Function at 0x40e750
Capabilities:
Check os version
Parse pe header
Query or enumerate registry value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ef8ad
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x535a40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
push 1
mov dword [0x539fa4], edi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [0x539fdc]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x40e7a9
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
mov esi, dword [ebp + 8]
test esi, 0x100
je 0x40e893
mov dword [0x539f4c], 0x100
cmp edi, 2
je 0x40e7d0
cmp edi, 1
jne 0x40e856
push str.BootExecute
push str.SystemCurrentControlSetControlSession_Manager
push dword [0x52ea0c]
push 0
call fcn.00413eb0
add esp, 0x10
cmp edi, 2
je 0x40e7f4
cmp edi, 1
jne 0x40e856
push str.SetupExecute
push str.SystemCurrentControlSetControlSession_Manager
push dword [0x52ea0c]
push 0
call fcn.00413eb0
add esp, 0x10
cmp edi, 2
je 0x40e818
cmp edi, 1
jne 0x40e856
push str.Execute
push str.SystemCurrentControlSetControlSession_Manager
push dword [0x52ea0c]
push 0
call fcn.00413eb0
add esp, 0x10
cmp edi, 2
je 0x40e83c
cmp edi, 1
jne 0x40e856
push str.S0InitialCommand
push str.SystemCurrentControlSetControlSession_Manager
push dword [0x52ea0c]
push 0
call fcn.00413eb0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov cx, ax
shr cx, 8
cmp al, 6
jne 0x40e893
cmp cx, 1
jb 0x40e893
cmp edi, 2
je 0x40e877
cmp edi, 1
jne 0x40e893
push 0x20
push str.ServiceControlManagerExtension
push str.SystemCurrentControlSetControl
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
test esi, 0x40000
je 0x40e8af
push 0
mov dword [0x539f4c], 0x40000
call fcn.004245c0
add esp, 4
test esi, 0x80000
je 0x40f2ae
mov dword [0x539f4c], 0x80000
cmp edi, 2
je 0x40e8cf
cmp edi, 1
jne 0x40e919
push str.SoftwareMicrosoftOfficeOutlookAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0
push eax
push dword [0x52ea0c]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40e91d
test edi, edi
jne 0x40e962
push str.SoftwareMicrosoftOfficeOutlookAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 1
push eax
push dword [0x52ea10]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x40e97c
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40e986
cmp edi, 1
jne 0x40e9d0
push str.SoftwareWow6432NodeMicrosoftOfficeOutlookAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 2
push eax
push dword [0x52ea0c]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40e9d4
test edi, edi
jne 0x40ea19
push str.SoftwareWow6432NodeMicrosoftOfficeOutlookAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 3
push eax
push dword [0x52ea10]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x40ea33
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40ea3d
cmp edi, 1
jne 0x40ea87
push str.SoftwareMicrosoftOfficeExcelAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 4
push eax
push dword [0x52ea0c]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40ea8b
test edi, edi
jne 0x40ead0
push str.SoftwareMicrosoftOfficeExcelAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 5
push eax
push dword [0x52ea10]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x40eaea
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40eaf4
cmp edi, 1
jne 0x40eb3e
push str.SoftwareWow6432NodeMicrosoftOfficeExcelAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 6
push eax
push dword [0x52ea0c]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40eb42
test edi, edi
jne 0x40eb87
push str.SoftwareWow6432NodeMicrosoftOfficeExcelAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 7
push eax
push dword [0x52ea10]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x40eba1
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40ebab
cmp edi, 1
jne 0x40ebf5
push str.SoftwareMicrosoftOfficePowerPointAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 8
push eax
push dword [0x52ea0c]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40ebf9
test edi, edi
jne 0x40ec3e
push str.SoftwareMicrosoftOfficePowerPointAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 9
push eax
push dword [0x52ea10]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x40ec58
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40ec62
cmp edi, 1
jne 0x40ecac
push str.SoftwareWow6432NodeMicrosoftOfficePowerPointAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0xa
push eax
push dword [0x52ea0c]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40ecb0
test edi, edi
jne 0x40ecf5
push str.SoftwareWow6432NodeMicrosoftOfficePowerPointAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0xb
push eax
push dword [0x52ea10]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x40ed0f
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40ed19
cmp edi, 1
jne 0x40ed63
push str.SoftwareMicrosoftOfficeWordAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0xc
push eax
push dword [0x52ea0c]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40ed67
test edi, edi
jne 0x40edac
push str.SoftwareMicrosoftOfficeWordAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0xd
push eax
push dword [0x52ea10]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x40edc6
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40edd0
cmp edi, 1
jne 0x40ee1a
push str.SoftwareWow6432NodeMicrosoftOfficeWordAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0xe
push eax
push dword [0x52ea0c]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40ee1e
test edi, edi
jne 0x40ee63
push str.SoftwareWow6432NodeMicrosoftOfficeWordAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0xf
push eax
push dword [0x52ea10]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x40ee7d
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40ee87
cmp edi, 1
jne 0x40eed1
push str.SoftwareMicrosoftOfficeAccessAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x10
push eax
push dword [0x52ea0c]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40eed5
test edi, edi
jne 0x40ef1a
push str.SoftwareMicrosoftOfficeAccessAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x11
push eax
push dword [0x52ea10]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x40ef34
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40ef3e
cmp edi, 1
jne 0x40ef88
push str.SoftwareWow6432NodeMicrosoftOfficeAccessAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x12
push eax
push dword [0x52ea0c]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40ef8c
test edi, edi
jne 0x40efd1
push str.SoftwareWow6432NodeMicrosoftOfficeAccessAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x13
push eax
push dword [0x52ea10]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x40efeb
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40eff5
cmp edi, 1
jne 0x40f03f
push str.SoftwareMicrosoftOfficeOnenoteAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x14
push eax
push dword [0x52ea0c]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40f043
test edi, edi
jne 0x40f088
push str.SoftwareMicrosoftOfficeOnenoteAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x15
push eax
push dword [0x52ea10]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x40f0a2
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40f0ac
cmp edi, 1
jne 0x40f0f6
push str.SoftwareWow6432NodeMicrosoftOfficeOnenoteAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x16
push eax
push dword [0x52ea0c]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40f0fa
test edi, edi
jne 0x40f13f
push str.SoftwareWow6432NodeMicrosoftOfficeOnenoteAddins
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x17
push eax
push dword [0x52ea10]
push 0
call fcn.0041d620
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x40f159
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40f163
cmp edi, 1
jne 0x40f1a6
push str.SOFTWAREMicrosoftOffice_testSpecialPerf
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 0xc], esi
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x18
push eax
push dword [0x52ea0c]
push 0
call fcn.0040b8a0
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40f1aa
test edi, edi
jne 0x40f1e8
push str.SOFTWAREMicrosoftOffice_testSpecialPerf
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 0xc], esi
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x19
push eax
push dword [0x52ea10]
push 0
call fcn.0040b8a0
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x40f202
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40f20c
cmp edi, 1
jne 0x40f24f
push str.SOFTWAREMicrosoftOffice_testSpecialPerf
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 0xc], esi
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x1a
push eax
push dword [0x52ea0c]
push 0
call fcn.0040b8a0
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40f253
test edi, edi
jne 0x40f291
push str.SOFTWAREMicrosoftOffice_testSpecialPerf
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 0xc], esi
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x1b
push eax
push dword [0x52ea10]
push 0
call fcn.0040b8a0
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x40f2ab
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
mov esi, dword [ebp + 8]
test esi, 0x200
je 0x40f57a
mov dword [0x539f4c], 0x200
cmp edi, 2
je 0x40f2ce
cmp edi, 1
jne 0x40f2e5
push 1
push str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
push dword [0x52ea0c]
push 0
call fcn.00419700
add esp, 0x10
mov eax, dword [0x539fdc]
test eax, eax
je 0x40f2ff
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40f309
cmp edi, 1
jne 0x40f320
push 1
push str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
push dword [0x52ea0c]
push 0
call fcn.00419700
add esp, 0x10
mov eax, dword [0x539fdc]
test eax, eax
je 0x40f33a
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40f344
cmp edi, 1
jne 0x40f360
push 0x2c
push str.Autorun
push str.SoftwareMicrosoftCommand_Processor
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
mov eax, dword [0x539fdc]
test eax, eax
je 0x40f37a
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40f384
cmp edi, 1
jne 0x40f3a0
push 0x2c
push str.Autorun
push str.SoftwareWow6432NodeMicrosoftCommand_Processor
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
mov eax, dword [0x539fdc]
test eax, eax
je 0x40f3ba
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x40f3c3
test edi, edi
jne 0x40f42b
push 0x2c
push str.Autorun
push str.SoftwareMicrosoftCommand_Processor
push dword [0x52ea10]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40f3e8
test edi, edi
jne 0x40f42b
push str.SOFTWAREClassesExefileShellOpenCommand
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 0xc], esi
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x1c
push eax
push dword [0x52ea10]
push 0
call fcn.0040b8a0
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40f430
cmp edi, 1
jne 0x40f492
push str.SOFTWAREClassesExefileShellOpenCommand
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 0xc], esi
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x1d
push eax
push dword [0x52ea0c]
push 0
call fcn.0040b8a0
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40f478
cmp edi, 1
jne 0x40f492
push str.SoftwareClasses.exe
push dword [0x52ea0c]
push 0
call fcn.0041aae0
add esp, 0xc
cmp edi, 2
je 0x40f496
test edi, edi
jne 0x40f4b0
push str.SoftwareClasses.exe
push dword [0x52ea10]
push 0
call fcn.0041aae0
add esp, 0xc
cmp edi, 2
je 0x40f4b5
cmp edi, 1
jne 0x40f4cf
push str.SoftwareClasses.cmd
push dword [0x52ea0c]
push 0
call fcn.0041aae0
add esp, 0xc
cmp edi, 2
je 0x40f4d3
test edi, edi
jne 0x40f534
push str.SoftwareClasses.cmd
push dword [0x52ea10]
push 0
call fcn.0041aae0
add esp, 0xc
cmp edi, 2
je 0x40f4f1
test edi, edi
jne 0x40f534
push str.SOFTWAREClassesHtmlfileShellOpenCommand
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 0xc], esi
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x1e
push eax
push dword [0x52ea10]
push 0
call fcn.0040b8a0
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40f539
cmp edi, 1
jne 0x40f577
push str.SOFTWAREClassesHtmlfileShellOpenCommand
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 0xc], esi
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x1f
push eax
push dword [0x52ea0c]
push 0
call fcn.0040b8a0
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov esi, dword [ebp + 8]
mov eax, esi
and eax, 0x1000
mov dword [ebp - 0x18], eax
je 0x40f610
mov dword [0x539f4c], 0x1000
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x40f5ea
cmp edi, 2
je 0x40f5a8
cmp edi, 1
jne 0x40f610
push 0x20
push str.ServiceControllerStart
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40f5ce
cmp edi, 1
jne 0x40f610
push 0x20
push str.LsaStart
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40f5f4
cmp edi, 1
jne 0x40f610
push 0x2c
push str.CmdLine
push str.SYSTEMSetup
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
test esi, 0x20000
je 0x40f654
mov dword [0x539f4c], 0x20000
cmp edi, 2
je 0x40f62c
cmp edi, 1
jne 0x40f654
push str.ROOT_subscription
push 0
call fcn.0042e510
add esp, 8
cmp edi, 2
je 0x40f645
cmp edi, 1
jne 0x40f654
push str.ROOTdefault
push 0
call fcn.0042e510
add esp, 8
mov eax, dword [ebp + 8]
test al, 0x20
je 0x40f687
mov dword [0x539f4c], 0x20
cmp edi, 2
je 0x40f66f
cmp edi, 1
jne 0x40f687
push str.SystemCurrentControlSetServices
push dword [0x52ea0c]
push 0
call fcn.0041f290
mov eax, dword [ebp + 8]
add esp, 0xc
test al, 0x40
je 0x40f700
mov dword [0x539f4c], 0x40
cmp edi, 2
je 0x40f69f
cmp edi, 1
jne 0x40f700
push str.SystemCurrentControlSetServices
push dword [0x52ea0c]
push 0
call fcn.00415390
add esp, 0xc
cmp edi, 2
je 0x40f6be
cmp edi, 1
jne 0x40f700
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFont_Drivers
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 0xc], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x20
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
cmp dword [ebp - 0x18], 0
je 0x40f9e7
mov dword [0x539f4c], 0x1000
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x40f80b
cmp edi, 2
je 0x40f730
cmp edi, 1
jne 0x40f902
push str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationCredential_Providers
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 0xc], esi
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x21
push eax
push dword [0x52ea0c]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40f77c
cmp edi, 1
jne 0x40f902
push str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationCredential_Provider_Filters
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 0xc], esi
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x22
push eax
push dword [0x52ea0c]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40f7c8
cmp edi, 1
jne 0x40f902
push str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationPLAP_Providers
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 0xc], esi
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x23
push eax
push dword [0x52ea0c]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
jmp 0x40f902
cmp edi, 2
je 0x40f819
cmp edi, 1
jne 0x40f92d
push 0x2c
push str.GinaDLL
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40f843
cmp edi, 1
jne 0x40f92d
push 0x2c
push str.UIHost
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40f86d
cmp edi, 1
jne 0x40f92d
push 0x2c
push str.System
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40f897
cmp edi, 1
jne 0x40f92d
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x24
push eax
push dword [0x52ea0c]
push 0
call fcn.0042a2d0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x40f8e6
cmp edi, 1
jne 0x40f92d
push 0x20
push str.SaveDumpStart
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40f90c
cmp edi, 1
jne 0x40f92d
push 0x20
push str.Taskman
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40f931
test edi, edi
jne 0x40f977
push 0x2c
push str.Scrnsave.exe
push str.SOFTWAREPoliciesMicrosoftWindowsControl_PanelDesktop
push dword [0x52ea10]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40f956
test edi, edi
jne 0x40f977
push 0x2c
push str.Scrnsave.exe
push str.Control_PanelDesktop
push dword [0x52ea10]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40f97c
cmp edi, 1
jne 0x40f9e7
push 0x2c
push str.ImagePath
push str.SystemCurrentControlSetControlBootVerificationProgram
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40f9a2
cmp edi, 1
jne 0x40f9e7
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonGpExtensions
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x25
push eax
push dword [0x52ea0c]
push 0
call fcn.0042a2d0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
test dword [ebp + 8], 0x4000
je 0x40faa4
mov dword [0x539f4c], 0x4000
cmp edi, 2
je 0x40fa0c
cmp edi, 1
jne 0x40faa4
push str.SYSTEMCurrentControlSetControlPrintMonitors
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
push 1
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x26
push eax
push dword [0x52ea0c]
push 0
call fcn.0041e480
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
cmp edi, 2
je 0x40fa5d
cmp edi, 1
jne 0x40faa4
push str.SYSTEMCurrentControlSetControlPrintProviders
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
push 1
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x27
push eax
push dword [0x52ea0c]
push 0
call fcn.0041e480
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
mov esi, dword [ebp + 8]
test esi, 0x8000
je 0x40fb7b
mov dword [0x539f4c], 0x8000
cmp edi, 2
je 0x40facb
cmp edi, 1
jne 0x40fb7b
push 0x2c
push str.SecurityProviders
push str.SYSTEMCurrentControlSetControlSecurityProviders
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40faf5
cmp edi, 1
jne 0x40fb7b
push str.Authentication_Packages
push str.SYSTEMCurrentControlSetControlLsa
push dword [0x52ea0c]
push 0
call fcn.0041bec0
add esp, 0x10
cmp edi, 2
je 0x40fb19
cmp edi, 1
jne 0x40fb7b
push str.Notification_Packages
push str.SYSTEMCurrentControlSetControlLsa
push dword [0x52ea0c]
push 0
call fcn.0041bec0
add esp, 0x10
cmp edi, 2
je 0x40fb3d
cmp edi, 1
jne 0x40fb7b
push str.Security_Packages
push str.SYSTEMCurrentControlSetControlLsa
push dword [0x52ea0c]
push 0
call fcn.0041bec0
add esp, 0x10
cmp edi, 2
je 0x40fb61
cmp edi, 1
jne 0x40fb7b
push str.Security_Packages
push str.SYSTEMCurrentControlSetControlLsaOSConfig
push dword [0x52ea0c]
push 0
call fcn.0041bec0
add esp, 0x10
test esi, 0x10000
je 0x40fbdc
mov dword [0x539f4c], 0x10000
cmp edi, 2
je 0x40fb97
cmp edi, 1
jne 0x40fbdc
push str.SYSTEMCurrentControlSetControlNetworkProviderOrder
mov dword [ebp + 0xc], 0
call fcn.004c8d00
push 0
mov dword [ebp + 0xc], eax
call fcn.004c8d5f
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0x28
push eax
push dword [0x52ea0c]
push 0
call fcn.0041ca20
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
test esi, 0x2000
je 0x40fcc9
mov dword [0x539f4c], 0x10000
cmp edi, 2
je 0x40fc00
cmp edi, 1
jne 0x40fcc6
push ecx
mov esi, esp
push str.SystemCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
mov dword [esi], 0
call fcn.004c8d00
push 0
mov dword [esi], eax
call fcn.004c8d5f
add esp, 8
push 0
call fcn.0042b7e0
add esp, 8
cmp edi, 2
je 0x40fc37
cmp edi, 1
jne 0x40fcc6
push ecx
mov esi, esp
push str.SystemCurrentControlSetServicesWinSock2ParametersNameSpace_Catalog5Catalog_Entries
mov dword [esi], 0
call fcn.004c8d00
push 0
mov dword [esi], eax
call fcn.004c8d5f
add esp, 8
push 0
call fcn.0042ac90
add esp, 8
cmp edi, 2
je 0x40fc6a
cmp edi, 1
jne 0x40fcc6
push ecx
mov esi, esp
push str.SystemCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries64
mov dword [esi], 0
call fcn.004c8d00
push 0
mov dword [esi], eax
call fcn.004c8d5f
add esp, 8
push 0
call fcn.0042b7e0
add esp, 8
cmp edi, 2
je 0x40fc9d
cmp edi, 1
jne 0x40fcc6
push ecx
mov esi, esp
push str.SystemCurrentControlSetServicesWinSock2ParametersNameSpace_Catalog5Catalog_Entries64
mov dword [esi], 0
call fcn.004c8d00
push 0
mov dword [esi], eax
call fcn.004c8d5f
add esp, 8
push 0
call fcn.0042ac90
add esp, 8
mov esi, dword [ebp + 8]
and esi, 2
mov dword [ebp + 0xc], esi
je 0x410237
mov dword [0x539f4c], 2
cmp edi, 2
je 0x40fce9
cmp edi, 1
jne 0x40fd2b
push 0x2c
push str.StartupPrograms
push str.SystemCurrentControlSetControlTerminal_ServerWds_rdpwd
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40fd0f
cmp edi, 1
jne 0x40fd2b
push 0x2c
push str.AppSetup
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
mov dword [0x539f4c], 2
cmp edi, 2
je 0x40fd3f
cmp edi, 1
jne 0x40fd8b
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsStartup
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x29
push eax
push dword [0x52ea0c]
push 0
call fcn.00415cc0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
cmp edi, 2
je 0x40fd8f
test edi, edi
jne 0x40fddb
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogon
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x2a
push eax
push dword [0x52ea10]
push 0
call fcn.00415cc0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
cmp edi, 2
je 0x40fde0
cmp edi, 1
jne 0x40fe2c
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogon
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x2b
push eax
push dword [0x52ea0c]
push 0
call fcn.00415cc0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
cmp edi, 2
je 0x40fe30
test edi, edi
jne 0x40fe76
push 0x2c
push str.UserInitMprLogonScript
push str.Environment
push dword [0x52ea10]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40fe55
test edi, edi
jne 0x40fe76
push 0x2c
push str.UserInitMprLogonScript
push str.Environment
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40fe7f
cmp edi, 1
jne 0x40ff17
push 0x2c
push str.Userinit
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40fea5
cmp edi, 1
jne 0x40ff17
push 0
push str.VmApplet
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x40fecb
cmp edi, 1
jne 0x40ff17
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsShutdown
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x2c
push eax
push dword [0x52ea0c]
push 0
call fcn.00415cc0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
cmp edi, 2
je 0x40ff1b
test edi, edi
jne 0x40ff67
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogoff
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x2d
push eax
push dword [0x52ea10]
push 0
call fcn.00415cc0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
cmp edi, 2
je 0x40ff6c
cmp edi, 1
jne 0x40ffb8
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogoff
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x2e
push eax
push dword [0x52ea0c]
push 0
call fcn.00415cc0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
cmp edi, 2
je 0x40ffbc
test edi, edi
jne 0x410008
push str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsStartup
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x2f
push eax
push dword [0x52ea10]
push 0
call fcn.00415cc0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
cmp edi, 2
je 0x41000d
cmp edi, 1
jne 0x410059
push str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsStartup
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x30
push eax
push dword [0x52ea0c]
push 0
call fcn.00415cc0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
cmp edi, 2
je 0x41005d
test edi, edi
jne 0x4100a9
push str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsLogon
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x31
push eax
push dword [0x52ea10]
push 0
call fcn.00415cc0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
cmp edi, 2
je 0x4100ae
cmp edi, 1
jne 0x4100fa
push str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsLogon
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x32
push eax
push dword [0x52ea0c]
push 0
call fcn.00415cc0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
cmp edi, 2
je 0x4100fe
test edi, edi
jne 0x41014a
push str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsLogoff
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x33
push eax
push dword [0x52ea10]
push 0
call fcn.00415cc0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
cmp edi, 2
je 0x41014f
cmp edi, 1
jne 0x41019b
push str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsLogoff
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x34
push eax
push dword [0x52ea0c]
push 0
call fcn.00415cc0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
cmp edi, 2
je 0x41019f
test edi, edi
jne 0x4101eb
push str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsShutdown
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x35
push eax
push dword [0x52ea10]
push 0
call fcn.00415cc0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
cmp edi, 2
je 0x4101f0
cmp edi, 1
jne 0x410237
push str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsShutdown
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x36
push eax
push dword [0x52ea0c]
push 0
call fcn.00415cc0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
test dword [ebp + 8], 0x400
je 0x410379
mov dword [0x539f4c], 0x400
cmp edi, 2
je 0x410258
cmp edi, 1
jne 0x4102a2
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push str.Appinit_Dlls
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x37
push eax
push dword [0x52ea0c]
push 0
call fcn.00403480
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
mov eax, dword [0x539fdc]
test eax, eax
je 0x4102bc
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4102c6
cmp edi, 1
jne 0x410310
push str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWindows
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push str.Appinit_Dlls
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x38
push eax
push dword [0x52ea0c]
push 0
call fcn.00403480
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
mov eax, dword [0x539fdc]
test eax, eax
je 0x41032a
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x410334
cmp edi, 1
jne 0x410379
push str.SystemCurrentControlSetControlSession_ManagerAppCertDlls
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x39
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
mov esi, dword [ebp + 0xc]
add esp, 0x20
test esi, esi
je 0x410af1
mov dword [0x539f4c], 2
cmp edi, 2
je 0x410394
test edi, edi
jne 0x4103da
push 0x2c
push str.Shell
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push dword [0x52ea10]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x4103b9
test edi, edi
jne 0x4103da
push 0x2c
push str.Shell
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push dword [0x52ea10]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x4103df
cmp edi, 1
jne 0x410447
push 0x2c
push str.Shell
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x410405
cmp edi, 1
jne 0x410447
push 0x2c
push str.Shell
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x41042b
cmp edi, 1
jne 0x410447
push 0x20
push str.Taskman
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetControlSafeBootOption
push dword [0x52ea0c]
call fcn.004086c0
add esp, 0x14
test eax, eax
jne 0x4104c6
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.UseAlternateShell
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4104bd
cmp edi, 2
je 0x4104a1
cmp edi, 1
jne 0x4104bd
push 0x2c
push str.AlternateShell
push str.SystemCurrentControlSetControlSafeBoot
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 2
je 0x4104d4
cmp edi, 1
jne 0x410678
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonAlternateShellsAvailableShells
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x3a
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
cmp edi, 2
je 0x410524
cmp edi, 1
jne 0x410678
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonce
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x3b
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
cmp edi, 2
je 0x410574
cmp edi, 1
jne 0x410678
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonceEx
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x3c
push eax
push dword [0x52ea0c]
push 0
call fcn.004133e0
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
cmp edi, 2
je 0x4105c4
cmp edi, 1
jne 0x410678
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x3d
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
cmp edi, 2
je 0x410610
cmp edi, 1
jne 0x410678
push 0x2c
push str.InitialProgram
push str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x410636
cmp edi, 1
jne 0x410678
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x3e
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x410692
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x41069c
cmp edi, 1
jne 0x4106de
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x3f
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x4106f8
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x410701
test edi, edi
jne 0x410743
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x40
push eax
push dword [0x52ea10]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x41075d
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x410766
test edi, edi
jne 0x4107a8
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x41
push eax
push dword [0x52ea10]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x4107c2
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4107cc
cmp edi, 1
jne 0x41080e
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x42
push eax
push dword [0x52ea0c]
push 0
call fcn.004133e0
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x410828
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x410832
cmp edi, 1
jne 0x410874
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x43
push eax
push dword [0x52ea0c]
push 0
call fcn.004133e0
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x41088e
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x410897
test edi, edi
jne 0x4108d9
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x44
push eax
push dword [0x52ea10]
push 0
call fcn.004133e0
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x4108f3
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4108fc
test edi, edi
jne 0x41093e
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x45
push eax
push dword [0x52ea10]
push 0
call fcn.004133e0
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x410958
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x410962
cmp edi, 1
jne 0x4109a4
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x46
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x4109be
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4109c8
cmp edi, 1
jne 0x410a0a
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x47
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x410a24
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x410a2d
test edi, edi
jne 0x410a6f
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x48
push eax
push dword [0x52ea10]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x410a89
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x410a92
test edi, edi
jne 0x410ad4
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x49
push eax
push dword [0x52ea10]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x410aee
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
and eax, 4
mov dword [ebp - 0x18], eax
je 0x410c92
mov dword [0x539f4c], 4
cmp edi, 2
je 0x410b13
test edi, edi
jne 0x410b5d
push str.SOFTWAREClassesProtocolsFilter
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x4a
push eax
push dword [0x52ea10]
push 0
call fcn.00417180
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x410b62
cmp edi, 1
jne 0x410bac
push str.SOFTWAREClassesProtocolsFilter
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x4b
push eax
push dword [0x52ea0c]
push 0
call fcn.00417180
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x410bb0
test edi, edi
jne 0x410bfa
push str.SOFTWAREClassesProtocolsHandler
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x4c
push eax
push dword [0x52ea10]
push 0
call fcn.00417180
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x410bff
cmp edi, 1
jne 0x410c49
push str.SOFTWAREClassesProtocolsHandler
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x4d
push eax
push dword [0x52ea0c]
push 0
call fcn.00417180
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x410c4d
test edi, edi
jne 0x410c92
push str.SOFTWAREMicrosoftInternet_ExplorerDesktopComponents
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x4e
push eax
push dword [0x52ea10]
push 0
call fcn.00417d70
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
test esi, esi
je 0x410f32
mov dword [0x539f4c], 2
cmp edi, 2
je 0x410cad
test edi, edi
jne 0x410ccc
push str.AltStartup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push dword [0x52ea10]
push 0
call fcn.00426500
add esp, 0x10
cmp edi, 2
je 0x410cd1
cmp edi, 1
jne 0x410d14
push str.Common_AltStartup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push dword [0x52ea0c]
push 0
call fcn.00426500
add esp, 0x10
cmp edi, 2
je 0x410cf5
cmp edi, 1
jne 0x410d14
push str.Common_Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push dword [0x52ea0c]
push 0
call fcn.00426500
add esp, 0x10
cmp edi, 2
je 0x410d1c
test edi, edi
jne 0x410da8
push str.Startup
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
push dword [0x52ea10]
push 0
call fcn.00426500
add esp, 0x10
cmp edi, 2
je 0x410d3f
test edi, edi
jne 0x410da8
push str.Startup
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push dword [0x52ea10]
push 0
call fcn.00426500
add esp, 0x10
cmp edi, 2
je 0x410d62
test edi, edi
jne 0x410da8
push 0x20
push str.Load
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push dword [0x52ea10]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x410d87
test edi, edi
jne 0x410da8
push 0x20
push 0x4fd364
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push dword [0x52ea10]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x410dad
cmp edi, 1
jne 0x410df4
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x4f
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
cmp edi, 2
je 0x410df8
test edi, edi
jne 0x410e3f
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x50
push eax
push dword [0x52ea10]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
cmp edi, 2
je 0x410e44
cmp edi, 1
jne 0x410e89
push str.SOFTWAREMicrosoftActive_SetupInstalled_Components
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x51
push eax
push dword [0x52ea0c]
push 0
call fcn.00402940
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x410ea3
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x410ead
cmp edi, 1
jne 0x410ef2
push str.SOFTWAREWow6432NodeMicrosoftActive_SetupInstalled_Components
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x52
push eax
push dword [0x52ea0c]
push 0
call fcn.00402940
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x410f0c
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x410f16
cmp edi, 1
jne 0x410f32
push 0x2c
push str.IconServiceLib
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push dword [0x52ea0c]
push 0
call fcn.0040de20
add esp, 0x14
cmp dword [ebp - 0x18], 0
je 0x411234
mov dword [0x539f4c], 4
cmp edi, 2
je 0x410f50
cmp edi, 1
jne 0x410f92
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
push 1
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x53
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x410fac
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x410fb6
cmp edi, 1
jne 0x410ff8
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
push 1
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x54
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x411012
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x41101c
cmp edi, 1
jne 0x41105a
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellServiceObjects
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x55
push eax
push dword [0x52ea0c]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x411074
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x41107e
cmp edi, 1
jne 0x4110bc
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellServiceObjects
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x56
push eax
push dword [0x52ea0c]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x4110d6
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4110df
test edi, edi
jne 0x411122
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellServiceObjects
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x57
push eax
push dword [0x52ea10]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x411127
cmp edi, 1
jne 0x411169
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x58
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x411183
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x41118d
cmp edi, 1
jne 0x4111cf
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x59
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x4111e9
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4111f2
test edi, edi
jne 0x411234
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x5a
push eax
push dword [0x52ea10]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
cmp dword [ebp + 0xc], 0
je 0x411518
mov dword [0x539f4c], 2
cmp edi, 2
je 0x411255
test edi, edi
jne 0x411385
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x5b
push eax
push dword [0x52ea10]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
cmp edi, 2
je 0x4112a4
test edi, edi
jne 0x411385
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonce
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x5c
push eax
push dword [0x52ea10]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
cmp edi, 2
je 0x4112f3
test edi, edi
jne 0x411385
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonceEx
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x5d
push eax
push dword [0x52ea10]
push 0
call fcn.004133e0
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
cmp edi, 2
je 0x41133e
test edi, edi
jne 0x411385
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x5e
push eax
push dword [0x52ea10]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
cmp edi, 2
je 0x41138a
cmp edi, 1
jne 0x4113cc
push str.SOFTWAREMicrosoftWindows_CE_ServicesAutoStartOnConnect
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x5f
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x4113e6
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4113f0
cmp edi, 1
jne 0x411432
push str.SOFTWAREWow6432NodeMicrosoftWindows_CE_ServicesAutoStartOnConnect
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x60
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x41144c
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x411456
cmp edi, 1
jne 0x411498
push str.SOFTWAREMicrosoftWindows_CE_ServicesAutoStartOnDisconnect
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x61
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x4114b2
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4114bc
