Function at 0x411cb6
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x10004]
mov eax, 0x10004
call fcn.004680f0
push 0xffffffffffffffff
push 0x46a377
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x49ce98]
xor eax, ebp
mov dword [ebp + 0x10000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov ebx, str.Settings
cmp dword [ebp + 0x1000c], esi
je 0x411dbc
push esi
mov edi, 0x477134
push edi
push str.LastUpdateCheck
push ebx
call fcn.0040ef78
push esi
push edi
push str.UpdateCheckingPeriod
push ebx
mov dword [ebp - 0x1c], eax
call fcn.0040ef78
mov edi, eax
add esp, 0x20
cmp edi, esi
je 0x412619
cmp dword [ebp - 0x1c], esi
je 0x411dbc
lea eax, [ebp - 0x6c]
push eax
call fcn.00408a13
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
push esi
pop edx
sbb eax, edx
mov edx, edi
dec edx
je 0x411dbc
dec edx
je 0x411d9c
dec edx
je 0x411d80
dec edx
jne 0x412619
push esi
push 0x15180
push eax
push ecx
call fcn.00467f80
cmp edx, esi
jl 0x412619
jg 0x411dbc
cmp eax, 0x1e
jmp 0x411db6
push esi
push 0x15180
push eax
push ecx
call fcn.00467f80
cmp edx, esi
jl 0x412619
jg 0x411dbc
cmp eax, 7
jmp 0x411db6
push esi
push 0x15180
push eax
push ecx
call fcn.00467f80
cmp edx, esi
jl 0x412619
jg 0x411dbc
cmp eax, 1
jb 0x412619
mov edi, 0x4749e0
push edi
lea eax, [ebp - 0x50]
push str.UpdateURL
push eax
call fcn.004116ea
add esp, 0xc
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], esi
call dword [sym.imp.mfc90.dll_Ordinal_4311]
test al, al
jne 0x412610
push 0x10000
lea eax, [ebp]
push esi
push eax
call sub.MSVCR90.dll_memset
push esi
push 1
push edi
push str.ProxyUsername
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.0040ed58
push esi
push 1
push edi
push str.ProxyPassword
lea eax, [ebp - 0x78]
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.0040ed58
add esp, 0x3c
mov byte [ebp - 4], 2
call sub.mfc90.dll_Ordinal_1137
mov ecx, dword [eax + 4]
call sub.mfc90.dll_Ordinal_1387
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
mov dword [ebp - 0x28], esi
call sub.mfc90.dll_Ordinal_404
lea eax, [ebp - 0x64]
push esi
push eax
mov byte [ebp - 4], 4
call fcn.0040e7d4
push str.Update.txt
push eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 4], 5
call dword [sym.imp.RTFC.dll_class_CStringLite___cdecl_operator_class_CStringLite_const___char_const__]
add esp, 0x14
mov eax, dword [eax + 4]
push esi
push 0x20
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 6
call sub.mfc90.dll_Ordinal_5520
mov ebx, dword [sym.imp.RTFC.dll_public_virtual:_void___thiscall_CStringLite::destructor_void_]
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 5
call ebx
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call ebx
cmp dword [ebp - 0x2c], esi
je 0x411ebc
push 0x10000
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x88]
call sub.mfc90.dll_Ordinal_5753
mov dword [ebp - 0x1c], eax
cmp eax, esi
jne 0x411ef7
push 0xffff
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x78]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [ebp - 0x70]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [ebp - 0x50]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call fcn.0040f687
add esp, 0x14
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
call sub.mfc90.dll_Ordinal_1137
mov ecx, dword [eax + 4]
call sub.mfc90.dll_Ordinal_5960
cmp dword [ebp - 0x1c], esi
jle 0x4123ba
lea ecx, [ebp - 0xb4]
call dword [sym.imp.RTFC.dll_public:_void___thiscall_CTextFile::constructor_void_]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 7
call dword [sym.imp.RTFC.dll_public:_void___thiscall_CTextFile::Precache_char_const__]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [ebp - 4], 8
cmp dword [ebp - 0x18], esi
je 0x411f5c
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push str.Update_d
push eax
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
jmp 0x411f6a
push str.Update
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push edi
push 0x478a38
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0xb4]
call dword [sym.imp.RTFC.dll_public_virtual:_class_CStringLite___thiscall_CTextFile::ReadSectionParam_char_const___char_const___char_const__]
push edi
push str.ProductBetaVersion
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 9
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0xb4]
call dword [sym.imp.RTFC.dll_public_virtual:_class_CStringLite___thiscall_CTextFile::ReadSectionParam_char_const___char_const___char_const__]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x74]
push eax
push str._d._d._d
push dword [ebp - 0x58]
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
call dword [sym.imp.MSVCR90.dll_sscanf_s]
mov eax, dword [ebp - 0x74]
shl eax, 8
or eax, dword [ebp - 0x4c]
mov dword [ebp - 0x20], esi
shl eax, 8
or eax, dword [ebp - 0x48]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
push eax
push 0x475278
push dword [ebp - 0x60]
call dword [sym.imp.MSVCR90.dll_sscanf_s]
add esp, 0x20
lea ecx, [ebp - 0x5c]
call dword [sym.imp.RTFC.dll_public:_int___thiscall_CStringLite::IsEmpty_void_const]
test eax, eax
jne 0x4121a5
push edi
push 0x478a38
lea eax, [ebp - 0x3c]
push str.Global
push eax
call fcn.0040ef11
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 0xb
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [ebp - 0x6c]
call dword [sym.imp.RTFC.dll_public:_void___thiscall_CStringLite::constructor_char_const__]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xd
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
push eax
push str._d._d._d
push dword [ebp - 0x68]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x2c], esi
call dword [sym.imp.MSVCR90.dll_sscanf_s]
mov esi, dword [ebp - 0x44]
shl esi, 8
or esi, dword [ebp - 0x40]
shl esi, 8
or esi, dword [ebp - 0x2c]
call fcn.0040f9a1
push 0
push 0x477134
push str.UpdateCheckingAllowBetas
push str.Settings
mov dword [ebp - 0x14], eax
call fcn.0040ef78
add esp, 0x24
neg eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x28], esi
jbe 0x412162
test eax, eax
jne 0x4120b9
cmp dword [ebp - 0x20], eax
jne 0x412198
mov dword [ebp - 0x30], 1
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_316]
cmp dword [ebp - 0x20], 0
mov byte [ebp - 4], 0xe
je 0x41220f
lea eax, [ebp - 0x34]
push 0x60
push eax
call dword [sym.imp.RTMUI.dll_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______cdecl_LoadStringA_unsigned_int_]
pop ecx
pop ecx
mov esi, eax
push dword [ebp - 0x58]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xf
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 0x4759f8
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 0x10
call fcn.004089ae
push esi
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0x11
call fcn.004034a8
add esp, 0x18
push dword [ebp - 0x20]
mov ecx, eax
mov byte [ebp - 4], 0x12
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x41221b
jne 0x412198
test eax, eax
mov eax, dword [ebp - 0x20]
je 0x41217d
cmp dword [ebp - 0x14], 0
je 0x412198
cmp eax, dword [ebp - 0x14]
jbe 0x41217d
mov dword [ebp - 0x30], 1
cmp dword [ebp - 0x14], 0
je 0x41218e
test eax, eax
jne 0x41218e
mov dword [ebp - 0x30], 1
cmp dword [ebp - 0x30], 0
jne 0x4120c0
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0xa
call ebx
xor esi, esi
jmp 0x4121de
cmp dword [ebp - 0x18], esi
jne 0x4122fa
lea eax, [ebp - 0x24]
push 0x48
push eax
call dword [sym.imp.RTMUI.dll_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______cdecl_LoadStringA_unsigned_int_]
pop ecx
pop ecx
push 0x2010
mov ecx, eax
mov byte [ebp - 4], 0x15
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call fcn.0040ed19
pop ecx
pop ecx
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 9
call ebx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 8
call ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call dword [sym.imp.mfc90.dll_Ordinal_601]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jb 0x411f33
jmp 0x41231e
push dword [ebp - 0x58]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
lea eax, [ebp - 0x34]
push 0x47
push eax
mov byte [ebp - 4], 0x13
call dword [sym.imp.RTMUI.dll_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______cdecl_LoadStringA_unsigned_int_]
pop ecx
pop ecx
mov esi, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x14
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x13
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0x24
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call fcn.0040ed19
pop ecx
pop ecx
cmp eax, 6
jne 0x4122bc
push edi
push str.ProductURL
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0xb4]
call dword [sym.imp.RTFC.dll_public_virtual:_class_CStringLite___thiscall_CTextFile::ReadSectionParam_char_const___char_const___char_const__]
mov eax, dword [eax + 4]
push 1
xor ecx, ecx
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x38]
call ebx
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0xa
call ebx
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 9
call ebx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 8
call ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call dword [sym.imp.mfc90.dll_Ordinal_601]
xor esi, esi
jmp 0x412319
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 9
call ebx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 8
call ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call dword [sym.imp.mfc90.dll_Ordinal_601]
cmp dword [ebp - 0x30], esi
jne 0x412356
cmp dword [ebp + 0x1000c], esi
jne 0x412356
lea eax, [ebp - 0x34]
push 0x46
push eax
call dword [sym.imp.RTMUI.dll_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______cdecl_LoadStringA_unsigned_int_]
pop ecx
pop ecx
push 0x2040
mov ecx, eax
mov byte [ebp - 4], 0x16
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call fcn.0040ed19
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push esi
call dword [sym.imp.MSVCR90.dll__time32]
pop ecx
lea ecx, [ebp - 0x1c]
mov esi, eax
call dword [sym.imp.mfc90.dll_Ordinal_316]
push esi
lea eax, [ebp - 0x1c]
push str._08Xh
push eax
mov byte [ebp - 4], 0x17
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
push str.LastUpdateCheck
push str.Settings
call fcn.0040f05c
add esp, 0xc
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 4
call dword [sym.imp.RTFC.dll_public_virtual:_void___thiscall_CTextFile::destructor_void_]
jmp 0x4125e3
mov edi, dword [sym.imp.RTMUI.dll_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______cdecl_LoadStringA_unsigned_int_]
lea eax, [ebp - 0x20]
push 0x49
push eax
call edi
pop ecx
pop ecx
push 0x11
mov byte [ebp - 4], 0x18
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x4125c4
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov ebx, dword [ebp - 0x1c]
mov esi, dword [sym.imp.mfc90.dll_Ordinal_2539]
mov byte [ebp - 4], 0x1a
cmp ebx, 0xfffffff9
je 0x41250e
cmp ebx, 0xfffffffa
je 0x4124f1
cmp ebx, 0xfffffffb
je 0x4124d4
cmp ebx, 0xfffffffc
je 0x4124b7
cmp ebx, 0xfffffffd
je 0x41249a
cmp ebx, 0xfffffffe
je 0x41247a
cmp ebx, 0xffffffff
je 0x41245a
lea eax, [ebp - 0x34]
push 0x6e
push eax
call edi
pop ecx
pop ecx
push ebx
mov ecx, eax
mov byte [ebp - 4], 0x22
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea eax, [ebp - 0x10]
push eax
call esi
add esp, 0xc
lea ecx, [ebp - 0x34]
jmp 0x412529
lea eax, [ebp - 0x24]
push 0x56
push eax
call edi
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1b
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x24]
jmp 0x412529
lea eax, [ebp - 0x3c]
push 0x68
push eax
call edi
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1c
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x3c]
jmp 0x412529
lea eax, [ebp - 0x2c]
push 0x69
push eax
call edi
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1d
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x2c]
jmp 0x412529
lea eax, [ebp - 0x40]
push 0x6a
push eax
call edi
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1e
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x40]
jmp 0x412529
lea eax, [ebp - 0x44]
push 0x6b
push eax
call edi
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1f
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x44]
jmp 0x412529
lea eax, [ebp - 0x48]
push 0x6c
push eax
call edi
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x20
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x48]
jmp 0x412529
lea eax, [ebp - 0x4c]
push 0x6d
push eax
call edi
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x21
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x1a
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea eax, [ebp - 0x24]
push 0x6f
push eax
call edi
push eax
lea eax, [ebp - 0x34]
push 0x4772b8
push eax
mov byte [ebp - 4], 0x23
call fcn.00410c98
add esp, 0x14
push dword [ebp - 0x28]
mov ecx, eax
push dword [ebp - 0x10]
mov byte [ebp - 4], 0x24
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea eax, [ebp - 0x14]
push eax
call esi
add esp, 0x10
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x1a
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004034a8
add esp, 0xc
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x25
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x18
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0x2010
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call fcn.0040ed19
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
call sub.mfc90.dll_Ordinal_663
lea ecx, [ebp - 0x51]
mov byte [ebp - 4], 2
call fcn.00410d24
lea ecx, [ebp - 0x78]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x70]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x50]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x10000]
xor ecx, ebp
call fcn.00467d0a
add ebp, 0x10004
leave
ret