Function at 0x464666
Capabilities:
Create process on windows
Create thread
Find taskbar
Get common file path
Get program files directory
Link many functions at runtime
Query environment variable
Read .ini file
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc7c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xc74], eax
mov eax, dword [0x4e2b78]
mov dword [esp + 4], edx
push ebx
mov ebx, ecx
push ebp
push esi
push edi
cmp eax, 0xc
jg 0x464608
inc eax
mov dword [0x4e2b78], eax
cmp eax, 0xc
jne 0x464608
call fcn.00472bf0
mov ebp, dword [esp + 0xc90]
mov edi, ebp
mov eax, dword [0x4e5c1c]
dec eax
shr edi, 0x10
movzx esi, bp
cmp eax, 7
ja case.default.0x464622
jmp dword [eax*4 + 0x4658ec]
mov ecx, esi
call fcn.00409b00
mov ecx, esi
call fcn.004142f0
jmp case.default.0x464622
mov ecx, esi
call fcn.0040a460
jmp case.default.0x464622
mov ecx, esi
call fcn.004261a0
jmp case.default.0x464622
mov ecx, esi
call fcn.00430590
mov edx, edi
mov ecx, esi
call fcn.00444f40
jmp case.default.0x464622
mov ecx, esi
call fcn.00449770
jmp case.default.0x464622
mov ecx, esi
call fcn.00454750
cmp esi, 0x7530
ja 0x464c2e
je 0x464c0b
cmp esi, 0x4e39
ja 0x464863
je 0x4647e7
add esi, 0xffffd6ee
cmp esi, 0xbb
ja case.0x464c3d.30028
movzx eax, byte [esi + 0x465920]
jmp dword [eax*4 + 0x46590c]
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x488], ax
lea eax, [esp + 0x48a]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x480]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0
lea eax, [esp + 0x488]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
lea ecx, [esp + 0x480]
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 0x800
jae 0x4658e6
xor ecx, ecx
mov word [esp + eax + 0x480], cx
lea eax, [esp + 0x480]
push str._tweakguide.exe
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
mov eax, dword [0x4e6030]
xorps xmm0, xmm0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x480]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
movaps xmm0, xmmword [0x4c77d0]
push eax
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x20], 0x4c
mov dword [esp + 0x28], 0
movups xmmword [esp + 0x30], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor eax, eax
jmp 0x4658cd
call fcn.0045fbb0
xor eax, eax
jmp 0x4658cd
cmp dword [0x4e6254], 0
jne 0x4647be
push 5
push 0
push 0
push str.http:__www.tweakguide.net
push str.open
push dword [0x4e6030]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4647d2
push 1
push 0xf
push 0x4e5a00
push dword [0x4e6030]
call fcn.00401149
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x29af
jmp 0x464b7f
mov edx, 0x4b4554
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4b331c
mov ecx, str.MENUTEXT
call fcn.00478640
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 2
push 0x40b
push dword [0x4e5c10]
call esi
push 0x4b34dc
push 1
push 0x40b
push dword [0x4e5c10]
call esi
call fcn.00468690
xor ecx, ecx
call fcn.0046d280
mov ecx, 5
mov dword [0x4e5c1c], 1
call fcn.0046d280
xor eax, eax
jmp 0x4658cd
cmp esi, 0x4f42
ja 0x464b99
je 0x464b5c
add esi, 0xffffb1c6
cmp esi, 5
ja case.0x464c3d.30028
jmp dword [esi*4 + 0x4659dc]
mov edx, 0x4b455c
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4b3314
mov ecx, str.MENUTEXT
call fcn.00478640
push eax
push 2
push 0x40b
push dword [0x4e5c10]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.004691d0
xor ecx, ecx
call fcn.0046d280
mov ecx, 5
mov dword [0x4e5c1c], 2
call fcn.0046d280
cmp dword [0x4cc1c8], 2
je 0x464982
push 5
push 0x27a7
jmp 0x46496f
mov edx, 0x4b3a0c
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4b361c
mov ecx, str.MENUTEXT
call fcn.00478640
push eax
push 2
push 0x40b
push dword [0x4e5c10]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.00469c90
xor ecx, ecx
call fcn.0046d280
mov ecx, 5
mov dword [0x4e5c1c], 3
call fcn.0046d280
cmp dword [0x4cc1d4], 2
je 0x464982
push 5
push 0x27ae
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
jmp 0x4658cd
mov edx, 0x4b3a14
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4b3684
mov ecx, str.MENUTEXT
call fcn.00478640
push eax
push 2
push 0x40b
push dword [0x4e5c10]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.0046a570
xor ecx, ecx
call fcn.0046d280
mov ecx, 5
mov dword [0x4e5c1c], 4
call fcn.0046d280
cmp byte [0x4d6bc4], 0
jne 0x464a09
lea eax, [esp + 0x14]
push eax
push 0
push 0
push fcn.0042c4a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x4d6bc4], 1
xor eax, eax
jmp 0x4658cd
cmp dword [0x4d9cc0], 0
jne 0x464a2a
mov dword [0x4d9cc0], 0x29fa
mov edx, 0x4b3a3c
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4b36c0
mov ecx, str.MENUTEXT
call fcn.00478640
push eax
push 2
push 0x40b
push dword [0x4e5c10]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.0046cb60
xor ecx, ecx
call fcn.0046d280
mov ecx, 5
mov dword [0x4e5c1c], 5
call fcn.0046d280
xor eax, eax
jmp 0x4658cd
mov edx, 0x4b46e8
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4b37a0
mov ecx, str.MENUTEXT
call fcn.00478640
push eax
push 2
push 0x40b
push dword [0x4e5c10]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.00470f10
xor ecx, ecx
call fcn.0046d280
mov ecx, 5
mov dword [0x4e5c1c], 6
call fcn.0046d280
xor eax, eax
jmp 0x4658cd
mov edx, 0x4b40d0
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4b39ac
mov ecx, str.MENUTEXT
call fcn.00478640
push eax
push 2
push 0x40b
push dword [0x4e5c10]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.00471b40
xor ecx, ecx
call fcn.0046d280
mov ecx, 5
mov dword [0x4e5c1c], 7
call fcn.0046d280
xor eax, eax
jmp 0x4658cd
push 0
push 0x4766d0
push dword [0x4e6030]
push str.IDD_STATUS
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push 0x4f42
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, eax
call fcn.00460130
xor eax, eax
jmp 0x4658cd
cmp esi, 0x4f78
jne case.0x464c3d.30028
mov edx, 0x4b6e6c
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x4b3bfc
mov ecx, str.MENUTEXT
call fcn.00478640
push eax
push 2
push 0x40b
push dword [0x4e5c10]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.00471cb0
xor ecx, ecx
call fcn.0046d280
mov ecx, 5
mov dword [0x4e5c1c], 8
call fcn.0046d280
xor eax, eax
jmp 0x4658cd
push 5
push 0
push 0
push str.notepad.exe
push str.open
push dword [0x4e6030]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
jmp 0x4658cd
add esi, 0xffff8acf
cmp esi, 0x3b
ja case.0x464c3d.30028
jmp dword [esi*4 + 0x4659f4]
cmp dword [0x4e5c1c], 0
je 0x464982
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 1
push 0xf8
push 0x4f42
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0x1000
push 0
push 0
push 1
push 0x4f42
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 1
push 0xf7
push 0x4f42
push dword [0x4e6030]
call edi
push eax
call esi
push 1
push 0
push 0x4f42
push dword [0x4e6030]
call edi
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x475d00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0x4b454c
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push 0
push 0x40b
push dword [0x4e5c10]
call esi
mov edx, 0x4b330c
mov ecx, str.MENUTEXT
call fcn.00478640
push eax
push 2
push 0x40b
push dword [0x4e5c10]
call esi
mov edx, 0x4b37a0
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push 0x2723
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call esi
mov edx, 0x4b39ac
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push 0x2724
push dword [0x4e6030]
call edi
push eax
call esi
xor ecx, ecx
call fcn.0046d280
call fcn.0047fd10
call fcn.00486470
mov dword [0x4e5c1c], 0
mov ecx, 1
call fcn.004869f0
mov ecx, 5
call fcn.0046d280
xor eax, eax
jmp 0x4658cd
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa000a
push 0
push 0x202
push 0x4e39
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xa000a
push 0
push 0x201
push 0x4e39
push dword [0x4e6030]
call edi
push eax
call esi
push 0xa000a
push 0
push 0x202
push 0x4e39
push dword [0x4e6030]
call edi
push eax
call esi
xor eax, eax
jmp 0x4658cd
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa000a
push 0
push 0x202
push 0x4e3a
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xa000a
push 0
push 0x201
push 0x4e3a
push dword [0x4e6030]
call edi
push eax
call esi
push 0xa000a
push 0
push 0x202
push 0x4e3a
push dword [0x4e6030]
call edi
push eax
call esi
xor eax, eax
jmp 0x4658cd
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa000a
push 0
push 0x202
push 0x4e3b
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xa000a
push 0
push 0x201
push 0x4e3b
push dword [0x4e6030]
call edi
push eax
call esi
push 0xa000a
push 0
push 0x202
push 0x4e3b
push dword [0x4e6030]
call edi
push eax
call esi
xor eax, eax
jmp 0x4658cd
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa000a
push 0
push 0x202
push 0x4e3c
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xa000a
push 0
push 0x201
push 0x4e3c
push dword [0x4e6030]
call edi
push eax
call esi
push 0xa000a
push 0
push 0x202
push 0x4e3c
push dword [0x4e6030]
call edi
push eax
call esi
xor eax, eax
jmp 0x4658cd
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa000a
push 0
push 0x202
push 0x4e3d
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xa000a
push 0
push 0x201
push 0x4e3d
push dword [0x4e6030]
call edi
push eax
call esi
push 0xa000a
push 0
push 0x202
push 0x4e3d
push dword [0x4e6030]
call edi
push eax
call esi
xor eax, eax
jmp 0x4658cd
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa000a
push 0
push 0x202
push 0x4e3e
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xa000a
push 0
push 0x201
push 0x4e3e
push dword [0x4e6030]
call edi
push eax
call esi
push 0xa000a
push 0
push 0x202
push 0x4e3e
push dword [0x4e6030]
call edi
push eax
call esi
xor eax, eax
jmp 0x4658cd
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa000a
push 0
push 0x202
push 0x4e3f
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0xa000a
push 0
push 0x201
push 0x4e3f
push dword [0x4e6030]
call edi
push eax
call esi
push 0xa000a
push 0
push 0x202
push 0x4e3f
push dword [0x4e6030]
call edi
push eax
call esi
xor eax, eax
jmp 0x4658cd
push 0x208
lea eax, [esp + 0x74]
push 0
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x18]
push 0x58
push 0
push eax
call fcn.0048fb10
mov eax, dword [0x4e5c0c]
add esp, 0xc
mov dword [esp + 0x20], eax
mov eax, dword [0x4e6030]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x58
mov dword [esp + 0x50], 0x81824
mov dword [esp + 0x28], str.All_Files__._
mov dword [esp + 0x4c], str.Select_a_file_to_open_in_Notepad
mov dword [esp + 0x48], 0x4b6c94
mov dword [esp + 0x3c], 0x104
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x60], 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
cmp word [esp + 0x70], 0
je 0x464982
push 5
push 0
lea eax, [esp + 0x78]
push eax
jmp 0x464c11
push 0x104
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str._system.ini
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
push 0
lea eax, [esp + 0x78]
push eax
jmp 0x464c11
push 0x104
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.win.ini
jmp 0x465126
push 0x104
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.config.nt
jmp 0x465126
push 0x104
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str._autoexec.nt
jmp 0x465126
push 5
push 0
push str.c:config.sys
jmp 0x464c11
push 5
push 0
push str.c:_autoexec.bat
jmp 0x464c11
push 5
push 0
push 0
push str.msinfo32.exe
jmp 0x464c16
push 5
push 0
push 0
push str.shell:::ED7BA470_8E54_465E_825C_99712043E01C
jmp 0x464c16
push 5
push 0
push 0
push str.shell:::78F3955E_3B90_4184_BD14_5397C15F1EFC
jmp 0x464c16
push 5
push 0
push 0
push str.compmgmt.msc
jmp 0x464c16
push 5
push 0
push 0
push str.cleanmgr.exe
jmp 0x464c16
push 5
push 0
push 0
push str.shell:::4026492F_2F69_46B8_B9BF_5654FC07E423
jmp 0x464c16
push 5
push 0
push 0
push str.shell:::9C60DE1E_E5FC_40f4_A487_460851A8D915
jmp 0x464c16
push str.Kernel32.dll
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test esi, esi
jne 0x465242
push str.Kernel32.dll
call ebp
mov esi, eax
test esi, esi
je 0x46525c
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x465259
lea ecx, [esp + 0x14]
push ecx
call eax
push esi
call edi
mov ebx, dword [esp + 0x14]
push 5
push 0
push 0
push str.msconfig.exe
push str.open
push dword [0x4e6030]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
test ebx, ebx
je 0x464982
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x4652a6
push str.Kernel32.dll
call ebp
mov esi, eax
test esi, esi
je 0x464982
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4652b9
push ebx
call eax
push esi
call edi
xor eax, eax
jmp 0x4658cd
push str.Kernel32.dll
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test esi, esi
jne 0x4652f5
push str.Kernel32.dll
call ebp
mov esi, eax
test esi, esi
je 0x46530f
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46530c
lea ecx, [esp + 0x14]
push ecx
call eax
push esi
call edi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 5
push 0
push 0
push str.dfrgui.exe
push str.open
push 0
call esi
cmp eax, 2
jne 0x465346
push 5
push 0
push 0
push str.dfrg.msc
push str.open
push dword [0x4e6030]
call esi
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x464982
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x465374
push str.Kernel32.dll
call ebp
mov esi, eax
test esi, esi
je 0x464982
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4652b6
push esi
call edi
xor eax, eax
jmp 0x4658cd
cmp dword [0x4e59f8], 2
je case.0x464c3d.30059
xor eax, eax
push 0x206
push eax
mov word [esp + 0x78], ax
lea eax, [esp + 0x7a]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x70]
push 0x104
push eax
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x70]
push str.program_filesWindows_DefenderMSASCui.exe
push eax
call edi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esp + 0x70]
push 5
push 0
push 0
push eax
push str.open
push dword [0x4e6030]
call esi
cmp eax, 2
jne 0x464982
lea eax, [esp + 0x14]
push eax
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [esp + 0x70]
push eax
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x464982
push str.Windows_DefenderMSASCui.exe
lea eax, [esp + 0x74]
push eax
call edi
push 5
push 0
push 0
lea eax, [esp + 0x7c]
push eax
push str.open
push dword [0x4e6030]
call esi
cmp eax, 2
jne 0x464982
push 5
push 0
push 0
push str.wf.msc
push str.open
push dword [0x4e6030]
call esi
xor eax, eax
jmp 0x4658cd
push str.Kernel32.dll
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test esi, esi
jne 0x4654ab
push str.Kernel32.dll
call ebp
mov esi, eax
test esi, esi
je 0x4654c5
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4654c2
lea ecx, [esp + 0x14]
push ecx
call eax
push esi
call edi
push 5
push 0
push 0
push str.rstrui.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x465346
push 5
push 0
push 0
push str.regedit.exe
jmp 0x464c16
push 5
push 0
push 0
push str.services.msc
jmp 0x464c16
push 5
push 0
push 0
push str.gpedit.msc
jmp 0x464c16
call fcn.00478ae0
xor eax, eax
jmp 0x4658cd
push 0
push 0x191
push 0x111
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x4658cd
push 5
push 0
push 0
push 0x4b67b4
jmp 0x464c16
push 5
push 0
push 0
push str.powershell
jmp 0x464c16
mov edx, 0x4b40c8
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x70]
mov edx, 0x4b40d8
push 0x24
push eax
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x464982
lea ecx, [eax - 4]
call fcn.00478890
xor eax, eax
jmp 0x4658cd
push 1
push 0x4e6040
push 0
push str.language.exe
jmp 0x464c16
mov edx, str.OnTop
mov ecx, 0x754f
call fcn.00478930
push 0x4e5e28
push 0
push str.OnTop
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 3
push 0
push 0
push 0
push 0
test eax, eax
jne 0x465617
push 0xfffffffffffffffe
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
jmp 0x4658cd
push 0xffffffffffffffff
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
jmp 0x4658cd
mov edx, str.Magnet
mov ecx, 0x7550
call fcn.00478930
push 0x4e5e28
push 0
push str.Magnet
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x4e6258], eax
xor eax, eax
jmp 0x4658cd
mov edx, str.SaveSize
mov ecx, 0x7551
call fcn.00478930
xor eax, eax
jmp 0x4658cd
mov edx, str.Position
mov ecx, 0x7552
call fcn.00478930
xor eax, eax
jmp 0x4658cd
mov edx, str.NoSaver
mov ecx, 0x7553
call fcn.00478930
push 0x4e5e28
push 0
push str.NoSaver
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 2
push 0
test eax, eax
jne 0x4656c9
push 1
push 0x11
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
xor eax, eax
jmp 0x4658cd
push 0
push 0x11
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
xor eax, eax
jmp 0x4658cd
push 0
push 0x463710
push dword [0x4e6030]
push str.IDD_TRANSPARENT
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor eax, eax
jmp 0x4658cd
mov edx, str.ClearFont
mov ecx, 0x7555
call fcn.00478930
mov edx, 0x4b36c8
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
lea eax, [esp + 0x27c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x278]
mov edx, 0x4b46f0
push 0x30
push eax
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x4658cd
mov edx, str.SystemTray
mov ecx, 0x7556
call fcn.00478930
call fcn.0047c7d0
xor eax, eax
jmp 0x4658cd
mov edx, 0x4c0a98
mov ecx, 0x7563
call fcn.00478930
xor eax, eax
jmp 0x4658cd
mov edx, str.ShowSysStat
mov ecx, 0x7564
call fcn.00478930
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x475d00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
jmp 0x4658cd
push 0x4e5e28
push 0
push str.Protect
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
test eax, eax
je 0x465807
push 0x7557
push dword [0x4e6250]
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0x4e5e28
push 0x4b3320
push str.Protect
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor eax, eax
jmp 0x4658cd
push 0x463bd0
push dword [0x4e6030]
push str.PASSWORD_1
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor eax, eax
jmp 0x4658cd
push 1
push 0xf
push 0x4e5a00
push dword [0x4e6030]
call fcn.00401149
xor eax, eax
jmp 0x4658cd
push 0x13
jmp 0x46582c
push 0
push 0x472350
push dword [0x4e6030]
push str.NAGSCREEN
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor eax, eax
jmp 0x4658cd
push 0x12
jmp 0x46582c
push 5
push 0
push 0
push str.https:__www.wintools.net
jmp 0x464c16
push 5
push 0
push 0
push str.mailto:support_wintools.net_subjectReport_about_WinTools.net
jmp 0x464c16
push 0
push 0x463dd0
push ebx
push 0x67
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor eax, eax
jmp 0x4658cd
push 0
push 0
push 0x10
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
jmp 0x4658cd
push dword [esp + 0xc94]
push ebp
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [esp + 0xc84]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0xc7c
ret
call fcn.0048eba6
nop
sub dword [esi + 0x46], eax
add byte [ecx], bh
inc esi
inc esi
add byte [eax], dh
inc esi
inc esi
add byte [edx + 0x46], al
inc esi
add byte [ebx + 0x46], cl
inc esi
add byte [edx + 0x46], dl
inc esi
add byte [ebp + 0x46], bl
inc esi
add byte [esi + 0x46], ah
inc esi
add byte [ebp + 0x55], ah
inc esi
add byte [ecx - 0x74ffb9ba], dh
inc edi
inc esi
add byte [edi - 0x45ffb9b9], dl
pop eax
inc esi
add byte [eax], al
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add dword [esp + eax], eax
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, byte [ebx]
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 2
mov ecx, dword [eax + 70]
add byte [eax], al
dec ecx
inc esi
add byte [ecx + 0x17004649], cl
dec edx
inc esi
add byte [eax - 0x9ffb9b6], dl
dec edx
inc esi
add byte [ebp + 0x50], ah
inc esi
add byte [edi], bh
push ecx
inc esi
add byte [ecx], dl
push ecx
inc esi
add byte [edx - 0x7bffb9af], dl
push ecx
inc esi
add byte [ebp + 0x51], ch
inc esi
add byte [esi + 0x51], dl
inc esi
add byte [esp + ecx*2 + 0x46], al
add byte [ebp + ecx*2 + 0x4dfb0046], dl
inc esi
add byte [edx + 0x4e], ah
inc esi
add cl, cl
dec esi
inc esi
add byte [eax], dh
dec edi
inc esi
add byte [edi - 0x1ffb9b1], dl
dec edi
inc esi
add byte [edx], ch
pop eax
inc esi
add byte [eax + 0x10004651], ah
push edx
inc esi
add al, ah
push ecx
inc esi
add bl, al
push edx
inc esi
add byte [edx - 0x2fffb9ad], dl
push ecx
inc esi
add byte [ecx + 0x54], bh
inc esi
add dl, ah
push esp
inc esi
add dl, dh
push esp
inc esi
add byte [edx], al
push ebp
inc esi
add byte [ebp + 0x55], dl
inc esi
add byte [edx - 0x44ffb9a8], bh
push ebp
inc esi
add byte [edx - 0x31ffb9a8], bh
push ebp
inc esi
add byte [esi + edx*2], ch
inc esi
add byte [esi + 0x56], bl
inc esi
add byte [esi + edx*2 + 0x46], dh
add byte [edx - 0x25ffb9aa], cl
push esi
inc esi
add bh, bh
push esi
inc esi
add byte [ecx + 0x57], bl
inc esi
add byte [eax - 0x56ffb9a9], bh
pop eax
inc esi
add byte [edx], dl
push ebp
inc esi
add byte [esi], bl
push ebp
inc esi
add byte [ebp + 0x55], al
inc esi
add byte [ebp + 0x55], ah
inc esi
add byte [ebp + 0x58], al
inc esi
add byte [ecx + 0x58], cl
inc esi
add byte [ebx + 0x58], ch
inc esi
add byte [edi + 0x58], ch
inc esi
add byte [edi + 0x58], bh
inc esi
add byte [edi + 0x74004658], cl
push edi
inc esi
add byte [edx - 0x4fffb9a9], cl
push ecx
inc esi
add byte [eax - 0x4fffb9af], ah
push ecx
inc esi
add al, al
push ecx
inc esi
add al, dl
push ecx
inc esi
add al, ah
push ecx
inc esi
add al, dh
push ecx
inc esi
add byte [eax], al
push edx
inc esi
add ah, cl
int3