Function at 0x401c60
Capabilities:
Get disk information
Get file attributes
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push 0x1d
push 0x10050511
call fcn.00403aa8
pop ecx
mov dword [ebp - 4], eax
pop ecx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
cmp word [ebp + 0xc], 0x8000
je 0x401c90
movsx eax, word [ebp + 0xc]
mov dword [ebp - 0x20], eax
cmp word [ebp + 0xe], 0x8000
je 0x401c9f
movsx eax, word [ebp + 0xe]
mov dword [ebp - 0x1c], eax
and byte [0x4062cc], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov ebx, 0x4062cc
cmp esi, 0x4000
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], edi
mov dword [0x40674c], edi
mov dword [0x406748], ebx
jae 0x401ce6
xor dword [ebp - 4], esi
test byte [ebp - 3], 8
je 0x401cde
lea eax, [ebp - 0x14]
mov dword [0x40682c], eax
lea esi, [ebp - 0x14]
jmp 0x401edb
mov al, byte [esi]
test al, al
je 0x401edb
cmp al, 0x2f
jne 0x401e50
mov eax, esi
and byte [eax], 0
dec eax
cmp byte [eax], 0x20
je 0x401cfa
and dword [ebp - 8], 0
mov dword [ebp + 0xc], eax
inc esi
mov al, byte [esi]
cmp al, 0x30
jb 0x401d41
cmp al, 0x39
ja 0x401d41
lea edx, [esi - 1]
xor ecx, ecx
mov dword [ebp + 0xc], edx
and eax, 0xf
lea ecx, [ecx + ecx*4]
inc esi
lea ecx, [eax + ecx*2]
mov al, byte [esi]
cmp al, 0x30
jb 0x401d31
cmp al, 0x39
jbe 0x401d1d
cmp byte [edx], 0x2d
jne 0x401d38
neg ecx
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x20], ecx
jmp 0x401d0b
mov al, byte [esi]
cmp al, 0x2e
je 0x401e35
cmp al, 0x2c
jne 0x401d58
mov dword [ebp - 8], 1
jmp 0x401d0a
cmp al, 0x27
jne 0x401d69
or byte [ebp - 4], 0x80
mov dword [ebp - 8], 1
jmp 0x401d0a
mov cx, word [esi]
cmp cx, 0x282d
jne 0x401d95
inc esi
inc esi
mov dword [ebp - 0xc], esi
mov al, byte [esi]
test al, al
je 0x401e4a
cmp al, 0x29
je 0x401d8d
and al, 0xdf
mov byte [esi], al
inc esi
jmp 0x401d78
and byte [esi], 0
jmp 0x401d0a
mov eax, ecx
and eax, 0xdfdf
cmp ax, 0x480d
jne 0x401da8
or dword [ebp - 4], 2
jmp 0x401e1e
cmp ax, 0x530d
jne 0x401db4
or dword [ebp - 4], 4
jmp 0x401e1e
cmp ax, 0x450b
jne 0x401dc0
or dword [ebp - 4], 0x20
jmp 0x401e1e
cmp ax, 0x4e0d
jne 0x401dcc
or dword [ebp - 4], 0x40
jmp 0x401e1e
cmp ax, 0x4d0d
jne 0x401dd8
xor dword [ebp - 4], 0x10
jmp 0x401e1e
cmp ax, 0x520d
jne 0x401de4
or byte [ebp - 3], 1
jmp 0x401e1e
cmp ax, 0x590d
jne 0x401df0
or byte [ebp - 3], 2
jmp 0x401e1e
cmp ax, 0x4c0d
jne 0x401dfc
or byte [ebp - 3], 4
jmp 0x401e1e
cmp ax, 0x460b
jne 0x401e08
or byte [ebp - 3], 0x10
jmp 0x401e1e
cmp ax, 0x420b
jne 0x401e14
or byte [ebp - 3], 0x20
jmp 0x401e1e
cmp ax, 0x4656
jne 0x401e24
or dword [ebp - 4], 8
inc esi
jmp 0x401d0a
and cx, 0xf0ff
cmp cx, 0x302d
jne 0x401e62
jmp 0x401d0a
lea eax, [esi + 1]
mov dword [0x40682c], esi
cmp byte [eax], 0x2a
jne 0x401e61
and byte [esi], 0
mov esi, eax
jmp 0x401e61
and dword [ebp - 0xc], 0
jmp 0x401e61
cmp word [esi], 0x5c5c
je 0x401e5f
cmp word [esi + 1], 0x5c3a
jne 0x401e61
mov edi, esi
inc esi
mov al, byte [esi]
test al, al
jne 0x401cf0
test edi, edi
je 0x401edb
cmp byte [edi], al
mov ecx, edi
mov dword [ebp + 0xc], ecx
je 0x401e82
inc ecx
cmp byte [ecx], 0
jne 0x401e79
mov dword [ebp + 0xc], ecx
cmp byte [ecx - 1], 0x22
lea eax, [ecx - 1]
jne 0x401e93
mov ecx, eax
mov dword [ebp + 0xc], ecx
and byte [ecx], 0
mov eax, dword [ecx - 4]
push edi
and eax, 0xdfdfdfff
cmp eax, 0x5458542e
jne 0x401eb9
push 0xffffffffffffffff
call fcn.00403063
pop ecx
test eax, eax
pop ecx
je 0x401edb
or dword [ebp - 4], 8
mov dword [ebp - 0x14], edi
jmp 0x401edb
push ebx
call fcn.00403b64
mov edi, eax
pop ecx
dec edi
pop ecx
mov dword [ebp + 8], edi
cmp byte [edi], 0x5c
jne 0x401edb
push 0x3e
call fcn.004035f0
cmp edi, eax
pop ecx
jne 0x401edb
and byte [edi], 0
push 0x37
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
lea eax, [ebp - 0x48]
push eax
push 2
push dword [ebp - 0x1c]
inc edi
inc edi
mov dword [ebp - 0x48], 0x28
push dword [ebp - 0x20]
mov dword [0x406840], edi
call dword [sym.imp.USER32.dll_MonitorFromPoint]
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoA]
test eax, eax
je 0x402869
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x20], eax
jge 0x401f20
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x2c]
lea eax, [edi + edi*4]
sub ecx, eax
cmp dword [ebp - 0x20], ecx
jle 0x401f30
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x30]
cmp dword [ebp - 0x1c], edx
jge 0x401f3b
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x28]
sub ecx, eax
cmp dword [ebp - 0x1c], ecx
jle 0x401f48
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x28]
sub eax, edx
sub eax, 8
cdq
idiv edi
add edi, 0xfffffffc
imul edi, edi, 0xd
mov ecx, eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
mov dword [0x406848], ecx
cdq
idiv edi
imul eax, ecx
cmp eax, 0x400
jle 0x401f79
mov eax, 0x400
mov dword [0x406844], eax
mov eax, dword [ebp - 4]
mov dword [0x406800], eax
and eax, 0x18
cmp al, 0x10
jne 0x401f9f
push 0x40
call fcn.004035f0
test eax, eax
pop ecx
jne 0x401f9f
and dword [0x4062cc], eax
test byte [ebp - 4], 1
je 0x401fb7
mov eax, dword [0x40682c]
neg eax
sbb eax, eax
not eax
and eax, esi
mov dword [0x40682c], eax
mov eax, dword [ebp - 4]
and eax, 6
mov dword [0x406828], eax
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.USER32.dll_AppendMenuA]
or dword [0x4062b4], 0xffffffff
and dword [0x406818], 0
add eax, 7
push eax
push str.At_Work
call fcn.00403e34
add esp, 0xc
test byte [ebp - 4], 8
jne 0x402027
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test eax, eax
jge 0x40200b
cmp byte [0x4062cc], 0x5c
jne 0x402107
sar eax, 4
push 0x40
and eax, 1
pop ecx
sub ecx, eax
push ecx
call fcn.004035f0
mov dword [ebp + 0xc], eax
mov eax, dword [0x406858]
pop ecx
jmp 0x402034
push 1
pop eax
mov dword [0x4062b8], eax
mov dword [0x406858], eax
cmp eax, 0x1f
jae 0x402062
cmp dword [eax*4 + 0x40677c], 0
lea esi, [eax*4 + 0x40677c]
jne 0x40205e
lea esi, [eax*4 + 0x40677c]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [esi], eax
mov eax, dword [0x406858]
mov esi, dword [esi]
jmp 0x40206b
jne 0x4023c9
push 2
pop esi
mov ebx, dword [eax*4 + 0x406778]
test ebx, ebx
je 0x4020be
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
test eax, eax
mov dword [ebp - 8], eax
jle 0x4020dd
dec dword [ebp - 8]
js 0x40209a
push 0x400
push dword [ebp - 8]
push ebx
call dword [sym.imp.USER32.dll_RemoveMenu]
jmp 0x402084
mov ecx, dword [0x406858]
cmp ecx, 1
jne 0x4020e3
mov al, byte [0x4062cc]
cmp byte [0x406740], al
je 0x4020e3
push ebx
mov byte [0x406740], al
call dword [sym.imp.USER32.dll_DestroyMenu]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ecx, dword [0x406858]
test eax, eax
mov dword [ecx*4 + 0x406778], eax
je 0x4023c9
mov ebx, eax
jmp 0x4020e3
mov ecx, dword [0x406858]
test ecx, ecx
mov dword [0x40683c], ecx
je 0x40213e
cmp dword [0x4062b8], 0
jg 0x40210e
push dword [ebp + 0xc]
push esi
push ebx
call fcn.00402a58
add esp, 0xc
test eax, eax
je 0x402129
xor eax, eax
jmp 0x40202f
xor esi, esi
push esi
push ebx
call fcn.00403063
pop ecx
pop ecx
push esi
push 0x8301
push 0x800
push ebx
call edi
jmp 0x40212b
xor esi, esi
push 0x406089
push 0x8302
push esi
push ebx
call edi
jmp 0x40229e
mov eax, dword [0x40677c]
push 1
pop esi
mov dword [ebp - 0x10], eax
mov dword [0x4063d4], 0x29412628
mov dword [ebp + 8], 0x4063d9
mov dword [ebp - 8], 0x5c3a41
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x18], eax
test dword [ebp - 0x18], esi
je 0x402237
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, eax
cmp esi, 2
jl 0x402245
jne 0x402193
cmp byte [ebp - 8], 0x43
jg 0x40219d
dec esi
jmp 0x4021bf
cmp esi, 5
je 0x40219d
cmp esi, 4
jne 0x4021a3
test byte [ebp - 4], 0x10
jne 0x4021bf
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push 0x7f
lea eax, [ebp - 8]
push 0x4063d9
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4021d2
and byte [0x4063d9], 0
cmp esi, 4
mov dword [ebp + 0xc], 0x11
jne 0x4021e2
cmp byte [0x4063d9], 0
mov dword [ebp + 0xc], 0x10
jne 0x4021f9
lea eax, [esi + esi*4]
lea eax, [eax*2 + str.EXPLORER]
push eax
push 0x4063d9
call fcn.00403b64
pop ecx
pop ecx
cmp esi, 4
mov dl, byte [ebp - 8]
sete al
dec eax
mov byte [0x4063d6], dl
and al, 0xf3
add eax, 0x2d
cmp dword [ebp - 0xc], 0
mov byte [0x4063d8], al
je 0x402229
mov ecx, dword [ebp - 0xc]
mov al, byte [ecx]
test al, al
je 0x402229
cmp al, dl
je 0x402237
inc ecx
jmp 0x40221c
push 0x4063d4
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push ebx
call edi
mov ecx, dword [ebp - 8]
push 1
and ecx, 0x1f
pop esi
shl esi, cl
inc dword [ebp - 8]
cmp esi, dword [ebp - 0x18]
jbe 0x40216a
test byte [ebp - 4], 0x40
jne 0x40226d
push 0x3f
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test al, 1
je 0x40226d
push str.Net_Work
push dword [ebp - 0x10]
push 0x10
push ebx
call edi
test byte [ebp - 3], 1
jne 0x402280
push str._Recent_Items
push dword [ebp - 0x10]
push 0x10
push ebx
call edi
push 0
push 0x8301
push 0x800
push ebx
call edi
push str.Version_Info.
push dword [ebp - 0x10]
push 0x10
push ebx
call edi
xor esi, esi
or dword [0x40685c], 0xffffffff
push esi
push esi
push esi
push esi
push esi
mov dword [0x406850], 0x1f
call dword [sym.imp.USER32.dll_mouse_event]
push esi
push 2
push esi
push esi
call dword [sym.imp.USER32.dll_keybd_event]
push dword [0x406868]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 4]
and eax, 0x100
test byte [ebp - 4], 0x80
mov dword [0x406804], eax
jne 0x4022f0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_SetCursorPos]
xor edi, edi
push edi
push dword [0x406868]
push edi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0x110
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
cmp dword [0x4062b4], edi
mov esi, eax
jl 0x4023c9
push 0x1b0201
push 0x12200d10
call fcn.00403aa8
mov ebx, eax
pop ecx
cmp ebx, 0x10
pop ecx
jge 0x4023ba
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x406868]
jne 0x4023ba
cmp esi, 0x8301
mov dword [ebp - 8], 5
ja 0x402358
test bl, 0xe
je 0x40236f
and ebx, 0xc
xor edi, edi
or ebx, 2
push edi
push ebx
push 0x121
push edi
call fcn.004012df
jmp 0x402371
xor edi, edi
test byte [0x406824], 1
jne 0x4023c1
cmp dword [0x406854], 0x8302
jne 0x4023df
test byte [0x4062b4], 1
jne 0x402395
dec dword [0x40683c]
mov eax, dword [0x40683c]
cmp eax, edi
jle 0x4023a7
push eax
call fcn.004035f0
pop ecx
jmp 0x4023ae
and byte [0x4062cc], 0
mov dword [0x40674c], 0x80
jmp 0x4023df
test bl, 1
je 0x4023c9
xor edi, edi
mov dword [0x406748], edi
jmp 0x4023df
xor edi, edi
push edi
push 0xffffffffffffffff
push str._Cancel
call fcn.00403e34
add esp, 0xc
or dword [ebp - 8], 0xffffffff
test byte [ebp - 3], 1
mov dword [0x406858], edi
jne 0x402403
cmp dword [ebp - 8], edi
jl 0x4023f7
push edi
call fcn.0040337d
pop ecx
push dword [0x406804]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0xff120201
push 0x2e737271
call fcn.00403aa8
push 0xffffffffffffffff
push 0x970200d
call fcn.00403aa8
push edi
push edi
push edi
call fcn.00403f1f
add esp, 0x1c
cmp dword [ebp - 8], edi
jl 0x40261d
push 0xffffffffffffffff
push 0x1d1b1011
call fcn.00403aa8
mov eax, dword [ebp - 8]
pop ecx
pop ecx
mov esi, dword [eax*8 + 0x406748]
cmp esi, edi
je 0x402614
mov ecx, dword [0x406818]
push edi
sub ecx, eax
mov ebx, esi
inc ecx
push 0xffffffffffffffff
push ecx
mov dword [ebp - 0x18], ebx
call fcn.00403e34
push edi
push edi
call fcn.00403aa8
mov eax, dword [ebp - 8]
add esp, 0x14
mov ecx, dword [eax*8 + 0x40674c]
cmp ecx, 0x40
mov dword [0x406824], ecx
jl 0x4024ce
mov eax, ecx
and eax, 0x38f
cmp eax, 1
jne 0x4024b8
test cl, 0x10
je 0x4024ae
push edi
call fcn.00403b8b
test eax, eax
pop ecx
jne 0x402614
mov ecx, dword [0x406824]
mov esi, 0x40616a
jmp 0x402548
cmp ecx, 0x45
je 0x4024c6
cmp ecx, 0x61
jne 0x402614
and byte [esi], 0
jmp 0x402561
cmp byte [esi], 0
je 0x402614
test cl, 1
jne 0x4025e8
cmp eax, edi
jne 0x4024fa
cmp dword [ebp + 8], edi
jne 0x4024fa
push edi
push 2
push edi
push edi
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [0x406824]
mov eax, dword [ebp - 4]
push esi
and eax, 0x20
xor ecx, eax
mov dword [0x406824], ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, edi
jge 0x40251c
cmp byte [esi], 0x5c
jne 0x402614
mov ecx, dword [0x406824]
test cl, 2
jne 0x4025b2
test cl, 1
jne 0x402614
test al, 0x10
je 0x40255c
test cl, 0x1c
jne 0x40255c
cmp word [esi], 0x5c
jne 0x402548
mov esi, 0x40613c
test cl, 0x20
je 0x4025d2
sub esi, 4
mov dword [esi], 0x202c452f
jmp 0x4025d2
test cl, 0x14
je 0x402577
cmp byte [esi], 0
je 0x402614
push esi
call fcn.00403b8b
test eax, eax
pop ecx
jne 0x4025de
jmp 0x40257c
test cl, 8
je 0x40259e
mov ebx, 0x406504
push esi
push str.shell32_OpenAs_RunDLL
push ebx
call fcn.00403b64
pop ecx
pop ecx
push eax
call fcn.00403b64
pop ecx
mov esi, str.rundll32
pop ecx
jmp 0x4025a0
xor ebx, ebx
push 0x1f
push ebx
push esi
call fcn.00403f1f
add esp, 0xc
test eax, eax
jl 0x4025b8
jmp 0x4025de
test al, 0x10
jne 0x4025e8
jmp 0x4025bb
mov ebx, dword [ebp - 0x18]
lea esi, [ebx - 0xc]
mov dword [esi], 0x202c4e2f
mov dword [esi + 4], 0x4c45532f
mov dword [esi + 8], 0x2c544345
push 0x1d
push esi
push edi
call fcn.00403f1f
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword [ebp + 8], edi
mov dword [eax], edi
jmp 0x402614
mov esi, dword [0x406858]
push ebx
push ebx
call fcn.004038eb
pop ecx
cmp eax, edi
pop ecx
jne 0x40260e
and byte [ebx], 0
push 0x20
mov dword [0x406858], esi
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x402614
jl 0x4026f1
dec dword [ebp - 8]
jns 0x402432
mov eax, dword [0x406858]
cmp eax, edi
je 0x402704
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
cmp esi, edi
je 0x4026fd
and byte [esi], 0
mov dword [0x40685c], esi
mov dword [ebp - 8], 5
mov eax, dword [ebp - 8]
shl eax, 3
mov ecx, dword [eax + 0x406748]
cmp ecx, edi
mov dword [ebp + 0xc], ecx
je 0x402699
cmp byte [ecx], 0
je 0x402699
mov eax, dword [eax + 0x40674c]
cmp eax, 0x40
mov dword [0x406824], eax
jge 0x402699
test al, 1
je 0x402699
or eax, 0x80000000
push ecx
push ecx
mov dword [0x406824], eax
call fcn.004038eb
pop ecx
test eax, eax
pop ecx
jle 0x40269e
dec dword [ebp - 8]
jns 0x402656
mov eax, dword [0x40685c]
push ebx
and byte [eax - 2], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp - 8], edi
jge 0x4026fd
cmp byte [esi], 0
je 0x4026fd
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4026fd
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x4026d5
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x4026e9
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x402704
mov dword [0x40674c], 0x70
jmp 0x402704
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, 0x406770
mov eax, dword [esi]
cmp eax, edi
je 0x40271b
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi], edi
sub esi, 8
cmp esi, 0x406748
jg 0x402709
cmp dword [ebp + 8], 0xffffffff
je 0x402730
and dword [ebp - 4], 0xfffffff7
mov eax, dword [0x40674c]
test al, 0x40
je 0x40275c
cmp dword [ebp + 8], edi
jne 0x402749
push 0x180
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x40674c]
test al, 0x80
je 0x402780
test al, 1
jne 0x402784
or dword [ebp - 4], 8
jmp 0x402764
test al, 0x80
je 0x4027f5
mov dword [0x4062b8], edi
mov dword [0x40674c], edi
mov dword [0x4062a4], edi
mov ebx, 0x4062cc
jmp 0x401fc2
test al, 2
je 0x40279d
mov esi, dword [ebp - 0x14]
cmp esi, edi
jne 0x40281b
push edi
push 1
call fcn.00403063
pop ecx
mov esi, eax
pop ecx
jmp 0x40281b
test al, 1
jne 0x402827
push dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0x70
push dword [ebp - 0x20]
setl cl
push 0x8003
add ecx, 0x5203
push dword [0x406868]
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp - 8]
mov ecx, eax
and eax, 1
imul eax, eax, 0x58
shl ecx, 4
push ecx
add eax, str.Show_Menu_Below_Assigned_Folder__Open._r_n10_05_2023_K.Hirayama_r_nhrymktr_mineo.jp
push str._SubFolder_2.460
push eax
push dword [0x406868]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x402827
test ah, 1
je 0x402827
mov esi, 0x406400
push 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add eax, esi
mov word [eax - 6], 0x7265
mov dword [eax - 3], 0x6d6863
push 0x1f
push edi
push esi
call fcn.00403f1f
add esp, 0xc
push 0x97
push edi
push edi
push edi
push edi
push edi
push dword [0x406868]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [0x40680c]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
push dword [0x406810]
call esi
mov dword [0x40680c], edi
mov dword [0x406810], edi
mov dword [0x4062b4], 0xfffffffd
pop edi
pop esi
pop ebx
leave
ret