Function at 0x4146c8
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1a94
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1a8c], eax
push ebx
push ebp
push esi
push edi
cmp ecx, 0x2990
jg 0x415237
je 0x41522d
add ecx, 0xffffd84f
cmp ecx, 0x46
ja case.0x414334.10176
movzx eax, byte [ecx + 0x41539c]
jmp dword [eax*4 + 0x415304]
push 0xc
push 0xf
push 0x4e5a00
push dword [0x4e6030]
call fcn.00401149
jmp case.0x414334.10176
push 0xe
jmp 0x41433d
push 0xf
jmp 0x41433d
push 0
push 0x4640a0
push dword [0x4e6030]
push str.IDD_SEARCH
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x414334.10176
push 0
push 0x464360
jmp 0x414363
cmp dword [0x4cc1d4], 0
je case.0x414334.10176
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x27b7
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 5
push 0x4f61
push dword [0x4e6030]
call edi
push eax
call esi
mov dword [0x4cc1d4], 0
jmp case.0x414334.10176
mov eax, dword [0x4e4f38]
cmp eax, 1
jne 0x414401
push 0
push 0x472350
push dword [0x4e6030]
push str.NAGSCREEN
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x414334.10176
cmp eax, 0x156
jl 0x41440f
cmp eax, 0x158
jle 0x41442d
push 0
push 0x472350
push dword [0x4e6030]
push str.NAGSCREEN
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push 1
push 0
push 0x1013
push 0x27c0
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x423660
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x414334.10176
mov eax, dword [0x4e4f38]
cmp eax, 1
je 0x4143de
cmp eax, 0x156
jl 0x41448a
cmp eax, 0x158
jle 0x4144a8
push 0
push 0x472350
push dword [0x4e6030]
push str.NAGSCREEN
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x423ca0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x414334.10176
lea eax, [esp + 0x88]
mov dword [0x4cc1d0], 1
push eax
push 0
push 0
push 0x424330
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x414334.10176
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push 0x27b1
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 0
push 0x27b2
push dword [0x4e6030]
call edi
push eax
call esi
mov dword [0x4cc1d0], 0
jmp case.0x414334.10176
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x425360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x414334.10176
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x425930
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x414334.10176
push 0
push 0x41acc0
push dword [0x4e6030]
push 0x4b4084
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x414334.10176
push 0
push 0x41b000
push dword [0x4e6030]
push 0x4b4084
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x414334.10176
mov edx, str.EXCLUDEREGISTRY
mov ecx, 0x27f2
call fcn.00401380
jmp case.0x414334.10176
mov edx, str.EXCLUDEREGISTRYLNK
mov ecx, 0x27f3
call fcn.00401380
jmp case.0x414334.10176
push 0x4e5e28
push 0
push str.Confirm
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x4e5e28
test eax, eax
je 0x414606
push 0x4b3320
jmp 0x41460b
push 0x4b32e4
push str.Confirm
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.0x414334.10176
push 0x4e5e28
push 0
push str.Undo
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x4e5e28
test eax, eax
je 0x41465a
push 0x4b3320
push str.Undo
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.0x414334.10176
push 0x4b32e4
push str.Undo
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.0x414334.10176
push 0x4e5e28
push 0
push str.Exclude
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x4e5e28
test eax, eax
je 0x4146ae
push 0x4b3320
push str.Exclude
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.0x414334.10176
push 0x4b32e4
push str.Exclude
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.0x414334.10176
mov edx, 0x4b32e4
mov ecx, 0x4b3c0c
call fcn.00478640
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push eax
lea eax, [esp + 0x94]
push eax
call esi
lea eax, [esp + 0x90]
mov edx, 0x4b3320
push 0x24
push eax
mov ecx, 0x4b3c0c
call fcn.00478640
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
push eax
push dword [0x4e6030]
call edi
cmp eax, 6
jne case.0x414334.10176
push 0x4e6040
lea eax, [esp + 0xa9c]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0xa98]
push str._bkup_
push eax
call esi
lea eax, [esp + 0xa98]
push eax
call fcn.00493613
mov ax, word [0x4b4608]
add esp, 4
movups xmm0, xmmword [str._e_BkUp_]
mov word [esp + 0x2a8], ax
lea eax, [esp + 0x2aa]
push 0x7ee
push 0
push eax
movups xmmword [esp + 0x2a4], xmm0
call fcn.0048fb10
add esp, 0xc
push 0
call fcn.00493a5c
add esp, 4
lea ecx, [esp + 0xa98]
push 0xa
push 0x64
push ecx
push eax
call fcn.0049099e
add esp, 0x10
lea eax, [esp + 0xa98]
push eax
lea eax, [esp + 0x29c]
push eax
call esi
push 0x4b460c
lea eax, [esp + 0x29c]
push eax
call esi
push str.__HKEY_LOCAL_MACHINESOFTWARE_
lea eax, [esp + 0x29c]
push eax
call esi
lea eax, [esp + 0x298]
mov dword [esp + 0x10], 0x3c
xorps xmm0, xmm0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
movlpd qword [esp + 0x34], xmm0
push eax
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
mov dword [esp + 0x18], 0x40
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], str.regedit.exe
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 5
mov dword [esp + 0x34], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x29e]
mov edx, 0x4b35b4
push eax
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0xaa0]
push 0x400
push eax
call fcn.0040a420
add esp, 0x10
call fcn.0041b4f0
push 0x40
mov edx, 0x4b35b0
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0xaa0]
push eax
push dword [0x4e6030]
call edi
jmp case.0x414334.10176
push 0x7fc
lea eax, [esp + 0xaa0]
mov dword [esp + 0xa9c], 0
push 0
push eax
call fcn.0048fb10
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
lea eax, [esp + 0xaa4]
add esp, 0xc
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x54], 0
mov dword [esp + 0x64], 0x400
push eax
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27e1
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push eax
push 0x1073
push 0x27e1
push dword [0x4e6030]
call edi
push eax
call esi
cmp word [esp + 0xa98], 0
jne 0x414971
mov edx, 0x4b32cc
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4b35b8
lea eax, [esp + 0x90]
mov ecx, 0x4b3c0c
push 0x30
push eax
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x414334.10176
push 0x4e6040
lea eax, [esp + 0x29c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str._bkup_
lea eax, [esp + 0x29c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x298]
push eax
call fcn.00493613
add esp, 4
mov dword [esp + 0x10], 0x3c
lea eax, [esp + 0xa98]
mov dword [esp + 0x14], 0x40
xorps xmm0, xmm0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
movlpd qword [esp + 0x34], xmm0
push eax
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], str.regedit.exe
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 5
mov dword [esp + 0x34], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.0041be50
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x41cb80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x414334.10176
call fcn.0041b6e0
jmp case.0x414334.10176
push 0x27e1
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x7fc
mov edi, eax
mov dword [esp + 0x29c], 0
lea eax, [esp + 0x2a0]
push 0
push eax
call fcn.0048fb10
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x2a4]
add esp, 0xc
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x54], 0
mov dword [esp + 0x64], 0x400
push eax
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call ebx
push eax
push 0x1073
push edi
call ebx
cmp word [esp + 0x298], 0
jne 0x414af0
mov edx, 0x4b32cc
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4b32e0
jmp 0x41494b
push 0x4e5e28
push 3
lea eax, [esp + 0x90]
push eax
push 0
push str.Confirm
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x88], 0x31
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
jne 0x414b6b
mov edx, 0x4b32e4
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x94]
push eax
call esi
lea eax, [esp + 0x90]
mov edx, 0x4b3310
push 0x24
push eax
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x414334.10176
push 0x4e6040
lea eax, [esp + 0x129c]
push eax
call esi
push str._bkup_
lea eax, [esp + 0x129c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x1298]
push eax
call fcn.00493613
add esp, 4
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je case.0x414334.10176
mov ebp, 0x414
nop dword [eax]
lea eax, [esp + 0xa98]
mov dword [esp + 0x54], 0
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
push eax
push esi
push 0x1073
push edi
mov dword [esp + 0x74], 0x400
call ebx
xorps xmm0, xmm0
mov dword [esp + 0x28], 0
lea eax, [esp + 0xa98]
movq qword [esp + 0x20], xmm0
push eax
movups xmmword [esp + 0x14], xmm0
mov word [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
cmp word [esp + eax*2 + 0xa96], 0x5c
jne 0x414c2b
mov word [esp + eax*2 + 0xa96], cx
jmp 0x414c33
mov word [esp + eax*2 + 0xa9a], cx
mov eax, dword [0x4e6030]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xa98]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], 0
mov word [esp + 0x24], bp
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 0
push esi
push 0x1008
push edi
call ebx
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 2
lea eax, [esi - 1]
push eax
push 0x100c
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x414bc0
jmp case.0x414334.10176
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x41b8a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x414334.10176
push 0x27e2
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
push 0
push 0
push 0x1004
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x414d0a
mov edx, 0x4b331c
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4b330c
jmp 0x41494b
push 0x4e5e28
push 1
push str.Confirm
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
test eax, eax
je 0x414d74
mov edx, 0x4b32e4
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x94]
push eax
call ebp
lea eax, [esp + 0x90]
mov edx, 0x4b3314
push 0x24
push eax
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x414334.10176
push 0x4e6040
lea eax, [esp + 0x129c]
push eax
call ebp
push str.undo_
lea eax, [esp + 0x129c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x1298]
push eax
call fcn.00493613
add esp, 4
xor eax, eax
mov word [esp + 0x298], ax
push 0x7fe
push eax
lea eax, [esp + 0x2a2]
push eax
call fcn.0048fb10
mov ebp, dword [sym.imp.SHELL32.dll_SHFileOperationW]
add esp, 0xc
nop dword [eax]
lea eax, [esp + 0x298]
mov dword [esp + 0x54], 0
mov dword [esp + 0x60], eax
dec esi
lea eax, [esp + 0x4c]
mov dword [esp + 0x64], 0x400
push eax
push esi
push 0x1073
push edi
call ebx
xorps xmm0, xmm0
mov dword [esp + 0x28], 0
lea eax, [esp + 0x298]
movq qword [esp + 0x20], xmm0
push eax
movups xmmword [esp + 0x14], xmm0
mov word [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
cmp word [esp + eax*2 + 0x296], 0x5c
jne 0x414e3c
mov word [esp + eax*2 + 0x296], cx
jmp 0x414e44
mov word [esp + eax*2 + 0x29a], cx
mov eax, dword [0x4e6030]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x298]
mov dword [esp + 0x18], eax
mov eax, 0x454
mov word [esp + 0x20], ax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], 0
call ebp
push 0
push esi
push 0x1008
push edi
call ebx
test esi, esi
jne 0x414dd0
jmp case.0x414334.10176
call fcn.0041bcb0
jmp case.0x414334.10176
push 0x27e2
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x7fc
mov edi, eax
mov dword [esp + 0xa9c], 0
lea eax, [esp + 0xaa0]
push 0
push eax
call fcn.0048fb10
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0xaa4]
add esp, 0xc
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x54], 0
mov dword [esp + 0x64], 0x400
push eax
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call ebx
push eax
push 0x1073
push edi
call ebx
cmp word [esp + 0xa98], 0
jne 0x414f3e
mov edx, 0x4b32cc
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4b361c
jmp 0x41494b
push 0x4e5e28
push 1
push str.Confirm
push str.SROPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
cmp eax, 1
jne 0x414fa9
mov edx, 0x4b32e4
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x94]
push eax
call esi
lea eax, [esp + 0x90]
mov edx, 0x4b3314
push 0x24
push eax
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x414334.10176
push 0x4e6040
lea eax, [esp + 0x129c]
push eax
call esi
push str.undo_
lea eax, [esp + 0x129c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x1298]
push eax
call fcn.00493613
add esp, 4
xor eax, eax
mov word [esp + 0x298], ax
push 0x7fe
push eax
lea eax, [esp + 0x2a2]
push eax
call fcn.0048fb10
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je case.0x414334.10176
mov ebp, 0x414
nop word [eax + eax]
lea eax, [esp + 0x298]
mov dword [esp + 0x54], 0
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
push eax
push esi
push 0x1073
push edi
mov dword [esp + 0x74], 0x400
call ebx
xorps xmm0, xmm0
mov dword [esp + 0x28], 0
lea eax, [esp + 0x298]
movq qword [esp + 0x20], xmm0
push eax
movups xmmword [esp + 0x14], xmm0
mov word [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
cmp word [esp + eax*2 + 0x296], 0x5c
jne 0x41508b
mov word [esp + eax*2 + 0x296], cx
jmp 0x415093
mov word [esp + eax*2 + 0x29a], cx
mov eax, dword [0x4e6030]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x298]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], 0
mov word [esp + 0x24], bp
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 0
push esi
push 0x1008
push edi
call ebx
push 2
lea eax, [esi - 1]
push eax
push 0x100c
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x415020
jmp case.0x414334.10176
mov eax, dword [0x4e6030]
xorps xmm0, xmm0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movaps xmm0, xmmword [0x4c7840]
push eax
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x4c
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], str.appwiz.cpl
movups xmmword [esp + 0x28], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.0x414334.10176
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27c4
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
call fcn.0041dae0
jmp case.0x414334.10176
lea eax, [esp + 0x88]
push eax
push 0
push 0
push fcn.0041be50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x414334.10176
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27c9
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
call fcn.0041dfe0
jmp case.0x414334.10176
push 0x27c0
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov ecx, eax
call fcn.0041e280
jmp case.0x414334.10176
push 0x27d2
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 1
mov ecx, eax
call fcn.0041e280
jmp case.0x414334.10176
call fcn.0041e5e0
call fcn.0041a860
jmp case.0x414334.10176
call fcn.0041ea40
call fcn.0041a930
jmp case.0x414334.10176
call fcn.0041ed30
jmp case.0x414334.10176
call fcn.0041b4f0
jmp case.0x414334.10176
sub ecx, 0x2991
je 0x4152e0
sub ecx, 0x3b
je case.0x414334.10222
sub ecx, 0x2595
jne case.0x414334.10176
mov eax, dword [0x4e4f38]
cmp eax, 0x156
jl 0x41526b
cmp eax, 0x158
jle 0x415289
push 0
push 0x472350
push dword [0x4e6030]
push str.NAGSCREEN
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x4f61
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 5
push 0x27b7
push dword [0x4e6030]
call edi
push eax
call esi
lea eax, [esp + 0x88]
mov dword [0x4cc1d4], 1
push eax
push 0
push 0
push 0x41f190
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x414334.10176
call fcn.0041b1e0
mov ecx, dword [esp + 0x1a9c]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x1a94
ret