Function at 0x40c1d0
Capabilities:
Change the wallpaper
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete file
Enumerate gui resources
Get file attributes
Parse pe header
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4517ea
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46c8b0]
xor eax, esp
push eax
lea eax, [esp + 0x9c]
mov dword fs:[0], eax
mov esi, ecx
or edi, 0xffffffff
cmp dword [esp + 0xac], 0
je 0x40c646
call fcn.00417b8f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40c22a
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov ecx, dword [esi + 8]
mov eax, dword [ecx - 0xc]
test eax, eax
lea ebx, [esi + 8]
mov dword [esp + 0xa4], 0
jle 0x40c3b0
lea edx, [esp + 0x20]
push edx
call fcn.00408fe0
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x2c]
push str._sTopThemes_Wallpaper.bmp
push ecx
mov byte [esp + 0xb4], 1
call fcn.004013d0
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x10
mov byte [esp + 0xa4], 0
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c2a4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebp, dword [esp + 0x24]
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0xfffffffc
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebx]
push 0x2e
push eax
call fcn.00434d33
add esp, 8
test eax, eax
jne 0x40c2cf
mov eax, edi
jmp 0x40c2d1
sub eax, dword [ebx]
add eax, 1
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebx
call fcn.004024d0
mov edx, dword [esp + 0x20]
push 0x457114
push edx
call fcn.00434b0e
add esp, 8
test eax, eax
jne 0x40c307
mov ebx, dword [ebx]
push eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x40c387
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], vtable.CBitmap.0
mov ebx, dword [ebx]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov byte [esp + 0xb0], 3
call fcn.00408bb0
mov ecx, dword [ebp - 8]
mov ebx, dword [esp + 0x38]
mov eax, 1
sub eax, dword [ebp - 4]
add esp, 0xc
or ecx, eax
jge 0x40c356
push 0
lea ecx, [esp + 0x28]
call fcn.00401190
mov ebp, dword [esp + 0x24]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push ebx
push ebp
call fcn.00408d00
add esp, 0xc
lea ecx, [esp + 0x28]
mov byte [esp + 0xa4], 2
mov dword [esp + 0x28], vtable.CGdiObject.0
call fcn.0041cd6d
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0xa4], 0
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c3c4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40c3c4
push 0
push 0x455b91
lea ecx, [esp + 0x2c]
call fcn.00401fa0
mov ebp, dword [esp + 0x24]
push SysReAllocStringLen
push ecx
lea ebx, [ebp - 0x10]
mov dword [esp + 0x30], esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004011e0
mov ecx, dword [esp + 0x2c]
add eax, 0x10
mov dword [ecx], eax
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Wallpaper
mov byte [esp + 0xb4], 4
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Control_PanelDesktop_
mov byte [esp + 0xb8], 5
call fcn.004044a0
mov byte [esp + 0xb4], 0
call fcn.00404720
mov eax, dword [esi + 0xc]
add esp, 0x10
cmp eax, 1
jne 0x40c4c5
push SysReAllocStringLen
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x457110
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.TileWallpaper
mov byte [esp + 0xb4], 6
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Control_PanelDesktop_
mov byte [esp + 0xb8], 7
call fcn.004044a0
mov byte [esp + 0xb4], 0
call fcn.00404720
add esp, 0x10
push SysReAllocStringLen
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x45710c
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.WallpaperStyle
mov byte [esp + 0xb4], 8
call fcn.004044a0
mov byte [esp + 0xb0], 9
jmp 0x40c5f9
test eax, eax
jne 0x40c561
push SysReAllocStringLen
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x45710c
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.TileWallpaper
mov byte [esp + 0xb4], 0xa
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Control_PanelDesktop_
mov byte [esp + 0xb8], 0xb
call fcn.004044a0
mov byte [esp + 0xb4], 0
call fcn.00404720
add esp, 0x10
push SysReAllocStringLen
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x45710c
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.WallpaperStyle
mov byte [esp + 0xb4], 0xc
call fcn.004044a0
mov byte [esp + 0xb0], 0xd
jmp 0x40c5f9
cmp eax, 2
jne 0x40c61a
push SysReAllocStringLen
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x45710c
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.TileWallpaper
mov byte [esp + 0xb4], 0xe
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Control_PanelDesktop_
mov byte [esp + 0xb8], 0xf
call fcn.004044a0
mov byte [esp + 0xb4], 0
call fcn.00404720
add esp, 0x10
push SysReAllocStringLen
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x457108
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.WallpaperStyle
mov byte [esp + 0xb4], 0x10
call fcn.004044a0
mov byte [esp + 0xb0], 0x11
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Control_PanelDesktop_
call fcn.004044a0
mov byte [esp + 0xb4], 0
call fcn.00404720
add esp, 0x10
push 3
push ebp
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov dword [esp + 0xa4], edi
lea edx, [ebx + 0xc]
mov eax, edi
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40c646
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
cmp dword [esp + 0xb0], 0
je 0x40c8a8
mov eax, dword [esi + 0x10]
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x12
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID20D04FE0_3AEA_1069_A2D8_08002B30309DDefaultIcon_
mov byte [esp + 0xb8], 0x13
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x14]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x14
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID208D2C60_3AEA_1069_A2D7_08002B30309DDefaultIcon_
mov byte [esp + 0xb8], 0x15
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x1c]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x16
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID645FF040_5081_101B_9F08_00AA002F954EDefaultIcon_
mov byte [esp + 0xb8], 0x17
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
add esp, 0x10
push SysReAllocStringLen
push ecx
mov dword [esp + 0x20], esp
mov eax, dword [esi + 0x1c]
sub eax, 0x10
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push str.full
mov dword [esp + 0xb4], 0x18
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID645FF040_5081_101B_9F08_00AA002F954EDefaultIcon_
mov byte [esp + 0xb8], 0x19
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x18]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push str.empty
mov dword [esp + 0xb4], 0x1a
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID645FF040_5081_101B_9F08_00AA002F954EDefaultIcon_
mov byte [esp + 0xb8], 0x1b
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x20]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x1c
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID450D8FBA_AD25_11D0_98A8_0800361B1103DefaultIcon_
mov byte [esp + 0xb8], 0x1d
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
add esp, 0x10
push 0
push 0
push 0
push 0x58
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
cmp dword [esp + 0xb4], 0
je 0x40cdcf
lea ecx, [esp + 0x3c]
call fcn.00401e60
mov dword [esp + 0xa4], 0x1e
call fcn.00417b8f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40c8e4
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x20]
mov bl, 0x1f
push ecx
mov byte [esp + 0xa8], bl
call fcn.00408f00
mov edx, dword [eax]
push edx
lea eax, [esp + 0x2c]
push 0x456f28
push eax
mov byte [esp + 0xb4], 0x20
call fcn.004013d0
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x10
mov byte [esp + 0xa4], bl
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c94a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x3c]
call fcn.004021e0
mov eax, dword [esp + 0x24]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov ebp, esp
push eax
mov dword [esp + 0x28], eax
call fcn.004011e0
add eax, 0x10
add esp, 4
lea ecx, [esp + 0x40]
mov dword [ebp], eax
call fcn.00402aa0
mov eax, dword [esi + 0x24]
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
push reloc.OLEAUT32.dll_SysReAllocString
sete al
test al, al
push ecx
mov dword [esp + 0x30], esp
je 0x40c9ed
mov ecx, esp
push 0x455b91
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x456f24
mov byte [esp + 0xb4], 0x21
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Icons
mov byte [esp + 0xb8], 0x22
call fcn.004044a0
mov byte [esp + 0xb4], bl
call fcn.0040b6f0
jmp 0x40ca3e
mov eax, dword [esi + 0x24]
sub eax, 0x10
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x456f24
mov byte [esp + 0xb4], 0x23
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Icons
mov byte [esp + 0xb8], 0x24
call fcn.004044a0
mov byte [esp + 0xb4], bl
call fcn.00404720
mov eax, dword [esi + 0x2c]
add esp, 0x10
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
push reloc.OLEAUT32.dll_SysReAllocString
sete al
test al, al
push ecx
mov dword [esp + 0x30], esp
je 0x40cab1
mov ecx, esp
push 0x455b91
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x456f20
mov byte [esp + 0xb4], 0x25
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Icons
mov byte [esp + 0xb8], 0x26
call fcn.004044a0
mov byte [esp + 0xb4], bl
call fcn.0040b6f0
jmp 0x40cb02
mov eax, dword [esi + 0x2c]
sub eax, 0x10
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x456f20
mov byte [esp + 0xb4], 0x27
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Icons
mov byte [esp + 0xb8], 0x28
call fcn.004044a0
mov byte [esp + 0xb4], bl
call fcn.00404720
mov eax, dword [esi + 0x30]
add esp, 0x10
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
push reloc.OLEAUT32.dll_SysReAllocString
sete al
test al, al
push ecx
mov dword [esp + 0x30], esp
je 0x40cb75
mov ecx, esp
push 0x455b91
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x456f1c
mov byte [esp + 0xb4], 0x29
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Icons
mov byte [esp + 0xb8], 0x2a
call fcn.004044a0
mov byte [esp + 0xb4], bl
call fcn.0040b6f0
jmp 0x40cbc6
mov eax, dword [esi + 0x30]
sub eax, 0x10
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x456f1c
mov byte [esp + 0xb4], 0x2b
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Icons
mov byte [esp + 0xb8], 0x2c
call fcn.004044a0
mov byte [esp + 0xb4], bl
call fcn.00404720
mov eax, dword [esi + 0x28]
add esp, 0x10
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
push reloc.OLEAUT32.dll_SysReAllocString
sete al
test al, al
push ecx
mov dword [esp + 0x30], esp
je 0x40cc39
mov ecx, esp
push 0x455b91
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x456f18
mov byte [esp + 0xb4], 0x2d
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Icons
mov byte [esp + 0xb8], 0x2e
call fcn.004044a0
mov byte [esp + 0xb4], bl
call fcn.0040b6f0
jmp 0x40cc8a
mov eax, dword [esi + 0x28]
sub eax, 0x10
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x456f18
mov byte [esp + 0xb4], 0x2f
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Icons
mov byte [esp + 0xb8], 0x30
call fcn.004044a0
mov byte [esp + 0xb4], bl
call fcn.00404720
add esp, 0x10
push SysReAllocStringLen
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x456f14
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Shell_Icon_Size
mov byte [esp + 0xb4], 0x31
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Control_PanelDesktopWindowMetrics
mov byte [esp + 0xb8], 0x32
call fcn.004044a0
mov byte [esp + 0xb4], bl
call fcn.00404720
mov ebp, dword [sym.imp.USER32.dll_SendNotifyMessageA]
add esp, 0x10
push 0
push 0x2a
push 0x1a
push 0xffff
call ebp
push SysReAllocStringLen
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x456edc
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Shell_Icon_Size
mov byte [esp + 0xb4], 0x33
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Control_PanelDesktopWindowMetrics
mov byte [esp + 0xb8], 0x34
call fcn.004044a0
mov byte [esp + 0xb4], bl
call fcn.00404720
add esp, 0x10
push 0
push 0x2a
push 0x1a
push 0xffff
call ebp
mov ebx, dword [esp + 0x20]
push ecx
mov dword [esp + 0x2c], esp
mov ebp, esp
push ebx
call fcn.004011e0
add eax, 0x10
add esp, 4
lea ecx, [esp + 0x40]
mov dword [ebp], eax
call fcn.00402870
mov ebp, dword [esp + 0x24]
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0xfffffffc
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [esp + 0xa4], 0x1e
add ebx, 0xc
mov ecx, edi
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x40cdbf
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0xa4], edi
call fcn.00401e80
cmp dword [esp + 0xb8], 0
je 0x40d81e
mov eax, dword [esi + 0x68]
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Arrow
mov dword [esp + 0xb4], 0x35
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Control_PanelCursors_
mov byte [esp + 0xb8], 0x36
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x6c]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4567fc
mov dword [esp + 0xb4], 0x37
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Control_PanelCursors_
mov byte [esp + 0xb8], 0x38
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x70]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push str.AppStarting
mov dword [esp + 0xb4], 0x39
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Control_PanelCursors_
mov byte [esp + 0xb8], 0x3a
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
add esp, 0x10
push SysReAllocStringLen
push ecx
mov dword [esp + 0x20], esp
mov eax, dword [esi + 0x74]
sub eax, 0x10
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Wait
mov dword [esp + 0xb4], 0x3b
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Control_PanelCursors_
mov byte [esp + 0xb8], 0x3c
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x78]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Crosshair
mov dword [esp + 0xb4], 0x3d
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Control_PanelCursors_
mov byte [esp + 0xb8], 0x3e
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x7c]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push str.IBeam
mov dword [esp + 0xb4], 0x3f
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Control_PanelCursors_
mov byte [esp + 0xb8], 0x40
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x80]
add esp, 0x10
push SysReAllocStringLen
push ecx
mov dword [esp + 0x20], esp
mov ebp, esp
sub eax, 0x10
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push str.NWPen
mov dword [esp + 0xb4], 0x41
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Control_PanelCursors_
mov byte [esp + 0xb8], 0x42
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x84]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4567c8
mov dword [esp + 0xb4], 0x43
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Control_PanelCursors_
mov byte [esp + 0xb8], 0x44
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x88]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SizeNS
mov dword [esp + 0xb4], 0x45
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Control_PanelCursors_
mov byte [esp + 0xb8], 0x46
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x8c]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SizeWE
mov dword [esp + 0xb4], 0x47
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Control_PanelCursors_
mov byte [esp + 0xb8], 0x48
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x90]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SizeNWSE
mov dword [esp + 0xb4], 0x49
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Control_PanelCursors_
mov byte [esp + 0xb8], 0x4a
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x94]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SizeNESW
mov dword [esp + 0xb4], 0x4b
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Control_PanelCursors_
mov byte [esp + 0xb8], 0x4c
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x98]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0xb0], 0x4d
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SizeAll
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Control_PanelCursors_
mov byte [esp + 0xb8], 0x4e
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x9c]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push str.UpArrow
mov dword [esp + 0xb4], 0x4f
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Control_PanelCursors_
mov byte [esp + 0xb8], 0x50
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xa0]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Hand
mov dword [esp + 0xb4], 0x51
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Control_PanelCursors_
mov byte [esp + 0xb8], 0x52
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0x68]
push 0x455b91
push eax
call fcn.00434540
mov ebx, dword [sym.imp.USER32.dll_LoadCursorFromFileA]
add esp, 0x18
test eax, eax
sete al
test al, al
je 0x40d3e4
call fcn.00424154
call fcn.00424154
mov eax, dword [eax + 0xc]
push 0x7f00
push 0xc5
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x40d3ef
mov eax, dword [esi + 0x68]
push 0x7f00
push eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_SetSystemCursor]
push eax
call ebp
mov eax, dword [esi + 0x6c]
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
sete al
test al, al
je 0x40d432
call fcn.00424154
call fcn.00424154
mov eax, dword [eax + 0xc]
push 0x7f8b
push 0xc6
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x40d43d
mov eax, dword [esi + 0x6c]
push 0x7f8b
push eax
call ebx
push eax
call ebp
mov eax, dword [esi + 0x70]
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
sete al
test al, al
je 0x40d47a
call fcn.00424154
call fcn.00424154
mov eax, dword [eax + 0xc]
push 0x7f8a
push 0xc8
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x40d485
mov eax, dword [esi + 0x70]
push 0x7f8a
push eax
call ebx
push eax
call ebp
mov eax, dword [esi + 0x74]
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
sete al
test al, al
je 0x40d4c2
call fcn.00424154
call fcn.00424154
mov eax, dword [eax + 0xc]
push 0x7f02
push 0xc9
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x40d4cd
mov eax, dword [esi + 0x74]
push 0x7f02
push eax
call ebx
push eax
call ebp
mov eax, dword [esi + 0x78]
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
sete al
test al, al
je 0x40d50a
call fcn.00424154
call fcn.00424154
mov eax, dword [eax + 0xc]
push 0x7f03
push 0xd9
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x40d515
mov eax, dword [esi + 0x78]
push 0x7f03
push eax
call ebx
push eax
call ebp
mov eax, dword [esi + 0x7c]
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
sete al
test al, al
je 0x40d552
call fcn.00424154
call fcn.00424154
mov eax, dword [eax + 0xc]
push 0x7f01
push 0xcc
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x40d55d
mov eax, dword [esi + 0x7c]
push 0x7f01
push eax
call ebx
push eax
call ebp
mov eax, dword [esi + 0x80]
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
sete al
test al, al
je 0x40d59d
call fcn.00424154
call fcn.00424154
mov eax, dword [eax + 0xc]
push 0x7f89
push 0xcd
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x40d5ab
mov eax, dword [esi + 0x80]
push 0x7f89
push eax
call ebx
push eax
call ebp
mov eax, dword [esi + 0x84]
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
sete al
test al, al
je 0x40d5eb
call fcn.00424154
call fcn.00424154
mov eax, dword [eax + 0xc]
push 0x7f88
push 0xcd
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x40d5f9
mov eax, dword [esi + 0x84]
push 0x7f88
push eax
call ebx
push eax
call ebp
mov eax, dword [esi + 0x88]
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
sete al
test al, al
je 0x40d639
call fcn.00424154
call fcn.00424154
mov eax, dword [eax + 0xc]
push 0x7f85
push 0xd0
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x40d647
mov eax, dword [esi + 0x88]
push 0x7f85
push eax
call ebx
push eax
call ebp
mov eax, dword [esi + 0x8c]
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
sete al
test al, al
je 0x40d687
call fcn.00424154
call fcn.00424154
mov eax, dword [eax + 0xc]
push 0x7f84
push 0xd1
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x40d695
mov eax, dword [esi + 0x8c]
push 0x7f84
push eax
call ebx
push eax
call ebp
mov eax, dword [esi + 0x90]
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
sete al
test al, al
je 0x40d6d5
call fcn.00424154
call fcn.00424154
mov eax, dword [eax + 0xc]
push 0x7f82
push 0xd2
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x40d6e3
mov eax, dword [esi + 0x90]
push 0x7f82
push eax
call ebx
push eax
call ebp
mov eax, dword [esi + 0x94]
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
sete al
test al, al
je 0x40d723
call fcn.00424154
call fcn.00424154
mov eax, dword [eax + 0xc]
push 0x7f83
push 0xd3
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x40d731
mov eax, dword [esi + 0x94]
push 0x7f83
push eax
call ebx
push eax
call ebp
mov eax, dword [esi + 0x98]
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
sete al
test al, al
je 0x40d771
call fcn.00424154
call fcn.00424154
mov eax, dword [eax + 0xc]
push 0x7f86
push 0xd4
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x40d77f
mov eax, dword [esi + 0x98]
push 0x7f86
push eax
call ebx
push eax
call ebp
mov eax, dword [esi + 0x9c]
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
sete al
test al, al
je 0x40d7bf
call fcn.00424154
call fcn.00424154
mov eax, dword [eax + 0xc]
push 0x7f04
push 0xd5
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x40d7cd
mov eax, dword [esi + 0x9c]
push 0x7f04
push eax
call ebx
push eax
call ebp
mov eax, dword [esi + 0xa0]
push 0x455b91
push eax
call fcn.00434540
add esp, 8
test eax, eax
sete al
test al, al
je 0x40d80d
call fcn.00424154
call fcn.00424154
mov eax, dword [eax + 0xc]
push 0x7f89
push 0xd6
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x40d81b
mov eax, dword [esi + 0xa0]
push 0x7f89
push eax
call ebx
push eax
call ebp
xor ebx, ebx
cmp dword [esp + 0xbc], ebx
je 0x40dffd
mov eax, dword [esi + 0xa4]
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x53
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.Default_systemAsterisk.Current
mov byte [esp + 0xb8], 0x54
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xa8]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x55
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultClose.Current
mov byte [esp + 0xb8], 0x56
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xac]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x57
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultSystemHand.Current
mov byte [esp + 0xb8], 0x58
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
add esp, 0x10
push SysReAllocStringLen
push ecx
mov dword [esp + 0x20], esp
mov eax, dword [esi + 0xb0]
sub eax, 0x10
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x59
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.Default.Default.Current
mov byte [esp + 0xb8], 0x5a
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xb4]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x5b
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultSystemExclamation.Current
mov byte [esp + 0xb8], 0x5c
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xb8]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x5d
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultSystemExit.Current
mov byte [esp + 0xb8], 0x5e
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xbc]
add esp, 0x10
push SysReAllocStringLen
push ecx
mov dword [esp + 0x20], esp
mov ebp, esp
sub eax, 0x10
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x5f
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultMaximize.Current
mov byte [esp + 0xb8], 0x60
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xc0]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x61
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultMenuCommand.Current
mov byte [esp + 0xb8], 0x62
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xc4]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x63
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultMenuPopup.Current
mov byte [esp + 0xb8], 0x64
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xc8]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x65
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultMinimize.Current
mov byte [esp + 0xb8], 0x66
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xcc]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x67
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultMailBeep.Current
mov byte [esp + 0xb8], 0x68
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xd0]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x69
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultOpen.Current
mov byte [esp + 0xb8], 0x6a
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xd4]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0xb0], 0x6b
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultAppGPFault.Current
mov byte [esp + 0xb8], 0x6c
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xd8]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x6d
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultSystemQuestion.Current
mov byte [esp + 0xb8], 0x6e
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xdc]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x6f
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultRestoreDown.Current
mov byte [esp + 0xb8], 0x70
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xe0]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
mov dword [esp + 0xb0], 0x71
push 0x455b91
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultRestoreUp.Current
mov byte [esp + 0xb8], 0x72
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xe4]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x73
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultRingIn.Current
mov byte [esp + 0xb8], 0x74
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xe8]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x75
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultRingOut.Current
mov byte [esp + 0xb8], 0x76
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xec]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x77
call fcn.004044a0
mov byte [esp + 0xb0], 0x78
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesApps.DefaultSystemStart.Current
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
mov eax, dword [esi + 0xf0]
add esp, 0x10
push SysReAllocStringLen
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
call fcn.004011e0
add eax, 0x10
mov dword [ebp], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x455b91
mov dword [esp + 0xb4], 0x79
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppEventsSchemesAppsExplorerEmptyRecycleBin.Current
mov byte [esp + 0xb8], 0x7a
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.00404720
add esp, 0x10
cmp dword [esp + 0xc8], ebx
je 0x40e319
mov eax, 0xbb8
push 0x400
mov dword [esp + 0x5c], 0x44
mov dword [esp + 0x60], ebx
mov dword [esp + 0x90], ebx
mov word [esp + 0x8e], bx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], 0x107
mov word [esp + 0x8c], bx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
call fcn.00434707
push 0x400
mov ebp, eax
push ebx
push ebp
call fcn.004345b0
mov eax, dword [esi + 0x54]
push 0x455b91
push eax
call fcn.00434540
add esp, 0x18
cmp eax, ebx
setne al
test al, al
je 0x40e137
lea ecx, [esp + 0x1c]
push ecx
call fcn.004090a0
mov ebx, eax
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0xac], 0x7b
call fcn.004090a0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0xb0], 0x7c
call fcn.004090a0
mov ecx, dword [esi + 0x54]
mov edx, dword [ebx]
mov eax, dword [eax]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [ecx]
push edx
push eax
push str._s_rundll32.exe__s_shell32.dll_Control_RunDLL__sdesk.cpl_desk__Appearance__Action:OpenMSTheme__file:__s_
push ebp
call fcn.00435d07
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
add esp, 0x24
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e107
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0xa4], 0x7b
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e12e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
jmp 0x40e217
lea ecx, [esp + 0x18]
push ecx
call fcn.00408fe0
mov ebx, eax
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0xac], 0x7d
call fcn.004090a0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0xb0], 0x7e
call fcn.004090a0
mov dword [esp + 0x3c], eax
lea ecx, [esp + 0x2c]
push ecx
mov byte [esp + 0xb4], 0x7f
call fcn.004090a0
mov edx, dword [ebx]
mov ecx, dword [esp + 0x2c]
mov eax, dword [eax]
push edx
mov edx, dword [ecx]
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [ecx]
push edx
push eax
push str._s_rundll32.exe__s_shell32.dll_Control_RunDLL__sdesk.cpl_desk__Appearance__Action:OpenMSTheme__file:__sResourcesThemesLunaluna.msstyles_
push ebp
call fcn.00435d07
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
add esp, 0x28
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e1c5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0xa4], 0x7e
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e1ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0xa4], 0x7d
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e213
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov edx, edi
lea ecx, [eax + 0xc]
mov dword [esp + 0xa4], edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e239
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x5c]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x44]
push edi
push ecx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
lea edx, [esp + 0x34]
push edx
push 0x409180
call dword [sym.imp.USER32.dll_EnumWindows]
push ebp
call fcn.0043462a
mov eax, dword [esi + 0x58]
add esp, 4
push SysReAllocStringLen
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Shell
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SoftwareTopThemesXP_themeXPSettings
mov dword [esp + 0xb8], 0x80
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.0040b830
mov ecx, dword [esi + 0x5c]
add esp, 0x10
push SysReAllocStringLen
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.ShColor
call fcn.004044a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SoftwareTopThemesXP_themeXPSettings
mov dword [esp + 0xb8], 0x81
call fcn.004044a0
mov dword [esp + 0xb4], edi
call fcn.0040b830
add esp, 0x10
jmp 0x40e355
push 0x8036
lea ecx, [esp + 0x2c]
call fcn.004044a0
mov edx, dword [eax]
push 0x40
push str.TopThemes_XP
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x40e355
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret 0x20