cmp edi, 1
jne 0x4114fe
push str.SOFTWAREWow6432NodeMicrosoftWindows_CE_ServicesAutoStartOnDisconnect
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x62
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x411518
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
mov eax, dword [ebp + 8]
test al, 0x10
je 0x411540
mov dword [0x539f4c], 0x10
cmp edi, 2
je 0x411533
cmp edi, 1
jne 0x411540
push 0
call fcn.004289e0
mov eax, dword [ebp + 8]
add esp, 4
and eax, 8
mov dword [ebp - 0x1c], eax
je 0x41161a
mov dword [0x539f4c], 8
cmp edi, 2
je 0x411560
cmp edi, 1
jne 0x41159e
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x63
push eax
push dword [0x52ea0c]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x4115b8
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4115c2
cmp edi, 1
jne 0x411600
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x10], esi
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x64
push eax
push dword [0x52ea0c]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x41161a
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp dword [ebp - 0x18], 0
je 0x412b35
mov dword [0x539f4c], 4
cmp edi, 2
je 0x411638
cmp edi, 1
jne 0x41167a
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 1
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x65
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x411694
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x41169e
cmp edi, 1
jne 0x4116e0
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
push 1
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x66
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x4116fa
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x411703
test edi, edi
jne 0x41174d
push str.SoftwareClassesShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x67
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x411752
cmp edi, 1
jne 0x411797
push str.SoftwareClassesShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x68
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x4117b1
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4117bb
cmp edi, 1
jne 0x411800
push str.SoftwareWow6432NodeClassesShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x69
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x41181a
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x411823
test edi, edi
jne 0x41186d
push str.SoftwareClassesDriveShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x6a
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x411872
cmp edi, 1
jne 0x4118b7
push str.SoftwareClassesDriveShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x6b
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x4118d1
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4118db
cmp edi, 1
jne 0x411920
push str.SoftwareWow6432NodeClassesDriveShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x6c
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x41193a
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x411943
test edi, edi
jne 0x41198d
push str.SoftwareClassesShellExPropertySheetHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x6d
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x411992
cmp edi, 1
jne 0x4119d7
push str.SoftwareClassesShellExPropertySheetHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x6e
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x4119f1
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4119fb
cmp edi, 1
jne 0x411a40
push str.SoftwareWow6432NodeClassesShellExPropertySheetHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x6f
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x411a5a
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x411a63
test edi, edi
jne 0x411aad
push str.SoftwareClassesAllFileSystemObjectsShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x70
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x411ab2
cmp edi, 1
jne 0x411af7
push str.SoftwareClassesAllFileSystemObjectsShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x71
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x411b11
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x411b1b
cmp edi, 1
jne 0x411b60
push str.SoftwareWow6432NodeClassesAllFileSystemObjectsShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x72
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x411b7a
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x411b83
test edi, edi
jne 0x411bcd
push str.SoftwareClassesAllFileSystemObjectsShellExDragDropHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x73
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x411bd2
cmp edi, 1
jne 0x411c17
push str.SoftwareClassesAllFileSystemObjectsShellExDragDropHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x74
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x411c31
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x411c3b
cmp edi, 1
jne 0x411c80
push str.SoftwareWow6432NodeClassesAllFileSystemObjectsShellExDragDropHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x75
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x411c9a
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x411ca3
test edi, edi
jne 0x411ced
push str.SoftwareClassesAllFileSystemObjectsShellExPropertySheetHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x76
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x411cf2
cmp edi, 1
jne 0x411d37
push str.SoftwareClassesAllFileSystemObjectsShellExPropertySheetHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x77
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x411d51
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x411d5b
cmp edi, 1
jne 0x411da0
push str.SoftwareWow6432NodeClassesAllFileSystemObjectsShellExPropertySheetHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x78
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x411dba
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x411dc3
test edi, edi
jne 0x411e0d
push str.SoftwareClassesDirectoryShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x79
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x411e12
cmp edi, 1
jne 0x411e57
push str.SoftwareClassesDirectoryShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x7a
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x411e71
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x411e7b
cmp edi, 1
jne 0x411ec0
push str.SoftwareWow6432NodeClassesDirectoryShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x7b
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x411eda
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x411ee3
test edi, edi
jne 0x411f2d
push str.SoftwareClassesDirectoryShellexDragDropHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x7c
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x411f32
cmp edi, 1
jne 0x411f77
push str.SoftwareClassesDirectoryShellexDragDropHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x7d
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x411f91
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x411f9b
cmp edi, 1
jne 0x411fe0
push str.SoftwareWow6432NodeClassesDirectoryShellexDragDropHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x7e
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x411ffa
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x412003
test edi, edi
jne 0x41204d
push str.SoftwareClassesDirectoryShellexPropertySheetHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x7f
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x412052
cmp edi, 1
jne 0x412097
push str.SoftwareClassesDirectoryShellexPropertySheetHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x80
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x4120b1
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4120bb
cmp edi, 1
jne 0x412100
push str.SoftwareWow6432NodeClassesDirectoryShellexPropertySheetHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x81
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x41211a
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x412123
test edi, edi
jne 0x41216d
push str.SoftwareClassesDirectoryShellexCopyHookHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x82
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x412172
cmp edi, 1
jne 0x4121b7
push str.SoftwareClassesDirectoryShellexCopyHookHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x83
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x4121d1
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4121db
cmp edi, 1
jne 0x412220
push str.SoftwareWow6432NodeClassesDirectoryShellexCopyHookHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x84
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x41223a
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x412243
test edi, edi
jne 0x41228d
push str.SoftwareClassesDirectoryBackgroundShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x85
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x412292
cmp edi, 1
jne 0x4122d7
push str.SoftwareClassesDirectoryBackgroundShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x86
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x4122f1
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4122fb
cmp edi, 1
jne 0x412340
push str.SoftwareWow6432NodeClassesDirectoryBackgroundShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x87
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x41235a
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x412363
test edi, edi
jne 0x4123a6
push str.SoftwareClassesFolderShellexColumnHandlers
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x88
push eax
push dword [0x52ea10]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x4123ab
cmp edi, 1
jne 0x4123e9
push str.SoftwareClassesFolderShellexColumnHandlers
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x89
push eax
push dword [0x52ea0c]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x412403
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x41240d
cmp edi, 1
jne 0x41244b
push str.SoftwareWow6432NodeClassesFolderShellexColumnHandlers
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x8a
push eax
push dword [0x52ea0c]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x412465
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x41246e
test edi, edi
jne 0x4124b8
push str.SoftwareClassesFolderShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x8b
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x4124bd
cmp edi, 1
jne 0x412502
push str.SoftwareClassesFolderShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x8c
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x41251c
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x412526
cmp edi, 1
jne 0x41256b
push str.SoftwareWow6432NodeClassesFolderShellExContextMenuHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x8d
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x412585
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x41258e
test edi, edi
jne 0x4125d8
push str.SoftwareClassesFolderShellExDragDropHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x8e
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x4125dd
cmp edi, 1
jne 0x412622
push str.SoftwareClassesFolderShellExDragDropHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x8f
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x41263c
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x412646
cmp edi, 1
jne 0x41268b
push str.SoftwareWow6432NodeClassesFolderShellExDragDropHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x90
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x4126a5
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4126ae
test edi, edi
jne 0x4126f8
push str.SoftwareClassesFolderShellExExtShellFolderViews
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x91
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x4126fd
cmp edi, 1
jne 0x412742
push str.SoftwareClassesFolderShellExExtShellFolderViews
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x92
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x41275c
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x412766
cmp edi, 1
jne 0x4127ab
push str.SoftwareWow6432NodeClassesFolderShellExExtShellFolderViews
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x93
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x4127c5
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4127ce
test edi, edi
jne 0x412818
push str.SoftwareClassesFolderShellExPropertySheetHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x94
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x41281d
cmp edi, 1
jne 0x412862
push str.SoftwareClassesFolderShellExPropertySheetHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x95
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x41287c
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x412886
cmp edi, 1
jne 0x4128cb
push str.SoftwareWow6432NodeClassesFolderShellExPropertySheetHandlers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x96
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x4128e5
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4128ee
test edi, edi
jne 0x412938
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x97
push eax
push dword [0x52ea10]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x41293d
cmp edi, 1
jne 0x412982
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x98
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x41299c
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4129a6
cmp edi, 1
jne 0x4129eb
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x99
push eax
push dword [0x52ea0c]
push 0
call fcn.004203e0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x412a05
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x412a0e
test edi, edi
jne 0x412a76
push 0x20
push str.Inprocserver32
push str.SoftwareClassesClsidAB8902B4_09CA_4bb6_B78D_A8F59079A8D5
push dword [0x52ea10]
push 0
call fcn.0040de20
add esp, 0x14
cmp edi, 2
je 0x412a33
test edi, edi
jne 0x412a76
push str.SoftwareMicrosoftCtfLangBarAddin
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x9a
push eax
push dword [0x52ea10]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x412a7b
cmp edi, 1
jne 0x412ab9
push str.SoftwareMicrosoftCtfLangBarAddin
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x9b
push eax
push dword [0x52ea0c]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x412ad3
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x412add
cmp edi, 1
jne 0x412b1b
push str.SoftwareMicrosoftCtfLangBarAddin
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x18], esi
call fcn.004c8d5f
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x9c
push eax
push dword [0x52ea0c]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x412b35
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp dword [ebp - 0x1c], 0
je 0x412f3c
mov dword [0x539f4c], 8
cmp edi, 2
je 0x412b52
test edi, edi
jne 0x412b99
push str.SoftwareMicrosoftInternet_ExplorerUrlSearchHooks
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x1c], esi
call fcn.004c8d5f
push 1
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0x9d
push eax
push dword [0x52ea10]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
cmp edi, 2
je 0x412b9e
cmp edi, 1
jne 0x412be0
push str.SoftwareMicrosoftInternet_ExplorerToolbar
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x1c], esi
call fcn.004c8d5f
push 1
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0x9e
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x412bfa
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x412c04
cmp edi, 1
jne 0x412c46
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerToolbar
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x1c], esi
call fcn.004c8d5f
push 1
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0x9f
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x412c60
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x412c69
test edi, edi
jne 0x412cb3
push str.SoftwareMicrosoftInternet_ExplorerExplorer_Bars
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0xa0
push eax
push dword [0x52ea10]
push 0
call fcn.004186d0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x412cb8
cmp edi, 1
jne 0x412cfd
push str.SoftwareMicrosoftInternet_ExplorerExplorer_Bars
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0xa1
push eax
push dword [0x52ea0c]
push 0
call fcn.004186d0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x412d17
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x412d20
test edi, edi
jne 0x412d6a
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExplorer_Bars
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0xa2
push eax
push dword [0x52ea10]
push 0
call fcn.004186d0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x412d6f
cmp edi, 1
jne 0x412db4
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExplorer_Bars
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0xa3
push eax
push dword [0x52ea0c]
push 0
call fcn.004186d0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x412dce
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x412dd7
test edi, edi
jne 0x412e21
push str.SoftwareMicrosoftInternet_ExplorerExtensions
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0xa4
push eax
push dword [0x52ea10]
push 0
call fcn.004186d0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x412e26
cmp edi, 1
jne 0x412e6b
push str.SoftwareMicrosoftInternet_ExplorerExtensions
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0xa5
push eax
push dword [0x52ea0c]
push 0
call fcn.004186d0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x412e85
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x412e8e
test edi, edi
jne 0x412ed8
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExtensions
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0xa6
push eax
push dword [0x52ea10]
push 0
call fcn.004186d0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x412edd
cmp edi, 1
jne 0x412f22
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExtensions
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0xa7
push eax
push dword [0x52ea0c]
push 0
call fcn.004186d0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x412f3c
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
test byte [ebp + 8], 0x80
je 0x413316
lea eax, [ebp - 0x1c]
mov dword [0x539f4c], 0x80
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionDrivers32
push dword [0x52ea0c]
call fcn.004086c0
add esp, 0x14
test eax, eax
je 0x412fa5
cmp dword [0x53a3f8], 0
je 0x413316
cmp edi, 2
je 0x412f8d
cmp edi, 1
jne 0x413316
push str._nNo_entry_to_display_for_codecs._Codecs_are_not_supported_on_Nano_Server._n
push dword [0x53a3fc]
call fcn.00413e50
add esp, 8
jmp 0x413316
cmp edi, 2
je 0x412fae
test edi, edi
jne 0x412ff5
push str.SoftwareMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 8], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp + 8]
mov dword [ebp - 4], 0xa8
push eax
push dword [0x52ea10]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
cmp edi, 2
je 0x412ffa
cmp edi, 1
jne 0x41303c
push str.SoftwareMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 8], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp + 8]
mov dword [ebp - 4], 0xa9
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x413056
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x41305f
test edi, edi
jne 0x4130a6
push str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 8], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp + 8]
mov dword [ebp - 4], 0xaa
push eax
push dword [0x52ea10]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
cmp edi, 2
je 0x4130ab
cmp edi, 1
jne 0x4130ed
push str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 8], esi
call fcn.004c8d5f
push 0
push 1
lea eax, [ebp + 8]
mov dword [ebp - 4], 0xab
push eax
push dword [0x52ea0c]
push 0
call fcn.0040c290
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x20
mov eax, dword [0x539fdc]
test eax, eax
je 0x413107
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x413110
test edi, edi
jne 0x413153
push str.SoftwareClassesFilter
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 8], esi
call fcn.004c8d5f
lea eax, [ebp + 8]
mov dword [ebp - 4], 0xac
push eax
push dword [0x52ea10]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
cmp edi, 2
je 0x413158
cmp edi, 1
jne 0x413196
push str.SoftwareClassesFilter
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 8], esi
call fcn.004c8d5f
lea eax, [ebp + 8]
mov dword [ebp - 4], 0xad
push eax
push dword [0x52ea0c]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x4131b0
push 1
call eax
push 0x200
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x4131ba
cmp edi, 1
jne 0x4131f8
push str.SoftwareClassesFilter
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp + 8], esi
call fcn.004c8d5f
lea eax, [ebp + 8]
mov dword [ebp - 4], 0xae
push eax
push dword [0x52ea0c]
push 0
call fcn.0040aa40
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x18
mov eax, dword [0x539fdc]
test eax, eax
je 0x413212
push 0
call eax
push 0x100
push dword [0x539fd0]
call ebx
cmp edi, 2
je 0x41321b
test edi, edi
jne 0x413297
push str.083863F1_70DE_11d0_BD40_00A0C911CE86
push dword [0x52ea10]
push 0
push 1
call fcn.0040b640
add esp, 0x10
cmp edi, 2
je 0x41323b
test edi, edi
jne 0x413297
push str.AC757296_3522_4E11_9862_C17BE5A1767E
push dword [0x52ea10]
push 0
push 1
call fcn.0040b640
add esp, 0x10
cmp edi, 2
je 0x41325b
test edi, edi
jne 0x413297
push str.7ED96837_96F0_4812_B211_F13C24117ED3
push dword [0x52ea10]
push 0
push 1
call fcn.0040b640
add esp, 0x10
cmp edi, 2
je 0x41327b
test edi, edi
jne 0x413297
push str.ABE3B9A4_257D_4B97_BD1A_294AF496222E
push dword [0x52ea10]
push 0
push 1
call fcn.0040b640
add esp, 0x10
cmp edi, 2
je 0x41329c
cmp edi, 1
jne 0x413316
push str.083863F1_70DE_11d0_BD40_00A0C911CE86
push dword [0x52ea0c]
push 0
push 1
call fcn.0040b640
add esp, 0x10
cmp edi, 2
je 0x4132bd
cmp edi, 1
jne 0x413316
push str.AC757296_3522_4E11_9862_C17BE5A1767E
push dword [0x52ea0c]
push 0
push 1
call fcn.0040b640
add esp, 0x10
cmp edi, 2
je 0x4132de
cmp edi, 1
jne 0x413316
push str.7ED96837_96F0_4812_B211_F13C24117ED3
push dword [0x52ea0c]
push 0
push 1
call fcn.0040b640
add esp, 0x10
cmp edi, 2
je 0x4132ff
cmp edi, 1
jne 0x413316
push str.ABE3B9A4_257D_4B97_BD1A_294AF496222E
push dword [0x52ea0c]
push 0
push 1
call fcn.0040b640
add esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x4133c4
mov dword [0x539f4c], 2
cmp edi, 2
je 0x413333
test edi, edi
jne 0x41337f
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogoff
mov dword [ebp + 8], 0
call fcn.004c8d00
push 0
mov dword [ebp + 8], eax
call fcn.004c8d5f
push 1
lea eax, [ebp + 8]
mov dword [ebp - 4], 0xaf
push eax
push dword [0x52ea10]
push 0
call fcn.00415cc0
push dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
add esp, 0x1c
cmp edi, 2
je 0x413384
cmp edi, 1
jne 0x4133c4
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsShutdown
mov dword [ebp + 8], 0
call fcn.004c8d00
push 0
mov dword [ebp + 8], eax
call fcn.004c8d5f
push 1
lea eax, [ebp + 8]
mov dword [ebp - 4], 0xb0
push eax
push dword [0x52ea0c]
push 0
call fcn.00415cc0
push dword [ebp + 8]
call fcn.004c8d5f
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret