Function at 0x411c37
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x10004]
mov eax, 0x10004
call fcn.00467fb0
push 0xffffffffffffffff
push 0x46a196
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x49ce78]
xor eax, ebp
mov dword [ebp + 0x10000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov ebx, str.Settings
cmp dword [ebp + 0x1000c], esi
je 0x411d3d
push esi
mov edi, 0x477124
push edi
push str.LastUpdateCheck
push ebx
call fcn.0040ef53
push esi
push edi
push str.UpdateCheckingPeriod
push ebx
mov dword [ebp - 0x1c], eax
call fcn.0040ef53
mov edi, eax
add esp, 0x20
cmp edi, esi
je 0x41259a
cmp dword [ebp - 0x1c], esi
je 0x411d3d
lea eax, [ebp - 0x6c]
push eax
call fcn.00408976
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
push esi
pop edx
sbb eax, edx
mov edx, edi
dec edx
je 0x411d3d
dec edx
je 0x411d1d
dec edx
je 0x411d01
dec edx
jne 0x41259a
push esi
push 0x15180
push eax
push ecx
call fcn.00467e40
cmp edx, esi
jl 0x41259a
jg 0x411d3d
cmp eax, 0x1e
jmp 0x411d37
push esi
push 0x15180
push eax
push ecx
call fcn.00467e40
cmp edx, esi
jl 0x41259a
jg 0x411d3d
cmp eax, 7
jmp 0x411d37
push esi
push 0x15180
push eax
push ecx
call fcn.00467e40
cmp edx, esi
jl 0x41259a
jg 0x411d3d
cmp eax, 1
jb 0x41259a
mov edi, 0x4749d0
push edi
lea eax, [ebp - 0x50]
push str.UpdateURL
push eax
call fcn.0041166b
add esp, 0xc
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], esi
call dword [sym.imp.mfc90.dll_Ordinal_4311]
test al, al
jne 0x412591
push 0x10000
lea eax, [ebp]
push esi
push eax
call sub.MSVCR90.dll_memset
push esi
push 1
push edi
push str.ProxyUsername
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.0040ed33
push esi
push 1
push edi
push str.ProxyPassword
lea eax, [ebp - 0x78]
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.0040ed33
add esp, 0x3c
mov byte [ebp - 4], 2
call sub.mfc90.dll_Ordinal_1137
mov ecx, dword [eax + 4]
call sub.mfc90.dll_Ordinal_1387
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
mov dword [ebp - 0x28], esi
call sub.mfc90.dll_Ordinal_404
lea eax, [ebp - 0x64]
push esi
push eax
mov byte [ebp - 4], 4
call fcn.0040e7af
push str.Update.txt
push eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 4], 5
call dword [sym.imp.RTFC.dll_class_CStringLite___cdecl_operator_class_CStringLite_const___char_const__]
add esp, 0x14
mov eax, dword [eax + 4]
push esi
push 0x20
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 6
call sub.mfc90.dll_Ordinal_5520
mov ebx, dword [sym.imp.RTFC.dll_public_virtual:_void___thiscall_CStringLite::destructor_void_]
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 5
call ebx
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call ebx
cmp dword [ebp - 0x2c], esi
je 0x411e3d
push 0x10000
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x88]
call sub.mfc90.dll_Ordinal_5753
mov dword [ebp - 0x1c], eax
cmp eax, esi
jne 0x411e78
push 0xffff
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x78]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [ebp - 0x70]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [ebp - 0x50]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call fcn.0040f662
add esp, 0x14
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
call sub.mfc90.dll_Ordinal_1137
mov ecx, dword [eax + 4]
call sub.mfc90.dll_Ordinal_5960
cmp dword [ebp - 0x1c], esi
jle 0x41233b
lea ecx, [ebp - 0xb4]
call dword [sym.imp.RTFC.dll_public:_void___thiscall_CTextFile::constructor_void_]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 7
call dword [sym.imp.RTFC.dll_public:_void___thiscall_CTextFile::Precache_char_const__]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [ebp - 4], 8
cmp dword [ebp - 0x18], esi
je 0x411edd
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push str.Update_d
push eax
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
jmp 0x411eeb
push str.Update
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push edi
push 0x4789e8
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0xb4]
call dword [sym.imp.RTFC.dll_public_virtual:_class_CStringLite___thiscall_CTextFile::ReadSectionParam_char_const___char_const___char_const__]
push edi
push str.ProductBetaVersion
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 9
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0xb4]
call dword [sym.imp.RTFC.dll_public_virtual:_class_CStringLite___thiscall_CTextFile::ReadSectionParam_char_const___char_const___char_const__]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x74]
push eax
push str._d._d._d
push dword [ebp - 0x58]
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
call dword [sym.imp.MSVCR90.dll_sscanf_s]
mov eax, dword [ebp - 0x74]
shl eax, 8
or eax, dword [ebp - 0x4c]
mov dword [ebp - 0x20], esi
shl eax, 8
or eax, dword [ebp - 0x48]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
push eax
push 0x475268
push dword [ebp - 0x60]
call dword [sym.imp.MSVCR90.dll_sscanf_s]
add esp, 0x20
lea ecx, [ebp - 0x5c]
call dword [sym.imp.RTFC.dll_public:_int___thiscall_CStringLite::IsEmpty_void_const]
test eax, eax
jne 0x412126
push edi
push 0x4789e8
lea eax, [ebp - 0x3c]
push str.Global
push eax
call fcn.0040eeec
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 0xb
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [ebp - 0x6c]
call dword [sym.imp.RTFC.dll_public:_void___thiscall_CStringLite::constructor_char_const__]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xd
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
push eax
push str._d._d._d
push dword [ebp - 0x68]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x2c], esi
call dword [sym.imp.MSVCR90.dll_sscanf_s]
mov esi, dword [ebp - 0x44]
shl esi, 8
or esi, dword [ebp - 0x40]
shl esi, 8
or esi, dword [ebp - 0x2c]
call fcn.0040f97c
push 0
push 0x477124
push str.UpdateCheckingAllowBetas
push str.Settings
mov dword [ebp - 0x14], eax
call fcn.0040ef53
add esp, 0x24
neg eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x28], esi
jbe 0x4120e3
test eax, eax
jne 0x41203a
cmp dword [ebp - 0x20], eax
jne 0x412119
mov dword [ebp - 0x30], 1
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_316]
cmp dword [ebp - 0x20], 0
mov byte [ebp - 4], 0xe
je 0x412190
lea eax, [ebp - 0x34]
push 0x60
push eax
call dword [sym.imp.RTMUI.dll_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______cdecl_LoadStringA_unsigned_int_]
pop ecx
pop ecx
mov esi, eax
push dword [ebp - 0x58]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xf
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 0x4759e8
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 0x10
call fcn.00408911
push esi
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0x11
call fcn.004034a5
add esp, 0x18
push dword [ebp - 0x20]
mov ecx, eax
mov byte [ebp - 4], 0x12
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x41219c
jne 0x412119
test eax, eax
mov eax, dword [ebp - 0x20]
je 0x4120fe
cmp dword [ebp - 0x14], 0
je 0x412119
cmp eax, dword [ebp - 0x14]
jbe 0x4120fe
mov dword [ebp - 0x30], 1
cmp dword [ebp - 0x14], 0
je 0x41210f
test eax, eax
jne 0x41210f
mov dword [ebp - 0x30], 1
cmp dword [ebp - 0x30], 0
jne 0x412041
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0xa
call ebx
xor esi, esi
jmp 0x41215f
cmp dword [ebp - 0x18], esi
jne 0x41227b
lea eax, [ebp - 0x24]
push 0x48
push eax
call dword [sym.imp.RTMUI.dll_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______cdecl_LoadStringA_unsigned_int_]
pop ecx
pop ecx
push 0x2010
mov ecx, eax
mov byte [ebp - 4], 0x15
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call fcn.0040ecf4
pop ecx
pop ecx
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 9
call ebx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 8
call ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call dword [sym.imp.mfc90.dll_Ordinal_601]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jb 0x411eb4
jmp 0x41229f
push dword [ebp - 0x58]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
lea eax, [ebp - 0x34]
push 0x47
push eax
mov byte [ebp - 4], 0x13
call dword [sym.imp.RTMUI.dll_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______cdecl_LoadStringA_unsigned_int_]
pop ecx
pop ecx
mov esi, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x14
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x13
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0x24
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call fcn.0040ecf4
pop ecx
pop ecx
cmp eax, 6
jne 0x41223d
push edi
push str.ProductURL
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0xb4]
call dword [sym.imp.RTFC.dll_public_virtual:_class_CStringLite___thiscall_CTextFile::ReadSectionParam_char_const___char_const___char_const__]
mov eax, dword [eax + 4]
push 1
xor ecx, ecx
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x38]
call ebx
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0xa
call ebx
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 9
call ebx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 8
call ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call dword [sym.imp.mfc90.dll_Ordinal_601]
xor esi, esi
jmp 0x41229a
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 9
call ebx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 8
call ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call dword [sym.imp.mfc90.dll_Ordinal_601]
cmp dword [ebp - 0x30], esi
jne 0x4122d7
cmp dword [ebp + 0x1000c], esi
jne 0x4122d7
lea eax, [ebp - 0x34]
push 0x46
push eax
call dword [sym.imp.RTMUI.dll_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______cdecl_LoadStringA_unsigned_int_]
pop ecx
pop ecx
push 0x2040
mov ecx, eax
mov byte [ebp - 4], 0x16
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call fcn.0040ecf4
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push esi
call dword [sym.imp.MSVCR90.dll__time32]
pop ecx
lea ecx, [ebp - 0x1c]
mov esi, eax
call dword [sym.imp.mfc90.dll_Ordinal_316]
push esi
lea eax, [ebp - 0x1c]
push str._08Xh
push eax
mov byte [ebp - 4], 0x17
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
push str.LastUpdateCheck
push str.Settings
call fcn.0040f037
add esp, 0xc
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 4
call dword [sym.imp.RTFC.dll_public_virtual:_void___thiscall_CTextFile::destructor_void_]
jmp 0x412564
mov edi, dword [sym.imp.RTMUI.dll_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______cdecl_LoadStringA_unsigned_int_]
lea eax, [ebp - 0x20]
push 0x49
push eax
call edi
pop ecx
pop ecx
push 0x11
mov byte [ebp - 4], 0x18
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x412545
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov ebx, dword [ebp - 0x1c]
mov esi, dword [sym.imp.mfc90.dll_Ordinal_2539]
mov byte [ebp - 4], 0x1a
cmp ebx, 0xfffffff9
je 0x41248f
cmp ebx, 0xfffffffa
je 0x412472
cmp ebx, 0xfffffffb
je 0x412455
cmp ebx, 0xfffffffc
je 0x412438
cmp ebx, 0xfffffffd
je 0x41241b
cmp ebx, 0xfffffffe
je 0x4123fb
cmp ebx, 0xffffffff
je 0x4123db
lea eax, [ebp - 0x34]
push 0x6e
push eax
call edi
pop ecx
pop ecx
push ebx
mov ecx, eax
mov byte [ebp - 4], 0x22
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea eax, [ebp - 0x10]
push eax
call esi
add esp, 0xc
lea ecx, [ebp - 0x34]
jmp 0x4124aa
lea eax, [ebp - 0x24]
push 0x56
push eax
call edi
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1b
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x24]
jmp 0x4124aa
lea eax, [ebp - 0x3c]
push 0x68
push eax
call edi
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1c
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x3c]
jmp 0x4124aa
lea eax, [ebp - 0x2c]
push 0x69
push eax
call edi
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1d
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x2c]
jmp 0x4124aa
lea eax, [ebp - 0x40]
push 0x6a
push eax
call edi
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1e
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x40]
jmp 0x4124aa
lea eax, [ebp - 0x44]
push 0x6b
push eax
call edi
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1f
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x44]
jmp 0x4124aa
lea eax, [ebp - 0x48]
push 0x6c
push eax
call edi
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x20
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x48]
jmp 0x4124aa
lea eax, [ebp - 0x4c]
push 0x6d
push eax
call edi
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x21
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x1a
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea eax, [ebp - 0x24]
push 0x6f
push eax
call edi
push eax
lea eax, [ebp - 0x34]
push 0x4772a8
push eax
mov byte [ebp - 4], 0x23
call fcn.00410c19
add esp, 0x14
push dword [ebp - 0x28]
mov ecx, eax
push dword [ebp - 0x10]
mov byte [ebp - 4], 0x24
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea eax, [ebp - 0x14]
push eax
call esi
add esp, 0x10
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x1a
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004034a5
add esp, 0xc
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x25
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x18
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0x2010
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call fcn.0040ecf4
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
call sub.mfc90.dll_Ordinal_663
lea ecx, [ebp - 0x51]
mov byte [ebp - 4], 2
call fcn.00410ca5
lea ecx, [ebp - 0x78]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x70]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x50]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x10000]
xor ecx, ebp
call fcn.00467bd4
add ebp, 0x10004
leave
ret