Function at 0x40c950
Capabilities:
Create thread
Delete file
Hide graphical window
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x918
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0xb8], 0
call sym._dll_hijacking_protection
mov eax, dword [ebp + 8]
mov dword [0x47d0a8], eax
call sym._should_have_security
test al, al
je 0x40c9df
call sym._got_advapi
xor eax, 1
test al, al
je 0x40c9df
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x4602a0
mov dword [esp + 4], 0x460bb8
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov eax, 1
jmp 0x40da5a
call sym._init_help
mov dword [esp + 8], 0x7f0
lea eax, [ebp - 0x8e0]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x8e0]
mov dword [ebp - 0x24], eax
mov dword [esp + 4], 0x5c
lea eax, [ebp - 0x8e0]
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x40ca40
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x24]
jb 0x40ca40
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x24], eax
mov dword [esp + 4], 0x3a
lea eax, [ebp - 0x8e0]
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x40ca70
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x24]
jb 0x40ca70
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [eax], 0x74747570
mov dword [eax + 4], 0x78652e79
mov word [eax + 8], 0x65
mov dword [esp + 4], 0x460bf0
lea eax, [ebp - 0x8e0]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x40cac5
lea eax, [ebp - 0x8e0]
mov dword [esp], eax
call sym._dupstr
mov dword [0x47d0c4], eax
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._fclose
jmp 0x40cb25
mov eax, dword [ebp - 0x24]
mov dword [eax], 0x75706e63
mov dword [eax + 4], 0x2e797474
mov dword [eax + 8], 0x657865
mov dword [esp + 4], 0x460bf0
lea eax, [ebp - 0x8e0]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x40cb1b
lea eax, [ebp - 0x8e0]
mov dword [esp], eax
call sym._dupstr
mov dword [0x47d0c4], eax
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._fclose
jmp 0x40cb25
mov dword [0x47d0c4], 0
lea eax, [ebp - 0xb4]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xb0]
mov dword [esp + 8], eax
lea eax, [ebp - 0xac]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._split_into_argv
mov byte [ebp - 0x25], 0
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 0xcc]
mov dword [esp + 0x10], sym._opt_error
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._aux_match_opt_init
jmp 0x40ce4d
lea eax, [ebp - 0xd0]
mov dword [esp + 4], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call sym._aux_match_arg
test al, al
je 0x40cc16
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 8
lea eax, [ebp - 0xb8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._safegrowarray
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
lea edx, [eax + 1]
mov dword [ebp - 0x20], edx
lea edx, [eax*8]
mov eax, dword [ebp - 0x1c]
add eax, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call sym._filename_from_str
mov edx, dword [ebp - 0x48]
mov dword [edx], eax
mov eax, dword [ebp - 0x48]
movzx edx, byte [ebp - 0x25]
mov byte [eax + 4], dl
jmp 0x40ce4d
mov dword [esp + 0xc], 0
mov dword [esp + 8], str._pgpfp
mov dword [esp + 4], 0
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call sym._aux_match_opt
test al, al
je 0x40cc56
mov dword [esp], 0
call sym._pgp_fingerprints_msgbox
mov eax, 1
jmp 0x40da5a
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], str._restrictacl
mov dword [esp + 0xc], 0x460c06
mov dword [esp + 8], str._restrict_acl
mov dword [esp + 4], 0
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call sym._aux_match_opt
test al, al
je 0x40cc9a
call sym._restrict_process_acl
jmp 0x40ce4d
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x460c22
mov dword [esp + 8], str._restrict_putty_acl
mov dword [esp + 4], 0
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call sym._aux_match_opt
test al, al
je 0x40ccd8
mov byte [0x47d0c8], 1
jmp 0x40ce4d
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], str._encrypted
mov dword [esp + 0x10], str._nodecrypt
mov dword [esp + 0xc], 0x460c60
mov dword [esp + 8], str._no_decrypt
mov dword [esp + 4], 0
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call sym._aux_match_opt
test al, al
je 0x40cd23
mov byte [ebp - 0x25], 1
jmp 0x40ce4d
mov dword [esp + 0xc], 0
mov dword [esp + 8], str._keylist
mov dword [esp + 4], 0
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call sym._aux_match_opt
test al, al
je 0x40cd56
mov byte [ebp - 0x11], 1
jmp 0x40ce4d
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x460c81
mov dword [esp + 8], str._openssh_config
lea eax, [ebp - 0xd0]
mov dword [esp + 4], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call sym._aux_match_opt
test al, al
je 0x40cd98
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x18], eax
jmp 0x40ce4d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x460ca1
lea eax, [ebp - 0xd0]
mov dword [esp + 4], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call sym._aux_match_opt
test al, al
je 0x40cdcf
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x10], eax
jmp 0x40ce4d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x460ca7
mov dword [esp + 4], 0
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call sym._aux_match_opt
test al, al
je 0x40ce2a
mov edx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xc8]
cmp edx, eax
jge 0x40ce21
mov eax, dword [ebp - 0xb4]
mov edx, dword [ebp - 0xcc]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
jmp 0x40ce66
mov dword [ebp - 0xc], 0x460849
jmp 0x40ce66
mov eax, dword [ebp - 0xc4]
mov edx, dword [ebp - 0xcc]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov dword [esp], 0x460caa
call sym._opt_error
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call sym._aux_match_done
xor eax, 1
test al, al
jne 0x40cb89
call sym._agent_mutex_name
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0xd4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sym._lock_interprocess_mutex
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sym._safefree
cmp dword [ebp - 0x50], 0
jne 0x40cecc
mov eax, dword [ebp - 0xd4]
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x460cc0
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov eax, 1
jmp 0x40da5a
call sym._agent_exists
mov byte [0x47d0c0], al
movzx eax, byte [0x47d0c0]
xor eax, 1
test al, al
je 0x40d3b8
cmp dword [ebp + 0xc], 0
jne 0x40cf5a
mov dword [esp + 8], 0x28
mov dword [esp + 4], 0
lea eax, [ebp - 0x8e0]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x8dc], sym._TrayWndProc_16
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0xc8
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_LoadIconA]
call eax
sub esp, 8
mov dword [ebp - 0x8cc], eax
mov dword [ebp - 0x8bc], str.PageantSysTray
lea eax, [ebp - 0x8e0]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_RegisterClassA]
call eax
sub esp, 4
mov dword [0x47d0b0], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x64
mov dword [esp + 0x18], 0x64
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0xef0000
mov dword [esp + 8], 0x4608ca
mov dword [esp + 4], str.PageantSysTray
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExA]
call eax
sub esp, 0x30
mov dword [0x47d0ac], eax
mov eax, dword [0x47d0ac]
mov dword [esp], eax
call sym._winselgui_set_hwnd
call sym._pageant_init
mov dword [0x47d0f4], 0x460b9c
mov byte [0x47d0f8], 1
call sym._should_have_security
test al, al
je 0x40d1b8
mov dword [esp + 4], 0x47d0f4
lea eax, [ebp - 0xdc]
mov dword [esp], eax
call sym._pageant_listener_new
mov dword [ebp - 0x54], eax
call sym._agent_named_pipe_name
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xdc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call sym._new_named_pipe_listener
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sym._sk_socket_error
test eax, eax
je 0x40d0a0
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sym._sk_socket_error
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x58]
mov dword [esp + 4], eax
mov dword [esp], 0x460ce0
call sym._dupprintf
mov dword [ebp - 0x68], eax
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x460cc0
mov eax, dword [ebp - 0x68]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov eax, 1
jmp 0x40da5a
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
call sym._pageant_listener_got_socket
cmp dword [ebp - 0x18], 0
je 0x40d1ad
mov dword [esp + 4], 0x460d07
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x40d120
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], 0x460d09
call sym._dupprintf
mov dword [ebp - 0x64], eax
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x460cc0
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov eax, 1
jmp 0x40da5a
mov eax, dword [ebp - 0x60]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xf
mov dword [esp + 4], 1
mov dword [esp], str.IdentityAgent__
call sym._fwrite
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x2c], eax
jmp 0x40d175
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0x5c
jne 0x40d15e
mov byte [ebp - 0x2d], 0x2f
movsx eax, byte [ebp - 0x2d]
mov edx, dword [ebp - 0x60]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fputc
add dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test al, al
jne 0x40d14b
mov eax, dword [ebp - 0x60]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x460d35
call sym._fwrite
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call sym._safefree
cmp dword [ebp - 0x10], 0
je 0x40d27b
call sym._sk_init
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._remove
mov dword [esp + 4], 0x47d0f4
lea eax, [ebp - 0xe0]
mov dword [esp], eax
call sym._pageant_listener_new
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xe0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._sk_newlistener_unix
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov dword [esp], eax
call sym._sk_socket_error
test eax, eax
je 0x40d269
mov eax, dword [ebp - 0x70]
mov dword [esp], eax
call sym._sk_socket_error
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x460d38
call sym._dupprintf
mov dword [ebp - 0x74], eax
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x460d6a
mov eax, dword [ebp - 0x74]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov eax, 1
jmp 0x40da5a
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sym._pageant_listener_got_socket
cmp dword [ebp + 0xc], 0
jne 0x40d2cf
mov dword [esp + 8], 0x28
mov dword [esp + 4], 0
lea eax, [ebp - 0x8e0]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x8dc], sym._wm_copydata_WndProc_16
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8d0], eax
mov dword [ebp - 0x8bc], 0x4608ca
lea eax, [ebp - 0x8e0]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_RegisterClassA]
call eax
sub esp, 4
mov dword [0x47d0e8], 0x460a6c
mov byte [0x47d0f0], 1
mov dword [esp], 0x47d0e8
call sym._pageant_register_client
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov dword [0x47d0a0], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov dword [0x47d0a4], eax
lea eax, [ebp - 0xd8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
lea eax, [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym._wm_copydata_threadfunc_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
je 0x40d39b
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [0x47d0a0]
mov dword [esp + 8], 0
mov dword [esp + 4], sym._wm_copydata_got_msg
mov dword [esp], eax
call sym._add_handle_wait
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call sym._unlock_interprocess_mutex
mov dword [ebp - 0x34], 0
jmp 0x40d416
mov eax, dword [ebp - 0x34]
lea edx, [eax*8]
mov eax, dword [ebp - 0x1c]
add eax, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
movzx eax, byte [eax + 4]
movzx edx, al
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._win_add_keyfile
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [esp], eax
call sym._filename_free
add dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x20]
jb 0x40d3cc
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._safefree
call sym._pageant_forget_passphrases
cmp dword [ebp - 0xc], 0
je 0x40d4c6
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x22
jne 0x40d45e
add dword [ebp - 0xc], 1
mov dword [esp + 4], 0x22
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x38], eax
jmp 0x40d474
mov dword [esp + 4], 0x20
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x40d4ad
mov eax, dword [ebp - 0x38]
lea edx, [eax + 1]
mov dword [ebp - 0x38], edx
mov byte [eax], 0
jmp 0x40d48c
add dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test al, al
je 0x40d4ad
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
movzx eax, al
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_isspace]
call eax
test eax, eax
jne 0x40d488
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._spawn_cmd
movzx eax, byte [0x47d0c0]
test al, al
je 0x40d510
cmp dword [ebp - 0xc], 0
jne 0x40d506
cmp dword [ebp - 0x20], 0
jne 0x40d506
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x460cc0
mov dword [esp + 4], 0x460d7e
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov eax, 0
jmp 0x40da5a
mov eax, dword [0x47d0ac]
mov dword [esp], eax
call sym._AddTrayIcon
mov eax, dword [sym.imp.USER32.dll_CreatePopupMenu]
call eax
mov dword [0x47d0b8], eax
mov eax, dword [0x47d0c4]
test eax, eax
je 0x40d5c3
mov eax, dword [sym.imp.USER32.dll_CreateMenu]
call eax
mov dword [0x47d0bc], eax
mov eax, dword [0x47d0b8]
mov dword [esp + 0xc], 0x460d92
mov dword [esp + 8], 0x90
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AppendMenuA]
call eax
sub esp, 0x10
mov eax, dword [0x47d0bc]
mov edx, eax
mov eax, dword [0x47d0b8]
mov dword [esp + 0xc], 0x460d9f
mov dword [esp + 8], edx
mov dword [esp + 4], 0x10
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AppendMenuA]
call eax
sub esp, 0x10
mov eax, dword [0x47d0b8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x800
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AppendMenuA]
call eax
sub esp, 0x10
mov eax, dword [0x47d0b8]
mov dword [esp + 0xc], 0x460dac
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AppendMenuA]
call eax
sub esp, 0x10
mov eax, dword [0x47d0b8]
mov dword [esp + 0xc], 0x460db9
mov dword [esp + 8], 0x30
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AppendMenuA]
call eax
sub esp, 0x10
mov eax, dword [0x47d0b8]
mov dword [esp + 0xc], 0x460dc6
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AppendMenuA]
call eax
sub esp, 0x10
mov eax, dword [0x47d0b8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x800
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AppendMenuA]
call eax
sub esp, 0x10
mov eax, dword [0x47d0b8]
mov dword [esp + 0xc], 0x460dd3
mov dword [esp + 8], 0x50
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AppendMenuA]
call eax
sub esp, 0x10
mov eax, dword [0x47d0b8]
mov dword [esp + 0xc], 0x460de0
mov dword [esp + 8], 0x60
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AppendMenuA]
call eax
sub esp, 0x10
mov eax, dword [0x47d0b8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x800
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AppendMenuA]
call eax
sub esp, 0x10
call sym._has_help
test al, al
je 0x40d71c
mov eax, dword [0x47d0b8]
mov dword [esp + 0xc], 0x460df1
mov dword [esp + 8], 0x70
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AppendMenuA]
call eax
sub esp, 0x10
mov eax, dword [0x47d0b8]
mov dword [esp + 0xc], 0x460dfa
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AppendMenuA]
call eax
sub esp, 0x10
mov eax, dword [0x47d0b8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x800
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AppendMenuA]
call eax
sub esp, 0x10
mov eax, dword [0x47d0b8]
mov dword [esp + 0xc], 0x460e03
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AppendMenuA]
call eax
sub esp, 0x10
mov eax, dword [0x47d0bc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetMenuItemCount]
call eax
sub esp, 4
mov dword [0x47d0d0], eax
mov eax, dword [0x47d0b8]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x20
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetMenuDefaultItem]
call eax
sub esp, 0xc
mov eax, dword [0x47d0ac]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
cmp byte [ebp - 0x11], 0
je 0x40d7f8
call sym._create_keylist_window
call sym._get_handle_wait_list
mov dword [ebp - 0x7c], eax
call sym._toplevel_callback_pending
test al, al
je 0x40d810
mov eax, 0
jmp 0x40d815
mov eax, 0xffffffff
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x7c]
mov edx, dword [edx + 0x100]
mov ecx, edx
mov dword [esp + 0x10], 0x4ff
mov edx, dword [ebp - 0x80]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], ecx
mov eax, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
call eax
sub esp, 0x14
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 0x100]
mov edx, eax
mov eax, dword [ebp - 0x84]
cmp eax, edx
jae 0x40d87e
mov eax, dword [ebp - 0x84]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sym._handle_wait_activate
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sym._handle_wait_list_free
jmp 0x40d96e
mov eax, dword [ebp - 0xa4]
cmp eax, 0x12
je 0x40d9b3
mov eax, dword [0x47d0b0]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_IsWindow]
call eax
sub esp, 4
test eax, eax
je 0x40d8d8
mov eax, dword [0x47d0b0]
lea edx, [ebp - 0xa8]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_IsDialogMessageA]
call eax
sub esp, 8
test eax, eax
je 0x40d8d8
jmp 0x40d96e
mov eax, dword [0x47d0b4]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_IsWindow]
call eax
sub esp, 4
test eax, eax
je 0x40d910
mov eax, dword [0x47d0b4]
lea edx, [ebp - 0xa8]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_IsDialogMessageA]
call eax
sub esp, 8
test eax, eax
je 0x40d910
jmp 0x40d96e
mov eax, dword [0x47d0d8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_IsWindow]
call eax
sub esp, 4
test eax, eax
je 0x40d948
mov eax, dword [0x47d0d8]
lea edx, [ebp - 0xa8]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_IsDialogMessageA]
call eax
sub esp, 8
test eax, eax
je 0x40d948
jmp 0x40d96e
lea eax, [ebp - 0xa8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_TranslateMessage]
call eax
sub esp, 4
lea eax, [ebp - 0xa8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DispatchMessageA]
call eax
sub esp, 4
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0xa8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_PeekMessageW]
call eax
sub esp, 0x14
test eax, eax
jne 0x40d88e
call sym._run_toplevel_callbacks
jmp 0x40d7f8
nop
mov dword [ebp - 0x8e0], 0x1f8
mov eax, dword [0x47d0ac]
mov dword [ebp - 0x8dc], eax
mov dword [ebp - 0x8d8], 1
lea eax, [ebp - 0x8e0]
mov dword [esp + 4], eax
mov dword [esp], 2
mov eax, dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
call eax
sub esp, 8
mov eax, dword [0x47d0b8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DestroyMenu]
call eax
sub esp, 4
mov eax, dword [0x47d0cc]
test eax, eax
je 0x40da16
mov eax, dword [0x47d0cc]
mov dword [esp], eax
call sym._filereq_free
cmp dword [ebp - 0x18], 0
je 0x40da4c
mov dword [esp + 4], 0x460d07
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x40da4c
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0xa0]
mov dword [esp], eax
call sym._cleanup_exit
leave
ret 0x10