Function at 0x4c1474
Capabilities:
Create process on windows
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x15
push 0
push 0
dec ecx
jne 0x4c147c
push ebx
push esi
push edi
mov esi, dword [0x4dade8]
xor eax, eax
push ebp
push 0x4c26e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4c2704
call fcn.004c4130
mov eax, dword [0x4daf70]
mov eax, dword [eax]
call fcn.0046ed04
push 1
push 0
lea eax, [ebp - 0x1c]
call fcn.004aedc0
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x4b77c0]
call fcn.004b78f0
mov eax, dword [0x4dacf0]
cmp byte [eax], 0
jne 0x4c1523
mov eax, dword [0x4dad4c]
cmp byte [eax], 0
jne 0x4c1523
mov eax, dword [esi]
mov eax, dword [eax + 0x3c8]
cmp byte [eax + 0x57], 0
je 0x4c1501
mov eax, dword [esi]
mov eax, dword [eax + 0x3cc]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
jne 0x4c1527
mov eax, dword [esi]
mov eax, dword [eax + 0x3c0]
cmp byte [eax + 0x57], 0
je 0x4c1523
mov eax, dword [esi]
mov eax, dword [eax + 0x3c4]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
jne 0x4c1527
xor eax, eax
jmp 0x4c1529
mov al, 1
mov edx, dword [0x4db084]
mov byte [edx], al
mov eax, dword [0x4db084]
cmp byte [eax], 0
je 0x4c1543
mov eax, dword [0x4dab7c]
mov byte [eax], 1
xor edx, edx
push ebp
push 0x4c25c8
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, 0x4c2724
call fcn.004c4130
lea eax, [ebp - 0x18]
push eax
push 2
mov eax, dword [0x4db148]
mov eax, dword [eax]
call eax
mov eax, 0x4c2750
call fcn.004c4130
mov eax, 0x7fff
mov edx, dword [0x4dace8]
cmp dword [edx], 5
jl 0x4c158e
or eax, 0x2000000
push 0x4c2768
push eax
push 0x4be63c
mov eax, dword [0x4dae60]
mov eax, dword [eax]
call eax
call fcn.004c0a10
test eax, eax
je 0x4c15b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c25fe
call fcn.004bd5b4
test al, al
jne 0x4c15fb
mov eax, 0x4c2788
call fcn.004c4130
mov eax, dword [0x4dadfc]
mov byte [eax], 2
cmp dword [esi], 0
je 0x4c15ee
push 0
push 0
push 0xd30
mov eax, dword [esi]
call fcn.004578a8
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c25fe
call fcn.004bdc04
test al, al
jne 0x4c162f
mov eax, 0x4c27b4
call fcn.004c4130
mov eax, dword [0x4dadfc]
mov byte [eax], 2
cmp dword [esi], 0
je 0x4c1622
mov eax, dword [esi]
call fcn.004d17a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c25fe
mov eax, 0x4c27dc
call fcn.004c4130
mov eax, dword [0x4db0d8]
cmp byte [eax], 0
je 0x4c1678
call fcn.004c3190
mov eax, dword [0x4dadfc]
mov byte [eax], 4
cmp dword [esi], 0
je 0x4c166b
push 0
push 0
push 0xd30
mov eax, dword [esi]
call fcn.004578a8
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c25fe
mov ecx, dword [0x4daef4]
mov ecx, dword [ecx]
lea eax, [ebp - 0x24]
mov edx, 0x4c2820
call fcn.00405be8
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.00405404
mov edx, dword [ebp - 0x20]
mov ecx, 0x80000002
mov eax, 0x4c2890
call fcn.004ae590
test al, al
je 0x4c16c5
mov eax, dword [0x4daccc]
mov edx, dword [0x4daef4]
mov edx, dword [edx]
call fcn.004059c0
jmp 0x4c1757
mov ecx, dword [0x4daacc]
mov ecx, dword [ecx]
lea eax, [ebp - 0x2c]
mov edx, 0x4c2820
call fcn.00405be8
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
call fcn.00405404
mov edx, dword [ebp - 0x28]
mov ecx, 0x80000002
mov eax, 0x4c2890
call fcn.004ae590
test al, al
je 0x4c170f
mov eax, dword [0x4daccc]
mov edx, dword [0x4daacc]
mov edx, dword [edx]
call fcn.004059c0
jmp 0x4c1757
mov ecx, dword [0x4db03c]
mov ecx, dword [ecx]
lea eax, [ebp - 0x34]
mov edx, 0x4c2820
call fcn.00405be8
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
call fcn.00405404
mov edx, dword [ebp - 0x30]
mov ecx, 0x80000002
mov eax, 0x4c2890
call fcn.004ae590
test al, al
je 0x4c1757
mov eax, dword [0x4daccc]
mov edx, dword [0x4db03c]
mov edx, dword [edx]
call fcn.004059c0
mov ecx, dword [0x4daccc]
mov ecx, dword [ecx]
lea eax, [ebp - 0x3c]
mov edx, 0x4c28b0
call fcn.00405be8
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
call fcn.00405404
mov eax, dword [ebp - 0x38]
call fcn.004c4130
push 0x4c28e4
mov eax, dword [0x4daee8]
push dword [eax]
push 0x4c2904
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405c58
mov eax, dword [0x4dab7c]
cmp byte [eax], 0
jne 0x4c17c9
mov eax, dword [esi]
mov eax, dword [eax + 0x3e0]
cmp byte [eax + 0x57], 0
je 0x4c17c9
mov eax, dword [esi]
mov eax, dword [eax + 0x3e4]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
jne 0x4c17d3
mov eax, dword [0x4daebc]
cmp byte [eax], 0
je 0x4c17e0
lea eax, [ebp - 4]
mov edx, 0x4c290c
call fcn.00405b88
mov eax, dword [0x4dac3c]
cmp byte [eax], 0
je 0x4c180d
mov eax, dword [0x4daccc]
mov eax, dword [eax]
mov edx, dword [0x4daef4]
mov edx, dword [edx]
call fcn.00405ca0
jne 0x4c180d
lea eax, [ebp - 4]
mov edx, 0x4c2934
call fcn.00405b88
call fcn.004c51dc
test al, al
jne 0x4c1861
call fcn.004c51e8
test al, al
jne 0x4c1861
push dword [ebp - 4]
push 0x4c2960
mov eax, dword [0x4daee8]
push dword [eax]
push 0x4c29d4
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405c58
push dword [ebp - 4]
push 0x4c29ec
mov eax, dword [0x4daee8]
push dword [eax]
push 0x4c2a1c
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405c58
lea eax, [ebp - 0xc]
call fcn.00405984
lea eax, [ebp - 0x10]
call fcn.00405984
lea eax, [ebp - 0x14]
call fcn.00405984
mov eax, dword [0x4dac3c]
cmp byte [eax], 0
je 0x4c1b42
mov eax, dword [0x4daccc]
mov eax, dword [eax]
mov edx, dword [0x4daef4]
mov edx, dword [edx]
call fcn.00405ca0
jne 0x4c1b42
mov ecx, dword [0x4dae64]
mov ecx, dword [ecx]
lea eax, [ebp - 0x10]
mov edx, 0x4c2a38
call fcn.00405be8
mov eax, dword [0x4db1ac]
cmp byte [eax], 1
je 0x4c18ca
mov eax, dword [0x4db1ac]
cmp byte [eax], 2
jne 0x4c18f5
mov eax, dword [0x4dad18]
cmp byte [eax], 0
je 0x4c18f5
push dword [ebp - 0x10]
push 0x4c2a54
mov eax, dword [0x4daf3c]
push dword [eax]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405c58
jmp 0x4c1983
mov eax, dword [0x4dab8c]
cmp byte [eax], 0
jne 0x4c1983
mov eax, dword [esi]
mov eax, dword [eax + 0x3d0]
cmp byte [eax + 0x57], 0
je 0x4c1983
mov eax, dword [esi]
mov eax, dword [eax + 0x3d4]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4c1964
mov eax, dword [0x4dad18]
cmp byte [eax], 0
je 0x4c194d
push dword [ebp - 0x10]
push 0x4c2a54
mov eax, dword [0x4daf3c]
push dword [eax]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405c58
jmp 0x4c1983
mov ecx, dword [0x4daf3c]
mov ecx, dword [ecx]
lea eax, [ebp - 0xc]
mov edx, 0x4c2a5c
call fcn.00405be8
jmp 0x4c1983
mov eax, dword [0x4dad18]
cmp byte [eax], 0
je 0x4c1983
mov ecx, dword [0x4daf3c]
mov ecx, dword [ecx]
lea eax, [ebp - 0x14]
mov edx, 0x4c2a78
call fcn.00405be8
mov eax, dword [0x4db1ac]
cmp byte [eax], 1
je 0x4c1997
mov eax, dword [0x4db1ac]
cmp byte [eax], 2
jne 0x4c19c2
mov eax, dword [0x4dacf0]
cmp byte [eax], 0
je 0x4c19c2
push dword [ebp - 0x10]
push 0x4c2a54
mov eax, dword [0x4daf00]
push dword [eax]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405c58
jmp 0x4c1a59
mov eax, dword [0x4dab70]
cmp byte [eax], 0
jne 0x4c1a59
mov eax, dword [esi]
mov eax, dword [eax + 0x3c8]
cmp byte [eax + 0x57], 0
je 0x4c1a59
mov eax, dword [esi]
mov eax, dword [eax + 0x3cc]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4c1a59
mov eax, dword [0x4dacf0]
cmp byte [eax], 0
je 0x4c1a1a
push dword [ebp - 0x10]
push 0x4c2a54
mov eax, dword [0x4daf00]
push dword [eax]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405c58
jmp 0x4c1a59
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405ca0
jbe 0x4c1a44
push dword [ebp - 0xc]
push 0x4c2a54
mov eax, dword [0x4daf00]
push dword [eax]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405c58
jmp 0x4c1a59
mov ecx, dword [0x4daf00]
mov ecx, dword [ecx]
lea eax, [ebp - 0xc]
mov edx, 0x4c2a5c
call fcn.00405be8
mov eax, dword [0x4db1ac]
cmp byte [eax], 1
je 0x4c1a6d
mov eax, dword [0x4db1ac]
cmp byte [eax], 2
jne 0x4c1a98
mov eax, dword [0x4dad4c]
cmp byte [eax], 0
je 0x4c1a98
push dword [ebp - 0x10]
push 0x4c2a54
mov eax, dword [0x4daf68]
push dword [eax]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405c58
jmp 0x4c1c2f
mov eax, dword [0x4dabcc]
cmp byte [eax], 0
jne 0x4c1c2f
mov eax, dword [esi]
mov eax, dword [eax + 0x3c0]
cmp byte [eax + 0x57], 0
je 0x4c1c2f
mov eax, dword [esi]
mov eax, dword [eax + 0x3c4]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4c1c2f
mov eax, dword [0x4dad4c]
cmp byte [eax], 0
je 0x4c1afb
push dword [ebp - 0x10]
push 0x4c2a54
mov eax, dword [0x4daf68]
push dword [eax]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405c58
jmp 0x4c1c2f
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405ca0
jbe 0x4c1b28
push dword [ebp - 0xc]
push 0x4c2a54
mov eax, dword [0x4daf68]
push dword [eax]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405c58
jmp 0x4c1c2f
mov ecx, dword [0x4daf68]
mov ecx, dword [ecx]
lea eax, [ebp - 0xc]
mov edx, 0x4c2a5c
call fcn.00405be8
jmp 0x4c1c2f
mov ecx, dword [0x4dae64]
mov ecx, dword [ecx]
lea eax, [ebp - 0xc]
mov edx, 0x4c2a5c
call fcn.00405be8
mov eax, dword [0x4dab8c]
cmp byte [eax], 0
jne 0x4c1b9f
mov eax, dword [esi]
mov eax, dword [eax + 0x3d0]
cmp byte [eax + 0x57], 0
je 0x4c1b9f
mov eax, dword [esi]
mov eax, dword [eax + 0x3d4]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4c1b9f
push dword [ebp - 0xc]
push 0x4c2a54
mov eax, dword [0x4daf3c]
push dword [eax]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405c58
mov eax, dword [0x4dab70]
cmp byte [eax], 0
jne 0x4c1be7
mov eax, dword [esi]
mov eax, dword [eax + 0x3c8]
cmp byte [eax + 0x57], 0
je 0x4c1be7
mov eax, dword [esi]
mov eax, dword [eax + 0x3cc]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4c1be7
push dword [ebp - 0xc]
push 0x4c2a54
mov eax, dword [0x4daf00]
push dword [eax]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405c58
mov eax, dword [0x4dabcc]
cmp byte [eax], 0
jne 0x4c1c2f
mov eax, dword [esi]
mov eax, dword [eax + 0x3c0]
cmp byte [eax + 0x57], 0
je 0x4c1c2f
mov eax, dword [esi]
mov eax, dword [eax + 0x3c4]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4c1c2f
push dword [ebp - 0xc]
push 0x4c2a54
mov eax, dword [0x4daf68]
push dword [eax]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405c58
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405c58
mov eax, dword [0x4dac3c]
cmp byte [eax], 0
je 0x4c1c6c
mov eax, dword [0x4daccc]
mov eax, dword [eax]
mov edx, dword [0x4daef4]
mov edx, dword [edx]
call fcn.00405ca0
je 0x4c1e14
lea eax, [ebp - 8]
call fcn.00405984
mov edi, 0x1d
mov ebx, dword [0x4dab48]
add ebx, 0xc
lea eax, [ebp - 0x40]
mov edx, ebx
call fcn.004053e0
mov edx, dword [ebp - 0x40]
mov eax, dword [0x4dafd0]
mov eax, dword [eax]
call fcn.004055a4
jne 0x4c1cf3
cmp byte [ebx + 3], 0
jbe 0x4c1cf9
mov eax, dword [0x4dafd0]
mov eax, dword [eax]
mov edx, 0x4c2a94
call fcn.004055a4
je 0x4c1cf9
mov eax, dword [0x4dafd0]
mov eax, dword [eax]
mov edx, 0x4c2aa0
call fcn.004055a4
je 0x4c1cf9
push dword [ebp - 8]
push 0x4c2aa8
lea eax, [ebp - 0x44]
lea edx, [ebx + 3]
call fcn.00405b1c
push dword [ebp - 0x44]
push 0x4c2ab4
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405c58
jmp 0x4c1cf9
add ebx, 0x24
dec edi
jne 0x4c1c82
mov eax, dword [0x4db0f4]
cmp byte [eax], 0
jne 0x4c1d17
mov eax, dword [esi]
mov eax, dword [eax + 0x3bc]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
jne 0x4c1d36
push dword [ebp - 8]
push 0x4c2aa8
push 0x4c2ac4
push 0x4c2ab4
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405c58
mov eax, dword [0x4daf54]
cmp byte [eax], 0
je 0x4c1d5f
push dword [ebp - 8]
push 0x4c2aa8
push 0x4c2af4
push 0x4c2ab4
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405c58
push dword [ebp - 8]
push 0x4c2aa8
push 0x4c2b20
push 0x4c2ab4
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405c58
mov eax, dword [0x4dafd4]
cmp byte [eax], 0
jne 0x4c1db1
mov eax, dword [0x4dab80]
cmp byte [eax], 0
jne 0x4c1db1
push dword [ebp - 8]
push 0x4c2aa8
push 0x4c2b40
push 0x4c2ab4
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405c58
lea eax, [ebp - 8]
mov edx, 0x4c2b68
call fcn.00405b88
mov eax, dword [0x4dabb8]
cmp byte [eax], 0
jne 0x4c1dd5
lea eax, [ebp - 8]
mov edx, 0x4c2ba0
call fcn.00405b88
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00405ca0
jbe 0x4c1e14
mov eax, dword [ebp - 8]
cmp word [eax], 0x3b
jne 0x4c1dfc
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.00405d70
push dword [ebp - 4]
push 0x4c2bd4
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405c58
lea eax, [ebp - 4]
mov edx, 0x4c2bf4
call fcn.00405b88
mov eax, dword [0x4dac3c]
cmp byte [eax], 0
je 0x4c1e62
mov eax, dword [0x4daccc]
mov eax, dword [eax]
mov edx, dword [0x4daef4]
mov edx, dword [edx]
call fcn.00405ca0
je 0x4c1e62
push dword [ebp - 4]
push 0x4c2c94
mov eax, dword [0x4daccc]
push dword [eax]
push 0x4c2904
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405c58
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.00409e78
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 4]
call fcn.004059e8
lea eax, [ebp - 0x50]
mov ecx, dword [ebp - 4]
mov edx, 0x4c2cb0
call fcn.00405be8
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
call fcn.00405404
mov eax, dword [ebp - 0x4c]
call fcn.004c4130
mov eax, dword [ebp - 4]
call fcn.00405b6c
push eax
mov eax, dword [0x4dacd0]
mov eax, dword [eax]
call fcn.00405b6c
push eax
mov eax, dword [0x4dae9c]
mov eax, dword [eax]
call eax
mov ebx, eax
mov eax, dword [esi]
mov eax, dword [eax + 0x3c8]
cmp byte [eax + 0x57], 0
je 0x4c1f72
push 0x80000001
push 0
mov eax, dword [esi]
mov eax, dword [eax + 0x3cc]
mov edx, dword [eax]
call dword [edx + 0xd8]
xor ecx, ecx
mov edx, 1
call fcn.00425de8
mov edx, eax
mov ecx, 0x4c2ce4
mov eax, 0x4c2d08
call fcn.004ae3dc
mov ecx, 0x80000001
mov edx, 0x4c2d1c
mov eax, 0x4c2d44
call fcn.004ae590
test al, al
je 0x4c1f2e
mov ecx, 0x80000001
mov edx, 0x4c2d1c
mov eax, 0x4c2d44
call fcn.004ae50c
mov eax, dword [esi]
mov eax, dword [eax + 0x3cc]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4c1f72
mov ecx, 0x80000001
mov edx, 0x4c2d60
mov eax, 0x4c2d84
call fcn.004ae590
test al, al
je 0x4c1f72
push 0x80000001
push 0
mov ecx, 0x4c2d60
xor edx, edx
mov eax, 0x4c2db4
call fcn.004ae3dc
mov eax, dword [esi]
mov eax, dword [eax + 0x3c0]
cmp byte [eax + 0x57], 0
je 0x4c2040
push 0x80000001
push 0
mov eax, dword [esi]
mov eax, dword [eax + 0x3c4]
mov edx, dword [eax]
call dword [edx + 0xd8]
xor ecx, ecx
mov edx, 1
call fcn.00425de8
mov edx, eax
mov ecx, 0x4c2ce4
mov eax, 0x4c2dd0
call fcn.004ae3dc
mov ecx, 0x80000001
mov edx, 0x4c2d1c
mov eax, 0x4c2de0
call fcn.004ae590
test al, al
je 0x4c1fe4
mov ecx, 0x80000001
mov edx, 0x4c2d1c
mov eax, 0x4c2de0
call fcn.004ae50c
mov eax, dword [esi]
mov eax, dword [eax + 0x3c4]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4c2040
mov ecx, 0x80000001
mov edx, 0x4c2dfc
mov eax, 0x4c2d84
call fcn.004ae590
test al, al
je 0x4c2040
push 0x80000001
push 0
mov ecx, 0x4c2dfc
xor edx, edx
mov eax, 0x4c2db4
call fcn.004ae3dc
push 0x80000002
push 0
mov ecx, 0x4c2dfc
xor edx, edx
mov eax, 0x4c2db4
call fcn.004ae3dc
mov eax, dword [esi]
mov eax, dword [eax + 0x3e0]
cmp byte [eax + 0x57], 0
je 0x4c2082
push 0x80000001
push 0
mov eax, dword [esi]
mov eax, dword [eax + 0x3e4]
mov edx, dword [eax]
call dword [edx + 0xd8]
xor ecx, ecx
mov edx, 1
call fcn.00425de8
mov edx, eax
mov ecx, 0x4c2ce4
mov eax, 0x4c2e30
call fcn.004ae3dc
mov eax, dword [esi]
mov eax, dword [eax + 0x3dc]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4c20cf
push 0x80000001
push 0
push 0x4c2904
mov eax, dword [0x4daee8]
push dword [eax]
push 0x4c2e40
lea eax, [ebp - 0x54]
mov edx, 3
call fcn.00405c58
mov edx, dword [ebp - 0x54]
mov ecx, 0x4c2e98
mov eax, 0x4c2ecc
call fcn.004ae46c
jmp 0x4c20fb
mov ecx, 0x80000001
mov edx, 0x4c2e98
mov eax, 0x4c2ecc
call fcn.004ae590
test al, al
je 0x4c20fb
mov ecx, 0x80000001
mov edx, 0x4c2e98
mov eax, 0x4c2ecc
call fcn.004ae50c
push 0x80000001
lea eax, [ebp - 0x58]
push eax
mov ecx, 0x4c2ee0
xor edx, edx
mov eax, 0x4c2efc
call fcn.004ae348
mov eax, dword [ebp - 0x58]
xor edx, edx
call fcn.00405ca0
ja 0x4c214c
xor edx, edx
mov eax, 0x4c2f18
call fcn.0040a414
test eax, eax
jle 0x4c214c
push 0x80000001
push 0
mov ecx, 0x4c2ee0
mov edx, 0x4c2f20
mov eax, 0x4c2efc
call fcn.004ae46c
push 0x80000001
lea eax, [ebp - 0x5c]
push eax
mov ecx, 0x4c2f2c
xor edx, edx
mov eax, 0x4c2f50
call fcn.004ae348
mov eax, dword [ebp - 0x5c]
xor edx, edx
call fcn.00405ca0
ja 0x4c219d
push 0x80000001
push 0
lea eax, [ebp - 0x60]
mov edx, dword [0x4dafd0]
mov edx, dword [edx]
call fcn.00405b5c
mov eax, dword [ebp - 0x60]
push eax
mov ecx, 0x4c2f2c
mov eax, 0x4c2f50
pop edx
call fcn.004ae46c
push 0x80000001
lea eax, [ebp - 0x64]
push eax
mov ecx, 0x4c2f2c
xor edx, edx
mov eax, 0x4c2f68
call fcn.004ae348
mov eax, dword [ebp - 0x64]
xor edx, edx
call fcn.00405ca0
ja 0x4c21ee
push 0x80000001
push 0
lea eax, [ebp - 0x68]
mov edx, dword [0x4dafd0]
mov edx, dword [edx]
call fcn.00405b5c
mov eax, dword [ebp - 0x68]
push eax
mov ecx, 0x4c2f2c
mov eax, 0x4c2f68
pop edx
call fcn.004ae46c
test ebx, ebx
jne 0x4c221f
push 1
lea eax, [ebp - 0x6c]
mov edx, dword [0x4daee8]
mov edx, dword [edx]
call fcn.00405404
lea eax, [ebp - 0x6c]
mov edx, 0x4c2f8c
call fcn.00405448
mov eax, dword [ebp - 0x6c]
call fcn.0040560c
push eax
call sub.kernel32.dll_WinExec
test ebx, ebx
jne 0x4c231b
mov edx, dword [0x4daee8]
mov edx, dword [edx]
lea eax, [ebp - 0x70]
mov ecx, 0x4c2fd0
call fcn.00405be8
mov eax, dword [ebp - 0x70]
call fcn.00477cbc
test al, al
jne 0x4c231b
lea eax, [ebp - 4]
mov edx, 0x4c2ff8
call fcn.004059e8
push dword [ebp - 4]
push 0x4c301c
mov eax, dword [0x4daee8]
push dword [eax]
push 0x4c2904
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405c58
mov eax, dword [0x4dab7c]
cmp byte [eax], 0
jne 0x4c22a6
mov eax, dword [esi]
mov eax, dword [eax + 0x3e0]
cmp byte [eax + 0x57], 0
je 0x4c22a6
mov eax, dword [esi]
mov eax, dword [eax + 0x3e4]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
jne 0x4c22b0
mov eax, dword [0x4daebc]
cmp byte [eax], 0
je 0x4c22bd
lea eax, [ebp - 4]
mov edx, 0x4c290c
call fcn.00405b88
lea eax, [ebp - 4]
mov edx, 0x4c2934
call fcn.00405b88
lea eax, [ebp - 4]
mov edx, 0x4c2bf4
call fcn.00405b88
lea eax, [ebp - 0x78]
mov ecx, dword [ebp - 4]
mov edx, 0x4c303c
call fcn.00405be8
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 0x74]
call fcn.00405404
mov eax, dword [ebp - 0x74]
call fcn.004c4130
mov eax, dword [ebp - 4]
call fcn.00405b6c
push eax
mov eax, dword [0x4dacd0]
mov eax, dword [eax]
call fcn.00405b6c
push eax
mov eax, dword [0x4dae9c]
mov eax, dword [eax]
call eax
mov ebx, eax
test ebx, ebx
je 0x4c2451
cmp ebx, 0xbc2
je 0x4c2451
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x80]
call fcn.0040a388
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
mov edx, 0x4c3074
call fcn.00405494
mov eax, dword [ebp - 0x7c]
call fcn.004c4130
mov eax, dword [0x4dadfc]
mov byte [eax], 2
cmp ebx, 0x642
je 0x4c2429
push 1
push 1
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x88]
mov eax, dword [0x4dac14]
mov eax, dword [eax]
mov edx, 0x4c30a0
call fcn.004745e0
mov eax, dword [ebp - 0x88]
push eax
lea edx, [ebp - 0x94]
mov eax, ebx
call fcn.004be24c
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x90], eax
mov byte [ebp - 0x8c], 0xf
lea edx, [ebp - 0x90]
xor ecx, ecx
pop eax
call fcn.00477768
mov eax, dword [ebp - 0x84]
or ecx, 0xffffffff
xor edx, edx
call fcn.004bb0f0
lea eax, [ebp - 0x9c]
call fcn.004aee50
push dword [ebp - 0x9c]
push 0x4c30cc
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa4]
call fcn.0040a388
mov edx, dword [ebp - 0xa4]
lea eax, [ebp - 0xa0]
call fcn.00405b5c
push dword [ebp - 0xa0]
lea eax, [ebp - 0x98]
mov edx, 3
call fcn.00405c58
mov eax, dword [ebp - 0x98]
call fcn.004aea90
cmp dword [esi], 0
je 0x4c2444
push 0
push 0
push 0xd30
mov eax, dword [esi]
call fcn.004578a8
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c25fe
call fcn.004ba6e8
call fcn.004b6cb8
mov eax, dword [esi]
mov eax, dword [eax + 0x3d0]
cmp byte [eax + 0x57], 0
je 0x4c2487
mov eax, dword [esi]
mov eax, dword [eax + 0x3d4]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4c2487
mov eax, 0x4c30ec
call fcn.004c630c
mov eax, dword [esi]
mov eax, dword [eax + 0x3c8]
cmp byte [eax + 0x57], 0
je 0x4c24b3
mov eax, dword [esi]
mov eax, dword [eax + 0x3cc]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4c24b3
mov eax, 0x4c30f8
call fcn.004c630c
mov eax, dword [esi]
mov eax, dword [eax + 0x3c0]
cmp byte [eax + 0x57], 0
je 0x4c24df
mov eax, dword [esi]
mov eax, dword [eax + 0x3c4]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4c24df
mov eax, 0x4c3104
call fcn.004c630c
mov eax, dword [0x4dab80]
cmp byte [eax], 0
je 0x4c2519
mov eax, dword [0x4dadfc]
mov byte [eax], 4
cmp dword [esi], 0
je 0x4c250c
push 0
push 0
push 0xd30
mov eax, dword [esi]
call fcn.004578a8
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c25fe
test ebx, ebx
jne 0x4c2580
mov eax, 0x4c3110
call fcn.004c4130
mov eax, dword [0x4dadfc]
mov byte [eax], 4
mov eax, dword [0x4db084]
cmp byte [eax], 0
je 0x4c2542
mov eax, dword [esi]
call fcn.004d1820
jmp 0x4c25be
mov eax, dword [esi]
mov eax, dword [eax + 0x3e0]
cmp byte [eax + 0x57], 0
je 0x4c2564
mov eax, dword [esi]
mov eax, dword [eax + 0x3e4]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
jne 0x4c256e
mov eax, dword [0x4daebc]
cmp byte [eax], 0
je 0x4c2577
mov eax, dword [esi]
call fcn.0046af2c
jmp 0x4c25be
mov eax, dword [esi]
call fcn.004d1cb8
jmp 0x4c25be
cmp ebx, 0xbc2
jne 0x4c25be
mov eax, 0x4c3138
call fcn.004c4130
mov eax, dword [0x4dadfc]
mov byte [eax], 5
mov eax, dword [0x4dac74]
cmp byte [eax], 0
jne 0x4c25ae
mov eax, dword [0x4dacc8]
cmp byte [eax], 0
je 0x4c25b7
mov eax, dword [esi]
call fcn.004d1820
jmp 0x4c25be
mov eax, dword [esi]
call fcn.004d1e6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c25fe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c26f2
lea eax, [ebp - 0xa8]
mov edx, 2
call fcn.004051a0
lea eax, [ebp - 0xa0]
mov edx, 4
call fcn.0040599c
lea eax, [ebp - 0x88]
mov edx, 2
call fcn.0040599c
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.004051a0
lea eax, [ebp - 0x78]
call fcn.00405984
lea eax, [ebp - 0x74]
call fcn.0040517c
lea eax, [ebp - 0x70]
call fcn.00405984
lea eax, [ebp - 0x6c]
call fcn.0040517c
lea eax, [ebp - 0x68]
mov edx, 7
call fcn.0040599c
lea eax, [ebp - 0x4c]
call fcn.0040517c
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040599c
lea eax, [ebp - 0x40]
call fcn.0040517c
lea eax, [ebp - 0x3c]
call fcn.00405984
lea eax, [ebp - 0x38]
call fcn.0040517c
lea eax, [ebp - 0x34]
call fcn.00405984
lea eax, [ebp - 0x30]
call fcn.0040517c
lea eax, [ebp - 0x2c]
call fcn.00405984
lea eax, [ebp - 0x28]
call fcn.0040517c
lea eax, [ebp - 0x24]
call fcn.00405984
lea eax, [ebp - 0x20]
call fcn.0040517c
lea eax, [ebp - 0x1c]
call fcn.00405984
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040599c
ret