Function at 0x4947d0
Capabilities:
Get common file path
Get hostname
Get session user name
Get system information on windows
Identify system language via api

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x548687
push eax
mov dword fs:[0], esp
sub esp, 0x28c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x8e0]
test eax, eax
je 0x494817
mov eax, dword [esp + 0x2b0]
mov ecx, dword [esp + 0x2ac]
push eax
push ecx
mov ecx, esi
call fcn.00493440
jmp 0x495b67
mov eax, dword [0x5ab980]
mov dword [esp + 0x10], eax
mov dword [esp + 0x2a4], 0
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2a4], 1
call fcn.00443890
mov ecx, esi
call fcn.004926e0
lea edx, [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0xffffffffffffff9a
push str.GetVersionEx
call fcn.004227e0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 8
lea eax, [esi + 0x28]
push eax
mov dword [eax], 0x94
call edi
test eax, eax
je 0x4953be
cmp dword [esi + 0x38], 1
je 0x494929
lea eax, [esp + 0x19c]
mov dword [esp + 0x19c], 0x9c
push eax
call edi
test eax, eax
je 0x494929
mov ecx, dword [0x5ab980]
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x232]
mov eax, dword [esp + 0x230]
and edx, 0xffff
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x38]
push str._hu._hu
push ecx
mov byte [esp + 0x2b4], 2
call fcn.0050e6c7
add esp, 0x10
lea ecx, [esp + 0x20]
push str.OSVersionInfoEx.ServicePack
call fcn.00512952
lea edx, [esp + 0x30]
lea eax, [esp + 0x20]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x2ac], 3
call fcn.00495bd0
lea ecx, [esp + 0x20]
mov byte [esp + 0x2a4], 2
call fcn.005128e4
lea ecx, [esp + 0x30]
mov byte [esp + 0x2a4], 1
call fcn.005128e4
mov ebp, dword [esi + 0x38]
xor ecx, ecx
cmp ebp, 2
sete cl
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [esi + 0xc6], ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [esi + 0xc4], ax
lea edx, [esp + 0x2c]
lea eax, [esp + 0x94]
mov edi, 0x104
push edx
push eax
mov dword [esp + 0x34], edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x494985
lea ecx, [esp + 0x94]
push ecx
lea ecx, [esi + 0xcc]
call fcn.00512a6d
lea edx, [esp + 0x2c]
lea eax, [esp + 0x94]
push edx
push eax
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x4949b3
lea ecx, [esp + 0x94]
push ecx
lea ecx, [esi + 0xc8]
call fcn.00512a6d
push 0xffffffffffffff9a
push str.GetWindowsDirectory
mov dword [esp + 0x34], 0x103
call fcn.004227e0
mov edx, dword [esp + 0x34]
add esp, 8
lea eax, [esp + 0x94]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x4953be
cmp eax, dword [esp + 0x2c]
ja 0x494a7b
lea ecx, [esp + 0x94]
lea eax, [esi + 0xdc]
push ecx
push eax
mov ecx, esi
call fcn.00495b90
push 0xffffffffffffff9a
push str.GetSystemDirectory
call fcn.004227e0
mov edx, dword [esp + 0x34]
add esp, 8
lea eax, [esp + 0x94]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4953be
cmp eax, dword [esp + 0x2c]
ja 0x494a7b
lea ecx, [esp + 0x94]
lea edi, [esi + 0xe4]
push ecx
push edi
mov ecx, esi
call fcn.00495b90
push 0xffffffffffffff9a
push str.GetTempPath
call fcn.004227e0
mov eax, dword [esp + 0x34]
add esp, 8
lea edx, [esp + 0x94]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4953be
cmp eax, dword [esp + 0x2c]
jbe 0x494aaa
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a4], 0
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4], 0xffffffff
call fcn.005128e4
mov eax, 0xfffffffe
jmp 0x495b67
lea ecx, [esp + 0x94]
lea edx, [esi + 0xe0]
push ecx
push edx
mov ecx, esi
call fcn.00495b90
mov eax, dword [0x5ab980]
mov dword [esp + 0x20], eax
push str.KERNEL32.DLL
lea ecx, [esp + 0x18]
mov bl, 4
push edi
push ecx
mov byte [esp + 0x2b0], bl
call fcn.00512b79
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a8], 5
call fcn.00512a1d
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
mov edx, dword [esp + 0x20]
push 0
push 0x80
push 3
push 0
push 3
push bind
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
cmp edi, 0xffffffff
jne 0x494b3c
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
mov dword [esp + 0x34], eax
jmp 0x494b61
lea eax, [esi + 0xbc]
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x494b5e
call ebp
mov dword [esp + 0x34], eax
push edi
call ebx
lea ecx, [esp + 0x20]
mov byte [esp + 0x2a4], 1
call fcn.005128e4
mov eax, dword [esp + 0x30]
test eax, eax
je 0x494c0a
lea edx, [esp + 0x14]
mov dword [esi + 0x764], 1
push edx
push 8
mov dword [esp + 0x28], 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x494bef
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1a0]
push ecx
push edx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [esp + 0x14]
mov edi, eax
push ecx
call ebx
test edi, edi
je 0x494bef
mov eax, dword [esp + 0x19c]
lea edx, [esi + 0xd0]
push edx
push eax
call fcn.00421a90
add esp, 8
test eax, eax
jne 0x494bf5
call ebp
mov dword [esp + 0x34], eax
lea edi, [esi + 0xd8]
push 1
push edi
push str.DefaultDomainName
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindows_NTCurrentVersionWinlogon
jmp 0x494c72
lea ecx, [esp + 0x14]
mov dword [esi + 0x764], 0
push ecx
push str.UserProfiles
push str.HKEY_LOCAL_MACHINENetworkLogon
call fcn.0041f120
add esp, 0xc
test eax, eax
jle 0x494c41
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x494c41
mov dword [esi + 0x764], 1
lea edi, [esi + 0xd8]
push 1
push edi
push str.AuthenticatingAgent
push str.HKEY_LOCAL_MACHINESystemCurrentControlSetServicesMSNP32NetworkProvider
call fcn.0041efa0
mov ecx, dword [edi]
add esp, 0x10
mov eax, dword [ecx - 8]
test eax, eax
jne 0x494c7a
push 1
push edi
push str.Container
push str.HKEY_LOCAL_MACHINESecurityProvider
call fcn.0041efa0
add esp, 0x10
mov ecx, edi
call fcn.0050e8af
mov ecx, edi
call fcn.0050e7b8
lea edx, [esi + 0x768]
push 0
push edx
lea ecx, [esp + 0x44]
call fcn.004438a0
lea ecx, [esp + 0x4c]
call fcn.00443080
lea eax, [esp + 0x4c]
mov bl, 6
push 0x14
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x2ac], bl
call fcn.004438a0
test eax, eax
jle 0x494cf9
mov eax, dword [esp + 0x50]
test eax, eax
je 0x494cf9
mov ecx, dword [eax + 8]
lea edx, [esp + 0x14]
push edx
call fcn.00441e60
push eax
lea ecx, [esi + 0x788]
mov byte [esp + 0x2a8], 7
call fcn.00512a1d
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2a4], 1
call fcn.004430c0
mov eax, dword [0x5ab980]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
mov bl, 9
test eax, eax
mov byte [esp + 0x2a4], bl
je 0x494e12
lea eax, [esp + 0x1c]
push 0
push eax
push str.ProfilesDirectory
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
call fcn.0041efa0
mov ecx, dword [esp + 0x2c]
add esp, 0x10
mov eax, dword [ecx - 8]
test eax, eax
jne 0x494e4a
push 0xffffffffffffff97
push str.Retrieve_Profile_Directory_NT
mov dword [esp + 0x34], 0x103
call fcn.004227e0
add esp, 8
push str.USERENV.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push str.GetProfilesDirectoryA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x494d94
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x49539c
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x94]
push edx
push ecx
call eax
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebp, ebp
jne 0x494dff
lea ecx, [esp + 0x28]
mov byte [esp + 0x2a4], 8
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2a4], 1
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a4], 0
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4], 0xffffffff
call fcn.005128e4
or eax, 0xffffffff
jmp 0x495b67
lea edx, [esp + 0x94]
lea ecx, [esp + 0x1c]
push edx
call fcn.00512a6d
jmp 0x494e4a
lea eax, [esi + 0xdc]
push str.Profiles_
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00512b79
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x2a8], 0xa
call fcn.00512a1d
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
push 0xffffffffffffff96
push str.Retrieve_Profile_Directory
call fcn.004227e0
mov ecx, dword [esp + 0x24]
add esp, 8
mov eax, dword [ecx - 8]
test eax, eax
jne 0x494eb3
lea ecx, [esp + 0x28]
mov byte [esp + 0x2a4], 8
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2a4], 1
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a4], 0
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4], 0xffffffff
call fcn.005128e4
or eax, 0xffffffff
jmp 0x495b67
lea edx, [esp + 0x1c]
push edx
call fcn.0041f9c0
add esp, 4
lea ecx, [esp + 0x14]
push str.ProfilesDir
call fcn.00512952
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x2ac], 0xb
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10]
push edx
call fcn.00512a1d
push 0xffffffffffffff96
push str.ExpandEnv_Retrieve_Profile_Directory
call fcn.004227e0
lea eax, [esp + 0x18]
push eax
call fcn.00420f40
add esp, 0xc
test eax, eax
jge 0x494f71
lea ecx, [esp + 0x28]
mov byte [esp + 0x2a4], 8
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2a4], 1
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a4], 0
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4], 0xffffffff
call fcn.005128e4
or eax, 0xffffffff
jmp 0x495b67
push str.ProfilesDirEx
lea ecx, [esp + 0x18]
call fcn.00512952
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x2ac], 0xc
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
mov ebp, 0x103
lea eax, [esp + 0x94]
push ebp
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x38], ebp
call fcn.00421160
add esp, 0xc
test eax, eax
jl 0x49502c
lea edx, [esp + 0x94]
lea ecx, [esp + 0x20]
push edx
call fcn.00512952
push str.ProfilesExDirDOS
lea ecx, [esp + 0x18]
mov byte [esp + 0x2a8], 0xd
call fcn.00512952
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x2ac], 0xe
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], 0xd
call fcn.005128e4
lea ecx, [esp + 0x20]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4954a1
push 0xffffffffffffff95
push str.Retrieve_target_DefaultUserProfile_Directory
call fcn.004227e0
mov eax, dword [esi + 0x2c]
mov edi, 5
add esp, 8
cmp eax, edi
jae 0x49508e
lea edx, [esp + 0x1c]
push str.Default_User_
lea eax, [esp + 0x18]
push edx
push eax
call fcn.00512b79
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a8], 0xf
call fcn.00512a1d
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
jmp 0x495116
lea ecx, [esp + 0x28]
push 0
push ecx
push str.DefaultUserProfile
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
call fcn.0041efa0
add esp, 0x10
test eax, eax
jg 0x4950fa
lea ecx, [esp + 0x28]
mov byte [esp + 0x2a4], 8
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2a4], 1
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a4], 0
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4], 0xffffffff
call fcn.005128e4
or eax, 0xffffffff
jmp 0x495b67
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x18]
push str._s_s_
push ecx
call fcn.0050e6c7
add esp, 0x10
push str.DefUsersDir
lea ecx, [esp + 0x18]
call fcn.00512952
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x2ac], 0x10
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
push 0xffffffffffffff93
push str.ExpandEnv_DefaultUserProfile_Directory
call fcn.004227e0
lea ecx, [esp + 0x18]
push ecx
call fcn.00420f40
add esp, 0xc
test eax, eax
jge 0x4951b9
lea ecx, [esp + 0x28]
mov byte [esp + 0x2a4], 8
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2a4], 1
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a4], 0
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4], 0xffffffff
call fcn.005128e4
or eax, 0xffffffff
jmp 0x495b67
