Function at 0x4374e0
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x508d4b
mov eax, dword fs:[0]
push eax
sub esp, 0x914
mov eax, dword [0x542040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp ecx, 0x514
jg 0x4387b4
je 0x4386f3
add ecx, 0xfffffc18
cmp ecx, 0xcf
ja case.default.0x438a14
movzx eax, byte [ecx + 0x438d9c]
jmp dword [eax*4 + 0x438cdc]
cmp dword [0x549340], 0
je 0x437573
push 0
push str.showHideWindow
mov ecx, 0x5492d0
call fcn.004347b0
test eax, eax
mov dword [0x5492d8], eax
setne cl
call fcn.0045f2f0
mov eax, 1
jmp 0x438cc0
mov eax, dword [0x5492d8]
test eax, eax
setne cl
call fcn.0045f2f0
mov eax, 1
jmp 0x438cc0
xor ecx, ecx
call fcn.0045b950
push 0x43c330
push 0x7d0
push 0x403
push dword [0x5482c0]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
jmp 0x438cc0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 9
push 0x110a
push dword [0x545fe0]
call esi
push 0
test eax, eax
jne 0x4375e4
push 0x51e7f8
push 0x51e830
jmp 0x438cab
push 9
push 0x110a
push dword [0x545fe0]
call esi
push eax
mov ecx, 0x545fdc
call fcn.00434a40
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x54a114
mov dword [ebp - 0x904], eax
call ebx
lea eax, [ebp - 0x904]
push eax
call fcn.00435aa0
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, eax
push 0x54a114
call edi
push 0x54a14c
call ebx
lea eax, [esi + 0x20]
push eax
call fcn.00435a80
push 0x54a14c
mov dword [ebp - 0x14], eax
call edi
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x110a
push dword [0x545ef4]
call ebx
xor esi, esi
nop
push eax
push 1
push 0x110a
push dword [0x545ef4]
call ebx
test eax, eax
je 0x43767a
inc esi
cmp esi, 7
jl 0x437660
xor esi, esi
test eax, eax
je 0x4376b4
push eax
push 4
push 0x110a
push dword [0x545ef4]
call ebx
push eax
mov ecx, 0x545ef0
call fcn.0043e3e0
test eax, eax
je 0x4376b4
mov ecx, dword [eax + 0xc]
shr ecx, 0x12
test cl, 1
jne 0x4376b4
mov esi, dword [eax + 8]
test esi, esi
je 0x4376cf
mov esi, dword [esi + 8]
xorps xmm0, xmm0
xor edx, edx
movlpd qword [ebp - 0x910], xmm0
test esi, esi
je 0x4376dc
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x4376e8
xorps xmm0, xmm0
xor edx, edx
movlpd qword [ebp - 0x910], xmm0
mov ecx, dword [ebp - 0x910]
mov eax, dword [ebp - 0x90c]
push edx
mov edx, dword [ebp - 0x14]
push eax
push ecx
mov edx, dword [edx + 0xc]
call fcn.004951a0
add esp, 0xc
mov eax, 1
jmp 0x438cc0
push 0
push 9
push 0x110a
push dword [0x545fe0]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4377c3
push eax
mov ecx, 0x545fdc
call fcn.00434a40
push eax
push 0x51c1c8
lea eax, [ebp - 0x80]
push 0x32
push eax
call fcn.00407ae0
lea ecx, [ebp - 0x80]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437745
sub ecx, edx
sar ecx, 1
lea edi, [ecx*2 + 2]
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4377a7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4377a7
push edi
lea ecx, [ebp - 0x80]
push ecx
push eax
call fcn.004def30
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x51ea84
push 0x51d6f4
call fcn.00464a70
add esp, 8
mov eax, 1
jmp 0x438cc0
push 0x51ea98
push 0x51d6f4
call fcn.00464a70
