Function at 0x4ca46d
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xfc
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0x7c]
mov eax, 0x2b74
cmp ecx, eax
mov dword [ebp + 0x40], edi
jg 0x4ca58b
je 0x4ca57f
cmp ecx, 0x41
jg 0x4ca535
je 0x4ca52b
cmp ecx, 0x2f
je 0x4ca521
cmp ecx, 0x31
jle case.0x4ca5a1.11127
cmp ecx, 0x33
jle 0x4ca514
cmp ecx, 0x34
je 0x4ca507
jle case.0x4ca5a1.11127
cmp ecx, 0x38
jle 0x4ca514
xor ebx, ebx
mov byte [ebp + 0x72], bl
cmp ecx, 0x28
jne 0x4ca4da
mov eax, dword [0x54b1b0]
cmp eax, 4
jae 0x4ca4da
add eax, 0x17
mov dword [ebp + 0x7c], eax
mov eax, dword [edi + 0x108]
mov eax, dword [eax + 0x14]
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
shr ecx, 0x1f
test cl, 1
jne 0x4ca62f
imul eax, eax, 0xc
call fcn.00401000
mov dword [ebp + 0x4c], esp
jmp 0x4ca63f
mov ecx, dword [edi + 4]
call fcn.004a9ceb
jmp case.0x4ca5a1.11125
push ecx
mov ecx, edi
call fcn.004c920b
jmp case.0x4ca5a1.11125
call fcn.004ce17b
jmp case.0x4ca5a1.11125
call fcn.004b93ca
jmp case.0x4ca5a1.11125
mov eax, ecx
sub eax, 0x72
je 0x4ca573
sub eax, 3
je 0x4ca567
dec eax
je 0x4ca55b
sub eax, 0x2afd
jne case.0x4ca5a1.11127
mov ecx, edi
call fcn.004c957e
jmp case.0x4ca5a1.11125
mov ecx, edi
call fcn.004c458b
jmp case.0x4ca5a1.11125
mov ecx, edi
call fcn.004c440a
jmp case.0x4ca5a1.11125
mov ecx, edi
call fcn.004c87c0
jmp case.0x4ca5a1.11125
mov ecx, edi
call fcn.004c958d
jmp case.0x4ca5a1.11125
lea eax, [ecx - 0x2b75]
cmp eax, 0x10
ja case.0x4ca5a1.11127
movzx eax, byte [eax + 0x4cb131]
jmp dword [eax*4 + 0x4cb10d]
mov ecx, edi
call fcn.004c9979
jmp case.0x4ca5a1.11125
mov ecx, edi
call fcn.004c9959
jmp case.0x4ca5a1.11125
mov ecx, edi
call fcn.004c454d
jmp case.0x4ca5a1.11125
mov ecx, edi
call fcn.004c959c
jmp case.0x4ca5a1.11125
mov ecx, edi
call fcn.004c95b3
jmp case.0x4ca5a1.11125
mov ecx, edi
call fcn.004c457f
jmp case.0x4ca5a1.11125
mov esi, dword [edi + 0x28]
add esi, 0x30
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x4ca623
mov eax, dword [esi]
push dword [eax + ebx*4]
mov ecx, dword [edi + 0x28]
call fcn.004239d9
test eax, eax
je 0x4ca61d
cmp byte [eax + 0x14], 0x17
jne 0x4ca61d
mov ecx, dword [edi + 0x28]
push eax
call fcn.00425abf
inc ebx
cmp ebx, dword [esi + 8]
jb 0x4ca5fd
mov ecx, edi
call fcn.004c334c
jmp case.0x4ca5a1.11125
call esi
mov dword [0x54f62c], eax
mov dword [0], ebx
mov dword [ebp + 0x4c], ebx
mov eax, dword [edi + 0x108]
mov eax, dword [eax + 0x14]
mov ecx, eax
shr ecx, 0x1f
test cl, 1
jne 0x4ca65f
shl eax, 2
call fcn.00401000
mov dword [ebp + 0x60], esp
jmp 0x4ca66f
call esi
mov dword [0x54f62c], eax
mov dword [0], ebx
mov dword [ebp + 0x60], ebx
mov eax, dword [edi + 0x108]
mov eax, dword [eax + 8]
push 2
push 0xffffffffffffffff
push 0x100c
push eax
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x68], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp + 0x54], eax
cmp eax, 0xffffffff
je 0x4ca7be
mov ebx, dword [ebp + 0x4c]
mov dword [ebp + 0x6c], ebx
mov eax, dword [edi + 0x108]
mov ecx, dword [ebp + 0x50]
cmp ecx, dword [eax + 0x14]
jae 0x4ca7be
mov esi, dword [ebp + 0x54]
mov eax, dword [edi + 0x58]
and dword [ebp + 0x44], 0
shl esi, 2
mov eax, dword [eax + esi]
mov eax, dword [eax + 0x1c]
mov dword [ebx], eax
cmp eax, 1
jne 0x4ca753
mov eax, dword [edi + 0x58]
mov eax, dword [eax + esi]
mov ecx, dword [eax + 0xc8]
call fcn.00485eac
mov ecx, dword [eax + 0x24]
and dword [ebp + 0x5c], 0
mov dword [ebp + 0x58], ecx
test ecx, ecx
jbe 0x4ca753
mov ecx, dword [ebp + 0x40]
mov ecx, dword [ecx + 0x58]
mov edi, dword [esi + ecx]
mov ebx, dword [eax + 0x1c]
mov ecx, dword [edi + 0x20]
mov eax, dword [ebx + 4]
call fcn.00493e5a
test eax, eax
jne 0x4ca73a
mov ecx, dword [edi + 0xcc]
mov eax, dword [ebx + 8]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4ca731
test dl, dl
je 0x4ca72d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4ca731
inc eax
inc eax
inc ecx
inc ecx
test dl, dl
jne 0x4ca713
xor eax, eax
jmp 0x4ca736
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4ca74a
inc dword [ebp + 0x5c]
mov eax, dword [ebp + 0x5c]
add ebx, 0x54
cmp eax, dword [ebp + 0x58]
jb 0x4ca6fb
jmp 0x4ca74d
mov dword [ebp + 0x44], ebx
mov ebx, dword [ebp + 0x6c]
mov edi, dword [ebp + 0x40]
mov eax, dword [ebp + 0x44]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0x58]
mov eax, dword [esi + eax]
cmp dword [eax + 0x1c], 0
jne 0x4ca76d
mov eax, dword [eax + 0xc4]
jmp 0x4ca76f
xor eax, eax
cmp dword [ebx], 0
mov dword [ebx + 4], eax
jne 0x4ca78f
mov eax, dword [edi + 0x58]
mov eax, dword [eax + esi]
mov edx, dword [ebp + 0x68]
mov eax, dword [eax + 0xc4]
mov ecx, dword [ebp + 0x60]
inc dword [ebp + 0x68]
mov dword [ecx + edx*4], eax
mov eax, dword [edi + 0x108]
mov eax, dword [eax + 8]
inc dword [ebp + 0x50]
push 2
push dword [ebp + 0x54]
add ebx, 0xc
push 0x100c
push eax
mov dword [ebp + 0x6c], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp + 0x54], eax
cmp eax, 0xffffffff
jne 0x4ca6a0
cmp dword [ebp + 0x7c], 0x25
je 0x4ca8d1
cmp dword [ebp + 0x7c], 0x2c
jne 0x4ca826
cmp dword [ebp + 0x68], 0xa
jbe 0x4ca826
push dword [ebp + 0x68]
lea eax, [ebp + 0x58]
push dword [0x550678]
mov dword [ebp - 0x18], 1
push eax
mov dword [ebp - 0x14], 4
call fcn.0048ee25
add esp, 0xc
mov ecx, eax
call fcn.0048e806
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004693e3
pop ecx
pop ecx
lea ecx, [ebp + 0x58]
mov esi, eax
call fcn.0048e50a
cmp esi, 7
je case.0x4ca5a1.11125
cmp esi, 2
je case.0x4ca5a1.11125
mov eax, dword [ebp + 0x50]
mov esi, dword [ebp + 0x68]
sub eax, esi
xor ebx, ebx
mov dword [ebp + 0x24], eax
cmp dword [ebp + 0x50], ebx
je case.0x4ca5a1.11125
cmp esi, ebx
jbe 0x4ca96b
mov eax, dword [ebp + 0x7c]
cmp eax, 0x17
je 0x4ca85f
cmp eax, 0x18
je 0x4ca85f
cmp eax, 0x19
je 0x4ca85f
cmp eax, 0x1a
jne 0x4ca96b
cmp byte [0x54b011], 0
je 0x4ca96b
mov dword [ebp - 0x14], 0x24
mov dword [ebp - 0x18], 9
mov dword [ebp - 4], 0x54b011
cmp esi, 1
jne 0x4ca897
mov eax, dword [ebp + 0x60]
mov eax, dword [eax]
cmp dword [eax + 0x1dc], ebx
je 0x4ca919
push esi
push 0
lea eax, [ebp + 0x58]
push eax
call fcn.004c0be5
mov ecx, eax
call fcn.0048e806
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004693e3
pop ecx
pop ecx
cmp eax, 6
lea ecx, [ebp + 0x58]
setne bl
call fcn.0048e50a
test bl, bl
jne case.0x4ca5a1.11125
jmp 0x4ca96b
cmp dword [ebp + 0x68], 0xa
jbe 0x4ca826
push dword [ebp + 0x68]
lea eax, [ebp + 0x48]
push dword [0x550674]
mov dword [ebp - 0x38], 1
push eax
mov dword [ebp - 0x34], 4
call fcn.0048ee25
add esp, 0xc
mov ecx, eax
call fcn.0048e806
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004693e3
pop ecx
pop ecx
lea ecx, [ebp + 0x48]
jmp 0x4ca80d
push eax
push edi
lea ecx, [ebp - 0x88]
call fcn.004ade3e
push ebx
push pe_nt_image_headers32
call fcn.00468651
push eax
lea ecx, [ebp - 0x88]
call fcn.0046834d
mov eax, dword [edi + 4]
push 0x1b
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
cmp byte [ebp - 0x68], 0
lea ecx, [ebp - 0x88]
jne 0x4ca966
call fcn.004adaff
jmp case.0x4ca5a1.11125
call fcn.004adaff
mov byte [ebp + 0x73], 1
call fcn.0046e3c9
cmp dword [ebp + 0x7c], 0x22
jne 0x4ca9c5
xor ebx, ebx
test esi, esi
jbe 0x4ca9be
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x68]
lea esi, [eax + ecx*4 - 4]
mov eax, dword [ebp + 0x60]
mov ecx, dword [eax + ebx*4]
call fcn.00490c85
test al, al
jne 0x4ca9a9
mov eax, dword [esi]
mov ecx, dword [ebp + 0x60]
dec dword [ebp + 0x68]
mov dword [ecx + ebx*4], eax
sub esi, 4
jmp 0x4ca9b8
mov eax, dword [ebp + 0x60]
mov eax, dword [eax + ebx*4]
test byte [eax + 0x1be], 0x20
je 0x4ca9fd
inc ebx
cmp ebx, dword [ebp + 0x68]
jb 0x4ca98a
mov dword [ebp + 0x7c], 0x23
cmp dword [ebp + 0x7c], 0x13
jne 0x4ca9e9
cmp dword [0x54aff4], 0
je 0x4ca9fd
push ecx
mov edx, str.A4D77A09_10EA_4574_8C09_9B6E1A21C95F
mov ecx, esp
call fcn.00493ad7
push 0xb
pop ecx
call fcn.0048bb4e
cmp dword [ebp + 0x7c], 0x1c
je 0x4cb08d
cmp dword [ebp + 0x7c], 0x1b
je 0x4cb08d
xor eax, eax
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x54], eax
cmp dword [ebp + 0x50], eax
jbe 0x4cb04e
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp + 0x4c]
mov esi, dword [eax + 4]
mov ebx, dword [eax + 8]
mov eax, dword [eax]
test eax, eax
jne 0x4cafb7
mov ecx, esi
call fcn.00490c85
test al, al
je 0x4cb02c
mov ebx, dword [ebp + 0x7c]
lea edx, [ebx - 0x2710]
cmp edx, 0x3e7
ja 0x4caa54
mov ecx, esi
call fcn.00446c59
cmp ebx, 0x6a
jg 0x4cafa0
je 0x4caf54
cmp ebx, 0x25
jg 0x4cac0b
je 0x4cabf0
