Function at 0x463516
Capabilities:
Create process on windows
Create thread
Find taskbar
Get common file path
Get program files directory
Link many functions at runtime
Query environment variable
Read .ini file
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc7c
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0xc74], eax
mov eax, dword [0x4db8d4]
mov dword [esp + 4], edx
push ebx
mov ebx, ecx
push ebp
push esi
push edi
cmp eax, 0xc
jg 0x4634b8
inc eax
mov dword [0x4db8d4], eax
cmp eax, 0xc
jne 0x4634b8
call fcn.004719a0
mov ebp, dword [esp + 0xc90]
mov edi, ebp
mov eax, dword [0x4deb74]
dec eax
shr edi, 0x10
movzx esi, bp
cmp eax, 7
ja case.default.0x4634d2
jmp dword [eax*4 + 0x464774]
mov ecx, esi
call fcn.00409aa0
mov ecx, esi
call fcn.00413f50
jmp case.default.0x4634d2
mov ecx, esi
call fcn.0040a400
jmp case.default.0x4634d2
mov ecx, esi
call fcn.00425de0
jmp case.default.0x4634d2
mov ecx, esi
call fcn.00430260
mov edx, edi
mov ecx, esi
call fcn.00444360
jmp case.default.0x4634d2
mov ecx, esi
call fcn.00448ba0
jmp case.default.0x4634d2
mov ecx, esi
call fcn.00453930
cmp esi, 0x7530
ja 0x463ab6
je 0x463a93
cmp esi, 0x4e39
ja 0x463713
je 0x463697
add esi, 0xffffd6ee
cmp esi, 0xbb
ja case.0x463ac5.30028
movzx eax, byte [esi + 0x4647a8]
jmp dword [eax*4 + 0x464794]
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x488], ax
lea eax, [esp + 0x48a]
push eax
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0x480]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0
lea eax, [esp + 0x488]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
lea ecx, [esp + 0x480]
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 0x800
jae 0x46476e
xor ecx, ecx
mov word [esp + eax + 0x480], cx
lea eax, [esp + 0x480]
push str._tweakguide.exe
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x480]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
movaps xmm0, xmmword [0x4c1440]
push eax
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x20], 0x4c
mov dword [esp + 0x28], 0
movups xmmword [esp + 0x30], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor eax, eax
jmp 0x464755
call fcn.0045ea50
xor eax, eax
jmp 0x464755
cmp dword [0x4df1ac], 0
jne 0x46366e
push 5
push 0
push 0
push str.http:__www.tweakguide.net
push str.open
push dword [0x4def88]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x463682
push 1
push 0xf
push 0x4de958
push dword [0x4def88]
call fcn.00401149
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x29af
jmp 0x463a07
mov edx, 0x4ae308
mov ecx, str.MAINPAGE
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4ad0dc
mov ecx, str.MENUTEXT
call fcn.00477440
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 2
push 0x40b
push dword [0x4deb68]
call esi
push 0x4ad29c
push 1
push 0x40b
push dword [0x4deb68]
call esi
call fcn.00467460
xor ecx, ecx
call fcn.0046c020
mov ecx, 5
mov dword [0x4deb74], 1
call fcn.0046c020
xor eax, eax
jmp 0x464755
cmp esi, 0x4f42
ja 0x463a21
je 0x4639e4
add esi, 0xffffb1c6
cmp esi, 5
ja case.0x463ac5.30028
jmp dword [esi*4 + 0x464864]
mov edx, 0x4ae310
mov ecx, str.MAINPAGE
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4ad0d4
mov ecx, str.MENUTEXT
call fcn.00477440
push eax
push 2
push 0x40b
push dword [0x4deb68]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.00467fa0
xor ecx, ecx
call fcn.0046c020
mov ecx, 5
mov dword [0x4deb74], 2
call fcn.0046c020
cmp dword [0x4c5188], 2
je 0x463832
push 5
push 0x27a7
jmp 0x46381f
mov edx, 0x4ad7cc
mov ecx, str.MAINPAGE
