Function at 0x482117
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x7154
call fcn.0049c210
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
mov edi, str.Q_Dir___Document
mov eax, edi
test eax, eax
jne 0x48213c
xor eax, eax
jmp 0x48213f
push edi
call esi
push edi
push eax
mov ecx, 0x4c6998
call fcn.004039ec
mov edi, 0x4b1a2c
mov eax, edi
test eax, eax
je 0x482159
push edi
call esi
push edi
push eax
mov ecx, 0x4c6994
call fcn.004039ec
mov eax, dword [0x4af550]
and byte [ebp - 0xf], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0x13], 0x2d
mov byte [ebp - 0x12], 0x44
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0x10], 0x72
call fcn.00403adc
mov eax, dword [0x4af550]
and byte [ebp - 0x13], 0
and byte [ebp - 0x11], 0
and byte [ebp - 0x10], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
mov byte [ebp - 0x18], 0x31
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x2e
mov byte [ebp - 0x15], 0x39
mov byte [ebp - 0x14], 0x36
mov byte [ebp - 0x12], 0x30
call fcn.00403adc
lea eax, [ebp - 8]
mov ecx, 0x4c55c4
push eax
call fcn.00403a8c
lea eax, [ebp - 8]
mov ecx, 0x4c55bc
push eax
call fcn.00403a8c
lea eax, [ebp - 8]
mov ecx, 0x4c5710
push eax
call fcn.00403a8c
lea eax, [ebp - 0xc]
mov edi, 0x4c5708
push eax
mov ecx, edi
call fcn.00403a8c
push edi
mov ecx, 0x4c5704
call fcn.00403a8c
mov ebx, dword [ebp + 8]
push ebx
call esi
cmp eax, 5
mov edi, 0x4c6988
jle 0x48224d
push ebx
call esi
cmp eax, 0x209
jge 0x48224d
test ebx, ebx
jne 0x482230
xor eax, eax
jmp 0x482233
push ebx
call esi
push ebx
push eax
mov ecx, edi
call fcn.004039ec
call fcn.0042c19f
test eax, eax
je 0x48224d
push 1
pop esi
jmp 0x482886
test ebx, ebx
je 0x48244e
push ebx
call esi
push str.AutoStart2017_IZASSHJ
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], eax
call fcn.0040a529
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax - 8]
jne 0x48228f
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x48228f
push 1
call fcn.00437fe7
pop ecx
lea ecx, [ebp - 4]
jmp 0x48275c
lea ecx, [ebp - 4]
call fcn.004038fb
push ebx
call esi
cmp eax, 0xa
mov dword [ebp - 0x10], eax
jle 0x4823e8
push ebx
call fcn.004842b0
test eax, eax
pop ecx
je 0x4822b8
xor esi, esi
jmp 0x482886
push str.FolderToFolder
lea ecx, [ebp - 4]
call fcn.0040a529
cmp word [ebx], 0x46
jne 0x4822ec
push 0
mov ecx, edi
push dword [ebp - 4]
call fcn.00403d34
test eax, eax
jne 0x4822ec
push 0xa
push eax
call fcn.0048174d
pop ecx
mov esi, eax
pop ecx
jmp 0x482381
mov ecx, str.RunMSExplore
mov eax, ecx
test eax, eax
je 0x4822ff
push ecx
call esi
mov ecx, str.RunMSExplore
push ecx
push eax
lea ecx, [ebp - 4]
call fcn.004039ec
push 0
lea ecx, [ebp - 4]
push dword [ebp - 4]
call fcn.00403d34
test eax, eax
jne 0x482332
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x482332
push 0xa
push ebx
call fcn.00481f59
jmp 0x4822e3
mov ebx, str.MEDIA2017_IZASSHJ
mov eax, ebx
test eax, eax
je 0x482340
push ebx
call esi
push ebx
push eax
lea ecx, [ebp - 4]
call fcn.004039ec
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax - 8]
jl 0x482389
push dword [ebp + 8]
push dword [ebp + 8]
call esi
push eax
mov ecx, edi
call fcn.004039ec
push 0
push ebx
mov ecx, edi
call fcn.00403d34
test eax, eax
jl 0x482389
push 0xa
push 0
call fcn.0048201f
pop ecx
pop ecx
push 1
pop esi
lea ecx, [ebp - 4]
jmp 0x482881
mov ebx, str.ThePloder2018
mov eax, ebx
test eax, eax
je 0x482397
push ebx
call esi
push ebx
push eax
lea ecx, [ebp - 4]
call fcn.004039ec
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax - 8]
jl 0x4823dd
push dword [ebp + 8]
push dword [ebp + 8]
call esi
push eax
mov ecx, edi
call fcn.004039ec
push 0
push ebx
mov ecx, edi
call fcn.00403d34
test eax, eax
jl 0x4823dd
push 0xa
push 0
call fcn.00481fb1
pop ecx
pop ecx
lea ecx, [ebp - 4]
jmp 0x48275c
lea ecx, [ebp - 4]
call fcn.004038fb
mov ebx, dword [ebp + 8]
push ebx
call esi
push ebx
push eax
mov ecx, edi
call fcn.004039ec
push str.RegisterAdminKey4_EEETWETRFSD
lea ecx, [ebp - 0x1c]
call fcn.0040a529
xor esi, esi
mov ecx, edi
push esi
push dword [ebp - 0x1c]
call fcn.00403d34
test eax, eax
jl 0x482452
mov eax, dword [ebp - 0x1c]
push esi
mov ecx, edi
mov ebx, dword [eax - 8]
call fcn.00403c58
lea eax, [eax + ebx*2]
lea ecx, [ebp + 8]
push eax
call fcn.0040a529
push 1
push dword [ebp + 8]
call fcn.0049c2d8
pop ecx
push eax
call fcn.0040b80d
pop ecx
mov esi, eax
pop ecx
lea ecx, [ebp + 8]
call fcn.004038fb
jmp 0x48287e
xor eax, eax
jmp 0x4823eb
lea ecx, [ebp - 0x58]
call fcn.00482f6c
lea ecx, [ebp - 0x4c]
call fcn.00482f6c
lea eax, [ebp - 0x5c]
mov ecx, 0x4c69a0
push eax
mov dword [ebp - 0x5c], 0x4aaea4
call fcn.00481865
mov eax, dword [0x4c6988]
push ecx
mov ecx, esp
cmp dword [eax - 0xc], esi
jl 0x482492
mov dword [ecx], eax
sub eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4824a4
mov eax, dword [0x4af550]
mov dword [ecx], eax
push dword [0x4c6988]
call fcn.0040a750
call fcn.0040832d
cmp eax, esi
pop ecx
je 0x4824cd
push 1
pop esi
push esi
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [ebp - 0x4c]
call fcn.00445596
lea ecx, [ebp - 0x58]
call fcn.00445596
jmp 0x48287e
mov ecx, 0x4c6c04
call fcn.0044b0e4
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [0x4c2ef0]
push 0x4c2ef8
push dword [0x4c55c4]
call fcn.0044a9d1
add esp, 0x14
cmp eax, esi
mov dword [0x4c2ef0], eax
je 0x482537
call fcn.004820e5
test eax, eax
je 0x482537
push dword [0x4b29c0]
push str.disable_dark_theme
call fcn.0048ef58
pop ecx
mov dword [0x4b29c0], eax
pop ecx
mov ebx, eax
call fcn.0042d8ec
cmp ebx, esi
jne 0x482537
push 1
push dword [0x4c6a7c]
call fcn.0042dfe0
pop ecx
pop ecx
push esi
push 0x4b8058
mov ecx, edi
call fcn.00403d34
test eax, eax
jne 0x4825b5
mov eax, dword [0x4af550]
push 0x23
push 1
mov dword [ebp + 8], eax
push dword [0x4c6988]
lea eax, [ebp + 8]
push eax
call fcn.0048e9cf
add esp, 0x10
test eax, eax
je 0x4825a3
push 0x4b8054
lea ecx, [ebp - 0x10]
call fcn.00403927
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00403b20
push eax
mov ecx, 0x4c6aa0
call fcn.00403a8c
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 0x10]
call fcn.004038fb
call fcn.00440b40
lea ecx, [ebp + 8]
call fcn.004038fb
jmp 0x482751
lea ecx, [ebp - 0x7154]
call fcn.00433298
push str.Q_DIR_GUID
lea ecx, [ebp + 8]
call fcn.00403927
push dword [eax]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea ecx, [ebp + 8]
mov dword [0x4c6a70], eax
call fcn.004038fb
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x482600
call ebx
cmp eax, 5
je 0x482600
and byte [ebp + 0xb], 0
jmp 0x482604
mov byte [ebp + 0xb], 1
push str.QDir_Id
lea ecx, [ebp - 0x20]
call fcn.00403927
mov ebx, 0x4afae4
lea ecx, [ebp - 0x24]
push ebx
call fcn.0040a529
push esi
push 0x4b3fc0
mov ecx, edi
call fcn.00403d34
test eax, eax
jne 0x482696
push edi
lea ecx, [ebp - 4]
call fcn.004038b5
lea eax, [ebp - 4]
push eax
call fcn.00436406
pop ecx
test eax, eax
lea ecx, [ebp - 4]
je 0x482691
call fcn.004038fb
lea ecx, [ebp - 0x24]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
lea ecx, [ebp - 0x7154]
call fcn.00433ddb
lea ecx, [ebp - 0x5c]
call fcn.0048289d
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
xor eax, eax
jmp 0x482898
call fcn.004038fb
cmp byte [ebp + 0xb], 0
je 0x4827ba
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [0x4c31a4]
push str.default_new_tab
push ebx
call fcn.0044a9d1
add esp, 0x14
cmp eax, esi
mov dword [0x4c31a4], eax
je 0x482779
push esi
push 0x4b3fc0
mov ecx, edi
call fcn.00403d34
test eax, eax
jne 0x482779
lea eax, [ebp + 8]
mov dword [ebp + 8], esi
push eax
push 0x48170a
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp + 8], esi
je 0x482779
mov eax, dword [0x4c6988]
mov ebx, 0x2774
mov ecx, edi
mov eax, dword [eax - 8]
mov dword [ebp - 0x18], ebx
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 0x14], eax
call fcn.00403c58
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push esi
push 0x4a
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
jne 0x482779
push 0xaffe
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [ebp - 0x24]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
lea ecx, [ebp - 0x7154]
call fcn.00433ddb
lea ecx, [ebp - 0x5c]
call fcn.0048289d
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
push 1
pop eax
jmp 0x482898
cmp dword [0x4c55c8], esi
je 0x48279b
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [0x4c6a74]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.0044a9d1
add esp, 0x14
jmp 0x4827b2
push esi
push ecx
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, 0x4c6c04
call fcn.0044acc1
inc eax
mov dword [0x4c6a74], eax
jmp 0x4827bf
mov eax, dword [0x4c6a74]
cmp dword [0x4c55c8], esi
je 0x4827d9
push esi
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.0044a990
add esp, 0x10
jmp 0x4827f0
push eax
push ecx
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, 0x4c6c04
call fcn.0044ad34
call fcn.00408b53
test eax, eax
jne 0x482806
push 0xaffe
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x48285b
push esi
push 1
push 0x4b02e0
push dword [0x4c5710]
call fcn.0044a990
add esp, 0x10
lea ecx, [ebp - 0x7154]
call fcn.00443d99
test eax, eax
jne 0x48283b
push esi
push esi
push str.Main_window_creation_failed__n
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x48285b
lea ecx, [ebp - 0x5c]
call fcn.004817ca
mov ecx, 0x4c69a0
mov esi, eax
call fcn.004818a4
push dword [0x4c6a70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x24]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
lea ecx, [ebp - 0x7154]
call fcn.00433ddb
lea ecx, [ebp - 0x5c]
call fcn.0048289d
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret