Function at 0x44fef1
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
mov eax, 0x460908
call fcn.0045e9d0
mov eax, 0x17ac
call fcn.0045e9a0
push ebx
push esi
push edi
push 1
mov esi, ecx
pop ebx
push ebx
mov ecx, 0x477d38
call fcn.0042b0f2
push 2
mov ecx, 0x460a70
call fcn.0041206f
and byte [ebp - 0x17b8], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x17b7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
cmp eax, 0x7701
jl 0x44ff67
cmp eax, 0x7800
jg 0x44ff67
add eax, 0xffff88ff
mov dword [0x476644], ebx
push eax
mov dword [0x476900], eax
push ebx
mov ecx, esi
jmp 0x4508a8
cmp eax, 0x3501
jl 0x44ff87
cmp eax, 0x7700
jg 0x44ff87
add eax, 0xffffcaff
mov ecx, esi
push eax
call fcn.00453e45
jmp case.0x450900.32857
cmp eax, 0x2700
jl 0x44ffa2
cmp eax, 0x2999
jg 0x44ffa2
push eax
mov ecx, esi
call fcn.00453e87
jmp case.0x450900.32857
cmp eax, 0x7801
jl 0x44ffc5
cmp eax, 0x7901
jg 0x44ffc5
add eax, 0xffff87ff
mov ecx, 0x49ac50
push eax
call fcn.00445493
jmp case.0x450900.32857
cmp eax, 0x2650
jl 0x44ffe8
cmp eax, 0x2699
jg 0x44ffe8
add eax, 0xffffd9b0
mov ecx, 0x498a58
push eax
call fcn.00439f07
jmp case.0x450900.32857
mov ecx, 0x8054
cmp eax, ecx
jg 0x4508d4
je 0x4508cc
mov ecx, reloc.KERNEL32.dll_GetShortPathNameW
cmp eax, ecx
jg 0x4503d3
je 0x4503c5
mov ecx, 0x3064
cmp eax, ecx
jg 0x4502ac
je case.0x450900.32906
add ecx, 0xfffffff0
cmp eax, ecx
jg 0x450170
je 0x450161
mov ecx, 0x3003
cmp eax, ecx
jg 0x45011d
je 0x4500d9
mov ecx, 0x1770
sub eax, ecx
je 0x4500cc
sub eax, 3
je 0x4500c5
sub eax, 7
je 0x4500be
dec eax
je 0x4500b7
sub eax, 0x1886
je 0x45006e
dec eax
je case.0x450900.32854
jmp case.0x450900.32857
and byte [ebp - 0xdb0], 0
mov ecx, 0x218
xor eax, eax
lea edi, [ebp - 0xdaf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xdb0]
push 0x863
push eax
push dword [esi + 0xb20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
mov ecx, esi
push eax
push eax
push eax
lea eax, [ebp - 0xdb0]
push eax
call fcn.00455157
jmp case.0x450900.32857
push 0x177b
jmp 0x4500cd
push 0x177a
jmp 0x4500cd
push 0x1773
jmp 0x4500cd
push ecx
mov ecx, esi
call fcn.0045692b
jmp case.0x450900.32857
mov al, byte [0x460a68]
mov ecx, 0x1ff
mov byte [ebp - 0xd4c], al
xor eax, eax
lea edi, [ebp - 0xd4b]
push 0x800
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xd4c]
push eax
push dword [esi + 0xb20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0
lea eax, [ebp - 0xd4c]
jmp 0x451100
sub eax, 0x3005
je 0x450152
dec eax
je 0x450143
sub eax, 0x4b
je case.0x450900.32925
dec eax
je case.0x450900.32918
dec eax
je case.0x450900.32919
jmp case.0x450900.32857
mov ecx, 0x49a108
call fcn.00456549
jmp case.0x450900.32857
mov ecx, 0x49a108
call fcn.00456829
jmp case.0x450900.32857
mov ecx, 0x4789e8
call fcn.00416916
jmp case.0x450900.32857
lea ecx, [eax - 0x3055]
cmp ecx, 0xe
ja case.0x450900.32857
jmp dword [ecx*4 + 0x451194]
cmp dword [0x4766d0], 0
je 0x4501bd
mov ecx, 0x5358f0
call fcn.004313a1
