Function at 0x413688
Capabilities:
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4898e5
mov eax, dword fs:[0]
push eax
sub esp, 0x318
mov eax, dword [0x4b701c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x314], edi
lea eax, [ebp - 0x30c]
xorps xmm0, xmm0
push eax
push dword [edi + 4]
movups xmmword [ebp - 0x30c], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [edi + 0x66c]
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0x69c], eax
test esi, esi
je 0x41278c
mov al, byte [esi + 0x2c]
mov byte [ebp - 0x30d], al
mov eax, dword [esi + 0x50]
mov byte [esi + 0x2c], 0
test eax, eax
je 0x41277a
push 0
push 0
push 0x401
push dword [eax]
call ebx
cmp byte [ebp - 0x30d], 0
je 0x41278c
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x24]
push 1
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [edi + 0x69c]
cmp eax, 0xa
ja case.default.0x4127a8
jmp dword [eax*4 + 0x413d34]
push 0
push dword [edi + 0x670]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x2c0]
call fcn.004199f5
sub esp, 0xc
mov dword [ebp - 4], 0
push 0xc8
push ecx
lea ecx, [ebp - 0x2c0]
call fcn.00419c6d
mov eax, dword [edi + 0x668]
push 1
sub esp, 0x34
mov ecx, esp
mov dword [eax + 0x28], 0
lea eax, [ebp - 0x2c0]
push eax
call fcn.00408c10
mov ecx, dword [edi + 0x668]
call fcn.0041fd8b
call fcn.004164c0
mov esi, dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x60
push dword [eax + 4]
push 0x8c
call esi
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x304]
sub eax, dword [ebp - 0x30c]
mov dword [ebp - 0x31c], eax
call fcn.004164c0
push 0x60
push dword [eax]
push 0x60
call esi
mov dword [ebp - 0x320], eax
call fcn.004164c0
push 0x60
push dword [eax]
push 0x60
call esi
mov ebx, eax
call fcn.004164c0
push 0x60
push dword [eax + 4]
push 0x2c
call esi
mov esi, dword [ebp - 0x304]
mov edi, eax
sub esi, dword [ebp - 0x30c]
call fcn.004164c0
push 0x60
push dword [eax]
push 0x60
call dword [sym.imp.KERNEL32.dll_MulDiv]
sub esi, eax
mov dword [ebp - 0x21c], edi
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x31c]
sub eax, dword [ebp - 0x320]
cdq
sub eax, edx
lea edx, [ebp - 0x220]
sar eax, 1
add eax, ebx
mov ebx, dword [ebp - 0x314]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x214], eax
mov ecx, dword [ebx + 0x668]
push 0
push edx
mov eax, dword [ecx]
call dword [eax + 0x14]
mov esi, dword [ebx + 0x668]
mov al, byte [esi + 0x2c]
mov byte [ebp - 0x30d], al
mov eax, dword [esi + 0x50]
mov byte [esi + 0x2c], 1
test eax, eax
je 0x41290c
push 0
push 1
push 0x401
push dword [eax]
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
call eax
cmp byte [ebp - 0x30d], 1
je 0x41291e
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x24]
lea ecx, [ebp - 0x28c]
call fcn.004199f5
push 0x4a4c78
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
call fcn.00404500
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 2
push eax
push 0xe1
push 0
lea ecx, [ebp - 0x28c]
call fcn.00419acc
lea ecx, [ebp - 0x240]
call fcn.004087f0
mov eax, dword [ebx + 0x694]
lea ecx, [ebp - 0x2fc]
push 0
push 0xf
mov dword [eax + 0x28], 0
lea eax, [ebp - 0x28c]
push eax
call fcn.00408ba0
mov byte [ebp - 4], 3
mov ecx, dword [ebx + 0x694]
push eax
call fcn.0041a4d8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2fc]
test ecx, ecx
je 0x4129b5
dec dword [ecx + 4]
cmp dword [ecx + 4], 0
jg 0x4129b5
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebx + 0x694]
push dword [ebx + 4]
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x28c]
call fcn.00419d57
lea esi, [eax + 0x98]
call fcn.004164c0
push 0x60
push dword [eax + 4]
push esi
call dword [sym.imp.KERNEL32.dll_MulDiv]
lea ecx, [ebp - 0x28c]
mov ebx, eax
call fcn.00419d2b
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov esi, edx
add edx, 0x7b
shr esi, 0x1f
add esi, edx
call fcn.004164c0
push 0x60
push dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MulDiv]
call esi
mov edi, eax
call fcn.004164c0
push 0x60
push dword [eax + 4]
push 0x98
call esi
mov esi, eax
call fcn.004164c0
push 0x60
push dword [eax]
push 0x7b
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x21c], esi
lea edx, [ebp - 0x220]
mov esi, dword [ebp - 0x314]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x214], ebx
mov ecx, dword [esi + 0x694]
push 0
push edx
mov eax, dword [ecx]
call dword [eax + 0x14]
mov edi, dword [esi + 0x694]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov al, byte [edi + 0x2c]
mov byte [ebp - 0x30d], al
mov eax, dword [edi + 0x50]
mov byte [edi + 0x2c], 1
test eax, eax
je 0x412aa1
push 0
push 1
push 0x401
push dword [eax]
call ebx
cmp byte [ebp - 0x30d], 1
je 0x412ab3
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x24]
mov esi, dword [esi + 0x694]
mov ecx, esi
push 0x32
call fcn.0041b7fa
mov al, byte [esi + 0x2c]
mov byte [ebp - 0x30d], al
mov eax, dword [esi + 0x50]
mov byte [esi + 0x2c], 1
test eax, eax
je 0x412ae3
push 0
push 1
push 0x401
push dword [eax]
call ebx
cmp byte [ebp - 0x30d], 1
je 0x412af5
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x24]
call fcn.004164c0
mov esi, dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x60
push dword [eax + 4]
push 0x28
call esi
mov ebx, eax
call fcn.004164c0
push 0x60
push dword [eax]
push 0x8c
call esi
mov edi, eax
call fcn.004164c0
push 0x60
push dword [eax + 4]
push 0x9a
call esi
mov esi, eax
call fcn.004164c0
push 0x60
push dword [eax]
push 0xa7
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 1
push ebx
mov ebx, dword [ebp - 0x314]
push edi
push esi
push eax
push dword [ebx + 0x678]
call dword [sym.imp.USER32.dll_MoveWindow]
push dword [0x4b8f44]
push dword [ebx + 0x678]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [0x4bc908]
push 0x30
push dword [ebx + 0x678]
call eax
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [ebx + 0x678]
call edi
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x218], eax
call fcn.004164c0
push 0x60
push dword [eax + 4]
push 0x27
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [ebp - 0x300]
mov ecx, edx
sub ecx, eax
mov dword [ebp - 0x214], edx
push ecx
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], ecx
push eax
lea ecx, [ebx + 0x47c]
call fcn.004190c0
mov eax, dword [0x4bc8f8]
lea ecx, [ebx + 0x478]
mov dword [ebx + 0x660], 2
mov dword [ebx + 0x65c], 1
mov dword [ebx + 0x664], eax
push dword [0x4b8574]
call fcn.0041da5c
push 5
push dword [ebx + 0x47c]
call edi
push dword [ebx + 0x47c]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0x28c]
test ecx, ecx
je 0x412c47
dec dword [ecx + 4]
cmp dword [ecx + 4], 0
jg 0x412c47
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0x2c0]
test ecx, ecx
je case.default.0x4127a8
dec dword [ecx + 4]
cmp dword [ecx + 4], 0
jg case.default.0x4127a8
mov eax, dword [ecx]
push 1
call dword [eax]
jmp case.default.0x4127a8
mov esi, dword [edi + 0x694]
mov ecx, esi
call fcn.0041b758
mov al, byte [esi + 0x2c]
mov byte [ebp - 0x30d], al
mov eax, dword [esi + 0x50]
mov byte [esi + 0x2c], 0
test eax, eax
je 0x412c9b
push 0
push 0
push 0x401
push dword [eax]
call ebx
cmp byte [ebp - 0x30d], 0
je 0x412cad
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x24]
call fcn.004164c0
mov edi, dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x60
push dword [eax + 4]
push 0x19
call edi
mov ebx, eax
mov eax, dword [ebp - 0x304]
sub eax, dword [ebp - 0x30c]
