Function at 0x405690
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e598
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x48200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0xc9], 0
jne 0x405c15
mov eax, dword [ebp + 8]
mov byte [esi + 0xc9], 1
test eax, eax
jne 0x4057a5
mov edi, dword [esi + 0x14]
mov eax, 0x55555556
mov ecx, dword [esi + 0xc]
neg edi
mov ebx, dword [sym.imp.USER32.dll_SetWindowPos]
sub ecx, edi
imul ecx
mov dword [ebp - 0x4c], 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [ebp - 0x50], ecx
push 0x40
push dword [esi + 0x18]
add edi, ecx
push dword [esi + 0x14]
push dword [esi + 0x10]
push edi
push 0
push dword [esi + 0x54]
call ebx
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x4c], 1
mov ecx, dword [ebp - 0x50]
jne 0x405704
mov dword [ebp - 0x4c], 2
push 0x40
push dword [esi + 0x18]
sub edi, 5
push dword [esi + 0x14]
push dword [esi + 0x10]
push edi
push 0
push dword [esi + 0x54]
call ebx
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x4c], 1
jne 0x405731
mov dword [ebp - 0x4c], 2
nop dword [eax]
push 0x40
push dword [esi + 0x18]
add edi, 5
push dword [esi + 0x14]
push dword [esi + 0x10]
push edi
push 0
push dword [esi + 0x54]
call ebx
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x4c], 1
jne 0x405760
push 0x40
push dword [esi + 0x18]
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0xc]
push 0
push dword [esi + 0x54]
call ebx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
jmp 0x405bfc
cmp eax, 1
jne 0x4057f0
mov eax, 0x66666667
mov dword [ebp - 0x4c], 5
imul dword [esi + 0x18]
sar edx, 1
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edi, ebx
push 0x40
push edi
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0xc]
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
add edi, ebx
sub dword [ebp - 0x4c], 1
jne 0x4057c4
jmp 0x405aad
cmp eax, 2
jne 0x405841
mov eax, 0x66666667
mov dword [ebp - 0x4c], 5
imul dword [esi + 0x18]
sar edx, 1
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edi, ebx
nop
mov eax, dword [esi + 0x18]
push 0x40
sub eax, edi
push eax
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0xc]
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
add edi, ebx
sub dword [ebp - 0x4c], 1
jne 0x405810
jmp 0x405bd8
cmp eax, 3
jne 0x405894
mov ecx, dword [esi + 0x14]
mov eax, 0x66666667
mov edi, dword [esi + 0xc]
mov ebx, 5
add ecx, edi
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x50], eax
push 0x40
push dword [esi + 0x18]
sub edi, eax
push dword [esi + 0x14]
push dword [esi + 0x10]
push edi
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x50]
sub ebx, 1
jne 0x405866
jmp 0x405bfc
cmp eax, 4
jne 0x4058a3
call fcn.004049c0
jmp 0x405bfc
cmp eax, 5
jne 0x405945
mov edi, dword [esi + 0x10]
mov eax, 0x66666667
imul dword [esi + 0x18]
mov byte [esi + 0xc8], 1
sar edx, 2
mov ecx, edx
mov dword [ebp - 0x4c], 9
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
mov dword [ebp - 0x50], ecx
cdq
mov ebx, ecx
sub eax, edx
sar eax, 1
mov dword [ebp - 0x54], eax
nop
add edi, eax
mov eax, dword [esi + 0x18]
push 0x40
sub eax, ebx
push eax
push dword [esi + 0x14]
push edi
push dword [esi + 0xc]
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0xf
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebx, dword [ebp - 0x50]
sub dword [ebp - 0x4c], 1
mov eax, dword [ebp - 0x54]
jne 0x4058e0
mov eax, dword [esi + 0x18]
push 0x40
cdq
push 1
push dword [esi + 0x14]
sub eax, edx
sar eax, 1
add eax, dword [esi + 0x10]
push eax
push dword [esi + 0xc]
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x405bd8
cmp eax, 6
jne 0x4059d4
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xffffffffffffffec
push dword [esi + 0x54]
call edi
or eax, 0x80000
push eax
push 0xffffffffffffffec
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 2
push 0
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 5
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, 1
nop dword [eax + eax]
push 0xffffffffffffffec
push dword [esi + 0x54]
call edi
or eax, 0x80000
push eax
push 0xffffffffffffffec
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SetWindowLongW]
movzx eax, bl
imul eax, eax, 0x13
push 2
add al, 0x3c
movzx eax, al
push eax
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jle 0x405990
jmp 0x405bfc
cmp eax, 7
jne 0x405a2a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [eax - 6]
push 0xffffffffffffffec
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov al, bl
add al, al
push 2
lea ecx, [eax + ebx]
shl cl, 2
not cl
movzx eax, cl
push eax
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0x1e
call edi
inc ebx
cmp ebx, 0x14
jle 0x4059e2
jmp 0x405bfc
cmp eax, 8
jne 0x405a39
call fcn.00404c10
jmp 0x405bfc
cmp eax, 9
jne 0x405a48
call fcn.00404e00
jmp 0x405bfc
cmp eax, 0xa
jne 0x405a57
call fcn.00405180
jmp 0x405bfc
cmp eax, 0xb
jne 0x405a66
call fcn.00405400
jmp 0x405bfc
cmp eax, 0xc
jne 0x405ad2
mov eax, 0x66666667
mov dword [ebp - 0x4c], 0xa
imul dword [esi + 0x14]
sar edx, 2
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edi, ebx
push 0x40
push dword [esi + 0x18]
push edi
push dword [esi + 0x10]
push dword [esi + 0xc]
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
add edi, ebx
sub dword [ebp - 0x4c], 1
jne 0x405a86
push 0x40
push dword [esi + 0x18]
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0xc]
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
jmp 0x405bfc
cmp eax, 0xd
jne 0x405bfc
mov eax, 0x66666667
mov edi, 0xa
imul dword [esi + 0x14]
mov dword [ebp - 0x4c], edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x54], eax
mov ebx, eax
nop word [eax + eax]
mov eax, dword [esi + 0x14]
push 0x40
push dword [esi + 0x18]
sub eax, ebx
push eax
push dword [esi + 0x10]
push dword [esi + 0xc]
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi]
mov eax, dword [eax + 0x20]
cmp eax, method.CMainDlg.virtual_32
jne 0x405bbd
cmp byte [esi + 0x5c], 0
je 0x405b46
push 0
push 0
push 0xf
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x405bc1
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [ebp - 0x48]
call sym.Uninstall_adv.exe_public:_void___thiscall_CNsDC::constructor_void_
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
cmp byte [esi + 0x5c], 0
lea ecx, [ebp - 0x48]
je 0x405b80
push dword [esi + 0x54]
push 1
jmp 0x405b84
push 0
push 0
push 0
push eax
push edi
call sym.Uninstall_adv.exe_public:_void___thiscall_CNsDC::CreateMemDC_struct_HDC_____struct_tagRECT___bool__bool__struct_HWND____
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0x48]
call dword [eax + 0xc]
lea ecx, [ebp - 0x48]
call sym.Uninstall_adv.exe_public:_void___thiscall_CNsDC::Draw_void_
push edi
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_ReleaseDC]
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0xffffffff
call sym.Uninstall_adv.exe_public:_void___thiscall_CNsDC::destructor_void_
mov edi, dword [ebp - 0x4c]
jmp 0x405bc1
mov ecx, esi
call eax
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebx, dword [ebp - 0x54]
sub edi, 1
mov dword [ebp - 0x4c], edi
jne 0x405b00
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x200
push dword [esi + 0x54]
mov byte [esi + 0xc7], 1
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1c39
push dword [esi + 0x54]
mov byte [esi + 0xc9], 0
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e140
mov esp, ebp
pop ebp
ret 4