Function at 0x4e7120
Capabilities:
Contain obfuscated stackstrings
Create directory
Create process on windows
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c0c2a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x4e0
push esi
push edi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x4f0]
mov dword [ebp - 4], 5
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [ebp - 0x4f0]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4e7190
mov ecx, 0xb
lea eax, [ebp - 0x4f0]
mov esi, str.AeroadminRecordings_
rep movsd dword es:[edi], dword [esi]
push 0
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [ebx + 0x7c], 8
lea edx, [ebx + 0x68]
mov dword [ebp - 0x90], 0
cmovae edx, dword [ebx + 0x68]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x90], ax
lea esi, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e71f0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x90]
call fcn.004496e0
mov eax, dword [str.path]
mov dword [ebp - 0xa8], 0
mov byte [ebp - 0xa8], 0
mov dword [ebp - 0x94], 0xf
mov dword [ebp - 0x98], 4
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa4], 0
lea eax, [ebp - 0xa8]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x178]
call fcn.00447260
lea edx, [ebp - 0x90]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x160]
call fcn.004e9040
fldz
fstp qword [ebp - 0x148]
mov byte [ebp - 0x140], 0
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 9
push ecx
lea eax, [ebp - 0x138]
push eax
push ecx
lea ecx, [ebp - 0x120]
call fcn.004456c0
push 0x20
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xa
call fcn.0044a110
mov ecx, 5
mov dword [ebp - 0x38], 0x17
mov esi, str.Ffmpeg__from_settings
mov dword [ebp - 0x34], 0x1f
mov edi, eax
mov dword [ebp - 0x48], eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [eax + 0x17], 0
mov eax, dword [str.admin]
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x28], eax
mov al, byte [0x5de3c8]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 5
mov byte [ebp - 0x24], al
mov byte [ebp - 0x23], 0
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 0xc
push eax
push 0x1c
lea eax, [ebp - 0x48]
xor ecx, ecx
push str.misc.cpp
push eax
lea edx, [ebp - 0x28]
call fcn.004d4b60
mov byte [ebp - 4], 0xb
add esp, 0x10
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x4e7357
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4e734d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e8598
push ecx
push edx
call fcn.00583877
add esp, 8
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x10
jb 0x4e738f
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4e7385
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e8598
push ecx
push edx
call fcn.00583877
add esp, 8
lea ecx, [ebp - 0x120]
call fcn.00449240
push fcn.00438e00
push 1
push 0x40
lea eax, [ebp - 0x178]
mov byte [ebp - 4], 7
push eax
call fcn.00583d37
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x94]
cmp ecx, 0x10
jb 0x4e73f1
mov edx, dword [ebp - 0xa8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4e73e7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e8598
push ecx
push edx
call fcn.00583877
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x7c]
cmp ecx, 8
jb 0x4e7432
mov edx, dword [ebp - 0x90]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e7428
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e8598
push ecx
push edx
call fcn.00583877
add esp, 8
call fcn.005201a0
lea ecx, [ebp - 0xc4]
push ecx
mov ecx, eax
call fcn.004380b0
mov ecx, dword [ebp - 0xb0]
mov esi, dword [eax + 0x10]
cmp ecx, 8
jb 0x4e7488
mov edx, dword [ebp - 0xc4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e747e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e8598
push ecx
push edx
call fcn.00583877
add esp, 8
xor eax, eax
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 7
mov word [ebp - 0xc4], ax
test esi, esi
jne 0x4e751d
mov eax, dword [0x5dddd0]
mov edi, 0xf
mov esi, dword [str.rec_txt_failed]
mov dword [ebp - 0x24], eax
mov eax, dword [0x5dddd4]
mov dword [ebp - 0x20], eax
mov ax, word [0x5dddd8]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 0xe
mov dword [ebp - 0x28], esi
mov word [ebp - 0x1c], ax
mov byte [ebp - 0x1a], 0
push 0xd0
mov byte [ebp - 4], 0xd
call fcn.005838a8
add esp, 4
mov dword [ebp - 0x2c], eax
push 0
push str.btn_ok
push str.rec_txt_failed
push ecx
push 0
push 0
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.00497cd0
mov byte [ebp - 4], 5
call fcn.0043b390
jmp 0x4e843e
mov al, byte [0x6c54a6]
lea ecx, [ebx + 0x68]
mov byte [0x6c54a5], al
lea eax, [ebp - 0x10c]
push eax
call fcn.00547b87
mov dword [ebp - 0x30], 4
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x10c]
cmp dword [ebp - 0xf8], 8
mov dword [ebp - 0xdc], 0
cmovae edx, dword [ebp - 0x10c]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 7
mov word [ebp - 0xdc], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e7581
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xdc]
call fcn.004496e0
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x11
call fcn.00449550
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
js 0x4e75b8
cmp ecx, 0x64
jle 0x4e75bd
mov ecx, 0x32
mov eax, 0x64
sub eax, ecx
imul ecx, eax, 0x17
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, 0x12
add esi, edx
cmp byte [0x6c54a6], 0
mov dword [ebp - 0x2c], esi
jne 0x4e8134
lea eax, [ebp - 0x120]
push eax
call fcn.0059defd
add esp, 4
lea eax, [ebp - 0x120]
push eax
call fcn.0059d86e
add esp, 4
push eax
push str._Y_m_d__H__M__S
lea eax, [ebp - 0x2c0]
push 0x50
push eax
call fcn.0059afc7
lea ecx, [ebp - 0x2c0]
mov dword [ebp - 0xa8], 0
add esp, 0x10
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0xa8], 0
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e7650
sub ecx, edx
lea eax, [ebp - 0x2c0]
push ecx
push eax
lea ecx, [ebp - 0xa8]
call fcn.00449cf0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xa8]
cmp dword [ebp - 0x94], 0x10
mov eax, dword [ebp - 0x98]
jb 0x4e768f
mov ecx, dword [ebp - 0xa8]
add eax, ecx
jmp 0x4e7697
add eax, ecx
lea ecx, [ebp - 0xa8]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x10c]
call fcn.004a82f0
mov byte [ebp - 4], 0x13
cmp dword [ebx + 0x90], 3
jb 0x4e771c
lea eax, [ebx + 0x80]
push eax
lea ecx, [ebp - 0x28]
call fcn.00446f20
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
jb 0x4e76d5
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + eax*2]
jmp 0x4e76db
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x28]
cmp ecx, eax
je 0x4e76f4
mov edx, 0x2f
cmp word [ecx], 0x5c
jne 0x4e76ed
mov word [ecx], dx
add ecx, 2
cmp ecx, eax
jne 0x4e76e4
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x138]
call fcn.00446f20
lea ecx, [ebp - 0x28]
call fcn.00449550
lea ecx, [ebp - 0x138]
mov eax, 0x65
jmp 0x4e7735
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 0xf4]
call fcn.00446ee0
mov ecx, eax
mov eax, 6
push ecx
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x30], eax
call fcn.00437a90
mov dword [ebp - 4], 0x16
mov eax, dword [ebp - 0x30]
test al, 2
je 0x4e7766
and eax, 0xfffffffd
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0x30], eax
call fcn.00449550
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 0x17
test al, 1
je 0x4e7779
lea ecx, [ebp - 0x138]
call fcn.00449550
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x138]
call fcn.00446f20
mov byte [ebp - 4], 0x18
lea eax, [ebx + 8]
cmp dword [ebx + 0x48], 0
mov edx, 0x5f0ab0
push eax
je 0x4e78ce
lea ecx, [ebp - 0x1a8]
call fcn.0044cff0
add esp, 4
push 0x5dde40
mov edx, eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x190]
call fcn.0044cdc0
add esp, 4
lea ecx, [ebx + 0x20]
mov byte [ebp - 4], 0x1a
push ecx
mov edx, eax
lea ecx, [ebp - 0x1d8]
call fcn.0044ce40
add esp, 4
push str.___Client
mov edx, eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x90]
call fcn.0044cdc0
add esp, 4
lea ecx, [ebx + 0x38]
mov byte [ebp - 4], 0x1c
push ecx
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.0044ce40
add esp, 4
push 0x5dde40
mov edx, eax
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x60]
call fcn.0044cdc0
add esp, 4
lea ecx, [ebx + 0x50]
mov byte [ebp - 4], 0x1e
push ecx
mov edx, eax
lea ecx, [ebp - 0x78]
call fcn.0044ce40
add esp, 4
push 0x5dde40
mov edx, eax
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x48]
call fcn.0044cdc0
add esp, 4
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x20
push ecx
mov edx, eax
lea ecx, [ebp - 0xf4]
call fcn.0044ce40
add esp, 4
lea ecx, [ebp - 0x10c]
push eax
call fcn.00446db0
lea ecx, [ebp - 0xf4]
call fcn.00449550
lea ecx, [ebp - 0x48]
call fcn.00449550
lea ecx, [ebp - 0x78]
call fcn.00449550
lea ecx, [ebp - 0x60]
call fcn.00449550
lea ecx, [ebp - 0x28]
call fcn.00449550
lea ecx, [ebp - 0x90]
call fcn.00449550
lea ecx, [ebp - 0x1d8]
call fcn.00449550
lea ecx, [ebp - 0x190]
call fcn.00449550
lea ecx, [ebp - 0x1a8]
jmp 0x4e7979
lea ecx, [ebp - 0x48]
call fcn.0044cff0
add esp, 4
push 0x5dde40
mov edx, eax
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xf4]
call fcn.0044cdc0
add esp, 4
lea ecx, [ebx + 0x20]
mov byte [ebp - 4], 0x22
push ecx
mov edx, eax
lea ecx, [ebp - 0x1d8]
call fcn.0044ce40
add esp, 4
push 0x5dde40
mov edx, eax
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x190]
call fcn.0044cdc0
add esp, 4
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x24
push ecx
mov edx, eax
lea ecx, [ebp - 0x1a8]
call fcn.0044ce40
add esp, 4
lea ecx, [ebp - 0x10c]
push eax
call fcn.00446db0
lea ecx, [ebp - 0x1a8]
call fcn.00449550
lea ecx, [ebp - 0x190]
call fcn.00449550
lea ecx, [ebp - 0x1d8]
call fcn.00449550
lea ecx, [ebp - 0xf4]
call fcn.00449550
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x18
call fcn.00449550
lea eax, [ebp - 0x270]
mov edx, 0x5ddc40
push eax
lea ecx, [ebp - 0x190]
call fcn.0044cff0
add esp, 4
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x25
push ecx
mov edx, eax
lea ecx, [ebp - 0x1a8]
call fcn.0044ce40
add esp, 4
push str..mp4_
mov edx, eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xc4]
call fcn.0044cdc0
add esp, 4
lea ecx, [ebp - 0x1a8]
call fcn.00449550
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x29
call fcn.00449550
mov edx, esi
lea ecx, [ebp - 0x90]
call fcn.00436850
mov esi, eax
mov edx, dword [ebp - 0xac]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x2a
call fcn.00436850
push eax
mov edx, str._y__rtbufsize_100M__f_gdigrab__framerate
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x60]
call fcn.004a1db0
add esp, 4
push str.__probesize_10M__draw_mouse_1__i_desktop__c:v_libx264__r_25__preset_ultrafast__tune_zerolatency__crf
mov edx, eax
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x78]
call fcn.0044cdc0
add esp, 4
push esi
push eax
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x48]
push dword [ebp - 0x2c]
call fcn.0044f020
push str.__pix_fmt_yuv420p
lea edx, [ebp - 0x48]
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0xf4]
call fcn.0044cdc0
add esp, 4
mov byte [ebp - 4], 0x30
mov ecx, dword [ebp - 0x34]
cmp ecx, 8
jb 0x4e7a9f
mov edx, dword [ebp - 0x48]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e7a95
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e859d
push ecx
push edx
call fcn.00583877
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov byte [ebp - 4], 0x31
mov ecx, dword [ebp - 0x64]
cmp ecx, 8
jb 0x4e7af1
mov edx, dword [ebp - 0x78]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e7ae7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e859d
push ecx
push edx
call fcn.00583877
add esp, 8
xor eax, eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], ax
mov byte [ebp - 4], 0x32
mov ecx, dword [ebp - 0x4c]
cmp ecx, 8
jb 0x4e7b43
mov edx, dword [ebp - 0x60]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e7b39
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e859d
push ecx
push edx
call fcn.00583877
add esp, 8
xor eax, eax
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
mov byte [ebp - 4], 0x33
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x4e7b95
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e7b8b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e859d
push ecx
push edx
call fcn.00583877
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x34
mov ecx, dword [ebp - 0x7c]
cmp ecx, 8
jb 0x4e7bea
mov edx, dword [ebp - 0x90]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e7be0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e859d
push ecx
push edx
call fcn.00583877
add esp, 8
mov edx, dword [ebp - 0xe4]
xor eax, eax
mov esi, dword [ebp - 0xb4]
mov word [ebp - 0x90], ax
mov eax, SysReAllocString
sub eax, edx
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
cmp eax, esi
jb 0x4e85a2
cmp dword [ebp - 0xe0], 8
lea ecx, [ebp - 0xf4]
push esi
cmovae ecx, dword [ebp - 0xf4]
lea eax, [ebp - 0xc4]
cmp dword [ebp - 0xb0], 8
cmovae eax, dword [ebp - 0xc4]
push eax
push edx
push ecx
push ecx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1c0]
call fcn.0044f200
mov eax, dword [str.frame_rate]
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x28], eax
mov eax, dword [0x5f0c84]
mov dword [ebp - 0x24], eax
mov ax, word [0x5f0c88]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0xa
mov word [ebp - 0x20], ax
mov byte [ebp - 0x1e], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x36
push eax
lea ecx, [ebp - 0x258]
call fcn.00447260
fild dword [ebp - 0xac]
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0xf
mov byte [ebp - 0x240], 0
fstp qword [ebp - 0x228]
mov byte [ebp - 0x220], 0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x48]
push 3
mov dword [ebp - 0x48], 0
push 0x5f0c7c
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
call fcn.00449cf0
mov byte [ebp - 4], 0x38
lea eax, [ebp - 0x48]
fild dword [ebp - 0x2c]
sub esp, 8
lea ecx, [ebp - 0x218]
fstp qword [esp]
push eax
call fcn.004d2c00
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0x3a
push ecx
lea eax, [ebp - 0x1d8]
push eax
push ecx
lea ecx, [ebp - 0x84]
call fcn.004456c0
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x78]
push 0x18
mov dword [ebp - 0x78], 0
push str.Screen_recording:___
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0xf
mov byte [ebp - 0x78], 0
call fcn.00449cf0
mov byte [ebp - 4], 0x3c
mov dword [ebp - 0x60], 0
push 6
push str.screen
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
call fcn.00449cf0
lea eax, [ebp - 0x84]
mov byte [ebp - 4], 0x3d
push eax
push 0x54
lea eax, [ebp - 0x78]
xor ecx, ecx
push str.misc.cpp
push eax
lea edx, [ebp - 0x60]
call fcn.004d4b60
mov byte [ebp - 4], 0x3c
add esp, 0x10
mov ecx, dword [ebp - 0x4c]
cmp ecx, 0x10
jb 0x4e7df2
mov edx, dword [ebp - 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4e7de8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e85a7
push ecx
push edx
call fcn.00583877
add esp, 8
mov byte [ebp - 4], 0x3b
mov ecx, dword [ebp - 0x64]
cmp ecx, 0x10
jb 0x4e7e2a
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4e7e20
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e85a7
push ecx
push edx
call fcn.00583877
add esp, 8
lea ecx, [ebp - 0x84]
call fcn.00449240
push fcn.00438e00
push 2
push 0x40
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 0x39
push eax
call fcn.00583d37
mov byte [ebp - 4], 0x36
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x10
jb 0x4e7e86
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4e7e7c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e85a7
push ecx
push edx
call fcn.00583877
add esp, 8
mov byte [ebp - 4], 0x35
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x4e7ebe
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4e7eb4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e85a7
push ecx
push edx
call fcn.00583877
add esp, 8
push 0x38
lea eax, [ebp - 0x170]
mov dword [ebp - 0x174], 0x3c
push 0
push eax
call fcn.00585a40
add esp, 0xc
mov dword [ebp - 0x168], 0
cmp dword [ebx + 0x7c], 8
lea eax, [ebx + 0x68]
mov dword [ebp - 0x16c], 0
cmovae eax, dword [ebx + 0x68]
cmp dword [ebp - 0x1ac], 8
mov dword [ebp - 0x164], eax
lea eax, [ebp - 0x1c0]
cmovae eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x160], eax
lea eax, [ebp - 0x174]
push eax
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x170], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4e80b5
push 0xffffffffffffffff
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 4
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
push str.path
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
call fcn.00449cf0
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x3e
push eax
lea ecx, [ebp - 0x218]
call fcn.00447260
lea edx, [ebp - 0xc4]
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x200]
call fcn.004e9040
fldz
fstp qword [ebp - 0x1e8]
mov byte [ebp - 0x1e0], 0
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0x40
push ecx
lea eax, [ebp - 0x1d8]
push eax
push ecx
lea ecx, [ebp - 0x84]
call fcn.004456c0
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x78]
push 0x21
mov dword [ebp - 0x78], 0
push str.Recording_started._Output_file_
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0xf
mov byte [ebp - 0x78], 0
call fcn.00449cf0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x48]
push 6
mov dword [ebp - 0x48], 0
push str.screen
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
call fcn.00449cf0
lea eax, [ebp - 0x84]
mov byte [ebp - 4], 0x43
push eax
push 0x61
lea eax, [ebp - 0x78]
xor ecx, ecx
push str.misc.cpp
push eax
lea edx, [ebp - 0x48]
call fcn.004d4b60
mov byte [ebp - 4], 0x42
add esp, 0x10
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x10
jb 0x4e8081
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4e8077
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e85ac
push ecx
push edx
call fcn.00583877
add esp, 8
lea ecx, [ebp - 0x78]
call fcn.004470b0
lea ecx, [ebp - 0x84]
call fcn.00449240
push fcn.00438e00
push 1
push 0x40
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x3e
push eax
call fcn.00583d37
lea ecx, [ebp - 0x60]
call fcn.004470b0
lea ecx, [ebp - 0x1c0]
call fcn.00449550
lea ecx, [ebp - 0xf4]
call fcn.00449550
lea ecx, [ebp - 0xc4]
call fcn.00449550
lea ecx, [ebp - 0x138]
call fcn.00449550
lea ecx, [ebp - 0x270]
call fcn.00449550
lea ecx, [ebp - 0x10c]
call fcn.00449550
mov ecx, dword [ebp - 0x94]
cmp ecx, 0x10
jb 0x4e83d3
mov edx, dword [ebp - 0xa8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4e83c9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e85b1
jmp 0x4e83c9
lea ecx, [ebp - 0xdc]
call fcn.004f09a0
mov edi, eax
test edi, edi
je 0x4e818a
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push edi
call dword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x4e8185
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 1
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
push 0
call esi
jmp 0x4e818a
call fcn.004f06c0
push 3
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
push 0x5e75bc
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00449cf0
mov byte [ebp - 4], 0x44
mov dword [ebp - 0x2c], edi
fild dword [ebp - 0x2c]
test edi, edi
jns 0x4e81c6
fadd qword [0x5f4758]
sub esp, 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x2f0]
fstp qword [esp]
push eax
call fcn.004d2c00
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x60]
push 4
mov dword [ebp - 0x60], 0
push str.proc
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
call fcn.00449cf0
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x46
push eax
lea ecx, [ebp - 0x2b0]
call fcn.00447260
lea edx, [ebp - 0xdc]
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x298]
call fcn.004e9040
fldz
fstp qword [ebp - 0x280]
mov byte [ebp - 0x278], 0
lea ecx, [ebp - 0x2f0]
mov byte [ebp - 4], 0x49
push ecx
lea eax, [ebp - 0x270]
push eax
push ecx
lea ecx, [ebp - 0x84]
call fcn.004456c0
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x78]
push 0x1b
mov dword [ebp - 0x78], 0
push str.CTRL_C_EVENT_sent_to___
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0xf
mov byte [ebp - 0x78], 0
call fcn.00449cf0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x48]
push 6
mov dword [ebp - 0x48], 0
push str.screen
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
call fcn.00449cf0
lea eax, [ebp - 0x84]
mov byte [ebp - 4], 0x4c
push eax
push 0x69
lea eax, [ebp - 0x78]
xor ecx, ecx
push str.misc.cpp
push eax
lea edx, [ebp - 0x48]
call fcn.004d4b60
mov byte [ebp - 4], 0x4b
add esp, 0x10
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x10
jb 0x4e830f
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4e8305
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e85b6
push ecx
push edx
call fcn.00583877
add esp, 8
mov byte [ebp - 4], 0x4a
mov ecx, dword [ebp - 0x64]
cmp ecx, 0x10
jb 0x4e8347
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4e833d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e85b6
push ecx
push edx
call fcn.00583877
add esp, 8
lea ecx, [ebp - 0x84]
call fcn.00449240
push fcn.00438e00
push 2
push 0x40
lea eax, [ebp - 0x2f0]
mov byte [ebp - 4], 0x48
push eax
call fcn.00583d37
mov ecx, dword [ebp - 0x4c]
cmp ecx, 0x10
jb 0x4e839f
mov edx, dword [ebp - 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4e8395
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e85b6
push ecx
push edx
call fcn.00583877
add esp, 8
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x4e83d3
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4e83c9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e85b6
push ecx
push edx
call fcn.00583877
add esp, 8
cmp byte [0x6c54a6], 0
mov ecx, dword [ebp - 0xc8]
sete byte [0x6c54a6]
cmp ecx, 8
jb 0x4e8421
mov edx, dword [ebp - 0xdc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e8417
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e85bb
push ecx
push edx
call fcn.00583877
add esp, 8
xor eax, eax
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 7
mov word [ebp - 0xdc], ax
mov ecx, dword [ebx + 0x1c]
cmp ecx, 8
jb 0x4e8478
mov edx, dword [ebx + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e846e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e85bb
push ecx
push edx
call fcn.00583877
add esp, 8
mov ecx, dword [ebx + 0x34]
xor eax, eax
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 7
mov word [ebx + 8], ax
cmp ecx, 8
jb 0x4e84c6
mov edx, dword [ebx + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e84bc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e85bb
push ecx
push edx
call fcn.00583877
add esp, 8
mov ecx, dword [ebx + 0x4c]
xor eax, eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 7
mov word [ebx + 0x20], ax
cmp ecx, 8
jb 0x4e8514
mov edx, dword [ebx + 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e850a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e85bb
push ecx
push edx
call fcn.00583877
add esp, 8
mov ecx, dword [ebx + 0x64]
xor eax, eax
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 7
mov word [ebx + 0x38], ax
cmp ecx, 8
jb 0x4e855e
mov edx, dword [ebx + 0x50]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e8554
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e85bb
push ecx
push edx
call fcn.00583877
add esp, 8
xor eax, eax
mov dword [ebx + 0x60], 0
lea ecx, [ebx + 0x68]
mov dword [ebx + 0x64], 7
mov word [ebx + 0x50], ax
call fcn.00449550
lea ecx, [ebx + 0x80]
call fcn.00449550
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00591c98
call fcn.00591c98
call fcn.004353d0
call fcn.00591c98
call fcn.00591c98
call fcn.00591c98
call fcn.00591c98
call fcn.00591c98
int3