Function at 0x48e256
Capabilities:
Create thread
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52807b
mov eax, dword fs:[0]
push eax
sub esp, 0x748
mov eax, dword [0x577698]
xor eax, esp
mov dword [esp + 0x740], eax
push ebx
push esi
push edi
mov eax, dword [0x577698]
xor eax, esp
push eax
lea eax, [esp + 0x758]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, 0x44f
cmp eax, esi
ja 0x48e80c
je 0x48e7c0
lea ecx, [eax - 0x3e8]
cmp ecx, 0xe
ja case.0x48e82f.1116
push 2
pop edi
jmp dword [ecx*4 + 0x48f33e]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
xor esi, esi
lea eax, [esp + 0x6c]
push esi
push eax
mov dword [esp + 0x74], esi
call fcn.00448783
pop ecx
pop ecx
cmp eax, 1
je 0x48e2fc
cmp eax, esi
je 0x48e2fc
push esi
push 0x55575453
push ebx
call fcn.00491fc1
jmp 0x48e326
mov eax, dword [0x57a718]
lea ecx, [eax - 0x2710]
push esi
cmp ecx, 0x323390
ja 0x48e313
push eax
jmp 0x48e318
push 0x325aa0
push 0x3ec
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
lea esi, [ebx + 0x1214]
mov dword [esp + 0x20], edi
call fcn.0047913c
test eax, eax
je 0x48e33e
call fcn.004791ea
xor esi, esi
inc esi
push esi
lea edi, [ebx + 0x1258]
call fcn.004b83a0
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x70]
push eax
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
xor edi, edi
push str.statsofttime
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x80], 0xb
mov dword [esp + 0x78], 8
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call fcn.00405747
push ecx
mov dword [esp + 0x774], esi
mov eax, esp
mov dword [esp + 0x2c], esp
push str.SOFTWARE360TotalSecurityUserProfile
push eax
call fcn.00405747
or dword [esp + 0x774], 0xffffffff
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [esp + 0xb0]
push eax
mov ecx, edi
call fcn.004049f3
call fcn.0040486a
add esp, 0xc
lea esi, [esp + 0x98]
call fcn.00401105
and dword [esp + 0x54], edi
and dword [esp + 0x58], edi
lea eax, [esp + 0x54]
push eax
call fcn.004eb76c
pop ecx
cmp eax, 0xffffffff
jne 0x48e3fc
cmp edx, eax
jne 0x48e3fc
mov dword [esp + 0x14], 1
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x58]
sub ecx, edx
sbb eax, dword [esp + 0x28]
xor esi, esi
cmp eax, esi
jg 0x48e420
jl 0x48e41a
cmp ecx, esi
jae 0x48e420
neg ecx
adc eax, esi
neg eax
or edx, dword [esp + 0x28]
je 0x48e434
cmp eax, esi
jl 0x48e43c
jg 0x48e434
cmp ecx, 0x93a80
jbe 0x48e43c
mov dword [esp + 0x14], 1
cmp dword [esp + 0x14], esi
je 0x48e4a1
cmp dword [ebx + 0x1210], esi
jne 0x48e478
push 0x582e91
push 0x14
call fcn.004eb6e3
pop ecx
pop ecx
cmp eax, esi
je 0x48e470
mov dword [eax], esi
mov dword [eax + 4], 0xff
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
jmp 0x48e472
xor eax, eax
mov dword [ebx + 0x1210], eax
mov ebx, dword [ebx + 0x1210]
cmp ebx, esi
je 0x48e4a1
push esi
push esi
push ebx
push 0x4251ff
push esi
push esi
mov dword [ebx + 0xc], 0x48832d
mov dword [ebx + 0x10], esi
call fcn.004eb0fa
add esp, 0x18
mov dword [ebx + 8], eax
cmp dword [esp + 0x20], 2
sete al
movzx eax, al
push eax
call fcn.004978b2
xor eax, eax
mov ecx, dword [esp + 0x758]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x740]
xor ecx, esp
call fcn.004e736b
mov esp, ebp
pop ebp
ret 8
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x55575453
push ebx
call fcn.00491fc1
mov dword [esp + 0x20], 1
jmp 0x48e4a1
mov dword [esp + 0x20], edi
jmp 0x48e4a1
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.00490776
jmp 0x48e4b2
mov ecx, 0x3f5
xor edi, edi
cmp eax, ecx
jne 0x48e54c
xor esi, esi
cmp dword [0x57a730], edi
je 0x48e52f
mov dword [0x57a730], edi
jmp 0x48e539
cmp dword [0x5856dc], edi
jbe 0x48e53a
xor esi, esi
inc esi
push ecx
push dword [ebx + 4]
mov dword [0x5856e0], edi
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x48e574
cmp eax, 0x3ed
jne 0x48e57d
push edi
push ecx
call int.00408c5f
add esp, 4
call fcn.004707db
cmp eax, 1
je 0x48e57d
call fcn.00494b5c
inc dword [0x5856dc]
mov esi, eax
cmp esi, 1
jne 0x48e4b2
push edi
push 0x41554156
push ebx
call fcn.00491fc1
jmp 0x48e4b2
push 0
push 0x54555054
jmp 0x48e583
push 0
push 0x54554d54
jmp 0x48e583
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
lea esi, [esp + 0x48]
mov dword [esp + 0x44], eax
call fcn.00404939
lea eax, [ebx + 0x4ac]
mov dword [esp + 0x760], 2
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x760], 3
mov eax, dword [ebx + 0x4a8]
test eax, eax
je 0x48e664
lea esi, [ebx + 0x490]
mov eax, dword [esi + 0x14]
mov ebx, dword [eax]
mov eax, dword [esi]
test eax, eax
jne 0x48e68b
call fcn.004e8466
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x48e611
call fcn.004e8466
add ebx, 8
mov eax, ebx
lea edi, [esp + 0x44]
call fcn.004044e5
lea eax, [ebx + 4]
lea edi, [esp + 0x48]
call fcn.004044e5
mov eax, dword [ebx + 8]
mov ecx, dword [esi]
mov ebx, dword [ebx + 0xc]
mov dword [esp + 0x4c], eax
mov eax, dword [esi + 0x14]
mov eax, dword [eax]
push eax
push ecx
lea eax, [esp + 0x78]
push eax
mov edi, esi
mov dword [esp + 0x5c], ebx
call fcn.0049c6b8
push ebx
push dword [esp + 0x50]
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x50]
call fcn.00441822
add esp, 0xc
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
call fcn.0040557a
jmp 0x48e4b2
mov eax, dword [eax]
jmp 0x48e607
mov edi, 0x3f0
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [0x585740], 0
je 0x48e4b2
push 0
mov esi, ebx
call fcn.0049a736
test al, al
je 0x48e6e2
test byte [0x5875d0], 1
jne 0x48e6cb
call fcn.004437a9
jmp 0x48e6d0
mov al, byte [0x5875cc]
test al, al
jne 0x48e6e2
push ebx
call fcn.00492299
test eax, eax
jne 0x48e4b2
push 0
push 0x927c0
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x48e4b2
push 0x3f3
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
test byte [0x5875d0], 1
jne 0x48e716
call fcn.004437a9
jmp 0x48e71b
mov al, byte [0x5875cc]
test al, al
jne 0x48e4b2
mov ecx, ebx
call fcn.00492378
jmp 0x48e4b2
add ebx, 0x370
push ebx
call fcn.00474507
jmp 0x48e4b2
push 0x3f6
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0047e129
test eax, eax
je 0x48e79a
xor edi, edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
lea esi, [esp + 0x38]
mov dword [esp + 0x760], 0x15
call fcn.0047e25b
test eax, eax
je 0x48e781
mov eax, esi
push eax
call fcn.0047e6aa
cmp dword [esp + 0x3c], edi
je 0x48e4b2
push dword [esp + 0x3c]
call fcn.004e7360
pop ecx
jmp 0x48e4b2
xor esi, esi
push esi
push esi
push esi
push 0x47e198
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
je 0x48e4b2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48e4b2
mov eax, ebx
call fcn.00492848
test eax, eax
je 0x48e4b2
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
and dword [ebx + 0x4c4], 0
call fcn.0043a7ef
lea eax, [esp + 0x64]
push eax
call fcn.0049ef35
pop ecx
mov dword [esp + 0x760], 4
push dword [eax]
call fcn.0043af0c
mov eax, dword [esp + 0x68]
pop ecx
jmp 0x48e67e
mov ecx, 0x4a6
cmp eax, ecx
ja 0x48ee2a
je 0x48ec84
push 0x12
add eax, 0xfffffbb0
pop esi
cmp eax, esi
ja case.0x48e82f.1116
jmp dword [eax*4 + 0x48f37a]
mov esi, 0x455
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
lea edi, [ebx + 0x24]
mov eax, dword [edi]
mov dword [esp + 0x18], eax
call fcn.00442887
push eax
mov eax, dword [esp + 0x1c]
mov ecx, edi
call dword [eax + 0x24]
xor edi, edi
cmp eax, edi
je 0x48e874
push str.true
push eax
call fcn.004eac41
pop ecx
pop ecx
test eax, eax
je 0x48e8ab
call fcn.004415ab
test eax, eax
jne 0x48e8ab
push edi
push 0x43504d41
push ebx
call fcn.00491fc1
mov eax, dword [0x57a71c]
lea ecx, [eax - 0x2710]
push edi
cmp ecx, 0x1496ff0
ja 0x48e8a4
push eax
push esi
jmp 0x48e6ea
push 0x1499700
jmp 0x48e89e
mov eax, dword [0x57a720]
lea ecx, [eax - 0x2710]
push edi
cmp ecx, 0x36c770
jbe 0x48e89d
push 0x36ee80
jmp 0x48e89e
mov eax, ebx
call fcn.00493000
jmp 0x48e4b2
mov ecx, ebx
call fcn.0049360d
jmp 0x48e4b2
mov eax, ebx
call fcn.00493a0a
jmp 0x48e4b2
mov esi, ebx
call fcn.004949fb
jmp 0x48e4b2
mov edi, ebx
call fcn.00494a3d
jmp 0x48e4b2
mov esi, ebx
call fcn.00494afa
jmp 0x48e4b2
lea esi, [ebx + 0x24]
mov edi, dword [esi]
call fcn.00442887
push eax
mov ecx, esi
call dword [edi + 0x24]
test eax, eax
je 0x48e937
push str.true
push eax
call fcn.004eac41
pop ecx
pop ecx
test eax, eax
je 0x48e4b2
call fcn.004415ab
test eax, eax
jne 0x48e4b2
call fcn.0048bba1
test al, al
je 0x48e4b2
push 0x454
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [ebx + 0xb68]
call fcn.004b4d20
lea esi, [ebx + 0x980]
mov eax, esi
call fcn.004b4d20
push 0
push dword [ebx + 0x524]
push esi
call fcn.004b5058
jmp 0x48e4b2
push ebx
call fcn.00495900
jmp 0x48e4b2
mov eax, ebx
call fcn.00495d83
jmp 0x48e4b2
mov edi, ebx
call fcn.00498f91
jmp 0x48e4b2
mov eax, ebx
call fcn.00499130
jmp 0x48e4b2
mov esi, ebx
call fcn.0049919d
jmp 0x48e4b2
mov eax, ebx
call fcn.004992d0
jmp 0x48e4b2
push 0x461
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov al, byte [ebx + 0x1104]
xor esi, esi
test al, al
jne 0x48eaf9
cmp dword [ebx + 0x974], esi
jne 0x48e4b2
push 0x582e91
push 0x30
call fcn.004eb6e3
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
je 0x48ea20
call fcn.0040813b
mov dword [edi], vtable.TS::AddFileMonitor.0
mov byte [edi + 0x2c], 1
jmp 0x48ea22
xor edi, edi
mov dword [ebx + 0x974], edi
cmp edi, esi
je 0x48e4b2
xor eax, eax
push 0x206
mov word [esp + 0x340], ax
lea eax, [esp + 0x342]
push esi
push eax
call fcn.004e7380
add esp, 0xc
lea eax, [esp + 0x33c]
push eax
push esi
push esi
push 0x10
pop edi
push edi
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x48e4b2
lea eax, [esp + 0x33c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00405747
mov dword [esp + 0x760], edi
mov eax, dword [esp + 0x30]
cmp dword [eax - 0xc], esi
je 0x48e67e
push eax
lea eax, [esp + 0xac]
call fcn.0040441b
mov byte [esp + 0x760], 0x11
push dword [ebx + 0x974]
lea ecx, [esp + 0xac]
call fcn.00408267
push 0
push 1
lea esi, [esp + 0xb0]
mov byte [esp + 0x768], 0x10
call fcn.00404e82
mov eax, dword [ebx + 0x974]
mov ecx, dword [ebx + 4]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 0x101d
mov eax, dword [ebx + 0x974]
call fcn.004082d6
mov eax, dword [esp + 0x30]
jmp 0x48e67e
or dword [ebx + 0x1108], 4
jmp 0x48e4b2
push 0x45b
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov al, byte [ebx + 0x1104]
test al, al
jne 0x48ec48
cmp dword [ebx + 0x96c], 0
jne 0x48e4b2
push 0x582e91
push 0x2c
call fcn.004eb6e3
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x48eb51
call fcn.0040813b
mov dword [edi], vtable.TS::RecycleBinMonitor.0
mov eax, edi
jmp 0x48eb53
xor eax, eax
mov dword [ebx + 0x96c], eax
test eax, eax
je 0x48e4b2
xor eax, eax
push 0x206
push eax
mov word [esp + 0x54c], ax
lea eax, [esp + 0x54e]
push eax
call fcn.004e7380
add esp, 0xc
push 0x208
lea eax, [esp + 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x48e4b2
lea eax, [esp + 0x544]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00405747
mov dword [esp + 0x760], esi
push 0x53c890
xor ecx, ecx
lea esi, [esp + 0x18]
call fcn.0042450a
mov ecx, eax
push 0
lea eax, [esp + 0x14]
push eax
inc ecx
mov eax, esi
call fcn.00424d23
mov byte [esp + 0x760], 0x13
mov edi, dword [esp + 0x10]
push edi
lea eax, [esp + 0x11c]
call fcn.0040441b
mov byte [esp + 0x760], 0x14
push dword [ebx + 0x96c]
lea ecx, [esp + 0x11c]
call fcn.00408267
mov eax, dword [ebx + 0x96c]
mov ecx, dword [ebx + 4]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 0x101c
mov eax, dword [ebx + 0x96c]
call fcn.004082d6
push 0
push 1
lea esi, [esp + 0x120]
call fcn.00404e82
lea eax, [edi - 0x10]
call fcn.0040557a
mov eax, dword [esp + 0x14]
jmp 0x48e67e
or dword [ebx + 0x1108], 2
jmp 0x48e4b2
push 0x45d
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0049a39c
jmp 0x48e4b2
push 0x462
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0048f62d
jmp 0x48e4b2
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push str.removepackge
xor ebx, ebx
push eax
mov dword [esp + 0x38], ebx
lea esi, [esp + 0x38]
call fcn.00405747
push ecx
mov dword [esp + 0x768], 5
mov eax, esp
mov dword [esp + 0x20], esp
mov edi, str.SOFTWARE360TotalSecurityFastInstall
push edi
push eax
call fcn.00405747
or dword [esp + 0x768], 0xffffffff
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [esp + 0x84]
push eax
mov ecx, ebx
call fcn.004049f3
push eax
call fcn.00404801
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
pop ecx
lea esi, [esp + 0x78]
inc bl
call fcn.00401105
test bl, bl
je 0x48ed20
xor eax, eax
cmp dword [esp + 0x2c], eax
je 0x48ed20
push eax
push eax
push eax
push 0x48e18e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x34], eax
push ecx
mov dword [esp + 0x764], 6
mov eax, esp
mov dword [esp + 0x20], esp
push str.lasttask
push eax
lea esi, [esp + 0x40]
xor ebx, ebx
call fcn.00405747
push ecx
mov byte [esp + 0x768], 7
mov eax, esp
mov dword [esp + 0x18], esp
push edi
push eax
call fcn.00405747
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [esp + 0x94]
push eax
mov ecx, ebx
mov byte [esp + 0x770], 6
call fcn.004049f3
push eax
mov byte [esp + 0x764], 8
call fcn.004048c2
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
pop ecx
lea esi, [esp + 0x88]
inc bl
mov byte [esp + 0x760], 6
call fcn.00401105
mov esi, dword [esp + 0x34]
test bl, bl
je 0x48ee22
xor edi, edi
cmp dword [esi - 0xc], edi
je 0x48ee22
xor eax, eax
push 0x206
mov word [esp + 0x138], ax
lea eax, [esp + 0x13a]
push edi
push eax
call fcn.004e7380
add esp, 0xc
push 0x104
lea eax, [esp + 0x138]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str....._softmgr360InstantSetup.exe
lea eax, [esp + 0x138]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
push 5
push str._tiplasttask
lea eax, [esp + 0x140]
call fcn.00442a8c
add esp, 0xc
lea eax, [esi - 0x10]
jmp 0x48e681
mov edi, 0x709
cmp eax, edi
ja 0x48f21f
je 0x48f1a9
mov ecx, 0x5dc
cmp eax, ecx
ja 0x48f062
je 0x48eeff
sub eax, 0x4b0
je 0x48eef1
dec eax
je 0x48eed7
sub eax, 0x63
je 0x48ee78
sub eax, 0x64
jne case.0x48e82f.1116
mov esi, ebx
call fcn.00495410
jmp 0x48e4b2
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
inc dword [0x586ef0]
push 0
mov edi, str.Q360InternationSafeClass
push edi
call esi
push eax
call fcn.00440cd6
pop ecx
push 0
push edi
mov dword [esp + 0x18], eax
call esi
push eax
call fcn.00440c08
cmp dword [esp + 0x14], 0
pop ecx
je 0x48eeb0
test eax, eax
jne 0x48eebd
cmp dword [0x586ef0], 5
jl 0x48e4b2
push 0x514
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
and dword [0x586ef0], 0
jmp 0x48e4b2
push 0x4b1
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, ebx
call fcn.00493acc
jmp 0x48e4b2
push 0
mov esi, ebx
call fcn.00495038
jmp 0x48e4b2
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
xor edi, edi
push edi
push str.IDS_PRODUCT_PUBLISHER
push 0xffffffffffffffff
lea ecx, [esp + 0xec]
call fcn.0043913e
add esp, 0xc
mov dword [esp + 0x760], 9
cmp dword [eax + 0x18], 8
jb 0x48ef38
mov eax, dword [eax + 4]
jmp 0x48ef3b
add eax, 4
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
push ecx
call fcn.00405747
push edi
push str.IDS_PRODUCT_TITLE
push 0xffffffffffffffff
lea ecx, [esp + 0x10c]
mov byte [esp + 0x770], 0xa
call fcn.0043913e
add esp, 0xc
mov byte [esp + 0x764], 0xb
cmp dword [eax + 0x18], 8
jb 0x48ef7b
mov eax, dword [eax + 4]
jmp 0x48ef7e
add eax, 4
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
push ecx
call fcn.00405747
push edi
push str.IDS_UNINSTALL_SHORTCUT_PTAH
push 0xffffffffffffffff
lea ecx, [esp + 0xd8]
mov byte [esp + 0x774], 0xc
call fcn.0043913e
add esp, 0xc
mov byte [esp + 0x768], 0xd
cmp dword [eax + 0x18], 8
jb 0x48efbe
mov eax, dword [eax + 4]
jmp 0x48efc1
add eax, 4
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
push ecx
call fcn.00405747
mov byte [esp + 0x76c], 0xf
call fcn.0049ea76
add esp, 0xc
push edi
push 1
lea esi, [esp + 0xcc]
call fcn.00404e82
push edi
push 1
lea esi, [esp + 0x104]
call fcn.00404e82
push edi
push 1
lea esi, [esp + 0xe8]
call fcn.00404e82
mov eax, dword [ebx + 0x1210]
cmp eax, edi
je 0x48e4b2
mov eax, dword [eax + 8]
cmp eax, edi
je 0x48f035
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
neg eax
jne 0x48e4b2
mov esi, dword [ebx + 0x1210]
cmp esi, edi
je 0x48f057
mov eax, dword [esi + 8]
cmp eax, edi
je 0x48f050
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], edi
push esi
call fcn.004e7360
pop ecx
mov dword [ebx + 0x1210], edi
jmp 0x48e4b2
mov ecx, 0x5e3
sub eax, ecx
je 0x48f113
sub eax, 0x5d
je 0x48f0ce
sub eax, 0x64
je 0x48f0b4
sub eax, 0x64
jne case.0x48e82f.1116
mov esi, 0x708
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
jne 0x48f0a6
push eax
push 0x3e8
jmp 0x48e89e
push 1
mov ecx, ebx
call fcn.00497762
jmp 0x48e4b2
push 0x6a4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov edi, ebx
call fcn.004965fa
jmp 0x48e4b2
mov eax, dword [ebx + 0x67c]
test eax, eax
je 0x48e4b2
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x48e4b2
push 0x640
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
lea esi, [ebx + 0x6d4]
movzx eax, byte [esi]
push eax
call fcn.0048e1fd
pop ecx
mov byte [esi], 0
jmp 0x48e4b2
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0043a862
call fcn.0044870d
test al, al
je 0x48f191
call fcn.00448748
test al, al
je 0x48f191
cmp dword [ebx + 0x6a8], 0
jne 0x48f176
push 0x582e91
push 0x1c8
call fcn.004eb6e3
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
and dword [esp + 0x760], 0
test eax, eax
je 0x48f166
push eax
call fcn.004a0817
jmp 0x48f168
xor eax, eax
or dword [esp + 0x760], 0xffffffff
mov dword [ebx + 0x6a8], eax
mov eax, dword [ebx + 0x6a8]
test eax, eax
je 0x48e4b2
push dword [ebx + 4]
call fcn.004a132c
jmp 0x48e4b2
push 0
push 0x8000
call fcn.004317c6
pop ecx
pop ecx
call fcn.0043a5f0
jmp 0x48e4b2
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
xor esi, esi
push esi
push dword [0x57a73c]
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
lea eax, [esp + 0x5c]
call fcn.00405fd8
lea ecx, [esp + 0x40]
push str.UtilsPopTip.exe
push ecx
mov edi, eax
mov dword [esp + 0x768], 0x16
call fcn.0040603b
pop ecx
pop ecx
mov byte [esp + 0x760], 0x18
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [esp + 0x40]
push esi
push 5
push esi
call fcn.00442a8c
add esp, 0xc
call fcn.00488747
mov eax, dword [esp + 0x40]
jmp 0x48e67e
mov ecx, 0x70e
cmp eax, ecx
ja 0x48f2f4
je 0x48f2de
sub eax, 0x70a
je 0x48f275
dec eax
je 0x48f269
dec eax
je 0x48f251
dec eax
jne case.0x48e82f.1116
push ebx
call fcn.00499613
jmp 0x48e4b2
push 0x70c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0049685f
jmp 0x48e4b2
mov ecx, ebx
call fcn.00499330
jmp 0x48e4b2
push 0
push 0
call fcn.00448783
pop ecx
pop ecx
test eax, eax
jne 0x48f2cb
xor esi, esi
push esi
push esi
push 2
push esi
push 0xff
call fcn.00448916
mov edi, dword [ebx + 4]
add esp, 0x14
push esi
push 0x3e8
push 4
lea eax, [esp + 0x28]
push eax
push 0x41505343
mov dword [esp + 0x30], 0x50533f07
call fcn.00436944
add esp, 0x14
mov esi, ebx
call fcn.00494ff8
mov edi, ebx
call fcn.00490a5b
push 0x70a
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x48e4b2
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov edi, ebx
call fcn.004966c4
jmp 0x48e4b2
mov ecx, 0x70f
cmp eax, ecx
je 0x48f329
cmp eax, 0x7bc
je 0x48f31d
mov esi, 0xbb9
cmp eax, esi
je 0x48f315
and dword [edx], 0
jmp 0x48e4b2
call fcn.00491b1f
push esi
jmp 0x48f2d0
mov eax, ebx
call fcn.00494a94
jmp 0x48e4b2
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0049672c
jmp 0x48e4b2