Function at 0x4d9310
Capabilities:
Create process on windows
Encode data using xor
Get number of processors
Hash data with crc32
Open clipboard
Resolve function by parsing pe exports
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x61e0f2
mov eax, dword fs:[0]
push eax
sub esp, 0x540
mov eax, dword [0x69e3d4]
xor eax, esp
mov dword [esp + 0x538], eax
push ebx
push esi
push edi
mov eax, dword [0x69e3d4]
xor eax, esp
push eax
lea eax, [esp + 0x550]
mov dword fs:[0], eax
lea eax, [esp + 0x30]
mov esi, edx
push eax
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x38], 0
call fcn.004d8d40
test eax, eax
mov dword [esp + 0x20], eax
je 0x4da1ec
mov ecx, dword [esp + 0x30]
mov edx, dword [0x6a5d6c]
add edx, ecx
push edx
push eax
lea eax, [esp + 0x1dc]
push eax
call fcn.005aa4f0
mov esi, dword [0x6a5d68]
mov edx, dword [esp + 0x3c]
lea eax, [esi + edx]
mov cl, byte [esp + eax + 0x1e0]
lea eax, [esp + eax + 0x1e0]
add esp, 0xc
cmp cl, 0x3a
je 0x4d93bd
cmp cl, 0x3d
jne 0x4d9416
cmp cl, 0x3a
jne 0x4d93c0
mov byte [eax], 0x3d
mov ecx, dword [0x6a5d6c]
add ecx, edx
cmp byte [esp + ecx + 0x1d3], 0x3a
lea ecx, [esp + ecx + 0x1d4]
jne 0x4d93dd
mov byte [ecx - 1], 0x3d
lea edi, [esp + 0x1d4]
lea esi, [esp + esi + 0x1d5]
add esi, edx
mov dword [esp + 0x10], edi
mov edi, esi
mov byte [eax], 0
mov byte [ecx], 0
mov dword [esp + 0x18], esi
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4d9400
mov dx, word [0x65be1c]
mov word [edi], dx
jmp 0x4d941a
mov esi, dword [esp + 0x18]
push 0x2d
push esi
call fcn.005a6320
add esp, 8
test eax, eax
je 0x4d9442
lea esp, [esp]
push 0x2d
push esi
mov byte [eax], 0x2f
call fcn.005a6320
add esp, 8
test eax, eax
jne 0x4d9430
push 0x170
lea eax, [esp + 0x348]
push 0
push eax
call fcn.005ab440
add esp, 0xc
push 0
push 6
call fcn.005e043b
push eax
lea ecx, [esp + 0x190]
call fcn.004d39c0
mov ebx, vtable.CryptoPP::Base64Decoder.0
mov edi, vtable.CryptoPP::Base64Decoder.1.0
mov dword [esp + 0x184], ebx
mov dword [esp + 0x188], edi
push 0
push 6
mov dword [esp + 0x560], 0
call fcn.005e043b
push eax
lea ecx, [esp + 0x78]
call fcn.004d39c0
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], edi
mov byte [esp + 0x558], 1
mov ecx, dword [0x6bd08c]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4d94c0
mov edx, dword [esp + 0x184]
push 1
sub eax, edi
push 0xffffffffffffffff
push eax
mov eax, dword [edx + 0x14]
push ecx
lea ecx, [esp + 0x194]
call eax
lea ecx, [esp + 0x184]
push ecx
lea edx, [esp + 0xa8]
push edx
call fcn.004dc670
mov eax, esi
mov byte [esp + 0x558], 2
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4d9506
push 1
sub eax, ecx
push 0xffffffffffffffff
push eax
mov eax, dword [esp + 0x78]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [esp + 0x7c]
call edx
push 0x170
lea eax, [esp + 0x348]
push eax
lea ecx, [esp + 0x74]
call fcn.005d8ae6
mov ecx, dword [esp + 0x10]
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x4d9541
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x348]
sub ecx, esi
push edx
push ecx
push eax
lea ecx, [esp + 0xb4]
call fcn.005d82c0
movzx ebx, al
test ebx, ebx
je 0x4d9dc4
mov esi, dword [0x6bd08c]
mov edi, dword [esp + 0x10]
add esi, 0xfffffffa
cmp byte [edi + 5], 0x61
jle 0x4d96ba
xor ebx, ebx
lea ecx, [esp + 0x48]
push ecx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], 1
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], 0x64
mov dword [esp + 0x6c], 0xffffffff
call fcn.005affa3
mov dword [esp + 0x28], eax
and eax, edx
add esp, 4
cmp eax, 0xffffffff
mov dword [esp + 0x28], edx
jne 0x4d95d9
push 0x80070057
call fcn.004012f0
lea edx, [edi + 8]
push edx
call fcn.005a6475
add esp, 4
push ebx
cdq
push 0x15180
push edx
push eax
call fcn.005aa4b0
add dword [esp + 0x24], eax
push 0x65be20
push esi
adc dword [esp + 0x30], edx
call fcn.005a5af0
add esp, 8
cmp eax, esi
jne 0x4d9682
lea esi, [esp + 0x34]
call fcn.0041cbd0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x24]
sub eax, ecx
mov ecx, dword [esp + 0x28]
push ebx
push 0x15180
sbb ecx, edx
push ecx
push eax
call fcn.005af190
cmp edx, ebx
jl 0x4d9682
jg 0x4d963f
cmp eax, 0x1e
jbe 0x4d9682
lea ecx, [esp + 0x170]
mov byte [esp + 0x558], 1
call fcn.004da4b0
lea esi, [esp + 0x6c]
mov byte [esp + 0x558], 0
call fcn.004d3f40
lea esi, [esp + 0x184]
mov dword [esp + 0x558], 0xffffffff
call fcn.004d3f40
xor eax, eax
jmp 0x4da46f
lea ecx, [esp + 0x24]
call fcn.0041cba0
mov ebx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
mov dword [ebx + 0xf0], eax
call fcn.0041cb70
lea ecx, [esp + 0x24]
mov dword [ebx + 0xf4], eax
call fcn.0041cb00
mov dword [ebx + 0xf8], eax
xor esi, esi
jmp 0x4d9775
push 0x65be20
push esi
call fcn.005a5af0
add esp, 8
cmp eax, esi
jne 0x4d975d
lea ecx, [esp + 0x170]
mov byte [esp + 0x558], 1
call fcn.004da4b0
mov byte [esp + 0x558], 0
mov ecx, dword [esp + 0x9c]
mov eax, dword [esp + 0xa0]
push ecx
push 0
push eax
mov esi, eax
call fcn.005ab440
add esp, 0xc
push esi
call fcn.005655db
add esp, 4
lea ecx, [esp + 0x74]
call fcn.004de5f0
mov dword [esp + 0x558], 0xffffffff
mov edx, dword [esp + 0x1b4]
mov eax, dword [esp + 0x1b8]
push edx
push 0
push eax
mov esi, eax
call fcn.005ab440
add esp, 0xc
push esi
call fcn.005655db
add esp, 4
lea ecx, [esp + 0x18c]
call fcn.004de5f0
xor eax, eax
jmp 0x4da46f
mov ebx, dword [esp + 0x14]
xor esi, esi
mov dword [ebx + 0xf0], esi
mov dword [ebx + 0xf4], esi
mov dword [ebx + 0xf8], esi
cmp dword [esp + 0x30], esi
je 0x4d9797
mov eax, dword [0x6a5d68]
mov byte [eax + edi], 0
mov ecx, dword [0x6a5d68]
mov edx, dword [esp + 0x30]
lea esi, [ecx + edi + 1]
mov byte [esi + edx - 2], 0
movsx eax, byte [edi + 4]
sub eax, 0x30
push 0x200
mov dword [ebx + 0xec], eax
call fcn.005a854a
add esp, 4
mov dword [ebx + 0xe0], eax
cmp byte [edi + 0xc], 0x2d
mov dword [esp + 0x1c], 0x643e60
jne 0x4d97d0
lea ecx, [edi + 0xd]
mov dword [esp + 0x1c], ecx
mov byte [edi + 0xc], 0
test esi, esi
mov edi, esi
jne 0x4d97db
mov edi, str.Licensed_User
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x38]
call fcn.00404eb0
mov esi, eax
push edi
lea ecx, [esp + 0x30]
mov byte [esp + 0x55c], 3
call fcn.00404eb0
lea ecx, [esp + 0x24]
push str.LO:
push ecx
mov ecx, eax
mov byte [esp + 0x560], 4
call fcn.0040ef20
push str.SN:
push eax
lea edx, [esp + 0x4c]
push edx
mov byte [esp + 0x56c], 5
call fcn.00401c10
add esp, 0x14
push esi
push eax
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0x564], 6
call fcn.004049e0
add esp, 0xc
push 0x646c2c
push eax
lea ecx, [esp + 0x4c]
push ecx
mov byte [esp + 0x564], 7
call fcn.00401c10
mov eax, dword [eax]
mov ecx, dword [ebx + 0xe0]
add esp, 0xc
jmp 0x4d9870
mov dl, byte [eax]
mov byte [ecx], dl
add eax, 1
add ecx, 1
test dl, dl
jne 0x4d9870
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4d989e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x558], 6
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d98c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x558], 5
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d98ee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x558], 4
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d9916
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x558], 3
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d993e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x558], 2
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d9966
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov al, byte [ecx + 5]
cmp al, 0x53
je 0x4d9a2f
cmp al, 0x73
je 0x4d9a2f
cmp al, 0x57
je 0x4d9a0c
cmp al, 0x77
je 0x4d9a0c
mov eax, dword [ebx + 0xe0]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4d9996
mov edx, dword [str.NC:]
mov dword [eax], edx
mov cl, byte [0x646c28]
mov byte [eax + 4], cl
mov eax, dword [esp + 0x1c]
mov ecx, eax
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4d99b7
mov edx, dword [esp + 0x14]
mov edi, dword [edx + 0xe0]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x4d99d1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [edx + 0xe0]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4d99f2
mov dx, word [0x646c2c]
mov ebx, dword [esp + 0x14]
mov word [edi], dx
jmp 0x4d9a53
mov eax, dword [ebx + 0xe0]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4d9a15
mov ecx, dword [str.NC:_2]
mov dword [eax], ecx
mov edx, dword [0x65be48]
jmp 0x4d9a50
mov eax, dword [ebx + 0xe0]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4d9a38
mov ecx, dword [str.NC:_1]
mov dword [eax], ecx
mov edx, dword [0x65be40]
mov dword [eax + 4], edx
mov esi, dword [esp + 0x18]
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4d9a60
sub eax, edx
mov dword [ebx + 0xe4], eax
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4d9a76
sub eax, edx
add eax, 1
push eax
call fcn.005a854a
add esp, 4
mov dword [ebx + 0xe8], eax
mov ecx, esi
mov edx, eax
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x4d9a97
push 0x641d28
lea ecx, [ebx + 0xfc]
call fcn.004015c0
mov edx, dword [0x6bd06c]
mov eax, dword [edx + 0xe0]
mov dword [esp + 0x34], eax
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4d9ac8
sub eax, esi
mov edi, eax
xor ebx, ebx
cmp edi, 0xb
jle 0x4d9b4e
mov ecx, dword [edx + 0xe4]
cmp ecx, 0x10
jle 0x4d9b4e
xor eax, eax
test edi, edi
jle 0x4d9b14
mov edx, dword [esp + 0x34]
movzx edx, byte [edx + eax]
xor edx, ebx
and edx, 0xff
shr ebx, 8
xor ebx, dword [edx*4 + 0x6a5968]
add eax, 1
cmp eax, edi
jl 0x4d9aed
mov edx, dword [0x6bd06c]
xor eax, eax
test ecx, ecx
jle 0x4d9b43
mov esi, dword [edx + 0xe8]
movzx edx, byte [esi + eax]
xor edx, ebx
and edx, 0xff
shr ebx, 8
xor ebx, dword [edx*4 + 0x6a5968]
add eax, 1
cmp eax, ecx
jl 0x4d9b20
mov edx, dword [0x6bd06c]
test ebx, ebx
jne 0x4d9b4e
mov ebx, 0xb
jmp 0x4d9ae7
mov eax, dword [edx + 0xf0]
test eax, eax
je 0x4d9c13
mov esi, dword [edx + 0xf8]
mov edi, dword [edx + 0xf4]
xor ecx, ecx
cmp eax, 0x76c
setge cl
test ecx, ecx
jne 0x4d9b80
push 0x80004005
call fcn.004012f0
lea ecx, [edi - 1]
cmp ecx, 0xb
jbe 0x4d9b92
push 0x80004005
call fcn.004012f0
lea edx, [esi - 1]
cmp edx, 0x1e
jbe 0x4d9ba4
push 0x80004005
call fcn.004012f0
add eax, 0xfffff894
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0x3b
mov dword [esp + 0x54], 0x17
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x6c], 0xffffffff
call fcn.005affa3
mov ecx, eax
and ecx, edx
add esp, 4
cmp ecx, 0xffffffff
jne 0x4d9bf5
push 0x80070057
call fcn.004012f0
mov ecx, dword [0x6bd06c]
mov esi, dword [ecx + 0xac]
cmp esi, edx
jl 0x4d9c13
jg 0x4d9c11
mov edx, dword [ecx + 0xa8]
cmp edx, eax
jbe 0x4d9c13
xor ebx, ebx
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xe0]
push 0x65bc3c
push eax
call fcn.005a5af0
add esp, 8
add eax, 4
push eax
lea ecx, [esp + 0x38]
call fcn.00404eb0
mov ecx, 0x646c2c
lea esi, [esp + 0x10]
mov edi, eax
mov byte [esp + 0x558], 8
call fcn.0041c960
mov byte [esp + 0x558], 0xa
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d9c78
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
push 0x647048
push ecx
lea ecx, [esp + 0x18]
call fcn.0040ef20
push 0x646c2c
push eax
lea edx, [esp + 0x3c]
push edx
mov byte [esp + 0x56c], 0xb
call fcn.00401c10
mov eax, dword [eax]
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + 0xdc]
add esp, 0x14
push eax
push ecx
call fcn.005a5af0
mov esi, eax
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4d9cde
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x558], 0xa
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d9d06
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x4d9d0c
xor ebx, ebx
xor esi, esi
xor edi, edi
call fcn.004255b0
mov esi, eax
test esi, esi
je 0x4d9d8e
jmp 0x4d9d20
xor eax, eax
test esi, esi
setne al
test eax, eax
je 0x4d9b76
mov ecx, dword [esp + 0x10]
push esi
push ecx
call fcn.005a58c6
add esp, 8
test eax, eax
sete al
test al, al
je 0x4d9d75
push 0
call dword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
je 0x4d9d5e
call dword [sym.imp.user32.dll_EmptyClipboard]
call dword [sym.imp.user32.dll_CloseClipboard]
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x1a0]
test eax, eax
je 0x4d9d73
push 1
call eax
add esp, 4
xor ebx, ebx
push esi
call fcn.005a8a7b
add edi, 1
add esp, 4
mov esi, edi
call fcn.004255b0
mov esi, eax
test esi, esi
jne 0x4d9d20
mov ecx, dword [esp + 0x30]
mov eax, dword [0x6a5d6c]
add eax, ecx
mov dword [ebp + 8], eax
mov byte [esp + 0x558], 2
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4d9dc4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x170]
mov byte [esp + 0x558], 1
call fcn.004da4b0
mov byte [esp + 0x558], 0
mov ecx, dword [esp + 0x9c]
mov eax, dword [esp + 0xa0]
push ecx
push 0
push eax
mov esi, eax
call fcn.005ab440
add esp, 0xc
push esi
call fcn.005655db
add esp, 4
lea ecx, [esp + 0x74]
call fcn.004de5f0
mov dword [esp + 0x558], 0xffffffff
mov edx, dword [esp + 0x1b4]
mov eax, dword [esp + 0x1b8]
push edx
push 0
push eax
mov esi, eax
call fcn.005ab440
add esp, 0xc
push esi
call fcn.005655db
add esp, 4
lea ecx, [esp + 0x18c]
call fcn.004de5f0
test ebx, ebx
je 0x4da46d
cmp dword [0x6bd088], 0
je 0x4da07a
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.004d6aa0
mov dword [esp + 0x558], 0x11
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x184]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
add eax, 1
test cl, cl
jne 0x4d9e86
lea eax, [esp + 0x184]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4d9ea0
sub eax, edx
lea esi, [esp + eax + 0x183]
lea eax, [esp + 0x184]
cmp esi, eax
jbe 0x4d9ede
lea ecx, [ecx]
movsx ecx, byte [esi]
push ecx
call fcn.005a6165
add esp, 4
test eax, eax
je 0x4d9ede
sub esi, 1
lea edx, [esp + 0x184]
cmp esi, edx
ja 0x4d9ec0
push 0xa
add esi, 1
push 0
push esi
call fcn.005afcc6
add esp, 0xc
mov byte [esi], 0
cmp byte [esp + 0x184], 0
mov dword [esp + 0x34], eax
je 0x4da04f
xor edi, edi
mov dword [esp + 0x1c], 0
call fcn.00425630
mov edi, eax
test edi, edi
je 0x4da04f
lea esp, [esp]
lea eax, [esp + 0x184]
push eax
push edi
call fcn.005a5af0
add esp, 8
cmp eax, edi
jne 0x4da02c
lea edx, [esp + 0x184]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
add eax, 1
test cl, cl
jne 0x4d9f44
lea eax, [esp + 0x184]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4d9f60
sub eax, edx
lea esi, [esp + eax + 0x183]
lea ecx, [esp + 0x184]
cmp esi, ecx
jbe 0x4d9f9e
lea ecx, [ecx]
movsx edx, byte [esi]
push edx
call fcn.005a6165
add esp, 4
test eax, eax
je 0x4d9f9e
sub esi, 1
lea eax, [esp + 0x184]
cmp esi, eax
ja 0x4d9f80
push 0xa
add esi, 1
push 0
push esi
call fcn.005afcc6
add esp, 0xc
cmp dword [esp + 0x34], eax
jae 0x4da02c
push 0
call dword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
je 0x4d9fcc
call dword [sym.imp.user32.dll_EmptyClipboard]
call dword [sym.imp.user32.dll_CloseClipboard]
xor ebx, ebx
push ebx
push 0x80e
lea ecx, [esp + 0xac]
call fcn.0056be45
lea ecx, [esp + 0xa4]
mov byte [esp + 0x558], 0x12
call fcn.0056c4d8
cmp eax, 2
jne 0x4da018
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x84]
push 5
push 0x645b3c
push ebx
push eax
push 0x646230
push ebx
call dword [sym.imp.shell32.dll_ShellExecuteA]
lea ecx, [esp + 0xa4]
mov byte [esp + 0x558], 0x11
call fcn.0056bdba
push edi
call fcn.005a8a7b
mov edi, dword [esp + 0x20]
add edi, 1
add esp, 4
mov dword [esp + 0x1c], edi
call fcn.00425630
mov edi, eax
test edi, edi
jne 0x4d9f20
mov dword [esp + 0x558], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4da07a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, ebx
je 0x4da46d
cmp dword [ebp + 0xc], 0
je 0x4da46d
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x2c]
push str.Software_
lea ecx, [esi + 0x7c]
push edx
call fcn.0040ef20
push 0x645b40
push eax
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x56c], 0x13
call fcn.00401c10
add esp, 0x14
add esi, 0x24
push esi
push eax
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x564], 0x14
call fcn.004049e0
add esp, 0xc
mov byte [esp + 0x558], 0x16
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4da102
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x558], 0x17
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4da12a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push edx
push 0x80000001
mov dword [esp + 0x34], 0
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
mov esi, dword [sym.imp.advapi32.dll_RegSetValueExA]
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
jne 0x4da186
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push eax
push ecx
push 3
push 0
push 0x65bb58
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
mov edx, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push edx
push 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4da1ce
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push eax
push ecx
push 3
push 0
push 0x65bb58
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
call fcn.0056d592
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4da383
push 0x80004005
call fcn.004012f0
mov dword [esp + 0x20], esi
call fcn.004fe120
test eax, eax
jge 0x4da209
push eax
call fcn.0049f320
add esp, 4
xor eax, eax
jmp 0x4da46f
mov eax, dword [ebp + 8]
mov edi, dword [esp + 0x14]
push eax
push edi
mov ecx, esi
call fcn.004d7b00
mov ebx, eax
call fcn.004fe220
test eax, eax
jge 0x4da22d
push eax
call fcn.0049f320
add esp, 4
test ebx, ebx
je 0x4da46d
mov eax, dword [edi + 0x18]
test eax, eax
je 0x4d9e4a
cmp eax, dword [edi + 8]
jne 0x4da265
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x4da251
cmp eax, dword [edi + 0xc]
jne 0x4da265
mov eax, dword [edi + 0x20]
test eax, eax
je 0x4d9e4a
cmp eax, dword [edi + 0x10]
je 0x4d9e4a
lea ecx, [esp + 0x10]
xor ebx, ebx
call fcn.004014a0
lea ecx, [esp + 0x20]
mov dword [esp + 0x558], 0xc
call fcn.004014a0
push 0x698e
lea ecx, [esp + 0x14]
mov byte [esp + 0x55c], 0xd
call fcn.00404fb0
push 0x698f
lea ecx, [esp + 0x24]
call fcn.00404fb0
push edi
lea esi, [esp + 0x44]
call fcn.004d6bc0
mov dword [esp + 0x34], eax
push edi
lea esi, [esp + 0x40]
mov byte [esp + 0x55c], 0xe
call fcn.004d6bc0
mov esi, eax
push 0x6476c0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x564], 0xf
call fcn.00401c10
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
push eax
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0x564], 0x10
call fcn.004049e0
mov ecx, dword [esp + 0x40]
mov edx, dword [ecx]
mov ecx, dword [esi]
mov eax, dword [eax]
add esp, 0xc
push edx
mov edx, dword [edi + 0x24]
push ecx
mov ecx, dword [edi + 0x10]
push edx
mov edx, dword [edi + 0xc]
push ecx
mov ecx, dword [edi + 8]
push edx
push ecx
push eax
lea edx, [esp + 0x360]
push edx
call fcn.005a5a2e
add esp, 0x20
lea ecx, [esp + 0x2c]
call fcn.00401280
lea ecx, [esp + 0x24]
call fcn.00401280
lea ecx, [esp + 0x3c]
call fcn.00401280
lea ecx, [esp + 0x40]
mov byte [esp + 0x558], 0xd
call fcn.00401280
push ebx
push ebx
lea eax, [esp + 0x34c]
push eax
call fcn.00572369
lea ecx, [esp + 0x20]
call fcn.00401280
lea ecx, [esp + 0x10]
call fcn.00401280
jmp 0x4da46d
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov edi, dword [esp + 0x14]
mov byte [esp + 0x558], 0x18
cmp dword [edi + 0xf0], 0
lea eax, [edi + 0xa4]
jne 0x4da3b4
lea eax, [edi + 0xa0]
push eax
lea ecx, [esp + 0x1c]
call fcn.004074e0
mov ecx, dword [esp + 0x18]
push 0x647660
push ecx
call fcn.005a6c42
mov esi, eax
add esp, 8
test esi, esi
je 0x4da40c
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x20]
push esi
push edx
push 1
push eax
call fcn.005a8c68
push esi
call fcn.005a6e16
mov eax, dword [edi + 0x1a0]
add esp, 0x14
test eax, eax
je 0x4da401
push 0
call eax
add esp, 4
push 0xffffffffffffffff
push 0
push 0x6987
jmp 0x4da415
push 0xffffffffffffffff
push 0
push 0x6986
call fcn.005723b2
mov byte [esp + 0x558], 0x17
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4da442
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x558], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4da46d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x550]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x538]
xor ecx, esp
call fcn.005a58d9
mov esp, ebp
pop ebp
ret 8