mov dword [ebp - 0x318], eax
call fcn.004164c0
push 0x60
push dword [eax + 4]
push 0x95
call edi
mov esi, eax
call fcn.004164c0
push 0x60
push dword [eax]
push 0
call edi
push 1
push ebx
push dword [ebp - 0x318]
mov ebx, dword [ebp - 0x314]
push esi
push eax
push dword [ebx + 0x678]
call dword [sym.imp.USER32.dll_MoveWindow]
push dword [0x4b8fdc]
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebx + 0x678]
call esi
push dword [0x4b8fe4]
push dword [ebx + 0x684]
call esi
push 5
push dword [ebx + 0x684]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4b859c]
lea ecx, [ebx + 0x478]
call fcn.0041da5c
jmp case.default.0x4127a8
mov esi, dword [edi + 0x694]
mov ecx, esi
call fcn.0041b758
mov al, byte [esi + 0x2c]
mov byte [ebp - 0x30d], al
mov eax, dword [esi + 0x50]
mov byte [esi + 0x2c], 0
test eax, eax
je 0x412d86
push 0
push 0
push 0x401
push dword [eax]
call ebx
cmp byte [ebp - 0x30d], 0
je 0x412d98
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x24]
call fcn.004164c0
mov edi, dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x60
push dword [eax + 4]
push 0x19
call edi
mov ebx, eax
mov eax, dword [ebp - 0x304]
sub eax, dword [ebp - 0x30c]
mov dword [ebp - 0x318], eax
call fcn.004164c0
push 0x60
push dword [eax + 4]
push 0x95
call edi
mov esi, eax
call fcn.004164c0
push 0x60
push dword [eax]
push 4
call edi
push 1
push ebx
push dword [ebp - 0x318]
mov ebx, dword [ebp - 0x314]
push esi
push eax
push dword [ebx + 0x678]
call dword [sym.imp.USER32.dll_MoveWindow]
push dword [0x4b8f4c]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebx + 0x678]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebx + 0x670]
call esi
call fcn.0043c950
lea eax, [ebp - 0x240]
push eax
call fcn.0043e7b0
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00455ce0
cmp dword [ebp - 0x22c], 8
lea eax, [ebp - 0x240]
cmovae eax, dword [ebp - 0x240]
push eax
push dword [0x4b8fd4]
lea eax, [ebp - 0x210]
push 0x100
push eax
call fcn.00409fc0
add esp, 0x1c
lea eax, [ebp - 0x210]
push eax
push dword [ebx + 0x684]
call edi
push 5
push dword [ebx + 0x684]
call esi
push dword [0x4b857c]
lea ecx, [ebx + 0x478]
call fcn.0041da5c
lea ecx, [ebp - 0x240]
call fcn.004087f0
jmp case.default.0x4127a8
mov esi, dword [edi + 0x694]
mov ecx, esi
call fcn.0041b758
mov al, byte [esi + 0x2c]
mov byte [ebp - 0x30d], al
mov eax, dword [esi + 0x50]
mov byte [esi + 0x2c], 0
test eax, eax
je 0x412edc
push 0
push 0
push 0x401
push dword [eax]
call ebx
cmp byte [ebp - 0x30d], 0
je 0x412eee
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x24]
mov esi, dword [edi + 0x668]
mov al, byte [esi + 0x2c]
mov byte [ebp - 0x30d], al
mov eax, dword [esi + 0x50]
mov byte [esi + 0x2c], 0
test eax, eax
je 0x412f15
push 0
push 0
push 0x401
push dword [eax]
call ebx
cmp byte [ebp - 0x30d], 0
je 0x412f27
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x24]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x678]
call ebx
cmp dword [edi + 0x6a0], 1
mov eax, dword [0x4b8f64]
cmove eax, dword [0x4b8f6c]
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
push dword [edi + 0x670]
call esi
push 5
push dword [edi + 0x670]
call ebx
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00455ce0
lea eax, [edi + 0x6bc]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x412f87
mov eax, dword [eax]
push eax
push dword [0x4b8fcc]
lea eax, [ebp - 0x210]
push 0x100
push eax
call fcn.00409fc0
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push dword [edi + 0x680]
call esi
push 5
push dword [edi + 0x680]
call ebx
lea eax, [edi + 0x74c]
push eax
lea ecx, [ebp - 0x240]
call fcn.00404570
push 0x4a54b8
lea ecx, [ebp - 0x258]
mov dword [ebp - 4], 4
call fcn.00404500
push 0x4a54bc
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 5
call fcn.00404500
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 6
push eax
lea edx, [ebp - 0x228]
lea ecx, [ebp - 0x240]
call fcn.0040fba0
add esp, 4
lea ecx, [ebp - 0x228]
call fcn.004087f0
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 4
call fcn.004087f0
push 0x4a54bc
lea ecx, [ebp - 0x228]
call fcn.00404500
push 0x4a54b8
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 7
call fcn.00404500
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 8
push eax
lea edx, [ebp - 0x258]
lea ecx, [ebp - 0x240]
call fcn.0040fba0
add esp, 4
lea ecx, [ebp - 0x258]
call fcn.004087f0
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 4
call fcn.004087f0
cmp dword [ebp - 0x22c], 8
lea eax, [ebp - 0x240]
cmovae eax, dword [ebp - 0x240]
push eax
push dword [edi + 0x688]
call esi
push 5
push dword [edi + 0x688]
call ebx
mov ecx, edi
call fcn.00414e40
cmp dword [edi + 0x6a0], 1
jne 0x41316c
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x218], eax
call fcn.004164c0
push 0x60
push dword [eax + 4]
push 0x27
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [ebp - 0x300]
lea esi, [edi + 0x47c]
mov ecx, edx
mov dword [ebp - 0x214], edx
sub ecx, eax
lea eax, [ebp - 0x220]
push ecx
mov dword [ebp - 0x21c], ecx
mov ecx, esi
push eax
call fcn.004190c0
mov eax, dword [0x4bc8f8]
lea ecx, [edi + 0x478]
mov dword [edi + 0x660], 2
mov dword [edi + 0x65c], 1
mov dword [edi + 0x664], eax
push dword [0x4b8f84]
call fcn.0041da5c
push dword [esi]
call dword [sym.imp.USER32.dll_SetFocus]
push 5
push dword [esi]
call ebx
lea ecx, [ebp - 0x240]
call fcn.004087f0
jmp case.default.0x4127a8
push 5
push dword [edi + 0x68c]
call ebx
mov ecx, dword [ebp - 0x30c]
mov eax, dword [ebp - 0x304]
sub eax, ecx
mov dword [ebp - 0x220], ecx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x218], eax
call fcn.004164c0
push 0x60
push dword [eax + 4]
push 0x27
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ebx, dword [ebp - 0x300]
mov edi, ebx
mov esi, dword [ebp - 0x314]
sub edi, eax
push ecx
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], edi
push eax
lea ecx, [esi + 0x28c]
mov dword [ebp - 0x214], ebx
call fcn.004190c0
mov eax, dword [0x4bc8f8]
mov ecx, esi
mov dword [ecx + 0x470], 6
mov dword [ecx + 0x46c], 1
mov dword [ecx + 0x474], eax
add ecx, 0x288
push dword [0x4b8f84]
call fcn.0041da5c
push 5
push dword [esi + 0x28c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x28c]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x214], ebx
mov ebx, esi
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x220]
push ecx
lea esi, [ebx + 0x47c]
mov dword [ebp - 0x21c], edi
push eax
mov ecx, esi
call fcn.004190c0
mov eax, dword [0x4bc8f8]
lea ecx, [ebx + 0x478]
mov dword [ebx + 0x660], 2
mov dword [ebx + 0x65c], 0
mov dword [ebx + 0x664], eax
push dword [0x4b8fac]
call fcn.0041da5c
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [esi]
call ebx
lea ecx, [ebp - 0x240]
call fcn.004087f0
jmp case.default.0x4127a8
mov eax, dword [edi + 0x6a0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
cmp eax, 4
je 0x4132c5
cmp eax, 5
jne 0x4132da
mov ecx, dword [edi + 0x694]
call fcn.0041a510
push 0
push dword [edi + 0x678]
call esi
mov ecx, dword [edi + 0x668]
mov dword [ebp - 0x318], ecx
mov al, byte [ecx + 0x2c]
mov byte [ebp - 0x30d], al
mov eax, dword [ecx + 0x50]
mov byte [ecx + 0x2c], 1
test eax, eax
je 0x41330d
push 0
push 1
push 0x401
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x318]
cmp byte [ebp - 0x30d], 1
je 0x41331d
mov eax, dword [ecx]
push 0
call dword [eax + 0x24]
push 0
push dword [edi + 0x670]
call esi
push 0
push dword [edi + 0x680]
call esi
cmp dword [edi + 0x690], 0
je 0x41347c
call fcn.004164c0
mov esi, dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x60
push dword [eax + 4]
push 0xa7
call esi
mov ebx, eax
call fcn.004164c0
push 0x60
push dword [eax]
push 0x1b
call esi
mov edi, eax
call fcn.004164c0
push 0x60
push dword [eax + 4]
push 0xa2
call esi
mov esi, eax
call fcn.004164c0
push 0x60
push dword [eax]
push 0x1b
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x220], eax
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0x304]
sub eax, edi
mov dword [ebp - 0x21c], esi
mov edi, dword [ebp - 0x314]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], ebx
push 0
mov ecx, dword [edi + 0x690]
push edx
mov eax, dword [ecx]
call dword [eax + 0x14]
mov esi, dword [edi + 0x690]
cmp dword [esi + 0x60], 0x64
ja 0x4133e4
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0x64
mov esi, dword [edi + 0x690]
mov eax, dword [edi + 0x7f0]
mov ecx, dword [esi + 0x60]
cmp eax, ecx
je 0x413448
sub eax, ecx
mov byte [esi + 0x69], 1
mov ebx, eax
cdq
xor eax, edx
shr ebx, 0x1f
sub eax, edx
mov byte [esi + 0x68], bl
cdq
idiv dword [esi + 0x5c]
mov dword [esi + 0x64], eax
test edx, edx
je 0x413413
inc eax
mov dword [esi + 0x64], eax
mov edx, dword [esi + 0x5c]
mov eax, dword [esi + 0x58]
neg edx
test bl, bl
cmove edx, dword [esi + 0x5c]
add edx, ecx
mov dword [esi + 0x60], edx
cmp edx, eax
jg 0x413433
cmp edx, dword [esi + 0x54]
mov eax, edx
cmovl eax, dword [esi + 0x54]
mov dword [esi + 0x60], eax
mov ecx, esi
mov eax, dword [esi]
push 0
call dword [eax + 0x24]
dec dword [esi + 0x64]
mov esi, dword [edi + 0x690]
mov eax, dword [esi + 0x50]
mov bl, byte [esi + 0x2c]
mov byte [esi + 0x2c], 1
test eax, eax
je 0x413468
push 0
push 1
push 0x401
push dword [eax]
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
call eax
cmp bl, 1
je 0x413476
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x24]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4b8f54]
push dword [edi + 0x67c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 5
push dword [edi + 0x67c]
call esi
push 0
push dword [edi + 0x688]
call esi
push 0
push dword [edi + 0x68c]
call esi
push 0
push dword [edi + 0x28c]
call esi
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x218], eax
call fcn.004164c0
push 0x60
push dword [eax + 4]
push 0x27
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [ebp - 0x300]
mov ecx, edx
sub ecx, eax
mov dword [ebp - 0x214], edx
push ecx
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], ecx
push eax
lea ecx, [edi + 0x47c]
call fcn.004190c0
mov dword [edi + 0x660], 2
lea ecx, [edi + 0x478]
push dword [0x4b8574]
call fcn.0041da5c
push 5
push dword [edi + 0x47c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0x47c]
call dword [sym.imp.USER32.dll_SetFocus]
push 1
mov ecx, edi
call fcn.004142e0
jmp case.default.0x4127a8
cmp byte [edi + 0x7fe], 0
mov ecx, dword [ebp - 0x30c]
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x220], ecx
jne 0x41356e
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x31c], eax
call fcn.004164c0
push 0x60
push dword [eax + 4]
push 0x27
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ebx, dword [ebp - 0x300]
mov edi, ebx
mov esi, dword [ebp - 0x314]
sub edi, eax
push ecx
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], edi
push eax
lea ecx, [esi + 0x28c]
mov dword [ebp - 0x214], ebx
call fcn.004190c0
mov eax, esi
mov dword [eax + 0x470], 6
lea ecx, [eax + 0x288]
mov dword [eax + 0x46c], 0
push dword [0x4b8ff4]
call fcn.0041da5c
push 5
push dword [esi + 0x28c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x214], ebx
mov ebx, esi
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x220]
push ecx
push eax
lea ecx, [ebx + 0x47c]
mov dword [ebp - 0x21c], edi
call fcn.004190c0
push dword [0x4b8574]
lea ecx, [ebx + 0x478]
call fcn.0041da5c
push dword [0x4b8fec]
lea ecx, [ebx + 0x478]
call fcn.0041da5c
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [ebx + 0x47c]
call esi
push dword [0x4b8fb4]
push dword [ebx + 0x67c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 5
push dword [ebx + 0x67c]
call esi
push dword [ebx + 0x67c]
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.default.0x4127a8
cmp byte [edi + 0x7fe], 0
mov ecx, 0x1538
mov eax, 0x12f8
cmovne eax, ecx
push dword [eax + 0x4b7c64]
push dword [edi + 0x67c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 5
push dword [edi + 0x67c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [edi + 0x690]
test esi, esi
je 0x4136f9
mov al, byte [esi + 0x2c]
mov byte [ebp - 0x30d], al
mov eax, dword [esi + 0x50]
mov byte [esi + 0x2c], 1
test eax, eax
je 0x4136e7
push 0
push 1
push 0x401
push dword [eax]
call ebx
cmp byte [ebp - 0x30d], 1
je 0x4136f9
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x24]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x28c]
call ebx
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x218], eax
call fcn.004164c0
push 0x60
push dword [eax + 4]
push 0x27
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [ebp - 0x300]
mov ecx, edx
sub ecx, eax
mov dword [ebp - 0x214], edx
push ecx
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], ecx
push eax
lea ecx, [edi + 0x47c]
call fcn.004190c0
push dword [0x4b8574]
lea ecx, [edi + 0x478]
call fcn.0041da5c
push 0
push dword [edi + 0x47c]
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
push dword [edi + 0x47c]
call ebx
push 0
mov ecx, edi
call fcn.004142e0
cmp byte [edi + 0x7fe], 0
je case.default.0x4127a8
mov ecx, dword [edi + 0x7f8]
test ecx, ecx
je 0x4137d3
call fcn.0040bbc0
mov eax, dword [edi + 0x7f8]
test eax, eax
je 0x4137c9
cmp dword [eax + 4], 0
jne 0x413cff
push 8
push eax
call fcn.00453c42
add esp, 8
mov dword [edi + 0x7f8], 0
push 8
call fcn.004585d6
mov esi, eax
add esp, 4
test esi, esi
je 0x413d04
mov dword [ebp - 0x318], esi
push 8
mov dword [ebp - 4], 9
call fcn.004585d6
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x413d15
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], 0x412280
mov dword [ebp - 0x320], ecx
lea ebx, [esi + 4]
mov byte [ebp - 4], 0xa
push ebx
push 0
push ecx
push 0x4187b0
push 0
push 0
call fcn.00463244
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x413d26
mov dword [edi + 0x7f8], esi
jmp case.default.0x4127a8
mov esi, dword [edi + 0x690]
test esi, esi
je 0x413888
mov al, byte [esi + 0x2c]
mov byte [ebp - 0x30d], al
mov eax, dword [esi + 0x50]
mov byte [esi + 0x2c], 0
test eax, eax
je 0x413876
push 0
push 0
push 0x401
push dword [eax]
call ebx
cmp byte [ebp - 0x30d], 0
je 0x413888
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x24]
mov eax, dword [ebp - 0x304]
mov esi, dword [ebp - 0x30c]
sub eax, esi
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov dword [ebp - 0x31c], ebx
call fcn.004164c0
push 0x60
push dword [eax + 4]
push 0x27
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [ebp - 0x300]
sub ebx, esi
mov edx, ecx
mov dword [ebp - 0x318], ecx
sub edx, eax
push 1
sub ecx, edx
mov dword [ebp - 0x320], edx
push ecx
push ebx
push edx
push esi
push dword [edi + 0x28c]
mov edi, dword [sym.imp.USER32.dll_MoveWindow]
call edi
mov ebx, dword [ebp - 0x314]
push 0
push 0
mov dword [ebx + 0x470], 6
mov dword [ebx + 0x46c], 0
push dword [ebx + 0x28c]
mov esi, dword [0x4b8ff4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push esi
push dword [ebx + 0x28c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x4bc8f8]
push 5
push dword [ebx + 0x28c]
mov dword [ebx + 0x474], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x320]
mov eax, dword [ebp - 0x318]
mov edx, dword [ebp - 0x31c]
sub eax, ecx
mov esi, dword [ebp - 0x314]
mov bl, byte [ebx + 0x7fe]
push 1
push eax
mov eax, dword [ebp - 0x304]
sub eax, edx
push eax
push ecx
push edx
push dword [esi + 0x47c]
call edi
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
test bl, bl
mov ebx, dword [ebp - 0x314]
mov ecx, 0x1388
push 0
mov eax, 0x910
cmove eax, ecx
push 0
push dword [ebx + 0x47c]
mov esi, dword [eax + 0x4b7c64]
call edi
push esi
push dword [ebx + 0x47c]
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
call esi
mov eax, dword [0x4bc8f8]
push 5
push dword [ebx + 0x47c]
mov dword [ebx + 0x660], 2
mov dword [ebx + 0x65c], 0
mov dword [ebx + 0x664], eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x258]
mov ecx, ebx
push eax
call 0x413d60
cmp dword [eax + 0x14], 8
jb 0x4139ee
mov eax, dword [eax]
push eax
push dword [ebx + 0x67c]
call esi
lea ecx, [ebp - 0x258]
call fcn.004087f0
push 5
push dword [ebx + 0x67c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 0x67c]
call dword [sym.imp.USER32.dll_SetFocus]
push 1
push dword [ebx + 0x47c]
call dword [sym.imp.USER32.dll_EnableWindow]
push 1
mov ecx, ebx
call fcn.004142e0
push 1
push 0
push dword [ebx + 4]
call edi
jmp case.default.0x4127a8
push dword [0x4b7c8c]
push dword [edi + 0x67c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 5
push dword [edi + 0x67c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [edi + 0x690]
test esi, esi
je 0x413a9e
mov al, byte [esi + 0x2c]
mov byte [ebp - 0x30d], al
mov eax, dword [esi + 0x50]
mov byte [esi + 0x2c], 0
test eax, eax
je 0x413a8c
push 0
push 0
push 0x401
push dword [eax]
call ebx
cmp byte [ebp - 0x30d], 0
je 0x413a9e
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x24]
push 1
mov ecx, edi
call fcn.004142e0
mov eax, dword [edi + 0x6a0]
cmp eax, 8
je 0x413b4d
cmp eax, 9
je 0x413b4d
cmp byte [edi + 0x7fc], 0
je 0x413b39
cmp byte [edi + 0x7fd], 0
je 0x413b39
cmp byte [edi + 0x7fe], 0
jne 0x413b39
lea eax, [ebp - 0x30d]
mov byte [ebp - 0x30d], 0
push eax
call fcn.00412640
test al, al
je 0x413b39
mov esi, dword [edi + 0x6a0]
call fcn.0043c950
mov ecx, dword [eax + 0x16c]
test ecx, ecx
je 0x413b24
movzx eax, byte [ebp - 0x30d]
mov edx, dword [ecx]
push 0
push 0
push str.after_install
push eax
push esi
push 0
push 0x7dc
call dword [edx + 4]
push 0xa
mov ecx, edi
mov byte [edi + 0x7fe], 1
call fcn.004126f0
jmp case.default.0x4127a8
push 0
push 0x66
push 0x66
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp case.default.0x4127a8
mov al, byte [edi + 0x7ff]
test al, al
je 0x413b6f
push dword [0x4b9194]
push dword [edi + 0x67c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov al, byte [edi + 0x7ff]
mov ecx, dword [ebp - 0x30c]
mov dword [ebp - 0x220], ecx
test al, al
je 0x413b90
mov eax, dword [ebp - 0x304]
sub eax, ecx
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
jmp 0x413b96
mov ebx, dword [ebp - 0x304]
mov dword [ebp - 0x218], ebx
call fcn.004164c0
push 0x60
push dword [eax + 4]
push 0x27
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [ebp - 0x300]
mov ecx, edx
sub ecx, eax
mov dword [ebp - 0x320], edx
push ecx
lea eax, [ebp - 0x220]
mov dword [ebp - 0x318], ecx
mov dword [ebp - 0x21c], ecx
lea ecx, [edi + 0x28c]
push eax
mov dword [ebp - 0x214], edx
call fcn.004190c0
cmp byte [edi + 0x7ff], 0
mov ecx, 0x1528
mov eax, 0x938
mov dword [edi + 0x470], 6
cmovne eax, ecx
mov dword [edi + 0x46c], 0
lea ecx, [edi + 0x288]
push dword [eax + 0x4b7c64]
call fcn.0041da5c
mov eax, dword [0x4bc8f8]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [edi + 0x28c]
mov dword [edi + 0x474], eax
call esi
cmp byte [edi + 0x7ff], 0
lea ecx, [edi + 0x47c]
je 0x413ccb
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x220]
push ecx
push eax
mov dword [ebp - 0x220], ebx
call fcn.004190c0
mov eax, dword [0x4bc8f8]
lea ecx, [edi + 0x478]
mov dword [edi + 0x660], 2
mov dword [edi + 0x65c], 0
mov dword [edi + 0x664], eax
push dword [0x4b859c]
call fcn.0041da5c
push 5
push dword [edi + 0x47c]
call esi
push 1
push dword [edi + 0x47c]
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.default.0x4127a8
push 0
push dword [ecx]
call esi
jmp case.default.0x4127a8
lea eax, [ebp - 0x30c]
mov ecx, edi
push eax
call fcn.00414fe0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00453c11
mov esp, ebp
pop ebp
ret 4
call fcn.0045d807
push 0x4b34a8
lea eax, [ebp - 0x30d]
push eax
call fcn.00456e9d
push 0x4b34a8
lea eax, [ebp - 0x321]
push eax
call fcn.00456e9d
push 6
mov dword [ebx], 0
call fcn.004527e7
nop
scasd eax, dword es:[edi]
daa
inc ecx
add byte [ebp + 0x2c], ch
inc ecx
add byte [eax + 0x2d], bl
inc ecx
add byte [esi - 0x50ffbed2], ch
xor al, byte [ecx]
dec esp
xor eax, 914882625
inc ecx
add byte [ebx + 0x38], cl
inc ecx
add byte [ebx + 0x38], cl
inc ecx
add byte [ecx + 0x3a], al
inc ecx
add bl, dl
cmp al, 0x41
add byte [ebp - 0x75], dl
in al, dx
push 0xffffffffffffffff
push 0x489938
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4b701c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x69c], 8
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], esi
je 0x413ddd
mov edx, dword [0x4b8ffc]
xor eax, eax
mov ecx, edx
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413dc0
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00408440
jmp 0x413f5c
cmp byte [edi + 0x7fe], 0
je 0x413e98
push 0x16
xor eax, eax
mov dword [ebp - 0x28], 0
push str.FlashHelperService.exe
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00408440
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
lea ecx, [ebp - 0x34]
call fcn.00404330
push fcn.004087f0
push 1
push 0x18
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
call fcn.00453ea1
lea ecx, [ebp - 0x34]
call fcn.00423fa6
test eax, eax
je 0x413e56
lea ecx, [ebp - 0x34]
call fcn.00424028
cmp byte [edi + 0x800], 0
mov ecx, esi
jne 0x413e80
mov byte [edi + 0x800], 1
push dword [0x4b91bc]
call fcn.00404500
lea ecx, [ebp - 0x34]
call fcn.00404690
jmp 0x413f5c
push dword [0x4b91c4]
call fcn.00404500
lea ecx, [ebp - 0x34]
call fcn.00404690
jmp 0x413f5c
push str.mutex_qqbrowser
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov edi, eax
test edi, edi
jne 0x413ecd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x413ecd
push dword [0x4b8fbc]
mov ecx, esi
call fcn.00404500
jmp 0x413f5c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x4b91ac]
lea ecx, [ebp - 0x28]
call fcn.00404500
mov dword [ebp - 4], 3
call fcn.0043c950
mov edx, dword [eax + 0x170]
cmp edx, 0xf
ja 0x413f1d
mov edx, dword [edx*4 + 0x4a9ae8]
test edx, edx
je 0x413f1d
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413f10
jmp 0x413f3b
mov edx, dword [0x4b91b4]
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413f30
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00404760
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004085f0
lea ecx, [ebp - 0x28]
call fcn.004087f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00453c11
mov esp, ebp
pop ebp
ret 4