Function at 0x413ef0
Capabilities:
Copy file
Create process on windows
Create thread
Delete file
Hide graphical window
Read .ini file
Set registry value

Disassembly:
mov eax, 0x1a94
call fcn.004a5d20
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x1a8c], eax
push ebx
push ebp
push esi
push edi
cmp ecx, 0x2990
jg 0x414e37
je 0x414e2d
add ecx, 0xffffd84f
cmp ecx, 0x46
ja case.0x413f34.10176
movzx eax, byte [ecx + 0x414f9c]
jmp dword [eax*4 + 0x414f04]
push 0xc
push 0xf
push 0x4de958
push dword [0x4def88]
call fcn.00401149
jmp case.0x413f34.10176
push 0xe
jmp 0x413f3d
push 0xf
jmp 0x413f3d
push 0
push 0x462ed0
push dword [0x4def88]
push 0x4ae318
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
jmp case.0x413f34.10176
push 0
push 0x463190
jmp 0x413f63
cmp dword [0x4c5194], 0
je case.0x413f34.10176
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0x27b7
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 5
push 0x4f61
push dword [0x4def88]
call edi
push eax
call esi
mov dword [0x4c5194], 0
jmp case.0x413f34.10176
mov eax, dword [0x4dde94]
cmp eax, 1
jne 0x414001
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
jmp case.0x413f34.10176
cmp eax, 0x156
jl 0x41400f
cmp eax, 0x158
jle 0x41402d
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
push 1
push 0
push 0x1013
push 0x27c0
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SendMessageW]
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x423210
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.0x413f34.10176
mov eax, dword [0x4dde94]
cmp eax, 1
je 0x413fde
cmp eax, 0x156
jl 0x41408a
cmp eax, 0x158
jle 0x4140a8
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x423850
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.0x413f34.10176
lea eax, [esp + 0x88]
mov dword [0x4c5190], 1
push eax
push 0
push 0
push 0x423ee0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.0x413f34.10176
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 5
push 0x27b1
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 0
push 0x27b2
push dword [0x4def88]
call edi
push eax
call esi
mov dword [0x4c5190], 0
jmp case.0x413f34.10176
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x424f00
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.0x413f34.10176
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x4254c0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.0x413f34.10176
push 0
push 0x41a8b0
push dword [0x4def88]
push 0x4ade44
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
jmp case.0x413f34.10176
push 0
push 0x41abf0
push dword [0x4def88]
push 0x4ade44
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
jmp case.0x413f34.10176
mov edx, 0x4ae330
mov ecx, 0x27f2
call fcn.00401380
jmp case.0x413f34.10176
mov edx, 0x4ae350
mov ecx, 0x27f3
call fcn.00401380
jmp case.0x413f34.10176
push 0x4ded80
push 0
push 0x4ae028
push 0x4ae378
call dword [sym.imp.kernel32.dll_GetPrivateProfileIntW]
push 0x4ded80
test eax, eax
je 0x414206
push 0x4ad0e0
jmp 0x41420b
push 0x4ad0a4
push 0x4ae028
push 0x4ae378
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.0x413f34.10176
push 0x4ded80
push 0
push 0x4ae38c
push 0x4ae378
call dword [sym.imp.kernel32.dll_GetPrivateProfileIntW]
push 0x4ded80
test eax, eax
je 0x41425a
push 0x4ad0e0
push 0x4ae38c
push 0x4ae378
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.0x413f34.10176
push 0x4ad0a4
push 0x4ae38c
push 0x4ae378
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.0x413f34.10176
push 0x4ded80
push 0
push 0x4ae398
push 0x4ae378
call dword [sym.imp.kernel32.dll_GetPrivateProfileIntW]
push 0x4ded80
test eax, eax
je 0x4142ae
push 0x4ad0e0
push 0x4ae398
push 0x4ae378
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.0x413f34.10176
push 0x4ad0a4
push 0x4ae398
push 0x4ae378
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
jmp case.0x413f34.10176
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.004773a0
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push eax
lea eax, [esp + 0x94]
push eax
call esi
lea eax, [esp + 0x90]
mov edx, 0x4ad0e0
push 0x24
push eax
mov ecx, 0x4ad9cc
call fcn.004773a0
mov edi, dword [sym.imp.user32.dll_MessageBoxW]
push eax
push dword [0x4def88]
call edi
cmp eax, 6
jne case.0x413f34.10176
push 0x4def98
lea eax, [esp + 0xa9c]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0xa98]
push 0x4ae3a8
push eax
call esi
lea eax, [esp + 0xa98]
push eax
call fcn.00492273
mov ax, word [0x4ae3c8]
add esp, 4
movups xmm0, xmmword [0x4ae3b8]
mov word [esp + 0x2a8], ax
lea eax, [esp + 0x2aa]
push 0x7ee
push 0
push eax
movups xmmword [esp + 0x2a4], xmm0
call fcn.0048e770
add esp, 0xc
lea eax, [esp + 0xa98]
push 0xa
push 0x64
push eax
push 0
call fcn.004926bc
add esp, 4
push eax
call fcn.0048f5fe
add esp, 0x10
lea eax, [esp + 0xa98]
push eax
lea eax, [esp + 0x29c]
push eax
call esi
push 0x4ae3cc
lea eax, [esp + 0x29c]
push eax
call esi
push 0x4ae3d8
lea eax, [esp + 0x29c]
push eax
call esi
lea eax, [esp + 0x298]
mov dword [esp + 0x10], 0x3c
xorps xmm0, xmm0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
movlpd qword [esp + 0x34], xmm0
push eax
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
mov dword [esp + 0x18], 0x40
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x4addfc
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 5
mov dword [esp + 0x34], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [esp + 0x4c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea eax, [esp + 0x29e]
mov edx, 0x4ad374
push eax
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0xaa0]
push 0x400
push eax
call fcn.0040a370
add esp, 0x10
call fcn.0041b0e0
push 0x40
mov edx, 0x4ad370
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0xaa0]
push eax
push dword [0x4def88]
call edi
jmp case.0x413f34.10176
push 0x7fc
lea eax, [esp + 0xaa0]
mov dword [esp + 0xa9c], 0
push 0
push eax
call fcn.0048e770
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
lea eax, [esp + 0xaa4]
add esp, 0xc
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x54], 0
mov dword [esp + 0x64], 0x400
push eax
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27e1
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_SendMessageW]
push eax
call esi
push eax
push 0x1073
push 0x27e1
push dword [0x4def88]
call edi
push eax
call esi
cmp word [esp + 0xa98], 0
jne 0x414571
mov edx, 0x4ad08c
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4ad378
lea eax, [esp + 0x90]
mov ecx, 0x4ad9cc
push 0x30
push eax
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
jmp case.0x413f34.10176
push 0x4def98
lea eax, [esp + 0x29c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4ae3a8
lea eax, [esp + 0x29c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x298]
push eax
call fcn.00492273
add esp, 4
mov dword [esp + 0x10], 0x3c
lea eax, [esp + 0xa98]
mov dword [esp + 0x14], 0x40
xorps xmm0, xmm0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
movlpd qword [esp + 0x34], xmm0
push eax
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x4addfc
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 5
mov dword [esp + 0x34], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [esp + 0x4c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
call fcn.0041ba40
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x41c770
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.0x413f34.10176
call fcn.0041b2d0
jmp case.0x413f34.10176
push 0x27e1
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push 0x7fc
mov edi, eax
mov dword [esp + 0x29c], 0
lea eax, [esp + 0x2a0]
push 0
push eax
call fcn.0048e770
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
lea eax, [esp + 0x2a4]
add esp, 0xc
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x54], 0
mov dword [esp + 0x64], 0x400
push eax
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call ebx
push eax
push 0x1073
push edi
call ebx
cmp word [esp + 0x298], 0
jne 0x4146f0
mov edx, 0x4ad08c
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4ad0a0
jmp 0x41454b
push 0x4ded80
push 3
lea eax, [esp + 0x90]
push eax
push 0
push 0x4ae028
push 0x4ae378
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x88], 0x31
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
jne 0x41476b
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x94]
push eax
call esi
lea eax, [esp + 0x90]
mov edx, 0x4ad0d0
push 0x24
push eax
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
jne case.0x413f34.10176
push 0x4def98
lea eax, [esp + 0x129c]
push eax
call esi
push 0x4ae3a8
lea eax, [esp + 0x129c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x1298]
push eax
call fcn.00492273
add esp, 4
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je case.0x413f34.10176
mov ebp, 0x414
nop dword [eax]
lea eax, [esp + 0xa98]
mov dword [esp + 0x54], 0
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
push eax
push esi
push 0x1073
push edi
mov dword [esp + 0x74], 0x400
call ebx
xorps xmm0, xmm0
mov dword [esp + 0x28], 0
lea eax, [esp + 0xa98]
movq qword [esp + 0x20], xmm0
push eax
movups xmmword [esp + 0x14], xmm0
mov word [esp + 0x30], 0
call dword [sym.imp.kernel32.dll_lstrlenW]
xor ecx, ecx
cmp word [esp + eax*2 + 0xa96], 0x5c
jne 0x41482b
mov word [esp + eax*2 + 0xa96], cx
jmp 0x414833
mov word [esp + eax*2 + 0xa9a], cx
mov eax, dword [0x4def88]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xa98]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], 0
mov word [esp + 0x24], bp
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 0
push esi
push 0x1008
push edi
call ebx
push edi
call dword [sym.imp.user32.dll_UpdateWindow]
push 2
lea eax, [esi - 1]
push eax
push 0x100c
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4147c0
jmp case.0x413f34.10176
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x41b490
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.0x413f34.10176
push 0x27e2
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov edi, eax
push 0
push 0
push 0x1004
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x41490a
mov edx, 0x4ad0dc
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4ad0cc
jmp 0x41454b
push 0x4ded80
push 1
push 0x4ae028
push 0x4ae378
call dword [sym.imp.kernel32.dll_GetPrivateProfileIntW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
test eax, eax
je 0x414974
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x94]
push eax
call ebp
lea eax, [esp + 0x90]
mov edx, 0x4ad0d4
push 0x24
push eax
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
jne case.0x413f34.10176
push 0x4def98
lea eax, [esp + 0x129c]
push eax
call ebp
push 0x4ae418
lea eax, [esp + 0x129c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x1298]
push eax
call fcn.00492273
add esp, 4
xor eax, eax
mov word [esp + 0x298], ax
push 0x7fe
push eax
lea eax, [esp + 0x2a2]
push eax
call fcn.0048e770
mov ebp, dword [sym.imp.SHELL32.dll_SHFileOperationW]
add esp, 0xc
nop dword [eax]
lea eax, [esp + 0x298]
mov dword [esp + 0x54], 0
mov dword [esp + 0x60], eax
dec esi
lea eax, [esp + 0x4c]
mov dword [esp + 0x64], 0x400
push eax
push esi
push 0x1073
push edi
call ebx
xorps xmm0, xmm0
mov dword [esp + 0x28], 0
lea eax, [esp + 0x298]
movq qword [esp + 0x20], xmm0
push eax
movups xmmword [esp + 0x14], xmm0
mov word [esp + 0x30], 0
call dword [sym.imp.kernel32.dll_lstrlenW]
xor ecx, ecx
cmp word [esp + eax*2 + 0x296], 0x5c
jne 0x414a3c
mov word [esp + eax*2 + 0x296], cx
jmp 0x414a44
mov word [esp + eax*2 + 0x29a], cx
mov eax, dword [0x4def88]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x298]
mov dword [esp + 0x18], eax
mov eax, 0x454
mov word [esp + 0x20], ax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], 0
call ebp
push 0
push esi
push 0x1008
push edi
call ebx
test esi, esi
jne 0x4149d0
jmp case.0x413f34.10176
call fcn.0041b8a0
jmp case.0x413f34.10176
push 0x27e2
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push 0x7fc
mov edi, eax
mov dword [esp + 0xa9c], 0
lea eax, [esp + 0xaa0]
push 0
push eax
call fcn.0048e770
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
lea eax, [esp + 0xaa4]
add esp, 0xc
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x54], 0
mov dword [esp + 0x64], 0x400
push eax
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call ebx
push eax
push 0x1073
push edi
call ebx
cmp word [esp + 0xa98], 0
jne 0x414b3e
mov edx, 0x4ad08c
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4ad3dc
jmp 0x41454b
push 0x4ded80
push 1
push 0x4ae028
push 0x4ae378
call dword [sym.imp.kernel32.dll_GetPrivateProfileIntW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
cmp eax, 1
jne 0x414ba9
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
lea eax, [esp + 0x94]
push eax
call esi
lea eax, [esp + 0x90]
mov edx, 0x4ad0d4
push 0x24
push eax
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
jne case.0x413f34.10176
push 0x4def98
lea eax, [esp + 0x129c]
push eax
call esi
push 0x4ae418
lea eax, [esp + 0x129c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x1298]
push eax
call fcn.00492273
add esp, 4
xor eax, eax
mov word [esp + 0x298], ax
push 0x7fe
push eax
lea eax, [esp + 0x2a2]
push eax
call fcn.0048e770
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je case.0x413f34.10176
mov ebp, 0x414
nop word [eax + eax]
lea eax, [esp + 0x298]
mov dword [esp + 0x54], 0
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
push eax
push esi
push 0x1073
push edi
mov dword [esp + 0x74], 0x400
call ebx
xorps xmm0, xmm0
mov dword [esp + 0x28], 0
lea eax, [esp + 0x298]
movq qword [esp + 0x20], xmm0
push eax
movups xmmword [esp + 0x14], xmm0
mov word [esp + 0x30], 0
call dword [sym.imp.kernel32.dll_lstrlenW]
xor ecx, ecx
cmp word [esp + eax*2 + 0x296], 0x5c
jne 0x414c8b
mov word [esp + eax*2 + 0x296], cx
jmp 0x414c93
mov word [esp + eax*2 + 0x29a], cx
mov eax, dword [0x4def88]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x298]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], 0
mov word [esp + 0x24], bp
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 0
push esi
push 0x1008
push edi
call ebx
push 2
lea eax, [esi - 1]
push eax
push 0x100c
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x414c20
jmp case.0x413f34.10176
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movaps xmm0, xmmword [0x4c1390]
push eax
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x4c
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x4ae428
movups xmmword [esp + 0x28], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.0x413f34.10176
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27c4
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SendMessageW]
mov ecx, eax
call fcn.0041d6d0
jmp case.0x413f34.10176
lea eax, [esp + 0x88]
push eax
push 0
push 0
push fcn.0041ba40
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.0x413f34.10176
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27c9
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SendMessageW]
mov ecx, eax
call fcn.0041dbd0
jmp case.0x413f34.10176
push 0x27c0
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
xor edx, edx
mov ecx, eax
call fcn.0041de70
jmp case.0x413f34.10176
push 0x27d2
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
mov edx, 1
mov ecx, eax
call fcn.0041de70
jmp case.0x413f34.10176
call fcn.0041e1d0
call fcn.0041a450
jmp case.0x413f34.10176
call fcn.0041e630
call fcn.0041a520
jmp case.0x413f34.10176
call fcn.0041e920
jmp case.0x413f34.10176
call fcn.0041b0e0
jmp case.0x413f34.10176
sub ecx, 0x2991
je 0x414ee0
sub ecx, 0x3b
je case.0x413f34.10222
sub ecx, 0x2595
jne case.0x413f34.10176
mov eax, dword [0x4dde94]
cmp eax, 0x156
jl 0x414e6b
cmp eax, 0x158
jle 0x414e89
push 0
push 0x471080
push dword [0x4def88]
push 0x4ade14
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0x4f61
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push 5
push 0x27b7
push dword [0x4def88]
call edi
push eax
call esi
lea eax, [esp + 0x88]
mov dword [0x4c5194], 1
push eax
push 0
push 0
push 0x41ed80
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.0x413f34.10176
call fcn.0041add0
mov ecx, dword [esp + 0x1a9c]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x1a94
ret