Function at 0x4e5ec0
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor
Get common file path
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x160
mov eax, dword [0x52f098]
xor eax, esp
mov dword [esp + 0x15c], eax
push esi
mov esi, dword [ebp + 0x10]
mov cl, 0x14
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [esp + 0x88], 0x61755814
mov dword [esp + 0x8c], 0x717c777a
mov dword [esp + 0x90], 0x713a5066
mov word [esp + 0x94], 0x716c
mov byte [esp + 0x96], 0
nop dword [eax]
xor byte [esp + eax + 0x89], cl
inc eax
cmp eax, 0xd
jae 0x4e5f36
mov cl, byte [esp + 0x88]
jmp 0x4e5f20
lea eax, [esp + 0x89]
mov byte [esp + 0x96], 0
push eax
call fcn.004bd90f
add esp, 4
mov dword [esp + 0x88], 0x24772104
cmp dword [0x540704], 0x10
mov edx, 0x5406f0
mov cl, 4
mov dword [esp + 0x8c], 0x6a716548
cmovae edx, dword [0x5406f0]
xor eax, eax
mov dword [esp + 0x90], 0x76616c67
mov byte [esp + 0x94], 0
nop
xor byte [esp + eax + 0x89], cl
inc eax
cmp eax, 0xb
jae 0x4e5fa6
mov cl, byte [esp + 0x88]
jmp 0x4e5f90
push edx
sub esp, 0x18
mov byte [esp + 0xb0], 0
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [esp + 0xa5], 0
jne 0x4e5fd3
xor ecx, ecx
jmp 0x4e5fec
lea ecx, [esp + 0xa5]
lea eax, [ecx + 1]
mov dword [esp + 0x28], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e5fe1
sub ecx, dword [esp + 0x28]
push ecx
lea eax, [esp + 0xa9]
mov ecx, edx
push eax
call fcn.00445cb0
lea eax, [esp + 0xbc]
push eax
call fcn.004ed610
push 0x2cc
call fcn.0049e639
add esp, 0x24
mov ecx, eax
call fcn.004eb640
mov dword [0x540428], eax
cmp dword [eax + 0x18], 0
jne 0x4e60b7
movaps xmm0, xmmword [0x5259b0]
lea edx, [esp + 0xa0]
cmp dword [esp + 0xb4], 0x10
movups xmmword [esp + 0xb8], xmm0
cmovae edx, dword [esp + 0xa0]
xor ecx, ecx
movaps xmm0, xmmword [0x5259a0]
movups xmmword [esp + 0xc8], xmm0
mov dword [esp + 0xd8], 0x1e020b0b
mov dword [esp + 0xdc], 0x46090e
nop dword [eax]
mov al, byte [esp + 0xb8]
xor byte [esp + ecx + 0xb9], al
inc ecx
cmp ecx, 0x26
jb 0x4e6080
push 0x10
push edx
lea eax, [esp + 0xc1]
mov byte [esp + 0xe7], 0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004e7920
test eax, eax
jne 0x4e6167
movaps xmm0, xmmword [0x526080]
lea edx, [esp + 0xa0]
cmp dword [esp + 0xb4], 0x10
movups xmmword [esp + 0xb8], xmm0
cmovae edx, dword [esp + 0xa0]
xor ecx, ecx
movaps xmm0, xmmword [0x525ca0]
movups xmmword [esp + 0xc8], xmm0
mov dword [esp + 0xf8], 0x742e383a
movaps xmm0, xmmword [0x525bf0]
movups xmmword [esp + 0xd8], xmm0
mov byte [esp + 0xfc], al
movaps xmm0, xmmword [0x525c50]
movups xmmword [esp + 0xe8], xmm0
nop dword [eax + eax]
mov al, byte [esp + 0xb8]
xor byte [esp + ecx + 0xb9], al
inc ecx
cmp ecx, 0x43
jb 0x4e6130
push 0x10
push edx
lea eax, [esp + 0xc1]
mov byte [esp + 0x104], 0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov cl, 0x5b
mov dword [esp + 0x88], 0x2e3a175b
mov dword [esp + 0x8c], 0x3e333835
xor eax, eax
mov dword [esp + 0x90], 0x233e7529
mov word [esp + 0x94], 0x3e
nop word [eax + eax]
xor byte [esp + eax + 0x89], cl
inc eax
cmp eax, 0xc
jae 0x4e61b6
mov cl, byte [esp + 0x88]
jmp 0x4e61a0
xor dl, dl
mov byte [esp + 0x95], 0
lea ecx, [esp + 0x89]
call fcn.004e74b0
test al, al
jne 0x4e6249
movaps xmm0, xmmword [0x525db0]
lea edx, [esp + 0xa0]
cmp dword [esp + 0xb4], 0x10
movups xmmword [esp + 0xb8], xmm0
cmovae edx, dword [esp + 0xa0]
xor ecx, ecx
movaps xmm0, xmmword [0x525a60]
movups xmmword [esp + 0xc8], xmm0
mov dword [esp + 0xd8], 0x803000d
mov dword [esp + 0xdc], 0x4013080d
mov byte [esp + 0xe0], al
nop dword [eax]
nop dword [eax + eax]
mov al, byte [esp + 0xb8]
xor byte [esp + ecx + 0xb9], al
inc ecx
cmp ecx, 0x27
jb 0x4e6230
jmp 0x4e72ed
call fcn.004e7310
push 0
push 0
push 0
push 0x4e41c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x5401a8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov al, 0x7b
mov byte [esp + 0x88], 0x27
mov byte [esp + 0x13], al
mov cl, 0x6b
xor al, byte [esp + 0x88]
mov ah, 0x52
xor cl, byte [esp + 0x88]
mov dl, 0x46
mov byte [esp + 0x89], al
mov ch, 0x49
mov byte [esp + 0x8a], cl
mov dh, 0x44
mov cl, byte [esp + 0x88]
mov byte [esp + 0x10], 0x4f
xor ah, cl
mov al, byte [esp + 0x10]
xor dl, cl
xor al, cl
mov byte [esp + 0x11], 0x42
mov byte [esp + 0x8f], al
xor dh, cl
mov al, byte [esp + 0x11]
xor ch, cl
xor al, cl
mov byte [esp + 0x12], 0x55
mov byte [esp + 0x90], al
mov al, byte [esp + 0x12]
xor al, cl
mov byte [esp + 0x8c], ah
mov byte [esp + 0x91], al
mov al, byte [esp + 0x13]
xor al, cl
mov byte [esp + 0x8b], dl
mov byte [esp + 0x92], al
lea eax, [esp + 0x89]
push eax
mov byte [esp + 0x91], ch
lea ecx, [esp + 0x11c]
mov byte [esp + 0x92], dh
mov edx, 0x523cc8
mov byte [esp + 0x97], 0
push 0x540708
mov byte [esp + 0x9b], 0
call fcn.00445eb0
add esp, 4
lea ecx, [esp + 0x104]
mov edx, eax
call fcn.00445fc0
add esp, 4
lea ecx, [esp + 0x130]
push eax
call fcn.00444fe0
mov eax, dword [esp + 0x114]
cmp eax, 0x10
jb 0x4e6385
inc eax
lea ecx, [esp + 0x100]
push eax
push dword [esp + 0x104]
call fcn.00445a30
mov eax, dword [esp + 0x12c]
mov dword [esp + 0x114], 0xf
mov dword [esp + 0x110], 0
mov byte [esp + 0x100], 0
cmp eax, 0x10
jb 0x4e63c4
inc eax
lea ecx, [esp + 0x118]
push eax
push dword [esp + 0x11c]
call fcn.00445a30
movss xmm1, dword [0x52591c]
xorps xmm3, xmm3
movss xmm2, dword [0x525910]
movaps xmm0, xmm3
unpcklps xmm0, xmm3
movq qword [0x540b98], xmm0
movaps xmm0, xmm1
unpcklps xmm0, xmm2
movq qword [0x540bc0], xmm0
unpcklps xmm1, xmm2
movq qword [0x540b24], xmm1
movss xmm1, dword [0x52592c]
movaps xmm0, xmm1
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x90]
unpcklps xmm0, xmm2
movq qword [0x540b4c], xmm0
movss xmm0, dword [0x525908]
unpcklps xmm0, xmm3
movq qword [0x540b30], xmm0
movss xmm0, dword [0x525900]
unpcklps xmm1, xmm2
movq qword [0x540b58], xmm1
movss xmm1, dword [0x525918]
unpcklps xmm1, xmm0
movss xmm0, dword [0x5258e8]
mov dword [0x540ba0], eax
movq qword [0x540b7c], xmm1
movss xmm1, dword [0x5258d8]
unpcklps xmm1, xmm0
movss xmm0, dword [0x5258e0]
movq qword [0x540b8c], xmm1
movss xmm1, dword [0x525920]
unpcklps xmm0, xmm1
movq qword [0x540bd0], xmm0
movss xmm0, dword [0x525914]
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x90]
mov dword [0x540bc8], eax
unpcklps xmm0, xmm1
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x90]
mov dword [0x540b2c], eax
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x90]
mov dword [0x540b54], eax
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x90]
mov dword [0x540b60], eax
movq qword [0x540bb4], xmm0
movss xmm0, dword [0x525904]
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x90]
mov dword [0x540b38], eax
unpcklps xmm0, xmm1
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x90]
mov dword [0x540b84], eax
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x90]
mov dword [0x540b94], eax
movq qword [0x540b70], xmm0
movss xmm0, dword [0x525928]
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x90]
mov dword [0x540bd8], eax
unpcklps xmm0, xmm1
movss xmm1, dword [0x525930]
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x90]
mov dword [0x540bbc], eax
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x90]
mov dword [esp + 0x90], 0
movq qword [0x540b3c], xmm0
movss xmm0, dword [0x5258dc]
mov dword [0x540b78], eax
mov eax, dword [esp + 0x90]
mov dword [0x540b44], eax
mov dword [esp + 0x90], 0
unpcklps xmm1, xmm0
mov eax, dword [esp + 0x90]
movss xmm0, dword [0x525924]
mov dword [0x540bac], eax
movq qword [0x540ba4], xmm1
movss xmm1, dword [0x5258e4]
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x90]
mov dword [0x540b6c], eax
lea eax, [esp + 0x148]
unpcklps xmm1, xmm0
push str.Verdana
push eax
movq qword [0x540b64], xmm1
call fcn.0044cc90
add esp, 8
mov dword [0x5403cc], 0x1e
mov dword [0x540198], 0x1f3
mov dword [0x5402ac], 0x1a4
mov dword [0x5403a4], 0xba
push 0
mov dword [0x5402b0], 0xba
mov dword [0x54019c], 0x2fe
mov dword [0x5402b4], 0x2fe
mov dword [0x5401a0], 0x20d
mov dword [0x5402b8], 0x20d
mov dword [esp + 0x1c], 0x30
mov dword [esp + 0x20], 0x40
mov dword [esp + 0x24], 0x4e23a0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp dword [esp + 0xb4], 0x10
xorps xmm0, xmm0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xa0]
cmovae eax, dword [esp + 0xa0]
push 0x65
push edi
movups xmmword [esp + 0x38], xmm0
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0
call dword [sym.imp.USER32.dll_LoadIconA]
cmp dword [esp + 0xb4], 0x10
mov dword [esp + 0x30], eax
lea eax, [esp + 0xa0]
cmovae eax, dword [esp + 0xa0]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
cmp dword [esp + 0xb4], 0x10
lea eax, [esp + 0xa0]
push 0
push dword [esp + 0x30]
cmovae eax, dword [esp + 0xa8]
push 0
push 0
push 0x20d
push 0x2fe
push 0x64
push 0x64
push bind
push eax
push dword [esp + 0x68]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
sub esp, 8
mov dword [esp + 0x1c], eax
mov ecx, eax
call fcn.004e79c0
mov ecx, dword [0x540428]
add esp, 8
mov eax, dword [esp + 0x14]
mov dword [0x540088], eax
mov dword [ecx + 0x284], eax
lea eax, [ecx + 0x290]
cmp byte [esi], 0
mov dword [esp + 0xc], eax
jne 0x4e67af
xor ecx, ecx
jmp 0x4e67c1
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e67b4
mov eax, dword [esp + 0xc]
sub ecx, edx
push ecx
push esi
mov ecx, eax
call fcn.00445cb0
mov esi, dword [esp + 0x14]
mov ecx, esi
call fcn.004e5bd0
test al, al
jne 0x4e681c
call fcn.004e5b90
push dword [esp + 0x2c]
push dword [esp + 0x44]
call dword [sym.imp.USER32.dll_UnregisterClassA]
lea ecx, [esp + 0x130]
call fcn.00444fa0
lea ecx, [esp + 0xa0]
call fcn.00444fa0
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x15c]
xor ecx, esp
call fcn.0049e623
mov esp, ebp
pop ebp
ret 0x10
push 0xa
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.004e7a30
test al, al
jne 0x4e6843
call fcn.004e5b90
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x4e67de
cmp dword [0x540110], 0
mov dword [0x5400b0], 0
mov dword [0x5402c0], 0
mov dword [0x5400b4], 0
mov dword [0x5402c4], 0
mov dword [0x5400b8], 0
mov dword [0x5402c8], 0
mov dword [0x5400bc], 0
mov dword [0x5402cc], 0
mov dword [0x5400c0], 0
mov dword [0x5402d0], 0
mov dword [0x5400c4], 0
mov dword [0x5402d4], 0
mov dword [0x5400c8], 0
mov dword [0x5402d8], 0
mov dword [0x5400cc], 0
mov dword [0x5402dc], 0
mov dword [0x5400d0], 0
mov dword [0x5402e0], 0
mov dword [0x5400d4], 0
mov dword [0x5402e4], 0
jne 0x4e6941
push 0x540110
lea eax, [esp + 0x14c]
push eax
push 8
push 6
push 0
push 1
push 0
push 0
push 0x1f4
push 0
push 0xd
push dword [0x540124]
call fcn.004027c5
lea eax, [esp + 0x80]
push eax
call fcn.004c0010
add esp, 4
cmp byte [0x54042c], 0
jne 0x4e6a33
movaps xmm0, xmmword [0x525da0]
xor ecx, ecx
movups xmmword [esp + 0x88], xmm0
mov dword [esp + 0x98], 0x565a5e49
mov word [esp + 0x9c], 0x15
nop dword [eax]
nop dword [eax + eax]
mov al, byte [esp + 0x88]
xor byte [esp + ecx + 0x89], al
inc ecx
cmp ecx, 0x14
jb 0x4e6990
cmp byte [esp + 0x89], 0
mov byte [esp + 0x9d], 0
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], 0
mov byte [esp + 0x48], 0
jne 0x4e69cf
xor ecx, ecx
jmp 0x4e69e9
lea ecx, [esp + 0x89]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e69e0
sub ecx, edx
push ecx
lea eax, [esp + 0x8d]
push eax
lea ecx, [esp + 0x50]
call fcn.00445cb0
mov ecx, dword [0x540428]
lea eax, [esp + 0x48]
add ecx, 0x2b0
cmp ecx, eax
je 0x4e6a19
push 0xffffffffffffffff
push 0
push eax
call fcn.00445490
mov eax, dword [esp + 0x5c]
cmp eax, 0x10
jb 0x4e6a54
inc eax
lea ecx, [esp + 0x48]
push eax
push dword [esp + 0x4c]
call fcn.00445a30
jmp 0x4e6a54
push 0
push 0
push 0
push 0x4e8b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x540428]
mov dword [ecx + 0x2a8], eax
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x68
push edi
call esi
push 0x68
push edi
mov dword [0x540b88], eax
call esi
push 0x69
push edi
mov dword [0x540b20], eax
call esi
push dword [0x540b88]
mov edi, dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x54098c], eax
call edi
mov eax, dword [0x540428]
add eax, 0x134
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xorps xmm0, xmm0
mov dword [esp + 0x64], 0
movd eax, xmm0
movups xmmword [esp + 0x68], xmm0
movq qword [esp + 0x78], xmm0
cmp eax, 0x12
je 0x4e721a
nop
push 1
push 0
push 0
push 0
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4e6af2
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4e720f
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x4e6b07
push dword [0x54098c]
jmp 0x4e6b0d
push dword [0x540b88]
call edi
mov eax, dword [0x540124]
push 0
push 7
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x540124]
push 1
push 0x1b
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x540124]
push 0
push 0xae
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x540124]
push 0
mov ecx, dword [eax]
push ecx
mov dword [esp], 0x3f800000
push 0xffffffffffffffff
push 1
push 0
push 0
push eax
call dword [ecx + 0xac]
mov eax, dword [0x540124]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
test eax, eax
js 0x4e71cb
mov eax, dword [0x540428]
mov dword [0x540410], 0
push 0x10
movzx ecx, byte [eax + 0x2c8]
mov eax, 0x51eb851f
imul ecx, dword [0x54032c]
mov dword [0x540414], 0
mul ecx
mov eax, dword [0x540330]
mov dword [0x54041c], eax
mov eax, dword [0x5403cc]
mov dword [0x540194], eax
mov eax, dword [0x5403a4]
mov dword [0x5402b0], eax
mov eax, dword [0x540354]
shr edx, 5
mov dword [0x540418], edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov edx, dword [0x540424]
test edx, edx
je 0x4e6c01
mov eax, dword [0x540354]
push 0xffffffffffffffff
push 0x540b8c
push 0
mov ecx, dword [eax]
push 0
push edx
push eax
call dword [ecx + 0x24]
mov edx, dword [0x540420]
test edx, edx
je 0x4e6c22
mov eax, dword [0x540354]
push 0xffffffffffffffff
push 0x540b98
push 0
mov ecx, dword [eax]
push 0
push edx
push eax
call dword [ecx + 0x24]
mov esi, dword [0x5400ac]
test esi, esi
je 0x4e6c81
mov eax, dword [0x540428]
cmp byte [eax + 0x288], 0
je 0x4e6c66
mov eax, dword [0x5400b0]
test eax, eax
jne 0x4e6c4a
mov edx, 0xffc8c8c8
jmp 0x4e6c6b
cmp eax, 1
jne 0x4e6c54
or edx, 0xffffffff
jmp 0x4e6c6b
cmp eax, 2
mov edx, 0xff505050
mov eax, 0xff969696
cmove edx, eax
jmp 0x4e6c6b
mov edx, 0xff505050
mov eax, dword [0x540354]
push edx
push 0x540b3c
push 0
mov ecx, dword [eax]
push 0
push esi
push eax
call dword [ecx + 0x24]
mov edx, dword [0x5402bc]
test edx, edx
je 0x4e6ca2
mov eax, dword [0x540354]
push 0xffffffffffffffff
push 0x540b7c
push 0
mov ecx, dword [eax]
push 0
push edx
push eax
call dword [ecx + 0x24]
mov esi, dword [0x5401a4]
test esi, esi
je 0x4e6d0b
mov ecx, dword [0x540428]
add ecx, 0x38
cmp dword [ecx + 0x14], 0x10
jb 0x4e6cbd
mov ecx, dword [ecx]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e6cc0
sub ecx, edx
je 0x4e6d0b
mov eax, dword [0x5400c4]
test eax, eax
jne 0x4e6cdb
mov edx, 0xffc8c8c8
jmp 0x4e6cf5
cmp eax, 1
jne 0x4e6ce5
or edx, 0xffffffff
jmp 0x4e6cf5
cmp eax, 2
mov edx, 0xff505050
mov eax, 0xff969696
cmove edx, eax
mov eax, dword [0x540354]
push edx
push 0x540bc0
push 0
mov ecx, dword [eax]
push 0
push esi
push eax
call dword [ecx + 0x24]
mov esi, dword [0x540064]
test esi, esi
je 0x4e6d7b
mov ecx, dword [0x540428]
add ecx, 0x50
cmp dword [ecx + 0x14], 0x10
jb 0x4e6d26
mov ecx, dword [ecx]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e6d30
sub ecx, edx
je 0x4e6d7b
mov eax, dword [0x5400c8]
test eax, eax
jne 0x4e6d4b
mov edx, 0xffc8c8c8
jmp 0x4e6d65
cmp eax, 1
jne 0x4e6d55
or edx, 0xffffffff
jmp 0x4e6d65
cmp eax, 2
mov edx, 0xff505050
mov eax, 0xff969696
cmove edx, eax
mov eax, dword [0x540354]
push edx
push 0x540b24
push 0
mov ecx, dword [eax]
push 0
push esi
push eax
call dword [ecx + 0x24]
mov esi, dword [0x540308]
test esi, esi
je 0x4e6deb
mov ecx, dword [0x540428]
add ecx, 0x68
cmp dword [ecx + 0x14], 0x10
jb 0x4e6d96
mov ecx, dword [ecx]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e6da0
sub ecx, edx
je 0x4e6deb
mov eax, dword [0x5400cc]
test eax, eax
jne 0x4e6dbb
mov edx, 0xffc8c8c8
jmp 0x4e6dd5
cmp eax, 1
jne 0x4e6dc5
or edx, 0xffffffff
jmp 0x4e6dd5
cmp eax, 2
mov edx, 0xff505050
mov eax, 0xff969696
cmove edx, eax
mov eax, dword [0x540354]
push edx
push 0x540b4c
push 0
mov ecx, dword [eax]
push 0
push esi
push eax
call dword [ecx + 0x24]
mov esi, dword [0x54014c]
test esi, esi
je 0x4e6e5b
mov ecx, dword [0x540428]
sub ecx, 0xffffff80
cmp dword [ecx + 0x14], 0x10
jb 0x4e6e06
mov ecx, dword [ecx]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e6e10
sub ecx, edx
je 0x4e6e5b
mov eax, dword [0x5400d0]
test eax, eax
jne 0x4e6e2b
mov edx, 0xffc8c8c8
jmp 0x4e6e45
cmp eax, 1
jne 0x4e6e35
or edx, 0xffffffff
jmp 0x4e6e45
cmp eax, 2
mov edx, 0xff505050
mov eax, 0xff969696
cmove edx, eax
mov eax, dword [0x540354]
push edx
push 0x540b58
push 0
mov ecx, dword [eax]
push 0
push esi
push eax
call dword [ecx + 0x24]
mov esi, dword [0x540150]
test esi, esi
je 0x4e6ea5
mov eax, dword [0x5400b4]
test eax, eax
jne 0x4e6e75
mov edx, 0xffc8c8c8
jmp 0x4e6e8f
cmp eax, 1
jne 0x4e6e7f
or edx, 0xffffffff
jmp 0x4e6e8f
cmp eax, 2
mov edx, 0xff505050
mov eax, 0xff969696
cmove edx, eax
mov eax, dword [0x540354]
push edx
push 0x540bd0
push 0
mov ecx, dword [eax]
push 0
push esi
push eax
call dword [ecx + 0x24]
mov esi, dword [0x54011c]
test esi, esi
je 0x4e6eef
mov eax, dword [0x5400b8]
test eax, eax
jne 0x4e6ebf
mov edx, 0xffc8c8c8
jmp 0x4e6ed9
cmp eax, 1
jne 0x4e6ec9
or edx, 0xffffffff
jmp 0x4e6ed9
cmp eax, 2
mov edx, 0xff505050
mov eax, 0xff969696
cmove edx, eax
mov eax, dword [0x540354]
push edx
push 0x540bb4
push 0
mov ecx, dword [eax]
push 0
push esi
push eax
call dword [ecx + 0x24]
mov esi, dword [0x54035c]
test esi, esi
je 0x4e6f39
mov eax, dword [0x5400c0]
test eax, eax
jne 0x4e6f09
mov edx, 0xffc8c8c8
jmp 0x4e6f23
cmp eax, 1
jne 0x4e6f13
or edx, 0xffffffff
jmp 0x4e6f23
cmp eax, 2
mov edx, 0xff505050
mov eax, 0xff969696
cmove edx, eax
mov eax, dword [0x540354]
push edx
push 0x540b70
push 0
mov ecx, dword [eax]
push 0
push esi
push eax
call dword [ecx + 0x24]
mov esi, dword [0x54030c]
test esi, esi
je 0x4e6f83
mov eax, dword [0x5400bc]
test eax, eax
jne 0x4e6f53
mov edx, 0xffc8c8c8
jmp 0x4e6f6d
cmp eax, 1
jne 0x4e6f5d
or edx, 0xffffffff
jmp 0x4e6f6d
cmp eax, 2
mov edx, 0xff505050
mov eax, 0xff969696
cmove edx, eax
mov eax, dword [0x540354]
push edx
push 0x540ba4
push 0
mov ecx, dword [eax]
push 0
push esi
push eax
call dword [ecx + 0x24]
mov edx, dword [0x540358]
test edx, edx
je 0x4e6fa4
mov eax, dword [0x540354]
push 0xffffffffffffffff
push 0x540b64
push 0
mov ecx, dword [eax]
push 0
push edx
push eax
call dword [ecx + 0x24]
mov edx, dword [0x5403a0]
test edx, edx
je 0x4e6fc8
mov eax, dword [0x540354]
push 0xffffffffffffffff
push 0x540b64
push 0
mov ecx, dword [eax]
push 0x540410
push edx
push eax
call dword [ecx + 0x24]
mov edx, dword [0x540114]
test edx, edx
je 0x4e6fe9
mov eax, dword [0x540354]
push 0xffffffffffffffff
push 0x540b30
push 0
mov ecx, dword [eax]
push 0
push edx
push eax
call dword [ecx + 0x24]
mov eax, dword [0x540354]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea eax, [esp + 0x100]
push eax
call fcn.0044fff0
mov edx, eax
cmp dword [edx + 0x14], 0x10
jb 0x4e700b
mov edx, dword [edx]
mov eax, dword [0x540110]
push 0xffac752b
push 0
push 0x540194
mov ecx, dword [eax]
push 0xffffffffffffffff
push edx
push 0
push eax
call dword [ecx + 0x38]
mov eax, dword [esp + 0x114]
cmp eax, 0x10
jb 0x4e7048
inc eax
lea ecx, [esp + 0x100]
push eax
push dword [esp + 0x104]
call fcn.00445a30
mov eax, dword [0x540428]
mov dword [esp + 0x114], 0xf
mov dword [esp + 0x110], 0
mov byte [esp + 0x100], 0
cmp dword [eax + 0x130], 0
jbe 0x4e71bd
mov eax, dword [eax + 0x12c]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
cmp ecx, eax
je 0x4e71bd
nop dword [eax]
lea eax, [ecx + 0x14]
mov edx, 0x523cf0
push eax
add ecx, 0x44
push 0x523cec
push ecx
lea ecx, [esp + 0xc4]
call fcn.00445eb0
add esp, 4
lea ecx, [esp + 0x120]
mov edx, eax
call fcn.00445fc0
add esp, 4
lea ecx, [esp + 0x8c]
mov edx, eax
call fcn.0044daf0
mov edx, eax
add esp, 4
cmp dword [edx + 0x14], 0x10
jb 0x4e70dd
mov edx, dword [edx]
mov eax, dword [0x540110]
push 0xffac752b
push 0
push 0x5402ac
mov ecx, dword [eax]
push 0xffffffffffffffff
push edx
push 0
push eax
call dword [ecx + 0x38]
mov eax, dword [esp + 0x9c]
cmp eax, 0x10
jb 0x4e711a
inc eax
lea ecx, [esp + 0x88]
push eax
push dword [esp + 0x8c]
call fcn.00445a30
mov eax, dword [esp + 0x12c]
mov dword [esp + 0x9c], 0xf
mov dword [esp + 0x98], 0
mov byte [esp + 0x88], 0
cmp eax, 0x10
jb 0x4e7159
inc eax
lea ecx, [esp + 0x118]
push eax
push dword [esp + 0x11c]
call fcn.00445a30
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x12c], 0xf
mov dword [esp + 0x128], 0
mov byte [esp + 0x118], 0
cmp eax, 0x10
jb 0x4e7198
inc eax
lea ecx, [esp + 0xb8]
push eax
push dword [esp + 0xbc]
call fcn.00445a30
add dword [0x5402b0], 0x23
lea ecx, [esp + 0xc]
call fcn.0044da60
mov eax, dword [0x540428]
mov ecx, dword [esp + 0xc]
cmp ecx, dword [eax + 0x12c]
jne 0x4e7090
mov eax, dword [0x540124]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov eax, dword [0x540124]
push 0
push 0
push 0
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x44]
cmp eax, 0x88760868
jne 0x4e7207
mov eax, dword [0x540124]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp eax, 0x88760869
jne 0x4e7207
mov eax, dword [0x540124]
push 0x5400d8
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x68], 0x12
jne 0x4e6ac0
mov ecx, dword [0x540124]
test ecx, ecx
je 0x4e7234
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x540124], 0
mov ecx, dword [0x540310]
test ecx, ecx
je 0x4e724e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x540310], 0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [esp + 0x2c]
push dword [esp + 0x44]
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x144]
mov esi, dword [esp + 0x6c]
cmp eax, 0x10
jb 0x4e7296
inc eax
lea ecx, [esp + 0x130]
push eax
push dword [esp + 0x134]
call fcn.00445a30
mov ecx, dword [esp + 0xb4]
mov dword [esp + 0x144], 0xf
mov dword [esp + 0x140], 0
mov byte [esp + 0x130], 0
cmp ecx, 0x10
jb 0x4e72d5
inc ecx
push ecx
push dword [esp + 0xa4]
lea ecx, [esp + 0xa8]
call fcn.00445a30
mov ecx, dword [esp + 0x164]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0049e623
mov esp, ebp
pop ebp
ret 0x10
push 0x30
push edx
lea eax, [esp + 0xc1]
mov byte [esp + 0xe8], 0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.004bfa70
int3