Function at 0x42ee47
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x46825b
call fcn.00466f40
mov eax, 0x478c
call fcn.00466f70
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], edx
push ebx
shr dword [ebp - 0x10], 0x10
cmp word [ebp - 0x10], 4
push esi
push edi
mov esi, ecx
sete al
cmp dx, 0x1974
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], edx
jne 0x42ee8e
push dword [ebp + 0xc]
call fcn.0042ee0c
jmp 0x42f4d4
lea eax, [esi + 0x43cc]
lea ecx, [esi + 0x43d0]
neg eax
sbb eax, eax
and eax, ecx
lea edi, [eax + 4]
mov eax, dword [eax + 4]
cmp dword [ebp + 0xc], eax
jne 0x42f26a
movzx eax, dx
push eax
lea ecx, [esi + 0x43cc]
mov dword [ebp + 0x10], eax
call fcn.00465b39
xor ebx, ebx
mov dword [ebp + 0xc], eax
cmp eax, ebx
je 0x42f4d2
cmp word [ebp - 0x10], bx
jne 0x42f04f
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x14
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x24]
lea ecx, [esi + 0x43cc]
push eax
mov dword [ebp - 0x24], ebx
push dword [ebp + 0x10]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.00465866
lea eax, [ebp - 0x24]
push 2
push eax
push ebx
push dword [edi]
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x24], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
jge 0x42ef2c
mov dword [ebp - 0x24], ebx
mov edi, dword [ebp + 0xc]
push dword [edi + 0x50]
call dword [sym.imp.USER32.dll_IsMenu]
test eax, eax
mov eax, dword [edi + 0x50]
je 0x42ef82
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esi + 0x43d0]
mov dword [esi + 0x1efd8], eax
mov dword [esi + 0x1f464], 1
call fcn.00466c99
lea eax, [ebp - 0x3c]
push eax
push dword [esi + 4]
push dword [ebp - 0x18]
push dword [ebp - 0x24]
push 0x4000
push dword [esi + 0x1efd8]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x42f4d2
lea ecx, [esi + 0x1efe0]
push eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ecx
call fcn.00452efb
test eax, eax
je 0x42effb
push dword [ebp + 8]
mov ecx, esi
call fcn.0043113a
cmp eax, ebx
je 0x42f4d2
mov dword [edi + 0x50], eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esi + 0x43d0]
mov dword [esi + 0x1efd8], eax
mov dword [esi + 0x1f464], 1
call fcn.00466c99
lea eax, [ebp - 0x3c]
push eax
push dword [esi + 4]
push dword [ebp - 0x18]
push dword [ebp - 0x24]
push 0x4000
push dword [esi + 0x1efd8]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
push dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.00452c09
jmp 0x42f4d2
mov ax, word [0x469bb8]
mov ecx, 0x81
mov word [ebp - 0x268], ax
xor eax, eax
lea edi, [ebp - 0x266]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x268]
lea ecx, [esi + 0x1efe0]
push eax
push dword [ebp + 8]
call fcn.00452d97
test eax, eax
je 0x42f4d2
push ebx
push ebx
push ebx
lea eax, [ebp - 0x268]
push dword [0x48d9dc]
jmp 0x42f2ec
cmp word [ebp - 0x10], 4
jne 0x42f4d2
mov edi, dword [ebp + 0xc]
mov dword [ebp + 8], ebx
push dword [edi + 0x50]
call dword [sym.imp.USER32.dll_IsMenu]
test eax, eax
je 0x42f09a
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x1c
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], 8
push dword [eax + 0x50]
call dword [sym.imp.USER32.dll_GetMenuInfo]
mov eax, dword [ebp - 0x40]
jmp 0x42f09d
mov eax, dword [edi + 0x50]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x42f4d2
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ax, word [0x469bb8]
mov ecx, 0x81
mov word [ebp - 0x268], ax
xor eax, eax
lea edi, [ebp - 0x266]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x268]
lea edi, [esi + 0x1efe0]
push eax
mov ecx, edi
push dword [ebp + 8]
call fcn.00452d97
test eax, eax
je 0x42f4d2
push 0x9f
push dword [0x49a554]
call dword [sym.imp.USER32.dll_LoadMenuW]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x42f4d2
push dword [ebp + 8]
mov ecx, edi
call fcn.00452efb
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetSubMenu]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x42f4d2
push ebx
push 0x80dd
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
push dword [esi + 4]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0x103
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
sub eax, 0x8021
je 0x42f242
sub eax, 0x3a
je 0x42f201
dec eax
je 0x42f1c0
dec eax
je 0x42f1ab
dec eax
jne 0x42f4d2
push dword [ebp + 8]
mov ecx, edi
call fcn.00452efb
test eax, eax
je 0x42f19a
push esi
push 0x430e5b
push 0x40
mov ecx, edi
push dword [ebp + 8]
call fcn.00452b08
jmp 0x42f4d2
push ebx
push 1
push ebx
push 1
lea eax, [ebp - 0x268]
jmp 0x42f2ec
push dword [esi + 4]
lea eax, [ebp + 8]
mov ecx, edi
push 1
push eax
call fcn.004535ea
jmp 0x42f24c
mov ecx, esi
call fcn.0043239a
push dword [esi + 4]
lea eax, [ebp + 8]
mov ecx, edi
push 1
push eax
call fcn.00453614
push dword [ebp + 8]
mov ecx, edi
call fcn.00453697
test eax, eax
jne 0x42f1f5
push 1
lea ecx, [esi + 0x43cc]
push dword [ebp + 0x10]
call fcn.00465e1a
mov ecx, esi
call fcn.00432332
jmp 0x42f4d2
lea ecx, [ebp - 0x2708]
call fcn.0044edeb
lea eax, [ebp - 0x268]
lea ecx, [ebp - 0x2708]
push eax
mov dword [ebp - 4], ebx
call fcn.0044edfd
push eax
push 0x49a560
call fcn.00453f89
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x2708]
call fcn.0046746d
jmp 0x42f4d2
push dword [ebp + 8]
mov ecx, edi
call fcn.004536b8
lea eax, [esi + 0x3370]
add esi, 0x3374
neg eax
sbb eax, eax
push ebx
push ebx
and eax, esi
push 0x1f
push dword [eax + 4]
jmp 0x42fe0d
mov edx, dword [esi + 0x4fc4]
xor ebx, ebx
cmp dword [ebp + 0xc], edx
jne 0x42f2f2
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x14b6]
mov word [ebp - 0x14b8], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, word [ebp - 0x10]
dec eax
je 0x42f2f2
sub eax, 8
jne 0x42f4d2
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0x147
push edx
call edi
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x14b8]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x60]
push eax
push ebx
push 0x40d
mov dword [ebp - 0x60], 1
push dword [esi + 0x4fc4]
mov dword [ebp - 0x54], 0x1048
call edi
push ebx
push 1
push 1
lea eax, [ebp - 0x14b8]
push dword [0x48dd80]
push eax
jmp 0x4300cc
mov eax, dword [ebp + 8]
cmp ax, 0x2650
jb 0x42f301
cmp ax, 0x2699
jbe 0x42f308
cmp eax, 0x9112650
jne 0x42f31c
