Function at 0x495ab6
Capabilities:
Create thread
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x533a8a
mov eax, dword fs:[0]
push eax
sub esp, 0x748
mov eax, dword [0x585698]
xor eax, esp
mov dword [esp + 0x740], eax
push ebx
push esi
push edi
mov eax, dword [0x585698]
xor eax, esp
push eax
lea eax, [esp + 0x758]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, 0x44f
cmp eax, esi
ja 0x49606c
je 0x496020
lea ecx, [eax - 0x3e8]
cmp ecx, 0xe
ja case.0x49608f.1116
push 2
pop edi
jmp dword [ecx*4 + 0x496bbe]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
xor esi, esi
lea eax, [esp + 0x6c]
push esi
push eax
mov dword [esp + 0x74], esi
call fcn.0044f993
pop ecx
pop ecx
cmp eax, 1
je 0x495b5c
cmp eax, esi
je 0x495b5c
push esi
push 0x55575453
push ebx
call fcn.00499863
jmp 0x495b86
mov eax, dword [0x588740]
lea ecx, [eax - 0x2710]
push esi
cmp ecx, 0x323390
ja 0x495b73
push eax
jmp 0x495b78
push 0x325aa0
push 0x3ec
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
lea esi, [ebx + 0x1214]
mov dword [esp + 0x20], edi
call fcn.00480524
test eax, eax
je 0x495b9e
call fcn.004805d2
xor esi, esi
inc esi
push esi
lea edi, [ebx + 0x1258]
call fcn.004c28b1
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x70]
push eax
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
xor edi, edi
push str.statsofttime
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x80], 0xb
mov dword [esp + 0x78], 8
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call fcn.004056ee
push ecx
mov dword [esp + 0x774], esi
mov eax, esp
mov dword [esp + 0x2c], esp
push str.SOFTWARE360TotalSecurityUserProfile
push eax
call fcn.004056ee
or dword [esp + 0x774], 0xffffffff
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [esp + 0xb0]
push eax
mov ecx, edi
call fcn.0040499a
call fcn.00404811
add esp, 0xc
lea esi, [esp + 0x98]
call fcn.00401105
and dword [esp + 0x54], edi
and dword [esp + 0x58], edi
lea eax, [esp + 0x54]
push eax
call fcn.004f5c9c
pop ecx
cmp eax, 0xffffffff
jne 0x495c5c
cmp edx, eax
jne 0x495c5c
mov dword [esp + 0x14], 1
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x58]
sub ecx, edx
sbb eax, dword [esp + 0x28]
xor esi, esi
cmp eax, esi
jg 0x495c80
jl 0x495c7a
cmp ecx, esi
jae 0x495c80
neg ecx
adc eax, esi
neg eax
or edx, dword [esp + 0x28]
je 0x495c94
cmp eax, esi
jl 0x495c9c
jg 0x495c94
cmp ecx, 0x93a80
jbe 0x495c9c
mov dword [esp + 0x14], 1
cmp dword [esp + 0x14], esi
je 0x495d01
cmp dword [ebx + 0x1210], esi
jne 0x495cd8
push 0x590f51
push 0x14
call fcn.004f5c13
pop ecx
pop ecx
cmp eax, esi
je 0x495cd0
mov dword [eax], esi
mov dword [eax + 4], 0xff
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
jmp 0x495cd2
xor eax, eax
mov dword [ebx + 0x1210], eax
mov ebx, dword [ebx + 0x1210]
cmp ebx, esi
je 0x495d01
push esi
push esi
push ebx
push 0x42a6a2
push esi
push esi
mov dword [ebx + 0xc], 0x48faca
mov dword [ebx + 0x10], esi
call fcn.004f5629
add esp, 0x18
mov dword [ebx + 8], eax
cmp dword [esp + 0x20], 2
sete al
movzx eax, al
push eax
call fcn.0049f6a2
xor eax, eax
mov ecx, dword [esp + 0x758]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x740]
xor ecx, esp
call fcn.004f189b
mov esp, ebp
pop ebp
ret 8
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x55575453
