Function at 0x41cc20
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469287
mov eax, dword fs:[0]
push eax
mov eax, 0x63b0
call fcn.00444240
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x63b0], ebx
mov eax, dword [ebp + 0x18]
mov esi, dword [ebx + 0x7c]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x63a4], eax
mov eax, dword [ebx + 0x78]
cmp eax, esi
mov dword [ebp - 0x63b8], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x63a8], ecx
mov dword [ebp - 0x63b4], edi
mov dword [ebp - 0x63ac], edx
mov dword [ebp - 0x63bc], eax
je 0x41ccd9
push dword [ebp - 0x63a4]
mov ecx, dword [eax]
push edx
push edi
push esi
mov eax, dword [ecx]
push dword [ebp - 0x63a8]
mov eax, dword [eax]
call eax
test al, al
jne 0x41d505
mov eax, dword [ebp - 0x63bc]
mov edx, dword [ebp - 0x63ac]
add eax, 4
mov dword [ebp - 0x63bc], eax
cmp eax, dword [ebp - 0x63b8]
jne 0x41cc97
mov ecx, dword [ebp - 0x63a8]
cmp esi, 0x502
ja 0x41d516
je 0x41d50c
cmp esi, 0xff
ja 0x41cedb
je 0x41cea7
add esi, 0xfffffffe
cmp esi, 0x80
ja case.0x41d537.1285
movzx eax, byte [esi + 0x41def0]
jmp dword [eax*4 + 0x41ded4]
test edx, edx
je case.0x41d537.1285
mov ecx, ebx
call fcn.0041ff10
mov al, 1
jmp 0x41d038
push 0x7f
lea eax, [ebp - 0x90]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
cmp eax, 0x80
jae 0x41deca
mov byte [ebp + eax - 0x90], 0
lea eax, [ebp - 0x90]
push 0x4725ac
push eax
call fcn.00452978
add esp, 8
test eax, eax
je 0x41cd9f
lea eax, [ebp - 0x90]
push 0x4725c4
push eax
call fcn.00452978
add esp, 8
test eax, eax
je 0x41cd9f
lea eax, [ebp - 0x90]
push 0x4725e4
push eax
call fcn.00452978
add esp, 8
test eax, eax
jne case.0x41d537.1285
push dword [ebp - 0x63a8]
mov ecx, 0x50fb50
call fcn.00416400
dec dword [0x53b370]
mov ecx, ebx
cmp dword [0x50ff50], 0
setne al
movzx eax, al
push eax
call fcn.0041bfd0
cmp dword [0x53b370], 0
jne 0x41d505
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov al, 1
jmp 0x41d038
lea eax, [ebp - 0x50]
push eax
push ecx
call dword [sym.imp.USER32.dll_BeginPaint]
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x63a8]
call dword [sym.imp.USER32.dll_EndPaint]
mov al, 1
jmp 0x41d038
cmp dword [0x50ff50], 0
mov ecx, ebx
setne al
movzx eax, al
push eax
call fcn.0041bfd0
push 0
push 0xffffffffffffffeb
push dword [ebp - 0x63a8]
call dword [sym.imp.USER32.dll_SetWindowLongA]
test ebx, ebx
je 0x41ce46
mov ecx, ebx
call fcn.0041a590
push 0x100
push ebx
call fcn.00443fd6
add esp, 8
mov ecx, dword [0x5a4fa4]
mov eax, dword fs:[0x2c]
mov eax, dword [eax + ecx*4]
add dword [eax + 4], 0xffffffff
jne case.0x41d537.1285
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp case.0x41d537.1285
push 3
push str.__restore
call dword [sym.imp.KERNEL32.DLL_RegisterApplicationRestart]
mov eax, dword [ebp - 0x63a4]
mov dword [eax], 1
mov al, 1
jmp 0x41d038
cmp edi, 1
jne case.0x41d537.1285
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov al, 1
jmp 0x41d038
cmp dword [0x50ffd4], 0
je case.0x41d537.1285
cmp dword [0x51b614], 0
jne case.0x41d537.1285
cmp dword [0x51b618], 0
jne case.0x41d537.1285
push edx
mov ecx, ebx
call fcn.0041c0f0
jmp case.0x41d537.1285
cmp esi, 0x111
ja 0x41d378
je 0x41d108
sub esi, 0x100
je 0x41d0c1
sub esi, 1
je 0x41d0a4
sub esi, 3
jne case.0x41d537.1285
add edi, 0xffffffaf
cmp edi, 0x29
ja case.0x41d537.1285
movzx eax, byte [edi + 0x41df90]
jmp dword [eax*4 + 0x41df74]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call esi
test ax, ax
jns case.0x41d537.1285
push 0x12
call esi
test ax, ax
jns case.0x41d537.1285
push 0x11
call esi
test ax, ax
jns case.0x41d537.1285
push 0x470cc8
push dword [0x502db0]
call fcn.004403a0
add esp, 8
jmp 0x41de1a
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns case.0x41d537.1285
mov al, 1
jmp 0x41d038
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call esi
test ax, ax
jns case.0x41d537.1285
push 0x12
call esi
test ax, ax
jns case.0x41d537.1285
push 0x11
call esi
test ax, ax
jns case.0x41d537.1285
push 0x1000
push 0x470ce0
push 0x470cfc
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp case.0x41d537.1285
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
mov dword [0x51b798], 0xa
call esi
test ax, ax
jns case.0x41d537.1285
push 0x11
call esi
test ax, ax
jns case.0x41d537.1285
push str.Shutdown__Main_:_Hotkey_Ctrl__Shift__q
push dword [0x502db0]
call fcn.004403a0
add esp, 8
jmp 0x41de1a
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call esi
test ax, ax
jns case.0x41d537.1285
push 0x12
call esi
test ax, ax
js case.0x41d537.1285
push 0x11
call esi
test ax, ax
jns case.0x41d537.1285
push 0x470d54
push dword [0x502db0]
call fcn.004403a0
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00443fa5
mov esp, ebp
pop ebp
ret 0x14
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call esi
test ax, ax
jns case.0x41d537.1285
push 0x12
call esi
test ax, ax
js case.0x41d537.1285
push 0x11
call esi
test ax, ax
jns case.0x41d537.1285
push 0x470d6c
push dword [0x502db0]
call fcn.004403a0
add esp, 8
push 1
push dword [ebp - 0x63a8]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [0x53d970], 0
jmp case.0x41d537.1285
test edx, 0x40000000
jne case.0x41d537.1285
push edi
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.0041c460
mov dword [ebp - 4], 1
jmp 0x41d0e0
test edx, 0x40000000
jne case.0x41d537.1285
push edi
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.0041c460
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x41d0fb
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [ebp - 0x38]
call fcn.004080c0
mov al, 1
jmp 0x41d038
lea ecx, [ebp - 0x38]
call fcn.004080c0
jmp case.0x41d537.1285
cmp dword [ebx + 0x50], 0
jne 0x41d130
movzx ecx, di
movzx eax, cx
add eax, 0xfffffbb0
cmp eax, 0x43
ja case.0x41d537.1285
movzx eax, byte [eax + 0x41dfdc]
jmp dword [eax*4 + 0x41dfbc]
movzx eax, di
mov edx, eax
add eax, 0xfffffba4
mov ecx, edx
cmp eax, 0x3b
ja case.0x41d148.1117
movzx eax, byte [eax + 0x41e034]
jmp dword [eax*4 + 0x41e020]
mov ecx, dword [ebx + 0x48]
lea edx, [ebp - 0x63a4]
mov dword [ebp - 0x63a4], 0
push edx
push ecx
mov eax, dword [ecx]
mov dword [ebp - 4], 2
call dword [eax + 0x14]
push str.Browser_version_after_webview_created
push dword [0x502db0]
call fcn.004403a0
mov eax, dword [ebp - 0x63a4]
add esp, 8
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x41dec3
push eax
mov dword [ebp - 4], 4
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
jmp 0x41d038
push str.IDM_CLOSE_WEBVIEW
push dword [0x502db0]
call fcn.004403a0
add esp, 8
mov ecx, ebx
push 0
call fcn.0041bfd0
mov al, 1
jmp 0x41d038
push str.IDM_CLOSE_WEBVIEW_CLEANUP
push dword [0x502db0]
call fcn.004403a0
add esp, 8
mov ecx, ebx
push 1
call fcn.0041bfd0
mov al, 1
jmp 0x41d038
push str.IDM_SCENARIO_POST_WEB_MESSAGE
push dword [0x502db0]
call fcn.004403a0
push 0x38
call fcn.0044426b
add esp, 0xc
mov dword [ebp - 0x63b4], eax
mov dword [ebp - 4], 5
test eax, eax
je 0x41d22a
push ebx
mov ecx, eax
call fcn.0042ed80
mov ecx, eax
jmp 0x41d22c
xor ecx, ecx
mov edx, dword [ebx + 0x7c]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x63b8], ecx
cmp edx, dword [ebx + 0x80]
je 0x41d251
mov dword [edx], ecx
mov al, 1
add dword [ebx + 0x7c], 4
jmp 0x41d038
lea ecx, [ebp - 0x63b8]
push ecx
push edx
lea ecx, [ebx + 0x78]
call fcn.00419e40
mov al, 1
jmp 0x41d038
push 0
push 0x41bf30
push dword [ebx]
push 0x44f
push dword [0x502da8]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov al, 1
jmp 0x41d038
lea eax, [ebp - 0x63a4]
mov dword [ebp - 0x63a4], 0
push eax
push 0
call fcn.004015e0
mov eax, dword [ebp - 0x63a4]
test eax, eax
je 0x41dec3
push eax
mov dword [ebp - 4], 7
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
jmp 0x41d038
cmp dword [0x50ff50], 0
mov ecx, ebx
setne al
movzx eax, al
push eax
call fcn.0041bfd0
push dword [ebx]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov al, 1
jmp 0x41d038
push 0
mov ecx, ebx
call fcn.0041e0f0
mov al, 1
jmp 0x41d038
cmp byte [ebx + 0xd8], 0
sete al
mov byte [ebx + 0xd8], al
mov al, 1
jmp 0x41d038
push 0x100
call fcn.0044426b
mov esi, eax
add esp, 4
mov dword [ebp - 0x63b4], esi
mov dword [ebp - 4], 8
test esi, esi
je 0x41dec3
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x63b8], esp
mov dword [ecx + 0x24], 0
push 0
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
push 0x46c9dc
call fcn.00407f70
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.0041a0b0
mov al, 1
jmp 0x41d038
call fcn.00408210
mov al, 1
jmp 0x41d038
cmp esi, 0x112
je 0x41d4ed
cmp esi, 0x2b1
jne case.0x41d537.1285
dec edi
xor esi, esi
cmp edi, 7
ja case.0x41d39c.5
jmp dword [edi*4 + 0x41e070]
push 0x471004
push dword [0x502db0]
call fcn.004403a0
add esp, 8
cmp dword [0x49638c], esi
jne case.0x41d39c.5
push 0
push 0
push 2
push 4
push 0x46da14
mov ecx, 0x50fb50
call fcn.004153d0
jmp case.0x41d39c.5
push 0x471020
jmp 0x41d41b
push 0x47103c
push dword [0x502db0]
call fcn.004403a0
mov esi, 1
jmp 0x41d426
push 0x47105c
jmp 0x41d41b
push 0x471078
push dword [0x502db0]
call fcn.004403a0
add esp, 8
mov edi, 1
jmp 0x41d42b
push 0x471094
push dword [0x502db0]
call fcn.004403a0
add esp, 8
xor edi, edi
cmp dword [0x53f3fc], 0
je case.0x41d537.1285
test esi, esi
je 0x41d490
mov eax, dword [ebx + 0x50]
push 0x4710b4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push 0
push 0
push 2
push 7
push 0x4710cc
mov ecx, 0x50fb50
mov dword [0x53c604], 1
call fcn.004153d0
push 0x471100
push 0x471180
mov ecx, 0x50fb50
call fcn.00418dd0
mov ecx, ebx
call fcn.0041bfb0
mov ecx, 0x50fb50
call fcn.00411920
cmp dword [0x50ffdc], 0
jne case.0x41d537.1285
test edi, edi
je case.0x41d537.1285
mov eax, dword [ebx + 0x50]
push 0x4710b4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push 0
push 0
push 2
push 3
push 0x46d3d4
mov ecx, 0x50fb50
mov dword [0x53c604], 1
call fcn.004153d0
push 0x471198
push 0x4711c8
mov ecx, 0x50fb50
call fcn.00418dd0
jmp 0x41de1a
cmp edi, 0xf060
jne case.0x41d537.1285
cmp ecx, dword [0x5194e0]
jne case.0x41d537.1285
mov al, 1
jmp 0x41d038
call fcn.00408de0
jmp case.0x41d537.1285
cmp esi, 0x8000
ja case.0x41d537.1285
je 0x41de90
add esi, 0xfffffafd
cmp esi, 0x16
ja case.0x41d537.1285
jmp dword [esi*4 + 0x41e090]
push 0x800
push 0x40
mov dword [0x53d974], edx
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
push 0x104
mov esi, eax
push esi
push dword [ebp - 0x63ac]
push dword [0x502db0]
call fcn.0043fcf0
add esp, 0x10
test eax, eax
jne 0x41d574
mov word [esi], ax
push 0
push 3
push 2
push 5
push esi
mov ecx, 0x50fb50
call fcn.004153d0
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
jmp case.0x41d537.1285
push 0x802
push 0x40
mov dword [0x53d974], edx
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
push 0x104
mov esi, eax
push esi
push dword [ebp - 0x63ac]
push dword [0x502db0]
call fcn.0043fcf0
add esp, 0x10
test eax, eax
jne 0x41d5c9
mov word [esi], ax
push 0
push 2
jmp 0x41d578
push 0x470d84
push dword [0x502db0]
mov dword [0x51b798], 0xa
mov dword [0x503fb0], 1
call fcn.004403a0
add esp, 8
jmp 0x41de1a
push 0x470da0
jmp 0x41d028
push edi
lea eax, [ebp - 0x194]
push 0x104
push eax
call fcn.00449d78
add esp, 0xc
push dword [ebp - 0x63ac]
lea eax, [ebp - 0x194]
mov ecx, ebx
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0041ef90
lea ecx, [ebp - 0x38]
call fcn.004080c0
jmp case.0x41d537.1285
push 0x800
push 1
call fcn.00449ef9
push edi
mov esi, eax
push 0x800
push esi
call fcn.00449d78
add esp, 0x14
mov ecx, ebx
push dword [ebp - 0x63ac]
push esi
call fcn.0041ee40
jmp case.0x41d537.1285
push 0x800
push 1
call fcn.00449ef9
push 0x800
push 1
mov edi, eax
call fcn.00449ef9
push dword [ebp - 0x63b4]
mov esi, eax
push 0x800
push edi
call fcn.00449d78
push dword [ebp - 0x63ac]
push 0x800
push esi
call fcn.00449d78
push 0x53e3f0
push esi
push edi
call fcn.00408e60
add esp, 0x34
jmp case.0x41d537.1285
cmp dword [0x53daf0], 0
jne 0x41d7c2
push 0x800
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
push 0
push 0
push 0x104
mov esi, eax
push esi
push 0xffffffffffffffff
push dword [0x51ac38]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push 0x64
push 0x512f98
mov ecx, 0x4d0d7c
call fcn.00407790
push eax
push 0x64
push 0x514780
call fcn.00449eee
add esp, 0x10
mov ecx, 0x4d0d7c
push 0x1000
push 0x470ce0
push esi
push 0x470db8
push 0x46f938
push 0x5130c4
call fcn.004078d0
push eax
push 0x470dc8
push 0x46f938
push 0x514780
push 0x470dd4
push 0x46f938
push 0x512ffc
mov ecx, 0x4d0d7c
call fcn.00407750
push eax
push 0x470de4
push 0x46f938
mov ecx, 0x4d0d7c
call fcn.00407870
push eax
push 0x470df4
push 0x46f938
mov ecx, 0x50fb50
call fcn.004144e0
push eax
push 0x470e08
push 0x46f938
push 0x502e38
push 0x470e18
push 0x14
push ebx
call fcn.00420d50
add esp, 0x58
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp case.0x41d537.1285
mov dword [0x53daf0], 0
jmp case.0x41d537.1285
cmp dword [0x50ffb8], 0
mov ecx, dword [ebx + 0xf4]
mov eax, dword [ecx]
je 0x41d810
push 1
push ecx
call dword [eax + 0x30]
mov eax, dword [ebx + 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xcc]
push 1
push dword [0x502db0]
call fcn.0043fb60
mov dword [0x53c62c], 1
jmp 0x41d033
push 0
push ecx
call dword [eax + 0x30]
jmp case.0x41d537.1285
push str.WM_GO_TO_DEFAULT_URL_call_initiated
push dword [0x502db0]
call fcn.004403a0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], vtable.std::_Func_impl_no_alloc_class__lambda_ece3fe955f81dbb901b556f815fa98bf___void___.0
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x14], eax
push 0x28
mov dword [ebp - 4], 0xa
call fcn.0044426b
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x63b4], esi
mov byte [ebp - 4], 0xb
test esi, esi
je 0x41d878
mov dword [esi + 0x24], 0
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xc
test ecx, ecx
je 0x41d87a
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
jmp 0x41d87a
xor esi, esi
push 0
push esi
push 0x8000
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je case.0x41d537.1285
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp case.0x41d537.1285
mov ebx, dword [ebx + 0x50]
push 0
push 0
push 0xffffffffffffffff
push 0x512a94
push 0
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov edi, eax
lea ecx, [edi - 1]
push ecx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
je 0x41d8f7
push edi
push esi
push 0xffffffffffffffff
push 0x512a94
push 0
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
cmp eax, edi
je 0x41d8f7
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x14]
push str.WM_GO_TO_ALTERNATE_URL_completed
jmp 0x41d028
mov ebx, dword [ebx + 0x50]
push 0
push 0
push 0xffffffffffffffff
push 0x514848
push 0
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov edi, eax
lea ecx, [edi - 1]
push ecx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
je 0x41d954
push edi
push esi
push 0xffffffffffffffff
push 0x514848
push 0
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
cmp eax, edi
je 0x41d954
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x14]
push str.WM_GO_TO_DYNAMIC_ALTERNATE_URL_completed
jmp 0x41d028
push edi
push 0x104
push 0x53d9e8
call fcn.00449d78
mov ebx, dword [ebx + 0x50]
add esp, 0xc
push 0
push 0
push 0xffffffffffffffff
push 0x53d9e8
push 0
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov edi, eax
lea ecx, [edi - 1]
push ecx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
je 0x41d9c4
push edi
push esi
push 0xffffffffffffffff
push 0x53d9e8
push 0
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
cmp eax, edi
je 0x41d9c4
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x14]
jmp case.0x41d537.1285
mov eax, dword [0x470ea8]
mov dword [ebp - 0x639c], eax
mov ax, word [0x470eac]
push 0x1ff8
mov word [ebp - 0x6398], ax
lea eax, [ebp - 0x6396]
push 0
push eax
call fcn.00446b20
add esp, 0xc
push 0x51a23c
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push edi
mov dword [ebp - 0x63b4], eax
lea eax, [ebp - 0x194]
push 0x104
push eax
call fcn.00449d78
add esp, 0xc
cmp dword [0x50ffbc], 0
je 0x41d61a
cmp dword [0x50ff58], 0
jne case.0x41d537.1285
mov ecx, 0x50fb50
call fcn.00411df0
mov esi, dword [ebx + 0x50]
push 0x46d174
mov edi, dword [esi]
call fcn.0041bed0
add esp, 4
push eax
push esi
call dword [edi + 0x14]
push dword [ebp - 0x63b4]
lea eax, [ebp - 0x194]
mov ecx, ebx
push 0x470390
push eax
push 0x47039c
push 0x470eb0
push 0x470f7c
call fcn.00420060
mov dword [0x4964e8], eax
cmp eax, 1
jne 0x41dbe1
push 0x51a23c
lea eax, [ebp - 0x439c]
push 0x1ffe
push eax
call fcn.00449d78
add esp, 0xc
lea eax, [ebp - 0x439c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x46c7d0
lea eax, [ebp - 0x439c]
push 0x104
push eax
call fcn.00449dd2
push 0x46cf80
lea eax, [ebp - 0x439c]
push 0x104
push eax
call fcn.00449dd2
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [ebp - 0x439c]
add esp, 0x18
push 1
push 0
push 0
push eax
push 0x46cd24
push 0
call esi
push str.Started_admin_launch
push dword [0x502db0]
call fcn.004403a0
push 0x503fc8
lea eax, [ebp - 0x239c]
push 0x1ffe
push eax
call fcn.00449d78
push 0x470fa4
lea eax, [ebp - 0x239c]
push 0x1ffe
push eax
call fcn.00449dd2
lea eax, [ebp - 0x639c]
push eax
lea eax, [ebp - 0x239c]
push 0x1ffe
push eax
call fcn.00449dd2
push str.___SBPathForadminLaunch_
lea eax, [ebp - 0x239c]
push 0x1ffe
push eax
call fcn.00449dd2
push 0x50a0d0
lea eax, [ebp - 0x239c]
push 0x1ffe
push eax
call fcn.00449dd2
add esp, 0x44
lea eax, [ebp - 0x239c]
push 0x46cfb8
push 0x1ffe
push eax
call fcn.00449dd2
lea eax, [ebp - 0x239c]
push eax
push str.admin_launch_cmd__s
push dword [0x502db0]
call fcn.004403a0
add esp, 0x18
mov dword [0x51b798], 2
lea eax, [ebp - 0x239c]
push 1
push 0
push eax
push 0x51a23c
push 0x46dc6c
push 0
call esi
jmp 0x41de1a
mov dword [0x51b798], 5
jmp 0x41de1a
push edx
push 0x470fe4
push dword [0x502db0]
mov dword [0x53d974], edx
call fcn.004403a0
add esp, 0xc
jmp case.0x41d537.1285
push str.Monitor_process
push dword [0x502db0]
call fcn.004403a0
add esp, 8
lea eax, [ebp - 0x39c]
push 0x104
push eax
push 0xffffffffffffffff
push dword [0x51b688]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov ecx, dword [0x51b644]
mov edx, 0x46c490
mov eax, ecx
mov bl, byte [eax]
mov byte [ebp - 0x639d], bl
cmp bl, byte [edx]
jne 0x41dc7c
test bl, bl
je 0x41dc78
mov bl, byte [eax + 1]
mov byte [ebp - 0x639d], bl
cmp bl, byte [edx + 1]
jne 0x41dc7c
add eax, 2
add edx, 2
test bl, bl
jne 0x41dc50
xor eax, eax
jmp 0x41dc81
sbb eax, eax
or eax, 1
test eax, eax
je 0x41dcb9
mov eax, 0x4711f0
nop word [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41dcb0
test dl, dl
je 0x41dcac
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41dcb0
add ecx, 2
add eax, 2
test dl, dl
jne 0x41dc90
xor eax, eax
jmp 0x41dcb5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41dcc3
mov dword [0x53c604], 1
push 0
push 0
push 2
push 8
lea eax, [ebp - 0x39c]
mov ecx, 0x50fb50
push eax
call fcn.004153d0
mov ecx, dword [0x51b644]
mov edx, 0x46c490
mov eax, ecx
nop dword [eax]
mov bl, byte [eax]
cmp bl, byte [edx]
mov byte [ebp - 0x639d], bl
mov ebx, dword [ebp - 0x63b0]
jne 0x41dd32
cmp byte [ebp - 0x639d], 0
je 0x41dd2e
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x639d], bl
mov ebx, dword [ebp - 0x63b0]
jne 0x41dd32
add eax, 2
add edx, 2
cmp byte [ebp - 0x639d], 0
jne 0x41dcf0
xor eax, eax
jmp 0x41dd37
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41dd78
push 0x4711f4
push dword [0x502db0]
call fcn.004403a0
add esp, 8
mov dword [0x51b798], 0x11
mov ecx, ebx
mov dword [0x503fb0], 1
call fcn.0041bfb0
mov ecx, 0x50fb50
call fcn.00411920
jmp case.0x41d537.1285
mov edx, 0x4711f0
mov eax, ecx
nop
mov bl, byte [eax]
cmp bl, byte [edx]
mov byte [ebp - 0x639d], bl
mov ebx, dword [ebp - 0x63b0]
jne 0x41ddc2
cmp byte [ebp - 0x639d], 0
je 0x41ddbe
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x639d], bl
mov ebx, dword [ebp - 0x63b0]
jne 0x41ddc2
add eax, 2
add edx, 2
cmp byte [ebp - 0x639d], 0
jne 0x41dd80
xor eax, eax
jmp 0x41ddc7
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41de30
push 0x471208
push dword [0x502db0]
call fcn.004403a0
mov esi, dword [ebx + 0x50]
push 0x46d174
mov edi, dword [esi]
call fcn.0041bed0
add esp, 0xc
push eax
push esi
call dword [edi + 0x14]
push 0x471220
push 0x471284
mov ecx, 0x50fb50
call fcn.00418dd0
mov dword [0x51b798], 0x11
mov dword [0x503fb0], 1
mov ecx, ebx
call fcn.0041bfb0
mov ecx, 0x50fb50
call fcn.00411920
jmp case.0x41d537.1285
mov eax, 0x4712a0
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41de55
test dl, dl
je 0x41de51
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41de55
add ecx, 2
add eax, 2
test dl, dl
jne 0x41de35
xor eax, eax
jmp 0x41de5a
sbb eax, eax
or eax, 1
test eax, eax
jne case.0x41d537.1285
mov eax, dword [0x51b640]
push 0
push 0
push 0
mov ecx, dword [eax]
push 0x51b630
push 1
push 0x400
push 0x470cb8
push 0
push eax
call dword [ecx + 0x18]
push 0x4712a4
jmp 0x41d028
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x41decf
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x41deb8
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
push 0x28
push edi
call fcn.00443fd6
add esp, 8
mov al, 1
jmp 0x41d038
call fcn.004443c2
call fcn.004451d0
xor ch, cl
inc ecx
add byte [edx], bl
int 0x41
add dh, ah
int 0x41
add byte [edi - 0x32], ch
inc ecx
add byte [edi + 0x80041ce], cl
into
inc ecx
add byte [esi], dh
rol byte [ecx], 1
add byte [esi], al
push es
add dword [esi], eax
push es
push es
push es
push es
push es
push es
push es
push es
add al, byte [esi]
add eax, dword [esi]
push es
push es
push es
add al, 6
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add eax, -939516145
iretd