push dword [ebp + 0xc]
lea ecx, [esi + 0x1ef1c]
push eax
call fcn.0043d01f
jmp 0x42f4d4
mov edi, dword [esi + 0x1b82c]
cmp word [ebp - 0x10], bx
mov dword [ebp - 0x14], edi
jne 0x42f3d1
lea eax, [esi + 0x3370]
lea ecx, [esi + 0x3374]
neg eax
sbb eax, eax
push ebx
and eax, ecx
push ebx
push 0x1f
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, word [ebp + 8]
cmp eax, dword [esi + 0x1efb0]
jl 0x42f394
cmp eax, dword [esi + 0x1efb4]
jg 0x42f394
cmp edi, ebx
je 0x42f4d2
cmp word [ebp + 8], 0xe73
jne 0x42f381
call fcn.0044e623
mov eax, dword [edi]
mov ecx, edi
jmp 0x42ff00
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x111
push dword [edi + 0x28]
jmp 0x42feb1
cmp word [ebp + 8], 0x4e20
jbe 0x42f402
cmp word [ebp + 8], 0x4ea0
jae 0x42f402
mov ecx, dword [esi + 0x1f000]
cmp ecx, ebx
je 0x42f4d2
add eax, 0xffffb1df
push eax
call fcn.0044f6d5
push 0x40
mov ecx, 0x46bb68
call fcn.00458661
push eax
push 0x29
jmp 0x42fe73
cmp word [ebp - 0x10], 1
jne 0x42f402
mov eax, 0x1388
cmp word [ebp + 8], ax
jb 0x42f402
cmp word [ebp + 8], 0x139c
ja 0x42f402
movzx ecx, word [ebp + 8]
sub ecx, eax
push ecx
lea ecx, [esi + 0x3370]
call fcn.0045ad52
jmp 0x42f4d2
lea eax, [esi + 0x47c8]
lea ecx, [esi + 0x47cc]
neg eax
sbb eax, eax
and eax, ecx
mov eax, dword [eax + 4]
cmp dword [ebp + 0xc], eax
jne 0x42f439
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.00432846
cmp eax, 0xffffffff
je 0x42f4d2
cmp eax, ebx
je 0x42f439
mov dword [ebp - 0x18], eax
movzx eax, word [ebp - 0x18]
mov ecx, 0x80b5
cmp eax, ecx
jg 0x42fc6e
je 0x42fc67
cmp eax, 0x8012
jg 0x42fa62
cmp eax, 0x800e
jge 0x42fa48
mov ecx, 0x7950
cmp eax, ecx
jg 0x42f921
je 0x42f905
cmp eax, 0x49
jg 0x42f645
cmp eax, 0x48
jge case.0x42fc96.40041
cmp eax, 0x12
jg 0x42f4e5
je case.0x42fc96.40024
sub eax, 6
je 0x42fbcb
dec eax
dec eax
je 0x42f69b
sub eax, 9
je 0x42f681
cmp dword [ebp + 0x10], ebx
je 0x42f4d2
lea eax, [ebp - 0x14]
lea ecx, [esi + 0x7458]
push eax
mov dword [ebp - 0x14], ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00438381
cmp dword [ebp - 0x14], ebx
jne 0x42f4d4
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
cmp eax, 0x23
jl case.0x42ff98.40056
cmp eax, 0x24
jle 0x42f631
cmp eax, 0x2d
je 0x42f506
cmp eax, 0x2e
jne case.0x42ff98.40056
mov ecx, esi
call fcn.004344e1
jmp 0x42f4d2
cmp edi, ebx
je 0x42f4d2
lea eax, [ebp - 0x38]
lea edi, [esi + 0x5220]
push eax
push 0x2d
mov ecx, edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call fcn.004603a5
lea eax, [ebp - 0x38]
push 2
neg edi
push eax
lea eax, [esi + 0x5224]
sbb edi, edi
push ebx
and edi, eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0x80
push dword [0x49a554]
call dword [sym.imp.USER32.dll_LoadMenuW]
push ebx
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov edi, eax
lea ecx, [esi + 0x1efbc]
push edi
mov dword [ebp + 0xc], edi
mov dword [ebp + 8], ecx
call fcn.00459b25
mov ecx, dword [ebp - 0x14]
push edi
mov dword [ebp - 0x18], eax
call fcn.00446716
lea eax, [ebp - 0x38]
mov dword [ebp - 0x50], 0x14
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea eax, [ebp - 0x50]
push eax
push dword [esi + 4]
push dword [ebp - 0x34]
push dword [ebp - 0x30]
push 0x128
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
mov edx, eax
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x14b6]
mov word [ebp - 0x14b8], bx
cmp edx, 0x9c71
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
jl 0x42f5fe
push ebx
lea eax, [ebp - 0x14b8]
push 0x823
push eax
push edx
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetMenuStringW]
push ebx
push 1
push ebx
lea eax, [ebp - 0x14b8]
push 1
push eax
mov ecx, esi
call fcn.004303d3
jmp 0x42f616
cmp edx, 0x9c6f
je 0x42f60e
cmp edx, 0x9c70
jne 0x42f616
mov ecx, dword [ebp - 0x14]
call fcn.0044693d
push dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
call fcn.00459e52
push dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
call fcn.00459b44
jmp 0x42f4d2
cmp edi, ebx
je 0x42f4d2
mov ecx, edi
call fcn.0044a72c
jmp 0x42f4d2
cmp eax, 0x4a
je 0x42f8e9
cmp eax, 0x4d
je 0x42f8e9
jle case.0x42ff98.40056
cmp eax, 0x4f
jle 0x42f879
cmp eax, 0x5f
je 0x42f879
cmp eax, 0x44c
je 0x42f690
cmp eax, 0x44d
jne case.0x42ff98.40056
push dword [ebp - 0x28]
mov ecx, esi
call fcn.00430343
jmp 0x42f4d2
cmp word [ebp - 0x10], 1
jne 0x42f4d2
cmp dword [ebp - 0x28], ebx
je 0x42f6ad
xor eax, eax
cmp dword [0x48dd80], ebx
sete al
jmp 0x42f6b2
mov eax, dword [0x48dd80]
lea ecx, [esi + 0x4fc0]
mov dword [ebp + 8], eax
call fcn.00456eb0
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x14b6]
mov word [ebp - 0x14b8], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 0x824
lea eax, [ebp - 0x14b8]
push edi
push eax
mov ecx, esi
call fcn.004349b3
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [ebp + 0xc]
call fcn.0044843e
lea eax, [ebp - 0x14b8]
mov dword [ebp - 4], 1
push eax
call fcn.004484d0
test eax, eax
pop ecx
je 0x42f741
lea eax, [ebp - 0x14b8]
push edi
push eax
lea eax, [ebp - 0x14b8]
push eax
lea ecx, [ebp + 0xc]
call fcn.00448548
lea eax, [ebp - 0x14b8]
lea ecx, [esi + 0x7458]
push eax
call fcn.00439bae
jmp 0x42f868
cmp dword [0x48dc1c], ebx
je 0x42f852
lea eax, [ebp - 0x14b8]
push eax
call fcn.00454cc8
test eax, eax
pop ecx
je 0x42f852
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x266]
mov word [ebp - 0x268], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x374e]
mov word [ebp - 0x3750], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x268]
push 0x103
push eax
lea eax, [ebp - 0x3750]
push 0x823
push eax
lea eax, [ebp - 0x14b8]
lea ecx, [esi + 0x1eef0]
push eax
call fcn.00440041
test eax, eax
je 0x42f7e4
mov eax, dword [esi + 0x50d8]
lea ecx, [ebp - 0x268]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
push 1
push 1
lea eax, [ebp - 0x3750]
push dword [ebp + 8]
jmp 0x42f860
cmp dword [0x48dc20], ebx
je 0x42f80c
mov eax, dword [esi + 0x50d8]
lea ecx, [ebp - 0x14b8]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x28]
mov ecx, esi
call fcn.00430343
jmp 0x42f868
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x2706]
mov word [ebp - 0x2708], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2708]
push 0x823
push eax
lea eax, [ebp - 0x14b8]
push eax
lea ecx, [esi + 0x50d4]
call fcn.00455b59
push ebx
push 1
push 1
lea eax, [ebp - 0x2708]
push dword [ebp + 8]
jmp 0x42f860
push ebx
push 1
push 1
lea eax, [ebp - 0x14b8]
push dword [ebp + 8]
push eax
mov ecx, esi
call fcn.004303d3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00448463
jmp 0x42f4d2
mov edi, dword [esi + 0x1b82c]
cmp edi, ebx
je 0x42f4d2
cmp dword [0x48b278], ebx
jne 0x42f8c9
lea eax, [esi + 0x293c]
push 0x44
push eax
push 0x61
call fcn.00452730
pop ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x42f4d2
mov dword [0x48b278], 1
mov ecx, esi
call fcn.004343cb
jmp 0x42f4d2
mov ecx, edi
mov dword [edi + 0x6c], ebx
call fcn.0044ac9c
neg eax
sbb eax, eax
mov ecx, edi
inc eax
push eax
call fcn.0044ac88
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
jmp 0x42f8bd
xor eax, eax
cmp dword [0x48d580], ebx
mov ecx, esi
sete al
mov dword [0x48d580], eax
call fcn.00434392
jmp 0x42fa3b
cmp edi, ebx
je 0x42f4d2
push ebx
push 0x26
push 0x100
mov ecx, edi
call fcn.00449d58
jmp 0x42f4d2
mov ecx, 0x800a
cmp eax, ecx
jg 0x42fa30
je 0x42f9df
add eax, 0xffff86af
cmp eax, 0xa
ja case.0x42ff98.40056
jmp dword [eax*4 + 0x430115]
cmp edi, ebx
je 0x42f4d2
push ebx
push 0x28
jmp 0x42f910
cmp edi, ebx
je 0x42f4d2
push dword [ebp + 0xc]
push 0x25
jmp 0x42f910
cmp edi, ebx
je 0x42f4d2
push dword [ebp + 0xc]
push 0x27
jmp 0x42f910
cmp edi, ebx
je 0x42f4d2
push ebx
push 0x22
jmp 0x42f910
cmp edi, ebx
je 0x42f4d2
push ebx
push 0x21
jmp 0x42f910
cmp edi, ebx
je 0x42f4d2
push ebx
push 6
jmp 0x42f9a6
cmp edi, ebx
je 0x42f4d2
push ebx
push 7
push 0x114
jmp 0x42f915
cmp edi, ebx
je 0x42f4d2
push ebx
push 0x23
jmp 0x42f910
cmp edi, ebx
je 0x42f4d2
push ebx
push 0x24
jmp 0x42f910
cmp edi, ebx
je 0x42f4d2
push 0xffffffffffffffff
jmp 0x42ff1c
cmp edi, ebx
je 0x42f4d2
call dword [sym.imp.USER32.dll_GetFocus]
cmp word [ebp - 0x10], 1
mov dword [ebp + 8], eax
jne 0x42fa24
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42fa24
push ebx
push 0x1b
push 0x100
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push 0x1b
push 0x101
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, edi
call fcn.0044a038
jmp case.0x42fc96.40040
cmp eax, 0x800b
jne case.0x42ff98.40056
cmp edi, ebx
je 0x42f4d2
jmp 0x42f378
cmp edi, ebx
je 0x42f4d2
add eax, 0xffff7ff2
mov ecx, edi
push eax
call fcn.0044a4dd
jmp 0x42f4d2
mov ecx, 0x8062
cmp eax, ecx
jg 0x42fb89
je 0x42fb82
add ecx, 0xffffffd5
cmp eax, ecx
jg 0x42fb1f
je 0x42fb0a
sub eax, 0x801a
je 0x42faf4
dec eax
dec eax
je 0x42fae8
sub eax, 0x13
je 0x42fadc
dec eax
dec eax
je 0x42fac7
dec eax
je 0x42fab2
dec eax
dec eax
jne case.0x42ff98.40056
push dword [esi + 4]
call fcn.00444a3e
jmp 0x42ffe8
xor eax, eax
cmp dword [0x48d568], ebx
sete al
mov dword [0x48d568], eax
jmp 0x42f4d2
xor eax, eax
cmp dword [0x48d564], ebx
sete al
mov dword [0x48d564], eax
jmp 0x42f4d2
mov ecx, esi
call fcn.00431cf6
jmp 0x42f4d2
cmp edi, ebx
je 0x42f4d2
push 3
jmp 0x42fafe
cmp edi, ebx
je 0x42f4d2
push 2
mov ecx, edi
call fcn.0044a407
jmp 0x42f4d2
xor eax, eax
cmp dword [0x48d58c], ebx
sete al
mov dword [0x48d58c], eax
jmp 0x42f4d2
sub eax, 0x8056
je 0x42fb6f
dec eax
dec eax
je 0x42fb6b
sub eax, 5
je 0x42fb56
dec eax
dec eax
je 0x42fb4c
dec eax
je 0x42fb42
dec eax
je case.0x42fc96.40045
jmp case.0x42ff98.40056
push 0x40cec8
jmp 0x42fbdc
push 0x40cec0
jmp 0x42fbdc
push 0x805d
lea ecx, [esi + 0x7458]
call fcn.004392ff
jmp 0x42f4d2
push 2
jmp 0x42fb70
push ebx
push dword [esi + 0x1efd4]
mov ecx, esi
call fcn.00431840
jmp 0x42f4d2
push 0x40ceb4
jmp 0x42fbdc
mov ecx, 0x8085
cmp eax, ecx
jg 0x42fbfe
je 0x42f8e9
sub eax, 0x8063
je 0x42fbf7
dec eax
je 0x42fbf0
dec eax
je 0x42fbe9
dec eax
je 0x42fbd7
sub eax, 0xb
je 0x42fbcb
sub eax, 5
jne case.0x42ff98.40056
push 0x8076
lea ecx, [esi + 0x7458]
call fcn.004392ff
jmp case.0x42fc96.40040
mov ecx, esi
call fcn.004585e6
jmp 0x42f4d2
push 0x40ceac
push edi
mov ecx, esi
call fcn.00434546
jmp 0x42f4d2
push 0x40cea0
jmp 0x42fbdc
push 0x40ce94
jmp 0x42fbdc
push 0x40ce88
jmp 0x42fbdc
sub eax, 0x8086
je 0x42fc5b
sub eax, 0xb
je 0x42fc46
dec eax
je 0x42fc3b
dec eax
je 0x42fc30
dec eax
je 0x42fc25
dec eax
jne case.0x42ff98.40056
mov ecx, esi
call fcn.0046746d
push 0x10
jmp 0x42fc4f
mov ecx, esi
call fcn.0046746d
push 2
jmp 0x42fc4f
mov ecx, esi
call fcn.0046746d
push 8
jmp 0x42fc4f
mov ecx, esi
call fcn.0046746d
push 4
jmp 0x42fc4f
mov ecx, esi
call fcn.0046746d
push 1
mov ecx, esi
call fcn.0043467b
jmp 0x42f4d2
mov ecx, esi
call fcn.004585c3
jmp 0x42f4d2
push 1
jmp 0x42fb70
mov ecx, 0x9c73
cmp eax, ecx
jg 0x42ff70
je 0x42ff60
add eax, 0xffff63bf
cmp eax, 0x31
ja case.0x42ff98.40056
movzx eax, byte [eax + 0x4301b1]
jmp dword [eax*4 + 0x430141]
cmp dword [ebp - 0x28], ebx
jne case.0x42fc96.40028
push 1
push ebx
push 0x40c610
lea ecx, [esi + 0x7458]
call fcn.00438643
mov ecx, esi
call fcn.00430573
jmp 0x42f4d2
add esi, 0x7458
lea eax, [ebp - 0x4798]
push eax
mov ecx, esi
call fcn.004392f7
push eax
mov ecx, esi
call fcn.004392bc
test eax, eax
je 0x42f4d2
push 1
lea eax, [ebp - 0x4798]
push ebx
push eax
mov ecx, esi
call fcn.00438643
jmp 0x42f4d2
push ebx
push ebx
push 1
lea ecx, [esi + 0x7458]
call fcn.00439854
jmp 0x42f4d2
mov ecx, esi
call fcn.004353cb
jmp 0x42f4d2
cmp dword [0x48b26c], ebx
jne 0x42fca2
mov eax, 0x469bb8
push 5
push eax
push eax
push 0x46b680
push 0x40bae4
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x42f4d2
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x268]
push 0x207
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x268]
push eax
push 0x15
push dword [0x49a554]
call edi
lea eax, [ebp - 0x16c0]
push 0x208
push eax
push 0x16
push dword [0x49a554]
call edi
lea eax, [ebp - 0x268]
push eax
call fcn.0044e1ad
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x46e]
mov word [ebp - 0x470], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp], 0x81800
lea eax, [ebp - 0x470]
push 0x40ce80
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x16c0]
push eax
push dword [esi + 4]
push dword [0x49a558]
call fcn.0044e22f
add esp, 0x1c
test eax, eax
je 0x42f4d2
push 1
lea eax, [ebp - 0x470]
push ebx
push eax
lea ecx, [esi + 0x7458]
jmp 0x42fcf1
cmp edi, ebx
je 0x42f4d2
push ebx
push 4
push GetStockObject
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x42f4d2
lea ecx, [esi + 0x7458]
call fcn.00438722
jmp 0x42f4d2
cmp edi, ebx
je 0x42f4d2
push ebx
push 8
jmp 0x42fe05
cmp edi, ebx
je 0x42f4d2
push ebx
push 6
jmp 0x42fe05
cmp edi, ebx
je 0x42f4d2
push ebx
push 7
jmp 0x42fe05
cmp edi, ebx
je 0x42f4d2
push ebx
mov ecx, edi
call fcn.004492d1
test eax, eax
jne 0x42f4d2
push 0x40
mov ecx, esi
call fcn.00458661
push eax
push 0x22
call fcn.00452730
pop ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x42f4d2
cmp edi, ebx
je 0x42f4d2
push 1
jmp 0x42fe58
cmp edi, ebx
je 0x42f4d2
push ebx
push 0x11c
push 0x111
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x42f4d2
cmp edi, ebx
je 0x42f4d2
push ebx
push 0x176
jmp 0x42fea2
cmp edi, ebx
je 0x42f4d2
push ebx
push 0xa
jmp 0x42fe05
push ebx
mov ecx, esi
call fcn.0042ecb9
jmp 0x42f4d2
mov ecx, esi
call fcn.004346fc
jmp 0x42f4d2
mov ecx, esi
call fcn.00430db2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
jmp 0x42f4d2
push 0x40ba9c
jmp 0x42fbdc
cmp edi, ebx
je 0x42f4d2
push 1
mov ecx, edi
call fcn.0044a63f
jmp 0x42f4d2
mov ecx, esi
call fcn.00458119
jmp 0x42f4d2
xor eax, eax
cmp dword [0x48b23c], ebx
mov ecx, esi
sete al
mov dword [0x48b23c], eax
call fcn.00434359
jmp 0x42f4d2
lea ecx, [esi + 0x7458]
call fcn.004399dc
jmp 0x42f4d2
lea ecx, [esi + 0x7494]
call fcn.00462e3c
jmp 0x42f4d2
mov ecx, 0xf060
cmp eax, ecx
jg case.0x42ff98.40056
je case.0x42fc96.40025
add eax, 0xffff638c
cmp eax, 0x2d
ja case.0x42ff98.40056
movzx eax, byte [eax + 0x43024f]
jmp dword [eax*4 + 0x4301e3]
mov ecx, esi
call fcn.0043506b
jmp 0x42f4d2
lea ecx, [esi + 0x6f20]
call fcn.004234bd
jmp 0x42f4d2
push 0xb
mov ecx, edi
call fcn.0044a3ed
jmp 0x42f4d2
push 0xc
jmp 0x42ffbd
push 0xd
jmp 0x42ffbd
push 0x11
jmp 0x42ffbd
push ebx
mov ecx, edi
call fcn.0044a872
jmp 0x42f4d2
push edi
call fcn.00427522
pop ecx
jmp 0x42f4d2
mov ecx, esi
call fcn.00433efc
jmp 0x42fefc
mov ecx, esi
call fcn.00433f56
jmp 0x42fefc
mov ecx, esi
call fcn.00433f1a
jmp 0x42fefc
mov ecx, esi
call fcn.00433f38
jmp 0x42fefc
cmp edi, ebx
je 0x42f4d2
mov ecx, edi
call fcn.0044a0da
jmp 0x42f4d2
mov ecx, esi
call fcn.00434487
jmp 0x42fa3b
mov ecx, esi
call fcn.0043455a
jmp 0x42f4d2
mov ecx, esi
call fcn.00430591
jmp 0x42f4d2
xor eax, eax
cmp dword [0x48b288], ebx
sete al
mov dword [0x48b288], eax
jmp 0x42f4d2
push ebx
lea ecx, [esi + 0x7494]
call fcn.0046278d
jmp 0x42f4d2
push 1
jmp 0x43006c
push 1
lea ecx, [esi + 0x7458]
call fcn.004396f0
jmp 0x42f4d2
lea ecx, [esi + 0x4fc0]
call fcn.00456ec6
jmp 0x42f4d2
push ebx
push 0x42b83f
push dword [esi + 4]
push 0x9e
push dword [0x49a554]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x42f4d2
push ebx
push 1
push ebx
push 1
push 0x40ce54
mov ecx, esi
call fcn.004303d3
jmp 0x42f4d2
push ebx
push 1
push ebx
push 1
push 0x78
call fcn.00452730
pop ecx
jmp 0x42f2ec
push ebx
push 1
push ebx
push 1
push 0x40ce20
jmp 0x4300cc
push ebx
push 1
push ebx
push 1
push 0x40cdbc
jmp 0x4300cc
lea ecx, [esi + 0x7458]
call fcn.00438246
jmp 0x42f4d2