Function at 0x40cd40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae4b0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push esi
push edi
mov eax, dword [0x4e406c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
movzx eax, word [ebp + 0xc]
cmp eax, 0x4b4
ja 0x40cfb2
je 0x40cf05
sub eax, 0x3eb
cmp eax, 0xc8
ja case.0x40cd96.1005
movzx eax, byte [eax + 0x40d18c]
jmp dword [eax*4 + 0x40d17c]
cmp byte [0x4e9953], 0
je 0x40ce3e
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov esi, eax
test esi, esi
je 0x40cdd0
push 1
push 0xf060
push esi
call dword [sym.imp.USER32.dll_EnableMenuItem]
push esi
call dword [sym.imp.USER32.dll_DestroyMenu]
call fcn.00448890
mov ecx, edi
call fcn.0040d600
mov esi, eax
push 5
mov dword [ebp - 0x10], esi
call fcn.0040d6b0
mov ebx, eax
test esi, esi
je case.0x40cd96.1005
test ebx, ebx
je case.0x40cd96.1005
cmp esi, ebx
je case.0x40cd96.1005
push 0
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
call esi
push 5
push dword [ebx]
call esi
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push 0xfffffffffffffff4
push dword [eax]
call esi
push 0xe900
push 0xfffffffffffffff4
push dword [ebx]
call esi
push 1
mov ecx, edi
call fcn.0040de20
jmp case.0x40cd96.1005
mov al, byte [0x4e4ac5]
test al, al
je 0x40ce4e
push 2
jmp 0x40d14b
cmp byte [0x4e994a], 0
je 0x40d135
lea ecx, [ebp - 0x40]
call fcn.0045e3b0
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x40ce75
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, 0x4c7118
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0x79
mov ecx, eax
call fcn.0040df40
mov edx, str.:_showing_BrowserGuard_screen
mov ecx, eax
call fcn.0040f940
push eax
call fcn.0040fcb0
mov edx, dword [ebp - 0x2c]
add esp, 4
cmp edx, 8
jb 0x40cef5
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ceeb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d166
push edx
push ecx
call fcn.0046d84e
add esp, 8
push 3
mov ecx, edi
jmp 0x40d14b
push 1
jmp 0x40d14b
cmp byte [0x4e994a], 0
je 0x40d135
lea ecx, [ebp - 0x58]
call fcn.0045e3b0
mov dword [ebp - 4], 1
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x40cf2c
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, 0x4c7118
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0x8e
mov ecx, eax
call fcn.0040df40
mov edx, str.:_showing_BrowserGuard_screen
mov ecx, eax
call fcn.0040f940
push eax
call fcn.0040fcb0
mov edx, dword [ebp - 0x44]
add esp, 4
cmp edx, 8
jb 0x40cef5
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ceeb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d16b
jmp 0x40ceeb
sub eax, 0x51d
je 0x40d13c
sub eax, 1
je 0x40d093
sub eax, 1
jne case.0x40cd96.1005
lea ecx, [ebp - 0x28]
call fcn.0045e3b0
mov dword [ebp - 4], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x40cfe9
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, 0x4c7118
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xa5
mov ecx, eax
call fcn.0040df40
mov edx, str.:_User_chose_NOT_to_install_BrowserGuard
mov ecx, eax
call fcn.0040f940
push eax
call fcn.0040fcb0
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40d073
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d069
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d170
push edx
push ecx
call fcn.0046d84e
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov ecx, edi
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0040dc40
jmp case.0x40cd96.1005
lea ecx, [ebp - 0x70]
call fcn.0045e3b0
mov dword [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x40d0ad
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, 0x4c7118
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xa1
mov ecx, eax
call fcn.0040df40
mov edx, str.:_User_chose_to_install_BrowserGuard
mov ecx, eax
call fcn.0040f940
push eax
call fcn.0040fcb0
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x40d133
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d129
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d175
push edx
push ecx
call fcn.0046d84e
add esp, 8
mov ecx, edi
call fcn.0040dc40
jmp case.0x40cd96.1005
mov al, byte [0x4e4ac5]
test al, al
jne 0x40ce47
push 0
call fcn.0040dba0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
nop
popfd
int 64
add dh, bh
into
inc eax
add byte [ecx - 0x2f], cl
inc eax
add byte [eax - 0x2f], dl
inc eax
add byte [eax], al
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
int3