Function at 0x43dcd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9ec
mov eax, dword [0x6385e0]
xor eax, ebp
mov dword [ebp - 0x138], eax
push esi
call fcn.0043db80
movzx eax, al
test eax, eax
jne 0x43dcfb
or eax, 0xffffffff
jmp 0x43f086
push 0x6003a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x70], eax
push str.NtQueryInformationProcess
mov ecx, dword [ebp - 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x643678], eax
push str.NtQuerySystemInformation
mov edx, dword [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x64367c], eax
push str.NtQueryObject
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x643680], eax
push 0xa2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov word [ebp - 0x78], ax
movsx ecx, word [ebp - 0x78]
and ecx, 0x8000
neg ecx
sbb ecx, ecx
neg ecx
mov byte [ebp - 0x19], cl
lea ecx, [ebp - 0x18]
call fcn.004324c0
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x8d4]
call fcn.004b3550
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x8d4]
push ecx
call fcn.0042e0b0
add esp, 8
lea ecx, [ebp - 0x8d4]
call fcn.004b3860
mov byte [ebp - 0x50], 0
mov byte [ebp - 0x4c], 0
mov byte [ebp - 3], 1
mov byte [ebp - 2], 0
mov byte [ebp - 0x4e], 0
mov byte [ebp - 1], 0
mov byte [ebp - 0x49], 0
mov byte [ebp - 0x4f], 0
mov byte [ebp - 0x69], 0
mov byte [ebp - 0x72], 1
mov byte [ebp - 0x71], 1
mov byte [ebp - 0x4b], 0
mov byte [ebp - 0x4d], 0
mov byte [ebp - 0x4a], 0
mov edx, dword [0x63e870]
push edx
lea ecx, [ebp - 0x48]
call fcn.004b3550
mov eax, dword [0x63e870]
push eax
lea ecx, [ebp - 0x68]
call fcn.004b3550
lea ecx, [ebp - 0x3c]
call fcn.0042fe80
lea ecx, [ebp - 0x18]
call fcn.00432770
push eax
lea ecx, [ebp - 0x5c]
call fcn.00432930
lea ecx, [ebp - 0x5c]
call fcn.004b9730
mov dword [ebp - 0x9dc], eax
mov ecx, dword [ebp - 0x9dc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x9dc]
mov eax, dword [edx]
call eax
movzx ecx, al
test ecx, ecx
je 0x43ee58
lea ecx, [ebp - 0x5c]
call fcn.004b9730
mov dword [ebp - 0x9e0], eax
mov edx, dword [ebp - 0x9e0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x9e0]
mov edx, dword [eax + 8]
call edx
mov dword [ebp - 0x7c], eax
push str._debug
mov ecx, dword [ebp - 0x7c]
call fcn.004b6880
movzx eax, al
test eax, eax
je 0x43de9b
push str.:full
mov ecx, dword [ebp - 0x7c]
call fcn.004b4780
movzx ecx, al
test ecx, ecx
je 0x43de8b
mov dword [0x643674], 2
push 0x43d970
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
jmp 0x43ee53
push str._console
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx edx, al
test edx, edx
je 0x43dec4
movzx eax, byte [ebp - 2]
test eax, eax
jne 0x43debf
call fcn.0043d890
mov byte [ebp - 2], al
jmp 0x43ee53
push str._crusader
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx ecx, al
test ecx, ecx
je 0x43df24
push 0
call fcn.00481d40
add esp, 4
mov dword [ebp - 0x8d8], 0
lea ecx, [ebp - 0x5c]
call fcn.00432970
lea ecx, [ebp - 0x3c]
call fcn.00409100
lea ecx, [ebp - 0x68]
call fcn.004b3860
lea ecx, [ebp - 0x48]
call fcn.004b3860
lea ecx, [ebp - 0x18]
call fcn.00432520
mov eax, dword [ebp - 0x8d8]
jmp 0x43f086
push str._crusader:boot
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx edx, al
test edx, edx
je 0x43df84
push 1
call fcn.00481d40
add esp, 4
mov dword [ebp - 0x8dc], 0
lea ecx, [ebp - 0x5c]
call fcn.00432970
lea ecx, [ebp - 0x3c]
call fcn.00409100
lea ecx, [ebp - 0x68]
call fcn.004b3860
lea ecx, [ebp - 0x48]
call fcn.004b3860
lea ecx, [ebp - 0x18]
call fcn.00432520
mov eax, dword [ebp - 0x8dc]
jmp 0x43f086
push str._installservice
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx eax, al
test eax, eax
je 0x43dfe3
push 0
call fcn.00481dc0
add esp, 4
movzx ecx, al
mov dword [ebp - 0x8e0], ecx
lea ecx, [ebp - 0x5c]
call fcn.00432970
lea ecx, [ebp - 0x3c]
call fcn.00409100
lea ecx, [ebp - 0x68]
call fcn.004b3860
lea ecx, [ebp - 0x48]
call fcn.004b3860
lea ecx, [ebp - 0x18]
call fcn.00432520
mov eax, dword [ebp - 0x8e0]
jmp 0x43f086
push str._uninstallservice
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx edx, al
test edx, edx
je 0x43e042
push 0
call fcn.00482200
add esp, 4
movzx eax, al
mov dword [ebp - 0x8e4], eax
lea ecx, [ebp - 0x5c]
call fcn.00432970
lea ecx, [ebp - 0x3c]
call fcn.00409100
lea ecx, [ebp - 0x68]
call fcn.004b3860
lea ecx, [ebp - 0x48]
call fcn.004b3860
lea ecx, [ebp - 0x18]
call fcn.00432520
mov eax, dword [ebp - 0x8e4]
jmp 0x43f086
push str._listen
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx ecx, al
test ecx, ecx
je 0x43e0dc
lea ecx, [ebp - 0x84]
call fcn.00481260
lea ecx, [ebp - 0x84]
call fcn.00481760
movzx edx, byte [ebp - 2]
test edx, edx
jne 0x43e07d
call fcn.0043d890
push str.Press_a_key_to_quit..._r_n
call fcn.0054d5e0
add esp, 4
call fcn.0054f282
mov dword [ebp - 0x8e8], 0
lea ecx, [ebp - 0x84]
call fcn.00481380
lea ecx, [ebp - 0x5c]
call fcn.00432970
lea ecx, [ebp - 0x3c]
call fcn.00409100
lea ecx, [ebp - 0x68]
call fcn.004b3860
lea ecx, [ebp - 0x48]
call fcn.004b3860
lea ecx, [ebp - 0x18]
call fcn.00432520
mov eax, dword [ebp - 0x8e8]
jmp 0x43f086
push str._uninstall
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx eax, al
test eax, eax
je 0x43e13d
call fcn.004298f0
movzx ecx, al
neg ecx
sbb ecx, ecx
add ecx, 1
mov dword [ebp - 0x8ec], ecx
lea ecx, [ebp - 0x5c]
call fcn.00432970
lea ecx, [ebp - 0x3c]
call fcn.00409100
lea ecx, [ebp - 0x68]
call fcn.004b3860
lea ecx, [ebp - 0x48]
call fcn.004b3860
lea ecx, [ebp - 0x18]
call fcn.00432520
mov eax, dword [ebp - 0x8ec]
jmp 0x43f086
push str._update:
mov ecx, dword [ebp - 0x7c]
call fcn.004b6880
movzx edx, al
test edx, edx
je 0x43e21f
mov byte [ebp - 0x19], 0
push 8
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x7c]
call fcn.004b64e0
push 0
lea ecx, [ebp - 0x90]
call fcn.004b3df0
movzx ecx, ax
cmp ecx, 0x22
jne 0x43e1b9
lea ecx, [ebp - 0x90]
call fcn.00404b70
sub eax, 2
push eax
push 1
lea edx, [ebp - 0x8f8]
push edx
lea ecx, [ebp - 0x90]
call fcn.004b6620
push eax
lea ecx, [ebp - 0x90]
call fcn.004b3890
lea ecx, [ebp - 0x8f8]
call fcn.004b3860
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x90]
push ecx
call fcn.00429240
add esp, 8
movzx edx, al
neg edx
sbb edx, edx
add edx, 1
mov dword [ebp - 0x8fc], edx
lea ecx, [ebp - 0x90]
call fcn.004b3860
lea ecx, [ebp - 0x5c]
call fcn.00432970
lea ecx, [ebp - 0x3c]
call fcn.00409100
lea ecx, [ebp - 0x68]
call fcn.004b3860
lea ecx, [ebp - 0x48]
call fcn.004b3860
lea ecx, [ebp - 0x18]
call fcn.00432520
mov eax, dword [ebp - 0x8fc]
jmp 0x43f086
push str._updated:
mov ecx, dword [ebp - 0x7c]
call fcn.004b6880
movzx eax, al
test eax, eax
je 0x43e2b2
push 9
lea ecx, [ebp - 0x9c]
push ecx
mov ecx, dword [ebp - 0x7c]
call fcn.004b64e0
push 0
lea ecx, [ebp - 0x9c]
call fcn.004b3df0
movzx edx, ax
cmp edx, 0x22
jne 0x43e293
lea ecx, [ebp - 0x9c]
call fcn.00404b70
sub eax, 2
push eax
push 1
lea eax, [ebp - 0x908]
push eax
lea ecx, [ebp - 0x9c]
call fcn.004b6620
push eax
lea ecx, [ebp - 0x9c]
call fcn.004b3890
lea ecx, [ebp - 0x908]
call fcn.004b3860
lea ecx, [ebp - 0x9c]
push ecx
call fcn.004294c0
add esp, 4
lea ecx, [ebp - 0x9c]
call fcn.004b3860
jmp 0x43ee53
push str._sr
mov ecx, dword [ebp - 0x7c]
call fcn.004b6880
movzx eax, al
test eax, eax
je 0x43e3ea
movzx ecx, byte [ebp - 2]
test ecx, ecx
jne 0x43e2da
call fcn.0043d890
mov byte [ebp - 2], al
push 4
lea edx, [ebp - 0xac]
push edx
mov ecx, dword [ebp - 0x7c]
call fcn.004b64e0
call fcn.00422da0
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jne 0x43e30e
push str.Failed_to_deploy_driver_r_n
call fcn.0054d5e0
add esp, 4
jmp 0x43e38b
push 0x5feb54
lea ecx, [ebp - 0xac]
call fcn.004b6880
movzx eax, al
test eax, eax
je 0x43e35f
lea ecx, [ebp - 0xac]
call fcn.00404b70
sub eax, 2
push eax
push 1
lea ecx, [ebp - 0x914]
push ecx
lea ecx, [ebp - 0xac]
call fcn.004b6620
push eax
lea ecx, [ebp - 0xac]
call fcn.004b3890
lea ecx, [ebp - 0x914]
call fcn.004b3860
push 0
push 0
mov edx, dword [ebp - 0xa0]
push edx
lea eax, [ebp - 0xac]
push eax
call fcn.0044a590
add esp, 0x10
mov ecx, dword [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004232b0
push str.Press_any_key_to_quit..._r_n
call fcn.0054d5e0
add esp, 4
call fcn.0054f282
mov dword [ebp - 0x918], 0
lea ecx, [ebp - 0xac]
call fcn.004b3860
lea ecx, [ebp - 0x5c]
call fcn.00432970
lea ecx, [ebp - 0x3c]
call fcn.00409100
lea ecx, [ebp - 0x68]
call fcn.004b3860
lea ecx, [ebp - 0x48]
call fcn.004b3860
lea ecx, [ebp - 0x18]
call fcn.00432520
mov eax, dword [ebp - 0x918]
jmp 0x43f086
push str._lcn
mov ecx, dword [ebp - 0x7c]
call fcn.004b6880
movzx edx, al
test edx, edx
je 0x43e59a
movzx eax, byte [ebp - 2]
test eax, eax
jne 0x43e412
call fcn.0043d890
mov byte [ebp - 2], al
push 5
lea ecx, [ebp - 0xb8]
push ecx
mov ecx, dword [ebp - 0x7c]
call fcn.004b64e0
lea ecx, [ebp - 0xb8]
call fcn.00404b70
test eax, eax
jle 0x43e58a
push 0
lea ecx, [ebp - 0xb8]
call fcn.004b3df0
mov word [ebp - 0xc0], ax
push 0
push 0
push 0
movzx edx, word [ebp - 0xc0]
push edx
call fcn.0044a2b0
add esp, 0x10
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
je 0x43e530
sub esp, 0xc
mov eax, esp
mov ecx, dword [ebp - 0xb8]
mov dword [eax], ecx
mov edx, dword [ebp - 0xb4]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0xb0]
mov dword [eax + 8], ecx
push str._ws_r_n_t
call fcn.0054eca8
add esp, 0x10
lea edx, [ebp - 0xc8]
push edx
lea eax, [ebp - 0xb8]
push eax
mov ecx, dword [ebp - 0xbc]
call fcn.0044da00
movzx ecx, al
test ecx, ecx
jne 0x43e4ce
push str.Could_not_locate_file_r_n
call fcn.0054d5e0
add esp, 4
jmp 0x43e4e9
mov edx, dword [ebp - 0xc4]
push edx
mov eax, dword [ebp - 0xc8]
push eax
push str.LCN_I64u_r_n
call fcn.0054d5e0
add esp, 0xc
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0x920], ecx
mov edx, dword [ebp - 0x920]
mov dword [ebp - 0x91c], edx
cmp dword [ebp - 0x91c], 0
je 0x43e526
push 1
mov eax, dword [ebp - 0x91c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x91c]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x9e4], eax
jmp 0x43e530
mov dword [ebp - 0x9e4], 0
push str.Press_any_key_to_quit..._r_n
call fcn.0054d5e0
add esp, 4
call fcn.0054f282
mov dword [ebp - 0x924], 0
lea ecx, [ebp - 0xb8]
call fcn.004b3860
lea ecx, [ebp - 0x5c]
call fcn.00432970
lea ecx, [ebp - 0x3c]
call fcn.00409100
lea ecx, [ebp - 0x68]
call fcn.004b3860
lea ecx, [ebp - 0x48]
call fcn.004b3860
lea ecx, [ebp - 0x18]
call fcn.00432520
mov eax, dword [ebp - 0x924]
jmp 0x43f086
lea ecx, [ebp - 0xb8]
call fcn.004b3860
jmp 0x43ee53
push str._swap
mov ecx, dword [ebp - 0x7c]
call fcn.004b6880
movzx ecx, al
test ecx, ecx
je 0x43e868
movzx edx, byte [ebp - 2]
test edx, edx
jne 0x43e5c2
call fcn.0043d890
mov byte [ebp - 2], al
lea ecx, [ebp - 0xd4]
call fcn.004b34a0
lea ecx, [ebp - 0xe0]
call fcn.004b34a0
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0xd4]
push ecx
push 0x2c
push 6
lea edx, [ebp - 0x934]
push edx
mov ecx, dword [ebp - 0x7c]
call fcn.004b64e0
mov ecx, eax
call fcn.004b6400
movzx eax, al
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x925], al
lea ecx, [ebp - 0x934]
call fcn.004b3860
movzx ecx, byte [ebp - 0x925]
test ecx, ecx
je 0x43e638
push str.Invalid_arguments_r_n
call fcn.0054d5e0
add esp, 4
jmp 0x43e7fe
lea ecx, [ebp - 0xd4]
call fcn.00404b70
test eax, eax
je 0x43e656
lea ecx, [ebp - 0xe0]
call fcn.00404b70
test eax, eax
jne 0x43e668
push str.Invalid_arguments_r_n
call fcn.0054d5e0
add esp, 4
jmp 0x43e7fe
push 0
lea ecx, [ebp - 0xd4]
call fcn.004b3df0
movzx esi, ax
push 0
lea ecx, [ebp - 0xe0]
call fcn.004b3df0
movzx edx, ax
cmp esi, edx
je 0x43e69e
push str.Files_must_be_on_the_same_drive_r_n
call fcn.0054d5e0
add esp, 4
jmp 0x43e7fe
call fcn.00422da0
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jne 0x43e6c4
push str.Failed_to_deploy_driver_r_n
call fcn.0054d5e0
add esp, 4
jmp 0x43e7fe
push 0
lea ecx, [ebp - 0xd4]
call fcn.004b3df0
mov word [ebp - 0xec], ax
movzx eax, word [ebp - 0xec]
push eax
call fcn.0047e5f0
add esp, 4
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jne 0x43e709
push str.Failed_to_open_File_System_r_n
call fcn.0054d5e0
add esp, 4
jmp 0x43e7ec
mov ecx, dword [ebp - 0xe8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xe8]
mov eax, dword [edx + 0x18]
call eax
movzx ecx, al
test ecx, ecx
jne 0x43e732
push str.File_System_cannot_swap_files_r_n
call fcn.0054d5e0
add esp, 4
jmp 0x43e7a5
lea ecx, [ebp - 0xe0]
call fcn.004553f0
push eax
lea ecx, [ebp - 0xd4]
call fcn.004553f0
push eax
push str.Are_you_sure_you_want_to_swap__y_n__r_n_t_ws_r_n_t_ws_r_n
call fcn.0054d5e0
add esp, 0xc
call fcn.0054f282
cmp eax, 0x79
jne 0x43e7a5
lea edx, [ebp - 0xe0]
push edx
lea eax, [ebp - 0xd4]
push eax
mov ecx, dword [ebp - 0xe8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xe8]
mov eax, dword [edx + 0x1c]
call eax
movzx ecx, al
test ecx, ecx
je 0x43e798
push str.Successfully_swapped_files_r_n
call fcn.0054d5e0
add esp, 4
jmp 0x43e7a5
push str.Failed_to_swap_files_r_n
call fcn.0054d5e0
add esp, 4
mov edx, dword [ebp - 0xe8]
mov dword [ebp - 0x93c], edx
mov eax, dword [ebp - 0x93c]
mov dword [ebp - 0x938], eax
cmp dword [ebp - 0x938], 0
je 0x43e7e2
push 1
mov ecx, dword [ebp - 0x938]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x938]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x9e8], eax
jmp 0x43e7ec
mov dword [ebp - 0x9e8], 0
mov ecx, dword [ebp - 0xe4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004232b0
push str.Press_any_key_to_quit..._r_n
call fcn.0054d5e0
add esp, 4
call fcn.0054f282
mov dword [ebp - 0x940], 0
lea ecx, [ebp - 0xe0]
call fcn.004b3860
lea ecx, [ebp - 0xd4]
call fcn.004b3860
lea ecx, [ebp - 0x5c]
call fcn.00432970
lea ecx, [ebp - 0x3c]
call fcn.00409100
lea ecx, [ebp - 0x68]
call fcn.004b3860
lea ecx, [ebp - 0x48]
call fcn.004b3860
lea ecx, [ebp - 0x18]
call fcn.00432520
mov eax, dword [ebp - 0x940]
jmp 0x43f086
push str._lic
mov ecx, dword [ebp - 0x7c]
call fcn.004b6880
movzx edx, al
test edx, edx
je 0x43e8a6
push 5
lea eax, [ebp - 0x94c]
push eax
mov ecx, dword [ebp - 0x7c]
call fcn.004b64e0
push eax
lea ecx, [ebp - 0x68]
call fcn.004b3890
lea ecx, [ebp - 0x94c]
call fcn.004b3860
jmp 0x43ee53
push str._scan
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx ecx, al
test ecx, ecx
je 0x43e8c3
mov byte [ebp - 0x4c], 1
jmp 0x43ee53
push str._scan:boot
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx edx, al
test edx, edx
je 0x43eb82
mov byte [ebp - 0x19], 0
call fcn.0042cff0
movzx eax, al
test eax, eax
jne 0x43e935
push str.Need_administrator_rights_r_n
call fcn.0054d5e0
add esp, 4
mov dword [ebp - 0x950], 0
lea ecx, [ebp - 0x5c]
call fcn.00432970
lea ecx, [ebp - 0x3c]
call fcn.00409100
lea ecx, [ebp - 0x68]
call fcn.004b3860
lea ecx, [ebp - 0x48]
call fcn.004b3860
lea ecx, [ebp - 0x18]
call fcn.00432520
mov eax, dword [ebp - 0x950]
jmp 0x43f086
mov byte [ebp - 0x4a], 1
mov byte [ebp - 0x4c], 1
mov byte [ebp - 0x50], 1
push 0
push str.SOFTWAREHitman_Pro
call fcn.00414b30
mov ecx, eax
call fcn.00414830
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
je 0x43eb44
lea ecx, [ebp - 0x104]
call fcn.004b34a0
lea ecx, [ebp - 0x104]
push ecx
push str.DailyScanMode
mov ecx, dword [ebp - 0xf0]
call fcn.004141d0
movzx edx, al
test edx, edx
je 0x43e9ad
push 0
push str.Quick
lea ecx, [ebp - 0x104]
call fcn.004b4b20
movzx eax, al
test eax, eax
jne 0x43e9ad
mov byte [ebp - 0x4a], 0
lea ecx, [ebp - 0x104]
push ecx
push str.LastScan
mov ecx, dword [ebp - 0xf0]
call fcn.004141d0
mov edx, dword [ebp - 0xf0]
mov dword [ebp - 0x958], edx
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0x954], eax
cmp dword [ebp - 0x954], 0
je 0x43ea01
push 1
mov ecx, dword [ebp - 0x954]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x954]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x9ec], eax
jmp 0x43ea0b
mov dword [ebp - 0x9ec], 0
lea ecx, [ebp - 0x120]
call fcn.00407bf0
lea ecx, [ebp - 0x104]
call fcn.00404b70
cmp eax, 0x13
jge 0x43ea2b
jmp 0x43eb2e
push str.yyyy_MM_dd_HH:mm:ss
lea ecx, [ebp - 0x968]
call fcn.004b3550
push 0
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x968]
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.0043d720
add esp, 0x10
movzx ecx, al
neg ecx
sbb ecx, ecx
add ecx, 1
mov byte [ebp - 0x959], cl
lea ecx, [ebp - 0x968]
call fcn.004b3860
movzx edx, byte [ebp - 0x959]
test edx, edx
je 0x43ea85
jmp 0x43eb2e
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x990]
push ecx
lea edx, [ebp - 0x980]
push edx
call fcn.00411800
add esp, 4
mov ecx, eax
call fcn.00407c50
mov ecx, eax
call fcn.00407ba0
fstp qword [ebp - 0x128]
lea ecx, [ebp - 0x990]
call fcn.00407b80
lea ecx, [ebp - 0x980]
call fcn.00407c30
fld1
fcomp qword [ebp - 0x128]
fnstsw ax
test ah, 0x41
jne 0x43eb2e
mov dword [ebp - 0x994], 0
lea ecx, [ebp - 0x120]
call fcn.00407c30
lea ecx, [ebp - 0x104]
call fcn.004b3860
lea ecx, [ebp - 0x5c]
call fcn.00432970
lea ecx, [ebp - 0x3c]
call fcn.00409100
lea ecx, [ebp - 0x68]
call fcn.004b3860
lea ecx, [ebp - 0x48]
call fcn.004b3860
lea ecx, [ebp - 0x18]
call fcn.00432520
mov eax, dword [ebp - 0x994]
jmp 0x43f086
lea ecx, [ebp - 0x120]
call fcn.00407c30
lea ecx, [ebp - 0x104]
call fcn.004b3860
mov dword [ebp - 0xf8], 0x493e0
mov dword [ebp - 0xf4], 0x2710
mov eax, dword [ebp - 0xf8]
push eax
call fcn.0042e880
add esp, 4
mov ecx, dword [ebp - 0xf4]
push ecx
mov edx, dword [ebp - 0xf8]
push edx
call fcn.0042e6a0
add esp, 8
jmp 0x43ee53
push str._quiet
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx eax, al
test eax, eax
je 0x43eb9f
mov byte [ebp - 0x50], 1
jmp 0x43ee53
push str._noscan
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx ecx, al
test ecx, ecx
je 0x43ebbc
mov byte [ebp - 0x69], 1
jmp 0x43ee53
push str._noinstall
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx edx, al
test edx, edx
je 0x43ebd9
mov byte [ebp - 0x4e], 1
jmp 0x43ee53
push str._nostartboot
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx eax, al
test eax, eax
je 0x43ebf6
mov byte [ebp - 1], 1
jmp 0x43ee53
push str._nodesktopshortcut
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx ecx, al
test ecx, ecx
je 0x43ec13
mov byte [ebp - 0x49], 1
jmp 0x43ee53
push str._nostartmenushortcut
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx edx, al
test edx, edx
je 0x43ec30
mov byte [ebp - 0x4f], 1
jmp 0x43ee53
push str._noupdate
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx eax, al
test eax, eax
je 0x43ec4d
mov byte [ebp - 3], 0
jmp 0x43ee53
push str._noupload
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx ecx, al
test ecx, ecx
je 0x43ec6a
mov byte [ebp - 0x72], 0
jmp 0x43ee53
push str._nocookies
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx edx, al
test edx, edx
je 0x43ec87
mov byte [ebp - 0x71], 0
jmp 0x43ee53
push str._scanonly
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx eax, al
test eax, eax
je 0x43ecb0
mov byte [ebp - 0x4c], 1
mov byte [ebp - 0x50], 1
mov byte [ebp - 0x4e], 1
mov byte [ebp - 0x4d], 1
jmp 0x43ee53
push str._ews
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx ecx, al
test ecx, ecx
je 0x43eccd
mov byte [ebp - 0x4b], 1
jmp 0x43ee53
push str._quick
mov ecx, dword [ebp - 0x7c]
call fcn.004b4b00
movzx edx, al
test edx, edx
je 0x43ecea
mov byte [ebp - 0x4a], 1
jmp 0x43ee53
push str._log
mov ecx, dword [ebp - 0x7c]
call fcn.004b6880
movzx eax, al
test eax, eax
je 0x43ed85
push 5
lea ecx, [ebp - 0x9a0]
push ecx
mov ecx, dword [ebp - 0x7c]
call fcn.004b64e0
push eax
lea ecx, [ebp - 0x48]
call fcn.004b3890
lea ecx, [ebp - 0x9a0]
call fcn.004b3860
push 0x5feb54
lea ecx, [ebp - 0x48]
call fcn.004b6880
movzx edx, al
test edx, edx
je 0x43ed80
push 0x5feb54
lea ecx, [ebp - 0x48]
call fcn.004b4780
movzx eax, al
test eax, eax
je 0x43ed80
lea ecx, [ebp - 0x48]
call fcn.00404b70
sub eax, 2
push eax
push 1
lea ecx, [ebp - 0x9ac]
push ecx
lea ecx, [ebp - 0x48]
call fcn.004b6620
push eax
lea ecx, [ebp - 0x48]
call fcn.004b3890
lea ecx, [ebp - 0x9ac]
call fcn.004b3860
jmp 0x43ee53
push 0x5fcdd0
mov ecx, dword [ebp - 0x7c]
call fcn.004b6880
movzx edx, al
test edx, edx
jne 0x43ee53
lea eax, [ebp - 0x9bc]
push eax
mov ecx, dword [ebp - 0x7c]
call fcn.004b6d00
mov ecx, eax
call fcn.00404b70
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x9ad], al
lea ecx, [ebp - 0x9bc]
call fcn.004b3860
movzx ecx, byte [ebp - 0x9ad]
test ecx, ecx
je 0x43edd8
jmp 0x43ee53
push 0x5feb54
mov ecx, dword [ebp - 0x7c]
call fcn.004b6880
movzx edx, al
test edx, edx
je 0x43ee40
push 0x5feb54
mov ecx, dword [ebp - 0x7c]
call fcn.004b4780
movzx eax, al
test eax, eax
je 0x43ee40
mov ecx, dword [ebp - 0x7c]
call fcn.00404b70
sub eax, 2
push eax
push 1
lea ecx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x7c]
call fcn.004b6620
lea edx, [ebp - 0x134]
push edx
lea eax, [ebp - 0x9c8]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0042feb0
lea ecx, [ebp - 0x134]
call fcn.004b3860
jmp 0x43ee53
mov ecx, dword [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x9d4]
push edx
lea ecx, [ebp - 0x3c]
call fcn.0042feb0
jmp 0x43de0a
lea ecx, [ebp - 0x3c]
call fcn.0040c9d0
test eax, eax
jbe 0x43ee66
jmp 0x43ee73
movzx eax, byte [ebp - 0x19]
test eax, eax
je 0x43ee73
call fcn.0043b5d0
movzx ecx, byte [ebp - 3]
push ecx
lea ecx, [ebp - 0x8c8]
call fcn.00416080
movzx edx, byte [ebp - 2]
push edx
lea ecx, [ebp - 0x8c8]
call fcn.0043d790
movzx eax, byte [ebp - 0x4e]
test eax, eax
je 0x43eea8
push 1
lea ecx, [ebp - 0x8c8]
call fcn.00439b00
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x43eebd
push 1
lea ecx, [ebp - 0x8c8]
call fcn.00439b40
movzx edx, byte [ebp - 0x49]
test edx, edx
je 0x43eed2
push 1
lea ecx, [ebp - 0x8c8]
call fcn.00439b60
movzx eax, byte [ebp - 0x4f]
test eax, eax
je 0x43eee7
push 1
lea ecx, [ebp - 0x8c8]
call fcn.00439b80
lea ecx, [ebp - 0x48]
call fcn.00404b70
test eax, eax
jle 0x43ef02
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x8c8]
call fcn.0043d870
lea ecx, [ebp - 0x68]
call fcn.00404b70
test eax, eax
jle 0x43ef4b
lea edx, [ebp - 0x68]
push edx
lea ecx, [ebp - 0x8c8]
call fcn.004242f0
movzx eax, al
test eax, eax
jne 0x43ef26
jmp 0x43ef4b
lea ecx, [ebp - 0x8c8]
call fcn.0043d850
movzx ecx, al
test ecx, ecx
jne 0x43ef4b
movzx edx, byte [ebp - 0x4e]
test edx, edx
jne 0x43ef4b
lea ecx, [ebp - 0x8c8]
call fcn.00428340
movzx eax, byte [ebp - 0x69]
test eax, eax
jne 0x43f021
lea ecx, [ebp - 0x3c]
call fcn.0040c9d0
test eax, eax
jbe 0x43ef76
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x8c8]
call fcn.0043d7b0
mov byte [ebp - 0x4c], 1
movzx edx, byte [ebp - 0x4c]
test edx, edx
je 0x43ef8b
push 1
lea ecx, [ebp - 0x8c8]
call fcn.0043d770
movzx eax, byte [ebp - 0x50]
test eax, eax
je 0x43efad
push 1
lea ecx, [ebp - 0x8c8]
call fcn.0043d7d0
push 1
lea ecx, [ebp - 0x8c8]
call fcn.0043d770
movzx ecx, byte [ebp - 0x4d]
test ecx, ecx
je 0x43efc2
push 1
lea ecx, [ebp - 0x8c8]
call fcn.0043d830
movzx edx, byte [ebp - 0x72]
test edx, edx
jne 0x43efd7
push 1
lea ecx, [ebp - 0x8c8]
call fcn.0043d7f0
movzx eax, byte [ebp - 0x71]
test eax, eax
jne 0x43efec
push 1
lea ecx, [ebp - 0x8c8]
call fcn.0043d810
movzx ecx, byte [ebp - 0x4a]
test ecx, ecx
je 0x43f001
push 1
lea ecx, [ebp - 0x8c8]
call fcn.0043d750
movzx edx, byte [ebp - 0x4b]
test edx, edx
je 0x43f016
push 1
lea ecx, [ebp - 0x8c8]
call fcn.00419c90
lea ecx, [ebp - 0x8c8]
call fcn.00423670
lea ecx, [ebp - 0x8c8]
call fcn.00416e70
movzx eax, byte [ebp - 2]
test eax, eax
je 0x43f04e
movzx ecx, byte [ebp - 0x4d]
test ecx, ecx
jne 0x43f04e
push str.Press_any_key_to_quit..._r_n
call fcn.0054d5e0
add esp, 4
call fcn.0054f282
mov dword [ebp - 0x9d8], 0
lea ecx, [ebp - 0x5c]
call fcn.00432970
lea ecx, [ebp - 0x3c]
call fcn.00409100
lea ecx, [ebp - 0x68]
call fcn.004b3860
lea ecx, [ebp - 0x48]
call fcn.004b3860
lea ecx, [ebp - 0x18]
call fcn.00432520
mov eax, dword [ebp - 0x9d8]
pop esi
mov ecx, dword [ebp - 0x138]
xor ecx, ebp
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret 0x10