Function at 0x413760
Capabilities:
Get common file path
Get keyboard layout
Query environment variable
Query or enumerate registry value
Set current directory
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bec96
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2e8
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x1c], ebx
call fcn.0042fd20
lea edi, [ebx + 0x94]
xor esi, esi
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.00495ab0
lea ecx, [ebx + 0xb0]
mov byte [ebp - 4], 1
call fcn.004306d0
lea ecx, [ebx + 0xe8]
mov byte [ebp - 4], 2
call fcn.00431800
lea ecx, [ebx + 0x118]
mov byte [ebp - 4], 3
call fcn.004252f0
mov dword [ebx], fcn.00404e90
mov dword [edi], 0x4c9db0
mov dword [ebx + 0xb0], 0x4c9da0
mov dword [ebx + 0xe8], 0x4c9d84
mov dword [ebx + 0x118], 0x4c9d80
or eax, 0xffffffff
xor ecx, ecx
xor edx, edx
mov dword [ebx + 0x37d8], esi
mov dword [ebx + 0x37e0], esi
mov dword [ebx + 0x37dc], esi
mov dword [ebx + 0x37e4], eax
mov word [ebx + 0x37e8], cx
mov word [ebx + 0x38ec], dx
mov dword [ebx + 0x38e8], esi
mov dword [ebx + 0x3d08], eax
xor eax, eax
mov dword [ebx + 0x3cfc], esi
mov dword [ebx + 0x3d04], esi
mov dword [ebx + 0x3d00], esi
mov word [ebx + 0x3d0c], ax
mov word [ebx + 0x3e10], cx
mov dword [ebx + 0x3e0c], esi
lea ecx, [ebx + 0x43bc]
mov byte [ebp - 4], 6
call fcn.00432730
mov byte [ebp - 4], 7
mov dword [0x50b39c], ebx
call fcn.0049e9e0
call fcn.0041fdb0
push 0x4c1318
push 4
push 6
push 0xd
lea eax, [ebx + 0x194]
push str._02u_02u_02u_s
push eax
mov dword [ebx + 0x4244], esi
mov byte [ebx + 0x74b0], 0
mov dword [ebx + 0x74b4], esi
call dword [sym.imp.USER32.dll_wsprintfW]
lea edi, [ebx + 0x154]
push 0x4cae30
push edi
call fcn.0040ee90
add esp, 0x20
lea eax, [ebx + 0x194]
push eax
push 0x20
push edi
call fcn.00401880
push str.__32_
push 0x20
push edi
call fcn.00401880
push 0x1cb8
call fcn.004412a0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 8
cmp eax, esi
je 0x4138f9
mov ecx, eax
call fcn.0043db60
jmp 0x4138fb
xor eax, eax
push 0xbbe8
mov byte [ebp - 4], 7
mov dword [ebx + 0x4230], eax
mov dword [ebx + 0x4234], esi
mov dword [ebx + 0x4240], esi
call fcn.004412a0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 9
cmp eax, esi
je 0x413932
mov ecx, eax
call fcn.00490900
jmp 0x413934
xor eax, eax
push 0x60
mov byte [ebp - 4], 7
mov dword [ebx + 0x423c], eax
call fcn.004412a0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xa
cmp eax, esi
je 0x41395c
mov ecx, eax
call fcn.00429b10
jmp 0x41395e
xor eax, eax
push 4
mov byte [ebp - 4], 7
mov dword [ebx + 0x4248], eax
mov dword [ebx + 0x4238], esi
call fcn.004412a0
add esp, 4
cmp eax, esi
je 0x413980
mov dword [eax], esi
jmp 0x413982
xor eax, eax
push 0x34
mov dword [ebx + 0x424c], eax
call fcn.004412a0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xb
cmp eax, esi
je 0x4139a6
mov ecx, eax
call fcn.00488010
jmp 0x4139a8
xor eax, eax
xor edx, edx
mov byte [ebp - 4], 7
mov dword [ebx + 0x4250], eax
mov word [ebx + 0x71b0], dx
mov dword [ebx + 0x73b8], esi
mov dword [ebx + 0x73bc], esi
mov byte [ebx + 0x73c0], dl
mov dword [ebx + 0x73c4], esi
mov dword [ebx + 0x73c8], esi
mov byte [ebx + 0x73cc], dl
mov dword [ebx + 0x73d0], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x42bc], esi
mov dword [ebx + 0x4228], esi
mov dword [ebx + 0x740c], eax
mov dword [ebx + 0x4260], 0x51f
mov byte [ebx + 0x425c], 0
mov dword [ebx + 0x4264], 0xffffffff
mov byte [ebx + 0x42ac], 0
mov byte [ebx + 0x42ad], 0
mov byte [ebx + 0x42ae], 0
mov byte [ebx + 0x4224], 1
mov byte [ebx + 0x422c], 0
mov eax, dword [0x50b3a0]
mov ecx, dword [eax + 0x113d8]
mov dword [ebx + 0x42a4], ecx
mov edx, dword [0x50b3a0]
mov eax, dword [edx + 0x113dc]
mov dword [ebx + 0x42a8], eax
mov esi, dword [0x50b3a0]
add esi, 0x1139c
lea edi, [ebx + 0x426c]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov esi, dword [0x50b3a0]
add esi, 0x113b8
lea edi, [ebx + 0x4288]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [ebx + 0x4220], edi
mov byte [ebx + 0x42af], 0
mov byte [ebx + 0x42b0], 0
mov byte [ebx + 0x42b1], 0
mov byte [ebx + 0x42b2], 0
mov dword [ebx + 0x42b4], edi
mov dword [ebx + 0x50a4], edi
mov dword [ebx + 0x50a8], edi
mov dword [ebx + 0x50ac], edi
mov dword [ebx + 0x50b0], edi
push edi
lea ecx, [ebp - 0x2c]
push edi
push ecx
mov byte [ebx + 0x4269], 0
mov byte [ebx + 0x426a], 0
mov dword [ebx + 0x42b8], edi
mov byte [ebx + 0x4330], 0
mov byte [ebx + 0x4331], 0
mov dword [ebx + 0x4334], edi
call fcn.0041f520
mov edx, dword [eax + 4]
mov esi, dword [eax + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x4340], ecx
mov dword [ebx + 0x4344], edx
mov dword [ebx + 0x4348], esi
mov dword [ebx + 0x434c], eax
mov esi, 1
mov edx, edi
mov eax, edi
mov byte [ebx + 0x4338], 0
mov dword [ebx + 0x433c], edi
mov dword [ebx + 0x4350], edi
mov dword [ebx + 0x4354], edi
mov dword [ebx + 0x4358], esi
mov dword [ebx + 0x435c], edi
mov dword [ebx + 0x4360], edi
mov dword [ebx + 0x4364], edx
mov dword [ebx + 0x4368], eax
mov dword [ebx + 0x43a8], edi
mov word [ebx + 0x4f48], dx
mov byte [ebx + 0x504a], dl
mov dword [ebx + 0x4384], edi
mov byte [ebx + 0x504b], dl
mov byte [ebx + 0x504c], dl
mov byte [ebx + 0x436c], dl
mov byte [ebx + 0x436d], dl
mov dword [ebx + 0x4370], edi
xor ecx, ecx
mov word [ebx + 0x45c8], cx
mov dword [ebx + 0x4374], edi
mov dword [ebx + 0x4378], edi
push 0x2c
mov dword [ebx + 0x437c], edi
lea eax, [ebx + 0x5074]
mov dword [ebx + 0x4380], edi
push edi
push eax
mov byte [ebx + 0x71ad], dl
mov byte [ebx + 0x71ae], dl
call fcn.004b03e0
add esp, 0x18
push 0x7f02
mov dword [ebx + 0x5064], esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
push edi
mov dword [ebx + 0x50a0], edi
mov dword [ebx + 0x50b4], edi
mov byte [ebx + 0x73d4], 0
mov dword [ebx + 0x73dc], edi
mov dword [ebx + 0x73e0], edi
mov dword [ebx + 0x73d8], edi
mov dword [ebx + 0x73e4], edi
mov dword [ebx + 0x73e8], edi
mov dword [ebx + 0x7400], edi
mov dword [ebx + 0x73fc], edi
mov dword [ebx + 0x73f4], edi
mov dword [ebx + 0x73f0], edi
mov dword [ebx + 0x73ec], edi
mov dword [ebx + 0x73f8], 0xffffffff
mov dword [ebx + 0x7408], edi
mov dword [ebx + 0x7404], edi
mov dword [ebx + 0x5060], edi
mov dword [ebx + 0x5068], edi
mov dword [ebx + 0x506c], edi
mov dword [ebx + 0x5070], edi
call esi
push 0x7f00
push edi
mov dword [ebx + 0x438c], eax
call esi
push 0x7f86
push edi
mov dword [ebx + 0x4390], eax
call esi
push 0x7f8a
mov dword [ebx + 0x4398], eax
push edi
mov dword [ebx + 0x43a4], edi
call esi
push 0x7c
push edi
mov dword [ebx + 0x4394], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
push 0x7d
