Function at 0x431002
Capabilities:
Log keystrokes
Open clipboard
Parse credit card information
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x4705d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp - 0x147]
push ebx
push eax
mov byte [ebp - 0x148], bl
call fcn.004464f0
push esi
lea eax, [ebp - 0x28b]
push ebx
push eax
mov byte [ebp - 0x28c], bl
call fcn.004464f0
push 0x3f
lea eax, [ebp - 0x187]
push ebx
push eax
mov byte [ebp - 0x188], bl
call fcn.004464f0
push 0x3f
lea eax, [ebp - 0x43]
push ebx
push eax
mov byte [ebp - 0x44], bl
call fcn.004464f0
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x2a4], ebx
lea edi, [ebp - 0x2a0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
imul edi, edi, 0xf54
shl esi, 2
mov eax, dword [esi + 0x473bec]
add eax, edi
push str.Comment
push eax
mov dword [ebp - 0x294], ebx
mov dword [ebp - 0x2a8], ebx
call fcn.004010ff
add esp, 0x38
test eax, eax
jne 0x4313fc
mov eax, dword [esi + 0x473bec]
add eax, edi
push str.Variable
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi + 0x473bec]
pop ecx
je 0x43160a
add eax, edi
cmp byte [eax + 0xcc8], bl
jne 0x431106
cmp eax, ebx
je 0x4310f5
push str.Delete
push eax
call fcn.00445d80
pop ecx
pop ecx
jmp 0x4310f7
xor eax, eax
cmp eax, ebx
jne 0x431106
push str.____WARNING:_No_variable_name_provided
call fcn.0042036e
pop ecx
mov eax, dword [esi + 0x473bec]
lea eax, [edi + eax + 0x58]
push str.No_Variable_Expansion
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x431126
push ebx
push 1
jmp 0x43112f
lea eax, [ebp - 0x2a8]
push eax
push 2
push dword [ebp + 0xc]
mov eax, dword [esi + 0x473bec]
push dword [ebp + 8]
push dword [edi + eax + 0x50]
call fcn.00439ea7
mov eax, dword [esi + 0x473bec]
add eax, edi
push 0x4604d0
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x43118f
mov eax, dword [esi + 0x473bec]
add eax, edi
push str.Create
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x43118f
mov eax, dword [esi + 0x473bec]
add eax, edi
push str.Update
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4311ca
mov eax, dword [esi + 0x473bec]
add eax, edi
push str.Environment
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x4311ca
mov eax, dword [ebp - 0x2a8]
cmp eax, ebx
jne 0x4311be
push dword [0x4775e4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [0x4775e4]
jmp 0x4315fa
mov eax, dword [esi + 0x473bec]
add eax, edi
push str.Set_Environment_Variable
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x431346
push dword [0x4775e4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
add ecx, 0x100
mov eax, 0x1000
cmp ecx, eax
jle 0x431215
push dword [0x4775e4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x100
push 1
push eax
call fcn.004462a8
pop ecx
pop ecx
mov dword [ebp - 0x2b8], eax
cmp eax, ebx
jne 0x431230
xor eax, eax
jmp 0x4313ff
push dword [0x4775e4]
push dword [ebp - 0x2b8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi + 0x473bec]
lea eax, [edi + eax + 0xcc8]
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push ebx
push 0x4597fe
push 0x459858
lea eax, [ebp - 0x148]
push eax
call fcn.0043fa75
push dword [ebp - 0x2b8]
lea eax, [ebp - 0x148]
push eax
call fcn.00442784
mov dword [ebp - 0x294], eax
mov eax, dword [esi + 0x473bec]
lea eax, [edi + eax + 0xcc8]
cmp byte [eax], 0x25
je 0x4312ab
push 0x459858
push ebx
push eax
call fcn.0043feaa
mov eax, dword [esi + 0x473bec]
mov dword [ebp - 0x290], eax
lea eax, [eax + edi + 0xcc8]
cmp eax, ebx
je 0x4312e1
mov esi, dword [esi + 0x473bec]
push eax
mov dword [ebp - 0x290], esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
movsx eax, byte [eax + edi + 0xcc7]
jmp 0x4312e3
xor eax, eax
cmp eax, 0x25
je 0x431305
mov eax, dword [ebp - 0x290]
lea eax, [eax + edi + 0xcc8]
cmp eax, ebx
je 0x431305
push 0x459858
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x2b8]
call fcn.00445e06
pop ecx
cmp dword [ebp - 0x294], ebx
jne 0x4313fc
push ebx
push 0x7ff
push dword [0x473bbc]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
jmp 0x431229
mov eax, dword [esi + 0x473bec]
add eax, edi
push str.Delete
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi + 0x473bec]
pop ecx
je 0x431534
lea eax, [edi + eax + 0x58]
push 0x45e938
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x431410
push str.SOFTWARE_vTaskUserVariables
push ebx
push ebx
push ebx
push 4
call fcn.0044129f
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0x14
push ebx
push ebx
push 0x1009
mov edi, 0x507
push edi
push dword [0x472450]
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x102f
push edi
push dword [0x472450]
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push edi
push dword [0x472450]
call esi
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, 0x473bc4
mov eax, dword [esi]
cmp eax, ebx
je 0x4313f1
push eax
call fcn.00445e06
pop ecx
mov dword [esi], ebx
add esi, 4
cmp esi, 0x473be4
jle 0x4313e2
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004464bf
leave
ret 0xc
mov eax, dword [esi + 0x473bec]
add eax, edi
lea esi, [eax + 0xcc8]
mov cl, byte [esi]
cmp cl, 0x7b
jne 0x431462
cmp byte [eax + 0xcca], 0x7d
jne 0x431462
movsx eax, byte [eax + 0xcc9]
add eax, 0xffffffcf
cmp eax, 1
jge 0x431442
xor eax, eax
inc eax
jmp 0x43144a
cmp eax, 9
jle 0x43144a
push 9
pop eax
lea esi, [eax*4 + 0x473bc0]
mov eax, dword [esi]
cmp eax, ebx
je 0x4313fc
push eax
call fcn.00445e06
pop ecx
mov dword [esi], ebx
jmp 0x4313fc
cmp cl, 0x25
jne 0x43146d
lea esi, [eax + 0xcc9]
push esi
lea eax, [ebp - 0x148]
push str.SOFTWARE_vTaskUserVariables_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x148]
push 0x5b
push eax
call fcn.00445cc0
add esp, 0x14
test eax, eax
je 0x43151b
lea eax, [ebp - 0x148]
push 0x5d
push eax
call fcn.00445cc0
pop ecx
pop ecx
test eax, eax
je 0x43151b
lea eax, [ebp - 0x148]
push 0x5b
push eax
call fcn.00445cc0
pop ecx
pop ecx
inc eax
push eax
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x28c]
mov cl, byte [eax]
cmp cl, bl
je 0x4314e4
cmp cl, 0x5d
je 0x4314e0
inc eax
jmp 0x4314d2
mov byte [eax], bl
jmp 0x4314d2
push 0x3f
lea eax, [ebp - 0x188]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x28c]
push dword [ebp + 8]
push eax
call fcn.0043db78
push ebx
push ebx
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x148]
push eax
call fcn.0043fa75
lea eax, [ebp - 0x148]
push eax
push ebx
push ebx
push ebx
push 4
call fcn.0044129f
add esp, 0x14
jmp 0x4313fc
add eax, edi
push str.Increment
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x431564
mov eax, dword [esi + 0x473bec]
add eax, edi
push str.Decrement
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4313fc
mov eax, dword [esi + 0x473bec]
push ebx
push ebx
push dword [ebp + 0xc]
lea eax, [edi + eax + 0xcc8]
push dword [ebp + 8]
push eax
call fcn.00439ea7
mov eax, dword [esi + 0x473bec]
add eax, edi
push str.Decrement
push eax
call fcn.004010ff
pop ecx
pop ecx
push dword [0x4775e4]
test eax, eax
je 0x4315b7
call fcn.004481cb
fstp dword [ebp - 0x290]
fld dword [ebp - 0x290]
fsub qword [0x45cb78]
jmp 0x4315ce
call fcn.004481cb
fstp dword [ebp - 0x290]
fld dword [ebp - 0x290]
fadd qword [0x45cb78]
pop ecx
push 0xf
push ecx
push ecx
lea eax, [ebp - 0x148]
fstp qword [esp]
push eax
call fcn.00416b8a
add esp, 0x10
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00423053
jmp 0x4313fc
add eax, edi
push str.Step_Delay
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi + 0x473bec]
pop ecx
je 0x4316b7
push ebx
push ebx
push dword [ebp + 0xc]
lea eax, [edi + eax + 0x15c]
push dword [ebp + 8]
push eax
call fcn.00439ea7
mov eax, dword [0x4775e4]
cmp byte [eax], bl
jne 0x43165c
mov eax, dword [esi + 0x473bec]
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + eax + 0x50]
call fcn.00439ea7
push dword [ebp + 8]
push str.InterStepDelay__d
push ebx
push dword [0x4775e4]
call fcn.00444117
mov eax, dword [esi + 0x473bec]
lea eax, [edi + eax + 0x58]
push str.Global
push eax
call fcn.004010ff
add esp, 0x18
test eax, eax
je 0x4316a0
push str.InterStepDelay
push ebx
push dword [0x4775e4]
call fcn.00444117
add esp, 0xc
push dword [0x4775e4]
call fcn.0040109c
pop ecx
mov dword [esi + 0x476fb8], eax
jmp 0x4313fc
add eax, edi
push str.vTask
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi + 0x473bec]
pop ecx
je 0x4318e5
push str.Track
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi + 0x473bec]
pop ecx
je 0x4317f7
lea eax, [edi + eax + 0x58]
push 0x459bd0
push eax
call fcn.004010ff
pop ecx
pop ecx
push str.RunTrackingShow
test eax, eax
je 0x431761
push ebx
push ebx
call fcn.00444117
mov eax, dword [0x476364]
add esp, 0xc
cmp eax, ebx
je 0x4313fc
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4313fc
push ebx
push ebx
push 0x10
push dword [0x476364]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [0x476364]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x476364], ebx
jmp 0x4313fc
push 1
push ebx
call fcn.00444117
mov eax, dword [0x476364]
add esp, 0xc
cmp eax, ebx
je 0x431780
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push str.SOFTWARE_vTaskColorsResultSuccessFill
mov dword [0x47714c], ebx
call fcn.0044426c
pop ecx
cmp eax, ebx
jne 0x43179a
mov eax, 0xecffec
push eax
push str.RunTrackingAlpha
call fcn.0044426c
pop ecx
push eax
push str.RunTrackingTimeout
call fcn.0044426c
pop ecx
push eax
push ebx
call fcn.0043ec20
lea eax, [eax + eax + 0xa]
push eax
push str.RunTrackingWidth
call fcn.0044426c
pop ecx
push eax
push str.RunTrackingY
call fcn.0044426c
pop ecx
push eax
push str.RunTrackingX
call fcn.0044426c
pop ecx
push eax
push dword [0x472420]
call fcn.00440f71
mov dword [0x476364], eax
jmp 0x4313fc
push 0x46039c
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi + 0x473bec]
pop ecx
je 0x43189d
lea eax, [edi + eax + 0x58]
push 0x459bd0
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x431832
mov dword [ebp - 0x294], ebx
jmp 0x43187e
mov eax, dword [esi + 0x473bec]
lea eax, [edi + eax + 0x58]
push 0x459bc4
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x431859
mov dword [ebp - 0x294], 1
jmp 0x43187e
mov eax, dword [esi + 0x473bec]
lea eax, [edi + eax + 0x58]
push 0x460398
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x43187e
mov dword [ebp - 0x294], 2
mov eax, dword [ebp - 0x294]
push str.LogLevel
push eax
push ebx
mov byte [0x476258], al
call fcn.00444117
add esp, 0xc
jmp 0x4313fc
push str.Highlight
push dword [edi + eax + 0x50]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4313fc
mov eax, dword [esi + 0x473bec]
lea eax, [edi + eax + 0x58]
push 0x459bd0
push eax
call fcn.004010ff
neg eax
sbb eax, eax
inc eax
push str.HiliteRunningStep
push eax
push ebx
mov byte [0x476fe4], al
call fcn.00444117
jmp 0x43152c
add eax, edi
push str.Write_to_Output
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi + 0x473bec]
pop ecx
je 0x4319e6
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + eax + 0x50]
call fcn.00439ea7
mov eax, dword [0x472460]
cmp eax, ebx
je 0x4319c0
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4319c0
push dword [0x4775e4]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
mov ecx, eax
inc ecx
mov eax, 0x103
cmp ecx, eax
jg 0x431952
push dword [0x4775e4]
call esi
inc eax
push eax
push dword [0x4775e4]
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x148]
push eax
push 0xffffffffffffffff
push 0x181
push dword [0x472460]
call esi
push ebx
push ebx
mov edi, 0x18b
push edi
push dword [0x472460]
call esi
dec eax
jns 0x431999
xor eax, eax
jmp 0x4319a5
push ebx
push ebx
push edi
push dword [0x472460]
call esi
dec eax
push ebx
push eax
push 0x197
push dword [0x472460]
call esi
push dword [0x472460]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x4775e4]
cmp eax, ebx
je 0x4319d5
push 0x45b4c0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [0x4775e4]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4313fc
add eax, edi
push str.Write_to_Log
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi + 0x473bec]
pop ecx
je 0x431a57
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + eax + 0x50]
call fcn.00439ea7
mov eax, dword [0x4775e4]
cmp eax, ebx
je 0x431a25
push 0x45b4c0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x148]
push eax
call fcn.0041f17e
push dword [0x4775e4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [0x4775e4]
lea eax, [ebp - 0x148]
push 0xffffffffffffffff
push eax
call fcn.0040f973
jmp 0x4313fc
add eax, edi
push str.Set_Clipboard
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi + 0x473bec]
pop ecx
je 0x431a91
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + eax + 0x50]
call fcn.00439ea7
push dword [0x4775e4]
call fcn.00440709
jmp 0x4313ff
add eax, edi
push str.Paste_Clipboard
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x431af3
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ebx
push 1
push ebx
push 0x11
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x11
call edi
push ebx
push ebx
push ebx
push 0x56
call esi
push eax
push 0x56
call edi
push ebx
push 2
push ebx
push 0x56
call esi
push eax
push 0x56
call edi
push ebx
push 3
push ebx
push 0x11
call esi
push eax
push 0x11
call edi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4313fc
mov eax, dword [esi + 0x473bec]
add eax, edi
push str.Clear_Clipboard
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x431b2c
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x431229
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4313fc
mov eax, dword [esi + 0x473bec]
add eax, edi
push str.Capture
push eax
call fcn.004010ff
pop ecx
test eax, eax
mov eax, dword [esi + 0x473bec]
pop ecx
je 0x431d29
lea eax, [edi + eax + 0x58]
push str.Area
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x431c1e
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x2a4]
push eax
mov eax, dword [esi + 0x473bec]
lea eax, [edi + eax + 0x364]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041eea2
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x29c]
push eax
mov eax, dword [esi + 0x473bec]
lea eax, [edi + eax + 0x468]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041eea2
mov eax, dword [ebp - 0x2a4]
add dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x2a0]
add dword [ebp - 0x298], eax
mov eax, dword [esi + 0x473bec]
push ebx
push ebx
push dword [ebp + 0xc]
lea eax, [edi + eax + 0xcc8]
push dword [ebp + 8]
push eax
call fcn.00439ea7
mov eax, dword [esi + 0x473bec]
lea eax, [edi + eax + 0xc88]
push str.Clipboard
push eax
call fcn.004010ff
pop ecx
pop ecx
push ebx
test eax, eax
push ebx
lea eax, [ebp - 0x2a4]
je 0x431c16
push ebx
push eax
jmp 0x431d1e
push dword [0x4775e4]
jmp 0x431c10
mov eax, dword [esi + 0x473bec]
lea eax, [edi + eax + 0x58]
push str.Window
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x431cd9
mov eax, dword [0x472468]
cmp eax, ebx
je 0x431c76
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x431c76
push 0xfffffffffffffff0
push dword [0x472468]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
je 0x431c76
push dword [0x472468]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x431c8c
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [0x472468], eax
mov eax, dword [esi + 0x473bec]
push ebx
push ebx
push dword [ebp + 0xc]
lea eax, [edi + eax + 0xcc8]
push dword [ebp + 8]
push eax
call fcn.00439ea7
mov eax, dword [esi + 0x473bec]
lea eax, [edi + eax + 0xc88]
push str.Clipboard
push eax
call fcn.004010ff
pop ecx
pop ecx
push ebx
push ebx
test eax, eax
je 0x431cd1
push ebx
push ebx
push dword [0x472468]
jmp 0x431d1f
push dword [0x4775e4]
jmp 0x431cc8
mov eax, dword [esi + 0x473bec]
push ebx
push ebx
push dword [ebp + 0xc]
lea eax, [edi + eax + 0xcc8]
push dword [ebp + 8]
push eax
call fcn.00439ea7
mov eax, dword [esi + 0x473bec]
lea eax, [edi + eax + 0xc88]
push str.Clipboard
push eax
call fcn.004010ff
pop ecx
pop ecx
push ebx
push ebx
test eax, eax
je 0x431d17
push ebx
jmp 0x431d1d
push dword [0x4775e4]
push ebx
push ebx
call fcn.004113b6
jmp 0x4313ff
add eax, edi
push str.Logoff
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x431d5c
mov eax, dword [ebp + 0xc]
inc eax
push eax
push str.Logoff_at__Step__d_...
call fcn.0042036e
pop ecx
pop ecx
push ebx
push ebx
call fcn.00444b1c
movzx eax, al
jmp 0x4313ff
mov eax, dword [esi + 0x473bec]
add eax, edi
push str.Restart
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x431d90
mov eax, dword [ebp + 0xc]
inc eax
push eax
push str.Rebooting_at__Step__d_...
call fcn.0042036e
pop ecx
pop ecx
push dword [0x472420]
push 6
jmp 0x431d4f
mov eax, dword [esi + 0x473bec]
add eax, edi
push str.Shutdown
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x431dc4
mov eax, dword [ebp + 0xc]
inc eax
push eax
push str.Shutdown_at__Step__d_...
call fcn.0042036e
pop ecx
pop ecx
push dword [0x472420]
push 5
jmp 0x431d4f
mov eax, dword [esi + 0x473bec]
add eax, edi
push 0x460298
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4313fc
cmp dword [ebp + 0x10], ebx
jne 0x431e0b
mov eax, dword [ebp + 8]
shl eax, 0x14
add eax, dword [ebp + 0xc]
push eax
push 0x380d8
push 0x111
push dword [0x472420]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4313ff
mov eax, dword [esi + 0x473bec]
mov eax, dword [edi + eax + 0x50]
push 0x3d
push eax
call fcn.00445cc0
pop ecx
pop ecx
mov dword [ebp - 0x290], eax
cmp eax, ebx
je 0x431f24
mov eax, dword [esi + 0x473bec]
mov eax, dword [edi + eax + 0x50]
push 0x28
push eax
call fcn.00445cc0
pop ecx
pop ecx
cmp dword [ebp - 0x290], eax
jae 0x431f24
mov eax, dword [esi + 0x473bec]
mov eax, dword [edi + eax + 0x50]
push 0x25
push eax
call fcn.00445cc0
pop ecx
pop ecx
test eax, eax
je 0x431f24
mov eax, dword [esi + 0x473bec]
push dword [edi + eax + 0x50]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cmp eax, 0x3f
jle 0x431e84
push 0x3f
pop eax
jmp 0x431e95
mov eax, dword [esi + 0x473bec]
push dword [edi + eax + 0x50]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov eax, dword [esi + 0x473bec]
push dword [edi + eax + 0x50]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov al, byte [ebp - 0x44]
cmp al, bl
je 0x431edf
cmp al, 0x20
je 0x431ec1
cmp al, 9
je 0x431ec1
cmp al, 0xd
je 0x431ec1
cmp al, 0xa
jne 0x431edf
lea eax, [ebp - 0x43]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x43]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00446570
add esp, 0xc
jmp 0x431eaa
lea ecx, [ebp - 0x44]
mov al, byte [ecx]
cmp al, bl
je 0x431ef7
cmp al, 0x20
je 0x431ef3
cmp al, 0x3d
je 0x431ef3
inc ecx
jmp 0x431ee2
mov byte [ecx], bl
jmp 0x431ee2
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x431f1f
lea ecx, [ebp + eax - 0x44]
mov dl, byte [ecx]
cmp dl, 0x20
je 0x431f1d
cmp dl, 9
je 0x431f1d
cmp dl, 0xd
je 0x431f1d
cmp dl, 0xa
jne 0x431f24
mov byte [ecx], bl
dec eax
cmp eax, ebx
jg 0x431f03
mov eax, dword [esi + 0x473bec]
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + eax + 0x50]
call fcn.00439ea7
push 1
push ebx
push dword [0x4775e4]
lea eax, [ebp - 0x148]
push eax
call fcn.004205d6
mov edi, eax
cmp edi, 0x69f6f36
je 0x431229
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [ebp - 0x148]
push 0x45aac0
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00423053
cmp byte [ebp - 0x44], bl
je 0x431fcd
cmp byte [ebp - 0x44], 0x25
lea eax, [ebp - 0x43]
je 0x431fa7
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28c]
push str.SOFTWARE_vTaskUserVariables_s
push eax
call esi
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x148]
push ebx
push eax
call fcn.00444117
add esp, 0x18
xor eax, eax
inc eax
cmp edi, eax
jl 0x4313ff
mov eax, edi
jmp 0x4313ff