Function at 0x4b49bc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x82
push 0
push 0
dec ecx
jne 0x4b49c4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x27c]
mov edx, dword [0x407a24]
call fcn.00404e40
xor eax, eax
push ebp
push 0x4b5454
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov edx, dword [eax]
call dword [edx + 0xd8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x678]
call fcn.004691d0
mov eax, 0x4c713c
call fcn.0040414c
mov byte [0x4c70e0], 1
lea eax, [ebp - 8]
push eax
mov ecx, 0x4b546c
mov edx, 0x4b547c
mov eax, 0x80000001
call fcn.0049b1d8
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4b546c
mov edx, 0x4b547c
mov eax, 0x80000002
call fcn.0049b1d8
mov dl, 1
mov eax, dword [0x41802c]
call fcn.004032cc
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, 0x4b54c8
mov eax, 0x80000001
call fcn.0049b138
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4b4bab
inc eax
mov dword [ebp - 0x20], eax
xor esi, esi
mov eax, dword [0x4c56d8]
mov eax, dword [eax]
call fcn.0047b658
lea ecx, [ebp - 0x10]
mov edx, esi
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0040441c
test eax, eax
jle 0x4b4ba1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x3c0]
mov edx, esi
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x3c0]
mov edx, 0x4b54c8
mov eax, 0x80000001
call fcn.0049b1d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
call fcn.00442abc
call fcn.00442990
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
mov edx, dword [0x4c57bc]
mov edx, dword [edx]
call fcn.0044255c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x14]
call fcn.004b48c0
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x678]
call fcn.00468eac
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
xor edx, edx
pop ecx
call fcn.00442714
mov eax, 0x4c713c
mov edx, 0x4b5500
call fcn.00404424
inc esi
dec dword [ebp - 0x20]
jne 0x4b4a89
mov edx, 0x4b54c8
mov ecx, dword [ebp - 0x1c]
mov eax, 0x80000002
call fcn.0049b138
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4b4d17
inc eax
mov dword [ebp - 0x20], eax
xor esi, esi
mov eax, dword [0x4c56d8]
mov eax, dword [eax]
call fcn.0047b658
lea ecx, [ebp - 0x10]
mov edx, esi
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0040441c
test eax, eax
jle 0x4b4d0d
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x3c4]
mov edx, esi
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x3c4]
mov edx, 0x4b54c8
mov eax, 0x80000002
call fcn.0049b1d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
call fcn.00442abc
call fcn.00442990
mov ebx, eax
push 0x4b550c
lea eax, [ebp - 0x3c8]
push eax
mov eax, dword [0x4c5840]
mov eax, dword [eax]
mov ecx, 0x4b5520
mov edx, 0x4b5534
mov edi, dword [eax]
call dword [edi]
mov eax, dword [ebp - 0x3c8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
pop edx
call fcn.0044255c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x14]
call fcn.004b48c0
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x678]
call fcn.00468eac
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
xor edx, edx
pop ecx
call fcn.00442714
mov eax, 0x4c713c
mov edx, 0x4b5544
call fcn.00404424
inc esi
dec dword [ebp - 0x20]
jne 0x4b4bd4
mov eax, dword [0x4c5788]
cmp dword [eax], 5
jle 0x4b4f58
mov ecx, dword [ebp - 0x1c]
mov edx, 0x4b5550
mov eax, 0x80000002
call fcn.0049b098
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4b4f58
inc eax
mov dword [ebp - 0x20], eax
xor esi, esi
mov eax, dword [0x4c56d8]
mov eax, dword [eax]
call fcn.0047b658
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x3d0]
mov edx, esi
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x3d0]
lea eax, [ebp - 0x3cc]
mov edx, 0x4b558c
call fcn.00404468
mov edx, dword [ebp - 0x3cc]
mov ecx, 0x4b55cc
mov eax, 0x80000002
call fcn.0049b1d8
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x3d8]
mov edx, esi
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x3d8]
lea eax, [ebp - 0x3d4]
mov edx, 0x4b558c
call fcn.00404468
mov edx, dword [ebp - 0x3d4]
mov ecx, 0x4b55dc
mov eax, 0x80000002
call fcn.0049b1d8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x3e0]
mov edx, esi
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x3e0]
lea eax, [ebp - 0x3dc]
mov edx, 0x4b558c
call fcn.00404468
mov edx, dword [ebp - 0x3dc]
mov ecx, 0x4b55ec
mov eax, 0x80000002
call fcn.0049b1d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
call fcn.00442abc
call fcn.00442990
mov ebx, eax
mov eax, dword [ebp - 0x18]
mov edx, 0x4b55fc
call fcn.00404568
jne 0x4b4e87
push 0x4b550c
lea eax, [ebp - 0x3e4]
push eax
mov eax, dword [0x4c5840]
mov eax, dword [eax]
mov ecx, 0x4b5520
mov edx, 0x4b5534
mov edi, dword [eax]
call dword [edi]
mov eax, dword [ebp - 0x3e4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
pop edx
call fcn.0044255c
jmp 0x4b4eaa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
mov edx, dword [0x4c57bc]
mov edx, dword [edx]
call fcn.0044255c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x3e8]
mov eax, dword [ebp - 0x14]
call fcn.0049d204
mov edx, dword [ebp - 0x3e8]
lea eax, [ebp - 0x14]
call fcn.004041e4
mov eax, dword [ebp - 0x14]
call fcn.004b48c0
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x678]
call fcn.00468eac
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
xor edx, edx
pop ecx
call fcn.00442714
mov eax, 0x4c713c
mov edx, 0x4b560c
call fcn.00404424
inc esi
dec dword [ebp - 0x20]
jne 0x4b4d4e
mov eax, dword [ebp - 0x1c]
call fcn.004032fc
mov eax, dword [ebp - 8]
call fcn.0040441c
test eax, eax
je 0x4b518d
mov eax, dword [ebp - 8]
call fcn.004094ec
test al, al
je 0x4b518d
lea eax, [ebp - 0x3ec]
mov ecx, 0x4b5618
mov edx, dword [ebp - 8]
call fcn.00404468
mov eax, dword [ebp - 0x3ec]
lea ecx, [ebp - 0x27c]
mov edx, 0x3f
call fcn.00409684
test eax, eax
jne 0x4b518d
push 0
call sub.ole32.dll_CoInitialize
mov eax, dword [0x4c56d8]
mov eax, dword [eax]
call fcn.0047b658
mov eax, dword [ebp - 0x274]
and eax, 0x10
cmp eax, 0x10
je 0x4b516f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
call fcn.00442abc
call fcn.00442990
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
mov edx, dword [0x4c57bc]
mov edx, dword [edx]
call fcn.0044255c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
push ebp
push 0x4b5168
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push dword [ebp - 8]
push 0x4b5628
push dword [ebp - 0x270]
lea eax, [ebp - 0x3f4]
mov edx, 3
call fcn.004044dc
mov edx, dword [ebp - 0x3f4]
lea eax, [ebp - 0x3f0]
call fcn.004049ec
mov eax, dword [ebp - 0x3f0]
call fcn.00404a68
push eax
mov eax, dword [0x4c5728]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
test eax, eax
jne 0x4b5155
push 4
lea eax, [ebp - 0x3bc]
push eax
push 0x104
lea eax, [ebp - 0x124]
push eax
mov eax, dword [0x4c5648]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
mov eax, dword [eax + 8]
push eax
lea eax, [ebp - 0x3f8]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.004043cc
mov edx, dword [ebp - 0x3f8]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x3fc]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.004043cc
mov eax, dword [ebp - 0x3fc]
call fcn.004b48c0
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x678]
call fcn.00468eac
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
xor edx, edx
pop ecx
call fcn.00442714
mov eax, 0x4c713c
mov edx, 0x4b5634
call fcn.00404424
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b516f
call sub.ole32.dll_CoUninitialize
ret
lea eax, [ebp - 0x27c]
call fcn.004096d4
test eax, eax
je 0x4b4fb8
lea eax, [ebp - 0x27c]
call fcn.004096f8
mov eax, dword [ebp - 0xc]
call fcn.0040441c
test eax, eax
je 0x4b53db
mov eax, dword [ebp - 0xc]
call fcn.004094ec
test al, al
je 0x4b53db
lea eax, [ebp - 0x400]
mov ecx, 0x4b5618
mov edx, dword [ebp - 0xc]
call fcn.00404468
mov eax, dword [ebp - 0x400]
lea ecx, [ebp - 0x27c]
mov edx, 0x3f
call fcn.00409684
test eax, eax
jne 0x4b53db
push 0
call sub.ole32.dll_CoInitialize
mov eax, dword [0x4c56d8]
mov eax, dword [eax]
call fcn.0047b658
mov eax, dword [ebp - 0x274]
and eax, 0x10
cmp eax, 0x10
je 0x4b53bd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
call fcn.00442abc
call fcn.00442990
mov ebx, eax
push 0x4b550c
lea eax, [ebp - 0x404]
push eax
mov eax, dword [0x4c5840]
mov eax, dword [eax]
mov ecx, 0x4b5520
mov edx, 0x4b5534
mov esi, dword [eax]
call dword [esi]
mov eax, dword [ebp - 0x404]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
pop edx
call fcn.0044255c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
push ebp
push 0x4b53b6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push dword [ebp - 0xc]
push 0x4b5628
push dword [ebp - 0x270]
lea eax, [ebp - 0x40c]
mov edx, 3
call fcn.004044dc
mov edx, dword [ebp - 0x40c]
lea eax, [ebp - 0x408]
call fcn.004049ec
mov eax, dword [ebp - 0x408]
call fcn.00404a68
push eax
mov eax, dword [0x4c5728]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
test eax, eax
jne 0x4b53a3
push 4
lea eax, [ebp - 0x3bc]
push eax
push 0x104
lea eax, [ebp - 0x124]
push eax
mov eax, dword [0x4c5648]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
mov eax, dword [eax + 8]
push eax
lea eax, [ebp - 0x410]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.004043cc
mov edx, dword [ebp - 0x410]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x414]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.004043cc
mov eax, dword [ebp - 0x414]
call fcn.004b48c0
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x678]
call fcn.00468eac
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.00442b48
xor edx, edx
pop ecx
call fcn.00442714
mov eax, 0x4c713c
mov edx, 0x4b5640
call fcn.00404424
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b53bd
call sub.ole32.dll_CoUninitialize
ret
lea eax, [ebp - 0x27c]
call fcn.004096d4
test eax, eax
je 0x4b51e5
lea eax, [ebp - 0x27c]
call fcn.004096f8
mov byte [0x4c70e0], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b545b
lea eax, [ebp - 0x414]
mov edx, 3
call fcn.00404170
lea eax, [ebp - 0x408]
call fcn.0040483c
lea eax, [ebp - 0x404]
mov edx, 5
call fcn.00404170
lea eax, [ebp - 0x3f0]
call fcn.0040483c
lea eax, [ebp - 0x3ec]
mov edx, 0xc
call fcn.00404170
lea eax, [ebp - 0x27c]
mov edx, dword [0x407a24]
call fcn.00404f10
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404170
ret