Function at 0x4829c0
Capabilities:
Create process on windows
Get common file path
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484ad7
mov eax, dword fs:[0]
push eax
sub esp, 0x4a4
mov eax, dword [0x4b6018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x3c0]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x482a78
lea ecx, [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x3c0]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [ebp - 0x3c0]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp - 0x11c]
add ecx, 0xffffffff
mov dword [ebp - 0x47c], ecx
mov edx, dword [ebp - 0x47c]
mov al, byte [edx + 1]
mov byte [ebp - 0x47d], al
add dword [ebp - 0x47c], 1
cmp byte [ebp - 0x47d], 0
jne 0x482a38
mov edi, dword [ebp - 0x47c]
mov ecx, dword [str.Microsoft_]
mov dword [edi], ecx
mov edx, dword [0x4a97d4]
mov dword [edi + 4], edx
mov eax, dword [0x4a97d8]
mov dword [edi + 8], eax
jmp 0x482a84
mov ecx, dword [0x4a97dc]
mov dword [ebp - 0x11c], ecx
lea edx, [ebp - 0x11c]
mov dword [ebp - 0x484], edx
lea eax, [ebp - 0x33c]
mov dword [ebp - 0x488], eax
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x48c], ecx
mov edx, dword [ebp - 0x484]
mov al, byte [edx]
mov byte [ebp - 0x48d], al
mov ecx, dword [ebp - 0x488]
mov dl, byte [ebp - 0x48d]
mov byte [ecx], dl
mov eax, dword [ebp - 0x484]
add eax, 1
mov dword [ebp - 0x484], eax
mov ecx, dword [ebp - 0x488]
add ecx, 1
mov dword [ebp - 0x488], ecx
cmp byte [ebp - 0x48d], 0
jne 0x482aa8
lea edx, [ebp - 0x33c]
add edx, 0xffffffff
mov dword [ebp - 0x494], edx
mov eax, dword [ebp - 0x494]
mov cl, byte [eax + 1]
mov byte [ebp - 0x495], cl
add dword [ebp - 0x494], 1
cmp byte [ebp - 0x495], 0
jne 0x482afa
mov edi, dword [ebp - 0x494]
mov edx, dword [str.MSYMDCOM2.dat]
mov dword [edi], edx
mov eax, dword [0x4a97e4]
mov dword [edi + 4], eax
mov ecx, dword [0x4a97e8]
mov dword [edi + 8], ecx
mov dx, word [0x4a97ec]
mov word [edi + 0xc], dx
push 0x4a97f0
lea eax, [ebp - 0x33c]
push eax
call dword [sym.imp.MSVCR90.dll_fopen]
add esp, 8
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x482d84
push 2
push 0
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
mov edx, dword [ebp - 0x120]
push edx
call dword [sym.imp.MSVCR90.dll_ftell]
add esp, 4
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.MSVCR90.dll_rewind]
add esp, 4
mov ecx, dword [ebp - 0x454]
add ecx, 1
push ecx
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [ebp - 0x450], eax
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x454]
push eax
push 1
mov ecx, dword [ebp - 0x450]
push ecx
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
mov dword [ebp - 0x3d0], eax
mov edx, dword [ebp - 0x120]
push edx
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
mov eax, dword [str.A7ws9dPA]
mov dword [ebp - 0x44c], eax
mov ecx, dword [0x4a9680]
mov dword [ebp - 0x448], ecx
lea edi, [ebp - 0x444]
mov ecx, 0xd
mov esi, str.QAZWSXEDCRFVTGBYHNUJMIKOLPqwertyuiop_asdfghjklzxcvbnm
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x40f]
mov ecx, 0xd
mov esi, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNO_PQRSTUVWXYZ
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x46c], 0
jmp 0x482c4c
mov edx, dword [ebp - 0x46c]
add edx, 1
mov dword [ebp - 0x46c], edx
mov eax, dword [ebp - 0x454]
sub eax, 1
cmp dword [ebp - 0x46c], eax
jg 0x482c98
mov ecx, dword [ebp - 0x450]
add ecx, dword [ebp - 0x46c]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x46c]
and eax, 0x80000007
jns 0x482c7e
dec eax
or eax, 0xfffffff8
inc eax
movsx ecx, byte [ebp + eax - 0x44c]
xor edx, ecx
mov eax, dword [ebp - 0x450]
add eax, dword [ebp - 0x46c]
mov byte [eax], dl
jmp 0x482c3d
mov ecx, dword [ebp - 0x450]
add ecx, dword [ebp - 0x454]
mov byte [ecx], 0
mov edx, dword [ebp - 0x450]
push edx
call dword [sym.imp.MSVCR90.dll_atoi]
add esp, 4
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 0
je 0x482d84
mov eax, dword [ebp - 0x458]
add eax, 0x1e28500
mov dword [ebp - 0x460], eax
push 0
call dword [sym.imp.MSVCR90.dll__time64]
add esp, 4
mov dword [ebp - 0x45c], eax
mov ecx, dword [ebp - 0x45c]
cmp ecx, dword [ebp - 0x460]
jl 0x482d84
cmp dword [0x4c7af0], 0
jne 0x482d7d
push 0
mov edx, dword [0x4c8c00]
push edx
push str.Your_1_year_Pro_License_has_expired._Please_buy_a_new_one._We_will_open_the_renew_page_for_you_in_browser.
push 0
call dword [sym.imp.BCGCBPRO120090.dll_int___cdecl_BCGPMessageBox_struct_HWND_____char_const___char_const___unsigned_int_]
add esp, 0x10
push str._renew.html
push 0x4c8bfc
lea eax, [ebp - 0x464]
push eax
call fcn.00401660
add esp, 0xc
mov dword [ebp - 0x470], eax
mov ecx, dword [ebp - 0x470]
mov edx, dword [ecx]
mov dword [ebp - 0x474], edx
push 1
push 0
push 0
mov eax, dword [ebp - 0x474]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x464]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [0x4c7af0], 1
xor eax, eax
jmp 0x48303a
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x49c], ecx
lea edx, [ebp - 0x22c]
mov dword [ebp - 0x4a0], edx
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x4a4], eax
mov ecx, dword [ebp - 0x49c]
mov dl, byte [ecx]
mov byte [ebp - 0x4a5], dl
mov eax, dword [ebp - 0x4a0]
mov cl, byte [ebp - 0x4a5]
mov byte [eax], cl
mov edx, dword [ebp - 0x49c]
add edx, 1
mov dword [ebp - 0x49c], edx
mov eax, dword [ebp - 0x4a0]
add eax, 1
mov dword [ebp - 0x4a0], eax
cmp byte [ebp - 0x4a5], 0
jne 0x482da8
lea ecx, [ebp - 0x22c]
add ecx, 0xffffffff
mov dword [ebp - 0x4ac], ecx
mov edx, dword [ebp - 0x4ac]
mov al, byte [edx + 1]
mov byte [ebp - 0x4ad], al
add dword [ebp - 0x4ac], 1
cmp byte [ebp - 0x4ad], 0
jne 0x482dfa
mov edi, dword [ebp - 0x4ac]
mov ecx, dword [str.MSYMDCOM.dat]
mov dword [edi], ecx
mov edx, dword [0x4a987c]
mov dword [edi + 4], edx
mov eax, dword [0x4a9880]
mov dword [edi + 8], eax
mov cl, byte [0x4a9884]
mov byte [edi + 0xc], cl
push 0x4a97f0
lea edx, [ebp - 0x22c]
push edx
call dword [sym.imp.MSVCR90.dll_fopen]
add esp, 8
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x482e6c
xor eax, eax
jmp 0x48303a
push 2
push 0
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 0x230]
push ecx
call dword [sym.imp.MSVCR90.dll_ftell]
add esp, 4
mov dword [ebp - 0x3bc], eax
mov edx, dword [ebp - 0x230]
push edx
call dword [sym.imp.MSVCR90.dll_rewind]
add esp, 4
mov eax, dword [ebp - 0x3bc]
add eax, 1
push eax
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [ebp - 0x3cc], eax
mov ecx, dword [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x3bc]
push edx
push 1
mov eax, dword [ebp - 0x3cc]
push eax
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
mov dword [ebp - 0x3c8], eax
mov ecx, dword [ebp - 0x230]
push ecx
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
mov edx, dword [ebp - 0x3c8]
cmp edx, dword [ebp - 0x3bc]
je 0x482f1a
mov eax, dword [ebp - 0x3cc]
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
xor eax, eax
jmp 0x48303a
mov ecx, dword [str.A7ws9dPA]
mov dword [ebp - 0x3b4], ecx
mov edx, dword [0x4a9680]
mov dword [ebp - 0x3b0], edx
lea edi, [ebp - 0x3ac]
mov ecx, 0xd
mov esi, str.QAZWSXEDCRFVTGBYHNUJMIKOLPqwertyuiop_asdfghjklzxcvbnm
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x377]
mov ecx, 0xd
mov esi, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNO_PQRSTUVWXYZ
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x478], 0
jmp 0x482f73
mov eax, dword [ebp - 0x478]
add eax, 1
mov dword [ebp - 0x478], eax
mov ecx, dword [ebp - 0x3bc]
sub ecx, 1
cmp dword [ebp - 0x478], ecx
jg 0x482fc0
mov edx, dword [ebp - 0x3cc]
add edx, dword [ebp - 0x478]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x478]
and ecx, 0x80000007
jns 0x482fa6
dec ecx
or ecx, 0xfffffff8
inc ecx
movsx edx, byte [ebp + ecx - 0x3b4]
xor eax, edx
mov ecx, dword [ebp - 0x3cc]
add ecx, dword [ebp - 0x478]
mov byte [ecx], al
jmp 0x482f64
mov edx, dword [ebp - 0x3cc]
add edx, dword [ebp - 0x3bc]
mov byte [edx], 0
lea eax, [ebp - 0x3c4]
push eax
call fcn.0047f650
add esp, 4
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x3cc]
push ecx
lea ecx, [ebp - 0x3c4]
call dword [sym.imp.mfc90.dll_Ordinal_1607]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x3b8], eax
mov edx, dword [ebp - 0x3cc]
push edx
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x468], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c4]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x468]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00408de6
mov esp, ebp
pop ebp
ret