Function at 0x4965c0
Capabilities:
Find taskbar
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x550
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.00488150
mov ebx, eax
mov eax, dword [0x4d2a70]
mov dword [ebp - 0x54c], ebx
cmp eax, ebx
jge 0x496ac7
mov eax, dword [ebp + 8]
push eax
push str.____d
lea ecx, [ebp - 0x218]
push 0x104
push ecx
call fcn.00402830
push str.Delayed_Start_Timer
lea esi, [ebp - 0x218]
call fcn.0047fb10
add esp, 0x14
cmp dword [0x4d2afc], 0
je 0x49663d
mov edx, dword [0x4c6444]
mov eax, dword [0x4c6448]
mov dword [ebp - 0x53c], edx
mov dword [ebp - 0x548], eax
xor edi, edi
mov dword [ebp - 0x534], edi
test ebx, ebx
jle 0x496a83
jmp 0x496656
mov edi, dword [ebp - 0x534]
mov ecx, dword [edi*4 + 0x4cd390]
xor esi, esi
push ecx
mov dword [ebp - 0x530], esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x496690
mov edx, dword [eax + 0x288]
mov eax, dword [edi*4 + 0x4cd390]
push eax
mov dword [ebp - 0x530], edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [ebp - 0x530]
xor eax, eax
mov ebx, 0x80000001
mov dword [ebp - 0x52c], eax
cmp esi, 0xb
jge 0x4966aa
mov dword [ebp - 0x52c], eax
jmp 0x4966c6
cmp esi, 0x15
jge 0x4966b7
mov dword [ebp - 0x52c], eax
jmp 0x4966cb
cmp esi, 0x1f
jge 0x4966cb
mov dword [ebp - 0x52c], 1
mov ebx, 0x80000002
cmp dword [0x4d2afc], eax
je 0x496705
cmp dword [ebp - 0x52c], eax
je 0x4966f1
mov dword [0x4c6444], 0x20019
mov dword [0x4c6448], 0xf003f
jmp 0x496705
mov dword [0x4c6444], 0x20119
mov dword [0x4c6448], 0xf013f
lea esi, [ebp - 0x528]
call fcn.0048fb30
push 0xff
mov ecx, esi
push ecx
push str.SoftwareBillP_StudiosWinPatrolDelayTime
lea ecx, [ebp - 0x318]
mov edx, ebx
call fcn.0048e050
lea edx, [ebp - 0x318]
add esp, 0xc
push edx
call fcn.004a02f9
mov ecx, dword [ebp - 0x530]
add esp, 4
mov edi, eax
mov eax, dword [ebp - 0x52c]
push edi
push eax
push ecx
push str.____d___d__Time:__d
lea edx, [ebp - 0x218]
push 0x104
push edx
call fcn.00402830
push str.Delayed_Start_Timer
lea esi, [ebp - 0x218]
call fcn.0047fb10
add esp, 0x1c
cmp edi, dword [ebp + 8]
jne 0x496a6a
push 0xff
lea eax, [ebp - 0x528]
push eax
push str.SoftwareBillP_StudiosWinPatrolDelay
lea ecx, [ebp - 0x318]
mov edx, ebx
call fcn.0048e050
lea ecx, [ebp - 0x318]
add esp, 0xc
push ecx
call fcn.004a02f9
add esp, 4
push 0xff
lea edx, [ebp - 0x528]
push edx
push str.SoftwareBillP_StudiosWinPatrolDelayOpenAs
lea ecx, [ebp - 0x318]
mov edx, ebx
mov dword [ebp - 0x530], eax
call fcn.0048e050
lea eax, [ebp - 0x318]
add esp, 0xc
push eax
call fcn.004a02f9
add esp, 4
push 0xff
lea ecx, [ebp - 0x528]
push ecx
push str.SoftwareBillP_StudiosWinPatrolDelayParameters
lea ecx, [ebp - 0x318]
mov edx, ebx
mov dword [ebp - 0x52c], eax
call fcn.0048e050
lea edx, [ebp - 0x110]
add esp, 0xc
push edx
lea ecx, [ebp - 0x528]
call fcn.0047f1b0
add esp, 4
lea eax, [ebp - 0x318]
push eax
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x420]
call fcn.00401000
push str.Launch_Program
lea esi, [ebp - 0x110]
call fcn.0047fb10
add esp, 4
mov ecx, esi
call fcn.0047d280
test eax, eax
je 0x496a64
mov ecx, dword [ebp - 0x530]
push edi
push ecx
mov edx, esi
push edx
push str.____s__Type:__d__Time:__d
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00402830
push str.Delayed_File_Exists
lea esi, [ebp - 0x218]
call fcn.0047fb10
add esp, 0x1c
lea ecx, [ebp - 0x110]
push ecx
push 0x487a00
mov dword [0x4cc878], 0
call fcn.0047ce90
cmp dword [0x4cc878], 0
ja 0x496a64
push edi
mov edi, dword [ebp - 0x530]
push edi
lea edx, [ebp - 0x110]
push edx
push str.____s__Type:__d__Time:__d
mov eax, esi
push 0x104
push eax
call fcn.00402830
push str.Delayed_File_is_not_active
call fcn.0047fb10
add esp, 0x1c
push 0xff
lea ecx, [ebp - 0x528]
push ecx
push str.SoftwareBillP_StudiosWinPatrolDelayApplet
lea ecx, [ebp - 0x318]
mov edx, ebx
call fcn.0048e050
add esp, 0xc
test eax, eax
je 0x4969b4
lea edx, [ebp - 0x110]
push edx
mov edx, 0x7ffffffe
mov eax, 0x104
mov ecx, esi
call fcn.00401000
lea eax, [ebp - 0x318]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x110]
call fcn.00401000
mov edx, 0x104
mov eax, esi
lea ecx, [ecx]
cmp byte [eax], 0
je 0x49695b
inc eax
dec edx
jne 0x496950
jmp 0x496985
test edx, edx
je 0x496985
mov ecx, 0x104
sub ecx, edx
lea edx, [ebp - 0x420]
mov eax, 0x104
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x218]
mov edx, 0x7fffffff
call fcn.00401000
lea eax, [ebp - 0x218]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x420]
call fcn.00401000
push str.Delayed_Start_Build_RUNDLL_Launch
lea esi, [ebp - 0x110]
call fcn.0047fb10
add esp, 4
mov edx, dword [0x4c6444]
lea ecx, [ebp - 0x538]
push ecx
push edx
push 0
push str.SoftwareBillP_StudiosWinPatrolDelayRunAs
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x496a1e
lea eax, [ebp - 0x540]
push eax
lea ecx, [ebp - 0x544]
push ecx
mov ecx, dword [ebp - 0x538]
lea edx, [ebp - 0x550]
push edx
push 0
lea eax, [ebp - 0x110]
push eax
push ecx
mov dword [ebp - 0x540], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x496ad8
mov edx, dword [ebp - 0x538]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Delayed_Start_Launch
lea esi, [ebp - 0x110]
call fcn.0047fb10
add esp, 4
push str.Parameters_
lea esi, [ebp - 0x420]
call fcn.0047fb10
mov eax, dword [ebp - 0x52c]
add esp, 4
push eax
push 0
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x420]
mov ecx, edi
call fcn.00480df0
add esp, 0xc
inc dword [0x4d2a70]
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp eax, dword [ebp - 0x54c]
jl 0x496650
cmp dword [0x4d2afc], 0
je 0x496aa3
mov edx, dword [ebp - 0x53c]
mov eax, dword [ebp - 0x548]
mov dword [0x4c6444], edx
mov dword [0x4c6448], eax
push 0x4b17de
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x496ac2
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [0x4d2a70]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x538]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x544], 0x31
jne 0x496a1e
push str.Delayed_Start_as_Administrator
lea esi, [ebp - 0x110]
call fcn.0047fb10
add esp, 4
push str.Parameters_
lea esi, [ebp - 0x420]
call fcn.0047fb10
mov ecx, dword [ebp - 0x52c]
add esp, 4
push ecx
push 1
lea edx, [ebp - 0x110]
push edx
jmp 0x496a54