Function at 0x5eda1a
Capabilities:
Create process on windows
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
sub esp, 0x68
mov eax, 0x6e7e35
call fcn.006899cc
sub esp, 0x214
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x74]
mov dword [ebp + 0x54], esi
push edi
cmp ecx, 0x41
jg 0x5edac8
je 0x5eda82
lea eax, [ecx - 0x2f]
cmp eax, 9
ja case.0x5eda57.48
movzx eax, byte [eax + 0x5ef2f6]
jmp dword [eax*4 + 0x5ef2e6]
push dword [esi + 4]
call fcn.006201de
jmp 0x5ef2ca
call fcn.00621d91
jmp 0x5ef2ca
push ecx
mov ecx, esi
call fcn.005efb19
jmp 0x5ef2ca
mov esi, dword [esi + 0xf4]
xor ebx, ebx
lea ecx, [esi + 0x44]
cmp dword [esi + 0x54], ebx
je 0x5edabd
mov eax, dword [esi + 0x50]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
call fcn.00445f03
mov ecx, esi
push dword [eax]
call fcn.0062406c
cmp byte [eax + 0x28], 0x11
jne 0x5edabd
lea ebx, [eax + 0x2c]
cmp dword [ebx + 0x14], 8
jb 0x5edabd
mov ebx, dword [ebx]
push ebx
call fcn.005b2942
jmp 0x5ef2ca
mov eax, 0x2b81
cmp ecx, eax
jg 0x5edba3
je 0x5edb97
mov eax, ecx
sub eax, 0x2b73
je 0x5edb8b
sub eax, 3
je 0x5edb7f
sub eax, 6
je 0x5edb20
sub eax, 4
jne case.0x5eda57.48
xor ebx, ebx
push ebx
push ebx
push 0x8070
push dword [esi + 0x1f4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, esi
call fcn.005effce
jmp 0x5ef2ca
mov esi, dword [esi + 0xf4]
xor ebx, ebx
lea edi, [esi + 0x44]
cmp dword [esi + 0x54], ebx
jbe 0x5edb72
mov eax, dword [esi + 0x50]
lea ecx, [ebp - 0x14]
add eax, ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
call fcn.00445f03
push dword [eax]
mov eax, dword [ebp + 0x54]
mov ecx, dword [eax + 0xf4]
call fcn.0062406c
test eax, eax
je 0x5edb6c
cmp byte [eax + 0x28], 0x17
jne 0x5edb6c
push eax
mov eax, dword [ebp + 0x54]
mov ecx, dword [eax + 0xf4]
call fcn.00624b81
inc ebx
cmp ebx, dword [esi + 0x54]
jb 0x5edb30
mov ecx, dword [ebp + 0x54]
call fcn.005f49f2
jmp 0x5ef2ca
mov ecx, esi
call fcn.005effb0
jmp 0x5ef2ca
mov ecx, esi
call fcn.005effbf
jmp 0x5ef2ca
mov ecx, esi
call fcn.005effe6
jmp 0x5ef2ca
mov eax, ecx
sub eax, 0x2b82
je 0x5ef2c3
sub eax, 1
je 0x5ef2ba
dec eax
sub eax, 1
je 0x5ef297
xor ebx, ebx
mov byte [ebp + 0x63], bl
cmp ecx, 0x28
jne 0x5edbdd
mov eax, dword [0x7e5b54]
cmp eax, 4
jae 0x5edbdd
lea ecx, [eax + 0x17]
mov dword [ebp + 0x74], ecx
mov esi, dword [esi + 0x258]
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp + 0x64], ecx
mov ecx, dword [esi + 0x18]
mov eax, ecx
shr eax, 0x1f
test al, al
jne 0x5edc05
imul eax, ecx, 0xc
call fcn.0068a010
mov dword [ebp + 0x5c], esp
jmp 0x5edc1e
call edi
mov dword [0x7ea0c0], eax
mov eax, dword [ebp + 0x54]
mov dword [0], ebx
mov dword [ebp + 0x5c], ebx
mov esi, dword [eax + 0x258]
mov ecx, dword [esi + 0x18]
mov eax, ecx
shr eax, 0x1f
test al, al
jne 0x5edc3c
mov eax, ecx
shl eax, 2
call fcn.0068a010
mov edi, dword [ebp + 0x54]
mov dword [ebp + 0x44], esp
jmp 0x5edc55
call edi
mov edi, dword [ebp + 0x54]
mov dword [0x7ea0c0], eax
mov dword [0], ebx
mov dword [ebp + 0x44], ebx
mov esi, dword [edi + 0x258]
push 2
push 0xffffffffffffffff
push 0x100c
push dword [esi + 0xc]
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x4c], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5eddd1
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x24], eax
mov eax, dword [edi + 0x258]
mov edx, dword [ebp + 0x1c]
cmp edx, dword [eax + 0x18]
jae 0x5eddd1
add edi, 0x154
push esi
mov ecx, edi
call fcn.00653992
mov ecx, dword [ebp + 0x24]
mov eax, dword [eax + 0x20]
mov dword [ecx], eax
mov ecx, ebx
mov dword [ebp + 0x68], ecx
cmp eax, 1
jne 0x5edd56
lea ecx, [ebp - 0x80]
call fcn.004d18bd
push esi
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.00653992
push dword [eax + 0xe8]
call fcn.004d45d1
mov edx, eax
mov ecx, ebx
mov dword [ebp + 0x50], edx
mov dword [ebp], ecx
cmp dword [edx + 0x40], ebx
jbe 0x5edd47
mov eax, dword [edx + 0x3c]
add ecx, eax
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 0x38]
dec eax
and ecx, eax
mov eax, dword [edx + 0x34]
push esi
mov eax, dword [eax + ecx*4]
mov ecx, edi
mov dword [ebp + 0x20], eax
call fcn.00653992
mov ecx, dword [ebp + 0x20]
add eax, 0x24
push eax
add ecx, 0x18
call fcn.004570f7
test al, al
je 0x5edd30
push esi
mov ecx, edi
call fcn.00653992
mov ecx, dword [ebp + 0x20]
add eax, 0xec
push eax
lea ecx, [ecx + 0x30]
call fcn.00410b90
test al, al
jne 0x5edd41
mov ecx, dword [ebp]
mov edx, dword [ebp + 0x50]
inc ecx
mov dword [ebp], ecx
cmp ecx, dword [edx + 0x40]
jb 0x5edce1
jmp 0x5edd47
mov eax, dword [ebp + 0x20]
mov dword [ebp + 0x68], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.0049f7c3
mov ecx, dword [ebp + 0x68]
mov eax, dword [ebp + 0x24]
push esi
mov dword [eax + 8], ecx
mov ecx, edi
call fcn.00653992
cmp dword [eax + 0x20], ebx
jne 0x5edd79
push esi
mov ecx, edi
call fcn.00653992
mov ecx, dword [eax + 0xe4]
jmp 0x5edd7b
mov ecx, ebx
mov eax, dword [ebp + 0x24]
mov dword [eax + 4], ecx
cmp dword [eax], ebx
jne 0x5edda3
push esi
mov ecx, edi
call fcn.00653992
mov ecx, dword [ebp + 0x4c]
mov edx, dword [ebp + 0x44]
mov eax, dword [eax + 0xe4]
mov dword [edx + ecx*4], eax
inc ecx
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x4c], ecx
mov edi, dword [ebp + 0x54]
add eax, 0xc
inc dword [ebp + 0x1c]
push 2
mov dword [ebp + 0x24], eax
mov eax, dword [edi + 0x258]
push esi
push 0x100c
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5edc7e
mov eax, dword [ebp + 0x74]
mov edi, dword [ebp + 0x4c]
mov esi, dword [ebp + 0x78]
cmp eax, 0x25
je 0x5edf4e
cmp eax, 0x2c
je 0x5ede36
cmp eax, 0x6a
jne 0x5edec4
cmp edi, 0xa
jbe 0x5edec4
test esi, esi
je 0x5ede0a
cmp byte [esi], 0
je 0x5ede0a
mov byte [esi], bl
call fcn.0048a01d
push edi
push 0x25
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 4
call fcn.005ba91d
push eax
lea eax, [ebp + 0x28]
push eax
call fcn.00475719
add esp, 0xc
mov dword [ebp - 4], 3
jmp 0x5ede79
cmp edi, 0xa
jbe 0x5edec4
test esi, esi
je 0x5ede4f
cmp byte [esi], 0
je 0x5ede4f
mov byte [esi], bl
call fcn.0048a01d
push edi
push 0x26
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 4
call fcn.005ba91d
push eax
lea eax, [ebp + 0x28]
push eax
call fcn.00475719
add esp, 0xc
mov dword [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x5ede81
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.005bb77f
or dword [ebp - 4], 0xffffffff
mov edi, eax
pop ecx
pop ecx
lea ecx, [ebp + 0x28]
call fcn.0044823e
test esi, esi
je 0x5edeac
cmp byte [esi], 0
jne 0x5edeac
mov byte [esi], 1
call fcn.00489fdc
cmp edi, 7
je 0x5ef2ca
cmp edi, 2
je 0x5ef2ca
mov eax, dword [ebp + 0x74]
mov edi, dword [ebp + 0x4c]
mov edx, dword [ebp + 0x1c]
mov ecx, edx
sub ecx, edi
mov dword [ebp - 0x10], ecx
test edx, edx
je 0x5ef2ca
test edi, edi
je 0x5ee039
cmp eax, 0x17
je 0x5edef6
cmp eax, 0x18
je 0x5edef6
cmp eax, 0x19
je 0x5edef6
cmp eax, 0x1a
jne 0x5ee039
cmp byte [0x7e5859], 0
je 0x5edffb
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0x30], 0x24
mov dword [ebp - 0x34], 1
mov ecx, dword [eax]
test ecx, ecx
je 0x5edffb
mov eax, dword [ecx]
call dword [eax + 0x170]
test al, al
je 0x5edf96
cmp byte [0x7e5bbb], 0
je 0x5edffb
mov eax, dword [ebp + 0x44]
push dword [eax]
call fcn.00666613
test al, al
je 0x5ef2ca
jmp 0x5edffb
cmp edi, 0xa
jbe 0x5edec4
test esi, esi
je 0x5edf67
cmp byte [esi], 0
je 0x5edf67
mov byte [esi], bl
call fcn.0048a01d
push edi
push 0x24
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 4
call fcn.005ba91d
push eax
lea eax, [ebp + 0x28]
push eax
call fcn.00475719
add esp, 0xc
mov dword [ebp - 4], 2
jmp 0x5ede79
mov eax, dword [ebp + 0x44]
cmp dword [eax], ebx
je 0x5edffb
test esi, esi
je 0x5edfad
cmp byte [esi], 0
je 0x5edfad
mov byte [esi], bl
call fcn.0048a01d
push edi
push ebx
lea eax, [ebp + 0x28]
push eax
call fcn.005f16f6
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], 4
jb 0x5edfc7
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.005bb77f
or dword [ebp - 4], 0xffffffff
mov edi, eax
pop ecx
pop ecx
lea ecx, [ebp + 0x28]
call fcn.0044823e
test esi, esi
je 0x5edff2
cmp byte [esi], 0
jne 0x5edff2
mov byte [esi], 1
call fcn.00489fdc
cmp edi, 6
jne 0x5ef2ca
mov edi, dword [ebp + 0x54]
push 0x1b
mov dword [ebp - 0x118], 3
mov dword [ebp - 0x11c], ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x128]
push ecx
push 0xffffffffffffffff
push 0x102b
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x258]
call fcn.005c696c
mov byte [ebp + 0x4b], bl
mov dword [ebp - 4], 6
test esi, esi
jne 0x5ee056
lea esi, [ebp + 0x4b]
mov byte [ebp + 0x4b], 1
mov dword [ebp + 0x78], esi
call fcn.00489fdc
cmp dword [ebp + 0x74], 0x22
jne 0x5ee0c5
mov eax, dword [ebp + 0x4c]
mov edi, ebx
test eax, eax
je 0x5ee0bc
mov ecx, dword [ebp + 0x44]
dec eax
lea eax, [ecx + eax*4]
mov dword [ebp + 0x68], eax
jmp 0x5ee074
mov ecx, dword [ebp + 0x44]
mov eax, dword [ecx + edi*4]
mov ecx, dword [ebp + 0x54]
push eax
call fcn.005f1bc4
test eax, eax
jne 0x5ee09e
mov ecx, dword [ebp + 0x68]
mov edx, dword [ebp + 0x44]
mov eax, dword [ecx]
mov dword [edx + edi*4], eax
mov eax, dword [ebp + 0x4c]
dec eax
sub ecx, 4
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x68], ecx
jmp 0x5ee0b7
mov eax, dword [ebp + 0x44]
mov ecx, dword [eax + edi*4]
mov eax, dword [ecx]
call dword [eax + 0x15c]
test al, 0x20
je 0x5ee144
mov eax, dword [ebp + 0x4c]
inc edi
cmp edi, eax
jb 0x5ee071
mov dword [ebp + 0x74], 0x23
jmp 0x5ee144
mov eax, dword [ebp + 0x64]
mov edx, eax
mov edi, dword [ebp + 0x4c]
mov ecx, edi
mov dword [ebp + 0x4c], edi
cmp eax, 0x13
jne 0x5ee12a
cmp dword [0x7f8538], 0
mov dword [ebp + 0x4c], edi
mov dword [ebp + 0x74], eax
je 0x5ee144
push dword [0x7da908]
lea eax, [ebp + 0x74]
push eax
call fcn.004a2557
push ecx
mov ecx, dword [eax]
mov edx, esp
mov byte [ebp - 4], 7
mov dword [edx], ecx
test ecx, ecx
je 0x5ee108
mov eax, dword [ecx]
call dword [eax]
push 0xb
call fcn.0049b41a
mov ecx, dword [ebp + 0x74]
mov byte [ebp - 4], 8
test ecx, ecx
je 0x5ee11f
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0x64]
mov dword [ebp + 0x4c], edi
mov dword [ebp + 0x74], eax
jmp 0x5ee144
mov eax, edx
cmp edx, 0x1c
je 0x5ef219
mov dword [ebp + 0x4c], ecx
mov dword [ebp + 0x74], edx
cmp eax, 0x1b
je 0x5ef219
push 7
pop eax
xor ecx, ecx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], eax
mov word [ebp - 0xb0], cx
mov ecx, ebx
mov byte [ebp - 4], 9
mov byte [ebp + 0x43], bl
mov dword [ebp + 0x24], ebx
cmp dword [ebp + 0x1c], ecx
je 0x5ef122
mov edx, dword [ebp + 0x5c]
imul eax, ecx, 0xc
mov ecx, dword [eax + edx + 8]
mov edi, dword [eax + edx + 4]
mov eax, dword [eax + edx]
mov dword [ebp + 0x50], ecx
test eax, eax
jne 0x5eef89
test edi, edi
je 0x5ef0c9
mov ecx, dword [ebp + 0x54]
push edi
call fcn.005f1bc4
test eax, eax
je case.0x5ee200.27
mov edx, dword [ebp + 0x74]
lea eax, [edx - 0x2710]
mov dword [ebp + 0x50], eax
cmp eax, 0x3e7
ja 0x5ee1e5
cmp byte [esi], 0
je 0x5ee1ce
mov byte [esi], bl
call fcn.0048a01d
mov eax, dword [ebp + 0x50]
push eax
push edi
call fcn.005c150a
cmp byte [esi], 0
jne 0x5ee1e2
mov byte [esi], 1
call fcn.00489fdc
mov edx, dword [ebp + 0x74]
cmp edx, 0x25
jg 0x5ee355
je 0x5ee336
lea eax, [edx - 0x13]
cmp eax, 0x11
ja case.0x5ee200.27
jmp dword [eax*4 + 0x5ef302]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x54]
mov byte [ebp + 0x63], 1
jmp case.0x5ee200.27
mov ecx, edi
call fcn.004c79b9
jmp 0x5ee20e
mov ecx, edi
call fcn.004cd899
jmp 0x5ee20e
mov ecx, edi
call fcn.004cc59c
jmp 0x5ee20e
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x15c]
test al, 0x40
jne 0x5ee20e
push 1
mov ecx, edi
call fcn.004c7d4e
jmp 0x5ee20e
cmp dword [edi + 0x534], ebx
je 0x5ee257
mov byte [ebp + 0x43], 1
movzx ecx, byte [0x7e5b96]
lea eax, [edx - 0x17]
neg ecx
push 1
sbb ecx, ecx
and ecx, 4
or ecx, eax
push ecx
mov ecx, edi
call fcn.004c85a8
mov eax, dword [ebp + 0x54]
cmp edi, dword [eax + 0x250]
jne 0x5ee28a
push ebx
mov ecx, eax
call fcn.005f9e58
mov eax, dword [ebp + 0x54]
cmp edi, dword [eax + 0x1c8]
jne case.0x5ee200.27
mov eax, dword [eax + 0x258]
push ebx
push 0xffffffffffffffff
push 0x1076
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x5ee20e
mov eax, dword [ebp + 0x74]
mov ecx, edi
mov edx, dword [edi]
add eax, 0xffffffe3
push eax
call dword [edx + 0x5c]
push ebx
push 0x20000
mov ecx, edi
call fcn.004b7090
mov ecx, 0x7ead50
call fcn.005266ba
jmp case.0x5ee200.27
cmp dword [0x7f8538], 0
je case.0x5ee200.27
mov eax, dword [ebp + 0x54]
push ebx
push 0xe
mov ecx, dword [eax + 0x258]
call fcn.005c613c
mov ecx, dword [0x7f8538]
push ebx
push 0xffffffffffffffff
push esi
push edi
call fcn.0061ad85
mov ecx, dword [0x7f8538]
cmp byte [ecx + 0x80], 0
je case.0x5ee200.27
push esi
push ebx
push ebx
call fcn.0061b259
jmp case.0x5ee200.27
mov ecx, edi
call fcn.004c8e33
jmp case.0x5ee200.27
mov eax, dword [edi + 0xec]
xor ecx, ecx
push esi
cmp byte [eax + 0x89], cl
sete cl
dec ecx
push ecx
push edi
call fcn.005c09ab
jmp case.0x5ee200.27
cmp edx, 0x6a
jg 0x5eef60
je 0x5eeed1
cmp edx, 0x2e
jg 0x5ee7cb
je 0x5ef198
mov eax, edx
sub eax, 0x26
je 0x5ee42f
sub eax, 1
je 0x5ee423
dec eax
sub eax, 1
je 0x5ee417
sub eax, 1
je 0x5ee413
sub eax, 1
je 0x5ee407
sub eax, 1
je 0x5ee3f9
sub eax, 1
jne case.0x5ee200.27
lea ecx, [ebp + 8]
call fcn.0045ea47
cmp byte [esi], 0
mov byte [ebp - 4], 0x23
je 0x5ee3c1
mov byte [esi], bl
call fcn.0048a01d
push edi
lea eax, [ebp + 8]
push eax
call fcn.00629642
cmp byte [esi], 0
jne 0x5ee3d8
mov byte [esi], 1
call fcn.00489fdc
lea ecx, [ebp + 8]
mov byte [ebp - 4], 9
call fcn.004878dd
mov eax, dword [ebp + 8]
push 8
mov dword [ebp + 8], ebx
push eax
call fcn.0068976d
pop ecx
pop ecx
jmp case.0x5ee200.27
push ebx
push 0xffffffffffffffff
push edi
call fcn.005c08e4
jmp case.0x5ee200.27
push ebx
push edi
call fcn.0062f22e
jmp case.0x5ee200.27
push 1
jmp 0x5ee408
mov ecx, edi
call fcn.004b4664
jmp case.0x5ee200.27
mov ecx, edi
call fcn.004c8b6c
jmp case.0x5ee200.27
xor eax, eax
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], 7
mov word [ebp - 0xc8], ax
push esi
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x108], 0x23
call fcn.004a715f
push eax
lea eax, [ebp - 0xc8]
push eax
push ebx
push edi
call fcn.005af14d
test al, al
sete byte [ebp + 0x5b]
test al, al
jne 0x5ee784
mov eax, dword [edi + 0xec]
mov dword [ebp], eax
xor eax, eax
mov dword [ebp + 4], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], 7
mov word [ebp + 4], ax
mov eax, dword [edi]
mov ecx, edi
mov byte [ebp - 4], 0xd
call dword [eax + 0x130]
xor ecx, ecx
mov dword [ebp + 0x28], ebx
mov word [ebp + 0x28], cx
lea ecx, [ebp + 0x28]
push eax
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x3c], 7
call fcn.004482e2
push 1
lea eax, [ebp + 0x28]
mov byte [ebp - 4], 0xe
push eax
sub esp, 0x18
lea eax, [ebp - 0xc8]
mov ecx, esp
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00448193
lea eax, [ebp - 0x2c]
push eax
call fcn.0046f4a0
lea ecx, [ebp - 0xc8]
cmp ecx, eax
je 0x5ee517
mov byte [ebp - 0xcc], bl
push dword [ebp - 0xcc]
push eax
call fcn.00448215
lea ecx, [ebp - 0x2c]
call fcn.0044823e
mov eax, dword [ebp + 0x3c]
cmp eax, 8
jb 0x5ee55a
mov ecx, dword [ebp + 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x5ee551
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], 7
mov word [ebp - 0x98], ax
mov ecx, dword [ebp]
mov byte [ebp - 4], 0xf
test ecx, ecx
je 0x5ee5f4
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x5ee5f4
cmp byte [ecx + 0x89], 0
je 0x5ee5f4
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x4c]
test al, al
je 0x5ee5f4
mov eax, dword [ebp]
push 1
mov eax, dword [eax + 4]
add eax, 0x38
push eax
sub esp, 0x18
lea eax, [ebp - 0xc8]
mov ecx, esp
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00448193
lea eax, [ebp + 0x28]
push eax
call fcn.0046f4a0
lea ecx, [ebp - 0x98]
cmp ecx, eax
je 0x5ee5ea
mov byte [ebp - 0xd0], bl
push dword [ebp - 0xd0]
push eax
call fcn.00448215
lea ecx, [ebp + 0x28]
call fcn.0044823e
jmp 0x5ee61b
cmp dword [ebp - 0xb4], 8
lea eax, [ebp - 0xc8]
jb 0x5ee609
mov eax, dword [ebp - 0xc8]
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x98]
push eax
call fcn.00448307
cmp dword [ebp - 0x84], 8
lea eax, [ebp - 0x98]
jb 0x5ee630
mov eax, dword [ebp - 0x98]
push eax
call fcn.0047050d
test al, al
je 0x5ee6ce
cmp byte [esi], 0
je 0x5ee64a
mov byte [esi], bl
call fcn.0048a01d
cmp dword [ebp - 0x84], 8
lea eax, [ebp - 0x98]
jb 0x5ee65f
mov eax, dword [ebp - 0x98]
push eax
push 0x367
call fcn.005ba91d
push eax
lea eax, [ebp + 0x28]
push eax
call fcn.00475719
add esp, 0xc
cmp dword [eax + 0x14], 8
mov ecx, eax
mov byte [ebp - 4], 0x10
jb 0x5ee685
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp + 4]
call fcn.00448284
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 0xf
call fcn.0044823e
cmp dword [ebp + 0x18], 8
lea eax, [ebp + 4]
jb 0x5ee6a9
mov eax, dword [ebp + 4]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.005bb77f
cmp eax, 6
pop ecx
sete al
cmp byte [esi], 0
pop ecx
mov byte [ebp + 0x5b], al
jne 0x5ee6d1
mov byte [esi], 1
call fcn.00489fdc
mov al, byte [ebp + 0x5b]
test al, al
je 0x5ee6ef
push ebx
push ebx
lea eax, [ebp - 0xc8]
mov ecx, edi
push eax
call fcn.004c1ed7
mov ecx, 0x7ead50
call fcn.005266ba
mov eax, dword [ebp - 0x84]
cmp eax, 8
jb 0x5ee730
mov ecx, dword [ebp - 0x98]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x5ee727
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x88], ebx
mov word [ebp - 0x98], ax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x84], 7
cmp eax, 8
jb 0x5ee784
mov ecx, dword [ebp + 4]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x5ee77b
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
mov eax, dword [ebp - 0xb4]
mov byte [ebp - 4], 9
cmp eax, 8
jb case.0x5ee200.27
mov ecx, dword [ebp - 0xc8]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x68], ecx
mov dword [ebp + 0x64], eax
cmp eax, 0x1000
jb 0x5ee7c4
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
jmp 0x5ee3ed
mov eax, edx
sub eax, 0x39
je 0x5eee69
sub eax, 1
je case.0x5ee200.22
sub eax, 3
je 0x5eea1c
sub eax, 1
je 0x5ef1bf
sub eax, 1
je 0x5ef1b5
sub eax, 1
jne case.0x5ee200.27
mov eax, dword [ebp + 0x54]
cmp byte [eax + 0x1e4], 0
je case.0x5ee200.27
cmp byte [esi], 0
je 0x5ee822
mov byte [esi], bl
call fcn.0048a01d
mov eax, dword [ebp + 0x54]
sub esp, 0x18
add eax, 0x584
mov ecx, esp
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040fd80
push edi
lea ecx, [ebp - 0x220]
call fcn.0065e36b
push 1
push ebx
push 0x75b
mov byte [ebp - 4], 0x1a
call fcn.005bb8f8
push eax
lea ecx, [ebp - 0x220]
call fcn.005bd16d
test eax, eax
jg 0x5ee9fb
mov dword [ebp - 0x44], 0x6f6164
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
push 0xd
mov dword [ebp + 0x28], ebx
lea ecx, [ebp + 0x28]
push str.launched.fail
mov byte [ebp - 4], 0x1b
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x3c], 0xf
mov byte [ebp + 0x28], bl
call fcn.00414b60
push 6
mov dword [ebp + 4], ebx
lea ecx, [ebp + 4]
push str.action
mov byte [ebp - 4], 0x1c
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], 0xf
mov byte [ebp + 4], bl
call fcn.00414b60
lea eax, [ebp + 0x28]
mov byte [ebp - 4], 0x1d
push eax
lea eax, [ebp + 4]
push eax
lea ecx, [ebp - 0x44]
call fcn.00458419
mov eax, dword [ebp + 0x18]
mov edi, 0x1000
cmp eax, 0x10
jb 0x5ee90c
mov ecx, dword [ebp + 4]
inc eax
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x68], ecx
cmp eax, edi
jb 0x5ee903
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
mov eax, dword [ebp + 0x3c]
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], 0xf
mov byte [ebp + 4], bl
mov byte [ebp - 4], 0x1b
cmp eax, 0x10
jb 0x5ee94f
mov ecx, dword [ebp + 0x28]
inc eax
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x68], ecx
cmp eax, edi
jb 0x5ee946
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
push 0xf
pop eax
push eax
mov dword [ebp + 0x28], ebx
lea ecx, [ebp + 0x28]
push str.client_share_ux
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x3c], eax
mov byte [ebp + 0x28], bl
call fcn.00414b60
push ebx
push ebx
push ebx
lea eax, [ebp + 0x28]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x44]
push eax
push 0x49
call fcn.00492ac4
mov eax, dword [ebp + 0x3c]
cmp eax, 0x10
jb 0x5ee9b4
mov ecx, dword [ebp + 0x28]
inc eax
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x68], ecx
cmp eax, edi
jb 0x5ee9ab
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
mov edi, dword [ebp - 0x40]
mov byte [ebp - 4], 0x1a
test edi, edi
je 0x5ee9f4
mov eax, dword [ebp - 0x3c]
cmp edi, eax
je 0x5ee9dc
mov esi, eax
mov ecx, edi
call fcn.0044a669
add edi, 8
cmp edi, esi
jne 0x5ee9c8
mov esi, dword [ebp + 0x78]
mov edi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
sub eax, edi
and eax, 0xfffffff8
push eax
push edi
call fcn.00447e20
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], method.std::_Facet_base.virtual_4
cmp byte [esi], 0
jne 0x5eea08
mov byte [esi], 1
call fcn.00489fdc
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 9
call fcn.0065e443
jmp case.0x5ee200.27
xor eax, eax
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], 7
mov word [ebp - 0xec], ax
mov eax, dword [edi + 0xec]
lea ecx, [ebp - 0x74]
mov dword [ebp + 0x20], eax
add eax, 0x28
push eax
mov byte [ebp - 4], 0x11
mov byte [ebp + 0x5b], bl
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
call fcn.00448193
cmp dword [ebp - 0x64], 0
mov byte [ebp - 4], 0x12
jne 0x5eea8c
cmp dword [0x7e59a4], 8
mov eax, 0x7e5990
jb 0x5eea7d
mov eax, dword [0x7e5990]
push dword [0x7e59a0]
lea ecx, [ebp - 0x74]
push eax
call fcn.00448307
xor eax, eax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
mov eax, dword [ebp + 0x20]
mov byte [ebp - 4], 0x13
cmp byte [eax + 0x89], 0
je 0x5eeb6a
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x130]
push eax
lea ecx, [ebp - 0x5c]
call fcn.004482e2
cmp dword [ebp - 0x60], 8
lea eax, [ebp - 0x74]
jb 0x5eead2
mov eax, dword [ebp - 0x74]
push 0x5c
push eax
call fcn.0068d26b
mov dword [ebp + 0x50], eax
pop ecx
pop ecx
test eax, eax
je 0x5eeb89
lea eax, [ebp - 0x74]
mov dword [ebp - 0x2c], ebx
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.00448193
cmp dword [ebp - 0x60], 8
lea edx, [ebp - 0x74]
mov byte [ebp - 4], 0x14
jb 0x5eeb0c
mov edx, dword [ebp - 0x74]
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
jb 0x5eeb18
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp + 0x50]
sub eax, edx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x74]
call fcn.00448307
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 0x13
cmp eax, 8
jb 0x5eeb89
mov ecx, dword [ebp - 0x2c]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x5eeb5f
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
jmp 0x5eeb89
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x5c]
add eax, 0x38
cmp ecx, eax
je 0x5eeb89
mov byte [ebp - 0xd4], bl
push dword [ebp - 0xd4]
push eax
call fcn.004481fb
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x130]
push eax
push 0x483
call fcn.005ba91d
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00475719
lea ecx, [ebp - 0xec]
add esp, 0xc
cmp ecx, eax
je 0x5eebc1
mov byte [ebp - 0x78], bl
push dword [ebp - 0x78]
push eax
call fcn.00448215
lea ecx, [ebp - 0x2c]
call fcn.0044823e
lea eax, [ebp - 0x5c]
mov dword [ebp + 4], ebx
push eax
lea ecx, [ebp + 4]
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
call fcn.00448193
cmp byte [esi], 0
mov byte [ebp - 4], 0x15
je 0x5eebee
mov byte [esi], bl
call fcn.0048a01d
lea eax, [ebp + 4]
push eax
lea eax, [ebp - 0xec]
push eax
lea ecx, [ebp - 0x16c]
call fcn.0065a8ec
push 1
push ebx
push 0x150
mov byte [ebp - 4], 0x16
call fcn.005bb8f8
push eax
lea ecx, [ebp - 0x16c]
call fcn.005bd16d
cmp dword [ebp - 0x12c], 0
jne 0x5eec57
cmp dword [ebp - 0x48], 8
lea ecx, [ebp - 0x5c]
jb 0x5eec36
mov ecx, dword [ebp - 0x5c]
cmp dword [ebp + 0x18], 8
lea eax, [ebp + 4]
jb 0x5eec42
mov eax, dword [ebp + 4]
push dword [ebp - 0x4c]
push ecx
push dword [ebp + 0x14]
push eax
call fcn.00448e68
test al, al
jne 0x5eec57
mov byte [ebp + 0x5b], 1
push 1
lea eax, [ebp + 4]
push eax
sub esp, 0x18
lea eax, [ebp - 0x74]
mov ecx, esp
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00448193
lea eax, [ebp + 0x28]
push eax
call fcn.0046f4a0
cmp byte [ebp + 0x5b], 0
mov byte [ebp - 4], 0x17
je 0x5eeccc
cmp dword [ebp + 0x3c], 8
lea eax, [ebp + 0x28]
jb 0x5eec92
mov eax, dword [ebp + 0x28]
push eax
call fcn.0047050d
test al, al
je 0x5eeccc
push 0x368
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x108], 0x30
call fcn.005ba91d
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.005bb77f
pop ecx
pop ecx
mov byte [ebp + 0x5b], bl
cmp byte [esi], 0
jne 0x5eecd9
mov byte [esi], 1
call fcn.00489fdc
cmp byte [ebp + 0x5b], 0
je 0x5eed4b
sub esp, 0x18
mov eax, esp
mov dword [ebp + 0x50], esp
mov dword [eax], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], 7
sub esp, 0x18
mov byte [ebp - 4], 0x18
mov ecx, esp
lea eax, [ebp + 0x28]
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00448193
mov ecx, dword [ebp + 0x20]
mov byte [ebp - 4], 0x17
call fcn.0051dd58
mov eax, dword [ebp + 0x20]
cmp dword [eax + 0x38], ebx
je 0x5eed44
cmp dword [ebp + 0x3c], 8
lea ecx, [ebp + 0x28]
jb 0x5eed2d
mov ecx, dword [ebp + 0x28]
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
jb 0x5eed39
mov eax, dword [ebp - 0x5c]
push ecx
push eax
call fcn.005ae51d
test al, al
je 0x5eed4b
or byte [edi + 0x161], 1
lea ecx, [ebp + 0x28]
call fcn.0044823e
lea ecx, [ebp - 0x16c]
call fcn.005bc551
mov eax, dword [ebp + 0x18]
cmp eax, 8
jb 0x5eed99
mov ecx, dword [ebp + 4]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x5eed90
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
xor eax, eax
mov dword [ebp + 0x14], ebx
mov word [ebp + 4], ax
mov eax, dword [ebp - 0x48]
mov dword [ebp + 0x18], 7
cmp eax, 8
jb 0x5eede4
mov ecx, dword [ebp - 0x5c]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x5eeddb
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x4c], ebx
mov word [ebp - 0x5c], ax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x48], 7
cmp eax, 8
jb 0x5eee2f
mov ecx, dword [ebp - 0x74]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x5eee26
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x64], ebx
mov word [ebp - 0x74], ax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x60], 7
mov byte [ebp - 4], 9
cmp eax, 8
jb case.0x5ee200.27
mov ecx, dword [ebp - 0xec]
jmp 0x5ee79d
mov ecx, edi
call fcn.004c7be8
jmp 0x5ee20e
cmp dword [ebp - 0xa0], 0
je 0x5eee82
push 0x700bf4
lea ecx, [ebp - 0xb0]
call fcn.004578e2
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.004bc020
push eax
lea eax, [ebp + 0x28]
mov byte [ebp - 4], 0x21
push eax
call fcn.0045b965
cmp dword [eax + 0x14], 8
mov ecx, eax
mov byte [ebp - 4], 0x22
jb 0x5eeea9
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0xb0]
call fcn.00448284
lea ecx, [ebp + 0x28]
call fcn.0044823e
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 9
call fcn.0040fad0
jmp case.0x5ee200.27
mov eax, dword [edi + 0xdc]
mov ecx, edi
mov dword [ebp + 0x50], eax
call fcn.004bac93
cmp dword [eax + 0x14], 8
jb 0x5eeee9
mov eax, dword [eax]
mov ecx, dword [ebp + 0x50]
push eax
lea eax, [ebp + 0x28]
push eax
call fcn.005383fb
cmp byte [esi], 0
mov byte [ebp - 4], 0x1f
je 0x5eef06
mov byte [esi], bl
call fcn.0048a01d
cmp dword [ebp + 0x3c], 8
lea eax, [ebp + 0x28]
jb 0x5eef12
mov eax, dword [ebp + 0x28]
push eax
lea eax, [ebp - 0x2c]
push str.__s_
push eax
call fcn.00475719
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x20
jb 0x5eef30
mov eax, dword [eax]
push eax
call fcn.00472edb
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1f
call fcn.0044823e
cmp byte [esi], 0
jne 0x5eef4f
mov byte [esi], 1
call fcn.00489fdc
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 9
call fcn.0044823e
jmp case.0x5ee200.27
cmp edx, 0x6c
jne case.0x5ee200.27
add edi, 0x504
cmp dword [edi + 0x14], 0x10
jb 0x5eef77
mov edi, dword [edi]
push 1
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.0x5ee200.27
cmp eax, 1
jne 0x5ef0c9
cmp byte [esi], 0
je 0x5eef9e
mov byte [esi], bl
call fcn.0048a01d
lea ecx, [ebp - 0x80]
call fcn.004d18bd
mov edi, dword [ebp + 0x50]
mov byte [ebp - 4], 0x25
push dword [edi + 0x78]
call fcn.004d45d1
mov ecx, dword [ebp + 0x74]
sub ecx, 0x16
je 0x5eefd6
sub ecx, 0x1a
je 0x5ef025
sub ecx, 1
je 0x5ef015
dec ecx
sub ecx, 1
je 0x5eefe7
sub ecx, 8
jne 0x5ef0a5
cmp dword [ebp - 0x10], 1
jbe 0x5ef03f
push edi
call fcn.004d607a
jmp 0x5ef0a5
lea ecx, [edi + 0x30]
cmp dword [ecx + 0x14], 0x10
jb 0x5eeff2
mov ecx, dword [ecx]
add edi, 0x18
cmp dword [edi + 0x14], 8
jb 0x5eeffd
mov edi, dword [edi]
add eax, 0xc
cmp dword [eax + 0x14], 8
jb 0x5ef008
mov eax, dword [eax]
push ecx
push edi
push eax
call fcn.004d3a61
jmp 0x5ef0a5
push edi
call fcn.004d2bdf
call fcn.00621d91
jmp 0x5ef0a5
lea eax, [edi + 0x30]
cmp dword [eax + 0x14], 0x10
jb 0x5ef030
mov eax, dword [eax]
push 1
push ebx
push ebx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x5ef0a5
xor eax, eax
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x3c], 7
mov word [ebp + 0x28], ax
push ebx
lea eax, [ebp + 0x28]
mov byte [ebp - 4], 0x26
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
call fcn.004d3aa0
mov eax, dword [ebp + 0x3c]
mov byte [ebp - 4], 0x25
cmp eax, 8
jb 0x5ef0a5
mov ecx, dword [ebp + 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x5ef09c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
lea ecx, [ebp - 0x80]
call fcn.004d7f0c
cmp byte [esi], 0
jne 0x5ef0ba
mov byte [esi], 1
call fcn.00489fdc
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 9
call fcn.0049f7c3
mov edx, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x24]
inc ecx
mov dword [ebp + 0x24], ecx
cmp ecx, dword [ebp + 0x1c]
jb 0x5ee17a
cmp dword [ebp - 0xa0], 0
je 0x5ef103
cmp dword [ebp - 0x9c], 8
lea eax, [ebp - 0xb0]
jb 0x5ef0f7
mov eax, dword [ebp - 0xb0]
push dword [ebp - 0xa0]
push eax
call fcn.00473859
cmp byte [ebp + 0x43], 0
je 0x5ef11c
push ebx
push ebx
push 0x8017
push dword [0x81d248]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0x9c]
mov byte [ebp - 4], 6
cmp eax, 8
jb 0x5ef261
mov ecx, dword [ebp - 0xb0]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x74], eax
mov dword [ebp + 0x78], ecx
cmp eax, 0x1000
jb 0x5ef15c
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x78]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
jmp 0x5ef261
push 0xa3
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
test ax, ax
mov eax, dword [ebp + 0x4c]
push eax
push dword [ebp + 0x44]
jns 0x5ef189
call fcn.005c13ad
jmp 0x5ef18e
call fcn.00646b57
mov ecx, dword [ebp + 0x54]
call fcn.005fd96a
jmp 0x5ef1d2
mov al, byte [esi]
test al, al
je 0x5ef1ab
mov byte [esi], bl
call fcn.0048a01d
mov al, byte [esi]
test al, al
jne 0x5ef1d2
mov byte [esi], 1
call fcn.00489fdc
jmp 0x5ef1d2
mov ecx, dword [ebp + 0x54]
call fcn.005ed8c2
jmp 0x5ef1d2
mov eax, dword [ebp + 0x54]
push ebx
push edi
push 0x8065
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0x9c]
cmp eax, 8
jb 0x5ef283
mov ecx, dword [ebp - 0xb0]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x74], eax
mov dword [ebp + 0x78], ecx
cmp eax, 0x1000
jb 0x5ef20e
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x78]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
jmp 0x5ef283
xor eax, eax
cmp edx, 0x1b
push 0x10
sete al
add eax, 4
mov dword [ebp + 0x74], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov eax, dword [ebp + 0x74]
jns 0x5ef23a
or eax, 2
push eax
mov eax, dword [ebp + 0x4c]
push eax
push dword [ebp + 0x44]
call fcn.004a01d8
mov ecx, 0x7ead50
call fcn.005266ba
mov dword [0x7eaa58], ebx
mov dword [0x7eaa5c], ebx
mov byte [ebp + 0x63], 1
cmp byte [esi], 0
je 0x5ef26d
mov byte [esi], bl
call fcn.0048a01d
cmp byte [ebp + 0x63], 0
je 0x5ef27b
mov ecx, dword [ebp + 0x54]
call fcn.005f78ba
mov ecx, dword [ebp + 0x54]
call fcn.005fdd18
cmp byte [ebp + 0x4b], 0
mov dword [ebp - 4], 0x27
je 0x5ef2ca
call fcn.0048a01d
jmp 0x5ef2ca
push 0
mov ecx, esi
call fcn.006095fd
call fcn.005dc922
push eax
call fcn.005dd3e3
push eax
push 0x14
push str.http:__utclient.utorrent.com_pro_utorrent_index.html
call fcn.006c9805
jmp 0x5ef2ca
mov ecx, esi
call fcn.005efae4
jmp 0x5ef2ca
mov ecx, esi
call fcn.005eff90
lea esp, [ebp - 0x22c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 8