push ebx
call fcn.00499863
mov dword [esp + 0x20], 1
jmp 0x495d01
mov dword [esp + 0x20], edi
jmp 0x495d01
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.00498018
jmp 0x495d12
mov ecx, 0x3f5
xor edi, edi
cmp eax, ecx
jne 0x495dac
xor esi, esi
cmp dword [0x588758], edi
je 0x495d8f
mov dword [0x588758], edi
jmp 0x495d99
cmp dword [0x59379c], edi
jbe 0x495d9a
xor esi, esi
inc esi
push ecx
push dword [ebx + 4]
mov dword [0x5937a0], edi
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x495dd4
cmp eax, 0x3ed
jne 0x495ddd
push edi
push ecx
call int.0040b2f7
add esp, 4
call fcn.0047795e
cmp eax, 1
je 0x495ddd
call fcn.0049c846
inc dword [0x59379c]
mov esi, eax
cmp esi, 1
jne 0x495d12
push edi
push 0x41554156
push ebx
call fcn.00499863
jmp 0x495d12
push 0
push 0x54555054
jmp 0x495de3
push 0
push 0x54554d54
jmp 0x495de3
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
lea esi, [esp + 0x48]
mov dword [esp + 0x44], eax
call fcn.004048e0
lea eax, [ebx + 0x4ac]
mov dword [esp + 0x760], 2
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x760], 3
mov eax, dword [ebx + 0x4a8]
test eax, eax
je 0x495ec4
lea esi, [ebx + 0x490]
mov eax, dword [esi + 0x14]
mov ebx, dword [eax]
mov eax, dword [esi]
test eax, eax
jne 0x495eeb
call fcn.004f2996
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x495e71
call fcn.004f2996
add ebx, 8
mov eax, ebx
lea edi, [esp + 0x44]
call fcn.00404477
lea eax, [ebx + 4]
lea edi, [esp + 0x48]
call fcn.00404477
mov eax, dword [ebx + 8]
mov ecx, dword [esi]
mov ebx, dword [ebx + 0xc]
mov dword [esp + 0x4c], eax
mov eax, dword [esi + 0x14]
mov eax, dword [eax]
push eax
push ecx
lea eax, [esp + 0x78]
push eax
mov edi, esi
mov dword [esp + 0x5c], ebx
call fcn.004a4cb2
push ebx
push dword [esp + 0x50]
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x50]
call fcn.004484c0
add esp, 0xc
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
call fcn.00405521
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
call fcn.00405521
jmp 0x495d12
mov eax, dword [eax]
jmp 0x495e67
mov edi, 0x3f0
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [0x593800], 0
je 0x495d12
push 0
mov esi, ebx
call fcn.004a2670
test al, al
je 0x495f42
test byte [0x5957d0], 1
jne 0x495f2b
call fcn.0044a44c
jmp 0x495f30
mov al, byte [0x5957cc]
test al, al
jne 0x495f42
push ebx
call fcn.00499d45
test eax, eax
jne 0x495d12
push 0
push 0x927c0
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x495d12
push 0x3f3
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
test byte [0x5957d0], 1
jne 0x495f76
call fcn.0044a44c
jmp 0x495f7b
mov al, byte [0x5957cc]
test al, al
jne 0x495d12
mov ecx, ebx
call fcn.00499e24
jmp 0x495d12
add ebx, 0x370
push ebx
call fcn.0047b66c
jmp 0x495d12
push 0x3f6
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.00485560
test eax, eax
je 0x495ffa
xor edi, edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
lea esi, [esp + 0x38]
mov dword [esp + 0x760], 0x15
call fcn.00485692
test eax, eax
je 0x495fe1
mov eax, esi
push eax
call fcn.00485ae1
cmp dword [esp + 0x3c], edi
je 0x495d12
push dword [esp + 0x3c]
call fcn.004f1890
pop ecx
jmp 0x495d12
xor esi, esi
push esi
push esi
push esi
push 0x4855cf
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
je 0x495d12