push str.DefUsersDirEx
lea ecx, [esp + 0x18]
call fcn.00512952
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x2ac], 0x11
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
lea ecx, [esp + 0x94]
push ebp
lea edx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x38], ebp
call fcn.00421160
add esp, 0xc
test eax, eax
jl 0x49526f
lea eax, [esp + 0x94]
lea ecx, [esp + 0x20]
push eax
call fcn.00512952
push str.DefUsersDirDOS
lea ecx, [esp + 0x18]
mov byte [esp + 0x2a8], 0x12
call fcn.00512952
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x2ac], 0x13
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], 0x12
call fcn.005128e4
lea ecx, [esp + 0x20]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
push 0xffffffffffffff94
push str.Retrieve_target_AllUsersProfile_Directory
call fcn.004227e0
mov eax, dword [esi + 0x2c]
add esp, 8
cmp eax, edi
jae 0x4952c0
lea eax, [esp + 0x1c]
push str.All_Users_
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00512b79
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a8], 0x14
call fcn.00512a1d
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
jmp 0x495348
lea edx, [esp + 0x28]
push 0
push edx
push str.AllUsersProfile
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
call fcn.0041efa0
add esp, 0x10
test eax, eax
jg 0x49532c
lea ecx, [esp + 0x28]
mov byte [esp + 0x2a4], 8
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2a4], 1
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a4], 0
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4], 0xffffffff
call fcn.005128e4
or eax, 0xffffffff
jmp 0x495b67
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea edx, [esp + 0x18]
push str._s_s_
push edx
call fcn.0050e6c7
add esp, 0x10
push str.AllUsersDir
lea ecx, [esp + 0x18]
call fcn.00512952
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x2ac], 0x15
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
push 0xffffffffffffff93
push str.ExpandEnv_AllUsersProfile_Directory
call fcn.004227e0
lea edx, [esp + 0x18]
push edx
call fcn.00420f40
add esp, 0xc
test eax, eax
jge 0x4953eb
lea ecx, [esp + 0x28]
mov byte [esp + 0x2a4], 8
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2a4], 1
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a4], 0
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4], 0xffffffff
call fcn.005128e4
or eax, 0xffffffff
jmp 0x495b67
push str.AllUsersDirEx
lea ecx, [esp + 0x18]
call fcn.00512952
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x2ac], 0x16
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
lea edx, [esp + 0x94]
push ebp
lea eax, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x38], ebp
call fcn.00421160
add esp, 0xc
test eax, eax
jl 0x4954a1
lea ecx, [esp + 0x94]
push ecx
lea ecx, [esp + 0x24]
call fcn.00512952
push str.AllUsersDirDOS
lea ecx, [esp + 0x18]
mov byte [esp + 0x2a8], 0x17
call fcn.00512952
lea edx, [esp + 0x20]
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x2ac], 0x18
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], 0x17
call fcn.005128e4
lea ecx, [esp + 0x20]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
lea ecx, [esp + 0x10]
push 1
push ecx
push str.Common_Start_Menu
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionexplorerShell_Folders
call fcn.0041efa0
mov edx, dword [esp + 0x20]
add esp, 0x10
mov eax, dword [edx - 8]
test eax, eax
jne 0x49557e
push str.AllUsersDirEx
lea ecx, [esp + 0x18]
call fcn.00512952
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x2ac], 0x19
call fcn.00495ca0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
test eax, eax
je 0x49553e
lea eax, [esp + 0x10]
push str.Start_Menu
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00512b79
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a8], 0x1a
call fcn.00512a1d
mov byte [esp + 0x2a4], bl
lea ecx, [esp + 0x14]
jmp 0x495579
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x49557e
lea eax, [esi + 0xdc]
push str.Start_Menu
lea edx, [esp + 0x18]
push eax
push edx
call fcn.00512b79
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a8], 0x1b
call fcn.00512a1d
mov byte [esp + 0x2a4], bl
lea ecx, [esp + 0x14]
call fcn.005128e4
lea eax, [esp + 0x10]
push eax
call fcn.0041f9c0
add esp, 4
lea ecx, [esp + 0x14]
push str.CommonStartMenuEx
call fcn.00512952
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x2ac], 0x1c
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
lea eax, [esp + 0x10]
push 1
push eax
push str.CommonFilesDir
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion
call fcn.0041efa0
mov ecx, dword [esp + 0x20]
add esp, 0x10
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4955f4
push str.C:Program_FilesCommon_Files_
lea ecx, [esp + 0x14]
call fcn.00512a6d
lea edx, [esp + 0x10]
push edx
call fcn.0041f9c0
add esp, 4
lea ecx, [esp + 0x14]
push str.CommonFilesDirEx
call fcn.00512952
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x2ac], 0x1d
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
lea edx, [esp + 0x24]
lea eax, [esp + 0x10]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00512659
call fcn.004215b0
add esp, 8
test eax, eax
jne 0x495691
push str.CommonFilesDirDOS
lea ecx, [esp + 0x18]
call fcn.00512952
lea ecx, [esp + 0x24]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x2ac], 0x1e
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
lea eax, [esp + 0x10]
push 1
push eax
push str.ProgramFilesDir
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion
call fcn.0041efa0
mov ecx, dword [esp + 0x20]
add esp, 0x10
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4956c3
push str.C:Program_Files_
lea ecx, [esp + 0x14]
call fcn.00512a6d
lea edx, [esp + 0x10]
push edx
call fcn.0041f9c0
add esp, 4
lea ecx, [esp + 0x14]
push str.ProgramFilesDirEx
call fcn.00512952
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x2ac], 0x1f
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
lea edx, [esp + 0x24]
lea eax, [esp + 0x10]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00512659
call fcn.004215b0
add esp, 8
test eax, eax
jne 0x495760
push str.ProgramFilesDirDOS
lea ecx, [esp + 0x18]
call fcn.00512952
lea ecx, [esp + 0x24]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x2ac], 0x20
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
lea eax, [esp + 0x3c]
mov ecx, esi
push eax
call fcn.0044b8b0
mov ecx, esi
call fcn.00495e50
push 0x48
call fcn.00516a15
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov byte [esp + 0x2a4], 0x21
je 0x495796
mov ecx, eax
call fcn.0048f870
jmp 0x495798
xor eax, eax
lea edi, [esi + 0x7e0]
push eax
mov ecx, edi
mov byte [esp + 0x2a8], bl
call fcn.0048bae0
push 0x38
call fcn.00516a15
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov byte [esp + 0x2a4], 0x22
je 0x4957d0
mov ecx, eax
call fcn.0048d970
jmp 0x4957d2
xor eax, eax
push eax
mov ecx, edi
mov byte [esp + 0x2a8], bl
call fcn.0048bae0
push 1
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5b0738
call fcn.00512952
lea ecx, [esi + 0xe8]
call fcn.004c4c00
push 1
push esi
lea ecx, [esi + 0x744]
call fcn.004c5740
mov ecx, dword [esi + 0x760]
lea eax, [esi + 0xe4]
push str.msi.dll
lea edx, [esp + 0x18]
push eax
push edx
mov dword [esi + 0x764], ecx
call fcn.00512b79
mov eax, dword [eax]
mov byte [esp + 0x2a4], 0x23
push eax
call fcn.00421e30
add esp, 4
mov dword [esi + 0x838], eax
lea ecx, [esp + 0x14]
mov dword [esi + 0x83c], edx
mov byte [esp + 0x2a4], bl
call fcn.005128e4
lea ebp, [esi + 0x85c]
mov ecx, esi
push ebp
push str.IEXPLORE.EXE
call fcn.00448560
push str.IEXPLORE.EXE
mov ecx, ebp
call fcn.00444d30
mov edi, eax
test edi, edi
jne 0x495896
push str.IEXPLORE.EXE
mov ecx, ebp
call fcn.00444cd0
mov edi, eax
test edi, edi
je 0x495907
mov eax, dword [0x5ab980]
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x20]
push 0
push ecx
push str.Version
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet_Explorer
mov byte [esp + 0x2b4], 0x24
call fcn.0041efa0
add esp, 0x10
test eax, eax
jle 0x4958f7
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push eax
call fcn.00422fb0
add esp, 8
cmp eax, 2
jne 0x4958f7
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
test eax, eax
ja 0x4958eb
test ecx, ecx
jbe 0x4958f7
mov dword [edi + 0x28], ecx
mov dword [edi + 0x30], ecx
mov dword [edi + 0x2c], eax
mov dword [edi + 0x34], eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
mov eax, dword [esp + 0x2b0]
test eax, eax
jne 0x495a1d
lea ecx, [esp + 0x4c]
call fcn.00466340
mov ecx, dword [0x5b0ab8]
mov byte [esp + 0x2a4], 0x25
test ecx, ecx
mov dword [esp + 0x14], 0
je 0x49595c
mov edx, dword [ecx]
lea eax, [esp + 0x4c]
push eax
push str.Auto.ScanMode
call dword [edx]
test eax, eax
jle 0x49595c
mov eax, dword [esp + 0x5c]
cmp eax, 0x14
mov dword [esp + 0x14], eax
jge 0x495a0d
push 0xfffffed3
push 0x4f52
call fcn.00422800
mov ecx, dword [esp + 0x2b4]
add esp, 8
push ecx
push ebp
mov ecx, esi
call fcn.00448300
mov edi, eax
test edi, edi
jle 0x4959af
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x2ac]
push edx
push eax
mov ecx, esi
call fcn.00449850
mov edi, eax
test edi, edi
jge 0x495a0d
cmp edi, 0xfffffc19
jne 0x4959af
push eax
call fcn.004227c0
add esp, 4
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2a4], bl
call fcn.004663b0
lea ecx, [esp + 0x28]
mov byte [esp + 0x2a4], 8
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2a4], 1
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a4], 0
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4], 0xffffffff
call fcn.005128e4
mov eax, edi
jmp 0x495b67
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2a4], bl
call fcn.004663b0
push 0xfffffec0
push 0x4f58
call fcn.00422800
mov edi, dword [esi + 0x7e4]
add esp, 8
test edi, edi
je 0x495a77
mov eax, edi
mov edi, dword [edi]
push str.HKEY_LOCAL_MACHINE
lea ecx, [esp + 0x18]
mov ebp, dword [eax + 8]
call fcn.00512952
mov edx, dword [ebp]
lea eax, [esp + 0x14]
push eax
mov ecx, ebp
mov byte [esp + 0x2a8], 0x26
call dword [edx + 0x14]
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], bl
call fcn.005128e4
test edi, edi
jne 0x495a39
lea ecx, [esp + 0x6c]
call fcn.004436d0
mov ecx, dword [0x5ab980]
mov dword [esp + 0x38], ecx
push 0
lea edx, [esp + 0x38]
push 0
lea eax, [esp + 0x74]
push edx
push eax
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs
lea ecx, [esp + 0x50]
mov byte [esp + 0x2b8], 0x28
call fcn.00444400
mov edi, dword [esp + 0x70]
test edi, edi
je 0x495adc
mov eax, edi
mov edi, dword [edi]
mov eax, dword [eax + 8]
cmp byte [eax + 4], 1
jne 0x495ad8
cmp dword [eax + 0x10], 1
jbe 0x495ad8
add eax, 8
lea ecx, [esi + 0x7fc]
push eax
call fcn.00510fd7
test edi, edi
jne 0x495ab6
push 0
lea ecx, [esp + 0x38]
push 0
add esi, 0x878
push ecx
push esi
push str.HKEY_LOCAL_MACHINESystemCurrentControlSetControlVMM32Files
lea ecx, [esp + 0x50]
call fcn.00444400
lea ecx, [esp + 0x38]
mov byte [esp + 0x2a4], 0x27
call fcn.005128e4
lea ecx, [esp + 0x6c]
mov byte [esp + 0x2a4], bl
call fcn.00443720
lea ecx, [esp + 0x28]
mov byte [esp + 0x2a4], 8
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2a4], 1
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a4], 0
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4], 0xffffffff
call fcn.005128e4
mov eax, 1
mov ecx, dword [esp + 0x29c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x298
ret 8