Function at 0x4c7fe0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x591094
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1ec
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push str.DB38160B_3B06_47e9_8E90_5F354255DE02
push 0
push 1
push 0
mov esi, ecx
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 0x2d50], eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push str.4C144B6B_BECD_4b53_81DD_42E8BB978A9E
push 0
push 0
mov dword [esi + 0x2d4c], eax
call ebx
push 0
push 0
push 0
push 0
mov dword [esi + 0x2d58], eax
call edi
xor edi, edi
push edi
push edi
push edi
mov dword [esi + 0x2d54], eax
call ebx
push edi
push 0x3e8
mov dword [esi + 0x2d5c], eax
mov eax, dword [esi + 4]
push edi
push eax
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.005096c0
xor ecx, ecx
push 0x17
mov ebx, eax
mov word [ebp - 0x2c], cx
push 0x5a3288
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
call fcn.00407db0
mov dword [ebp - 4], edi
push edi
lea edx, [ebp - 0x2c]
push edx
push 1
mov ecx, ebx
call fcn.00509210
mov dword [ebp - 0x78], eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x4c80c7
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00553d26
add esp, 4
mov edx, dword [esi + 4]
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], cx
mov dword [ebp - 0x7c], edx
cmp dword [ebp - 0x78], edi
jle 0x4c810f
lea eax, [ebp - 0x40]
push eax
push 4
lea ecx, [ebp - 0x7c]
push ecx
push 0x4b9340
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2d0c], eax
cmp eax, edi
je 0x4c810f
cmp eax, 0xffffffff
je 0x4c810f
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esi + 0x2cc8]
mov ecx, dword [esi + 0x2ccc]
push esi
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esi + 0x2cd0]
mov dword [eax + 4], ecx
mov ecx, dword [esi + 0x2cd4]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov ecx, dword [esi + 0x2cc4]
call fcn.00412290
mov edx, dword [esi + 0x2cc8]
mov ecx, dword [esi + 0x2ccc]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esi + 0x2cd0]
mov dword [eax + 4], ecx
mov ecx, dword [esi + 0x2cd4]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov ecx, dword [esi + 0x2cc4]
add ecx, 0x21c
call fcn.004f35c0
mov ecx, dword [eax + 0xc4]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
add eax, 0x5d
push edx
lea ebx, [esi + 0x1a4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x24], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x28]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 1
mov edx, dword [0x5f5774]
mov dword [ebp + 8], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x5f5774
call eax
add eax, 0x10
mov dword [ebp + 0x10], eax
mov dword [ebp - 4], 2
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp + 0x10]
push 0x5a3c64
push edx
call fcn.004060d0
push 0x79c
call fcn.0055549a
mov edi, eax
add esp, 0x10
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], 3
test edi, edi
je 0x4c8225
mov eax, dword [ebp + 0x10]
cmp dword [eax - 4], 1
jle 0x4c821b
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp + 0x10]
call fcn.00403bd0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, edi
call fcn.004a7ad0
jmp 0x4c8227
xor eax, eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp + 0x10]
push str.ProcessView_u
push edx
mov dword [esi + 0x2cdc], eax
call fcn.004060d0
push 0x304
call fcn.0055549a
mov edi, eax
add esp, 0x10
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], 4
test edi, edi
je 0x4c827f
mov eax, dword [ebp + 0x10]
cmp dword [eax - 4], 1
jle 0x4c8275
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp + 0x10]
call fcn.00403bd0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, edi
call fcn.004a0860
jmp 0x4c8281
xor eax, eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp + 0x10]
push str.InternetView_u
push edx
mov dword [esi + 0x2ce0], eax
call fcn.004060d0
push 0x330
call fcn.0055549a
mov edi, eax
add esp, 0x10
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], 5
test edi, edi
je 0x4c82d9
mov eax, dword [ebp + 0x10]
cmp dword [eax - 4], 1
jle 0x4c82cf
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp + 0x10]
call fcn.00403bd0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, edi
call fcn.00462d00
jmp 0x4c82db
xor eax, eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp + 0x10]
push str.QueriesView_u
push edx
mov dword [esi + 0x2cd8], eax
call fcn.004060d0
push 0x330
call fcn.0055549a
mov edi, eax
add esp, 0x10
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], 6
test edi, edi
je 0x4c8333
mov eax, dword [ebp + 0x10]
cmp dword [eax - 4], 1
jle 0x4c8329
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp + 0x10]
call fcn.00403bd0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, edi
call fcn.004a9c90
jmp 0x4c8335
xor eax, eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp + 0x10]
push str.IMView_u
push edx
mov dword [esi + 0x2d00], eax
call fcn.004060d0
push 0x358
call fcn.0055549a
mov edi, eax
add esp, 0x10
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], 7
test edi, edi
je 0x4c838d
mov eax, dword [ebp + 0x10]
cmp dword [eax - 4], 1
jle 0x4c8383
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp + 0x10]
call fcn.00403bd0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, edi
call fcn.004535f0
jmp 0x4c838f
xor eax, eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp + 0x10]
push str.SNView_u
push edx
mov dword [esi + 0x2ce4], eax
call fcn.004060d0
push 0x378
call fcn.0055549a
mov edi, eax
add esp, 0x10
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], 8
test edi, edi
je 0x4c83e7
mov eax, dword [ebp + 0x10]
cmp dword [eax - 4], 1
jle 0x4c83dd
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp + 0x10]
call fcn.00403bd0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, edi
call fcn.004b5420
jmp 0x4c83e9
xor eax, eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp + 0x10]
push str.KbdLogView_u
push edx
mov dword [esi + 0x2d04], eax
call fcn.004060d0
push 0x37c
call fcn.0055549a
mov edi, eax
add esp, 0x10
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], 9
test edi, edi
je 0x4c8441
mov eax, dword [ebp + 0x10]
cmp dword [eax - 4], 1
jle 0x4c8437
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp + 0x10]
call fcn.00403bd0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, edi
call fcn.00469e50
jmp 0x4c8443
xor eax, eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp + 0x10]
push str.FilespyView_u
push edx
mov dword [esi + 0x2cec], eax
call fcn.004060d0
push 0x330
call fcn.0055549a
mov edi, eax
add esp, 0x10
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], 0xa
test edi, edi
je 0x4c849b
mov eax, dword [ebp + 0x10]
cmp dword [eax - 4], 1
jle 0x4c8491
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp + 0x10]
call fcn.00403bd0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, edi
call fcn.0044a7e0
jmp 0x4c849d
xor eax, eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp + 0x10]
push str.USBShadowspyView_u
push edx
mov dword [esi + 0x2cf0], eax
call fcn.004060d0
push 0x358
call fcn.0055549a
mov edi, eax
add esp, 0x10
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], 0xb
test edi, edi
je 0x4c84f5
mov eax, dword [ebp + 0x10]
cmp dword [eax - 4], 1
jle 0x4c84eb
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp + 0x10]
call fcn.00403bd0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, edi
call fcn.004e7070
jmp 0x4c84f7
xor eax, eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp + 0x10]
push str.EmailspyView_u
push edx
mov dword [esi + 0x2cf8], eax
call fcn.004060d0
push 0x37c
call fcn.0055549a
mov edi, eax
add esp, 0x10
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], 0xc
test edi, edi
je 0x4c854f
mov eax, dword [ebp + 0x10]
cmp dword [eax - 4], 1
jle 0x4c8545
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp + 0x10]
call fcn.00403bd0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, edi
call fcn.00443e50
jmp 0x4c8551
xor eax, eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp + 0x10]
push str.ClipboardContentView_u
push edx
mov dword [esi + 0x2cf4], eax
call fcn.004060d0
push 0x388
call fcn.0055549a
mov edi, eax
add esp, 0x10
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], 0xd
test edi, edi
je 0x4c85a9
mov eax, dword [ebp + 0x10]
cmp dword [eax - 4], 1
jle 0x4c859f
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp + 0x10]
call fcn.00403bd0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, edi
call fcn.00437560
jmp 0x4c85ab
xor eax, eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp + 0x10]
push str.LoginView_u
push edx
mov dword [esi + 0x2cfc], eax
call fcn.004060d0
push 0x2f0
call fcn.0055549a
mov edi, eax
add esp, 0x10
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], 0xe
test edi, edi
je 0x4c8603
mov eax, dword [ebp + 0x10]
cmp dword [eax - 4], 1
jle 0x4c85f9
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp + 0x10]
call fcn.00403bd0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, edi
call fcn.0046e930
jmp 0x4c8605
xor eax, eax
mov byte [ebp - 4], 2
mov dword [esi + 0x2ce8], eax
cmp dword [0x5f7bf0], 0
jne 0x4c8654
push 0
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push 0
push 0
push 0
push ecx
mov dword [eax], 0x4d2
mov eax, esp
mov dword [eax], 0
mov ecx, dword [esi + 4]
mov dword [ebp + 0xc], esp
push ecx
lea ecx, [esi + 0x154]
call fcn.004c1540
push 1
lea ecx, [esi + 0x154]
call fcn.004302a0
mov eax, dword [esi + 4]
lea edx, [ebp - 0x8c]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x80]
push 2
add edx, 0xc8
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov dword [ebp - 0x8c], edx
mov edx, dword [ebp - 0x88]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x84]
add ecx, 0xfa
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov eax, dword [esi + 4]
mov dword [ebp - 0x80], ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004c7370
push 0
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push 0
push 0
push 0
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [eax], 0
mov ecx, dword [esi + 4]
mov dword [ebp + 0xc], esp
push ecx
mov ecx, dword [esi + 0x2cdc]
call fcn.004c0fc0
mov edx, dword [esi + 0x2cdc]
push 0
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push 0
push 0
mov dword [edx + 0x5a8], ebx
push 0
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [eax], 0
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x2ce0]
mov dword [ebp + 0xc], esp
push eax
call fcn.004c1040
mov ecx, dword [esi + 0x2ce0]
push 0
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push 0
push 0
mov dword [ecx + 0x2a4], ebx
push 0
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [eax], 0
mov edx, dword [esi + 4]
mov ecx, dword [esi + 0x2cd8]
mov dword [ebp + 0xc], esp
push edx
call fcn.004c0e80
mov eax, dword [esi + 0x2cd8]
push 0
push ecx
mov dword [eax + 0x2a4], ebx
mov dword [ebp + 0xc], esp
mov eax, esp
push 0
push 0
push 0
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [eax], 0
mov ecx, dword [esi + 4]
mov dword [ebp + 0xc], esp
push ecx
mov ecx, dword [esi + 0x2d00]
call fcn.004c1980
mov edx, dword [esi + 0x2d00]
push 0
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push 0
push 0
mov dword [edx + 0x2a4], ebx
push 0
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [eax], 0
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x2ce4]
mov dword [ebp + 0xc], esp
push eax
call fcn.004c1180
mov ecx, dword [esi + 0x2ce4]
push 0
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push 0
push 0
mov dword [ecx + 0x2a8], ebx
push 0
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [eax], 0
mov edx, dword [esi + 4]
mov ecx, dword [esi + 0x2d04]
mov dword [ebp + 0xc], esp
push edx
call fcn.004c1400
mov eax, dword [esi + 0x2d04]
push 0
push ecx
mov dword [eax + 0x2a8], ebx
mov eax, esp
mov dword [ebp + 0xc], esp
push 0
push 0
push 0
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [eax], 0
mov ecx, dword [esi + 4]
mov dword [ebp + 0xc], esp
push ecx
mov ecx, dword [esi + 0x2cec]
call fcn.004c1700
mov edx, dword [esi + 0x2cec]
push 0
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push 0
push 0
push 0
mov dword [edx + 0x2a8], ebx
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [ebp + 0xc], esp
mov dword [eax], 0
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x2cfc]
push eax
call fcn.004c12c0
mov ecx, dword [esi + 0x2cfc]
push 0
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push 0
push 0
mov dword [ecx + 0x2a8], ebx
push 0
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [eax], 0
mov edx, dword [esi + 4]
mov ecx, dword [esi + 0x2cf0]
mov dword [ebp + 0xc], esp
push edx
call fcn.004c1c00
mov eax, dword [esi + 0x2cf0]
push 0
push ecx
mov dword [eax + 0x2a4], ebx
mov eax, esp
mov dword [ebp + 0xc], esp
push 0
push 0
push 0
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [eax], 0
mov ecx, dword [esi + 4]
mov dword [ebp + 0xc], esp
push ecx
mov ecx, dword [esi + 0x2cf8]
call fcn.004c1ac0
mov edx, dword [esi + 0x2cf8]
push 0
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push 0
push 0
mov dword [edx + 0x2a8], ebx
push 0
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [eax], 0
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x2cf4]
mov dword [ebp + 0xc], esp
push eax
call fcn.004c1840
mov ecx, dword [esi + 0x2cf4]
push 0
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push 0
push 0
mov dword [ecx + 0x2a8], ebx
push 0
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [eax], 0
mov edx, dword [esi + 4]
mov ecx, dword [esi + 0x2ce8]
mov dword [ebp + 0xc], esp
push edx
call fcn.004c15c0
mov eax, dword [esi + 0x2ce8]
push 0x80
lea ecx, [ebp - 0x19c]
mov dword [eax + 0x2a4], ebx
push ecx
mov edx, dword [0x5fd7c0]
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push 0x8f
push edx
call ebx
mov eax, dword [0x5fd7c0]
push eax
push ecx
mov eax, esp
mov dword [eax], 0x12c
mov ecx, dword [esi + 0x2cdc]
mov eax, dword [ecx + 4]
mov dword [ebp + 0xc], esp
lea edx, [ebp - 0x19c]
push edx
push eax
lea ecx, [esi + 0x40]
call fcn.004c7f60
mov dword [esi + 0x2d18], eax
mov ecx, dword [0x5fd7c0]
push 0x80
lea eax, [ebp - 0x19c]
push eax
push 0x90
push ecx
call ebx
mov edx, dword [0x5fd7c0]
push edx
push ecx
mov eax, esp
mov dword [eax], 0x131
mov eax, dword [esi + 0x2ce0]
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], esp
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004c7f60
push 0x80
lea edx, [ebp - 0x19c]
push edx
mov dword [esi + 0x2d1c], eax
mov eax, dword [0x5fd7c0]
push 0xda
push eax
call ebx
mov ecx, dword [0x5fd7c0]
push ecx
push ecx
mov eax, esp
mov dword [eax], 0xe4
mov edx, dword [esi + 0x2cd8]
mov eax, dword [edx + 4]
mov dword [ebp + 0xc], esp
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004c7f60
push 0x80
lea edx, [ebp - 0x19c]
push edx
mov dword [esi + 0x2d20], eax
mov eax, dword [0x5fd7c0]
push 0x140
push eax
call ebx
mov ecx, dword [0x5fd7c0]
push ecx
push ecx
mov eax, esp
mov dword [eax], 0x151
mov edx, dword [esi + 0x2d00]
mov eax, dword [edx + 4]
mov dword [ebp + 0xc], esp
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004c7f60
push 0x80
lea edx, [ebp - 0x19c]
push edx
mov dword [esi + 0x2d14], eax
mov eax, dword [0x5fd7c0]
push 0x145
push eax
call ebx
mov ecx, dword [0x5fd7c0]
push ecx
push ecx
mov eax, esp
mov dword [eax], 0x154
mov edx, dword [esi + 0x2d04]
mov eax, dword [edx + 4]
mov dword [ebp + 0xc], esp
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004c7f60
push 0x80
lea edx, [ebp - 0x19c]
push edx
mov dword [esi + 0x2d24], eax
mov eax, dword [0x5fd7c0]
push 0xb7
push eax
call ebx
mov ecx, dword [0x5fd7c0]
push ecx
push ecx
mov eax, esp
mov dword [eax], 0xdc
mov edx, dword [esi + 0x2ce4]
mov eax, dword [edx + 4]
mov dword [ebp + 0xc], esp
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004c7f60
push 0x80
lea edx, [ebp - 0x19c]
push edx
mov dword [esi + 0x2d28], eax
mov eax, dword [0x5fd7c0]
push 0xe7
push eax
call ebx
mov ecx, dword [0x5fd7c0]
push ecx
push ecx
mov eax, esp
mov dword [eax], 0x135
mov edx, dword [esi + 0x2cec]
mov eax, dword [edx + 4]
mov dword [ebp + 0xc], esp
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004c7f60
push 0x80
lea edx, [ebp - 0x19c]
push edx
mov dword [esi + 0x2d2c], eax
mov eax, dword [0x5fd7c0]
push 0x13a
push eax
call ebx
mov ecx, dword [0x5fd7c0]
push ecx
push ecx
mov eax, esp
mov dword [eax], 0x148
mov edx, dword [esi + 0x2cfc]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x19c]
mov dword [ebp + 0xc], esp
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004c7f60
push 0x80
lea edx, [ebp - 0x19c]
push edx
mov dword [esi + 0x2d30], eax
mov eax, dword [0x5fd7c0]
push 0xf0
push eax
call ebx
mov ecx, dword [0x5fd7c0]
push ecx
push ecx
mov eax, esp
mov dword [eax], 0x133
mov edx, dword [esi + 0x2cf0]
mov eax, dword [edx + 4]
mov dword [ebp + 0xc], esp
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004c7f60
push 0x80
lea edx, [ebp - 0x19c]
push edx
mov dword [esi + 0x2d38], eax
mov eax, dword [0x5fd7c0]
push 0x124
push eax
call ebx
mov ecx, dword [0x5fd7c0]
push ecx
push ecx
mov eax, esp
mov dword [eax], 0x13b
mov edx, dword [esi + 0x2cf8]
mov eax, dword [edx + 4]
mov dword [ebp + 0xc], esp
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004c7f60
push 0x80
lea edx, [ebp - 0x19c]
push edx
mov dword [esi + 0x2d40], eax
mov eax, dword [0x5fd7c0]
push 0x11f
push eax
call ebx
mov ecx, dword [0x5fd7c0]
push ecx
push ecx
mov eax, esp
mov dword [eax], 0x137
mov edx, dword [esi + 0x2cf4]
mov eax, dword [edx + 4]
mov dword [ebp + 0xc], esp
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004c7f60
push 0x80
lea edx, [ebp - 0x19c]
push edx
mov dword [esi + 0x2d3c], eax
mov eax, dword [0x5fd7c0]
push 0x7d4
push eax
call ebx
mov ecx, dword [0x5fd7c0]
push ecx
push ecx
mov eax, esp
mov dword [eax], 0x139
mov edx, dword [esi + 0x2ce8]
mov dword [ebp + 0xc], esp
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004c7f60
push 0x13
xor edx, edx
push 0x5a4af0
lea ecx, [ebp - 0x2c]
mov dword [esi + 0x2d34], eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
call fcn.00407db0
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x74]
push 0
lea eax, [ebp - 0x2c]
push eax
push 1
call fcn.00509210
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 8
jb 0x4c8d4c
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00553d26
add esp, 4
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x64]
xor edx, edx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
mov dword [ebp + 0xc], ecx
cmp ecx, eax
je 0x4c8e7e
cmp ecx, dword [esi + 0x74]
jl 0x4c8d79
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x14], eax
mov eax, dword [esi + 0x44]
push eax
mov dword [ebp - 0x2c], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x44]
push eax
mov dword [ebp - 0x24], 0xfffffdd8
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
call dword [sym.imp.USER32.dll_GetParent]
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x2c]
push ecx
push edx
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
je 0x4c8e7e
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x64], eax
test eax, eax
js 0x4c8e46
test dword [esi + 0xec], 6
je 0x4c8e46
cmp eax, dword [esi + 0x74]
jge 0x4c8e46
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x9c]
push eax
push ecx
lea ecx, [esi + 0x40]
call fcn.004b9c40
mov eax, dword [esi + 0x90]
mov ecx, dword [ebp - 0x9c]
cmp ecx, eax
jge 0x4c8e2b
sub eax, ecx
add eax, 0x14
jmp 0x4c8e40
mov eax, dword [esi + 0x98]
mov ecx, dword [ebp - 0x94]
cmp ecx, eax
jle 0x4c8e46
sub eax, ecx
sub eax, 0x14
add dword [esi + 0xe8], eax
lea ecx, [esi + 0x40]
call fcn.004be020
mov edx, dword [esi + 0x44]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 0x44]
push eax
mov dword [ebp - 0x24], 0xfffffdd9
call dword [sym.imp.USER32.dll_GetParent]
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x2c]
push ecx
push edx
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x5fd7c0]
push 0x80
lea eax, [ebp - 0x19c]
push eax
push 0x800d
push ecx
call ebx
mov edx, dword [esi + 0x2cdc]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004d1eb0
mov eax, dword [0x5fd7c0]
push 0x80
lea edx, [ebp - 0x19c]
push edx
push 0x8016
push eax
call ebx
mov ecx, dword [esi + 0x2d04]
mov eax, dword [ecx + 4]
lea edx, [ebp - 0x19c]
push edx
push eax
lea ecx, [esi + 0x40]
call fcn.004d1eb0
mov ecx, dword [0x5fd7c0]
push 0x80
lea eax, [ebp - 0x19c]
push eax
push 0x800e
push ecx
call ebx
mov edx, dword [esi + 0x2ce0]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004d1eb0
mov eax, dword [0x5fd7c0]
push 0x80
lea edx, [ebp - 0x19c]
push edx
push 0x800f
push eax
call ebx
mov ecx, dword [esi + 0x2cd8]
mov eax, dword [ecx + 4]
lea edx, [ebp - 0x19c]
push edx
push eax
lea ecx, [esi + 0x40]
call fcn.004d1eb0
mov ecx, dword [0x5fd7c0]
push 0x80
lea eax, [ebp - 0x19c]
push eax
push 0xb8
push ecx
call ebx
mov edx, dword [esi + 0x2ce4]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004d1eb0
mov eax, dword [0x5fd7c0]
push 0x80
lea edx, [ebp - 0x19c]
push edx
push 0x7d5
push eax
call ebx
mov ecx, dword [esi + 0x2ce8]
mov eax, dword [ecx + 4]
lea edx, [ebp - 0x19c]
push edx
push eax
lea ecx, [esi + 0x40]
call fcn.004d1eb0
mov ecx, dword [0x5fd7c0]
push 0x80
lea eax, [ebp - 0x19c]
push eax
push 0x7d6
push ecx
call ebx
mov edx, dword [esi + 0x2cf0]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004d1eb0
mov eax, dword [0x5fd7c0]
push 0x80
lea edx, [ebp - 0x19c]
push edx
push 0x120
push eax
call ebx
mov ecx, dword [esi + 0x2cf4]
mov eax, dword [ecx + 4]
lea edx, [ebp - 0x19c]
push edx
push eax
lea ecx, [esi + 0x40]
call fcn.004d1eb0
mov ecx, dword [0x5fd7c0]
push 0x80
lea eax, [ebp - 0x19c]
push eax
push 0x125
push ecx
call ebx
mov edx, dword [esi + 0x2cf8]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004d1eb0
mov eax, dword [0x5fd7c0]
push 0x80
lea edx, [ebp - 0x19c]
push edx
push 0x8011
push eax
call ebx
mov ecx, dword [esi + 0x2cec]
mov eax, dword [ecx + 4]
lea edx, [ebp - 0x19c]
push edx
push eax
lea ecx, [esi + 0x40]
call fcn.004d1eb0
mov ecx, dword [0x5fd7c0]
push 0x80
lea eax, [ebp - 0x19c]
push eax
push 0x8012
push ecx
call ebx
mov edx, dword [esi + 0x2cfc]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.004d1eb0
mov eax, dword [0x5fd7c0]
push 0x80
lea edx, [ebp - 0x19c]
push edx
push 0x8013
push eax
call ebx
mov ecx, dword [esi + 0x2d00]
mov eax, dword [ecx + 4]
lea edx, [ebp - 0x19c]
push edx
push eax
lea ecx, [esi + 0x40]
call fcn.004d1eb0
push 0x80
lea eax, [ebp - 0x19c]
push eax
mov dword [esi + 0x1a0], 1
mov ecx, dword [0x5fd7c0]
push 0x92
push ecx
call ebx
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x2c]
push edx
call fcn.00412e80
mov byte [ebp - 4], 0x10
cmp dword [eax + 0x14], 8
jb 0x4c9118
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040bfb0
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x18], 8
jb 0x4c9137
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00553d26
add esp, 4
xor ecx, ecx
push 3
mov word [ebp - 0x2c], cx
push 0x59cdf4
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
call fcn.00406040
lea eax, [ebp - 0x19c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c9163
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x19c]
push edx
lea ecx, [ebp - 0x10]
call fcn.00406040
mov eax, dword [ebp - 0x10]
cmp dword [eax - 4], 1
jle 0x4c919a
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.00403bd0
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
push eax
push ecx
mov edi, eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esi + 4]
mov eax, dword [0x5f71ac]
mov ecx, dword [esi + 8]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push edx
push eax
push ecx
call ebx
lea ecx, [esi + 0x124]
call fcn.004ba330
mov edx, dword [0x5fd7c0]
push 0x2040
push 0
push 0xff000000
push 1
push 0x10
push 0xe5
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
push 0
push 1
mov ecx, esi
mov dword [esi + 0x150], eax
call fcn.004bfc30
mov eax, dword [esi + 0x2cf0]
test eax, eax
je 0x4c920e
add eax, 4
mov dword [ebp - 0x70], eax
jmp 0x4c9215
mov dword [ebp - 0x70], 0
mov eax, dword [esi + 0x2cd8]
xor edi, edi
cmp eax, edi
je 0x4c9229
add eax, 4
mov dword [ebp - 0x6c], eax
jmp 0x4c922c
mov dword [ebp - 0x6c], edi
mov eax, dword [esi + 0x2d00]
cmp eax, edi
je 0x4c923e
add eax, 4
mov dword [ebp - 0x68], eax
jmp 0x4c9241
mov dword [ebp - 0x68], edi
mov eax, dword [esi + 0x2ce4]
cmp eax, edi
je 0x4c9253
add eax, 4
mov dword [ebp - 0x64], eax
jmp 0x4c9256
mov dword [ebp - 0x64], edi
mov eax, dword [esi + 0x2d04]
cmp eax, edi
je 0x4c9268
add eax, 4
mov dword [ebp - 0x60], eax
jmp 0x4c926b
mov dword [ebp - 0x60], edi
mov eax, dword [esi + 0x2cec]
cmp eax, edi
je 0x4c927d
add eax, 4
mov dword [ebp - 0x5c], eax
jmp 0x4c9280
mov dword [ebp - 0x5c], edi
mov eax, dword [esi + 0x2cfc]
cmp eax, edi
je 0x4c9292
add eax, 4
mov dword [ebp - 0x58], eax
jmp 0x4c9295
mov dword [ebp - 0x58], edi
mov eax, dword [esi + 0x2ce8]
cmp eax, edi
je 0x4c92a7
add eax, 4
mov dword [ebp - 0x54], eax
jmp 0x4c92aa
mov dword [ebp - 0x54], edi
mov eax, dword [esi + 0x2ce0]
cmp eax, edi
je 0x4c92bc
add eax, 4
mov dword [ebp - 0x50], eax
jmp 0x4c92bf
mov dword [ebp - 0x50], edi
mov eax, dword [esi + 0x2cf4]
cmp eax, edi
je 0x4c92d1
add eax, 4
mov dword [ebp - 0x4c], eax
jmp 0x4c92d4
mov dword [ebp - 0x4c], edi
mov eax, dword [esi + 0x2cf8]
cmp eax, edi
je 0x4c92e6
add eax, 4
mov dword [ebp - 0x48], eax
jmp 0x4c92e9
mov dword [ebp - 0x48], edi
push 0x11
mov dword [ebp - 0x44], edi
call dword [sym.imp.GDI32.dll_GetStockObject]
lea ecx, [ebp - 0x1f8]
push ecx
push 0x5c
push eax
mov dword [esi + 0x2d68], eax
call dword [sym.imp.GDI32.dll_GetObjectW]
push str.Calibri
lea edx, [ebp - 0x1dc]
push 0x20
push edx
call fcn.00554e48
sub dword [ebp - 0x1f8], 2
add esp, 0xc
lea eax, [ebp - 0x1f8]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [esi + 0x2d68], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp + 0xc], edi
cmp eax, edi
je 0x4c93de
mov edi, eax
lea ebx, [ebx]
mov eax, dword [esi + 0x2d68]
mov ecx, dword [edi]
push 1
push eax
push 0x30
push ecx
call ebx
mov edx, dword [edi]
push 0x18433
push 0
push 0x1036
push edx
call ebx
mov eax, dword [edi]
push 0
push 0
push 0x104e
push eax
call ebx
push 0x12c
push 0
push 0x418
push eax
mov dword [ebp + 0x14], eax
call ebx
mov ecx, dword [ebp + 0x14]
mov edx, dword [edi]
push 0
push ecx
push 0x104a
push edx
call ebx
mov eax, dword [edi]
push 0
push 0
push 0x101f
push eax
call ebx
lea ecx, [ebp - 0x3c]
push ecx
push 0
push 0x120c
push eax
mov dword [ebp - 0x3c], 0x80
mov dword [ebp - 0x1c], 0
call ebx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + eax*4 - 0x6c]
inc eax
mov dword [ebp + 0xc], eax
test edi, edi
jne 0x4c9350
mov edx, dword [esi + 4]
push 0
push 0xe803
push 0x111
push edx
mov byte [esi + 0x198], 0
call ebx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c941a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c9440
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10