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x495d12
mov eax, ebx
call fcn.0049a2f4
test eax, eax
je 0x495d12
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
and dword [ebx + 0x4c4], 0
call fcn.0043fa0c
lea eax, [esp + 0x64]
push eax
call fcn.004a7b61
pop ecx
mov dword [esp + 0x760], 4
push dword [eax]
call fcn.00440129
mov eax, dword [esp + 0x68]
pop ecx
jmp 0x495ede
mov ecx, 0x4a6
cmp eax, ecx
ja 0x49668a
je 0x4964e4
push 0x12
add eax, 0xfffffbb0
pop esi
cmp eax, esi
ja case.0x49608f.1116
jmp dword [eax*4 + 0x496bfa]
mov esi, 0x455
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
lea edi, [ebx + 0x24]
mov eax, dword [edi]
mov dword [esp + 0x18], eax
call fcn.00449525
push eax
mov eax, dword [esp + 0x1c]
mov ecx, edi
call dword [eax + 0x24]
xor edi, edi
cmp eax, edi
je 0x4960d4
push str.true
push eax
call fcn.004f5171
pop ecx
pop ecx
test eax, eax
je 0x49610b
call fcn.00448249
test eax, eax
jne 0x49610b
push edi
push 0x43504d41
push ebx
call fcn.00499863
mov eax, dword [0x588744]
lea ecx, [eax - 0x2710]
push edi
cmp ecx, 0x1496ff0
ja 0x496104
push eax
push esi
jmp 0x495f4a
push 0x1499700
jmp 0x4960fe
mov eax, dword [0x588748]
lea ecx, [eax - 0x2710]
push edi
cmp ecx, 0x36c770
jbe 0x4960fd
push 0x36ee80
jmp 0x4960fe
mov eax, ebx
call fcn.0049aaac
jmp 0x495d12
mov ecx, ebx
call fcn.0049b0b9
jmp 0x495d12
mov eax, ebx
call fcn.0049b4b6
jmp 0x495d12
mov esi, ebx
call fcn.0049c6e5
jmp 0x495d12
mov edi, ebx
call fcn.0049c727
jmp 0x495d12
mov esi, ebx
call fcn.0049c7e4
jmp 0x495d12
lea esi, [ebx + 0x24]
mov edi, dword [esi]
call fcn.00449525
push eax
mov ecx, esi
call dword [edi + 0x24]
test eax, eax
je 0x496197
push str.true
push eax
call fcn.004f5171
pop ecx
pop ecx
test eax, eax
je 0x495d12
call fcn.00448249
test eax, eax
jne 0x495d12
call fcn.0049336f
test al, al
je 0x495d12
push 0x454
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [ebx + 0xb68]
call fcn.004bf2fe
lea esi, [ebx + 0x980]
mov eax, esi
call fcn.004bf2fe
push 0
push dword [ebx + 0x524]
push esi
call fcn.004bf636
jmp 0x495d12
push ebx
call fcn.0049d5ea
jmp 0x495d12
mov eax, ebx
call fcn.0049da6d
jmp 0x495d12
mov edi, ebx
call fcn.004a0ecb
jmp 0x495d12
mov eax, ebx
call fcn.004a106a
jmp 0x495d12
mov esi, ebx
call fcn.004a10d7
jmp 0x495d12
mov eax, ebx
call fcn.004a120a
jmp 0x495d12
push 0x461
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov al, byte [ebx + 0x1104]
xor esi, esi
test al, al
jne 0x496359
cmp dword [ebx + 0x974], esi
jne 0x495d12
push 0x590f51
push 0x30
call fcn.004f5c13
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
je 0x496280
call fcn.0040a7d3
mov dword [edi], vtable.TS::AddFileMonitor.0
mov byte [edi + 0x2c], 1
jmp 0x496282
xor edi, edi
mov dword [ebx + 0x974], edi
cmp edi, esi
je 0x495d12
xor eax, eax
push 0x206
mov word [esp + 0x340], ax
lea eax, [esp + 0x342]
push esi
push eax
call fcn.004f18b0
add esp, 0xc
lea eax, [esp + 0x33c]
push eax
push esi
push esi
push 0x10
pop edi
push edi
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x495d12
lea eax, [esp + 0x33c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.004056ee
mov dword [esp + 0x760], edi
mov eax, dword [esp + 0x30]
cmp dword [eax - 0xc], esi
je 0x495ede
push eax
lea eax, [esp + 0xac]
call fcn.004043d1
mov byte [esp + 0x760], 0x11
push dword [ebx + 0x974]
lea ecx, [esp + 0xac]
call fcn.0040a8ff
push 0
push 1
lea esi, [esp + 0xb0]
mov byte [esp + 0x768], 0x10
call fcn.00404e29
mov eax, dword [ebx + 0x974]
mov ecx, dword [ebx + 4]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 0x101d
mov eax, dword [ebx + 0x974]
call fcn.0040a96e
mov eax, dword [esp + 0x30]
jmp 0x495ede
or dword [ebx + 0x1108], 4
jmp 0x495d12
push 0x45b
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov al, byte [ebx + 0x1104]
test al, al
jne 0x4964a8
cmp dword [ebx + 0x96c], 0
jne 0x495d12
push 0x590f51
push 0x2c
call fcn.004f5c13
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4963b1
call fcn.0040a7d3
mov dword [edi], vtable.TS::RecycleBinMonitor.0
mov eax, edi
jmp 0x4963b3
xor eax, eax
mov dword [ebx + 0x96c], eax
test eax, eax
je 0x495d12
xor eax, eax
push 0x206
push eax
mov word [esp + 0x54c], ax
lea eax, [esp + 0x54e]
push eax
call fcn.004f18b0
add esp, 0xc
push 0x208
lea eax, [esp + 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x495d12
lea eax, [esp + 0x544]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004056ee
mov dword [esp + 0x760], esi
push 0x5481d0
xor ecx, ecx
lea esi, [esp + 0x18]
call fcn.004299ad
mov ecx, eax
push 0
lea eax, [esp + 0x14]
push eax
inc ecx
mov eax, esi
call fcn.0042a1c6
mov byte [esp + 0x760], 0x13
mov edi, dword [esp + 0x10]
push edi
lea eax, [esp + 0x11c]
call fcn.004043d1
mov byte [esp + 0x760], 0x14
push dword [ebx + 0x96c]
lea ecx, [esp + 0x11c]
call fcn.0040a8ff
mov eax, dword [ebx + 0x96c]
mov ecx, dword [ebx + 4]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 0x101c
mov eax, dword [ebx + 0x96c]
call fcn.0040a96e
push 0
push 1
lea esi, [esp + 0x120]
call fcn.00404e29
lea eax, [edi - 0x10]
call fcn.00405521
mov eax, dword [esp + 0x14]
jmp 0x495ede
or dword [ebx + 0x1108], 2
jmp 0x495d12
push 0x45d
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.004a22d6
jmp 0x495d12
push 0x462
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.00496ec2
jmp 0x495d12
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push str.removepackge
xor ebx, ebx
push eax
mov dword [esp + 0x38], ebx
lea esi, [esp + 0x38]
call fcn.004056ee
push ecx
mov dword [esp + 0x768], 5
mov eax, esp
mov dword [esp + 0x20], esp
mov edi, str.SOFTWARE360TotalSecurityFastInstall
push edi
push eax
call fcn.004056ee
or dword [esp + 0x768], 0xffffffff
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [esp + 0x84]
push eax
mov ecx, ebx
call fcn.0040499a
push eax
call fcn.004047a8
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
pop ecx
lea esi, [esp + 0x78]
inc bl
call fcn.00401105
test bl, bl
je 0x496580
xor eax, eax
cmp dword [esp + 0x2c], eax
je 0x496580
push eax
push eax
push eax
push 0x4959ee
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x34], eax
push ecx
mov dword [esp + 0x764], 6
mov eax, esp
mov dword [esp + 0x20], esp
push str.lasttask
push eax
lea esi, [esp + 0x40]
xor ebx, ebx
call fcn.004056ee
push ecx
mov byte [esp + 0x768], 7
mov eax, esp
mov dword [esp + 0x18], esp
push edi
push eax
call fcn.004056ee
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [esp + 0x94]
push eax
mov ecx, ebx
mov byte [esp + 0x770], 6
call fcn.0040499a
push eax
mov byte [esp + 0x764], 8
call fcn.00404869
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
pop ecx
lea esi, [esp + 0x88]
inc bl
mov byte [esp + 0x760], 6
call fcn.00401105
mov esi, dword [esp + 0x34]
test bl, bl
je 0x496682
xor edi, edi
cmp dword [esi - 0xc], edi
je 0x496682
xor eax, eax
push 0x206
mov word [esp + 0x138], ax
lea eax, [esp + 0x13a]
push edi
push eax
call fcn.004f18b0
add esp, 0xc
push 0x104
lea eax, [esp + 0x138]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str....._softmgr360InstantSetup.exe
lea eax, [esp + 0x138]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
push 5
push str._tiplasttask
lea eax, [esp + 0x140]
call fcn.0044972a
add esp, 0xc
lea eax, [esi - 0x10]
jmp 0x495ee1
mov edi, 0x709
cmp eax, edi
ja 0x496a7f
je 0x496a09
mov ecx, 0x5dc
cmp eax, ecx
ja 0x4968c2
je 0x49675f
sub eax, 0x4b0
je 0x496751
dec eax
je 0x496737
sub eax, 0x63
je 0x4966d8
sub eax, 0x64
jne case.0x49608f.1116
mov esi, ebx
call fcn.0049d0fa
jmp 0x495d12
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
inc dword [0x594fb8]
push 0
mov edi, str.Q360InternationSafeClass
push edi
call esi
push eax
call fcn.00447a57
pop ecx
push 0
push edi
mov dword [esp + 0x18], eax
call esi
push eax
call fcn.00447989
cmp dword [esp + 0x14], 0
pop ecx
je 0x496710
test eax, eax
jne 0x49671d
cmp dword [0x594fb8], 5
jl 0x495d12
push 0x514
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
and dword [0x594fb8], 0
jmp 0x495d12
push 0x4b1
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, ebx
call fcn.0049b578
jmp 0x495d12
push 0
mov esi, ebx
call fcn.0049cd22
jmp 0x495d12
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
xor edi, edi
push edi
push str.IDS_PRODUCT_PUBLISHER
push 0xffffffffffffffff
lea ecx, [esp + 0xec]
call fcn.0043e727
add esp, 0xc
mov dword [esp + 0x760], 9
cmp dword [eax + 0x18], 8
jb 0x496798
mov eax, dword [eax + 4]
jmp 0x49679b
add eax, 4
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
push ecx
call fcn.004056ee
push edi
push str.IDS_PRODUCT_TITLE
push 0xffffffffffffffff
lea ecx, [esp + 0x10c]
mov byte [esp + 0x770], 0xa
call fcn.0043e727
add esp, 0xc
mov byte [esp + 0x764], 0xb
cmp dword [eax + 0x18], 8
jb 0x4967db
mov eax, dword [eax + 4]
jmp 0x4967de
add eax, 4
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
push ecx
call fcn.004056ee
push edi
push str.IDS_UNINSTALL_SHORTCUT_PTAH
push 0xffffffffffffffff
lea ecx, [esp + 0xd8]
mov byte [esp + 0x774], 0xc
call fcn.0043e727
add esp, 0xc
mov byte [esp + 0x768], 0xd
cmp dword [eax + 0x18], 8
jb 0x49681e
mov eax, dword [eax + 4]
jmp 0x496821
add eax, 4
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
push ecx
call fcn.004056ee
mov byte [esp + 0x76c], 0xf
call fcn.004a76a2
add esp, 0xc
push edi
push 1
lea esi, [esp + 0xcc]
call fcn.00404e29
push edi
push 1
lea esi, [esp + 0x104]
call fcn.00404e29
push edi
push 1
lea esi, [esp + 0xe8]
call fcn.00404e29
mov eax, dword [ebx + 0x1210]
cmp eax, edi
je 0x495d12
mov eax, dword [eax + 8]
cmp eax, edi
je 0x496895
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
neg eax
jne 0x495d12
mov esi, dword [ebx + 0x1210]
cmp esi, edi
je 0x4968b7
mov eax, dword [esi + 8]
cmp eax, edi
je 0x4968b0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], edi
push esi
call fcn.004f1890
pop ecx
mov dword [ebx + 0x1210], edi
jmp 0x495d12
mov ecx, 0x5e3
sub eax, ecx
je 0x496973
sub eax, 0x5d
je 0x49692e
sub eax, 0x64
je 0x496914
sub eax, 0x64
jne case.0x49608f.1116
mov esi, 0x708
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
jne 0x496906
push eax
push 0x3e8
jmp 0x4960fe
push 1
mov ecx, ebx
call fcn.0049f552
jmp 0x495d12
push 0x6a4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov edi, ebx
call fcn.0049e2e6
jmp 0x495d12
mov eax, dword [ebx + 0x67c]
test eax, eax
je 0x495d12
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x495d12
push 0x640
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
lea esi, [ebx + 0x6d4]
movzx eax, byte [esi]
push eax
call fcn.00495a5d
pop ecx
mov byte [esi], 0
jmp 0x495d12
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0043fa7f
call fcn.0044f91d
test al, al
je 0x4969f1
call fcn.0044f958
test al, al
je 0x4969f1
cmp dword [ebx + 0x6a8], 0
jne 0x4969d6
push 0x590f51
push 0x1c8
call fcn.004f5c13
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
and dword [esp + 0x760], 0
test eax, eax
je 0x4969c6
push eax
call fcn.004a942b
jmp 0x4969c8
xor eax, eax
or dword [esp + 0x760], 0xffffffff
mov dword [ebx + 0x6a8], eax
mov eax, dword [ebx + 0x6a8]
test eax, eax
je 0x495d12
push dword [ebx + 4]
call fcn.004a9f40
jmp 0x495d12
push 0
push 0x8000
call fcn.00436f62
pop ecx
pop ecx
call fcn.0043f80d
jmp 0x495d12
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
xor esi, esi
push esi
push dword [0x588764]
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
lea eax, [esp + 0x5c]
call fcn.004059e3
lea ecx, [esp + 0x40]
push str.UtilsPopTip.exe
push ecx
mov edi, eax
mov dword [esp + 0x768], 0x16
call fcn.00405a46
pop ecx
pop ecx
mov byte [esp + 0x760], 0x18
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
call fcn.00405521
mov eax, dword [esp + 0x40]
push esi
push 5
push esi
call fcn.0044972a
add esp, 0xc
call fcn.0048fee4
mov eax, dword [esp + 0x40]
jmp 0x495ede
mov ecx, 0x70e
cmp eax, ecx
ja 0x496b54
je 0x496b3e
sub eax, 0x70a
je 0x496ad5
dec eax
je 0x496ac9
dec eax
je 0x496ab1
dec eax
jne case.0x49608f.1116
push ebx
call fcn.004a154d
jmp 0x495d12
push 0x70c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0049e64f
jmp 0x495d12
mov ecx, ebx
call fcn.004a126a
jmp 0x495d12
push 0
push 0
call fcn.0044f993
pop ecx
pop ecx
test eax, eax
jne 0x496b2b
xor esi, esi
push esi
push esi
push 2
push esi
push 0xff
call fcn.0044fb26
mov edi, dword [ebx + 4]
add esp, 0x14
push esi
push 0x3e8
push 4
lea eax, [esp + 0x28]
push eax
push 0x41505343
mov dword [esp + 0x30], 0x50533f07
call fcn.0043bf4b
add esp, 0x14
mov esi, ebx
call fcn.0049cce2
mov edi, ebx
call fcn.004982fd
push 0x70a
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x495d12
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov edi, ebx
call fcn.0049e3b0
jmp 0x495d12
mov ecx, 0x70f
sub eax, ecx
je 0x496ba7
dec eax
je 0x496b8e
sub eax, 0xac
je 0x496b82
sub eax, 0x3fd
je 0x496b76
and dword [edx], 0
jmp 0x495d12
call fcn.004993c1
push 0xbb9
jmp 0x496b30
mov eax, ebx
call fcn.0049c77e
jmp 0x495d12
push 0x710
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push ebx
call fcn.0049e473
jmp 0x495d12
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0049e418
jmp 0x495d12