Function at 0x402503
Capabilities:
Accept command line arguments
Create process on windows
Enumerate gui resources
Get file attributes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
jl 0x402b40
cmp eax, 0x200
jg 0x40253c
cmp dword [0x405b7c], ebx
jne 0x40255d
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, ebx
je 0x40255d
mov dword [0x405240], eax
jmp 0x40255d
cmp eax, 0x201
je 0x4031fc
cmp eax, 0x207
je 0x4031fc
cmp eax, 0x204
je 0x4031fc
test byte [ebp + 0xc], 0xe
je 0x403203
cmp dword [0x405b7c], ebx
jle 0x402583
push ebx
push 0x12
push 0x100
push ebx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x403203
mov esi, dword [0x405240]
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x14], esi
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x48
call dword [sym.imp.USER32.dll_GetSystemMetrics]
inc eax
cmp eax, dword [0x405b5c]
mov dword [ebp - 4], eax
mov edi, 0x405860
je 0x40260c
mov dword [0x405b5c], eax
mov eax, dword [0x405b68]
cmp eax, ebx
je 0x4025ca
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [0x405b68], ebx
push ebx
mov eax, 0x154
push edi
push eax
push 0x29
mov dword [0x405860], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
je 0x4025f7
push 0x405900
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
cmp eax, ebx
mov dword [0x405b68], eax
jne 0x4025ff
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push dword [0x405b24]
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp + 0xc]
and al, 0x40
neg al
sbb eax, eax
and eax, 0xfffffff0
add eax, 0x124
test byte [ebp + 0xc], 8
mov dword [ebp - 0x18], eax
jne 0x4027c1
test byte [ebp + 0xc], 4
je 0x402e23
push 0x1d
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x40264a
or dword [ebp + 0xc], 8
jmp 0x4027c1
push 6
push fcn.004021d4
mov dword [0x405b88], ebx
mov dword [0x405b84], ebx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [0x405b20], ebx
je 0x40268d
mov eax, dword [section..data]
push ebx
add eax, 0x8016
push eax
push 0x801b
push 0x8016
push dword [0x405b2c]
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push 1
push esi
call fcn.004021d4
shr eax, 0x1f
mov dword [0x405b70], eax
je 0x4026ac
cmp dword [0x405b84], 2
jl 0x4026ac
xor eax, eax
jmp 0x4026af
push 1
pop eax
add eax, 0x400
push eax
mov eax, dword [0x405b20]
add eax, 0xd
push eax
push dword [0x405b2c]
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
push 0xffffffffffffffec
push esi
call edi
and eax, 8
push 0xfffffffffffffff0
shl eax, 1
push esi
mov dword [0x405b40], eax
call edi
test eax, 0x10000000
je 0x4026fb
cmp esi, dword [0x405354]
je 0x4026fb
cmp esi, dword [0x405350]
jne 0x402702
or dword [0x405b40], 1
cmp esi, dword [0x405b44]
jne 0x402711
or dword [0x405b40], 8
xor ecx, ecx
cmp dword [0x405ad4], ebx
push 0x4050d0
setg cl
mov eax, 0x8025
push eax
shl ecx, 9
push ecx
push eax
push dword [0x405b2c]
call dword [sym.imp.USER32.dll_ModifyMenuA]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp dword [eax*4 + 0x405ac0], ebx
setge cl
add eax, 0x8020
shl ecx, 3
push ecx
push eax
push dword [0x405b2c]
call dword [sym.imp.USER32.dll_CheckMenuItem]
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
jle 0x40273b
mov esi, 0x100
mov dword [ebp - 4], ebx
push 8
pop edi
mov eax, esi
cdq
idiv edi
mov ecx, dword [0x405b6c]
and ecx, esi
xor edx, edx
mov edi, eax
mov eax, ecx
div edi
push eax
mov eax, dword [ebp - 4]
add eax, 0x8030
push eax
push dword [0x405b2c]
call dword [sym.imp.USER32.dll_CheckMenuItem]
