Function at 0x4dbf20
Capabilities:
Accept command line arguments
Check mutex on windows
Check os version
Copy file
Enumerate processes on remote desktop session host

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.006f5ae0
mov eax, dword [0x7db1e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x73817c
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4dc15a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
mov ebx, eax
mov dword [ebp - 0x42c], 0
push 0x736434
lea ecx, [ebp - 0x42c]
mov dword [ebp - 0xf54], ebx
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 7
call fcn.004da1e0
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0xf58], 0
push 0
push eax
mov dword [ebp - 0xf64], 0
call fcn.006f7570
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.006f7570
add esp, 0x18
mov dword [ebp - 0xf60], 0
lea eax, [ebp - 0xf64]
mov dword [ebp - 0xf5c], 0
mov dword [ebp - 0xf50], 8
push eax
lea eax, [ebp - 0xf58]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
je 0x4dc0f4
mov ecx, dword [ebp - 0xf64]
xor edi, edi
test ecx, ecx
je 0x4dc0f4
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
xor esi, esi
mov edx, dword [ebp - 0xf54]
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ebp - 0xf58]
cmp dword [esi + eax + 4], edx
jne 0x4dc0ce
lea ecx, [ebp - 0xf50]
push ecx
lea ecx, [ebp - 0xf5c]
push ecx
push 0
lea ecx, [ebp - 0xf60]
push ecx
push 0
push dword [esi + eax + 0xc]
push 0
call ebx
mov eax, dword [ebp - 0xf60]
dec eax
cmp eax, 0x102
ja 0x4dc0c2
mov eax, dword [ebp - 0xf5c]
dec eax
cmp eax, 0x103
ja 0x4dc0c2
lea eax, [ebp - 0xf50]
push eax
lea eax, [ebp - 0xf5c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xf60]
push eax
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0xf58]
push dword [esi + eax + 0xc]
push 0
call ebx
test eax, eax
jne 0x4dc0dc
mov ecx, dword [ebp - 0xf64]
mov edx, dword [ebp - 0xf54]
inc edi
add esi, 0x10
cmp edi, ecx
jb 0x4dc040
jmp 0x4dc0ee
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x42c]
call fcn.004ccf80
mov ebx, dword [ebp - 0xf54]
mov eax, dword [ebp - 0xf58]
test eax, eax
je 0x4dc104
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
lea eax, [ebp - 0x42c]
push ebx
push eax
call fcn.004d1770
mov edx, dword [ebp - 0x418]
add esp, 8
movzx esi, al
cmp edx, 8
jb 0x4dceeb
mov ecx, dword [ebp - 0x42c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4dcee1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4dcf00
jmp 0x4dcee1
push 0x110
lea eax, [ebp - 0x5e4]
push 0
push eax
call fcn.006f7570
add esp, 0xc
mov dword [ebp - 0x5e8], 0x114
lea eax, [ebp - 0x5e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x5e4], 5
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
ja 0x4dc1a1
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
movzx eax, ax
jmp 0x4dc1c5
push str.Kernel32.dll
call edi
push str.GetThreadUILanguage
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4dc1bf
call eax
movzx eax, ax
jmp 0x4dc1c5
mov eax, dword [ebp - 0xf50]
movzx eax, ax
mov dword [0x7df2dc], eax
lea eax, [ebp - 0x48c]
push eax
call fcn.00516930
add esp, 4
cmp dword [ebp - 0x47c], 0
je 0x4dce9a
cmp dword [ebp - 0x478], 0x10
lea eax, [ebp - 0x48c]
cmovae eax, dword [ebp - 0x48c]
push eax
call fcn.00551630
add esp, 4
test al, al
je 0x4dce9a
lea eax, [ebp - 0x474]
push eax
call fcn.00515bb0
cmp dword [ebp - 0x460], 0x10
lea eax, [ebp - 0x474]
cmovae eax, dword [ebp - 0x474]
push eax
call fcn.00551630
add esp, 8
test al, al
jne 0x4dc36d
cmp dword [ebp - 0x460], 0x10
lea eax, [ebp - 0x474]
push 0x180
cmovae eax, dword [ebp - 0x474]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0xf50]
push eax
call fcn.005514e0
add esp, 0x10
cmp dword [ebp - 0xf50], 0
je 0x4dc36d
push 0x30
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
call fcn.0044f2f0
movups xmm0, xmmword [0x738320]
mov dword [ebp - 0x434], 0x21
mov dword [ebp - 0x430], 0x2f
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x738330]
movups xmmword [eax + 0x10], xmm0
mov cl, byte [0x738340]
mov byte [eax + 0x20], cl
lea ecx, [ebp - 0xf50]
mov byte [eax + 0x21], 0
mov dword [ebp - 0x444], eax
call fcn.004dbc20
push eax
lea ecx, [ebp - 0x444]
call fcn.0044efe0
cmp dword [ebp - 0x430], 0x10
lea eax, [ebp - 0x444]
push 0x10
cmovae eax, dword [ebp - 0x444]
push 0x738174
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [ebp - 0x430]
cmp edx, 0x10
jb 0x4dc358
mov ecx, dword [ebp - 0x444]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4dc34e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4dcf05
push edx
push ecx
call fcn.006f4b9f
add esp, 8
lea ecx, [ebp - 0x474]
mov esi, 0x80004001
call fcn.0044f440
jmp 0x4dceb5
mov ecx, dword [ebp - 0x464]
mov esi, closesocket
mov eax, esi
sub eax, ecx
cmp eax, 5
jb 0x4dcf14
cmp dword [ebp - 0x460], 0x10
lea eax, [ebp - 0x474]
push 5
cmovae eax, dword [ebp - 0x474]
push str.logs_
push ecx
push eax
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0xf50]
lea ecx, [ebp - 0x45c]
call fcn.004cc200
cmp dword [ebp - 0x448], 0x10
lea eax, [ebp - 0x45c]
cmovae eax, dword [ebp - 0x45c]
push eax
call fcn.00551630
add esp, 4
test al, al
jne 0x4dc4f6
cmp dword [ebp - 0x448], 0x10
lea eax, [ebp - 0x45c]
push 0x180
cmovae eax, dword [ebp - 0x45c]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0xf50]
push eax
call fcn.005514e0
add esp, 0x10
cmp dword [ebp - 0xf50], 0
je 0x4dc4f6
push 0x30
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
call fcn.0044f2f0
movups xmm0, xmmword [0x73834c]
mov dword [ebp - 0x434], 0x20
lea ecx, [ebp - 0xf50]
mov dword [ebp - 0x430], 0x2f
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x73835c]
movups xmmword [eax + 0x10], xmm0
mov byte [eax + 0x20], 0
mov dword [ebp - 0x444], eax
call fcn.004dbc20
push eax
lea ecx, [ebp - 0x444]
call fcn.0044efe0
cmp dword [ebp - 0x430], 0x10
lea eax, [ebp - 0x444]
push 1
cmovae eax, dword [ebp - 0x444]
push 0x738174
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [ebp - 0x430]
cmp edx, 0x10
jb 0x4dc522
mov ecx, dword [ebp - 0x444]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4dc4e5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4dcf0a
push edx
push ecx
call fcn.006f4b9f
add esp, 8
xor esi, esi
jmp 0x4dce82
lea eax, [ebp - 0x45c]
push eax
call fcn.004d3e50
add esp, 4
test eax, eax
jne 0x4dc529
push 0x10
push 0x738174
push 0x738370
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor esi, esi
jmp 0x4dce82
mov eax, dword [0x738150]
movq xmm0, qword [str.Foxmail.Addins]
mov dword [ebp - 0x424], eax
mov ax, word [0x738154]
push 1
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x42c]
push 0x400
push eax
mov dword [ebp - 0x418], 0xf
mov dword [ebp - 0x41c], 0xe
movq qword [ebp - 0x42c], xmm0
mov byte [ebp - 0x41e], 0
call fcn.00555fc0
add esp, 4
lea ecx, [ebp - 0x100c]
push eax
call fcn.00552eb0
mov edx, dword [ebp - 0x418]
cmp edx, 0x10
jb 0x4dc5c8
mov ecx, dword [ebp - 0x42c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4dc5be
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4dcf0f
push edx
push ecx
call fcn.006f4b9f
add esp, 8
mov eax, dword [ebp - 0x100c]
lea ecx, [ebp - 0x100c]
call dword [eax + 0x34]
lea eax, [ebp - 0xfd4]
mov dword [ebp - 0xfc0], 6
push str._ADDINS_APP_:FoxmailAddinsApp_InitInstance_
push eax
call fcn.004cb4e0
push eax
call fcn.004cbd50
mov ecx, dword [ebp - 0x464]
mov eax, esi
sub eax, ecx
add esp, 0xc
cmp eax, 9
jb 0x4dcf14
cmp dword [ebp - 0x460], 0x10
lea eax, [ebp - 0x474]
push 9
cmovae eax, dword [ebp - 0x474]
push str.config.db
push ecx
push eax
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0xf50]
lea ecx, [ebp - 0x42c]
call fcn.004cc200
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x45c]
call fcn.0044e870
lea ecx, [ebp - 0x42c]
call fcn.0044f440
cmp dword [ebp - 0x448], 0x10
lea eax, [ebp - 0x45c]
cmovae eax, dword [ebp - 0x45c]
push eax
call fcn.00551630
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 4
test al, al
jne 0x4dc9a3
mov eax, dword [ebp - 0x100c]
lea ecx, [ebp - 0x100c]
call dword [eax + 0x34]
push str._not_exist__copy_from_default
lea eax, [ebp - 0x45c]
mov dword [ebp - 0xfc0], 6
push eax
lea eax, [ebp - 0xfd4]
push str.CCMFoxmailAddinsApp::InitInstance
push eax
call fcn.004cb4e0
add esp, 8
push eax
call fcn.004cb4b0
add esp, 8
push eax
call fcn.004cb4e0
push eax
call fcn.004cbd50
mov ecx, dword [ebp - 0x47c]
mov eax, esi
sub eax, ecx
add esp, 0xc
cmp eax, 9
jb 0x4dcf14
cmp dword [ebp - 0x478], 0x10
lea eax, [ebp - 0x48c]
push 9
cmovae eax, dword [ebp - 0x48c]
push str.config.db
push ecx
push eax
lea eax, [ebp - 0x48c]
push eax
push dword [ebp - 0xf50]
lea ecx, [ebp - 0x444]
call fcn.004cc200
cmp dword [ebp - 0x430], 0x10
lea eax, [ebp - 0x444]
cmovae eax, dword [ebp - 0x444]
push eax
call fcn.00551630
add esp, 4
test al, al
jne 0x4dc852
mov eax, dword [ebp - 0x100c]
lea ecx, [ebp - 0x100c]
call dword [eax + 0x34]
push str._not_exist__copy_from_default
lea eax, [ebp - 0x444]
mov dword [ebp - 0xfc0], 3
push eax
lea eax, [ebp - 0xfd4]
push str.CCMFoxmailAddinsApp::InitInstance
push eax
call fcn.004cb4e0
add esp, 8
push eax
call fcn.004cb4b0
add esp, 8
push eax
call fcn.004cb4e0
push eax
call fcn.004cbd50
movq xmm0, qword [str.config.db]
add esp, 0xc
mov al, byte [0x7383c4]
mov dword [ebp - 0x418], 0xf
mov dword [ebp - 0x41c], 9
movq qword [ebp - 0x42c], xmm0
mov byte [ebp - 0x424], al
mov byte [ebp - 0x423], 0
push 0x33
push 0x73840c
lea ecx, [ebp - 0x42c]
call fcn.0044ef80
cmp dword [ebp - 0x418], 0x10
lea eax, [ebp - 0x42c]
push 0x10
cmovae eax, dword [ebp - 0x42c]
push 0x738174
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [ebp - 0x418]
cmp edx, 0x10
jb 0x4dc845
mov ecx, dword [ebp - 0x42c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4dc83b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4dcf19
push edx
push ecx
call fcn.006f4b9f
add esp, 8
xor esi, esi
lea ecx, [ebp - 0x444]
jmp 0x4dce72
cmp dword [ebp - 0x448], 0x10
lea ecx, [ebp - 0x45c]
push 0
cmovae ecx, dword [ebp - 0x45c]
lea eax, [ebp - 0x444]
cmp dword [ebp - 0x430], 0x10
push ecx
cmovae eax, dword [ebp - 0x444]
push eax
call ebx
test eax, eax
jne 0x4dc998
mov eax, dword [ebp - 0x100c]
lea ecx, [ebp - 0x100c]
call dword [eax + 0x34]
push str._failed
lea eax, [ebp - 0x45c]
mov dword [ebp - 0xfc0], 3
push eax
push str._to
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0xfd4]
push str.CConnect::OnConnection_copy
push eax
call fcn.004cb4e0
add esp, 8
push eax
call fcn.004cb4b0
add esp, 8
push eax
call fcn.004cb4e0
add esp, 8
push eax
call fcn.004cb4b0
add esp, 8
push eax
call fcn.004cb4e0
push eax
call fcn.004cbd50
add esp, 0xc
lea eax, [ebp - 0x45c]
push eax
push str._nTo:
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x4d4]
push 0x738478
push eax
call fcn.0044e8f0
add esp, 0xc
push eax
lea eax, [ebp - 0x4bc]
push eax
call fcn.0044f050
add esp, 0xc
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.0044f600
add esp, 0xc
lea ecx, [ebp - 0x4bc]
call fcn.0044f440
lea ecx, [ebp - 0x4d4]
call fcn.0044f440
cmp dword [ebp - 0x418], 0x10
lea eax, [ebp - 0x42c]
push 0x10
cmovae eax, dword [ebp - 0x42c]
push 0x738174
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x42c]
mov esi, 0x80004001
call fcn.0044f440
lea ecx, [ebp - 0x444]
jmp 0x4dce72
lea ecx, [ebp - 0x444]
call fcn.0044f440
lea eax, [ebp - 0x45c]
push eax
call fcn.004cf830
add esp, 4
test al, al
jne 0x4dc9f0
mov eax, dword [ebp - 0x100c]
lea ecx, [ebp - 0x100c]
call dword [eax + 0x34]
lea eax, [ebp - 0xfd4]
mov dword [ebp - 0xfc0], 3
push str.CMFoxmailAddins::CheckEncryption_config_fail
push eax
call fcn.004cb4e0
push eax
call fcn.004cbd50
add esp, 0xc
xor esi, esi
jmp 0x4dce77
mov ecx, dword [ebp - 0x464]
mov eax, esi
sub eax, ecx
cmp eax, 0xa
jb 0x4dcf14
cmp dword [ebp - 0x460], 0x10
lea eax, [ebp - 0x474]
push 0xa
cmovae eax, dword [ebp - 0x474]
push str.address.db
push ecx
push eax
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0xf50]
lea ecx, [ebp - 0x42c]
call fcn.004cc200
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x45c]
call fcn.0044e870
lea ecx, [ebp - 0x42c]
call fcn.0044f440
cmp dword [ebp - 0x448], 0x10
lea eax, [ebp - 0x45c]
cmovae eax, dword [ebp - 0x45c]
push eax
call fcn.00551630
add esp, 4
test al, al
jne 0x4dccd1
mov eax, dword [ebp - 0x100c]
lea ecx, [ebp - 0x100c]
call dword [eax + 0x34]
push str._not_exist__copy_from_default
lea eax, [ebp - 0x45c]
mov dword [ebp - 0xfc0], 6
push eax
lea eax, [ebp - 0xfd4]
push str.CCMFoxmailAddinsApp::InitInstance
push eax
call fcn.004cb4e0
add esp, 8
push eax
call fcn.004cb4b0
add esp, 8
push eax
call fcn.004cb4e0
push eax
call fcn.004cbd50
mov ecx, dword [ebp - 0x47c]
add esp, 0xc
sub esi, ecx
cmp esi, 9
jb 0x4dcf1e
cmp dword [ebp - 0x478], 0x10
lea eax, [ebp - 0x48c]
push 9
cmovae eax, dword [ebp - 0x48c]
push str.config.db
push ecx
push eax
lea eax, [ebp - 0x48c]
push eax
push dword [ebp - 0xf50]
lea ecx, [ebp - 0x444]
call fcn.004cc200
cmp dword [ebp - 0x430], 0x10
lea eax, [ebp - 0x444]
cmovae eax, dword [ebp - 0x444]
push eax
call fcn.00551630
add esp, 4
test al, al
jne 0x4dcbc4
mov eax, dword [ebp - 0x100c]
lea ecx, [ebp - 0x100c]
call dword [eax + 0x34]
push str._not_exist__copy_from_default
lea eax, [ebp - 0x444]
mov dword [ebp - 0xfc0], 3
push eax
lea eax, [ebp - 0xfd4]
push str.CCMFoxmailAddinsApp::InitInstance
push eax
call fcn.004cb4e0
add esp, 8
push eax
call fcn.004cb4b0
add esp, 8
push eax
call fcn.004cb4e0
push eax
call fcn.004cbd50
movq xmm0, qword [str.address.db]
add esp, 0xc
mov ax, word [0x7384c8]
mov dword [ebp - 0x418], 0xf
mov dword [ebp - 0x41c], 0xa
movq qword [ebp - 0x42c], xmm0
mov word [ebp - 0x424], ax
mov byte [ebp - 0x422], 0
jmp 0x4dc7d0
cmp dword [ebp - 0x448], 0x10
lea ecx, [ebp - 0x45c]
push 0
cmovae ecx, dword [ebp - 0x45c]
lea eax, [ebp - 0x444]
cmp dword [ebp - 0x430], 0x10
push ecx
cmovae eax, dword [ebp - 0x444]
push eax
call ebx
test eax, eax
jne 0x4dccc6
mov eax, dword [ebp - 0x100c]
lea ecx, [ebp - 0x100c]
call dword [eax + 0x34]
push str._failed
lea eax, [ebp - 0x45c]
mov dword [ebp - 0xfc0], 3
push eax
push str._to
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0xfd4]
push str.CConnect::OnConnection_copy
push eax
call fcn.004cb4e0
add esp, 8
push eax
call fcn.004cb4b0
add esp, 8
push eax
call fcn.004cb4e0
add esp, 8
push eax
call fcn.004cb4b0
add esp, 8
push eax
call fcn.004cb4e0
push eax
call fcn.004cbd50
add esp, 0xc
lea eax, [ebp - 0x45c]
push eax
push str._nTo:
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x4bc]
push 0x738478
push eax
call fcn.0044e8f0
add esp, 0xc
push eax
lea eax, [ebp - 0x4d4]
push eax
call fcn.0044f050
add esp, 0xc
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.0044f600
add esp, 0xc
lea ecx, [ebp - 0x4d4]
call fcn.0044f440
lea ecx, [ebp - 0x4bc]
jmp 0x4dc94f
lea ecx, [ebp - 0x444]
call fcn.0044f440
lea eax, [ebp - 0x45c]
push eax
call fcn.004cf830
add esp, 4
test al, al
jne 0x4dcd1e
mov eax, dword [ebp - 0x100c]
lea ecx, [ebp - 0x100c]
call dword [eax + 0x34]
lea eax, [ebp - 0xfd4]
mov dword [ebp - 0xfc0], 3
push str.CMFoxmailAddins::CheckEncryption_address_fail
push eax
call fcn.004cb4e0
push eax
call fcn.004cbd50
add esp, 0xc
xor esi, esi
jmp 0x4dce77
lea eax, [ebp - 0x4a4]
push eax
call fcn.004d25a0
mov eax, dword [ebp - 0x100c]
lea ecx, [ebp - 0x100c]
add esp, 4
call dword [eax + 0x34]
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0xfc0], 6
push eax
lea eax, [ebp - 0xfd4]
push str._ADDINS_APP_:FoxmailAddinsApp_Version_:
push eax
call fcn.004cb4e0
add esp, 8
push eax
call fcn.004cb4b0
push eax
call fcn.004cbd50
lea eax, [ebp - 0x4a4]
push eax
call fcn.00536330
mov eax, dword [ebp - 0x100c]
lea ecx, [ebp - 0x100c]
add esp, 0x10
call dword [eax + 0x34]
lea eax, [ebp - 0xfd4]
mov dword [ebp - 0xfc0], 6
push str._ADDINS_APP_:FoxmailAddinsApp_InitInstance_successful_
push eax
call fcn.004cb4e0
push eax
call fcn.004cbd50
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xf4c]
add esp, 0xc
mov dword [0x7df2d8], eax
call fcn.004cc320
mov eax, dword [0x7df2dc]
push 0
mov dword [ebp - 0x624], eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0xf4c]
call fcn.004d1b40
cmp byte [0x7df21c], 0
je 0x4dcdef
or esi, 0xffffffff
jmp 0x4dce61
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
mov dword [ebp - 0xf50], esi
test esi, esi
jns 0x4dce18
cmp esi, 0x80010106
jne 0x4dce61
push str.Mscoree.dll
call edi
test eax, eax
jne 0x4dce1f
jmp 0x4dce61
mov byte [0x7df2d6], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0xf50]
push ecx
push eax
mov ecx, 0x7df298
call fcn.004d4f70
cmp al, 1
jne 0x4dce4c
push dword [ebp + 0x14]
mov ecx, 0x7df298
call fcn.004d8680
mov esi, eax
jmp 0x4dce52
mov esi, dword [ebp - 0xf50]
cmp byte [0x7df2d6], 0
je 0x4dce61
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0xf4c]
call fcn.00501390
lea ecx, [ebp - 0x4a4]
call fcn.0044f440
lea ecx, [ebp - 0x100c]
call fcn.004cd070
lea ecx, [ebp - 0x45c]
call fcn.0044f440
lea ecx, [ebp - 0x474]
call fcn.0044f440
jmp 0x4dceb5
push 0x10
push 0x738174
push 0x7382e0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor esi, esi
mov edx, dword [ebp - 0x478]
cmp edx, 0x10
jb 0x4dceeb
mov ecx, dword [ebp - 0x48c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4dcee1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4dcf19
push edx
push ecx
call fcn.006f4b9f
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f4db8
mov esp, ebp
pop ebp
ret 0x10
call fcn.006fb96e
call fcn.006fb96e
call fcn.006fb96e
call fcn.006fb96e
call fcn.0044f120
call fcn.006fb96e
call fcn.0044f120
int3