Function at 0x439c10
Capabilities:
Log keystrokes
Open clipboard
Parse credit card information
Print debug messages

Disassembly:
push ebp
lea ebp, [esp - 0x27c]
sub esp, 0x2fc
mov eax, dword [0x47e5d0]
xor eax, ebp
mov dword [ebp + 0x278], eax
mov eax, dword [ebp + 0x288]
push ebx
push esi
mov esi, dword [ebp + 0x284]
push edi
mov edi, 0x103
xor ebx, ebx
push edi
mov dword [ebp - 0x68], eax
lea eax, [ebp + 0x135]
push ebx
push eax
mov dword [ebp - 0x64], esi
mov byte [ebp + 0x134], bl
call fcn.00452e00
push edi
lea eax, [ebp - 0x4f]
push ebx
push eax
mov byte [ebp - 0x50], bl
call fcn.00452e00
push 0x3f
lea eax, [ebp + 0xf5]
push ebx
push eax
mov byte [ebp + 0xf4], bl
call fcn.00452e00
push 0x3f
lea eax, [ebp + 0x239]
push ebx
push eax
mov byte [ebp + 0x238], bl
call fcn.00452e00
xor eax, eax
mov dword [ebp - 0x60], ebx
lea edi, [ebp - 0x5c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x68]
mov eax, dword [esi*4 + 0x481990]
imul edi, edi, 0xf54
add eax, edi
push str.Comment
push eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], ebx
call fcn.004010ff
add esp, 0x38
test eax, eax
jne 0x43a01e
mov eax, dword [esi*4 + 0x481990]
add eax, edi
push str.Variable
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi*4 + 0x481990]
pop ecx
je 0x43a219
add eax, edi
cmp byte [eax + 0xcc8], bl
jne 0x439d1f
cmp eax, ebx
je 0x439d0e
push str.Delete
push eax
call fcn.004526d0
pop ecx
pop ecx
jmp 0x439d10
xor eax, eax
cmp eax, ebx
jne 0x439d1f
push str.____WARNING:_No_variable_name_provided
call fcn.0042604a
pop ecx
mov eax, dword [esi*4 + 0x481990]
lea eax, [edi + eax + 0x58]
push str.No_Variable_Expansion
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi*4 + 0x481990]
pop ecx
je 0x439d47
push ebx
push 1
jmp 0x439d6e
lea eax, [edi + eax + 0x58]
push str.Single
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x439d61
push ebx
push 4
jmp 0x439d67
lea eax, [ebp - 0x70]
push eax
push 2
mov eax, dword [esi*4 + 0x481990]
push dword [ebp - 0x68]
push esi
push dword [edi + eax + 0x50]
call fcn.00442c90
mov eax, dword [esi*4 + 0x481990]
add eax, edi
push 0x46c360
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x439dc9
mov eax, dword [esi*4 + 0x481990]
add eax, edi
push str.Create
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x439dc9
mov eax, dword [esi*4 + 0x481990]
add eax, edi
push str.Update
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x439e02
mov eax, dword [esi*4 + 0x481990]
add eax, edi
push str.Environment
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x439e02
mov eax, dword [ebp - 0x70]
cmp eax, ebx
jne 0x439df6
push dword [0x485434]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [0x485434]
jmp 0x43a20b
mov eax, dword [esi*4 + 0x481990]
add eax, edi
push str.Set_Environment_Variable
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x439f66
push dword [0x485434]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [eax + 0x100]
mov eax, 0x1000
cmp ecx, eax
jle 0x439e4c
push dword [0x485434]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x100
push 1
push eax
call fcn.00452b24
pop ecx
pop ecx
mov dword [ebp - 0x80], eax
cmp eax, ebx
jne 0x439e64
xor eax, eax
jmp 0x43a021
push dword [0x485434]
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi*4 + 0x481990]
lea eax, [edi + eax + 0xcc8]
push eax
lea eax, [ebp + 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push ebx
push 0x464a50
push 0x46493c
lea eax, [ebp + 0x134]
push eax
call fcn.0044923e
push dword [ebp - 0x80]
lea eax, [ebp + 0x134]
push eax
call fcn.0044c262
mov dword [ebp - 0x6c], eax
mov eax, dword [esi*4 + 0x481990]
lea eax, [edi + eax + 0xcc8]
cmp byte [eax], 0x25
je 0x439ed8
push 0x46493c
push ebx
push eax
call fcn.00449673
mov eax, dword [esi*4 + 0x481990]
mov dword [ebp - 0x64], eax
lea eax, [eax + edi + 0xcc8]
cmp eax, ebx
je 0x439f0a
mov esi, dword [esi*4 + 0x481990]
push eax
mov dword [ebp - 0x64], esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
movsx eax, byte [eax + edi + 0xcc7]
jmp 0x439f0c
xor eax, eax
cmp eax, 0x25
je 0x439f2b
mov eax, dword [ebp - 0x64]
lea eax, [eax + edi + 0xcc8]
cmp eax, ebx
je 0x439f2b
push 0x46493c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x80]
call fcn.00452756
pop ecx
cmp dword [ebp - 0x6c], ebx
jne 0x43a01e
push ebx
push 0x7ff
push dword [0x481960]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
jmp 0x439e5d
mov eax, dword [esi*4 + 0x481990]
add eax, edi
push str.Delete
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi*4 + 0x481990]
pop ecx
je 0x43a150
lea eax, [edi + eax + 0x58]
push 0x46a230
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43a03b
push str.SOFTWARE_vTaskUserVariables
push ebx
push ebx
push ebx
push 4
call fcn.0044ad45
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0x14
push ebx
push ebx
push 0x1009
mov edi, 0x508
push edi
push dword [0x4800f0]
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x102f
push edi
push dword [0x4800f0]
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push edi
push dword [0x4800f0]
call esi
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, 0x481968
mov eax, dword [esi]
cmp eax, ebx
je 0x43a013
push eax
call fcn.00452756
pop ecx
mov dword [esi], ebx
add esi, 4
cmp esi, 0x481988
jle 0x43a004
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x278]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452dee
add ebp, 0x27c
leave
ret 0xc
mov eax, dword [esi*4 + 0x481990]
add eax, edi
lea esi, [eax + 0xcc8]
mov cl, byte [esi]
cmp cl, 0x7b
jne 0x43a08e
cmp byte [eax + 0xcca], 0x7d
jne 0x43a08e
movsx eax, byte [eax + 0xcc9]
add eax, 0xffffffcf
cmp eax, 1
jge 0x43a06e
xor eax, eax
inc eax
jmp 0x43a076
cmp eax, 9
jle 0x43a076
push 9
pop eax
lea esi, [eax*4 + 0x481964]
mov eax, dword [esi]
cmp eax, ebx
je 0x43a01e
push eax
call fcn.00452756
pop ecx
mov dword [esi], ebx
jmp 0x43a01e
cmp cl, 0x25
jne 0x43a099
lea esi, [eax + 0xcc9]
push esi
lea eax, [ebp + 0x134]
push str.SOFTWARE_vTaskUserVariables_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0x134]
push 0x5b
push eax
call fcn.00452d30
add esp, 0x14
test eax, eax
je 0x43a137
lea eax, [ebp + 0x134]
push 0x5d
push eax
call fcn.00452d30
pop ecx
pop ecx
test eax, eax
je 0x43a137
lea eax, [ebp + 0x134]
push 0x5b
push eax
call fcn.00452d30
pop ecx
pop ecx
inc eax
push eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x50]
mov cl, byte [eax]
cmp cl, bl
je 0x43a106
cmp cl, 0x5d
je 0x43a102
inc eax
jmp 0x43a0f4
mov byte [eax], bl
jmp 0x43a0f4
push 0x3f
lea eax, [ebp + 0xf4]
push eax
push dword [ebp - 0x68]
lea eax, [ebp - 0x50]
push dword [ebp - 0x64]
push eax
call fcn.00446b09
push ebx
push ebx
lea eax, [ebp + 0xf4]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x134]
push eax
call fcn.0044923e
lea eax, [ebp + 0x134]
push eax
push ebx
push ebx
push ebx
push 4
call fcn.0044ad45
add esp, 0x14
jmp 0x43a01e
add eax, edi
push str.Increment
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x43a181
mov eax, dword [esi*4 + 0x481990]
add eax, edi
push str.Decrement
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43a01e
mov eax, dword [esi*4 + 0x481990]
push ebx
push ebx
push dword [ebp - 0x68]
lea eax, [edi + eax + 0xcc8]
push esi
push eax
call fcn.00442c90
mov eax, dword [esi*4 + 0x481990]
add eax, edi
push str.Decrement
push eax
call fcn.004010ff
pop ecx
pop ecx
push dword [0x485434]
test eax, eax
je 0x43a1ce
call fcn.00454966
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x6c]
fsub qword [0x468330]
jmp 0x43a1df
call fcn.00454966
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x6c]
fadd qword [0x468330]
pop ecx
push 0xf
push ecx
push ecx
lea eax, [ebp + 0x134]
fstp qword [esp]
push eax
call fcn.0041c447
add esp, 0x10
lea eax, [ebp + 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp + 0x134]
push eax
push dword [ebp - 0x68]
push esi
call fcn.00428e6d
jmp 0x43a01e
add eax, edi
push str.Step_Delay
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi*4 + 0x481990]
pop ecx
je 0x43a2fa
push ebx
push ebx
push dword [ebp - 0x68]
lea eax, [edi + eax + 0x15c]
push esi
push eax
call fcn.00442c90
mov eax, dword [0x485434]
cmp byte [eax], bl
jne 0x43a269
mov eax, dword [esi*4 + 0x481990]
push ebx
push ebx
push dword [ebp - 0x68]
push esi
push dword [edi + eax + 0x50]
call fcn.00442c90
push 0x3f
lea eax, [ebp + 0xb5]
push ebx
push eax
mov byte [ebp + 0xb4], bl
call fcn.00452e00
push esi
lea eax, [ebp + 0xb4]
push str.InterStepDelay__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push ebx
push dword [0x485434]
call fcn.0040109c
pop ecx
push eax
lea eax, [ebp + 0xb4]
push eax
call fcn.00402396
mov eax, dword [esi*4 + 0x481990]
lea eax, [edi + eax + 0x58]
push str.Global
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43a2e2
push ebx
push dword [0x485434]
call fcn.0040109c
pop ecx
push eax
push str.InterStepDelay
call fcn.00402396
push dword [0x485434]
call fcn.0040109c
pop ecx
mov dword [esi*4 + 0x484e04], eax
jmp 0x43a01e
add eax, edi
push str.vTask
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi*4 + 0x481990]
pop ecx
je 0x43a5a6
push str.Stop
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi*4 + 0x481990]
pop ecx
je 0x43a3a5
push ebx
push ebx
push dword [ebp - 0x68]
lea eax, [edi + eax + 0x364]
push esi
push eax
call fcn.00442c90
mov eax, dword [0x485434]
mov al, byte [eax]
mov byte [0x47e00c], al
movzx eax, al
push eax
lea eax, [ebp + 0x134]
push str._d0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 0x134]
push eax
push ebx
push str.AcceleratorsStop
call fcn.00402396
cmp byte [0x4840a0], 2
jb 0x43a01e
movzx eax, byte [0x47e00c]
push eax
push eax
push str.____gcStopKey:__02d___02x
call fcn.0042604a
add esp, 0xc
jmp 0x43a01e
push str.Track
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi*4 + 0x481990]
pop ecx
je 0x43a4cd
lea eax, [edi + eax + 0x58]
push 0x464fec
push eax
call fcn.004010ff
pop ecx
pop ecx
push ebx
test eax, eax
je 0x43a430
push ebx
push str.RunTrackingShow
call fcn.00402396
mov eax, dword [0x4841ac]
cmp eax, ebx
je 0x43a01e
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43a01e
push ebx
push ebx
push 0x10
push dword [0x4841ac]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [0x4841ac]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x4841ac], ebx
jmp 0x43a01e
push 1
push str.RunTrackingShow
call fcn.00402396
mov eax, dword [0x4841ac]
cmp eax, ebx
je 0x43a450
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push str.SOFTWARE_vTaskColorsResultSuccessFill
mov dword [0x484f98], ebx
call fcn.0040225d
cmp eax, ebx
jne 0x43a46b
mov eax, 0xecffec
push eax
push ebx
push ebx
push str.RunTrackingAlpha
call fcn.0040225d
push eax
push ebx
push ebx
push str.RunTrackingTimeout
call fcn.0040225d
push eax
push ebx
call fcn.004482a1
lea eax, [eax + eax + 0xa]
push eax
push ebx
push ebx
push str.RunTrackingWidth
call fcn.0040225d
push eax
push ebx
push ebx
push str.RunTrackingY
call fcn.0040225d
push eax
push ebx
push ebx
push str.RunTrackingX
call fcn.0040225d
push eax
push dword [0x4800c0]
call fcn.0044a8d1
mov dword [0x4841ac], eax
jmp 0x43a01e
push 0x46c1fc
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi*4 + 0x481990]
pop ecx
je 0x43a55b
lea eax, [edi + eax + 0x58]
push 0x464fec
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43a502
mov dword [ebp - 0x6c], ebx
jmp 0x43a54a
mov eax, dword [esi*4 + 0x481990]
lea eax, [edi + eax + 0x58]
push 0x464fe0
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43a527
mov dword [ebp - 0x6c], 1
jmp 0x43a54a
mov eax, dword [esi*4 + 0x481990]
lea eax, [edi + eax + 0x58]
push 0x46c1f8
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43a54a
mov dword [ebp - 0x6c], 2
mov eax, dword [ebp - 0x6c]
push ebx
push eax
mov byte [0x4840a0], al
push str.LogLevel
jmp 0x43a59c
push str.Highlight
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43a01e
mov eax, dword [esi*4 + 0x481990]
lea eax, [edi + eax + 0x58]
push 0x464fec
push eax
call fcn.004010ff
pop ecx
neg eax
pop ecx
sbb eax, eax
inc eax
push ebx
push eax
mov byte [0x484f70], al
push str.HiliteRunningStep
call fcn.00402396
jmp 0x43a01e
add eax, edi
push str.Write_to_Output
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi*4 + 0x481990]
pop ecx
je 0x43a6a6
push ebx
push ebx
push dword [ebp - 0x68]
push esi
push dword [edi + eax + 0x50]
call fcn.00442c90
mov eax, dword [0x480100]
cmp eax, ebx
je 0x43a680
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43a680
push dword [0x485434]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
lea ecx, [eax + 1]
mov eax, 0x103
cmp ecx, eax
jg 0x43a612
push dword [0x485434]
call esi
inc eax
push eax
push dword [0x485434]
lea eax, [ebp + 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp + 0x134]
push eax
push 0xffffffffffffffff
push 0x181
push dword [0x480100]
call esi
push ebx
push ebx
mov edi, 0x18b
push edi
push dword [0x480100]
call esi
dec eax
jns 0x43a659
xor eax, eax
jmp 0x43a665
push ebx
push ebx
push edi
push dword [0x480100]
call esi
dec eax
push ebx
push eax
push 0x197
push dword [0x480100]
call esi
push dword [0x480100]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x485434]
cmp eax, ebx
je 0x43a695
push 0x4663d8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [0x485434]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x43a01e
add eax, edi
push str.Write_to_Log
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi*4 + 0x481990]
pop ecx
je 0x43a716
push ebx
push ebx
push dword [ebp - 0x68]
push esi
push dword [edi + eax + 0x50]
call fcn.00442c90
mov eax, dword [0x485434]
cmp eax, ebx
je 0x43a6e4
push 0x4663d8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x134]
push eax
call fcn.00424df8
push dword [0x485434]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [0x485434]
lea eax, [ebp + 0x134]
push 0xffffffffffffffff
push eax
call fcn.00413f55
jmp 0x43a01e
add eax, edi
push str.Set_Clipboard
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi*4 + 0x481990]
pop ecx
je 0x43a74f
push ebx
push ebx
push dword [ebp - 0x68]
push esi
push dword [edi + eax + 0x50]
call fcn.00442c90
push dword [0x485434]
call fcn.00449ff4
jmp 0x43a021
add eax, edi
push str.Paste_Clipboard
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43a7b1
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ebx
push 1
push ebx
push 0x11
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x11
call edi
push ebx
push ebx
push ebx
push 0x56
call esi
push eax
push 0x56
call edi
push ebx
push 2
push ebx
push 0x56
call esi
push eax
push 0x56
call edi
push ebx
push 3
push ebx
push 0x11
call esi
push eax
push 0x11
call edi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43a01e
mov eax, dword [esi*4 + 0x481990]
add eax, edi
push str.Clear_Clipboard
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43a7eb
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x439e5d
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x43a01e
mov eax, dword [esi*4 + 0x481990]
add eax, edi
push str.Capture
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi*4 + 0x481990]
pop ecx
je 0x43a9ce
lea eax, [edi + eax + 0x58]
push str.Area
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43a8c2
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [esi*4 + 0x481990]
lea eax, [edi + eax + 0x364]
push eax
push dword [ebp - 0x68]
push esi
call fcn.00424b20
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [esi*4 + 0x481990]
lea eax, [edi + eax + 0x468]
push eax
push dword [ebp - 0x68]
push esi
call fcn.00424b20
mov eax, dword [ebp - 0x60]
add dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x5c]
add dword [ebp - 0x54], eax
mov eax, dword [esi*4 + 0x481990]
push ebx
push ebx
push dword [ebp - 0x68]
lea eax, [edi + eax + 0xcc8]
push esi
push eax
call fcn.00442c90
mov eax, dword [esi*4 + 0x481990]
lea eax, [edi + eax + 0xc88]
push str.Clipboard
push eax
call fcn.004010ff
pop ecx
pop ecx
push ebx
test eax, eax
push ebx
lea eax, [ebp - 0x60]
je 0x43a8ba
push ebx
push eax
jmp 0x43a9c3
push dword [0x485434]
jmp 0x43a8b4
mov eax, dword [esi*4 + 0x481990]
lea eax, [edi + eax + 0x58]
push str.Window
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43a97e
mov eax, dword [0x480108]
cmp eax, ebx
je 0x43a91b
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43a91b
push 0xfffffffffffffff0
push dword [0x480108]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
je 0x43a91b
push dword [0x480108]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x43a931
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [0x480108], eax
mov eax, dword [esi*4 + 0x481990]
push ebx
push ebx
push dword [ebp - 0x68]
lea eax, [edi + eax + 0xcc8]
push esi
push eax
call fcn.00442c90
mov eax, dword [esi*4 + 0x481990]
lea eax, [edi + eax + 0xc88]
push str.Clipboard
push eax
call fcn.004010ff
pop ecx
pop ecx
push ebx
push ebx
test eax, eax
je 0x43a976
push ebx
push ebx
push dword [0x480108]
jmp 0x43a9c4
push dword [0x485434]
jmp 0x43a96d
mov eax, dword [esi*4 + 0x481990]
push ebx
push ebx
push dword [ebp - 0x68]
lea eax, [edi + eax + 0xcc8]
push esi
push eax
call fcn.00442c90
mov eax, dword [esi*4 + 0x481990]
lea eax, [edi + eax + 0xc88]
push str.Clipboard
push eax
call fcn.004010ff
pop ecx
pop ecx
push ebx
push ebx
test eax, eax
je 0x43a9bc
push ebx
jmp 0x43a9c2
push dword [0x485434]
push ebx
push ebx
call fcn.00415c28
jmp 0x43a021
add eax, edi
push str.Logoff
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43aa01
mov eax, dword [ebp - 0x68]
inc eax
push eax
push str.Logoff_at__Step__d_...
call fcn.0042604a
pop ecx
pop ecx
push ebx
push ebx
call fcn.0044e5d3
movzx eax, al
jmp 0x43a021
mov eax, dword [esi*4 + 0x481990]
add eax, edi
push str.Restart
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43aa36
mov eax, dword [ebp - 0x68]
inc eax
push eax
push str.Rebooting_at__Step__d_...
call fcn.0042604a
pop ecx
pop ecx
push dword [0x4800c0]
push 6
jmp 0x43a9f4
mov eax, dword [esi*4 + 0x481990]
add eax, edi
push str.Shutdown
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43aa6b
mov eax, dword [ebp - 0x68]
inc eax
push eax
push str.Shutdown_at__Step__d_...
call fcn.0042604a
pop ecx
pop ecx
push dword [0x4800c0]
push 5
jmp 0x43a9f4
mov eax, dword [esi*4 + 0x481990]
add eax, edi
push 0x46c0f8
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43a01e
cmp dword [ebp + 0x28c], ebx
jne 0x43aab5
mov eax, esi
shl eax, 0x14
add eax, dword [ebp - 0x68]
push eax
push 0x380d8
push 0x111
push dword [0x4800c0]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x43a021
mov eax, dword [esi*4 + 0x481990]
mov eax, dword [edi + eax + 0x50]
push 0x3d
push eax
call fcn.00452d30
pop ecx
pop ecx
mov dword [ebp - 0x6c], eax
cmp eax, ebx
je 0x43abe6
mov eax, dword [esi*4 + 0x481990]
mov eax, dword [edi + eax + 0x50]
push 0x28
push eax
call fcn.00452d30
pop ecx
pop ecx
cmp dword [ebp - 0x6c], eax
jae 0x43abe6
mov eax, dword [esi*4 + 0x481990]
mov eax, dword [edi + eax + 0x50]
push 0x25
push eax
call fcn.00452d30
pop ecx
pop ecx
test eax, eax
je 0x43abe6
mov eax, dword [esi*4 + 0x481990]
push dword [edi + eax + 0x50]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cmp eax, 0x3f
jle 0x43ab2c
push 0x3f
pop eax
jmp 0x43ab3e
mov eax, dword [esi*4 + 0x481990]
push dword [edi + eax + 0x50]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov eax, dword [esi*4 + 0x481990]
push dword [edi + eax + 0x50]
lea eax, [ebp + 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov al, byte [ebp + 0x238]
cmp al, bl
je 0x43ab98
cmp al, 0x20
je 0x43ab71
cmp al, 9
je 0x43ab71
cmp al, 0xd
je 0x43ab71
cmp al, 0xa
jne 0x43ab98
lea eax, [ebp + 0x239]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp + 0x239]
push eax
lea eax, [ebp + 0x238]
push eax
call fcn.00452ea0
add esp, 0xc
jmp 0x43ab57
lea ecx, [ebp + 0x238]
mov al, byte [ecx]
cmp al, bl
je 0x43abb3
cmp al, 0x20
je 0x43abaf
cmp al, 0x3d
je 0x43abaf
inc ecx
jmp 0x43ab9e
mov byte [ecx], bl
jmp 0x43ab9e
lea eax, [ebp + 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x43abe1
lea ecx, [ebp + eax + 0x238]
mov dl, byte [ecx]
cmp dl, 0x20
je 0x43abdf
cmp dl, 9
je 0x43abdf
cmp dl, 0xd
je 0x43abdf
cmp dl, 0xa
jne 0x43abe6
mov byte [ecx], bl
dec eax
cmp eax, ebx
jg 0x43abc2
mov eax, dword [esi*4 + 0x481990]
push ebx
push ebx
push dword [ebp - 0x68]
push esi
push dword [edi + eax + 0x50]
call fcn.00442c90
push 1
push ebx
push dword [0x485434]
lea eax, [ebp + 0x134]
push eax
call fcn.004262b2
mov edi, eax
cmp edi, 0x69f6f36
je 0x439e5d
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [ebp + 0x134]
push 0x464bf8
push eax
call esi
add esp, 0xc
lea eax, [ebp + 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp + 0x134]
push eax
push dword [ebp - 0x68]
push dword [ebp - 0x64]
call fcn.00428e6d
cmp byte [ebp + 0x238], bl
je 0x43ac94
cmp byte [ebp + 0x238], 0x25
lea eax, [ebp + 0x239]
je 0x43ac74
lea eax, [ebp + 0x238]
push eax
lea eax, [ebp - 0x50]
push str.SOFTWARE_vTaskUserVariables_s
push eax
call esi
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x134]
push ebx
push eax
call fcn.0044dba4
add esp, 0x18
xor eax, eax
inc eax
cmp edi, eax
jl 0x43a021
mov eax, edi
jmp 0x43a021