Function at 0x41bf90
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Create shortcut via ishelllink
Enumerate gui resources
Get file attributes
Get file system object information
Hide graphical window
Open clipboard
Resolve function by parsing pe exports
Set current directory
Set file attributes
Write clipboard data

Disassembly:
mov eax, 0x1420
call fcn.0047a160
mov eax, dword [0x493008]
xor eax, esp
mov dword [esp + 0x141c], eax
push ebx
push ebp
push esi
push edi
movzx edi, dx
mov ebx, ecx
mov eax, edi
cmp eax, 0x9d6d
ja 0x41d5f1
je 0x41d5b5
sub eax, 0x9c41
cmp eax, 0xd7
ja case.default.0x41de9d
movzx eax, byte [eax + 0x41e390]
jmp dword [eax*4 + 0x41e308]
push 0x208
lea eax, [esp + 0x98]
mov dword [esp + 0x94], 7
push 0
push eax
call fcn.00425950
add esp, 0xc
xor eax, eax
mov word [esp + 0x29c], ax
push 0x206
push eax
lea eax, [esp + 0x2a6]
push eax
call fcn.00425950
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x9c]
add esp, 0xc
mov dword [esp + 0x4a4], 0
or edx, 0xffffffff
push eax
call fcn.00413ce0
mov eax, dword [esp + 0x4a8]
add esp, 4
sub eax, 1
je 0x41c0fc
sub eax, 1
jne case.default.0x41de9d
call fcn.00414fa0
lea ecx, [esp + 0x94]
call fcn.00416000
lea ecx, [esp + 0x94]
test eax, eax
jne 0x41c08e
xor edx, edx
call fcn.004205c0
call fcn.00414fc0
jmp case.default.0x41de9d
push 0x104
lea edx, [esp + 0x984]
call fcn.00416080
add esp, 4
test eax, eax
je 0x41c0e6
mov edx, 0x104
lea ecx, [esp + 0x980]
call fcn.00416590
lea eax, [esp + 0x980]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41c0e6
test al, 0x10
jne 0x41c0e6
xor edx, edx
lea ecx, [esp + 0x980]
call fcn.004205c0
call fcn.00414fc0
jmp case.default.0x41de9d
lea ecx, [esp + 0x94]
call fcn.0041fbf0
call fcn.00414fc0
jmp case.default.0x41de9d
lea edx, [esp + 0x94]
push 1
mov ecx, ebx
call fcn.0041eee0
add esp, 4
test eax, eax
jne case.default.0x41de9d
push 0xc350
push 2
call fcn.00412d90
add esp, 8
jmp case.default.0x41de9d
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x90]
push eax
or edx, 0xffffffff
mov dword [esp + 0x94], 7
call fcn.00413ce0
add esp, 4
cmp dword [esp + 0x4a4], 2
jne 0x41c20a
call fcn.00414fa0
lea ecx, [esp + 0x94]
call fcn.00416000
lea ecx, [esp + 0x94]
test eax, eax
jne 0x41c18b
lea edx, [eax + 1]
call fcn.004205c0
call fcn.00414fc0
jmp case.default.0x41de9d
push 0x104
lea edx, [esp + 0x984]
call fcn.00416080
add esp, 4
test eax, eax
je 0x41c1e6
mov edx, 0x104
lea ecx, [esp + 0x980]
call fcn.00416590
lea eax, [esp + 0x980]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41c1e6
test al, 0x10
jne 0x41c1e6
mov edx, 1
lea ecx, [esp + 0x980]
call fcn.004205c0
call fcn.00414fc0
jmp case.default.0x41de9d
lea ecx, [esp + 0x94]
call fcn.0041fbf0
call fcn.00414fc0
jmp case.default.0x41de9d
cmp dword [esp + 0x4a4], 2
je 0x41e06f
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp case.default.0x41de9d
mov esi, dword [0x560844]
mov ecx, 0x65
call fcn.00417a20
push 0
push 0x40dc80
push ebx
mov edi, eax
push edi
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
test edi, edi
je case.default.0x41de9d
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.default.0x41de9d
call fcn.00416890
test eax, eax
je 0x41c20a
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x4a8]
push eax
or edx, 0xffffffff
mov dword [esp + 0x4ac], 1
call fcn.00413ce0
add esp, 4
cmp eax, 0xffffffff
je case.default.0x41de9d
lea eax, [esp + 0x4ac]
mov dword [esp + 0x8d8], 0x5634ac
mov dword [esp + 0x8d0], eax
mov dword [esp + 0x8d4], 0
xorps xmm0, xmm0
mov dword [esp + 0x8f8], 0
lea eax, [esp + 0x8c0]
movlpd qword [esp + 0x8e0], xmm0
push eax
movlpd qword [esp + 0x8ec], xmm0
movlpd qword [esp + 0x8f4], xmm0
mov dword [esp + 0x8c4], 0x3c
mov dword [esp + 0x8c8], 0
mov dword [esp + 0x8cc], ebx
mov dword [esp + 0x8d0], 0
mov dword [esp + 0x8e0], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.default.0x41de9d
push 0x208
lea eax, [esp + 0x984]
push 0
push eax
call fcn.00425950
add esp, 0xc
lea eax, [esp + 0xe18]
push 0x208
push 0
push eax
call fcn.00425950
add esp, 0xc
call fcn.00416890
test eax, eax
je 0x41c20a
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x90]
push eax
or edx, 0xffffffff
mov dword [esp + 0x94], 1
call fcn.00413ce0
add esp, 4
cmp eax, 0xffffffff
je case.default.0x41de9d
lea ecx, [esp + 0x94]
call fcn.00416000
test eax, eax
je 0x41c3bc
push 0x104
lea edx, [esp + 0xe1c]
lea ecx, [esp + 0x98]
call fcn.00416080
add esp, 4
test eax, eax
je 0x41c3bc
push 0x104
lea eax, [esp + 0xe1c]
push eax
jmp 0x41c3d0
lea eax, [esp + 0xe18]
push 0x104
push eax
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp word [0x56390c], 0
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
je 0x41c40f
push 0x104
push 0x56390c
lea eax, [esp + 0x988]
push eax
call esi
push 0x104
push 0x48ddec
lea eax, [esp + 0x988]
push eax
call esi
push 0x104
lea eax, [esp + 0xe1c]
push eax
lea eax, [esp + 0x988]
push eax
call esi
lea eax, [esp + 0x980]
mov dword [esp + 0x8d0], 0x563704
mov dword [esp + 0x8d4], eax
mov dword [esp + 0x8d8], 0x5634ac
jmp 0x41c2a7
push 0
push 0
push 0x1032
push dword [0x561c6c]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41c20a
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x4a8]
push eax
or edx, 0xffffffff
mov dword [esp + 0x4ac], 1
call fcn.00413ce0
add esp, 4
cmp eax, 0xffffffff
je case.default.0x41de9d
lea edx, [esp + 0x4a8]
mov ecx, ebx
call fcn.00411bb0
jmp case.default.0x41de9d
mov esi, dword [0x560844]
mov ecx, 0x66
call fcn.00417a20
push 0
push 0x40e3c0
jmp 0x41c22e
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x980]
push 0x48d420
push eax
call edi
push pe_nt_image_headers32
lea edx, [esp + 0xe1c]
mov ecx, 0x2afc
call fcn.00414fe0
add esp, 4
lea ecx, [esp + 0xe18]
call fcn.00416530
push 0x20
lea edx, [esp + 0x8c4]
mov ecx, 0x2afb
call fcn.00414fe0
add esp, 4
lea eax, [esp + 0x900]
push 0x58
push 0
push eax
call fcn.00425950
lea eax, [esp + 0xe24]
mov dword [esp + 0x90c], 0x58
mov dword [esp + 0x918], eax
add esp, 0xc
lea eax, [esp + 0x980]
mov dword [esp + 0x904], ebx
mov dword [esp + 0x91c], eax
lea eax, [esp + 0x8c0]
mov dword [esp + 0x930], eax
lea eax, [esp + 0x900]
push eax
mov dword [esp + 0x924], 0x104
mov dword [esp + 0x930], 0x5634ac
mov dword [esp + 0x938], 0x210080e
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je case.default.0x41de9d
push 0
push pe_nt_image_headers32
push 2
push 0
push 3
push 0xc0000000
lea eax, [esp + 0x998]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41c660
push 0x2b4
lea eax, [esp + 0x102c]
push 0
push eax
call fcn.00425950
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x980]
push eax
lea eax, [esp + 0xc0c]
push eax
call edi
lea eax, [esp + 0xc08]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0xc08]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x19d0d
push 0x111
push ebx
call esi
push 0x200
push 0x2b4
lea eax, [esp + 0x1030]
push eax
push 0
lea eax, [esp + 0x990]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [esp + 0x980]
lea edx, [esp + 0x1034]
jmp 0x41dac1
push 0xc352
push 2
call fcn.00412d90
add esp, 8
jmp case.default.0x41de9d
mov esi, dword [0x560844]
mov ecx, 0x6b
call fcn.00417a20
mov edi, eax
lea eax, [esp + 0x90]
push eax
push 0x411de0
push ebx
push edi
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov esi, eax
test edi, edi
je 0x41c6a9
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 1
jne case.default.0x41de9d
lea eax, [esp + 0x298]
push eax
lea eax, [esp + 0xc0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
lea eax, [esp + 0xc0c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne case.default.0x41de9d
push 0xc353
push 2
call fcn.00412d90
add esp, 8
jmp case.default.0x41de9d
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x4a8]
push eax
or edx, 0xffffffff
mov dword [esp + 0x4ac], 1
call fcn.00413ce0
add esp, 4
cmp eax, 0xffffffff
je case.default.0x41de9d
push ecx
lea eax, [esp + 0xc0c]
mov edx, 0x2b02
push 0
push eax
mov ecx, ebx
call fcn.0040da00
add esp, 0xc
test eax, eax
je case.default.0x41de9d
push 2
lea eax, [esp + 0x20]
xor esi, esi
push eax
lea eax, [esp + 0x988]
push eax
lea eax, [esp + 0xc14]
push eax
lea eax, [esp + 0x4bc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
test eax, eax
je 0x41c815
lea eax, [esp + 0x14]
push eax
push 0x47fd7c
push 1
push esi
push 0x48378c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x41c80d
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push 0x48094c
push eax
mov ecx, dword [eax]
mov eax, dword [ecx]
call eax
test eax, eax
js 0x41c801
lea eax, [esp + 0x980]
push eax
lea eax, [esp + 0xe1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x4ac]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x50]
call eax
test eax, eax
jne 0x41c7f5
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xe18]
push 1
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x18]
call eax
test eax, eax
mov ecx, 1
cmovns esi, ecx
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
test esi, esi
jne case.default.0x41de9d
push 0xc35d
push 2
call fcn.00412d90
add esp, 8
jmp case.default.0x41de9d
call fcn.00416890
test eax, eax
je 0x41c20a
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x90]
push eax
or edx, 0xffffffff
mov dword [esp + 0x94], 7
call fcn.00413ce0
add esp, 4
cmp eax, 0xffffffff
je case.default.0x41de9d
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x984]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push pe_nt_image_headers32
lea edx, [esp + 0xe1c]
mov ecx, 0x2afc
call fcn.00414fe0
add esp, 4
lea ecx, [esp + 0xe18]
call fcn.00416530
push 0x58
lea eax, [esp + 0x904]
push 0
push eax
call fcn.00425950
lea eax, [esp + 0xe24]
mov dword [esp + 0x90c], 0x58
mov dword [esp + 0x918], eax
add esp, 0xc
lea eax, [esp + 0x980]
mov dword [esp + 0x904], ebx
mov dword [esp + 0x91c], eax
lea eax, [esp + 0x900]
mov dword [esp + 0x920], 0x104
push eax
mov dword [esp + 0x938], 0x210080e
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je case.default.0x41de9d
call fcn.00414fa0
lea eax, [esp + 0x29c]
push eax
push 0x2713
lea eax, [esp + 0xc10]
push 0x104
push eax
call fcn.00415060
lea eax, [esp + 0xc18]
mov edx, 0xff
push eax
call fcn.004158e0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x14
push 0
push 1
push 0x409
push dword [0x561b40]
call esi
push 1
push 0
push dword [0x561b40]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [0x561b40]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
lea eax, [esp + 0x984]
push eax
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x41c9ad
lea eax, [esp + 0x29c]
push eax
push 0xc354
push 2
call fcn.00412d90
add esp, 0xc
jmp 0x41c9ed
cmp dword [0x5633e8], 0
je 0x41c9ed
lea eax, [esp + 0x980]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x41c9ed
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x984]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x41c9ed
push 0xc355
push 2
call fcn.00412d90
add esp, 8
push 0
push 0
push 0x409
push dword [0x561b40]
call esi
call fcn.00414fc0
jmp case.default.0x41de9d
push 0
push 0
push 0x1032
push dword [0x561c6c]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41c20a
mov ecx, ebx
call fcn.00410eb0
jmp case.default.0x41de9d
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x4a8]
push eax
or edx, 0xffffffff
mov dword [esp + 0x4ac], 7
call fcn.00413ce0
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je case.default.0x41de9d
xor eax, eax
mov dword [esp + 0x3c], 0
push 0x400
push eax
mov word [esp + 0x48], ax
xorps xmm0, xmm0
lea eax, [esp + 0x1030]
movlpd qword [esp + 0x3c], xmm0
push eax
call fcn.00425950
add esp, 0xc
lea eax, [esp + 0x4ac]
push eax
lea eax, [esp + 0x102c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [0x563414], 0
lea eax, [esp + 0x1028]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 3
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0
je 0x41cae2
mov eax, 0x9c4e
cmp di, ax
je 0x41cae2
mov eax, 0x40
mov word [esp + 0x34], ax
jmp 0x41cae7
mov ax, word [esp + 0x34]
cmp dword [0x563418], 0
jne 0x41cafa
mov ecx, 0x9c4f
cmp di, cx
jne 0x41cb03
or ax, 0x10
mov word [esp + 0x34], ax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 0
push dword [0x56128c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne case.default.0x41de9d
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0x19d0d
push 0x111
push ebx
call edi
test esi, esi
jle 0x41cb3d
dec esi
push 0
push 0
push 0x1004
push dword [0x561c6c]
call edi
dec eax
cmp esi, eax
jl 0x41cb67
push 0
push 0
push 0x1004
push dword [0x561c6c]
call edi
lea esi, [eax - 1]
lea eax, [esp + 0x8c0]
mov dword [esp + 0x8d0], 1
push eax
push esi
push 0x102b
push dword [0x561c6c]
mov dword [esp + 0x8dc], 1
call edi
push 0
push esi
push 0x1013
push dword [0x561c6c]
call edi
push dword [0x56128c]
call dword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
jmp case.default.0x41de9d
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1032
push dword [0x561c6c]
call ebp
test eax, eax
je 0x41c20a
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x4a8]
push eax
or edx, 0xffffffff
mov dword [esp + 0x4ac], 1
call fcn.00413ce0
add esp, 4
cmp eax, 0xffffffff
je case.default.0x41de9d
lea ecx, [esp + 0x4ac]
call fcn.004164f0
push eax
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [0x560844]
mov ecx, 0x68
call fcn.00417a20
mov edi, eax
lea eax, [esp + 0x90]
push eax
push 0x4102c0
push ebx
push edi
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov esi, eax
test edi, edi
je 0x41cc50
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 1
jne case.default.0x41de9d
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0xe18]
mov dword [esp + 0x2c], eax
xorps xmm0, xmm0
lea eax, [esp + 0xc08]
movlpd qword [esp + 0x36], xmm0
mov dword [esp + 0x30], eax
mov eax, 0x40
mov word [esp + 0x34], ax
lea eax, [esp + 0x4ac]
push eax
lea eax, [esp + 0x984]
mov dword [esp + 0x42], 0
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 4
call esi
lea ecx, [esp + 0x980]
call fcn.004164f0
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x298]
push eax
lea eax, [esp + 0x984]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x210
lea eax, [esp + 0xe1c]
push 0
push eax
call fcn.00425950
add esp, 0xc
lea eax, [esp + 0xc08]
push 0x210
push 0
push eax
call fcn.00425950
add esp, 0xc
lea eax, [esp + 0x4ac]
push eax
lea eax, [esp + 0xe1c]
push eax
call esi
lea eax, [esp + 0x980]
push eax
lea eax, [esp + 0xc0c]
push eax
call esi
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne case.default.0x41de9d
push 0x2b4
push eax
lea eax, [esp + 0x1030]
push eax
call fcn.00425950
add esp, 0xc
push 0
push 0x19d0d
push 0x111
push ebx
call ebp
push 0x200
push 0x2b4
lea eax, [esp + 0x1030]
push eax
push 0
lea eax, [esp + 0xc18]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [esp + 0xc08]
push eax
lea edx, [esp + 0x1038]
call fcn.00414140
add esp, 4
jmp case.default.0x41de9d
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1032
push dword [0x561c6c]
call esi
push 0
test eax, eax
je 0x41c20c
mov ebx, dword [0x561c6c]
push 0
push 0x1032
push ebx
call esi
test eax, eax
je case.default.0x41de9d
push 2
push 0xffffffffffffffff
push 0x100c
push ebx
call esi
mov dword [esp + 0x8c4], eax
lea eax, [esp + 0x8c0]
push eax
push 0
push 0x104b
push ebx
mov dword [esp + 0x8d0], 4
mov dword [esp + 0x8d8], 0
call esi
test eax, eax
je case.default.0x41de9d
mov esi, dword [esp + 0x8e0]
mov ebp, dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [esi + 4]
mov edi, dword [eax]
lea eax, [esp + 0x18]
push eax
push 0
push 0x47f03c
push esi
push 1
push ebx
call ebp
push eax
push dword [esi + 4]
mov eax, dword [edi + 0x28]
call eax
test eax, eax
jne case.default.0x41de9d
push ebx
mov dword [esp + 0x28], 0x24
mov dword [esp + 0x2c], eax
call ebp
mov dword [esp + 0x2c], eax
lea edx, [esp + 0x24]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], str.properties
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x10]
call eax
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
jmp case.default.0x41de9d
push ecx
lea eax, [esp + 0xc0c]
mov edx, 0x2afe
push 0
push eax
call fcn.0040da00
add esp, 0xc
test eax, eax
je case.default.0x41de9d
lea edx, [esp + 0xc08]
jmp 0x41c103
mov ebx, dword [0x561b84]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x147
push ebx
call esi
cmp eax, 0xffffffff
je case.default.0x41de9d
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x48]
push eax
push 0
push 0x40d
push ebx
mov dword [esp + 0x58], 0x20
call esi
mov esi, dword [esp + 0x68]
mov ebp, dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [esi + 4]
mov edi, dword [eax]
lea eax, [esp + 0x18]
push eax
push 0
push 0x47f03c
push esi
push 1
push ebx
call ebp
push eax
push dword [esi + 4]
mov eax, dword [edi + 0x28]
call eax
test eax, eax
jne case.default.0x41de9d
push ebx
mov dword [esp + 0x28], 0x24
mov dword [esp + 0x2c], eax
call ebp
mov dword [esp + 0x2c], eax
lea edx, [esp + 0x24]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], str.properties
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x10]
call eax
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
jmp case.default.0x41de9d
push 0x104
lea eax, [esp + 0xc0c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5634ac
lea eax, [esp + 0x984]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x980]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x980]
push 0x48e6b0
push eax
call esi
cmp word [0x560388], 0
lea eax, [esp + 0x980]
je 0x41d033
push 0x48df90
push eax
call esi
push 0x560388
lea eax, [esp + 0x984]
push eax
call esi
push 0x48e2d4
lea eax, [esp + 0x984]
jmp 0x41d038
push 0x48e6b8
push eax
call esi
push 0x48e6bc
lea eax, [esp + 0x984]
push eax
call esi
lea eax, [esp + 0x8c0]
mov dword [esp + 0x8c0], 0x2c
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 2
lea eax, [esp + 0x8e0]
push eax
call dword [sym.imp.USER32.dll_MonitorFromRect]
lea ecx, [esp + 0x48]
mov dword [esp + 0x48], 0x28
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov eax, dword [esp + 0x8dc]
mov ecx, dword [esp + 0x8e0]
mov edi, dword [esp + 0x8e4]
sub edi, eax
mov dword [esp + 0x18], edi
lea ebp, [eax + 0xa]
mov edi, dword [esp + 0x8e8]
lea edx, [ecx + 0xa]
sub edi, ecx
mov ecx, dword [esp + 0x18]
lea eax, [ecx + ebp]
cmp eax, dword [esp + 0x64]
jg 0x41d0c8
lea eax, [edi + edx]
cmp eax, dword [esp + 0x68]
jle 0x41d0d0
mov ebp, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
push edi
push ecx
push edx
push ebp
lea eax, [esp + 0x910]
push 0x48e6c4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [esp + 0x900]
push eax
lea eax, [esp + 0x984]
push eax
call esi
push 1
push 0
lea eax, [esp + 0x988]
push eax
lea eax, [esp + 0xc14]
push eax
push 0
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.default.0x41de9d
mov eax, dword [0x5634a0]
test al, 0x20
je 0x41d12c
and eax, 0xffffffdf
jmp 0x41d12f
or eax, 0x20
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x19d0d
push 0x111
push ebx
mov dword [0x5634a0], eax
call esi
push 0
push 0
push 0x1013
push dword [0x561c6c]
call esi
jmp case.default.0x41de9d
mov eax, dword [0x5634a0]
test al, 0x40
je 0x41d16d
and eax, 0xffffffbf
jmp 0x41d12f
or eax, 0x40
jmp 0x41d12f
mov eax, dword [0x5634a0]
test al, al
jns 0x41d182
and eax, 0xffffff7f
jmp 0x41d12f
or eax, 0x80
jmp 0x41d12f
push 0x56493c
lea eax, [esp + 0xe1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebp, dword [0x56343c]
mov ecx, 0x67
mov esi, dword [0x560844]
call fcn.00417a20
push 0
push 0x40fea0
push ebx
mov edi, eax
push edi
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov esi, eax
test edi, edi
je 0x41d1d1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 1
jne 0x41d271
lea eax, [esp + 0xe18]
push eax
push 0x56493c
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41d1f9
cmp ebp, dword [0x56343c]
je 0x41d271
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x90]
push eax
or edx, 0xffffffff
mov dword [esp + 0x94], 7
mov dword [esp + 0x4a8], 0
call fcn.00413ce0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 4
push 0
push 0x19d0d
push 0x111
push ebx
call esi
cmp dword [esp + 0x4a4], 0
je 0x41d271
lea eax, [esp + 0x94]
push eax
lea edx, [esp + 0x2a0]
call fcn.00414140
add esp, 4
test eax, eax
jne 0x41d271
push eax
push eax
push 0x1013
push dword [0x561c6c]
call esi
push 0x48d9fc
push 0x56493c
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x41d292
cmp dword [0x56343c], eax
mov eax, 0xe
je 0x41d297
mov eax, 0xd
push eax
call fcn.00415c10
add esp, 4
jmp case.default.0x41de9d
push 0x48d9fc
push 0x56493c
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x41d2c5
cmp dword [0x56343c], eax
je 0x41d357
push 0x48d9fc
push 0x56493c
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x90]
push eax
or edx, 0xffffffff
mov dword [0x56343c], 0
mov dword [esp + 0x94], 7
mov dword [esp + 0x4a8], 0
call fcn.00413ce0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 4
push 0
push 0x19d0d
push 0x111
push ebx
call esi
cmp dword [esp + 0x4a4], 0
je 0x41d357
lea eax, [esp + 0x94]
push eax
lea edx, [esp + 0x2a0]
call fcn.00414140
add esp, 4
test eax, eax
jne 0x41d357
push eax
push eax
push 0x1013
push dword [0x561c6c]
call esi
push 0xe
call fcn.00415c10
add esp, 4
jmp case.default.0x41de9d
push 1
xor edx, edx
call fcn.0041eee0
add esp, 4
jmp case.default.0x41de9d
mov edx, 0xc35a
mov ecx, 0x563b14
call fcn.0041f9a0
jmp case.default.0x41de9d
mov dword [esp + 0x8d0], 0x563b14
mov dword [esp + 0x8d8], 0
jmp 0x41c29c
xor eax, eax
cmp dword [0x56341c], eax
sete al
mov dword [0x56341c], eax
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [0x561b50]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, ebx
call fcn.00415c50
jmp case.default.0x41de9d
push 0
push 0
push 0x41b
push dword [0x561b48]
jmp 0x41e2e4
cmp dword [0x563420], 0
je 0x41d417
push 0
push dword [0x561b40]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, ebx
mov dword [0x563420], 0
call fcn.00415c50
jmp case.default.0x41de9d
push 5
push dword [0x561b40]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, ebx
mov dword [0x563420], 1
call fcn.00415c50
jmp case.default.0x41de9d
cmp dword [0x563424], 0
je 0x41d488
push 0
push dword [0x561b84]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x563424], 0
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp eax, 0xa000
jne 0x41d4a0
push dword [0x561c6c]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, ebx
call fcn.00415c50
jmp case.default.0x41de9d
push 5
push dword [0x561b84]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x563424], 1
mov ecx, ebx
call fcn.00415c50
jmp case.default.0x41de9d
xor edi, edi
cmp word [0x560388], di
jne 0x41d516
cmp word [0x55ff68], di
je case.default.0x41de9d
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x55ff68
push 0x560388
call esi
call fcn.00404070
push 0x48d420
test eax, eax
je 0x41d4ed
push 0x55ff68
call esi
jmp 0x41d4f9
push 0x560388
call esi
mov edi, 1
test edi, edi
je 0x41d516
mov ecx, 0xc363
mov eax, 2
push ecx
push eax
call fcn.00412d90
add esp, 8
jmp case.default.0x41de9d
push 0x48e6e4
push str.WriteTest
mov edx, str.Settings
call fcn.00403560
add esp, 8
test eax, eax
je 0x41d569
push ecx
push 0x563f24
call fcn.00415900
add esp, 8
call fcn.00414fa0
mov ecx, 1
call fcn.00405440
call fcn.00414fc0
mov ecx, 0x2b03
xor eax, eax
push ecx
push eax
call fcn.00412d90
add esp, 8
jmp case.default.0x41de9d
mov ecx, 0xc364
mov eax, 2
push ecx
push eax
call fcn.00412d90
add esp, 8
jmp case.default.0x41de9d
push 0
push 0x4123d0
push ebx
mov edx, 0x6c
call fcn.00417c40
add esp, 0xc
jmp case.default.0x41de9d
call fcn.0040fb10
mov ecx, 0x563704
call fcn.004025d0
mov dword [0x561288], eax
jmp case.default.0x41de9d
cmp dword [0x5634a8], 0
mov eax, dword [0x561c6c]
mov dword [0x5634a4], 0
je 0x41d5df
push 0x413c70
push 0
push 0x1030
push eax
jmp 0x41e2e4
push 0x413c30
push 0
push 0x1030
push eax
jmp 0x41e2e4
cmp eax, 0x9e35
ja 0x41d746
je 0x41d6b9
sub eax, 0x9d6e
cmp eax, 3
ja case.default.0x41de9d
jmp dword [eax*4 + 0x41e468]
push dword [0x5634a8]
mov ecx, dword [0x561c6c]
mov edx, 1
mov dword [0x5634a4], 1
call fcn.00413cb0
add esp, 4
jmp case.default.0x41de9d
push dword [0x5634a8]
mov ecx, dword [0x561c6c]
mov edx, 2
mov dword [0x5634a4], 2
call fcn.00413cb0
add esp, 4
jmp case.default.0x41de9d
push dword [0x5634a8]
mov ecx, dword [0x561c6c]
mov edx, 3
mov dword [0x5634a4], 3
call fcn.00413cb0
add esp, 4
jmp case.default.0x41de9d
mov edx, dword [0x5634a4]
xor eax, eax
cmp dword [0x5634a8], eax
mov ecx, dword [0x561c6c]
sete al
push eax
mov dword [0x5634a8], eax
call fcn.00413cb0
add esp, 4
jmp case.default.0x41de9d
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x4a8]
push eax
or edx, 0xffffffff
mov dword [esp + 0x4ac], 1
call fcn.00413ce0
add esp, 4
lea eax, [esp + 0x4ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea ecx, [esp + 0x4ac]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.default.0x41de9d
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp case.default.0x41de9d
cmp eax, 0xa411
ja 0x41de8f
je 0x41de0a
sub eax, 0xa000
cmp eax, 0x33
ja case.default.0x41de9d
movzx eax, byte [eax + 0x41e4a8]
jmp dword [eax*4 + 0x41e478]
shr edx, 0x10
cmp edx, 3
je 0x41d866
cmp edx, 8
jne case.default.0x41de9d
mov esi, dword [0x561b84]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x147
push esi
call edi
cmp eax, 0xffffffff
je 0x41d855
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x48]
push eax
push 0
push 0x40d
push esi
mov dword [esp + 0x58], 0x20
call edi
mov eax, dword [esp + 0x68]
lea edx, [esp + 0xe18]
push edx
push 0x8000
mov esi, dword [eax]
mov eax, dword [eax + 4]
push esi
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x2c]
call eax
test eax, eax
jne 0x41d800
push 0x40
lea eax, [esp + 0x904]
push eax
push esi
lea eax, [esp + 0xe24]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRetToBufW]
lea eax, [esp + 0x900]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [esp + 0x900]
push eax
push 0x5634ac
call dword [sym.imp.SHLWAPI.dll_PathIsSameRootW]
test eax, eax
jne 0x41d855
push 1
lea edx, [esp + 0x904]
mov ecx, ebx
call fcn.0041eee0
add esp, 4
test eax, eax
jne 0x41d855
push 0xc350
push 2
call fcn.00412d90
add esp, 8
mov edx, 0x5634ac
call fcn.00414810
push dword [0x561c6c]
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.default.0x41de9d
mov dword [0x55e7a8], 0xa000
jmp case.default.0x41de9d
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x157
push dword [0x561b84]
call esi
test eax, eax
je 0x41d8a6
push 0
push 0
push 0x14f
push dword [0x561b84]
call esi
jmp case.default.0x41de9d
mov eax, dword [0x563400]
cmp eax, 1
jne 0x41d8c4
push 0
push 0xf020
push 0x112
push ebx
call esi
jmp case.default.0x41de9d
cmp eax, 2
jne case.default.0x41de9d
push 0
push 0
push 0x10
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x41de9d
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov ecx, 0xa02a
cmp di, cx
jne 0x41d903
inc eax
cmp eax, 0xa001
jle 0x41d924
lea eax, [ecx - 0x2a]
jmp 0x41d92b
dec eax
cmp eax, 0xa000
jge 0x41d929
mov eax, 0xa001
push eax
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.default.0x41de9d
cmp eax, 0xa000
jne 0x41d93a
cmp dword [0x563424], 0
mov ecx, 0xa001
cmove eax, ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.default.0x41de9d
xor eax, eax
cmp dword [0x563404], eax
sete al
mov dword [0x563404], eax
jmp case.default.0x41de9d
push dword [0x561c70]
xor edx, edx
cmp dword [0x56340c], edx
sete dl
mov dword [0x56340c], edx
call fcn.00415880
add esp, 4
jmp case.default.0x41de9d
push 0x208
lea eax, [esp + 0x98]
mov dword [esp + 0x94], 7
push 0
push eax
call fcn.00425950
add esp, 0xc
xor eax, eax
mov word [esp + 0x29c], ax
push 0x206
push eax
lea eax, [esp + 0x2a6]
push eax
call fcn.00425950
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x9c]
add esp, 0xc
mov dword [esp + 0x4a4], 0
or edx, 0xffffffff
push eax
call fcn.00413ce0
add esp, 4
cmp dword [esp + 0x4a4], 2
jne case.default.0x41de9d
lea ecx, [esp + 0x94]
call fcn.00416000
test eax, eax
je case.default.0x41de9d
push 0x104
lea edx, [esp + 0xe1c]
lea ecx, [esp + 0x98]
call fcn.00416080
add esp, 4
test eax, eax
je case.default.0x41de9d
lea eax, [esp + 0xe18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je case.default.0x41de9d
lea eax, [esp + 0xe18]
push eax
lea eax, [esp + 0x984]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x5c
push 0
lea eax, [esp + 0x988]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
test esi, esi
je case.default.0x41de9d
xor eax, eax
mov word [esi + 2], ax
lea eax, [esp + 0x980]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x41da95
mov word [esi], ax
lea eax, [esp + 0x980]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x19d0d
push 0x111
push ebx
call esi
lea eax, [esp + 0xe18]
xor edx, edx
push eax
call fcn.00414140
add esp, 4
test eax, eax
jne case.default.0x41de9d
jmp 0x41d149
mov edx, 1
mov ecx, 0x48d420
call fcn.004205c0
jmp case.default.0x41de9d
push 0xfb
push str.UseTargetApplication
mov edx, 0x48e010
call fcn.004036d0
add esp, 8
cmp eax, 0xfb
je 0x41db44
push 0x104
push 0x560850
push 0x560850
push str.TargetApplicationWndClass
mov edx, 0x48e010
mov ecx, 0x560388
call fcn.004033b0
add esp, 0x10
cmp word [0x560850], 0
je case.default.0x41de9d
push 0x560850
jmp 0x41db49
push str.Notepad3
push 0x561298
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0x420310
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x14]
test eax, eax
je case.default.0x41de9d
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x41db91
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
je 0x41dba7
push 0
push 0xf120
push 0x112
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [esp + 0x14]
mov esi, dword [sym.imp.USER32.dll_SetForegroundWindow]
call esi
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push ebx
call esi
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, eax
lea eax, [esp + 0x80]
push eax
push ebx
call esi
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x18]
call esi
mov eax, dword [esp + 0x2c]
sub edi, eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x88]
mov esi, dword [esp + 0x80]
cmp ecx, edi
jle 0x41dc08
mov eax, esi
sub eax, edx
add eax, ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x70], eax
sub eax, esi
add eax, edx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x8c]
sub eax, dword [esp + 0x84]
add eax, ecx
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
jne case.default.0x41de9d
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 8
push eax
push 8
push 0x48
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp dword [esp + 0x20], 0
je 0x41dc80
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x84]
push eax
push 3
push ebx
call dword [sym.imp.USER32.dll_DrawAnimatedRects]
push 5
push 0
push 0
push dword [esp + 0x80]
push dword [esp + 0x80]
push 0
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp case.default.0x41de9d
lea eax, [esp + 0x24]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
xorps xmm0, xmm0
lea eax, [esp + 0x24]
push 2
movups xmmword [esp + 0x4c], xmm0
push eax
movups xmmword [esp + 0x60], xmm0
mov dword [esp + 0x50], 0x28
movq qword [esp + 0x70], xmm0
call dword [sym.imp.USER32.dll_MonitorFromRect]
lea ecx, [esp + 0x48]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
add edx, 0x10
add ecx, 0x10
mov dword [esp + 0x8c0], 0x2c
mov dword [esp + 0x8c4], 4
mov dword [esp + 0x8c8], 9
lea eax, [edx + 0x110]
mov dword [esp + 0x8dc], edx
mov dword [esp + 0x8e4], eax
lea eax, [ecx + 0x280]
mov dword [esp + 0x8e8], eax
lea eax, [esp + 0x8dc]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x8e4], ecx
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
je 0x41dd6c
mov eax, dword [esp + 0x64]
add eax, 0xfffffee0
mov dword [esp + 0x8dc], eax
add eax, 0x110
mov dword [esp + 0x8e4], eax
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 8
push eax
push 8
push 0x48
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp dword [esp + 0x20], 0
je 0x41ddc2
lea eax, [esp + 0x8dc]
push eax
lea eax, [esp + 0x28]
push eax
push 3
push ebx
call dword [sym.imp.USER32.dll_DrawAnimatedRects]
mov eax, dword [esp + 0x50]
sub eax, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x50]
sub eax, dword [esp + 0x60]
push eax
lea eax, [esp + 0x8e4]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov esi, dword [sym.imp.USER32.dll_SetWindowPlacement]
lea eax, [esp + 0x8c0]
push eax
push ebx
call esi
lea eax, [esp + 0x8c0]
push eax
push ebx
call esi
jmp case.default.0x41de9d
cmp word [0x560388], 0
je case.default.0x41de9d
call fcn.00404070
mov edx, 0xc362
mov ecx, 0x560388
call fcn.0041f9a0
jmp case.default.0x41de9d
mov eax, dword [0x561c68]
test eax, eax
jle 0x41de77
cmp dword [eax*4 + 0x561b9c], 0
je 0x41de77
test eax, eax
jle 0x41de41
dec eax
push 0x104
mov dword [0x561c68], eax
push dword [eax*4 + 0x561ba0]
lea eax, [esp + 0xc10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
lea edx, [esp + 0xc0c]
mov ecx, ebx
