Function at 0x4fc750
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x188
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x184], eax
mov eax, dword [esp + 0x194]
push ebx
mov ebx, dword [esp + 0x190]
push ebp
xor ebp, ebp
push edi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x44], eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x28], ebp
cmp ebx, ebp
je 0x4fc78d
mov dword [ebx], ebp
cmp eax, ebp
je 0x4fc793
mov dword [eax], ebp
or edi, 0xffffffff
cmp dword [0x74bb7c], ebp
jne 0x4fc7d0
push 0x61bed4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x74bb7c], eax
cmp eax, ebp
je 0x4fc7b6
cmp eax, edi
jne 0x4fc7d0
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x188
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x74bb78], ebp
jne 0x4fc872
push 0x613110
call fcn.004f4be0
mov dword [0x74bb78], eax
cmp eax, ebp
je 0x4fce4d
cmp eax, edi
je 0x4fce4d
mov eax, dword [0x74bb7c]
push 0x627a4c
push eax
call esi
mov ecx, dword [0x74bb78]
push 0x64a7ec
push ecx
mov dword [0x74bb74], eax
call esi
mov edx, dword [0x74bb78]
push 0x6130f4
push edx
mov dword [0x74bb70], eax
call esi
mov dword [0x74bb6c], eax
mov eax, dword [0x74bb78]
push 0x6130e4
push eax
call esi
mov ecx, dword [0x74bb78]
push 0x6130cc
push ecx
mov dword [0x74bb68], eax
call esi
mov edx, dword [0x74bb7c]
push 0x627a34
push edx
mov dword [0x74bb64], eax
call esi
mov dword [0x74bb60], eax
cmp ebx, ebp
je 0x4fce4d
mov ecx, dword [0x74bb74]
cmp ecx, ebp
je 0x4fce4d
cmp dword [0x74bb70], ebp
je 0x4fce4d
cmp dword [0x74bb6c], ebp
je 0x4fce4d
cmp dword [0x74bb68], ebp
je 0x4fce4d
mov eax, dword [0x74bb64]
mov ebx, dword [esp + 0x1a8]
mov dword [esp + 0x4c], 1
cmp eax, ebp
je 0x4fcb24
cmp ebx, ebp
je 0x4fcb24
cmp byte [ebx], 0
je 0x4fcb24
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x28]
push edx
push 1
push ebp
push ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x34], edi
call eax
test eax, eax
je 0x4fc914
mov eax, dword [esp + 0x30]
cmp eax, ebp
jne 0x4fc91e
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x4fc914
push eax
call dword [0x74bb68]
mov eax, 1
jmp 0x4fce4f
mov dword [esp + 0x3c], ebp
cmp eax, ebp
jbe 0x4fcaf9
mov dword [esp + 0x38], ebp
mov edi, edi
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x24]
lea esi, [eax + ecx]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x34], ebp
cmp esi, ebp
je 0x4fcac2
push 0x3f
lea edx, [esp + 0x55]
push ebp
push edx
mov byte [esp + 0x5c], 0
call fcn.005dfd60
mov eax, dword [esi + 8]
add esp, 0xc
cmp eax, 9
ja case.default.0x4fc96c
jmp dword [eax*4 + 0x4fce68]
push ebp
push 0x6130a4
lea eax, [esp + 0x58]
push eax
jmp 0x4fc9fa
push 1
push 0x613090
jmp 0x4fc9f5
push 2
push 0x61307c
lea edx, [esp + 0x58]
push edx
jmp 0x4fc9fa
push 3
push 0x61306c
lea eax, [esp + 0x58]
push eax
jmp 0x4fc9fa
push 4
push 0x613058
jmp 0x4fc9f5
push 5
push 0x61304c
lea edx, [esp + 0x58]
push edx
jmp 0x4fc9fa
push 6
push 0x61303c
lea eax, [esp + 0x58]
push eax
jmp 0x4fc9fa
push 7
push 0x61302c
jmp 0x4fc9f5
push 8
push 0x613020
lea edx, [esp + 0x58]
push edx
jmp 0x4fc9fa
push 9
push 0x613014
lea eax, [esp + 0x58]
push eax
jmp 0x4fc9fa
push eax
push 0x613004
lea ecx, [esp + 0x58]
push ecx
call fcn.005dfb23
mov ecx, dword [esi]
add esp, 0xc
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x20]
push eax
push 5
push ecx
push ebp
call dword [0x74bb6c]
cmp dword [esp + 0x1c], ebp
je 0x4fcac2
push 0x103
lea edx, [esp + 0x95]
push ebp
push edx
mov dword [esp + 0x34], ebp
mov byte [esp + 0x9c], 0
call fcn.005dfd60
push 1
push ebp
push 0x2c
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0xac]
push ecx
push ebx
call fcn.004e1380
add esp, 0x24
cmp dword [esp + 0x28], edi
je 0x4fcab3
mov eax, dword [esp + 0x1c]
cmp byte [eax], 0
je 0x4fca92
lea edx, [esp + 0x90]
push edx
push eax
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x4fca92
mov eax, dword [esi + 8]
cmp eax, ebp
je 0x4fcadc
cmp eax, 4
jne 0x4fca92
mov eax, dword [esi]
mov dword [esp + 0x20], eax
push 1
push ebp
push 0x2c
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0xa0]
push edx
push ebx
call fcn.004e1380
add esp, 0x18
cmp dword [esp + 0x28], edi
jne 0x4fca62
mov eax, dword [esp + 0x1c]
push eax
call dword [0x74bb68]
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x3c]
add dword [esp + 0x38], 0xc
inc eax
mov dword [esp + 0x3c], eax
cmp eax, dword [esp + 0x30]
jb 0x4fc930
jmp 0x4fcaf9
mov edx, dword [esp + 0x1c]
mov ecx, dword [esi]
push edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x48], 1
