Function at 0x4826b0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x6bb4
call fcn.0049c760
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
mov edi, str.Q_Dir___Document
mov eax, edi
test eax, eax
jne 0x4826d5
xor eax, eax
jmp 0x4826d8
push edi
call esi
push edi
push eax
mov ecx, 0x4c7a80
call fcn.004039ec
mov edi, 0x4b2a2c
mov eax, edi
test eax, eax
je 0x4826f2
push edi
call esi
push edi
push eax
mov ecx, 0x4c7a7c
call fcn.004039ec
mov eax, dword [0x4b0550]
and byte [ebp - 0xf], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0x13], 0x2d
mov byte [ebp - 0x12], 0x44
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0x10], 0x72
call fcn.00403adc
mov eax, dword [0x4b0550]
and byte [ebp - 0x13], 0
and byte [ebp - 0x11], 0
and byte [ebp - 0x10], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
mov byte [ebp - 0x18], 0x31
mov byte [ebp - 0x17], 0x31
mov byte [ebp - 0x16], 0x2e
mov byte [ebp - 0x15], 0x34
mov byte [ebp - 0x14], 0x38
mov byte [ebp - 0x12], 0x30
call fcn.00403adc
lea eax, [ebp - 8]
mov ecx, 0x4c668c
push eax
call fcn.00403a8c
lea eax, [ebp - 8]
mov ecx, 0x4c6684
push eax
call fcn.00403a8c
lea eax, [ebp - 8]
mov ecx, 0x4c67d8
push eax
call fcn.00403a8c
lea eax, [ebp - 0xc]
mov edi, 0x4c67d0
push eax
mov ecx, edi
call fcn.00403a8c
push edi
mov ecx, 0x4c67cc
call fcn.00403a8c
mov ebx, dword [ebp + 8]
push ebx
call esi
cmp eax, 5
mov edi, 0x4c7a70
jle 0x4827e6
push ebx
call esi
cmp eax, 0x209
jge 0x4827e6
test ebx, ebx
jne 0x4827c9
xor eax, eax
jmp 0x4827cc
push ebx
call esi
push ebx
push eax
mov ecx, edi
call fcn.004039ec
call fcn.0042c1f6
test eax, eax
je 0x4827e6
push 1
pop esi
jmp 0x482e1f
test ebx, ebx
je 0x4829e7
push ebx
call esi
push str.AutoStart2017_IZASSHJ
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], eax
call fcn.0040a4e8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax - 8]
jne 0x482828
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x482828
push 1
call fcn.00438034
pop ecx
lea ecx, [ebp - 4]
jmp 0x482cf5
lea ecx, [ebp - 4]
call fcn.004038fb
push ebx
call esi
cmp eax, 0xa
mov dword [ebp - 0x10], eax
jle 0x482981
push ebx
call fcn.00484866
test eax, eax
pop ecx
je 0x482851
xor esi, esi
jmp 0x482e1f
push str.FolderToFolder
lea ecx, [ebp - 4]
call fcn.0040a4e8
cmp word [ebx], 0x46
jne 0x482885
push 0
mov ecx, edi
push dword [ebp - 4]
call fcn.00403d34
test eax, eax
jne 0x482885
push 0xa
push eax
call fcn.00481ce3
pop ecx
mov esi, eax
pop ecx
jmp 0x48291a
mov ecx, str.RunMSExplore
mov eax, ecx
test eax, eax
je 0x482898
push ecx
call esi
mov ecx, str.RunMSExplore
push ecx
push eax
lea ecx, [ebp - 4]
call fcn.004039ec
push 0
lea ecx, [ebp - 4]
push dword [ebp - 4]
call fcn.00403d34
test eax, eax
jne 0x4828cb
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4828cb
push 0xa
push ebx
call fcn.004824f2
jmp 0x48287c
mov ebx, str.MEDIA2017_IZASSHJ
mov eax, ebx
test eax, eax
je 0x4828d9
push ebx
call esi
push ebx
push eax
lea ecx, [ebp - 4]
call fcn.004039ec
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax - 8]
jl 0x482922
push dword [ebp + 8]
push dword [ebp + 8]
call esi
push eax
mov ecx, edi
call fcn.004039ec
push 0
push ebx
mov ecx, edi
call fcn.00403d34
test eax, eax
jl 0x482922
push 0xa
push 0
call fcn.004825b8
pop ecx
pop ecx
push 1
pop esi
lea ecx, [ebp - 4]
jmp 0x482e1a
mov ebx, str.ThePloder2018
mov eax, ebx
test eax, eax
je 0x482930
push ebx
call esi
push ebx
push eax
lea ecx, [ebp - 4]
call fcn.004039ec
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax - 8]
jl 0x482976
push dword [ebp + 8]
push dword [ebp + 8]
call esi
push eax
mov ecx, edi
call fcn.004039ec
push 0
push ebx
mov ecx, edi
call fcn.00403d34
test eax, eax
jl 0x482976
push 0xa
push 0
call fcn.0048254a
pop ecx
pop ecx
lea ecx, [ebp - 4]
jmp 0x482cf5
lea ecx, [ebp - 4]
call fcn.004038fb
mov ebx, dword [ebp + 8]
push ebx
call esi
push ebx
push eax
mov ecx, edi
call fcn.004039ec
push str.RegisterAdminKey4_EEETWETRFSD
lea ecx, [ebp - 0x1c]
call fcn.0040a4e8
xor esi, esi
mov ecx, edi
push esi
push dword [ebp - 0x1c]
call fcn.00403d34
test eax, eax
jl 0x4829eb
mov eax, dword [ebp - 0x1c]
push esi
mov ecx, edi
mov ebx, dword [eax - 8]
call fcn.00403c58
lea eax, [eax + ebx*2]
lea ecx, [ebp + 8]
push eax
call fcn.0040a4e8
push 1
push dword [ebp + 8]
call fcn.0049c828
pop ecx
push eax
call fcn.0040b810
pop ecx
mov esi, eax
pop ecx
lea ecx, [ebp + 8]
call fcn.004038fb
jmp 0x482e17
xor eax, eax
jmp 0x482984
lea ecx, [ebp - 0x58]
call fcn.00483505
lea ecx, [ebp - 0x4c]
call fcn.00483505
lea eax, [ebp - 0x5c]
mov ecx, 0x4c7a88
push eax
mov dword [ebp - 0x5c], 0x4abeb4
call fcn.00481dfb
mov eax, dword [0x4c7a70]
push ecx
mov ecx, esp
cmp dword [eax - 0xc], esi
jl 0x482a2b
mov dword [ecx], eax
sub eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x482a3d
mov eax, dword [0x4b0550]
mov dword [ecx], eax
push dword [0x4c7a70]
call fcn.0040a70f
call fcn.004082ec
cmp eax, esi
pop ecx
je 0x482a66
push 1
pop esi
push esi
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [ebp - 0x4c]
call fcn.0048382a
lea ecx, [ebp - 0x58]
call fcn.0048382a
jmp 0x482e17
mov ecx, 0x4c7cec
call fcn.0044b485
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [0x4c3fb8]
push 0x4c3fc0
push dword [0x4c668c]
call fcn.0044ad72
add esp, 0x14
cmp eax, esi
mov dword [0x4c3fb8], eax
je 0x482ad0
call fcn.0048267e
test eax, eax
je 0x482ad0
push dword [0x4b39c0]
push str.disable_dark_theme
call fcn.0048f43d
pop ecx
mov dword [0x4b39c0], eax
pop ecx
mov ebx, eax
call fcn.0042d942
cmp ebx, esi
jne 0x482ad0
push 1
push dword [0x4c7b64]
call fcn.0042e036
pop ecx
pop ecx
push esi
push 0x4b9120
mov ecx, edi
call fcn.00403d34
test eax, eax
jne 0x482b4e
mov eax, dword [0x4b0550]
push 0x23
push 1
mov dword [ebp + 8], eax
push dword [0x4c7a70]
lea eax, [ebp + 8]
push eax
call fcn.0048eeb4
add esp, 0x10
test eax, eax
je 0x482b3c
push 0x4b911c
lea ecx, [ebp - 0x10]
call fcn.00403927
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00403b20
push eax
mov ecx, 0x4c7b88
call fcn.00403a8c
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 0x10]
call fcn.004038fb
call fcn.00440bf0
lea ecx, [ebp + 8]
call fcn.004038fb
jmp 0x482cea
lea ecx, [ebp - 0x6bb4]
call fcn.004332b0
push str.Q_DIR_GUID
lea ecx, [ebp + 8]
call fcn.00403927
push dword [eax]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea ecx, [ebp + 8]
mov dword [0x4c7b58], eax
call fcn.004038fb
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x482b99
call ebx
cmp eax, 5
je 0x482b99
and byte [ebp + 0xb], 0
jmp 0x482b9d
mov byte [ebp + 0xb], 1
push str.QDir_Id
lea ecx, [ebp - 0x20]
call fcn.00403927
mov ebx, 0x4b0ae4
lea ecx, [ebp - 0x24]
push ebx
call fcn.0040a4e8
push esi
push 0x4b4fe0
mov ecx, edi
call fcn.00403d34
test eax, eax
jne 0x482c2f
push edi
lea ecx, [ebp - 4]
call fcn.004038b5
lea eax, [ebp - 4]
push eax
call fcn.00436453
pop ecx
test eax, eax
lea ecx, [ebp - 4]
je 0x482c2a
call fcn.004038fb
lea ecx, [ebp - 0x24]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
lea ecx, [ebp - 0x6bb4]
call fcn.00433e0f
lea ecx, [ebp - 0x5c]
call fcn.00482e36
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
xor eax, eax
jmp 0x482e31
call fcn.004038fb
cmp byte [ebp + 0xb], 0
je 0x482d53
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [0x4c426c]
push str.default_new_tab
push ebx
call fcn.0044ad72
add esp, 0x14
cmp eax, esi
mov dword [0x4c426c], eax
je 0x482d12
push esi
push 0x4b4fe0
mov ecx, edi
call fcn.00403d34
test eax, eax
jne 0x482d12
lea eax, [ebp + 8]
mov dword [ebp + 8], esi
push eax
push 0x481ca0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp + 8], esi
je 0x482d12
mov eax, dword [0x4c7a70]
mov ebx, 0x2774
mov ecx, edi
mov eax, dword [eax - 8]
mov dword [ebp - 0x18], ebx
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 0x14], eax
call fcn.00403c58
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push esi
push 0x4a
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
jne 0x482d12
push 0xaffe
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [ebp - 0x24]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
lea ecx, [ebp - 0x6bb4]
call fcn.00433e0f
lea ecx, [ebp - 0x5c]
call fcn.00482e36
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
push 1
pop eax
jmp 0x482e31
cmp dword [0x4c6690], esi
je 0x482d34
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [0x4c7b5c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.0044ad72
add esp, 0x14
jmp 0x482d4b
push esi
push ecx
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, 0x4c7cec
call fcn.0044b062
inc eax
mov dword [0x4c7b5c], eax
jmp 0x482d58
mov eax, dword [0x4c7b5c]
cmp dword [0x4c6690], esi
je 0x482d72
push esi
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.0044ad31
add esp, 0x10
jmp 0x482d89
push eax
push ecx
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, 0x4c7cec
call fcn.0044b0d5
call fcn.00408b12
test eax, eax
jne 0x482d9f
push 0xaffe
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x482df4
push esi
push 1
push 0x4b12e0
push dword [0x4c67d8]
call fcn.0044ad31
add esp, 0x10
lea ecx, [ebp - 0x6bb4]
call fcn.00443e49
test eax, eax
jne 0x482dd4
push esi
push esi
push str.Main_window_creation_failed__n
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x482df4
lea ecx, [ebp - 0x5c]
call fcn.00481d60
mov ecx, 0x4c7a88
mov esi, eax
call fcn.00481e3a
push dword [0x4c7b58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x24]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
lea ecx, [ebp - 0x6bb4]
call fcn.00433e0f
lea ecx, [ebp - 0x5c]
call fcn.00482e36
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret