Function at 0x402cf0
Capabilities:
Create process on windows
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1fb2
mov eax, dword fs:[0]
push eax
mov eax, 0x1454
call fcn.004963b0
mov eax, dword [0x4d0c20]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13f0], ecx
mov dword [ebp - 0x13ec], 0
push 0x4c5ef8
mov eax, dword [ebp + 8]
push eax
call fcn.0040a800
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x402d5a
mov ecx, dword [ebp - 0x13f0]
sub ecx, 0x14
call fcn.00403e50
jmp 0x403c25
push 0x4c5f10
mov edx, dword [ebp + 8]
push edx
call fcn.0040a800
add esp, 8
movzx eax, al
test eax, eax
je 0x4037a5
lea ecx, [ebp - 0xa9c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x108]
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x13f4], eax
mov ecx, dword [ebp - 0x13f4]
mov dword [ebp - 0x13f8], ecx
mov dword [ebp - 4], 0
push 0x4c5f1c
mov edx, dword [ebp - 0x13f8]
push edx
call fcn.0040a800
add esp, 8
mov byte [ebp - 0xa15], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa9c]
call fcn.00424c10
movzx eax, byte [ebp - 0xa15]
test eax, eax
je 0x402f2f
mov ecx, dword [ebp - 0x13f0]
mov ecx, dword [ecx + 0x564]
call fcn.00425f50
cmp eax, 3
jne 0x402e1b
mov ecx, dword [ebp - 0x13f0]
sub ecx, 0x14
call fcn.00404730
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
mov ecx, dword [ebp - 0x13f0]
sub ecx, 0x14
call fcn.004069c0
push 0x4c5f30
lea ecx, [ebp - 0xab8]
call fcn.00401680
mov dword [ebp - 4], 1
push 0x4c5f38
lea ecx, [ebp - 0xad4]
call fcn.00401680
mov byte [ebp - 4], 2
push 0x4c5f40
lea ecx, [ebp - 0xaf0]
call fcn.00401680
mov byte [ebp - 4], 3
push 0x4c5f5c
lea ecx, [ebp - 0xb0c]
call fcn.00401680
mov byte [ebp - 4], 4
push 0xb4
push 0x12c
lea edx, [ebp - 0xab8]
push edx
lea eax, [ebp - 0xad4]
push eax
push 2
push 1
lea ecx, [ebp - 0xaf0]
push ecx
lea edx, [ebp - 0xb0c]
push edx
mov ecx, dword [0x4d526c]
call fcn.00424af0
push eax
call fcn.0040bd50
add esp, 0x24
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb0c]
call fcn.004016c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xaf0]
call fcn.004016c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xad4]
call fcn.004016c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xab8]
call fcn.004016c0
push 0
mov ecx, dword [ebp - 0x13f0]
sub ecx, 0x14
call fcn.004069c0
cmp dword [ebp - 0x10], 1
jne 0x402f2a
mov ecx, dword [ebp - 0x13f0]
sub ecx, 0x14
call fcn.00404730
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x4037a0
lea eax, [ebp - 0xb94]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x108]
mov edx, dword [edx]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x13fc], eax
mov ecx, dword [ebp - 0x13fc]
mov dword [ebp - 0x1400], ecx
mov dword [ebp - 4], 5
push str.min_btn
mov edx, dword [ebp - 0x1400]
push edx
call fcn.0040a800
add esp, 8
mov byte [ebp - 0xb0d], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb94]
call fcn.00424c10
movzx eax, byte [ebp - 0xb0d]
test eax, eax
je 0x402fb6
push 6
mov ecx, dword [ebp - 0x13f0]
mov edx, dword [ecx - 0x10]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4037a0
lea eax, [ebp - 0xc1c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x108]
mov edx, dword [edx]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x1404], eax
mov ecx, dword [ebp - 0x1404]
mov dword [ebp - 0x1408], ecx
mov dword [ebp - 4], 6
push str.selected_path_btn
mov edx, dword [ebp - 0x1408]
push edx
call fcn.0040a800
add esp, 8
mov byte [ebp - 0xb95], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc1c]
call fcn.00424c10
movzx eax, byte [ebp - 0xb95]
test eax, eax
je 0x403064
xor ecx, ecx
mov word [ebp - 0x814], cx
push 0x7fe
push 0
lea edx, [ebp - 0x812]
push edx
call fcn.004955c0
add esp, 0xc
push 0x3ff
lea eax, [ebp - 0x814]
push eax
mov ecx, dword [ebp - 0x13f0]
sub ecx, 0x14
call fcn.004054e0
jmp 0x4037a0
lea ecx, [ebp - 0xca4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x108]
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x140c]
mov dword [ebp - 0x1410], ecx
mov dword [ebp - 4], 7
push str.self_install_btn
mov edx, dword [ebp - 0x1410]
push edx
call fcn.0040a800
add esp, 8
mov byte [ebp - 0xc1d], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca4]
call fcn.00424c10
movzx eax, byte [ebp - 0xc1d]
test eax, eax
je 0x403114
push 1
push 1
mov ecx, dword [ebp - 0x13f0]
mov edx, dword [ecx + 0x550]
mov eax, dword [ebp - 0x13f0]
mov ecx, dword [eax + 0x550]
mov edx, dword [edx]
mov eax, dword [edx + 0x168]
call eax
push 0
push 1
mov ecx, dword [ebp - 0x13f0]
mov ecx, dword [ecx + 0x564]
call fcn.00425f70
jmp 0x4037a0
lea edx, [ebp - 0xd2c]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x108]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dword [ebp - 0x1418], ecx
mov dword [ebp - 4], 8
mov edx, dword [ebp - 0x13ec]
or edx, 1
mov dword [ebp - 0x13ec], edx
push 0x4c5fc0
mov eax, dword [ebp - 0x1418]
push eax
call fcn.0040a800
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x4031ea
lea edx, [ebp - 0xdb0]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x108]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x141c], eax
mov ecx, dword [ebp - 0x141c]
mov dword [ebp - 0x1420], ecx
mov dword [ebp - 4], 9
mov edx, dword [ebp - 0x13ec]
or edx, 2
mov dword [ebp - 0x13ec], edx
push 0x4c5fec
mov eax, dword [ebp - 0x1420]
push eax
call fcn.0040a800
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x4031ea
mov dword [ebp - 0x1424], 0
jmp 0x4031f4
mov dword [ebp - 0x1424], 1
mov dl, byte [ebp - 0x1424]
mov byte [ebp - 0xca5], dl
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x13ec]
and eax, 2
je 0x403224
and dword [ebp - 0x13ec], 0xfffffffd
lea ecx, [ebp - 0xdb0]
call fcn.00424c10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x13ec]
and ecx, 1
je 0x403248
and dword [ebp - 0x13ec], 0xfffffffe
lea ecx, [ebp - 0xd2c]
call fcn.00424c10
movzx edx, byte [ebp - 0xca5]
test edx, edx
je 0x403562
lea eax, [ebp - 0xe34]
push eax
mov ecx, dword [ebp - 0x13f0]
mov edx, dword [ecx + 0x548]
mov eax, dword [ebp - 0x13f0]
mov ecx, dword [eax + 0x548]
mov edx, dword [edx]
mov eax, dword [edx + 0x38]
call eax
mov dword [ebp - 0x1428], eax
mov ecx, dword [ebp - 0x1428]
mov dword [ebp - 0x142c], ecx
mov dword [ebp - 4], 0xa
mov ecx, dword [ebp - 0x142c]
call fcn.00424e90
push eax
mov ecx, dword [ebp - 0x13f0]
add ecx, 0xc
call fcn.004069f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe34]
call fcn.00424c10
xor edx, edx
mov word [ebp - 0x91c], dx
push 0xfe
push 0
lea eax, [ebp - 0x91a]
push eax
call fcn.004955c0
add esp, 0xc
push 0x7f
lea ecx, [ebp - 0x91c]
push ecx
mov edx, dword [ebp - 0x13f0]
add edx, 0xc
push edx
call fcn.0040ec30
add esp, 0xc
mov byte [ebp - 0x939], al
lea eax, [ebp - 0x91c]
push eax
lea ecx, [ebp - 0x938]
call fcn.00401680
mov dword [ebp - 4], 0xb
movzx ecx, byte [ebp - 0x939]
test ecx, ecx
jne 0x4034c3
lea ecx, [ebp - 0x938]
call fcn.00406a10
movzx edx, al
test edx, edx
je 0x4034c3
push 1
mov ecx, dword [ebp - 0x13f0]
sub ecx, 0x14
call fcn.004069c0
push 0x4c601c
lea ecx, [ebp - 0xe54]
call fcn.00401680
mov byte [ebp - 4], 0xc
push 0x4c6024
lea ecx, [ebp - 0xe70]
call fcn.00401680
mov byte [ebp - 4], 0xd
push 0x4c602c
lea ecx, [ebp - 0xe8c]
call fcn.00401680
mov byte [ebp - 4], 0xe
push 0x4c6054
lea ecx, [ebp - 0xea8]
call fcn.00401680
mov byte [ebp - 4], 0xf
push 0xb4
push 0x12c
lea eax, [ebp - 0xe54]
push eax
lea ecx, [ebp - 0xe70]
push ecx
push 2
push 1
lea edx, [ebp - 0xe8c]
push edx
lea eax, [ebp - 0xea8]
push eax
mov ecx, dword [ebp - 0x13f0]
mov edx, dword [ecx - 0x10]
push edx
call fcn.0040bd50
add esp, 0x24
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0xe35], al
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xea8]
call fcn.004016c0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xe8c]
call fcn.004016c0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xe70]
call fcn.004016c0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xe54]
call fcn.004016c0
movzx eax, byte [ebp - 0xe35]
test eax, eax
je 0x403457
push 0
mov ecx, dword [ebp - 0x13f0]
sub ecx, 0x14
call fcn.004069c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x938]
call fcn.004016c0
jmp 0x403c25
push 0
mov ecx, dword [ebp - 0x13f0]
sub ecx, 0x14
call fcn.004069c0
push 0x4c6060
mov ecx, dword [ebp - 0x13f0]
add ecx, 0xc
push ecx
lea edx, [ebp - 0x95c]
push edx
call fcn.00401d00
add esp, 0xc
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x95c]
call fcn.00402ab0
push eax
call fcn.0040e620
add esp, 4
test eax, eax
jne 0x4034b4
push 0x4c6080
mov ecx, dword [ebp - 0x13f0]
add ecx, 0xc
call fcn.00401e50
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x95c]
call fcn.004016c0
push 0
push 2
mov eax, dword [ebp - 0x13f0]
mov ecx, dword [eax + 0x564]
call fcn.00425f70
push 0x64
push 0x64
mov ecx, dword [ebp - 0x13f0]
mov edx, dword [ecx + 0x568]
push edx
mov ecx, dword [ebp - 0x13f0]
add ecx, 0x64
call fcn.0041f310
mov dword [ebp - 0x818], 0
lea eax, [ebp - 0x818]
push eax
push 0
push 0
push 0x406340
push 0
push 0
call fcn.0049287c
add esp, 0x18
mov dword [ebp - 0x940], eax
mov ecx, dword [ebp - 0x818]
mov dword [ebp - 0xeac], ecx
lea edx, [ebp - 0x940]
push edx
lea eax, [ebp - 0xeac]
push eax
mov ecx, dword [ebp - 0x13f0]
sub ecx, 0x14
call fcn.004050a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x938]
call fcn.004016c0
jmp 0x4037a0
lea ecx, [ebp - 0xf34]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x108]
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x1430], eax
mov ecx, dword [ebp - 0x1430]
mov dword [ebp - 0x1434], ecx
mov dword [ebp - 4], 0x11
push str.show_policy_btn
mov edx, dword [ebp - 0x1434]
push edx
call fcn.0040a800
add esp, 8
mov byte [ebp - 0xead], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf34]
call fcn.00424c10
movzx eax, byte [ebp - 0xead]
test eax, eax
je 0x403617
push str.https:__www.saibo.com_article_1986.html
lea ecx, [ebp - 0x978]
call fcn.00401680
push 1
push 0x4c6100
push 0x4c6104
lea ecx, [ebp - 0x978]
call fcn.00402ab0
push eax
push 0x4c6108
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x978]
call fcn.004016c0
jmp 0x4037a0
lea ecx, [ebp - 0xfbc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x108]
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x1438], eax
mov ecx, dword [ebp - 0x1438]
mov dword [ebp - 0x143c], ecx
mov dword [ebp - 4], 0x12
push str.return_btn
mov edx, dword [ebp - 0x143c]
push edx
call fcn.0040a800
add esp, 8
mov byte [ebp - 0xf35], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfbc]
call fcn.00424c10
movzx eax, byte [ebp - 0xf35]
test eax, eax
je 0x4036a1
push 0
push 0
mov ecx, dword [ebp - 0x13f0]
mov ecx, dword [ecx + 0x564]
call fcn.00425f70
jmp 0x4037a0
lea edx, [ebp - 0x1044]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x108]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x1440], eax
mov ecx, dword [ebp - 0x1440]
mov dword [ebp - 0x1444], ecx
mov dword [ebp - 4], 0x13
push str.immediate_startup_btn
mov edx, dword [ebp - 0x1444]
push edx
call fcn.0040a800
add esp, 8
mov byte [ebp - 0xfbd], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1044]
call fcn.00424c10
movzx eax, byte [ebp - 0xfbd]
test eax, eax
je 0x4037a0
mov ecx, dword [ebp - 0x13f0]
add ecx, 0x28
push ecx
lea ecx, [ebp - 0x994]
call fcn.00401e10
mov dword [ebp - 4], 0x14
push 0x4c6158
lea ecx, [ebp - 0x994]
call fcn.00401e50
push 0x4c615c
lea ecx, [ebp - 0x994]
call fcn.00401e50
push 1
push 0x4c6170
push str._install
lea ecx, [ebp - 0x994]
call fcn.00402ab0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x13f0]
sub ecx, 0x14
call fcn.00404730
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x403c25
push str.selectchanged
mov edx, dword [ebp + 8]
push edx
call fcn.0040a800
add esp, 8
movzx eax, al
test eax, eax
je 0x403947
lea ecx, [ebp - 0x10cc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x108]
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x1448], eax
mov ecx, dword [ebp - 0x1448]
mov dword [ebp - 0x144c], ecx
mov dword [ebp - 4], 0x15
push 0x4c61b0
mov edx, dword [ebp - 0x144c]
push edx
call fcn.0040a800
add esp, 8
mov byte [ebp - 0x1045], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10cc]
call fcn.00424c10
movzx eax, byte [ebp - 0x1045]
test eax, eax
je 0x403942
mov ecx, dword [ebp - 0x13f0]
mov ecx, dword [ecx + 0x550]
call fcn.00426a80
movzx edx, al
cmp edx, 1
jne 0x4038ca
push 1
mov eax, dword [ebp - 0x13f0]
mov ecx, dword [eax + 0x55c]
mov edx, dword [ebp - 0x13f0]
mov eax, dword [edx + 0x55c]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0xec]
call eax
push 0xffffffffffffffff
push 0x4c61c4
lea ecx, [ebp - 0x1150]
call fcn.00424b90
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0x1150]
push ecx
mov edx, dword [ebp - 0x13f0]
mov eax, dword [edx + 0x55c]
mov ecx, dword [ebp - 0x13f0]
mov ecx, dword [ecx + 0x55c]
mov edx, dword [eax]
mov eax, dword [edx + 0xb0]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1150]
call fcn.00424c10
jmp 0x403942
push 0
mov ecx, dword [ebp - 0x13f0]
mov edx, dword [ecx + 0x55c]
mov eax, dword [ebp - 0x13f0]
mov ecx, dword [eax + 0x55c]
mov edx, dword [edx]
mov eax, dword [edx + 0xec]
call eax
push 0xffffffffffffffff
push 0x4c61c8
lea ecx, [ebp - 0x11d4]
call fcn.00424b90
mov dword [ebp - 4], 0x17
lea ecx, [ebp - 0x11d4]
push ecx
mov edx, dword [ebp - 0x13f0]
mov eax, dword [edx + 0x55c]
mov ecx, dword [ebp - 0x13f0]
mov ecx, dword [ecx + 0x55c]
mov edx, dword [eax]
mov eax, dword [edx + 0xb0]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11d4]
call fcn.00424c10
jmp 0x403c25
push str.textchanged
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040a800
add esp, 8
movzx edx, al
test edx, edx
je 0x403a84
lea eax, [ebp - 0x125c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x108]
mov edx, dword [edx]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x1450], eax
mov ecx, dword [ebp - 0x1450]
mov dword [ebp - 0x1454], ecx
mov dword [ebp - 4], 0x18
push 0x4c6204
mov edx, dword [ebp - 0x1454]
push edx
call fcn.0040a800
add esp, 8
mov byte [ebp - 0x11d5], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x125c]
call fcn.00424c10
movzx eax, byte [ebp - 0x11d5]
test eax, eax
je 0x403a7f
lea ecx, [ebp - 0x1364]
push ecx
mov edx, dword [ebp - 0x13f0]
mov eax, dword [edx + 0x548]
mov ecx, dword [ebp - 0x13f0]
mov ecx, dword [ecx + 0x548]
mov edx, dword [eax]
mov eax, dword [edx + 0x38]
call eax
mov dword [ebp - 0x1458], eax
mov ecx, dword [ebp - 0x1458]
mov dword [ebp - 0x145c], ecx
mov dword [ebp - 4], 0x19
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x145c]
call fcn.00424e90
push eax
lea ecx, [ebp - 0x12e0]
call fcn.00424b90
mov byte [ebp - 4], 0x1a
lea edx, [ebp - 0x12e0]
push edx
mov eax, dword [ebp - 0x13f0]
mov ecx, dword [eax + 0x548]
mov edx, dword [ebp - 0x13f0]
mov eax, dword [edx + 0x548]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0xb0]
call eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x12e0]
call fcn.00424c10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1364]
call fcn.00424c10
jmp 0x403c25
push str.timer
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040a800
add esp, 8
movzx edx, al
test edx, edx
je 0x403c25
mov eax, dword [ebp + 8]
cmp dword [eax + 0x118], 0x64
jne 0x403c25
mov ecx, dword [ebp - 0x13f0]
mov edx, dword [ecx + 0x578]
mov dword [ebp - 0x1460], edx
cmp dword [ebp - 0x1460], 0
je 0x403ad6
cmp dword [ebp - 0x1460], 1
je 0x403b12
jmp 0x403b2d
mov eax, dword [ebp - 0x13f0]
mov ecx, dword [eax + 0x574]
add ecx, 1
mov edx, dword [ebp - 0x13f0]
mov dword [edx + 0x574], ecx
mov eax, dword [ebp - 0x13f0]
cmp dword [eax + 0x574], 0x50
jl 0x403b10
mov ecx, dword [ebp - 0x13f0]
mov dword [ecx + 0x578], 1
jmp 0x403b2d
mov edx, dword [ebp - 0x13f0]
mov eax, dword [edx + 0x574]
add eax, 1
mov ecx, dword [ebp - 0x13f0]
mov dword [ecx + 0x574], eax
mov edx, dword [ebp - 0x13f0]
mov eax, dword [edx + 0x574]
push eax
mov ecx, dword [ebp - 0x13f0]
mov ecx, dword [ecx + 0x568]
call fcn.00428140
xor edx, edx
mov word [ebp - 0xa14], dx
push 0x7e
push 0
lea eax, [ebp - 0xa12]
push eax
call fcn.004955c0
add esp, 0xc
mov ecx, dword [ebp - 0x13f0]
mov edx, dword [ecx + 0x574]
push edx
push str.ck_W
push 0x40
lea eax, [ebp - 0xa14]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0xa14]
push ecx
lea ecx, [ebp - 0x13e8]
call fcn.00424b90
mov dword [ebp - 4], 0x1b
lea edx, [ebp - 0x13e8]
push edx
mov eax, dword [ebp - 0x13f0]
mov ecx, dword [eax + 0x56c]
mov edx, dword [ebp - 0x13f0]
mov eax, dword [edx + 0x56c]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0x3c]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13e8]
call fcn.00424c10
mov ecx, dword [ebp - 0x13f0]
cmp dword [ecx + 0x574], 0x64
jl 0x403c25
push 0x64
mov edx, dword [ebp - 0x13f0]
mov eax, dword [edx + 0x568]
push eax
mov ecx, dword [ebp - 0x13f0]
add ecx, 0x64
call fcn.0041f490
push 0
push 0
push 0x7ea
mov ecx, dword [ebp - 0x13f0]
mov edx, dword [ecx - 0x10]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00492337
mov esp, ebp
pop ebp
ret 4