Function at 0x4437cd
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x2df4
call fcn.0049ebb0
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x2df0], eax
mov eax, dword [esp + 0x2df8]
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x2e00]
push esi
mov esi, dword [esp + 0x2e0c]
mov dword [esp + 8], ebp
cmp ecx, 0x4e
jne 0x4444c3
mov ecx, dword [esi + 8]
push edi
xor edi, edi
xor eax, eax
cmp dword [eax + 0x4bf0f4], ecx
je 0x443798
add eax, 4
cmp eax, 0x1c
jb 0x443786
jmp 0x4437ab
mov eax, dword [0x4dc210]
push edi
push edi
push 0x400
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esi + 8]
add eax, 0x9b
push ebx
cmp eax, 0x9a
ja case.0x443841.10
movzx ecx, byte [eax + 0x444508]
jmp dword [ecx*4 + 0x4444dc]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebx
movzx edi, ax
shr edi, 0xf
push 0x12
and edi, 1
call ebx
movzx ebp, ax
shr ebp, 0xf
push 0x11
and ebp, 1
call ebx
movzx ebx, ax
shr ebx, 0xf
and ebx, 1
cmp word [esi + 0xc], 0x79
jne 0x443812
test edi, edi
jne 0x443809
test ebp, ebp
je 0x443822
mov ecx, dword [esp + 0x10]
call fcn.00440030
test edi, edi
jne case.0x443841.10
test ebp, ebp
jne case.0x443841.10
test ebx, ebx
jne case.0x443841.10
movzx eax, word [esi + 0xc]
add eax, 0xfffffff7
cmp eax, 0x6b
ja case.0x443841.10
movzx edx, byte [eax + 0x4445c4]
jmp dword [edx*4 + 0x4445a4]
call fcn.0049f4dd
mov ecx, dword [esp + 0x10]
push 0
push 1
mov dword [0x4ed188], eax
call fcn.00443280
call fcn.0049f4dd
mov dword [0x4ed188], eax
jmp case.0x443841.10
mov ecx, dword [esp + 0x10]
call fcn.0043ffa0
jmp case.0x443841.10
mov eax, dword [0x4dc210]
push 0
push 0xb4
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.0x443841.10
mov ecx, dword [esp + 0x10]
call fcn.0043e080
jmp case.0x443841.10
mov ecx, 0x4dff28
call fcn.00406c70
jmp case.0x443841.10
cmp dword [0x4dbca4], 0
mov ecx, 0x4dff38
je 0x4438c8
call fcn.004428f0
jmp case.0x443841.10
call fcn.00441d30
jmp case.0x443841.10
cmp dword [0x4dbcf4], 0
je case.0x443841.10
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx]
jne case.0x443841.10
mov edx, dword [0x4dbcf4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x443841.10
push edi
push str.SingleClick
push str.FileList
call fcn.00456940
test eax, eax
je case.0x443841.10
mov ecx, ebp
call fcn.0043def0
test eax, eax
je case.0x443841.10
call fcn.0049f4dd
sub eax, dword [0x4ed188]
cmp eax, 0x3e8
jle case.0x443841.10
push edi
push 1
mov ecx, ebp
call fcn.00443280
xor eax, eax
pop ebx
pop edi
mov ecx, dword [esp + 0x2df8]
pop esi
pop ebp
xor ecx, esp
call fcn.0049e626
add esp, 0x2df4
ret 0x10
mov ecx, ebp
call fcn.0043def0
test eax, eax
je case.0x443841.10
jmp 0x443926
call fcn.00422db0
jmp case.0x443841.10
mov eax, dword [esi + 0x10]
push eax
mov ecx, ebp
call fcn.004412f0
jmp case.0x443841.10
mov ecx, 0x4e0c60
call fcn.004112e0
cmp dword [0x4dbda0], edi
jne 0x443a9d
cmp byte [ebp + 0xc1e], 0
jne 0x443a9d
cmp dword [0x4dbca4], edi
je 0x4439a7
test al, 0x40
jne 0x4439a7
cmp byte [ebp + 0x1c], 0
je 0x443a9d
cmp byte [ebp + 0x1c], 0
je 0x4439bf
xor ecx, ecx
mov byte [ebp + 0x1d], 0
mov word [ebp + 0x41e], cx
jmp case.0x443841.10
mov ecx, dword [ebp]
mov edx, dword [esi + 0x10]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x14]
push eax
push edi
push 0x1005
push ecx
mov dword [esp + 0x24], 4
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edi
call ebx
test eax, eax
je 0x443a9d
mov edx, dword [esp + 0x34]
push edx
lea eax, [esp + 0xdd4]
push eax
mov ecx, 0x4ecc70
call fcn.0043d090
push 0x400
lea ecx, [esp + 0xdd4]
push ecx
lea edi, [ebp + 0x1d]
call fcn.0044daf0
push eax
push edi
call fcn.00465370
push 0x400
lea edx, [esp + 0x11d4]
push edx
lea esi, [ebp + 0x41e]
call fcn.0044db70
push eax
push esi
call fcn.004653b0
mov eax, dword [ebp]
push 0
push 0
push 0x1018
push eax
call ebx
cmp word [esi], 0
je 0x443a61
push esi
push eax
call fcn.0047df20
jmp 0x443a69
push edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, 0x4b1a5c
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x443a90
test dl, dl
je 0x443a8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x443a90
add eax, 2
add ecx, 2
test dl, dl
jne 0x443a70
xor eax, eax
jmp 0x443a95
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne case.0x443841.10
mov eax, 1
jmp 0x443932
mov byte [0x4ecd88], 0
mov ecx, dword [esi + 0x20]
mov dword [esp + 0x10], edi
mov byte [esp + 0x2600], 0
cmp ecx, edi
jne 0x443b06
cmp byte [ebp + 0x1c], 0
je case.0x443841.10
mov eax, dword [ebp]
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0x14]
push edx
push edi
push 0x1005
mov ebx, 1
push eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x38], 0x4ecd88
mov dword [esp + 0x3c], 0x400
mov dword [esp + 0x24], ebx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x443b64
mov edx, 0x4ecd88
mov ebx, 1
mov al, byte [ecx]
mov byte [edx], al
add ecx, ebx
add edx, ebx
test al, al
jne 0x443b10
mov esi, dword [esi + 0x2c]
cmp esi, dword [0x4ecd74]
jae 0x443b64
push esi
lea ecx, [esp + 0xdd4]
push ecx
mov ecx, 0x4ecc70
call fcn.0043d090
push 0x400
lea edx, [esp + 0xdd4]
push edx
lea eax, [esp + 0x2608]
push eax
call fcn.00465370
lea ecx, [esp + 0x2600]
push ecx
call fcn.0044daf0
mov byte [eax], 0
cmp byte [0x4ecd88], 0
je case.0x443841.10
cmp byte [ebp + 0x1c], 0
je 0x443ce9
mov byte [ebp + 0x1c], 0
cmp dword [0x4dbca4], edi
je 0x443cc2
lea edx, [esp + 0x1a00]
push edx
push str.Rar_MDXXXXXX
call fcn.0047f110
test al, al
je 0x443f88
xor eax, eax
jmp 0x443bb0
mov cl, byte [esp + eax + 0x1a00]
mov byte [esp + eax + 0x1e00], cl
inc eax
test cl, cl
jne 0x443bb0
lea eax, [esp + 0x1e00]
push eax
call fcn.0044df70
mov eax, 0x4ecd88
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x443bd7
lea edi, [esp + 0x1e00]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x443be8
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [esp + 0x1e04]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x443ca2
call fcn.0047b520
push 0
push 0x4e75f4
mov ecx, 0x4e0c60
call fcn.00413520
mov ecx, dword [0x4e81f4]
lea edx, [esp + 0x1e00]
push edx
call fcn.00465960
push 0
push 0x4e4710
mov ecx, 0x4e0c60
mov dword [0x4e57c4], 2
mov dword [0x4e57c0], 1
mov byte [0x4e57ff], 0
call fcn.004134e0
mov eax, dword [0x4e0e68]
push 0
mov ecx, 0x4e0c60
mov dword [0x4e6194], eax
call fcn.00415390
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0x1e00]
push ecx
call esi
lea edx, [esp + 0x1a00]
push edx
call esi
jmp 0x443f88
lea eax, [esp + 0x1e00]
push eax
push 0x1f7
call fcn.0045be10
push eax
call fcn.0048cd40
add esp, 8
jmp 0x443f7e
push edi
push 0x4ecd88
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x443f5f
cmp byte [0x4ecd88], al
je 0x443f88
push 0x4ecd88
jmp 0x443caa
cmp dword [0x4dbca4], edi
je 0x443f45
lea ecx, [esp + 0xdd0]
push ecx
mov ecx, ebp
call fcn.0043f080
test al, al
je 0x443d37
push 0x400
lea edx, [esp + 0xdd4]
push edx
lea eax, [ebp + 0x1d]
push eax
call fcn.00465370
push 0x400
lea ecx, [esp + 0x11d4]
push ecx
lea edx, [ebp + 0x41e]
push edx
call fcn.004653b0
push edi
call fcn.0047b480
call fcn.00477200
push 0x4e79f4
push 0x4e75f4
mov ecx, 0x4e0c60
call fcn.00413520
mov eax, dword [0x4e0e68]
push edi
push str.FlatView
push str.FileList
mov dword [0x4e6194], eax
call fcn.00456940
test eax, eax
je 0x443d96
xor eax, eax
jmp 0x443d80
mov cl, byte [esp + eax + 0x2600]
mov byte [esp + eax + 0x1a00], cl
add eax, ebx
test cl, cl
jne 0x443d80
jmp 0x443db6
push edi
lea ecx, [esp + 0x1a04]
push ecx
mov ecx, 0x4e0c60
call fcn.004134e0
lea edx, [esp + 0x1a00]
push edx
call fcn.0044df70
mov ecx, dword [0x4e81f4]
lea eax, [ebp + 0x41e]
push eax
lea ebx, [ebp + 0x1d]
push ebx
mov dword [esp + 0x44], eax
call fcn.00465650
xor eax, eax
jmp 0x443de0
mov cl, byte [esp + eax + 0x1a00]
mov byte [esp + eax + 0x1e00], cl
inc eax
test cl, cl
jne 0x443de0
mov eax, 0x4ecd88
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x443e00
lea edi, [esp + 0x1e00]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x443e11
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x4e8204]
call fcn.004655e0
mov ecx, dword [0x4e8204]
lea eax, [esp + 0x1e00]
push eax
call fcn.00465960
push 0
push 0
push 0
lea ecx, [esp + 0x1e0c]
push ecx
mov ecx, 0x4ecc70
call fcn.0043d190
test al, al
je 0x443ecf
lea edx, [esp + 0x1e00]
push edx
push ebx
call fcn.00465330
test eax, eax
jne 0x443ea9
lea ecx, [esp + 0x1e00]
mov eax, ebx
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x443ea0
test dl, dl
je 0x443e9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x443ea0
add eax, 2
add ecx, 2
test dl, dl
jne 0x443e80
xor eax, eax
jmp 0x443ea5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x443ecf
push 0
push 0x4ecd88
mov ecx, ebp
call fcn.00440ed0
push 0x50d
call fcn.0045be10
push eax
call fcn.0048cd40
add esp, 4
jmp 0x443f88
cmp byte [0x4ecd88], 0
mov esi, 0x4ecd88
je 0x443f07
lea ecx, [ecx]
movsx eax, byte [esi]
push eax
mov eax, dword [str._____:]
push eax
call fcn.0049e290
add esp, 8
test eax, eax
jne 0x443f88
push esi
call fcn.00405af0
mov esi, eax
cmp byte [esi], 0
jne 0x443ee0
push 0
lea ecx, [esp + 0x1a04]
push ecx
call fcn.0044d8b0
test al, al
jne 0x443f88
push 0
push ebx
call fcn.0044d8b0
test al, al
je 0x443f39
mov edx, dword [esp + 0x3c]
cmp word [edx], 0
je 0x443f88
cmp dword [0x4e0e68], 0
jne 0x443f88
mov ecx, 0x4e0c60
call fcn.00411320
jmp 0x443f88
push edi
lea esi, [ebp + 0x1d]
push 0x4ecd88
add ebp, 0x41e
push ebp
push esi
call fcn.0042ff90
test al, al
je 0x443f65
mov dword [esp + 0x10], ebx
jmp 0x443f88
push 0x4ecd88
push esi
push 0x207
call fcn.0045be10
push eax
call fcn.0048cd40
add esp, 0xc
mov ecx, 0x4c93ac
call fcn.00428050
mov eax, dword [0x4dc210]
push 0x4ecd88
push 0
push 0x402
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x10]
jmp 0x443932
push 0x30
push 0x65
call fcn.0045be10
push eax
push 0x1f4
call fcn.0045be10
mov ecx, dword [0x4dc210]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp case.0x443841.10
mov eax, dword [esi + 0xc]
sub eax, 1
je 0x444064
sub eax, 0x10000
jne case.0x443841.10
cmp dword [0x4bf0ec], 0xffffffff
jne 0x444022
push 0xff0000
push str.AltColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.00456940
push 0xd9213
push str.AltEncryptionColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov dword [0x4bf0ec], eax
call fcn.00456940
mov dword [0x4ecd84], eax
mov edx, dword [esi + 0x2c]
push edx
lea eax, [esp + 0x44]
push eax
mov ecx, 0x4ecc70
call fcn.0043d090
mov eax, dword [eax + 0xc10]
test eax, 0x800
je 0x44404b
mov ecx, dword [0x4bf0ec]
mov dword [esi + 0x30], ecx
test eax, 0x4000
je case.0x443841.10
mov edx, dword [0x4ecd84]
mov dword [esi + 0x30], edx
jmp case.0x443841.10
movzx eax, byte [0x4e0c5c]
neg eax
sbb eax, eax
and eax, 0x20
jmp 0x443932
test byte [esi + 0xc], 2
je case.0x443841.10
mov eax, dword [esi + 0x2c]
push eax
lea ecx, [esp + 0xdd4]
push ecx
mov ecx, 0x4ecc70
call fcn.0043d090
cmp dword [0x4ecd80], edi
jne 0x4440b9
mov dword [0x4ecd80], 0x4401
call fcn.0047e590
test al, al
jne 0x4440b9
or dword [0x4ecd80], 0x10
call fcn.0043cdb0
test eax, eax
je 0x444208
cmp word [esp + 0x11d0], di
je 0x444208
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edx, [esp + 0x2600]
push edx
push 0x400
call edi
mov eax, dword [0x4ecd7c]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x444127
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x44411a
push str.SHGetFileInfoW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4ecd7c], eax
jmp 0x44411f
mov eax, dword [0x4ecd7c]
test eax, eax
je 0x4441c9
mov ecx, dword [0x4ecd80]
push ecx
mov ecx, dword [esp + 0x19e4]
push 0x2b4
lea edx, [esp + 0x1a08]
push edx
push ecx
lea edx, [esp + 0x11e0]
push edx
call eax
test eax, eax
je 0x4441c9
push 0x1000000
lea eax, [esp + 0xc74]
push eax
lea ecx, [esp + 0x1c1c]
push ecx
call fcn.0046d7f0
cmp byte [esp + 0xc70], 0
jne 0x44418c
lea edx, [esp + 0xc70]
push edx
lea eax, [esp + 0xdd4]
push eax
mov ecx, ebp
call fcn.0043e0c0
mov ecx, dword [0x4dbca4]
add ecx, 2
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0xc74]
push ecx
mov dword [esp + 0x30], edx
mov edx, dword [ebp]
push 0x102e
push edx
call ebx
mov eax, dword [esp + 0x1a04]
or dword [esi + 0xc], 0x1000
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x1e00]
push ecx
push 0x400
call edi
lea edx, [esp + 0x1e00]
push edx
lea eax, [esp + 0x2604]
push eax
call fcn.0046dc20
test eax, eax
je 0x444309
lea ecx, [esp + 0x2600]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x444309
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0x2600]
push edx
push 0x400
call edi
mov eax, dword [0x4ecd80]
mov edx, dword [esp + 0x19e0]
push eax
push 0x160
lea ecx, [esp + 0xc78]
push ecx
push edx
lea eax, [esp + 0xde0]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x4442ad
cmp byte [esp + 0xd80], 0
jne 0x444271
lea ecx, [esp + 0xd80]
push ecx
lea edx, [esp + 0xdd4]
push edx
mov ecx, ebp
call fcn.0043e0c0
mov eax, dword [0x4dbca4]
add eax, 2
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x10]
lea ecx, [esp + 0xd84]
push eax
mov dword [esp + 0x30], ecx
mov ecx, dword [ebp]
push 0x102e
push ecx
call ebx
mov edx, dword [esp + 0xc74]
or dword [esi + 0xc], 0x1000
mov dword [esi + 0x28], edx
lea eax, [esp + 0x1e00]
push eax
push 0x400
call edi
lea ecx, [esp + 0x1e00]
lea eax, [esp + 0x2600]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4442f0
test dl, dl
je 0x4442ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4442f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4442d0
xor eax, eax
jmp 0x4442f5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x444309
lea ecx, [esp + 0x2600]
push ecx
call fcn.004acbe8
add esp, 4
test dword [esi + 0xc], 0x1000
jne case.0x443841.10
lea edx, [esp + 0xc70]
push edx
lea eax, [esp + 0xdd4]
push eax
mov ecx, ebp
call fcn.0043e0c0
mov ecx, dword [0x4dbca4]
add ecx, 2
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0xc74]
push ecx
mov dword [esp + 0x30], edx
mov edx, dword [ebp]
push 0x102e
push edx
call ebx
lea eax, [esp + 0x11d0]
push eax
lea ecx, [esp + 0xdd4]
push ecx
call fcn.0042fd20
push 0x400
lea edx, [esp + 0x1e04]
push edx
mov edi, eax
call fcn.0047e340
lea eax, [esp + 0x1e00]
push eax
call fcn.0044df70
lea eax, [esp + 0x1e00]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x444397
mov ecx, dword [str._rar_icon_]
mov edx, dword [0x4b370c]
mov dword [eax], ecx
mov cx, word [0x4b3710]
mov dword [eax + 4], edx
mov dl, byte [0x4b3712]
mov word [eax + 8], cx
push edi
mov byte [eax + 0xa], dl
call fcn.0042fcd0
test al, al
je 0x444437
mov eax, dword [0x4bf0e8]
cmp eax, 0xffffffff
jne 0x4444b4
push 0
lea eax, [esp + 0x1e04]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x444422
push 0x4001
push 0x160
lea ecx, [esp + 0x1a08]
push ecx
push 0
lea edx, [esp + 0x1e10]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x444422
mov eax, dword [esp + 0x1a04]
mov dword [0x4bf0e8], eax
lea ecx, [esp + 0x1e00]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, dword [0x4bf0e8]
jmp 0x4444ab
mov eax, dword [0x4bf0e4]
cmp eax, 0xffffffff
jne 0x4444b4
lea edx, [esp + 0x1e00]
push 0x4b1ba8
push edx
call fcn.0049fec8
add esp, 8
test eax, eax
je 0x444496
push eax
call fcn.0049fba6
add esp, 4
push 0x4001
push 0x160
lea eax, [esp + 0x1a08]
push eax
push 0
lea ecx, [esp + 0x1e10]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x444496
mov edx, dword [esp + 0x1a04]
mov dword [0x4bf0e4], edx
lea eax, [esp + 0x1e00]
push eax
call fcn.004a1a8d
mov eax, dword [0x4bf0e4]
add esp, 4
cmp eax, 0xffffffff
je case.0x443841.10
or dword [esi + 0xc], 0x1000
mov dword [esi + 0x28], eax
jmp case.0x443841.10
mov edx, dword [esp + 0x2e08]
push esi
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x443934