add esp, 8
mov eax, 1
jmp 0x438cc0
call fcn.0043c3b0
mov eax, 1
jmp 0x438cc0
call fcn.0043c6e0
mov eax, 1
jmp 0x438cc0
mov ecx, 0x2b0d
call fcn.00464ce0
push 0x23
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, 1
jmp 0x438cc0
mov ecx, 0x2b0d
call fcn.00464ce0
push 0x23
push 0
push 0
push 0
push 0
push 1
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, 1
jmp 0x438cc0
mov ecx, 0x2b0d
call fcn.00464ce0
push 0x23
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, 1
jmp 0x438cc0
mov ecx, 0x2b0d
call fcn.00464ce0
push 0x23
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, 1
jmp 0x438cc0
call fcn.0043c9c0
mov eax, 1
jmp 0x438cc0
push 0
push 9
push 0x110a
push dword [0x545fe0]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x438cb7
push eax
mov ecx, 0x545fdc
call fcn.00434a40
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov ebx, eax
mov dword [ebp - 0x904], 0
xor eax, eax
mov dword [ebp - 4], 0
push 0x64
push eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0xe8]
push eax
mov dword [ebp - 0x18], 0x640025
call fcn.004ded20
add esp, 0xc
lea eax, [ebp - 0x18]
push ebx
push eax
lea eax, [ebp - 0xe8]
push 0x32
push eax
call fcn.00407ae0
add esp, 0x10
lea ecx, [ebp - 0x904]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0042dfa0
mov eax, dword [ebp - 0x904]
mov byte [ebp - 0x905], 0
test eax, eax
je 0x43794a
mov eax, dword [eax + 8]
jmp 0x43794c
xor eax, eax
lea ecx, [ebp - 0x905]
mov edx, 0x51eb9c
push ecx
mov ecx, dword [0x5482c0]
sub esp, 8
push eax
push 0x51ebd8
call fcn.0043bf80
add esp, 0x14
mov edi, eax
cmp byte [ebp - 0x905], 0
jne 0x437983
mov dword [ebp - 4], 1
jmp 0x4379cf
push edi
push 0xfffffffffffffff4
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0xfffffffffffffff4
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, edi
je 0x4379bb
push 0
push 0x51ebb0
push 0x51ec18
push dword [0x5482c0]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 2
jmp 0x4379cf
push ebx
push str.oldid_long
push esi
call dword [sym.imp.USER32.dll_SetPropW]
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x904]
test eax, eax
je 0x438cb7
add dword [eax + 4], 0xffffffff
jne 0x438cb7
mov eax, dword [ebp - 0x904]
test eax, eax
je 0x438cb7
push eax
call fcn.004eb01a
add esp, 4
mov eax, 1
jmp 0x438cc0
mov ecx, 0x2b0d
call fcn.00464ce0
push 0x127
jmp 0x437809
push 0
push 9
push 0x110a
push dword [0x545fe0]
call dword [sym.imp.USER32.dll_SendMessageW]
xor dl, dl
mov ecx, eax
call fcn.0045ffe0
mov eax, 1
jmp 0x438cc0
push 0
push 9
push 0x110a
push dword [0x545fe0]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dl, 1
mov ecx, eax
call fcn.0045ffe0
mov eax, 1
jmp 0x438cc0
push 0
push 0
push 0x110a
push dword [0x545fe0]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dl, 1
mov ecx, eax
call fcn.0043cfb0
mov eax, 1
jmp 0x438cc0
push 0
push 0
push 0x110a
push dword [0x545fe0]
call dword [sym.imp.USER32.dll_SendMessageW]
xor dl, dl
mov ecx, eax
call fcn.0043cfb0
mov eax, 1
jmp 0x438cc0
push 0
push 9
jmp 0x437a70
push 0
push 9
push 0x110a
push dword [0x545fe0]
call dword [sym.imp.USER32.dll_SendMessageW]
xor dl, dl
mov ecx, eax
call fcn.0043cfb0
mov eax, 1
jmp 0x438cc0
cmp dword [0x549340], 0
je 0x437b0e
push 0
push 0x51d474
mov ecx, 0x5492d0
call fcn.004347b0
mov ecx, eax
mov dword [0x549304], ecx
jmp 0x437b14
mov ecx, dword [0x549304]
test ecx, ecx
mov edx, 0x51ec00
mov eax, 0x51ebe8
sete bl
test ecx, ecx
cmovne eax, edx
push eax
push str._f:y1
call fcn.00464a70
movzx eax, bl
mov edx, 0x3f3
push eax
xor ecx, ecx
call fcn.00435950
add esp, 0xc
mov cl, bl
call fcn.0045fb70
mov eax, 1
jmp 0x438cc0
call fcn.0043d0c0
mov eax, 1
jmp 0x438cc0
call fcn.0043cd60
mov eax, 1
jmp 0x438cc0
push dword [0x54a0e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x438cb7
mov ecx, 0x5492b0
call fcn.00463cf0
mov esi, dword [0x5482c0]
lea eax, [ebp - 0x8f6]
push 0x80c
push 0
push eax
call fcn.004ded20
add esp, 0xc
mov dword [ebp - 0x900], 0x14c80000
xor eax, eax
mov dword [ebp - 0x8fc], 0x10101
mov word [ebp - 0x8f8], ax
lea eax, [ebp - 0x8ea]
push 0x52bbb8
push 0x400
push eax
call fcn.004f286b
add esp, 0xc
push 8
call fcn.004db155
add esp, 4
mov dword [eax + 4], fcn.004630a0
push eax
push 0x4685a0
mov dword [eax], 0
lea eax, [ebp - 0x900]
push esi
push eax
push dword [0x548d7c]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov dword [0x54a0e8], eax
mov eax, 1
jmp 0x438cc0
call fcn.0043ab50
mov eax, 1
jmp 0x438cc0
lea ecx, [ebp - 0x904]
mov dword [ebp - 0x904], 0
call fcn.0043aa10
mov edi, eax
test edi, edi
je 0x438cb7
mov ecx, dword [edi]
lea eax, [ebp - 0x910]
mov edx, dword [edi + 4]
push eax
mov dword [ebp - 0x910], ecx
mov dword [ebp - 0x90c], edx
call fcn.0043b570
push eax
lea eax, [ebp - 0x910]
mov ecx, 0x548e58
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0043b5e0
mov esi, dword [0x548e5c]
mov eax, dword [eax + 4]
test eax, eax
cmovne esi, eax
cmp esi, dword [0x548e5c]
je 0x437cbc
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x437cbc
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, 1
jmp 0x438cc0
push dword [edi + 8]
mov edx, dword [ebp - 0x904]
push dword [edi + 4]
mov ecx, dword [0x5482c0]
push dword [edi]
mov edx, dword [edx + 0xc]
call fcn.00494df0
add esp, 0xc
mov esi, eax
lea eax, [ebp - 0x910]
mov ecx, 0x548e58
push edi
push eax
call fcn.0043b240
mov ecx, dword [eax]
mov dword [ecx + 0x10], esi
call fcn.0043a950
mov eax, 1
jmp 0x438cc0
xor ecx, ecx
call fcn.0043ae40
mov eax, 1
jmp 0x438cc0
mov ecx, 0xa
call fcn.0043ae40
mov eax, 1
jmp 0x438cc0
mov ecx, 0x10
call fcn.0043ae40
mov eax, 1
jmp 0x438cc0
push 0
push 9
push 0x110a
push dword [0x545ef4]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ecx, 0x545ef0
call fcn.0043e3e0
test eax, eax
jne 0x437d7c
push str._rY6R1Y_
push str._rY6R_jWW_
call fcn.00464a70
add esp, 8
mov eax, 1
jmp 0x438cc0
mov edi, dword [eax + 4]
test edi, edi
je 0x438cb7
mov edi, dword [edi + 8]
test edi, edi
je 0x438cb7
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437d97
sub ecx, edx
sar ecx, 1
lea ebx, [ecx*2 + 2]
push ebx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x438cb7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x437dfa
push ebx
push edi
