Function at 0x4b81a0
Capabilities:
Create thread
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2b8], ecx
push 0xc
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0
push ecx
mov ecx, esp
push 0x80
call fcn.004bfa40
call fcn.004c3a60
add esp, 0x10
mov dword [ebp - 4], eax
push 1
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x30
call fcn.004bfcd0
push 0x32
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0
push ecx
mov ecx, esp
push 0x80
call fcn.004bfa40
call fcn.004c3a60
add esp, 0x10
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x30
call fcn.004bfcd0
push 0
push 0
call fcn.004140d0
add esp, 8
push 1
mov edx, dword [ebp - 0x2b8]
mov eax, dword [edx + 0x30]
push eax
call fcn.00452820
mov ecx, eax
call fcn.004528c0
cmp dword [ebp - 0x2b8], 0
je 0x4b827a
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x19c
mov dword [ebp - 0x2bc], ecx
jmp 0x4b8284
mov dword [ebp - 0x2bc], 0
mov edx, dword [ebp - 0x2bc]
push edx
push 1
push 1
mov eax, dword [ebp - 0x2b8]
push eax
push 0
mov ecx, dword [ebp - 0x2b8]
mov edx, dword [ecx + 0x30]
push edx
push str.PopWndTrackermaindlg.xml
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x54
call fcn.00410dd0
movzx eax, al
test eax, eax
jne 0x4b82c4
or eax, 0xffffffff
jmp 0x4b8808
push 0
push 0xffffffffffffffff
push str.PopWndTracker_shared.xml
call fcn.004144d0
add esp, 0xc
push 0
push 0xffffffffffffffff
push 0x551b6c
lea ecx, [ebp - 0x254]
push ecx
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x54
call fcn.00411510
mov ecx, eax
call fcn.00402b70
push eax
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x30
call fcn.004bfab0
lea ecx, [ebp - 0x254]
call fcn.00402ac0
mov ecx, dword [ebp - 0x2b8]
call fcn.004beb50
test eax, eax
je 0x4b832b
or eax, 0xffffffff
jmp 0x4b8808
movzx edx, byte [0x57c125]
test edx, edx
jne 0x4b8448
movzx eax, byte [0x57c124]
cmp eax, 1
jne 0x4b8353
or eax, 0xffffffff
jmp 0x4b8808
lea ecx, [ebp - 0x230]
call fcn.004c6e80
push 0
push ecx
mov ecx, esp
push 0
call fcn.00483e20
push 0
push 0
push 0
push ecx
mov ecx, esp
push 0
call fcn.00483db0
mov ecx, dword [ebp - 0x2b8]
mov edx, dword [ecx + 0x30]
push edx
lea ecx, [ebp - 0x204]
call fcn.004c03e0
test eax, eax
je 0x4b8428
push 0
push 0xffffffffffffffff
push 0x551b90
lea eax, [ebp - 0x278]
push eax
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x54
call fcn.00411510
mov ecx, eax
call fcn.00402b70
push eax
lea ecx, [ebp - 0x230]
call fcn.004c8fc0
lea ecx, [ebp - 0x278]
call fcn.00402ac0
push 1
push 0
push 0
push 0
push str.IDS_TRAP_NEED_ADMIN
lea ecx, [ebp - 0x294]
push ecx
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x54
call fcn.004114c0
mov ecx, eax
call fcn.00402b70
push eax
push 0
lea ecx, [ebp - 0x230]
call fcn.004c9110
lea ecx, [ebp - 0x294]
call fcn.00402ac0
push 0
push 0
push 1
push 0
lea ecx, [ebp - 0x230]
call fcn.004c8d50
mov dword [ebp - 0x298], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.004bf980
mov eax, dword [ebp - 0x298]
jmp 0x4b8808
lea edx, [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x5c
call fcn.00415be0
mov ecx, eax
call fcn.00425610
lea ecx, [ebp - 0xc]
call fcn.00415c30
movzx eax, al
test eax, eax
jne 0x4b848d
mov dword [ebp - 0x29c], 0xffffffff
lea ecx, [ebp - 0xc]
call fcn.00425860
mov eax, dword [ebp - 0x29c]
jmp 0x4b8808
push 0
push 0x2710
lea ecx, [ebp - 0x2a0]
push ecx
lea ecx, [ebp - 0xc]
call fcn.00415c10
mov ecx, eax
call fcn.00425c50
push eax
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x1a8
call fcn.0044b610
lea ecx, [ebp - 0x2a0]
call fcn.00425c40
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x1a8
call fcn.00417680
movzx edx, al
test edx, edx
jne 0x4b84fc
mov dword [ebp - 0x2a4], 0xffffffff
lea ecx, [ebp - 0xc]
call fcn.00425860
mov eax, dword [ebp - 0x2a4]
jmp 0x4b8808
push 0
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x30
call fcn.004a7ea0
mov eax, dword [ebp - 0x2b8]
add eax, 0x938
push eax
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x30
call fcn.00425310
call fcn.004fef10
mov ecx, eax
call fcn.004fefe0
mov ecx, dword [ebp - 0x2b8]
mov dword [ecx + 0x954], eax
call fcn.004d3030
mov ecx, dword [ebp - 0x2b8]
call fcn.004bc920
mov ecx, dword [ebp - 0x2b8]
call fcn.004bc910
mov ecx, dword [ebp - 0x2b8]
call fcn.004bd090
mov ecx, dword [ebp - 0x2b8]
call fcn.004bea30
lea edx, [ebp - 0x2a8]
push edx
call fcn.00482b90
add esp, 4
mov ecx, eax
call fcn.00406010
push eax
push 0
push str.PopNum
push 0x551bec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x2b8]
mov dword [ecx + 0x294], eax
lea ecx, [ebp - 0x2a8]
call fcn.00406190
lea edx, [ebp - 0x2ac]
push edx
call fcn.00482b90
add esp, 4
mov ecx, eax
call fcn.00406010
push eax
push 0
push 0x551c00
push 0x551c10
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x2b8]
mov dword [ecx + 0x2a4], eax
lea ecx, [ebp - 0x2ac]
call fcn.00406190
mov ecx, dword [ebp - 0x2b8]
call fcn.004b8d50
mov ecx, dword [ebp - 0x2b8]
call fcn.004be190
mov dword [ebp - 0x10], 1
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push str.AdBlocker
push str.SOFTWARE360TotalSecurityTryNowLog
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x2b8]
call fcn.004baec0
mov eax, dword [ebp - 0x2b8]
mov ecx, dword [eax + 0x294]
mov edx, dword [ebp - 0x2b8]
add ecx, dword [edx + 0x2a4]
push ecx
mov ecx, dword [ebp - 0x2b8]
call fcn.004bb140
push 0xcc
mov ecx, 0x57c128
call fcn.004bf970
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov ecx, dword [ebp - 0x2b8]
mov dword [ecx + 0x930], eax
lea edx, [ebp - 0x2b0]
push edx
call fcn.00482b90
add esp, 4
mov ecx, eax
call fcn.00406010
push eax
push 0x551c80
push 0x551c84
push 0x551c8c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x2b0]
call fcn.00406190
movzx eax, byte [0x57c124]
test eax, eax
jne 0x4b86d8
push 0
push 0x7d0
push 0x3ee
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x30
call fcn.004a0cc0
mov ecx, dword [ebp - 0x2b8]
cmp dword [ecx + 0x2a0], 0
jne 0x4b870f
push 0
push 0
mov edx, dword [ebp - 0x2b8]
push edx
push 0x4b91e0
push 0
push 0
call fcn.0050e25b
add esp, 0x18
mov ecx, dword [ebp - 0x2b8]
mov dword [ecx + 0x2a0], eax
cmp dword [ebp - 0x2b8], 0
je 0x4b8729
mov edx, dword [ebp - 0x2b8]
add edx, 0x50
mov dword [ebp - 0x2c0], edx
jmp 0x4b8733
mov dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x2c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov ecx, 0x57c128
call fcn.004a06e0
mov ecx, eax
call fcn.004a06a0
mov ecx, dword [ebp - 0x2b8]
mov edx, dword [ecx + 0x30]
mov dword [0x57ca98], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4bd000
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x57ca94], eax
movzx eax, byte [0x57c124]
test eax, eax
je 0x4b87f0
mov ecx, dword [ebp - 0x2b8]
mov byte [ecx + 0x961], 0
push 0
push 0
call fcn.004b7d20
push eax
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x30
call fcn.00425100
push 0
push 0x80088
push 0
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x30
call fcn.004a17f0
push 2
push 1
push 0
mov edx, dword [ebp - 0x2b8]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0
push 0xa
push 0x3ef
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x30
call fcn.004a0cc0
mov dword [ebp - 0x2b4], 1
lea ecx, [ebp - 0xc]
call fcn.00425860
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret 4