Function at 0x49bf50
Capabilities:
Create process on windows
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536fc4
mov eax, dword fs:[0]
push eax
sub esp, 0x550
mov eax, dword [0x58e5a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x534], edi
cmp dword [ebp + 0x1c], 0
mov esi, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x520], esi
mov dword [ebp - 0x524], eax
mov dword [ebp - 0x52c], ecx
mov dword [ebp - 0x538], 0
jne 0x49d637
mov ecx, dword [ebp + 0xc]
cmp ecx, 0x470
jne 0x49bfe2
lea ecx, [ebp - 0x530]
push ecx
push eax
push dword [ebp + 0x10]
mov ecx, edi
push 0x470
call fcn.004918d0
mov dword [esi], eax
mov eax, 1
jmp 0x49d639
cmp ecx, 0x46e
jne 0x49c029
cmp byte [edi + 0x32d], 0
mov eax, dword [ebp + 0x10]
jne 0x49c010
push eax
push 0x100
push 0x40b
push dword [edi + 0x204]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x10]
push eax
call fcn.004d2aa1
add esp, 4
mov dword [esi], 0
mov eax, 1
jmp 0x49d639
mov esi, dword [ebp + 0x10]
cmp ecx, 5
jne 0x49c076
cmp esi, 1
je 0x49c045
push 1
mov ecx, edi
call fcn.004a0ac0
mov eax, dword [ebp - 0x524]
cmp dword [edi + 0x2e8], 0
je 0x49c065
shr eax, 0x10
lea ecx, [edi + 0x250]
cwde
push 1
sub eax, 0xc8
push eax
call fcn.0049f200
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
jmp 0x49c130
cmp ecx, 1
jne 0x49c0a1
lea ecx, [ebp - 0x530]
push ecx
push eax
push dword [ebp + 0x10]
mov ecx, edi
push 1
call fcn.00492aa0
mov ecx, dword [ebp - 0x520]
mov dword [ecx], eax
mov eax, 1
jmp 0x49d639
cmp ecx, 2
jne 0x49c0dd
lea ecx, [ebp - 0x530]
mov dword [ebp - 0x530], 1
push ecx
push eax
push esi
push 2
mov ecx, edi
call fcn.00493e90
cmp dword [ebp - 0x530], 0
mov ecx, dword [ebp - 0x520]
mov dword [ecx], eax
je 0x49c130
mov eax, 1
jmp 0x49d639
cmp ecx, 0x10
jne 0x49c124
mov eax, dword [edi + 0x318]
nop
cmp eax, 1
jle 0x49c065
push 0
push 0x8033
push 0x111
mov byte [edi + 0x32c], 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
cmp ecx, 0x11f
je 0x49c22c
mov eax, dword fs:[0x2c]
mov ecx, dword [0x596df0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5969a0]
cmp eax, dword [ecx + 8]
jg 0x49d656
mov edx, dword [ebp + 0xc]
cmp edx, dword [0x59699c]
jne 0x49c242
mov eax, dword [edi + 0x320]
test byte [eax + 0x30], 0x40
je 0x49c18b
mov eax, dword [ebp - 0x520]
mov dword [edi + 0x320], 0
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
mov edx, dword [eax + 0x34]
lea eax, [edi + 0x324]
test edx, edx
jne 0x49c19c
xor ecx, ecx
jmp 0x49c1b6
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49c1a1
sub ecx, esi
lea eax, [edi + 0x324]
sar ecx, 1
push ecx
push edx
mov ecx, eax
call fcn.0040d3a0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1304
push dword [edi + 0xa8]
call esi
test eax, eax
je 0x49c21d
cmp byte [edi + 0x32c], 0
jne 0x49c21d
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], 8
push eax
push dword [edi + 0xd4]
xorps xmm0, xmm0
push 0x133c
push dword [edi + 0xa8]
movlpd qword [ebp - 0x70], xmm0
movlpd qword [ebp - 0x68], xmm0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
call esi
mov ecx, dword [ebp - 0x54]
jmp 0x49c21f
xor ecx, ecx
push 0
push dword [edi + 0x320]
call fcn.004af7e0
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
cmp edx, 0x4e
jne 0x49c2df
mov eax, dword [ebp - 0x524]
cmp dword [eax + 8], 0xfffffd1b
jne 0x49d302
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1304
push dword [edi + 0xa8]
call esi
test eax, eax
je 0x49c22c
cmp byte [edi + 0x32c], 0
jne 0x49c22c
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], 8
push eax
push dword [edi + 0xd4]
xorps xmm0, xmm0
push 0x133c
push dword [edi + 0xa8]
movlpd qword [ebp - 0x70], xmm0
movlpd qword [ebp - 0x68], xmm0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
call esi
mov ecx, dword [ebp - 0x54]
test ecx, ecx
je 0x49c22c
push 1
call fcn.004b07e0
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
cmp edx, 0x111
jne 0x49d197
movzx ecx, si
mov eax, 0x8033
cmp ax, cx
jne 0x49c399
cmp byte [edi + 0x32d], 0
jne 0x49c22c
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x5629d0
push 0x115
push 0x40b
push dword [edi + 0x204]
call esi
push 0
push 0
lea ecx, [edi + 0x40]
mov byte [edi + 0x32d], 1
push 0x8033
call fcn.004a01b0
push 1
call fcn.00430160
add esp, 4
push str.Cancelling...
push 0x100
push 0x40b
push dword [edi + 0x204]
call esi
mov esi, dword [edi + 0x308]
mov eax, dword [edi + 0x30c]
mov edi, eax
cmp esi, edi
je 0x49c22c
mov ecx, dword [esi]
call fcn.004af530
add esi, 4
cmp esi, edi
jne 0x49c375
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
mov eax, 0x8037
cmp ax, cx
jne 0x49c3c5
push dword [edi + 0x2b8]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
mov eax, 0xe124
cmp ax, cx
jne 0x49c3fe
lea eax, [ebp - 0x530]
shr esi, 0x10
push eax
push dword [ebp - 0x524]
mov ecx, edi
push 0xe124
push esi
call fcn.00494cd0
mov ecx, dword [ebp - 0x520]
mov dword [ecx], eax
mov eax, 1
jmp 0x49d639
mov eax, 0x803d
cmp ax, cx
jne 0x49c41a
cmp dword [edi + 0x320], 0
je 0x49c22c
jmp 0x49c1bf
mov eax, 0x8041
cmp ax, cx
jne 0x49c49d
cmp dword [edi + 0x320], 0
je 0x49c22c
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1304
push dword [edi + 0xa8]
call esi
test eax, eax
je 0x49c494
cmp byte [edi + 0x32c], 0
jne 0x49c494
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], 8
push eax
push dword [edi + 0xd4]
xorps xmm0, xmm0
push 0x133c
push dword [edi + 0xa8]
movlpd qword [ebp - 0x70], xmm0
movlpd qword [ebp - 0x68], xmm0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
call esi
mov ecx, dword [ebp - 0x54]
push 1
jmp 0x49c221
xor ecx, ecx
push 1
jmp 0x49c221
mov eax, 0xe803
cmp ax, cx
jne 0x49c4e1
cmp byte [edi + 0x32d], 0
jne 0x49c22c
mov eax, dword [edi + 0x318]
nop
cmp eax, 1
jg 0x49c22c
mov ecx, edi
call fcn.0048b110
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
lea eax, [ecx + 0x100]
mov dword [ebp - 0x530], 0xfd
cmp ax, word [ebp - 0x530]
ja 0x49c522
lea eax, [ecx - 0xff00]
lea ecx, [edi + 0x84]
push eax
call fcn.0049edc0
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
mov eax, 0x801b
cmp ax, cx
jne 0x49c632
call fcn.0048e580
mov esi, eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x8c]
push 0x543c40
push eax
mov ecx, esi
call fcn.004a8b50
cmp dword [ebp - 0x7c], 0
mov eax, 1
mov dword [ebp - 0x538], 1
mov dword [ebp - 0x538], eax
setne byte [ebp - 0x525]
and eax, 0xfffffffe
mov dword [ebp - 0x538], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.00409020
cmp byte [ebp - 0x525], 0
je 0x49c22c
xor eax, eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x58], 0
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x54], 0
push 0x5629d0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.00408360
mov dword [ebp - 4], 2
cmp dword [ebp - 0x54], 8
lea eax, [ebp - 0x68]
mov ecx, esi
cmovae eax, dword [ebp - 0x68]
push eax
push 0x543c40
call fcn.004a96d0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x49c714
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49c70a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49d6a0
jmp 0x49c70a
mov eax, 0x801c
cmp ax, cx
jne 0x49c75a
call fcn.0048e580
mov esi, eax
mov dword [ebp - 4], 3
lea eax, [ebp - 0x8c]
push 0x543c40
push eax
mov ecx, esi
call fcn.004a8b50
cmp dword [ebp - 0x78], 8
lea ecx, [ebp - 0x8c]
push 9
cmovae ecx, dword [ebp - 0x8c]
push str.DarkTheme
push dword [ebp - 0x7c]
mov dword [ebp - 0x538], 2
push ecx
call fcn.0041ce20
mov ecx, 2
mov byte [ebp - 0x525], al
mov dword [ebp - 0x538], ecx
add esp, 0x10
and ecx, 0xfffffffd
mov dword [ebp - 0x538], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.00409020
cmp byte [ebp - 0x525], 0
jne 0x49c22c
xor eax, eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x58], 0
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x54], 0
push str.DarkTheme
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.00408360
mov dword [ebp - 4], 4
jmp 0x49c5d6
push edx
push ecx
call fcn.004d24a7
add esp, 8
xor eax, eax
mov dword [ebp - 0x58], 0
push eax
mov ecx, esi
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.004a9390
push 0
push 0
push 0x10
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.004a7ec0
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
mov eax, 0x802a
cmp ax, cx
jne 0x49c885
call fcn.0048e580
mov esi, eax
push str.AlwaysOnTop
mov ecx, esi
call fcn.00484860
neg eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x58], 0
lea ecx, [ebp - 0x68]
sbb eax, eax
mov dword [ebp - 0x54], 0
inc eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x52c], eax
xor eax, eax
push str.AlwaysOnTop
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.00408360
mov dword [ebp - 4], 5
lea eax, [ebp - 0x52c]
push 3
push eax
lea eax, [ebp - 0x68]
mov ecx, esi
push eax
call fcn.00484980
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x49c818
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49c80e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49d6a0
push edx
push ecx
call fcn.004d24a7
add esp, 8
xor eax, eax
mov dword [ebp - 0x58], 0
push str.AlwaysOnTop
mov ecx, esi
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.00484860
push 3
push 0
xor ecx, ecx
mov esi, eax
push 0
push 0
test esi, esi
push 0
setne cl
add ecx, 0xfffffffe
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
lea ecx, [edi + 0x40]
test esi, esi
push 0
setne al
push eax
push 0x802a
call fcn.004a02a0
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
mov eax, 0x802b
cmp ax, cx
jne 0x49c99a
call fcn.0048e580
mov esi, eax
push str.HideEmptyEntries
mov ecx, esi
mov dword [ebp - 0x534], esi
call fcn.00484860
neg eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x58], 0
lea ecx, [ebp - 0x68]
