Function at 0x4079de
Capabilities:
Capture screenshot
Create process on windows
Download url
Receive data
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6e0
push ebx
push esi
push edi
push 0x87
mov eax, dword [0x40e3a8]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x40e404], eax
push 0x88
mov ecx, dword [0x40e3a8]
push ecx
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x40e3f8], eax
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x6d8], edx
cmp dword [ebp - 0x6d8], 0x111
ja 0x407ab1
cmp dword [ebp - 0x6d8], 0x111
je 0x407e24
cmp dword [ebp - 0x6d8], 0xf
ja 0x407a7f
cmp dword [ebp - 0x6d8], 0xf
je 0x408153
mov eax, dword [ebp - 0x6d8]
sub eax, 1
mov dword [ebp - 0x6d8], eax
cmp dword [ebp - 0x6d8], 6
ja case.0x407a78.2
mov ecx, dword [ebp - 0x6d8]
jmp dword [ecx*4 + 0x408af0]
cmp dword [ebp - 0x6d8], 0x12
je 0x408acd
cmp dword [ebp - 0x6d8], 0x100
je 0x4080d9
cmp dword [ebp - 0x6d8], 0x101
je 0x4080d4
jmp case.0x407a78.2
cmp dword [ebp - 0x6d8], 0x312
ja 0x407b02
cmp dword [ebp - 0x6d8], 0x312
je 0x408112
cmp dword [ebp - 0x6d8], 0x200
je 0x408a1f
cmp dword [ebp - 0x6d8], 0x201
je 0x408225
cmp dword [ebp - 0x6d8], 0x204
je 0x408a32
jmp case.0x407a78.2
cmp dword [ebp - 0x6d8], 0x6f4
je 0x407b41
cmp dword [ebp - 0x6d8], 0x7a8
je 0x40813a
cmp dword [ebp - 0x6d8], 0xbd7
je 0x4080d9
jmp case.0x407a78.2
mov edx, dword [ebp + 0x10]
mov dword [0x40e46c], edx
jmp 0x408ae7
call fcn.00407835
jmp 0x408ae7
mov dword [ebp - 0x158], str.http:__www.3bi.cn_shengji_lr_a.txt
mov byte [ebp - 0x154], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x153]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
push 0
push 0x108
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x158]
push ecx
push 0
call sub.urlmon.dll_URLDownloadToCacheFileA
test eax, eax
jne 0x407c5d
push 0x40d634
lea edx, [ebp - 0x154]
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
je 0x407c5d
mov byte [ebp - 0x578], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x577]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x178]
push eax
push 0x400
lea ecx, [ebp - 0x578]
push ecx
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
lea edx, [ebp - 0x578]
push edx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x178]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
cmp dword [ebp - 0x57c], 4
jle 0x407c5d
push 4
push 0x40d638
push 0x40d644
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x407c5d
mov dword [ebp - 0x580], 0x40d674
push 5
push 0
push 0
mov ecx, dword [ebp - 0x580]
push ecx
push 0x40d698
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea edx, [ebp - 0x170]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp - 0x170]
and eax, 0xffff
cmp eax, 0x7dd
jl 0x407ccd
mov ecx, dword [ebp - 0x16e]
and ecx, 0xffff
cmp ecx, 0xb
jl 0x407ccd
push 0x40
push 0x40d6a0
push 0x40d6ac
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x584], str.http:__www.mama98.com_download.htm
push 5
push 0
push 0
mov edx, dword [ebp - 0x584]
push edx
push 0x40d70c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x40d714
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x10
call dword [sym.imp.GDI32.dll_CreateFontA]
mov dword [0x40e40c], eax
push 0x40d71c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x2bc
push 0
push 0
push 0
push 0x12
call dword [sym.imp.GDI32.dll_CreateFontA]
mov dword [0x40e470], eax
push 0xa6eefd
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [0x40e468], eax
push 0xe6e6e6
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [0x40e464], eax
push 0xffc7b5
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
mov dword [0x40e408], eax
push 0x990000
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
mov dword [0x40e410], eax
push 0x86
mov eax, dword [0x40e3a8]
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
push 0xfffffffffffffff4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetClassLongA]
mov edx, dword [ebp + 8]
push edx
call fcn.004061b9
add esp, 4
push 0x51
push 2
push 0x270f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_RegisterHotKey]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x174], eax
lea edx, [ebp - 0x160]
push edx
push 1
push 0x40d724
mov eax, dword [ebp - 0x174]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [ebp - 0x160]
shl ecx, 1
mov dword [0x40e400], ecx
mov edx, dword [ebp - 0x174]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x407e05
call fcn.004041f3
call fcn.00404841
jmp 0x407e1f
jmp 0x408ae7
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
shr edx, 0x10