push edi
mov dword [ebx + 0x439c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
push 0x64
lea ecx, [ebx + 0x42c0]
push edi
push ecx
mov dword [ebx + 0x43a0], eax
call fcn.004b03e0
or eax, 0xffffffff
mov dword [ebx + 0x42ec], eax
mov dword [ebx + 0x42f0], eax
push 0x2000
mov dword [ebx + 0x4324], edi
lea edx, [ebx + 0x51ac]
push edi
mov dword [ebx + 0x4328], edi
push edx
mov dword [ebx + 0x432c], edi
call fcn.004b03e0
mov eax, dword [ebx + 0x740c]
add esp, 0x18
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push pe_nt_image_headers32
lea ecx, [ebx + 0x50bc]
push edi
push ecx
mov dword [ebx + 0x50b8], eax
call fcn.004b03e0
push 0x1746
lea esi, [ebx + 0x2090]
push edi
push esi
mov byte [ebx + 0x71ac], 0
call fcn.004b03e0
mov dword [esi], 0x1746
mov byte [ebx + 0x43ac], 0
mov byte [ebx + 0x43ad], 0
mov dword [ebx + 0x43b0], edi
mov byte [ebx + 0x43b5], 0
mov byte [ebx + 0x43b4], 0
push 0x78
mov dword [ebx + 0x43b8], edi
lea edx, [ebx + 0x74b8]
push edi
mov byte [ebx + 0x43b6], 0
push edx
mov byte [ebx + 0x162c], 0
call fcn.004b03e0
mov dword [ebx + 0x7530], edi
mov dword [ebx + 0x7534], edi
mov dword [ebx + 0x7538], edi
mov dword [ebx + 0x753c], edi
add esp, 0x24
mov dword [ebx + 0x7540], edi
mov dword [ebx + 0x7544], edi
push str.user32.dll
mov dword [ebx + 0xbe4], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x413de3
push str.GetLayeredWindowAttributes
push eax
call esi
jmp 0x413de5
xor eax, eax
mov dword [ebx + 0x7548], eax
mov dword [ebx + 0x754c], edi
mov dword [ebx + 0x7550], edi
mov dword [ebx + 0x7554], edi
mov eax, 0x501
mov dword [ebx + 0x7558], edi
cmp word [0x4ec108], ax
jb 0x413e99
push str.Imm32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 0x754c], eax
cmp eax, edi
je 0x413e99
push str.ImmSetCompositionFontW
push eax
call esi
mov dword [ebx + 0x7550], eax
mov ecx, dword [ebx + 0x754c]
push str.ImmSetCompositionWindow
push ecx
call esi
mov dword [ebx + 0x7554], eax
mov edx, dword [ebx + 0x754c]
push str.ImmGetContext
push edx
call esi
mov dword [ebx + 0x7558], eax
cmp dword [ebx + 0x7550], edi
je 0x413e74
cmp dword [ebx + 0x7554], edi
je 0x413e74
cmp eax, edi
jne 0x413e99
mov dword [ebx + 0x7550], edi
mov dword [ebx + 0x7554], edi
mov dword [ebx + 0x7558], edi
mov eax, dword [ebx + 0x754c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebx + 0x754c], edi
lea edx, [ebp - 0x18]
push edx
push 0x20019
push edi
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
xor ecx, ecx
lea esi, [ebx + 0x9dc]
push reloc.OLEAUT32.dll_SysReAllocString
mov word [esi], cx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413ef2
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
push esi
push edi
push edi
push str.ComSpec
push ecx
mov dword [ebp - 0x10], 0x206
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x413ee8
xor edx, edx
mov word [esi], dx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esi], di
jne 0x413f06
push edi
push 0x104
push esi
call fcn.004aedf0
add esp, 0xc
mov dword [ebx + 0x208c], edi
xor ecx, ecx
mov word [ebx + 0x7d2], cx
xor edx, edx
mov word [ebx + 0x5c8], dx
xor eax, eax
mov word [ebx + 0x3be], ax
lea esi, [ebx + 0x3be]
mov word [ebx + 0x1b4], cx
lea eax, [ebx + 0x1b4]
mov word [ebx + 0x1e6c], dx
push 0x104
mov word [ebx + 0x1c4c], cx
mov word [ebx + 0x1a42], dx
push eax
mov word [ebx + 0x1838], cx
push edi
mov word [ebx + 0x162e], dx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4149ca
lea eax, [ebx + 0x1b4]
push 0x5c
push eax
call fcn.004b135e
add esp, 8
test eax, eax
je 0x4149ca
lea eax, [ebx + 0x7d2]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, edi
je 0x413fbf
cmp eax, 0x104
ja 0x413fbf
cmp word [ebx + eax*2 + 0x7d0], 0x5c
jne 0x413fcf
xor ecx, ecx
mov word [ebx + eax*2 + 0x7d0], cx
jmp 0x413fcf
lea eax, [ebx + 0x7d2]
push esi
push eax
call fcn.0040eef0
add esp, 8
lea eax, [ebx + 0x1b4]
push eax
push esi
call fcn.0040eef0
push 0x5c
push esi
call fcn.004b135e
add esp, 0x10
xor edx, edx
push esi
mov word [eax], dx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x2f4]
push esi
push eax
mov dword [ebx + 0xbec], edi
call fcn.00401a70
lea ecx, [ebp - 0x2f4]
push 0x5c
push ecx
call fcn.004b135e
add esp, 0x10
cmp eax, edi
je 0x414020
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x2f4]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x414030
sub eax, edx
sar eax, 1
push str.msys1.0_bin_sh.exe
mov dword [ebp - 0x10], eax
push 0x144
lea eax, [ebp - 0x2f4]
push eax
call fcn.00401880
lea ecx, [ebp - 0x2f4]
push edi
push ecx
call fcn.004acca0
add esp, 8
mov dword [ebx + 0xbf0], eax
cmp eax, edi
jne 0x4140ab
mov eax, dword [ebp - 0x10]
push str._bin_sh.exe
push 0x144
lea ecx, [ebp - 0x2f4]
xor edx, edx
push ecx
mov word [ebp + eax*2 - 0x2f4], dx
call fcn.00401880
lea edx, [ebp - 0x2f4]
push edi
push edx
call fcn.004acca0
add esp, 8
mov dword [ebx + 0xbf0], eax
lea eax, [ebx + 0x5c8]
push esi
push eax
call fcn.0040eef0
add esp, 8
push 0x4cacb8
push 0x105
lea eax, [ebx + 0x5c8]
push eax
call fcn.00401880
mov ecx, ebx
call fcn.00404e20
test al, al
jne 0x414185
lea eax, [ebx + 0x5c8]
push esi
push eax
call fcn.0040eef0
add esp, 8
mov ecx, ebx
call fcn.00404e20
test al, al
jne 0x414185
push 0x5c
push esi
call fcn.004b135e
add esp, 8
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x414185
push str._bin
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x414185
mov eax, dword [ebp - 0x10]
sub eax, ebx
sub eax, 0x3be
sar eax, 1
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebx + 0x5c8]
push esi
push eax
call fcn.00404870
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov word [ebx + ecx*2 + 0x5c8], ax
lea eax, [ebx + 0x5c8]
push str.libexecConEmu
push eax
call fcn.0040ef50
add esp, 0x14
mov ecx, ebx
call fcn.00404e20
test al, al
je 0x414175
movzx edx, al
mov dword [ebx + 0xbec], edx
jmp 0x414185
lea eax, [ebx + 0x5c8]
push esi
push eax
call fcn.0040eef0
add esp, 8
cmp dword [ebx + 0xbec], edi
je 0x4141a5
cmp dword [ebx + 0xbf0], edi
je 0x4141a5
mov ecx, dword [0x50b3a4]
push str.sh.exe___login__i
call fcn.0045da50
mov byte [ebx + 0x162d], 0
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4141e5
push 0x20
lea eax, [ebp - 0x6c]
push eax
push str.ConEmuBlockChildDebuggers
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4141e5
push 0x4cac2c
lea ecx, [ebp - 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
sete dl
mov byte [ebx + 0x162d], dl
push edi
push str.ConEmuBlockChildDebuggers
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
push str.ConEmuDir
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebx + 0x5c8]
push eax
push str.ConEmuBaseDir
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebx + 0x194]
push eax
push str.ConEmuBuild
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x4c1318
push str.ConEmuConfig
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, ebx
call fcn.0040f8a0
mov ecx, ebx
call fcn.0040f960
lea eax, [ebx + 0x5c8]
push eax
lea eax, [ebx + 0x1a42]
push eax
call fcn.0040eef0
add esp, 8
push str.ConEmu.chm
lea eax, [ebx + 0x1a42]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebx + 0x1a42]
push edi
push eax
call fcn.004acca0
add esp, 8
test eax, eax
jne 0x4142c5
push esi
lea eax, [ebx + 0x5c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4142bc
push esi
lea esi, [ebx + 0x1a42]
push esi
call fcn.0040eef0
add esp, 8
push str.ConEmu.chm
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
push esi
call fcn.004acca0
add esp, 8
test eax, eax
jne 0x4142c5
mov word [esi], ax
jmp 0x4142c5
xor ecx, ecx
mov word [ebx + 0x1a42], cx
lea esi, [ebx + 0x5c8]
lea eax, [ebx + 0x1c4c]
push esi
push eax
call fcn.0040ef70
add esp, 8
push 0x4c0bb0
push 0x110
lea eax, [ebx + 0x1c4c]
push eax
call fcn.00401880
call fcn.004ad0f0
test eax, eax
je 0x414349
push esi
lea esi, [ebx + 0x1e6c]
push esi
call fcn.0040ef70
add esp, 8
push 0x4c0bcc
push 0x110
push esi
call fcn.00401880
push edi
push esi
call fcn.004acca0
add esp, 8
test eax, eax
lea eax, [ebx + 0x1c4c]
jne 0x414332
push eax
push esi
jmp 0x414357
push edi
push eax
call fcn.004acca0
add esp, 8
test eax, eax
jne 0x41435f
push esi
lea eax, [ebx + 0x1c4c]
jmp 0x414356
lea eax, [ebx + 0x1c4c]
push eax
lea eax, [ebx + 0x1e6c]
push eax
call fcn.0040ef70
add esp, 8
mov ecx, ebx
call fcn.00410790
mov dword [ebx + 0xbe8], eax
mov dword [ebx + 0xbf4], edi
xor edx, edx
mov word [ebx + 0x1214], dx
xor eax, eax
mov word [ebx + 0xe00], ax
xor ecx, ecx
mov word [ebx + 0xbf8], cx
mov word [ebx + 0x1008], dx
mov dword [ebx + 0x141c], edi
mov word [ebx + 0x1420], ax
mov dword [ebx + 0x1628], edi
mov dword [ebx + 0x1210], edi
cmp dword [0x50b3c4], 6
jb 0x4143c3
call fcn.004acfb0
mov dword [ebx + 0x4388], eax
jmp 0x4143c9
mov dword [ebx + 0x4388], edi
mov dword [ebx + 0x5050], edi
mov dword [ebx + 0x5054], edi
mov dword [ebx + 0x5058], edi
xor eax, eax
mov dword [ebx + 0x7410], 0x800a
lea esi, [ebx + 0x7414]
push 0xc
mov dword [esi], eax
push 0x100
mov dword [esi + 4], eax
call fcn.004412c0
add esp, 8
mov dword [esi], eax
cmp eax, edi
je 0x41440e
mov dword [esi + 4], 0x100
inc dword [ebx + 0x7410]
mov ecx, dword [ebx + 0x7410]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x14], str.PostCreate
call fcn.00409670
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x741c], ecx
inc dword [ebx + 0x7410]
mov edx, dword [ebx + 0x7410]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.PostCopy
mov dword [ebp - 0x10], edx
call fcn.00409670
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x7420], edx
inc dword [ebx + 0x7410]
mov eax, dword [ebx + 0x7410]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.MyDestroy
mov dword [ebp - 0x10], eax
call fcn.00409670
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x7424], eax
inc dword [ebx + 0x7410]
mov ecx, dword [ebx + 0x7410]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x14], str.UpdateSizes
call fcn.00409670
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x7428], ecx
inc dword [ebx + 0x7410]
mov edx, dword [ebx + 0x7410]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.UpdateCursorInfo
mov dword [ebp - 0x10], edx
call fcn.00409670
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x742c], edx
inc dword [ebx + 0x7410]
mov eax, dword [ebx + 0x7410]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.SetWindowMode
mov dword [ebp - 0x10], eax
call fcn.00409670
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x7430], eax
inc dword [ebx + 0x7410]
mov ecx, dword [ebx + 0x7410]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], str.UpdateTitle
push eax
mov ecx, esi
call fcn.00409670
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x7434], ecx
inc dword [ebx + 0x7410]
mov edx, dword [ebx + 0x7410]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.SrvStarted
mov dword [ebp - 0x10], edx
call fcn.00409670
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x7438], edx
inc dword [ebx + 0x7410]
mov eax, dword [ebx + 0x7410]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.VConTerminated
mov dword [ebp - 0x10], eax
call fcn.00409670
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x743c], eax
inc dword [ebx + 0x7410]
mov ecx, dword [ebx + 0x7410]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x14], str.UpdateScrollInfo
call fcn.00409670
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x7440], ecx
inc dword [ebx + 0x7410]
mov edx, dword [ebx + 0x7410]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.UpdateTabs
mov dword [ebp - 0x10], edx
call fcn.00409670
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x7444], edx
inc dword [ebx + 0x7410]
mov eax, dword [ebx + 0x7410]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.OldCmdVer
mov dword [ebp - 0x10], eax
call fcn.00409670
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x7448], eax
mov dword [ebx + 0x744c], edi
inc dword [ebx + 0x7410]
mov ecx, dword [ebx + 0x7410]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x14], str.TabCommand
call fcn.00409670
mov ecx, dword [ebp - 0x10]
push str.ConEmuMain::SwitchCon
mov dword [ebx + 0x7450], ecx
push str.CONEMUMSG_SWITCHCON
mov ecx, ebx
call fcn.0040ed70
mov dword [ebx + 0x7454], eax
push str.ConEmuMain::HookedKey
push str.CONEMUMSG_HOOKEDKEY
mov ecx, ebx
call fcn.0040ed70
mov dword [ebx + 0x7458], eax
inc dword [ebx + 0x7410]
mov edx, dword [ebx + 0x7410]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.PostConsoleResize
mov dword [ebp - 0x10], edx
call fcn.00409670
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x7460], edx
inc dword [ebx + 0x7410]
mov eax, dword [ebx + 0x7410]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.ConsoleLangChanged
mov dword [ebp - 0x10], eax
call fcn.00409670
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x7464], eax
inc dword [ebx + 0x7410]
mov ecx, dword [ebx + 0x7410]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x14], str.PostOnBufferHeight
call fcn.00409670
mov ecx, dword [ebp - 0x10]
push str.ConEmuMain::FlashWindow
mov dword [ebx + 0x7468], ecx
push str.CONEMUMSG_FLASHWINDOW
mov ecx, ebx
call fcn.0040ed70
mov dword [ebx + 0x7474], eax
inc dword [ebx + 0x7410]
mov edx, dword [ebx + 0x7410]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.PostAltF9
mov dword [ebp - 0x10], edx
call fcn.00409670
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x746c], edx
inc dword [ebx + 0x7410]
mov eax, dword [ebx + 0x7410]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.InitInactiveDC
mov dword [ebp - 0x10], eax
call fcn.00409670
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x7470], eax
inc dword [ebx + 0x7410]
mov ecx, dword [ebx + 0x7410]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x14], str.UpdateProcDisplay
call fcn.00409670
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x7478], ecx
inc dword [ebx + 0x7410]
mov edx, dword [ebx + 0x7410]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.AutoSizeFont
mov dword [ebp - 0x10], edx
call fcn.00409670
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x747c], edx
inc dword [ebx + 0x7410]
mov eax, dword [ebx + 0x7410]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.DisplayRConError
mov dword [ebp - 0x10], eax
call fcn.00409670
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x7480], eax
inc dword [ebx + 0x7410]
mov ecx, dword [ebx + 0x7410]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x14], str.MacroFontSetName
call fcn.00409670
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x7484], ecx
inc dword [ebx + 0x7410]
mov edx, dword [ebx + 0x7410]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], str.CreateViewWindow
mov dword [ebp - 0x10], edx
call fcn.00409670
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x7488], edx
inc dword [ebx + 0x7410]
mov eax, dword [ebx + 0x7410]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.PostTaskbarActivate
mov dword [ebp - 0x10], eax
call fcn.00409670
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x748c], eax
mov dword [ebx + 0x7490], edi
inc dword [ebx + 0x7410]
mov edi, dword [ebx + 0x7410]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.InitVConGhost
mov dword [ebp - 0x10], edi
call fcn.00409670
mov dword [ebx + 0x7494], edi
inc dword [ebx + 0x7410]
mov edi, dword [ebx + 0x7410]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], str.CreateCon
mov dword [ebp - 0x10], edi
push ecx
mov ecx, esi
call fcn.00409670
mov dword [ebx + 0x7498], edi
inc dword [ebx + 0x7410]
mov edi, dword [ebx + 0x7410]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
mov dword [ebp - 0x14], str.RequestUpdate
mov dword [ebp - 0x10], edi
call fcn.00409670
push str.ConEmuTh::MapCoords
push str.CONEMUMSG_PNLVIEWMAPCOORD
mov ecx, ebx
mov dword [ebx + 0x749c], edi
call fcn.0040ed70
push str.TaskbarCreated
push 0x4ca8c8
mov ecx, ebx
mov dword [ebx + 0x74a4], eax
call fcn.0040ed70
push str.TaskbarButtonCreated
push 0x4ca884
mov ecx, ebx
mov dword [ebx + 0x74a0], eax
call fcn.0040ed70
push str.SHELLHOOK
push 0x4ca864
mov ecx, ebx
mov dword [ebx + 0x74a8], eax
call fcn.0040ed70
mov dword [ebx + 0x745c], eax
inc dword [ebx + 0x7410]
mov edi, dword [ebx + 0x7410]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
mov dword [ebp - 0x14], str.RequestRunProcess
mov dword [ebp - 0x10], edi
call fcn.00409670
mov dword [ebx + 0x74ac], edi
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push edi
push edi
push edi
push edi
push str.GetModuleFileName_failed
call fcn.004200b0
add esp, 0x14
push 0x64
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret