Function at 0x4f6271
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x954
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x90f]
push ebx
push eax
mov byte [ebp - 0x910], bl
call fcn.005117f0
add esp, 0xc
push ebx
push ebx
push ebx
call fcn.00489f49
push eax
push str._sSoundsEdit.wav
push ebx
call fcn.004c5467
add esp, 0x14
push eax
call fcn.004c0b87
pop ecx
pop ecx
xor eax, eax
call fcn.004b3457
mov esi, eax
call fcn.00437937
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp esi, ebx
je 0x4f62f0
push ebx
push ebx
push esi
xor eax, eax
call fcn.004b2513
add esp, 0xc
mov eax, esi
call fcn.004b1c97
xor ecx, ecx
call fcn.00415cc5
call fcn.00462849
push eax
push ebx
mov esi, str.L95g
push esi
call fcn.004c6598
pop ecx
pop ecx
push eax
call fcn.00462849
push eax
push ebx
push esi
call fcn.004c6598
pop ecx
pop ecx
push eax
push ebx
xor ecx, ecx
call fcn.00462751
pop ecx
push eax
push str.Please_visit_www.paula2.com_in_your_web_browser._nClick_the__Downloads__link_to_open_the_login_popup._n_nEnter_the_following_login_information:_n_rUser_Name:__s_n_rPassword:__s_04d_n_nYou_will_be_asked_to_download_a_file._nRun_it_and_acknowledge_the_Windows_security_warnings._n_n_rWhen_the_setup_begins__you_will_be_asked_for_a_key._n_rProduct_Key:__s_04d_n_nPress__SPACE_BAR__to_close...
push str.__PAULA_Installation_Instructions__
push str.DeepBeep.WAV
xor esi, esi
push str.__133__134_
inc esi
push esi
push edi
call fcn.00436110
mov edi, eax
add esp, 0x2c
cmp edi, 0x85
je 0x4f635d
cmp edi, 0x86
jne 0x4f65ea
xor ecx, ecx
call fcn.00415cc5
test eax, eax
je 0x4f6439
cmp edi, 0x86
je 0x4f6439
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x950]
push ebx
push eax
call fcn.005117f0
add esp, 0xc
mov dword [ebp - 0x950], edi
mov dword [ebp - 0x94c], 0x4c
mov dword [ebp - 0x944], str.open
mov dword [ebp - 0x940], str.control.exe
mov dword [ebp - 0x93c], str._name_Microsoft.NetworkAndSharingCenter
call fcn.004101db
mov dword [ebp - 0x948], eax
lea eax, [ebp - 0x950]
push eax
mov dword [ebp - 0x934], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4f6499
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.You_may_need_to_enable_file_sharing._nIf_you_are_not_familiar_with_file_sharing__nplease_call_tech_support____360_545_6605_nOtherwise__follow_the_instructions_below:_n_n__1._Press_the__File_sharing__drop_down_arrow._n__2._Select___Turn_on_file_sharing_._n__3._Press_the__Apply__button._n__4._You_may_then_close_the_Sharing_Center_window.
lea eax, [ebp - 0x910]
push 0x800
push eax
call fcn.004c53b7
add esp, 0xc
push 0x1388
call fcn.00416a43
mov dword [esp], 0x2710
call fcn.00416a43
mov dword [esp], 0x11040
push str.To_Enable_File_Sharing
lea eax, [ebp - 0x910]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4f65d1
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x950]
push ebx
push eax
call fcn.005117f0
add esp, 0xc
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0x950], edi
mov dword [ebp - 0x94c], 0x4c
mov dword [ebp - 0x944], str.properties
call fcn.00489f49
pop ecx
pop ecx
mov dword [ebp - 0x940], eax
call fcn.004101db
mov dword [ebp - 0x948], eax
lea eax, [ebp - 0x950]
push eax
mov dword [ebp - 0x934], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x4f64c8
push str._GetLastError_
push str.:6:ShowSpawningInstructions___FAILED:_ShellExecuteEx___FAILED:__s
call fcn.004265da
push 0x536a30
push str.A_problem_occurred_and_the_sharing_setup_cannot_initialize._nPlease_call_teck_support____s_for_help._n_nPress_any_key_to_continue...
push str.__ShellExecuteEx___FAILED__
push ebx
push ebx
push ebx
push esi
call fcn.00436110
add esp, 0x24
jmp 0x4f65ea
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.005117f0
add esp, 0xc
lea eax, [ebp - 0x110]
push 0xffffffffffffffff
push eax
call fcn.00489f49
pop ecx
pop ecx
lea esi, [ebp - 0x110]
call fcn.004c3e68
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
lea eax, [ebp - 0x110]
push eax
push str._s_Properties
push ebx
call fcn.004c5467
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
add esp, 0xc
push eax
push ebx
call edi
cmp eax, ebx
mov dword [ebp - 0x914], eax
jne 0x4f6604
push 0x7d0
call esi
lea eax, [ebp - 0x110]
push eax
push str._s_Properties
push ebx
call fcn.004c5467
add esp, 0xc
push eax
push ebx
call edi
cmp eax, ebx
mov dword [ebp - 0x914], eax
jne 0x4f65f9
push str.:4:ShowSpawningInstructions___EAP:_The_Properties_box_never_appeared_
call fcn.004265da
pop ecx
call fcn.004101db
mov eax, str.HCTC
push eax
push eax
push str.You_may_need_to_enable_file_sharing._nIf_you_are_not_familiar_with_file_sharing__nplease_call_tech_support____360_545_6605_nOtherwise__follow_the_instructions_below:_n_n__1._Select_the__Sharing__tab_if_it_is_not_already_selected._n__2._Enable_file_sharing_for_the__s_folder._n_____If_the__s_folder_is_already_shared__n_____unshare_the_folder_and_press__Apply_._n_____Then__re_enable_file_sharing._n_____If_the_sharing_option_does_not_exist__click_the_n_____colored_text_toward_the_bottom_of_the_window_that_says__n______If_you_understand_the_risk_but_want_to_share..._._n_____Then_select__Just_enable_file_sharing.__n_____DO_NOT_RUN_THE_WIZARD._n__3._Press__OK__on_the_file_sharing_dialog_box_to_exit.
lea eax, [ebp - 0x910]
push 0x800
push eax
call fcn.004c53b7
add esp, 0x14
push 0x11040
mov esi, str.To_Enable_File_Sharing
push esi
lea eax, [ebp - 0x910]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
push ebx
call edi
mov esi, eax
cmp esi, ebx
je 0x4f65d1
push 0x243
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0xffffffffffffffff
push dword [ebp - 0x918]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [ebp - 0x918]
call fcn.0042dbeb
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
push str.:2:ShowSpawningInstructions___EAP:_The_Properties_box_took_too_long_to_appear.
call fcn.00426c01
pop ecx
push dword [ebp - 0x914]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push ebx
push ebx
push ebx
push 0x11
call esi
push ebx
push ebx
push ebx
push 9
call esi
push ebx
push 2
push ebx
push 9
call esi
push ebx
push 2
push ebx
push 0x11
call esi
jmp 0x4f6576