Function at 0x41e0c0
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Hide graphical window
Log keystrokes via polling
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447900
push 0x446cec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x1d24
call fcn.00446c80
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0xc]
cmp esi, 0x87d0
jl 0x41e2fc
cmp esi, dword [0x45bde8]
jge 0x41e2fc
mov dword [ebp - 0x1c], 0
sub esi, 0x87d0
lea eax, [ebp - 0x120]
push eax
call fcn.00407c13
push 0x44c34c
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x41f55a
push ebx
push 0x104
lea edx, [ebp - 0x120]
push edx
mov edi, dword [sym.imp.MSVCRT.dll_fgets]
call edi
add esp, 0xc
test byte [ebx + 0xc], 0x10
jne 0x41e2dc
push ebx
push 0x1000
lea eax, [ebp - 0x1120]
push eax
call edi
add esp, 0xc
test byte [ebx + 0xc], 0x10
jne 0x41e2dc
mov al, byte [ebp - 0x1120]
test al, al
je 0x41e143
mov al, byte [ebp - 0x120]
test al, al
je 0x41e143
lea edi, [ebp - 0x120]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ebp + ecx - 0x121], 0xa
jne 0x41e1c6
lea edi, [ebp - 0x120]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x121], al
lea edi, [ebp - 0x1120]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ebp + ecx - 0x1121], 0xa
jne 0x41e1f7
lea edi, [ebp - 0x1120]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x1121], al
mov al, byte [ebp - 0x1120]
test al, al
je 0x41e143
mov al, byte [ebp - 0x120]
test al, al
je 0x41e143
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
cmp ecx, esi
jne 0x41e143
push str.http:__
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 8
test eax, eax
jne 0x41e28d
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41e28d
test al, 0x10
je 0x41e28d
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp + 8]
push edx
push 1
call fcn.0042f695
add esp, 0xc
call fcn.00431ae3
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004305d0
lea eax, [ebp - 0x120]
push eax
call fcn.00430867
add esp, 4
mov al, byte [0x45dea4]
test al, al
je 0x41e2b6
push 0xc4653600
call fcn.004311db
jmp 0x41e2bd
push 0
call fcn.00430e77
add esp, 4
push 0x45bbe0
push 0x45c0c0
call fcn.00430cb4
add esp, 8
call fcn.00431ae3
call fcn.0042fb16
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x7fff
jl 0x41e447
cmp esi, dword [0x45c0a8]
jge 0x41e447
xor ebx, ebx
mov byte [ebp - 0x1320], bl
cmp esi, 0x8000
jl 0x41e3cb
mov dword [ebp - 0x134c], 0x2c
mov dword [ebp - 0x1348], 0x30
mov dword [ebp - 0x1344], ebx
mov ecx, 8
xor eax, eax
lea edi, [ebp - 0x1340]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x1320]
mov dword [ebp - 0x1328], ecx
mov dword [ebp - 0x1324], 0x200
lea edx, [ebp - 0x134c]
push edx
push ebx
push esi
mov eax, dword [0x45bf14]
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoA]
mov eax, dword [ebp - 0x132c]
cmp eax, 1
jne 0x41e3a8
lea edi, [ebp - 0x1320]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, dword [str..zip]
mov dword [edi], ecx
mov dl, byte [0x44da58]
mov byte [edi + 4], dl
jmp 0x41e3cb
cmp eax, 2
jne 0x41e3cb
lea edi, [ebp - 0x1320]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [str..wsz]
mov dword [edi], eax
mov cl, byte [0x44d8c8]
mov byte [edi + 4], cl
xor eax, eax
mov cl, byte [ebp + eax - 0x1320]
mov byte [eax + 0x45e460], cl
inc eax
test cl, cl
jne 0x41e3cd
push ebx
push 0x9d63
push 0x111
mov edx, dword [0x45b980]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, 0x28
cmp dword [0x45ad60], esi
jne 0x41f55a
cmp dword [0x45ad64], ebx
je 0x41f55a
mov dword [0x45ad60], ebx
push 1
call fcn.00427280
mov dword [0x45ad60], esi
push 1
call fcn.00427280
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x9cf9
jg 0x41e9ff
je 0x41e9cd
lea eax, [esi - 0x9c41]
cmp eax, 0xa4
ja case.0x41ea18.40215
xor ecx, ecx
mov cl, byte [eax + 0x41f780]
jmp dword [ecx*4 + 0x41f720]
mov cl, byte [0x45e9e0]
test cl, cl
sete dl
mov byte [0x45e9e0], dl
push 1
call fcn.004346b8
mov eax, dword [0x4528a0]
push eax
xor ecx, ecx
mov cl, byte [0x45e9e0]
push ecx
push 1
call fcn.004105d0
add esp, 0x10
push 0
push 0x2a
push 0x113
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
mov al, byte [0x44ae63]
push eax
call fcn.00434240
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45c230]
test eax, eax
je 0x41f708
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x41f708
sub esi, 0x9c7c
neg esi
sbb esi, esi
and esi, 0xffffd8f0
add esi, 0x1388
mov eax, dword [0x45289c]
test eax, eax
je 0x41f55a
call fcn.00419bc0
add eax, esi
jns 0x41e529
xor eax, eax
push eax
call fcn.00419d10
add esp, 4
push 0
test eax, eax
jge 0x41e55f
push 0
push 0x402
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00419bc0
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
push edx
call fcn.00438d6a
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1354], 6
mov dword [ebp - 0x1350], 0xd
mov al, byte [0x45e0e6]
test al, al
je 0x41e5c7
mov dword [ebp - 0x1354], 0xc
mov dword [ebp - 0x1350], 0x1a
lea ecx, [ebp - 0x1354]
push ecx
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.USER32.dll_ClientToScreen]
cmp dword [ebp - 0x1354], 0xbb8
jg 0x41e5f0
cmp dword [ebp - 0x1350], 0xbb8
jle 0x41e5fd
lea edx, [ebp - 0x1354]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
push esi
push 0
mov eax, dword [ebp - 0x1350]
push eax
mov ecx, dword [ebp - 0x1354]
push ecx
push 2
mov edx, dword [0x45bf14]
push edx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push esi
mov edx, dword [ebp + 8]
push edx
call fcn.0041f940
add esp, 0x10
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push esi
mov edx, dword [ebp + 8]
push edx
call fcn.0041fa40
add esp, 0x10
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push esi
mov edx, dword [ebp + 8]
push edx
call fcn.0041fb30
add esp, 0x10
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push esi
mov edx, dword [ebp + 8]
push edx
call fcn.0041fb60
add esp, 0x10
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push esi
mov edx, dword [ebp + 8]
push edx
call fcn.0041fc90
add esp, 0x10
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x452890]
test eax, eax
jne 0x41e725
mov eax, dword [ebp + 8]
push 0
push eax
push 1
call fcn.0042f695
add esp, 0xc
call fcn.00431ae3
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call fcn.00427280
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dl, byte [0x45e0e5]
test dl, dl
sete cl
mov byte [0x45e0e5], cl
push 0
call fcn.004346b8
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dl, byte [0x45e0e6]
test dl, dl
sete dl
mov byte [0x45e0e6], dl
push 1
call fcn.004346b8
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, byte [0x45dea4]
test bl, bl
sete al
mov byte [0x45dea4], al
neg al
sbb eax, eax
and eax, 8
push eax
push 0x9c57
mov eax, dword [0x45bf14]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
xor ecx, ecx
mov cl, byte [0x45dea4]
push ecx
call fcn.0040d840
add esp, 8
mov al, byte [0x45dea4]
test al, al
je 0x41f55a
call fcn.0043100f
mov al, byte [0x45dea4]
test al, al
je 0x41f55a
mov eax, dword [0x45289c]
test eax, eax
jne 0x41f55a
push 0xc4653600
call fcn.004311db
push 0x45bbe0
push 0x45c0c0
call fcn.00430cb4
add esp, 0xc
mov eax, dword [0x45289c]
test eax, eax
je 0x41ee7e
call fcn.00419bd0
jmp 0x41ee83
mov bl, byte [0x45eb09]
test bl, bl
sete al
mov byte [0x45eb09], al
neg al
sbb eax, eax
and eax, 8
push eax
push 0x9c56
mov edx, dword [0x45bf14]
push edx
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
xor eax, eax
mov al, byte [0x45eb09]
push eax
call fcn.0040d8b0
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push ecx
call fcn.00415539
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
call fcn.00431b1b
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x45eb08], 0
push 8
push 0x9c65
mov eax, dword [0x45bf14]
push eax
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
call esi
push 0
push 0x9c66
mov ecx, dword [0x45bf14]
push ecx
call esi
push 0
push 0x2a
push 0x113
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x45eb08], 1
push 0
push 0x9c65
mov eax, dword [0x45bf14]
push eax
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
call esi
push 8
jmp 0x41e91e
mov al, byte [0x44ae60]
cmp al, 0xfb
ja 0x41e982
add al, 4
jmp 0x41e984
or al, 0xff
mov byte [0x44ae60], al
xor ecx, ecx
mov cl, al
push ecx
call fcn.00419c30
push 0
xor edx, edx
mov dl, byte [0x44ae60]
push edx
call fcn.0040d920
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [0x44ae60]
cmp al, 3
jbe 0x41e9c9
add al, 0xfc
jmp 0x41e984
xor al, al
jmp 0x41e984
mov eax, dword [0x452890]
test eax, eax
jne 0x41e9d9
mov eax, dword [ebp + 8]
push eax
push 1
call fcn.0042f842
add esp, 8
call fcn.00431ae3
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi - 0x9cfa]
cmp eax, 0x99
ja case.0x41ea18.40215
xor ecx, ecx
mov cl, byte [eax + 0x41f8a0]
jmp dword [ecx*4 + 0x41f828]
mov al, byte [esi + 0x448b05]
test al, al
je 0x41f55a
push 0
call fcn.0042fd1e
movsx edx, byte [esi + 0x448b05]
push edx
push str.cda:___c
lea eax, [ebp - 0x1374]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
call fcn.004305d0
lea ecx, [ebp - 0x1374]
push ecx
call fcn.00430867
push 0
call fcn.00430e77
add esp, 0x18
mov al, byte [0x45dea4]
test al, al
je 0x41ea7f
push 0xc4653600
call fcn.004311db
add esp, 4
push 0x45bbe0
push 0x45c0c0
call fcn.00430cb4
add esp, 8
call fcn.0042fb16
call fcn.00431ae3
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x45ad60], 0x32
push 1
call fcn.00427280
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1784]
push edx
lea eax, [ebp - 0x1888]
push eax
push 0
call fcn.00430e83
add esp, 4
push eax
call fcn.004304b6
lea ecx, [ebp - 0x1784]
push ecx
lea edx, [ebp - 0x1888]
push edx
call fcn.00407c67
add esp, 0x14
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004068f0
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ax, word [0x44bfbc]
mov word [ebp - 0x198c], ax
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x198a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x19d0], 0x44
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x19cc]
rep stosd dword es:[edi], eax
push 0x103
lea ecx, [ebp - 0x198b]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [ebp - 0x198c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov edx, dword [str.___NEW]
mov dword [edi], edx
mov ax, word [0x44da44]
mov word [edi + 4], ax
mov cl, byte [0x44da46]
mov byte [edi + 6], cl
push 1
call fcn.00407d64
add esp, 4
lea edx, [ebp - 0x19e0]
push edx
lea eax, [ebp - 0x19d0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x198c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x45ad60], 0x16
push 1
call fcn.00427280
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x45ac20], 1
xor ebx, ebx
push ebx
push ebx
push 0x7e
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x45ac20], ebx
mov eax, dword [0x44ae84]
mov esi, dword [sym.imp.USER32.dll_InvalidateRect]
cmp eax, ebx
je 0x41ec5f
push ebx
push ebx
mov eax, dword [0x45bf04]
push eax
call esi
cmp dword [0x44ae98], ebx
je 0x41ed44
mov dword [ebp - 0x19f0], ebx
mov dword [ebp - 0x19ec], ebx
mov edi, 0xb
mov dword [ebp - 0x19e8], edi
mov ecx, dword [0x44aea0]
mov dword [ebp - 0x19e4], ecx
push ebx
lea edx, [ebp - 0x19f0]
push edx
mov eax, dword [0x45bdf4]
push eax
call esi
mov dword [ebp - 0x19f0], edi
mov dword [ebp - 0x19ec], ebx
mov ecx, dword [0x44ae9c]
mov dword [ebp - 0x19e8], ecx
mov dword [ebp - 0x19e4], 0x14
push ebx
lea edx, [ebp - 0x19f0]
push edx
mov eax, dword [0x45bdf4]
push eax
call esi
mov eax, dword [0x44ae9c]
lea ecx, [eax - 8]
mov dword [ebp - 0x19f0], ecx
mov dword [ebp - 0x19ec], 0x14
mov dword [ebp - 0x19e8], eax
mov edx, dword [0x44aea0]
mov dword [ebp - 0x19e4], edx
push ebx
lea eax, [ebp - 0x19f0]
push eax
mov ecx, dword [0x45bdf4]
push ecx
call esi
mov dword [ebp - 0x19f0], edi
mov eax, dword [0x44aea0]
lea edx, [eax - 0x26]
mov dword [ebp - 0x19ec], edx
mov ecx, dword [0x44ae9c]
add ecx, 0xfffffff8
mov dword [ebp - 0x19e8], ecx
mov dword [ebp - 0x19e4], eax
push ebx
lea edx, [ebp - 0x19f0]
push edx
mov eax, dword [0x45bdf4]
push eax
call esi
cmp dword [0x44ae74], ebx
je 0x41ed57
push ebx
push ebx
mov ecx, dword [0x45c0a4]
push ecx
call esi
cmp dword [0x450e9c], ebx
je 0x41f55a
push ebx
push ebx
mov edx, dword [0x45c0b4]
push edx
call esi
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x45ad60], 0x28
push 1
call fcn.00427280
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00441db0
test eax, eax
je 0x41edd2
call fcn.00441f40
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
mov eax, dword [0x45b980]
push eax
call fcn.00441dd0
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x45ad60], 0x21
push 1
call fcn.00427280
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [0x44ae62]
xor al, 1
mov byte [0x44ae62], al
cmp al, 1
jne 0x41ee5b
push 0
push 0xc8
push 0x27
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test al, al
jne 0x41f55a
push 0x27
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [0x459584], 0
jmp 0x41e853
call fcn.004301aa
push eax
push 0x459584
push 0x45bbe0
call fcn.0040db30
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [0x45c0c0]
test al, al
je 0x41f55a
push 0x45c0c0
mov eax, dword [0x45b980]
push eax
call fcn.00419dd0
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x44ae8c]
cmp eax, 0xe
jne 0x41ef2a
mov eax, dword [0x45eb04]
cmp eax, 0x74
jge 0x41eefb
mov eax, 0x74
mov dword [0x44ae8c], eax
mov dword [0x45eb04], 0
push 1
call fcn.004346b8
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x45eb04], eax
mov dword [0x44ae8c], 0xe
push 1
call fcn.004346b8
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, byte [0x45e0e4]
test bl, bl
sete cl
mov byte [0x45e0e4], cl
push 1
call fcn.004346b8
add esp, 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x45c0a4]
jne 0x41efa6
mov eax, 1
push eax
call fcn.004106b0
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov cl, byte [0x44ae52]
test cl, cl
sete al
push eax
call fcn.004106b0
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov edx, dword [0x44ae78]
test edx, edx
sete al
mov dword [0x44ae78], eax
test eax, eax
je 0x41f049
mov ecx, dword [0x44ae84]
test ecx, ecx
je 0x41f06a
mov edx, dword [0x44ae88]
cmp edx, 0x15e
jl 0x41f06a
mov ecx, dword [0x44ae8c]
cmp ecx, 0xe
je 0x41f06a
lea eax, [edx - 0xe1]
mov dword [ebp - 0x1a00], eax
add ecx, 0xffffffe6
mov dword [ebp - 0x19fc], ecx
add eax, 0x4d
mov dword [ebp - 0x19f8], eax
add ecx, 0x10
mov dword [ebp - 0x19f4], ecx
push 0
lea edx, [ebp - 0x1a00]
push edx
mov eax, dword [0x45bf04]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x41f065
push 0x15
push 0
push 0
push 0xbb8
push 0xbb8
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x44ae78]
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x9d42
mov edx, dword [0x45bf14]
push edx
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
call fcn.004346b8
mov eax, dword [0x44ae78]
push eax
push 4
call fcn.00423bb0
add esp, 0xc
push 0x45190c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x451938]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1a04], eax
test eax, eax
jne 0x41f0c7
mov esi, dword [0x45b980]
mov eax, dword [0x44ae78]
jmp 0x41f142
cmp eax, 1
jne 0x41f0d9
mov esi, dword [0x45c0a4]
mov eax, dword [0x44ae74]
jmp 0x41f142
cmp eax, 2
jne 0x41f0eb
mov esi, dword [0x45bf04]
mov eax, dword [0x44ae84]
jmp 0x41f142
cmp eax, 3
jne 0x41f0fd
mov esi, dword [0x45bdf4]
mov eax, dword [0x44ae98]
jmp 0x41f142
cmp eax, 4
jne 0x41f10f
mov esi, dword [0x45c0b4]
mov eax, dword [0x450e9c]
jmp 0x41f142
test edi, edi
jne 0x41f139
cmp ebx, 1
jne 0x41f186
mov edi, dword [0x451938]
mov dword [ebp - 0x1a04], 0xffffffff
mov ebx, 2
mov eax, dword [ebp - 0x1a04]
inc eax
jmp 0x41f0b0
mov esi, dword [edi]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test ebx, ebx
jne 0x41f163
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
je 0x41f15c
push eax
push esi
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x41f167
mov ebx, 1
jmp 0x41f167
test eax, eax
jne 0x41f17f
cmp dword [ebp - 0x1a04], 4
jle 0x41f173
mov edi, dword [edi + 0x1c]
mov eax, dword [ebp - 0x1a04]
inc eax
jmp 0x41f0b0
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x45190c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45b980]
push ecx
call fcn.0041a967
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45289c]
test eax, eax
je 0x41f55a
mov eax, dword [0x45c230]
test eax, eax
je 0x41f55a
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x41f55a
mov edx, dword [0x45b980]
push edx
call fcn.0041a930
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 1
mov al, byte [0x45dea4]
test al, al
jne 0x41f24f
push 0xffffffffffffffff
call fcn.00430e83
add esp, 4
test eax, eax
jge 0x41f24f
xor esi, esi
mov al, byte [0x45eb09]
test al, al
je 0x41f24f
mov esi, 1
push 0x3b9aca00
call fcn.00430e83
add esp, 4
test esi, esi
je case.0x41ea18.40215
call fcn.0043051a
test eax, eax
je case.0x41ea18.40215
mov al, byte [0x45dea4]
test al, al
je 0x41f277
push 0xffffffffffffffff
call fcn.004311db
add esp, 4
test eax, eax
jne 0x41f55a
push 0x45bbe0
push 0x45c0c0
call fcn.00430cb4
add esp, 8
mov eax, dword [0x45289c]
push 0
test eax, eax
je 0x41f2b4
call fcn.0042fd1e
add esp, 4
call fcn.0042fb16
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042fd1e
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x452890]
xor edi, edi
cmp eax, edi
jne 0x41f2dd
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a24], eax
mov dword [ebp - 0x1a20], edi
lea ecx, [ebp - 0x1b28]
mov dword [ebp - 0x1a1c], ecx
mov dword [ebp - 0x1a18], 0x450890
mov dword [ebp - 0x1a14], 1
mov dword [ebp - 0x1a10], 0x41e010
mov dword [ebp - 0x1a0c], edi
lea edx, [ebp - 0x1a24]
push edx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov esi, eax
cmp esi, edi
je 0x41f55a
lea eax, [ebp - 0x1c2c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push esi
call fcn.00435e44
add esp, 4
lea ecx, [ebp - 0x1c2c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call fcn.004305d0
mov dl, byte [0x45dea7]
not dl
shr edx, 1
and edx, 1
push edx
lea eax, [ebp - 0x1c2c]
push eax
call fcn.00431768
add esp, 8
test byte [0x45dea7], 1
je 0x41f38a
push edi
push 2
call fcn.00431405
add esp, 8
push edi
call fcn.00430e77
add esp, 4
mov al, byte [0x45dea4]
test al, al
je 0x41f3a9
push 0xc4653600
call fcn.004311db
add esp, 4
push 0x45bbe0
push 0x45c0c0
call fcn.00430cb4
add esp, 8
call fcn.00431ae3
call fcn.0042fb16
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, byte [0x44ae61]
test bl, bl
sete al
mov byte [0x44ae61], al
neg al
sbb eax, eax
and eax, 8
push eax
push 0x9cfa
mov ecx, dword [0x45bf14]
push ecx
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
call fcn.00423be0
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push eax
call fcn.00440b90
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, byte [0x45eb08]
test bl, bl
sete al
mov byte [0x45eb08], al
neg al
sbb eax, eax
and al, 0xf8
add eax, 8
push eax
push 0x9c65
mov ecx, dword [0x45bf14]
push ecx
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
call esi
mov dl, byte [0x45eb08]
neg dl
sbb edx, edx
and edx, 8
push edx
push 0x9c66
mov eax, dword [0x45bf14]
push eax
call esi
push 0
push 0x2a
push 0x113
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45289c]
mov dword [ebp - 0x1c30], eax
test eax, eax
je 0x41f4ea
push 0
call fcn.0042fd1e
add esp, 4
mov ebx, 0xa
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x9c6c
push 0x111
push esi
call edi
dec ebx
jne 0x41f4f8
mov eax, dword [ebp - 0x1c30]
jmp 0x41f551
mov eax, dword [0x45289c]
mov dword [ebp - 0x1c34], eax
test eax, eax
je 0x41f52b
push 0
call fcn.0042fd1e
add esp, 4
mov ebx, 0xa
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x9c70
push 0x111
push esi
call edi
dec ebx
jne 0x41f539
mov eax, dword [ebp - 0x1c34]
test eax, eax
je 0x41f55a
call fcn.0042fb16
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.http:__www.winamp.com_skins_
mov edx, dword [ebp + 8]
push edx
call fcn.0043975c
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x45e100
push 0x45dc80
push str._s_s
lea eax, [ebp - 0x1d38]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x1d38]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov dword [ebp - 0x1d3c], esi
test esi, esi
je 0x41f6b0
push str.winampVisGetHeader
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
xor edx, edx
mov dl, byte [0x45eb0a]
push edx
call dword [eax + 8]
add esp, 4
test eax, eax
je 0x41f689
mov dword [eax + 8], esi
mov ecx, dword [0x45b980]
mov dword [eax + 4], ecx
mov dword [ebp - 4], 0
push eax
call dword [eax + 0x924]
add esp, 4
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x44d088
push 0
push 0
push 0xb
call fcn.004394a8
add esp, 0xc
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, 0x8000
neg ax
sbb eax, eax
neg eax
mov dword [0x45abf8], eax
push 6
mov ecx, dword [0x45b980]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004418f0
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret