0x78bc]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.PostTaskbarActivate
mov dword [ebp - 0x10], eax
call fcn.0040d260
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x7934], eax
mov dword [ebx + 0x7938], 0
add dword [ebx + 0x78bc], edi
mov ecx, dword [ebx + 0x78bc]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x14], str.InitVConGhost
call fcn.0040d260
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x793c], ecx
add dword [ebx + 0x78bc], edi
mov edx, dword [ebx + 0x78bc]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.CreateCon
mov dword [ebp - 0x10], edx
call fcn.0040d260
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x7940], edx
add dword [ebx + 0x78bc], edi
mov eax, dword [ebx + 0x78bc]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.RequestUpdate
mov dword [ebp - 0x10], eax
call fcn.0040d260
mov eax, dword [ebp - 0x10]
push str.ConEmuTh::MapCoords
mov dword [ebx + 0x7944], eax
mov dword [ebp - 0x14], str.CONEMUMSG_PNLVIEWMAPCOORD
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x10], eax
call fcn.0040d260
mov eax, dword [ebp - 0x10]
push str.TaskbarCreated
mov dword [ebx + 0x794c], eax
mov dword [ebp - 0x14], 0x4e95ec
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x10], eax
call fcn.0040d260
mov eax, dword [ebp - 0x10]
push str.TaskbarButtonCreated
mov dword [ebx + 0x7948], eax
mov dword [ebp - 0x14], 0x4e95a8
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x10], eax
call fcn.0040d260
mov eax, dword [ebp - 0x10]
push str.SHELLHOOK
mov dword [ebx + 0x7950], eax
mov dword [ebp - 0x14], 0x4e9588
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x10], eax
call fcn.0040d260
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x7904], eax
add dword [ebx + 0x78bc], edi
mov ecx, dword [ebx + 0x78bc]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], str.DeleteVConMainThread
mov dword [ebp - 0x10], ecx
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.0040d260
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x7954], ecx
add dword [ebx + 0x78bc], edi
mov edx, dword [ebx + 0x78bc]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.ChangeCurrentPalette
mov dword [ebp - 0x10], edx
call fcn.0040d260
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x7958], edx
add dword [ebx + 0x78bc], edi
mov eax, dword [ebx + 0x78bc]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.MacroExecSync
mov dword [ebp - 0x10], eax
call fcn.0040d260
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x795c], eax
add dword [ebx + 0x78bc], edi
mov edi, dword [ebx + 0x78bc]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.ActivateVCon
mov dword [ebp - 0x10], edi
call fcn.0040d260
mov dword [ebx + 0x7960], edi
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
push esi
push esi
push esi
push str.GetModuleFileName_failed
call fcn.004263e0
add esp, 0x14
push 0x64
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret