Function at 0x4e297a
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x104
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0x78]
mov eax, 0x2b74
cmp ecx, eax
mov dword [ebp + 0x40], edi
jg 0x4e2a98
je 0x4e2a8c
cmp ecx, 0x41
jg 0x4e2a42
je 0x4e2a38
cmp ecx, 0x2f
je 0x4e2a2e
cmp ecx, 0x31
jle case.0x4e2aae.11127
cmp ecx, 0x33
jle 0x4e2a21
cmp ecx, 0x34
je 0x4e2a14
jle case.0x4e2aae.11127
cmp ecx, 0x38
jle 0x4e2a21
xor ebx, ebx
mov byte [ebp + 0x6f], bl
cmp ecx, 0x28
jne 0x4e29e7
mov eax, dword [0x88f9b8]
cmp eax, 4
jae 0x4e29e7
add eax, 0x17
mov dword [ebp + 0x78], eax
mov eax, dword [edi + 0x150]
mov eax, dword [eax + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
shr ecx, 0x1f
test cl, 1
jne 0x4e2b5d
imul eax, eax, 0xc
call fcn.00401000
mov dword [ebp + 0x3c], esp
jmp 0x4e2b6d
mov ecx, dword [edi + 4]
call fcn.004beb70
jmp 0x4e3718
push ecx
mov ecx, edi
call fcn.004e12f8
jmp 0x4e3718
call fcn.004e6bbc
jmp 0x4e3718
call fcn.004ceca9
jmp 0x4e3718
mov eax, ecx
sub eax, 0x72
je 0x4e2a80
sub eax, 3
je 0x4e2a74
dec eax
je 0x4e2a68
sub eax, 0x2afd
jne case.0x4e2aae.11127
mov ecx, edi
call fcn.004e167e
jmp 0x4e3718
mov ecx, edi
call fcn.004dc0ec
jmp 0x4e3718
mov ecx, edi
call fcn.004dbf57
jmp 0x4e3718
mov ecx, edi
call fcn.004e079a
jmp 0x4e3718
mov ecx, edi
call fcn.004e168d
jmp 0x4e3718
lea eax, [ecx - 0x2b75]
cmp eax, 0x10
ja case.0x4e2aae.11127
movzx eax, byte [eax + 0x4e374e]
jmp dword [eax*4 + 0x4e372a]
mov ecx, edi
call fcn.004e1c37
jmp 0x4e3718
mov ecx, edi
call fcn.004e1c17
jmp 0x4e3718
mov ecx, edi
call fcn.004dc09a
jmp 0x4e3718
push 0
push 0
push 0x8069
push dword [edi + 0xc8]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, edi
call fcn.004e16ab
jmp 0x4e3718
mov ecx, edi
call fcn.004e169c
jmp 0x4e3718
mov ecx, edi
call fcn.004e16c2
jmp 0x4e3718
mov ecx, edi
call fcn.004dc0cc
jmp 0x4e3718
mov esi, dword [edi + 0x30]
add esi, 0x38
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x4e2b51
mov eax, dword [esi]
push dword [eax + ebx*4]
mov ecx, dword [edi + 0x30]
call fcn.0042a41e
test eax, eax
je 0x4e2b4b
cmp byte [eax + 0x14], 0x17
jne 0x4e2b4b
mov ecx, dword [edi + 0x30]
push eax
call fcn.0042c5c9
inc ebx
cmp ebx, dword [esi + 8]
jb 0x4e2b2b
mov ecx, edi
call fcn.004dac4d
jmp 0x4e3718
call esi
mov dword [0x89444c], eax
mov dword [0], ebx
mov dword [ebp + 0x3c], ebx
mov eax, dword [edi + 0x150]
mov eax, dword [eax + 0x14]
mov ecx, eax
shr ecx, 0x1f
test cl, 1
jne 0x4e2b8d
shl eax, 2
call fcn.00401000
mov dword [ebp + 0x5c], esp
jmp 0x4e2b9d
call esi
mov dword [0x89444c], eax
mov dword [0], ebx
mov dword [ebp + 0x5c], ebx
mov eax, dword [edi + 0x150]
mov eax, dword [eax + 8]
push 2
push 0xffffffffffffffff
push 0x100c
push eax
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x68], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp + 0x64], eax
cmp eax, 0xffffffff
je 0x4e2cec
mov ebx, dword [ebp + 0x3c]
mov dword [ebp + 0x54], ebx
mov eax, dword [edi + 0x150]
mov ecx, dword [ebp + 0x48]
cmp ecx, dword [eax + 0x14]
jae 0x4e2cec
mov esi, dword [ebp + 0x64]
mov eax, dword [edi + 0x60]
and dword [ebp + 0x44], 0
shl esi, 2
mov eax, dword [esi + eax]
mov eax, dword [eax + 0x1c]
mov dword [ebx], eax
cmp eax, 1
jne 0x4e2c81
mov eax, dword [edi + 0x60]
mov eax, dword [esi + eax]
mov ecx, dword [eax + 0xc8]
call fcn.004977e8
mov ecx, dword [eax + 0x24]
and dword [ebp + 0x50], 0
mov dword [ebp + 0x4c], ecx
test ecx, ecx
jbe 0x4e2c81
mov ecx, dword [ebp + 0x40]
mov ecx, dword [ecx + 0x60]
mov edi, dword [esi + ecx]
mov ebx, dword [eax + 0x1c]
mov ecx, dword [edi + 0x20]
mov eax, dword [ebx + 4]
call fcn.0042a25c
test eax, eax
jne 0x4e2c68
mov ecx, dword [edi + 0xcc]
mov eax, dword [ebx + 8]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4e2c5f
test dl, dl
je 0x4e2c5b
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4e2c5f
inc eax
inc eax
inc ecx
inc ecx
test dl, dl
jne 0x4e2c41
xor eax, eax
jmp 0x4e2c64
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4e2c78
inc dword [ebp + 0x50]
mov eax, dword [ebp + 0x50]
add ebx, 0x54
cmp eax, dword [ebp + 0x4c]
jb 0x4e2c29
jmp 0x4e2c7b
mov dword [ebp + 0x44], ebx
mov ebx, dword [ebp + 0x54]
mov edi, dword [ebp + 0x40]
mov eax, dword [ebp + 0x44]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0x60]
mov eax, dword [esi + eax]
cmp dword [eax + 0x1c], 0
jne 0x4e2c9b
mov eax, dword [eax + 0xc4]
jmp 0x4e2c9d
xor eax, eax
cmp dword [ebx], 0
mov dword [ebx + 4], eax
jne 0x4e2cbd
mov eax, dword [edi + 0x60]
mov eax, dword [esi + eax]
mov edx, dword [ebp + 0x68]
mov eax, dword [eax + 0xc4]
mov ecx, dword [ebp + 0x5c]
inc dword [ebp + 0x68]
mov dword [ecx + edx*4], eax
mov eax, dword [edi + 0x150]
mov eax, dword [eax + 8]
inc dword [ebp + 0x48]
push 2
push dword [ebp + 0x64]
add ebx, 0xc
push 0x100c
push eax
mov dword [ebp + 0x54], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp + 0x64], eax
cmp eax, 0xffffffff
jne 0x4e2bce
cmp dword [ebp + 0x78], 0x25
mov eax, dword [ebp + 0x7c]
je 0x4e2e4f
cmp dword [ebp + 0x78], 0x2c
jne 0x4e2d7c
cmp dword [ebp + 0x68], 0xa
jbe 0x4e2d7c
test eax, eax
je 0x4e2d16
cmp byte [eax], 0
je 0x4e2d16
mov byte [eax], 0
call fcn.0047cff8
push dword [ebp + 0x68]
lea eax, [ebp + 0x4c]
push dword [0x8953a8]
mov dword [ebp - 0x1c], 1
push eax
mov dword [ebp - 0x18], 4
call fcn.004a1618
add esp, 0xc
mov ecx, eax
call fcn.004a0ff9
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00477c73
pop ecx
pop ecx
lea ecx, [ebp + 0x4c]
mov esi, eax
call fcn.004a0c7d
mov eax, dword [ebp + 0x7c]
test eax, eax
je 0x4e2d6a
cmp byte [eax], 0
jne 0x4e2d6a
mov byte [eax], 1
call fcn.0047cfd9
cmp esi, 7
je 0x4e3718
cmp esi, 2
je 0x4e3718
mov eax, dword [ebp + 0x48]
sub eax, dword [ebp + 0x68]
cmp dword [ebp + 0x48], 0
mov dword [ebp + 0x20], eax
je 0x4e3718
cmp dword [ebp + 0x68], 0
jbe 0x4e2efb
mov eax, dword [ebp + 0x78]
cmp eax, 0x17
je 0x4e2db4
cmp eax, 0x18
je 0x4e2db4
cmp eax, 0x19
je 0x4e2db4
cmp eax, 0x1a
jne 0x4e2efb
cmp byte [0x88f811], 0
je 0x4e2efb
cmp dword [ebp + 0x68], 1
mov dword [ebp - 0x18], 0x24
mov dword [ebp - 0x1c], 9
mov dword [ebp - 8], 0x88f811
jne 0x4e2dee
mov eax, dword [ebp + 0x5c]
mov eax, dword [eax]
cmp dword [eax + 0x1dc], 0
je 0x4e2ea8
mov eax, dword [ebp + 0x7c]
test eax, eax
je 0x4e2e02
cmp byte [eax], 0
je 0x4e2e02
mov byte [eax], 0
call fcn.0047cff8
push dword [ebp + 0x68]
lea eax, [ebp + 0x4c]
push 0
push eax
call fcn.004d76c3
mov ecx, eax
call fcn.004a0ff9
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00477c73
pop ecx
pop ecx
lea ecx, [ebp + 0x4c]
mov esi, eax
call fcn.004a0c7d
mov eax, dword [ebp + 0x7c]
test eax, eax
je 0x4e2e41
cmp byte [eax], 0
jne 0x4e2e41
mov byte [eax], 1
call fcn.0047cfd9
cmp esi, 6
jne 0x4e3718
jmp 0x4e2efb
cmp dword [ebp + 0x68], 0xa
jbe 0x4e2d7c
test eax, eax
je 0x4e2e6a
cmp byte [eax], 0
je 0x4e2e6a
mov byte [eax], 0
call fcn.0047cff8
push dword [ebp + 0x68]
lea eax, [ebp + 0x58]
push dword [0x8953a4]
mov dword [ebp - 0x3c], 1
push eax
mov dword [ebp - 0x38], 4
call fcn.004a1618
add esp, 0xc
mov ecx, eax
call fcn.004a0ff9
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00477c73
pop ecx
pop ecx
lea ecx, [ebp + 0x58]
jmp 0x4e2d4f
push eax
push edi
lea ecx, [ebp - 0x94]
call fcn.004c303c
push 0
push 0x110
call fcn.00476ebd
push eax
lea ecx, [ebp - 0x94]
call fcn.00476b03
mov eax, dword [edi + 4]
push 0x1b
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
cmp byte [ebp - 0x6c], 0
lea ecx, [ebp - 0x94]
jne 0x4e2ef6
call fcn.004c2d11
jmp 0x4e3718
call fcn.004c2d11
cmp dword [ebp + 0x7c], 0
mov byte [ebp + 0x6e], 0
jne 0x4e2f14
lea eax, [ebp + 0x6e]
mov dword [ebp + 0x7c], eax
mov byte [ebp + 0x6e], 1
call fcn.0047cfd9
cmp dword [ebp + 0x78], 0x22
jne 0x4e2f65
mov eax, dword [ebp + 0x68]
xor ebx, ebx
test eax, eax
jbe 0x4e2f5e
mov ecx, dword [ebp + 0x5c]
lea esi, [ecx + eax*4 - 4]
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax + ebx*4]
call fcn.004a3a85
test al, al
jne 0x4e2f49
mov eax, dword [esi]
mov ecx, dword [ebp + 0x5c]
dec dword [ebp + 0x68]
mov dword [ecx + ebx*4], eax
sub esi, 4
jmp 0x4e2f58
mov eax, dword [ebp + 0x5c]
mov eax, dword [eax + ebx*4]
test byte [eax + 0x1be], 0x20
je 0x4e2f9d
inc ebx
cmp ebx, dword [ebp + 0x68]
jb 0x4e2f2a
mov dword [ebp + 0x78], 0x23
cmp dword [ebp + 0x78], 0x13
jne 0x4e2f89
cmp dword [0x88f7f0], 0
je 0x4e2f9d
push ecx
mov edx, 0x5109c0
mov ecx, esp
call fcn.004a66fd
push 0xb
pop ecx
call fcn.0049dbb7
cmp dword [ebp + 0x78], 0x1c
je 0x4e36a8
cmp dword [ebp + 0x78], 0x1b
je 0x4e36a8
xor eax, eax
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x50], eax
cmp dword [ebp + 0x48], eax
jbe 0x4e3665
mov eax, dword [ebp + 0x50]
mov ecx, dword [ebp + 0x3c]
imul eax, eax, 0xc
add eax, ecx
mov esi, dword [eax + 4]
mov ebx, dword [eax + 8]
mov eax, dword [eax]
test eax, eax
jne 0x4e35cf
mov ecx, esi
call fcn.004a3a85
test al, al
je 0x4e3647
mov eax, dword [ebp + 0x78]
lea ebx, [eax - 0x2710]
cmp ebx, 0x3e7
ja 0x4e301b
mov eax, dword [ebp + 0x7c]
cmp byte [eax], 0
je 0x4e2fff
mov byte [eax], 0
call fcn.0047cff8
mov edx, ebx
mov ecx, esi
call fcn.00450196
mov eax, dword [ebp + 0x7c]
cmp byte [eax], 0
jne 0x4e3018
mov byte [eax], 1
call fcn.0047cfd9
mov eax, dword [ebp + 0x78]
cmp eax, 0x6a
jg 0x4e35b8
je 0x4e354f
cmp eax, 0x25
jg 0x4e31dc
je 0x4e31be
cmp eax, 0x1f
jg 0x4e3177
cmp eax, 0x1d
jge 0x4e3151
cmp eax, 0x13
je 0x4e30fe
cmp eax, 0x14
je 0x4e30f2
cmp eax, 0x15
je 0x4e30d9
cmp eax, 0x16
je 0x4e34d3
jle 0x4e3647
cmp eax, 0x1a
jg 0x4e3647
mov ecx, esi
call fcn.00491f62
movzx eax, byte [0x88f9cf]
mov ecx, dword [ebp + 0x78]
neg eax
sbb eax, eax
add ecx, 0xffffffe9
and eax, 4
or eax, ecx
push eax
mov ecx, esi
call fcn.004228bf
cmp esi, dword [edi + 0x148]
jne 0x4e30b0
push 0
mov ecx, edi
call fcn.004dc8b0
cmp esi, dword [edi + 0xa8]
jne 0x4e3647
mov eax, dword [edi + 0x150]
push 0
push 0xffffffffffffffff
push 0x1076
push dword [eax + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4e31b5
test byte [esi + 0x1be], 0x40
jne 0x4e31b5
mov ecx, esi
call fcn.0041f435
jmp 0x4e31b5
mov ecx, esi
call fcn.00419137
jmp 0x4e31b5
cmp dword [0x88f7f0], 0
je 0x4e3647
cmp byte [0x88f904], 0
jne 0x4e3123
mov ecx, dword [edi + 0x150]
push 0
push 0xe
call fcn.004314dd
mov ecx, dword [0x88f7f0]
push 0
push 0xffffffffffffffff
push esi
call fcn.0040729f
mov ecx, dword [0x88f7f0]
cmp byte [ecx + 0x10], 0
je 0x4e3647
push 0
push 0
call fcn.0040804c
jmp 0x4e3647
mov eax, dword [ebp + 0x78]
add eax, 0xffffffe3
push eax
mov ecx, esi
call fcn.00412481
push 0
push 0x20000
mov ecx, esi
call fcn.0040f0bd
call fcn.004a26a0
jmp 0x4e3647
sub eax, 0x20
je 0x4e366f
dec eax
je 0x4e31ae
dec eax
je 0x4e31a5
dec eax
je 0x4e319c
dec eax
jne 0x4e3647
mov ecx, esi
call fcn.0041295c
jmp 0x4e3647
mov ecx, esi
call fcn.0041f317
jmp 0x4e31b5
mov ecx, esi
call fcn.0041f39a
jmp 0x4e31b5
mov ecx, esi
call fcn.00420857
mov byte [ebp + 0x6f], 1
jmp 0x4e3647
mov eax, dword [esi + 0x168]
push dword [ebp + 0x7c]
xor edx, edx
cmp byte [eax + 0x28], dl
mov ecx, esi
sete dl
dec edx
call fcn.004503f2
jmp 0x4e3647
cmp eax, 0x2c
jg 0x4e34bb
je 0x4e34aa
sub eax, 0x26
je 0x4e322b
dec eax
je 0x4e321f
dec eax
dec eax
je 0x4e3213
dec eax
je 0x4e3205
dec eax
jne 0x4e3647
xor dl, dl
jmp 0x4e3207
mov dl, 1
mov ecx, esi
call fcn.004c802a
jmp 0x4e3647
mov ecx, esi
call fcn.00412300
jmp 0x4e3647
mov ecx, esi
call fcn.004123c7
jmp 0x4e3647
lea ecx, [ebp + 0x64]
mov byte [ebp + 0x63], 0
call fcn.004a0e93
push dword [ebp + 0x7c]
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x64]
push eax
xor dl, dl
mov ecx, esi
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x38], 0x23
mov dword [ebp + 0x44], 0x513920
call fcn.004cdeee
mov bl, al
neg bl
sbb bl, bl
inc bl
mov dword [ebp + 0x44], 0x5138b4
je 0x4e349d
mov edi, dword [esi + 0x168]
cmp byte [edi + 0x28], 0
mov dword [ebp + 0x58], edi
je 0x4e32d1
test byte [esi + 0x1cd], 0x10
je 0x4e32d1
mov ecx, esi
call fcn.0040f54c
lea ecx, [ebp + 0x64]
mov edi, eax
call fcn.004a0ff9
mov edx, edi
mov ecx, eax
call fcn.0049fc6f
test al, al
jne 0x4e32ce
mov ecx, esi
call fcn.0040f54c
lea ecx, [ebp + 0x64]
mov edi, eax
call fcn.004a0ff9
mov edx, edi
mov ecx, eax
call fcn.004b7a3f
push eax
lea ecx, [ebp + 0x64]
call fcn.004a101e
mov edi, dword [ebp + 0x58]
lea ecx, [ebp + 0x54]
call fcn.004a0e93
test edi, edi
je 0x4e3317
cmp dword [edi + 8], 0
je 0x4e3317
cmp byte [edi + 0x28], 0
je 0x4e3317
test byte [esi + 0x1cd], 0x10
je 0x4e3317
mov eax, dword [edi]
lea ecx, [ebp + 0x64]
mov dword [ebp + 0x58], eax
call fcn.004a0ff9
mov ecx, dword [ebp + 0x58]
mov edx, dword [ecx + 0x24]
mov ecx, eax
call fcn.004b7a3f
push eax
lea ecx, [ebp + 0x54]
call fcn.004a0c86
jmp 0x4e3322
push dword [ebp + 0x64]
lea ecx, [ebp + 0x54]
call fcn.004a101e
lea ecx, [ebp + 0x54]
call fcn.004a0ff9
mov ecx, eax
call fcn.00482110
test al, al
je 0x4e33aa
mov eax, dword [ebp + 0x7c]
cmp byte [eax], 0
je 0x4e3345
mov byte [eax], 0
call fcn.0047cff8
mov ebx, dword [0x895e7c]
xor eax, eax
lea ecx, [ebp + 0x54]
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x14], eax
call fcn.004a0ff9
push eax
lea eax, [ebp + 0x10]
push ebx
push eax
call fcn.004a04a6
add esp, 0xc
lea ecx, [ebp + 0x10]
call fcn.004a0486
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00477c73
pop ecx
pop ecx
lea ecx, [ebp + 0x10]
mov dword [ebp + 0x58], eax
call fcn.004a0bd2
cmp dword [ebp + 0x58], 6
mov eax, dword [ebp + 0x7c]
sete bl
cmp dword [ebp + 0x58], 7
sete byte [ebp + 0x63]
cmp byte [eax], 0
jne 0x4e33aa
mov byte [eax], 1
call fcn.0047cfd9
test bl, bl
je 0x4e33cc
push 0
push 0
lea ecx, [ebp + 0x64]
call fcn.004a0ff9
push eax
mov ecx, esi
call fcn.0041f7f9
call fcn.004a26a0
jmp 0x4e3492
cmp byte [ebp + 0x63], 0
je 0x4e3492
cmp byte [edi + 0x28], 0
jne 0x4e3474
cmp dword [edi + 8], 0
je 0x4e3474
xor eax, eax
lea ecx, [ebp + 0x64]
mov dword [ebp + 0x24], eax
mov dword [ebp + 0x2c], eax
mov dword [ebp + 0x28], eax
call fcn.004a0ff9
push 0x5c
push eax
call sub.msvcrt.dll_wcsrchr
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4e3431
lea ecx, [ebp + 0x64]
call fcn.004a0ff9
mov ecx, ebx
sub ecx, eax
sar ecx, 1
push ecx
lea ecx, [ebp + 0x64]
call fcn.004a0ff9
push eax
lea ecx, [ebp + 0x24]
call fcn.004a02f6
inc ebx
inc ebx
jmp 0x4e3449
call fcn.004b7c53
push eax
lea ecx, [ebp + 0x24]
call fcn.004a02d0
lea ecx, [ebp + 0x64]
call fcn.004a0ff9
mov ebx, eax
lea ecx, [ebp + 0x24]
call fcn.004a0486
push eax
mov ecx, edi
call fcn.0044a344
mov ecx, ebx
call fcn.0042876e
push eax
push dword [edi]
mov ecx, edi
call fcn.0044a35e
lea ecx, [ebp + 0x24]
call fcn.004a0bd2
jmp 0x4e3484
lea ecx, [ebp + 0x64]
call fcn.004a0ff9
push eax
mov ecx, edi
call fcn.0044a344
push 0
push 0x1000
mov ecx, esi
call fcn.0040f0bd
lea ecx, [ebp + 0x54]
call fcn.004a0c7d
mov edi, dword [ebp + 0x40]
lea ecx, [ebp + 0x64]
call fcn.004a0c7d
jmp 0x4e3647
push 0
or edx, 0xffffffff
mov ecx, esi
call fcn.0045007a
jmp 0x4e3647
sub eax, 0x2d
je 0x4e350e
dec eax
je 0x4e3696
sub eax, 0xb
je 0x4e34df
dec eax
jne 0x4e3647
mov ecx, esi
call fcn.0042092d
jmp 0x4e31b5
cmp dword [ebp + 0x38], 0
jbe 0x4e34f2
push 0x514924
lea ecx, [ebp + 0x30]
call fcn.004a02d0
mov ecx, esi
call fcn.004158a3
mov ecx, eax
call fcn.0049e604
push eax
lea ecx, [ebp + 0x30]
call fcn.004a02d0
jmp 0x4e3647
xor eax, eax
mov dword [ebp + 4], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x7c]
cmp byte [eax], 0
mov ebx, eax
je 0x4e352b
mov byte [ebx], 0
call fcn.0047cff8
mov edx, esi
lea ecx, [ebp + 4]
call fcn.004ee637
cmp byte [ebx], 0
jne 0x4e3542
mov byte [ebx], 1
call fcn.0047cfd9
lea ecx, [ebp + 4]
call fcn.004a0bd2
jmp 0x4e3647
mov ecx, esi
call fcn.0040f556
push eax
lea eax, [ebp + 0x4c]
push eax
lea ecx, [esi + 0x1c]
call fcn.00433f8f
mov esi, dword [ebp + 0x7c]
cmp byte [esi], 0
je 0x4e3573
mov byte [esi], 0
call fcn.0047cff8
lea ecx, [ebp + 0x4c]
call fcn.004a0ff9
push eax
lea eax, [ebp + 0x1c]
push 0x51a2f0
push eax
call fcn.004a1618
add esp, 0xc
mov ecx, eax
call fcn.004a0ff9
mov ecx, eax
call fcn.004b900f
lea ecx, [ebp + 0x1c]
call fcn.004a0c7d
cmp byte [esi], 0
jne 0x4e35b0
mov byte [esi], 1
call fcn.0047cfd9
lea ecx, [ebp + 0x4c]
jmp 0x4e34a0
cmp eax, 0x6c
jne 0x4e3647
push 1
xor eax, eax
push eax
push eax
push dword [esi + 0x470]
jmp 0x4e362d
cmp eax, 1
jne 0x4e3647
mov ecx, dword [ebx + 0x38]
call fcn.004977e8
mov ecx, dword [ebp + 0x78]
sub ecx, 0x16
je 0x4e35f5
sub ecx, 0x1a
je 0x4e3624
dec ecx
je 0x4e3616
dec ecx
dec ecx
je 0x4e3606
sub ecx, 8
jne 0x4e3647
xor edx, edx
cmp dword [ebp + 0x20], 1
mov ecx, ebx
jbe 0x4e3637
call fcn.00499fa3
jmp 0x4e3647
push dword [ebx + 8]
mov edx, dword [ebx + 4]
mov ecx, dword [eax + 0x10]
call fcn.0049964e
jmp 0x4e3647
mov ecx, ebx
call fcn.004979b8
call fcn.004e6bbc
jmp 0x4e3647
push 1
xor eax, eax
push eax
push eax
push dword [ebx + 8]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4e3647
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 0x7c]
push eax
call fcn.00498785
inc dword [ebp + 0x50]
mov eax, dword [ebp + 0x50]
cmp eax, dword [ebp + 0x48]
jb 0x4e2fb4
mov edx, dword [ebp + 0x38]
test edx, edx
jbe 0x4e3665
mov ecx, dword [ebp + 0x30]
call fcn.004b9a44
lea ecx, [ebp + 0x30]
call fcn.004a0bd2
jmp 0x4e36e9
push 0xa3
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push dword [ebp + 0x7c]
mov edx, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x5c]
test ax, ax
jge 0x4e368f
call fcn.0044ebcd
jmp 0x4e370d
call fcn.004f7164
jmp 0x4e370d
mov eax, dword [ebp + 0x7c]
cmp byte [eax], 0
je 0x4e370d
mov byte [eax], 0
call fcn.0047cff8
jmp 0x4e370d
xor eax, eax
cmp dword [ebp + 0x78], 0x1b
push 0x10
sete al
add eax, 4
mov esi, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x4e36c6
or esi, 2
mov edx, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x5c]
push esi
call fcn.004a42be
call fcn.004a26a0
and dword [0x88dd70], 0
and dword [0x88dd74], 0
mov byte [ebp + 0x6f], 1
mov eax, dword [ebp + 0x7c]
cmp byte [eax], 0
je 0x4e36f9
mov byte [eax], 0
call fcn.0047cff8
cmp byte [ebp + 0x6f], 0
je 0x4e3706
mov ecx, edi
call fcn.004e11fc
mov ecx, edi
call fcn.004db51a
cmp byte [ebp + 0x6e], 0
je 0x4e3718
call fcn.0047cff8
lea esp, [ebp - 0xa0]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8