Function at 0x497400
Capabilities:
Move file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x704
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
xor edi, edi
lea eax, [ebp - 0x4cf]
push edi
push eax
mov byte [ebp - 0x4d0], 0
call fcn.004a3190
add esp, 0xc
mov dword [0x4c6444], 0x20019
mov dword [0x4c6448], 0xf003f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov word [0x4d1e04], cx
push 8
lea edx, [ebp - 0xc]
mov ecx, 0x27a
mov dword [0x4d19b4], eax
call fcn.00499890
add esp, 4
mov edx, 0x4bf63c
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x497490
mov edx, 9
mov word [0x4d1e04], dx
jmp 0x4976be
cmp word [0x4d1e04], 9
je 0x4976be
mov edx, 0x4bbbb4
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x4974ba
mov eax, 7
mov word [0x4d1e04], ax
mov edx, 0x4bbbb8
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x4974d7
mov ecx, 0xc
mov word [0x4d1e04], cx
mov edx, 0x4bf640
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x4974f4
mov edx, 0xa
mov word [0x4d1e04], dx
mov edx, 0x4bf644
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x497510
mov eax, 0x10
mov word [0x4d1e04], ax
mov edx, 0x4bf648
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x49752d
mov ecx, 0x1d
mov word [0x4d1e04], cx
mov edx, 0x4bf64c
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x49754a
mov edx, 1
mov word [0x4d1e04], dx
mov edx, 0x4bf650
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x497566
mov eax, 0x19
mov word [0x4d1e04], ax
mov edx, 0x4bf654
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x497583
mov ecx, 0x16
mov word [0x4d1e04], cx
mov edx, 0x4bf658
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x4975a0
mov edx, 0x15
mov word [0x4d1e04], dx
mov edx, 0x4b5e2c
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x4975bc
mov eax, 0x14
mov word [0x4d1e04], ax
mov edx, 0x4bf65c
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x4975d9
mov ecx, 8
mov word [0x4d1e04], cx
mov edx, 0x4bf660
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x4975f6
mov edx, 0x13
mov word [0x4d1e04], dx
mov edx, 0x4b5e2c
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x497612
mov eax, 0x14
mov word [0x4d1e04], ax
mov edx, 0x4bf664
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x49762f
mov ecx, 0x16
mov word [0x4d1e04], cx
mov edx, 0x4bf668
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x49764c
mov edx, 0x1c
mov word [0x4d1e04], dx
mov edx, 0x4bf66c
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x497668
mov eax, 0x1f
mov word [0x4d1e04], ax
mov edx, 0x4bf670
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x497685
mov ecx, 1
mov word [0x4d1e04], cx
mov edx, 0x4bf674
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x4976a2
mov edx, 0xb
mov word [0x4d1e04], dx
mov edx, 0x4bf678
lea ecx, [ebp - 0xc]
call fcn.0047dee0
test eax, eax
je 0x4976be
mov eax, 4
mov word [0x4d1e04], ax
push 0x80
push str.Debug
push str.SoftwareBillP_StudiosWinPatrolOptions
lea ecx, [ebp - 0x1b8]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
jle 0x4976fd
lea ecx, [ebp - 0x1b8]
push ecx
call fcn.004a02f9
add esp, 4
cmp eax, edi
je 0x4976fd
mov dword [0x4c6438], edi
push str.kernel32
mov dword [0x4cbe24], 0x404040
mov dword [0x4c7288], edi
mov dword [0x4c728c], edi
mov dword [0x4d2b0c], edi
mov dword [0x4cd38c], edi
mov dword [0x4d2acc], edi
mov dword [0x4d2ad0], edi
mov dword [0x4d2ad4], edi
mov dword [0x4d2ad8], edi
mov dword [0x4d2adc], edi
mov dword [0x4d2ae0], edi
mov dword [0x4d2ae4], edi
mov dword [0x4d2ae8], edi
mov dword [ebp - 0x6ec], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, edi
je 0x4977aa
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4d3e50], eax
cmp eax, edi
je 0x497791
lea edx, [ebp - 0x6ec]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x4d3e50]
test eax, eax
je 0x4977aa
cmp dword [ebp - 0x6ec], edi
je 0x4977aa
mov dword [0x4d2afc], 1
mov esi, str._x64_
jmp 0x4977b5
mov dword [0x4d2afc], edi
mov esi, str._x86_
push str.GetInitalValues
call fcn.0047fb10
add esp, 4
push 0x20
push 0x4b17de
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x2c]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
jne 0x497aa9
push str.GetInitalValues
mov esi, str.FIRSTTIME
call fcn.0047fb10
mov edx, dword [0x4c6448]
add esp, 4
lea eax, [ebp - 0x6f8]
push eax
lea ecx, [ebp - 0x6ec]
push ecx
push edi
push edx
push edi
push edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push str.SoftwareBillP_Studios
push 0x80000001
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x497836
mov eax, dword [ebp - 0x6ec]
push eax
call ebx
mov eax, dword [0x4c6448]
lea ecx, [ebp - 0x6f8]
push ecx
lea edx, [ebp - 0x6ec]
push edx
push 0
push eax
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrol
push 0x80000001
call edi
test eax, eax
jne 0x49786b
mov ecx, dword [ebp - 0x6ec]
push ecx
call ebx
mov ecx, dword [0x4c6448]
lea edx, [ebp - 0x6f8]
push edx
lea eax, [ebp - 0x6ec]
push eax
push 0
push ecx
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolNuts
push 0x80000001
call edi
test eax, eax
jne 0x4978a1
mov edx, dword [ebp - 0x6ec]
push edx
call ebx
mov edx, dword [0x4c6448]
lea eax, [ebp - 0x6f8]
push eax
lea ecx, [ebp - 0x6ec]
push ecx
push 0
push edx
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolCookies
push 0x80000001
call edi
test eax, eax
jne 0x4978d7
mov eax, dword [ebp - 0x6ec]
push eax
call ebx
mov eax, dword [0x4c6448]
lea ecx, [ebp - 0x6f8]
push ecx
lea edx, [ebp - 0x6ec]
push edx
push 0
push eax
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolOptions
push 0x80000001
call edi
test eax, eax
jne 0x49790c
mov ecx, dword [ebp - 0x6ec]
push ecx
call ebx
mov ecx, dword [0x4c6448]
lea edx, [ebp - 0x6f8]
push edx
lea eax, [ebp - 0x6ec]
push eax
push 0
push ecx
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolRun
push 0x80000001
call edi
test eax, eax
jne 0x497942
mov edx, dword [ebp - 0x6ec]
push edx
call ebx
mov edx, dword [0x4c6448]
lea eax, [ebp - 0x6f8]
push eax
lea ecx, [ebp - 0x6ec]
push ecx
push 0
push edx
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolIEHelpers
push 0x80000001
call edi
test eax, eax
jne 0x497978
mov eax, dword [ebp - 0x6ec]
push eax
call ebx
mov eax, dword [0x4c6448]
lea ecx, [ebp - 0x6f8]
push ecx
lea edx, [ebp - 0x6ec]
push edx
push 0
push eax
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolHostFile
push 0x80000001
call edi
test eax, eax
jne 0x4979ad
mov ecx, dword [ebp - 0x6ec]
push ecx
call ebx
mov ecx, dword [0x4c6448]
lea edx, [ebp - 0x6f8]
push edx
lea eax, [ebp - 0x6ec]
push eax
push 0
push ecx
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolTasks
push 0x80000001
call edi
test eax, eax
jne 0x4979e3
mov edx, dword [ebp - 0x6ec]
push edx
call ebx
mov edx, dword [0x4c6448]
lea eax, [ebp - 0x6f8]
push eax
lea ecx, [ebp - 0x6ec]
push ecx
push 0
push edx
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolActiveX
push 0x80000001
call edi
test eax, eax
jne 0x497a19
mov eax, dword [ebp - 0x6ec]
push eax
call ebx
mov eax, dword [0x4c6448]
lea ecx, [ebp - 0x6f8]
push ecx
lea edx, [ebp - 0x6ec]
push edx
push 0
push eax
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolRejects
push 0x80000001
call edi
test eax, eax
jne 0x497a4e
mov ecx, dword [ebp - 0x6ec]
push ecx
call ebx
mov ecx, str._PLUS
call fcn.00482e00
lea edx, [ebp - 0x6e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x6e8]
call fcn.004807a0
add esp, 4
push 0x4b17de
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x138]
mov edx, 0x80000001
call fcn.0048e390
push str.GetInitalValues_LocalTime
lea esi, [ebp - 0x138]
call fcn.0047fb10
add esp, 0xc
jmp 0x497ab5
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [0x4c6448]
lea ecx, [ebp - 0x6f8]
push ecx
lea edx, [ebp - 0x6ec]
push edx
push 0
push eax
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolFileSizeMonitor
push 0x80000001
call edi
test eax, eax
jne 0x497aea
mov ecx, dword [ebp - 0x6ec]
push ecx
call ebx
push 0x104
push str.FilterBySizeIndex
push str.SoftwareBillP_StudiosWinPatrolFileSizeMonitor
lea ecx, [ebp - 0x4d0]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
cmp byte [ebp - 0x4d0], 0
jne 0x497b31
push str.FilterBySizeIndex
push str.SoftwareBillP_StudiosWinPatrolFileSizeMonitor
mov ecx, 0x4b7398
mov edx, 0x80000001
call fcn.0048e390
add esp, 8
push 0x104
push str.FilterByTypeIndex
push str.SoftwareBillP_StudiosWinPatrolFileSizeMonitor
lea ecx, [ebp - 0x4d0]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
cmp byte [ebp - 0x4d0], 0
jne 0x497b78
push str.FilterByTypeIndex
push str.SoftwareBillP_StudiosWinPatrolFileSizeMonitor
mov ecx, 0x4b7398
mov edx, 0x80000001
call fcn.0048e390
add esp, 8
push 0x104
push str.PATH
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x138]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
jne 0x497bce
lea edi, [ebp - 0x138]
call fcn.0047e3e0
push str.PATH
push str.SoftwareBillP_StudiosWinPatrol
mov ecx, edi
mov edx, 0x80000001
call fcn.0048e390
push str.GetInitValues_GetMyFolder_New
mov esi, edi
call fcn.0047fb10
add esp, 0xc
lea edx, [ebp - 0x1b8]
push edx
mov ecx, 3
call fcn.0047ebe0
add esp, 4
push str.GetInitalValues
mov esi, str.Initialize_PLUS_files
call fcn.0047fb10
add esp, 4
call fcn.0049b590
call fcn.0049af40
call fcn.0049b110
call fcn.0049b2a0
push str.GetInitalValues
mov esi, str.AutoUpdate
call fcn.0047fb10
add esp, 4
cmp dword [0x4d2afc], 0
je 0x497c4e
mov eax, dword [0x4c6444]
mov ecx, dword [0x4c6448]
mov dword [ebp - 0x704], eax
mov dword [ebp - 0x6f8], ecx
mov dword [0x4c6444], 0x20119
mov dword [0x4c6448], 0x20106
mov eax, dword [0x4c6444]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x6ec]
push edx
push eax
push 0
push str.SoftwareBillP_StudiosWinPatrol
push 0x80000001
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x497cd5
lea ecx, [ebp - 0x6f4]
push ecx
mov ecx, dword [ebp - 0x6ec]
lea edx, [ebp - 0x6f0]
push edx
lea eax, [ebp - 0x700]
push eax
push 0
push str.AUOptions
push ecx
mov dword [ebp - 0x6f4], 4
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x497cbd
mov edx, dword [ebp - 0x6ec]
push edx
call esi
jmp 0x497cdb
mov eax, dword [ebp - 0x6ec]
push eax
call esi
cmp dword [ebp - 0x6f0], 0
jne 0x497d7c
jmp 0x497cdb
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [0x4c6444]
lea ecx, [ebp - 0x6ec]
push ecx
push edx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto_Update
push 0x80000002
call edi
test eax, eax
je 0x497cff
xor eax, eax
jmp 0x497d4e
lea eax, [ebp - 0x6f0]
push eax
mov eax, dword [ebp - 0x6ec]
lea ecx, [ebp - 0x6f4]
push ecx
lea edx, [ebp - 0x700]
push edx
push 0
push str.AUOptions
push eax
mov dword [ebp - 0x6f0], 4
call ebx
test eax, eax
je 0x497d3f
mov ecx, dword [ebp - 0x6ec]
push ecx
call esi
xor eax, eax
jmp 0x497d4e
mov edx, dword [ebp - 0x6ec]
push edx
call esi
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x6fc], eax
test eax, eax
je 0x497d7c
lea eax, [ebp - 0x6fc]
push eax
push str.AUOptions
mov esi, str.SoftwareBillP_StudiosWinPatrol
mov ebx, 0x80000001
call fcn.0048e590
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
call fcn.0049a060
test eax, eax
je 0x498124
push str.GetInitalValues
mov esi, str.UAC_Values
call fcn.0047fb10
mov edx, dword [0x4c6444]
add esp, 4
lea ecx, [ebp - 0x6ec]
push ecx
push edx
push 0
push str.SoftwareBillP_StudiosWinPatrol
push 0x80000001
call edi
test eax, eax
je 0x497dc0
or eax, 0xffffffff
jmp 0x497e18
lea eax, [ebp - 0x6f0]
push eax
mov eax, dword [ebp - 0x6ec]
lea ecx, [ebp - 0x6f4]
push ecx
lea edx, [ebp - 0x700]
push edx
push 0
push str.ConsentPromptBehaviorAdmin
push eax
mov dword [ebp - 0x6f0], 4
call ebx
test eax, eax
je 0x497e05
mov ecx, dword [ebp - 0x6ec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x497e18
mov edx, dword [ebp - 0x6ec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x6fc], eax
cmp eax, 0xffffffff
jne 0x497ece
mov ecx, dword [0x4c6444]
lea eax, [ebp - 0x6ec]
push eax
push ecx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call edi
test eax, eax
je 0x497e4c
or eax, 0xffffffff
jmp 0x497ea4
lea edx, [ebp - 0x6f0]
push edx
mov edx, dword [ebp - 0x6ec]
lea eax, [ebp - 0x6f4]
push eax
lea ecx, [ebp - 0x700]
push ecx
push 0
push str.ConsentPromptBehaviorAdmin
push edx
mov dword [ebp - 0x6f0], 4
call ebx
test eax, eax
je 0x497e91
mov eax, dword [ebp - 0x6ec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x497ea4
mov ecx, dword [ebp - 0x6ec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x6f4]
lea edx, [ebp - 0x6fc]
push edx
push str.ConsentPromptBehaviorAdmin
mov esi, str.SoftwareBillP_StudiosWinPatrol
mov ebx, 0x80000001
mov dword [ebp - 0x6fc], eax
call fcn.0048e590
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
mov ecx, dword [0x4c6444]
lea eax, [ebp - 0x6ec]
push eax
push ecx
push 0
push str.SoftwareBillP_StudiosWinPatrol
push 0x80000001
call edi
test eax, eax
je 0x497ef9
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x497f4f
lea edx, [ebp - 0x6f0]
push edx
mov edx, dword [ebp - 0x6ec]
lea eax, [ebp - 0x6f4]
push eax
lea ecx, [ebp - 0x700]
push ecx
push 0
push str.EnableLUA
push edx
mov dword [ebp - 0x6f0], 4
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x497f40
mov eax, dword [ebp - 0x6ec]
push eax
call esi
or eax, 0xffffffff
jmp 0x497f4f
mov ecx, dword [ebp - 0x6ec]
push ecx
call esi
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x6fc], eax
cmp eax, 0xffffffff
jne 0x498002
mov eax, dword [0x4c6444]
lea edx, [ebp - 0x6ec]
push edx
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call edi
test eax, eax
je 0x497f82
or eax, 0xffffffff
jmp 0x497fd2
lea ecx, [ebp - 0x6f0]
push ecx
mov ecx, dword [ebp - 0x6ec]
lea edx, [ebp - 0x6f4]
push edx
lea eax, [ebp - 0x700]
push eax
push 0
push str.EnableLUA
push ecx
mov dword [ebp - 0x6f0], 4
call ebx
test eax, eax
je 0x497fc3
mov edx, dword [ebp - 0x6ec]
push edx
call esi
or eax, 0xffffffff
jmp 0x497fd2
mov eax, dword [ebp - 0x6ec]
push eax
call esi
mov eax, dword [ebp - 0x6f4]
lea ecx, [ebp - 0x6fc]
push ecx
push str.EnableLUA
mov esi, str.SoftwareBillP_StudiosWinPatrol
mov ebx, 0x80000001
mov dword [ebp - 0x6fc], eax
call fcn.0048e590
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
mov eax, dword [0x4c6444]
lea edx, [ebp - 0x6ec]
push edx
push eax
push 0
push str.SoftwareBillP_StudiosWinPatrol
push 0x80000001
call edi
test eax, eax
je 0x498026
or eax, 0xffffffff
jmp 0x498076
lea ecx, [ebp - 0x6f0]
push ecx
mov ecx, dword [ebp - 0x6ec]
lea edx, [ebp - 0x6f4]
push edx
lea eax, [ebp - 0x700]
push eax
push 0
push str.PromptOnSecureDesktop
push ecx
mov dword [ebp - 0x6f0], 4
call ebx
test eax, eax
je 0x498067
mov edx, dword [ebp - 0x6ec]
push edx
call esi
or eax, 0xffffffff
jmp 0x498076
mov eax, dword [ebp - 0x6ec]
push eax
call esi
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x6fc], eax
cmp eax, 0xffffffff
jne 0x498124
mov edx, dword [0x4c6444]
lea ecx, [ebp - 0x6ec]
push ecx
push edx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call edi
test eax, eax
je 0x4980aa
or eax, 0xffffffff
jmp 0x4980fa
lea eax, [ebp - 0x6f0]
push eax
mov eax, dword [ebp - 0x6ec]
lea ecx, [ebp - 0x6f4]
push ecx
lea edx, [ebp - 0x700]
push edx
push 0
push str.PromptOnSecureDesktop
push eax
mov dword [ebp - 0x6f0], 4
call ebx
test eax, eax
je 0x4980eb
mov ecx, dword [ebp - 0x6ec]
push ecx
call esi
or eax, 0xffffffff
jmp 0x4980fa
mov edx, dword [ebp - 0x6ec]
push edx
call esi
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x6fc], eax
lea eax, [ebp - 0x6fc]
push eax
push str.PromptOnSecureDesktop
mov esi, str.SoftwareBillP_StudiosWinPatrol
mov ebx, 0x80000001
call fcn.0048e590
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
push 0x20
push 0x4b17de
push str.SoftwareBillP_StudiosWinPatrolSysfiles
lea ecx, [ebp - 0x2c]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
test eax, eax
jne 0x4981f0
push str.GetInitalValues
mov esi, str.Create_REGWINPATROLSYSFILES_Keys
call fcn.0047fb10
mov eax, dword [0x4c6448]
add esp, 4
lea ecx, [ebp - 0x700]
push ecx
lea edx, [ebp - 0x6f0]
push edx
push 0
push eax
push 0
push 0
push 0
push str.SoftwareBillP_StudiosWinPatrolSysfiles
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x498197
mov ecx, dword [ebp - 0x6f0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.GetHOSTSFile
mov esi, str.winpatrol.c
call fcn.0047fb10
add esp, 4
lea esi, [ebp - 0x138]
call fcn.0047fd80
call fcn.00491ef0
lea edx, [ebp - 0x6e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, esi
push eax
lea ecx, [ebp - 0x6e8]
call fcn.004807a0
add esp, 4
push 0x4b17de
push str.SoftwareBillP_StudiosWinPatrolSysfiles
mov ecx, esi
mov edx, 0x80000002
call fcn.0048e390
add esp, 8
call fcn.0049db40
push 0x20
push str.RegNumber
push str.SoftwareBillP_StudiosWinPatrol
mov ecx, 0x4c7a9c
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
push str.GetInitalValues
mov esi, str.Check_if_New_Installs
call fcn.0047fb10
add esp, 4
push 0x20
push str.NewVersion
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x2c]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
jne 0x4982a1
push str.34.11.2016.15
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x138]
call fcn.00401000
push str.New_Install
lea esi, [ebp - 0x138]
call fcn.0047fb10
add esp, 4
push str.NewVersion
push str.SoftwareBillP_StudiosWinPatrol
mov ecx, esi
mov edx, 0x80000001
call fcn.0048e390
call fcn.0049ae50
call fcn.00482180
push 1
call fcn.00499cb0
add esp, 0xc
jmp 0x498431
mov edx, str.34.11.2016.15
lea ecx, [ebp - 0x2c]
call fcn.0047dee0
test eax, eax
jne 0x4983b1
push str.Update_Install
lea esi, [ebp - 0x2c]
call fcn.0047fb10
add esp, 4
push str.34.11.2016.15
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x138]
call fcn.00401000
push str.NewVersion
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x138]
mov edx, 0x80000001
call fcn.0048e390
call fcn.0049ae50
call fcn.00482180
push 1
call fcn.00499cb0
mov edx, dword [0x4c6444]
add esp, 0xc
lea ecx, [ebp - 0x6ec]
push ecx
push edx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto_Update
push 0x80000002
call edi
test eax, eax
je 0x498332
xor eax, eax
jmp 0x498389
lea eax, [ebp - 0x6f0]
push eax
mov eax, dword [ebp - 0x6ec]
lea ecx, [ebp - 0x6f4]
push ecx
lea edx, [ebp - 0x700]
push edx
push 0
push str.AUOptions
push eax
mov dword [ebp - 0x6f0], 4
call ebx
test eax, eax
je 0x498376
mov ecx, dword [ebp - 0x6ec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x498389
mov edx, dword [ebp - 0x6ec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x6fc], eax
test eax, eax
je 0x4983b1
lea eax, [ebp - 0x6fc]
push eax
push str.AUOptions
mov esi, str.SoftwareBillP_StudiosWinPatrol
mov ebx, 0x80000001
call fcn.0048e590
add esp, 8
cmp dword [0x4d2afc], 0
je 0x4983d2
mov ecx, dword [ebp - 0x704]
mov edx, dword [ebp - 0x6f8]
mov dword [0x4c6444], ecx
mov dword [0x4c6448], edx
push 0x80
push str.Cleanup
push str.SoftwareBillP_StudiosWinPatrolOptions
lea ecx, [ebp - 0x1b8]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
jle 0x498431
lea eax, [ebp - 0x1b8]
push eax
call fcn.004a02f9
add esp, 4
test eax, eax
je 0x498431
push str.GetInitalValues
mov esi, str.Registry_Garbage_Collection
call fcn.0047fb10
add esp, 4
call fcn.0049ae50
push 0
mov esi, str.Cleanup
call fcn.0049a200
add esp, 4
call fcn.00484b00
call fcn.00498740
push str.GetInitalValues
mov esi, str.Explorer_Integration
call fcn.0047fb10
add esp, 4
push 0x104
push 0x4b17de
push str.exefile_shellWinPatrol_PLUS
lea ecx, [ebp - 0x138]
mov edx, 0x80000000
call fcn.0048e050
add esp, 0xc
cmp dword [0x4c6470], 1
jne 0x498488
test eax, eax
jne 0x4984c4
push 1
call fcn.0049c3a0
add esp, 4
jmp 0x4984c4
test eax, eax
je 0x4984c4
push str.exefile_shellWinPatrol_PLUS
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x208
ja 0x4984c4
push str.exefile_shellWinPatrol_PLUS
lea ecx, [ebp - 0x6d8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x6d8]
push edx
push 0x80000000
call fcn.0048f3b0
add esp, 8
push 0x80
push str.AppData
push str.SoftwareBillP_StudiosWinPatrolOptions
lea ecx, [ebp - 0x1b8]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
jle 0x498501
lea eax, [ebp - 0x1b8]
push eax
call fcn.004a02f9
add esp, 4
test eax, eax
jne 0x4986dc
push 0x104
push str.PATH
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x5d8]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
je 0x4986dc
lea ecx, [ebp - 0x5d8]
push ecx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x2c0]
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x2c0]
cmp byte [eax], 0
je 0x49855d
inc eax
dec edx
jne 0x498552
jmp 0x498585
test edx, edx
je 0x498585
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.history.txt
lea ecx, [ebp + ecx - 0x2c0]
mov edx, 0x7fffffff
call fcn.00401000
lea ecx, [ebp - 0x2c0]
call fcn.0047d280
test eax, eax
je 0x498600
lea ebx, [ebp - 0x3c8]
call fcn.0047ea60
mov eax, 0x104
mov ecx, ebx
cmp byte [ecx], 0
je 0x4985b1
inc ecx
dec eax
jne 0x4985a6
jmp 0x4985d9
test eax, eax
je 0x4985d9
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
sub eax, ecx
push str.history.txt
lea ecx, [ebp + ecx - 0x3c8]
mov edx, 0x7fffffff
call fcn.00401000
lea edx, [ebp - 0x3c8]
push edx
lea eax, [ebp - 0x2c0]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x498600
push 1
mov esi, str.AppData
call fcn.0049a200
add esp, 4
lea ecx, [ebp - 0x5d8]
push ecx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x2c0]
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x2c0]
cmp byte [eax], 0
je 0x498632
inc eax
dec edx
jne 0x498627
jmp 0x49865a
test edx, edx
je 0x49865a
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.disabled
lea ecx, [ebp + ecx - 0x2c0]
mov edx, 0x7fffffff
call fcn.00401000
lea ebx, [ebp - 0x3c8]
call fcn.0047ea60
mov eax, 0x104
mov ecx, ebx
lea esp, [esp]
cmp byte [ecx], 0
je 0x49867b
inc ecx
dec eax
jne 0x498670
jmp 0x4986a3
test eax, eax
je 0x4986a3
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
sub eax, ecx
push str.disabled
lea ecx, [ebp + ecx - 0x3c8]
mov edx, 0x7fffffff
call fcn.00401000
lea edx, [ebp - 0x3c8]
push edx
lea eax, [ebp - 0x2c0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4986dc
push 8
lea ecx, [ebp - 0x3c8]
push ecx
lea edx, [ebp - 0x2c0]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ebx, [ebp - 0x2c0]
call fcn.0047dcf0
xor edi, edi
push edi
call fcn.0049bdc0
add esp, 4
push str.GetInitalValues
mov esi, str.Init_Delayed_Launch
mov dword [0x4d2a80], eax
call fcn.0047fb10
add esp, 4
mov dword [0x4d2a6c], edi
mov dword [0x4d2a70], edi
mov dword [0x4d2a74], edi
mov dword [0x4d2a78], edi
call fcn.00488150
mov ecx, dword [ebp - 4]
mov eax, dword [0x4cd38c]
pop edi
pop esi
xor ecx, ebp
mov dword [0x4d2a6c], eax
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret