Function at 0x485360
Capabilities:
Check for time delay via gettickcount
Create process on windows
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8d8
push esi
push edi
mov esi, ecx
xor edi, edi
cmp esi, edi
jne 0x48537b
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 1
push str.Preparing_process_startup_line...
mov dword [ebp - 8], edi
call fcn.00479200
mov eax, dword [esi + 0x47c]
mov ecx, dword [0x50b39c]
push edi
mov dword [ebp - 0x4c], eax
call fcn.00405600
test al, al
jne 0x4853c0
mov ecx, dword [0x50b384]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4853c0
mov edx, dword [0x50b384]
mov dword [ebp - 0x44], edx
jmp 0x4853c9
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x44], eax
mov eax, dword [esi + 0x670c]
mov dword [esi + 0x6b8], edi
cmp eax, edi
je 0x485409
cmp dword [eax + 0x38], edi
je 0x4853f0
mov ecx, dword [eax + 0x38]
mov dword [eax + 0x38], edi
cmp ecx, 0xffffffff
je 0x4853f0
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x670c]
cmp eax, edi
je 0x485409
push eax
call fcn.00441300
add esp, 4
mov dword [esi + 0x670c], edi
xor eax, eax
mov dword [esi + 0x44cc], edi
mov byte [esi + 0x44d0], 0
mov dword [esi + 0x6b4], 1
mov dword [esi + 0x44c8], edi
mov byte [esi + 0x4a4], 0
mov dword [esi + 0x3c08], eax
mov dword [esi + 0x3c0c], eax
push 0x44
mov dword [esi + 0x3c10], eax
lea eax, [ebp - 0x94]
push edi
push eax
call fcn.004b03e0
add esp, 0xc
mov dword [ebp - 0x94], 0x44
mov dword [ebp - 0x68], 0xb
xor eax, eax
jmp 0x485470
movzx ecx, word [eax + str.ConEmu]
mov word [ebp + eax - 0x8d8], cx
add eax, 2
cmp cx, di
jne 0x485470
lea ecx, [ebp - 0x8d8]
mov dword [ebp - 0x88], ecx
mov ecx, dword [esi + 0x3bec]
push ebx
call fcn.0046d520
mov ecx, dword [esi + 0x3bec]
movsx edx, ax
mov dword [ebp - 0x74], edx
call fcn.0046d530
mov ecx, dword [esi + 0x3bec]
cwde
push 3
mov dword [ebp - 0x70], eax
call fcn.0046d1f0
mov ecx, dword [esi + 0x3bec]
test eax, eax
je 0x48550d
call fcn.0046d570
mov ebx, eax
push 0x20
add ebx, ebx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
add edi, ebx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 2
add edi, edi
call ebx
mov ecx, dword [esi + 0x3bec]
add eax, edi
mov dword [ebp - 0x7c], eax
call fcn.0046d5a0
lea ecx, [eax + eax*2]
push 0x21
mov dword [ebp - 0x10], ecx
call ebx
mov edi, eax
add edi, dword [ebp - 0x10]
jmp 0x485541
call fcn.0046d570
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
push 0x20
add edi, edi
call ebx
mov ecx, dword [esi + 0x3bec]
add eax, edi
add eax, eax
mov dword [ebp - 0x7c], eax
call fcn.0046d5a0
lea edx, [eax + eax*2]
push 0x21
mov dword [ebp - 0x10], edx
call ebx
mov edi, eax
add edi, dword [ebp - 0x10]
push 4
add edi, edi
call ebx
add eax, edi
mov dword [ebp - 0x78], eax
mov eax, dword [0x50b3a0]
xor ecx, ecx
cmp byte [eax + 0x1181c], cl
setne cl
xor ebx, ebx
push ebx
mov word [ebp - 0x64], cx
movzx edx, byte [eax + 0x1181c]
xor eax, eax
cmp dword [esi + 0x3780], ebx
lea ecx, [ebp - 0x1c]
push ecx
push ebx
push 0xf003f
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
push ebx
setne al
push ebx
push ebx
push str.ConsoleConEmu
push SysReAllocString
mov dword [esi + 0x44a4], edx
mov dword [ebp - 0x1c], ebx
inc eax
mov dword [ebp - 0x28], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea edi, [ebx + 0x10]
cmp eax, ebx
jne 0x48568d
mov eax, 0x3e7
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x48], 4
mov dword [ebp - 0xb4], str.HistoryBufferSize
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], 0x32
mov dword [ebp - 0xa4], str.NumberOfHistoryBuffers
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], 0x20
lea edi, [ebp - 0xac]
mov dword [ebp - 0x20], 2
nop
mov ebx, dword [edi - 8]
lea edx, [ebp - 0x48]
push edx
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x485662
mov eax, dword [ebp - 0x24]
mov ecx, 4
cmp dword [ebp - 0x50], ecx
jne 0x48564b
cmp dword [ebp - 0x48], ecx
jne 0x48564b
cmp eax, dword [edi - 4]
jb 0x48564b
cmp eax, dword [edi]
jbe 0x48567d
mov ecx, dword [edi - 4]
cmp eax, ecx
jae 0x485657
mov dword [ebp - 0x24], ecx
jmp 0x485668
mov ecx, dword [edi]
cmp eax, ecx
jbe 0x485662
mov dword [ebp - 0x24], ecx
jmp 0x485668
mov eax, dword [edi + 4]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x1c]
push 4
lea ecx, [ebp - 0x24]
push ecx
push 4
push 0
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add edi, 0x10
sub dword [ebp - 0x20], 1
jne 0x485610
xor ebx, ebx
lea edi, [ebx + 0x10]
jmp 0x4856a1
push ebx
push ebx
push ebx
push eax
push str.Failed_to_create_open_registry_key_HKCUConsoleConEmu
call fcn.004200b0
add esp, 0x14
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x1c]
push eax
push 1
lea ecx, [ebp - 9]
push ecx
lea edx, [ebp - 0xa]
push edx
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 3]
push ecx
mov ecx, esi
call fcn.00480710
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 3]
or dword [ebp - 0x68], edi
shl edx, 4
or edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x6c], edx
cmp eax, ebx
je 0x4856e2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], ebx
mov eax, dword [esi + 0x3780]
cmp eax, ebx
je 0x4856f1
cmp word [eax], bx
jne 0x4856fd
mov ecx, dword [0x50b3a0]
push ebx
call fcn.00447c50
mov edi, eax
mov eax, dword [esi + 0x3be8]
cmp eax, ebx
je 0x485718
push eax
call fcn.00441300
add esp, 4
mov dword [esi + 0x3be8], ebx
push edi
mov ecx, esi
call fcn.00476b10
mov dword [esi + 0x3be8], eax
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jne 0x485730
mov dword [ebp - 0x2c], edi
mov ecx, 0x601
cmp word [0x4ec108], cx
sete al
mov byte [ebp - 2], al
test al, al
je 0x485790
cmp dword [esi + 0x48c], ebx
jne 0x485760
push 8
push 1
call fcn.004412c0
add esp, 8
mov dword [esi + 0x48c], eax
mov edi, dword [esi + 0x48c]
cmp edi, ebx
je 0x48578c
push 0xc
push 0x100
call fcn.004412c0
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x48578c
mov dword [edi + 4], 0x100
mov byte [ebp - 2], 1
jmp 0x4857c7
mov byte [ebp - 2], 0
mov edi, dword [esi + 0x48c]
cmp edi, ebx
je 0x4857ae
mov eax, dword [edi]
mov dword [edi + 4], ebx
cmp eax, ebx
je 0x4857ae
push eax
call fcn.00441300
add esp, 4
mov dword [edi], ebx
mov eax, dword [esi + 0x48c]
cmp eax, ebx
je 0x4857c7
push eax
call fcn.00441300
add esp, 4
mov dword [esi + 0x48c], ebx
cmp dword [ebp - 0x28], 2
jg 0x486212
movzx eax, byte [ebp - 9]
movzx edx, byte [ebp - 0xa]
movzx ecx, byte [ebp - 1]
shl eax, 8
or eax, edx
movzx edx, byte [ebp - 3]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x485800
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, dword [0x50b39c]
add eax, 0x1b4
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x485820
sub eax, edx
sar eax, 1
lea edi, [edi + eax + 0x352]
lea eax, [edi + edi]
push eax
call fcn.004412a0
add esp, 4
push 0x4c2ee0
mov ebx, eax
push edi
xor ecx, ecx
push ebx
mov dword [ebp - 0x14], ebx
mov word [ebx], cx
call fcn.00401880
mov edx, dword [ebp - 0x2c]
mov ecx, dword [0x50b39c]
push edx
call fcn.0040fa20
push eax
push edi
push ebx
call fcn.00401880
push 0x4c2924
push edi
push ebx
call fcn.00401880
cmp dword [esi + 0x378c], 0
je 0x4858a8
mov eax, dword [0x50b39c]
cmp dword [eax + 0x4388], 0
jne 0x4858a8
push str.__ATTACH
push edi
push ebx
mov dword [esi + 0x3770], 1
call fcn.00401880
mov ecx, dword [0x50b3a0]
mov eax, dword [ecx + 0x11820]
cmp eax, 0xffffffff
jne 0x4858c2
cmp dword [esi + 0x39ac], 0
je 0x485908
mov ecx, eax
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
cmp dword [esi + 0x39ac], 0
je 0x4858dd
and ecx, 0xffffffdf
or ecx, 0x200000
mov eax, ebx
lea edx, [eax + 2]
mov dword [ebp - 0x10], edx
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4858e5
sub eax, dword [ebp - 0x10]
push ecx
sar eax, 1
lea eax, [ebx + eax*2]
push str.__CINMODE_X
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, dword [esi + 0x3bec]
call fcn.0046d570
mov ecx, dword [esi + 0x3bec]
mov dword [ebp - 0x10], eax
call fcn.0046d5a0
mov ecx, esi
mov edx, eax
call fcn.004770a0
mov dword [ebp - 8], eax
mov eax, ebx
lea ecx, [eax + 2]
mov bx, word [eax]
add eax, 2
test bx, bx
jne 0x485932
sub eax, ecx
mov ecx, dword [ebp - 0x30]
push ecx
sar eax, 1
mov ebx, eax
mov eax, dword [0x50b3a0]
mov ecx, dword [eax + 0xee4]
push ecx
mov ecx, dword [eax + 0xee8]
push ecx
mov ecx, dword [ebp - 0x10]
add eax, 0xf00
push eax
mov eax, dword [esi + 0x3c00]
push eax
push edx
mov edx, dword [0x50b384]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
lea edx, [ecx + ebx*2]
push str._AID_u__GID_u__GHWND_08X__BW_i__BH_i__BZ_i___FN_s___FW_i__FH_i__TA_08X
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov al, byte [esi + 0x44d2]
add esp, 0x30
test al, al
je 0x4859c1
cmp al, 3
jne 0x4859a8
mov eax, str.__LOG3
jmp 0x4859b6
cmp al, 2
mov eax, str.__LOG2
je 0x4859b6
mov eax, str.__LOG
push eax
mov eax, dword [ebp - 0x14]
push edi
push eax
call fcn.00401880
mov ecx, dword [0x50b3a0]
cmp byte [ecx + 0x1181c], 0
mov ebx, dword [ebp - 0x14]
jne 0x4859df
push str.__HIDE
push edi
push ebx
call fcn.00401880
mov eax, dword [esi + 0x39c4]
cmp eax, 1
jne 0x4859f1
push str.__CONFIRM
jmp 0x4859fb
cmp eax, 2
jne 0x485a02
push str.__NOCONFIRM
push edi
push ebx
call fcn.00401880
cmp dword [esi + 0x39c0], 0
je 0x485a17
push str.__NOINJECT
push edi
push ebx
call fcn.00401880
push str.__ROOT
push edi
push ebx
call fcn.00401880
mov edx, dword [ebp - 0x2c]
push edx
push edi
push ebx
call fcn.00401880
mov ecx, dword [esi + 0x47c]
add ecx, 8
mov dword [ebp - 0x18], 0
call fcn.0049ca00
push eax
call fcn.00424830
add esp, 4
cmp byte [ebp - 2], 0
je 0x485a59
mov ecx, esi
call fcn.00479d80
xor edi, edi
cmp dword [esi + 0x378c], edi
je 0x485d3c
mov eax, dword [0x50b39c]
cmp dword [eax + 0x4388], edi
jne 0x485d3c
push edi
lea ecx, [ebp - 0x6d8]
push ecx
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0x20], ebx
call fcn.004044b0
add esp, 0xc
test eax, eax
je 0x485aa2
mov dword [ebp - 8], edi
mov dword [ebp - 0x18], 0xffffffff
jmp 0x485f66
mov eax, dword [esi + 0x670c]
cmp eax, edi
je 0x485adc
cmp dword [eax + 0x38], edi
je 0x485ac3
mov ecx, dword [eax + 0x38]
mov dword [eax + 0x38], edi
cmp ecx, 0xffffffff
je 0x485ac3
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x670c]
cmp eax, edi
je 0x485adc
push eax
call fcn.00441300
add esp, 4
mov dword [esi + 0x670c], edi
mov eax, dword [esi + 0x3784]
mov ecx, dword [0x50b39c]
push eax
call fcn.00404e00
lea edx, [ebp - 0x4cc]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
cmp cx, di
jne 0x485af4
lea eax, [ebp - 0x6d8]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x485b10
sub eax, edx
sar eax, 1
mov ebx, eax
mov eax, dword [ebp - 0x20]
cmp eax, edi
jne 0x485b2c
xor ecx, ecx
jmp 0x485b42
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x485b30
sub eax, edx
sar eax, 1
lea ecx, [eax + 2]
lea eax, [ebp - 0x4cc]
lea edi, [eax + 2]
jmp 0x485b50
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x485b50
sub eax, edi
sar eax, 1
add eax, ecx
add eax, ebx
lea ecx, [eax + eax + 0x58]
push 1
push ecx
call fcn.004412c0
mov dword [esi + 0x670c], eax
mov dword [eax], 0x3c
mov edx, dword [esi + 0x670c]
mov eax, dword [0x50b384]
mov dword [edx + 8], eax
mov ecx, dword [esi + 0x670c]
mov dword [ecx + 4], 0x8100
mov eax, dword [esi + 0x670c]
add esp, 8
or dword [eax + 4], 0x40
mov eax, dword [esi + 0x670c]
lea edx, [eax + 0x3c]
mov dword [eax + 0xc], edx
mov ecx, dword [esi + 0x670c]
mov ecx, dword [ecx + 0xc]
mov eax, str.runas
lea ecx, [ecx]
movzx edx, word [eax]
mov word [ecx], dx
add eax, 2
add ecx, 2
test dx, dx
jne 0x485bc0
mov edx, dword [esi + 0x670c]
mov edi, dword [edx + 0xc]
mov eax, edi
lea ebx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x485be0
sub eax, ebx
sar eax, 1
lea eax, [edi + eax*2 + 4]
mov dword [edx + 0x10], eax
mov edx, dword [esi + 0x670c]
mov edx, dword [edx + 0x10]
lea ecx, [ebp - 0x6d8]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x485c05
mov edx, dword [esi + 0x670c]
mov edi, dword [edx + 0x10]
mov eax, edi
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x485c24
sub eax, ebx
sar eax, 1
lea eax, [edi + eax*2 + 4]
mov dword [edx + 0x14], eax
cmp dword [ebp - 0x20], 0
je 0x485c71
mov ecx, dword [esi + 0x670c]
mov edx, dword [ecx + 0x14]
mov eax, 0x20
mov word [edx], ax
mov ecx, dword [esi + 0x670c]
mov eax, dword [ecx + 0x14]
mov edx, dword [ebp - 0x20]
add eax, 2
movzx ecx, word [edx]
mov word [eax], cx
add edx, 2
add eax, 2
test cx, cx
jne 0x485c60
mov edx, dword [esi + 0x670c]
mov edi, dword [edx + 0x14]
mov eax, edi
lea ebx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x485c80
sub eax, ebx
sar eax, 1
lea eax, [edi + eax*2 + 4]
mov dword [edx + 0x18], eax
cmp word [ebp - 0x4cc], cx
je 0x485cc3
mov edx, dword [esi + 0x670c]
mov edx, dword [edx + 0x18]
lea ecx, [ebp - 0x4cc]
mov edi, edi
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x485cb0
jmp 0x485cd0
mov eax, dword [esi + 0x670c]
mov dword [eax + 0x18], 0
mov ecx, dword [esi + 0x670c]
mov dword [ecx + 0x1c], 1
cmp dword [0x50b3c4], 6
mov eax, str.Starting_root_process_as_Administrator...
jae 0x485cf0
mov eax, str.Starting_root_process_as_user...
push 0
push 1
push eax
mov ecx, esi
call fcn.00479200
mov eax, dword [0x50b39c]
mov bl, byte [eax + 0x43b4]
mov byte [eax + 0x43b4], 1
mov edx, dword [esi + 0x670c]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
mov eax, dword [0x50b39c]
mov dword [ebp - 8], edi
mov byte [eax + 0x43b4], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
jmp 0x485f5e
push 1
call dword [sym.imp.USER32.dll_LockSetForegroundWindow]
push edi
push 1
push str.Starting_root_process...
mov ecx, esi
call fcn.00479200
cmp dword [esi + 0x3794], edi
je 0x485e96
mov edi, dword [esi + 0x3784]
push 0x20a
lea ecx, [ebp - 0x2c0]
push 0
push ecx
call fcn.004b03e0
add esp, 0xc
test edi, edi
je 0x485d89
cmp word [edi], 0
jne 0x485e11
lea ecx, [esi + 0x3770]
call fcn.0046be30
mov ebx, eax
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x485e11
cmp dword [0x50b3c4], 5
ja 0x485ddd
cmp dword [0x50b3c8], 0
jne 0x485ddd
push ebx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x485e0a
lea edx, [ebp - 0x2c0]
push edx
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x485df3
lea eax, [ebp - 0x2c0]
push eax
push 0
push ebx
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
test ebx, ebx
jl 0x485e07
cmp word [ebp - 0x2c0], 0
je 0x485e07
lea edi, [ebp - 0x2c0]
mov ebx, dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [0x50b39c]
lea edx, [ebp - 0x94]
push edx
push edi
lea ebx, [esi + 0x379c]
call fcn.00404e00
mov ecx, dword [esi + 0x3798]
mov edx, dword [esi + 0x3794]
push eax
mov eax, dword [ebp - 0x14]
push 0
push 0x4000030
push eax
push 0
push 1
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov edi, eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test edi, edi
je 0x485e77
mov eax, dword [ebp - 0x38]
push 0
push eax
mov ecx, esi
call fcn.0047a580
jmp 0x485e80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov eax, 0x208
mov byte [ebx], 0
inc ebx
sub eax, 1
jne 0x485e85
mov ebx, dword [ebp - 0x14]
jmp 0x485f56
cmp dword [esi + 0x3790], edi
je 0x485ef5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [esi + 0x3784]
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x94]
push eax
push ecx
mov ecx, dword [0x50b39c]
call fcn.00404e00
push eax
push 0
push 0x4000030
push 0
push 0
push 0
push ebx
push 0
call fcn.0041fac0
mov edi, eax
add esp, 0x2c
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test edi, edi
je 0x485f56
mov edx, dword [ebp - 0x38]
push 0
push edx
jmp 0x485f4f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esi + 0x3784]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x94]
push ecx
mov ecx, dword [0x50b39c]
push edx
call fcn.00404e00
push eax
push 0
push 0x4000030
push 0
push 0
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test edi, edi
jne 0x485f49
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x485f56
mov eax, dword [ebp - 0x38]
push 0
push eax
mov ecx, esi
call fcn.0047a580
push 2
call dword [sym.imp.USER32.dll_LockSetForegroundWindow]
test edi, edi
jne 0x4861d4
mov ecx, esi
call fcn.00479660
test al, al
je 0x485fab
mov eax, dword [esi + 0x484]
mov dword [esi + 0x3770], 1
test eax, eax
je 0x485f9b
mov dword [esi + 0x484], 0
cmp eax, 0xffffffff
je 0x485f9b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push str.Restart_console_failed
mov ecx, esi
call fcn.00479200
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x485fb0
sub eax, edx
sar eax, 1
lea edi, [eax + 0x64]
push 2
push edi
call fcn.004412c0
mov ecx, dword [ebp - 0x18]
add esp, 8
push 0
push 0x400
mov ebx, eax
push ebx
push 0x400
push ecx
push 0
push 0x1200
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x486007
mov edx, dword [ebp - 0x18]
push edx
push str.Unknown_system_error:_0x_x
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x486010
sub eax, edx
sar eax, 1
add edi, eax
lea eax, [edi + 0x64]
push 2
push eax
call fcn.004412c0
add esp, 8
push str.Command_execution_failed_n_n
mov ebx, eax
push edi
push ebx
mov dword [ebp - 0x30], 0x10030
call fcn.00401800
mov ecx, dword [ebp - 0x14]
push ecx
push edi
push ebx
call fcn.00401880
push 0x4c97e0
push edi
push ebx
call fcn.00401880
mov edx, dword [ebp - 0x10]
push edx
push edi
push ebx
call fcn.00401880
cmp dword [esi + 0x3780], 0
jne 0x486113
mov eax, ebx
lea edx, [eax + 2]
jmp 0x486080
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x486080
sub eax, edx
sar eax, 1
cmp word [ebx + eax*2 - 2], 0xa
je 0x4860a3
push 0x4c976c
push edi
push ebx
call fcn.00401880
mov eax, dword [0x50b3a0]
cmp dword [eax + 0x1178], 0
jne 0x486113
mov ecx, dword [0x50b3a4]
call fcn.00450cb0
mov ecx, dword [0x50b3a0]
push eax
push 0
call fcn.00447c50
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x486113
push 0x4c97e0
push edi
push ebx
call fcn.00401880
push str.Do_You_want_to_simply_start
push edi
push ebx
call fcn.00401880
mov ecx, dword [0x50b3a4]
call fcn.00450cb0
push eax
push edi
push ebx
call fcn.00401880
push 0x4c2d18
push edi
push ebx
call fcn.00401880
mov dword [ebp - 0x30], 0x10034
mov ecx, dword [ebp - 0x30]
push ecx
mov ecx, dword [0x50b39c]
call fcn.004059f0
push eax
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, eax
test ebx, ebx
je 0x48613b
push ebx
call fcn.00441300
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x48614b
push eax
call fcn.00441300
add esp, 4
cmp edi, 6
jne 0x4862cf
cmp dword [esi + 0x3780], 0
jne 0x48617d
mov ecx, dword [0x50b3a4]
call fcn.00450cb0
push eax
call fcn.00441380
mov edx, dword [0x50b3a0]
add esp, 4
mov dword [edx + 0x1178], eax
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x28]
push eax
call fcn.00441300
add esp, 4
push 0
push 1
lea ecx, [ebp - 9]
push ecx
lea edx, [ebp - 0xa]
push edx
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 3]
push ecx
mov ecx, esi
call fcn.00480710
mov al, byte [ebp - 3]
mov cl, byte [ebp - 1]
cmp al, 0xf
jbe 0x4861b6
cmp cl, 0xf
ja 0x4861c8
or dword [ebp - 0x68], 0x10
movzx edx, cl
movzx eax, al
shl edx, 4
or edx, eax
mov dword [ebp - 0x6c], edx
cmp dword [ebp - 0x28], 2
jle 0x4857d1
jmp 0x486210
cmp dword [esi + 0x378c], 0
jne 0x4861f4
push 1
lea ecx, [ebp - 0x38]
push ecx
mov ecx, esi
call fcn.0047e1a0
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov eax, dword [ebp - 0x44]
push eax
call fcn.004acc10
add esp, 4
push ebx
mov dword [ebp - 8], 1
call fcn.00441300
add esp, 4
xor ebx, ebx
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
je 0x486228
mov dword [ebp - 0x3c], ebx
cmp eax, 0xffffffff
je 0x486228
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
push edx
push eax
mov ecx, esi
mov dword [ebp - 0x3c], ebx
call fcn.0047a580
cmp byte [ebp - 2], 0
mov dword [ebp - 0x40], ebx
je 0x486282
push ebx
mov ecx, esi
call fcn.0047ce50
test eax, eax
je 0x486282
mov edi, dword [esi + 0x48c]
mov eax, dword [edi]
mov dword [edi + 4], ebx
cmp eax, ebx
je 0x486269
push eax
call fcn.00441300
add esp, 4
mov dword [edi], ebx
mov eax, dword [esi + 0x48c]
cmp eax, ebx
je 0x486282
push eax
call fcn.00441300
add esp, 4
mov dword [esi + 0x48c], ebx
cmp dword [esi + 0x378c], ebx
jne 0x486298
mov ecx, esi
call fcn.0047e8c0
mov ecx, esi
call fcn.00479eb0
mov edi, dword [ebp - 8]
cmp edi, ebx
je 0x4862a7
cmp dword [esi + 0x480], ebx
je 0x4862ad
mov dword [esi + 0x6b4], ebx
mov ecx, dword [esi + 0x3760]
push ecx
mov dword [esi + 0x3764], edi
mov dword [esi + 0x3734], ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x4c]
push ecx
mov ecx, dword [0x50b39c]
call fcn.00406a30
test al, al
je 0x486300
cmp dword [esi + 0x44c4], 0
mov dword [esi + 0x6b4], 0
jne 0x486300
push 0
push 0
mov ecx, esi
call fcn.00484600
mov dword [ebp - 8], 0
mov edi, dword [ebp - 8]
xor ebx, ebx
jmp 0x4862a7