Function at 0x4c67a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x704
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
xor edi, edi
lea eax, [ebp - 0x4cf]
push edi
push eax
mov byte [ebp - 0x4d0], 0
call fcn.004d29c0
add esp, 0xc
mov dword [0x4f8b78], 0x20019
mov dword [0x4f8b7c], 0xf003f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov word [0x5062f0], cx
push 8
lea edx, [ebp - 0xc]
mov ecx, 0x27a
mov dword [0x505b9c], eax
call fcn.004ca1e0
add esp, 4
mov edx, 0x4f3640
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c6830
mov edx, 9
mov word [0x5062f0], dx
jmp 0x4c6a5e
cmp word [0x5062f0], 9
je 0x4c6a5e
mov edx, 0x4ecb8c
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c685a
mov eax, 7
mov word [0x5062f0], ax
mov edx, 0x4ecb90
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c6877
mov ecx, 0xc
mov word [0x5062f0], cx
mov edx, 0x4f3644
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c6894
mov edx, 0xa
mov word [0x5062f0], dx
mov edx, 0x4f3648
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c68b0
mov eax, 0x10
mov word [0x5062f0], ax
mov edx, 0x4f364c
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c68cd
mov ecx, 0x1d
mov word [0x5062f0], cx
mov edx, 0x4f3650
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c68ea
mov edx, 1
mov word [0x5062f0], dx
mov edx, 0x4f3654
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c6906
mov eax, 0x19
mov word [0x5062f0], ax
mov edx, 0x4f3658
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c6923
mov ecx, 0x16
mov word [0x5062f0], cx
mov edx, 0x4f365c
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c6940
mov edx, 0x15
mov word [0x5062f0], dx
mov edx, 0x4e6ee4
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c695c
mov eax, 0x14
mov word [0x5062f0], ax
mov edx, 0x4f3660
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c6979
mov ecx, 8
mov word [0x5062f0], cx
mov edx, 0x4f3664
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c6996
mov edx, 0x13
mov word [0x5062f0], dx
mov edx, 0x4e6ee4
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c69b2
mov eax, 0x14
mov word [0x5062f0], ax
mov edx, 0x4f3668
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c69cf
mov ecx, 0x16
mov word [0x5062f0], cx
mov edx, 0x4f366c
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c69ec
mov edx, 0x1c
mov word [0x5062f0], dx
mov edx, 0x4f3670
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c6a08
mov eax, 0x1f
mov word [0x5062f0], ax
mov edx, 0x4f3674
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c6a25
mov ecx, 1
mov word [0x5062f0], cx
mov edx, 0x4f3678
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c6a42
mov edx, 0xb
mov word [0x5062f0], dx
mov edx, 0x4f367c
lea ecx, [ebp - 0xc]
call fcn.0047bb80
test eax, eax
je 0x4c6a5e
mov eax, 4
mov word [0x5062f0], ax
push 0x80
push str.Debug
push str.SoftwareBillP_StudiosWinPatrolOptions
lea ecx, [ebp - 0xb0]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
jle 0x4c6a9d
lea ecx, [ebp - 0xb0]
push ecx
call fcn.004cf355
add esp, 4
cmp eax, edi
je 0x4c6a9d
mov dword [0x4f83a4], edi
push str.kernel32
mov dword [0x500330], 0x404040
mov dword [0x4fb798], edi
mov dword [0x4fb79c], edi
mov dword [0x506e18], edi
mov dword [0x505890], edi
mov dword [0x506e98], edi
mov dword [0x506e9c], edi
mov dword [0x506ea0], edi
mov dword [0x506ea4], edi
mov dword [0x506ea8], edi
mov dword [0x506eac], edi
mov dword [0x506eb0], edi
mov dword [0x506eb4], edi
mov dword [ebp - 0x6ec], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, edi
je 0x4c6b4a
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x508044], eax
cmp eax, edi
je 0x4c6b31
lea edx, [ebp - 0x6ec]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x508044]
test eax, eax
je 0x4c6b4a
cmp dword [ebp - 0x6ec], edi
je 0x4c6b4a
mov dword [0x506e0c], 1
mov esi, str._x64_
jmp 0x4c6b55
mov dword [0x506e0c], edi
mov esi, str._x86_
push str.GetInitalValues
call fcn.0047da70
add esp, 4
push 0x20
push 0x4e27f8
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x2c]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
jne 0x4c6e3f
push str.GetInitalValues
mov esi, str.FIRSTTIME
call fcn.0047da70
mov edx, dword [0x4f8b7c]
add esp, 4
lea eax, [ebp - 0x6f8]
push eax
lea ecx, [ebp - 0x6ec]
push ecx
push edi
push edx
push edi
push edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push str.SoftwareBillP_Studios
push 0x80000001
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4c6bd6
mov eax, dword [ebp - 0x6ec]
push eax
call ebx
mov eax, dword [0x4f8b7c]
lea ecx, [ebp - 0x6f8]
push ecx
lea edx, [ebp - 0x6ec]
push edx
push 0
push eax
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrol
push 0x80000001
call edi
test eax, eax
jne 0x4c6c0b
mov ecx, dword [ebp - 0x6ec]
push ecx
call ebx
mov ecx, dword [0x4f8b7c]
lea edx, [ebp - 0x6f8]
push edx
lea eax, [ebp - 0x6ec]
push eax
push 0
push ecx
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolNuts
push 0x80000001
call edi
test eax, eax
jne 0x4c6c41
mov edx, dword [ebp - 0x6ec]
push edx
call ebx
mov edx, dword [0x4f8b7c]
lea eax, [ebp - 0x6f8]
push eax
lea ecx, [ebp - 0x6ec]
push ecx
push 0
push edx
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolCookies
push 0x80000001
call edi
test eax, eax
jne 0x4c6c77
mov eax, dword [ebp - 0x6ec]
push eax
call ebx
mov eax, dword [0x4f8b7c]
lea ecx, [ebp - 0x6f8]
push ecx
lea edx, [ebp - 0x6ec]
push edx
push 0
push eax
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolOptions
push 0x80000001
call edi
test eax, eax
jne 0x4c6cac
mov ecx, dword [ebp - 0x6ec]
push ecx
call ebx
mov ecx, dword [0x4f8b7c]
lea edx, [ebp - 0x6f8]
push edx
lea eax, [ebp - 0x6ec]
push eax
push 0
push ecx
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolRun
push 0x80000001
call edi
test eax, eax
jne 0x4c6ce2
mov edx, dword [ebp - 0x6ec]
push edx
call ebx
mov edx, dword [0x4f8b7c]
lea eax, [ebp - 0x6f8]
push eax
lea ecx, [ebp - 0x6ec]
push ecx
push 0
push edx
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolIEHelpers
push 0x80000001
call edi
test eax, eax
jne 0x4c6d18
mov eax, dword [ebp - 0x6ec]
push eax
call ebx
mov eax, dword [0x4f8b7c]
lea ecx, [ebp - 0x6f8]
push ecx
lea edx, [ebp - 0x6ec]
push edx
push 0
push eax
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolHostFile
push 0x80000001
call edi
test eax, eax
jne 0x4c6d4d
mov ecx, dword [ebp - 0x6ec]
push ecx
call ebx
mov ecx, dword [0x4f8b7c]
lea edx, [ebp - 0x6f8]
push edx
lea eax, [ebp - 0x6ec]
push eax
push 0
push ecx
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolTasks
push 0x80000001
call edi
test eax, eax
jne 0x4c6d83
mov edx, dword [ebp - 0x6ec]
push edx
call ebx
mov edx, dword [0x4f8b7c]
lea eax, [ebp - 0x6f8]
push eax
lea ecx, [ebp - 0x6ec]
push ecx
push 0
push edx
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolActiveX
push 0x80000001
call edi
test eax, eax
jne 0x4c6db9
mov eax, dword [ebp - 0x6ec]
push eax
call ebx
mov eax, dword [0x4f8b7c]
lea ecx, [ebp - 0x6f8]
push ecx
lea edx, [ebp - 0x6ec]
push edx
push 0
push eax
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolRejects
push 0x80000001
call edi
test eax, eax
jne 0x4c6dee
mov ecx, dword [ebp - 0x6ec]
push ecx
call ebx
lea edx, [ebp - 0x6e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x6e8]
call fcn.0047fb70
add esp, 4
push 0x4e27f8
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x1b8]
mov edx, 0x80000001
call fcn.004c0250
push str.GetInitalValues_LocalTime
lea esi, [ebp - 0x1b8]
call fcn.0047da70
add esp, 0xc
jmp 0x4c6e4b
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4f8b7c]
lea ecx, [ebp - 0x6f8]
push ecx
lea edx, [ebp - 0x6ec]
push edx
push 0
push eax
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolFileSizeMonitor
push 0x80000001
call edi
test eax, eax
jne 0x4c6e80
mov ecx, dword [ebp - 0x6ec]
push ecx
call ebx
push 0x104
push str.FilterBySizeIndex
push str.SoftwareBillP_StudiosWinPatrolFileSizeMonitor
lea ecx, [ebp - 0x4d0]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
cmp byte [ebp - 0x4d0], 0
jne 0x4c6ec7
push str.FilterBySizeIndex
push str.SoftwareBillP_StudiosWinPatrolFileSizeMonitor
mov ecx, 0x4e8468
mov edx, 0x80000001
call fcn.004c0250
add esp, 8
push 0x104
push str.FilterByTypeIndex
push str.SoftwareBillP_StudiosWinPatrolFileSizeMonitor
lea ecx, [ebp - 0x4d0]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
cmp byte [ebp - 0x4d0], 0
jne 0x4c6f0e
push str.FilterByTypeIndex
push str.SoftwareBillP_StudiosWinPatrolFileSizeMonitor
mov ecx, 0x4e8468
mov edx, 0x80000001
call fcn.004c0250
add esp, 8
push 0x104
push str.PATH
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x1b8]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
jne 0x4c6f64
lea edi, [ebp - 0x1b8]
call fcn.0047c070
push str.PATH
push str.SoftwareBillP_StudiosWinPatrol
mov ecx, edi
mov edx, 0x80000001
call fcn.004c0250
push str.GetInitValues_GetMyFolder_New
mov esi, edi
call fcn.0047da70
add esp, 0xc
lea edx, [ebp - 0xb0]
push edx
mov ecx, 3
call fcn.0047c870
add esp, 4
push str.GetInitalValues
mov esi, str.Initialize_PLUS_files
call fcn.0047da70
add esp, 4
call fcn.004cc300
call fcn.004cbcf0
call fcn.004cbed0
call fcn.004cc060
push str.GetInitalValues
mov esi, str.AutoUpdate
call fcn.0047da70
add esp, 4
cmp dword [0x506e0c], 0
je 0x4c6fe4
mov eax, dword [0x4f8b78]
mov ecx, dword [0x4f8b7c]
mov dword [ebp - 0x704], eax
mov dword [ebp - 0x6f8], ecx
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0x20106
mov eax, dword [0x4f8b78]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x6ec]
push edx
push eax
push 0
push str.SoftwareBillP_StudiosWinPatrol
push 0x80000001
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4c706b
lea ecx, [ebp - 0x6f4]
push ecx
mov ecx, dword [ebp - 0x6ec]
lea edx, [ebp - 0x6f0]
push edx
lea eax, [ebp - 0x700]
push eax
push 0
push str.AUOptions
push ecx
mov dword [ebp - 0x6f4], 4
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4c7053
mov edx, dword [ebp - 0x6ec]
push edx
call esi
jmp 0x4c7071
mov eax, dword [ebp - 0x6ec]
push eax
call esi
cmp dword [ebp - 0x6f0], 0
jne 0x4c7112
jmp 0x4c7071
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [0x4f8b78]
lea ecx, [ebp - 0x6ec]
push ecx
push edx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto_Update
push CreateStatusWindowA
call edi
test eax, eax
je 0x4c7095
xor eax, eax
jmp 0x4c70e4
lea eax, [ebp - 0x6f0]
push eax
mov eax, dword [ebp - 0x6ec]
lea ecx, [ebp - 0x6f4]
push ecx
lea edx, [ebp - 0x700]
push edx
push 0
push str.AUOptions
push eax
mov dword [ebp - 0x6f0], 4
call ebx
test eax, eax
je 0x4c70d5
mov ecx, dword [ebp - 0x6ec]
push ecx
call esi
xor eax, eax
jmp 0x4c70e4
mov edx, dword [ebp - 0x6ec]
push edx
call esi
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x6fc], eax
test eax, eax
je 0x4c7112
lea eax, [ebp - 0x6fc]
push eax
push str.AUOptions
mov esi, str.SoftwareBillP_StudiosWinPatrol
mov ebx, 0x80000001
call fcn.004c0450
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
call fcn.004cab60
test eax, eax
je 0x4c74ba
push str.GetInitalValues
mov esi, str.UAC_Values
call fcn.0047da70
mov edx, dword [0x4f8b78]
add esp, 4
lea ecx, [ebp - 0x6ec]
push ecx
push edx
push 0
push str.SoftwareBillP_StudiosWinPatrol
push 0x80000001
call edi
test eax, eax
je 0x4c7156
or eax, 0xffffffff
jmp 0x4c71ae
lea eax, [ebp - 0x6f0]
push eax
mov eax, dword [ebp - 0x6ec]
lea ecx, [ebp - 0x6f4]
push ecx
lea edx, [ebp - 0x700]
push edx
push 0
push str.ConsentPromptBehaviorAdmin
push eax
mov dword [ebp - 0x6f0], 4
call ebx
test eax, eax
je 0x4c719b
mov ecx, dword [ebp - 0x6ec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x4c71ae
mov edx, dword [ebp - 0x6ec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x6fc], eax
cmp eax, 0xffffffff
jne 0x4c7264
mov ecx, dword [0x4f8b78]
lea eax, [ebp - 0x6ec]
push eax
push ecx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push CreateStatusWindowA
call edi
test eax, eax
je 0x4c71e2
or eax, 0xffffffff
jmp 0x4c723a
lea edx, [ebp - 0x6f0]
push edx
mov edx, dword [ebp - 0x6ec]
lea eax, [ebp - 0x6f4]
push eax
lea ecx, [ebp - 0x700]
push ecx
push 0
push str.ConsentPromptBehaviorAdmin
push edx
mov dword [ebp - 0x6f0], 4
call ebx
test eax, eax
je 0x4c7227
mov eax, dword [ebp - 0x6ec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x4c723a
mov ecx, dword [ebp - 0x6ec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x6f4]
lea edx, [ebp - 0x6fc]
push edx
push str.ConsentPromptBehaviorAdmin
mov esi, str.SoftwareBillP_StudiosWinPatrol
mov ebx, 0x80000001
mov dword [ebp - 0x6fc], eax
call fcn.004c0450
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
mov ecx, dword [0x4f8b78]
lea eax, [ebp - 0x6ec]
push eax
push ecx
push 0
push str.SoftwareBillP_StudiosWinPatrol
push 0x80000001
call edi
test eax, eax
je 0x4c728f
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x4c72e5
lea edx, [ebp - 0x6f0]
push edx
mov edx, dword [ebp - 0x6ec]
lea eax, [ebp - 0x6f4]
push eax
lea ecx, [ebp - 0x700]
push ecx
push 0
push str.EnableLUA
push edx
mov dword [ebp - 0x6f0], 4
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4c72d6
mov eax, dword [ebp - 0x6ec]
push eax
call esi
or eax, 0xffffffff
jmp 0x4c72e5
mov ecx, dword [ebp - 0x6ec]
push ecx
call esi
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x6fc], eax
cmp eax, 0xffffffff
jne 0x4c7398
mov eax, dword [0x4f8b78]
lea edx, [ebp - 0x6ec]
push edx
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push CreateStatusWindowA
call edi
test eax, eax
je 0x4c7318
or eax, 0xffffffff
jmp 0x4c7368
lea ecx, [ebp - 0x6f0]
push ecx
mov ecx, dword [ebp - 0x6ec]
lea edx, [ebp - 0x6f4]
push edx
lea eax, [ebp - 0x700]
push eax
push 0
push str.EnableLUA
push ecx
mov dword [ebp - 0x6f0], 4
call ebx
test eax, eax
je 0x4c7359
mov edx, dword [ebp - 0x6ec]
push edx
call esi
or eax, 0xffffffff
jmp 0x4c7368
mov eax, dword [ebp - 0x6ec]
push eax
call esi
mov eax, dword [ebp - 0x6f4]
lea ecx, [ebp - 0x6fc]
push ecx
push str.EnableLUA
mov esi, str.SoftwareBillP_StudiosWinPatrol
mov ebx, 0x80000001
mov dword [ebp - 0x6fc], eax
call fcn.004c0450
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
mov eax, dword [0x4f8b78]
lea edx, [ebp - 0x6ec]
push edx
push eax
push 0
push str.SoftwareBillP_StudiosWinPatrol
push 0x80000001
call edi
test eax, eax
je 0x4c73bc
or eax, 0xffffffff
jmp 0x4c740c
lea ecx, [ebp - 0x6f0]
push ecx
mov ecx, dword [ebp - 0x6ec]
lea edx, [ebp - 0x6f4]
push edx
lea eax, [ebp - 0x700]
push eax
push 0
push str.PromptOnSecureDesktop
push ecx
mov dword [ebp - 0x6f0], 4
call ebx
test eax, eax
je 0x4c73fd
mov edx, dword [ebp - 0x6ec]
push edx
call esi
or eax, 0xffffffff
jmp 0x4c740c
mov eax, dword [ebp - 0x6ec]
push eax
call esi
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x6fc], eax
cmp eax, 0xffffffff
jne 0x4c74ba
mov edx, dword [0x4f8b78]
lea ecx, [ebp - 0x6ec]
push ecx
push edx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push CreateStatusWindowA
call edi
test eax, eax
je 0x4c7440
or eax, 0xffffffff
jmp 0x4c7490
lea eax, [ebp - 0x6f0]
push eax
mov eax, dword [ebp - 0x6ec]
lea ecx, [ebp - 0x6f4]
push ecx
lea edx, [ebp - 0x700]
push edx
push 0
push str.PromptOnSecureDesktop
push eax
mov dword [ebp - 0x6f0], 4
call ebx
test eax, eax
je 0x4c7481
mov ecx, dword [ebp - 0x6ec]
push ecx
call esi
or eax, 0xffffffff
jmp 0x4c7490
mov edx, dword [ebp - 0x6ec]
push edx
call esi
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x6fc], eax
lea eax, [ebp - 0x6fc]
push eax
push str.PromptOnSecureDesktop
mov esi, str.SoftwareBillP_StudiosWinPatrol
mov ebx, 0x80000001
call fcn.004c0450
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
push 0x20
push 0x4e27f8
push str.SoftwareBillP_StudiosWinPatrolSysfiles
lea ecx, [ebp - 0x2c]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
jne 0x4c7586
push str.GetInitalValues
mov esi, str.Create_REGWINPATROLSYSFILES_Keys
call fcn.0047da70
mov eax, dword [0x4f8b7c]
add esp, 4
lea ecx, [ebp - 0x700]
push ecx
lea edx, [ebp - 0x6f0]
push edx
push 0
push eax
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolSysfiles
push CreateStatusWindowA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4c752d
mov ecx, dword [ebp - 0x6f0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.GetHOSTSFile
mov esi, str.winpatrol.c
call fcn.0047da70
add esp, 4
lea esi, [ebp - 0x1b8]
call fcn.0047dd80
call fcn.004c6510
lea edx, [ebp - 0x6e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, esi
push eax
lea ecx, [ebp - 0x6e8]
call fcn.0047fb70
add esp, 4
push 0x4e27f8
push str.SoftwareBillP_StudiosWinPatrolSysfiles
mov ecx, esi
mov edx, CreateStatusWindowA
call fcn.004c0250
add esp, 8
call fcn.004cedc0
push 0x20
push str.RegNumber
push str.SoftwareBillP_StudiosWinPatrol
mov ecx, 0x4fbf9c
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
push str.GetInitalValues
mov esi, str.Check_if_New_Installs
call fcn.0047da70
add esp, 4
push 0x20
push str.NewVersion
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x2c]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
jne 0x4c7639
push str.34.11.2016.15
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x1b8]
call fcn.004010b0
push str.New_Install
lea esi, [ebp - 0x1b8]
call fcn.0047da70
add esp, 4
push str.NewVersion
push str.SoftwareBillP_StudiosWinPatrol
mov ecx, esi
mov edx, 0x80000001
call fcn.004c0250
call fcn.004cbc00
call fcn.00482200
push 0
push 1
call fcn.004ca680
add esp, 0x10
jmp 0x4c77cb
mov edx, str.34.11.2016.15
lea ecx, [ebp - 0x2c]
call fcn.0047bb80
test eax, eax
jne 0x4c774b
push str.Update_Install
lea esi, [ebp - 0x2c]
call fcn.0047da70
add esp, 4
push str.34.11.2016.15
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x1b8]
call fcn.004010b0
push str.NewVersion
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x1b8]
mov edx, 0x80000001
call fcn.004c0250
call fcn.004cbc00
call fcn.00482200
push 0
push 1
call fcn.004ca680
mov edx, dword [0x4f8b78]
add esp, 0x10
lea ecx, [ebp - 0x6ec]
push ecx
push edx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto_Update
push CreateStatusWindowA
call edi
test eax, eax
je 0x4c76cc
xor eax, eax
jmp 0x4c7723
lea eax, [ebp - 0x6f0]
push eax
mov eax, dword [ebp - 0x6ec]
lea ecx, [ebp - 0x6f4]
push ecx
lea edx, [ebp - 0x700]
push edx
push 0
push str.AUOptions
push eax
mov dword [ebp - 0x6f0], 4
call ebx
test eax, eax
je 0x4c7710
mov ecx, dword [ebp - 0x6ec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4c7723
mov edx, dword [ebp - 0x6ec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x6fc], eax
test eax, eax
je 0x4c774b
lea eax, [ebp - 0x6fc]
push eax
push str.AUOptions
mov esi, str.SoftwareBillP_StudiosWinPatrol
mov ebx, 0x80000001
call fcn.004c0450
add esp, 8
cmp dword [0x506e0c], 0
je 0x4c776c
mov ecx, dword [ebp - 0x704]
mov edx, dword [ebp - 0x6f8]
mov dword [0x4f8b78], ecx
mov dword [0x4f8b7c], edx
push 0x80
push str.Cleanup
push str.SoftwareBillP_StudiosWinPatrolOptions
lea ecx, [ebp - 0xb0]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
jle 0x4c77cb
lea eax, [ebp - 0xb0]
push eax
call fcn.004cf355
add esp, 4
test eax, eax
je 0x4c77cb
push str.GetInitalValues
mov esi, str.Registry_Garbage_Collection
call fcn.0047da70
add esp, 4
call fcn.004cbc00
push 0
mov esi, str.Cleanup
call fcn.004cae00
add esp, 4
call fcn.00484810
call fcn.004c7cb0
push 0x80
push 0x4f391c
push str.SoftwareBillP_StudiosWinPatrolOptions
lea ecx, [ebp - 0xb0]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
jle 0x4c7812
lea ecx, [ebp - 0xb0]
push ecx
call fcn.004cf355
add esp, 4
test eax, eax
jne 0x4c7aa5
push 0x104
push str.PATH
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x5d8]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x4c79dc
lea edx, [ebp - 0x5d8]
push edx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x2c0]
call fcn.004010b0
mov edx, 0x104
lea eax, [ebp - 0x2c0]
cmp byte [eax], 0
je 0x4c786e
inc eax
dec edx
jne 0x4c7863
jmp 0x4c7896
test edx, edx
je 0x4c7896
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.history.txt
lea ecx, [ebp + ecx - 0x2c0]
mov edx, 0x7fffffff
call fcn.004010b0
lea ecx, [ebp - 0x2c0]
call fcn.0047af20
test eax, eax
je 0x4c78fe
lea ebx, [ebp - 0x3c8]
call fcn.0047c6f0
mov eax, 0x104
mov ecx, ebx
cmp byte [ecx], 0
je 0x4c78c2
inc ecx
dec eax
jne 0x4c78b7
jmp 0x4c78ea
test eax, eax
je 0x4c78ea
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
sub eax, ecx
push str.history.txt
lea ecx, [ebp + ecx - 0x3c8]
mov edx, 0x7fffffff
call fcn.004010b0
lea eax, [ebp - 0x3c8]
push eax
lea ecx, [ebp - 0x2c0]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea edx, [ebp - 0x5d8]
push edx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x2c0]
call fcn.004010b0
mov edx, 0x104
lea eax, [ebp - 0x2c0]
cmp byte [eax], 0
je 0x4c7930
inc eax
dec edx
jne 0x4c7925
jmp 0x4c7958
test edx, edx
je 0x4c7958
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.disabled
lea ecx, [ebp + ecx - 0x2c0]
mov edx, 0x7fffffff
call fcn.004010b0
lea ebx, [ebp - 0x3c8]
call fcn.0047c6f0
mov eax, 0x104
mov ecx, ebx
lea ebx, [ebx]
cmp byte [ecx], 0
je 0x4c797b
inc ecx
dec eax
jne 0x4c7970
jmp 0x4c79a3
test eax, eax
je 0x4c79a3
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
sub eax, ecx
push str.disabled
lea ecx, [ebp + ecx - 0x3c8]
mov edx, 0x7fffffff
call fcn.004010b0
lea eax, [ebp - 0x3c8]
push eax
lea ecx, [ebp - 0x2c0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4c79dc
push 8
lea edx, [ebp - 0x3c8]
push edx
lea eax, [ebp - 0x2c0]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ebx, [ebp - 0x5d8]
call fcn.0047b990
call fcn.004ce860
call fcn.004caed0
push 0
push 1
call fcn.004ca680
push 1
call fcn.004cd760
add esp, 0xc
cmp dword [0x501868], 0
je 0x4c7a0c
push 1
call fcn.004cd8c0
add esp, 4
push 1
push 0x4e8d64
lea ecx, [ebp - 0xb0]
push 0x80
push ecx
call fcn.00402ee0
push 0x4f391c
push str.SoftwareBillP_StudiosWinPatrolOptions
lea ecx, [ebp - 0xb0]
mov edx, 0x80000001
call fcn.004c0250
push str.Update
push str.SoftwareBillP_StudiosWinPatrolOptions
mov ecx, 0x4e2ca8
mov edx, 0x80000001
call fcn.004c0250
push 1
push 0x4e8d64
lea edx, [ebp - 0xb0]
push 0x80
push edx
call fcn.00402ee0
push str.Installed2015
push str.SoftwareBillP_StudiosWinPatrolOptions
lea ecx, [ebp - 0xb0]
mov edx, 0x80000001
call fcn.004c0250
push str.Update
push str.SoftwareBillP_StudiosWinPatrolOptions
mov ecx, 0x4e2ca8
mov edx, 0x80000001
call fcn.004c0250
add esp, 0x40
push 0x20
push str.Init
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x2c]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
jne 0x4c7b04
lea eax, [ebp - 0x6e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x1b8]
push ecx
lea ecx, [ebp - 0x6e8]
call fcn.0047fb70
add esp, 4
push str.Init
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x1b8]
mov edx, 0x80000001
call fcn.004c0250
add esp, 8
push 0x80
push str.Installed2015
push str.SoftwareBillP_StudiosWinPatrolOptions
lea ecx, [ebp - 0xb0]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
jle 0x4c7b45
lea edx, [ebp - 0xb0]
push edx
call fcn.004cf355
xor edi, edi
add esp, 4
cmp eax, edi
jne 0x4c7bc3
jmp 0x4c7b47
xor edi, edi
push str.GetInitalValues
mov esi, str.New_2015_Cleanup
call fcn.0047da70
add esp, 4
call fcn.004ce860
cmp dword [0x501868], edi
je 0x4c7b70
push 1
call fcn.004cd8c0
add esp, 4
call fcn.004caed0
push 1
push 0x4e8d64
lea eax, [ebp - 0xb0]
push 0x80
push eax
call fcn.00402ee0
push str.Installed2015
push str.SoftwareBillP_StudiosWinPatrolOptions
lea ecx, [ebp - 0xb0]
mov edx, 0x80000001
call fcn.004c0250
push str.Update
push str.SoftwareBillP_StudiosWinPatrolOptions
mov ecx, 0x4e2ca8
mov edx, 0x80000001
call fcn.004c0250
add esp, 0x20
push str.GetInitalValues
mov esi, str.Explorer_Integration
call fcn.0047da70
add esp, 4
push 0x104
push 0x4e27f8
push str.exefile_shellWinPatrol_PLUS
lea ecx, [ebp - 0x1b8]
mov edx, 0x80000000
call fcn.004bff10
add esp, 0xc
cmp dword [0x4f8ba4], 1
jne 0x4c7c10
cmp eax, edi
jne 0x4c7c4c
push 1
call fcn.004cd2d0
add esp, 4
jmp 0x4c7c4c
cmp eax, edi
je 0x4c7c4c
push str.exefile_shellWinPatrol_PLUS
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x208
ja 0x4c7c4c
push str.exefile_shellWinPatrol_PLUS
lea ecx, [ebp - 0x6d8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x6d8]
push edx
push 0x80000000
call fcn.004c1970
add esp, 8
push edi
call fcn.004ccb10
add esp, 4
push str.GetInitalValues
mov esi, str.Init_Delayed_Launch
mov dword [0x506e78], eax
call fcn.0047da70
add esp, 4
mov dword [0x506e64], edi
mov dword [0x506e68], edi
mov dword [0x506e6c], edi
mov dword [0x506e70], edi
call fcn.00488120
mov ecx, dword [ebp - 4]
mov eax, dword [0x505890]
pop edi
pop esi
xor ecx, ebp
mov dword [0x506e64], eax
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret