Function at 0x4b632c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x4b6334
push ebx
push esi
push edi
mov esi, dword [0x4c314c]
xor eax, eax
push ebp
push 0x4b6e98
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4b6eb0
call fcn.004b0280
mov eax, dword [0x4c32ac]
mov eax, dword [eax]
call fcn.00479544
push 1
push 0
lea eax, [ebp - 0x1c]
call fcn.004a5c14
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x4a7cd0]
call fcn.004a7dd4
mov eax, dword [0x4c306c]
cmp byte [eax], 0
jne 0x4b63db
mov eax, dword [0x4c30c0]
cmp byte [eax], 0
jne 0x4b63db
mov eax, dword [esi]
mov eax, dword [eax + 0x350]
cmp byte [eax + 0x57], 0
je 0x4b63b9
mov eax, dword [esi]
mov eax, dword [eax + 0x354]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x4b63df
mov eax, dword [esi]
mov eax, dword [eax + 0x348]
cmp byte [eax + 0x57], 0
je 0x4b63db
mov eax, dword [esi]
mov eax, dword [eax + 0x34c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x4b63df
xor eax, eax
jmp 0x4b63e1
mov al, 1
mov edx, dword [0x4c33a4]
mov byte [edx], al
mov eax, dword [0x4c33a4]
cmp byte [eax], 0
je 0x4b63fb
mov eax, dword [0x4c2f1c]
mov byte [eax], 1
xor eax, eax
push ebp
push 0x4b6df1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0x4b6ed0
call fcn.004b0280
lea eax, [ebp - 0xc]
push eax
push 2
mov eax, dword [0x4c3450]
mov eax, dword [eax]
call eax
mov eax, 0x4b6efc
call fcn.004b0280
push 0x4b6f14
push 0x7fff
push 0x4b4868
mov eax, dword [0x4c31bc]
mov eax, dword [eax]
call eax
call fcn.004b5d00
call fcn.004b3688
test al, al
jne 0x4b6464
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6e21
call fcn.004b3ce8
test al, al
jne 0x4b647a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6e21
mov eax, 0x4b6f34
call fcn.004b0280
push 0x4b6f78
mov eax, dword [0x4c3234]
push dword [eax]
push 0x4b6f98
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405790
mov eax, dword [0x4c2f1c]
cmp byte [eax], 0
jne 0x4b64ce
mov eax, dword [esi]
mov eax, dword [eax + 0x368]
cmp byte [eax + 0x57], 0
je 0x4b64ce
mov eax, dword [esi]
mov eax, dword [eax + 0x36c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x4b64d8
mov eax, dword [0x4c3208]
cmp byte [eax], 0
je 0x4b64e5
lea eax, [ebp - 4]
mov edx, 0x4b6fa0
call fcn.004056c8
mov eax, dword [0x4c34a0]
cmp byte [eax], 1
je 0x4b64fd
mov eax, dword [0x4c34a0]
cmp byte [eax], 2
jne 0x4b6594
push dword [ebp - 4]
push 0x4b6fc8
mov eax, dword [0x4c31c0]
push dword [eax]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405790
mov eax, dword [0x4c308c]
cmp byte [eax], 0
je 0x4b653f
push dword [ebp - 4]
push 0x4b702c
mov eax, dword [0x4c327c]
push dword [eax]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405790
mov eax, dword [0x4c306c]
cmp byte [eax], 0
je 0x4b6565
push dword [ebp - 4]
push 0x4b702c
mov eax, dword [0x4c3244]
push dword [eax]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405790
mov eax, dword [0x4c30c0]
cmp byte [eax], 0
je 0x4b690f
push dword [ebp - 4]
push 0x4b702c
mov eax, dword [0x4c32a4]
push dword [eax]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405790
jmp 0x4b690f
mov eax, dword [0x4c2fcc]
cmp byte [eax], 0
je 0x4b65ab
lea eax, [ebp - 4]
mov edx, 0x4b7034
call fcn.004056c8
call fcn.004b12b8
test al, al
jne 0x4b65ff
call fcn.004b12c4
test al, al
jne 0x4b65ff
push dword [ebp - 4]
push 0x4b7064
mov eax, dword [0x4c3234]
push dword [eax]
push 0x4b70d8
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405790
push dword [ebp - 4]
push 0x4b70f0
mov eax, dword [0x4c3234]
push dword [eax]
push 0x4b7120
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405790
lea eax, [ebp - 0x10]
call fcn.00405474
lea eax, [ebp - 0x14]
call fcn.00405474
lea eax, [ebp - 0x18]
call fcn.00405474
mov eax, dword [0x4c2fcc]
cmp byte [eax], 0
je 0x4b6809
mov ecx, dword [0x4c31c0]
mov ecx, dword [ecx]
lea eax, [ebp - 0x14]
mov edx, 0x4b713c
call fcn.00405728
mov eax, dword [0x4c2f28]
cmp byte [eax], 0
jne 0x4b66c8
mov eax, dword [esi]
mov eax, dword [eax + 0x358]
cmp byte [eax + 0x57], 0
je 0x4b66c8
mov eax, dword [esi]
mov eax, dword [eax + 0x35c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4b66a9
mov eax, dword [0x4c308c]
cmp byte [eax], 0
je 0x4b6692
push dword [ebp - 0x14]
push 0x4b702c
mov eax, dword [0x4c327c]
push dword [eax]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405790
jmp 0x4b66c8
mov ecx, dword [0x4c327c]
mov ecx, dword [ecx]
lea eax, [ebp - 0x10]
mov edx, 0x4b7158
call fcn.00405728
jmp 0x4b66c8
mov eax, dword [0x4c308c]
cmp byte [eax], 0
je 0x4b66c8
mov ecx, dword [0x4c327c]
mov ecx, dword [ecx]
lea eax, [ebp - 0x18]
mov edx, 0x4b7174
call fcn.00405728
mov eax, dword [0x4c3280]
cmp byte [eax], 0
jne 0x4b675f
mov eax, dword [esi]
mov eax, dword [eax + 0x350]
cmp byte [eax + 0x57], 0
je 0x4b675f
mov eax, dword [esi]
mov eax, dword [eax + 0x354]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4b675f
mov eax, dword [0x4c306c]
cmp byte [eax], 0
je 0x4b6720
push dword [ebp - 0x14]
push 0x4b702c
mov eax, dword [0x4c3244]
push dword [eax]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405790
jmp 0x4b675f
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.004057d8
jbe 0x4b674a
push dword [ebp - 0x10]
push 0x4b702c
mov eax, dword [0x4c3244]
push dword [eax]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405790
jmp 0x4b675f
mov ecx, dword [0x4c3244]
mov ecx, dword [ecx]
lea eax, [ebp - 0x10]
mov edx, 0x4b7158
call fcn.00405728
mov eax, dword [0x4c3280]
cmp byte [eax], 0
jne 0x4b68f6
mov eax, dword [esi]
mov eax, dword [eax + 0x348]
cmp byte [eax + 0x57], 0
je 0x4b68f6
mov eax, dword [esi]
mov eax, dword [eax + 0x34c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4b68f6
mov eax, dword [0x4c30c0]
cmp byte [eax], 0
je 0x4b67c2
push dword [ebp - 0x14]
push 0x4b702c
mov eax, dword [0x4c32a4]
push dword [eax]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405790
jmp 0x4b68f6
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.004057d8
jbe 0x4b67ef
push dword [ebp - 0x10]
push 0x4b702c
mov eax, dword [0x4c32a4]
push dword [eax]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405790
jmp 0x4b68f6
mov ecx, dword [0x4c32a4]
mov ecx, dword [ecx]
lea eax, [ebp - 0x10]
mov edx, 0x4b7158
call fcn.00405728
jmp 0x4b68f6
mov ecx, dword [0x4c31c0]
mov ecx, dword [ecx]
lea eax, [ebp - 0x10]
mov edx, 0x4b7158
call fcn.00405728
mov eax, dword [0x4c2f28]
cmp byte [eax], 0
jne 0x4b6866
mov eax, dword [esi]
mov eax, dword [eax + 0x358]
cmp byte [eax + 0x57], 0
je 0x4b6866
mov eax, dword [esi]
mov eax, dword [eax + 0x35c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4b6866
push dword [ebp - 0x10]
push 0x4b702c
mov eax, dword [0x4c327c]
push dword [eax]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405790
mov eax, dword [0x4c3280]
cmp byte [eax], 0
jne 0x4b68ae
mov eax, dword [esi]
mov eax, dword [eax + 0x350]
cmp byte [eax + 0x57], 0
je 0x4b68ae
mov eax, dword [esi]
mov eax, dword [eax + 0x354]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4b68ae
push dword [ebp - 0x10]
push 0x4b702c
mov eax, dword [0x4c3244]
push dword [eax]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405790
mov eax, dword [0x4c3280]
cmp byte [eax], 0
jne 0x4b68f6
mov eax, dword [esi]
mov eax, dword [eax + 0x348]
cmp byte [eax + 0x57], 0
je 0x4b68f6
mov eax, dword [esi]
mov eax, dword [eax + 0x34c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4b68f6
push dword [ebp - 0x10]
push 0x4b702c
mov eax, dword [0x4c32a4]
push dword [eax]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405790
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405790
mov eax, dword [0x4c2fcc]
cmp byte [eax], 0
jne 0x4b6a6f
lea eax, [ebp - 8]
call fcn.00405474
mov edi, 0x1c
mov ebx, dword [0x4c2eec]
add ebx, 0xc
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00404f90
mov edx, dword [ebp - 0x20]
mov eax, dword [0x4c3304]
mov eax, dword [eax]
call fcn.00405138
jne 0x4b6991
cmp byte [ebx + 3], 0
jbe 0x4b6997
mov eax, dword [0x4c3304]
mov eax, dword [eax]
mov edx, 0x4b7190
call fcn.00405138
je 0x4b6997
push dword [ebp - 8]
push 0x4b7198
lea eax, [ebp - 0x24]
lea edx, [ebx + 3]
call fcn.00405608
push dword [ebp - 0x24]
push 0x4b71a4
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405790
jmp 0x4b6997
add ebx, 0x20
dec edi
jne 0x4b6933
mov eax, dword [0x4c3400]
cmp byte [eax], 0
jne 0x4b69b5
mov eax, dword [esi]
mov eax, dword [eax + 0x344]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x4b69d4
push dword [ebp - 8]
push 0x4b7198
push 0x4b71b4
push 0x4b71a4
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405790
mov eax, dword [0x4c3290]
cmp byte [eax], 0
je 0x4b69fd
push dword [ebp - 8]
push 0x4b7198
push 0x4b71e4
push 0x4b71a4
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405790
mov eax, dword [0x4c3308]
cmp byte [eax], 0
jne 0x4b6a30
mov eax, dword [0x4c2f20]
cmp byte [eax], 0
jne 0x4b6a30
push dword [ebp - 8]
push 0x4b7198
push 0x4b7210
push 0x4b71a4
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405790
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004057d8
jbe 0x4b6a6f
mov eax, dword [ebp - 8]
cmp word [eax], 0x3b
jne 0x4b6a57
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.004058a8
push dword [ebp - 4]
push 0x4b7238
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405790
lea eax, [ebp - 4]
mov edx, 0x4b7258
call fcn.004056c8
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004099a0
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 4]
call fcn.004054d4
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 4]
mov edx, 0x4b72f8
call fcn.00405728
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
call fcn.00404fb4
mov eax, dword [ebp - 0x2c]
call fcn.004b0280
mov eax, dword [esi]
mov eax, dword [eax + 0x350]
cmp byte [eax + 0x57], 0
je 0x4b6b23
push 0x80000001
push 0
mov eax, dword [esi]
mov eax, dword [eax + 0x354]
mov edx, dword [eax]
call dword [edx + 0xc8]
xor ecx, ecx
mov edx, 1
call fcn.0042f7e0
mov edx, eax
mov ecx, 0x4b732c
mov eax, 0x4b7350
call fcn.004a56e4
mov ecx, 0x80000001
mov edx, 0x4b7364
mov eax, 0x4b738c
call fcn.004a5890
test al, al
je 0x4b6b23
mov ecx, 0x80000001
mov edx, 0x4b7364
mov eax, 0x4b738c
call fcn.004a580c
mov eax, dword [esi]
mov eax, dword [eax + 0x348]
cmp byte [eax + 0x57], 0
je 0x4b6b91
push 0x80000001
push 0
mov eax, dword [esi]
mov eax, dword [eax + 0x34c]
mov edx, dword [eax]
call dword [edx + 0xc8]
xor ecx, ecx
mov edx, 1
call fcn.0042f7e0
mov edx, eax
mov ecx, 0x4b732c
mov eax, 0x4b73a8
call fcn.004a56e4
mov ecx, 0x80000001
mov edx, 0x4b7364
mov eax, 0x4b73b8
call fcn.004a5890
test al, al
je 0x4b6b91
mov ecx, 0x80000001
mov edx, 0x4b7364
mov eax, 0x4b73b8
call fcn.004a580c
mov eax, dword [ebp - 4]
call fcn.004056ac
push eax
mov eax, dword [0x4c304c]
mov eax, dword [eax]
call fcn.004056ac
push eax
mov eax, dword [0x4c31ec]
mov eax, dword [eax]
call eax
mov ebx, eax
test ebx, ebx
je 0x4b6c5c
cmp ebx, 0xbc2
je 0x4b6c5c
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x38]
call fcn.00409e78
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x4b73d4
call fcn.00405038
mov eax, dword [ebp - 0x34]
call fcn.004b0280
mov eax, dword [0x4c3160]
mov byte [eax], 2
cmp ebx, 0x642
je 0x4b6c48
push 1
push 1
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x40]
mov eax, dword [0x4c2fa4]
mov eax, dword [eax]
mov edx, 0x4b7400
call fcn.0047f1a4
mov eax, dword [ebp - 0x40]
push eax
lea edx, [ebp - 0x4c]
mov eax, ebx
call fcn.004b4098
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0xf
lea edx, [ebp - 0x48]
xor ecx, ecx
pop eax
call fcn.00481540
mov eax, dword [ebp - 0x3c]
or ecx, 0xffffffff
xor edx, edx
call fcn.004aa868
mov eax, dword [esi]
call fcn.00475f74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6e21
call fcn.004aa030
mov eax, dword [esi]
mov eax, dword [eax + 0x358]
cmp byte [eax + 0x57], 0
je 0x4b6c8d
mov eax, dword [esi]
mov eax, dword [eax + 0x35c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4b6c8d
mov eax, 0x4b7430
call fcn.004b1f04
mov eax, dword [esi]
mov eax, dword [eax + 0x350]
cmp byte [eax + 0x57], 0
je 0x4b6cb9
mov eax, dword [esi]
mov eax, dword [eax + 0x354]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4b6cb9
mov eax, 0x4b743c
call fcn.004b1f04
mov eax, dword [esi]
mov eax, dword [eax + 0x348]
cmp byte [eax + 0x57], 0
je 0x4b6ce5
mov eax, dword [esi]
mov eax, dword [eax + 0x34c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4b6ce5
mov eax, 0x4b7448
call fcn.004b1f04
mov eax, dword [esi]
mov eax, dword [eax + 0x364]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x4b6d25
mov ecx, 0x80000001
mov edx, 0x4b7454
mov eax, 0x4b7488
call fcn.004a5890
test al, al
je 0x4b6d25
mov ecx, 0x80000001
mov edx, 0x4b7454
mov eax, 0x4b7488
call fcn.004a580c
mov eax, dword [0x4c2f20]
cmp byte [eax], 0
je 0x4b6d5f
mov eax, dword [0x4c3160]
mov byte [eax], 3
cmp dword [esi], 0
je 0x4b6d52
push 0
push 0
push 0xd30
mov eax, dword [esi]
call fcn.0045fb5c
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6e21
test ebx, ebx
jne 0x4b6dc6
mov eax, 0x4b749c
call fcn.004b0280
mov eax, dword [0x4c3160]
mov byte [eax], 3
mov eax, dword [0x4c33a4]
cmp byte [eax], 0
je 0x4b6d88
mov eax, dword [esi]
call fcn.004bd8a8
jmp 0x4b6de7
mov eax, dword [esi]
mov eax, dword [eax + 0x368]
cmp byte [eax + 0x57], 0
je 0x4b6daa
mov eax, dword [esi]
mov eax, dword [eax + 0x36c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x4b6db4
mov eax, dword [0x4c3208]
cmp byte [eax], 0
je 0x4b6dbd
mov eax, dword [esi]
call fcn.00475f74
jmp 0x4b6de7
mov eax, dword [esi]
call fcn.004bdb44
jmp 0x4b6de7
cmp ebx, 0xbc2
jne 0x4b6de7
mov eax, 0x4b74c4
call fcn.004b0280
mov eax, dword [0x4c3160]
mov byte [eax], 4
mov eax, dword [esi]
call fcn.004bdcac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6e21
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6e9f
lea eax, [ebp - 0x50]
call fcn.00404d1c
lea eax, [ebp - 0x4c]
call fcn.00405474
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.0040548c
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00404d40
lea eax, [ebp - 0x30]
call fcn.00405474
lea eax, [ebp - 0x2c]
call fcn.00404d1c
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.0040548c
lea eax, [ebp - 0x20]
call fcn.00404d1c
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.0040548c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040548c
ret