Function at 0x48e6c0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Create thread
Get file attributes
Hide graphical window
Open clipboard
Persist via app paths registry key
Query or enumerate registry value
Read clipboard data
Set file attributes
Set registry value
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578870
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x36a4
call fcn.0052c270
mov eax, dword [0x5fc150]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x368c], edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x3688], ecx
cmp ecx, 0xa7f9
jg 0x490366
je case.0x490394.43003
cmp ecx, 0xa411
jg 0x48ee32
je 0x48ee12
cmp ecx, 0xa029
jg 0x48e8a7
je 0x490de2
cmp ecx, 0x2711
jg 0x48e7d2
je 0x48e7c0
cmp ecx, 0x3e9
jne case.default.0x49431c
push 0
mov ecx, edi
call fcn.0046ec50
mov ecx, dword [ebp - 0x3688]
cmp byte [edi + 0x68980], 0
je case.0x4948be.44069
cmp ecx, 0xa414
jg 0x49478c
cmp ecx, 0xa411
jge case.0x4948be.44061
cmp ecx, 0xa031
jg 0x494768
je case.0x4948be.44061
cmp ecx, 0xa029
jg 0x49474b
je case.0x4948be.44061
cmp ecx, 0x2711
je case.0x4948be.44061
jmp case.0x4948be.44069
push 2
mov ecx, edi
call fcn.0046da10
mov ecx, edi
call fcn.0046b410
jmp 0x48e760
cmp ecx, 0x2714
jg 0x48e825
je 0x48e813
mov eax, ecx
sub eax, 0x2712
je 0x48e7fe
sub eax, 1
jne case.default.0x49431c
push eax
push eax
push 2
mov ecx, edi
call fcn.0046dba0
jmp 0x48e760
push 1
mov ecx, edi
call fcn.0046da10
mov ecx, edi
call fcn.0046b410
jmp 0x48e760
push 0
push 0
push 1
mov ecx, edi
call fcn.0046dba0
jmp 0x48e760
cmp ecx, 0x2af9
jne case.default.0x49431c
lea ecx, [ebp - 0x3520]
call fcn.00504eb0
mov dword [ebp - 4], 0x97
mov eax, dword [edi]
push dword [edi + 0x418]
push dword [eax + 0xc]
push dword [eax + 4]
lea ecx, [ebp - 0x3520]
call fcn.00505d10
mov ecx, dword [edi + 0x300]
test ecx, ecx
je 0x48e885
push str.Dialog
call fcn.004f0760
test eax, eax
je 0x48e885
push str.Window
push eax
lea ecx, [edi + 0x300]
call fcn.00460de0
lea ecx, [ebp - 0x3520]
call fcn.005058d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3520]
call fcn.0048d2b0
jmp 0x48e760
lea eax, [ecx - 0xa02a]
cmp eax, 0x16
ja case.default.0x49431c
jmp dword [eax*4 + 0x494930]
mov ecx, edi
call fcn.0049ad50
jmp 0x48e760
push str.explorer__select____FULL_CURRENT_PATH__
lea ecx, [ebp - 0x3464]
call fcn.004029a0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x3464]
push eax
lea ecx, [ebp - 0x344c]
call fcn.0048cbd0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3464]
call fcn.004038c0
mov eax, dword [edi]
push dword [eax + 0xc]
lea ecx, [ebp - 0x344c]
call fcn.004d3720
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344c]
call fcn.00466460
jmp 0x48e760
call fcn.0040baa0
add eax, 0x290
cmp dword [eax + 0x14], 8
jb 0x48e93a
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x3464]
call fcn.004029a0
mov dword [ebp - 4], 3
lea eax, [ebp - 0x3464]
push eax
lea ecx, [ebp - 0x344c]
call fcn.0048cbd0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3464]
call fcn.004038c0
mov eax, dword [edi]
push str.__CURRENT_DIRECTORY_
push dword [eax + 0xc]
lea ecx, [ebp - 0x344c]
call fcn.004d3740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344c]
call fcn.00466460
jmp 0x48e760
mov eax, dword [edi + 0x580]
mov esi, dword [eax + 0x1c]
add esi, 0x74
cmp dword [esi + 0x14], 8
jb 0x48e9b0
mov eax, dword [esi]
jmp 0x48e9b2
mov eax, esi
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, eax
cmp ebx, 0x20
jg 0x48e760
mov dword [ebp - 0x3424], 0
mov dword [ebp - 0x3420], 0
mov dword [ebp - 0x3420], 7
mov dword [ebp - 0x3424], 0
xor eax, eax
mov word [ebp - 0x3434], ax
mov dword [ebp - 4], 6
push ebx
lea eax, [ebp - 0x3494]
push eax
call fcn.00423a00
add esp, 8
mov byte [ebp - 4], 7
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x3434]
call fcn.00406650
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3494]
call fcn.004038c0
push str.An_attempt_was_made_to_execute_the_below_command.
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
push str._n__________________________________________________________
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
push str._nCommand:
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
cmp dword [esi + 0x14], 8
jb 0x48ea74
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
push str._nError_Code:
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
push ebx
lea eax, [ebp - 0x3494]
push eax
call fcn.00425f30
add esp, 8
mov byte [ebp - 4], 8
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x3434]
call fcn.00406650
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3494]
call fcn.004038c0
push str._n__________________________________________________________
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
cmp dword [ebp - 0x3420], 8
mov ecx, dword [ebp - 0x3434]
jae 0x48eae8
lea ecx, [ebp - 0x3434]
mov eax, dword [edi]
push 0x40
push str.ShellExecute___ERROR
push ecx
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3434]
call fcn.004038c0
jmp 0x48e760
push str.Select_a_folder_to_add_in_Folder_as_Workspace_panel
lea ecx, [ebp - 0x3464]
call fcn.004029a0
mov dword [ebp - 4], 9
mov eax, dword [edi]
push 0
push 0
lea ecx, [ebp - 0x3464]
push ecx
push dword [eax + 0xc]
lea eax, [ebp - 0x344c]
push eax
call fcn.00425040
add esp, 0x14
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3464]
call fcn.004038c0
cmp dword [ebp - 0x343c], 0
je 0x48ec79
mov ecx, dword [edi + 0x68fe8]
test ecx, ecx
jne 0x48ec0c
mov dword [ebp - 0x3428], ecx
mov dword [ebp - 0x3424], ecx
mov dword [ebp - 0x3420], ecx
mov byte [ebp - 4], 0xc
push ecx
lea eax, [ebp - 0x3428]
push eax
mov ecx, edi
call fcn.00475390
cmp dword [edi + 0x68fe8], 0
je 0x48ebe6
push 8
push 0xac35
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 1
push 0xac35
push 0x402
push dword [edi + 0x668]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0x68fe8]
mov byte [eax + 0x60], 0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3428]
call fcn.00403aa0
jmp 0x48ec4f
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3428]
call fcn.00403aa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344c]
call fcn.004038c0
jmp case.0x4948be.44069
mov al, byte [ecx + 0x60]
test al, al
je 0x48ec4f
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
push 8
push 0xac35
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 1
push 0xac35
push 0x402
push dword [edi + 0x668]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0x68fe8]
mov byte [eax + 0x60], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x368c], esp
lea eax, [ebp - 0x344c]
push eax
call fcn.00402970
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0xb
mov ecx, dword [edi + 0x68fe8]
call fcn.0050fa20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344c]
call fcn.004038c0
jmp 0x48e760
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.004990a0
test al, al
je 0x48e760
mov ecx, edi
call fcn.0046ae20
jmp 0x48e760
push 0
mov ecx, edi
call fcn.0049a790
test al, al
je 0x48e760
mov ecx, edi
call fcn.0046ae20
jmp 0x48e760
push 0
mov ecx, edi
call fcn.0049af90
jmp 0x48e760
call fcn.0040baa0
lea ecx, [eax + 0x54]
call fcn.00483140
mov byte [ebp - 0x368c], al
push 0
push dword [ebp - 0x368c]
mov ecx, edi
call fcn.00499170
mov ecx, edi
call fcn.0046ae20
jmp 0x48e760
mov ecx, edi
call fcn.00499710
mov ecx, edi
call fcn.0046ae20
jmp 0x48e760
mov ecx, edi
call fcn.0049a160
mov ecx, edi
call fcn.0046ae20
jmp 0x48e760
mov ecx, edi
call fcn.0049a360
mov ecx, edi
call fcn.0046ae20
jmp 0x48e760
mov ecx, edi
call fcn.0049a570
mov ecx, edi
call fcn.0046ae20
jmp 0x48e760
push 0
mov ecx, edi
call fcn.0049b420
jmp 0x48e760
mov ecx, edi
call fcn.0049b7e0
jmp 0x48e760
push 0
push 0
mov ecx, edi
call fcn.0049bc60
jmp 0x48e760
push 1
push 0
mov ecx, edi
call fcn.0049bc60
jmp 0x48e760
push 0
mov ecx, edi
call fcn.0049a8d0
jmp 0x48e760
push 0
push 0
mov ecx, edi
call fcn.0049be00
jmp 0x48e760
push 1
jmp 0x48e759
lea eax, [ebp - 0x3464]
push eax
lea ecx, [edi + 0x688dc]
call fcn.00495440
mov dword [ebp - 4], 0x98
cmp dword [ebp - 0x3454], 0
je 0x48edfb
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x3464]
push eax
mov ecx, edi
call fcn.00497ca0
test eax, eax
je 0x48edfb
push eax
mov ecx, edi
call fcn.0047bb00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3464]
call fcn.004038c0
jmp 0x48e760
push 0
push 0
push 0x300
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov ecx, edi
call fcn.0046ac70
jmp 0x48e760
lea eax, [ecx - 0xa412]
cmp eax, 0x4b
ja case.default.0x49431c
jmp dword [eax*4 + 0x49498c]
push 0x61014c
lea ecx, [ebp - 0x368c]
call fcn.0043d960
mov dword [ebp - 4], 0xf
push 0
push 0
push 0x304
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov ecx, edi
call fcn.0046ac70
mov ecx, edi
call fcn.0046b500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x368c]
call fcn.00418e50
jmp 0x48e760
push 0x61014c
lea ecx, [ebp - 0x368c]
call fcn.0043d960
mov dword [ebp - 4], 0x10
push 0
push 0
push 0x7db
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov ecx, edi
call fcn.0046ac70
mov ecx, edi
call fcn.0046b500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x368c]
call fcn.00418e50
jmp 0x48e760
push 0
push 0
push 0x301
jmp 0x48ee1b
push 0
push 0
push 0x871
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov ebx, eax
sub ebx, 1
je case.0x4948be.44069
lea esi, [ebx + 1]
push esi
call fcn.0052bd85
add esp, 4
mov dword [ebp - 0x368c], eax
push 1
push esi
push eax
mov ecx, dword [edi + 0x580]
call fcn.004d8ca0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.0x4948be.44069
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x3698], eax
test eax, eax
jne 0x48ef6a
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp case.0x4948be.44069
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
push ebx
push dword [ebp - 0x368c]
push esi
call fcn.00543aa0
add esp, 0xc
mov byte [esi + ebx], 0
mov esi, dword [ebp - 0x3698]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push 4
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x48ef5f
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [eax], ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push str.Notepad_Binary_Text_Length
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push esi
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0x3688]
cmp ecx, 0xa441
jne case.default.0x492eaf
push 0x586904
push 0
push 0x87a
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48e760
push 0x61014c
lea ecx, [ebp - 0x368c]
call fcn.0043d960
mov dword [ebp - 4], 0x11
push 0
push 0
push 0x7ee
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov esi, eax
push 0
push 0
push 0x883
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 0
push esi
push 0x7ed
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x368c]
call fcn.00418e50
jmp 0x48e760
push 0x61014c
lea ecx, [ebp - 0x3694]
call fcn.0043d960
mov dword [ebp - 4], 0x12
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x48f0a9
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3694]
call fcn.00418e50
jmp case.0x4948be.44069
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x48f092
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x48f173
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x48f173
push str.Notepad_Binary_Text_Length
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov dword [ebp - 0x368c], eax
push eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x48f159
push dword [ebp - 0x368c]
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x3698], eax
test eax, eax
je 0x48f16c
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x368c], eax
test eax, eax
je 0x48f16c
push 0x586904
push 0
push 0x87a
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push ebx
mov eax, dword [ebp - 0x368c]
push dword [eax]
push 0x7d1
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push dword [ebp - 0x3698]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x48f16c
push ebx
push 0
push 0x87a
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3694]
call fcn.00418e50
jmp 0x48e760
push 0
push 0
push 0xa0a
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
cmp eax, 1
jne case.0x4948be.44069
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
lea eax, [ebp - 0x241c]
push eax
push 0x800
push 0xfc3
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [ebp - 0x3688]
lea eax, [ebp - 0x141c]
cmp ebx, 0xa45a
jne 0x48f1f3
push str.explorer
push 0x800
push eax
call fcn.0054bd88
add esp, 0xc
jmp 0x48f205
push eax
push 0x800
push 0xfc2
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x241c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48f2d9
cmp ebx, 0xa45a
mov eax, str._select_
je 0x48f22c
mov eax, 0x5883b8
push eax
lea ecx, [ebp - 0x3434]
call fcn.004029a0
mov dword [ebp - 4], 0x13
push 0x593ed8
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
lea eax, [ebp - 0x241c]
push eax
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
push 0x593ed8
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
cmp ebx, 0xa45a
je 0x48f292
cmp ebx, 0xa459
jne 0x48f2c2
lea eax, [ebp - 0x241c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x48f2c2
cmp dword [ebp - 0x3420], 8
mov eax, dword [ebp - 0x3434]
jae 0x48f2a7
lea eax, [ebp - 0x3434]
push 5
push 0x58823c
push eax
lea eax, [ebp - 0x141c]
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3434]
call fcn.004038c0
jmp 0x48e760
lea eax, [ebp - 0x341c]
push eax
push 0x800
push 0xfba
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, 0xa45a
mov eax, str._select_
je 0x48f303
mov eax, 0x5883b8
push eax
lea ecx, [ebp - 0x3434]
call fcn.004029a0
mov dword [ebp - 4], 0x14
push 0x593ed8
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
lea eax, [ebp - 0x341c]
push eax
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
push 0x588408
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
lea eax, [ebp - 0x241c]
push eax
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
cmp ebx, 0xa459
jne 0x48f3e8
cmp dword [ebp - 0x3420], 8
mov eax, dword [ebp - 0x3434]
jae 0x48f37b
lea eax, [ebp - 0x3434]
add eax, 2
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48f3ac
cmp dword [ebp - 0x3420], 8
mov eax, dword [ebp - 0x3434]
jae 0x48f39e
lea eax, [ebp - 0x3434]
add eax, 2
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x48f3e8
mov eax, dword [edi]
push 0
push 0
push 0
push str.File_Open
push str.The_file_youre_trying_to_open_doesnt_exist.
push dword [eax + 0xc]
push str.FilePathNotFoundWarning
lea ecx, [edi + 0x300]
call fcn.004607b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3434]
call fcn.004038c0
jmp case.0x4948be.44069
push 0x593ed8
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
cmp dword [ebp - 0x3420], 8
mov eax, dword [ebp - 0x3434]
jae 0x48f40d
lea eax, [ebp - 0x3434]
push 5
push 0x58823c
push eax
lea eax, [ebp - 0x141c]
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3434]
call fcn.004038c0
jmp 0x48e760
push 0
push 0
push 0xa0a
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
cmp eax, 1
jne case.0x4948be.44069
call fcn.0040baa0
mov ecx, eax
mov dword [ebp - 0x3424], 0
mov dword [ebp - 0x3420], 0
mov dword [ebp - 0x3420], 7
mov dword [ebp - 0x3424], 0
xor eax, eax
mov word [ebp - 0x3434], ax
mov dword [ebp - 4], 0x15
mov eax, dword [ecx + 0x720]
test eax, eax
jne 0x48f537
lea eax, [ecx + 0x724]
push eax
lea ecx, [ebp - 0x3434]
call fcn.0043ef70
cmp dword [ebp - 0x3420], 8
mov esi, dword [ebp - 0x3434]
jae 0x48f4d0
lea esi, [ebp - 0x3434]
lea eax, [ebp - 0x368c]
push eax
lea ecx, [ebp - 0x3434]
call fcn.0043bed0
push fcn.00554e19
push dword [eax]
push esi
lea eax, [ebp - 0x3698]
push eax
call fcn.0048cb30
add esp, 0x10
push 0
push str.http:__
lea ecx, [ebp - 0x3434]
call fcn.00495250
mov esi, eax
push 0
push str.https:__
lea ecx, [ebp - 0x3434]
call fcn.00495250
cmp dword [ebp - 0x3424], 0
je 0x48f530
test esi, esi
je 0x48f57c
test eax, eax
je 0x48f57c
push str.https:__www.google.com_search_q__CURRENT_WORD_
jmp 0x48f571
cmp eax, 1
jne 0x48f543
push str.https:__duckduckgo.com__q__CURRENT_WORD_
jmp 0x48f571
cmp eax, 2
jne 0x48f54f
push str.https:__www.google.com_search_q__CURRENT_WORD_
jmp 0x48f571
cmp eax, 3
jne 0x48f55b
push str.https:__www.bing.com_search_q__CURRENT_WORD_
jmp 0x48f571
cmp eax, 4
jne 0x48f567
push str.https:__search.yahoo.com_search_q__CURRENT_WORD_
jmp 0x48f571
cmp eax, 5
jne 0x48f57c
push str.https:__stackoverflow.com_search_q__CURRENT_WORD_
lea ecx, [ebp - 0x3434]
call fcn.00403ef0
cmp dword [ebp - 0x3420], 8
mov eax, dword [ebp - 0x3434]
jae 0x48f591
lea eax, [ebp - 0x3434]
push eax
lea ecx, [ebp - 0x3464]
call fcn.004029a0
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x3464]
push eax
lea ecx, [ebp - 0x344c]
call fcn.0048cbd0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x3464]
call fcn.004038c0
mov eax, dword [edi]
push dword [eax + 0xc]
lea ecx, [ebp - 0x344c]
call fcn.004d3720
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x344c]
call fcn.00466460
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3434]
call fcn.004038c0
jmp 0x48e760
push 0xbb8b
mov ecx, edi
call fcn.0048e6c0
push str.SearchEngine
lea ecx, [edi + 0x46208]
call fcn.004cbd00
jmp 0x48e760
push 0x61014c
lea ecx, [ebp - 0x3694]
call fcn.0043d960
mov dword [ebp - 4], 0x19
cmp dword [ebp - 0x3688], 0xa436
mov eax, str.HTML_Format
je 0x48f646
mov eax, str.Rich_Text_Format
push eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x48f092
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x48f092
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x48f173
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x48f173
push eax
jmp 0x48f15a
mov ecx, dword [edi + 0x580]
call fcn.0048e560
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xfffffff8
add eax, 8
push eax
push 0xa424
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov ecx, dword [edi + 0x580]
call fcn.004d5c80
jmp 0x48e760
push 0x61014c
lea ecx, [ebp - 0x3698]
call fcn.0043d960
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x36b0], 0
mov byte [ebp - 0x368d], 0
push 0
push 0
push 0xa0a
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 0
mov ecx, dword [edi + 0x580]
push 0
cmp eax, 1
jle 0x48f808
push 0x944
call fcn.0040d9f0
test eax, eax
je 0x48f7f1
lea eax, [ebp - 0x3428]
push eax
mov ecx, dword [edi + 0x580]
call fcn.004d83c0
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x3428]
mov esi, dword [eax]
mov eax, dword [ebp - 0x3424]
mov ebx, dword [eax - 0x14]
cmp esi, ebx
mov eax, esi
jl 0x48f766
mov eax, ebx
mov dword [ebp - 0x36a4], esi
jg 0x48f76c
mov dword [ebp - 0x36a4], ebx
push 0
push eax
push 0x876
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov dword [ebp - 0x36a0], eax
mov dword [ebp - 0x3694], eax
push 0
push dword [ebp - 0x36a4]
push 0x876
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov dword [ebp - 0x36a8], eax
mov dword [ebp - 0x36a4], eax
push 0
push esi
push 0x851
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov esi, eax
push 0
push ebx
push 0x851
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov dword [ebp - 0x36b0], eax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x3428]
call fcn.00421290
jmp 0x48f898
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3698]
call fcn.00418e50
jmp case.0x4948be.44069
push 0x85f
call fcn.0040d9f0
mov esi, eax
push 0
push 0
push 0x861
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
cmp esi, eax
setne al
mov byte [ebp - 0x368d], al
mov ecx, dword [edi + 0x580]
test al, al
je 0x48f86d
lea eax, [ebp - 0x3424]
push eax
call fcn.004d8d70
mov eax, dword [ebp - 0x3424]
mov dword [ebp - 0x36a0], eax
mov esi, dword [ebp - 0x3420]
mov dword [ebp - 0x36a8], esi
cmp eax, esi
je 0x48f7f1
mov dword [ebp - 0x3694], eax
jmp 0x48f890
xor eax, eax
mov dword [ebp - 0x36a0], eax
mov dword [ebp - 0x3694], eax
push eax
push eax
push 0x86a
call fcn.0040d9f0
lea esi, [eax - 1]
mov dword [ebp - 0x36a8], esi
mov dword [ebp - 0x36a4], esi
xor esi, esi
mov ebx, dword [ebp - 0x3688]
cmp ebx, 0xa44c
je 0x48f8c5
cmp ebx, 0xa44e
je 0x48f8c5
cmp ebx, 0xa450
je 0x48f8c5
cmp ebx, 0xa452
mov byte [ebp - 0x369c], 0
jne 0x48f8cc
mov byte [ebp - 0x369c], 1
push 0
push 0
push 0x81e
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov dword [ebp - 0x36ac], 0
mov byte [ebp - 4], 0x1c
cmp ebx, 0xa44c
je 0x48f9f1
cmp ebx, 0xa44b
je 0x48f9f1
cmp ebx, 0xa44e
je 0x48f9b1
cmp ebx, 0xa44d
je 0x48f9b1
cmp ebx, 0xa450
je 0x48f971
cmp ebx, 0xa44f
je 0x48f971
push 0x14
call fcn.0052bd3f
add esp, 4
mov dword [ebp - 0x3420], eax
mov byte [ebp - 4], 0x23
test eax, eax
je 0x48f95c
push dword [ebp - 0x36b0]
push esi
push dword [ebp - 0x369c]
mov ecx, eax
call fcn.0048ccd0
jmp 0x48f95e
xor eax, eax
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x369c], eax
mov byte [ebp - 4], 0x24
jmp 0x48fa2f
push 0x14
call fcn.0052bd3f
add esp, 4
mov dword [ebp - 0x3420], eax
mov byte [ebp - 4], 0x21
test eax, eax
je 0x48f99f
push dword [ebp - 0x36b0]
push esi
push dword [ebp - 0x369c]
mov ecx, eax
call fcn.0048cc40
jmp 0x48f9a1
xor eax, eax
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x369c], eax
mov byte [ebp - 4], 0x22
jmp 0x48fa2f
push 0x10
call fcn.0052bd3f
add esp, 4
mov dword [ebp - 0x3420], eax
mov byte [ebp - 4], 0x1f
test eax, eax
je 0x48f9df
push dword [ebp - 0x36b0]
push esi
push dword [ebp - 0x369c]
mov ecx, eax
call fcn.0048ce00
jmp 0x48f9e1
xor eax, eax
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x369c], eax
mov byte [ebp - 4], 0x20
jmp 0x48fa2f
push 0x10
call fcn.0052bd3f
add esp, 4
mov dword [ebp - 0x3420], eax
mov byte [ebp - 4], 0x1d
test eax, eax
je 0x48fa1f
push dword [ebp - 0x36b0]
push esi
push dword [ebp - 0x369c]
mov ecx, eax
call fcn.0048cd60
jmp 0x48fa21
xor eax, eax
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x369c], eax
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x369c]
push eax
lea ecx, [ebp - 0x36ac]
call fcn.0048d340
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x369c]
test ecx, ecx
je 0x48fa55
mov eax, dword [ecx]
push 1
call dword [eax]
mov byte [ebp - 4], 0x25
mov esi, dword [ebp - 0x36ac]
push esi
mov ebx, dword [ebp - 0x36a8]
push ebx
push dword [ebp - 0x36a0]
mov ecx, dword [edi + 0x580]
call fcn.004de8f0
mov dword [ebp - 4], 0x1c
jmp 0x48faef
push 0
push 0
push 0x81f
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
cmp byte [ebp - 0x368d], 0
je 0x48fb6a
push 0
push dword [ebp - 0x36a0]
push 0x877
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov dword [ebp - 0x368c], eax
push 0
push ebx
push 0x858
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov ebx, eax
push 0
push dword [ebp - 0x368c]
push 0x85e
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 0
push ebx
push 0x860
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov byte [ebp - 4], 0x1a
test esi, esi
je 0x48fb7a
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3698]
call fcn.00418e50
jmp 0x48e760
mov ecx, dword [edi + 0x580]
call fcn.004d9690
jmp 0x48e760
mov ecx, dword [edi + 0x580]
call fcn.004d97f0
jmp 0x48e760
mov ecx, edi
call fcn.00474d70
jmp 0x48e760
mov ecx, edi
call fcn.00474f60
jmp 0x48e760
push 0
push 0
push 0x303
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48e760
cmp byte [edi + 0x68980], 0
jne 0x48e773
lea eax, [edi + 0x68974]
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x3420], esp
push eax
call fcn.00461bf0
mov dword [ebp - 4], 0x29
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.004957f0
jmp 0x48e760
cmp byte [edi + 0x68980], 0
jne 0x48e773
mov eax, dword [edi + 0x68984]
lea ecx, [edi + 0x68984]
mov eax, dword [eax + 0x34]
call eax
test al, al
sete bl
mov al, byte [edi + 0x308]
mov byte [ebp - 0x368c], al
push dword [ebp - 0x368c]
lea ecx, [edi + 0x68984]
call fcn.00495110
test bl, bl
je 0x48e760
push 0
push 0
push str.MultiMacro
push dword [edi + 0x68990]
lea ecx, [edi + 0x300]
call fcn.0045e090
jmp 0x48e760
mov ecx, edi
call fcn.00469150
test al, al
je 0x48e760
mov byte [edi + 0x68982], 1
lea ecx, [edi + 0x68984]
call fcn.004d40a0
mov ecx, edi
call fcn.0046b260
jmp 0x48e760
mov eax, dword [edi + 0x580]
mov eax, dword [eax + 0x20]
cmp ecx, 0xa42d
jne 0x48fd04
mov ecx, eax
call fcn.00495510
push eax
lea ecx, [ebp - 0x3464]
call fcn.004029a0
mov dword [ebp - 4], 0x2a
lea eax, [ebp - 0x3464]
push eax
mov ecx, edi
call fcn.0047b9e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3464]
call fcn.004038c0
jmp 0x48e760
cmp ecx, 0xa42f
jne 0x48fd49
mov ecx, eax
call fcn.00495510
push eax
lea ecx, [ebp - 0x3464]
call fcn.004029a0
mov dword [ebp - 4], 0x2b
lea eax, [ebp - 0x3464]
push eax
lea eax, [ebp - 0x3494]
push eax
call fcn.00423dd0
add esp, 8
lea ecx, [ebp - 0x3494]
call fcn.004038c0
jmp 0x48fcdf
cmp ecx, 0xa42e
jne case.default.0x492eaf
push dword [eax + 0x8c]
lea ecx, [ebp - 0x3464]
call fcn.004029a0
mov dword [ebp - 4], 0x2c
jmp 0x48fcdf
mov eax, dword [edi]
push 0
push 0
push 0
push str.Column_Mode_Tip
push str.Please_use__ALTMouse_Selection__or__AltShiftArrow_key__to_switch_to_column_mode.
push dword [eax + 0xc]
push str.ColumnModeTip
lea ecx, [edi + 0x300]
call fcn.004607b0
jmp 0x48e760
mov eax, dword [edi + 0x145c]
lea ecx, [edi + 0x145c]
mov eax, dword [eax + 0x34]
call eax
test al, al
sete bl
mov al, byte [edi + 0x308]
mov byte [ebp - 0x368c], al
push dword [ebp - 0x368c]
lea ecx, [edi + 0x145c]
call fcn.00494fc0
test bl, bl
je 0x48e760
push 0
push 0
push str.ColumnEditor
push dword [edi + 0x1468]
lea ecx, [edi + 0x300]
call fcn.0045e090
jmp 0x48e760
push 0
push 0
push 0x7dd
jmp 0x48ee1b
push 0
push 0
push 0x917
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48e760
push 0
push 0
push 0x918
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48e760
push 0
push 0
push 0x964
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48e760
push 0
push 0
push 0x81e
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov ecx, edi
call fcn.00478840
push 0
push 0
push 0x81f
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48e760
push 0
push 0
push 0x8ef
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 0
push 0
push 0x93a
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov ecx, dword [edi + 0x580]
test eax, eax
jne 0x48fec6
push eax
push eax
push 0x8f1
call fcn.0040d9f0
jmp 0x48e760
push 0x5ae424
push 0x21
push 0x8e4
call fcn.0040d9f0
mov esi, eax
push 0
push 0
push 0x938
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 0
imul eax, esi
push eax
push 0x8f1
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48e760
push 0
push 0
push 0x8ef
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 0
push 0
push 0x8f0
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48e760
mov ecx, dword [edi + 0x580]
call fcn.004d6f10
jmp 0x48e760
mov ecx, dword [edi + 0x580]
call fcn.004d6ec0
jmp 0x48e760
push 0
push 0
push 0x81e
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 0
mov ecx, edi
call fcn.00478930
push 0
push 0
push 0x81f
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48e760
push 0
push 0
push 0x81e
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 1
jmp 0x48ff6b
mov ecx, dword [edi + 0x580]
call fcn.00494f60
jmp 0x48e760
mov ecx, dword [edi + 0x580]
call fcn.00494ee0
jmp 0x48e760
mov byte [ebp - 0x368d], 2
lea eax, [ebp - 0x368d]
push eax
mov ecx, dword [edi + 0x580]
call fcn.00494f20
jmp 0x48e760
mov byte [ebp - 0x368d], 3
lea eax, [ebp - 0x368d]
push eax
mov ecx, dword [edi + 0x580]
call fcn.00494f20
jmp 0x48e760
mov byte [ebp - 0x368d], 4
lea eax, [ebp - 0x368d]
push eax
mov ecx, dword [edi + 0x580]
call fcn.00494f20
jmp 0x48e760
mov byte [ebp - 0x368d], 5
lea eax, [ebp - 0x368d]
push eax
mov ecx, dword [edi + 0x580]
call fcn.00494f20
jmp 0x48e760
mov byte [ebp - 0x368d], 6
lea eax, [ebp - 0x368d]
push eax
mov ecx, dword [edi + 0x580]
call fcn.00494f20
jmp 0x48e760
mov byte [ebp - 0x368d], 7
lea eax, [ebp - 0x368d]
push eax
mov ecx, dword [edi + 0x580]
call fcn.00494f20
jmp 0x48e760
push 2
mov ecx, edi
call fcn.0046c180
jmp 0x48e760
push 0
mov ecx, edi
call fcn.0046c180
jmp 0x48e760
push 1
mov ecx, edi
call fcn.0046c180
jmp 0x48e760
mov ecx, edi
call fcn.0046d2e0
jmp 0x48e760
push 1
mov ecx, edi
call fcn.0047c690
jmp 0x48e760
push 0x61014c
lea ecx, [ebp - 0x368c]
call fcn.0043d960
mov dword [ebp - 4], 0x43
push 0
push 0
push 0x81e
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 1
mov ecx, edi
call fcn.0046d950
push 0
push 0
push 0x81f
jmp 0x48f04d
push 0x61014c
lea ecx, [ebp - 0x368c]
call fcn.0043d960
mov dword [ebp - 4], 0x44
push 0
push 0
push 0x81e
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 0
jmp 0x4900e8
push 0x61014c
lea ecx, [ebp - 0x368c]
call fcn.0043d960
mov dword [ebp - 4], 0x45
push 0
push 0
push 0x81e
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 1
mov ecx, edi
call fcn.0046d950
push 0
jmp 0x4900e8
push 0
push 0
push 0x81e
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 0
push 0
push 0xa82
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 0
push 0
push 0x8f0
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48ff72
push 0x61014c
lea ecx, [ebp - 0x368c]
call fcn.0043d960
mov dword [ebp - 4], 0x46
push 0
push 0
push 0x81e
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 1
mov ecx, edi
call fcn.0046d950
push 0
mov ecx, edi
call fcn.0046d950
push 0
push 0
push 0xa82
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 0
push 0
push 0x8f0
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 0
push 0
push 0x81f
jmp 0x48f04d
push 0
mov ecx, edi
call fcn.0047d500
jmp 0x48e760
push 1
mov ecx, edi
call fcn.0047d500
jmp 0x48e760
push 2
mov ecx, edi
call fcn.0047d500
jmp 0x48e760
mov eax, dword [edi + 0x580]
mov ecx, dword [eax + 0x20]
mov al, byte [ecx + 0x3c]
test al, al
sete al
movzx eax, al
push eax
call fcn.00495ec0
jmp 0x48e760
mov eax, dword [edi + 0x580]
mov esi, dword [eax + 0x20]
mov ecx, esi
call fcn.00495510
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
mov ecx, esi
call fcn.00495510
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
mov ecx, esi
call fcn.00495e60
jmp 0x48e760
xor ebx, ebx
mov esi, dword [edi + 0x688f8]
sub esi, 1
js case.default.0x492eaf
lea eax, [edi + 0x688dc]
nop
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push esi
mov ecx, eax
call fcn.0045cac0
push eax
mov ecx, edi
call fcn.00497ca0
test eax, eax
je 0x4902d2
mov ebx, eax
sub esi, 1
lea eax, [edi + 0x688dc]
jns 0x4902b0
test ebx, ebx
je 0x48e760
push ebx
mov ecx, edi
call fcn.0047bb00
jmp 0x48e760
lea ecx, [edi + 0x688dc]
call fcn.0045c520
jmp 0x48e760
cmp ecx, 0xa42a
sete bl
push ebx
mov ecx, dword [edi + 0x580]
call fcn.004d6100
mov ecx, dword [edi + 0x580]
call fcn.0043a160
mov byte [ebp - 0x368c], al
test al, al
sete al
movzx eax, al
push eax
mov ecx, dword [edi + 0x580]
call fcn.004967d0
push dword [ebp - 0x368c]
mov ecx, dword [edi + 0x580]
call fcn.004967d0
mov ecx, dword [edi + 0x68fec]
test ecx, ecx
je 0x48e760
push ebx
call fcn.00439f50
jmp 0x48e760
cmp ecx, 0xa9ee
jg 0x490fec
cmp ecx, 0xa9ed
jge 0x490f06
lea eax, [ecx - 0xa7fa]
cmp eax, 0x67
ja case.default.0x49431c
movzx eax, byte [eax + 0x494b40]
jmp dword [eax*4 + 0x494abc]
lea esi, [edi + 0x798]
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x34]
call eax
test al, al
sete byte [ebp - 0x368d]
xor ecx, ecx
mov ebx, dword [ebp - 0x3688]
cmp ebx, 0xa7fb
jne 0x4903ca
mov ecx, 1
jmp 0x4903d7
cmp ebx, 0xa82e
jne 0x4903d7
mov ecx, 3
mov al, byte [edi + 0x308]
mov byte [ebp - 0x368c], al
push 1
push dword [ebp - 0x368c]
push ecx
mov ecx, esi
call fcn.00441970
call fcn.0040baa0
cmp byte [eax + 0xad], 0
jne 0x490428
push 1
push 0x800
lea eax, [ebp - 0x341c]
push eax
mov ecx, dword [edi + 0x580]
call fcn.004d8800
lea eax, [ebp - 0x341c]
push eax
mov ecx, esi
call fcn.0044a780
push 0
push 0
mov ecx, edi
call fcn.0047ad70
cmp byte [ebp - 0x368d], 0
je 0x49471c
push esi
lea ecx, [edi + 0x300]
call fcn.0045e4e0
mov ecx, ebx
jmp case.default.0x492eaf
mov eax, dword [edi]
push 0
push 0
push 0x805
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x48e760
push 0
push 0x800
lea eax, [ebp - 0x141c]
push eax
mov ecx, dword [edi + 0x580]
call fcn.004d8800
xor eax, eax
cmp ax, word [ebp - 0x141c]
je 0x4904b6
mov eax, dword [edi + 0x580]
mov eax, dword [eax + 0x20]
cmp dword [eax + 0x34], 0
setne al
movzx eax, al
push eax
lea eax, [ebp - 0x141c]
push eax
lea ecx, [edi + 0x1180]
call fcn.00495ea0
lea ecx, [edi + 0x1180]
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
jmp 0x48e760
lea esi, [edi + 0x798]
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x34]
call eax
test al, al
je case.0x4948be.44069
push dword [0x60fc7c]
lea ecx, [ebp - 0x35f4]
call fcn.0043dae0
mov dword [ebp - 4], 0x2d
cmp dword [ebp - 0x3688], 0xa7fa
sete byte [ebp - 0x35f1]
lea eax, [ebp - 0x344c]
push eax
mov ecx, esi
call fcn.004722a0
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x368c], 5
cmp dword [ebp - 0x3438], 8
mov eax, dword [ebp - 0x344c]
jae 0x490539
lea eax, [ebp - 0x344c]
push 0
lea ecx, [ebp - 0x368c]
push ecx
lea ecx, [ebp - 0x35f4]
push ecx
push eax
mov ecx, esi
call fcn.00444f50
mov eax, dword [ebp - 0x368c]
cmp eax, 3
jne 0x4905a1
push str.Find:_Found_the_1st_occurrence_from_the_top._The_end_of_the_document_has_been_reached.
lea ecx, [ebp - 0x3464]
call fcn.004029a0
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x3464]
push eax
push str.find_status_end_reached
lea eax, [ebp - 0x347c]
push eax
lea ecx, [edi + 0x300]
call fcn.0045ff80
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x3464]
call fcn.004038c0
push 3
jmp 0x4905e9
cmp eax, 2
jne 0x490606
push str.Find:_Found_the_1st_occurrence_from_the_bottom._The_beginning_of_the_document_has_been_reached.
lea ecx, [ebp - 0x3464]
call fcn.004029a0
mov byte [ebp - 4], 0x32
lea eax, [ebp - 0x3464]
push eax
push str.find_status_top_reached
lea eax, [ebp - 0x347c]
push eax
lea ecx, [edi + 0x300]
call fcn.0045ff80
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x3464]
call fcn.004038c0
push 2
lea eax, [ebp - 0x347c]
push eax
mov ecx, esi
call fcn.0044a7f0
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x347c]
call fcn.004038c0
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x344c]
call fcn.004038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x35f4]
call fcn.0043e780
jmp 0x48e760
lea esi, [edi + 0x798]
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x34]
call eax
test al, al
sete bl
test bl, bl
je 0x490661
mov al, byte [edi + 0x308]
mov byte [ebp - 0x3698], al
push 0
push dword [ebp - 0x3698]
push 0
mov ecx, esi
call fcn.00441970
push 1
push 0x800
lea eax, [ebp - 0x141c]
push eax
mov ecx, dword [edi + 0x580]
call fcn.004d8800
lea eax, [ebp - 0x141c]
push eax
mov ecx, esi
call fcn.0044a780
lea eax, [ebp - 0x141c]
push eax
mov ecx, dword [0x60fc7c]
lea ecx, [ecx + 0x10]
call fcn.00403ef0
push 0
push 0
mov ecx, edi
call fcn.0047ad70
test bl, bl
je 0x4906b8
push esi
lea ecx, [edi + 0x300]
call fcn.0045e4e0
push dword [0x60fc7c]
lea ecx, [ebp - 0x35f4]
call fcn.0043dae0
mov dword [ebp - 4], 0x35
cmp dword [ebp - 0x3688], 0xa828
sete byte [ebp - 0x35f1]
mov dword [ebp - 0x368c], 5
push 0
lea eax, [ebp - 0x368c]
push eax
lea eax, [ebp - 0x35f4]
push eax
lea eax, [ebp - 0x141c]
push eax
mov ecx, esi
call fcn.00444f50
mov eax, dword [ebp - 0x368c]
cmp eax, 3
jne 0x49076e
push str.Find:_Found_the_1st_occurrence_from_the_top._The_end_of_the_document_has_been_reached.
lea ecx, [ebp - 0x3464]
call fcn.004029a0
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x3464]
push eax
push str.find_status_end_reached
lea eax, [ebp - 0x344c]
push eax
lea ecx, [edi + 0x300]
call fcn.0045ff80
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x3464]
call fcn.004038c0
push 3
lea eax, [ebp - 0x344c]
push eax
mov ecx, esi
call fcn.0044a7f0
mov byte [ebp - 4], 0x35
jmp 0x49060a
cmp eax, 2
jne 0x490615
push str.Find:_Found_the_1st_occurrence_from_the_bottom._The_beginning_of_the_document_has_been_reached.
lea ecx, [ebp - 0x3464]
call fcn.004029a0
mov byte [ebp - 4], 0x39
lea eax, [ebp - 0x3464]
push eax
push str.find_status_top_reached
lea eax, [ebp - 0x344c]
push eax
lea ecx, [edi + 0x300]
call fcn.0045ff80
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x3464]
call fcn.004038c0
push 2
lea eax, [ebp - 0x344c]
push eax
mov ecx, esi
call fcn.0044a7f0
mov byte [ebp - 4], 0x35
jmp 0x49060a
push 0
lea ecx, [edi + 0x798]
call fcn.00495710
jmp 0x48e760
push 0xffffffffffffffff
lea ecx, [edi + 0x798]
call fcn.00495710
jmp 0x48e760
lea ecx, [edi + 0x798]
call fcn.00495520
mov esi, eax
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
jne 0x49081e
push dword [edi + 0x68ff8]
mov ecx, edi
call fcn.0047ba00
jmp 0x48e760
lea ecx, [edi + 0x798]
call fcn.004438e0
jmp 0x48e760
push 1
push 0x104
lea eax, [ebp - 0x41c]
push eax
mov ecx, dword [edi + 0x580]
call fcn.004d8800
lea ecx, [ebp - 0x35f4]
call fcn.0043dc20
mov dword [ebp - 4], 0x3c
mov byte [ebp - 0x35f4], 0
cmp dword [ebp - 0x3688], 0xa806
sete byte [ebp - 0x35f1]
mov dword [ebp - 0x368c], 5
push 0
lea eax, [ebp - 0x368c]
push eax
lea eax, [ebp - 0x35f4]
push eax
lea eax, [ebp - 0x41c]
push eax
lea ecx, [edi + 0x798]
call fcn.00444f50
mov eax, dword [ebp - 0x368c]
cmp eax, 3
jne 0x4908ed
push str.Find:_Found_the_1st_occurrence_from_the_top._The_end_of_the_document_has_been_reached.
lea ecx, [ebp - 0x3464]
call fcn.004029a0
mov byte [ebp - 4], 0x3d
lea eax, [ebp - 0x3464]
push eax
push str.find_status_end_reached
lea eax, [ebp - 0x344c]
push eax
lea ecx, [edi + 0x300]
call fcn.0045ff80
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x3464]
call fcn.004038c0
push 3
jmp 0x490939
cmp eax, 2
jne 0x490615
push str.Find:_Found_the_1st_occurrence_from_the_bottom._The_beginning_of_the_document_has_been_reached.
lea ecx, [ebp - 0x3464]
call fcn.004029a0
mov byte [ebp - 4], 0x40
lea eax, [ebp - 0x3464]
push eax
push str.find_status_top_reached
lea eax, [ebp - 0x344c]
push eax
lea ecx, [edi + 0x300]
call fcn.0045ff80
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x3464]
call fcn.004038c0
push 2
lea eax, [ebp - 0x344c]
push eax
lea ecx, [edi + 0x798]
call fcn.0044a7f0
mov byte [ebp - 4], 0x3c
jmp 0x49060a
cmp ecx, 0xa80e
jne 0x490963
mov ebx, 0x19
jmp 0x49098f
cmp ecx, 0xa810
jne 0x490972
mov ebx, 0x18
jmp 0x49098f
cmp ecx, 0xa812
jne 0x490981
mov ebx, 0x17
jmp 0x49098f
xor ebx, ebx
cmp ecx, 0xa814
sete bl
add ebx, 0x15
mov dword [ebp - 0x3694], ebx
push 0
push 0x800
lea eax, [ebp - 0x141c]
push eax
mov ecx, dword [edi + 0x580]
call fcn.004d8800
push 0x800
lea eax, [ebp - 0x241c]
push eax
mov ecx, dword [edi + 0x580]
call fcn.004d8a80
lea eax, [ebp - 0x241c]
cmp word [ebp - 0x141c], 0
jne 0x4909e9
push 1
push ebx
push eax
lea ecx, [edi + 0x798]
call fcn.00444410
jmp 0x48e760
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
call ebx
mov esi, eax
lea eax, [ebp - 0x141c]
push eax
call ebx
cmp eax, esi
sete al
movzx eax, al
push eax
push dword [ebp - 0x3694]
lea eax, [ebp - 0x141c]
push eax
lea ecx, [edi + 0x798]
call fcn.00444410
jmp 0x48e760
cmp ecx, 0xa80f
jne 0x490a41
mov eax, 0x19
push eax
mov ecx, dword [edi + 0x580]
call fcn.00440260
jmp 0x48e760
cmp ecx, 0xa811
jne 0x490a5f
mov eax, 0x18
push eax
mov ecx, dword [edi + 0x580]
call fcn.00440260
jmp 0x48e760
cmp ecx, 0xa813
jne 0x490a7d
mov eax, 0x17
push eax
mov ecx, dword [edi + 0x580]
call fcn.00440260
jmp 0x48e760
xor eax, eax
cmp ecx, 0xa815
sete al
add eax, 0x15
push eax
mov ecx, dword [edi + 0x580]
call fcn.00440260
jmp 0x48e760
cmp ecx, 0xa81f
jne 0x490ab8
mov ecx, 0x19
push 1
push ecx
mov ecx, edi
call fcn.00472320
jmp 0x48e760
cmp ecx, 0xa820
jne 0x490ad4
mov ecx, 0x18
push 1
push ecx
mov ecx, edi
call fcn.00472320
jmp 0x48e760
cmp ecx, 0xa821
jne 0x490af0
mov ecx, 0x17
push 1
push ecx
mov ecx, edi
call fcn.00472320
jmp 0x48e760
cmp ecx, 0xa822
jne 0x490b0c
mov ecx, 0x16
push 1
push ecx
mov ecx, edi
call fcn.00472320
jmp 0x48e760
sub ecx, 0xa823
neg ecx
sbb ecx, ecx
and ecx, 0xa
add ecx, 0x15
push 1
push ecx
mov ecx, edi
call fcn.00472320
jmp 0x48e760
cmp ecx, 0xa819
jne 0x490b47
mov ecx, 0x19
push 1
push ecx
mov ecx, edi
call fcn.004724f0
jmp 0x48e760
cmp ecx, 0xa81a
jne 0x490b63
mov ecx, 0x18
push 1
push ecx
mov ecx, edi
call fcn.004724f0
jmp 0x48e760
cmp ecx, 0xa81b
jne 0x490b7f
mov ecx, 0x17
push 1
push ecx
mov ecx, edi
call fcn.004724f0
jmp 0x48e760
cmp ecx, 0xa81c
jne 0x490b9b
mov ecx, 0x16
push 1
push ecx
mov ecx, edi
call fcn.004724f0
jmp 0x48e760
sub ecx, 0xa81d
neg ecx
sbb ecx, ecx
and ecx, 0xa
add ecx, 0x15
push 1
push ecx
mov ecx, edi
call fcn.004724f0
jmp 0x48e760
push 0x19
mov ecx, dword [edi + 0x580]
call fcn.00440260
push 0x18
mov ecx, dword [edi + 0x580]
call fcn.00440260
push 0x17
mov ecx, dword [edi + 0x580]
call fcn.00440260
push 0x16
mov ecx, dword [edi + 0x580]
call fcn.00440260
push 0x15
mov ecx, dword [edi + 0x580]
call fcn.00440260
jmp 0x48e760
mov eax, dword [edi + 0x1434]
lea ecx, [edi + 0x1434]
mov eax, dword [eax + 0x34]
call eax
test al, al
sete bl
mov al, byte [edi + 0x308]
mov byte [ebp - 0x368c], al
push dword [ebp - 0x368c]
lea ecx, [edi + 0x1434]
call fcn.00495060
test bl, bl
je 0x48e760
push 0
push 0
push str.GoToLine
push dword [edi + 0x1440]
lea ecx, [edi + 0x300]
call fcn.0045e090
jmp 0x48e760
mov eax, dword [edi + 0x68718]
lea ecx, [edi + 0x68718]
mov eax, dword [eax + 0x34]
call eax
test al, al
sete bl
mov al, byte [edi + 0x308]
mov byte [ebp - 0x368c], al
push dword [ebp - 0x368c]
lea ecx, [edi + 0x68718]
call fcn.00495030
test bl, bl
je 0x48e760
push 0
push 0
push str.FindCharsInRange
push dword [edi + 0x68724]
lea ecx, [edi + 0x300]
call fcn.0045e090
jmp 0x48e760
mov dword [ebp - 0x3698], 0xffffffff
mov dword [ebp - 0x368c], 0xffffffff
lea eax, [ebp - 0x368c]
push eax
lea eax, [ebp - 0x3698]
push eax
mov ecx, edi
call fcn.0046fed0
mov eax, dword [ebp - 0x368c]
cmp eax, 0xffffffff
je 0x48e760
cmp dword [ebp - 0x3688], 0xa801
jne 0x490d10
push 0
push eax
push 0x7e9
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48e760
mov ecx, dword [ebp - 0x3698]
cmp ecx, eax
mov edx, ecx
jg 0x490d20
mov edx, eax
jl 0x490d22
mov ecx, eax
lea eax, [edx + 1]
push eax
push ecx
push 0x870
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48e760
push 0xffffffffffffffff
mov ecx, edi
call fcn.0048e5a0
jmp 0x48e760
push 1
mov ecx, edi
call fcn.0046a960
jmp 0x48e760
push 0
mov ecx, edi
call fcn.0046a960
jmp 0x48e760
mov ecx, edi
call fcn.0048e580
jmp 0x48e760
mov ecx, edi
call fcn.0046b990
jmp 0x48e760
mov ecx, edi
call fcn.0046b710
jmp 0x48e760
mov ecx, edi
call fcn.004773c0
jmp 0x48e760
push 1
mov ecx, edi
call fcn.0046beb0
jmp 0x48e760
push 0
mov ecx, edi
call fcn.0046beb0
jmp 0x48e760
mov ecx, edi
call fcn.00474940
jmp 0x48e760
call fcn.0040baa0
mov ecx, dword [edi]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
cmp byte [eax + 0x98], cl
sete cl
lea ecx, [ecx*2 + 3]
push ecx
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, edi
call fcn.0049ad10
jmp 0x48e760
call fcn.0040baa0
mov ecx, dword [edi]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
cmp byte [eax + 0x98], cl
sete cl
lea ecx, [ecx*2 + 3]
push ecx
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi]
push 0
push 0
push 5
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x48e760
call fcn.0040baa0
mov ecx, dword [edi]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
cmp byte [eax + 0x98], cl
sete cl
lea ecx, [ecx*2 + 3]
push ecx
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x580]
mov esi, dword [eax + 0x1c]
call fcn.00439ba0
cmp dword [esi + 0x64], 2
jne 0x490e6e
push dword [esi + 0xc]
mov ecx, dword [esi]
call fcn.0041af60
test eax, eax
je 0x490e75
mov ecx, edi
call fcn.0049ad10
push 0xa415
mov ecx, edi
call fcn.0048e6c0
jmp 0x48e760
call fcn.0040baa0
mov ecx, dword [edi]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
cmp byte [eax + 0x98], cl
sete cl
lea ecx, [ecx*2 + 3]
push ecx
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi]
push 0
push 0
push 5
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, edi
call fcn.0049ad50
jmp 0x48e760
mov eax, dword [edi]
mov byte [eax + 0x69010], 0
push 2
mov ecx, dword [edi + 0x689d0]
call fcn.004f7430
mov eax, dword [edi]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x48e760
mov eax, dword [edi]
push 0
push 0
push 0x10
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x48e760
mov edx, dword [edi + 0x68fd8]
test edx, edx
je case.default.0x492eaf
cmp ecx, 0xa9ee
sete al
movzx eax, al
push eax
lea eax, [ebp - 0x3428]
push eax
mov ecx, edx
call fcn.00495560
mov dword [ebp - 4], 0xe
mov ebx, dword [ebp - 0x3424]
mov eax, dword [ebp - 0x3428]
sub ebx, eax
sar ebx, 3
xor esi, esi
test ebx, ebx
je 0x490f6b
lea ecx, [ecx]
push dword [eax + esi*8 + 4]
push dword [eax + esi*8]
mov ecx, edi
call fcn.004990a0
inc esi
cmp esi, ebx
jae 0x490f6b
mov eax, dword [ebp - 0x3428]
jmp 0x490f50
mov ecx, dword [ebp - 0x3688]
cmp ecx, 0xa9ee
jne 0x490f9c
mov eax, dword [edi + 0x580]
mov ecx, dword [edi + 0x68fd8]
push dword [edi + 0x68ff8]
push dword [eax + 0x1c]
add ecx, 0x6c
call fcn.00502690
mov ecx, dword [ebp - 0x3688]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x3428]
test edx, edx
je case.default.0x492eaf
mov eax, dword [ebp - 0x3420]
sub eax, edx
sar eax, 3
push eax
push edx
lea ecx, [ebp - 0x3428]
call fcn.004414b0
mov dword [ebp - 0x3428], 0
mov dword [ebp - 0x3424], 0
mov dword [ebp - 0x3420], 0
jmp 0x48e760
cmp ecx, 0xafcb
jg 0x492afa
cmp ecx, 0xafc9
jge 0x492a6f
lea eax, [ecx - 0xabe2]
cmp eax, 0x65
ja case.default.0x49431c
movzx eax, byte [eax + 0x494c78]
jmp dword [eax*4 + 0x494ba8]
mov ecx, edi
call fcn.00475650
jmp 0x48e760
push 0
lea eax, [edi + 0x68fdc]
push eax
push ecx
mov ecx, edi
call fcn.00475a30
jmp 0x48e760
push 1
lea eax, [edi + 0x68fe0]
push eax
push ecx
mov ecx, edi
call fcn.00475a30
jmp 0x48e760
push 2
lea eax, [edi + 0x68fe4]
push eax
push ecx
mov ecx, edi
call fcn.00475a30
jmp 0x48e760
mov ecx, dword [edi + 0x68fe8]
test ecx, ecx
jne 0x4910f0
call fcn.0040baa0
lea ecx, [ebp - 0x3428]
push ecx
mov ecx, eax
call fcn.004953e0
mov dword [ebp - 4], 0x27
push 0
push eax
mov ecx, edi
call fcn.00475390
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3428]
call fcn.00403aa0
cmp dword [edi + 0x68fe8], 0
je 0x48e760
push 8
push 0xac35
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 1
push 0xac35
lea ecx, [edi + 0x65c]
call fcn.00486ad0
mov eax, dword [edi + 0x68fe8]
mov byte [eax + 0x60], 0
jmp 0x48e760
mov al, byte [ecx + 0x60]
test al, al
jne 0x491132
mov eax, dword [ecx]
push 0
call dword [eax + 0xc]
mov eax, dword [edi + 0x68fe8]
mov byte [eax + 0x60], 1
push 0
push 0xac35
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0xac35
lea ecx, [edi + 0x65c]
call fcn.00486ad0
jmp 0x48e760
lea ecx, [ebp - 0x3428]
call fcn.0048cbb0
mov dword [ebp - 4], 0x28
push 0
lea eax, [ebp - 0x3428]
push eax
mov ecx, edi
call fcn.00475390
push 8
push 0xac35
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 1
push 0xac35
lea ecx, [edi + 0x65c]
call fcn.00486ad0
mov eax, dword [edi + 0x68fe8]
mov byte [eax + 0x60], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3428]
call fcn.00403aa0
jmp 0x48e760
mov ecx, dword [edi + 0x68fec]
test ecx, ecx
je 0x4911f8
mov al, byte [ecx + 0x60]
test al, al
jne 0x4911f8
mov eax, dword [ecx]
push 0
call dword [eax + 0xc]
mov ecx, dword [edi + 0x68fec]
push 0
push 0
add ecx, 0x6c
call fcn.004e92f0
mov eax, dword [edi + 0x68fec]
mov byte [eax + 0x60], 1
push 0
push 0xac30
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0xac30
lea ecx, [edi + 0x65c]
call fcn.00486ad0
jmp 0x48e760
mov ecx, edi
call fcn.00475150
cmp dword [edi + 0x68fec], 0
je 0x48e760
push 8
push 0xac30
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 1
push 0xac30
lea ecx, [edi + 0x65c]
call fcn.00486ad0
mov eax, dword [edi + 0x68fec]
mov byte [eax + 0x60], 0
jmp 0x48e760
mov ecx, dword [edi + 0x68ff0]
test ecx, ecx
je 0x49128c
mov al, byte [ecx + 0x60]
test al, al
jne 0x49128c
mov eax, dword [ecx]
push 0
call dword [eax + 0xc]
mov eax, dword [edi + 0x68ff0]
mov byte [eax + 0x60], 1
push 0
push 0xac34
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0xac34
lea ecx, [edi + 0x65c]
call fcn.00486ad0
jmp 0x48e760
push 8
push 0xac34
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 1
push 0xac34
lea ecx, [edi + 0x65c]
call fcn.00486ad0
mov ecx, edi
call fcn.00475830
mov eax, dword [edi + 0x68ff0]
mov byte [eax + 0x60], 0
jmp 0x48e760
lea eax, [ecx - 0xac36]
push eax
mov ecx, dword [edi + 0x418]
call fcn.00439b00
mov byte [edi + 0x689b5], 1
test eax, eax
jne 0x491300
mov ecx, dword [edi + 0x418]
call fcn.00495540
dec eax
test eax, eax
jle 0x491308
push eax
mov ecx, dword [edi + 0x418]
call fcn.00439b00
push eax
mov ecx, edi
call fcn.0047bb00
mov byte [edi + 0x689b5], 0
jmp 0x48e760
mov ecx, dword [edi + 0x418]
call fcn.00482f30
mov esi, eax
mov ecx, dword [edi + 0x418]
call fcn.00495540
dec eax
mov byte [edi + 0x689b5], 1
mov ecx, dword [edi + 0x418]
cmp esi, eax
jge 0x491344
lea eax, [esi + 1]
push eax
jmp 0x491346
push 0
call fcn.00439b00
push eax
mov ecx, edi
call fcn.0047bb00
mov byte [edi + 0x689b5], 0
jmp 0x48e760
mov ecx, dword [edi + 0x418]
call fcn.00482f30
mov byte [edi + 0x689b5], 1
mov ecx, dword [edi + 0x418]
test eax, eax
jg 0x491386
call fcn.00495540
mov ecx, dword [edi + 0x418]
dec eax
push eax
call fcn.00439b00
push eax
mov ecx, edi
call fcn.0047bb00
mov byte [edi + 0x689b5], 0
jmp 0x48e760
mov ecx, dword [edi + 0x418]
call fcn.00482f30
mov esi, eax
mov dword [ebp - 0x368c], esi
mov ecx, dword [edi + 0x418]
call fcn.00495540
dec eax
cmp dword [ebp - 0x3688], 0xac42
jne 0x4913d9
cmp esi, eax
jge case.0x4948be.44069
lea ebx, [esi + 1]
jmp 0x4913e5
cmp esi, 1
jl case.0x4948be.44069
lea ebx, [esi - 1]
mov dword [ebp - 0x34e4], 0xb
mov dword [ebp - 0x3498], 0xb
lea eax, [ebp - 0x214]
mov dword [ebp - 0x348c], eax
mov dword [ebp - 0x3488], 0x100
lea eax, [ebp - 0x414]
mov dword [ebp - 0x34d8], eax
mov dword [ebp - 0x34d4], 0x100
mov eax, dword [edi + 0x418]
lea ecx, [ebp - 0x3498]
push ecx
push esi
push 0x133c
push dword [eax + 0xc]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
mov eax, dword [edi + 0x418]
lea ecx, [ebp - 0x34e4]
push ecx
push ebx
push 0x133c
push dword [eax + 0xc]
call esi
mov eax, dword [edi + 0x418]
lea ecx, [ebp - 0x34e4]
push ecx
push dword [ebp - 0x368c]
push 0x133d
push dword [eax + 0xc]
call esi
mov eax, dword [edi + 0x418]
lea ecx, [ebp - 0x3498]
push ecx
push ebx
push 0x133d
push dword [eax + 0xc]
call esi
mov eax, dword [edi + 0x418]
push 0
push ebx
push 0x130c
push dword [eax + 0xc]
call esi
mov eax, dword [edi + 0x418]
push ebx
push 0
push 0x420
push dword [eax + 8]
call esi
jmp 0x48e760
mov ecx, edi
call fcn.0046ffb0
jmp 0x48e760
push 0
push ecx
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_GetMenuState]
lea esi, [eax - 8]
neg esi
sbb esi, esi
and esi, 8
push esi
mov ebx, dword [ebp - 0x3688]
push ebx
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
push 3
push 0
push 0
push 0
push 0
xor eax, eax
cmp esi, 8
sete al
add eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, ebx
jmp case.default.0x492eaf
cmp ecx, 0xabfe
setne al
movzx eax, al
push eax
mov ecx, dword [edi + 0x580]
call fcn.004d8380
jmp 0x48e760
mov byte [edi + 0x689b5], 1
cmp ecx, 0xabea
setne byte [ebp - 0x368c]
mov esi, dword [ebp - 0x368c]
push esi
mov ecx, dword [edi + 0x580]
call fcn.004d80d0
mov ecx, dword [edi + 0x68fec]
test ecx, ecx
je 0x491308
push esi
call fcn.0043a0b0
mov byte [edi + 0x689b5], 0
jmp 0x48e760
push 0
lea eax, [ecx - 0xac13]
mov byte [edi + 0x689b5], 1
push eax
mov ecx, dword [edi + 0x580]
call fcn.004d6150
mov byte [edi + 0x689b5], 0
jmp 0x48e760
push 1
lea eax, [ecx - 0xac1d]
jmp 0x491588
cmp dword [edi + 0x68c], 0
je case.default.0x492eaf
lea ecx, [edi + 0x65c]
call fcn.004f6bf0
mov ecx, edi
call fcn.0046ac60
jmp 0x48e760
cmp dword [edi + 0x68c], 1
je case.default.0x492eaf
lea ecx, [edi + 0x65c]
call fcn.004f6340
mov ecx, edi
call fcn.0046ac60
jmp 0x48e760
cmp dword [edi + 0x68c], 2
je case.default.0x492eaf
lea ecx, [edi + 0x65c]
call fcn.004f71a0
jmp 0x48e760
cmp byte [edi + 0x75c], 0
sete al
mov byte [edi + 0x75c], al
call fcn.0040baa0
movzx ecx, byte [edi + 0x75c]
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffa
add ecx, 0x12
push ecx
lea ecx, [eax + 0xc]
call fcn.00495da0
mov dword [ebp - 0x368c], eax
call fcn.0040baa0
push 0x60
push dword [eax + 0xc]
push 0x2d
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ebx, eax
call fcn.0040baa0
movzx ecx, byte [edi + 0x75c]
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 0x19
push ecx
lea ecx, [eax + 0xc]
call fcn.00495da0
movzx esi, ax
shl esi, 0x10
movzx eax, bx
or esi, eax
push esi
push 0
push 0x1329
push dword [edi + 0x31c]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
call ebx
push esi
push 0
push 0x1329
push dword [edi + 0x3a0]
call ebx
push dword [ebp - 0x368c]
lea ecx, [edi + 0x710]
call fcn.0045b980
xor eax, eax
cmp byte [edi + 0x75c], al
setne al
lea eax, [eax*4 + 0xd]
push eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov esi, eax
test esi, esi
je 0x4916f9
push 1
push esi
push 0x30
push dword [edi + 0x31c]
call ebx
push 1
push esi
push 0x30
push dword [edi + 0x3a0]
call ebx
mov eax, dword [edi]
push 0
push 0
push 5
push dword [eax + 0xc]
call ebx
jmp 0x48e760
cmp byte [0x611304], 0
sete byte [0x611304]
jmp case.default.0x492eaf
cmp byte [0x5fbed8], 0
sete al
movzx eax, al
push eax
call fcn.00495e00
add esp, 4
jmp 0x48e760
cmp byte [0x5fbed9], 0
sete al
movzx eax, al
push eax
call fcn.00495e40
add esp, 4
jmp 0x48e760
cmp byte [0x611305], 0
sete al
movzx eax, al
push eax
call fcn.00495e20
add esp, 4
call fcn.0040baa0
push 0x60
push dword [eax + 0x10]
push 0x16
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
mov bl, byte [0x611305]
call fcn.0040baa0
movzx ecx, bl
neg ecx
sbb ecx, ecx
and ecx, 0xf
add ecx, 0x2d
push ecx
lea ecx, [eax + 0xc]
call fcn.00495d80
movzx esi, si
shl esi, 0x10
movzx eax, ax
or esi, eax
push esi
push 0
push 0x1329
push dword [edi + 0x31c]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
call ebx
push esi
push 0
push 0x1329
jmp 0x4916f1
cmp byte [0x611306], 0
sete byte [0x611306]
jmp case.default.0x492eaf
cmp byte [0x611307], 0
sete al
movzx eax, al
push eax
call fcn.00495ee0
add esp, 4
jmp case.0x49101a.44040
cmp byte [0x611308], 0
sete al
movzx eax, al
push eax
call fcn.00495e80
add esp, 4
jmp case.0x49101a.44040
mov ecx, edi
call fcn.00477630
jmp 0x48e760
mov eax, dword [edi + 0x580]
mov esi, dword [eax + 0x20]
cmp dword [esi + 0x64], 2
je case.default.0x492eaf
lea ecx, [ebp - 0x344c]
call fcn.0045de80
mov dword [ebp - 4], 0x47
mov ebx, dword [ebp - 0x3688]
cmp ebx, 0xac44
jne 0x49185c
push str.firefox.exe
jmp 0x491870
cmp ebx, 0xac45
jne 0x49186b
push str.chrome.exe
jmp 0x491870
push str.IEXPLORE.EXE
lea ecx, [ebp - 0x344c]
call fcn.00403ef0
push 0x208
push 0
lea eax, [ebp - 0x41c]
push eax
call fcn.00544020
add esp, 0xc
mov dword [ebp - 0x368c], 0x208
mov dword [ebp - 0x3694], 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0x34b0]
call fcn.004029a0
mov byte [ebp - 4], 0x48
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x344c]
push eax
lea ecx, [ebp - 0x34b0]
call fcn.00406650
cmp dword [ebp - 0x349c], 8
mov eax, dword [ebp - 0x34b0]
jae 0x4918e4
lea eax, [ebp - 0x34b0]
lea ecx, [ebp - 0x3694]
push ecx
push 0x20019
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x368c]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x3420]
push eax
push 0
push 0x5883b8
push dword [ebp - 0x3694]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x593ed8
lea ecx, [ebp - 0x347c]
call fcn.004029a0
mov byte [ebp - 4], 0x49
mov ecx, esi
call fcn.00495510
push eax
lea ecx, [ebp - 0x347c]
call fcn.0040a2e0
push 0x593ed8
lea ecx, [ebp - 0x347c]
call fcn.0040a2e0
cmp dword [ebp - 0x3694], 0
je 0x4919a0
cmp word [ebp - 0x41c], 0
je 0x4919a0
cmp dword [ebp - 0x3468], 8
mov eax, dword [ebp - 0x347c]
jae 0x491985
lea eax, [ebp - 0x347c]
push 1
push 0
push eax
lea eax, [ebp - 0x41c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4919c5
mov eax, dword [edi]
push 0
push 0
push 0
push str.View_Current_File_in_Browser
push str.Application_cannot_be_found_in_your_system.
push dword [eax + 0xc]
push str.ViewInBrowser
lea ecx, [edi + 0x300]
call fcn.004607b0
push dword [ebp - 0x3694]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x347c]
call fcn.004038c0
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x34b0]
call fcn.004038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344c]
call fcn.004038c0
jmp 0x48e760
mov eax, dword [edi + 0x580]
mov eax, dword [eax + 0x20]
cmp dword [eax + 0x64], 2
je case.default.0x492eaf
mov ecx, eax
call fcn.00495510
push eax
lea ecx, [ebp - 0x344c]
call fcn.004029a0
mov dword [ebp - 4], 0x4a
cmp dword [ebp - 0x3438], 8
mov eax, dword [ebp - 0x344c]
jae 0x491a48
lea eax, [ebp - 0x344c]
push 5
push 0
push eax
push str.shell:AppsfolderMicrosoft.MicrosoftEdge_8wekyb3d8bbwe_MicrosoftEdge
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344c]
call fcn.004038c0
jmp 0x48e760
push 0
push 0xabf9
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_GetMenuState]
cmp eax, 8
setne bl
mov byte [ebp - 0x368c], bl
push 0
push 0xabfa
push dword [edi + 0x68934]
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
call esi
push 0
push 0xabf3
push dword [edi + 0x68934]
call esi
movzx eax, bl
neg eax
sbb eax, eax
and eax, 8
push eax
push 0xabf9
push dword [edi + 0x68934]
call esi
push 0
push 0xabf3
lea ecx, [edi + 0x65c]
call fcn.00486ad0
push 0
lea ecx, [edi + 0x478]
call fcn.00495f00
mov ebx, dword [ebp - 0x368c]
push ebx
lea ecx, [edi + 0x478]
call fcn.00495f70
push 0
lea ecx, [edi + 0x420]
call fcn.00495f00
push ebx
lea ecx, [edi + 0x420]
call fcn.00495f70
call fcn.0040baa0
mov cl, bl
mov byte [eax + 0x768], cl
mov byte [eax + 0x769], 0
jmp 0x48e760
push 0
push 0xabfa
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_GetMenuState]
cmp eax, 8
setne bl
mov byte [ebp - 0x368c], bl
push 0
push 0xabf9
push dword [edi + 0x68934]
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
call esi
movzx eax, bl
neg eax
sbb eax, eax
and eax, 8
push eax
push 0xabfa
push dword [edi + 0x68934]
call esi
push 0
push 0xabf3
push dword [edi + 0x68934]
call esi
push 0
push 0xabf3
lea ecx, [edi + 0x65c]
call fcn.00486ad0
mov esi, dword [ebp - 0x368c]
push esi
lea ecx, [edi + 0x478]
call fcn.00495f00
lea ecx, [edi + 0x420]
push esi
call fcn.00495f00
push 0
push 0
push 0x7e5
lea ecx, [edi + 0x478]
call fcn.0040d9f0
push 0
push 2
push 0x826
lea ecx, [edi + 0x478]
call fcn.0040d9f0
push 0
push 0
push 0x7e5
lea ecx, [edi + 0x420]
call fcn.0040d9f0
push 0
push 2
push 0x826
lea ecx, [edi + 0x420]
call fcn.0040d9f0
call fcn.0040baa0
mov byte [eax + 0x768], 0
mov cl, bl
mov byte [eax + 0x769], cl
jmp 0x48e760
push 0
push ecx
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_GetMenuState]
cmp eax, 8
setne bl
mov byte [ebp - 0x368c], bl
push 0
push 0xabfa
push dword [edi + 0x68934]
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
call esi
push 0
push 0xabf9
push dword [edi + 0x68934]
call esi
movzx eax, bl
neg eax
sbb eax, eax
and eax, 8
push eax
push 0xabf3
push dword [edi + 0x68934]
call esi
mov esi, dword [ebp - 0x368c]
push esi
lea ecx, [edi + 0x478]
call fcn.00495f20
push esi
lea ecx, [edi + 0x420]
call fcn.00495f20
push esi
push 0xabf3
lea ecx, [edi + 0x65c]
call fcn.00486ad0
call fcn.0040baa0
mov byte [eax + 0x768], bl
mov byte [eax + 0x769], bl
jmp 0x48e760
mov ecx, dword [edi + 0x580]
call fcn.004957b0
test al, al
sete al
movzx eax, al
push eax
lea ecx, [edi + 0x478]
call fcn.004de8a0
mov ecx, dword [edi + 0x580]
call fcn.004957b0
test al, al
sete al
movzx eax, al
push eax
lea ecx, [edi + 0x420]
call fcn.004de8a0
mov ecx, dword [edi + 0x580]
call fcn.004957b0
movzx eax, al
push eax
push 0xabf4
lea ecx, [edi + 0x65c]
call fcn.00486ad0
mov ecx, dword [edi + 0x580]
call fcn.004957b0
movzx eax, al
push eax
push 0xabf4
mov ecx, edi
call fcn.0048e640
call fcn.0040baa0
mov esi, eax
mov ecx, dword [edi + 0x580]
call fcn.004957b0
mov byte [esi + 0x74d], al
jmp 0x48e760
mov ecx, dword [edi + 0x580]
call fcn.0043a160
test al, al
sete bl
mov byte [ebp - 0x368c], bl
test bl, bl
jne 0x491d97
lea ecx, [edi + 0x478]
call fcn.004da940
mov byte [edi + 0x4a1], 1
lea ecx, [edi + 0x420]
call fcn.004da940
mov byte [edi + 0x449], 1
mov esi, dword [ebp - 0x368c]
push esi
lea ecx, [edi + 0x478]
call fcn.004967d0
push esi
lea ecx, [edi + 0x420]
call fcn.004967d0
push esi
push 0xabf6
lea ecx, [edi + 0x65c]
call fcn.00486ad0
push esi
push 0xabf6
mov ecx, edi
call fcn.0048e640
call fcn.0040baa0
mov byte [eax + 0x750], bl
mov ecx, dword [edi + 0x68fec]
test ecx, ecx
je 0x48e760
call fcn.0043a0c0
push 0
mov ecx, dword [edi + 0x68fec]
call fcn.0043ac20
jmp 0x48e760
mov ecx, dword [edi + 0x580]
call fcn.004957d0
test al, al
sete al
movzx eax, al
push eax
lea ecx, [edi + 0x478]
call fcn.00495fa0
mov ecx, dword [edi + 0x580]
call fcn.004957d0
test al, al
sete al
movzx eax, al
push eax
lea ecx, [edi + 0x420]
call fcn.00495fa0
mov ecx, dword [edi + 0x580]
call fcn.004957d0
movzx eax, al
push eax
push 0xac09
mov ecx, edi
call fcn.0048e640
call fcn.0040baa0
mov esi, eax
mov ecx, dword [edi + 0x580]
call fcn.004957d0
mov byte [esi + 0x74f], al
jmp 0x48e760
mov ecx, dword [edi + 0x580]
call fcn.004d8f80
jmp 0x48e760
push 0
push 0
push 0x91d
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48e760
push 0
push 0
push 0x91e
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48e760
push 0
push 0
push 0x945
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48e760
mov bh, byte [edi + 0x689c8]
test bh, bh
sete bl
mov byte [ebp - 0x368c], bl
mov esi, dword [ebp - 0x368c]
push esi
push 0xac03
mov ecx, edi
call fcn.0048e640
push esi
push 0xac03
lea ecx, [edi + 0x65c]
call fcn.00486ad0
mov byte [edi + 0x689c8], bl
test bh, bh
jne 0x48e760
push 0
push 0
push 0x868
lea ecx, [edi + 0x478]
call fcn.0040d9f0
mov esi, eax
push 0
push 0
push 0x868
lea ecx, [edi + 0x420]
call fcn.0040d9f0
sub esi, eax
mov dword [edi + 0x689c0], esi
jmp 0x48e760
mov bh, byte [edi + 0x689c9]
test bh, bh
sete bl
mov byte [ebp - 0x368c], bl
mov esi, dword [ebp - 0x368c]
push esi
push 0xac04
mov ecx, edi
call fcn.0048e640
push esi
push 0xac04
lea ecx, [edi + 0x65c]
call fcn.00486ad0
mov byte [edi + 0x689c9], bl
test bh, bh
jne 0x48e760
push 0
push 0
push 0x95e
lea ecx, [edi + 0x478]
call fcn.0040d9f0
mov esi, eax
push 0x5ae424
push 0x20
push 0x8e4
lea ecx, [edi + 0x478]
call fcn.0040d9f0
mov ecx, eax
mov eax, esi
cdq
idiv ecx
mov dword [ebp - 0x368c], eax
push 0
push 0
push 0x95e
lea ecx, [edi + 0x420]
call fcn.0040d9f0
mov esi, eax
push 0x5ae424
push 0x20
push 0x8e4
lea ecx, [edi + 0x420]
call fcn.0040d9f0
mov ecx, eax
mov eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x368c]
sub ecx, eax
mov dword [edi + 0x689c4], ecx
jmp 0x48e760
push 0x5883b8
lea ecx, [ebp - 0x3434]
call fcn.004029a0
mov dword [ebp - 4], 0x4b
mov eax, dword [edi + 0x580]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x3698], eax
mov ecx, eax
call fcn.0041b310
mov esi, eax
mov dword [ebp - 0x368c], edx
call fcn.0040baa0
mov ebx, dword [eax + 0x234d8]
mov dword [ebp - 0x36a8], ebx
test ebx, ebx
je 0x4927dc
and esi, dword [ebp - 0x368c]
cmp esi, 0xffffffff
je 0x492244
push str.Full_file_path:
lea ecx, [ebp - 0x3464]
call fcn.004029a0
mov byte [ebp - 4], 0x4c
lea eax, [ebp - 0x3464]
push eax
push str.summary_filepath
lea eax, [ebp - 0x3580]
push eax
mov ecx, ebx
call fcn.0045ff80
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x3464]
call fcn.004038c0
push str.Created:
lea ecx, [ebp - 0x347c]
call fcn.004029a0
mov byte [ebp - 4], 0x4f
lea eax, [ebp - 0x347c]
push eax
push str.summary_filecreatetime
lea eax, [ebp - 0x3568]
push eax
mov ecx, ebx
call fcn.0045ff80
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x347c]
call fcn.004038c0
push str.Modified:
lea ecx, [ebp - 0x34b0]
call fcn.004029a0
mov byte [ebp - 4], 0x52
lea eax, [ebp - 0x34b0]
push eax
push str.summary_filemodifytime
lea eax, [ebp - 0x3550]
push eax
mov ecx, ebx
call fcn.0045ff80
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x34b0]
call fcn.004038c0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x3580]
push eax
lea ecx, [ebp - 0x3434]
call fcn.00406650
mov esi, dword [ebp - 0x3698]
mov ecx, esi
call fcn.00495510
push eax
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
push 0x5962bc
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x3568]
push eax
lea ecx, [ebp - 0x3434]
call fcn.00406650
push 0
lea eax, [ebp - 0x3538]
push eax
mov ecx, esi
call fcn.0041b3e0
mov byte [ebp - 4], 0x55
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x3434]
call fcn.00406650
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x3538]
call fcn.004038c0
push 0x5962bc
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x3550]
push eax
lea ecx, [ebp - 0x3434]
call fcn.00406650
push 1
lea eax, [ebp - 0x34e0]
push eax
mov ecx, esi
call fcn.0041b3e0
mov byte [ebp - 4], 0x56
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x3434]
call fcn.00406650
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x34e0]
call fcn.004038c0
push 0x5962bc
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x3550]
call fcn.004038c0
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x3568]
call fcn.004038c0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x3580]
call fcn.004038c0
push str.Characters__without_line_endings_:
lea ecx, [ebp - 0x3580]
call fcn.004029a0
mov byte [ebp - 4], 0x57
lea eax, [ebp - 0x3580]
push eax
push str.summary_nbchar
lea eax, [ebp - 0x3494]
push eax
mov ecx, ebx
call fcn.0045ff80
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x3580]
call fcn.004038c0
push str.Words:
lea ecx, [ebp - 0x3568]
call fcn.004029a0
mov byte [ebp - 4], 0x5a
lea eax, [ebp - 0x3568]
push eax
push str.summary_nbword
lea eax, [ebp - 0x34c8]
push eax
mov ecx, ebx
call fcn.0045ff80
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x3568]
call fcn.004038c0
push str.Lines:
lea ecx, [ebp - 0x3550]
call fcn.004029a0
mov byte [ebp - 4], 0x5d
lea eax, [ebp - 0x3550]
push eax
push str.summary_nbline
lea eax, [ebp - 0x3684]
push eax
mov ecx, ebx
call fcn.0045ff80
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x3550]
call fcn.004038c0
push str.Document_length:
lea ecx, [ebp - 0x3464]
call fcn.004029a0
mov byte [ebp - 4], 0x60
lea eax, [ebp - 0x3464]
push eax
push str.summary_nbbyte
lea eax, [ebp - 0x366c]
push eax
mov ecx, ebx
call fcn.0045ff80
mov byte [ebp - 4], 0x62
lea ecx, [ebp - 0x3464]
call fcn.004038c0
push str._selected_characters__
lea ecx, [ebp - 0x347c]
call fcn.004029a0
mov byte [ebp - 4], 0x63
lea eax, [ebp - 0x347c]
push eax
push str.summary_nbsel1
lea eax, [ebp - 0x3654]
push eax
mov ecx, ebx
call fcn.0045ff80
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0x347c]
call fcn.004038c0
push str._bytes__in
lea ecx, [ebp - 0x34b0]
call fcn.004029a0
mov byte [ebp - 4], 0x66
lea eax, [ebp - 0x34b0]
push eax
push str.summary_nbsel2
lea eax, [ebp - 0x363c]
push eax
mov ecx, ebx
call fcn.0045ff80
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x34b0]
call fcn.004038c0
push str._ranges
lea ecx, [ebp - 0x3538]
call fcn.004029a0
mov byte [ebp - 4], 0x69
lea eax, [ebp - 0x3538]
push eax
push str.summary_nbrange
lea eax, [ebp - 0x3624]
push eax
mov ecx, ebx
call fcn.0045ff80
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x3538]
call fcn.004038c0
mov eax, dword [edi + 0x580]
mov eax, dword [eax + 0x20]
mov esi, dword [eax + 0x34]
push esi
mov ecx, edi
call fcn.00470300
mov ebx, eax
mov ecx, edi
call fcn.0047d460
mov dword [ebp - 0x368c], eax
push 0
push 0
push 0x86a
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov dword [ebp - 0x3698], eax
push 0
push 0
push 0x7d6
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov dword [ebp - 0x36a4], eax
push esi
mov ecx, edi
call fcn.004719c0
mov esi, eax
mov ecx, edi
call fcn.00471950
mov dword [ebp - 0x3694], eax
mov ecx, edi
call fcn.004718e0
mov dword [ebp - 0x36a0], eax
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x3494]
push eax
lea ecx, [ebp - 0x3434]
call fcn.00406650
push ebx
lea eax, [ebp - 0x34e0]
push eax
call fcn.00424620
add esp, 8
mov byte [ebp - 4], 0x6c
cmp dword [eax + 0x14], 8
jb 0x49249c
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x34e0]
call fcn.004038c0
push 0x5962bc
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x34c8]
push eax
lea ecx, [ebp - 0x3434]
call fcn.00406650
push dword [ebp - 0x368c]
lea eax, [ebp - 0x3538]
push eax
call fcn.00424620
add esp, 8
mov byte [ebp - 4], 0x6d
cmp dword [eax + 0x14], 8
jb 0x4924fe
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x3538]
call fcn.004038c0
push 0x5962bc
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x3684]
push eax
lea ecx, [ebp - 0x3434]
call fcn.00406650
push dword [ebp - 0x3698]
lea eax, [ebp - 0x34e0]
push eax
call fcn.00424620
add esp, 8
mov byte [ebp - 4], 0x6e
cmp dword [eax + 0x14], 8
jb 0x492560
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x34e0]
call fcn.004038c0
push 0x5962bc
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x366c]
push eax
lea ecx, [ebp - 0x3434]
call fcn.00406650
push dword [ebp - 0x36a4]
lea eax, [ebp - 0x3580]
push eax
call fcn.00424620
add esp, 8
mov byte [ebp - 4], 0x6f
mov ecx, eax
call fcn.0042d9f0
push eax
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x3580]
call fcn.004038c0
push 0x5962bc
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
push esi
lea eax, [ebp - 0x3568]
push eax
call fcn.00424620
add esp, 8
mov byte [ebp - 4], 0x70
mov ecx, eax
call fcn.0042d9f0
push eax
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x3568]
call fcn.004038c0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x3654]
push eax
lea ecx, [ebp - 0x3434]
call fcn.00406650
push dword [ebp - 0x3694]
lea eax, [ebp - 0x3550]
push eax
call fcn.00424620
add esp, 8
mov byte [ebp - 4], 0x71
mov ecx, eax
call fcn.0042d9f0
push eax
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x3550]
call fcn.004038c0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x363c]
push eax
lea ecx, [ebp - 0x3434]
call fcn.00406650
push dword [ebp - 0x36a0]
lea eax, [ebp - 0x3464]
push eax
call fcn.00424620
add esp, 8
mov byte [ebp - 4], 0x72
mov ecx, eax
call fcn.0042d9f0
push eax
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x3464]
call fcn.004038c0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x3624]
push eax
lea ecx, [ebp - 0x3434]
call fcn.00406650
push 0x5962bc
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
push str.Summary
lea ecx, [ebp - 0x3538]
call fcn.004029a0
mov byte [ebp - 4], 0x73
lea eax, [ebp - 0x3538]
push eax
push str.summary
lea eax, [ebp - 0x344c]
push eax
mov ecx, dword [ebp - 0x36a8]
call fcn.0045ff80
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x3538]
call fcn.004038c0
cmp dword [ebp - 0x3438], 8
mov ecx, dword [ebp - 0x344c]
jae 0x492740
lea ecx, [ebp - 0x344c]
cmp dword [ebp - 0x3420], 8
mov edx, dword [ebp - 0x3434]
jae 0x492755
lea edx, [ebp - 0x3434]
mov eax, dword [edi]
push 0
push ecx
push edx
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x344c]
call fcn.004038c0
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x3624]
call fcn.004038c0
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0x363c]
call fcn.004038c0
mov byte [ebp - 4], 0x62
lea ecx, [ebp - 0x3654]
call fcn.004038c0
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x366c]
call fcn.004038c0
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x3684]
call fcn.004038c0
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x34c8]
call fcn.004038c0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x3494]
call fcn.004038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3434]
call fcn.004038c0
jmp 0x48e760
mov eax, dword [edi + 0x580]
mov esi, dword [eax + 0x20]
mov al, byte [esi + 0xb8]
test al, al
je 0x492815
push 0
push esi
mov ecx, edi
call fcn.00476b50
jmp 0x48e760
mov ecx, esi
call fcn.00495510
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4928b6
mov al, byte [esi + 0x30]
test al, al
je 0x49285c
mov eax, dword [edi]
push 0
push 0
push 0
push str.Monitoring_problem
push str.The_document_is_dirty._Please_save_the_modification_before_monitoring_it.
push dword [eax + 0xc]
push str.DocTooDirtyToMonitor
lea ecx, [edi + 0x300]
call fcn.004607b0
jmp 0x48e760
push 1
push esi
mov ecx, edi
call fcn.00476b50
push 8
call fcn.0052bd3f
add esp, 4
mov dword [ebp - 0x3420], eax
mov dword [ebp - 4], 0x76
test eax, eax
je 0x49288d
mov ecx, dword [edi]
mov ecx, dword [ecx + 0xc]
mov dword [eax], esi
mov dword [eax + 4], ecx
jmp 0x49288f
xor eax, eax
mov dword [ebp - 4], 0xffffffff
push 0
push 0
push eax
push 0x49d2c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48e760
mov eax, dword [edi]
push 0
push 0
push 0
push str.Monitoring_problem
push str.The_file_should_exist_to_be_monitored.
push dword [eax + 0xc]
push str.DocNoExistToMonitor
lea ecx, [edi + 0x300]
call fcn.004607b0
jmp 0x48e760
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi + 0x580]
cmp dword [ecx + 0xc], eax
jne 0x492908
xor ebx, ebx
cmp dword [edi + 0x68ff8], ebx
sete bl
push ebx
mov ecx, edi
call fcn.0047d440
test al, al
jne 0x49290e
mov ebx, dword [edi + 0x68ff8]
push ebx
mov ecx, edi
call fcn.0047ba00
jmp 0x48e760
cmp ecx, 0xabec
mov esi, dword [0x5bdda8]
je 0x49292f
mov esi, dword [0x5bddac]
push esi
lea ecx, [edi + 0x478]
call fcn.00495730
lea ecx, [edi + 0x478]
test al, al
je 0x492960
push 0
push esi
call fcn.00413ac0
push 0
push esi
lea ecx, [edi + 0x420]
call fcn.00413ac0
jmp 0x48e760
push 1
push esi
call fcn.00413ac0
push 1
push esi
lea ecx, [edi + 0x420]
call fcn.00413ac0
jmp 0x48e760
cmp ecx, 0xabef
jne 0x49298a
mov ebx, 1
jmp 0x4929b6
cmp ecx, 0xabf0
jne 0x492999
mov ebx, 2
jmp 0x4929b6
cmp ecx, 0xabf1
jne 0x4929a8
mov ebx, 3
jmp 0x4929b6
xor ebx, ebx
cmp ecx, 0xabee
sete bl
add ebx, 4
push ebx
lea ecx, [edi + 0x478]
call fcn.0044a650
push ebx
lea ecx, [edi + 0x420]
call fcn.0044a650
jmp 0x48e760
call fcn.0040baa0
mov ecx, eax
call fcn.004b21b0
mov esi, eax
push esi
mov ecx, dword [edi + 0x580]
call fcn.00495790
test al, al
sete cl
movzx ecx, cl
push ecx
lea ecx, [edi + 0x478]
call fcn.00495dc0
push esi
mov ecx, dword [edi + 0x580]
call fcn.00495790
test al, al
sete al
movzx eax, al
push eax
lea ecx, [edi + 0x420]
call fcn.00495dc0
jmp 0x48e760
cmp ecx, 0xac0f
jne 0x492a35
mov ebx, 1
jmp 0x492a44
xor ebx, ebx
cmp ecx, 0xac10
setne bl
dec ebx
and ebx, 2
push 0
push ebx
push 0x9a8
lea ecx, [edi + 0x478]
call fcn.0040d9f0
push 0
push ebx
push 0x9a8
lea ecx, [edi + 0x420]
call fcn.0040d9f0
jmp 0x48e760
jne 0x492a7a
mov byte [ebp - 0x368c], 0
jmp 0x492a8b
cmp ecx, 0xafca
sete al
inc al
mov byte [ebp - 0x368c], al
mov eax, dword [edi + 0x580]
mov esi, dword [eax + 0x20]
cmp byte [esi + 0x3c], 0
jne case.default.0x492eaf
cmp byte [esi + 0x70], 0
jne case.default.0x492eaf
push 0x61014c
lea ecx, [ebp - 0x3698]
call fcn.0043d960
mov dword [ebp - 4], 0x77
push dword [ebp - 0x368c]
mov ecx, esi
call fcn.00486b30
push 0
movzx eax, byte [esi + 0x31]
push eax
push 0x7ed
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3698]
call fcn.00418e50
jmp 0x48e760
cmp ecx, 0xbb85
jg 0x493bcd
je 0x493b61
cmp ecx, 0xb798
jg 0x4935db
je 0x49345d
cmp ecx, 0xb3b1
jg 0x4931db
je 0x49318a
lea eax, [ecx - 0xafcc]
cmp eax, 0x40
ja case.default.0x49431c
movzx eax, byte [eax + 0x494cf0]
jmp dword [eax*4 + 0x494ce0]
mov eax, dword [edi + 0x580]
mov esi, dword [eax + 0x20]
mov byte [ebp - 0x368d], 1
lea eax, [ecx - 0xafcd]
cmp eax, 3
ja case.default.0x492b68
jmp dword [eax*4 + 0x494d34]
cmp dword [esi + 0x34], 0
setne byte [ebp - 0x368d]
mov ebx, 4
jmp 0x492ba3
mov ebx, 1
jmp 0x492ba3
mov ebx, 2
jmp 0x492ba3
mov ebx, 3
jmp 0x492ba3
cmp dword [esi + 0x34], 4
setne byte [ebp - 0x368d]
xor ebx, ebx
cmp dword [esi + 0x38], 0xffffffff
je 0x492ce9
mov al, byte [esi + 0x30]
test al, al
je 0x492bff
mov eax, dword [edi]
push 0
push 0
push 4
push str.Save_Current_Modification
push str.You_should_save_the_current_modification._rAll_the_saved_modifications_can_not_be_undone._r_rContinue_
push dword [eax + 0xc]
push str.SaveCurrentModifWarning
lea ecx, [edi + 0x300]
call fcn.004607b0
cmp eax, 6
jne case.0x4948be.44069
push 0
mov ecx, edi
call fcn.0049b420
push 0
push 0
push 0x87f
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 0
push 0
push 0x87e
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
cmp eax, 1
jne 0x492c84
lea ecx, [ebp - 0x34c8]
call fcn.0045de80
mov dword [ebp - 4], 0x78
lea ecx, [ebp - 0x3494]
call fcn.0045de80
mov byte [ebp - 4], 0x79
mov eax, dword [edi]
push 0
push 0
push 4
push str.Lose_Undo_Ability_Waning
push str.You_should_save_the_current_modification._rAll_the_saved_modifications_can_not_be_undone._r_rContinue_
push dword [eax + 0xc]
push str.LoseUndoAbilityWarning
lea ecx, [edi + 0x300]
call fcn.004607b0
cmp eax, 6
jne 0x492caf
mov byte [ebp - 4], 0x78
lea ecx, [ebp - 0x3494]
call fcn.004038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34c8]
call fcn.004038c0
push 0xffffffffffffffff
mov ecx, esi
call fcn.0041cbc0
test ebx, ebx
jne 0x492cd5
push ebx
push ebx
push 0x7f5
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov ecx, edi
call fcn.0049af70
jmp 0x48e760
mov byte [ebp - 4], 0x78
lea ecx, [ebp - 0x3494]
call fcn.004038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34c8]
call fcn.004038c0
jmp case.0x4948be.44069
push ebx
mov ecx, esi
call fcn.0041d0f0
mov ecx, edi
call fcn.0049af70
jmp 0x48e760
cmp dword [esi + 0x34], ebx
je case.default.0x492eaf
push ebx
mov ecx, esi
call fcn.0041d0f0
cmp byte [ebp - 0x368d], 0
je 0x48e760
push 1
mov ecx, esi
call fcn.0041cba0
jmp 0x48e760
lea eax, [ecx - 0xafdc]
push eax
mov ecx, 0x60fb5c
call fcn.0043ad50
mov ebx, eax
cmp ebx, 0xffffffff
je case.0x4948be.44069
mov ecx, dword [edi + 0x580]
mov esi, dword [ecx + 0x20]
mov cl, byte [esi + 0x30]
test cl, cl
je 0x492dd2
lea ecx, [ebp - 0x34c8]
call fcn.0045de80
mov dword [ebp - 4], 0x7a
lea ecx, [ebp - 0x3494]
call fcn.0045de80
mov byte [ebp - 4], 0x7b
mov eax, dword [edi]
push 0
push 0
push 4
push str.Save_Current_Modification
push str.You_should_save_the_current_modification._rAll_the_saved_modifications_can_not_be_undone._r_rContinue_
push dword [eax + 0xc]
push str.SaveCurrentModifWarning
lea ecx, [edi + 0x300]
call fcn.004607b0
cmp eax, 6
jne 0x492e3f
push 0
mov ecx, edi
call fcn.0049b420
push 0
push 0
push 0x87f
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x3494]
call fcn.004038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34c8]
call fcn.004038c0
push 0
push 0
push 0x87e
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
cmp eax, 1
jne 0x492e69
lea ecx, [ebp - 0x34c8]
call fcn.0045de80
mov dword [ebp - 4], 0x7c
lea ecx, [ebp - 0x3494]
call fcn.0045de80
mov byte [ebp - 4], 0x7d
mov eax, dword [edi]
push 0
push 0
push 4
push str.Lose_Undo_Ability_Waning
push str.You_should_save_the_current_modification._rAll_the_saved_modifications_can_not_be_undone._r_rContinue_
push dword [eax + 0xc]
push str.LoseUndoAbilityWarning
lea ecx, [edi + 0x300]
call fcn.004607b0
cmp eax, 6
je 0x492e48
mov byte [ebp - 4], 0x7c
jmp 0x492cb3
mov byte [ebp - 4], 0x7a
jmp 0x492cb3
mov byte [ebp - 4], 0x7c
lea ecx, [ebp - 0x3494]
call fcn.004038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34c8]
call fcn.004038c0
mov al, byte [esi + 0x30]
test al, al
jne 0x48e760
push ebx
mov ecx, esi
call fcn.0041cbc0
push 4
mov ecx, esi
call fcn.0041d0f0
mov ecx, edi
call fcn.0049af70
jmp 0x48e760
mov eax, dword [edi + 0x580]
mov esi, dword [eax + 0x20]
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x38]
lea ebx, [ecx - 0xafd1]
cmp ebx, 4
ja case.default.0x492eaf
jmp dword [ebx*4 + 0x494d44]
cmp edx, 0xffffffff
jne case.0x4948be.44069
test eax, eax
je case.0x4948be.44069
mov dword [ebp - 0x36a0], 0xafcc
mov eax, dword [edi]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_OpenClipboard]
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
mov dword [ebp - 0x3698], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov dword [ebp - 0x368c], eax
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
call esi
mov ebx, eax
push dword [ebp - 0x368c]
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x36a4], eax
push eax
call esi
mov dword [ebp - 0x3694], eax
push dword [ebp - 0x368c]
push ebx
push eax
call fcn.00543aa0
add esp, 0xc
push dword [ebp - 0x3698]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
push dword [ebp - 0x36a4]
call esi
mov esi, dword [sym.imp.USER32.dll_CloseClipboard]
call esi
mov ecx, dword [edi + 0x580]
call fcn.004da940
mov ecx, dword [edi + 0x580]
call fcn.004953d0
push eax
push 0
push 0x973
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
push 0
push 0
push 0x7d4
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov eax, dword [edi]
push 0
push dword [ebp - 0x36a0]
push 0x111
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x883
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov ecx, dword [edi + 0x580]
call fcn.004da6b0
mov eax, dword [edi]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp - 0x3694]
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call esi
push 0
push 0
push 0x87f
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp 0x48e760
cmp edx, 0xffffffff
je 0x493022
push 1
mov ecx, esi
call fcn.0041cba0
push 4
mov ecx, esi
call fcn.0041d0f0
push 0xffffffffffffffff
mov ecx, esi
call fcn.0041cbc0
jmp case.0x4948be.44069
mov dword [ebp - 0x36a0], 0xafd0
cmp eax, 4
je case.0x4948be.44069
test eax, eax
je 0x492ed1
push 0
push 0xafd0
push 0x111
mov eax, dword [edi]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x87f
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp case.0x4948be.44069
cmp edx, 0xffffffff
je 0x49307f
push 1
mov ecx, esi
call fcn.0041cba0
push 1
jmp 0x49300d
mov dword [ebp - 0x36a0], 0xafcd
cmp eax, 1
je case.0x4948be.44069
test eax, eax
je 0x492ed1
push 0
push 0xafcd
push 0x111
mov eax, dword [edi]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x87f
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp case.0x4948be.44069
cmp edx, 0xffffffff
je 0x4930df
push 1
mov ecx, esi
call fcn.0041cba0
push 2
jmp 0x49300d
mov dword [ebp - 0x36a0], 0xafce
cmp eax, 2
je case.0x4948be.44069
test eax, eax
je 0x492ed1
push 0
push 0xafce
push 0x111
mov eax, dword [edi]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x87f
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp case.0x4948be.44069
cmp edx, 0xffffffff
je 0x49313f
push 1
mov ecx, esi
call fcn.0041cba0
push 3
jmp 0x49300d
mov dword [ebp - 0x36a0], 0xafcf
cmp eax, 3
je case.0x4948be.44069
test eax, eax
je 0x492ed1
push 0
push 0xafcf
push 0x111
mov eax, dword [edi]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x87f
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
jmp case.0x4948be.44069
mov eax, dword [edi + 0x1480]
lea ecx, [edi + 0x1480]
mov eax, dword [eax + 0x34]
call eax
test al, al
sete bl
mov al, byte [edi + 0x308]
mov byte [ebp - 0x368c], al
push dword [ebp - 0x368c]
lea ecx, [edi + 0x1480]
call fcn.004951c0
test bl, bl
je 0x48e760
push dword [edi + 0x148c]
lea ecx, [edi + 0x300]
call fcn.0045ded0
jmp 0x48e760
cmp ecx, 0xb4aa
jg 0x49340c
je 0x493235
cmp ecx, 0xb403
jle 0x4931fd
cmp ecx, 0xb464
jne case.default.0x49431c
push ecx
mov ecx, edi
call fcn.00476620
push eax
mov ecx, edi
call fcn.0047b110
mov eax, dword [edi + 0x580]
mov eax, dword [eax + 0x20]
mov byte [eax + 0xb9], 1
mov ecx, dword [edi + 0x68fec]
test ecx, ecx
je 0x48e760
call fcn.0043ab50
jmp 0x48e760
xor bl, bl
mov ecx, 0x611190
mov eax, dword [0x611190]
mov eax, dword [eax + 0x34]
call eax
test al, al
jne 0x4932a2
mov al, byte [edi + 0x308]
mov byte [ebp - 0x368c], al
push dword [ebp - 0x368c]
push 1
mov ecx, dword [edi + 0x580]
call fcn.00495210
push 0x611190
lea ecx, [edi + 0x300]
call fcn.0045f7c0
cmp byte [edi + 0x689cc], bl
je 0x4933e4
push 0
push 0x4e21
push 0x111
push dword [0x61119c]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4933e4
mov ecx, 0x611190
mov eax, dword [0x611190]
mov eax, dword [eax + 0x2c]
call eax
mov bl, al
cmp byte [0x6112c0], 1
jne 0x4933ce
test bl, bl
je 0x49331b
mov ecx, dword [edi + 0x588]
push 0
push dword [ecx + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, byte [edi + 0x68ff4]
and al, 3
cmp al, 3
lea eax, [edi + 0x590]
je 0x4932ed
mov eax, dword [edi + 0x418]
mov dword [edi + 4], eax
mov eax, dword [edi]
push 0
push 0
push 5
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
mov ecx, 0x611190
call fcn.004e92f0
and byte [edi + 0x68ff4], 0xfb
jmp 0x4933e4
cmp dword [edi + 0x588], 0
jne 0x493386
push 0x90
call fcn.0052bd3f
add esp, 4
test eax, eax
je 0x493340
mov ecx, eax
call fcn.00463f40
mov ecx, eax
jmp 0x493342
xor ecx, ecx
mov dword [edi + 0x588], ecx
mov eax, dword [edi]
mov edx, dword [ecx]
push dword [eax + 0xc]
push dword [eax + 4]
call dword [edx + 4]
mov al, byte [edi + 0x68ff4]
and al, 3
cmp al, 3
lea eax, [edi + 0x590]
je 0x49336d
mov eax, dword [edi + 0x418]
push 1
push 0x2d
push 2
push 8
push 0x611190
push eax
mov ecx, dword [edi + 0x588]
call fcn.004e8910
mov ecx, dword [edi + 0x588]
mov dword [edi + 4], ecx
mov al, byte [edi + 0x68ff4]
and al, 3
cmp al, 3
lea eax, [edi + 0x590]
je 0x4933a7
mov eax, dword [edi + 0x418]
mov dword [ecx + 0x10], eax
mov eax, dword [edi]
push 0
push 0
push 5
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
or byte [edi + 0x68ff4], 4
jmp 0x4933e4
push 0
mov ecx, 0x611190
test bl, bl
je 0x4933dd
push 0
jmp 0x4933df
push 1
call fcn.004e92f0
test bl, bl
sete bl
push ebx
push 0xb4aa
mov ecx, edi
call fcn.0048e640
push ebx
push 0xb4aa
lea ecx, [edi + 0x65c]
call fcn.00486ad0
jmp 0x48e760
cmp ecx, 0xb4dc
jne case.default.0x49431c
call fcn.0040baa0
lea ecx, [ebp - 0x344c]
push ecx
mov ecx, eax
call fcn.00495690
mov dword [ebp - 4], 0x95
cmp dword [ebp - 0x3438], 8
mov ecx, dword [ebp - 0x344c]
jae 0x493447
lea ecx, [ebp - 0x344c]
mov eax, dword [edi]
push 5
push 0
push 0
push ecx
push str.open
push dword [eax + 0xc]
jmp 0x491a59
push 0
push 0
push 0x871
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
sub eax, 1
sete cl
cmp eax, 0x20
jg 0x4935cb
test cl, cl
jne 0x4935cb
xor eax, eax
mov dword [ebp - 0x34ec], eax
mov dword [ebp - 0x34e8], eax
mov dword [ebp - 0x34e4], eax
mov dword [ebp - 0x34e0], eax
mov dword [ebp - 0x34dc], eax
mov dword [ebp - 0x34d8], eax
mov dword [ebp - 0x34d4], eax
mov dword [ebp - 0x34d0], eax
mov byte [ebp - 0x34cc], al
push 1
push 0x21
lea eax, [ebp - 0x34ec]
push eax
mov ecx, dword [edi + 0x580]
call fcn.004d8ca0
call fcn.0040b9e0
push 0
push 0
push 0xffffffffffffffff
push dword [edi + 0x304]
lea ecx, [ebp - 0x34ec]
push ecx
mov ecx, eax
call fcn.00424360
push eax
mov ecx, edi
call fcn.00471840
mov esi, eax
cmp esi, 0xffffffff
je 0x4935cb
call fcn.0040baa0
lea ecx, [ebp - 0x344c]
push ecx
mov ecx, eax
call fcn.0042fb90
cmp esi, 0xfffffffe
jne 0x493575
mov dword [ebp - 4], 0x87
push str._noEasterEggs.xml
lea ecx, [ebp - 0x344c]
call fcn.0040a2e0
cmp dword [ebp - 0x3438], 8
mov eax, dword [ebp - 0x344c]
jae 0x49354c
lea eax, [ebp - 0x344c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49355e
mov ecx, edi
call fcn.00516660
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344c]
call fcn.004038c0
jmp case.0x4948be.44069
mov dword [ebp - 4], 0x88
push str._noEasterEggs.xml
lea ecx, [ebp - 0x344c]
call fcn.0040a2e0
cmp dword [ebp - 0x3438], 8
mov eax, dword [ebp - 0x344c]
jae 0x4935a1
lea eax, [ebp - 0x344c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49355e
push esi
mov ecx, edi
call fcn.0047b750
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344c]
call fcn.004038c0
jmp case.0x4948be.44069
lea ecx, [edi + 0x1200]
call fcn.0040cda0
jmp 0x48e760
lea eax, [ecx - 0xb799]
cmp eax, 0xb
ja case.default.0x49431c
jmp dword [eax*4 + 0x494d58]
lea ecx, [edi + 0x12b0]
call fcn.0040cdd0
jmp 0x48e760
call fcn.0040baa0
lea ecx, [ebp - 0x3464]
push ecx
mov ecx, eax
call fcn.0042fb90
mov dword [ebp - 4], 0x89
cmp dword [ebp - 0x3450], 8
mov eax, dword [ebp - 0x3464]
jae 0x493630
lea eax, [ebp - 0x3464]
push eax
lea ecx, [ebp - 0x3434]
call fcn.004029a0
mov byte [ebp - 4], 0x8a
push str.user.manualdocumentation_notepad_online_document.html
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
cmp dword [ebp - 0x3420], 8
mov eax, dword [ebp - 0x3434]
jae 0x493665
lea eax, [ebp - 0x3434]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4936bf
cmp dword [ebp - 0x3420], 8
mov eax, dword [ebp - 0x3434]
jae 0x493685
lea eax, [ebp - 0x3434]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0x89
lea ecx, [ebp - 0x3434]
call fcn.004038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3464]
call fcn.004038c0
jmp 0x48e760
lea eax, [ebp - 0x3434]
push eax
lea ecx, [ebp - 0x344c]
call fcn.00402970
mov byte [ebp - 4], 0x8b
lea ecx, [ebp - 0x34b0]
call fcn.0045de80
mov byte [ebp - 4], 0x8c
lea ecx, [ebp - 0x347c]
call fcn.0045de80
mov byte [ebp - 4], 0x8d
lea eax, [ebp - 0x34b0]
push eax
lea eax, [ebp - 0x347c]
push eax
push str.NppHelpAbsentWarning
lea ecx, [edi + 0x300]
call fcn.00460110
test al, al
jne 0x493735
push str.File_does_not_exist
lea ecx, [ebp - 0x347c]
call fcn.00403ef0
push str._rdoesnt_exist._Please_download_it_on_Notepad_site.
lea ecx, [ebp - 0x34b0]
call fcn.00403ef0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x34b0]
push eax
lea ecx, [ebp - 0x344c]
call fcn.00406650
cmp dword [ebp - 0x3468], 8
mov ecx, dword [ebp - 0x347c]
jae 0x493760
lea ecx, [ebp - 0x347c]
cmp dword [ebp - 0x3438], 8
mov edx, dword [ebp - 0x344c]
jae 0x493775
lea edx, [ebp - 0x344c]
mov eax, dword [edi]
push 0
push ecx
push edx
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 4], 0x8c
lea ecx, [ebp - 0x347c]
call fcn.004038c0
mov byte [ebp - 4], 0x8b
lea ecx, [ebp - 0x34b0]
call fcn.004038c0
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0x344c]
call fcn.004038c0
mov byte [ebp - 4], 0x89
lea ecx, [ebp - 0x3434]
call fcn.004038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3464]
call fcn.004038c0
jmp 0x48e760
push 1
push 0
push 0
push 0x58801c
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x48e760
push 1
push 0
push 0
push str.https:__github.com_notepad_plus_plus_notepad_plus_plus_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x48e760
push 1
push 0
push 0
push str.https:__npp_user_manual.org_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x48e760
mov eax, dword [edi]
push 0
push str.Notepad_Command_Argument_Help
push 0x5aebb8
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x48e760
push 1
push 0
push 0
push str.https:__community.notepad_plus_plus.org_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x48e760
push 1
push 0
push 0
push str.https:__gitter.im_notepad_plus_plus_notepad_plus_plus
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x48e760
call fcn.0040baa0
cmp dword [eax + 0x234d0], 7
jg 0x4938dd
mov eax, dword [edi]
push 0
push 0
push 4
push str.Notepad_Updater
push str.Notepad_updater_is_not_compatible_with_XP_due_to_the_obsolete_security_layer_under_XP._rDo_you_want_to_go_to_Notepad_page_to_download_the_latest_version_
push dword [eax + 0xc]
push str.XpUpdaterProblem
lea ecx, [edi + 0x300]
call fcn.004607b0
cmp eax, 6
jne 0x48e760
push 1
push 0
push 0
push str.https:__notepad_plus_plus.org_downloads_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x48e760
call fcn.0040baa0
lea ecx, [ebp - 0x347c]
push ecx
mov ecx, eax
call fcn.0042fb90
mov dword [ebp - 4], 0x8e
push str.updater
lea ecx, [ebp - 0x3494]
call fcn.004029a0
mov byte [ebp - 4], 0x8f
lea eax, [ebp - 0x3494]
push eax
lea eax, [ebp - 0x347c]
push eax
lea eax, [ebp - 0x34e0]
push eax
call fcn.00423c40
add esp, 0xc
lea ecx, [ebp - 0x34e0]
call fcn.004038c0
mov byte [ebp - 4], 0x8e
lea ecx, [ebp - 0x3494]
call fcn.004038c0
lea eax, [ebp - 0x347c]
push eax
lea ecx, [ebp - 0x34b0]
call fcn.00402970
mov byte [ebp - 4], 0x90
push str.gup.exe
lea ecx, [ebp - 0x34c8]
call fcn.004029a0
mov byte [ebp - 4], 0x91
lea eax, [ebp - 0x34c8]
push eax
lea eax, [ebp - 0x34b0]
push eax
lea eax, [ebp - 0x34e0]
push eax
call fcn.00423c40
add esp, 0xc
lea ecx, [ebp - 0x34e0]
call fcn.004038c0
mov byte [ebp - 4], 0x90
lea ecx, [ebp - 0x34c8]
call fcn.004038c0
lea ecx, [ebp - 0x35f0]
call fcn.00402c40
mov byte [ebp - 4], 0x92
push 1
lea eax, [ebp - 0x34b0]
push eax
lea ecx, [ebp - 0x35f0]
call fcn.00406d80
test al, al
je 0x493b2c
lea ecx, [ebp - 0x3434]
call fcn.0045de80
mov byte [ebp - 4], 0x93
cmp dword [ebp - 0x3688], 0xb7a1
jne 0x493a71
cmp byte [edi + 0x68a81], 0
jne 0x493a5f
mov eax, dword [edi]
push 0
push 0
push 0
push str.Proxy_Settings
push str.Please_relaunch_Notepad_in_Admin_mode_to_configure_proxy.
push dword [eax + 0xc]
push str.GUpProxyConfNeedAdminMode
lea ecx, [edi + 0x300]
call fcn.004607b0
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0x3434]
call fcn.004038c0
mov byte [ebp - 4], 0x90
lea ecx, [ebp - 0x35f0]
call fcn.0042c6c0
mov byte [ebp - 4], 0x8e
lea ecx, [ebp - 0x34b0]
call fcn.004038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x347c]
call fcn.004038c0
jmp case.0x4948be.44069
push str._options
lea ecx, [ebp - 0x3434]
call fcn.00403ef0
jmp 0x493ab0
push str._verbose__v
lea ecx, [ebp - 0x3434]
call fcn.00403ef0
push 0x5ae998
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
call fcn.0040baa0
mov al, byte [eax + 0x231e1]
test al, al
je 0x493ab0
push str.__px64
lea ecx, [ebp - 0x3434]
call fcn.0040a2e0
cmp dword [ebp - 0x3468], 8
mov eax, dword [ebp - 0x347c]
jae 0x493ac5
lea eax, [ebp - 0x347c]
cmp dword [ebp - 0x3420], 8
mov ecx, dword [ebp - 0x3434]
jae 0x493ada
lea ecx, [ebp - 0x3434]
cmp dword [ebp - 0x349c], 8
mov edx, dword [ebp - 0x34b0]
jae 0x493aef
lea edx, [ebp - 0x34b0]
push eax
push ecx
push edx
lea ecx, [ebp - 0x3510]
call fcn.00481ab0
mov byte [ebp - 4], 0x94
push 0
lea ecx, [ebp - 0x3510]
call fcn.004cdf20
mov byte [ebp - 4], 0x93
lea ecx, [ebp - 0x3510]
call fcn.004825b0
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0x3434]
call fcn.004038c0
mov byte [ebp - 4], 0x90
lea ecx, [ebp - 0x35f0]
call fcn.0042c6c0
mov byte [ebp - 4], 0x8e
lea ecx, [ebp - 0x34b0]
call fcn.004038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x347c]
call fcn.004038c0
jmp 0x48e760
push str..dll
push str.Notepad_plugin
lea eax, [ebp - 0x3428]
push eax
mov ecx, edi
call fcn.0046a060
mov dword [ebp - 4], 0x7e
lea ecx, [ebp - 0x3428]
call fcn.00495fd0
test eax, eax
je 0x493bb6
call fcn.0040baa0
push 0
push 0
push 0
push str.Notepad_need_to_be_relaunched
push str.You_have_to_restart_Notepad_to_load_plugins_you_installed.
push 0
push str.NeedToRestartToLoadPlugins
mov ecx, dword [eax + 0x234d8]
call fcn.004607b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3428]
call fcn.00403aa0
jmp 0x48e760
cmp ecx, 0xbd75
jg 0x493f33
je 0x493ed9
lea eax, [ecx - 0xbb86]
cmp eax, 0xc
ja case.default.0x49431c
movzx eax, byte [eax + 0x494da4]
jmp dword [eax*4 + 0x494d88]
call fcn.0040baa0
lea ebx, [eax + 0x2329c]
mov dword [ebp - 0x368c], ebx
push 0x5884e4
push str.Notepad_style_theme
push str.themes
lea eax, [ebp - 0x3428]
push eax
mov ecx, edi
call fcn.00469c10
mov dword [ebp - 4], 0x7f
lea ecx, [ebp - 0x3428]
call fcn.00495fd0
mov dword [ebp - 0x3698], eax
test eax, eax
je 0x493d11
xor esi, esi
lea esp, [esp]
mov ecx, dword [ebp - 0x3428]
add ecx, esi
call fcn.0042d9f0
push eax
lea eax, [ebp - 0x3464]
push eax
mov ecx, ebx
call fcn.004b4630
mov byte [ebp - 4], 0x80
cmp dword [ebp - 0x3450], 8
mov eax, dword [ebp - 0x3464]
jae 0x493c85
lea eax, [ebp - 0x3464]
push eax
mov ecx, ebx
call fcn.0047f2b0
test al, al
jne 0x493cf2
mov ecx, dword [ebp - 0x3428]
lea ecx, [ecx + esi]
call fcn.0042d9f0
push eax
lea ecx, [ebp - 0x3494]
call fcn.004029a0
mov byte [ebp - 4], 0x81
lea eax, [ebp - 0x3494]
push eax
mov ecx, ebx
call fcn.0047dcf0
mov byte [ebp - 4], 0x80
lea ecx, [ebp - 0x3494]
call fcn.004038c0
mov eax, dword [edi + 0x1480]
lea ecx, [edi + 0x1480]
mov eax, dword [eax + 0x34]
call eax
test al, al
je 0x493cec
lea ecx, [edi + 0x1480]
call fcn.0048e480
mov ebx, dword [ebp - 0x368c]
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x3464]
call fcn.004038c0
add esi, 0x18
sub dword [ebp - 0x3698], 1
jne 0x493c50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3428]
call fcn.00403aa0
jmp 0x48e760
mov esi, dword [edi + 0x68748]
mov al, byte [edi + 0x308]
mov byte [ebp - 0x368c], al
lea ebx, [edi + 0x6873c]
push dword [ebp - 0x368c]
mov ecx, ebx
call fcn.00495090
test esi, esi
jne 0x48e760
push ebx
lea ecx, [edi + 0x300]
call fcn.0045ed00
mov ecx, ebx
call fcn.00434380
jmp 0x48e760
call fcn.0040baa0
mov ecx, eax
call fcn.00482f50
test eax, eax
je 0x48e760
cmp word [eax], 0
je 0x48e760
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x48e760
cmp ecx, 0xbb90
jne 0x493db0
mov ebx, 1
jmp 0x493dbf
xor ebx, ebx
cmp ecx, 0xbb91
setne bl
dec ebx
and ebx, 2
lea ecx, [ebp - 0x164]
call fcn.00481bc0
mov dword [ebp - 4], 0x82
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x120], ebx
mov al, byte [edi + 0x308]
mov byte [ebp - 0x368c], al
push dword [ebp - 0x368c]
lea ecx, [ebp - 0x164]
call fcn.00495150
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.004826b0
jmp 0x48e760
lea esi, [edi + 0x46208]
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x34]
call eax
test al, al
sete bl
mov al, byte [edi + 0x308]
mov byte [ebp - 0x368c], al
push dword [ebp - 0x368c]
mov ecx, esi
call fcn.004950d0
test bl, bl
je 0x48e760
push esi
lea ecx, [edi + 0x300]
call fcn.0045efe0
jmp 0x48e760
mov eax, dword [edi]
push 0
push 0
push 0
push str.Editing_contextMenu
push str.Editing_contextMenu.xml_allows_you_to_modify_your_Notepad_popup_context_menu_on_edit_zone._rYou_have_to_restart_your_Notepad_to_take_effect_after_modifying_contextMenu.xml.
push dword [eax + 0xc]
push str.ContextMenuXmlEditWarning
lea ecx, [edi + 0x300]
call fcn.004607b0
call fcn.0040baa0
lea ecx, [ebp - 0x34e0]
push ecx
mov ecx, eax
call fcn.00495350
mov dword [ebp - 4], 0x83
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push eax
mov ecx, edi
call fcn.00497ca0
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34e0]
call fcn.004038c0
push esi
mov ecx, edi
call fcn.0047bb00
jmp 0x48e760
mov eax, dword [edi + 0x13b0]
lea ecx, [edi + 0x13b0]
mov eax, dword [eax + 0x34]
call eax
test al, al
sete bl
mov al, byte [edi + 0x308]
mov byte [ebp - 0x368c], al
push dword [ebp - 0x368c]
lea ecx, [edi + 0x13b0]
call fcn.0040b180
test bl, bl
je 0x48e760
push 0
push 0
push str.MD5FromTextDlg
push dword [edi + 0x13bc]
lea ecx, [edi + 0x300]
call fcn.0045e090
jmp 0x48e760
cmp ecx, 0xbf68
jg 0x49430d
je 0x4942b3
lea eax, [ecx - 0xbd76]
cmp eax, 4
ja case.default.0x49431c
jmp dword [eax*4 + 0x494db4]
mov eax, dword [edi + 0x1384]
lea ecx, [edi + 0x1384]
mov eax, dword [eax + 0x34]
call eax
test al, al
sete bl
mov al, byte [edi + 0x308]
mov byte [ebp - 0x368c], al
push dword [ebp - 0x368c]
lea ecx, [edi + 0x1384]
call fcn.0040b090
test bl, bl
je 0x48e760
push 0
push 0
push str.MD5FromFilesDlg
push dword [edi + 0x1390]
lea ecx, [edi + 0x300]
call fcn.0045e090
jmp 0x48e760
push 0
push 0
push 0xa0a
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
cmp eax, 1
jne 0x48e760
push 0
push 0
push 0x85f
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov esi, eax
push 0
push 0
push 0x861
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
sub eax, esi
je 0x48e760
inc eax
push eax
call fcn.0052bd85
add esp, 4
mov esi, eax
push esi
push 0
push 0x871
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
lea ecx, [ebp - 0x360c]
call fcn.0048cdd0
push esi
lea ecx, [ebp - 0x360c]
call fcn.0040b030
push eax
lea ecx, [ebp - 0x344c]
call fcn.0042aaa0
mov dword [ebp - 4], 0x84
cmp dword [ebp - 0x3438], 0x10
mov ebx, dword [ebp - 0x344c]
jae 0x494062
lea ebx, [ebp - 0x344c]
lea eax, [ebp - 0x3420]
push eax
lea ecx, [ebp - 0x344c]
call fcn.0042e7c0
lea ecx, [ebp - 0x368d]
push ecx
push dword [eax]
push ebx
lea ecx, [ebp - 0x3494]
call fcn.00428740
mov byte [ebp - 4], 0x85
mov eax, dword [edi]
push dword [eax + 0xc]
lea eax, [ebp - 0x3494]
push eax
call fcn.00426ea0
push esi
call fcn.0052bd8e
add esp, 0xc
mov byte [ebp - 4], 0x84
lea ecx, [ebp - 0x3494]
call fcn.004038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344c]
call fcn.00403840
jmp 0x48e760
mov eax, dword [edi + 0x1408]
lea ecx, [edi + 0x1408]
mov eax, dword [eax + 0x34]
call eax
test al, al
sete bl
mov al, byte [edi + 0x308]
mov byte [ebp - 0x368c], al
push dword [ebp - 0x368c]
lea ecx, [edi + 0x1408]
call fcn.0040b180
test bl, bl
je 0x48e760
push 0
push 0
push str.SHA256FromTextDlg
push dword [edi + 0x1414]
lea ecx, [edi + 0x300]
call fcn.0045e090
jmp 0x48e760
mov eax, dword [edi + 0x13dc]
lea ecx, [edi + 0x13dc]
mov eax, dword [eax + 0x34]
call eax
test al, al
sete bl
mov al, byte [edi + 0x308]
mov byte [ebp - 0x368c], al
push dword [ebp - 0x368c]
lea ecx, [edi + 0x13dc]
call fcn.0040b090
test bl, bl
je 0x48e760
push 0
push 0
push str.SHA256FromFilesDlg
push dword [edi + 0x13e8]
lea ecx, [edi + 0x300]
call fcn.0045e090
jmp 0x48e760
push 0
push 0
push 0xa0a
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
cmp eax, 1
jne 0x48e760
push 0
push 0
push 0x85f
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov esi, eax
push 0
push 0
push 0x861
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
sub eax, esi
je 0x48e760
inc eax
push eax
call fcn.0052bd85
add esp, 4
mov ebx, eax
mov dword [ebp - 0x368c], ebx
push ebx
push 0
push 0x871
mov ecx, dword [edi + 0x580]
call fcn.0040d9f0
mov ecx, ebx
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x494200
sub ecx, edx
push ecx
push ebx
lea eax, [ebp - 0x34e8]
push eax
call fcn.0040c620
push 0x82
push 0
lea eax, [ebp - 0x3604]
push eax
call fcn.00544020
add esp, 0x18
xor esi, esi
lea ebx, [ebp - 0x3604]
jmp 0x494240
movzx eax, byte [ebp + esi - 0x34e8]
push eax
push str._02x
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
add ebx, 4
cmp esi, 0x20
jb 0x494240
lea eax, [ebp - 0x3604]
push eax
lea ecx, [ebp - 0x3494]
call fcn.004029a0
mov dword [ebp - 4], 0x86
mov eax, dword [edi]
push dword [eax + 0xc]
lea eax, [ebp - 0x3494]
push eax
call fcn.00426ea0
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3494]
call fcn.004038c0
push dword [ebp - 0x368c]
call fcn.0052bd8e
add esp, 4
jmp 0x48e760
mov eax, dword [edi + 0x134c]
lea ecx, [edi + 0x134c]
mov eax, dword [eax + 0x34]
call eax
test al, al
sete bl
mov al, byte [edi + 0x308]
mov byte [ebp - 0x368c], al
push dword [ebp - 0x368c]
lea ecx, [edi + 0x134c]
call fcn.004d3380
test bl, bl
je 0x48e760
push 0
push 0
push 0x5ae478
push dword [edi + 0x1358]
lea ecx, [edi + 0x300]
call fcn.0045e090
jmp 0x48e760
lea eax, [ecx - 0xc350]
cmp eax, 6
ja case.default.0x49431c
jmp dword [eax*4 + 0x494dc8]
push 0
lea ecx, [edi + 0x478]
cmp byte [edi + 0x68980], 0
je 0x4943a1
push 0
push 0xbba
call fcn.0040d9f0
push 0
push 0
push 0xbba
lea ecx, [edi + 0x420]
call fcn.0040d9f0
push 0
push 0xffffffffffffffff
push 0x952
lea ecx, [edi + 0x478]
call fcn.0040d9f0
push 0
push 0xffffffffffffffff
push 0x952
lea ecx, [edi + 0x420]
call fcn.0040d9f0
mov byte [edi + 0x68980], 0
lea ecx, [edi + 0x68984]
call fcn.004d40a0
mov byte [edi + 0x68982], 0
mov ecx, edi
call fcn.0046b260
jmp 0x48e760
push 9
push 0x952
call fcn.0040d9f0
push 0
push 9
push 0x952
lea ecx, [edi + 0x420]
call fcn.0040d9f0
lea ecx, [edi + 0x68974]
call fcn.0048e670
push 0
push 0
push 0xbb9
lea ecx, [edi + 0x478]
call fcn.0040d9f0
push 0
push 0
push 0xbb9
lea ecx, [edi + 0x420]
call fcn.0040d9f0
mov byte [edi + 0x68980], 1
mov byte [edi + 0x68982], 0
mov ecx, edi
call fcn.0046b260
jmp 0x48e760
mov ecx, edi
call fcn.0047b5e0
jmp 0x48e760
push 1
mov ecx, edi
call fcn.0046a6d0
jmp 0x48e760
mov ecx, edi
call fcn.0047b640
jmp 0x48e760
mov ecx, edi
call fcn.0047b610
jmp 0x48e760
push 0
mov ecx, edi
call fcn.0047d440
test al, al
je 0x494455
mov esi, dword [edi + 0x320]
jmp 0x494457
xor esi, esi
push 1
mov ecx, edi
call fcn.0047d440
test al, al
je 0x49446c
mov eax, dword [edi + 0x3a4]
jmp 0x49446e
xor eax, eax
add esi, eax
call fcn.0040baa0
mov al, byte [eax + 0x9d]
mov byte [edi + 0x689b5], 1
mov ecx, dword [ebp - 0x3688]
cmp esi, 1
jbe 0x494522
cmp ecx, 0xc354
setne byte [ebp - 0x368c]
test al, al
jne 0x4944c3
push dword [ebp - 0x368c]
mov ecx, edi
call fcn.00469090
mov ecx, dword [ebp - 0x3688]
mov word [edi + 0x689b4], 1
jmp case.default.0x492eaf
cmp dword [0x61133c], 0
jne 0x494522
lea ecx, [ebp - 0x35f0]
call fcn.0048ce70
mov dword [ebp - 4], 0x96
mov eax, dword [edi]
push dword [ebp - 0x368c]
push dword [edi + 0x710]
push dword [eax + 0xc]
push dword [eax + 4]
lea ecx, [ebp - 0x35f0]
call fcn.00495770
push 0
lea ecx, [ebp - 0x35f0]
call fcn.004ec3c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x35f0]
call fcn.0048d140
mov ecx, dword [ebp - 0x3688]
mov word [edi + 0x689b4], 1
jmp case.default.0x492eaf
lea eax, [ecx - 0xa041]
cmp eax, 0x1d
ja 0x494570
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push ecx
lea ecx, [edi + 0x688dc]
call fcn.0045cb10
push eax
mov ecx, edi
call fcn.00497ca0
test eax, eax
je 0x48e760
push eax
mov ecx, edi
call fcn.0047bb00
jmp 0x48e760
lea eax, [ecx - 0xb465]
cmp eax, 0x1c
ja 0x4945af
push 0
push 0x40
lea eax, [ebp - 0x3600]
push eax
push ecx
push dword [edi + 0x68934]
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov eax, dword [edi + 0x580]
lea ecx, [ebp - 0x3600]
push ecx
push 0xf
mov ecx, dword [eax + 0x20]
call fcn.0041cfa0
jmp 0x49321d
lea eax, [ecx - 0xb455]
cmp eax, 0xe
ja 0x4945cd
lea eax, [ecx - 0xb400]
push eax
mov ecx, edi
call fcn.0047b110
jmp 0x49321d
lea eax, [ecx - 0x4e20]
cmp eax, 0xc7
ja 0x494622
call fcn.0040baa0
imul ecx, dword [ebp - 0x3688], 0x150
mov eax, dword [eax + 0x231fc]
add ecx, 0xff997744
add eax, ecx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x3420], esp
push eax
call fcn.00461bf0
mov dword [ebp - 4], 0x99
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.004957f0
jmp 0x48e760
lea eax, [ecx - 0x5208]
cmp eax, 0xc7
ja 0x4946d5
call fcn.0040baa0
mov ecx, dword [ebp - 0x3688]
add ecx, 0xffffadf8
imul ecx, ecx, 0x15c
add ecx, dword [eax + 0x23208]
push ecx
lea ecx, [ebp - 0x170]
call fcn.0048cf50
mov dword [ebp - 4], 0x9a
lea ecx, [ebp - 0x170]
call fcn.00495330
push eax
lea ecx, [ebp - 0x3494]
call fcn.004029a0
mov byte [ebp - 4], 0x9b
lea eax, [ebp - 0x3494]
push eax
lea ecx, [ebp - 0x34c8]
call fcn.0048cbd0
mov byte [ebp - 4], 0x9d
lea ecx, [ebp - 0x3494]
call fcn.004038c0
mov eax, dword [edi]
push dword [eax + 0xc]
lea ecx, [ebp - 0x34c8]
call fcn.004d3720
mov byte [ebp - 4], 0x9a
lea ecx, [ebp - 0x34c8]
call fcn.00466460
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x170]
call fcn.0048d1f0
jmp 0x48e760
lea eax, [ecx - 0x55f0]
cmp eax, 0x1f3
ja 0x4946f3
push eax
lea ecx, [edi + 0x68a08]
call fcn.004c1e00
jmp 0x48e760
push ecx
lea ecx, [edi + 0x68a08]
call fcn.00495750
test al, al
je 0x494723
push 0
mov ebx, dword [ebp - 0x3688]
push ebx
push 0x111
lea ecx, [edi + 0x68a08]
call fcn.004c1a30
mov ecx, ebx
jmp case.default.0x492eaf
mov ecx, dword [ebp - 0x3688]
lea eax, [ecx - 0x2b0c]
cmp eax, 9
ja case.default.0x492eaf
lea eax, [ecx - 0x2b0c]
push eax
mov ecx, edi
call fcn.00469010
jmp 0x48e760
cmp ecx, 0xa02b
jl case.0x4948be.44069
cmp ecx, 0xa02f
jle case.0x4948be.44061
jmp case.0x4948be.44069
mov eax, ecx
sub eax, 0xa036
je case.0x4948be.44061
sub eax, 4
je case.0x4948be.44061
sub eax, 6
je case.0x4948be.44061
jmp case.0x4948be.44069
cmp ecx, 0xa824
jg 0x494829
cmp ecx, 0xa80a
jge case.0x4948be.44061
cmp ecx, 0xa43e
jg 0x4947d5
cmp ecx, 0xa43a
jge case.0x4948be.44061
lea eax, [ecx - 0xa416]
cmp eax, 0x1e
ja case.0x4948be.44069
movzx eax, byte [eax + 0x494dec]
jmp dword [eax*4 + 0x494de4]
cmp ecx, 0xa7fa
jg 0x49480c
je case.0x4948be.44061
cmp ecx, 0xa445
jl case.0x4948be.44069
cmp ecx, 0xa458
jle case.0x4948be.44061
cmp ecx, 0xa45d
je case.0x4948be.44061
jmp case.0x4948be.44069
lea eax, [ecx - 0xa7fd]
cmp eax, 0xa
ja case.0x4948be.44069
movzx eax, byte [eax + 0x494e14]
jmp dword [eax*4 + 0x494e0c]
cmp ecx, 0xac1a
jg 0x49489c
cmp ecx, 0xac13
jge case.0x4948be.44061
cmp ecx, 0xabf6
jg 0x49487f
je case.0x4948be.44061
cmp ecx, 0xa82d
jg 0x494872
je case.0x4948be.44061
cmp ecx, 0xa828
jl case.0x4948be.44069
cmp ecx, 0xa82b
jle case.0x4948be.44061
jmp case.0x4948be.44069
cmp ecx, 0xabea
je case.0x4948be.44061
jmp case.0x4948be.44069
lea eax, [ecx - 0xabfd]
cmp eax, 7
ja case.0x4948be.44069
movzx eax, byte [eax + 0x494e28]
jmp dword [eax*4 + 0x494e20]
cmp ecx, 0xac47
jg 0x4948c5
cmp ecx, 0xac42
jge case.0x4948be.44061
lea eax, [ecx - 0xac1d]
cmp eax, 0x23
ja case.0x4948be.44069
movzx eax, byte [eax + 0x494e38]
jmp dword [eax*4 + 0x494e30]
cmp ecx, 0xc354
jg case.0x4948be.44069
cmp ecx, 0xc353
jge case.0x4948be.44061
lea eax, [ecx - 0xafc9]
cmp eax, 2
ja case.0x4948be.44069
push ecx
lea ecx, [ebp - 0x34f0]
call fcn.0048cfe0
mov dword [ebp - 4], 0x9e
push eax
lea ecx, [edi + 0x68974]
call fcn.00486960
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34f0]
call fcn.0043ec40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 4