Function at 0x48fde0
Capabilities:
Accept command line arguments
Acquire debug privileges
Get common file path
Get hostname
Get memory capacity
Initialize winsock library
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7530
mov eax, dword fs:[0]
push eax
mov eax, 0x4870
call fcn.004a4d60
mov eax, dword [0x517ba0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
push 0x114
mov dword [ebp - 0x47dc], eax
lea eax, [ebp - 0x264]
push 0
push eax
mov dword [ebp - 0x4830], edi
mov dword [ebp - 0x268], 0
call fcn.004a7410
add esp, 0xc
mov dword [ebp - 0x26c], 0x11c
lea eax, [ebp - 0x4828]
push eax
push 1
push 0
push 0x4f3938
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48feaa
lea eax, [ebp - 0x47c4]
mov dword [ebp - 0x47c4], 4
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x482c]
push eax
push 0
push 0x4f3994
push dword [ebp - 0x4828]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x4828]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4f399c
push 0x4f39b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
test eax, eax
je 0x48fece
push 0x4e1a9c
call eax
push 0x4f39cc
push 0x4eb4bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
mov esi, eax
test esi, esi
je 0x48ff1c
lea eax, [ebp - 0x47e4]
mov dword [ebp - 0x47e4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
movzx eax, byte [0x51cf31]
mov ecx, 1
cmp dword [ebp - 0x47e4], 0
cmovne eax, ecx
mov byte [0x51cf31], al
lea eax, [ebp - 0x47c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [0x51cf38], edi
lea eax, [ebp - 0x47c4]
mov dword [ebp - 0x482c], esi
push eax
push 0x51cb20
mov dword [ebp - 0x47c4], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x104
push 0x51cd28
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x5c
push 0x51cd2e
call fcn.004a83c5
xor ecx, ecx
push esi
mov word [eax], cx
lea eax, [ebp - 0x47c0]
push eax
push 0x4e23b8
call fcn.00405840
add esp, 0x14
test eax, eax
je 0x490506
push 1
push esi
lea eax, [ebp - 0x47c0]
push eax
push 0x4f39dc
call fcn.004883a0
push 0
mov edi, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f39ec
mov dword [ebp - 0x4818], edi
call fcn.004883a0
push 0
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3a00
setne byte [ebp - 0x47f2]
call fcn.004883a0
push 1
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3a18
setne byte [ebp - 0x47f1]
call fcn.004883a0
add esp, 0x40
mov dword [ebp - 0x47cc], eax
lea eax, [ebp - 0x47c0]
push 1
push esi
push eax
push 0x4f3a28
call fcn.004883a0
push 1
mov dword [ebp - 0x4808], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3a38
call fcn.004883a0
push 0
mov dword [ebp - 0x4804], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3a48
call fcn.004883a0
push 0
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3a68
setne byte [ebp - 0x47d7]
call fcn.004883a0
add esp, 0x40
test eax, eax
lea eax, [ebp - 0x47c0]
setne byte [ebp - 0x47ea]
push 1
push esi
push eax
push 0x4f3a8c
call fcn.004883a0
push 1
mov dword [ebp - 0x480c], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4e297c
call fcn.004883a0
push 1
mov dword [ebp - 0x481c], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3aac
call fcn.004883a0
push 0
mov dword [ebp - 0x4814], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3ac4
call fcn.004883a0
add esp, 0x40
test eax, eax
lea eax, [ebp - 0x47c0]
setne byte [ebp - 0x47e6]
push 1
push esi
push eax
push 0x4f3ad8
call fcn.004883a0
push 1
mov dword [ebp - 0x47e4], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3af0
call fcn.004883a0
push 0
mov dword [ebp - 0x4820], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3b0c
call fcn.004883a0
push 0
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4e3038
setne byte [ebp - 0x47d6]
call fcn.004883a0
add esp, 0x40
test eax, eax
lea eax, [ebp - 0x47c0]
setne byte [ebp - 0x47e7]
push 0
push esi
push eax
push 0x4f3b24
call fcn.004883a0
push 1
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3b3c
setne byte [ebp - 0x47f3]
call fcn.004883a0
push 1
mov dword [ebp - 0x4800], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3b5c
call fcn.004883a0
push 0
mov dword [ebp - 0x47f0], eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3b78
call fcn.004883a0
add esp, 0x40
test eax, eax
lea eax, [ebp - 0x47c0]
setne byte [ebp - 0x47c5]
push 0
push esi
push eax
push 0x4f3b8c
call fcn.004883a0
test eax, eax
push 0
push esi
lea eax, [ebp - 0x47c0]
setne byte [ebp - 0x47e8]
push eax
push 0x4f3b9c
call fcn.004883a0
push 0
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3bb0
setne byte [ebp - 0x47d8]
call fcn.004883a0
push 1
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3bbc
setne byte [ebp - 0x47e9]
call fcn.004883a0
add esp, 0x40
mov dword [ebp - 0x4810], eax
lea eax, [ebp - 0x47c0]
push 0
push esi
push eax
push 0x4f3bcc
call fcn.004883a0
push 0
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3bd0
setne byte [ebp - 0x47d5]
call fcn.004883a0
add esp, 0x20
test eax, eax
je 0x49027f
or dword [0x5174c8], 8
push 0
push esi
lea eax, [ebp - 0x47c0]
push eax
push 0x4f3bec
call fcn.004883a0
push 0
test eax, eax
lea eax, [ebp - 0x47c0]
push esi
push eax
push 0x4f3c0c
setne byte [ebp - 0x47e5]
call fcn.004883a0
add esp, 0x20
test eax, eax
setne byte [ebp - 0x47d0]
test edi, edi
jne 0x4902de
push edi
push esi
lea eax, [ebp - 0x47c0]
push eax
push 0x4e1a9c
call fcn.004883a0
add esp, 0x10
mov dword [ebp - 0x4818], eax
mov edi, eax
cmp byte [ebp - 0x47d5], 0
jne 0x490310
test edi, edi
jne 0x490310
call fcn.00467400
test al, al
jne 0x490310
mov al, byte [0x51cf31]
mov cl, byte [ebp - 0x47d0]
test al, al
je 0x490307
test cl, cl
jne 0x49031b
mov byte [ebp - 0x47d4], 1
jmp 0x490322
mov al, byte [0x51cf31]
mov cl, byte [ebp - 0x47d0]
mov byte [ebp - 0x47d4], 0
test al, al
je 0x49032e
test cl, cl
jne 0x49032e
mov al, 1
jmp 0x490330
xor al, al
mov byte [ebp - 0x47fc], al
test edi, edi
je 0x490373
test al, al
je 0x490373
push 0x590
call fcn.004a4441
add esp, 4
test eax, eax
je 0x490358
mov ecx, eax
call fcn.0042a970
jmp 0x49035a
xor eax, eax
push edi
mov ecx, eax
call fcn.0049b940
cmp eax, 0xffffffff
je 0x490373
and al, 1
neg al
sbb al, al
and byte [ebp - 0x47fc], al
mov al, byte [ebp - 0x47d4]
test al, al
je 0x49042c
lea eax, [ebp - 0x47f8]
mov dword [ebp - 0x47c4], 0
push eax
push 0x4f3c18
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4903df
lea eax, [ebp - 0x4834]
mov dword [ebp - 0x4834], 4
push eax
lea eax, [ebp - 0x47c4]
push eax
push 0
push 0
push 0x4f3c8c
push dword [ebp - 0x47f8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x47f8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 6
call fcn.00457b30
add esp, 0xc
test al, al
je 0x4903fa
cmp dword [ebp - 0x47c4], 0
jne 0x490426
push 0
push ecx
mov edi, esp
push 0x4f3ca0
call fcn.0049fbd0
push eax
push 0x4f3ca0
call fcn.0049fd60
add esp, 0xc
mov dword [edi], eax
call fcn.00468ea0
add esp, 8
jmp 0x490506
mov al, byte [ebp - 0x47d4]
cmp byte [ebp - 0x47fc], 0
jne 0x491562
test al, al
jne 0x491562
mov eax, dword [ebp - 0x4820]
test eax, eax
je 0x490460
push eax
push 0x104
push 0x51c900
call fcn.004b7f10
add esp, 0xc
jmp 0x490472
push 0x104
push 0x51c900
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 0x4804]
mov dword [ebp - 0x47d4], 0
test eax, eax
je 0x490498
mov dword [ebp - 0x47d4], 2
mov dword [ebp - 0x47cc], eax
jmp 0x4904ba
mov eax, dword [ebp - 0x4808]
test eax, eax
je 0x4904b4
mov dword [ebp - 0x47d4], 1
mov dword [ebp - 0x47cc], eax
jmp 0x4904ba
mov eax, dword [ebp - 0x47cc]
cmp byte [ebp - 0x47d5], 0
jne 0x491543
cmp dword [ebp - 0x47c0], 1
jne 0x491492
cmp byte [ebp - 0x47d6], 0
je 0x4904ea
cmp dword [ebp - 0x47e4], 0
jne 0x491492
test eax, eax
je 0x490531
test edi, edi
jne 0x490531
push 0x10
push 0x4e23b8
push 0x4f3dd8
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4433
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x480c]
test ecx, ecx
je 0x490578
push ecx
push dword [0x51cf34]
call fcn.00485710
add esp, 8
test al, al
je 0x4906f9
push 0
mov ecx, 0x51c200
call fcn.0042d650
push 0
call fcn.0046c3d0
add esp, 4
mov ecx, 0x51c200
push 0
call fcn.0042b470
xor edi, edi
jmp 0x49050b
cmp byte [ebp - 0x47d7], 0
je 0x4905dd
test eax, eax
jne 0x4905dd
push 0x4f3e50
call fcn.0049fbd0
push eax
push 0x4f3e50
call fcn.0049fd60
add esp, 0xc
mov dword [ebp - 0x47c4], eax
lea ecx, [ebp - 0x47c4]
push 0x10
push 0x4e23b8
call fcn.0049f770
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x47c4]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x490506
call fcn.0049fda0
jmp 0x490506
mov ecx, 0x51c200
call fcn.0042ca90
test al, al
jne 0x4905fc
push 0x10
push 0x4e23b8
push 0x4f3ed8
jmp 0x4904fe
cmp byte [ebp - 0x47f1], 0
je 0x49064b
xor edi, edi
nop word [eax + eax]
push 0
push 0x4f2ec8
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x490634
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x64
jl 0x490610
jmp 0x490506
push 0
push 0
push 0x8009
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
jmp 0x49050b
mov ecx, dword [ebp - 0x4810]
or eax, 0xffffffff
mov dword [ebp - 0x4824], eax
test ecx, ecx
je 0x4906ab
lea eax, [ebp - 0x4824]
push eax
push 0x4e38d4
push ecx
call fcn.00454fa0
add esp, 0xc
cmp eax, 1
je 0x490689
push 0x10
push 0x4e23b8
push 0x4f3fa0
jmp 0x4904fe
mov eax, dword [ebp - 0x4824]
test eax, eax
je 0x49069a
cmp eax, 0xe10
jbe 0x4906ab
push 0x10
push 0x4e23b8
push 0x4f4000
jmp 0x4904fe
cmp byte [ebp - 0x47ea], 0
je 0x4906cb
push eax
push 1
push 1
push 0
call fcn.00422e90
add esp, 0x10
movzx edi, al
jmp 0x49050b
cmp byte [ebp - 0x47f2], 0
je 0x490700
push 0
push 0x4f2ec8
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x490506
push 0
push 0
push 0x800a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
jmp 0x49050b
