Function at 0x55c520
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fa8b6
mov eax, dword fs:[0]
push eax
sub esp, 0x2f8
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2fc], esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2f8], ecx
mov dword [ebp - 0x2f0], eax
test eax, eax
je 0x55e1f0
xor edi, edi
test ecx, ecx
jne 0x55c5ca
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
lea eax, [eax*2 + 4]
push eax
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x18], eax
call fcn.0055e500
cmp byte [esi + 0x48], 0
mov edi, eax
je 0x55c5ad
push dword [ebp - 0x18]
mov ecx, esi
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
call fcn.0055e500
add edi, eax
mov edx, dword [ebp - 0x2f0]
mov ecx, esi
push edx
push dword [ebp - 0x18]
push 0x64d0a0
call fcn.0055c3b0
add edi, eax
jmp 0x55e1ee
cmp ecx, 1
jne 0x55c6ba
xor eax, eax
cmp byte [ebp + 0xc], al
setne al
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x2f8], eax
call fcn.0057be30
push eax
mov ecx, esi
call fcn.0055e500
sub esp, 8
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x24]
mov edi, eax
movq qword [ebp - 0x24], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Tasks
push dword [esi + 0x40]
call fcn.005dc520
mov esi, dword [ebp - 0x2f8]
lea ecx, [ebp - 0x24]
push esi
mov dword [ebp - 4], 0
call fcn.005dc190
mov ecx, dword [ebp - 0x2fc]
push eax
call fcn.0055e500
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
add edi, eax
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x2fc]
push 0
push str.Tasks
push dword [eax + 0x44]
call fcn.005dc200
push esi
lea ecx, [ebp - 0x24]
call fcn.005dc190
mov ecx, dword [ebp - 0x2fc]
push eax
call fcn.0055e500
mov edx, dword [ebp - 0x2f0]
add edi, eax
push edx
push esi
push ecx
mov ecx, dword [ebp - 0x2fc]
call fcn.0057bdc0
mov ecx, dword [ebp - 0x2fc]
push eax
call fcn.0055c3b0
lea ecx, [ebp - 0x24]
add edi, eax
call fcn.005dc430
jmp 0x55e1ee
cmp ecx, 2
jne 0x55c710
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
add eax, 0xc
push eax
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov dword [ebp - 0x18], eax
call fcn.0055e500
cmp byte [esi + 0x48], 0
mov edi, eax
je 0x55c6f3
push dword [ebp - 0x18]
mov ecx, esi
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
call fcn.0055e500
add edi, eax
mov edx, dword [ebp - 0x2f0]
mov ecx, esi
push edx
push dword [ebp - 0x18]
push 0x64d100
call fcn.0055c3b0
add edi, eax
jmp 0x55e1ee
cmp ecx, 3
jne 0x55c7a3
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
add eax, 4
push eax
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov dword [ebp - 0x14], eax
call fcn.0055e500
push dword [ebp - 0x14]
mov ecx, esi
mov edi, eax
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.0055e500
add edi, eax
cmp byte [esi + 0x48], 0
je 0x55c76f
push dword [ebp - 0x14]
mov ecx, esi
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
call fcn.0055e500
push dword [ebp - 0x14]
mov ecx, esi
add edi, eax
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.0055e500
add edi, eax
mov edx, dword [ebp - 0x2f0]
mov ecx, esi
push edx
push dword [ebp - 0x14]
push 0x64d300
call fcn.0055c3b0
push dword [ebp - 0x2f0]
mov ecx, esi
add edi, eax
push dword [ebp - 0x14]
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.0055c3b0
add edi, eax
jmp 0x55e1ee
cmp ecx, 4
jne 0x55c7ea
xor eax, eax
cmp byte [ebp + 0xc], al
setne al
add eax, ecx
mov ecx, esi
push eax
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunServices
mov dword [ebp - 0x2f8], eax
call fcn.0055e500
cmp byte [esi + 0x48], 0
mov edi, eax
je 0x55e1ee
push dword [ebp - 0x2f8]
mov ecx, esi
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunServices
call fcn.0055e500
add edi, eax
jmp 0x55e1ee
cmp ecx, 5
jne 0x55c832
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
add eax, 4
push eax
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
mov dword [ebp - 0x2f8], eax
call fcn.0055e500
cmp byte [esi + 0x48], 0
mov edi, eax
je 0x55e1ee
push dword [ebp - 0x2f8]
mov ecx, esi
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunServicesOnce
call fcn.0055e500
add edi, eax
jmp 0x55e1ee
cmp ecx, 6
jne 0x55c932
xor edi, edi
mov dword [ebp - 0x40], 0
cmp byte [ebp + 0xc], 0
lea ecx, [ebp - 0x48]
mov eax, 9
xorps xmm0, xmm0
cmovne edi, eax
movq qword [ebp - 0x48], xmm0
sub esp, 8
mov dword [ebp - 0x14], edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.GroupPolicy
push dword [esi + 0x44]
call fcn.005dc520
push edi
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 1
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0055e500
mov esi, dword [ebp - 0x14]
mov edi, eax
mov ecx, dword [ebp - 0x2fc]
or esi, 4
push esi
push str.HKLMSOFTWAREPolicies
call fcn.0055e500
push esi
mov esi, dword [ebp - 0x2fc]
add edi, eax
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPolicies
mov ecx, esi
call fcn.0055e500
add edi, eax
mov eax, dword [ebp - 0x14]
or eax, 0xc
cmp byte [esi + 0x48], 0
mov dword [ebp - 0x14], eax
je 0x55c8f8
push eax
push str.HKLMSOFTWAREWow6432NodePolicies
mov ecx, esi
call fcn.0055e500
push dword [ebp - 0x14]
mov ecx, esi
add edi, eax
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPolicies
call fcn.0055e500
add edi, eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2f0]
mov ecx, esi
push edx
push eax
push 0x64d6f8
call fcn.0055c3b0
push dword [ebp - 0x2f0]
mov ecx, esi
add edi, eax
push dword [ebp - 0x14]
push 0x64d720
call fcn.0055c3b0
lea ecx, [ebp - 0x48]
add edi, eax
call fcn.005dc430
jmp 0x55e1ee
cmp ecx, 7
jne 0x55c956
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
add eax, 0xc
push eax
push str.HKLMSYSTEMCurrentControlSetControlSecurityProviders
call fcn.0055e500
mov edi, eax
jmp 0x55e1ee
cmp ecx, 8
jne 0x55c9a3
xor eax, eax
mov dword [ebp - 0x40], edi
cmp byte [ebp + 0xc], al
lea ecx, [ebp - 0x48]
xorps xmm0, xmm0
setne al
movq qword [ebp - 0x48], xmm0
sub esp, 8
mov dword [ebp - 0x2f8], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.driversetc
push dword [esi + 0x44]
call fcn.005dc520
mov dword [ebp - 4], 2
jmp 0x55ca33
cmp ecx, 9
jne 0x55c9eb
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
add eax, 4
push eax
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov dword [ebp - 0x2f8], eax
call fcn.0055e500
cmp byte [esi + 0x48], 0
mov edi, eax
je 0x55e1ee
push dword [ebp - 0x2f8]
mov ecx, esi
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
call fcn.0055e500
add edi, eax
jmp 0x55e1ee
cmp ecx, 0xa
jne 0x55ca58
xor eax, eax
mov dword [ebp - 0x40], edi
cmp byte [ebp + 0xc], al
lea ecx, [ebp - 0x48]
xorps xmm0, xmm0
setne al
movq qword [ebp - 0x48], xmm0
sub esp, 8
mov dword [ebp - 0x2f8], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.drivers
push dword [esi + 0x44]
call fcn.005dc520
mov dword [ebp - 4], 3
push dword [ebp - 0x2f8]
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0055e500
lea ecx, [ebp - 0x48]
mov edi, eax
call fcn.005dc430
jmp 0x55e1ee
cmp ecx, 0xb
jne 0x55ca7c
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
add eax, 0xc
push eax
push str.HKLMSYSTEMCurrentControlSetControlSession_ManagerSubSystems
call fcn.0055e500
mov edi, eax
jmp 0x55e1ee
cmp ecx, 0xc
jne 0x55cac3
xor eax, eax
cmp byte [ebp + 0xc], al
setne al
add eax, ecx
mov ecx, esi
push eax
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
mov dword [ebp - 0x2f8], eax
call fcn.0055e500
cmp byte [esi + 0x48], 0
mov edi, eax
je 0x55e1ee
push dword [ebp - 0x2f8]
mov ecx, esi
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
call fcn.0055e500
add edi, eax
jmp 0x55e1ee
cmp ecx, 0xd
jne 0x55cae8
push eax
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
add eax, 0xc
push eax
push 0x64dae0
call fcn.0055c3b0
mov edi, eax
jmp 0x55e1ee
cmp ecx, 0xe
jne 0x55cfa5
push eax
push 0
push 0x64db48
mov ecx, esi
call fcn.0055c3b0
push 6
mov ecx, esi
call fcn.0055e910
mov byte [ebp - 0x2fd], al
test al, al
je 0x55cb24
push dword [ebp - 0x2f0]
mov ecx, esi
push 0
push 6
call fcn.0055c520
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
add eax, 0xc
push eax
push str.HKLMSOFTWAREMicrosoftInternet_ExplorerMain
mov dword [ebp - 0x2f8], eax
call fcn.0055e500
push 0
push 5
mov edx, 1
mov ecx, str.HKLMSOFTWAREMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
mov edi, eax
call fcn.005d7570
cmp byte [esi + 0x48], 0
je 0x55cb84
push dword [ebp - 0x2f8]
mov ecx, esi
push str.HKLMSOFTWAREWow6432NodeMicrosoftInternet_ExplorerMain
call fcn.0055e500
push 0
push 5
mov edx, 1
mov ecx, str.HKLMSOFTWAREWow6432NodeMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
add edi, eax
call fcn.005d7570
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x24]
movq qword [ebp - 0x24], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x30]
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movq qword [ebp - 0x30], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x3c]
movq qword [ebp - 0x3c], xmm0
call fcn.005dc5e0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.005d6aa0
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp - 0x2f0]
mov byte [ebp - 4], 7
mov ecx, dword [eax]
je 0x55ce9d
mov dword [ebp - 0x18], 0
test ecx, ecx
je 0x55cf6b
xor esi, esi
mov dword [ebp - 0x2f4], esi
nop dword [eax]
mov ecx, dword [eax + 0xc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
add ecx, esi
push 0x64ddf0
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x30]
call fcn.005dc200
push 1
push 1
push str.HomePage
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 0
push 0
push 0
push 0
movzx eax, al
push 0
add edi, eax
mov eax, dword [ebp - 0x2f0]
push 0
push 0
push 0
mov ecx, dword [eax + 0xc]
add ecx, esi
push str.SoftwareMicrosoftInternet_ExplorerMain
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea eax, [ebp - 0x24]
push eax
push str.Start_Page
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d65d0
test al, al
je 0x55ccba
lea ecx, [ebp - 0x24]
call fcn.005dbeb0
test al, al
je 0x55ccd0
lea eax, [ebp - 0x24]
push eax
push str.Start_Page
push str.HKLMSOFTWAREMicrosoftInternet_ExplorerMain
lea ecx, [ebp - 0x14]
call fcn.005d65d0
lea ecx, [ebp - 0x24]
call fcn.005dbeb0
test al, al
je 0x55cce6
push str.about:Tabs
call fcn.005dc510
mov eax, dword [ebp - 0x2f0]
push 0
push 0
push 0
mov ecx, dword [eax + 0xc]
push 0
push 0
push 0
push 0
push 0
push 0
add ecx, esi
push 0x64df08
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x30]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
push 1
push str.Start_Page
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d5be0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
movzx eax, al
lea ecx, [ebp - 0x30]
push 0x64df70
add edi, eax
call fcn.005da780
push 0
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d55d0
lea eax, [ebp - 0x24]
push eax
push str.Secondary_Start_Pages
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d65d0
test al, al
je 0x55ce2b
lea ecx, [ebp - 0x24]
call fcn.005dc3a0
test eax, eax
je 0x55ce2b
xorps xmm0, xmm0
lea ecx, [ebp - 0x24]
push 0
push 0x627824
movups xmmword [ebp - 0x54], xmm0
movq qword [ebp - 0x44], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x54]
call fcn.005d92a0
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 8
xor esi, esi
call fcn.005d9210
test eax, eax
je 0x55ce19
push 0
push esi
lea ecx, [ebp - 0x54]
call fcn.005d9220
push eax
push 1
push esi
call fcn.005d9220
push eax
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d5be0
movzx eax, al
lea ecx, [ebp - 0x54]
add edi, eax
inc esi
call fcn.005d9210
cmp esi, eax
jb 0x55cde1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 7
call fcn.005d9280
mov esi, dword [ebp - 0x2f4]
mov eax, dword [ebp - 0x2f0]
push 0
push 0
push 0
mov ecx, dword [eax + 0xc]
push 0
push 0
push 0
push 0
push 0
push 0
add ecx, esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x30]
call fcn.005dc200
push 0
push 5
lea ecx, [ebp - 0x30]
call fcn.005dc190
mov edx, 1
mov ecx, eax
call fcn.005d7570
mov edx, dword [ebp - 0x2f0]
add esi, 0xc
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x2f4], esi
mov dword [ebp - 0x18], eax
cmp eax, dword [edx]
mov eax, edx
jb 0x55cc10
jmp 0x55cf65
mov dword [ebp - 0x2f4], 0
test ecx, ecx
je 0x55cf6b
xor esi, esi
mov ecx, dword [eax + 0xc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
add ecx, esi
push 0x64ddf0
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x30]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
movzx eax, al
push 0
add edi, eax
mov eax, dword [ebp - 0x2f0]
push 0
push 0
push 0
mov ecx, dword [eax + 0xc]
add ecx, esi
push 0x64df08
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x30]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d55d0
mov edx, dword [ebp - 0x2f0]
add esi, 0xc
movzx eax, al
add edi, eax
mov eax, dword [ebp - 0x2f4]
inc eax
cmp eax, dword [edx]
mov dword [ebp - 0x2f4], eax
mov eax, edx
jb 0x55ceb1
mov esi, dword [ebp - 0x2fc]
cmp byte [ebp - 0x2fd], 0
je 0x55cf80
push eax
push 1
push 6
mov ecx, esi
call fcn.0055c520
lea ecx, [ebp - 0x14]
call fcn.005d69e0
lea ecx, [ebp - 0x3c]
call fcn.005dc430
lea ecx, [ebp - 0x30]
call fcn.005dc430
lea ecx, [ebp - 0x24]
call fcn.005dc430
jmp 0x55e1ee
cmp ecx, 0xf
jne 0x55d32c
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
lea eax, [eax*2 + 0xc]
push eax
push str.HKLMSOFTWAREMicrosoftInternet_ExplorerToolbar
mov dword [ebp - 0x14], eax
call fcn.0055e500
cmp byte [esi + 0x48], 0
mov edi, eax
je 0x55cfe6
push dword [ebp - 0x14]
mov ecx, esi
push str.HKLMSOFTWAREWow6432NodeMicrosoftInternet_ExplorerToolbar
call fcn.0055e500
add edi, eax
push dword [ebp - 0x14]
mov ecx, esi
push str.HKLMSOFTWAREMicrosoftInternet_ExplorerSearchScopes
call fcn.0055e500
add edi, eax
cmp byte [esi + 0x48], 0
je 0x55d00e
push dword [ebp - 0x14]
mov ecx, esi
push str.HKLMSOFTWAREWow6432NodeMicrosoftInternet_ExplorerSearchScopes
call fcn.0055e500
add edi, eax
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x48]
movq qword [ebp - 0x48], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x30]
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movq qword [ebp - 0x30], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x3c]
movq qword [ebp - 0x3c], xmm0
call fcn.005dc5e0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.005d6aa0
cmp byte [ebp + 0xc], 0
mov ecx, dword [ebp - 0x2f0]
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x2f4], 0
mov eax, dword [ecx]
je 0x55d20a
test eax, eax
je 0x55d307
xor eax, eax
mov esi, ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [esi + 0xc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
add ecx, eax
push str.SoftwarePoliciesMicrosoftInternet_Explorer
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x30]
call fcn.005dc200
push 0
push 5
lea ecx, [ebp - 0x30]
call fcn.005dc190
mov edx, 4
mov ecx, eax
call fcn.005d76e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64e2b0
lea ecx, [ebp - 0x30]
call fcn.005da780
push 1
push 1
push str.UsePolicySearchProvidersOnly
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
call fcn.00553890
mov ecx, dword [esi + 0xc]
add ecx, dword [ebp - 0x14]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
movzx eax, al
push 0x64e328
add edi, eax
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x3c]
call fcn.005dc200
mov ecx, dword [esi + 0xc]
add ecx, dword [ebp - 0x14]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64e390
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x30]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x30]
call fcn.005dc190
lea ecx, [ebp - 0x3c]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005d3c40
mov esi, dword [ebp - 0x2f0]
push 0
push 0
push 0
mov ecx, dword [esi + 0xc]
add ecx, dword [ebp - 0x14]
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwarePoliciesMicrosoftInternet_Explorer
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x30]
call fcn.005dc200
push 0xe
lea ecx, [ebp - 0x30]
call fcn.005dc190
mov ecx, dword [ebp - 0x2fc]
push eax
call fcn.0055e500
mov ecx, dword [ebp - 0x2f4]
mov eax, dword [ebp - 0x14]
inc ecx
add eax, 0xc
mov dword [ebp - 0x2f4], ecx
mov dword [ebp - 0x14], eax
cmp ecx, dword [esi]
jb 0x55d098
jmp 0x55d307
test eax, eax
je 0x55d307
xor eax, eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ecx + 0xc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
add ecx, eax
push str.SoftwarePoliciesMicrosoftInternet_Explorer
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x30]
call fcn.005dc200
push 0xc
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0055e500
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64e2b0
lea ecx, [ebp - 0x30]
call fcn.005da780
push 0
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
movzx eax, al
push 0
add edi, eax
mov eax, dword [ebp - 0x2f0]
push 0
push 0
push 0
mov ecx, dword [eax + 0xc]
add ecx, dword [ebp - 0x14]
push 0x64e390
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x30]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d55d0
mov edx, dword [ebp - 0x2f0]
mov ecx, dword [ebp - 0x2f4]
movzx eax, al
inc ecx
add edi, eax
mov dword [ebp - 0x2f4], ecx
mov eax, dword [ebp - 0x14]
add eax, 0xc
cmp ecx, dword [edx]
mov dword [ebp - 0x14], eax
mov ecx, edx
jb 0x55d217
lea ecx, [ebp - 0x18]
call fcn.005d69e0
lea ecx, [ebp - 0x3c]
call fcn.005dc430
lea ecx, [ebp - 0x30]
call fcn.005dc430
lea ecx, [ebp - 0x48]
call fcn.005dc430
jmp 0x55e1ee
cmp ecx, 0x10
jne 0x55d3b3
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
add eax, 0xc
push eax
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionInternet_Settings
mov dword [ebp - 0x18], eax
call fcn.0055e500
cmp byte [esi + 0x48], 0
mov edi, eax
je 0x55d369
push dword [ebp - 0x18]
mov ecx, esi
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionInternet_Settings
call fcn.0055e500
add edi, eax
push dword [ebp - 0x2f0]
mov ecx, esi
push dword [ebp - 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones
call fcn.0055c3b0
push dword [ebp - 0x2f0]
mov ecx, esi
add edi, eax
push dword [ebp - 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsLockdown_Zones
call fcn.0055c3b0
push dword [ebp - 0x2f0]
mov ecx, esi
add edi, eax
push dword [ebp - 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZoneMap
call fcn.0055c3b0
add edi, eax
jmp 0x55e1ee
cmp ecx, 0x11
jne 0x55d4b0
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
add eax, 0xc
push eax
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer
mov dword [ebp - 0x2f4], eax
call fcn.0055e500
cmp byte [esi + 0x48], 0
mov edi, eax
je 0x55d3f6
push dword [ebp - 0x2f4]
mov ecx, esi
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorer
call fcn.0055e500
add edi, eax
push 0
push 0xffffffffffffffff
push dword [esi + 0x100]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.005d6a80
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0xd
push eax
push str.UnimmunizedEE
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.005d66b0
movsd xmm0, qword [esi]
comisd xmm0, xmmword [0x6edac0]
jbe 0x55d459
cmp dword [ebp - 0x14], 0
jne 0x55d459
push 0x11
mov ecx, esi
call fcn.0055e910
test al, al
je 0x55d459
push dword [ebp - 0x2f0]
push 0xc
jmp 0x55d473
movsd xmm0, qword [0x6edac8]
comisd xmm0, xmmword [esi]
jbe 0x55d481
push dword [ebp - 0x2f0]
push dword [ebp - 0x2f4]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov ecx, esi
call fcn.0055c3b0
add edi, eax
cmp dword [ebp - 0x14], 0
jne 0x55d4a3
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 4
push str.UnimmunizedEE
lea ecx, [ebp - 0x18]
call fcn.005d5f20
lea ecx, [ebp - 0x18]
call fcn.005d69e0
jmp 0x55e1ee
cmp ecx, 0x12
jne 0x55d50e
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
add eax, 0xc
push eax
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
mov dword [ebp - 0x2f4], eax
call fcn.0055e500
cmp byte [esi + 0x48], 0
mov edi, eax
je 0x55d4ef
push dword [ebp - 0x2f4]
mov ecx, esi
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
call fcn.0055e500
add edi, eax
push dword [ebp - 0x2f0]
mov ecx, esi
push dword [ebp - 0x2f4]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
call fcn.0055c3b0
add edi, eax
jmp 0x55e1ee
cmp ecx, 0x13
jne 0x55d533
push eax
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
add eax, 0xc
push eax
push str.Control_PanelDesktop
call fcn.0055c3b0
mov edi, eax
jmp 0x55e1ee
cmp ecx, 0x14
jne 0x55d5f4
xor eax, eax
mov dword [ebp - 0x1c], edi
cmp byte [ebp + 0xc], al
xorps xmm0, xmm0
push 1
setne al
movq qword [ebp - 0x24], xmm0
add eax, 8
push ecx
mov ecx, esi
mov dword [ebp - 0x2f4], eax
call fcn.0057bd60
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc570
push 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xe
call fcn.005dbed0
lea ecx, [ebp - 0x24]
call fcn.005dc3a0
cmp eax, 3
jle 0x55d5a1
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0055e500
mov edi, eax
push ecx
mov ecx, esi
call fcn.0057bf90
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc510
push 0
lea ecx, [ebp - 0x24]
call fcn.005dbed0
lea ecx, [ebp - 0x24]
call fcn.005dc3a0
cmp eax, 3
jle 0x55d5e7
push dword [ebp - 0x2f0]
lea ecx, [ebp - 0x24]
push dword [ebp - 0x2f4]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0055c3b0
add edi, eax
lea ecx, [ebp - 0x24]
call fcn.005dc430
jmp 0x55e1ee
cmp ecx, 0x15
je 0x55de6f
cmp ecx, 0x16
je 0x55de6f
cmp ecx, 0x17
je 0x55de6f
cmp ecx, 0x18
jne 0x55d66d
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
add eax, 0xc
push eax
push str.HKLMSOFTWAREPoliciesGoogleChrome
mov dword [ebp - 0x2f4], eax
call fcn.0055e500
cmp byte [esi + 0x48], 0
mov edi, eax
je 0x55d64e
push dword [ebp - 0x2f4]
mov ecx, esi
push str.HKLMSOFTWAREWow6432NodePoliciesGoogleChrome
call fcn.0055e500
add edi, eax
push dword [ebp - 0x2f0]
mov ecx, esi
push dword [ebp - 0x2f4]
push 0x64eb68
call fcn.0055c3b0
add edi, eax
jmp 0x55e1ee
cmp ecx, 0x19
je 0x55dad5
cmp ecx, 0x1a
je 0x55dad5
cmp ecx, 0x1b
je 0x55dad5
cmp ecx, 0x1c
je 0x55dad5
cmp ecx, 0x1d
je 0x55d702
cmp ecx, 0x1e
je 0x55d702
cmp ecx, 0x1f
je 0x55d702
cmp ecx, 0x20
jne 0x55e1ee
xor eax, eax
mov ecx, esi
cmp byte [ebp + 0xc], al
setne al
add eax, 0xc
push eax
push str.HKLMSOFTWAREPoliciesMicrosoftEdge
mov dword [ebp - 0x2f4], eax
call fcn.0055e500
cmp byte [esi + 0x48], 0
mov edi, eax
je 0x55d6e3
push dword [ebp - 0x2f4]
mov ecx, esi
push str.HKLMSOFTWAREWow6432NodePoliciesMicrosoftEdge
call fcn.0055e500
add edi, eax
push dword [ebp - 0x2f0]
mov ecx, esi
push dword [ebp - 0x2f4]
push 0x64ed08
call fcn.0055c3b0
add edi, eax
jmp 0x55e1ee
push 0x250
xorps xmm0, xmm0
lea eax, [ebp - 0x2ec]
push 0
movups xmmword [ebp - 0x9c], xmm0
push eax
mov dword [ebp - 0x9c], 0xffffffff
call fcn.00420090
add esp, 0xc
mov eax, dword [ebp - 0x2f8]
xor edx, edx
cmp eax, 0x1d
mov dword [ebp - 4], 0x18
mov ecx, 0x64ea58
cmovne ecx, edx
cmp eax, 0x1e
jne 0x55d757
mov dword [ebp - 0x2f4], 0x64ea70
jmp 0x55d768
cmp eax, 0x1f
mov edx, str.Extensions
cmovne edx, ecx
mov dword [ebp - 0x2f4], edx
xor ecx, ecx
mov dword [ebp - 0x28], 0
cmp eax, 0x1f
mov edx, 8
xorps xmm0, xmm0
cmove ecx, edx
movq qword [ebp - 0x30], xmm0
xor eax, eax
mov edx, 2
cmp byte [ebp + 0xc], al
cmovne eax, edx
or ecx, eax
mov dword [ebp - 0x2f8], ecx
lea ecx, [ebp - 0x30]
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x24]
movq qword [ebp - 0x24], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x3c]
movq qword [ebp - 0x3c], xmm0
call fcn.005dc5e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MicrosoftEdgeUser_Data_
push ecx
mov ecx, esi
mov byte [ebp - 4], 0x1b
call fcn.0057c1c0
push eax
push 1
push ecx
mov ecx, esi
call fcn.0057c260
push eax
lea ecx, [ebp - 0x30]
call fcn.005dc260
mov ecx, eax
call fcn.005dad50
mov ecx, eax
call fcn.005da780
mov ecx, dword [ebp - 0x2f0]
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x18], 0
cmp dword [ecx], 0
jbe 0x55dabd
xor edx, edx
mov dword [ebp - 0x14], edx
nop dword [eax]
mov esi, dword [ecx + 4]
lea ecx, [ebp - 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624384
add esi, edx
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc200
lea ecx, [ebp - 0x24]
call fcn.005dc190
mov ecx, dword [ebp - 0x9c]
mov esi, eax
cmp ecx, 0xffffffff
je 0x55d891
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x2ec]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, eax
mov dword [ebp - 0x9c], edx
cmp edx, 0xffffffff
je 0x55d946
mov ecx, 5
mov dword [ebp - 0x98], ecx
nop dword [eax + eax]
cmp word [ebp - 0x2c0], 0x2e
jne 0x55d8e6
mov ax, word [ebp - 0x2be]
test ax, ax
je 0x55d910
cmp ax, 0x2e
jne 0x55d8e6
cmp word [ebp - 0x2bc], 0
je 0x55d910
test ecx, ecx
je 0x55d946
mov eax, dword [ebp - 0x2ec]
test cl, 1
je 0x55d8fc
test eax, 0x400
jne 0x55d910
test cl, 2
je 0x55d907
test al, 0x10
je 0x55d946
jmp 0x55d910
test cl, 4
je 0x55d946
test al, 0x10
jne 0x55d946
lea eax, [ebp - 0x2ec]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x55d930
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 0x9c]
jmp 0x55d8c0
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x9c], 0xffffffff
push 1
lea ecx, [ebp - 0x24]
call fcn.005dadc0
cmp dword [ebp - 0x9c], 0xffffffff
je 0x55da99
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x2f4]
lea eax, [ebp - 0x2c0]
push 0x624284
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x55d9ae
lea edi, [eax + 1]
jmp 0x55d9ca
push dword [ebp - 0x2f8]
lea ecx, [ebp - 0x3c]
call fcn.005dc190
mov ecx, dword [ebp - 0x2fc]
push eax
call fcn.0055e500
add edi, eax
mov eax, dword [ebp - 0x9c]
cmp eax, 0xffffffff
je 0x55da99
lea ecx, [ebp - 0x2ec]
push ecx
push eax
call esi
test eax, eax
je 0x55da7f
mov edx, dword [ebp - 0x9c]
cmp edx, 0xffffffff
je 0x55da99
nop word [eax + eax]
cmp word [ebp - 0x2c0], 0x2e
jne 0x55da26
mov ax, word [ebp - 0x2be]
test ax, ax
je 0x55da69
cmp ax, 0x2e
jne 0x55da26
cmp word [ebp - 0x2bc], 0
je 0x55da69
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x55d963
mov ecx, dword [ebp - 0x2ec]
test al, 1
je 0x55da46
test ecx, 0x400
jne 0x55da69
test al, 2
je 0x55da55
test cl, 0x10
je 0x55d963
jmp 0x55da69
test al, 4
je 0x55d963
test ecx, 0x10
jne 0x55d963
lea eax, [ebp - 0x2ec]
push eax
push edx
call esi
test eax, eax
je 0x55da7f
mov edx, dword [ebp - 0x9c]
jmp 0x55da00
push dword [ebp - 0x9c]
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
call esi
mov dword [ebp - 0x9c], 0xffffffff
jmp 0x55da9f
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2f0]
inc eax
mov edx, dword [ebp - 0x14]
add edx, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp eax, dword [ecx]
jb 0x55d840
lea ecx, [ebp - 0x3c]
call fcn.005dc430
lea ecx, [ebp - 0x24]
call fcn.005dc430
lea ecx, [ebp - 0x30]
jmp 0x55e1db
xor edx, edx
mov dword [ebp - 0x2f8], 2
cmp ecx, 0x1a
mov eax, 8
cmove edx, eax
xor eax, eax
cmp byte [ebp + 0xc], al
cmovne eax, dword [ebp - 0x2f8]
or edx, eax
xor eax, eax
mov dword [ebp - 0x304], edx
cmp ecx, 0x19
mov edx, str._addons.json
cmovne edx, eax
cmp ecx, 0x1a
jne 0x55db1b
mov dword [ebp - 0x18], 0x64ebc4
jmp 0x55db37
cmp ecx, 0x1b
jne 0x55db29
mov dword [ebp - 0x18], str._search.json
jmp 0x55db37
cmp ecx, 0x1c
mov eax, 0x64ebf8
cmovne eax, edx
mov dword [ebp - 0x18], eax
xorps xmm0, xmm0
mov dword [ebp - 0x34], edi
lea ecx, [ebp - 0x3c]
movq qword [ebp - 0x3c], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0x48]
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
movq qword [ebp - 0x48], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x30], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x24]
movq qword [ebp - 0x24], xmm0
call fcn.005dc5e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MozillaFirefox_
push ecx
mov ecx, esi
mov byte [ebp - 4], 0x16
call fcn.0057c1c0
push eax
push 1
push ecx
mov ecx, esi
call fcn.0057be80
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc260
mov ecx, eax
call fcn.005dad50
mov ecx, eax
call fcn.005da780
mov edx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f8], 0
cmp dword [edx], 0
jbe 0x55de4a
xor eax, eax
mov dword [ebp - 0x14], eax
nop dword [eax]
mov esi, dword [edx + 4]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.profiles.ini
add esi, eax
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
push 0x38
lea eax, [ebp - 0x8c]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x8c]
call fcn.005dd680
sub esp, 0xc
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2f4], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x630470
push 0
call fcn.005db290
mov ecx, eax
call fcn.005da510
push 0
push str.Path
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db160
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x55de17
push 0xa
push 1
push 1
push 1
push 0x624518
lea ecx, [ebp - 0x24]
call fcn.005daa70
neg eax
lea ecx, [ebp - 0x30]
sbb eax, eax
inc eax
push eax
push str.IsRelative
call fcn.005dc190
push eax
lea ecx, [ebp - 0x8c]
call fcn.005dd290
test eax, eax
je 0x55ddb4
mov eax, dword [ebp - 0x2f0]
lea ecx, [ebp - 0x3c]
sub esp, 0xc
mov esi, dword [eax + 4]
add esi, dword [ebp - 0x14]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
push 0
push 0
push 0x624284
push 0x6287bc
lea ecx, [ebp - 0x24]
call fcn.005da270
mov ecx, eax
call fcn.005da510
push 0
push 0
push 0x624284
push 0x624b44
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.005da780
mov ecx, eax
call fcn.005da270
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x55ddaf
push dword [ebp - 0x304]
lea ecx, [ebp - 0x24]
call fcn.005dc190
mov ecx, dword [ebp - 0x2fc]
push eax
call fcn.0055e500
add edi, eax
jmp 0x55ddb4
mov edi, 1
mov eax, dword [ebp - 0x2f4]
lea ecx, [ebp - 0x30]
sub esp, 0xc
inc eax
mov dword [ebp - 0x2f4], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x630470
push eax
call fcn.005db290
mov ecx, eax
call fcn.005da510
push 0
push str.Path
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db160
mov ecx, eax
call fcn.005dbeb0
test al, al
je 0x55dcc1
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x16
call fcn.005dd5d0
mov ecx, dword [ebp - 0x2f8]
mov edx, dword [ebp - 0x2f0]
inc ecx
mov eax, dword [ebp - 0x14]
add eax, 0xc
mov dword [ebp - 0x2f8], ecx
mov dword [ebp - 0x14], eax
cmp ecx, dword [edx]
jb 0x55dc00
lea ecx, [ebp - 0x24]
call fcn.005dc430
lea ecx, [ebp - 0x30]
call fcn.005dc430
lea ecx, [ebp - 0x48]
call fcn.005dc430
lea ecx, [ebp - 0x3c]
call fcn.005dc430
jmp 0x55e1ee
push 0x250
xorps xmm0, xmm0
lea eax, [ebp - 0x2ec]
push 0
movups xmmword [ebp - 0x9c], xmm0
push eax
mov dword [ebp - 0x9c], 0xffffffff
call fcn.00420090
add esp, 0xc
mov eax, dword [ebp - 0x2f8]
xor edx, edx
cmp eax, 0x15
mov dword [ebp - 4], 0xf
mov ecx, 0x64ea58
cmovne ecx, edx
cmp eax, 0x16
jne 0x55dec4
mov dword [ebp - 0x2f8], 0x64ea70
jmp 0x55ded5
cmp eax, 0x17
mov edx, str.Extensions
cmovne edx, ecx
mov dword [ebp - 0x2f8], edx
xor ecx, ecx
mov dword [ebp - 0x40], 0
cmp eax, 0x17
mov edx, 8
xorps xmm0, xmm0
cmove ecx, edx
movq qword [ebp - 0x48], xmm0
xor eax, eax
mov edx, 2
cmp byte [ebp + 0xc], al
cmovne eax, edx
or ecx, eax
mov dword [ebp - 0x304], ecx
lea ecx, [ebp - 0x48]
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x24]
movq qword [ebp - 0x24], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x3c]
movq qword [ebp - 0x3c], xmm0
call fcn.005dc5e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.GoogleChromeUser_Data_
push ecx
mov ecx, esi
mov byte [ebp - 4], 0x12
call fcn.0057c1c0
push eax
push 1
push ecx
mov ecx, esi
call fcn.0057c260
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc260
mov ecx, eax
call fcn.005dad50
mov ecx, eax
call fcn.005da780
mov ecx, dword [ebp - 0x2f0]
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x2f4], 0
cmp dword [ecx], 0
jbe 0x55e1c8
xor edx, edx
mov dword [ebp - 0x18], edx
nop dword [eax]
mov esi, dword [ecx + 4]
lea ecx, [ebp - 0x48]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624384
add esi, edx
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc200
lea ecx, [ebp - 0x24]
call fcn.005dc190
mov ecx, dword [ebp - 0x9c]
mov esi, eax
cmp ecx, 0xffffffff
je 0x55e001
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x2ec]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, eax
mov dword [ebp - 0x9c], edx
cmp edx, 0xffffffff
je 0x55e089
mov ecx, 5
mov dword [ebp - 0x98], ecx
nop word [eax + eax]
cmp word [ebp - 0x2c0], 0x2e
jne 0x55e05e
mov ax, word [ebp - 0x2be]
test ax, ax
je 0x55e11b
cmp ax, 0x2e
jne 0x55e05e
cmp word [ebp - 0x2bc], 0
je 0x55e11b
test ecx, ecx
je 0x55e089
mov eax, dword [ebp - 0x2ec]
test cl, 1
je 0x55e078
test eax, 0x400
jne 0x55e11b
test cl, 2
je 0x55e10a
test al, 0x10
jne 0x55e11b
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
push 1
lea ecx, [ebp - 0x24]
call fcn.005dadc0
cmp dword [ebp - 0x9c], 0xffffffff
je 0x55e1a4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x2f8]
lea eax, [ebp - 0x2c0]
push 0x624284
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x55e15b
push dword [ebp - 0x304]
lea ecx, [ebp - 0x3c]
call fcn.005dc190
mov ecx, dword [ebp - 0x2fc]
push eax
call fcn.0055e500
add edi, eax
jmp 0x55e160
test cl, 4
je 0x55e089
test al, 0x10
jne 0x55e089
lea eax, [ebp - 0x2ec]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x55e13e
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 0x9c]
jmp 0x55e030
push dword [ebp - 0x9c]
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
call esi
mov dword [ebp - 0x9c], 0xffffffff
jmp 0x55e08f
mov edi, 1
mov eax, dword [ebp - 0x9c]
cmp eax, 0xffffffff
je 0x55e1a4
lea ecx, [ebp - 0x2ec]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x55e192
lea ecx, [ebp - 0x2ec]
call fcn.004011a0
test al, al
jne 0x55e0a6
jmp 0x55e1a4
push dword [ebp - 0x9c]
call esi
mov dword [ebp - 0x9c], 0xffffffff
mov eax, dword [ebp - 0x2f4]
mov ecx, dword [ebp - 0x2f0]
inc eax
mov edx, dword [ebp - 0x18]
add edx, 0xc
mov dword [ebp - 0x2f4], eax
mov dword [ebp - 0x18], edx
cmp eax, dword [ecx]
jb 0x55dfb0
lea ecx, [ebp - 0x3c]
call fcn.005dc430
lea ecx, [ebp - 0x24]
call fcn.005dc430
lea ecx, [ebp - 0x48]
call fcn.005dc430
mov eax, dword [ebp - 0x9c]
cmp eax, 0xffffffff
je 0x55e1ee
push eax
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 0xc