Function at 0x4433cd
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x2df4
call fcn.0049e430
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x2df0], eax
mov eax, dword [esp + 0x2df8]
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x2e00]
push esi
mov esi, dword [esp + 0x2e0c]
mov dword [esp + 8], ebp
cmp ecx, 0x4e
jne 0x4440c3
mov ecx, dword [esi + 8]
push edi
xor edi, edi
xor eax, eax
cmp dword [eax + 0x4bf0dc], ecx
je 0x443398
add eax, 4
cmp eax, 0x1c
jb 0x443386
jmp 0x4433ab
mov eax, dword [0x4dc1c8]
push edi
push edi
push 0x400
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esi + 8]
add eax, 0x9b
push ebx
cmp eax, 0x9a
ja case.0x443441.10
movzx ecx, byte [eax + 0x444108]
jmp dword [ecx*4 + 0x4440dc]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebx
movzx edi, ax
shr edi, 0xf
push 0x12
and edi, 1
call ebx
movzx ebp, ax
shr ebp, 0xf
push 0x11
and ebp, 1
call ebx
movzx ebx, ax
shr ebx, 0xf
and ebx, 1
cmp word [esi + 0xc], 0x79
jne 0x443412
test edi, edi
jne 0x443409
test ebp, ebp
je 0x443422
mov ecx, dword [esp + 0x10]
call fcn.0043fcb0
test edi, edi
jne case.0x443441.10
test ebp, ebp
jne case.0x443441.10
test ebx, ebx
jne case.0x443441.10
movzx eax, word [esi + 0xc]
add eax, 0xfffffff7
cmp eax, 0x6b
ja case.0x443441.10
movzx edx, byte [eax + 0x4441c4]
jmp dword [edx*4 + 0x4441a4]
call fcn.0049ed5d
mov ecx, dword [esp + 0x10]
push 0
push 1
mov dword [0x4ed110], eax
call fcn.00442e90
call fcn.0049ed5d
mov dword [0x4ed110], eax
jmp case.0x443441.10
mov ecx, dword [esp + 0x10]
call fcn.0043fc20
jmp case.0x443441.10
mov eax, dword [0x4dc1c8]
push 0
push 0xb4
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.0x443441.10
mov ecx, dword [esp + 0x10]
call fcn.0043dd10
jmp case.0x443441.10
mov ecx, 0x4dfed0
call fcn.00406c30
jmp case.0x443441.10
cmp dword [0x4dbc5c], 0
mov ecx, 0x4dfee0
je 0x4434c8
call fcn.00442500
jmp case.0x443441.10
call fcn.00441940
jmp case.0x443441.10
cmp dword [0x4dbc64], 0
je case.0x443441.10
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx]
jne case.0x443441.10
mov edx, dword [0x4dbc64]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x443441.10
push edi
push str.SingleClick
push str.FileList
call fcn.00456960
test eax, eax
je case.0x443441.10
mov ecx, ebp
call fcn.0043db80
test eax, eax
je case.0x443441.10
call fcn.0049ed5d
sub eax, dword [0x4ed110]
cmp eax, 0x3e8
jle case.0x443441.10
push edi
push 1
mov ecx, ebp
call fcn.00442e90
xor eax, eax
pop ebx
pop edi
mov ecx, dword [esp + 0x2df8]
pop esi
pop ebp
xor ecx, esp
call fcn.0049dea6
add esp, 0x2df4
ret 0x10
mov ecx, ebp
call fcn.0043db80
test eax, eax
je case.0x443441.10
jmp 0x443526
call fcn.00422b10
jmp case.0x443441.10
mov eax, dword [esi + 0x10]
push eax
mov ecx, ebp
call fcn.00440f00
jmp case.0x443441.10
mov ecx, 0x4e0c08
call fcn.00411260
cmp dword [0x4dbd58], edi
jne 0x44369d
cmp byte [ebp + 0xc1e], 0
jne 0x44369d
cmp dword [0x4dbc5c], edi
je 0x4435a7
test al, 0x40
jne 0x4435a7
cmp byte [ebp + 0x1c], 0
je 0x44369d
cmp byte [ebp + 0x1c], 0
je 0x4435bf
xor ecx, ecx
mov byte [ebp + 0x1d], 0
mov word [ebp + 0x41e], cx
jmp case.0x443441.10
mov ecx, dword [ebp]
mov edx, dword [esi + 0x10]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x14]
push eax
push edi
push 0x1005
push ecx
mov dword [esp + 0x24], 4
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edi
call ebx
test eax, eax
je 0x44369d
mov edx, dword [esp + 0x34]
push edx
lea eax, [esp + 0xdd4]
push eax
mov ecx, 0x4ecbf8
call fcn.0043cd40
push 0x400
lea ecx, [esp + 0xdd4]
push ecx
lea edi, [ebp + 0x1d]
call fcn.0044db30
push eax
push edi
call fcn.00465320
push 0x400
lea edx, [esp + 0x11d4]
push edx
lea esi, [ebp + 0x41e]
call fcn.0044dbb0
push eax
push esi
call fcn.00465360
mov eax, dword [ebp]
push 0
push 0
push 0x1018
push eax
call ebx
cmp word [esi], 0
je 0x443661
push esi
push eax
call fcn.0047deb0
jmp 0x443669
push edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, 0x4b1a5c
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x443690
test dl, dl
je 0x44368c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x443690
add eax, 2
add ecx, 2
test dl, dl
jne 0x443670
xor eax, eax
jmp 0x443695
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne case.0x443441.10
mov eax, 1
jmp 0x443532
mov byte [0x4ecd10], 0
mov ecx, dword [esi + 0x20]
mov dword [esp + 0x10], edi
mov byte [esp + 0x2600], 0
cmp ecx, edi
jne 0x443706
cmp byte [ebp + 0x1c], 0
je case.0x443441.10
mov eax, dword [ebp]
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0x14]
push edx
push edi
push 0x1005
mov ebx, 1
push eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x38], 0x4ecd10
mov dword [esp + 0x3c], 0x400
mov dword [esp + 0x24], ebx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x443764
mov edx, 0x4ecd10
mov ebx, 1
mov al, byte [ecx]
mov byte [edx], al
add ecx, ebx
add edx, ebx
test al, al
jne 0x443710
mov esi, dword [esi + 0x2c]
cmp esi, dword [0x4eccfc]
jae 0x443764
push esi
lea ecx, [esp + 0xdd4]
push ecx
mov ecx, 0x4ecbf8
call fcn.0043cd40
push 0x400
lea edx, [esp + 0xdd4]
push edx
lea eax, [esp + 0x2608]
push eax
call fcn.00465320
lea ecx, [esp + 0x2600]
push ecx
call fcn.0044db30
mov byte [eax], 0
cmp byte [0x4ecd10], 0
je case.0x443441.10
cmp byte [ebp + 0x1c], 0
je 0x4438e9
mov byte [ebp + 0x1c], 0
cmp dword [0x4dbc5c], edi
je 0x4438c2
lea edx, [esp + 0x1a00]
push edx
push str.Rar_MDXXXXXX
call fcn.0047f0a0
test al, al
je 0x443b88
xor eax, eax
jmp 0x4437b0
mov cl, byte [esp + eax + 0x1a00]
mov byte [esp + eax + 0x1e00], cl
inc eax
test cl, cl
jne 0x4437b0
lea eax, [esp + 0x1e00]
push eax
call fcn.0044dfb0
mov eax, 0x4ecd10
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4437d7
lea edi, [esp + 0x1e00]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4437e8
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [esp + 0x1e04]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4438a2
call fcn.0047b4b0
push 0
push 0x4e758c
mov ecx, 0x4e0c08
call fcn.00413690
mov ecx, dword [0x4e818c]
lea edx, [esp + 0x1e00]
push edx
call fcn.00465910
push 0
push 0x4e46b8
mov ecx, 0x4e0c08
mov dword [0x4e576c], 2
mov dword [0x4e5768], 1
mov byte [0x4e57a7], 0
call fcn.00413650
mov eax, dword [0x4e0e10]
push 0
mov ecx, 0x4e0c08
mov dword [0x4e613c], eax
call fcn.004154f0
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0x1e00]
push ecx
call esi
lea edx, [esp + 0x1a00]
push edx
call esi
jmp 0x443b88
lea eax, [esp + 0x1e00]
push eax
push 0x1f7
call fcn.0045bde0
push eax
call fcn.0048e100
add esp, 8
jmp 0x443b7e
push edi
push 0x4ecd10
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x443b5f
cmp byte [0x4ecd10], al
je 0x443b88
push 0x4ecd10
jmp 0x4438aa
cmp dword [0x4dbc5c], edi
je 0x443b45
lea ecx, [esp + 0xdd0]
push ecx
mov ecx, ebp
call fcn.0043ed10
test al, al
je 0x443937
push 0x400
lea edx, [esp + 0xdd4]
push edx
lea eax, [ebp + 0x1d]
push eax
call fcn.00465320
push 0x400
lea ecx, [esp + 0x11d4]
push ecx
lea edx, [ebp + 0x41e]
push edx
call fcn.00465360
push edi
call fcn.0047b410
call fcn.004771b0
push 0x4e798c
push 0x4e758c
mov ecx, 0x4e0c08
call fcn.00413690
mov eax, dword [0x4e0e10]
push edi
push str.FlatView
push str.FileList
mov dword [0x4e613c], eax
call fcn.00456960
test eax, eax
je 0x443996
xor eax, eax
jmp 0x443980
mov cl, byte [esp + eax + 0x2600]
mov byte [esp + eax + 0x1a00], cl
add eax, ebx
test cl, cl
jne 0x443980
jmp 0x4439b6
push edi
lea ecx, [esp + 0x1a04]
push ecx
mov ecx, 0x4e0c08
call fcn.00413650
lea edx, [esp + 0x1a00]
push edx
call fcn.0044dfb0
mov ecx, dword [0x4e818c]
lea eax, [ebp + 0x41e]
push eax
lea ebx, [ebp + 0x1d]
push ebx
mov dword [esp + 0x44], eax
call fcn.00465600
xor eax, eax
jmp 0x4439e0
mov cl, byte [esp + eax + 0x1a00]
mov byte [esp + eax + 0x1e00], cl
inc eax
test cl, cl
jne 0x4439e0
mov eax, 0x4ecd10
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x443a00
lea edi, [esp + 0x1e00]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x443a11
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x4e819c]
call fcn.00465590
mov ecx, dword [0x4e819c]
lea eax, [esp + 0x1e00]
push eax
call fcn.00465910
push 0
push 0
push 0
lea ecx, [esp + 0x1e0c]
push ecx
mov ecx, 0x4ecbf8
call fcn.0043ce40
test al, al
je 0x443acf
lea edx, [esp + 0x1e00]
push edx
push ebx
call fcn.004652e0
test eax, eax
jne 0x443aa9
lea ecx, [esp + 0x1e00]
mov eax, ebx
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x443aa0
test dl, dl
je 0x443a9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x443aa0
add eax, 2
add ecx, 2
test dl, dl
jne 0x443a80
xor eax, eax
jmp 0x443aa5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x443acf
push 0
push 0x4ecd10
mov ecx, ebp
call fcn.00440b60
push 0x50d
call fcn.0045bde0
push eax
call fcn.0048e100
add esp, 4
jmp 0x443b88
cmp byte [0x4ecd10], 0
mov esi, 0x4ecd10
je 0x443b07
lea ecx, [ecx]
movsx eax, byte [esi]
push eax
mov eax, dword [str._____:]
push eax
call fcn.0049db10
add esp, 8
test eax, eax
jne 0x443b88
push esi
call fcn.00405ab0
mov esi, eax
cmp byte [esi], 0
jne 0x443ae0
push 0
lea ecx, [esp + 0x1a04]
push ecx
call fcn.0044d8f0
test al, al
jne 0x443b88
push 0
push ebx
call fcn.0044d8f0
test al, al
je 0x443b39
mov edx, dword [esp + 0x3c]
cmp word [edx], 0
je 0x443b88
cmp dword [0x4e0e10], 0
jne 0x443b88
mov ecx, 0x4e0c08
call fcn.004112a0
jmp 0x443b88
push edi
lea esi, [ebp + 0x1d]
push 0x4ecd10
add ebp, 0x41e
push ebp
push esi
call fcn.0042fc50
test al, al
je 0x443b65
mov dword [esp + 0x10], ebx
jmp 0x443b88
push 0x4ecd10
push esi
push 0x207
call fcn.0045bde0
push eax
call fcn.0048e100
add esp, 0xc
mov ecx, 0x4c9364
call fcn.00427d40
mov eax, dword [0x4dc1c8]
push 0x4ecd10
push 0
push 0x402
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x10]
jmp 0x443532
push 0x30
push 0x65
call fcn.0045bde0
push eax
push 0x1f4
call fcn.0045bde0
mov ecx, dword [0x4dc1c8]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp case.0x443441.10
mov eax, dword [esi + 0xc]
sub eax, 1
je 0x443c64
sub eax, 0x10000
jne case.0x443441.10
cmp dword [0x4bf0d4], 0xffffffff
jne 0x443c22
push 0xff0000
push str.AltColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.00456960
push 0xd9213
push str.AltEncryptionColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov dword [0x4bf0d4], eax
call fcn.00456960
mov dword [0x4ecd0c], eax
mov edx, dword [esi + 0x2c]
push edx
lea eax, [esp + 0x44]
push eax
mov ecx, 0x4ecbf8
call fcn.0043cd40
mov eax, dword [eax + 0xc10]
test eax, 0x800
je 0x443c4b
mov ecx, dword [0x4bf0d4]
mov dword [esi + 0x30], ecx
test eax, 0x4000
je case.0x443441.10
mov edx, dword [0x4ecd0c]
mov dword [esi + 0x30], edx
jmp case.0x443441.10
movzx eax, byte [0x4e0c04]
neg eax
sbb eax, eax
and eax, 0x20
jmp 0x443532
test byte [esi + 0xc], 2
je case.0x443441.10
mov eax, dword [esi + 0x2c]
push eax
lea ecx, [esp + 0xdd4]
push ecx
mov ecx, 0x4ecbf8
call fcn.0043cd40
cmp dword [0x4ecd08], edi
jne 0x443cb9
mov dword [0x4ecd08], 0x4401
call fcn.0047e520
test al, al
jne 0x443cb9
or dword [0x4ecd08], 0x10
call fcn.0043ca60
test eax, eax
je 0x443e08
cmp word [esp + 0x11d0], di
je 0x443e08
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edx, [esp + 0x2600]
push edx
push 0x400
call edi
mov eax, dword [0x4ecd04]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x443d27
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x443d1a
push str.SHGetFileInfoW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4ecd04], eax
jmp 0x443d1f
mov eax, dword [0x4ecd04]
test eax, eax
je 0x443dc9
mov ecx, dword [0x4ecd08]
push ecx
mov ecx, dword [esp + 0x19e4]
push 0x2b4
lea edx, [esp + 0x1a08]
push edx
push ecx
lea edx, [esp + 0x11e0]
push edx
call eax
test eax, eax
je 0x443dc9
push 0x1000000
lea eax, [esp + 0xc74]
push eax
lea ecx, [esp + 0x1c1c]
push ecx
call fcn.0046d7a0
cmp byte [esp + 0xc70], 0
jne 0x443d8c
lea edx, [esp + 0xc70]
push edx
lea eax, [esp + 0xdd4]
push eax
mov ecx, ebp
call fcn.0043dd50
mov ecx, dword [0x4dbc5c]
add ecx, 2
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0xc74]
push ecx
mov dword [esp + 0x30], edx
mov edx, dword [ebp]
push 0x102e
push edx
call ebx
mov eax, dword [esp + 0x1a04]
or dword [esi + 0xc], 0x1000
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x1e00]
push ecx
push 0x400
call edi
lea edx, [esp + 0x1e00]
push edx
lea eax, [esp + 0x2604]
push eax
call fcn.0046dbd0
test eax, eax
je 0x443f09
lea ecx, [esp + 0x2600]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x443f09
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0x2600]
push edx
push 0x400
call edi
mov eax, dword [0x4ecd08]
mov edx, dword [esp + 0x19e0]
push eax
push 0x160
lea ecx, [esp + 0xc78]
push ecx
push edx
lea eax, [esp + 0xde0]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x443ead
cmp byte [esp + 0xd80], 0
jne 0x443e71
lea ecx, [esp + 0xd80]
push ecx
lea edx, [esp + 0xdd4]
push edx
mov ecx, ebp
call fcn.0043dd50
mov eax, dword [0x4dbc5c]
add eax, 2
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x10]
lea ecx, [esp + 0xd84]
push eax
mov dword [esp + 0x30], ecx
mov ecx, dword [ebp]
push 0x102e
push ecx
call ebx
mov edx, dword [esp + 0xc74]
or dword [esi + 0xc], 0x1000
mov dword [esi + 0x28], edx
lea eax, [esp + 0x1e00]
push eax
push 0x400
call edi
lea ecx, [esp + 0x1e00]
lea eax, [esp + 0x2600]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x443ef0
test dl, dl
je 0x443eec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x443ef0
add eax, 2
add ecx, 2
test dl, dl
jne 0x443ed0
xor eax, eax
jmp 0x443ef5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x443f09
lea ecx, [esp + 0x2600]
push ecx
call fcn.004ac458
add esp, 4
test dword [esi + 0xc], 0x1000
jne case.0x443441.10
lea edx, [esp + 0xc70]
push edx
lea eax, [esp + 0xdd4]
push eax
mov ecx, ebp
call fcn.0043dd50
mov ecx, dword [0x4dbc5c]
add ecx, 2
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0xc74]
push ecx
mov dword [esp + 0x30], edx
mov edx, dword [ebp]
push 0x102e
push edx
call ebx
lea eax, [esp + 0x11d0]
push eax
lea ecx, [esp + 0xdd4]
push ecx
call fcn.0042f9f0
push 0x400
lea edx, [esp + 0x1e04]
push edx
mov edi, eax
call fcn.0047e2d0
lea eax, [esp + 0x1e00]
push eax
call fcn.0044dfb0
lea eax, [esp + 0x1e00]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x443f97
mov ecx, dword [str._rar_icon_]
mov edx, dword [0x4b3674]
mov dword [eax], ecx
mov cx, word [0x4b3678]
mov dword [eax + 4], edx
mov dl, byte [0x4b367a]
mov word [eax + 8], cx
push edi
mov byte [eax + 0xa], dl
call fcn.0042f9a0
test al, al
je 0x444037
mov eax, dword [0x4bf0d0]
cmp eax, 0xffffffff
jne 0x4440b4
push 0
lea eax, [esp + 0x1e04]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x444022
push 0x4001
push 0x160
lea ecx, [esp + 0x1a08]
push ecx
push 0
lea edx, [esp + 0x1e10]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x444022
mov eax, dword [esp + 0x1a04]
mov dword [0x4bf0d0], eax
lea ecx, [esp + 0x1e00]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, dword [0x4bf0d0]
jmp 0x4440ab
mov eax, dword [0x4bf0cc]
cmp eax, 0xffffffff
jne 0x4440b4
lea edx, [esp + 0x1e00]
push 0x4b1ba8
push edx
call fcn.0049f748
add esp, 8
test eax, eax
je 0x444096
push eax
call fcn.0049f426
add esp, 4
push 0x4001
push 0x160
lea eax, [esp + 0x1a08]
push eax
push 0
lea ecx, [esp + 0x1e10]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x444096
mov edx, dword [esp + 0x1a04]
mov dword [0x4bf0cc], edx
lea eax, [esp + 0x1e00]
push eax
call fcn.004a124d
mov eax, dword [0x4bf0cc]
add esp, 4
cmp eax, 0xffffffff
je case.0x443441.10
or dword [esi + 0xc], 0x1000
mov dword [esi + 0x28], eax
jmp case.0x443441.10
mov edx, dword [esp + 0x2e08]
push esi
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x443534