Function at 0x457da0
Capabilities:
Create process on windows
Hide graphical window
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6318
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x517b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x10]
movzx edx, word [ebp + 0xc]
mov esi, dword [edi + 4]
mov ecx, edx
mov dword [ebp - 0x228], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x41c], eax
mov eax, edx
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x418], ecx
cmp ecx, 0x9c41
ja 0x457e5b
je 0x457e39
sub eax, 1
je case.0x457e84.40003
sub eax, 0x12b
jne case.default.0x45a292
push eax
push 0x418240
push esi
push 0x4edc40
push dword [0x52e7d8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x45a55c
push dword [edi + 0x15c]
push 0x436380
push esi
push 0x4eda24
push dword [0x52e7d8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x45a55c
cmp ecx, 0xd101
ja 0x45a284
je case.0x45a292.53506
sub eax, 0x9c43
cmp eax, 0xa4
ja case.default.0x45a292
movzx eax, byte [eax + 0x45a65c]
jmp dword [eax*4 + 0x45a588]
push 0
push 0x9c53
push 0x111
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x45a292
cmp byte [0x51763c], 0
push 0
sete al
mov byte [0x51763c], al
movzx eax, al
push eax
push ecx
lea ecx, [edi + 0x40]
call fcn.00462510
movzx eax, byte [0x51763c]
push eax
push esi
call fcn.0046c3e0
add esp, 8
jmp case.default.0x45a292
cmp byte [0x51763f], 0
push 0
sete al
mov byte [0x51763f], al
movzx eax, al
push eax
push 0x9cc0
lea ecx, [edi + 0x40]
call fcn.00462510
mov ecx, 0x52da90
call fcn.004298d0
jmp case.default.0x45a292
cmp byte [0x517640], 0
push 0
sete al
mov byte [0x517640], al
movzx eax, al
push eax
push 0x9ce6
jmp 0x457ef1
cmp byte [0x517641], 0
push 0
sete al
mov byte [0x517641], al
movzx eax, al
push eax
push 0x9ce7
jmp 0x457ef1
push 2
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x15c]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
setne al
push eax
push dword [edi + 0x15c]
call fcn.00451d70
add esp, 8
jmp case.default.0x45a292
mov ecx, 0x52da90
call fcn.00428b30
test al, al
je 0x457f97
push 0x10
push 0x4e4e40
push 0x4ed968
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.default.0x45a292
push dword [edi + 0x15c]
call fcn.00419140
add esp, 4
jmp case.default.0x45a292
mov ecx, dword [edi + 0x41a0]
mov edx, 0x9cdd
mov eax, ecx
and ecx, 0xfffffffe
or eax, 1
cmp word [ebp - 0x220], dx
cmovne ecx, eax
mov dword [edi + 0x41a0], ecx
and ecx, 1
mov byte [ebp - 0x219], 0
lea eax, [ecx*2 - 1]
lea ecx, [ebp - 0x219]
push ecx
push eax
push dword [edi + 0x15c]
call fcn.004195e0
add esp, 0xc
test al, al
jne 0x458068
cmp byte [ebp - 0x219], al
jne 0x458068
push 0x4ed9dc
mov dword [ebp - 0x220], 0
call fcn.004a27e0
push eax
push 0x4ed9dc
call fcn.004a29e0
add esp, 0xc
mov dword [ebp - 0x220], eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea ecx, [ebp - 0x220]
call fcn.004a2380
push 0x30
push 0x4e4e40
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x458068
call fcn.004a2a20
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.default.0x45a292
cmp byte [0x51763d], 0
lea ecx, [edi + 0x40]
push 0
sete al
mov byte [0x51763d], al
movzx eax, al
push eax
push 0x9c53
call fcn.00462510
jmp 0x45a55c
push 0
push 0x4953e0
push esi
push 0x4eda00
push dword [0x52e7d8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.default.0x45a292
lea ecx, [edi + 0x15c]
call fcn.004551b0
mov dword [ebp - 0x228], eax
test eax, eax
js case.default.0x45a292
lfence
push 0x52da90
mov dword [ebp - 0x414], 0x52da90
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x228]
lea eax, [ebp - 0x3cc]
mov dword [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ebp - 0x3bc], 0
push eax
mov ecx, 0x52da90
movups xmmword [ebp - 0x3cc], xmm0
call fcn.00455180
mov dword [ebp - 0x224], 0
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 4
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x3cc]
call fcn.00420700
mov eax, dword [ebp - 0x3c4]
movzx eax, word [eax + 8]
sub eax, 2
je 0x458197
sub eax, 1
je 0x458175
push 0x10
push 0x4e4e40
push 0x4eda40
lfence
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4581ba
push ecx
mov eax, esp
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x224]
mov dword [eax], ecx
test ecx, ecx
je 0x45818f
call fcn.004a26e0
push esi
call fcn.00450440
jmp 0x4581b7
push ecx
mov eax, esp
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x224]
mov dword [eax], ecx
test ecx, ecx
je 0x4581b1
call fcn.004a26e0
push esi
call fcn.00450650
add esp, 8
mov ecx, dword [ebp - 0x224]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x4581cd
call fcn.004a2a20
lea ecx, [ebp - 0x3cc]
call fcn.0041f2b0
jmp 0x45a545
push dword [edi + 0x416c]
push 0x9c91
push 0x111
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x45a292
lea ecx, [edi + 0x15c]
call fcn.004551b0
mov edi, eax
test edi, edi
js case.default.0x45a292
lfence
push 0x52da90
mov dword [ebp - 0x414], 0x52da90
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
lea eax, [ebp - 0x3cc]
mov dword [ebp - 4], 6
xorps xmm0, xmm0
mov dword [ebp - 0x3bc], 0
push eax
mov ecx, 0x52da90
movups xmmword [ebp - 0x3cc], xmm0
call fcn.00455180
cmp dword [ebp - 0x3c4], 0
mov byte [ebp - 4], 7
je 0x45828c
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x9c75
lea ecx, [ebp - 0x3cc]
call fcn.00420eb0
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.0046ba30
add esp, 8
lea ecx, [ebp - 0x3cc]
call fcn.0041f2b0
jmp 0x45a545
push 0
push 0
push 0x1042
push dword [edi + 0x15c]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
js case.default.0x45a292
push dword [ebp - 0x418]
lea ecx, [edi + 0x38]
push eax
push esi
push ecx
lfence
call fcn.0043ece0
add esp, 0x10
jmp case.default.0x45a292
xor esi, esi
nop word [eax + eax]
mov eax, dword [esi + 0x4ed940]
cmp eax, ecx
jne 0x45831b
push 0
push eax
push 0x40a
push dword [edi + 0x160]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
setne al
movzx eax, al
push eax
push dword [esi + 0x4ed944]
call fcn.0048ae10
mov ecx, dword [ebp - 0x418]
add esp, 8
add esi, 8
cmp esi, 0x28
jb 0x4582e0
jmp case.default.0x45a292
cmp byte [0x51763e], 0
lea ecx, [edi + 0x40]
push 0
sete al
mov byte [0x51763e], al
movzx eax, al
push eax
push 0x9c7f
call fcn.00462510
cmp byte [0x51763e], 0
mov ecx, 0x52db14
sete al
movzx eax, al
push eax
call fcn.00424eb0
push 0
mov ecx, 0x52da90
call fcn.004291c0
jmp case.default.0x45a292
mov eax, dword [0x52e3bc]
test eax, eax
je 0x458396
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x52e3bc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x45a55c
push 0x48
call fcn.004a71b8
mov edi, eax
add esp, 4
mov dword [ebp - 0x41c], edi
test edi, edi
je 0x458435
push 0x48
push 0
push edi
call fcn.004aa220
mov dword [edi + 4], 0
add esp, 0xc
mov dword [edi + 0x14], 0
mov ecx, edi
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
push 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov byte [edi + 0x3c], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xffffffff
mov dword [edi + 0x38], 0xffffffff
push esi
mov dword [edi], vtable.CFilterDlg.0
mov dword [edi + 0x40], 0xb8
call fcn.004544c0
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x45a55c
xor edi, edi
push edi
push esi
mov ecx, edi
call fcn.004544c0
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x45a55c
push 0x52db14
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x52db30]
sub esi, dword [0x52db2c]
push 0x52db14
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, 0x20
jae 0x458491
push 0x40
push 0x4e4e40
push 0x4eda98
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.default.0x45a292
mov esi, dword [ebp - 0x224]
push 0
push 0x49ac90
push esi
push 0x4edae4
push dword [0x52e7d8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push dword [edi + 0x417c]
mov ecx, 0x52e830
call fcn.00455110
jmp case.default.0x45a292
push 0
push 0x4746e0
push esi
push 0x4edafc
jmp 0x4584a4
mov eax, dword [0x52e3c0]
test eax, eax
je 0x4584f7
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x52e3c0]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.default.0x45a292
push 0x44
call fcn.004a71b8
mov edi, eax
add esp, 4
mov dword [ebp - 0x414], edi
test edi, edi
je 0x458577
push 0x44
push 0
push edi
call fcn.004aa220
mov dword [edi + 4], 0
add esp, 0xc
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov byte [edi + 0x3c], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xffffffff
mov dword [edi + 0x38], 0xffffffff
mov dword [edi], vtable.CHighlightDlg.0
mov byte [edi + 0x40], 0
jmp 0x458579
xor edi, edi
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x4585a4
call fcn.004a893c
mov dword [edi + 0x14], eax
test eax, eax
jne 0x4585a4
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x45a292
push 0
push 0
push eax
call fcn.004a8a3e
lea eax, [edi + 8]
test eax, eax
je 0x45a57b
test edi, edi
je 0x45a57b
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x517170
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x517188]
lea ecx, [edi + 8]
mov dword [ecx + 8], eax
push 0x517170
mov dword [0x517188], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x43ef00
push esi
push 0xbc
push dword [0x52f1b0]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x45a292
push dword [0x517650]
xorps xmm0, xmm0
lea ecx, [ebp - 0x25c]
push dword [0x517654]
movups xmmword [ebp - 0x25c], xmm0
movups xmmword [ebp - 0x24c], xmm0
movq qword [ebp - 0x23c], xmm0
call fcn.0044e140
mov dword [ebp - 4], 8
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
mov eax, dword [ebp - 0x248]
test eax, eax
jne 0x458681
call fcn.004a893c
mov dword [ebp - 0x248], eax
test eax, eax
jne 0x458681
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x458718
push 0
push 0
push eax
call fcn.004a8a3e
lea eax, [ebp - 0x25c]
lea edi, [ebp - 0x254]
mov dword [ebp - 0x254], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x517170
mov dword [ebp - 0x250], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x517188]
push 0x517170
mov dword [ebp - 0x24c], eax
mov dword [0x517188], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x43ef00
push esi
push 0xbd
push dword [0x52f1b0]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 1
jne 0x458718
lea ecx, [ebp - 0x25c]
call fcn.0044e380
lea ecx, [ebp - 0x25c]
mov dword [0x517654], eax
call fcn.0044e390
mov ecx, 0x52da90
mov dword [0x517650], eax
call fcn.004298d0
mov eax, dword [ebp - 0x248]
test eax, eax
je case.default.0x45a292
push eax
call fcn.004a89e8
jmp case.default.0x45a292
push 0x34
lea eax, [ebp - 0x3ec]
mov dword [ebp - 0x3f4], 0x3c
push 0
push eax
call fcn.004aa220
push 0x5c
lea eax, [ebp - 0x3b8]
push 0
push eax
call fcn.004aa220
add esp, 0x18
lea eax, [ebp - 0x3b8]
push eax
push 0x5c
push dword [0x5174b0]
call dword [sym.imp.GDI32.dll_GetObjectW]
lea eax, [ebp - 0x3b8]
mov dword [ebp - 0x3f0], esi
mov dword [ebp - 0x3e8], eax
lea eax, [ebp - 0x3f4]
push eax
mov dword [ebp - 0x3e0], 0x10041
call dword [sym.imp.COMDLG32.dll_ChooseFontW]
test eax, eax
je case.default.0x45a292
push dword [0x5174b0]
call dword [sym.imp.GDI32.dll_DeleteObject]
lea eax, [ebp - 0x3b8]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0
push eax
push 0x30
mov dword [0x5174b0], eax
push dword [edi + 0x15c]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [0x5174b4]
mov ecx, 0x2bc
mov eax, 0x320
cmp dword [ebp - 0x3a8], ecx
cmovl eax, ecx
mov dword [ebp - 0x3a8], eax
call dword [sym.imp.GDI32.dll_DeleteObject]
lea eax, [ebp - 0x3b8]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [0x5174b4], eax
lea eax, [ebp - 0x234]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x228]
mov edx, dword [ebp - 0x230]
sub eax, edx
mov ecx, dword [ebp - 0x234]
push 0
push eax
mov eax, dword [ebp - 0x22c]
sub eax, ecx
dec eax
push eax
push edx
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [ebp - 0x228]
mov edx, dword [ebp - 0x230]
sub eax, edx
mov ecx, dword [ebp - 0x234]
push 0
push eax
mov eax, dword [ebp - 0x22c]
sub eax, ecx
push eax
push edx
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MoveWindow]
lea eax, [ebp - 0x234]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x228]
mov edx, dword [ebp - 0x230]
sub eax, edx
mov ecx, dword [ebp - 0x234]
push 4
push eax
mov eax, dword [ebp - 0x22c]
sub eax, ecx
dec eax
push eax
push edx
push ecx
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp - 0x228]
mov edx, dword [ebp - 0x230]
sub eax, edx
mov ecx, dword [ebp - 0x234]
push 4
push eax
mov eax, dword [ebp - 0x22c]
sub eax, ecx
push eax
push edx
push ecx
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push 0
push dword [edi + 0x15c]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp case.default.0x45a292
push 0
push 0x44f360
push esi
push 0x4edb20
push dword [0x52e7d8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x45a55c
mov ecx, 0x52da90
call fcn.00427ae0
test eax, eax
je 0x45893b
push 0
push 0x4a6a50
push esi
push 0x4edb3c
push dword [0x52e7d8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x45a55c
push 0x10
push 0x4e4e40
push 0x4edb60
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x45a55c
push 0x58
call fcn.004a71b8
add esp, 4
mov dword [ebp - 0x418], eax
test eax, eax
je 0x458a0d
push 0x58
push 0
push eax
call fcn.004aa220
lea eax, [edi + 0x38]
add esp, 0xc
mov edi, dword [ebp - 0x418]
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov byte [edi + 0x40], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0xffffffff
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi + 0x20], vtable.._AV__CSummaryDlg__0LP__0ME__2U__RegistryName__0BC___3G0EP__0GD__0GD__0HF__0HC__0HC__0GF__0GO__0GD__0GF__0HD__0EE__0GJ__0GB__0GM__0GP__0GH__0A______.0
mov dword [edi + 0x20], 0x4ed54c
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi], vtable.COccurrencesDlg.0
mov dword [edi + 0x20], vtable.COccurrencesDlg.1.0
mov dword [edi + 0x50], 0
mov byte [edi + 0x54], 1
jmp 0x458a0f
xor edi, edi
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x458a2c
call fcn.004a893c
mov dword [edi + 0x14], eax
test eax, eax
jne 0x458a2c
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x458a94
push 0
push 0
push eax
call fcn.004a8a3e
lea eax, [edi + 8]
test eax, eax
je 0x45a57b
test edi, edi
je 0x45a57b
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x517170
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x517188]
lea ecx, [edi + 8]
mov dword [ecx + 8], eax
push 0x517170
mov dword [0x517188], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x43ef00
push esi
push 0xbf
push dword [0x52f1b0]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x45a55c
push 1
push eax
mov ecx, edi
call fcn.00473e00
jmp 0x45a55c
mov eax, dword [0x52e3b8]
test eax, eax
je 0x458adf
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x52e3b8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x458c21
push 0x50
call fcn.004a71b8
mov esi, eax
add esp, 4
mov dword [ebp - 0x414], esi
test esi, esi
je 0x458b7a
push 0x50
push 0
push esi
call fcn.004aa220
mov dword [esi + 4], 0
lea eax, [edi + 0x38]
mov dword [esi + 0x14], 0
add esp, 0xc
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x40], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x20], vtable.._AV__CSummaryDlg__0KO__0GF__2U__RegistryName__0BC___3G0FA__0HC__0GP__0GD__0GF__0HD__0HD__0FE__0HC__0GF__0GF__0EE__0GJ__0GB__0GM__0GP__0GH__0A______.0
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 0
mov dword [esi], vtable.CProcessTreeDlg.0
mov dword [esi + 0x20], vtable.CProcessTreeDlg.1.0
jmp 0x458b7c
xor esi, esi
mov eax, dword [edi + 4]
mov dword [ebp - 0x228], eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x458ba4
call fcn.004a893c
mov dword [esi + 0x14], eax
test eax, eax
jne 0x458ba4
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x458c11
push 0
push 0
push eax
call fcn.004a8a3e
lea eax, [esi + 8]
test eax, eax
je 0x45a57b
test esi, esi
je 0x45a57b
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x517170
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x517188]
lea ecx, [esi + 8]
mov dword [ecx + 8], eax
push 0x517170
mov dword [0x517188], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x43ef00
push dword [ebp - 0x228]
push 0xae
push dword [0x52f1b0]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
mov dword [0x52e3b8], eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x52da90
mov dword [ebp - 0x414], 0x52da90
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xorps xmm0, xmm0
mov dword [ebp - 4], 9
lea ecx, [edi + 0x15c]
mov dword [ebp - 0x3bc], 0
movups xmmword [ebp - 0x3cc], xmm0
call fcn.004551b0
push eax
lea eax, [ebp - 0x3cc]
mov ecx, 0x52da90
push eax
call fcn.00455180
cmp dword [ebp - 0x3c4], 0
mov byte [ebp - 4], 0xa
je 0x458c9c
lea ecx, [ebp - 0x3cc]
call fcn.00421b60
push dword [eax + 4]
push 0
push 0x8003
push dword [0x52e3b8]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x3cc]
call fcn.0041f2b0
jmp 0x45a545
push 0x50
call fcn.004a71b8
mov esi, eax
add esp, 4
mov dword [ebp - 0x41c], esi
test esi, esi
je 0x458d47
push 0x50
push 0
push esi
call fcn.004aa220
mov dword [esi + 4], 0
lea eax, [edi + 0x38]
mov dword [esi + 0x14], 0
add esp, 0xc
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x40], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x20], vtable.._AV__CSummaryDlg__0JJ__0GF__2U__RegistryName__0BN___3G0FA__0HC__0GP__0GD__0GF__0HD__0HD__0EB__0GD__0HE__0GJ__0HG__0GJ__0HE__0HJ__0FD__0HF__0GN__0GN__0GB__0HC__0HJ__0EE__0GJ__0GB__0GM__0GP__0GH__0A______.0
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 0
mov dword [esi], vtable.CProcessActivitySummaryDlg.0
mov dword [esi + 0x20], vtable.CProcessActivitySummaryDlg.1.0
jmp 0x458d49
xor esi, esi
mov eax, dword [edi + 4]
mov dword [ebp - 0x228], eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x458d6f
call fcn.004a893c
mov dword [esi + 0x14], eax
test eax, eax
jne 0x458d6f
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x458dd9
push 0
push 0
push eax
call fcn.004a8a3e
lea edi, [esi + 8]
test edi, edi
je 0x45a57b
test esi, esi
je 0x45a57b
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x517170
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x517188]
mov dword [edi + 8], eax
push 0x517170
mov dword [0x517188], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x43ef00
push dword [ebp - 0x228]
push 0x99
push dword [0x52f1b0]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x45a55c
push 0x60
call fcn.004a71b8
mov esi, eax
add esp, 4
mov dword [ebp - 0x41c], esi
test esi, esi
je 0x458eb0
push 0x60
push 0
push esi
call fcn.004aa220
mov dword [esi + 4], 0
lea eax, [edi + 0x38]
mov dword [esi + 0x14], 0
add esp, 0xc
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x40], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x20], vtable.._AV__CSummaryDlg__0LK__0IA__2U__RegistryName__0BC___3G0EG__0GJ__0GM__0GF__0FD__0HF__0GN__0GN__0GB__0HC__0HJ__0EE__0GJ__0GB__0GM__0GP__0GH__0A______.0
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 0
mov dword [esi], vtable.CFileSummaryDlg.0
mov dword [esi + 0x20], vtable.CFileSummaryDlg.1.0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
jmp 0x458eb2
xor esi, esi
mov eax, dword [edi + 4]
mov dword [ebp - 0x228], eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x458ed2
call fcn.004a893c
mov dword [esi + 0x14], eax
test eax, eax
je 0x458d65
push 0
push 0
push eax
call fcn.004a8a3e
lea edi, [esi + 8]
test edi, edi
je 0x45a57b
test esi, esi
je 0x45a57b
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x517170
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x517188]
mov dword [edi + 8], eax
push 0x517170
mov dword [0x517188], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x43ef00
push dword [ebp - 0x228]
push 0xba
jmp 0x458dcd
push 0x50
call fcn.004a71b8
mov esi, eax
add esp, 4
mov dword [ebp - 0x41c], esi
test esi, esi
je 0x458fde
push 0x50
push 0
push esi
call fcn.004aa220
mov dword [esi + 4], 0
lea eax, [edi + 0x38]
mov dword [esi + 0x14], 0
add esp, 0xc
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x40], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x20], vtable.._AV__CSummaryDlg__0JG__0IK__2U__RegistryName__0BG___3G0FC__0GF__0GH__0GJ__0HD__0HE__0HC__0HJ__0FD__0HF__0GN__0GN__0GB__0HC__0HJ__0EE__0GJ__0GB__0GM__0GP__0GH__0A______.0
mov dword [esi + 0x20], 0x4ed0a4
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi], vtable.CRegistrySummaryDlg.0
mov dword [esi + 0x20], vtable.CRegistrySummaryDlg.1.0
jmp 0x458fe0
xor esi, esi
mov eax, dword [edi + 4]
mov dword [ebp - 0x228], eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x459000
call fcn.004a893c
mov dword [esi + 0x14], eax
test eax, eax
je 0x458d65
push 0
push 0
push eax
call fcn.004a8a3e
lea edi, [esi + 8]
test edi, edi
je 0x45a57b
test esi, esi
je 0x45a57b
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x517170
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x517188]
mov dword [edi + 8], eax
push 0x517170
mov dword [0x517188], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x43ef00
push dword [ebp - 0x228]
push 0x96
jmp 0x458dcd
push 0x50
call fcn.004a71b8
mov esi, eax
add esp, 4
mov dword [ebp - 0x41c], esi
test esi, esi
je 0x45910c
push 0x50
push 0
push esi
call fcn.004aa220
mov dword [esi + 4], 0
lea eax, [edi + 0x38]
mov dword [esi + 0x14], 0
add esp, 0xc
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x40], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x20], vtable.._AV__CSummaryDlg__0JI__0IC__2U__RegistryName__0BF___3G0EO__0GF__0HE__0HH__0GP__0HC__0GL__0FD__0HF__0GN__0GN__0GB__0HC__0HJ__0EE__0GJ__0GB__0GM__0GP__0GH__0A______.0
mov dword [esi + 0x20], 0x4ed254
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi], vtable.CNetworkSummaryDlg.0
mov dword [esi + 0x20], vtable.CNetworkSummaryDlg.1.0
jmp 0x45910e
xor esi, esi
mov eax, dword [edi + 4]
mov dword [ebp - 0x228], eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x45912e
call fcn.004a893c
mov dword [esi + 0x14], eax
test eax, eax
je 0x458d65
push 0
push 0
push eax
call fcn.004a8a3e
lea edi, [esi + 8]
test edi, edi
je 0x45a57b
test esi, esi
je 0x45a57b
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x517170
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x517188]
mov dword [edi + 8], eax
push 0x517170
mov dword [0x517188], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x43ef00
push dword [ebp - 0x228]
push 0x98
jmp 0x458dcd
push 0xb8
call fcn.004a71b8
mov esi, eax
add esp, 4
mov dword [ebp - 0x220], esi
mov dword [ebp - 4], 0xb
test esi, esi
je 0x459346
push 0xb8
push 0
push esi
call fcn.004aa220
mov dword [esi + 4], 0
lea eax, [edi + 0x38]
mov dword [esi + 0x14], 0
add esp, 0xc
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x40], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x20], vtable.._AV__CSummaryDlg__0JP__0HN__2U__RegistryName__0BD___3G0FD__0HE__0GB__0GD__0GL__0FD__0HF__0GN__0GN__0GB__0HC__0HJ__0EE__0GJ__0GB__0GM__0GP__0GH__0A______.0
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 0
mov dword [esi], vtable.CStackSummaryDlg.0
mov dword [esi + 0x20], vtable.CStackSummaryDlg.1.0
add esi, 0x4c
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x414], esi
mov dword [esi], 0
push 0x4ed354
mov ecx, esi
mov byte [ebp - 4], 0xd
call fcn.004a2300
xorps xmm0, xmm0
movups xmmword [esi + 8], xmm0
movq qword [esi + 0x18], xmm0
mov dword [esi + 0x20], 0
push 0x4ed354
mov byte [ebp - 4], 0xe
call fcn.004a27e0
push eax
push 0x4ed354
call fcn.004a29e0
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x220]
push 0x40
mov byte [ebp - 4], 0xf
mov dword [eax + 0x78], esi
lea esi, [eax + 0x7c]
mov dword [ebp - 0x41c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004a71b8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, dword [ebp - 0x220]
mov dword [eax + 0x88], 0xffffffff
mov dword [eax + 0x8c], 0xffffffff
mov dword [eax + 0x90], 0xffffffff
mov dword [eax + 0x98], 0
mov dword [eax + 0x9c], 0
mov dword [eax + 0xa0], 0
lea esi, [eax + 0xa8]
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x41c], esi
push 0x3c
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004a71b8
add esp, 0x14
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov esi, dword [ebp - 0x220]
jmp 0x459348
xor esi, esi
mov eax, dword [edi + 4]
mov dword [ebp - 0x228], eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x45937c
call fcn.004a893c
mov dword [esi + 0x14], eax
test eax, eax
jne 0x45937c
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x45a55c
push 0
push 0
push eax
call fcn.004a8a3e
lea edi, [esi + 8]
test edi, edi
je 0x45a57b
test esi, esi
je 0x45a57b
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x517170
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x517188]
mov dword [edi + 8], eax
push 0x517170
mov dword [0x517188], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x43ef00
push dword [ebp - 0x228]
push 0x9f
push dword [0x52f1b0]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x45a55c
push 0x50
call fcn.004a71b8
mov esi, eax
add esp, 4
mov dword [ebp - 0x41c], esi
test esi, esi
je 0x45949f
push 0x50
push 0
push esi
call fcn.004aa220
mov dword [esi + 4], 0
lea eax, [edi + 0x38]
mov dword [esi + 0x14], 0
add esp, 0xc
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x40], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x20], vtable.._AV__CSummaryDlg__0KA__0MD__2U__RegistryName__0BM___3G0ED__0HC__0GP__0HD__0HD__0FC__0GF__0GG__0GF__0HC__0GF__0GO__0GD__0GF__0FD__0HF__0GN__0GN__0GB__0HC__0HJ__0EE__0GJ__0GB__0GM__0GP__0GH__0A______.0
mov dword [esi + 0x20], 0x4ed3e8
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi], vtable.CCrossReferenceSummaryDlg.0
mov dword [esi + 0x20], vtable.CCrossReferenceSummaryDlg.1.0
jmp 0x4594a1
xor esi, esi
mov eax, dword [edi + 4]
mov dword [ebp - 0x228], eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x4594c1
call fcn.004a893c
mov dword [esi + 0x14], eax
test eax, eax
je 0x459364
push 0
push 0
push eax
call fcn.004a8a3e
lea edi, [esi + 8]
test edi, edi
je 0x45a57b
test esi, esi
je 0x45a57b
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x517170
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x517188]
mov dword [edi + 8], eax
push 0x517170
mov dword [0x517188], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x43ef00
push dword [ebp - 0x228]
push 0xa0
jmp 0x4593da
push 0
push 0x4a5960
push esi
push 0x4edba4
push dword [0x52e7d8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x45a55c
and dword [edi + 0x41a0], 0xffffffbf
lea eax, [edi + 0x4194]
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
mov dword [0x52e3a8], eax
jmp 0x45a55c
mov ecx, dword [edi + 0x41a0]
mov esi, 0x9cd3
mov edx, dword [edi + 0x15c]
mov eax, ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x414], edx
or eax, 1
cmp word [ebp - 0x220], si
push 0
cmovne ecx, eax
push 0
mov dword [edi + 0x41a0], ecx
and cl, 1
push 0x1042
push edx
mov byte [ebp - 0x228], cl
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x228]
mov ecx, 0x52da90
push eax
call fcn.00428df0
mov ecx, 0x52da90
mov dword [ebp - 0x418], eax
call fcn.00427ae0
mov esi, dword [ebp - 0x224]
cmp dword [ebp - 0x418], eax
jb 0x459648
push 0x4edbc0
mov dword [ebp - 0x220], 0
call fcn.004a27e0
push eax
push 0x4edbc0
call fcn.004a29e0
add esp, 0xc
mov dword [ebp - 0x220], eax
push esi
mov dword [ebp - 4], 0x11
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea ecx, [ebp - 0x220]
call fcn.004a2380
push 0x30
push 0x4e4e40
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 4], 0x12
test ecx, ecx
je 0x45a55c
call fcn.004a2a20
jmp 0x45a55c
lea eax, [ebp - 0x3f4]
push eax
push 0xffffffffffffffff
lfence
mov esi, dword [ebp - 0x414]
push 0x102b
push esi
mov dword [ebp - 0x3e4], 3
mov dword [ebp - 0x3e8], 0
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [ebp - 0x418]
lea eax, [ebp - 0x3f4]
push eax
push edi
push 0x102b
push esi
mov dword [ebp - 0x3e4], 3
mov dword [ebp - 0x3e8], 3
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
push 0x1013
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
push 0x1043
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x45a55c
mov ecx, dword [edi + 0x41a0]
mov edx, 0x9c7e
mov eax, ecx
and ecx, 0xfffffffe
or eax, 1
cmp word [ebp - 0x220], dx
cmovne ecx, eax
lea eax, [edi + 0x4194]
push eax
push 0
push 0x8004
push esi
mov dword [edi + 0x41a0], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x45a55c
push 1
push 0
push 0
push 0x4edbe8
push 0x4e4c58
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x45a55c
push 0
push 0x418240
push esi
push 0x4edc54
push dword [0x52e7d8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x45a55c
lea eax, [ebp - 0x3e8]
mov dword [ebp - 0x3e8], 0x30
push eax
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x3e4], 1
push 0x9cb0
push dword [edi + 0xb4]
movups xmmword [ebp - 0x3e0], xmm0
movups xmmword [ebp - 0x3d0], xmm0
movq qword [ebp - 0x3c0], xmm0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov eax, dword [ebp - 0x3dc]
lea ecx, [edi + 0x40]
shr eax, 3
not al
and al, 1
mov byte [0x51764c], al
push 0
movzx eax, al
push eax
push 0x9cb0
call fcn.00462510
jmp case.default.0x45a292
push 1
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x15c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1028
push dword [edi + 0x15c]
mov esi, eax
call dword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, word [ebp + 0xc]
lea edx, [eax + eax*4]
mov eax, 0x9c8e
add edx, edx
cmp cx, ax
jne 0x459807
mov eax, esi
mov esi, 0
sub eax, edx
cmovns esi, eax
jmp 0x459825
push 0
push 0
push 0x1004
push dword [edi + 0x15c]
add esi, edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, eax
jl 0x459825
lea esi, [eax - 1]
lea eax, [ebp - 0x3f4]
mov dword [ebp - 0x3e4], 3
push eax
push esi
push 0x102b
push dword [edi + 0x15c]
mov dword [ebp - 0x3e8], 3
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push esi
push 0x1013
push dword [edi + 0x15c]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x45a292
push 0x52da90
mov dword [ebp - 0x414], 0x52da90
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
mov ecx, 0x52db40
mov dword [ebp - 4], 0x13
call fcn.00461950
cmp byte [0x51763e], 0
mov ecx, 0x52db14
sete al
movzx eax, al
push eax
call fcn.00461950
push 0
jmp 0x45a526
push 0x44
call fcn.004a71b8
mov esi, eax
add esp, 4
mov dword [ebp - 0x414], esi
test esi, esi
je 0x459935
push 0x44
push 0
push esi
call fcn.004aa220
mov dword [esi + 4], 0
add esp, 0xc
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi + 0x3c], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x38], 0xffffffff
mov dword [esi], vtable.CBackingFileDlg.0
mov dword [esi + 0x40], 0
jmp 0x459937
xor esi, esi
mov eax, dword [edi + 4]
mov dword [ebp - 0x414], eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x45996b
call fcn.004a893c
mov dword [esi + 0x14], eax
test eax, eax
jne 0x45996b
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x45a292
push 0
push 0
push eax
call fcn.004a8a3e
lea edi, [esi + 8]
test edi, edi
je 0x45a57b
test esi, esi
je 0x45a57b
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x517170
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x517188]
mov dword [edi + 8], eax
push 0x517170
mov dword [0x517188], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x43ef00
push dword [ebp - 0x414]
push 0x93
push dword [0x52f1b0]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x45a292
mov eax, 0x9cc7
cmp dx, ax
lea eax, [ebp - 0x410]
push 0x58
push 0
push eax
sete byte [ebp - 0x414]
call fcn.004aa220
movups xmm0, xmmword [0x4edc60]
mov ax, word [0x4edc90]
push 0x1d6
movups xmmword [ebp - 0x218], xmm0
mov word [ebp - 0x1e8], ax
lea eax, [ebp - 0x1e6]
movups xmm0, xmmword [0x4edc70]
push 0
push eax
movups xmmword [ebp - 0x208], xmm0
movups xmm0, xmmword [0x4edc80]
movups xmmword [ebp - 0x1f8], xmm0
call fcn.004aa220
movzx ecx, word [ebp + 0xc]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x3f4], eax
add esp, 0x18
xor eax, eax
mov dword [ebp - 0x40c], esi
mov esi, dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov edx, 0x9cc7
cmp cx, dx
mov dword [ebp - 0x410], 0x58
mov dword [ebp - 0x3f0], 0x104
cmove esi, dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
setne al
mov ecx, esi
mov dword [ebp - 0x404], 0x4edc98
lea eax, [eax*4 + 8]
mov dword [ebp - 0x3dc], eax
lea eax, [ebp - 0x410]
push eax
call dword [0x4dc8a4]
call esi
test eax, eax
je case.default.0x45a292
push 0x100
lea eax, [ebp - 0x35c]
push 0
push eax
call fcn.004aa220
add esp, 0xc
lea eax, [ebp - 0x334]
mov ecx, 6
mov dword [eax - 8], 0
lea eax, [eax + 0x20]
mov dword [eax - 0x24], 0
mov dword [eax - 0x20], 0
mov dword [eax - 0x1c], 0
mov dword [eax - 0x18], 0
mov dword [eax - 0x14], 0
mov dword [eax - 0x10], 0
sub ecx, 1
jne 0x459ae6
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp - 0x35c]
mov dword [ebp - 0x264], 0
xorps xmm0, xmm0
mov word [ebp - 0x354], 0
movlpd qword [ebp - 0x35c], xmm0
mov dword [ebp - 0x350], 0
mov dword [ebp - 0x34c], 0xffffffff
mov dword [ebp - 0x348], 0
movlpd qword [ebp - 0x344], xmm0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x2fc], eax
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 0x29c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0x1b
push 0x2e
push eax
call fcn.004ab205
add esp, 8
test eax, eax
jne 0x459bd9
push 0x4edce4
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004bad7a
add esp, 0xc
push 0
push dword [ebp - 0x414]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x35c]
call fcn.00463380
test al, al
jne 0x459c18
push 0x10
push 0x4e4e40
push 0x4edcf0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 0x1c
jmp 0x459d87
lea eax, [ebp - 0x35c]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x22c]
movlpd qword [ebp - 0x22c], xmm0
call fcn.0049b670
movzx ecx, word [ebp + 0xc]
mov eax, 0x9cc7
cmp cx, ax
mov byte [ebp - 4], 0x1d
lea eax, [ebp - 0x22c]
jne 0x459d66
push eax
call fcn.0049bfb0
add esp, 4
lea ecx, [edi + 0x40]
xor eax, eax
cmp byte [0x51763c], al
push 0
setne al
push eax
push 0x9cb4
call fcn.00462510
xor eax, eax
lea ecx, [edi + 0x40]
cmp byte [0x51763d], al
push 0
setne al
push eax
push 0x9c53
call fcn.00462510
xor eax, eax
lea ecx, [edi + 0x40]
cmp byte [0x51763e], al
push 0
setne al
push eax
push 0x9c7f
call fcn.00462510
mov ecx, edi
call fcn.00462880
xor eax, eax
lea ecx, [edi + 0x40]
cmp byte [0x51764c], 1
push 0
sete al
push eax
push 0x9cb0
call fcn.00462510
xor eax, eax
lea ecx, [edi + 0x40]
cmp byte [0x51763f], al
push 0
setne al
push eax
push 0x9cc0
call fcn.00462510
xor eax, eax
lea ecx, [edi + 0x40]
cmp byte [0x517640], al
push 0
setne al
push eax
push 0x9ce6
call fcn.00462510
push 0
push dword [0x5174b0]
push 0x30
push dword [edi + 0x15c]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [0x517538]
push 0x5174b8
push 0x51753c
push dword [edi + 0x15c]
call fcn.00436610
push dword [edi + 0x134]
call fcn.004929b0
add esp, 4
mov ecx, 0x52da90
push 0
call fcn.004291c0
push 0
push 0
push 0x800b
push dword [0x52e3bc]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x459d75
push dword [edi + 0x15c]
push eax
call fcn.0049c260
add esp, 8
lea ecx, [ebp - 0x22c]
call fcn.00405a40
mov dword [ebp - 4], 0x1e
lea ecx, [ebp - 0x35c]
call fcn.00463da0
mov esi, dword [ebp - 0x264]
test esi, esi
je 0x459dea
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x459de0
test esi, esi
je 0x459de0
mov eax, dword [esi]
test eax, eax
je 0x459dbe
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x459dd5
push eax
call fcn.004a71f6
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.004a71e8
add esp, 8
mov dword [ebp - 0x264], 0
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.default.0x45a292
call fcn.0046f580
mov esi, eax
call fcn.0046eb70
push 0x7f02
push 0
mov byte [ebp - 0x219], al
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 0x414], eax
test esi, esi
je 0x459e7f
cmp byte [ebp - 0x219], 0
je 0x459e7f
push 1
call fcn.0046f590
add esp, 4
mov ecx, 0x52da90
push 0
call fcn.004271e0
push 0x52e5d0
push 0x52e3c8
push 0
push 0x517868
mov ecx, 0x52da90
call fcn.00427b50
mov esi, dword [ebp - 0x224]
test al, al
je 0x459e9b
push 0
push 1
push esi
call fcn.0046eee0
add esp, 0xc
jmp 0x459e9b
push 0
call fcn.0046f590
add esp, 4
mov ecx, 0x52da90
push 0
call fcn.004271e0
mov esi, dword [ebp - 0x224]
push 0
push 0xfa
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
push ecx
mov ecx, esp
push 0x517868
call fcn.00433aa0
push esi
call fcn.00491750
add esp, 8
call fcn.0046eb70
movzx eax, al
mov ecx, edi
push eax
push 0x9c52
call fcn.00461aa0
push dword [edi + 0x134]
call fcn.004929b0
add esp, 4
push dword [ebp - 0x414]
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x45a55c
push 0
push 1
push 0x9c54
lea ecx, [edi + 0x40]
call fcn.00462420
call fcn.0046eb70
test al, al
jne 0x459f31
call fcn.0046f580
test eax, eax
jne 0x459f31
push eax
push 0x9c87
push 0x111
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x45a55c
call fcn.0046eb70
mov byte [ebp - 0x219], al
mov dword [ebp - 0x418], 0
test al, al
je 0x459f85
call fcn.00469ce0
test al, al
jne 0x459f7f
push 0
push 0x488ab0
push esi
push 0x4edd38
push dword [0x52e7d8]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push eax
mov dword [ebp - 0x418], eax
call dword [sym.imp.USER32.dll_UpdateWindow]
call dword [sym.imp.GDI32.dll_GdiFlush]
mov al, byte [ebp - 0x219]
xor al, 1
movzx ecx, al
push 0
push ecx
call fcn.0046f710
add esp, 8
mov esi, eax
push dword [ebp - 0x418]
call dword [sym.imp.USER32.dll_DestroyWindow]
test esi, esi
je 0x459fc5
call fcn.0046eb70
test al, al
jne 0x459fc5
push 0x30
push 0x4e4e40
push 0x4edd58
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
call fcn.0046eb70
movzx eax, al
mov ecx, edi
push eax
push 0x9c52
call fcn.00461aa0
push dword [edi + 0x134]
call fcn.004929b0
add esp, 4
call fcn.0046eb70
test al, al
je 0x45a55c
push 0
push 0xfa
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x45a55c
cmp byte [0x52e199], 0
push 0
sete al
mov byte [0x52e199], al
push 0
movzx eax, al
push eax
push esi
call fcn.0041e4c0
add esp, 0x10
mov byte [0x52e199], al
movzx eax, al
lea ecx, [edi + 0x40]
push 0
push eax
push 0x9c8c
call fcn.00462510
jmp 0x45a55c
push 0
push 0x49a300
push esi
push 0x4edda4
push dword [0x52e7d8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.default.0x45a292
push esi
call fcn.0048dc50
add esp, 4
test al, al
je case.default.0x45a292
push 0
push 0
push 0x9c54
lea ecx, [edi + 0x40]
call fcn.00462420
jmp case.default.0x45a292
push 0
call fcn.0046f590
add esp, 4
mov ecx, 0x52da90
push 0
call fcn.004271e0
call fcn.0046eb70
movzx eax, al
mov ecx, edi
push eax
push 0x9c52
call fcn.00461aa0
push ecx
mov ecx, esp
push 0x4e454c
call fcn.00433aa0
push esi
call fcn.00491750
add esp, 8
jmp case.default.0x45a292
mov eax, dword [ebp - 0x228]
mov byte [ebp - 0x418], 1
mov dword [ebp - 0x220], 0
test eax, eax
je 0x45a102
cmp byte [eax], 0
mov eax, dword [eax + 4]
sete byte [ebp - 0x418]
mov dword [ebp - 0x220], eax
push 0
push 0x9c8a
push 0x111
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x52e5d0
push 0x52e3c8
push dword [ebp - 0x418]
mov ecx, 0x52da90
push 0x517868
call fcn.00427b50
mov byte [ebp - 0x219], al
test al, al
je 0x45a167
push dword [ebp - 0x220]
push 0
push esi
call fcn.0046eee0
add esp, 0xc
mov byte [ebp - 0x219], al
push 0
push 0xfa
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.0046eb70
movzx eax, al
mov ecx, edi
push eax
push 0x9c52
call fcn.00461aa0
push ecx
mov ecx, esp
push 0x517868
call fcn.00433aa0
push esi
call fcn.00491750
movzx eax, byte [ebp - 0x219]
add esp, 8
jmp 0x45a55e
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0
push esi
push eax
call fcn.00464b40
add esp, 8
lea ecx, [ebp - 0x224]
mov dword [ebp - 4], 0x1f
call fcn.004a2a40
test eax, eax
jne 0x45a1de
lea ecx, [ebp - 0x224]
call fcn.00418440
jmp case.default.0x45a292
push 0
push 0x9c8a
push 0x111
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x4eddb0
push 0x4edddc
push 0
push 0x517868
mov ecx, 0x52da90
call fcn.00427b50
test al, al
je 0x45a228
push ecx
lea eax, [ebp - 0x224]
mov ecx, esp
push eax
call fcn.00453020
push esi
call fcn.0046f0f0
add esp, 8
call fcn.0046eb70
movzx eax, al
mov ecx, edi
push eax
push 0x9c52
call fcn.00461aa0
push ecx
mov ecx, esp
push 0x517868
call fcn.00433aa0
push esi
call fcn.00491750
add esp, 8
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 4], 0x20
test ecx, ecx
je case.default.0x45a292
call fcn.004a2a20
jmp case.default.0x45a292
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x45a55c
sub eax, 0xd102
cmp eax, 5
ja case.default.0x45a292
jmp dword [eax*4 + 0x45a704]
push 0x52da90
mov dword [ebp - 0x228], 0x52da90
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ecx, word [ebp + 0xc]
mov eax, 0xd101
cmp cx, ax
mov dword [ebp - 4], 0x14
sete al
movzx eax, al
push eax
lea eax, [edi + 0x16c]
push eax
push 0
push dword [edi + 0x416c]
jmp 0x45a510
mov eax, dword [0x52e3bc]
test eax, eax
je 0x45a2ff
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x52e3bc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x45a3a9
push 0x48
call fcn.004a71b8
add esp, 4
mov dword [ebp - 0x220], eax
test eax, eax
je 0x45a386
push 0x48
push 0
push eax
call fcn.004aa220
mov eax, dword [ebp - 0x220]
add esp, 0xc
mov dword [eax + 4], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov byte [eax + 0x3c], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0xffffffff
mov dword [eax + 0x38], 0xffffffff
mov dword [eax], vtable.CFilterDlg.0
mov dword [eax + 0x40], 0xb8
jmp 0x45a38e
xor eax, eax
mov dword [ebp - 0x220], eax
push 0
push esi
mov ecx, eax
call fcn.004544c0
mov eax, dword [ebp - 0x220]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x52da90
mov dword [ebp - 0x414], 0x52da90
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 1
lea eax, [edi + 0x16c]
mov dword [ebp - 4], 0x15
push eax
push 0
push dword [edi + 0x416c]
xorps xmm0, xmm0
lea ecx, [ebp - 0x3d8]
movups xmmword [ebp - 0x3d8], xmm0
movups xmmword [ebp - 0x3c8], xmm0
call fcn.004456c0
lea eax, [ebp - 0x3d8]
push eax
push 0
push 0x800d
push 0x418
push dword [0x52e3bc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x3d0]
mov byte [ebp - 4], 0x16
test ecx, ecx
je 0x45a545
call fcn.004a2a20
jmp 0x45a545
push 0x52da90
mov dword [ebp - 0x414], 0x52da90
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 1
lea eax, [edi + 0x16c]
mov dword [ebp - 4], 0x17
push eax
push 0
push dword [edi + 0x416c]
mov ecx, 0x52db40
call fcn.00423400
mov ecx, 0x52da90
call fcn.004298d0
push 0
push 0
push 0x800b
push dword [0x52e3c0]
jmp 0x45a53f
lea eax, [edi + 0x16c]
push eax
lea ecx, [ebp - 0x228]
call fcn.00433aa0
lea eax, [ebp - 0x228]
mov dword [ebp - 4], 0x18
push eax
push esi
call fcn.00466c80
add esp, 8
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 4], 0x19
test ecx, ecx
je case.default.0x45a292
call fcn.004a2a20
jmp case.default.0x45a292
push 0x52da90
mov dword [ebp - 0x228], 0x52da90
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ecx, word [ebp + 0xc]
lea eax, [edi + 0x216c]
push 0
push eax
xor eax, eax
mov dword [ebp - 4], 0x1a
mov edx, 0xd104
cmp cx, dx
setne al
add eax, 2
push eax
push 0x9c74
mov ecx, 0x52db14
call fcn.00423400
mov byte [ebp - 0x414], al
push dword [ebp - 0x414]
mov ecx, 0x52da90
call fcn.004291c0
push 0
push 0
push 0x800b
push dword [0x52e3bc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x52da90
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x41c]
mov dword [eax], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a71aa
mov esp, ebp
pop ebp
ret 0x10
hlt
push 1
push 0xc0000005
call fcn.0043fc90
nop
pushfd
add byte [ebp], 36
xchg ebp, eax
inc ebp
add byte [ecx - 0x60], cl
inc ebp
add byte [edx + 0x6b004598], dh
cwde
inc ebp
add byte [edi], cl
xchg edi, eax
inc ebp
add bh, dh
sahf
inc ebp
add byte [ebp - 0x80], bh
inc ebp
add ah, bh
popfd
inc ebp
add byte [edx + ecx*4 - 0x7c8cffbb], bh
inc ebp
add byte [edx - 0x6b], al
inc ebp
add byte [ecx], dh
xchg dword [ebp], eax
jb 0x45a560
inc ebp
add byte [edi - 0x60], ah
inc ebp
add byte [eax + 0x7f], al
inc ebp
add ch, dl
add byte [ebp], 0xd4
test byte [ebp], al
ret 0x4580