test eax, eax
je case.0x450900.32857
mov esi, 0x498a78
push ebx
push ebx
mov ecx, esi
call fcn.0041c6f6
push 0
mov ecx, esi
call fcn.0041c4e0
jmp case.0x450900.32857
push eax
lea ecx, [esi + 0xae4]
call fcn.0044966c
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push dword [esi + 0xae8]
mov ecx, esi
push 0x3eb
call fcn.00452995
lea eax, [ebp - 0x14]
mov ecx, 0x5358f0
push eax
call fcn.00430cc0
jmp case.0x450900.32857
push eax
lea ecx, [esi + 0xae4]
call fcn.0044966c
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push dword [esi + 0xae8]
mov ecx, esi
push 0x3eb
call fcn.00452995
lea eax, [ebp - 0x14]
mov ecx, 0x5358f0
push eax
call fcn.00430df5
jmp case.0x450900.32857
push 0xffffffffffffffff
push dword [esi + 4]
mov ecx, esi
call fcn.0044fd12
jmp case.0x450900.32857
push eax
lea ecx, [esi + 0xae4]
call fcn.0044966c
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push dword [esi + 0xae8]
mov ecx, esi
push 0x3eb
call fcn.00452995
push dword [ebp - 0x10]
mov ecx, esi
push dword [ebp - 0x14]
call fcn.004520f2
jmp case.0x450900.32857
push eax
lea ecx, [esi + 0xae4]
call fcn.0044966c
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push dword [esi + 0xae8]
mov ecx, esi
push 0x3eb
call fcn.00452995
push dword [ebp - 0x10]
mov ecx, esi
push dword [ebp - 0x14]
call fcn.004521b9
jmp case.0x450900.32857
mov ecx, 0x7950
cmp eax, ecx
jg 0x450352
je 0x45033a
lea ecx, [eax - 0x3065]
cmp ecx, 9
ja case.0x450900.32857
jmp dword [ecx*4 + 0x4511d0]
mov ecx, 0x4789e8
call fcn.0041a348
jmp case.0x450900.32857
mov ecx, 0x49a108
call fcn.00455716
jmp case.0x450900.32857
mov ecx, 0x49a108
call fcn.00456455
jmp case.0x450900.32857
mov ecx, esi
jmp 0x450bc7
push eax
lea ecx, [esi + 0xae4]
call fcn.0044966c
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push dword [esi + 0xae8]
mov ecx, esi
push 0x3eb
call fcn.00452995
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.004568cd
jmp case.0x450900.32857
push 0
push 0x26
push 0x100
mov ecx, 0x4789e8
call fcn.0041894e
jmp case.0x450900.32857
mov ecx, GetShortPathNameW
cmp eax, ecx
jg case.0x450900.32857
je case.0x4503ec.32679
add eax, 0xffff86af
cmp eax, 0xa
ja case.0x450900.32857
jmp dword [eax*4 + 0x4511f8]
push 0
push 0x28
jmp 0x45033e
push 0
push 0x25
jmp 0x45033e
push 0
push 0x27
jmp 0x45033e
push 0
push 0x22
jmp 0x45033e
push 0
push 0x21
jmp 0x45033e
push 0
push 6
jmp 0x4503a2
push 0
push 7
push 0x114
jmp 0x450343
push 0
push 0x23
jmp 0x45033e
push 0
push 0x24
jmp 0x45033e
push ebx
mov ecx, 0x4789e8
call fcn.004195ec
jmp case.0x450900.32857
mov esi, 0x4789e8
mov ecx, esi
call fcn.00416adf
jmp 0x4503ff
lea ecx, [eax - 0x7fa3]
cmp ecx, 0xb0
ja case.0x450900.32857
movzx ecx, byte [ecx + 0x4512d0]
jmp dword [ecx*4 + 0x451224]
mov esi, 0x4789e8
mov ecx, esi
call fcn.00416abd
push 0
mov ecx, esi
call fcn.00418846
jmp case.0x450900.32857
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
mov dword [ebp - 0x34], 0x100
mov dword [ebp - 0x30], 0x79
call fcn.00453963
jmp case.0x450900.32857
xor eax, eax
push ebx
cmp dword [0x5361c8], eax
mov ecx, 0x5358f0
sete al
push eax
mov dword [0x5361c8], eax
call fcn.00430f83
jmp case.0x450900.32857
push 4
jmp 0x451161
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x240]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x240]
push 0x103
push eax
push 0x91
push dword [0x536190]
call edi
mov ebx, 0x104
lea eax, [ebp - 0x448]
push ebx
push eax
push 0x90
push dword [0x536190]
call edi
lea eax, [ebp - 0x240]
push eax
call fcn.00425f2a
pop ecx
lea eax, [ebp - 0x13c]
push ebx
mov ebx, 0x49ac50
push eax
mov ecx, ebx
call fcn.00445622
lea eax, [ebp - 0x13c]
push eax
call fcn.00426dc3
mov eax, dword [0x411164]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push SysReAllocStringLen
lea eax, [ebp - 0x30]
push 0x14
push eax
mov edi, 0x410f38
push 0x411158
push edi
call fcn.0042499c
lea eax, [esi + 0x99c]
push eax
lea eax, [ebp - 0x30]
push 0x80802
push eax
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x448]
push eax
push dword [esi + 4]
push dword [0x536190]
call fcn.00426070
add esp, 0x38
test eax, eax
je case.0x450900.32857
and dword [ebp - 0x18], 0
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x13c]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
mov dword [ebp + 8], eax
test eax, eax
pop ecx
je 0x450613
push 0x40e7d8
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x450584
push 0x40e7d0
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x45058b
mov dword [ebp - 0x18], 1
push 0x40ab5c
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x4505a6
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp + 8]
push SysReAllocStringLen
inc eax
push 0xffffffffffffffff
push eax
push 0x411158
push edi
call fcn.00424b0a
add esp, 0x14
cmp dword [ebp - 0x18], 0
je 0x45060d
mov al, byte [0x460a68]
mov ecx, 0x1ff
mov byte [ebp - 0xd4c], al
xor eax, eax
lea edi, [ebp - 0xd4b]
push 0x800
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xd4c]
mov ecx, ebx
push eax
call fcn.0044565d
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0xd4c]
push eax
call fcn.004269f3
pop ecx
pop ecx
jmp 0x450667
cmp dword [ebp - 0x1c], 0
jne 0x450656
mov ecx, 0x462840
call fcn.00429982
test eax, eax
jne 0x450656
push 0x4010
push 0x40a37c
push 0xc1
mov dword [0x464510], 0xc3
call fcn.004252ac
pop ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
and dword [0x464510], 0
jmp case.0x450900.32857
lea eax, [ebp - 0x13c]
mov ecx, 0x4789e8
push eax
call fcn.0041a4de
test eax, eax
jne 0x45068c
push 0x10
push 0x40a37c
push 0x92
call fcn.004252ac
pop ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp case.0x450900.32857
lea eax, [ebp - 0x13c]
push eax
push 0x99
call fcn.004252ac
pop ecx
push eax
lea eax, [ebp - 0xfb8]
push 0x208
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0xfb8]
push 0x40
push 0x40a37c
jmp 0x45067d
mov ecx, 0x49ac50
call fcn.00443d7e
jmp case.0x450900.32857
mov ecx, 0x49ac50
call fcn.00443e88
jmp case.0x450900.32857
push 0
mov ecx, 0x4789e8
call fcn.00418117
jmp case.0x450900.32857
add eax, 0xffff7ff2
mov ecx, 0x4789e8
push eax
call fcn.004181da
jmp case.0x450900.32857
call fcn.004261ab
jmp case.0x450900.32857
push 0x411140
mov ecx, 0x4789e8
call fcn.00418658
jmp case.0x450900.32857
push 0x411130
jmp 0x450716
push 0x411124
jmp 0x450716
push 0x411110
jmp 0x450716
push 0x411100
jmp 0x450716
push 0x4110e8
jmp 0x450716
push 0x4110dc
jmp 0x450716
push 0x17
jmp 0x451161
push 2
jmp 0x45110b
mov ecx, 0x4789e8
call fcn.00418f7d
jmp case.0x450900.32857
push 3
jmp 0x45110b
xor eax, eax
cmp dword [0x47664c], eax
je 0x4507af
push eax
push eax
push 0x93
call fcn.004252ac
pop ecx
mov edi, 0x460a90
push eax
mov ecx, edi
call fcn.00412478
push dword [esi + 4]
mov ecx, edi
call fcn.004124e8
mov ecx, edi
call fcn.004124d4
mov dword [0x47664c], eax
xor eax, eax
push eax
push eax
push eax
push eax
push ebx
push 0x4110bc
jmp 0x45096f
mov ecx, 0x49a108
call fcn.00452d8e
jmp case.0x450900.32857
push ebx
jmp 0x4507db
cmp dword [esi + 0x8e4], 0
je 0x4507ea
push 0
mov ecx, 0x49ac50
call fcn.0044581c
jmp case.0x450900.32857
mov ecx, 0x49ac50
call fcn.00445810
jmp case.0x450900.32857
xor eax, eax
cmp dword [0x474dfc], eax
sete al
mov dword [0x474dfc], eax
push 0
mov ecx, 0x4994a0
call fcn.004431ad
jmp case.0x450900.32857
xor eax, eax
cmp dword [0x474e08], eax
sete al
mov dword [0x474e08], eax
jmp 0x450809
xor eax, eax
push ebx
cmp dword [0x476634], eax
sete al
push eax
call fcn.004491c1
jmp 0x450d20
xor eax, eax
cmp dword [0x47665c], eax
sete al
mov dword [0x47665c], eax
jmp case.0x450900.32857
push dword [esi + 4]
call fcn.00447d3b
jmp 0x450be6
mov esi, 0x5358f0
mov ecx, esi
call fcn.0042ee4f
mov ecx, esi
call fcn.0043150d
jmp case.0x450900.32857
push 7
jmp 0x45022f
cmp dword [0x476644], 0
je case.0x450900.32857
and dword [0x476644], 0
or dword [0x476900], 0xffffffff
push 0xffffffffffffffff
push 0
mov ecx, 0x49a108
call fcn.004535ba
jmp case.0x450900.32857
push ebx
push 0x3ec
mov ecx, esi
call fcn.00453cb0
jmp case.0x450900.32857
push ebx
push 0x3eb
jmp 0x4508b8
push ebx
push 0x3ea
jmp 0x4508b8
mov ecx, GetCurrentProcessId
cmp eax, ecx
jg 0x451072
je 0x45106b
lea ecx, [eax - 0x8055]
cmp ecx, 0x8a
ja case.0x450900.32857
movzx ecx, byte [ecx + 0x4514c9]
jmp dword [ecx*4 + 0x451381]
xor eax, eax
cmp dword [0x476658], eax
je 0x45091b
push ebx
mov ecx, esi
call fcn.0044fe37
jmp 0x45092f
push eax
push eax
push eax
push ebx
push ebx
push 0x40a66c
mov ecx, 0x4789e8
call fcn.004164ab
mov ecx, esi
call fcn.00451aaf
jmp case.0x450900.32857
push ebx
mov ecx, 0x4789e8
call fcn.00416776
jmp case.0x450900.32857
lea eax, [ebp - 0x17b8]
push 0x800
push eax
mov ecx, 0x49ac50
call fcn.0044565d
xor eax, eax
push eax
push eax
push eax
push ebx
push ebx
lea eax, [ebp - 0x17b8]
push eax
mov ecx, 0x4789e8
call fcn.004164ab
jmp case.0x450900.32857
push 0
mov ecx, esi
call fcn.0044fe37
jmp case.0x450900.32857
mov ecx, 0x4789e8
call fcn.004168c0
jmp case.0x450900.32857
mov ecx, 0x4789e8
call fcn.0041686a
jmp case.0x450900.32857
mov ecx, 0x4789e8
call fcn.0041696b
jmp case.0x450900.32857
mov ecx, 0x4789e8
call fcn.0041a2cb
jmp case.0x450900.32857
push 0
mov ecx, 0x4789e8
call fcn.0041a0f6
jmp case.0x450900.32857
push ebx
jmp 0x4509ca
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x240]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x240]
push 0x103
push eax
push 0x6f
push dword [0x536190]
call edi
lea eax, [ebp - 0x448]
push 0x104
push eax
push 0x6e
push dword [0x536190]
call edi
lea eax, [ebp - 0x240]
push eax
call fcn.00425f2a
mov al, byte [0x460a68]
push 0x40
mov byte [ebp - 0x13c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x13b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [esp], 0x81800
lea eax, [ebp - 0x13c]
push 0x4110b8
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x448]
push eax
push dword [esi + 4]
push dword [0x536190]
call fcn.00425fa9
add esp, 0x1c
test eax, eax
je case.0x450900.32857
xor eax, eax
push eax
push eax
push eax
push eax
push 2
lea eax, [ebp - 0x13c]
jmp 0x45096e
mov ebx, 0x49ac50
mov ecx, ebx
call fcn.004464da
push eax
mov ecx, ebx
call fcn.00446825
jmp case.0x450900.32857
push 0
mov ecx, 0x4789e8
call fcn.00419869
jmp case.0x450900.32857
mov ecx, 0x4789e8
call fcn.004196c8
jmp case.0x450900.32857
lea eax, [ebp - 0x344]
push 0x104
push eax
call fcn.0044906a
lea eax, [ebp - 0x344]
push eax
push dword [0x5358f4]
call fcn.0042580d
add esp, 0x10
jmp case.0x450900.32857
lea eax, [ebp - 0x344]
push 0x104
push eax
call fcn.0044906a
pop ecx
lea eax, [ebp - 0x344]
pop ecx
push 0xa
push 0
push 0
push eax
push 0x40a7e0
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.0x450900.32857
push 0
mov ecx, 0x4789e8
call fcn.00419367
jmp case.0x450900.32857
push 7
jmp 0x451161
mov ecx, 0x49ac50
call fcn.004468f7
jmp case.0x450900.32857
mov ecx, 0x49ac50
call fcn.00445d86
jmp case.0x450900.32857
mov ecx, 0x4789e8
call fcn.0041a1c2
jmp case.0x450900.32857
xor edi, edi
mov esi, 0x4789e8
cmp dword [0x5361c8], edi
je 0x450b88
push ebx
push edi
mov ecx, 0x5358f0
call fcn.00430f83
jmp 0x450b8f
mov ecx, esi
call fcn.00416916
mov ecx, 0x4645a8
call fcn.00434c53
mov eax, dword [0x477d28]
cmp eax, edi
je 0x450baf
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x477d28], edi
push 0xffffffffffffffff
mov ecx, esi
call fcn.004162c3
mov ecx, 0x49a108
jmp 0x450931
mov ecx, 0x49a108
call fcn.004564f2
jmp case.0x450900.32857
mov ecx, 0x4789e8
call fcn.00416a96
jmp case.0x450900.32857
push eax
call fcn.0045470f
pop ecx
jmp case.0x450900.32857
push 0
call fcn.0043ee95
neg eax
sbb eax, eax
inc eax
push eax
push dword [esi + 4]
call fcn.0043f103
add esp, 0xc
jmp case.0x450900.32857
xor eax, eax
push eax
push eax
push eax
push eax
push ebx
push 0x41109c
jmp 0x45096f
xor eax, eax
push eax
push eax
push eax
push eax
push ebx
push 0xa3
jmp 0x450ca5
mov dword [0x476e84], ebx
call fcn.00447f50
jmp case.0x450900.32857
call fcn.00415483
test eax, eax
je 0x450c70
push 0x24
push 0x40a37c
push 0xad
call fcn.004252ac
pop ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne case.0x450900.32857
call fcn.00415574
jmp case.0x450900.32857
push 0x40
push 0x40a37c
push 0xb0
call fcn.004252ac
pop ecx
push eax
push dword [esi + 4]
jmp 0x450681
xor eax, eax
push eax
push eax
push eax
push eax
push ebx
push 0xa0
jmp 0x450ca5
xor eax, eax
push eax
push eax
push eax
push eax
push ebx
push 0x9f
call fcn.004252ac
pop ecx
jmp 0x45096e
xor eax, eax
push eax
push eax
push eax
push eax
push ebx
push 0x411084
jmp 0x45096f
xor eax, eax
mov ecx, 0x4994a0
cmp dword [0x47663c], eax
sete al
mov dword [0x47663c], eax
call fcn.00442e29
jmp case.0x450900.32857
xor eax, eax
cmp dword [0x474e14], eax
sete al
mov dword [0x474e14], eax
jmp case.0x450900.32857
xor eax, eax
cmp dword [0x474e28], eax
sete al
mov dword [0x474e28], eax
jmp case.0x450900.32857
push 0
push dword [esi + 4]
call fcn.0043fe04
jmp 0x450d20
push 0
push dword [esi + 4]
call fcn.004400e6
pop ecx
jmp 0x450be6
xor eax, eax
cmp dword [0x476d58], eax
sete al
mov dword [0x476d58], eax
jmp case.0x450900.32857
push 2
pop eax
cmp dword [0x476644], eax
je case.0x450900.32857
or dword [0x476900], 0xffffffff
push 0xffffffffffffffff
mov dword [0x476644], eax
push eax
jmp 0x4508a3
push ebx
push 0x3e9
jmp 0x4508b8
push ebx
push 0x3ed
jmp 0x4508b8
mov ecx, 0x5358f0
call fcn.004313a1
jmp case.0x450900.32857
mov ecx, 0x5358f0
call fcn.0043134b
jmp case.0x450900.32857
push 0
lea ecx, [esi + 0xae4]
mov dword [esi + 0xafc], 0xba
call fcn.004496d4
mov ebx, 0x49ac50
mov ecx, ebx
call fcn.004464da
push eax
mov ecx, ebx
call fcn.004454af
mov ecx, 0x49a108
call fcn.004543df
jmp case.0x450900.32857
mov dword [esi + 0xae0], 0x78
and dword [esi + 0xadc], 0
push 0
lea ecx, [esi + 0xac8]
call fcn.004496d4
jmp case.0x450900.32857
mov dword [esi + 0xb18], 0x78
and dword [esi + 0xb14], 0
push 0
lea ecx, [esi + 0xb00]
jmp 0x450de5
xor eax, eax
mov ecx, esi
cmp dword [0x474dd4], eax
sete al
mov dword [0x474dd4], eax
call fcn.0044a4f2
jmp case.0x450900.32857
push 0
push 0x41107c
mov ecx, 0x4789e8
call fcn.0041947d
jmp case.0x450900.32857
push 0
push 0x411074
jmp 0x450e2d
push 0
push 0x41106c
jmp 0x450e2d
push 0
push 0x40a774
jmp 0x450e2d
push 0
push 0x411060
jmp 0x450e2d
push 0
push 0x411054
jmp 0x450e2d
push 0
push 0x411048
jmp 0x450e2d
push 0
push 0x41103c
jmp 0x450e2d
push 0xffffffffffffffff
jmp 0x4503b6
push 2
mov ecx, 0x5358f0
call fcn.0045da88
jmp case.0x450900.32857
push 3
jmp 0x450e84
call fcn.0041288f
jmp case.0x450900.32857
push 0
jmp 0x450ea6
push ebx
call fcn.0041274f
jmp 0x450be6
push dword [esi + 4]
call fcn.00413cb2
jmp 0x450be6
mov ecx, esi
call fcn.0044fcd1
test byte [0x47662c], 1
je 0x450ed9
and dword [0x47662c], 0xfffffffe
jmp case.0x450900.32857
or dword [0x47662c], ebx
jmp case.0x450900.32857
mov ecx, esi
call fcn.0044fcd1
test byte [0x47662c], 4
je 0x450f00
and dword [0x47662c], 0xfffffffb
jmp case.0x450900.32857
or dword [0x47662c], 4
jmp case.0x450900.32857
mov ecx, esi
call fcn.0044fcd1
test byte [0x47662c], 8
je 0x450f28
and dword [0x47662c], 0xfffffff7
jmp case.0x450900.32857
or dword [0x47662c], 8
jmp case.0x450900.32857
mov ecx, esi
call fcn.0044fcd1
test byte [0x47662c], 2
je 0x450f50
and dword [0x47662c], 0xfffffffd
jmp case.0x450900.32857
or dword [0x47662c], 2
jmp case.0x450900.32857
mov ecx, esi
call fcn.0044fcd1
test byte [0x47662c], 0x10
je 0x450f78
and dword [0x47662c], 0xffffffef
jmp case.0x450900.32857
or dword [0x47662c], 0x10
jmp case.0x450900.32857
push 0
mov ecx, 0x4789e8
call fcn.00416992
jmp case.0x450900.32857
push dword [0x476b30]
lea eax, [ebp - 0x54c]
push 0x411038
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x54c]
lea ecx, [ebp + 8]
push eax
call fcn.0042cff3
and dword [ebp - 4], 0
push 0xb9
call fcn.004252ac
pop ecx
push eax
lea ecx, [ebp + 8]
push dword [esi + 4]
call fcn.0042d0e8
cmp eax, ebx
jne 0x450ff8
lea ecx, [ebp + 8]
call fcn.0042d109
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [0x476b30], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0042d04c
jmp case.0x450900.32857
push 4
jmp 0x45022f
push 0x80d1
jmp 0x4500cd
push 0x80d2
jmp 0x4500cd
push 0
push 0
push 0x411014
mov ecx, esi
call fcn.004515c9
jmp case.0x450900.32857
push 0
push 0
push 0x410fe8
jmp 0x45102d
push 0
push 0
push 0x410fc0
jmp 0x45102d
push 0
push 0
push 0x410f9c
jmp 0x45102d
push 0x411014
mov ecx, esi
call fcn.00451554
jmp case.0x450900.32857
push 0xa
jmp 0x451161
mov ecx, 0xe124
cmp eax, ecx
jg 0x451117
je 0x4510b3
sub eax, 0xe106
je 0x4510ac
dec eax
je case.0x45017f.12387
sub eax, 0x1b
je case.0x4502ca.12393
dec eax
jne case.0x450900.32857
push 0xb
jmp 0x451161
push 0xc
jmp 0x451161
push 6
jmp 0x451161
push 8
jmp 0x451161
mov ecx, 0x49a108
call fcn.00452a2e
test eax, eax
je 0x45110a
mov al, byte [0x460a68]
mov ecx, 0x1ff
mov byte [ebp - 0xd4c], al
xor eax, eax
lea edi, [ebp - 0xd4b]
push 0x800
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xd4c]
push eax
push dword [esi + 0xb20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0
lea eax, [ebp - 0xd4c]
push eax
mov ecx, esi
call fcn.004524a2
jmp case.0x450900.32857
push ebx
mov ecx, 0x4789e8
call fcn.00418059
jmp case.0x450900.32857
sub eax, 0xe125
je 0x45115f
sub eax, 5
je 0x45115b
sub eax, 0x16
je 0x45114a
dec eax
jne case.0x450900.32857
xor esi, esi
push esi
push esi
push 0x1f
push dword [0x49a9f4]
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
mov ecx, 0x5358f0
call fcn.004312ac
jmp case.0x450900.32857
push 0x410f90
mov ecx, 0x5358f0
call fcn.00430f2a
jmp case.0x450900.32857
push 0x11
jmp 0x451161
push 0xd
mov ecx, 0x4789e8
call fcn.004180f9
push 0
mov ecx, 0x460a70
call fcn.0041206f
push 0
mov ecx, 0x477d38
call fcn.0042b0f2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4