Function at 0x443022
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4deeec
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x56f710]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x10], ebx
call fcn.004051e4
push 0xe5
lea esi, [ebx + 0xbc]
call section..text
push 0xe3
lea esi, [ebx + 0xcc]
call section..text
push 0xea
lea esi, [ebx + 0xdc]
call section..text
push 0xe7
lea esi, [ebx + 0xec]
call section..text
call fcn.00492c24
fld qword [0x54cc40]
mov eax, dword [eax + 0xc]
push ecx
push ecx
fstp qword [esp]
push 0x1b0
push dword [ebx + 0x20]
lea ecx, [ebx + 0xfc]
mov edx, eax
call fcn.0040b93f
push 0x6c
push 0
push ecx
mov dword [esp + 0x28], esp
mov esi, esp
push 0x52dc10
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
mov edi, str.RESOURCESTRING
push edi
call fcn.0040254f
and dword [esp + 0x64], 0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x53c890
call fcn.0040254f
or dword [esp + 0x68], 0xffffffff
push esi
call fcn.00406eff
add ebx, 0x3e0
call fcn.0045d6a7
add esp, 0xc
push 0x6c
push 0
push ecx
mov dword [esp + 0x28], esp
mov esi, esp
push 0x52dc10
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
mov dword [esp + 0x30], eax
call fcn.0040254f
push ecx
mov dword [esp + 0x68], 1
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x53c890
call fcn.0040254f
or dword [esp + 0x68], 0xffffffff
push esi
call fcn.00406eff
mov esi, dword [esp + 0x1c]
lea ebx, [esi + 0x278]
call fcn.0045d6a7
add esp, 0xc
push 0x6c
push 0
push ecx
mov dword [esp + 0x28], eax
mov ebx, esp
mov dword [esp + 0x20], esp
push 0x52dc10
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push edi
call fcn.0040254f
push ecx
mov dword [esp + 0x68], 2
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.IDS_BTN_RESTORE_DEFAULTS
call fcn.0040254f
or dword [esp + 0x68], 0xffffffff
push ebx
call fcn.00406eff
lea ebx, [esi + 0x110]
mov dword [esp + 0x20], ebx
call fcn.0045d6a7
add esp, 0xc
mov dword [esp + 0x2c], eax
push 0x84
lea eax, [esp + 0x38]
push eax
call fcn.0043d336
mov dword [esp + 0x50], 3
mov eax, dword [esp + 0x3c]
mov ebx, dword [0x579008]
mov ecx, dword [esp + 0x14]
add eax, 0x1c
cdq
push 1
sub eax, edx
push 1
sar eax, 1
sub ebx, eax
push 1
push ebx
push 0x15
mov dword [esp + 0x34], ebx
call fcn.00492e98
push 0x1c
pop eax
push eax
push dword [esp + 0x30]
mov byte [esi + 0x354], 1
push ecx
mov dword [esp + 0x30], esp
mov byte [esi + 0x1ec], 1
mov byte [esi + 0x4bc], 1
mov esi, esp
push 0x52dc10
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x68], 4
mov ecx, esp
mov dword [esp + 0x40], esp
push str.IDS_BTN_RESTORE_DEFAULTS
call fcn.0040254f
push esi
mov byte [esp + 0x6c], 3
call fcn.00406eff
mov esi, dword [esp + 0x20]
push 0xa0
push 0x9f
push 0x9e
call fcn.004018ae
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
push 1
push 1
push 1
add eax, 0x27
push ebx
push eax
add ecx, 0x278
mov dword [esp + 0x28], ecx
call fcn.00492e98
push 0x1c
pop eax
push eax
push dword [esp + 0x20]
mov ebx, 0x52dc10
push ecx
mov dword [esp + 0x34], esp
mov esi, esp
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x68], 5
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x53b7b8
call fcn.0040254f
push esi
mov byte [esp + 0x6c], 3
call fcn.00406eff
mov esi, dword [esp + 0x20]
push 0x9d
push 0x9c
push 0x9b
call fcn.004018ae
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, 0xffffff
push 0
mov dword [esi + 0x3c4], eax
mov dword [esi + 0x3c0], eax
mov dword [esi + 0x3bc], eax
mov byte [esi + 0x35a], 1
call fcn.00492f1a
mov eax, dword [0x57900c]
sub eax, dword [esp + 0x18]
push 1
push 1
push 1
push dword [esp + 0x2c]
sub eax, 0x12
add esi, 0x3e0
push eax
mov ecx, esi
call fcn.00492e98
push 0x1c
pop eax
push eax
push dword [esp + 0x1c]
push ecx
mov dword [esp + 0x34], esp
mov esi, esp
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x68], 6
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x53c890
call fcn.0040254f
push esi
mov byte [esp + 0x6c], 3
call fcn.00406eff
mov esi, dword [esp + 0x1c]
push 0x9d
push 0x9c
add esi, 0x3e0
push 0x9b
mov dword [esp + 0x38], esi
call fcn.004018ae
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov eax, 0xffffff
push 1
mov dword [esi + 0x52c], eax
mov dword [esi + 0x528], eax
mov dword [esi + 0x524], eax
mov byte [esi + 0x4c2], 1
call fcn.00492f1a
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 7
mov ecx, esp
mov dword [esp + 0x30], esp
push str.string24
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 8
push dword [eax]
mov ecx, esi
push 0x136
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 9
mov ecx, esp
mov dword [esp + 0x30], esp
push str.IDS_APPLICATION
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0xa
push dword [eax]
mov ecx, esi
push 0x131
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0xb
mov ecx, esp
mov dword [esp + 0x30], esp
push str.IDS_FONTS
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0xc
push dword [eax]
mov ecx, esi
push 0x135
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0xd
mov ecx, esp
mov dword [esp + 0x30], esp
push str.IDS_HELP_FILES
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0xe
push dword [eax]
mov ecx, esi
push 0x13a
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0xf
mov ecx, esp
mov dword [esp + 0x30], esp
push str.IDS_SHAREDFILES
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0x10
push dword [eax]
mov ecx, esi
push 0x13e
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0x11
mov ecx, esp
mov dword [esp + 0x30], esp
push str.IDS_DEEP_SCAN
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0x12
push dword [eax]
mov ecx, esi
push 0x132
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0x13
mov ecx, esp
mov dword [esp + 0x30], esp
push str.string26
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0x14
push dword [eax]
mov ecx, esi
push 0x137
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0x15
mov ecx, esp
mov dword [esp + 0x30], esp
push str.IDS_ACTIVEX_COM
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0x16
push dword [eax]
mov ecx, esi
push 0x12e
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0x17
mov ecx, esp
mov dword [esp + 0x30], esp
push str.IDS_FILE_TYPE
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0x18
push dword [eax]
mov ecx, esi
push 0x134
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0x19
mov ecx, esp
mov dword [esp + 0x30], esp
push str.string28
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0x1a
push dword [eax]
mov ecx, esi
push 0x138
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0x1b
mov ecx, esp
mov dword [esp + 0x30], esp
push str.IDS_HISTORYLIST
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0x1c
push dword [eax]
mov ecx, esi
push 0x13b
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0x1d
mov ecx, esp
mov dword [esp + 0x30], esp
push str.IDS_SHORTCUTS_NAME
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0x1e
push dword [eax]
mov ecx, esi
push 0x13f
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0x1f
mov ecx, esp
mov dword [esp + 0x30], esp
push str.IDS_SOUNDS
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0x20
push dword [eax]
mov ecx, esi
push 0x142
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0x21
mov ecx, esp
mov dword [esp + 0x30], esp
push str.IDS_CURRENTUSER
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0x22
push dword [eax]
mov ecx, esi
push 0x133
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0x23
mov ecx, esp
mov dword [esp + 0x30], esp
push str.string30
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0x24
push dword [eax]
mov ecx, esi
push 0x139
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0x25
mov ecx, esp
mov dword [esp + 0x30], esp
push str.IDS_STARTMENU
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0x26
push dword [eax]
mov ecx, esi
push 0x143
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0x27
mov ecx, esp
mov dword [esp + 0x30], esp
push str.IDS_STARTUP
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0x28
push dword [eax]
mov ecx, esi
push 0x144
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.0040254f
push ecx
mov byte [esp + 0x5c], 0x29
mov ecx, esp
mov dword [esp + 0x30], esp
push str.IDS_SOFTWARE
call fcn.0040254f
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x60], 3
call fcn.00406eff
mov byte [esp + 0x50], 0x2a
push dword [eax]
mov ecx, esi
push 0x145
call fcn.00492d20
mov ecx, eax
call fcn.00492e36
mov byte [esp + 0x50], 3
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00402845
mov edi, esi
call fcn.00443b4c
push 0
push 0x65
push 0x65
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
or dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], vtable.CBitmap.0
call fcn.00402a27
xor eax, eax
inc eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret