Function at 0x460890
Capabilities:
Check if file exists
Create process on windows
Get graphical window text
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a91c5
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x4db064]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x280], edi
xor esi, esi
mov dword [ebp - 0x298], esi
mov dword [ebp - 4], esi
mov eax, dword [edi]
cmp dword [eax - 0xc], esi
jne 0x46096c
lea eax, [ebp - 0x288]
push eax
call fcn.00464170
mov byte [ebp - 4], 1
lea esi, [edi + 0xc]
push eax
mov ecx, esi
call fcn.00408560
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x288]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x460918
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x148
call fcn.00477719
add esp, 4
mov dword [ebp - 0x290], eax
mov byte [ebp - 4], 3
mov ecx, eax
push esi
call fcn.0043fc70
mov esi, eax
mov byte [ebp - 4], 0
mov ecx, esi
mov dword [ebp - 0x298], esi
call fcn.00440100
mov dword [ebp - 0x278], eax
test eax, eax
jne 0x4616eb
mov eax, dword [esi + 0x40]
lea ecx, [esi + 0x40]
cmp dword [eax - 0xc], 0
je 0x46096c
push ecx
mov ecx, edi
call fcn.00408560
push 0x18
push str.caphyon_advinst_updater:
lea ecx, [edi + 0x17c]
call fcn.00403320
push 5
push str._Link
lea ecx, [edi + 0x17c]
call fcn.004021c0
mov edi, dword [ebp - 0x280]
mov ecx, edi
call fcn.004647d0
mov dword [ebp - 0x278], eax
test eax, eax
jne 0x4616eb
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4609d9
cmp ecx, 1
je 0x4609d9
cmp ecx, 2
je 0x4609d9
cmp ecx, 3
je 0x4609d9
cmp ecx, 0xb
je 0x4609d9
cmp ecx, 4
je 0x4609d9
mov eax, dword [edi + 0xc]
cmp dword [eax - 0xc], 0
je 0x4609d9
cmp ecx, 0xa
jne 0x460a14
lea eax, [ebp - 0x288]
push eax
call fcn.00464170
mov byte [ebp - 4], 4
lea ecx, [edi + 0xc]
push eax
call fcn.00408560
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x288]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x460a14
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x460a82
push 0x148
call fcn.00477719
add esp, 4
mov dword [ebp - 0x290], eax
mov byte [ebp - 4], 6
lea ecx, [edi + 0xc]
push ecx
mov ecx, eax
call fcn.0043fc70
mov esi, eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x298], esi
lea ecx, [edi + 0x14]
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
je 0x460a6d
push ecx
lea ecx, [esi + 0x90]
call fcn.00408560
mov eax, dword [edi + 0x14]
cmp dword [eax - 0xc], 0
je 0x460a6d
mov byte [esi + 0xd8], 1
mov ecx, esi
call fcn.00440100
mov dword [ebp - 0x278], eax
test eax, eax
jg 0x4616eb
mov eax, dword [edi + 4]
test eax, eax
je 0x460aa6
cmp eax, 1
je 0x460aa6
cmp eax, 2
je 0x460aa6
cmp eax, 3
je 0x460aa6
cmp eax, 4
je 0x460aa6
cmp eax, 0xb
jne 0x460ba6
call fcn.00404130
mov ecx, eax
test ecx, ecx
je 0x461736
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x284], eax
mov byte [ebp - 4], 8
lea eax, [ebp - 0x284]
push dword [esi]
push str.SoftwareCaphyonAdvanced_Updater_s
push eax
call fcn.00407900
mov edi, dword [ebp - 0x284]
lea eax, [ebp - 0x28c]
add esp, 0xc
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x460b0d
jmp 0x460b84
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [0x4dc390]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x290]
push eax
push 0
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x460b78
push 4
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x27c], 0
push eax
push 4
push 0
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
or eax, 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x460ba0
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x280]
lea eax, [edi + 0x8c]
push eax
lea ecx, [esi + 0x5c]
call fcn.00408560
lea eax, [edi + 0x90]
push eax
lea ecx, [esi + 0x60]
call fcn.00408560
lea eax, [edi + 0x94]
push eax
lea ecx, [esi + 0x64]
call fcn.00408560
lea eax, [edi + 0x98]
push eax
lea ecx, [esi + 0x68]
call fcn.00408560
mov eax, dword [edi + 0xa0]
lea ecx, [edi + 0xa0]
cmp dword [eax - 0xc], 0
je 0x460c07
cmp dword [esi + 8], 0
jle 0x461740
push ecx
mov ecx, dword [esi + 4]
call fcn.00408560
push esi
mov ecx, edi
call fcn.004673b0
mov al, byte [edi + 0x11c]
lea ecx, [esi + 0x94]
mov byte [esi + 0x84], al
mov al, byte [edi + 0x11d]
mov byte [esi + 0x85], al
lea eax, [edi + 0x160]
push eax
call fcn.00408560
mov al, byte [edi + 0x168]
lea ecx, [esi + 0x98]
mov byte [esi + 0x9c], al
lea eax, [edi + 0x164]
push eax
call fcn.00408560
mov al, byte [edi + 0x16a]
lea ecx, [edi + 0x170]
mov byte [esi + 0x86], al
mov al, byte [edi + 0x16b]
mov byte [esi + 0x87], al
mov al, byte [edi + 0x16d]
mov byte [esi + 0x88], al
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
je 0x460c92
push ecx
lea ecx, [esi + 0x48]
call fcn.00408560
lea eax, [esi + 0x18]
push eax
lea ecx, [ebp - 0x29c]
mov dword [ebp - 0x288], eax
call fcn.004023e0
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x294]
call fcn.004023e0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x294]
call fcn.0040d280
push 0xb
push str.updater.log
lea ecx, [ebp - 0x294]
call fcn.004021c0
mov eax, dword [esi + 0xdc]
mov dword [ebp - 0x27c], eax
test eax, eax
je 0x460d4a
mov eax, dword [ebp - 0x29c]
mov edx, dword [eax - 0xc]
cmp edx, 2
jb 0x460d4a
test edx, edx
js 0x46174c
cmp word [eax], 0x5c
jne 0x460d1e
cmp edx, 1
jl 0x46174c
movzx ecx, word [eax + 2]
cmp ecx, 0x5c
jne 0x460d27
jmp 0x460d30
cmp edx, 1
jl 0x46174c
movzx ecx, word [eax + 2]
cmp ecx, 0x3a
jne 0x460d4a
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x460d4a
push ecx
lea ecx, [ebp - 0x294]
call fcn.0040dd10
add esp, 4
call fcn.00427020
lea ecx, [ebp - 0x294]
push ecx
mov ecx, eax
call fcn.00427190
call fcn.00427020
mov esi, eax
mov byte [ebp - 0x2a8], 0
mov dword [ebp - 0x2ac], esi
mov cl, byte [esi + 0x18]
test cl, cl
jne 0x460d86
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, 1
lea ecx, [esi + 0x18]
xchg byte [ecx], al
push dword [ebp - 0x2ac]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x27c], 0
setne al
mov byte [esi + 0x1c], al
mov byte [ebp - 4], 0xc
mov al, byte [ebp - 0x2a8]
test al, al
jne 0x460dc7
push dword [ebp - 0x2ac]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
lea ecx, [ebp - 0x2a8]
xchg byte [ecx], al
call fcn.00427020
mov esi, eax
mov byte [ebp - 0x2b0], 0
mov dword [ebp - 0x2b4], esi
mov cl, byte [esi + 0x18]
test cl, cl
jne 0x460df0
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, 1
lea ecx, [esi + 0x18]
xchg byte [ecx], al
push dword [ebp - 0x2b4]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x27c]
mov dword [esi + 0x20], eax
mov byte [ebp - 4], 0xc
mov al, byte [ebp - 0x2b0]
test al, al
jne 0x460e2d
push dword [ebp - 0x2b4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
lea ecx, [ebp - 0x2b0]
xchg byte [ecx], al
call fcn.00427020
cmp byte [eax + 0x1c], 0
je 0x460f2b
call fcn.00427020
test byte [eax + 0x20], 8
je 0x460f2b
call fcn.00427020
mov esi, eax
call fcn.00404130
test eax, eax
je 0x461736
mov edx, dword [eax]
mov ecx, eax
mov edx, dword [edx + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x284], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x284]
push 0x17
push str.Running_updater._Mode:
call fcn.004021c0
push dword [edi + 4]
lea ecx, [ebp - 0x284]
call fcn.00426bf0
mov dword [ebp - 0x27c], eax
call fcn.00404130
test eax, eax
je 0x461736
mov edx, dword [eax]
mov ecx, eax
mov edx, dword [edx + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x28c], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x28c]
push 0
push 0x4bc000
call fcn.004021c0
push ecx
push dword [ebp - 0x27c]
lea eax, [ebp - 0x28c]
push ecx
push eax
mov ecx, esi
call fcn.00427310
mov byte [ebp - 4], 0x11
or esi, 0xffffffff
mov edx, dword [ebp - 0x28c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x460f0a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
mov eax, esi
mov edx, dword [ebp - 0x284]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x460f2b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 4]
mov esi, dword [ebp - 0x298]
cmp eax, 0x15
ja case.0x460f44.5
movzx eax, byte [eax + 0x461798]
jmp dword [eax*4 + 0x461760]
cmp byte [edi + 0x168], 0
je 0x460f68
mov eax, dword [edi + 0x160]
cmp dword [eax - 0xc], 0
je 0x460f68
push esi
mov ecx, edi
call fcn.004617b0
push esi
mov ecx, edi
call fcn.00461930
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x461445
mov eax, dword [ebp - 0x288]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x4610c5
cmp dword [esi + 8], 0
je 0x4610c5
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x4610c5
mov eax, dword [esi + 0x14]
cmp dword [eax - 0xc], 0
je 0x4610c5
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0x2c0], 0
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x2bc], esi
mov byte [ebp - 0x2b8], 0
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x2c8]
push dword [edi + 4]
lea ecx, [ebp - 0x240]
push eax
push esi
lea eax, [edi + 0x18]
push eax
call fcn.0043c620
mov byte [ebp - 4], 0x1b
lea ecx, [edi + 0xa8]
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
je 0x46101d
push ecx
lea ecx, [ebp - 0x224]
call fcn.00408560
mov cl, byte [edi + 0x169]
movzx edx, byte [ebp - 0x228]
test cl, cl
movzx eax, cl
lea ecx, [ebp - 0x240]
push 0
cmovne edx, eax
push 0
mov byte [ebp - 0x228], dl
call fcn.0043c6d0
mov dword [ebp - 0x278], eax
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x224]
mov dword [ebp - 0x27c], eax
mov byte [ebp - 4], 0x1c
or eax, 0xffffffff
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46107f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x234]
mov dword [ebp - 0x27c], eax
mov byte [ebp - 4], 0x1a
or eax, 0xffffffff
mov edx, dword [ebp - 0x234]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4610b1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2c8]
call fcn.00432aa0
jmp case.0x460f44.5
mov ecx, 0xe0000007
mov dword [ebp - 0x278], ecx
jmp 0x461445
cmp byte [edi + 0x168], 0
je 0x4610f2
mov eax, dword [edi + 0x160]
cmp dword [eax - 0xc], 0
je 0x4610f2
push esi
mov ecx, edi
call fcn.004617b0
push esi
mov ecx, edi
call fcn.00461c50
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x461445
sub esp, 8
lea ecx, [ebp - 0x274]
push esi
call fcn.00472190
mov byte [ebp - 4], 0x21
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x27c], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [edi + 0x84]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x46114e
mov eax, dword [edi + 0x84]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x260]
test eax, eax
jne 0x461171
call fcn.0047605e
mov dword [ebp - 0x260], eax
test eax, eax
jne 0x461171
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4611a9
push 0
push 0
push eax
call fcn.00476160
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.00433a00
push 0
push 0x43bfc0
push dword [ebp - 0x27c]
push 0x69
push dword [0x4dc394]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x274]
call fcn.00448a60
xor ecx, ecx
mov dword [ebp - 0x278], ecx
jmp 0x461445
push esi
mov ecx, edi
call fcn.004620a0
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x461445
push esi
mov ecx, edi
call fcn.00462340
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x461445
push esi
mov ecx, edi
call fcn.00463200
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x461445
push esi
mov ecx, edi
call fcn.004634b0
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x461445
mov dword [edi + 0x148], esi
lea ecx, [edi + 0x120]
push dword [edi + 0x178]
call fcn.00450940
test al, al
je 0x46126a
lea ecx, [edi + 0x120]
call fcn.0044fe30
test al, al
je 0x46126a
lea ecx, [edi + 0x120]
call fcn.004504b0
test al, al
je 0x46126a
lea ecx, [edi + 0x120]
call fcn.0044f690
xor ecx, ecx
mov dword [ebp - 0x278], ecx
jmp 0x461445
mov ecx, 0xe000000b
mov dword [ebp - 0x278], ecx
jmp 0x461445
mov eax, dword [edi + 0x14c]
mov dword [ebp - 0x2c0], 0x4bc954
mov dword [ebp - fcn.00418860], 0x4bc948
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x248], 0x4bd238
mov dword [ebp - 0x244], 0
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0x220], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x2bc]
movq qword [ebp - 0x230], xmm0
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x248]
movups xmmword [ebp - 0x240], xmm0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [0x4dd23c], eax
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x27c]
push eax
push 0x60000
push 0xf003f
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x27c], 0
call fcn.0041dbe0
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x284], eax
cmp eax, ecx
je 0x461350
mov edx, dword [ebp - 0x248]
lea ecx, [ebp - 0x248]
call dword [edx + 4]
mov ecx, dword [ebp - 0x284]
mov dword [ebp - 0x244], ecx
test ecx, ecx
jne 0x461396
mov ecx, dword [ebp - 0x27c]
mov dword [ebp - 0x278], ecx
test ecx, ecx
je 0x461396
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x248], 0x4bd238
test eax, eax
je 0x461445
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x244], 0
jmp case.0x460f44.5
lea eax, [ebp - 0x248]
push eax
call fcn.00463570
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x461364
push esi
mov ecx, edi
call fcn.00463740
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x461445
push esi
mov ecx, edi
call fcn.00463ca0
mov ecx, eax
mov dword [ebp - 0x278], ecx
jmp 0x461445
mov eax, dword [edi + 0x180]
xorps xmm0, xmm0
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x254]
push eax
movlpd qword [ebp - 0x250], xmm0
movlpd qword [ebp - 0x240], xmm0
movlpd qword [ebp - 0x234], xmm0
movlpd qword [ebp - 0x22c], xmm0
movlpd qword [ebp - 0x224], xmm0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x254], 0x3c
mov dword [ebp - 0x238], 1
mov dword [ebp - 0x248], str.open
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 0x278]
mov eax, dword [edi + 0x160]
cmp dword [eax - 0xc], 0
je 0x461479
cmp byte [edi + 0x168], 0
jne 0x461479
cmp byte [edi + 0x15c], 0
jne 0x46146b
test ecx, ecx
je 0x4616a7
push esi
mov ecx, edi
call fcn.004617b0
mov ecx, dword [ebp - 0x278]
test ecx, ecx
je 0x4616a7
cmp ecx, 0xe0000011
je 0x4616a7
cmp ecx, 0xe0000027
je 0x4616a7
cmp ecx, 0xe0000008
je 0x4616a7
cmp ecx, 0x4c7
je 0x4616a7
cmp ecx, 0x642
je 0x4616a7
cmp ecx, 0xe0000029
je 0x4616a7
cmp dword [edi + 4], 0
jne 0x4616a7
cmp byte [edi + 0xa4], 0
jne 0x4616a7
call fcn.00404130
mov ecx, eax
test ecx, ecx
je 0x461756
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 4], 0x27
lea edx, [ebp - 0x2a4]
mov ecx, dword [ebp - 0x278]
call fcn.0043c230
mov edx, 0x8e
lea ecx, [ebp - 0x280]
call fcn.00409070
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x280]
push 3
push 0x4c1df4
call fcn.004021c0
mov edi, dword [ebp - 0x2a4]
lea ecx, [ebp - 0x280]
push dword [edi - 0xc]
push edi
call fcn.004021c0
mov eax, dword [ebp - 0x278]
add eax, 0xffffd120
cmp eax, 0xaf
ja 0x4615ff
mov eax, dword [esi + 0x144]
mov dword [ebp - 0x27c], eax
cmp dword [eax - 0xc], 0
je 0x4615ff
mov edx, 0x43a
lea ecx, [ebp - 0x290]
call fcn.00409070
mov byte [ebp - 4], 0x29
push dword [ebp - 0x27c]
push dword [eax]
lea eax, [ebp - 0x2a0]
push eax
call fcn.00402490
add esp, 0xc
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x280]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.004021c0
mov byte [ebp - 4], 0x29
or eax, 0xffffffff
mov edx, dword [ebp - 0x2a0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4615dd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x28
or eax, 0xffffffff
mov edx, dword [ebp - 0x290]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4615ff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esi + 0x34]
push eax
lea ecx, [ebp - 0x288]
call fcn.004023e0
mov byte [ebp - 4], 0x2e
call dword [sym.imp.USER32.dll_GetActiveWindow]
push ecx
mov ecx, dword [ebp - 0x288]
mov edx, 0x10
mov dword [ebp - 0x290], eax
mov eax, esp
push ecx
mov dword [eax], ecx
mov ecx, esp
mov eax, dword [ebp - 0x280]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x290]
call fcn.0041c8e0
add esp, 8
mov byte [ebp - 4], 0x28
or eax, 0xffffffff
mov edx, dword [ebp - 0x288]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x461669
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x27
or eax, 0xffffffff
mov edx, dword [ebp - 0x280]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46168b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4616a7
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
or eax, 0xffffffff
mov edx, dword [ebp - 0x294]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4616c9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x29c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4616eb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x46170b
mov ecx, esi
call fcn.00467a80
push 0x148
push esi
call fcn.0047770b
add esp, 8
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x298], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477280
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004022e0
push 1
push 0xc000008c
call fcn.00408700
push 0x80070057
call fcn.004022e0
push 0x80004005
call fcn.004022e0
dec ebx
cmovbe eax, dword [eax]
aad 0x10
inc esi
add byte [edi], al
adc dword [esi], eax
lds edx, [ecx]
inc esi
add dl, bl
adc dword [esi], eax
out dx, eax
adc dword [esi], eax
jge 0x461789
inc esi
add byte [edx + edx], al
inc esi
add byte [edx + 0x12], bh
inc esi
add byte [ecx], bl
adc al, byte [esi]
lodsb al, byte [esi]
adc eax, dword [esi]
rcl dword [ebx], 0x46
add bl, dl
adc eax, dword [esi]
aas
adc al, 70
add byte [eax], al
add dword [ecx], eax
add dword [edx], eax
or eax, 67372035
add eax, 117900806
pop es
or byte [edi], al
or dword [edx], ecx
or ecx, dword [esp + ecx*8]
int3