sbb eax, eax
mov dword [ebp - 0x54], 0
inc eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x52c], eax
xor eax, eax
push str.HideEmptyEntries
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.00408360
mov dword [ebp - 4], 6
lea eax, [ebp - 0x52c]
push 3
push eax
lea eax, [ebp - 0x68]
mov ecx, esi
push eax
call fcn.00484980
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x49c949
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49c93f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49d6a0
push edx
push ecx
call fcn.004d24a7
add esp, 8
mov ecx, dword [ebp - 0x534]
xor eax, eax
push eax
push str.HideEmptyEntries
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.00484860
push eax
push 0x802b
lea ecx, [edi + 0x40]
call fcn.004a02a0
lea ecx, [edi + 0x3c]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
mov eax, 0x802d
cmp ax, cx
jne 0x49c9f9
call fcn.0048e580
mov edi, eax
push str.HideWindowsEntries
mov ecx, edi
call fcn.00484860
neg eax
mov ecx, edi
sbb eax, eax
inc eax
mov dword [ebp - 0x52c], eax
lea eax, [ebp - 0x52c]
push eax
call fcn.0048f5b0
mov esi, dword [ebp - 0x534]
mov ecx, edi
push 0
push str.HideWindowsEntries
call fcn.00484860
push eax
push 0x802d
lea ecx, [esi + 0x40]
call fcn.004a02a0
mov ecx, esi
add ecx, 0x3c
jmp 0x49c97f
mov eax, 0x802c
cmp ax, cx
jne 0x49cb3d
call fcn.0048e580
mov esi, eax
push str.HideMicrosoftEntries
mov ecx, esi
call fcn.00484860
neg eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x58], 0
lea ecx, [ebp - 0x68]
sbb eax, eax
mov dword [ebp - 0x54], 0
inc eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x52c], eax
xor eax, eax
push str.HideMicrosoftEntries
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.00408360
mov dword [ebp - 4], 7
lea eax, [ebp - 0x52c]
push 3
push eax
lea eax, [ebp - 0x68]
mov ecx, esi
push eax
call fcn.00484980
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x49cab7
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49caad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49d6a0
push edx
push ecx
call fcn.004d24a7
add esp, 8
xor eax, eax
mov dword [ebp - 0x58], 0
push eax
push str.HideMicrosoftEntries
mov ecx, esi
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.00484860
push eax
push 0x802c
lea ecx, [edi + 0x40]
call fcn.004a02a0
push str.HideMicrosoftEntries
mov ecx, esi
call fcn.00484860
test eax, eax
je 0x49cb23
lea eax, [ebp - 0x52c]
mov dword [ebp - 0x52c], 1
push eax
mov ecx, esi
call fcn.0048f5b0
push 0
push 1
push 0x802d
lea ecx, [edi + 0x40]
call fcn.004a02a0
xor eax, eax
jmp 0x49cb28
mov eax, 1
push 0
push eax
push 0x802d
lea ecx, [edi + 0x40]
call fcn.004a01b0
jmp 0x49c97c
mov eax, 0x802e
cmp ax, cx
jne 0x49cc31
call fcn.0048e580
mov esi, eax
push str.HideVirusTotalCleanEntries
mov ecx, esi
mov dword [ebp - 0x534], esi
call fcn.00484860
neg eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x58], 0
lea ecx, [ebp - 0x68]
sbb eax, eax
mov dword [ebp - 0x54], 0
inc eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x52c], eax
xor eax, eax
push str.HideVirusTotalCleanEntries
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.00408360
mov dword [ebp - 4], 8
lea eax, [ebp - 0x52c]
push 3
push eax
lea eax, [ebp - 0x68]
mov ecx, esi
push eax
call fcn.00484980
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x49cc01
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49cbf7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49d6a0
push edx
push ecx
call fcn.004d24a7
add esp, 8
mov ecx, dword [ebp - 0x534]
xor eax, eax
push eax
push str.HideVirusTotalCleanEntries
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.00484860
push eax
push 0x802e
jmp 0x49c974
mov eax, 0x802f
cmp ax, cx
jne 0x49cc6a
lea eax, [ebp - 0x530]
shr esi, 0x10
push eax
push dword [ebp - 0x524]
mov ecx, edi
push 0x802f
push esi
call fcn.00497650
mov ecx, dword [ebp - 0x520]
mov dword [ecx], eax
mov eax, 1
jmp 0x49d639
mov eax, 0x8030
cmp ax, cx
jne 0x49cca3
lea eax, [ebp - 0x530]
shr esi, 0x10
push eax
push dword [ebp - 0x524]
mov ecx, edi
push 0x8030
push esi
call fcn.00496b90
mov ecx, dword [ebp - 0x520]
mov dword [ecx], eax
mov eax, 1
jmp 0x49d639
mov eax, 0xe141
cmp ax, cx
jne 0x49ccd2
push 0
push 0
push 0x10
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
mov eax, 0x801d
cmp ax, cx
jne 0x49cd0e
push 1
push 0
push 0
push str.https:__docs.microsoft.com_en_us_sysinternals_downloads_autoruns
push str.open
push dword [ebp - 0x524]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
mov eax, 0xe140
cmp ax, cx
jne 0x49ce60
lea eax, [ebp - 0x554]
mov dword [ebp - 0x558], 0
mov dword [ebp - 0x53c], eax
mov dword [ebp - 0x548], 0
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x544], 0
mov dword [ebp - 0x540], 0
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x55c], 0x5437c4
mov dword [ebp - 4], 0xe
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
mov eax, dword [ebp - 0x548]
test eax, eax
jne 0x49cd9d
call fcn.004b878d
mov dword [ebp - 0x548], eax
test eax, eax
jne 0x49cd9d
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x49ce1c
push 0
push 0
push eax
call fcn.004b888f
lea eax, [ebp - 0x55c]
mov dword [ebp - 0x554], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x550], eax
mov dword [ebp - 0x7c], 0x58f20c
mov byte [ebp - 0x78], 0
mov byte [ebp - 4], 0xf
push 0x58f20c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x58f224]
mov dword [ebp - 0x54c], eax
lea eax, [ebp - 0x554]
mov byte [ebp - 0x78], 1
mov dword [0x58f224], eax
mov byte [ebp - 4], 0xe
push 0x58f20c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x49f560
push esi
push 0x64
push dword [0x596a20]
mov byte [ebp - 0x78], 0
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x554]
mov dword [ebp - 0x53c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x548]
test eax, eax
je 0x49c22c
push eax
call fcn.004b8839
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
mov eax, 0x801f
cmp ax, cx
jne 0x49cea3
call fcn.004a7f30
mov byte [ebp - 0x525], al
test al, al
je 0x49ce8e
push 0
push 0
push 0x10
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov al, byte [ebp - 0x525]
mov ecx, dword [ebp - 0x520]
movzx eax, al
mov dword [ecx], eax
mov eax, 1
jmp 0x49d639
mov eax, 0xe103
cmp ax, cx
jne 0x49cedc
lea eax, [ebp - 0x530]
shr esi, 0x10
push eax
push dword [ebp - 0x524]
mov ecx, edi
push 0xe103
push esi
call fcn.00494a20
mov ecx, dword [ebp - 0x520]
mov dword [ecx], eax
mov eax, 1
jmp 0x49d639
mov eax, 0xe101
cmp ax, cx
jne 0x49d047
mov ax, word [0x5441cc]
movups xmm0, xmmword [str.Computer]
push 0x2e
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push 0
push eax
movups xmmword [ebp - 0x50], xmm0
call fcn.004d52d0
add esp, 0xc
mov dword [ebp - 0x52c], 0x20
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov esi, dword [edi + 4]
lea eax, [ebp - 0x51c]
push 0x58
push 0
push eax
mov dword [ebp - 0x4c4], 1
call fcn.004d52d0
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0x51c], 0x58
mov dword [ebp - 0x500], eax
lea eax, [ebp - 0x4c0]
mov dword [ebp - 0x4f8], eax
mov eax, dword [0x596a20]
mov dword [ebp - 0x514], eax
xor eax, eax
mov word [ebp - 0x2c0], ax
mov word [ebp - 0x4c0], ax
lea eax, [ebp - 0x50]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0x4fc], 0x104
push 0x104
push eax
mov dword [ebp - 0x4e0], 0x544240
mov dword [ebp - 0x4f4], 0x100
mov dword [ebp - 0x4e8], 0x881000
mov dword [ebp - 0x510], str.Autoruns_files__.arn_
mov dword [ebp - 0x518], esi
call fcn.004fc358
push eax
call fcn.0040f8f0
add esp, 0x20
mov dword [ebp - 0x4ec], str.Open_Autoruns_Scan
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [ebp - 0x518]
test ecx, ecx
cmove ecx, eax
cmp dword [ebp - 0x4c4], 0
lea eax, [ebp - 0x51c]
mov dword [ebp - 0x518], ecx
push eax
je 0x49d015
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
jmp 0x49d01b
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x49c22c
lea eax, [ebp - 0x2c0]
mov ecx, edi
push eax
call fcn.00498250
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
mov eax, 0x8007
cmp ax, cx
jne 0x49d080
lea eax, [ebp - 0x530]
shr esi, 0x10
push eax
push dword [ebp - 0x524]
mov ecx, edi
push 0x8007
push esi
call fcn.00496840
mov ecx, dword [ebp - 0x520]
mov dword [ecx], eax
mov eax, 1
jmp 0x49d639
mov eax, 0x8029
cmp ax, cx
jne 0x49d0b9
lea eax, [ebp - 0x530]
shr esi, 0x10
push eax
push dword [ebp - 0x524]
mov ecx, edi
push 0x8029
push esi
call fcn.00494330
mov ecx, dword [ebp - 0x520]
mov dword [ecx], eax
mov eax, 1
jmp 0x49d639
lea eax, [ecx - 0x1388]
cmp ax, 0x63
ja 0x49d2fc
mov esi, dword [edi + 0x7c]
lea eax, [esi + 0x1388]
cmp ecx, eax
je 0x49d14d
mov eax, dword [edi + 0x318]
nop
cmp eax, 1
jle 0x49d118
mov ecx, dword [edi + 4]
push 0x30
push ecx
mov eax, esp
push ecx
mov dword [eax], 0x81
mov eax, esp
mov dword [eax], str.Cannot_switch_profiles_while_scanning._Wait_or_cancel_the_scan.
push ecx
call fcn.00477060
mov eax, dword [ebp - 0x520]
add esp, 0x10
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
lea eax, [ecx - 0x1388]
mov ecx, edi
push eax
call fcn.0049f8c0
test al, al
jne 0x49d143
mov ecx, dword [edi + 4]
push 0x40
push ecx
mov eax, esp
push ecx
mov dword [eax], 0x10
mov eax, esp
mov dword [eax], str.Error_loading_profile.
jmp 0x49d0f9
mov ecx, edi
call fcn.0048b110
mov esi, dword [edi + 0x7c]
mov ecx, dword [edi + 0x74]
mov eax, 0x38e38e39
sub ecx, dword [edi + 0x70]
imul ecx
push 0
sar edx, 4
lea ecx, [edi + 0x40]
mov eax, edx
add edx, 0x1387
shr eax, 0x1f
add eax, edx
push eax
push 0x1388
lea eax, [esi + 0x1388]
push eax
call fcn.004a03b0
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
cmp edx, 0x18
jne 0x49d2fc
cmp byte [0x596994], 0
jne 0x49c22c
mov byte [0x596994], 1
call fcn.0048e580
mov esi, eax
mov dword [ebp - 0x68], 0
xor eax, eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
lea ecx, [ebp - 0x68]
push str.MainWindowPlacement
mov dword [ebp - 0x52c], esi
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.00408360
mov dword [ebp - 4], 0x15
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
mov ecx, esi
push eax
call fcn.004857d0
mov esi, dword [ebp - 0x78]
cmp byte [esi + 0xd], 0
jne 0x49d23a
cmp dword [esi + 0x24], 8
lea ecx, [esi + 0x10]
jb 0x49d221
mov ecx, dword [ecx]
cmp dword [ebp - 0x54], 8
lea eax, [ebp - 0x68]
push ecx
cmovae eax, dword [ebp - 0x68]
push eax
call fcn.004fb9d0
add esp, 8
test eax, eax
jns 0x49d242
mov esi, dword [ebp - 0x52c]
mov esi, dword [esi]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x49d283
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49d279
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49d6a0
push edx
push ecx
call fcn.004d24a7
add esp, 8
xor eax, eax
mov dword [ebp - 0x58], 0
mov word [ebp - 0x68], ax
mov dword [ebp - 0x54], 7
mov eax, dword [esi + 0x44]
movups xmm1, xmmword [eax]
movups xmmword [ebp - 0xb8], xmm1
movups xmm0, xmmword [eax + 0x10]
psrldq xmm1, 8
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [ebp - 0x98], xmm0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x90], eax
movd eax, xmm1
test eax, eax
je 0x49c22c
lea eax, [ebp - 0xb8]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPlacement]
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
mov eax, dword [ebp - 0x524]
lea ecx, [edi + 0x40]
cmp edx, 0x117
jne 0x49d349
lea edx, [ebp - 0x534]
mov dword [ebp - 0x534], 1
push edx
push eax
push esi
push 0x117
call fcn.00495e50
cmp dword [ebp - 0x534], 0
mov ecx, dword [ebp - 0x520]
mov dword [ecx], eax
je 0x49d485
mov eax, 1
jmp 0x49d639
cmp edx, 0x111
jne 0x49d3f6
xor edx, edx
cmp byte [ecx + 0x16], dl
je 0x49d3b9
mov eax, esi
shr eax, 0x10
cmp eax, 1
jne 0x49d3b9
mov edx, dword [edi + 0x50]
mov ecx, dword [ecx + 0xc]
movzx eax, si
mov dword [ebp - 0x78], eax
test edx, edx
je 0x49d3b7
movzx eax, word [ecx]
mov dword [ebp - 0x530], 0xffff
cmp ax, word [ebp - 0x530]
je 0x49d3b7
nop dword [eax]
cmp word [ebp - 0x78], ax
je 0x49d3d7
movzx eax, word [ecx + 4]
add ecx, 4
mov edi, eax
add edx, 8
mov dword [ebp - 0x53c], edi
mov edi, dword [ebp - 0x534]
cmp ax, word [ebp - 0x530]
jne 0x49d390
xor edx, edx
mov ecx, dword [ebp - 0x520]
mov dword [ecx], 0
test edx, edx
je 0x49d485
mov eax, 1
jmp 0x49d639
mov eax, 0x100
mov ecx, 0
test word [edx], ax
mov eax, 1
cmovne ecx, eax
mov dword [ebp - 0x53c], ecx
mov edx, ecx
jmp 0x49d3b9
cmp edx, 5
jne 0x49d417
cmp esi, 1
je 0x49d409
push 1
mov ecx, edi
call fcn.004a0ac0
mov ecx, dword [ebp - 0x520]
mov dword [ecx], 1
jmp 0x49d485
cmp edx, 0x4e
jne 0x49d47f
mov ecx, dword [eax + 8]
cmp ecx, 0xfffffcbe
jne 0x49d446
push 0
mov ecx, edi
call fcn.004a0ac0
mov eax, dword [ebp - 0x520]
mov dword [eax], 0
mov eax, 1
jmp 0x49d639
cmp ecx, 0xfffffcb7
jne 0x49d47f
lea ecx, [ebp - 0x534]
mov dword [ebp - 0x534], 1
push ecx
push eax
push esi
mov ecx, edi
call fcn.00492120
cmp dword [ebp - 0x534], 0
mov ecx, dword [ebp - 0x520]
mov dword [ecx], eax
jne 0x49c238
jmp 0x49d485
mov ecx, dword [ebp - 0x520]
mov eax, dword [ebp + 0xc]
push 0
push ecx
push dword [ebp - 0x524]
mov ecx, edi
push esi
push eax
push dword [ebp - 0x52c]
call fcn.0049a270
test eax, eax
jne 0x49c238
mov ecx, dword [ebp + 0xc]
cmp ecx, 0x111
jne 0x49d522
push dword [edi + 0x88]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x49d503
mov eax, dword [edi + 0xd4]
test eax, eax
js 0x49d503
push eax
lea ecx, [edi + 0x84]
call fcn.0048eb30
push 1
push dword [ebp - 0x520]
push dword [ebp - 0x524]
mov ecx, dword [eax]
push esi
push 0x111
push dword [ebp - 0x52c]
mov edx, dword [ecx]
mov ecx, eax
call edx
test eax, eax
jne 0x49c238
mov ecx, dword [ebp + 0xc]
lea eax, [ecx - 0x2b]
cmp eax, 0xea
ja case.0x49d607.313
movzx eax, byte [eax + 0x49d6c8]
jmp dword [eax*4 + 0x49d6a8]
cmp ecx, 0x132
ja 0x49d5f3
jne 0x49d506
mov eax, dword [ebp - 0x524]
mov edx, eax
test edx, edx
je case.0x49d607.313
push eax
push esi
lea eax, [ecx + 0x2000]
push eax
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x520]
mov dword [ecx], eax
test eax, eax
jne 0x49c238
mov eax, dword [ebp + 0xc]
add eax, 0xfffffece
cmp eax, 6
jbe 0x49d637
mov eax, 1
jmp 0x49d639
mov eax, dword [ebp - 0x524]
xor edi, edi
test eax, eax
mov edx, eax
cmove edx, edi
jmp 0x49d538
mov eax, dword [ebp - 0x524]
mov edx, dword [eax]
jmp 0x49d538
test esi, esi
je case.0x49d607.313
mov eax, dword [ebp - 0x524]
mov edx, dword [eax + 0x14]
jmp 0x49d538
test esi, esi
je case.0x49d607.313
mov eax, dword [ebp - 0x524]
push dword [eax + 4]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [ebp + 0xc]
mov edx, eax
mov eax, dword [ebp - 0x524]
jmp 0x49d538
test esi, esi
je case.0x49d607.313
mov eax, dword [ebp - 0x524]
mov edx, dword [eax + 8]
jmp 0x49d538
test esi, esi
je case.0x49d607.313
mov eax, dword [ebp - 0x524]
mov edx, dword [eax + 0xc]
jmp 0x49d538
lea eax, [ecx - 0x133]
cmp eax, 0xdd
ja case.0x49d607.313
movzx eax, byte [eax + 0x49d7c0]
jmp dword [eax*4 + 0x49d7b4]
movzx eax, si
sub eax, 1
je case.0x49d607.307
sub eax, 1
je case.0x49d607.307
mov eax, esi
shr eax, 0x10
push eax
jmp 0x49d5b6
mov eax, dword [ebp - 0x520]
mov dword [eax], 1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d2a60
mov esp, ebp
pop ebp
ret 0x18
push 0x5969a0
call fcn.004d2972
add esp, 4
cmp dword [0x5969a0], 0xffffffff
jne 0x49c150
mov dword [ebp - 4], 0
push str.commdlg_FindReplace
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x59699c], eax
mov dword [ebp - 4], 0xffffffff
push 0x5969a0
call fcn.004d2928
add esp, 4
jmp 0x49c150
call fcn.004e0791
nop dword [eax]
xchg esi, eax
aad 73
add byte [ecx - 0x1effb62b], ch
aad 0x49
add byte [eax], dh
aad 0x49
add bh, cl
aad 0x49
add byte [ebp + edx*8 - 0x2a84ffb7], cl
dec ecx
add byte [ebx], ch
salc
dec ecx
add byte [eax], al
add dword [edx], eax
add eax, dword [ebx]
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
add al, 7
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
add eax, 117901063
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
push es
pop es
pop es
add eax, dword [ebx]
nop
xor ch, dl
dec ecx
add byte [esi], cl
salc
dec ecx
add byte [ebx], ch
salc
dec ecx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add esp, ecx
int3