Function at 0x489480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x7fe3e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1e0
mov eax, dword [esp + 0x1f4]
push ebx
push ebp
push esi
push edi
xor esi, esi
mov edi, ecx
cmp eax, esi
mov dword [esp + 0x14c], edi
mov dword [esp + 0x28], esi
mov ebx, 1
je 0x4894dd
mov dword [edi + 0x88], 0x85afbc
mov dword [edi + 0xb8], vtable.IRefCountable.0
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1f8], esi
mov ecx, edi
call fcn.00487c70
lea ebp, [edi + 0x88]
push esi
mov ecx, ebp
mov dword [esp + 0x1fc], 2
call fcn.004866f0
lea ecx, [edi + 0x9c]
mov byte [esp + 0x1f8], 3
call fcn.006d09a0
lea eax, [esp + 0x27]
lea ecx, [esp + 0x26]
push eax
push ecx
lea ecx, [edi + 0xa0]
mov byte [esp + 0x200], 4
call fcn.0042da70
mov edx, dword [ebp]
mov dword [edi], vtable.DlgBox.0
push esi
mov eax, dword [edx + 4]
mov dword [eax + edi + 0x88], 0x853818
mov ecx, dword [ebp]
mov eax, dword [ecx + 4]
lea edx, [eax - 0x2c]
mov dword [eax + edi + 0x84], edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [edi + 0x94], eax
mov dword [edi + 0x98], esi
mov eax, dword [ebp]
mov dword [edi], vtable.DefaultColorsDlg.0
mov dword [esp + 0x1f8], 5
mov ecx, dword [eax + 4]
mov dword [ecx + edi + 0x88], 0x85af9c
mov edx, dword [ebp]
mov eax, dword [edx + 4]
mov edx, dword [esp + 0x200]
lea ecx, [eax - 0x30]
mov dword [eax + edi + 0x84], ecx
mov al, byte [edi + 8]
test al, al
mov dword [edi + 0x98], edx
je 0x4895b9
mov al, byte [edi + 9]
test al, al
mov eax, 0x90c800c0
jne 0x4895be
mov eax, 0x90c80080
lea ecx, [esp + 0x10]
mov dword [edi + 0xc], eax
mov word [edi + 0x1a], 0xaa
call fcn.004034a0
mov esi, vtable.ucs2string.0
push str.Default_Colors
mov byte [esp + 0x1fc], 6
mov dword [esp + 0x14], esi
call fcn.007ac4d2
add esp, 4
lea ecx, [esp + 0x14]
push eax
push str.Default_Colors
call fcn.00403980
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push 0
lea ecx, [edi + 0x4c]
push eax
mov byte [esp + 0x204], 7
call fcn.00419a20
push ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x1fc], 5
call fcn.00404f20
lea ecx, [esp + 0x10]
push 0x866ab8
push ecx
lea ecx, [esp + 0x1cc]
call fcn.0057deb0
mov ecx, eax
call fcn.0057ded0
mov ecx, eax
call fcn.0057dac0
test al, al
mov eax, str.MS_Shell_Dlg_2
jne 0x48965a
mov eax, 0x8fc24c
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x1b8]
call fcn.00419730
lea edx, [esp + 0x1b0]
mov ecx, edi
push edx
push 8
mov byte [esp + 0x200], 8
call fcn.00434c20
push ebx
lea ecx, [esp + 0x1b8]
mov byte [esp + 0x1fc], 5
call fcn.00404f20
lea ecx, [esp + 0x2c]
call fcn.00487c50
lea ecx, [esp + 0x48]
mov byte [esp + 0x1f8], 9
call fcn.005560e0
lea ecx, [esp + 0x60]
mov byte [esp + 0x1f8], 0xa
call fcn.005560e0
lea ecx, [esp + 0x78]
mov byte [esp + 0x1f8], 0xb
call fcn.004413f0
xor eax, eax
mov dword [esp + 0x2c], vtable.DlgItemTmpl.0
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov word [esp + 0x44], ax
movsx ebp, word [edi + 0x1a]
sub ebp, 7
push 0x11
push ebp
push 7
push 7
lea ecx, [esp + 0x3c]
mov byte [esp + 0x208], 0xc
mov byte [esp + 0x40], al
mov word [esp + 0x6c], 0x82
mov dword [esp + 0x44], 0x50000200
call fcn.0048bb80
lea ecx, [esp + 0x10]
mov word [esp + 0x44], 0x64
call fcn.004034a0
push str.Text_color
mov byte [esp + 0x1fc], 0xd
mov dword [esp + 0x14], esi
call fcn.007ac4d2
add esp, 4
lea ecx, [esp + 0x14]
push eax
push str.Text_color
call fcn.00403980
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
push 0
push ecx
lea ecx, [esp + 0x6c]
mov byte [esp + 0x204], 0xe
mov byte [esp + 0x3d], bl
call fcn.00419a20
push ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x1fc], 0xc
call fcn.00404f20
mov eax, dword [edi + 0x80]
lea esi, [edi + 0x78]
lea edx, [esp + 0x2c]
mov ecx, esi
push edx
push eax
call fcn.00486110
mov ecx, edi
call fcn.00487d20
call fcn.0048a3d0
lea ecx, [esp + 0xec]
call fcn.00487c50
lea ecx, [esp + 0x108]
mov byte [esp + 0x1f8], 0xf
call fcn.005560e0
lea ecx, [esp + 0x120]
mov byte [esp + 0x1f8], 0x10
call fcn.005560e0
lea ecx, [esp + 0x138]
mov byte [esp + 0x1f8], 0x11
call fcn.004413f0
xor eax, eax
mov dword [esp + 0xec], vtable.DlgItemTmpl.0
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], eax
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], eax
mov word [esp + 0x104], ax
lea ecx, [esp + 0x10]
mov byte [esp + 0x1f8], 0x12
call fcn.004034a0
push str.BitviseConsoleColorPicker
mov byte [esp + 0x1fc], 0x13
mov dword [esp + 0x14], vtable.ucs2string.0
call fcn.007ac4d2
add esp, 4
lea ecx, [esp + 0x14]
push eax
push str.BitviseConsoleColorPicker
call fcn.00403980
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
push 0
push ecx
lea ecx, [esp + 0x114]
mov byte [esp + 0x204], 0x14
mov byte [esp + 0xfc], bl
call fcn.00419a20
push ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x1fc], 0x12
call fcn.00404f20
push 0x1e
push ebp
push 0x12
push 7
lea ecx, [esp + 0xfc]
mov dword [esp + 0x104], 0x50810000
call fcn.0048bb80
mov eax, dword [esi + 8]
lea edx, [esp + 0xec]
push edx
push eax
mov ecx, esi
mov word [esp + 0x10c], 0x65
call fcn.00486110
mov ecx, edi
call fcn.00487d20
push 0x2d
push ebp
push 0x23
push 7
lea ecx, [esp + 0x3c]
call fcn.0048bb80
lea ecx, [esp + 0x10]
mov word [esp + 0x44], 0x66
call fcn.004034a0
mov byte [esp + 0x1f8], 0x15
mov dword [esp + 0x10], vtable.ucs2string.0
push str.Background_color
call fcn.007ac4d2
add esp, 4
lea ecx, [esp + 0x14]
push eax
push str.Background_color
call fcn.00403980
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0x204], 0x16
mov byte [esp + 0x3d], bl
call fcn.00419a20
push ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x1fc], 0x12
call fcn.00404f20
mov eax, dword [esi + 8]
lea ecx, [esp + 0x2c]
push ecx
push eax
mov ecx, esi
call fcn.00486110
mov ecx, edi
call fcn.00487d20
push 0x3a
push ebp
push 0x2e
push 7
lea ecx, [esp + 0xfc]
call fcn.0048bb80
mov eax, dword [esi + 8]
lea edx, [esp + 0xec]
push edx
push eax
mov ecx, esi
mov word [esp + 0x10c], 0x67
call fcn.00486110
mov ecx, edi
call fcn.00487d20
push 0x49
push ebp
push 0x3f
push 7
lea ecx, [esp + 0x3c]
call fcn.0048bb80
lea ecx, [esp + 0x10]
mov word [esp + 0x44], 0x68
call fcn.004034a0
push str.Selected_colors
mov byte [esp + 0x1fc], 0x17
mov dword [esp + 0x14], vtable.ucs2string.0
call fcn.007ac4d2
add esp, 4
lea ecx, [esp + 0x14]
push eax
push str.Selected_colors
call fcn.00403980
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0x204], 0x18
mov byte [esp + 0x3d], bl
call fcn.00419a20
push ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x1fc], 0x12
call fcn.00404f20
mov eax, dword [esi + 8]
lea ecx, [esp + 0x2c]
push ecx
push eax
mov ecx, esi
call fcn.00486110
mov ecx, edi
call fcn.00487d20
call fcn.0048ac30
lea ecx, [esp + 0x150]
call fcn.00487c50
lea ecx, [esp + 0x16c]
mov byte [esp + 0x1f8], 0x19
call fcn.005560e0
lea ecx, [esp + 0x184]
mov byte [esp + 0x1f8], 0x1a
call fcn.005560e0
lea ecx, [esp + 0x19c]
mov byte [esp + 0x1f8], 0x1b
call fcn.004413f0
xor edx, edx
mov dword [esp + method.DlgItemTmpl.virtual_0], vtable.DlgItemTmpl.0
mov dword [esp + 0x158], edx
mov dword [esp + 0x15c], edx
mov dword [esp + 0x160], edx
mov dword [esp + 0x164], edx
mov word [esp + 0x168], dx
lea ecx, [esp + 0x10]
mov byte [esp + 0x1f8], 0x1c
call fcn.004034a0
push str.BitviseConsoleColorSample
mov byte [esp + 0x1fc], 0x1d
mov dword [esp + 0x14], vtable.ucs2string.0
call fcn.007ac4d2
add esp, 4
lea ecx, [esp + 0x14]
push eax
push str.BitviseConsoleColorSample
call fcn.00403980
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x178]
mov byte [esp + 0x204], 0x1e
mov byte [esp + 0x160], bl
call fcn.00419a20
push ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x1fc], 0x1c
call fcn.00404f20
push 0x72
push ebp
push 0x4a
push 7
lea ecx, [esp + 0x160]
mov dword [esp + 0x168], 0x50800000
call fcn.0048bb80
mov eax, dword [esi + 8]
lea ecx, [esp + 0x150]
push ecx
push eax
mov ecx, esi
mov word [esp + 0x170], 0x69
call fcn.00486110
mov ecx, edi
call fcn.00487d20
lea ecx, [esp + 0x8c]
call fcn.00487c50
lea ecx, [esp + 0xa8]
mov byte [esp + 0x1f8], 0x1f
call fcn.005560e0
lea ecx, [esp + 0xc0]
mov byte [esp + 0x1f8], 0x20
call fcn.005560e0
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1f8], 0x21
call fcn.004413f0
mov dword [esp + 0x8c], vtable.DlgItemTmpl.0
xor edx, edx
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], edx
mov dword [esp + 0x9c], edx
mov dword [esp + 0xa0], edx
mov word [esp + 0xa4], dx
movsx eax, word [edi + 0x1a]
sub eax, 0x70
push 0x8a
lea ecx, [esp + 0x90]
mov byte [esp + 0x1fc], 0x22
lea ebp, [eax + 0x32]
mov byte [esp + 0x94], dl
push ebp
push 0x7c
push eax
mov word [esp + 0xcc], 0x80
mov dword [esp + 0xa4], 0x50010f01
call fcn.0048bb80
lea ecx, [esp + 0x10]
mov word [esp + 0xa4], bx
call fcn.004034a0
push 0x904b24
mov byte [esp + 0x1fc], 0x23
mov dword [esp + 0x14], vtable.ucs2string.0
call fcn.007ac4d2
add esp, 4
lea ecx, [esp + 0x14]
push eax
push 0x904b24
call fcn.00403980
push 0xffffffffffffffff
lea eax, [esp + 0x18]
push 0
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0x204], 0x24
mov byte [esp + 0x9d], bl
call fcn.00403760
push ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x1fc], 0x22
call fcn.00404f20
mov eax, dword [esi + 8]
lea ecx, [esp + 0x8c]
push ecx
push eax
mov ecx, esi
call fcn.00486110
mov ecx, esi
call fcn.004860e0
cmp eax, 0xffff
jae 0x489cc5
mov ecx, esi
call fcn.004860e0
jmp 0x489cca
mov eax, 0xffff
add ebp, 5
mov word [edi + 0x14], ax
push 0x8a
lea ecx, [esp + 0x90]
lea eax, [ebp + 0x32]
mov dword [esp + 0x98], 0x50010f00
push eax
push 0x7c
push ebp
call fcn.0048bb80
lea ecx, [esp + 0x10]
mov word [esp + 0xa4], 2
call fcn.004034a0
push 0x904b14
mov byte [esp + 0x1fc], 0x25
mov dword [esp + 0x14], vtable.ucs2string.0
call fcn.007ac4d2
add esp, 4
lea ecx, [esp + 0x14]
push eax
push 0x904b14
call fcn.00403980
push 0xffffffffffffffff
lea edx, [esp + 0x18]
push 0
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0x204], 0x26
mov byte [esp + 0x9d], bl
call fcn.00403760
push ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x1fc], 0x22
call fcn.00404f20
mov eax, dword [esi + 8]
lea ecx, [esp + 0x8c]
push ecx
push eax
mov ecx, esi
call fcn.00486110
mov ecx, esi
call fcn.004860e0
cmp eax, 0xffff
jae 0x489d93
mov ecx, esi
call fcn.004860e0
jmp 0x489d98
mov eax, 0xffff
mov ebp, vtable.DlgItemTmpl.0
mov word [edi + 0x14], ax
mov word [edi + 0x1c], 0x91
mov dword [esp + 0x8c], ebp
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1f8], 0x29
call fcn.0040e080
push ebx
lea ecx, [esp + 0xc8]
mov byte [esp + 0x1fc], 0x28
call fcn.00404f20
push ebx
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1fc], 0x27
call fcn.00404f20
mov esi, vtable.DlgItemTmplBase.0
mov dword [esp + 0x150], ebp
mov dword [esp + 0x8c], esi
lea ecx, [esp + 0x19c]
mov byte [esp + 0x1f8], 0x2c
call fcn.0040e080
push ebx
lea ecx, [esp + 0x18c]
mov byte [esp + 0x1fc], 0x2b
call fcn.00404f20
push ebx
lea ecx, [esp + 0x174]
mov byte [esp + 0x1fc], 0x2a
call fcn.00404f20
mov dword [esp + 0x150], esi
mov dword [esp + 0xec], ebp
lea ecx, [esp + 0x138]
mov byte [esp + 0x1f8], 0x2f
call fcn.0040e080
push ebx
lea ecx, [esp + 0x128]
mov byte [esp + 0x1fc], 0x2e
call fcn.00404f20
push ebx
lea ecx, [esp + 0x110]
mov byte [esp + 0x1fc], 0x2d
call fcn.00404f20
mov dword [esp + 0xec], esi
mov dword [esp + 0x2c], ebp
lea ecx, [esp + 0x78]
mov byte [esp + 0x1f8], 0x32
call fcn.0040e080
push ebx
lea ecx, [esp + 0x68]
mov byte [esp + 0x1fc], 0x31
call fcn.00404f20
push ebx
lea ecx, [esp + 0x50]
mov byte [esp + 0x1fc], 0x30
call fcn.00404f20
mov ecx, dword [esp + 0x1f0]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1ec
ret 8