Function at 0x48cd80
Capabilities:
Accept command line arguments
Acquire debug privileges
Get common file path
Get hostname
Get memory capacity
Initialize winsock library
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3850
mov eax, dword fs:[0]
push eax
mov eax, 0x4870
call fcn.004a1750
mov eax, dword [0x513b94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
push 0x118
mov dword [ebp - 0x47dc], eax
lea eax, [ebp - 0x268]
push 0
push eax
mov dword [ebp - 0x4830], edi
call fcn.004a3e00
add esp, 0xc
mov dword [ebp - 0x26c], 0x11c
lea eax, [ebp - 0x4828]
push eax
push 1
push 0
push 0x4ef958
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48ce40
lea eax, [ebp - 0x47c4]
mov dword [ebp - 0x47c4], 4
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x482c]
push eax
push 0
push 0x4ef9b4
push dword [ebp - 0x4828]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x4828]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4ef9bc
push 0x4ef9d0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
test eax, eax
je 0x48ce64
push 0x4dd79c
call eax
push 0x4ef9ec
push 0x4e74d4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
mov esi, eax
test esi, esi
je 0x48ceb2
lea eax, [ebp - 0x47e4]
mov dword [ebp - 0x47e4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
movzx eax, byte [0x518ed9]
mov ecx, 1
cmp dword [ebp - 0x47e4], 0
cmovne eax, ecx
mov byte [0x518ed9], al
lea eax, [ebp - 0x47c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [0x518ee0], edi
lea eax, [ebp - 0x47c4]
mov dword [ebp - 0x482c], esi
push eax
push 0x518ac8
mov dword [ebp - 0x47c4], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x104
push 0x518cd0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x5c
push 0x518cd6
call fcn.004a4db5
xor ecx, ecx
push esi
mov word [eax], cx
lea eax, [ebp - 0x47c0]
push eax
push 0x4de0b8
call fcn.00404de0
add esp, 0x14
test eax, eax
je 0x48d49c
push 1
push esi
lea eax, [ebp - 0x47c0]
push eax
push 0x4ef9fc
call fcn.00485510
push 0
mov edi, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efa0c
mov dword [ebp - 0x4818], edi
call fcn.00485510
push 0
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efa20
setne byte [ebp - 0x47f2]
call fcn.00485510
push 1
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efa38
setne byte [ebp - 0x47f1]
call fcn.00485510
add esp, 0x40
mov dword [ebp - 0x47cc], eax
lea eax, [ebp - 0x47c0]
push 1
push esi
push eax
push 0x4efa48
call fcn.00485510
push 1
mov dword [ebp - 0x4808], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efa58
call fcn.00485510
push 0
mov dword [ebp - 0x4804], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efa68
call fcn.00485510
push 0
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efa88
setne byte [ebp - 0x47d7]
call fcn.00485510
add esp, 0x40
test eax, eax
lea eax, [ebp - 0x47c0]
setne byte [ebp - 0x47ea]
push 1
push esi
push eax
push 0x4efaac
call fcn.00485510
push 1
mov dword [ebp - 0x480c], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4de67c
call fcn.00485510
push 1
mov dword [ebp - 0x481c], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efacc
call fcn.00485510
push 0
mov dword [ebp - 0x4814], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efae4
call fcn.00485510
add esp, 0x40
test eax, eax
lea eax, [ebp - 0x47c0]
setne byte [ebp - 0x47e6]
push 1
push esi
push eax
push 0x4efaf8
call fcn.00485510
push 1
mov dword [ebp - 0x47e4], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efb10
call fcn.00485510
push 0
mov dword [ebp - 0x4820], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efb2c
call fcn.00485510
push 0
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4ded38
setne byte [ebp - 0x47d6]
call fcn.00485510
add esp, 0x40
test eax, eax
lea eax, [ebp - 0x47c0]
setne byte [ebp - 0x47e7]
push 0
push esi
push eax
push 0x4efb44
call fcn.00485510
push 1
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efb5c
setne byte [ebp - 0x47f3]
call fcn.00485510
push 1
mov dword [ebp - 0x4800], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efb7c
call fcn.00485510
push 0
mov dword [ebp - 0x47f0], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efb98
call fcn.00485510
add esp, 0x40
test eax, eax
lea eax, [ebp - 0x47c0]
setne byte [ebp - 0x47c5]
push 0
push esi
push eax
push 0x4efbac
call fcn.00485510
test eax, eax
push 0
push esi
lea eax, [ebp - 0x47c0]
setne byte [ebp - 0x47e8]
push eax
push 0x4efbbc
call fcn.00485510
push 0
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efbd0
setne byte [ebp - 0x47d8]
call fcn.00485510
push 1
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efbdc
setne byte [ebp - 0x47e9]
call fcn.00485510
add esp, 0x40
mov dword [ebp - 0x4810], eax
lea eax, [ebp - 0x47c0]
push 0
push esi
push eax
push 0x4efbec
call fcn.00485510
push 0
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efbf0
setne byte [ebp - 0x47d5]
call fcn.00485510
add esp, 0x20
test eax, eax
je 0x48d215
or dword [0x5134c0], 8
push 0
push esi
lea eax, [ebp - 0x47c0]
push eax
push 0x4efc0c
call fcn.00485510
push 0
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4efc2c
setne byte [ebp - 0x47e5]
call fcn.00485510
add esp, 0x20
test eax, eax
setne byte [ebp - 0x47d0]
test edi, edi
jne 0x48d274
push edi
push esi
lea eax, [ebp - 0x47c0]
push eax
push 0x4dd79c
call fcn.00485510
add esp, 0x10
mov dword [ebp - 0x4818], eax
mov edi, eax
cmp byte [ebp - 0x47d5], 0
jne 0x48d2a6
test edi, edi
jne 0x48d2a6
call fcn.00464a30
test al, al
jne 0x48d2a6
mov al, byte [0x518ed9]
mov cl, byte [ebp - 0x47d0]
test al, al
je 0x48d29d
test cl, cl
jne 0x48d2b1
mov byte [ebp - 0x47d4], 1
jmp 0x48d2b8
mov al, byte [0x518ed9]
mov cl, byte [ebp - 0x47d0]
mov byte [ebp - 0x47d4], 0
test al, al
je 0x48d2c4
test cl, cl
jne 0x48d2c4
mov al, 1
jmp 0x48d2c6
xor al, al
mov byte [ebp - 0x47fc], al
test edi, edi
je 0x48d309
test al, al
je 0x48d309
push 0x588
call fcn.004a0e21
add esp, 4
test eax, eax
je 0x48d2ee
mov ecx, eax
call fcn.004296c0
jmp 0x48d2f0
xor eax, eax
push edi
mov ecx, eax
call fcn.00498380
cmp eax, 0xffffffff
je 0x48d309
and al, 1
neg al
sbb al, al
and byte [ebp - 0x47fc], al
mov al, byte [ebp - 0x47d4]
test al, al
je 0x48d3c2
lea eax, [ebp - 0x47f8]
mov dword [ebp - 0x47c4], 0
push eax
push 0x4efc38
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x48d375
lea eax, [ebp - 0x4834]
mov dword [ebp - 0x4834], 4
push eax
lea eax, [ebp - 0x47c4]
push eax
push 0
push 0
push 0x4efcac
push dword [ebp - 0x47f8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x47f8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 6
call fcn.00455090
add esp, 0xc
test al, al
je 0x48d390
cmp dword [ebp - 0x47c4], 0
jne 0x48d3bc
push 0
push ecx
mov edi, esp
push 0x4efcc0
call fcn.0049c580
push eax
push 0x4efcc0
call fcn.0049c710
add esp, 0xc
mov dword [edi], eax
call fcn.004664c0
add esp, 8
jmp 0x48d49c
mov al, byte [ebp - 0x47d4]
cmp byte [ebp - 0x47fc], 0
jne 0x48e4f2
test al, al
jne 0x48e4f2
mov eax, dword [ebp - 0x4820]
test eax, eax
je 0x48d3f6
push eax
push 0x104
push 0x5188a8
call fcn.004b4900
add esp, 0xc
jmp 0x48d408
push 0x104
push 0x5188a8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 0x4804]
mov dword [ebp - 0x47d4], 0
test eax, eax
je 0x48d42e
mov dword [ebp - 0x47d4], 2
mov dword [ebp - 0x47cc], eax
jmp 0x48d450
mov eax, dword [ebp - 0x4808]
test eax, eax
je 0x48d44a
mov dword [ebp - 0x47d4], 1
mov dword [ebp - 0x47cc], eax
jmp 0x48d450
mov eax, dword [ebp - 0x47cc]
cmp byte [ebp - 0x47d5], 0
jne 0x48e4d3
cmp dword [ebp - 0x47c0], 1
jne 0x48e422
cmp byte [ebp - 0x47d6], 0
je 0x48d480
cmp dword [ebp - 0x47e4], 0
jne 0x48e422
test eax, eax
je 0x48d4c7
test edi, edi
jne 0x48d4c7
push 0x10
push 0x4de0b8
push 0x4efdf8
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a0e13
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x480c]
test ecx, ecx
je 0x48d50e
push ecx
push dword [0x518edc]
call fcn.004828f0
add esp, 8
test al, al
je 0x48d689
push 0
mov ecx, 0x5181b8
call fcn.0042c390
push 0
call fcn.004699e0
add esp, 4
mov ecx, 0x5181b8
push 0
call fcn.0042a1c0
xor edi, edi
jmp 0x48d4a1
cmp byte [ebp - 0x47d7], 0
je 0x48d573
test eax, eax
jne 0x48d573
push 0x4efe70
call fcn.0049c580
push eax
push 0x4efe70
call fcn.0049c710
add esp, 0xc
mov dword [ebp - 0x47c4], eax
lea ecx, [ebp - 0x47c4]
push 0x10
push 0x4de0b8
call fcn.0049c120
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x47c4]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x48d49c
call fcn.0049c750
jmp 0x48d49c
mov ecx, 0x5181b8
call fcn.0042b7b0
test al, al
jne 0x48d592
push 0x10
push 0x4de0b8
push 0x4efef8
jmp 0x48d494
cmp byte [ebp - 0x47f1], 0
je 0x48d5db
xor edi, edi
nop dword [eax]
push 0
push 0x4eeee8
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x48d5c4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x64
jl 0x48d5a0
jmp 0x48d49c
push 0
push 0
push 0x8009
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
jmp 0x48d4a1
mov ecx, dword [ebp - 0x4810]
or eax, 0xffffffff
mov dword [ebp - 0x4824], eax
test ecx, ecx
je 0x48d63b
lea eax, [ebp - 0x4824]
push eax
push 0x4df700
push ecx
call fcn.00452510
add esp, 0xc
cmp eax, 1
je 0x48d619
push 0x10
push 0x4de0b8
push 0x4effc0
jmp 0x48d494
mov eax, dword [ebp - 0x4824]
test eax, eax
je 0x48d62a
cmp eax, 0xe10
jbe 0x48d63b
push 0x10
push 0x4de0b8
push 0x4f0020
jmp 0x48d494
cmp byte [ebp - 0x47ea], 0
je 0x48d65b
push eax
push 1
push 1
push 0
call fcn.00422410
add esp, 0x10
movzx edi, al
jmp 0x48d4a1
cmp byte [ebp - 0x47f2], 0
je 0x48d690
push 0
push 0x4eeee8
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x48d49c
push 0
push 0
push 0x800a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
jmp 0x48d4a1
mov eax, dword [0x518f40]
test eax, eax
je 0x48d6aa
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x518f40], 0
push 0
push 0x4000000
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0x3c
mov dword [0x518f40], eax
lea eax, [ebp - 0x4c]
push 0
push eax
mov dword [ebp - 0x50], 0x40
call fcn.004a3e00
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x48]
mov edx, 0xaaaaaaab
mov eax, dword [ebp - 0x44]
shld eax, ecx, 1
add ecx, ecx
add ecx, 0xc4653600
adc eax, 0xffffffff
mov dword [ebp - 0x47c4], eax
mov eax, ecx
mul edx
mov dword [ebp - 0x47e0], eax
mov edi, edx
mov eax, ecx
mov ecx, 0xaaaaaaaa
mul ecx
mov ecx, 0xaaaaaaab
mov dword [ebp - 0x4808], edx
mov dword [ebp - 0x480c], eax
mov eax, dword [ebp - 0x47c4]
mul ecx
mov dword [ebp - 0x4810], edx
mov ecx, eax
mov eax, dword [ebp - 0x47c4]
mov edx, 0xaaaaaaaa
mul edx
add ecx, edi
mov dword [ebp - 0x4820], edx
mov edx, dword [ebp - 0x4810]
adc edx, 0
mov dword [ebp - 0x4804], eax
mov eax, dword [ebp - 0x480c]
add eax, ecx
mov ecx, dword [ebp - 0x4808]
mov dword [ebp - 0x47e0], eax
adc ecx, 0
xor eax, eax
add edx, ecx
mov ecx, dword [ebp - 0x4804]
adc eax, eax
add ecx, edx
mov edx, dword [ebp - 0x4820]
adc edx, eax
shrd ecx, edx, 1
shr edx, 1
mov dword [0x518ef8], ecx
mov dword [0x518efc], edx
test edx, edx
jg 0x48d7cc
jl 0x48d7af
cmp ecx, 0x800000
jae 0x48d7c0
mov dword [0x518ef8], 0x800000
mov ecx, 0x800000
jmp 0x48d7db
test edx, edx
jne 0x48d7cc
cmp ecx, 0x3e800000
jb 0x48d7e3
mov dword [0x518ef8], 0x3e800000
mov ecx, 0x3e800000
xor edx, edx
mov dword [0x518efc], edx
add ecx, 0x2000000
push 0x4f008c
adc edx, 0
mov dword [0x518f00], ecx
mov dword [0x518f04], edx
call fcn.00422ad0
add esp, 4
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push 1
push 0x4f00b0
push 0x4f00d4
push 0x4de130
push dword [ebp - 0x47d0]
call fcn.00462be0
push 0x190
lea eax, [ebp - 0x3fc]
push 0
push eax
call fcn.004a3e00
add esp, 0x20
lea eax, [ebp - 0x3fc]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push fcn.004882a0
call fcn.004b8409
push 1
call fcn.004b8879
add esp, 8
push 1
push 0x4828c0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 1
push 0x1ff
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
cmp byte [0x518ed9], 0
mov ecx, 0x4f0148
push 0
push 0x518ab4
push 0
push 0xf003f
push 0
push 0
mov eax, 0x4f00f8
cmove eax, ecx
push 0
push eax
push reloc.WS2_32.dll_accept
mov dword [0x518ab8], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push dword [0x518ab4]
lea ecx, [ebp - 0x47e0]
call fcn.004951c0
lea eax, [ebp - 0x47e0]
push eax
call fcn.00495aa0
add esp, 4
lea ecx, [ebp - 0x47e0]
call fcn.00405010
push dword [0x513660]
mov ecx, 0x5181b8
call fcn.0042d8a0
mov edi, dword [ebp - 0x4814]
test edi, edi
je 0x48d97c
lea ecx, [ebp - 0x150]
call fcn.00482040
push 0
push 1
push edi
lea ecx, [ebp - 0x150]
call fcn.0045ea60
test al, al
jne 0x48d945
push 0x10
push 0x4de0b8
push 0x4f0198
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x150]
call fcn.00429d20
mov edi, 2
jmp 0x48d4a1
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x47e0]
call fcn.004951a0
lea eax, [ebp - 0x47e0]
push eax
call fcn.00495aa0
add esp, 4
lea ecx, [ebp - 0x47e0]
call fcn.00405010
lea ecx, [ebp - 0x150]
call fcn.00429d20
cmp byte [ebp - 0x47f3], 0
je 0x48da02
mov eax, dword [ebp - 0x4800]
mov byte [0x513a88], 1
test eax, eax
je 0x48d9b7
push eax
call fcn.004afad4
mov edx, dword [0x513a8c]
add esp, 4
lea ecx, [eax - 0x64]
cmp ecx, 0xf3c
cmovbe edx, eax
mov dword [0x513a8c], edx
mov eax, dword [ebp - 0x47f0]
test eax, eax
je 0x48d9e1
push eax
call fcn.004afad4
mov edx, dword [0x513a90]
add esp, 4
lea ecx, [eax - 1]
cmp ecx, 0xe
cmovbe edx, eax
mov dword [0x513a90], edx
jmp 0x48d9e7
mov edx, dword [0x513a90]
test edx, edx
jne 0x48da02
movzx eax, byte [0x513a88]
xor ecx, ecx
cmp dword [0x513a8c], ecx
cmove eax, ecx
mov byte [0x513a88], al
cmp byte [ebp - 0x47e5], 0
je 0x48da12
or dword [0x5134c0], 0x10
cmp byte [ebp - 0x47e6], 0
je 0x48da91
push 0x51823c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x518258]
mov ecx, dword [0x518254]
cmp ecx, eax
je 0x48da4e
push 0x518254
push eax
push ecx
call fcn.0041e320
mov eax, dword [0x518254]
add esp, 0xc
mov dword [0x518258], eax
push 0
mov ecx, 0x51823c
mov dword [0x518264], 0
call fcn.004283e0
cmp byte [0x518260], 0
je 0x48da86
push 0
push dword [0x4df3d8]
mov ecx, 0x51823c
push 0
push 0x9c92
call fcn.00426c30
push 0x51823c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x518f10
push 0x4f01fc
push dword [0x518ab4]
call fcn.00464c00
mov eax, dword [ebp - 0x47e4]
add esp, 0xc
test eax, eax
je 0x48dadf
push 0
push 0x513880
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0x4de130
push 0x104
push 0x513880
call fcn.00463e70
add esp, 0xc
jmp 0x48daf0
cmp byte [ebp - 0x47d6], 0
je 0x48daf0
xor eax, eax
mov word [0x513880], ax
call fcn.00464b30
test al, al
je 0x48db07
or dword [0x5134c0], 0x40
mov byte [0x518edb], 1
mov eax, dword [0x51365c]
mov ecx, 1
cmp byte [ebp - 0x47e7], 0
push 2
cmovne eax, ecx
mov dword [0x51365c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call fcn.0049ec40
mov edi, dword [ebp - 0x4818]
test edi, edi
je 0x48dd74
mov eax, dword [ebp - 0x47cc]
test eax, eax
je 0x48dd74
push 0x2e
push eax
call fcn.004a500e
add esp, 8
test eax, eax
je 0x48dd63
push eax
call fcn.00493de0
add esp, 4
mov dword [ebp - 0x4814], eax
test eax, eax
js 0x48dd63
push 0
push edi
push 0
call fcn.00487da0
add esp, 0xc
test al, al
je 0x48d49c
cmp dword [ebp - 0x47d4], 1
mov ecx, 0x5181b8
push 0
setae byte [ebp - 0x4800]
cmp dword [ebp - 0x47d4], 2
setae byte [ebp - 0x47f0]
call fcn.0042c390
push dword [ebp - 0x47f0]
mov eax, dword [ebp - 0x4814]
mov ecx, 0x5181b8
push dword [ebp - 0x4800]
push 1
push dword [eax*8 + 0x5134a8]
movzx eax, byte [ebp - 0x47d7]
push eax
mov eax, dword [ebp - 0x47cc]
push eax
push 0
call fcn.00433e90
mov edi, eax
test edi, edi
je 0x48d689
push 0x4f026c
call fcn.0049c580
push eax
push 0x4f026c
call fcn.0049c710
add esp, 0xc
mov dword [ebp - 0x47d0], eax
cmp edi, 5
ja case.default.0x48dc1e
jmp dword [edi*4 + 0x48e560]
push 0x4ef154
call fcn.0049c580
push eax
push 0x4ef154
jmp 0x48dcec
push 0x4ef190
call fcn.0049c580
push eax
push 0x4ef190
jmp 0x48dcec
push 0x4ef1d8
call fcn.0049c580
push eax
push 0x4ef1d8
jmp 0x48dcec
push 0x4ef220
call fcn.0049c580
push eax
push 0x4ef220
jmp 0x48dcec
mov dword [ebp - 0x47d4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x47d4]
push eax
call fcn.00464150
mov ecx, dword [ebp - 0x47d4]
add esp, 8
mov dword [ebp - 0x47cc], ecx
test ecx, ecx
je 0x48dcb1
call fcn.0049c480
mov ecx, dword [ebp - 0x47d4]
mov dword [ebp - 4], 4
test ecx, ecx
je 0x48dcc1
call fcn.0049c750
mov dword [ebp - 4], 0xffffffff
jmp 0x48dcfa
push 0x4ef2e0
call fcn.0049c580
push eax
push 0x4ef2e0
jmp 0x48dcec
push 0x4ef298
call fcn.0049c580
push eax
push 0x4ef298
call fcn.0049c710
mov dword [ebp - 0x47cc], eax
add esp, 0xc
lea eax, [ebp - 0x47cc]
push eax
lea ecx, [ebp - 0x47d0]
call fcn.0049c380
mov ecx, dword [ebp - 0x47cc]
mov dword [ebp - 4], 5
test ecx, ecx
je 0x48dd22
call fcn.0049c750
push 0x10
push 0x4de0b8
lea ecx, [ebp - 0x47d0]
mov dword [ebp - 4], 0xffffffff
call fcn.0049c120
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x47d0]
mov dword [ebp - 4], 6
test ecx, ecx
je 0x48d49c
call fcn.0049c750
jmp 0x48d49c
push 0x10
push 0x4de0b8
push 0x4f0218
jmp 0x48d494
cmp byte [ebp - 0x47e8], 0
jne 0x48e3f7
push 0x4e66cc
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x518ab0], eax
lea eax, [ebp - 0x47e0]
push eax
mov dword [ebp - 0x47e0], 8
mov dword [ebp - 0x47dc], 0xf
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.00412880
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
mov ecx, edi
call fcn.00413ce0
push 0
push dword [ebp - 0x4830]
mov ecx, 0x5183b0
push 0
call fcn.00485bb0
mov eax, dword [0x517da0]
xorps xmm0, xmm0
add eax, 0x10
mov dword [ebp - 0x48], vtable.WTL::CMessageLoop.0
push eax
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x4800], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x5183e4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [edi + 8]
push 4
inc ecx
mov dword [ebp - 0x47f0], eax
push ecx
push dword [edi]
call fcn.004b477d
add esp, 0xc
test eax, eax
je 0x48de85
mov dword [edi], eax
mov eax, dword [edi + 8]
push 4
inc eax
push eax
push dword [edi + 4]
call fcn.004b477d
add esp, 0xc
test eax, eax
je 0x48de85
mov dword [edi + 4], eax
mov eax, dword [edi + 8]
lea ecx, [eax*4]
mov eax, dword [edi]
add eax, ecx
je 0x48de76
mov edx, dword [ebp - 0x47f0]
mov dword [eax], edx
mov eax, dword [edi + 4]
add eax, ecx
je 0x48de82
lea ecx, [ebp - 0x48]
mov dword [eax], ecx
inc dword [edi + 8]
push dword [ebp - 0x4800]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [sym.imp.USER32.dll_DefWindowProcW]
lea ecx, [ebp - 0x477c]
xorps xmm0, xmm0
mov dword [ebp - 0x47b8], 0
mov dword [ebp - 0x47a8], 0
mov dword [ebp - 0x47a4], 0
mov dword [ebp - 0x47a0], 0
mov dword [ebp - 0x479c], edi
movups xmmword [ebp - 0x4798], xmm0
call fcn.00481ea0
lea ecx, [ebp - 0x474c]
mov dword [ebp - 0x47bc], 0x4eeec0
mov dword [ebp - 0x4788], 0x4eeed4
mov dword [ebp - 0x4784], 0x4eeedc
mov dword [ebp - 0x4780], 0x4eeee4
call fcn.00481c70
push 0x208
xorps xmm0, xmm0
mov dword [ebp - 0x474c], 0x4eeeac
lea eax, [ebp - 0x604]
mov dword [ebp - 0x4688], 0
push 0
push eax
mov dword [ebp - 0x4678], 0
mov dword [ebp - 0x4674], 0
mov dword [ebp - 0x4670], 0
mov dword [ebp - 0x466c], edi
mov dword [ebp - 0x4668], 0
mov dword [ebp - 0x4664], 0
mov dword [ebp - 0x468c], 0x4eee10
mov dword [ebp - 0x4660], 0
mov dword [ebp - 0x465c], 0
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xffffffff
mov dword [ebp - 0x630], 0x28
movups xmmword [ebp - 0x62c], xmm0
mov dword [ebp - 0x60c], 0
movups xmmword [ebp - 0x61c], xmm0
mov dword [ebp - 0x608], 1
call fcn.004a3e00
add esp, 0xc
push 0
push 0
push 0
push ecx
mov eax, esp
lea ecx, [ebp - 0x47bc]
push 0
mov dword [eax], 0
call fcn.00482b80
test eax, eax
jne 0x48dff8
lea edi, [eax + 1]
jmp 0x48e3a7
cmp byte [ebp - 0x47d8], 0
je 0x48e008
mov eax, 2
jmp 0x48e016
mov eax, dword [ebp + 0x14]
mov ecx, 5
cmp eax, 1
cmove eax, ecx
push eax
push dword [ebp - 0x47b8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 0x47b8]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, 0x51823c
call fcn.00428350
test al, al
jne 0x48e187
cmp byte [ebp - 0x47d8], al
jne 0x48e187
cmp byte [ebp - 0x47e9], al
jne 0x48e187
movaps xmm0, xmmword [0x4e0630]
mov edi, dword [0x518edc]
mov dword [ebp - 0x4878], 0
mov dword [ebp - 0x4864], 0
mov dword [ebp - 0x4860], 0
mov dword [ebp - 0x485c], 0
mov dword [ebp - 0x4858], 0
mov dword [ebp - 0x4854], 0
mov byte [ebp - 0x4840], al
movups xmmword [ebp - 0x4850], xmm0
mov dword [ebp - method.CFilterDlg.virtual_0], vtable.CFilterDlg.0
mov dword [ebp - 0x483c], 0xb9
call fcn.004a26fc
mov dword [ebp - 0x4868], eax
test eax, eax
jne 0x48e0dc
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x48e146
push 0
push 0
push eax
call fcn.004a27fe
lea eax, [ebp - 0x487c]
mov dword [ebp - 0x4874], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x5131bc
mov dword [ebp - 0x4870], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x5131d4]
mov dword [ebp - 0x486c], eax
lea eax, [ebp - 0x4874]
push 0x5131bc
mov dword [0x5131d4], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, word [ebp - 0x483c]
push 1
push 0x440a20
push edi
push eax
push dword [0x5198e0]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov eax, dword [ebp - 0x485c]
test eax, eax
je 0x48e163
push eax
call fcn.004ae0f7
add esp, 4
mov dword [ebp - 0x485c], 0
mov eax, dword [ebp - 0x4868]
mov dword [ebp - 0x4858], 0
mov dword [ebp - 0x4854], 0
test eax, eax
je 0x48e187
push eax
call fcn.004a27a8
lea ecx, [ebp - 0x47bc]
call fcn.0045c330
push 0
push dword [0x518edc]
call fcn.004828f0
add esp, 8
test al, al
je 0x48e1b7
push 0
mov ecx, 0x5181b8
call fcn.0042c390
jmp 0x48e249
mov edi, dword [ebp - 0x4818]
test edi, edi
je 0x48e1f5
cmp byte [0x513655], 0
je 0x48e1e2
push 0
push 0x9c53
push 0x111
push dword [0x518edc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
push dword [0x518edc]
call fcn.00487da0
add esp, 0xc
jmp 0x48e249
cmp byte [ebp - 0x47c5], 0
jne 0x48e249
cmp byte [0x518ed9], 0
jne 0x48e249
mov eax, dword [ebp - 0x481c]
xorps xmm0, xmm0
cmp dword [ebp - 0x47e4], 0
movlpd qword [ebp - 0x47e0], xmm0
mov dword [ebp - 0x47dc], eax
setne byte [ebp - 0x47e0]
lea eax, [ebp - 0x47e0]
push eax
push 0x9c87
push 0x111
push dword [0x518edc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x4824]
cmp eax, 0xffffffff
je 0x48e26b
imul eax, eax, 0x3e8
push 0
push eax
push 2
push dword [0x518edc]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
xor edi, edi
mov dword [ebp - 0x47d0], eax
test eax, eax
je 0x48e2ad
nop dword [eax]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x48e2ad
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x48]
push edi
inc edi
mov edx, dword [eax + 8]
call edx
test eax, eax
jne 0x48e280
mov dword [ebp - 0x47d0], eax
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
mov ecx, eax
mov eax, dword [ebp - 0x47d0]
cmp ecx, 0xffffffff
je 0x48e278
test ecx, ecx
je 0x48e317
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
mov eax, dword [eax + 4]
call eax
test eax, eax
jne 0x48e2f5
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
mov eax, dword [eax + 0xc]
call eax
test eax, eax
mov eax, dword [ebp - 0x47d0]
je 0x48e278
jmp 0x48e26b
mov eax, dword [0x517da0]
mov edi, dword [ebp - 0x24]
add eax, 0x10
push eax
mov dword [ebp - 0x47f0], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x5183e4]
mov dword [ebp - 0x47c4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebp - 0x47c4]
xor ecx, ecx
mov dword [ebp - 0x481c], eax
mov eax, dword [edx + 8]
test eax, eax
jle 0x48e38b
mov edx, dword [edx]
nop word [eax + eax]
mov esi, dword [ebp - 0x481c]
cmp dword [edx], esi
mov esi, dword [ebp - 0x482c]
je 0x48e37a
inc ecx
add edx, 4
cmp ecx, eax
jl 0x48e360
jmp 0x48e38b
cmp ecx, 0xffffffff
je 0x48e38b
push ecx
mov ecx, dword [ebp - 0x47c4]
call fcn.0048a790
push dword [ebp - 0x47f0]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, 0x5183b0
call fcn.0048bc30
call dword [sym.imp.ole32.dll_OleUninitialize]
lea ecx, [ebp - 0x47bc]
call fcn.004823e0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], vtable.WTL::CMessageLoop.0
test eax, eax
je 0x48e3d0
push eax
call fcn.004ae0f7
add esp, 4
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
test eax, eax
je 0x48d4a1
push eax
call fcn.004ae0f7
add esp, 4
jmp 0x48d4a1
call fcn.00469010
push 0
call fcn.004699e0
push 0x518f10
push 0x4f01fc
push dword [0x518ab4]
call fcn.004660a0
add esp, 0x10
xor edi, edi
jmp 0x48d4a1
push 0x4efdd0
call fcn.0049c580
push eax
push 0x4efdd0
call fcn.0049c710
mov edi, dword [esi + 4]
push edi
mov dword [ebp - 0x47f8], eax
call fcn.0049c580
push eax
push edi
call fcn.0049c710
add esp, 0x18
mov dword [ebp - 0x47c4], eax
lea eax, [ebp - 0x47c4]
lea ecx, [ebp - 0x47f8]
push eax
lea eax, [ebp - 0x47e4]
push eax
call fcn.0049c250
mov ecx, dword [ebp - 0x47c4]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x48e485
call fcn.0049c750
mov ecx, dword [ebp - 0x47f8]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x48e49b
call fcn.0049c750
push 0x10
push 0x4de0b8
lea ecx, [ebp - 0x47e4]
mov dword [ebp - 4], 0xffffffff
call fcn.0049c120
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x47e4]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x48e4d3
call fcn.0049c750
push 0
push 0x41c240
push 0
push 0x4e6c94
push dword [ebp - 0x4830]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x48d49c
push dword [ebp - 0x47dc]
lea ecx, [ebp - 0x47dc]
call fcn.00421f20
mov eax, dword [eax]
test eax, eax
je 0x48e50d
mov eax, dword [eax]
jmp 0x48e50f
xor eax, eax
push dword [ebp - 0x47d4]
push dword [ebp - 0x47fc]
push eax
push dword [ebp + 0x14]
call fcn.00465c20
add esp, 0x10
mov byte [ebp - 0x47c5], al
lea ecx, [ebp - 0x47dc]
call fcn.00402620
cmp byte [ebp - 0x47c5], 0
jne 0x48d689
push 0
push ecx
mov edi, esp
push 0x4efd38
call fcn.0049c580
push eax
push 0x4efd38
jmp 0x48d3a5