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4ad3dc
mov ecx, str.MENUTEXT
call fcn.00477440
push eax
push 2
push 0x40b
push dword [0x4deb68]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.00468a60
xor ecx, ecx
call fcn.0046c020
mov ecx, 5
mov dword [0x4deb74], 3
call fcn.0046c020
cmp dword [0x4c5194], 2
je 0x463832
push 5
push 0x27ae
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
jmp 0x464755
mov edx, 0x4ad7d4
mov ecx, str.MAINPAGE
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4ad444
mov ecx, str.MENUTEXT
call fcn.00477440
push eax
push 2
push 0x40b
push dword [0x4deb68]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.00469340
xor ecx, ecx
call fcn.0046c020
mov ecx, 5
mov dword [0x4deb74], 4
call fcn.0046c020
xor eax, eax
jmp 0x464755
cmp dword [0x4d2c80], 0
jne 0x4638b2
mov dword [0x4d2c80], 0x29fa
mov edx, 0x4ad7fc
mov ecx, str.MAINPAGE
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4ad480
mov ecx, str.MENUTEXT
call fcn.00477440
push eax
push 2
push 0x40b
push dword [0x4deb68]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.0046b900
xor ecx, ecx
call fcn.0046c020
mov ecx, 5
mov dword [0x4deb74], 5
call fcn.0046c020
xor eax, eax
jmp 0x464755
mov edx, 0x4ae4a8
mov ecx, str.MAINPAGE
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4ad560
mov ecx, str.MENUTEXT
call fcn.00477440
push eax
push 2
push 0x40b
push dword [0x4deb68]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.0046fcb0
xor ecx, ecx
call fcn.0046c020
mov ecx, 5
mov dword [0x4deb74], 6
call fcn.0046c020
xor eax, eax
jmp 0x464755
mov edx, 0x4ade90
mov ecx, str.MAINPAGE
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4ad76c
mov ecx, str.MENUTEXT
call fcn.00477440
push eax
push 2
push 0x40b
push dword [0x4deb68]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.004708e0
xor ecx, ecx
call fcn.0046c020
mov ecx, 5
mov dword [0x4deb74], 7
call fcn.0046c020
xor eax, eax
jmp 0x464755
push 0
push 0x4754c0
push dword [0x4def88]
push str.IDD_STATUS
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push 0x4f42
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, eax
call fcn.0045efd0
xor eax, eax
jmp 0x464755
cmp esi, 0x4f78
jne case.0x463ac5.30028
mov edx, 0x4b0c28
mov ecx, str.MAINPAGE
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4ad9bc
mov ecx, str.MENUTEXT
call fcn.00477440
push eax
push 2
push 0x40b
push dword [0x4deb68]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.00470a50
xor ecx, ecx
call fcn.0046c020
mov ecx, 5
mov dword [0x4deb74], 8
call fcn.0046c020
xor eax, eax
jmp 0x464755
push 5
push 0
push 0
push str.notepad.exe
push str.open
push dword [0x4def88]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
jmp 0x464755
add esi, 0xffff8acf
cmp esi, 0x3b
ja case.0x463ac5.30028
jmp dword [esi*4 + 0x46487c]
cmp dword [0x4deb74], 0
je 0x463832
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 1
push 0xf8
push 0x4f42
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0x1000
push 0
push 0
push 1
push 0x4f42
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 1
push 0xf7
push 0x4f42
push dword [0x4def88]
call edi
push eax
call esi
push 1
push 0
push 0x4f42
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x474b00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0x4ae300
mov ecx, str.MAINPAGE
call fcn.00477440
push eax
push 0
push 0x40b
push dword [0x4deb68]
call esi
mov edx, 0x4ad0cc
mov ecx, str.MENUTEXT
call fcn.00477440
push eax
push 2
push 0x40b
push dword [0x4deb68]
call esi
mov edx, 0x4ad560
mov ecx, str.MAINPAGE
