Function at 0x46e340
Capabilities:
Check mutex on windows
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b2a82
mov eax, dword fs:[0]
push eax
sub esp, 0x75c
mov eax, dword [0x4d0968]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x6d8], ebx
call fcn.00467100
mov dword [ebp - 0x68], 0xf
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x7c], bl
cmp esi, ebx
mov dword [ebp - 4], ebx
je 0x46e3f5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x46e3a7
xor eax, eax
jmp 0x46e3c0
lea edi, [eax + eax]
mov eax, edi
call fcn.00480be0
mov eax, esp
push 0x3a8
push edi
push esi
push eax
call fcn.0042ba10
mov ecx, esi
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x46e3c5
sub ecx, esi
sar ecx, 1
je 0x46e3f5
mov ecx, eax
lea esi, [ecx + 1]
jmp 0x46e3e0
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x46e3e0
sub ecx, esi
push ecx
push eax
lea ecx, [ebp - 0x80]
call fcn.0040bd70
lea eax, [ebp - 0x6f4]
push eax
call fcn.00467990
push str.configupdateStartCommond.tmp
push eax
lea ecx, [ebp - 0x64]
push ecx
mov byte [ebp - 4], 1
call fcn.00415930
add esp, 0x10
mov esi, 0x10
cmp dword [ebp - 0x6dc], esi
mov byte [ebp - 4], 3
jb 0x46e437
mov edx, dword [ebp - 0x6f0]
push edx
call fcn.004803bd
add esp, 4
cmp dword [ebp - 0x6c], ebx
mov eax, 0xf
mov dword [ebp - 0x6dc], eax
mov dword [ebp - 0x6e0], ebx
mov byte [ebp - 0x6f0], bl
je 0x46e481
lea ecx, [ebp - 0x80]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6d0], esp
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x64]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.0040bc90
call fcn.00466d30
add esp, 0x20
jmp 0x46e4a7
cmp dword [ebp - 0x4c], esi
mov ebx, dword [ebp - 0x60]
jae 0x46e48c
lea ebx, [ebp - 0x60]
call fcn.00461200
test al, al
je 0x46e4a5
cmp dword [ebp - 0x4c], esi
mov ecx, dword [ebp - 0x60]
jae 0x46e4a0
lea ecx, [ebp - 0x60]
call fcn.00461280
xor ebx, ebx
lea eax, [ebp - 0x748]
push eax
call fcn.00467990
push str._startCommand.txt
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov byte [ebp - 4], 4
call fcn.00415930
add esp, 0x10
cmp dword [ebp - 0x730], esi
mov byte [ebp - 4], 6
jb 0x46e4e4
mov edx, dword [ebp - 0x744]
push edx
call fcn.004803bd
add esp, 4
cmp dword [ebp - 0x14], esi
mov dword [ebp - 0x734], ebx
mov byte [ebp - 0x744], bl
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x730], 0xf
jae 0x46e505
lea ebx, [ebp - 0x28]
call fcn.00461200
xor ebx, ebx
test al, al
je 0x46e668
mov eax, 0xf
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6d0], esp
push 0xffffffffffffffff
mov dword [ecx + 0x18], eax
push ebx
lea eax, [ebp - 0x2c]
mov dword [ecx + 0x14], ebx
push eax
mov byte [ebp - 4], 7
mov byte [ecx + 4], bl
call fcn.0040bc90
lea ecx, [ebp - 0x48]
call fcn.00466e10
add esp, 0x1c
cmp al, bl
je 0x46e63e
cmp dword [ebp - 0x34], ebx
je 0x46e63e
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [ebp - 0x28]
jae 0x46e56e
lea ecx, [ebp - 0x28]
call fcn.00461280
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov ebx, dword [ebp - 0x28]
add esi, 1
cmp dword [ebp - 0x14], 0x10
jae 0x46e58a
lea ebx, [ebp - 0x28]
call fcn.00461200
test al, al
je 0x46e59c
push 0x32
call edi
cmp esi, 3
jl 0x46e57b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6d0], esp
xor ebx, ebx
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x48]
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov si, 0xa
mov byte [ecx + 4], bl
call fcn.0040bc90
mov ecx, esi
xor edx, edx
call fcn.00465bd0
mov esi, 0x10
add esp, 0x1c
cmp dword [ebp - 0x30], esi
jb 0x46e5e9
mov eax, dword [ebp - 0x44]
push eax
call fcn.004803bd
add esp, 4
cmp dword [ebp - 0x14], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
jb 0x46e603
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004803bd
add esp, 4
cmp dword [ebp - 0x4c], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
jb 0x46e61d
mov edx, dword [ebp - 0x60]
push edx
call fcn.004803bd
add esp, 4
cmp dword [ebp - 0x68], esi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x60], bl
jb 0x46e637
mov eax, dword [ebp - 0x7c]
push eax
call fcn.004803bd
add esp, 4
xor eax, eax
jmp 0x46edff
mov ecx, dword [ebp - 0x28]
mov esi, 0x10
cmp dword [ebp - 0x14], esi
jae 0x46e64e
lea ecx, [ebp - 0x28]
call fcn.00461280
cmp dword [ebp - 0x30], esi
mov byte [ebp - 4], 6
jb 0x46e668
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.004803bd
add esp, 4
push str.bmvpnclient
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
cmp esi, ebx
je 0x46e68d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x46e994
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6d0], esp
push 0x26
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push str.625922BE_A44B_40a8_B944_805C674807A5
mov dword [ebp - 0x6d4], 1
mov word [ecx + 4], bx
call fcn.00412d30
call fcn.00466fa0
add esp, 0x1c
cmp dword [0x4d1f64], ebx
mov edi, eax
jne 0x46e70c
push 4
push 0x4b6750
lea ecx, [ebp - 0x6f4]
mov dword [ebp - 0x6dc], 0xf
mov dword [ebp - 0x6e0], ebx
mov byte [ebp - 0x6f0], bl
call fcn.0040bd70
lea eax, [ebp - 0x6f4]
mov byte [ebp - 4], 8
mov dword [ebp - 0x6d8], 1
jmp 0x46e711
mov eax, 0x4d1f50
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
call fcn.0040bc90
test byte [ebp - 0x6d8], 1
mov dword [ebp - 4], 0xa
je 0x46e768
cmp dword [ebp - 0x6dc], 0x10
jb 0x46e752
mov edx, dword [ebp - 0x6f0]
push edx
call fcn.004803bd
add esp, 4
mov dword [ebp - 0x6dc], 0xf
mov dword [ebp - 0x6e0], ebx
mov byte [ebp - 0x6f0], bl
cmp esi, ebx
je 0x46e773
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46e803
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
mov esi, eax
call fcn.00461120
add esp, 4
test al, al
je 0x46e8ac
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
push esi
push eax
mov dword [ebp - 0x6d4], eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 0x6d4]
push ebx
push esi
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x46e920
push str.tyframe.exe
lea ebx, [ebp - 0x73c]
call fcn.004698d0
mov eax, dword [ebp - 0x738]
add esp, 4
test eax, eax
je 0x46e8aa
mov ecx, dword [ebp - 0x734]
sub ecx, eax
sar ecx, 2
je 0x46e894
cmp dword [ebp - 0x30], 0x10
jb 0x46e842
mov edi, dword [ebp - 0x44]
test edi, edi
jne 0x46e845
xor eax, eax
jmp 0x46e874
lea edi, [ebp - 0x44]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
add esi, 1
cmp esi, 0x3fffffff
jle 0x46e85d
xor eax, eax
jmp 0x46e874
lea eax, [esi + esi]
call fcn.00480be0
mov eax, esp
push 0x3a8
push esi
push edi
push eax
call fcn.004010f0
push 0
push eax
push 0x4b9100
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x6d4], 0
test eax, eax
je 0x46e8a1
push eax
call fcn.004803bd
add esp, 4
cmp dword [ebp - 0x6d4], 0
je 0x46e91e
xor ebx, ebx
cmp dword [ebp - 0x30], 0x10
jb 0x46e8cc
mov edi, dword [ebp - 0x44]
cmp edi, ebx
jne 0x46e8cf
push 0x30
xor eax, eax
push eax
push 0x4b90d8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x46e920
lea edi, [ebp - 0x44]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
add esi, 1
cmp esi, 0x3fffffff
jle 0x46e8f6
push 0x30
xor eax, eax
push eax
push 0x4b90d8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x46e920
lea eax, [esi + esi]
call fcn.00480be0
mov eax, esp
push 0x3a8
push esi
push edi
push eax
call fcn.004010f0
push 0x30
push eax
push 0x4b90d8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x46e920
xor ebx, ebx
mov esi, 0x10
cmp dword [ebp - 0x30], esi
jb 0x46e936
mov edx, dword [ebp - 0x44]
push edx
call fcn.004803bd
add esp, 4
cmp dword [ebp - 0x14], esi
mov edi, 0xf
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
jb 0x46e955
mov eax, dword [ebp - 0x28]
push eax
call fcn.004803bd
add esp, 4
cmp dword [ebp - 0x4c], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
jb 0x46e96f
mov ecx, dword [ebp - 0x60]
push ecx
call fcn.004803bd
add esp, 4
cmp dword [ebp - 0x68], esi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x60], bl
jb 0x46e637
mov edx, dword [ebp - 0x7c]
push edx
call fcn.004803bd
add esp, 4
xor eax, eax
jmp 0x46edff
mov dword [0x4d23d8], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00482119
add esp, 4
mov dword [ebp - method.WTL::CMessageLoop.virtual_0], vtable.WTL::CMessageLoop.0
mov dword [ebp - 0x728], ebx
mov dword [ebp - 0x724], ebx
mov dword [ebp - 0x720], ebx
mov dword [ebp - 0x71c], ebx
mov dword [ebp - 0x718], ebx
mov dword [ebp - 0x714], ebx
mov edi, dword [0x4d1dd0]
lea eax, [ebp - 0x72c]
add edi, 0x10
push edi
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x6d4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [ebp - 0x6d4]
push ecx
mov ecx, dword [0x4d24ec]
lea edx, [ebp - 0x6d0]
push edx
mov dword [ebp - 0x6d0], eax
call fcn.004642d0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x1774
push str.CA3B26E9_D363_474E_AC76_73DCBAC3C388
lea ecx, [ebp - 0x758]
call fcn.00479100
push 0x100000
push str.XUNYOU_241C82F9_A704_4AF4_A143_CDC246545889
lea ecx, [ebp - 0x768]
mov byte [ebp - 4], 0xc
call fcn.00479100
mov byte [ebp - 4], 0xd
call fcn.0046db20
call fcn.0046d960
cmp dword [ebp - 0x6c], ebx
je 0x46ea74
lea eax, [ebp - 0x80]
push eax
call fcn.0040b870
mov ecx, eax
call fcn.00469060
call fcn.0040b870
cmp dword [eax + 0x1c], ebx
je 0x46eabe
cmp dword [eax + 0x38], ebx
je 0x46eabe
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6d0], esp
push ecx
call fcn.0040b870
mov ecx, eax
call fcn.004670a0
sub esp, 0x1c
mov edx, esp
mov dword [ebp - 0x6d4], esp
push edx
mov byte [ebp - 4], 0xe
call fcn.0040b870
mov ecx, eax
call fcn.00467070
mov byte [ebp - 4], 0xd
jmp 0x46eaed
push 1
sub esp, 0x1c
mov eax, esp
mov dword [eax + 0x14], ebx
mov ecx, 0xf
mov dword [eax + 0x18], ecx
mov dword [ebp - 0x6d0], esp
mov byte [eax + 4], bl
sub esp, 0x1c
mov eax, esp
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ebx
mov dword [ebp - 0x6d0], esp
mov byte [eax + 4], bl
call fcn.004679c0
mov eax, dword [0x4d1ec8]
mov edi, 0x10
add esp, 0x3c
cmp dword [0x4d1edc], edi
jae 0x46eb0c
mov eax, 0x4d1ec8
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.B029
push eax
call esi
test eax, eax
je 0x46eb5a
lea eax, [ebp - 0x6f4]
push eax
call fcn.0040b870
mov ecx, eax
call fcn.004670d0
cmp dword [eax + 0x18], edi
mov dword [ebp - 0x6d8], 2
jb 0x46eb45
mov eax, dword [eax + 4]
jmp 0x46eb48
add eax, 4
push str.B029
push eax
call esi
test eax, eax
mov byte [ebp - 0x6c9], bl
jne 0x46eb61
mov byte [ebp - 0x6c9], 1
test byte [ebp - 0x6d8], 2
je 0x46eb81
cmp dword [ebp - 0x6dc], edi
jb 0x46eb81
mov ecx, dword [ebp - 0x6f0]
push ecx
call fcn.004803bd
add esp, 4
cmp byte [ebp - 0x6c9], bl
je 0x46eb8e
call fcn.0046d7a0
lea ecx, [ebp - 0x6c8]
call fcn.0046a0d0
lea edx, [ebp - 0x6c8]
push edx
lea eax, [ebp - 0x6c0]
push eax
push 0x4d2574
mov byte [ebp - 4], 0xf
call fcn.004086c0
mov ecx, dword [0x4d2540]
push ebx
push 0x40b310
push ebx
push 0x81
push ecx
call fcn.004697b0
add esp, 0x14
cmp eax, ebx
jne 0x46eca4
lea ecx, [ebp - 0x6c8]
mov byte [ebp - 4], 0xd
call fcn.00469ea0
lea ecx, [ebp - 0x768]
mov byte [ebp - 4], 0xc
call fcn.004788a0
lea ecx, [ebp - 0x758]
mov byte [ebp - 4], 0xb
call fcn.00462310
mov eax, dword [ebp - 0x71c]
cmp eax, ebx
je 0x46ec1e
push eax
call fcn.0048047c
add esp, 4
mov dword [ebp - 0x71c], ebx
mov eax, dword [ebp - 0x728]
cmp eax, ebx
mov dword [ebp - 0x718], ebx
mov dword [ebp - 0x714], ebx
je 0x46ec43
push eax
call fcn.0048047c
add esp, 4
mov dword [ebp - 0x728], ebx
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x724], ebx
mov dword [ebp - 0x720], ebx
jb 0x46ec60
mov edx, dword [ebp - 0x28]
push edx
call fcn.004803bd
add esp, 4
cmp dword [ebp - 0x4c], edi
mov esi, 0xf
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
jb 0x46ec7f
mov eax, dword [ebp - 0x60]
push eax
call fcn.004803bd
add esp, 4
cmp dword [ebp - 0x68], edi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x60], bl
jb 0x46e637
mov ecx, dword [ebp - 0x7c]
push ecx
call fcn.004803bd
add esp, 4
xor eax, eax
jmp 0x46edff
lea edx, [ebp - 0x6f4]
push edx
call fcn.00467990
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x6d0], esp
push str.misc.dll
push eax
push ecx
mov byte [ebp - 4], 0x10
call fcn.00415930
add esp, 0xc
mov ecx, 0x4d24b4
call fcn.00465d40
cmp dword [ebp - 0x6dc], edi
mov byte [ebp - 4], 0xf
jb 0x46ecf3
mov edx, dword [ebp - 0x6f0]
push edx
call fcn.004803bd
add esp, 4
call fcn.0040b870
cmp dword [0x4d21fc], ebx
mov eax, dword [eax + 0x40]
je 0x46ed08
mov eax, dword [0x4d21e4]
push eax
mov eax, dword [ebp - 0x6c4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040b870
mov ecx, eax
call fcn.004613e0
lea ecx, [ebp - 0x72c]
call fcn.00462190
mov ecx, 0x4d24b8
mov esi, eax
call fcn.00465a50
lea ecx, [ebp - 0x6c8]
mov byte [ebp - 4], 0xd
call fcn.00469ea0
lea ecx, [ebp - 0x768]
mov byte [ebp - 4], 0xc
call fcn.004788a0
lea ecx, [ebp - 0x758]
mov byte [ebp - 4], 0xb
call fcn.00462310
mov eax, dword [ebp - 0x71c]
cmp eax, ebx
je 0x46ed7f
push eax
call fcn.0048047c
add esp, 4
mov dword [ebp - 0x71c], ebx
mov eax, dword [ebp - 0x728]
cmp eax, ebx
mov dword [ebp - 0x718], ebx
mov dword [ebp - 0x714], ebx
je 0x46eda4
push eax
call fcn.0048047c
add esp, 4
mov dword [ebp - 0x728], ebx
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x724], ebx
mov dword [ebp - 0x720], ebx
jb 0x46edc1
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004803bd
add esp, 4
cmp dword [ebp - 0x4c], edi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
jb 0x46eddf
mov edx, dword [ebp - 0x60]
push edx
call fcn.004803bd
add esp, 4
cmp dword [ebp - 0x68], edi
mov dword [ebp - 0x4c], 0xf
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x60], bl
jb 0x46edfd
mov eax, dword [ebp - 0x7c]
push eax
call fcn.004803bd
add esp, 4
mov eax, esi
lea esp, [ebp - 0x778]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00480bcf
mov esp, ebp
pop ebp
ret