call dword [0x74bb68]
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x4fcb0c
push eax
call dword [0x74bb68]
mov dword [esp + 0x24], ebp
cmp dword [esp + 0x44], ebp
jne 0x4fcb32
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x4fc914
mov dword [esp + 0x18], eax
jmp 0x4fcb32
call ecx
mov dword [esp + 0x18], eax
cmp eax, edi
je 0x4fc914
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 8
push edx
push ebp
xor bl, bl
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call dword [0x74bb6c]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebp
je 0x4fcccc
cmp dword [esp + 0x14], 4
jne 0x4fcccc
cmp dword [0x74bb64], ebp
je 0x4fcb8b
mov eax, dword [esp + 0x1a8]
cmp eax, ebp
je 0x4fcb8b
cmp byte [eax], bl
je 0x4fcb8b
mov bl, 1
jmp 0x4fcc94
mov eax, dword [esp + 0x10]
cmp dword [eax], ebp
sete bl
test bl, bl
jne 0x4fcc94
call edi
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call dword [0x74bb68]
push esi
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esp + 0x14], ebp
call fcn.004d9b00
lea edx, [esp + 0x14]
push edx
test eax, eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], ebp
push 8
je 0x4fccc2
mov dword [esp + 0x24], 1
push 1
push ebp
call dword [0x74bb6c]
cmp eax, ebp
je 0x4fcc14
cmp dword [esp + 0x14], 4
jne 0x4fcc14
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx]
cmp eax, ebp
sete bl
test bl, bl
jne 0x4fcc94
cmp eax, 4
sete bl
test bl, bl
jne 0x4fcc94
mov dword [esp + 0x20], 0xffffffff
cmp dword [esp + 0x10], ebp
je 0x4fcc3c
call edi
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call dword [0x74bb68]
push esi
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
mov dword [esp + 0x20], ebp
call fcn.004f6dd0
mov eax, dword [esp + 0x2c]
add esp, 0xc
cmp eax, 0xffffffff
je 0x4fcc94
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 8
push eax
push ebp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ebp
call dword [0x74bb6c]
cmp eax, ebp
je 0x4fcc94
cmp dword [esp + 0x14], 4
jne 0x4fcc94
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
cmp eax, ebp
sete bl
test bl, bl
jne 0x4fcc94
cmp eax, 4
sete bl
cmp dword [esp + 0x10], ebp
je 0x4fccb4
call edi
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call dword [0x74bb68]
push esi
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
test bl, bl
jne 0x4fcce6
mov eax, 4
jmp 0x4fce4f
mov dword [esp + 0x24], ebp
push ebp
jmp 0x4fcbe1
call edi
cmp eax, 0x6a6
je 0x4fcce2
call edi
cmp eax, 0x47f
jne 0x4fcc14
mov bl, 1
jmp 0x4fcc94
push 0x2000000
push ebp
push 0x64a7e4
call dword [sym.imp.USER32.dll_OpenWindowStationA]
mov esi, eax
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
cmp esi, ebp
je 0x4fce46
mov edi, dword [sym.imp.USER32.dll_SetProcessWindowStation]
push esi
call edi
push 0x2000000
push ebp
push ebp
call dword [sym.imp.USER32.dll_OpenInputDesktop]
cmp eax, ebp
jne 0x4fcd46
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov ebp, eax
call edi
push esi
call dword [sym.imp.USER32.dll_CloseWindowStation]
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 6
jmp 0x4fce4f
push eax
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call edi
push esi
call dword [sym.imp.USER32.dll_CloseWindowStation]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [0x74bb70]
cmp eax, ebp
jne 0x4fcdbc
push ebp
push 0x64a7d4
call fcn.004e21c0
add esp, 8
push 0x64a7c0
push 0x61bf44
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x34], 1
cmp eax, ebp
je 0x4fcda8
lea ecx, [esp + 0x34]
push ecx
push ebp
push 1
push 7
call eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [0x74bb70]
cmp eax, ebp
je 0x4fce13
mov eax, dword [esp + 0x2c]
cmp eax, ebp
je 0x4fce3e
cmp dword [esp + 0x1a0], ebp
je 0x4fcdf2
mov ecx, dword [esp + 0x40]
push ecx
push 1
push 2
push ebp
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
lea eax, [esp + 0x2c]
push eax
mov esi, 2
call fcn.004dca10
mov eax, esi
jmp 0x4fce4f
mov edx, dword [esp + 0x40]
push edx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
lea eax, [esp + 0x2c]
push eax
mov esi, 2
call fcn.004dca10
mov eax, esi
jmp 0x4fce4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x48]
cmp ecx, ebp
je 0x4fce35
cmp eax, 0x4dd
je 0x4fce2f
cmp eax, 0x6d3
jne 0x4fce35
mov dword [ecx], 1
mov esi, 7
mov eax, esi
jmp 0x4fce4f
mov esi, dword [esp + 0x4c]
mov eax, esi
jmp 0x4fce4f
mov eax, 5
jmp 0x4fce4f
xor eax, eax
mov ecx, dword [esp + 0x194]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x188
ret