call fcn.0041eee0
add esp, 4
test eax, eax
jne 0x41de7f
push 0xc350
push 2
call fcn.00412d90
add esp, 8
sub esp, 8
call fcn.00416d00
add esp, 8
jmp case.default.0x41de9d
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
sub esp, 8
call fcn.00416d00
add esp, 8
jmp case.default.0x41de9d
sub eax, 0xa412
cmp eax, 0xc
ja case.default.0x41de9d
jmp dword [eax*4 + 0x41e4dc]
call fcn.00416cc0
test eax, eax
je 0x41de77
mov eax, dword [0x561c68]
cmp eax, 0x31
jge 0x41dee1
cmp dword [eax*4 + 0x561ba4], 0
je 0x41dee1
inc eax
push 0x104
mov dword [0x561c68], eax
push dword [eax*4 + 0x561ba0]
lea eax, [esp + 0xc10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
lea edx, [esp + 0xc0c]
mov ecx, ebx
call fcn.0041eee0
add esp, 4
test eax, eax
jne 0x41de7f
push 0xc350
push 2
call fcn.00412d90
add esp, 8
sub esp, 8
call fcn.00416d00
add esp, 8
jmp case.default.0x41de9d
push 0x5634ac
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x41c20a
mov edx, 0x48e2d8
jmp 0x41c103
push 0x5634ac
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x41c20a
mov edx, str.A_RHS
jmp 0x41c103
push 0
push 0x19d0e
jmp 0x41e2de
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0xffffffffffffffff
push 0x100c
push dword [0x561c6c]
call ebp
push 0
push 0
push 0x1032
push dword [0x561c6c]
mov edi, eax
mov dword [esp + 0x4b4], 0
mov dword [esp + 0xa0], 5
call ebp
mov ecx, dword [0x561c6c]
neg eax
sbb esi, esi
lea eax, [esp + 0x90]
neg esi
add esi, edi
push eax
mov edx, esi
call fcn.00413ce0
add esp, 4
cmp eax, 0xffffffff
je 0x41e009
cmp dword [esp + 0x4a4], 2
jne 0x41dfeb
push 0x104
lea edx, [esp + 0xc0c]
lea ecx, [esp + 0x98]
call fcn.004161b0
add esp, 4
test eax, eax
je 0x41e009
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x90]
inc esi
push eax
mov edx, esi
call fcn.00413ce0
add esp, 4
cmp eax, 0xffffffff
jne 0x41dfc2
cmp dword [esp + 0x4a4], 2
je 0x41e06f
xor esi, esi
test edi, edi
js 0x41c1fc
nop dword [eax]
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x90]
push eax
mov edx, esi
call fcn.00413ce0
add esp, 4
cmp dword [esp + 0x4a4], 2
jne 0x41e065
push 0x104
lea edx, [esp + 0xc0c]
lea ecx, [esp + 0x98]
call fcn.004161b0
add esp, 4
test eax, eax
je 0x41c1fc
inc esi
cmp esi, edi
jle 0x41e020
jmp 0x41c1fc
lea eax, [esp + 0x8c0]
mov dword [esp + 0x8d0], 3
push eax
push esi
push 0x102b
push dword [0x561c6c]
mov dword [esp + 0x8dc], 3
call ebp
push 0
push esi
push 0x1013
push dword [0x561c6c]
call ebp
push 0
push esi
push 0x102a
push dword [0x561c6c]
call ebp
push 0
push 0x19c41
push 0x111
push ebx
call ebp
jmp case.default.0x41de9d
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0xffffffffffffffff
push 0x100c
push dword [0x561c6c]
call ebp
push 0
push 0
push 0x1032
push dword [0x561c6c]
mov edi, eax
mov dword [esp + 0x4b4], 0
mov dword [esp + 0xa0], 5
call ebp
test eax, eax
jne 0x41e117
test edi, edi
jne 0x41e11c
mov eax, 1
mov esi, edi
sub esi, eax
cmp esi, 0xffffffff
jle 0x41e177
nop word [eax + eax]
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x90]
push eax
mov edx, esi
call fcn.00413ce0
add esp, 4
cmp dword [esp + 0x4a4], 2
jne 0x41e171
push 0x104
lea edx, [esp + 0xc0c]
lea ecx, [esp + 0x98]
call fcn.004161b0
add esp, 4
test eax, eax
je 0x41e177
dec esi
cmp esi, 0xffffffff
jg 0x41e130
cmp dword [esp + 0x4a4], 2
je 0x41e06f
push 0
push 0
push 0x1004
push dword [0x561c6c]
call ebp
lea esi, [eax - 1]
cmp esi, edi
jl 0x41c1fc
mov ecx, dword [0x561c6c]
lea eax, [esp + 0x90]
push eax
mov edx, esi
call fcn.00413ce0
add esp, 4
cmp dword [esp + 0x4a4], 2
jne 0x41e1e6
push 0x104
lea edx, [esp + 0xc0c]
lea ecx, [esp + 0x98]
call fcn.004161b0
add esp, 4
test eax, eax
je 0x41c1fc
dec esi
cmp esi, edi
jge 0x41e1a1
jmp 0x41c1fc
push 0
push 0x19c43
jmp 0x41e2de
call fcn.00416890
push 0
test eax, eax
je 0x41c20c
push 0x19c45
jmp 0x41e2de
call fcn.00416890
push 0
test eax, eax
je 0x41c20c
push 0x19c4b
jmp 0x41e2de
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1032
push dword [0x561c6c]
call esi
push 0
test eax, eax
je 0x41c20c
push 0x19c4c
push 0x111
push ebx
call esi
jmp case.default.0x41de9d
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1032
push dword [0x561c6c]
call edi
push 0
test eax, eax
je 0x41c20c
mov esi, dword [0x563414]
push 0x19c4d
push 0x111
push ebx
mov dword [0x563414], 1
call edi
mov dword [0x563414], esi
jmp case.default.0x41de9d
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1032
push dword [0x561c6c]
call esi
push 0
test eax, eax
je 0x41c20c
push 0x19c4e
push 0x111
push ebx
call esi
jmp case.default.0x41de9d
push 0
push 0x19d10
push 0x111
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x142c]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00422d0c
add esp, 0x1420
ret