call fcn.00477440
push eax
push 0x2723
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call esi
mov edx, 0x4ad76c
mov ecx, str.MAINPAGE
call fcn.00477440
push eax
push 0x2724
push dword [0x4def88]
call edi
push eax
call esi
xor ecx, ecx
call fcn.0046c020
call fcn.0047eca0
call fcn.00485310
mov dword [0x4deb74], 0
mov ecx, 1
call fcn.004858d0
mov ecx, 5
call fcn.0046c020
xor eax, eax
jmp 0x464755
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa000a
push 0
push 0x202
push 0x4e39
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xa000a
push 0
push 0x201
push 0x4e39
push dword [0x4def88]
call edi
push eax
call esi
push 0xa000a
push 0
push 0x202
push 0x4e39
push dword [0x4def88]
call edi
push eax
call esi
xor eax, eax
jmp 0x464755
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa000a
push 0
push 0x202
push 0x4e3a
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xa000a
push 0
push 0x201
push 0x4e3a
push dword [0x4def88]
call edi
push eax
call esi
push 0xa000a
push 0
push 0x202
push 0x4e3a
push dword [0x4def88]
call edi
push eax
call esi
xor eax, eax
jmp 0x464755
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa000a
push 0
push 0x202
push 0x4e3b
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xa000a
push 0
push 0x201
push 0x4e3b
push dword [0x4def88]
call edi
push eax
call esi
push 0xa000a
push 0
push 0x202
push 0x4e3b
push dword [0x4def88]
call edi
push eax
call esi
xor eax, eax
jmp 0x464755
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa000a
push 0
push 0x202
push 0x4e3c
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xa000a
push 0
push 0x201
push 0x4e3c
push dword [0x4def88]
call edi
push eax
call esi
push 0xa000a
push 0
push 0x202
push 0x4e3c
push dword [0x4def88]
call edi
push eax
call esi
xor eax, eax
jmp 0x464755
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa000a
push 0
push 0x202
push 0x4e3d
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xa000a
push 0
push 0x201
push 0x4e3d
push dword [0x4def88]
call edi
push eax
call esi
push 0xa000a
push 0
push 0x202
push 0x4e3d
push dword [0x4def88]
call edi
push eax
call esi
xor eax, eax
jmp 0x464755
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa000a
push 0
push 0x202
push 0x4e3e
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xa000a
push 0
push 0x201
push 0x4e3e
push dword [0x4def88]
call edi
push eax
call esi
push 0xa000a
push 0
push 0x202
push 0x4e3e
push dword [0x4def88]
call edi
push eax
call esi
xor eax, eax
jmp 0x464755
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa000a
push 0
push 0x202
push 0x4e3f
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xa000a
push 0
push 0x201
push 0x4e3f
push dword [0x4def88]
call edi
push eax
call esi
push 0xa000a
push 0
push 0x202
push 0x4e3f
push dword [0x4def88]
call edi
push eax
call esi
xor eax, eax
jmp 0x464755
push 0x208
lea eax, [esp + 0x74]
push 0
push eax
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0x18]
push 0x58
push 0
push eax
call fcn.0048e880
mov eax, dword [0x4deb64]
add esp, 0xc
mov dword [esp + 0x20], eax
mov eax, dword [0x4def88]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x58
mov dword [esp + 0x50], 0x81824
mov dword [esp + 0x28], str.All_Files__._
mov dword [esp + 0x4c], str.Select_a_file_to_open_in_Notepad
mov dword [esp + 0x48], 0x4b0a54
mov dword [esp + 0x3c], 0x104
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x60], 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
cmp word [esp + 0x70], 0
je 0x463832
push 5
push 0
lea eax, [esp + 0x78]
push eax
jmp 0x463a99
push 0x104
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str._system.ini
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
push 0
lea eax, [esp + 0x78]
push eax
jmp 0x463a99
push 0x104
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.win.ini
jmp 0x463fae
push 0x104
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.config.nt
jmp 0x463fae
push 0x104
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str._autoexec.nt
jmp 0x463fae
push 5
push 0
push str.c:config.sys
jmp 0x463a99
push 5
push 0
push str.c:_autoexec.bat
jmp 0x463a99
push 5
push 0
push 0
push str.msinfo32.exe
jmp 0x463a9e
push 5
push 0
push 0
push str.shell:::ED7BA470_8E54_465E_825C_99712043E01C
jmp 0x463a9e
push 5
push 0
push 0
push str.shell:::78F3955E_3B90_4184_BD14_5397C15F1EFC
jmp 0x463a9e
push 5
push 0
push 0
push str.compmgmt.msc
jmp 0x463a9e
push 5
push 0
push 0
push str.cleanmgr.exe
jmp 0x463a9e
push 5
push 0
push 0
push str.shell:::4026492F_2F69_46B8_B9BF_5654FC07E423
jmp 0x463a9e
push 5
push 0
push 0
push str.shell:::9C60DE1E_E5FC_40f4_A487_460851A8D915
jmp 0x463a9e
push str.Kernel32.dll
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test esi, esi
jne 0x4640ca
push str.Kernel32.dll
call ebp
mov esi, eax
test esi, esi
je 0x4640e4
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4640e1
lea ecx, [esp + 0x14]
push ecx
call eax
push esi
call edi
mov ebx, dword [esp + 0x14]
push 5
push 0
push 0
push str.msconfig.exe
push str.open
push dword [0x4def88]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
test ebx, ebx
je 0x463832
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x46412e
push str.Kernel32.dll
call ebp
mov esi, eax
test esi, esi
je 0x463832
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x464141
push ebx
call eax
push esi
call edi
xor eax, eax
jmp 0x464755
push str.Kernel32.dll
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test esi, esi
jne 0x46417d
push str.Kernel32.dll
call ebp
mov esi, eax
test esi, esi
je 0x464197
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x464194
lea ecx, [esp + 0x14]
push ecx
call eax
push esi
call edi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 5
push 0
push 0
push str.dfrgui.exe
push str.open
push 0
call esi
cmp eax, 2
jne 0x4641ce
push 5
push 0
push 0
push str.dfrg.msc
push str.open
push dword [0x4def88]
call esi
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x463832
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x4641fc
push str.Kernel32.dll
call ebp
mov esi, eax
test esi, esi
je 0x463832
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x46413e
push esi
call edi
xor eax, eax
jmp 0x464755
cmp dword [0x4de950], 2
je case.0x463ac5.30059
xor eax, eax
push 0x206
push eax
mov word [esp + 0x78], ax
lea eax, [esp + 0x7a]
push eax
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0x70]
push 0x104
push eax
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x70]
push str.program_filesWindows_DefenderMSASCui.exe
push eax
call edi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esp + 0x70]
push 5
push 0
push 0
push eax
push str.open
push dword [0x4def88]
call esi
cmp eax, 2
jne 0x463832
lea eax, [esp + 0x14]
push eax
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [esp + 0x70]
push eax
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x463832
push str.Windows_DefenderMSASCui.exe
lea eax, [esp + 0x74]
push eax
call edi
push 5
push 0
push 0
lea eax, [esp + 0x7c]
push eax
push str.open
push dword [0x4def88]
call esi
cmp eax, 2
jne 0x463832
push 5
push 0
push 0
push str.wf.msc
push str.open
push dword [0x4def88]
call esi
xor eax, eax
jmp 0x464755
push str.Kernel32.dll
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test esi, esi
jne 0x464333
push str.Kernel32.dll
call ebp
mov esi, eax
test esi, esi
je 0x46434d
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46434a
lea ecx, [esp + 0x14]
push ecx
call eax
push esi
call edi
push 5
push 0
push 0
push str.rstrui.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4641ce
push 5
push 0
push 0
push str.regedit.exe
jmp 0x463a9e
push 5
push 0
push 0
push str.services.msc
jmp 0x463a9e
push 5
push 0
push 0
push str.gpedit.msc
jmp 0x463a9e
call fcn.00477920
xor eax, eax
jmp 0x464755
push 0
push 0x191
push 0x111
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x464755
push 5
push 0
push 0
push 0x4b0574
jmp 0x463a9e
push 5
push 0
push 0
push str.powershell
jmp 0x463a9e
mov edx, 0x4ade88
mov ecx, str.MAINPAGE
call fcn.00477440
push eax
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x70]
mov edx, 0x4ade98
push 0x24
push eax
mov ecx, str.MAINPAGE
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x463832
lea ecx, [eax - 4]
call fcn.00477690
xor eax, eax
jmp 0x464755
push 1
push 0x4def98
push 0
push str.language.exe
jmp 0x463a9e
mov edx, str.OnTop
mov ecx, 0x754f
call fcn.00477730
push 0x4ded80
push 0
push str.OnTop
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 3
push 0
push 0
push 0
push 0
test eax, eax
jne 0x46449f
push 0xfffffffffffffffe
push dword [0x4def88]
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
jmp 0x464755
push 0xffffffffffffffff
push dword [0x4def88]
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
jmp 0x464755
mov edx, str.Magnet
mov ecx, 0x7550
call fcn.00477730
push 0x4ded80
push 0
push str.Magnet
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x4df1b0], eax
xor eax, eax
jmp 0x464755
mov edx, str.SaveSize
mov ecx, 0x7551
call fcn.00477730
xor eax, eax
jmp 0x464755
mov edx, str.Position
mov ecx, 0x7552
call fcn.00477730
xor eax, eax
jmp 0x464755
mov edx, str.NoSaver
mov ecx, 0x7553
call fcn.00477730
push 0x4ded80
push 0
push str.NoSaver
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 2
push 0
test eax, eax
jne 0x464551
push 1
push 0x11
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
xor eax, eax
jmp 0x464755
push 0
push 0x11
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
xor eax, eax
jmp 0x464755
push 0
push 0x4625b0
push dword [0x4def88]
push str.IDD_TRANSPARENT
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor eax, eax
jmp 0x464755
mov edx, str.ClearFont
mov ecx, 0x7555
call fcn.00477730
mov edx, 0x4ad488
mov ecx, str.MAINPAGE
call fcn.00477440
push eax
lea eax, [esp + 0x27c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x278]
mov edx, 0x4ae4b0
push 0x30
push eax
mov ecx, str.MAINPAGE
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x464755
mov edx, str.SystemTray
mov ecx, 0x7556
call fcn.00477730
call fcn.0047b6c0
xor eax, eax
jmp 0x464755
mov edx, 0x4ba750
mov ecx, 0x7563
call fcn.00477730
xor eax, eax
jmp 0x464755
mov edx, str.ShowSysStat
mov ecx, 0x7564
call fcn.00477730
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x474b00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
jmp 0x464755
push 0x4ded80
push 0
push str.Protect
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
test eax, eax
je 0x46468f
push 0x7557
push dword [0x4df1a8]
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0x4ded80
push 0x4ad0e0
push str.Protect
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor eax, eax
jmp 0x464755
push 0x462a70
push dword [0x4def88]
push str.PASSWORD_1
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor eax, eax
jmp 0x464755
push 1
push 0xf
push 0x4de958
push dword [0x4def88]
call fcn.00401149
xor eax, eax
jmp 0x464755
push 0x13
jmp 0x4646b4
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor eax, eax
jmp 0x464755
push 0x12
jmp 0x4646b4
push 5
push 0
push 0
push str.https:__www.wintools.net
jmp 0x463a9e
push 5
push 0
push 0
push str.mailto:support_wintools.net_subjectReport_about_WinTools.net
jmp 0x463a9e
push 0
push 0x462c70
push ebx
push 0x67
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor eax, eax
jmp 0x464755
push 0
push 0
push 0x10
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
jmp 0x464755
push dword [esp + 0xc94]
push ebp
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [esp + 0xc84]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d925
add esp, 0xc7c
ret
call fcn.0048da55
nop
fnstenv [esi + eax*2]
add cl, ch
xor al, 0x46
add al, ah
xor al, 0x46
add dl, dh
xor al, 0x46
add bl, bh
xor al, 0x46
add byte [edx], al
xor eax, 0x350d0046
inc esi
add byte [esi], dl
xor eax, 0x43ed0046
inc esi
add byte [ecx + 0x35], ah
inc esi
add byte [ebx], bh
inc esi
add byte [edi + 0x36], al
inc esi
add byte [edx + 0x47], al
inc esi
add byte [eax], al
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add dword [esp + eax], eax
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, byte [ebx]
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 2
cmp esi, dword [edi]
inc esi
add byte [eax + 0x39004637], dh
cmp byte [esi], al
lahf
cmp byte [esi], al
sbb byte [ecx], bh
inc esi
add byte [esi + 0x39], bh
inc esi
add ch, ch
inc esi
add bh, al
aas
inc esi
add byte [ecx + 0x1a00463f], bl
inc eax
inc esi
add byte [eax + eax*2], cl
inc esi
add ch, dh
aas
inc esi
add dh, bl
aas
inc esi
add ah, cl
cmp al, byte [esi]
sbb al, 0x3c
inc esi
add byte [ebx - 0x15ffb9c4], al
cmp al, 0x46
add byte [ecx + 0x3d], dl
inc esi
add byte [eax + 0x1f00463d], bh
inc esi
add byte [esi - 0x4dffb9c2], al
inc esi
inc esi
add byte [eax], ch
inc eax
inc esi
add byte [eax + 0x68004640], bl
inc eax
inc esi
add byte [ebx + 0x41], cl
inc esi
add byte [edx], bl
inc edx
inc esi
add byte [eax + 0x40], bl
inc esi
add byte [ecx], al
inc ebx
inc esi
add byte [edx + 0x43], ch
inc esi
add byte [edx + 0x43], bh
inc esi
add byte [edx - 0x22ffb9bd], cl
inc ebx
inc esi
add byte [edx + 0x47], al
inc esi
add byte [ebx + 0x44], al
inc esi
add byte [edx + 0x47], al
inc esi
add byte [esi + 0x44], dl
inc esi
add byte [esp + eax*2 + 0x44e60046], dh
inc esi
add ah, bh
inc esp
inc esi
add byte [edx], dl
inc ebp
inc esi
add byte [edx + 0x45], ah
inc esi
add byte [edi - 0x1effb9bb], al
inc ebp
inc esi
add byte [eax + 0x46], al
inc esi
add byte [ecx], dh
inc edi
inc esi
add byte [edx - 0x59ffb9bd], bl
inc ebx
inc esi
add ch, cl
inc ebx
inc esi
add ch, ch
inc ebx
inc esi
add ch, cl
inc esi
inc esi
add cl, dl
inc esi
inc esi
add bl, dh
inc esi
inc esi
add bh, dh
inc esi
inc esi
add byte [edi], al
inc edi
inc esi
add byte [edi], dl
inc edi
inc esi
add ah, bh
inc ebp
inc esi
add byte [edx], dl
inc esi
inc esi
add byte [eax], bh
inc eax
inc esi
add byte [eax], ch
inc eax
inc esi
add byte [eax], bh
inc eax
inc esi
add byte [eax + 0x40], cl
inc esi
add byte [eax + 0x40], bl
inc esi
add byte [eax + 0x40], ch
inc esi
add byte [eax + 0x40], bh
inc esi
add byte [eax - 0x33ffb9c0], cl
int3