add esi, esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 6
jle 0x402771
call fcn.00402336
mov esi, dword [ebp - 0x14]
mov dword [0x405b7c], 2
mov edi, 0x405860
mov eax, dword [0x405650]
push ebx
push 2
push ebx
push ebx
mov byte [eax], bl
call dword [sym.imp.USER32.dll_keybd_event]
push dword [0x40500c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp + 0xc]
push ebx
push dword [0x40500c]
sar eax, 2
push ebx
push dword [ebp - 0x28]
and eax, 2
push dword [ebp - 0x2c]
push dword [ebp - 0x18]
push dword [eax*4 + 0x405b2c]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov ecx, 0x82ff
cmp eax, ecx
mov dword [ebp + 8], eax
jbe 0x4028a5
push 1
mov dword [ebp - 4], ebx
mov esi, 0x405654
pop edi
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x108
mov ecx, dword [ecx + 0x405650]
cmp ecx, ebx
je 0x40285e
push ebx
push 0x7f
push ecx
push eax
push dword [0x405b34]
call dword [sym.imp.USER32.dll_GetMenuStringA]
mov eax, dword [ebp - 4]
imul eax, eax, 0x108
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test eax, eax
jge 0x40286b
mov eax, dword [ebp + 8]
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jle 0x402821
jmp 0x4031d4
mov eax, dword [ebp - 4]
imul eax, eax, 0x108
add eax, esi
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x700
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
jmp 0x4031d4
jne 0x4028c1
push 0x50
push edi
push 9
push dword [0x405b28]
call dword [sym.imp.USER32.dll_LoadStringA]
push 1
push ebx
push edi
jmp 0x402d38
cmp eax, 0x8030
jb 0x4028e7
cmp eax, 0x8036
ja 0x4028e7
lea ecx, [eax - 0x8030]
mov eax, 0x100
shl eax, cl
xor dword [0x405b6c], eax
jmp 0x4031d4
mov ecx, 0x8010
cmp eax, ecx
jb 0x402a50
cmp eax, 0x8012
ja 0x402a50
sub eax, ecx
cmp dword [0x405b84], 2
mov dword [ebp + 8], eax
jl 0x4031d4
push 4
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 2
add eax, 4
pop edi
cmp dword [ebp + 8], edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0x14
jae 0x40293f
cmp dword [0x405b54], ebx
jne 0x402959
mov dword [ebp - 0x18], 0x15
jmp 0x402959
test byte [0x405b54], 2
push 0
pop eax
setne al
mov dword [ebp - 0x18], 0x16
inc eax
mov dword [0x405b54], eax
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x3c]
sub ecx, eax
cmp dword [0x405b88], edi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], edi
jl 0x4031d4
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 4]
push 0xfffffffffffffff0
push dword [eax*4 + 0x405240]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x21000000
jne 0x402a39
test byte [0x405b54], 2
je 0x4029cd
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 4]
push dword [eax*4 + 0x405240]
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [ebp + 8], ebx
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
jne 0x402a0b
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x1c], eax
inc dword [ebp - 0x10]
mov ecx, dword [0x405b84]
mov eax, esi
imul eax, dword [ebp - 0x10]
cdq
idiv ecx
mov dword [ebp - 0x20], eax
mov eax, edi
imul eax, dword [ebp - 0x10]
dec ecx
cdq
idiv ecx
cmp eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
jle 0x402a0b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x40]
sub edi, dword [ebp - 0x24]
sub esi, dword [ebp - 0x20]
push eax
push dword [ebp - 8]
mov eax, dword [ebp - 4]
push edi
push esi
push ebx
push dword [eax*4 + 0x405240]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 9
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [0x405b88]
jle 0x402993
jmp 0x4031d4
cmp eax, 0x8016
jb 0x402ac1
cmp eax, 0x801b
ja 0x402ac1
add eax, 0xffff7fea
push 0x10
mov dword [section..data], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x4031d4
mov eax, dword [0x405b88]
cmp eax, 1
mov dword [ebp - 4], eax
jl 0x4031d4
mov eax, dword [section..data]
push ebx
add eax, 0x7029
push eax
mov eax, dword [ebp - 4]
push 0x111
push dword [eax*4 + 0x405240]
call dword [sym.imp.USER32.dll_PostMessageA]
push 9
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [ebp - 4]
cmp dword [ebp - 4], 1
jge 0x402a8a
jmp 0x4031d4
cmp eax, 0x8020
jb 0x402c28
mov ecx, 0x802a
cmp eax, ecx
ja 0x402c28
cmp eax, 0x8029
jne 0x402af2
cmp dword [0x405b54], 2
je 0x402b43
push ebx
push ebx
push 0x10
jmp 0x402df6
cmp eax, ecx
jne 0x402b43
cmp dword [0x405b70], ebx
je 0x402b43
cmp dword [0x405b54], ebx
je 0x402b43
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x44]
test byte [0x405b54], 2
mov dword [0x405ae8], eax
je 0x402b30
mov dword [0x405aec], ebx
jmp 0x4031d4
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x40]
mov dword [0x405aec], eax
jmp 0x4031d4
mov eax, dword [ebp + 8]
xor dword [eax*4 + 0x3e5a40], 0x80000000
cmp eax, 0x8025
jne 0x402b79
test byte [0x405b54], 2
je 0x402b6d
mov dword [0x405ad4], 1
jmp 0x4031d4
and dword [0x405ad4], 0xfffffffe
jmp 0x4031d4
cmp eax, 0x8028
mov esi, 0x8027
je 0x402b8d
cmp eax, esi
jne 0x4031d4
mov eax, dword [0x405ae0]
push fcn.00401b60
xor eax, 0x80000201
shr eax, 1
push eax
push 0x60
push dword [0x40500c]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [0x405ae0]
push 0x6f
pop ecx
shr eax, 0x1f
sub ecx, eax
push ecx
push dword [0x405b28]
call dword [sym.imp.USER32.dll_LoadIconA]
cmp dword [ebp + 8], esi
mov dword [0x40501c], eax
jne 0x402c0a
cmp dword [ebp + 0xc], ebx
mov eax, dword [0x405adc]
jge 0x402be3
cmp eax, ebx
jl 0x4031d4
shr eax, 0x1f
mov dword [ebp - 4], eax
push 0x405008
add eax, eax
push eax
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
or eax, dword [ebp - 4]
not eax
shl eax, 0x1f
xor dword [0x405adc], eax
jmp 0x4031d4
cmp dword [0x405adc], ebx
jl 0x4031d4
push 0x405008
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
jmp 0x4031d4
sub eax, 0x800a
je 0x402e07
dec eax
je 0x402dbc
dec eax
je 0x402d4a
dec eax
je 0x402ccf
dec eax
dec eax
jne 0x4031d4
mov eax, dword [0x405b88]
cmp eax, ebx
mov dword [ebp - 4], eax
jle 0x4031d4
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
mov esi, dword [eax*4 + 0x405240]
mov eax, dword [0x405b54]
cmp eax, 2
jne 0x402c9f
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindowAsync]
push 9
call edi
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 9
call edi
dec dword [ebp - 4]
cmp dword [ebp - 4], ebx
jg 0x402c66
jmp 0x4031d4
cmp dword [ebp - 0x14], esi
je 0x402c8e
cmp eax, 1
jne 0x402cb4
push 7
push esi
call dword [sym.imp.USER32.dll_ShowWindowAsync]
jmp 0x402c8e
cmp eax, ebx
je 0x402cc3
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x402c8e
push 9
push esi
call fcn.004037d0
pop ecx
pop ecx
jmp 0x402c92
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x14]
xor esi, esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp + 8]
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x4031d4
push 0x104
push 0x40586c
push ebx
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x402d0f
mov esi, edi
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x4031d4
push 1
push ebx
mov dword [esi], 0x202c4e2f
mov dword [esi + 4], 0x4c45532f
mov dword [esi + 8], 0x2c544345
push esi
push str.EXPLORER
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4031d4
mov eax, dword [0x405b54]
and eax, 1
mov dword [ebp - 4], eax
jne 0x402d65
mov eax, dword [0x405b40]
shr eax, 3
and eax, 2
mov dword [ebp - 4], eax
push 3
push ebx
cdq
push ebx
push ebx
sub eax, edx
sar eax, 1
or ecx, 0xffffffff
push ebx
sub ecx, eax
push ecx
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
test eax, eax
je 0x4031d4
cmp dword [ebp - 4], 1
jne 0x402da4
mov eax, dword [0x405b40]
and al, 8
neg al
sbb eax, eax
not eax
and eax, esi
mov dword [0x405b44], eax
jmp 0x4031d4
test byte [0x405b40], 8
je 0x4031d4
mov dword [0x405b44], ebx
jmp 0x4031d4
test byte [0x405b54], 2
jne 0x402df2
push 0x50
push edi
push 8
push dword [0x405b28]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x11040
push str.__CabFixer__3.340
push edi
push dword [0x40500c]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4031d4
push ebx
push ebx
push 0x7e
push dword [0x40500c]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x4031d4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp + 8], eax
cmp byte [eax], 0x22
jne 0x402e19
inc eax
mov dword [ebp + 8], eax
push 1
push ebx
push ebx
push eax
jmp 0x402d3d
cmp dword [ebp + 8], ebx
jne 0x402e30
mov eax, dword [0x405b6c]
mov dword [ebp + 8], eax
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x1d
call esi
movzx eax, ax
shr eax, 5
xor dword [ebp + 8], eax
push 0x11
call esi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, ax
shr eax, 4
xor dword [ebp + 8], eax
test byte [ebp + 9], 4
mov dword [0x405b7c], 1
je 0x402f02
mov eax, dword [ebp - 0x14]
cmp eax, dword [0x405350]
je 0x402f02
cmp eax, dword [0x405354]
je 0x402f02
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x30
call edi
lea eax, [ebp - 8]
push eax
push fcn.00403812
call dword [sym.imp.USER32.dll_EnumWindows]
push ebx
push ebx
push ebx
push 0x12
call esi
push ebx
push ebx
push ebx
push 0x57
call esi
push ebx
push 2
push ebx
push 0x57
call esi
push ebx
push 2
push ebx
push 0x12
call esi
push 0x60
call edi
lea eax, [ebp - 4]
push eax
push fcn.00403812
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
je 0x402f02
lea ecx, [ebp - 0x44]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x402f02
mov eax, dword [ebp - 0x38]
add eax, 0xffffffee
push eax
mov eax, dword [ebp - 0x44]
add eax, 0xc
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x4031d4
push dword [0x405b30]
call dword [sym.imp.USER32.dll_GetMenuItemCount]
dec eax
mov dword [ebp - 4], eax
js 0x402f2b
push 0x400
push eax
push dword [0x405b30]
call dword [sym.imp.USER32.dll_RemoveMenu]
mov eax, dword [ebp - 4]
jmp 0x402f0e
mov eax, dword [0x405afc]
mov ecx, dword [0x405b5c]
add eax, 0xfffffff8
cdq
add ecx, 4
idiv ecx
or dword [0x405b18], 0xffffffff
push ebx
push 2
push ebx
push ebx
mov dword [0x40535c], ebx
mov dword [0x405b60], ebx
or dword [ebp + 8], eax
call esi
push dword [0x40500c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0xd
call edi
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x402f68
mov eax, dword [ebp + 8]
mov edi, 0x80000000
or eax, edi
push eax
push dword [ebp - 0x14]
mov dword [0x405b64], ebx
call fcn.00403812
mov eax, dword [ebp + 8]
or eax, edi
push eax
push fcn.00403812
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [0x405b64], ebx
jle 0x4031d4
mov eax, dword [ebp + 8]
push ebx
push dword [0x40500c]
mov dword [0x405b1c], eax
push ebx
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x18]
push dword [0x405b30]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
mov dword [ebp - 0x10], eax
call edi
xor edx, edx
mov dx, ax
push 0x1b
shr edx, 1
mov dword [ebp - 0x24], edx
call edi
mov edi, dword [ebp - 0x24]
movzx eax, ax
or edi, eax
push 0x11
shr edi, 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx eax, ax
or edi, eax
shr edi, 0xc
mov dword [ebp - 8], edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xd
call edi
test ax, ax
jge 0x403027
push 0x11
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xd
jmp 0x403014
mov edi, dword [0x405b64]
push 1
pop eax
cmp edi, eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], eax
jl 0x403116
cmp eax, dword [ebp - 0x10]
jne 0x403047
or dword [ebp - 8], 1
cmp dword [ebp - 8], ebx
lea ecx, [eax + eax*2]
je 0x4030af
shl ecx, 2
cmp byte [ecx + 0x405358], bl
je 0x40306b
push 8
push dword [ecx + 0x405350]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
mov eax, dword [ebp - 4]
push 0xfffffffffffffff0
lea eax, [eax + eax*2]
push dword [eax*4 + 0x405350]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x20000000
je 0x4030fd
test byte [ebp - 8], 3
je 0x4030a4
mov eax, dword [ebp - 4]
push 9
lea eax, [eax + eax*2]
push dword [eax*4 + 0x405350]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
inc dword [ebp - 0xc]
jmp 0x4030fd
test byte [ebp - 8], 8
mov eax, dword [ebp - 4]
jne 0x4030b8
jmp 0x403100
cmp byte [ecx*4 + 0x405358], bl
je 0x403100
push 0xfffffffffffffff8
lea eax, [eax + eax*2]
push dword [eax*4 + 0x405350]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edi, eax
mov eax, dword [ebp - 4]
lea eax, [eax + eax*2]
push 0x60
push dword [eax*4 + 0x405350]
call fcn.004037d0
cmp edi, ebx
mov eax, dword [ebp - 4]
pop ecx
pop ecx
lea ecx, [eax + eax*2]
mov dword [ecx*4 + 0x405350], ebx
je 0x403100
push 0x60
push edi
call fcn.004037d0
pop ecx
pop ecx
mov eax, dword [ebp - 4]
and dword [ebp - 8], 0xe
mov edi, dword [0x405b64]
inc eax
cmp eax, edi
mov dword [ebp - 4], eax
jle 0x40303e
mov al, byte [ebp - 0x10]
mov byte [0x405366], al
cmp edi, ebx
mov dword [ebp - 4], edi
jle 0x4031d4
lea eax, [edi + edi*2]
lea ecx, [eax*4 + 0x40535a]
mov al, byte [ecx]
cmp al, bl
je 0x4031c4
movsx eax, al
lea eax, [eax + eax*2]
mov edi, dword [eax*4 + 0x405350]
push 0xfffffffffffffff0
push edi
mov byte [ecx], bl
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0x20], eax
xor eax, 0x10000000
test eax, 0x30000000
je 0x403178
push 4
push edi
call dword [sym.imp.USER32.dll_ShowWindowAsync]
inc dword [ebp - 0xc]
push 0x30
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 1
jne 0x4031af
cmp dword [ebp - 0xc], ebx
jne 0x4031a0
cmp dword [ebp - 0x10], 1
jne 0x4031a0
test byte [ebp - 0x1d], 1
je 0x40319a
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindowAsync]
jmp 0x4031a0
test byte [ebp + 9], 0x20
jne 0x4031ca
push ebx
push 2
push ebx
push ebx
call esi
push 0x3d
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
inc dword [ebp - 0xc]
push 0x30
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 4]
dec edi
jmp 0x40311e
push 0x60
push edi
call fcn.004037d0
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
and eax, 1
or eax, 2
push eax
push dword [ebp - 0x14]
push 0x8002
push dword [0x40500c]
call dword [sym.imp.USER32.dll_PostMessageA]
push 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x403203
or dword [0x405b7c], 0xffffffff
pop edi
pop esi
pop ebx
leave
ret