Function at 0x4ff497
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x954
mov eax, dword [0x5f2e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x90f]
push ebx
push eax
mov byte [ebp - 0x910], bl
call fcn.005306b0
add esp, 0xc
push ebx
push ebx
push ebx
call fcn.00493030
push eax
push str._sSoundsEdit.wav
push ebx
call fcn.004ce595
add esp, 0x14
push eax
call fcn.004c9c3f
pop ecx
pop ecx
xor eax, eax
call fcn.004bc615
mov esi, eax
call fcn.0043f465
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp esi, ebx
je 0x4ff516
push ebx
push ebx
push esi
xor eax, eax
call fcn.004bb6d1
add esp, 0xc
mov eax, esi
call fcn.004bae55
xor ecx, ecx
call fcn.004185e3
call fcn.0046b1ba
push eax
push ebx
mov esi, str.L95g
push esi
call fcn.004cf702
pop ecx
pop ecx
push eax
call fcn.0046b1ba
push eax
push ebx
push esi
call fcn.004cf702
pop ecx
pop ecx
push eax
push ebx
xor ecx, ecx
call fcn.0046b0c2
pop ecx
push eax
push str.Please_visit_www.paula2.com_in_your_web_browser._nClick_the__Downloads__link_to_open_the_login_popup._n_nEnter_the_following_login_information:_n_rUser_Name:__s_n_rPassword:__s_04d_n_nYou_will_be_asked_to_download_a_file._nRun_it_and_acknowledge_the_Windows_security_warnings._n_n_rWhen_the_setup_begins__you_will_be_asked_for_a_key._n_rProduct_Key:__s_04d_n_nPress__SPACE_BAR__to_close...
push str.__PAULA_Installation_Instructions__
push str.DeepBeep.WAV
xor esi, esi
push str.__133__134_
inc esi
push esi
push edi
call fcn.0043dc3e
mov edi, eax
add esp, 0x2c
cmp edi, 0x85
je 0x4ff583
cmp edi, 0x86
jne 0x4ff810
xor ecx, ecx
call fcn.004185e3
test eax, eax
je 0x4ff65f
cmp edi, 0x86
je 0x4ff65f
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x950]
push ebx
push eax
call fcn.005306b0
add esp, 0xc
mov dword [ebp - 0x950], edi
mov dword [ebp - 0x94c], 0x4c
mov dword [ebp - 0x944], str.open
mov dword [ebp - 0x940], str.control.exe
mov dword [ebp - 0x93c], str._name_Microsoft.NetworkAndSharingCenter
call fcn.00411df1
mov dword [ebp - 0x948], eax
lea eax, [ebp - 0x950]
push eax
mov dword [ebp - 0x934], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4ff6bf
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.You_may_need_to_enable_file_sharing._nIf_you_are_not_familiar_with_file_sharing__nplease_call_tech_support____360_545_6605_nOtherwise__follow_the_instructions_below:_n_n__1._Press_the__File_sharing__drop_down_arrow._n__2._Select___Turn_on_file_sharing_._n__3._Press_the__Apply__button._n__4._You_may_then_close_the_Sharing_Center_window.
lea eax, [ebp - 0x910]
push 0x800
push eax
call fcn.004ce4e5
add esp, 0xc
push 0x1388
call fcn.004193b4
mov dword [esp], 0x2710
call fcn.004193b4
mov dword [esp], 0x11040
push str.To_Enable_File_Sharing
lea eax, [ebp - 0x910]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4ff7f7
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x950]
push ebx
push eax
call fcn.005306b0
add esp, 0xc
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0x950], edi
mov dword [ebp - 0x94c], 0x4c
mov dword [ebp - 0x944], str.properties
call fcn.00492f0c
pop ecx
pop ecx
mov dword [ebp - 0x940], eax
call fcn.00411df1
mov dword [ebp - 0x948], eax
lea eax, [ebp - 0x950]
push eax
mov dword [ebp - 0x934], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x4ff6ee
push str._GetLastError_
push str.:6:ShowSpawningInstructions___FAILED:_ShellExecuteEx___FAILED:__s
call fcn.0042b70b
push 0x556890
push str.A_problem_occurred_and_the_sharing_setup_cannot_initialize._nPlease_call_teck_support____s_for_help._n_nPress_any_key_to_continue...
push str.__ShellExecuteEx___FAILED__
push ebx
push ebx
push ebx
push esi
call fcn.0043dc3e
add esp, 0x24
jmp 0x4ff810
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.005306b0
add esp, 0xc
lea eax, [ebp - 0x110]
push 0xffffffffffffffff
push eax
call fcn.00492f0c
pop ecx
pop ecx
lea esi, [ebp - 0x110]
call fcn.004ccf41
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
lea eax, [ebp - 0x110]
push eax
push str._s_Properties
push ebx
call fcn.004ce595
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
add esp, 0xc
push eax
push ebx
call edi
cmp eax, ebx
mov dword [ebp - 0x914], eax
jne 0x4ff82a
push 0x7d0
call esi
lea eax, [ebp - 0x110]
push eax
push str._s_Properties
push ebx
call fcn.004ce595
add esp, 0xc
push eax
push ebx
call edi
cmp eax, ebx
mov dword [ebp - 0x914], eax
jne 0x4ff81f
push str.:4:ShowSpawningInstructions___EAP:_The_Properties_box_never_appeared_
call fcn.0042b70b
pop ecx
call fcn.00411df1
mov eax, str.HCTC
push eax
push eax
push str.You_may_need_to_enable_file_sharing._nIf_you_are_not_familiar_with_file_sharing__nplease_call_tech_support____360_545_6605_nOtherwise__follow_the_instructions_below:_n_n__1._Select_the__Sharing__tab_if_it_is_not_already_selected._n__2._Enable_file_sharing_for_the__s_folder._n_____If_the__s_folder_is_already_shared__n_____unshare_the_folder_and_press__Apply_._n_____Then__re_enable_file_sharing._n_____If_the_sharing_option_does_not_exist__click_the_n_____colored_text_toward_the_bottom_of_the_window_that_says__n______If_you_understand_the_risk_but_want_to_share..._._n_____Then_select__Just_enable_file_sharing.__n_____DO_NOT_RUN_THE_WIZARD._n__3._Press__OK__on_the_file_sharing_dialog_box_to_exit.
lea eax, [ebp - 0x910]
push 0x800
push eax
call fcn.004ce4e5
add esp, 0x14
push 0x11040
mov esi, str.To_Enable_File_Sharing
push esi
lea eax, [ebp - 0x910]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
push ebx
call edi
mov esi, eax
cmp esi, ebx
je 0x4ff7f7
push 0x243
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0xffffffffffffffff
push dword [ebp - 0x918]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [ebp - 0x918]
call fcn.00435716
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005317e7
leave
ret
push str.:2:ShowSpawningInstructions___EAP:_The_Properties_box_took_too_long_to_appear.
call fcn.0042bd38
pop ecx
push dword [ebp - 0x914]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push ebx
push ebx
push ebx
push 0x11
call esi
push ebx
push ebx
push ebx
push 9
call esi
push ebx
push 2
push ebx
push 9
call esi
push ebx
push 2
push ebx
push 0x11
call esi
jmp 0x4ff79c