cmp ebx, 0x1f
jg 0x4caba7
cmp ebx, 0x1d
jge 0x4cab84
cmp ebx, 0x13
je 0x4cab34
cmp ebx, 0x14
je 0x4cab28
cmp ebx, 0x15
je 0x4cab0f
cmp ebx, 0x16
je 0x4caedb
jle 0x4cb02c
cmp ebx, 0x1a
jg 0x4cb02c
mov ecx, esi
call fcn.0048094e
movzx eax, byte [0x54b1c7]
neg eax
sbb eax, eax
and eax, 4
add ebx, 0xffffffe9
or eax, ebx
push eax
mov ecx, esi
call fcn.0041c712
cmp esi, dword [edi + 0x100]
jne 0x4caae6
push 0
mov ecx, edi
call fcn.004c006b
cmp esi, dword [edi + 0xa0]
jne 0x4cb02c
mov eax, dword [edi + 0x108]
push 0
push 0xffffffffffffffff
push 0x1076
push dword [eax + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4cabe7
test byte [esi + 0x1be], 0x40
jne 0x4cabe7
mov ecx, esi
call fcn.00419f56
jmp 0x4cabe7
mov ecx, esi
call int.0041348f
jmp 0x4cabe7
xor ebx, ebx
cmp dword [0x54aff4], ebx
je 0x4cb02c
cmp byte [0x54b104], bl
jne 0x4cab58
mov ecx, dword [edi + 0x108]
push ebx
push 0xe
call fcn.0042abef
mov ecx, dword [0x54aff4]
push 1
push 0xffffffffffffffff
push esi
call fcn.0040284a
mov ecx, dword [0x54aff4]
cmp byte [ecx + 0x10], 0
je 0x4cb02c
push ebx
push ebx
call fcn.004032ad
jmp 0x4cb02c
add ebx, 0xffffffe3
push ebx
mov ecx, esi
call fcn.0040cc89
push 0
push 0x20000
mov ecx, esi
call fcn.00409c85
call fcn.0048fcd8
jmp 0x4cb02c
mov eax, ebx
sub eax, 0x20
je 0x4cb058
dec eax
je 0x4cabe0
dec eax
je 0x4cabd7
dec eax
je 0x4cabce
dec eax
jne 0x4cb02c
mov ecx, esi
call fcn.0040d164
jmp 0x4cb02c
mov ecx, esi
call fcn.00419e39
jmp 0x4cabe7
mov ecx, esi
call fcn.00419ebc
jmp 0x4cabe7
mov ecx, esi
call fcn.0041a740
mov byte [ebp + 0x72], 1
jmp 0x4cb02c
mov eax, dword [esi + 0x168]
xor edx, edx
cmp byte [eax + 0x28], dl
mov ecx, esi
sete dl
dec edx
call fcn.00446eae
jmp 0x4cb02c
cmp ebx, 0x2c
jg 0x4caec1
je 0x4caeb0
mov eax, ebx
sub eax, 0x26
je 0x4cac5c
dec eax
je 0x4cac50
dec eax
dec eax
je 0x4cac44
dec eax
je 0x4cac36
dec eax
jne 0x4cb02c
xor dl, dl
jmp 0x4cac38
mov dl, 1
mov ecx, esi
call fcn.004b2af6
jmp 0x4cb02c
mov ecx, esi
call fcn.0040cb08
jmp 0x4cb02c
mov ecx, esi
call fcn.0040cbcf
jmp 0x4cb02c
lea ecx, [ebp + 0x6c]
mov byte [ebp + 0x67], 0
call fcn.0044502c
lea eax, [ebp + 0x73]
push eax
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x6c]
push eax
xor dl, dl
mov ecx, esi
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], 0x23
mov dword [ebp + 0x44], 0x4f4558
call fcn.004b83ac
mov bl, al
neg bl
sbb bl, bl
inc bl
mov dword [ebp + 0x44], 0x4f44ec
je 0x4caea3
mov eax, dword [esi + 0x168]
cmp byte [eax + 0x28], 0
je 0x4cacf4
mov ecx, esi
call fcn.0040a126
lea ecx, [ebp + 0x6c]
mov edi, eax
call fcn.0048e806
mov edx, edi
mov ecx, eax
call fcn.0048d60c
test al, al
jne 0x4cacf4
mov ecx, esi
call fcn.0040a126
lea ecx, [ebp + 0x6c]
mov edi, eax
call fcn.0048e806
mov edx, edi
mov ecx, eax
call fcn.004a307f
push eax
lea ecx, [ebp + 0x6c]
call fcn.0048e82b
lea ecx, [ebp + 0x5c]
xor edi, edi
call fcn.0044502c
mov eax, dword [esi + 0x168]
cmp byte [eax + 0x28], 0
je 0x4cad2f
mov eax, dword [eax]
lea ecx, [ebp + 0x6c]
mov dword [ebp + 0x48], eax
call fcn.0048e806
mov ecx, dword [ebp + 0x48]
mov edx, dword [ecx + 0x1c]
mov ecx, eax
call fcn.004a307f
push eax
lea ecx, [ebp + 0x5c]
call fcn.0048e513
jmp 0x4cad3a
push dword [ebp + 0x6c]
lea ecx, [ebp + 0x5c]
call fcn.0048e82b
lea ecx, [ebp + 0x5c]
call fcn.0048e806
mov ecx, eax
call fcn.00472219
test al, al
je 0x4cadbe
cmp byte [ebp + 0x73], 0
je 0x4cad5c
mov byte [ebp + 0x73], 0
call fcn.0046e3e5
mov ebx, dword [0x551134]
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x18], edi
call fcn.0048e806
push eax
lea eax, [ebp + 0x14]
push ebx
push eax
call fcn.0048de20
add esp, 0xc
lea ecx, [ebp + 0x14]
call fcn.0048de00
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004693e3
pop ecx
pop ecx
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x48], eax
call fcn.0048e45f
cmp dword [ebp + 0x48], 6
sete bl
cmp dword [ebp + 0x48], 7
sete byte [ebp + 0x67]
cmp byte [ebp + 0x73], 0
jne 0x4cadbe
mov byte [ebp + 0x73], 1
call fcn.0046e3c9
test bl, bl
je 0x4cadde
push edi
push edi
lea ecx, [ebp + 0x6c]
call fcn.0048e806
push eax
mov ecx, esi
call fcn.0041a2da
call fcn.0048fcd8
jmp 0x4cae98
cmp byte [ebp + 0x67], 0
je 0x4cae98
mov ebx, dword [esi + 0x168]
cmp byte [ebx + 0x28], 0
lea ecx, [ebp + 0x6c]
je 0x4cae09
call fcn.0048e806
push eax
mov ecx, ebx
call fcn.00441708
jmp 0x4cae98
mov dword [ebp + 0x28], edi
mov dword [ebp + 0x30], edi
mov dword [ebp + 0x2c], edi
call fcn.0048e806
push 0x5c
push eax
call sub.MSVCRT.dll_wcsrchr
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
je 0x4cae4b
lea ecx, [ebp + 0x6c]
call fcn.0048e806
mov ecx, ebx
sub ecx, eax
sar ecx, 1
push ecx
lea ecx, [ebp + 0x6c]
call fcn.0048e806
push eax
lea ecx, [ebp + 0x28]
call fcn.0048dc70
inc ebx
inc ebx
jmp 0x4cae63
call fcn.004a3293
push eax
lea ecx, [ebp + 0x28]
call fcn.0048dc4a
lea ecx, [ebp + 0x6c]
call fcn.0048e806
mov ebx, eax
mov edi, dword [esi + 0x168]
lea ecx, [ebp + 0x28]
call fcn.0048de00
push eax
mov ecx, edi
call fcn.00441708
mov ecx, ebx
call fcn.00422199
mov esi, dword [esi + 0x168]
push eax
push dword [esi]
mov ecx, esi
call fcn.00441722
lea ecx, [ebp + 0x28]
call fcn.0048e45f
lea ecx, [ebp + 0x5c]
call fcn.0048e50a
mov edi, dword [ebp + 0x40]
lea ecx, [ebp + 0x6c]
call fcn.0048e50a
jmp 0x4cb02c
push 0
or edx, 0xffffffff
mov ecx, esi
call fcn.00446b52
jmp 0x4cb02c
mov eax, ebx
sub eax, 0x2d
je 0x4caf16
dec eax
je 0x4cb07c
sub eax, 0xb
je 0x4caee7
dec eax
jne 0x4cb02c
mov ecx, esi
call fcn.0041a816
jmp 0x4cabe7
cmp dword [ebp + 0x3c], 0
jbe 0x4caefa
push 0x4f5594
lea ecx, [ebp + 0x34]
call fcn.0048dc4a
mov ecx, esi
call fcn.0040d195
mov ecx, eax
call fcn.0048bfe7
push eax
lea ecx, [ebp + 0x34]
call fcn.0048dc4a
jmp 0x4cb02c
xor eax, eax
mov dword [ebp + 8], eax
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], eax
cmp byte [ebp + 0x73], al
je 0x4caf2e
mov byte [ebp + 0x73], al
call fcn.0046e3e5
mov edx, esi
lea ecx, [ebp + 8]
call fcn.004d5806
cmp byte [ebp + 0x73], 0
jne 0x4caf47
mov byte [ebp + 0x73], 1
call fcn.0046e3c9
lea ecx, [ebp + 8]
call fcn.0048e45f
jmp 0x4cb02c
mov ecx, esi
call fcn.0040a130
push eax
lea eax, [ebp + 0x58]
push eax
lea ecx, [esi + 0x1c]
call fcn.0042d5cf
lea ecx, [ebp + 0x58]
call fcn.0048e806
push eax
lea eax, [ebp + 0x20]
push str.__s_
push eax
call fcn.0048ee25
add esp, 0xc
mov ecx, eax
call fcn.0048e806
mov ecx, eax
call fcn.004a4532
lea ecx, [ebp + 0x20]
call fcn.0048e50a
lea ecx, [ebp + 0x58]
jmp 0x4caea6
cmp ebx, 0x6c
jne 0x4cb02c
push 1
xor eax, eax
push eax
push eax
push dword [esi + 0x460]
jmp 0x4cb013
cmp eax, 1
jne 0x4cb02c
mov ecx, dword [ebx + 0x38]
call fcn.00485eac
mov ecx, dword [ebp + 0x7c]
sub ecx, 0x16
je 0x4cafdd
sub ecx, 0x1a
je 0x4cb00a
dec ecx
je 0x4caffc
dec ecx
dec ecx
je 0x4cafec
sub ecx, 8
jne 0x4cb02c
cmp dword [ebp + 0x24], 1
mov ecx, ebx
jbe 0x4cb01d
call fcn.0048861a
jmp 0x4cb02c
push dword [ebx + 8]
mov edx, dword [ebx + 4]
mov ecx, dword [eax + 0x10]
call fcn.00487cfc
jmp 0x4cb02c
mov ecx, ebx
call fcn.0048607c
call fcn.004ce17b
jmp 0x4cb02c
push 1
xor eax, eax
push eax
push eax
push dword [ebx + 8]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4cb02c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
xor edx, edx
call fcn.00486e5a
inc dword [ebp + 0x54]
mov eax, dword [ebp + 0x54]
add dword [ebp + 0x4c], 0xc
cmp eax, dword [ebp + 0x50]
jb 0x4caa1a
mov edx, dword [ebp + 0x3c]
test edx, edx
jbe 0x4cb04e
mov ecx, dword [ebp + 0x34]
call fcn.004a4ee0
lea ecx, [ebp + 0x34]
call fcn.0048e45f
jmp 0x4cb0ce
push 0xa3
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edx, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x60]
test ax, ax
jge 0x4cb075
call fcn.00445654
jmp 0x4cb0f1
call fcn.004de1d5
jmp 0x4cb0f1
cmp byte [ebp + 0x73], 0
je case.0x4ca5a1.11125
mov byte [ebp + 0x73], 0
call fcn.0046e3e5
jmp 0x4cb0f1
xor eax, eax
cmp dword [ebp + 0x7c], 0x1b
push 0x10
sete al
add eax, 4
mov esi, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x4cb0ab
or esi, 2
mov edx, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x60]
push esi
call fcn.004914bc
call fcn.0048fcd8
and dword [0x549b48], 0
and dword [0x549b4c], 0
mov byte [ebp + 0x72], 1
cmp byte [ebp + 0x73], 0
je 0x4cb0dd
mov byte [ebp + 0x73], 0
call fcn.0046e3e5
cmp byte [ebp + 0x72], 0
je 0x4cb0ea
mov ecx, edi
call fcn.004c9104
mov ecx, edi
call fcn.004c3a0a
cmp byte [ebp + 0x73], 0
je case.0x4ca5a1.11125
call fcn.0046e3e5
lea esp, [ebp - 0x94]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4