Function at 0x401650
Capabilities:
Accept command line arguments
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c4
push ebx
push esi
push edi
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push section..text
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x4016a2
test eax, eax
je 0x40169e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x14], esi
call fcn.00401570
test al, al
jne 0x4017bd
push 0xffffffffffffffff
call sub.IMM32.dll_ImmDisableIME
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.00404190
mov ecx, dword [ebp + 0x10]
add esp, 0x10
push str.dump
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4016e2
xor eax, eax
mov dword [eax], eax
call fcn.00401d20
mov dword [esp + 0x20], eax
test eax, eax
jne 0x40178a
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
lea esp, [esp]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x40180e
xor edi, edi
mov edi, edi
cmp edi, dword [esp + 0x10]
jge 0x40180b
mov eax, dword [esi + edi*4]
push str.from_install
push eax
call fcn.0046f9ec
add esp, 8
test eax, eax
je 0x40175b
mov ecx, dword [esi + edi*4]
push str.from_service
push ecx
call fcn.0046f9ec
add esp, 8
test eax, eax
je 0x4017d8
inc edi
jmp 0x401720
push esi
call ebx
mov eax, dword [0x4aacf8]
inc eax
cmp eax, 0xa
mov dword [0x4aacf8], eax
jg 0x4017aa
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401d20
mov dword [esp + 0x20], eax
test eax, eax
je 0x401700
push 0xbc
call fcn.0046f046
add esp, 4
test eax, eax
je 0x401889
push eax
call fcn.00403ef0
jmp 0x40188b
cmp byte [0x4aacd0], 0
je 0x4017bd
push 1
call fcn.0046bdd0
add esp, 4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4017cc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
call ebx
cmp byte [0x4aacd0], 0
je 0x4017ee
push 1
call fcn.0046bdd0
add esp, 4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4017fd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
call ebx
lea edx, [esp + 0x198]
push edx
call fcn.004304c0
lea ebx, [esp + 0xc]
lea esi, [esp + 0x2c0]
mov dword [esp + 0xc], 0
call fcn.0042f970
test eax, eax
jne 0x40184a
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40184a
mov eax, esi
jmp 0x401868
lea ebx, [esp + 0x19c]
lea esi, [esp + 0x2c0]
call fcn.0042f970
neg eax
sbb eax, eax
and eax, dword [esp + 0x19c]
push 0
push 0
push 0x658
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x198]
call fcn.00430650
jmp 0x4017aa
xor eax, eax
push 0xbc
mov dword [0x4aab8c], eax
call fcn.0046f046
add esp, 4
test eax, eax
je 0x4018a9
push eax
call fcn.00402df0
jmp 0x4018ab
xor eax, eax
push str.SetProcessDPIAware
push str.user32.dll
mov dword [0x4aab50], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4018cd
call eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 8
mov dword [esp + 0x30], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov edi, dword [ebp + 8]
mov dword [0x4aacd4], edi
mov dword [0x4aacd8], edi
mov dword [0x4aacdc], edi
mov dword [0x4aace0], edi
mov dword [0x4aace4], edi
mov dword [0x4aace8], edi
mov dword [0x4aacec], edi
mov dword [0x4aacf0], edi
mov dword [0x4aacf4], edi
call fcn.0042cc70
xor esi, esi
push esi
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
call sub.gdiplus.dll_GdiplusStartup
push 0xc
call fcn.0046f046
add esp, 4
cmp eax, esi
je 0x401968
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [esp + 0xc], eax
jmp 0x40196c
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0xc]
push 0x7c
mov dword [0x4aab24], eax
call fcn.0046f046
add esp, 4
cmp eax, esi
je 0x401990
mov esi, eax
call fcn.00437260
mov dword [esp + 0x1c], eax
jmp 0x401994
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x60]
push edx
mov dword [0x4aab20], ecx
call fcn.004304c0
lea ebx, [esp + 0x60]
mov dword [esp + 0x16c], edi
call fcn.004306f0
xor ebx, ebx
mov dword [esp + 0x10], ebx
cmp byte [esp + 0x160], bl
jne 0x401c2c
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
cmp byte [esp + 0x170], bl
