Function at 0x4ca74d
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xfc
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0x7c]
mov eax, 0x2b74
cmp ecx, eax
mov dword [ebp + 0x40], edi
jg 0x4ca86b
je 0x4ca85f
cmp ecx, 0x41
jg 0x4ca815
je 0x4ca80b
cmp ecx, 0x2f
je 0x4ca801
cmp ecx, 0x31
jle case.0x4ca881.11127
cmp ecx, 0x33
jle 0x4ca7f4
cmp ecx, 0x34
je 0x4ca7e7
jle case.0x4ca881.11127
cmp ecx, 0x38
jle 0x4ca7f4
xor ebx, ebx
mov byte [ebp + 0x72], bl
cmp ecx, 0x28
jne 0x4ca7ba
mov eax, dword [0x54b1b8]
cmp eax, 4
jae 0x4ca7ba
add eax, 0x17
mov dword [ebp + 0x7c], eax
mov eax, dword [edi + 0x108]
mov eax, dword [eax + 0x14]
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
shr ecx, 0x1f
test cl, 1
jne 0x4ca90f
imul eax, eax, 0xc
call fcn.00401000
mov dword [ebp + 0x4c], esp
jmp 0x4ca91f
mov ecx, dword [edi + 4]
call fcn.004a9eb2
jmp case.0x4ca881.11125
push ecx
mov ecx, edi
call fcn.004c94a1
jmp case.0x4ca881.11125
call fcn.004ce446
jmp case.0x4ca881.11125
call fcn.004b94e7
jmp case.0x4ca881.11125
mov eax, ecx
sub eax, 0x72
je 0x4ca853
sub eax, 3
je 0x4ca847
dec eax
je 0x4ca83b
sub eax, 0x2afd
jne case.0x4ca881.11127
mov ecx, edi
call fcn.004c9814
jmp case.0x4ca881.11125
mov ecx, edi
call fcn.004c46b6
jmp case.0x4ca881.11125
mov ecx, edi
call fcn.004c4535
jmp case.0x4ca881.11125
mov ecx, edi
call fcn.004c8a84
jmp case.0x4ca881.11125
mov ecx, edi
call fcn.004c9823
jmp case.0x4ca881.11125
lea eax, [ecx - 0x2b75]
cmp eax, 0x10
ja case.0x4ca881.11127
movzx eax, byte [eax + 0x4cb411]
jmp dword [eax*4 + 0x4cb3ed]
mov ecx, edi
call fcn.004c9c0f
jmp case.0x4ca881.11125
mov ecx, edi
call fcn.004c9bef
jmp case.0x4ca881.11125
mov ecx, edi
call fcn.004c4678
jmp case.0x4ca881.11125
mov ecx, edi
call fcn.004c9832
jmp case.0x4ca881.11125
mov ecx, edi
call fcn.004c9849
jmp case.0x4ca881.11125
mov ecx, edi
call fcn.004c46aa
jmp case.0x4ca881.11125
mov esi, dword [edi + 0x28]
add esi, 0x30
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x4ca903
mov eax, dword [esi]
push dword [eax + ebx*4]
mov ecx, dword [edi + 0x28]
call fcn.00423a30
test eax, eax
je 0x4ca8fd
cmp byte [eax + 0x14], 0x17
jne 0x4ca8fd
mov ecx, dword [edi + 0x28]
push eax
call fcn.00425b49
inc ebx
cmp ebx, dword [esi + 8]
jb 0x4ca8dd
mov ecx, edi
call fcn.004c3477
jmp case.0x4ca881.11125
call esi
mov dword [0x54f634], eax
mov dword [0], ebx
mov dword [ebp + 0x4c], ebx
mov eax, dword [edi + 0x108]
mov eax, dword [eax + 0x14]
mov ecx, eax
shr ecx, 0x1f
test cl, 1
jne 0x4ca93f
shl eax, 2
call fcn.00401000
mov dword [ebp + 0x60], esp
jmp 0x4ca94f
call esi
mov dword [0x54f634], eax
mov dword [0], ebx
mov dword [ebp + 0x60], ebx
mov eax, dword [edi + 0x108]
mov eax, dword [eax + 8]
push 2
push 0xffffffffffffffff
push 0x100c
push eax
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x68], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp + 0x54], eax
cmp eax, 0xffffffff
je 0x4caa9e
mov ebx, dword [ebp + 0x4c]
mov dword [ebp + 0x6c], ebx
mov eax, dword [edi + 0x108]
mov ecx, dword [ebp + 0x50]
cmp ecx, dword [eax + 0x14]
jae 0x4caa9e
mov esi, dword [ebp + 0x54]
mov eax, dword [edi + 0x58]
and dword [ebp + 0x44], 0
shl esi, 2
mov eax, dword [eax + esi]
mov eax, dword [eax + 0x1c]
mov dword [ebx], eax
cmp eax, 1
jne 0x4caa33
mov eax, dword [edi + 0x58]
mov eax, dword [eax + esi]
mov ecx, dword [eax + 0xc8]
call fcn.004860f1
mov ecx, dword [eax + 0x24]
and dword [ebp + 0x5c], 0
mov dword [ebp + 0x58], ecx
test ecx, ecx
jbe 0x4caa33
mov ecx, dword [ebp + 0x40]
mov ecx, dword [ecx + 0x58]
mov edi, dword [esi + ecx]
mov ebx, dword [eax + 0x1c]
mov ecx, dword [edi + 0x20]
mov eax, dword [ebx + 4]
call fcn.0047cb94
test eax, eax
jne 0x4caa1a
mov ecx, dword [edi + 0xcc]
mov eax, dword [ebx + 8]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4caa11
test dl, dl
je 0x4caa0d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4caa11
inc eax
inc eax
inc ecx
inc ecx
test dl, dl
jne 0x4ca9f3
xor eax, eax
jmp 0x4caa16
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4caa2a
inc dword [ebp + 0x5c]
mov eax, dword [ebp + 0x5c]
add ebx, 0x54
cmp eax, dword [ebp + 0x58]
jb 0x4ca9db
jmp 0x4caa2d
mov dword [ebp + 0x44], ebx
mov ebx, dword [ebp + 0x6c]
mov edi, dword [ebp + 0x40]
mov eax, dword [ebp + 0x44]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0x58]
mov eax, dword [esi + eax]
cmp dword [eax + 0x1c], 0
jne 0x4caa4d
mov eax, dword [eax + 0xc4]
jmp 0x4caa4f
xor eax, eax
cmp dword [ebx], 0
mov dword [ebx + 4], eax
jne 0x4caa6f
mov eax, dword [edi + 0x58]
mov eax, dword [eax + esi]
mov edx, dword [ebp + 0x68]
mov eax, dword [eax + 0xc4]
mov ecx, dword [ebp + 0x60]
inc dword [ebp + 0x68]
mov dword [ecx + edx*4], eax
mov eax, dword [edi + 0x108]
mov eax, dword [eax + 8]
inc dword [ebp + 0x50]
push 2
push dword [ebp + 0x54]
add ebx, 0xc
push 0x100c
push eax
mov dword [ebp + 0x6c], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp + 0x54], eax
cmp eax, 0xffffffff
jne 0x4ca980
cmp dword [ebp + 0x7c], 0x25
je 0x4cabb1
cmp dword [ebp + 0x7c], 0x2c
jne 0x4cab06
cmp dword [ebp + 0x68], 0xa
jbe 0x4cab06
push dword [ebp + 0x68]
lea eax, [ebp + 0x58]
push dword [0x550680]
mov dword [ebp - 0x18], 1
push eax
mov dword [ebp - 0x14], 4
call fcn.0048f08b
add esp, 0xc
mov ecx, eax
call fcn.0048ea50
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0046960b
pop ecx
pop ecx
lea ecx, [ebp + 0x58]
mov esi, eax
call fcn.0048e75f
cmp esi, 7
je case.0x4ca881.11125
cmp esi, 2
je case.0x4ca881.11125
mov eax, dword [ebp + 0x50]
mov esi, dword [ebp + 0x68]
sub eax, esi
xor ebx, ebx
mov dword [ebp + 0x24], eax
cmp dword [ebp + 0x50], ebx
je case.0x4ca881.11125
cmp esi, ebx
jbe 0x4cac4b
mov eax, dword [ebp + 0x7c]
cmp eax, 0x17
je 0x4cab3f
cmp eax, 0x18
je 0x4cab3f
cmp eax, 0x19
je 0x4cab3f
cmp eax, 0x1a
jne 0x4cac4b
cmp byte [0x54b019], 0
je 0x4cac4b
mov dword [ebp - 0x14], 0x24
mov dword [ebp - 0x18], 9
mov dword [ebp - 4], 0x54b019
cmp esi, 1
jne 0x4cab77
mov eax, dword [ebp + 0x60]
mov eax, dword [eax]
cmp dword [eax + 0x1dc], ebx
je 0x4cabf9
push esi
push 0
lea eax, [ebp + 0x58]
push eax
call fcn.004c0d1c
mov ecx, eax
call fcn.0048ea50
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0046960b
pop ecx
pop ecx
cmp eax, 6
lea ecx, [ebp + 0x58]
setne bl
call fcn.0048e75f
test bl, bl
jne case.0x4ca881.11125
jmp 0x4cac4b
cmp dword [ebp + 0x68], 0xa
jbe 0x4cab06
push dword [ebp + 0x68]
lea eax, [ebp + 0x48]
push dword [0x55067c]
mov dword [ebp - 0x38], 1
push eax
mov dword [ebp - 0x34], 4
call fcn.0048f08b
add esp, 0xc
mov ecx, eax
call fcn.0048ea50
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0046960b
pop ecx
pop ecx
lea ecx, [ebp + 0x48]
jmp 0x4caaed
push eax
push edi
lea ecx, [ebp - 0x88]
call fcn.004ae044
push ebx
push 0x110
call fcn.00468857
push eax
lea ecx, [ebp - 0x88]
call fcn.00468553
mov eax, dword [edi + 4]
push 0x1b
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
cmp byte [ebp - 0x68], 0
lea ecx, [ebp - 0x88]
jne 0x4cac46
call fcn.004add03
jmp case.0x4ca881.11125
call fcn.004add03
mov byte [ebp + 0x73], 1
call fcn.0046e5c1
cmp dword [ebp + 0x7c], 0x22
jne 0x4caca5
xor ebx, ebx
test esi, esi
jbe 0x4cac9e
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x68]
lea esi, [eax + ecx*4 - 4]
mov eax, dword [ebp + 0x60]
mov ecx, dword [eax + ebx*4]
call fcn.00490f07
test al, al
jne 0x4cac89
mov eax, dword [esi]
mov ecx, dword [ebp + 0x60]
dec dword [ebp + 0x68]
mov dword [ecx + ebx*4], eax
sub esi, 4
jmp 0x4cac98
mov eax, dword [ebp + 0x60]
mov eax, dword [eax + ebx*4]
test byte [eax + 0x1be], 0x20
je 0x4cacdd
inc ebx
cmp ebx, dword [ebp + 0x68]
jb 0x4cac6a
mov dword [ebp + 0x7c], 0x23
cmp dword [ebp + 0x7c], 0x13
jne 0x4cacc9
cmp dword [0x54affc], 0
je 0x4cacdd
push ecx
mov edx, str.A4D77A09_10EA_4574_8C09_9B6E1A21C95F
mov ecx, esp
call fcn.00493d05
push 0xb
pop ecx
call fcn.0048bd92
cmp dword [ebp + 0x7c], 0x1c
je 0x4cb36d
cmp dword [ebp + 0x7c], 0x1b
je 0x4cb36d
xor eax, eax
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x54], eax
cmp dword [ebp + 0x50], eax
jbe 0x4cb32e
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp + 0x4c]
mov esi, dword [eax + 4]
mov ebx, dword [eax + 8]
mov eax, dword [eax]
test eax, eax
jne 0x4cb297
mov ecx, esi
call fcn.00490f07
test al, al
je 0x4cb30c
mov ebx, dword [ebp + 0x7c]
lea edx, [ebx - 0x2710]
cmp edx, 0x3e7
ja 0x4cad34
mov ecx, esi
call fcn.00446e9a
cmp ebx, 0x6a
jg 0x4cb280
je 0x4cb234
cmp ebx, 0x25
jg 0x4caeeb
je 0x4caed0
cmp ebx, 0x1f
jg 0x4cae87
cmp ebx, 0x1d
jge 0x4cae64
cmp ebx, 0x13
je 0x4cae14
cmp ebx, 0x14
je 0x4cae08
cmp ebx, 0x15
je 0x4cadef
cmp ebx, 0x16
je 0x4cb1bb
jle 0x4cb30c
cmp ebx, 0x1a
jg 0x4cb30c
mov ecx, esi
call fcn.00480b6e
movzx eax, byte [0x54b1cf]
neg eax
sbb eax, eax
and eax, 4
add ebx, 0xffffffe9
or eax, ebx
push eax
mov ecx, esi
call fcn.0041c7ac
cmp esi, dword [edi + 0x100]
jne 0x4cadc6
push 0
mov ecx, edi
call fcn.004c01e4
cmp esi, dword [edi + 0xa0]
jne 0x4cb30c
mov eax, dword [edi + 0x108]
push 0
push 0xffffffffffffffff
push 0x1076
push dword [eax + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4caec7
test byte [esi + 0x1be], 0x40
jne 0x4caec7
mov ecx, esi
call fcn.00419ff0
jmp 0x4caec7
mov ecx, esi
call fcn.0041352b
jmp 0x4caec7
xor ebx, ebx
cmp dword [0x54affc], ebx
je 0x4cb30c
cmp byte [0x54b10c], bl
jne 0x4cae38
mov ecx, dword [edi + 0x108]
push ebx
push 0xe
call fcn.0042ac59
mov ecx, dword [0x54affc]
push 1
push 0xffffffffffffffff
push esi
call fcn.00402890
mov ecx, dword [0x54affc]
cmp byte [ecx + 0x10], 0
je 0x4cb30c
push ebx
push ebx
call fcn.004032f3
jmp 0x4cb30c
add ebx, 0xffffffe3
push ebx
mov ecx, esi
call fcn.0040cc9e
push 0
push 0x20000
mov ecx, esi
call fcn.00409d0f
call fcn.0048ff3e
jmp 0x4cb30c
mov eax, ebx
sub eax, 0x20
je 0x4cb338
dec eax
je 0x4caec0
dec eax
je 0x4caeb7
dec eax
je 0x4caeae
dec eax
jne 0x4cb30c
mov ecx, esi
call fcn.0040d179
jmp 0x4cb30c
mov ecx, esi
call fcn.00419ed3
jmp 0x4caec7
mov ecx, esi
call fcn.00419f56
jmp 0x4caec7
mov ecx, esi
call fcn.0041a7da
mov byte [ebp + 0x72], 1
jmp 0x4cb30c
mov eax, dword [esi + 0x168]
xor edx, edx
cmp byte [eax + 0x28], dl
mov ecx, esi
sete dl
dec edx
call fcn.004470ef
jmp 0x4cb30c
cmp ebx, 0x2c
jg 0x4cb1a1
je 0x4cb190
mov eax, ebx
sub eax, 0x26
je 0x4caf3c
dec eax
je 0x4caf30
dec eax
dec eax
je 0x4caf24
dec eax
je 0x4caf16
dec eax
jne 0x4cb30c
xor dl, dl
jmp 0x4caf18
mov dl, 1
mov ecx, esi
call fcn.004b2c51
jmp 0x4cb30c
mov ecx, esi
call fcn.0040cb1d
jmp 0x4cb30c
mov ecx, esi
call fcn.0040cbe4
jmp 0x4cb30c
lea ecx, [ebp + 0x6c]
mov byte [ebp + 0x67], 0
call fcn.0048ea4a
lea eax, [ebp + 0x73]
push eax
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x6c]
push eax
xor dl, dl
mov ecx, esi
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], 0x23
mov dword [ebp + 0x44], 0x4f4560
call fcn.004b8435
mov bl, al
neg bl
sbb bl, bl
inc bl
mov dword [ebp + 0x44], 0x4f44f4
je 0x4cb183
mov eax, dword [esi + 0x168]
cmp byte [eax + 0x28], 0
je 0x4cafd4
mov ecx, esi
call fcn.0040a1b1
lea ecx, [ebp + 0x6c]
mov edi, eax
call fcn.0048ea50
mov edx, edi
mov ecx, eax
call fcn.0048d850
test al, al
jne 0x4cafd4
mov ecx, esi
call fcn.0040a1b1
lea ecx, [ebp + 0x6c]
mov edi, eax
call fcn.0048ea50
mov edx, edi
mov ecx, eax
call fcn.004a327a
push eax
lea ecx, [ebp + 0x6c]
call fcn.0048ea75
lea ecx, [ebp + 0x5c]
xor edi, edi
call fcn.0048ea4a
mov eax, dword [esi + 0x168]
cmp byte [eax + 0x28], 0
je 0x4cb00f
mov eax, dword [eax]
lea ecx, [ebp + 0x6c]
mov dword [ebp + 0x48], eax
call fcn.0048ea50
mov ecx, dword [ebp + 0x48]
mov edx, dword [ecx + 0x1c]
mov ecx, eax
call fcn.004a327a
push eax
lea ecx, [ebp + 0x5c]
call fcn.0048e768
jmp 0x4cb01a
push dword [ebp + 0x6c]
lea ecx, [ebp + 0x5c]
call fcn.0048ea75
lea ecx, [ebp + 0x5c]
call fcn.0048ea50
mov ecx, eax
call fcn.00472429
test al, al
je 0x4cb09e
cmp byte [ebp + 0x73], 0
je 0x4cb03c
mov byte [ebp + 0x73], 0
call fcn.0046e5dd
mov ebx, dword [0x55113c]
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x18], edi
call fcn.0048ea50
push eax
lea eax, [ebp + 0x14]
push ebx
push eax
call fcn.0048e075
add esp, 0xc
lea ecx, [ebp + 0x14]
call fcn.0048e055
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0046960b
pop ecx
pop ecx
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x48], eax
call fcn.0048e6b4
cmp dword [ebp + 0x48], 6
sete bl
cmp dword [ebp + 0x48], 7
sete byte [ebp + 0x67]
cmp byte [ebp + 0x73], 0
jne 0x4cb09e
mov byte [ebp + 0x73], 1
call fcn.0046e5c1
test bl, bl
je 0x4cb0be
push edi
push edi
lea ecx, [ebp + 0x6c]
call fcn.0048ea50
push eax
mov ecx, esi
call fcn.0041a374
call fcn.0048ff3e
jmp 0x4cb178
cmp byte [ebp + 0x67], 0
je 0x4cb178
mov ebx, dword [esi + 0x168]
cmp byte [ebx + 0x28], 0
lea ecx, [ebp + 0x6c]
je 0x4cb0e9
call fcn.0048ea50
push eax
mov ecx, ebx
call fcn.0044190f
jmp 0x4cb178
mov dword [ebp + 0x28], edi
mov dword [ebp + 0x30], edi
mov dword [ebp + 0x2c], edi
call fcn.0048ea50
push 0x5c
push eax
call sub.MSVCRT.dll_wcsrchr
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
je 0x4cb12b
lea ecx, [ebp + 0x6c]
call fcn.0048ea50
mov ecx, ebx
sub ecx, eax
sar ecx, 1
push ecx
lea ecx, [ebp + 0x6c]
call fcn.0048ea50
push eax
lea ecx, [ebp + 0x28]
call fcn.0048dec5
inc ebx
inc ebx
jmp 0x4cb143
call fcn.004a348e
push eax
lea ecx, [ebp + 0x28]
call fcn.0048de9f
lea ecx, [ebp + 0x6c]
call fcn.0048ea50
mov ebx, eax
mov edi, dword [esi + 0x168]
lea ecx, [ebp + 0x28]
call fcn.0048e055
push eax
mov ecx, edi
call fcn.0044190f
mov ecx, ebx
call fcn.004221f4
mov esi, dword [esi + 0x168]
push eax
push dword [esi]
mov ecx, esi
call fcn.00441929
lea ecx, [ebp + 0x28]
call fcn.0048e6b4
lea ecx, [ebp + 0x5c]
call fcn.0048e75f
mov edi, dword [ebp + 0x40]
lea ecx, [ebp + 0x6c]
call fcn.0048e75f
jmp 0x4cb30c
push 0
or edx, 0xffffffff
mov ecx, esi
call 0x446d93
jmp 0x4cb30c
mov eax, ebx
sub eax, 0x2d
je 0x4cb1f6
dec eax
je 0x4cb35c
sub eax, 0xb
je 0x4cb1c7
dec eax
jne 0x4cb30c
mov ecx, esi
call fcn.0041a8b0
jmp 0x4caec7
cmp dword [ebp + 0x3c], 0
jbe 0x4cb1da
push 0x4f559c
lea ecx, [ebp + 0x34]
call fcn.0048de9f
mov ecx, esi
call fcn.0040d1aa
mov ecx, eax
call fcn.0048c22b
push eax
lea ecx, [ebp + 0x34]
call fcn.0048de9f
jmp 0x4cb30c
xor eax, eax
mov dword [ebp + 8], eax
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], eax
cmp byte [ebp + 0x73], al
je 0x4cb20e
mov byte [ebp + 0x73], al
call fcn.0046e5dd
mov edx, esi
lea ecx, [ebp + 8]
call fcn.004d5b0a
cmp byte [ebp + 0x73], 0
jne 0x4cb227
mov byte [ebp + 0x73], 1
call fcn.0046e5c1
lea ecx, [ebp + 8]
call fcn.0048e6b4
jmp 0x4cb30c
mov ecx, esi
call fcn.0040a1bb
push eax
lea eax, [ebp + 0x58]
push eax
lea ecx, [esi + 0x1c]
call fcn.0042d707
lea ecx, [ebp + 0x58]
call fcn.0048ea50
push eax
lea eax, [ebp + 0x20]
push 0x4fa324
push eax
call fcn.0048f08b
add esp, 0xc
mov ecx, eax
call fcn.0048ea50
mov ecx, eax
call fcn.004a472a
lea ecx, [ebp + 0x20]
call fcn.0048e75f
lea ecx, [ebp + 0x58]
jmp 0x4cb186
cmp ebx, 0x6c
jne 0x4cb30c
push 1
xor eax, eax
push eax
push eax
push dword [esi + 0x460]
jmp 0x4cb2f3
cmp eax, 1
jne 0x4cb30c
mov ecx, dword [ebx + 0x38]
call fcn.004860f1
mov ecx, dword [ebp + 0x7c]
sub ecx, 0x16
je 0x4cb2bd
sub ecx, 0x1a
je 0x4cb2ea
dec ecx
je 0x4cb2dc
dec ecx
dec ecx
je 0x4cb2cc
sub ecx, 8
jne 0x4cb30c
cmp dword [ebp + 0x24], 1
mov ecx, ebx
jbe 0x4cb2fd
call fcn.0048885e
jmp 0x4cb30c
push dword [ebx + 8]
mov edx, dword [ebx + 4]
mov ecx, dword [eax + 0x10]
call fcn.00487f40
jmp 0x4cb30c
mov ecx, ebx
call fcn.004862c1
call fcn.004ce446
jmp 0x4cb30c
push 1
xor eax, eax
push eax
push eax
push dword [ebx + 8]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4cb30c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
xor edx, edx
call fcn.0048709e
inc dword [ebp + 0x54]
mov eax, dword [ebp + 0x54]
add dword [ebp + 0x4c], 0xc
cmp eax, dword [ebp + 0x50]
jb 0x4cacfa
mov edx, dword [ebp + 0x3c]
test edx, edx
jbe 0x4cb32e
mov ecx, dword [ebp + 0x34]
call fcn.004a50d8
lea ecx, [ebp + 0x34]
call fcn.0048e6b4
jmp 0x4cb3ae
push 0xa3
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edx, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x60]
test ax, ax
jge 0x4cb355
call fcn.00445856
jmp 0x4cb3d1
call fcn.004de4c1
jmp 0x4cb3d1
cmp byte [ebp + 0x73], 0
je case.0x4ca881.11125
mov byte [ebp + 0x73], 0
call fcn.0046e5dd
jmp 0x4cb3d1
xor eax, eax
cmp dword [ebp + 0x7c], 0x1b
push 0x10
sete al
add eax, 4
mov esi, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x4cb38b
or esi, 2
mov edx, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x60]
push esi
call fcn.0049173e
call fcn.0048ff3e
and dword [0x549b50], 0
and dword [0x549b54], 0
mov byte [ebp + 0x72], 1
cmp byte [ebp + 0x73], 0
je 0x4cb3bd
mov byte [ebp + 0x73], 0
call fcn.0046e5dd
cmp byte [ebp + 0x72], 0
je 0x4cb3ca
mov ecx, edi
call fcn.004c939a
mov ecx, edi
call fcn.004c3b35
cmp byte [ebp + 0x73], 0
je case.0x4ca881.11125
call fcn.0046e5dd
lea esp, [ebp - 0x94]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4