mov eax, dword [0x51cf98]
test eax, eax
je 0x49071a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x51cf98], 0
push 0
push 0x4000000
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0x38
mov dword [0x51cf98], eax
lea eax, [ebp - 0x48]
push 0
push eax
mov dword [ebp - 0x50], 0x40
mov dword [ebp - 0x4c], 0
call fcn.004a7410
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x48]
mov edx, 0xaaaaaaab
mov eax, dword [ebp - 0x44]
shld eax, ecx, 1
add ecx, ecx
add ecx, 0xc4653600
adc eax, 0xffffffff
mov dword [ebp - 0x47c4], eax
mov eax, ecx
mul edx
mov dword [ebp - 0x47e0], eax
mov edi, edx
mov eax, ecx
mov ecx, 0xaaaaaaaa
mul ecx
mov ecx, 0xaaaaaaab
mov dword [ebp - 0x4808], edx
mov dword [ebp - 0x480c], eax
mov eax, dword [ebp - 0x47c4]
mul ecx
mov dword [ebp - 0x4810], edx
mov ecx, eax
mov eax, dword [ebp - 0x47c4]
mov edx, 0xaaaaaaaa
mul edx
add ecx, edi
mov dword [ebp - 0x4820], edx
mov edx, dword [ebp - 0x4810]
adc edx, 0
mov dword [ebp - 0x4804], eax
mov eax, dword [ebp - 0x480c]
add eax, ecx
mov ecx, dword [ebp - 0x4808]
mov dword [ebp - 0x47e0], eax
adc ecx, 0
xor eax, eax
add edx, ecx
mov ecx, dword [ebp - 0x4804]
adc eax, eax
add ecx, edx
mov edx, dword [ebp - 0x4820]
adc edx, eax
shrd ecx, edx, 1
shr edx, 1
mov dword [0x51cf50], ecx
mov dword [0x51cf54], edx
test edx, edx
jg 0x490843
jl 0x490826
cmp ecx, 0x800000
jae 0x490837
mov dword [0x51cf50], 0x800000
mov ecx, 0x800000
jmp 0x490852
test edx, edx
jne 0x490843
cmp ecx, 0x3e800000
jb 0x49085a
mov dword [0x51cf50], 0x3e800000
mov ecx, 0x3e800000
xor edx, edx
mov dword [0x51cf54], edx
add ecx, 0x2000000
push 0x4f406c
adc edx, 0
mov dword [0x51cf58], ecx
mov dword [0x51cf5c], edx
call fcn.00423550
add esp, 4
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push 1
push 0x4f4090
push 0x4f40b4
push 0x4e2430
push dword [ebp - 0x47d0]
call fcn.00465600
push 0x190
lea eax, [ebp - 0x3fc]
push 0
push eax
call fcn.004a7410
add esp, 0x20
lea eax, [ebp - 0x3fc]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push fcn.0048b130
call fcn.004bba19
push 1
call fcn.004bbe89
add esp, 8
push 1
push 0x4856e0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 1
push 0x1ff
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
cmp byte [0x51cf31], 0
mov ecx, 0x4f4128
push 0
push 0x51cb0c
push 0
push 0xf003f
push 0
push 0
mov eax, 0x4f40d8
cmove eax, ecx
push 0
push eax
push reloc.WS2_32.dll_accept
mov dword [0x51cb10], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push dword [0x51cb0c]
lea ecx, [ebp - 0x47e0]
call fcn.004987c0
lea eax, [ebp - 0x47e0]
push eax
call fcn.004990a0
add esp, 4
lea ecx, [ebp - 0x47e0]
call fcn.00405a70
push dword [0x517668]
mov ecx, 0x51c200
call fcn.0042ebc0
mov edi, dword [ebp - 0x4814]
test edi, edi
je 0x4909f3
lea ecx, [ebp - 0x150]
call fcn.00484e60
push 0
push 1
push edi
lea ecx, [ebp - 0x150]
call fcn.004613e0
test al, al
jne 0x4909bc
push 0x10
push 0x4e23b8
push 0x4f4178
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x150]
call fcn.0042afd0
mov edi, 2
jmp 0x49050b
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x47e0]
call fcn.004987a0
lea eax, [ebp - 0x47e0]
push eax
call fcn.004990a0
add esp, 4
lea ecx, [ebp - 0x47e0]
call fcn.00405a70
lea ecx, [ebp - 0x150]
call fcn.0042afd0
cmp byte [ebp - 0x47f3], 0
je 0x490a79
mov eax, dword [ebp - 0x4800]
mov byte [0x517a90], 1
test eax, eax
je 0x490a2e
push eax
call fcn.004b30e4
mov edx, dword [0x517a94]
add esp, 4
lea ecx, [eax - 0x64]
cmp ecx, 0xf3c
cmovbe edx, eax
mov dword [0x517a94], edx
mov eax, dword [ebp - 0x47f0]
test eax, eax
je 0x490a58
push eax
call fcn.004b30e4
mov edx, dword [0x517a98]
add esp, 4
lea ecx, [eax - 1]
cmp ecx, 0xe
cmovbe edx, eax
mov dword [0x517a98], edx
jmp 0x490a5e
mov edx, dword [0x517a98]
test edx, edx
jne 0x490a79
movzx eax, byte [0x517a90]
xor ecx, ecx
cmp dword [0x517a94], ecx
cmove eax, ecx
mov byte [0x517a90], al
cmp byte [ebp - 0x47e5], 0
je 0x490a89
or dword [0x5174c8], 0x10
cmp byte [ebp - 0x47e6], 0
je 0x490b0a
push 0x51c284
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x51c2a0]
mov ecx, dword [0x51c29c]
cmp ecx, eax
je 0x490ac5
push 0x51c29c
push eax
push ecx
call fcn.0041ed90
mov eax, dword [0x51c29c]
add esp, 0xc
mov dword [0x51c2a0], eax
push 0
mov ecx, 0x51c284
mov dword [0x51c2ac], 0
call fcn.00429690
cmp byte [0x51c2a8], 0
je 0x490aff
mov eax, dword [0x51c080]
mov ecx, 0x51c284
push 0
push dword [eax + 0x10]
push 0
push 0x9c92
call fcn.00427d10
push 0x51c284
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x51cf68
push 0x4f41dc
push dword [0x51cb0c]
call fcn.004675d0
mov eax, dword [ebp - 0x47e4]
add esp, 0xc
test eax, eax
je 0x490b58
push 0
push 0x517888
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0x4e2430
push 0x104
push 0x517888
call fcn.00466840
add esp, 0xc
jmp 0x490b69
cmp byte [ebp - 0x47d6], 0
je 0x490b69
xor eax, eax
mov word [0x517888], ax
call fcn.00467500
test al, al
je 0x490b80
or dword [0x5174c8], 0x40
mov byte [0x51cf33], 1
mov eax, dword [0x517664]
mov ecx, 1
cmp byte [ebp - 0x47e7], 0
push 2
cmovne eax, ecx
mov dword [0x517664], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call fcn.004a22e0
mov edi, dword [ebp - 0x4818]
test edi, edi
je 0x490ded
mov eax, dword [ebp - 0x47cc]
test eax, eax
je 0x490ded
push 0x2e
push eax
call fcn.004a861e
add esp, 8
test eax, eax
je 0x490ddc
push eax
call fcn.004973e0
add esp, 4
mov dword [ebp - 0x4814], eax
test eax, eax
js 0x490ddc
push 0
push edi
push 0
call fcn.0048ac30
add esp, 0xc
test al, al
je 0x490506
cmp dword [ebp - 0x47d4], 1
mov ecx, 0x51c200
push 0
setae byte [ebp - 0x4800]
cmp dword [ebp - 0x47d4], 2
setae byte [ebp - 0x47f0]
call fcn.0042d650
push dword [ebp - 0x47f0]
mov eax, dword [ebp - 0x4814]
mov ecx, 0x51c200
push dword [ebp - 0x4800]
push 1
push dword [eax*8 + 0x5174b0]
movzx eax, byte [ebp - 0x47d7]
push eax
mov eax, dword [ebp - 0x47cc]
push eax
push 0
call fcn.00435230
mov edi, eax
test edi, edi
je 0x4906f9
push 0x4f424c
call fcn.0049fbd0
push eax
push 0x4f424c
call fcn.0049fd60
add esp, 0xc
mov dword [ebp - 0x47d0], eax
cmp edi, 5
ja case.default.0x490c97
jmp dword [edi*4 + 0x4915d0]
push 0x4f3134
call fcn.0049fbd0
push eax
push 0x4f3134
jmp 0x490d65
push 0x4f3170
call fcn.0049fbd0
push eax
push 0x4f3170
jmp 0x490d65
push 0x4f31b8
call fcn.0049fbd0
push eax
push 0x4f31b8
jmp 0x490d65
push 0x4f3200
call fcn.0049fbd0
push eax
push 0x4f3200
jmp 0x490d65
mov dword [ebp - 0x47d4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x47d4]
push eax
call fcn.00466b20
mov ecx, dword [ebp - 0x47d4]
add esp, 8
mov dword [ebp - 0x47cc], ecx
test ecx, ecx
je 0x490d2a
call fcn.0049fad0
mov ecx, dword [ebp - 0x47d4]
mov dword [ebp - 4], 4
test ecx, ecx
je 0x490d3a
call fcn.0049fda0
mov dword [ebp - 4], 0xffffffff
jmp 0x490d73
push 0x4f32c0
call fcn.0049fbd0
push eax
push 0x4f32c0
jmp 0x490d65
push 0x4f3278
call fcn.0049fbd0
push eax
push 0x4f3278
call fcn.0049fd60
mov dword [ebp - 0x47cc], eax
add esp, 0xc
lea eax, [ebp - 0x47cc]
push eax
lea ecx, [ebp - 0x47d0]
call fcn.0049f9d0
mov ecx, dword [ebp - 0x47cc]
mov dword [ebp - 4], 5
test ecx, ecx
je 0x490d9b
call fcn.0049fda0
push 0x10
push 0x4e23b8
lea ecx, [ebp - 0x47d0]
mov dword [ebp - 4], 0xffffffff
call fcn.0049f770
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x47d0]
mov dword [ebp - 4], 6
test ecx, ecx
je 0x490506
call fcn.0049fda0
jmp 0x490506
push 0x10
push 0x4e23b8
push 0x4f41f8
jmp 0x4904fe
cmp byte [ebp - 0x47e8], 0
jne 0x491467
push 0x4ea6b4
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x51cb08], eax
lea eax, [ebp - 0x47e0]
push eax
mov dword [ebp - 0x47e0], 8
mov dword [ebp - 0x47dc], 0xf
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.00413260
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
mov ecx, edi
call fcn.00414720
push 0
push dword [ebp - 0x4830]
mov ecx, 0x51c408
push 0
call fcn.00488a40
mov eax, dword [0x51bda0]
xorps xmm0, xmm0
add eax, 0x10
mov dword [ebp - 0x48], vtable.WTL::CMessageLoop.0
push eax
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x4800], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x51c43c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [edi + 8]
push 4
inc ecx
mov dword [ebp - 0x47f0], eax
push ecx
push dword [edi]
call fcn.004b7d8d
add esp, 0xc
test eax, eax
je 0x490efe
mov dword [edi], eax
mov eax, dword [edi + 8]
push 4
inc eax
push eax
push dword [edi + 4]
call fcn.004b7d8d
add esp, 0xc
test eax, eax
je 0x490efe
mov dword [edi + 4], eax
mov eax, dword [edi + 8]
lea ecx, [eax*4]
mov eax, dword [edi]
add eax, ecx
je 0x490eef
mov edx, dword [ebp - 0x47f0]
mov dword [eax], edx
mov eax, dword [edi + 4]
add eax, ecx
je 0x490efb
lea ecx, [ebp - 0x48]
mov dword [eax], ecx
inc dword [edi + 8]
push dword [ebp - 0x4800]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [sym.imp.USER32.dll_DefWindowProcW]
lea ecx, [ebp - 0x477c]
xorps xmm0, xmm0
mov dword [ebp - 0x47b8], 0
mov dword [ebp - 0x47a8], 0
mov dword [ebp - 0x47a4], 0
mov dword [ebp - 0x47a0], 0
mov dword [ebp - 0x479c], edi
movups xmmword [ebp - 0x4798], xmm0
call fcn.00484cc0
lea ecx, [ebp - 0x474c]
mov dword [ebp - 0x47bc], 0x4f2ea0
mov dword [ebp - 0x4788], 0x4f2eb4
mov dword [ebp - 0x4784], 0x4f2ebc
mov dword [ebp - 0x4780], 0x4f2ec4
call fcn.00484a90
push 0x208
xorps xmm0, xmm0
mov dword [ebp - 0x474c], 0x4f2e8c
lea eax, [ebp - 0x604]
mov dword [ebp - 0x4688], 0
push 0
push eax
mov dword [ebp - 0x4678], 0
mov dword [ebp - 0x4674], 0
mov dword [ebp - 0x4670], 0
mov dword [ebp - 0x466c], edi
mov dword [ebp - 0x4668], 0
mov dword [ebp - 0x4664], 0
mov dword [ebp - 0x468c], 0x4f2df0
mov dword [ebp - 0x4660], 0
mov dword [ebp - 0x465c], 0
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xffffffff
mov dword [ebp - 0x630], 0x28
mov dword [ebp - 0x62c], 0
movups xmmword [ebp - 0x628], xmm0
mov dword [ebp - 0x608], 1
movups xmmword [ebp - 0x618], xmm0
call fcn.004a7410
add esp, 0xc
push 0
push 0
push 0
push ecx
mov eax, esp
lea ecx, [ebp - 0x47bc]
push 0
mov dword [eax], 0
call fcn.004859a0
test eax, eax
jne 0x491071
lea edi, [eax + 1]
jmp 0x491417
cmp byte [ebp - 0x47d8], 0
je 0x491081
mov eax, 2
jmp 0x49108f
mov eax, dword [ebp + 0x14]
mov ecx, 5
cmp eax, 1
cmove eax, ecx
push eax
push dword [ebp - 0x47b8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 0x47b8]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, 0x51c284
call fcn.00429600
test al, al
jne 0x491200
cmp byte [ebp - 0x47d8], al
jne 0x491200
cmp byte [ebp - 0x47e9], al
jne 0x491200
movaps xmm0, xmmword [0x4e4880]
mov edi, dword [0x51cf34]
mov dword [ebp - 0x4878], 0
mov dword [ebp - 0x4864], 0
mov dword [ebp - 0x4860], 0
mov dword [ebp - 0x485c], 0
mov dword [ebp - 0x4858], 0
mov dword [ebp - 0x4854], 0
mov byte [ebp - 0x4840], al
movups xmmword [ebp - 0x4850], xmm0
mov dword [ebp - method.CFilterDlg.virtual_0], vtable.CFilterDlg.0
mov dword [ebp - 0x483c], 0xb9
call fcn.004a5d0c
mov dword [ebp - 0x4868], eax
test eax, eax
jne 0x491155
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4911bf
push 0
push 0
push eax
call fcn.004a5e0e
lea eax, [ebp - 0x487c]
mov dword [ebp - 0x4874], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x5171c4
mov dword [ebp - 0x4870], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x5171dc]
mov dword [ebp - 0x486c], eax
lea eax, [ebp - 0x4874]
push 0x5171c4
mov dword [0x5171dc], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, word [ebp - 0x483c]
push 1
push 0x4422e0
push edi
push eax
push dword [0x51d938]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov eax, dword [ebp - 0x485c]
test eax, eax
je 0x4911dc
push eax
call fcn.004b1707
add esp, 4
mov dword [ebp - 0x485c], 0
mov eax, dword [ebp - 0x4868]
mov dword [ebp - 0x4858], 0
mov dword [ebp - 0x4854], 0
test eax, eax
je 0x491200
push eax
call fcn.004a5db8
lea ecx, [ebp - 0x47bc]
call fcn.0045ecf0
push 0
push dword [0x51cf34]
call fcn.00485710
add esp, 8
test al, al
je 0x491230
push 0
mov ecx, 0x51c200
call fcn.0042d650
jmp 0x4912c2
mov edi, dword [ebp - 0x4818]
test edi, edi
je 0x49126e
cmp byte [0x51765d], 0
je 0x49125b
push 0
push 0x9c53
push 0x111
push dword [0x51cf34]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
push dword [0x51cf34]
call fcn.0048ac30
add esp, 0xc
jmp 0x4912c2
cmp byte [ebp - 0x47c5], 0
jne 0x4912c2
cmp byte [0x51cf31], 0
jne 0x4912c2
mov eax, dword [ebp - 0x481c]
xorps xmm0, xmm0
cmp dword [ebp - 0x47e4], 0
movlpd qword [ebp - 0x47e0], xmm0
mov dword [ebp - 0x47dc], eax
setne byte [ebp - 0x47e0]
lea eax, [ebp - 0x47e0]
push eax
push 0x9c87
push 0x111
push dword [0x51cf34]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x4824]
cmp eax, 0xffffffff
je 0x4912e4
imul eax, eax, 0x3e8
push 0
push eax
push 2
push dword [0x51cf34]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
xor edi, edi
mov dword [ebp - 0x47d0], eax
test eax, eax
je 0x491322
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x491322
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x48]
push edi
inc edi
mov edx, dword [eax + 8]
call edx
test eax, eax
jne 0x4912f5
mov dword [ebp - 0x47d0], eax
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
mov ecx, eax
mov eax, dword [ebp - 0x47d0]
cmp ecx, 0xffffffff
je 0x4912f1
test ecx, ecx
je 0x49138c
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
mov eax, dword [eax + 4]
call eax
test eax, eax
jne 0x49136a
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
mov eax, dword [eax + 0xc]
call eax
test eax, eax
mov eax, dword [ebp - 0x47d0]
je 0x4912f1
jmp 0x4912e4
mov eax, dword [0x51bda0]
mov edi, dword [ebp - 0x24]
add eax, 0x10
push eax
mov dword [ebp - 0x47f0], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x51c43c]
mov dword [ebp - 0x47c4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebp - 0x47c4]
xor ecx, ecx
mov dword [ebp - 0x481c], eax
mov eax, dword [edx + 8]
test eax, eax
jle 0x4913fb
mov edx, dword [edx]
nop dword [eax]
mov esi, dword [ebp - 0x481c]
cmp dword [edx], esi
mov esi, dword [ebp - 0x482c]
je 0x4913ea
inc ecx
add edx, 4
cmp ecx, eax
jl 0x4913d0
jmp 0x4913fb
cmp ecx, 0xffffffff
je 0x4913fb
push ecx
mov ecx, dword [ebp - 0x47c4]
call fcn.0048d640
push dword [ebp - 0x47f0]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, 0x51c408
call fcn.0048ec90
call dword [sym.imp.ole32.dll_OleUninitialize]
lea ecx, [ebp - 0x47bc]
call fcn.00485200
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], vtable.WTL::CMessageLoop.0
test eax, eax
je 0x491440
push eax
call fcn.004b1707
add esp, 4
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
test eax, eax
je 0x49050b
push eax
call fcn.004b1707
add esp, 4
jmp 0x49050b
call fcn.0046ba00
push 0
call fcn.0046c3d0
push 0x51cf68
push 0x4f41dc
push dword [0x51cb0c]
call fcn.00468a70
add esp, 0x10
xor edi, edi
jmp 0x49050b
push 0x4f3db0
call fcn.0049fbd0
push eax
push 0x4f3db0
call fcn.0049fd60
mov edi, dword [esi + 4]
push edi
mov dword [ebp - 0x47f8], eax
call fcn.0049fbd0
push eax
push edi
call fcn.0049fd60
add esp, 0x18
mov dword [ebp - 0x47c4], eax
lea eax, [ebp - 0x47c4]
lea ecx, [ebp - 0x47f8]
push eax
lea eax, [ebp - 0x47e4]
push eax
call fcn.0049f8a0
mov ecx, dword [ebp - 0x47c4]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x4914f5
call fcn.0049fda0
mov ecx, dword [ebp - 0x47f8]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x49150b
call fcn.0049fda0
push 0x10
push 0x4e23b8
lea ecx, [ebp - 0x47e4]
mov dword [ebp - 4], 0xffffffff
call fcn.0049f770
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x47e4]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x491543
call fcn.0049fda0
push 0
push 0x41cc90
push 0
push 0x4eac7c
push dword [ebp - 0x4830]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x490506
push dword [ebp - 0x47dc]
lea ecx, [ebp - 0x47dc]
call fcn.004229a0
mov eax, dword [eax]
test eax, eax
je 0x49157d
mov eax, dword [eax]
jmp 0x49157f
xor eax, eax
push dword [ebp - 0x47d4]
push dword [ebp - 0x47fc]
push eax
push dword [ebp + 0x14]
call fcn.004685f0
add esp, 0x10
mov byte [ebp - 0x47c5], al
lea ecx, [ebp - 0x47dc]
call fcn.00403090
cmp byte [ebp - 0x47c5], 0
jne 0x4906f9
push 0
push ecx
mov edi, esp
push 0x4f3d18
call fcn.0049fbd0
push eax
push 0x4f3d18
jmp 0x49040f