je 0x4019f2
lea ecx, [esp + 0x60]
call fcn.00401190
mov dword [esp + 0x10], eax
cmp eax, 0xdead
je 0x401c2c
cmp byte [esp + 0x160], bl
jne 0x401c2c
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x493d48
call fcn.0040b010
lea edi, [esp + 0x88]
call fcn.0043a030
mov edx, dword [eax + 0x48]
test dl, 0xf
je 0x401a3b
cmp edx, ebx
jbe 0x401a51
cmp edx, 2
jbe 0x401a32
cmp edx, 4
jne 0x401a51
mov dword [eax + 0x48], 8
jmp 0x401a51
cmp edx, 0x10
je 0x401a4a
cmp edx, 0x20
je 0x401a4a
cmp edx, 0x40
jne 0x401a51
mov dword [eax + 0x48], 0x80
mov ecx, dword [eax + 0x48]
mov edx, dword [eax]
mov edx, dword [edx + 0x2c]
push ecx
mov ecx, eax
call edx
mov dword [esp + 0x158], ebx
cmp byte [esp + 0x170], bl
je 0x401a9e
mov eax, dword [esp + 0x64]
push 0x42
push 0x87
push 0x10c
push ebx
push ebx
push 0xffffffffffffffff
push eax
call esi
mov edx, dword [esp + 0x84]
mov eax, dword [edx + 0x38]
push 1
push 1
lea ecx, [esp + 0x8c]
call eax
jmp 0x401acc
mov ecx, dword [esp + 0x64]
push 0x82
push 0x87
push 0x10c
push ebx
push ebx
push 0xffffffffffffffff
push ecx
call esi
mov edx, dword [esp + 0x64]
push ebx
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esp + 0x170], 1
cmp byte [esp + 0x160], bl
jne 0x401c2c
lea esp, [esp]
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x401aff
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x401bd2
lea ecx, [esp + 0x44]
push ecx
call fcn.00401420
add esp, 4
test eax, eax
jne 0x401b26
lea edx, [esp + 0x44]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [esp + 0x48], 0x12
je 0x401be1
mov eax, dword [esp + 0x15c]
mov edx, 0x492924
mov ecx, eax
nop
mov di, word [ecx]
cmp di, word [edx]
jne 0x401b66
cmp di, bx
je 0x401b62
mov di, word [ecx + 2]
cmp di, word [edx + 2]
jne 0x401b66
add ecx, 4
add edx, 4
cmp di, bx
jne 0x401b40
xor ecx, ecx
jmp 0x401b6b
sbb ecx, ecx
sbb ecx, 0xffffffff
cmp ecx, ebx
sete cl
cmp cl, bl
jne 0x401c0d
mov ecx, str.Hide
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401ba6
cmp dx, bx
je 0x401ba2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401ba6
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x401b80
xor eax, eax
jmp 0x401bab
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
je 0x401bd2
push ebx
push 0x492994
lea ecx, [esp + 0x164]
call fcn.00402640
mov ecx, dword [esp + 0x64]
push ebx
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [esp + 0x160], bl
je 0x401ae0
jmp 0x401c2c
mov eax, dword [esp + 0x168]
mov byte [esp + 0x160], 1
cmp eax, ebx
je 0x401c2c
mov edi, eax
call fcn.0040aeb0
push edi
call fcn.0046f011
add esp, 4
mov dword [esp + 0x168], ebx
jmp 0x401c1f
push ebx
push 0x492994
lea ecx, [esp + 0x164]
call fcn.00402640
cmp byte [esp + 0x160], bl
je 0x4019d1
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x401c3e
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
mov dword [0x4aab20], ebx
call eax
mov esi, dword [esp + 0xc]
mov dword [0x4aab24], ebx
cmp esi, ebx
je 0x401c7c
mov eax, dword [esi]
cmp eax, ebx
je 0x401c6d
push eax
call fcn.0046f0ab
add esp, 4
mov dword [esi], ebx
push esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.0046f011
add esp, 4
mov ecx, dword [esp + 0x24]
push ecx
call sub.gdiplus.dll_GdiplusShutdown
mov edx, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov ecx, dword [0x4aab8c]
cmp ecx, ebx
je 0x401ca5
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, dword [0x4aab4c]
mov dword [0x4aab8c], ebx
cmp eax, ebx
je 0x401cd1
call fcn.004048e0
mov ecx, dword [0x4aab4c]
cmp ecx, ebx
je 0x401ccb
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [0x4aab4c], ebx
mov ecx, dword [0x4aab50]
cmp ecx, ebx
je 0x401ce9
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [0x4aab50], ebx
lea eax, [esp + 0x60]
call fcn.00430650
cmp byte [0x4aacd0], bl
je 0x401d04
push 1
call fcn.0046bdd0
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x401d0f
push eax
call esi
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10