and edx, 0xffff
and edx, 0xffff
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6dc], eax
cmp dword [ebp - 0x6dc], 0x8009
jg 0x407ed6
cmp dword [ebp - 0x6dc], 0x8009
je 0x408093
cmp dword [ebp - 0x6dc], 0x8005
jg 0x407eb1
cmp dword [ebp - 0x6dc], 0x8005
je 0x407f6f
cmp dword [ebp - 0x6dc], 0x68
je 0x407f02
cmp dword [ebp - 0x6dc], 0x69
je 0x407f21
cmp dword [ebp - 0x6dc], 0x8004
je 0x407f52
jmp case.0x407efb.1
cmp dword [ebp - 0x6dc], 0x8006
je 0x4080ad
cmp dword [ebp - 0x6dc], 0x8007
je 0x407f8c
jmp case.0x407efb.1
mov ecx, dword [ebp - 0x6dc]
sub ecx, 0x800a
mov dword [ebp - 0x6dc], ecx
cmp dword [ebp - 0x6dc], 6
ja case.0x407efb.1
mov edx, dword [ebp - 0x6dc]
jmp dword [edx*4 + 0x408b0c]
push 0
push 0x401ea5
mov eax, dword [ebp + 8]
push eax
push 0x67
mov ecx, dword [0x40e3a8]
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x4080cf
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x4080cf
push 0
push 0x405fd0
mov eax, dword [ebp + 8]
push eax
push 0x8a
mov ecx, dword [0x40e3a8]
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x4080cf
push 5
push 0
push 0
push 0x40d728
push 0x40d740
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4080cf
push 5
push 0
push 0
push str.http:__www.3bi.cn_goumai.htm
push 0x40d768
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4080cf
push 5
push 0
push 0
push 0x40d770
push 0x40d784
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4080cf
push 5
push 0
push 0
push str.http:__www.mama98.com_
push 0x40d7a4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4080cf
push 5
push 0
push 0
push str.http:__www.zhshlm.com_
push 0x40d7c4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [0x40e474], 0
jne 0x407ffd
mov dword [0x40e3fc], 0x40d440
mov dword [0x40e474], 1
jmp 0x40801a
cmp dword [0x40e474], 1
jne 0x40801a
mov dword [0x40e3fc], 0x40d454
mov dword [0x40e474], 0
mov dword [ebp - 0x588], 4
lea edx, [ebp - 0x58c]
push edx
push str.SoftwareConvert
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x408069
push 4
push 0x40e474
push 4
push 0
push str.num2asc
mov eax, dword [ebp - 0x58c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x58c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4080cf
push 5
push 0
push 0
push str.http:__www.bhsrf.com__ahsm
push 0x40d804
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4080cf
push 5
push 0
push 0
push str.http:__www.3bi.cn_nm_
push 0x40d824
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4080cf
call fcn.004046e4
jmp 0x4080cf
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x408ae9
jmp 0x408ae7
jmp 0x408ae7
mov byte [0x40d3b8], 0
mov ecx, dword [ebp + 0x14]
and ecx, 0x80000000
test ecx, ecx
jne 0x40810d
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, 0x40d9e8
call fcn.004025cc
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x408ae7
cmp dword [ebp + 0x10], 0x270f
jne 0x408135
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x408130
call fcn.004077c7
jmp 0x408135
call fcn.00407835
jmp 0x408ae7
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00407955
add esp, 0xc
jmp 0x408ae7
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_BeginPaint]
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x590], eax
mov eax, dword [ebp - 0x590]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004062d7
add esp, 0x10
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 0
push 0
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [ebp - 0x590]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x408ae7
mov edx, 2
test edx, edx
je 0x408220
push 0x40a620
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 1
mov ecx, 0x40d9e8
call fcn.00402920
jmp 0x408ae7
mov byte [0x40d3b8], 0
mov ecx, dword [ebp + 0x14]
and ecx, 0xffff
mov dword [ebp - 0x594], ecx
mov edx, dword [ebp + 0x14]
and edx, 0xffff0000
shr edx, 0x10
mov dword [ebp - 0x598], edx
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x5a4], eax
mov ecx, dword [ebp - 0x598]
mov dword [ebp - 0x5a0], ecx
lea edx, [ebp - 0x5a4]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x5a4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [ebp - 0x5a0]
push edx
mov eax, dword [ebp - 0x5a4]
push eax
mov ecx, dword [0x40e478]
call fcn.00405f4e
mov dword [ebp - 0x5a8], eax
cmp dword [ebp - 0x5a8], 0xffffffff
jne 0x4082c0
push 0
push 2
push 0xa1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4082d4
push 0
push 0x40d82c
push 0x40d830
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [ebp - 0x5a0]
push edx
mov eax, dword [ebp - 0x5a4]
push eax
push 0x40e3e8
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x408309
push 5
push 0
push 0
push str.http:__www.3bi.cn_
push 0x40d848
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x5a0]
push ecx
mov edx, dword [ebp - 0x5a4]
push edx
push 0x40d3c0
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x408343
push 5
push 0
push 0
push str.http:__www.mama98.com
push 0x40d868
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4084b4
mov eax, dword [ebp - 0x5a0]
push eax
mov ecx, dword [ebp - 0x5a4]
push ecx
push 0x40d3d0
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x408390
push 5
push 0
push 0
push str.http:__www.zhshlm.com
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0x22
push 0x100
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4084b4
mov eax, dword [ebp - 0x5a0]
push eax
mov ecx, dword [ebp - 0x5a4]
push ecx
push 0x40d3e0
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4083c0
push 0
push 0
push 0
push 8
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x408ae7
mov edx, dword [ebp - 0x5a0]
push edx
mov eax, dword [ebp - 0x5a4]
push eax
push 0x40d3f0
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4083f0
mov ecx, dword [ebp + 8]
push ecx
push 2
call fcn.004078a3
add esp, 8
jmp 0x4084b4
mov edx, dword [ebp - 0x5a0]
push edx
mov eax, dword [ebp - 0x5a4]
push eax
push 0x40d400
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x408425
push 0
push 0x21
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4084b4
mov edx, dword [ebp - 0x5a0]
push edx
mov eax, dword [ebp - 0x5a4]
push eax
push 0x40d410
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x408457
push 0
push 0x22
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4084b4
mov edx, dword [ebp - 0x5a0]
push edx
mov eax, dword [ebp - 0x5a4]
push eax
push 0x40d420
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x408489
push 0
push 0x42
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4084b4
mov edx, dword [ebp - 0x5a0]
push edx
mov eax, dword [ebp - 0x5a4]
push eax
push 0x40d430
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4084b4
mov ecx, dword [ebp + 8]
push ecx
push 3
call fcn.004078a3
add esp, 8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x5a0]
push eax
mov ecx, dword [ebp - 0x5a4]
push ecx
push 0x40e3c0
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4086e1
mov ecx, 0x40d9e8
call fcn.00408be0
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call fcn.0040625f
add esp, 4
test eax, eax
jbe 0x4086e1
mov ecx, 0x40d9e8
call fcn.00408be0
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 0x5ac], 0
mov dword [ebp - 0x5f0], 0
mov ecx, 0x40d9e8
call fcn.00408be0
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call fcn.0040625f
add esp, 4
mov dword [ebp - 0x5fc], eax
mov dword [ebp - 0x5f8], 0
jmp 0x408570
mov edx, dword [ebp - 0x5f8]
add edx, 1
mov dword [ebp - 0x5f8], edx
mov eax, dword [ebp - 0x5f8]
cmp eax, dword [ebp - 0x5fc]
jge 0x4086dc
push 0x20
push 0
lea ecx, [ebp - 0x5cc]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x20
push 0
lea edx, [ebp - 0x5ec]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push str._n_n_n_n
mov eax, dword [ebp - 0x5f4]
push eax
call fcn.00408bc0
add esp, 8
mov dword [ebp - 0x5ac], eax
mov ecx, dword [ebp - 0x5ac]
sub ecx, dword [ebp - 0x5f4]
push ecx
mov edx, dword [ebp - 0x5f4]
push edx
lea eax, [ebp - 0x5ec]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
lea ecx, [ebp - 0x5ec]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
cmp eax, 8
jbe 0x408609
lea edx, [ebp - 0x5ec]
push edx
call fcn.0040736a
add esp, 4
lea eax, [ebp - 0x5ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0x5ec]
push ecx
lea edx, [ebp - 0x5cc]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
lea eax, [ebp + eax - 0x5cc]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x5cc]
push ecx
mov edx, dword [ebp - 0x59c]
push edx
call fcn.0040620f
add esp, 8
mov dword [ebp - 0x6cc], eax
mov dword [ebp - 0x6c8], edx
mov eax, dword [ebp - 0x6cc]
mov dword [ebp - 0x604], eax
mov ecx, dword [ebp - 0x6c8]
mov dword [ebp - 0x600], ecx
mov edx, dword [ebp - 0x604]
add edx, dword [0x40e400]
mov dword [ebp - 0x604], edx
mov eax, dword [ebp - 0x5f0]
add eax, dword [ebp - 0x604]
mov dword [ebp - 0x5f0], eax
mov ecx, dword [ebp - 0x5a4]
cmp ecx, dword [ebp - 0x5f0]
ja 0x4086bc
push 1
mov edx, dword [ebp - 0x5f8]
push edx
call fcn.004060e4
add esp, 8
jmp 0x4086dc
push 0x40d894
call sub.MSVCRT.dll_strlen
add esp, 4
mov ecx, dword [ebp - 0x5ac]
add ecx, eax
mov dword [ebp - 0x5f4], ecx
jmp 0x408561
jmp case.default.0x40899b
mov edx, dword [ebp - 0x5a0]
push edx
mov eax, dword [ebp - 0x5a4]
push eax
push 0x40e3d0
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4088fe
mov ecx, 0x40d9e8
call fcn.00408c00
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call fcn.0040625f
add esp, 4
test eax, eax
jbe 0x4088fe
mov ecx, 0x40d9e8
call fcn.00408c00
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x608], 0
mov dword [ebp - 0x64c], 0
mov ecx, 0x40d9e8
call fcn.00408c00
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call fcn.0040625f
add esp, 4
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x654], 0
jmp 0x40878d
mov ecx, dword [ebp - 0x654]
add ecx, 1
mov dword [ebp - 0x654], ecx
mov edx, dword [ebp - 0x654]
cmp edx, dword [ebp - 0x658]
jge 0x4088f9
push 0x20
push 0
lea eax, [ebp - 0x628]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x20
push 0
lea ecx, [ebp - 0x648]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x40d898
mov edx, dword [ebp - 0x650]
push edx
call fcn.00408bc0
add esp, 8
mov dword [ebp - 0x608], eax
mov eax, dword [ebp - 0x608]
sub eax, dword [ebp - 0x650]
push eax
mov ecx, dword [ebp - 0x650]
push ecx
lea edx, [ebp - 0x648]
push edx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
lea eax, [ebp - 0x648]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
cmp eax, 8
jbe 0x408826
lea ecx, [ebp - 0x648]
push ecx
call fcn.0040736a
add esp, 4
lea edx, [ebp - 0x648]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x648]
push eax
lea ecx, [ebp - 0x628]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
lea edx, [ebp + eax - 0x628]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x628]
push eax
mov ecx, dword [ebp - 0x59c]
push ecx
call fcn.0040620f
add esp, 8
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x6d0], edx
mov edx, dword [ebp - 0x6d4]
mov dword [ebp - 0x660], edx
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x65c], eax
mov ecx, dword [ebp - 0x660]
add ecx, dword [0x40e400]
mov dword [ebp - 0x660], ecx
mov edx, dword [ebp - 0x64c]
add edx, dword [ebp - 0x660]
mov dword [ebp - 0x64c], edx
mov eax, dword [ebp - 0x5a4]
cmp eax, dword [ebp - 0x64c]
ja 0x4088d9
push 2
mov ecx, dword [ebp - 0x654]
push ecx
call fcn.004060e4
add esp, 8
jmp 0x4088f9
push 0x40d89c
call sub.MSVCRT.dll_strlen
add esp, 4
mov edx, dword [ebp - 0x608]
add edx, eax
mov dword [ebp - 0x650], edx
jmp 0x40877e
jmp case.default.0x40899b
mov eax, dword [ebp - 0x5a0]
push eax
mov ecx, dword [ebp - 0x5a4]
push ecx
push 0x40e418
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je case.default.0x40899b
mov dword [ebp - 0x664], 0
jmp 0x40893a
mov edx, dword [ebp - 0x664]
add edx, 1
mov dword [ebp - 0x664], edx
cmp dword [ebp - 0x664], 5
jge 0x408971
mov eax, dword [0x40e420]
sub eax, dword [0x40e418]
cdq
mov ecx, 5
idiv ecx
imul eax, dword [ebp - 0x664]
mov edx, dword [0x40e418]
add edx, eax
cmp dword [ebp - 0x594], edx
jge 0x40896f
jmp 0x408971
jmp 0x40892b
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x6e0], eax
mov ecx, dword [ebp - 0x6e0]
sub ecx, 1
mov dword [ebp - 0x6e0], ecx
cmp dword [ebp - 0x6e0], 4
ja case.default.0x40899b
mov edx, dword [ebp - 0x6e0]
jmp dword [edx*4 + 0x408b28]
push 0
push 0x41
push 0x100
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x40899b
push 0
push 0x53
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x40899b
push 0
push 0x44
push 0x100
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x40899b
push 0
push 0x46
push 0x100
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x40899b
push 0
push 0x47
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x59c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x408ae7
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x408ae7
push 0
push 0x1b
push 0x100
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp + 0x14]
and eax, 0xffff
mov dword [ebp - 0x66c], eax
mov ecx, dword [ebp + 0x14]
shr ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
mov dword [ebp - 0x668], ecx
lea edx, [ebp - 0x66c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x408ae7
mov dword [ebp - 0x6c4], 0
mov ecx, 0x15
xor eax, eax
lea edi, [ebp - 0x6c0]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6c4], 0x58
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x6c0], ecx
mov dword [ebp - 0x6bc], 1
lea edx, [ebp - 0x6c4]
push edx
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x408ae7
jmp 0x408ae7
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x408ae9
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret