Function at 0x4d0e9c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x4d0adc
call fcn.00406d60
mov ebx, dword [0x4d4028]
xor eax, eax
push ebp
push 0x4d1214
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4d1224
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x4d0ef9
mov eax, 0x4d1238
call fcn.0043208c
mov eax, dword [0x4d41b4]
mov eax, dword [eax]
call fcn.004823b4
jmp 0x4d11f9
call fcn.004cb964
call fcn.004cced8
mov edx, dword [0x4d4208]
mov byte [edx], al
mov eax, dword [0x4d42a0]
mov byte [eax], 0
mov eax, dword [0x4d43f4]
mov byte [eax], 1
mov eax, dword [0x4d4208]
cmp byte [eax], 0
je 0x4d0ff2
cmp dword [ebx], 0xf
je 0x4d0f4b
cmp dword [ebx], 0x10
je 0x4d0f4b
cmp dword [ebx], 0x11
je 0x4d0f4b
cmp dword [ebx], 0x19
je 0x4d0f4b
cmp dword [ebx], 0x1a
je 0x4d0f4b
cmp dword [ebx], 0x1b
jne 0x4d0ff2
mov eax, dword [0x4d43f4]
mov byte [eax], 0
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00402b10
mov eax, dword [ebp - 0x14]
mov edx, 0x4d125c
call fcn.00404fa4
jne 0x4d0f77
mov eax, dword [0x4d42a0]
mov byte [eax], 1
mov dl, 1
mov eax, dword [0x43c050]
call fcn.0043c150
mov dword [0x4d5f00], eax
xor eax, eax
push ebp
push 0x4d0feb
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [0x4d5f00]
call fcn.0043c1f0
xor ecx, ecx
mov edx, 0x4d1268
mov eax, dword [0x4d5f00]
call fcn.0043c254
test al, al
je 0x4d0fc9
mov edx, 0x4d12a0
mov eax, dword [0x4d5f00]
call fcn.0043c378
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d10ac
mov eax, dword [0x4d5f00]
call fcn.0043c1c0
mov eax, dword [0x4d5f00]
call fcn.00403e48
ret
lea edx, [ebp - 0x18]
mov eax, 1
call fcn.00402b10
mov eax, dword [ebp - 0x18]
mov edx, 0x4d125c
call fcn.00404fa4
je 0x4d10ac
mov dl, 1
mov eax, dword [0x43c050]
call fcn.0043c150
mov dword [0x4d5f04], eax
xor eax, eax
push ebp
push 0x4d10a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [0x4d5f04]
call fcn.0043c1f0
xor ecx, ecx
mov edx, 0x4d1268
mov eax, dword [0x4d5f04]
call fcn.0043c254
test al, al
je 0x4d1083
lea edx, [ebp - 0x1c]
mov eax, dword [0x4d41b4]
mov eax, dword [eax]
call fcn.004828d8
lea eax, [ebp - 0x1c]
mov edx, 0x4d12b4
call fcn.00404e60
mov ecx, dword [ebp - 0x1c]
mov edx, 0x4d12a0
mov eax, dword [0x4d5f04]
call fcn.0043c410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d10ac
mov eax, dword [0x4d5f04]
call fcn.0043c1c0
mov eax, dword [0x4d5f04]
call fcn.00403e48
ret
call fcn.004ccfe8
mov ecx, dword [0x4d3e90]
mov eax, dword [0x4d41b4]
mov eax, dword [eax]
mov edx, dword [0x4cc404]
call fcn.00482248
mov ecx, dword [0x4d3ecc]
mov eax, dword [0x4d41b4]
mov eax, dword [eax]
mov edx, dword [0x4ca818]
call fcn.00482248
mov ecx, dword [0x4d3ea8]
mov eax, dword [0x4d41b4]
mov eax, dword [eax]
mov edx, dword [0x4ca418]
call fcn.00482248
mov ecx, dword [0x4d426c]
mov eax, dword [0x4d41b4]
mov eax, dword [eax]
mov edx, dword [0x4b4a80]
call fcn.00482248
mov ecx, dword [0x4d4294]
mov eax, dword [0x4d41b4]
mov eax, dword [eax]
mov edx, dword [0x4bfa8c]
call fcn.00482248
mov ecx, dword [0x4d4084]
mov eax, dword [0x4d41b4]
mov eax, dword [eax]
mov edx, dword [0x4b1024]
call fcn.00482248
mov ecx, dword [0x4d3ebc]
mov eax, dword [0x4d41b4]
mov eax, dword [eax]
mov edx, dword [0x4b1f58]
call fcn.00482248
mov ecx, dword [0x4d43a0]
mov eax, dword [0x4d41b4]
mov eax, dword [eax]
mov edx, dword [0x4c5110]
call fcn.00482248
mov ecx, dword [0x4d40f8]
mov eax, dword [0x4d41b4]
mov eax, dword [eax]
mov edx, dword [0x4b2828]
call fcn.00482248
mov ecx, dword [0x4d4248]
mov eax, dword [0x4d41b4]
mov eax, dword [eax]
mov edx, dword [0x4c5da4]
call fcn.00482248
mov eax, dword [0x4d42a0]
cmp byte [eax], 0
je 0x4d11ed
xor eax, eax
push ebp
push 0x4d11e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d426c]
mov eax, dword [eax]
call fcn.004bac70
mov eax, dword [0x4d41b4]
mov eax, dword [eax]
call fcn.004823b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d11f9
mov eax, dword [0x4d41b4]
mov eax, dword [eax]
call fcn.004822c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d121b
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404bbc
ret