push eax
call fcn.004def30
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x51e590
push str._rY6R_jWW_
call fcn.00464a70
add esp, 8
mov eax, 1
jmp 0x438cc0
push 0
push 9
push 0x110a
push dword [0x545ef4]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ecx, 0x545ef0
call fcn.0043e3e0
mov esi, eax
test esi, esi
jne 0x437e56
push str._e1Y_
push str._e_jWW
call fcn.00464a70
add esp, 8
lea eax, [esi + 1]
jmp 0x438cc0
push 0x20
call fcn.004db155
mov edi, eax
add esp, 4
mov dword [edi], 0x20
mov eax, dword [esi]
test eax, eax
je 0x437e73
mov ecx, dword [eax + 8]
jmp 0x437e75
xor ecx, ecx
call fcn.0043a860
cdq
lea ebx, [edi + 4]
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
mov eax, dword [0x5482c4]
mov eax, dword [eax + 0x20]
mov dword [ebx], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x437e9a
mov eax, dword [eax + 8]
jmp 0x437e9c
xor eax, eax
cdq
mov dword [edi + 0x10], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x910]
mov dword [edi + 0x14], edx
push eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 0x904], 0x43b080
mov dword [ebp - 0x14], 9
call fcn.0046c750
mov ecx, dword [eax]
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0x918]
add ecx, 0xc
push eax
call fcn.00463f10
push 0x54a14c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
call fcn.00435a80
push 0x54a14c
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi + 0x10], 0
mov eax, edi
cdq
push edx
push eax
setne cl
mov edx, 9
call fcn.0046bd90
add esp, 8
mov eax, 1
jmp 0x438cc0
push 0
push 9
push 0x110a
push dword [0x545ef4]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ecx, 0x545ef0
call fcn.0043e3e0
mov edi, eax
test edi, edi
jne 0x437f6b
push 0x51e9e8
push 0x51e9d8
call fcn.00464a70
add esp, 8
lea eax, [edi + 1]
jmp 0x438cc0
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
movzx ebx, ax
push 0x10
shr ebx, 0xf
call esi
shr eax, 0xf
and al, 1
and bl, 1
je 0x437f91
test al, al
jne 0x437f91
mov bl, 1
jmp 0x437f93
xor bl, bl
mov eax, dword [edi + 4]
test eax, eax
je 0x437f9f
mov eax, dword [eax + 8]
jmp 0x437fa1
xor eax, eax
push eax
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov esi, eax
test esi, esi
je 0x437fd2
movzx ecx, bl
push ecx
push 0
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHOpenFolderAndSelectItems]
push esi
mov ebx, eax
call dword [sym.imp.SHELL32.dll_SHFree]
shr ebx, 0x1f
xor bl, 1
jne 0x438cb7
mov eax, dword [edi + 4]
test eax, eax
je 0x437fde
mov eax, dword [eax + 8]
jmp 0x437fe0
xor eax, eax
push eax
push 0x51ea08
lea eax, [ebp - 0x500]
push 0x208
push eax
call fcn.00407ae0
add esp, 0x10
lea eax, [ebp - 0x500]
push 0
push 0x51c3bc
push eax
jmp 0x438cab
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x110a
push dword [0x545ef4]
call edi
xor esi, esi
push eax
push 1
push 0x110a
push dword [0x545ef4]
call edi
test eax, eax
je 0x4380d2
inc esi
cmp esi, 7
jl 0x438026
cmp byte [0x54b07c], 0
jne 0x4380a9
push 0x52b314
push 0
push 0x66
mov byte [0x54b07c], 1
call fcn.0045ba10
push 0x52b2f8
push 0x11
push 0x64
call fcn.0045ba10
push 0x52b2d0
push 0x1011
push 0x65
call fcn.0045ba10
push 0x52b328
mov ecx, 0x5490b4
mov dword [0x54912c], 3
call fcn.00424d70
push 0x52b4c0
mov ecx, 0x54909c
call fcn.00424d70
push dword [0x5482c0]
mov ecx, 0x549078
call fcn.0041c580
test eax, eax
je 0x438cb7
mov cl, 1
call fcn.0045bab0
mov eax, 1
jmp 0x438cc0
mov dword [ebp - 0x904], 0
push str.I:cpp_spy_src_spyevent_FindModule.cpp
push str.event_FineModule
push 0x2d
lea eax, [ebp - 0x904]
mov dword [ebp - 4], 4
push 0x52b228
push eax
call fcn.00423fb0
mov esi, dword [ebp - 0x904]
add esp, 0x14
test esi, esi
je 0x438112
mov eax, dword [esi + 8]
jmp 0x438114
xor eax, eax
push 0
push 0x52b208
push eax
push dword [0x5482c0]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 5
test esi, esi
je 0x438cb7
add dword [esi + 4], 0xffffffff
jne 0x438cb7
push esi
call fcn.004eb01a
add esp, 4
mov eax, 1
jmp 0x438cc0
xor cl, cl
call fcn.0045bab0
mov eax, 1
jmp 0x438cc0
lea ecx, [ebp - 0x904]
mov dword [ebp - 0x904], 0
call fcn.0043aa10
mov esi, eax
test esi, esi
je 0x438cb7
mov ecx, dword [esi]
lea eax, [ebp - 0x910]
mov edx, dword [esi + 4]
push eax
mov dword [ebp - 0x910], ecx
mov dword [ebp - 0x90c], edx
call fcn.0043b570
push eax
lea eax, [ebp - 0x910]
mov ecx, 0x548e98
push eax
lea eax, [ebp - 0x918]
push eax
call fcn.0043b5e0
mov edi, dword [0x548e9c]
mov eax, dword [eax + 4]
test eax, eax
cmovne edi, eax
cmp edi, dword [0x548e9c]
je 0x4381f0
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4381f0
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, 1
jmp 0x438cc0
push dword [esi + 0x18]
mov edx, dword [ebp - 0x904]
push dword [esi + 4]
mov ecx, dword [0x5482c0]
push dword [esi]
mov edx, dword [edx + 0xc]
call fcn.0041fe70
add esp, 0xc
call fcn.0043a950
mov eax, 1
jmp 0x438cc0
lea ecx, [ebp - 0x904]
mov dword [ebp - 0x904], 0
call fcn.0043aa10
mov esi, eax
test esi, esi
je 0x438cb7
mov ecx, dword [esi]
lea eax, [ebp - 0x910]
mov edx, dword [esi + 4]
push eax
mov dword [ebp - 0x910], ecx
mov dword [ebp - 0x90c], edx
call fcn.0043b570
push eax
lea eax, [ebp - 0x910]
mov ecx, 0x548eb8
push eax
lea eax, [ebp - 0x920]
push eax
call fcn.0043b5e0
mov edi, dword [0x548ebc]
mov eax, dword [eax + 4]
test eax, eax
cmovne edi, eax
cmp edi, dword [0x548ebc]
je 0x43829a
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4381dd
push dword [esi + 0x18]
mov edx, dword [ebp - 0x904]
push dword [esi + 4]
mov ecx, dword [0x5482c0]
push dword [esi]
mov edx, dword [edx + 0xc]
call fcn.00428a40
add esp, 0xc
call fcn.0043a950
mov eax, 1
jmp 0x438cc0
push 0
push 0x51c748
push 0x51c748
jmp 0x438cab
push 0
push 9
push 0x110a
push dword [0x545ef4]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ecx, 0x545ef0
call fcn.0043e3e0
test eax, eax
jne 0x438319
push str._rY6R1Y_
push str._rY6R8_rT
call fcn.00464a70
add esp, 8
mov eax, 1
jmp 0x438cc0
mov edi, dword [eax]
test edi, edi
je 0x438cb7
mov edi, dword [edi + 8]
test edi, edi
je 0x438cb7
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438333
sub ecx, edx
sar ecx, 1
lea ebx, [ecx*2 + 2]
push ebx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x438cb7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x438396
push ebx
push edi
push eax
call fcn.004def30
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x51e590
push str._rY6R8_rT
call fcn.00464a70
add esp, 8
mov eax, 1
jmp 0x438cc0
xor ecx, ecx
call fcn.0043b7b0
mov eax, 1
jmp 0x438cc0
push 0
push 9
push 0x110a
push dword [0x545ef4]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ecx, 0x545ef0
call fcn.0043e3e0
test eax, eax
je 0x438cb7
mov edi, dword [eax + 8]
test edi, edi
je 0x438cb7
mov edi, dword [edi + 8]
test edi, edi
je 0x438cb7
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438406
sub ecx, edx
sar ecx, 1
lea ebx, [ecx*2 + 2]
push ebx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x438cb7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x438469
push ebx
push edi
push eax
call fcn.004def30
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x51e590
push str._rY6R_aY
call fcn.00464a70
add esp, 8
mov eax, 1
jmp 0x438cc0
mov ecx, 0xa
call fcn.0043b7b0
mov eax, 1
jmp 0x438cc0
mov ecx, 0x10
call fcn.0043b7b0
mov eax, 1
jmp 0x438cc0
mov edi, dword [0x549d4c]
mov esi, dword [sym.imp.USER32.dll_GetMenuState]
push 0
push 0x4b5
push edi
call esi
not eax
and eax, 8
push eax
push 0x4b5
push edi
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x4b5
push edi
call esi
mov edi, eax
mov edx, 0x4b5
and edi, 8
mov ecx, 0xa
setne bl
movzx esi, bl
push esi
call fcn.00435950
add esp, 4
cmp dword [0x549308], esi
je 0x43851b
push esi
push str.sort_style
mov ecx, 0x5492d0
mov dword [0x549308], esi
call fcn.00437440
mov ecx, dword [0x545f38]
mov al, cl
and al, 1
cmp bl, al
je 0x438cb7
test edi, edi
je 0x438549
or ecx, 1
mov dword [0x545f38], ecx
call fcn.00447ee0
mov eax, 1
jmp 0x438cc0
and ecx, 0xfffffffe
mov dword [0x545f38], ecx
call fcn.00447ee0
mov eax, 1
jmp 0x438cc0
mov edi, dword [0x549d4c]
mov esi, dword [sym.imp.USER32.dll_GetMenuState]
push 0
push 0x4b6
push edi
call esi
not eax
and eax, 8
push eax
push 0x4b6
push edi
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x4b6
push edi
call esi
mov edi, eax
mov edx, 0x4b6
and edi, 8
mov ecx, 0xa
setne bl
movzx esi, bl
push esi
call fcn.00435950
add esp, 4
cmp dword [0x549310], esi
je 0x4385cf
push esi
push str.check_front
mov ecx, 0x5492d0
mov dword [0x549310], esi
call fcn.00437440
mov ecx, dword [0x545f38]
mov eax, ecx
shr eax, 8
and al, 1
cmp al, bl
je 0x438cb7
test edi, edi
je 0x438603
or ecx, 0x100
mov dword [0x545f38], ecx
call fcn.00447ee0
mov eax, 1
jmp 0x438cc0
and ecx, 0xfffffeff
mov dword [0x545f38], ecx
call fcn.00447ee0
mov eax, 1
jmp 0x438cc0
mov edi, dword [0x549d4c]
mov esi, dword [sym.imp.USER32.dll_GetMenuState]
push 0
push 0x4b7
push edi
call esi
not eax
and eax, 8
push eax
push 0x4b7
push edi
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x4b7
push edi
call esi
mov edi, eax
mov edx, 0x4b7
and edi, 8
mov ecx, 0xa
setne bl
movzx esi, bl
push esi
call fcn.00435950
add esp, 4
cmp dword [0x54930c], esi
je 0x43868c
push esi
push str.sort_value
mov ecx, 0x5492d0
mov dword [0x54930c], esi
call fcn.00437440
mov ecx, dword [0x545f38]
mov eax, ecx
shr eax, 4
and al, 1
cmp bl, al
je 0x438cb7
test edi, edi
je 0x4386bd
or ecx, 0x10
mov dword [0x545f38], ecx
call fcn.00447ee0
mov eax, 1
jmp 0x438cc0
and ecx, 0xffffffef
mov dword [0x545f38], ecx
call fcn.00447ee0
mov eax, 1
jmp 0x438cc0
call fcn.00438f90
mov eax, 1
jmp 0x438cc0
call fcn.00439000
mov eax, 1
jmp 0x438cc0
push 0
push 9
push 0x110a
push dword [0x545ef4]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ecx, 0x545ef0
call fcn.0043e3e0
test eax, eax
je 0x438cb7
mov edi, dword [eax]
test edi, edi
je 0x438cb7
mov edi, dword [edi + 8]
test edi, edi
je 0x438cb7
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438735
sub ecx, edx
sar ecx, 1
lea ebx, [ecx*2 + 2]
push ebx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x438cb7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x438798
push ebx
push edi
push eax
call fcn.004def30
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x51e590
push str._rY6R__rT
call fcn.00464a70
add esp, 8
mov eax, 1
jmp 0x438cc0
cmp ecx, 0x578
jg 0x438941
je 0x438894
cmp ecx, 0x515
jne case.default.0x438a14
push 0
push 9
push 0x110a
push dword [0x545ef4]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ecx, 0x545ef0
call fcn.0043e3e0
test eax, eax
je 0x438cb7
mov edi, dword [eax + 4]
test edi, edi
je 0x438cb7
mov edi, dword [edi + 8]
test edi, edi
je 0x438cb7
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438815
sub ecx, edx
sar ecx, 1
lea ebx, [ecx*2 + 2]
push ebx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x438cb7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x438878
push ebx
push edi
push eax
call fcn.004def30
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x51e590
push str._rY6R__P
call fcn.00464a70
add esp, 8
mov eax, 1
jmp 0x438cc0
push 0
push 9
push 0x110a
push dword [0x545ef4]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ecx, 0x545ef0
call fcn.0043e3e0
mov esi, eax
test esi, esi
je 0x438cb7
mov edx, dword [esi]
test edx, edx
je 0x43890f
cmp dword [edx], 0
je 0x43890f
mov edx, dword [edx + 8]
test edx, edx
je 0x438904
xor ecx, ecx
mov eax, edx
cmp word [edx], cx
je 0x4388ea
nop dword [eax]
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x4388e0
lea eax, [ecx - 1]
mov edi, ecx
cmp eax, edi
cmovbe eax, eax
test eax, eax
js 0x438904
cmp word [edx + eax*2], 0x20
je 0x438907
sub eax, 1
jns 0x4388f8
or eax, 0xffffffff
mov ecx, dword [esi]
mov edx, ecx
mov edx, dword [edx]
jmp 0x43891e
mov ecx, edx
or eax, 0xffffffff
test ecx, ecx
je 0x43891c
mov edx, dword [edx]
jmp 0x43891e
xor edx, edx
cmp eax, 0xffffffff
cmovne edx, eax
test ecx, ecx
je 0x43892d
mov ecx, dword [ecx + 8]
jmp 0x43892f
xor ecx, ecx
call fcn.00418d90
test eax, eax
je 0x438cb7
jmp 0x438798
cmp ecx, 0x6a4
jg 0x438a05
je 0x4389c8
lea eax, [ecx - 0x579]
cmp eax, 0xe1
ja case.default.0x438a14
movzx eax, byte [eax + 0x438e84]
jmp dword [eax*4 + 0x438e6c]
call fcn.0043cb60
mov eax, 1
jmp 0x438cc0
call fcn.0043b650
mov eax, 1
jmp 0x438cc0
mov ecx, 0x579
call fcn.00439c80
mov eax, 1
jmp 0x438cc0
mov ecx, 0x57a
call fcn.00439c80
mov eax, 1
jmp 0x438cc0
mov ecx, 0x57b
call fcn.00439c80
mov eax, 1
jmp 0x438cc0
mov ecx, 0x2b0d
call fcn.00464ce0
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4389e8
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x23
push 0
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, 1
jmp 0x438cc0
add ecx, 0xfffff95b
cmp ecx, 9
ja case.default.0x438a14
jmp dword [ecx*4 + 0x438f68]
mov ecx, 0x2b21
call fcn.0045a820
mov eax, 1
jmp 0x438cc0
mov ecx, 0x2b0d
call fcn.00464ce0
push 6
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
jmp 0x438cc0
mov ecx, 0x2b0d
call fcn.00464ce0
push 3
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
jmp 0x438cc0
mov ecx, 0x2b0d
call fcn.00464ce0
push 9
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
jmp 0x438cc0
push 0x34
push 0x51e23c
push str._fTsQ
push dword [0x5482c0]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x438cb7
mov ecx, 0x2b0d
call fcn.00464ce0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ecx
push 0x3e8
push 0x2a
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov eax, 1
jmp 0x438cc0
mov ecx, 0x2b0d
call fcn.00464ce0
push 0x6aa
push 0
mov edx, str.RELIVEBTN121007124
mov ecx, eax
call fcn.00439070
add esp, 8
mov eax, 1
jmp 0x438cc0
mov ecx, 0x2b0d
call fcn.00464ce0
push 0x6ab
push 1
mov edx, str.SHOWHIDECONTROL121007124
mov ecx, eax
call fcn.00439070
add esp, 8
mov eax, 1
jmp 0x438cc0
mov ecx, 0x2b0d
call fcn.00464ce0
mov edi, eax
push str.style121007124
push edi
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
test esi, esi
jne 0x438c0c
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x438b7c
push 0x44
push 0x51e364
push 0x51e3b0
push dword [0x5482c0]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x438cb7
mov esi, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push edi
call esi
mov ebx, eax
mov ecx, ebx
or ecx, 0xcf0000
push ecx
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x27
push 0
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0xfffffffffffffff0
push edi
call esi
cmp eax, ebx
jne 0x438bd3
push 0x51e398
push 0x51e424
call fcn.00464a70
add esp, 8
mov eax, 1
jmp 0x438cc0
push ebx
push str.style121007124
push edi
call dword [sym.imp.USER32.dll_SetPropW]
mov esi, dword [0x549d30]
push 0
push 0x6ac
push esi
call dword [sym.imp.USER32.dll_GetMenuState]
push 8
push 0x6ac
push esi
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, 1
jmp 0x438cc0
push esi
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, esi
je 0x438c3f
push 0x51e418
push 0x51e45c
call fcn.00464a70
add esp, 8
mov eax, 1
jmp 0x438cc0
push 0x27
push 0
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, dword [0x549d30]
push 0
push 0x6ac
push esi
call dword [sym.imp.USER32.dll_GetMenuState]
push 0
push 0x6ac
push esi
call dword [sym.imp.USER32.dll_CheckMenuItem]
push str.style121007124
push edi
call dword [sym.imp.USER32.dll_RemovePropW]
mov eax, 1
jmp 0x438cc0
mov ecx, 0x2b0d
call fcn.00464ce0
mov ecx, eax
call fcn.00439450
mov eax, 1
jmp 0x438cc0
push 0
push 0x51e2d0
push 0x51e2b0
push dword [0x5482c0]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
jmp 0x438cc0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret