Function at 0x4f6fd0
Capabilities:
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522605
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x565300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
cmp ebx, 0x511
jne 0x4f7048
mov eax, dword [edi + 0xc4]
test eax, eax
je 0x4f702d
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4f702d
mov eax, dword [edi + 0xc4]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [edi + 0x9c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ebx, 0x500
je 0x4f732a
cmp ebx, 0x501
je 0x4f732a
cmp ebx, 0x502
je 0x4f732a
cmp ebx, 0x503
je 0x4f732a
cmp ebx, 0x505
je 0x4f732a
cmp ebx, 0x504
je 0x4f732a
cmp ebx, 0x509
jne 0x4f70ac
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4f7339
cmp ebx, 0x50a
jne 0x4f7218
cmp dword [edi + 0x17c], 0
jne 0x4f733f
call fcn.004fe840
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 0x10], eax
call esi
mov dword [ebp - 0x14], eax
push ecx
mov ecx, esp
mov dword [ebp - 4], 0
mov dword [ecx], eax
mov ecx, edi
call fcn.004f7360
mov ecx, edi
call fcn.004f6990
mov eax, dword [0x568c54]
cmp dword [eax - 0xc], 0
je 0x4f715b
push dword [edi + 4]
call esi
mov esi, dword [0x568c54]
mov dword [ebp + 8], eax
cmp dword [esi - 4], 1
jle 0x4f712b
push dword [esi - 0xc]
mov ecx, 0x568c54
call fcn.004038f0
mov esi, dword [0x568c54]
mov eax, dword [ebp + 8]
push eax
mov ecx, edi
call fcn.004f6c40
push eax
push esi
call fcn.004f1bb0
add esp, 0xc
mov ecx, 0x568c54
push 0xffffffffffffffff
call fcn.0040b0f0
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov eax, dword [edi + 0x180]
cmp eax, 6
jne 0x4f71ca
cmp dword [edi + 0x188], 0
je 0x4f71da
cmp dword [edi + 0x184], 0
je 0x4f71da
push dword [edi + 4]
call esi
mov esi, eax
mov ecx, edi
push esi
call fcn.004f6c40
push eax
lea ecx, [edi + 0x188]
call fcn.00420100
push eax
call fcn.004f1bb0
add esp, 0xc
lea ecx, [edi + 0x188]
push 0xffffffffffffffff
call fcn.0040b0f0
push 0
push 1
push 0x2421
push dword [edi + 0x184]
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x4f71fc
cmp eax, 7
jne 0x4f71da
push 1
mov ecx, edi
call fcn.004fe9a0
jmp 0x4f71fc
mov eax, dword [0x568c10]
test eax, eax
jne 0x4f71ec
call fcn.004f8020
test eax, eax
je 0x4f71fc
push 0
push 1
push 0x7936
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x14]
call fcn.004f6360
jmp 0x4f7339
cmp ebx, 0x506
jne 0x4f72ba
cmp dword [edi + 0x18c], 0x505
jne 0x4f7262
push dword [edi + 0xd0]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4f7262
push 0
push dword [edi + 0xd0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0xb4]
mov ecx, dword [edi + 0xb0]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x4f7339
lea eax, [eax*4 - 4]
mov ecx, dword [eax + ecx]
mov dword [ebp + 8], eax
test ecx, ecx
je 0x4f7292
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [edi + 0xb0]
lea ecx, [edi + 0xb0]
add eax, dword [ebp + 8]
push eax
lea eax, [ebp + 8]
push eax
call fcn.00500ad0
push 1
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4f7339
cmp ebx, 0x508
jne 0x4f72fd
call fcn.004fe840
mov eax, dword [edi + 4]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x14], eax
push ecx
mov ecx, esp
mov dword [ebp - 4], 1
mov dword [ecx], eax
mov ecx, edi
call fcn.004f7360
push 0
mov ecx, edi
call fcn.004fe9a0
lea ecx, [ebp - 0x14]
call fcn.004f6360
jmp 0x4f7339
cmp ebx, 0x510
je 0x4f7315
cmp ebx, 0x50e
je 0x4f7315
cmp ebx, 0x50f
jne 0x4f7339
mov dword [edi + 0x18c], ebx
call fcn.004f76d0
push ebx
mov ecx, edi
call fcn.004ff180
jmp 0x4f7339
call fcn.004fe840
push 0
push ebx
mov ecx, edi
call fcn.004ff500
mov dword [edi + 0x18c], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4