Function at 0x4e69a0
Capabilities:
Check http status code
Check if file exists
Get graphical window text
Manipulate safe mode programs
Shutdown system

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4f92
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x508
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x448], esi
push str.Tools_And_Tweaks
lea ecx, [esi + 0x1448]
call fcn.005dc510
push 2
push str.Tools_and_tweaks
mov ecx, esi
call fcn.0045f680
mov ecx, esi
mov dword [ebp - 0x48c], eax
call fcn.0043e530
test al, al
je 0x4ee086
mov edi, dword [esi + 0x14e4]
lea ecx, [esi + 0x119c]
push 1
push str.https:__www.carifred.com_uvk_help_toolsandtweaks.php
mov dword [ebp - 0x4ac], edi
call fcn.005dc260
push 0x2e
push 0x78
push 2
push 5
mov ecx, esi
call fcn.0045fec0
movsd xmm1, qword [0x6edb28]
mov ecx, edi
push 0
push str.Arial
push 1
push 0x320
call fcn.005c42b0
push dword [esi + 0x1438]
mov ecx, edi
call fcn.005c44a0
push 0
mov ecx, edi
call fcn.005c4340
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1e
push 0xc8
push 0xa
push 0x82
push str.Tools_and_tweaks
mov ecx, edi
call fcn.005c0890
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Show_online_help__F1_
push 0x1e
push 0x50
push 0xa
push 0x21c
push 0x7d
push str.Help
call fcn.0045fd50
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Go_back_to_the_home_page__Esc_
push 0x1e
push 0x64
push 0xa
push 0x276
push 0xb3
push str.Home
mov dword [esi + 0x11bc], eax
call fcn.0045fd50
xorps xmm0, xmm0
mov dword [ebp - 0x4a8], eax
lea ecx, [ebp - 0x3c]
movq qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x34], 0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x5c]
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
movq qword [ebp - 0x5c], xmm0
call fcn.005dc5e0
push 0
push 0xffffffffffffffff
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x7c]
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerRunHistory
mov dword [ebp - 0x7c], 0
call fcn.005d6a80
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb8]
xorps xmm0, xmm0
mov dword [ebp - 0xb0], 0
movq qword [ebp - 0xb8], xmm0
call fcn.005d6ac0
push 0
push str.Arial
push 1
mov byte [ebp - 4], 3
mov ecx, edi
movsd xmm1, qword [0x6edaf8]
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
mov ecx, edi
call fcn.005c44a0
push 0x400
mov ecx, edi
call fcn.005c4340
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1ef
push 0x2e4
push 0x32
push 5
mov ecx, edi
call fcn.005bfc70
push 0
mov ecx, edi
mov dword [ebp - 0x480], eax
call fcn.005c4340
push str.Run_Open
push 0
push dword [ebp - 0x480]
mov ecx, edi
call fcn.005bfb00
push 0x10
push 0x10
push 0
push 0
push 0
push 0x97
mov ecx, esi
call fcn.00436420
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, edi
call fcn.005be310
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x6e
push 0x2d0
push 0xa
push 5
push str.Run_a_program__open_a_file_or_internet_location__supports_drag__drop_
mov ecx, edi
call fcn.005c0950
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0x29e
push 0x28
push 0x1e
push 0
mov ecx, edi
call fcn.005c1650
movsd xmm0, qword [0x6edaf8]
sub esp, 8
mov ecx, edi
mov dword [ebp - 0x470], eax
movsd qword [esp], xmm0
push 0
push 0
push 0
push 0x190
push 0xffffffffffffffff
call fcn.005beb10
push dword [ebp - 0x470]
mov ecx, edi
call fcn.005c5730
mov dword [ebp - 0x474], eax
xor edi, edi
mov esi, eax
nop dword [eax + eax]
push edi
lea ecx, [ebp - 0x3c]
call fcn.005db320
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6838d8
lea ecx, [ebp - 0x3c]
call fcn.005da510
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x7c]
call fcn.005d6740
test al, al
je 0x4e6ced
lea ecx, [ebp - 0x5c]
call fcn.005dc3a0
test eax, eax
je 0x4e6ce7
lea ecx, [ebp - 0x5c]
call fcn.005dc190
push eax
push 0
push 0x143
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
inc edi
cmp edi, 0x1e
jl 0x4e6c80
mov esi, dword [ebp - 0x448]
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Delete_the_applications_run_history.
push 0x1c
push 0x87
push 0x50
push 0x3c
push 0x72
push str.Delete_history
call fcn.0045fd50
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Browse_to_the_file_you_wish_to_run.
push 0x1c
push 0x87
push 0x50
push 0xd7
push 0x78
push str.Browse...
mov dword [ebp - 0x514], eax
call fcn.0045fd50
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Run_or_open_the_selected_file__folder_or_internet_location__Enter_.
push 0x1c
push 0x87
push 0x50
push 0x172
push 0x9c
push str.Run___Open
mov dword [ebp - 0x510], eax
call fcn.0045fd50
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Google_the_typed_text_instead_of_running.
push 0x1c
push 0x87
push 0x50
push 0x20d
push 0x7c
push str.Google_search
mov dword [ebp - 0x4b0], eax
call fcn.0045fd50
mov edi, dword [ebp - 0x4ac]
mov ecx, edi
push 0x10020
push 0x1000000d
push 0x14a
push 0x2d0
push 0x82
push 5
push 0x627824
push str.Name_nCommand_nCMD_Show
mov dword [ebp - 0x50c], eax
call fcn.005c0620
movsd xmm0, qword [0x6edaf8]
sub esp, 8
mov ecx, edi
mov dword [ebp - 0x494], eax
movsd qword [esp], xmm0
push 0
push 0
push 0
push 0x190
push 0xffffffffffffffff
call fcn.005beb10
push 0
push str.Double_click_an_item_to_automatically_enable_and_run_it.
push 0xffffffffffffffff
mov ecx, esi
call fcn.0045b370
push dword [ebp - 0x494]
mov ecx, edi
call fcn.005c5730
push 0
push 0
push 0x108e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
movsd xmm0, qword [esi + 8]
xor eax, eax
comisd xmm0, xmmword [0x6edab8]
push 0xffffffffffffffff
push 0
mov ecx, 8
cmovae eax, ecx
mov ecx, edi
push eax
push 0xffffffffffffffff
push 0
push str.Enable_and_run_tools__double_click_to_run
push 0
push dword [ebp - 0x494]
call fcn.005bbd80
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Action_center
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xbd
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._wscui.cpl
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Add_a_device
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xe9
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push str.DevicePairingWizard.exe
push 0x624284
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Add_network_location
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xef
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
add eax, 0x1290
push str._rundll32.exe_shwebsvc.dll_AddNetPlaceRunDll
push 0
mov ecx, eax
mov dword [ebp - 0x460], eax
call fcn.0057c540
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Add_Remove_programs
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xbc
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._appwiz.cpl
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Advanced_user_manager
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xb8
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._netplwiz.dll_UsersRunDll
push 0x627e5c
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Blue_screen_viewer
mov ecx, edi
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov esi, eax
mov eax, dword [ebp - 0x448]
push 0
add eax, 0x150
push 0
mov dword [ebp - 0x464], eax
mov ecx, eax
push str._bluescreenviewBlueScreenView.exe
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 0x20
push 0x20
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005baf80
mov ecx, dword [ebp - 0x464]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._bluescreenviewBlueScreenView.exe
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Certificate_manager
mov ecx, edi
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov esi, eax
lea ecx, [ebp - 0x3c]
mov eax, dword [ebp - 0x448]
push 0
push str.certmgr.dll
push dword [eax + 0x24]
call fcn.005dc200
push 0x20
push 0x20
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005baf80
push 1
push str.Certificate_manager
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Change_UAC_settings
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xbb
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UserAccountControlSettings.exe
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Command_prompt
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xb4
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.cmd.exe
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Computer_management
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xba
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.mmc.exe_compmgmt.msc__s
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Control_panel
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xb5
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push str.shell32.dll_Control_RunDLL
push str._rundll32.exe
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Date_and_time
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xe1
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._timedate.cpl__0
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Desktop_icon_settings
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xe2
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._desk.cpl__0
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Device_manager
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xb9
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._devmgmt.msc
push str.mmc.exe
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Disk_cleanup
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xc3
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [eax + 0x1c]
push str.cleanmgr.exe__D
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Disk_defragmenter
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0x71
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov ecx, dword [ebp - 0x448]
mov edx, str.dfrgui.exe
movsd xmm0, qword [0x6edac0]
mov eax, str.mmc.exe_dfrg.msc
push 0
push 0
comisd xmm0, xmmword [ecx + 8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
cmovbe eax, edx
push eax
push dword [ecx + 0x24]
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Disk_management
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xf6
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push str.mmc.exe_diskmgmt.msc
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Diskpart
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xb4
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__k_Diskpart
push str.cmd.exe
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Display_settings
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xee
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._desk.cpl
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Driver_Verifier__sigverif_
mov ecx, edi
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov esi, eax
lea ecx, [ebp - 0x3c]
mov eax, dword [ebp - 0x448]
push 0
push str._sigverif.exe
push dword [eax + 0x24]
call fcn.005dc200
push 0x20
push 0x20
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005baf80
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Sigverif.exe
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Event_viewer
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xc0
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.mmc.exe_eventvwr.msc__s
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Folder_options
mov ecx, edi
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov esi, eax
lea ecx, [ebp - 0x3c]
mov eax, dword [ebp - 0x448]
push 0
push str.explorer.exe
push dword [eax + 0x20]
call fcn.005dc200
push 0x20
push 0x20
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005baf80
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._shell32.dll_Options_RunDLL
push 0x627e5c
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Fonts
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xf3
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
mov ecx, dword [ebp - 0x460]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Rundll32_Shell32.dll_SHHelpShortcuts_RunDLL_FontsFolder
push 0
call fcn.0057c540
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Forgotten_password_wizzard
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xf1
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x460]
push 0
push 0
push 0
push str.RunDll32.exe_keymgr.dll_PRShowSaveWizardExW
push 0
call fcn.0057c540
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.God_mode
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xb5
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
mov ecx, dword [ebp - 0x460]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.GodMode.ED7BA470_8E54_465E_825C_99712043E01C
push 0
call fcn.0057bbe0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Group_Policy_editor
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xc8
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.mmc.exe_gpedit.msc__s
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Internet_settings
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xc2
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._inetcpl.cpl
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Keyboard_properties
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xe4
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._main.cpl__1
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Magnifier
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xd2
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Magnify.exe
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Math_input_panel
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xd3
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Common_FilesMicrosoft_SharedInkmip.exe
push ecx
mov ecx, dword [ebp - 0x460]
push 0
call fcn.0057c120
add esp, 4
lea ecx, [ebp - 0x3c]
push eax
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Mouse_properties
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xe5
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._main.cpl__0
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Network_connections
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xe6
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._ncpa.cpl
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Notification_settings
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xf0
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
mov ecx, dword [ebp - 0x460]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Rundll32.exe_shell32.dll_Options_RunDLL_5
push 0
call fcn.0057c540
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.On_screen_keyboard
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xd4
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
mov ecx, dword [ebp - 0x460]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.osk.exe
push 0
call fcn.0057c540
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Passwords_manager
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xc6
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._keymgr.dll_KRShowKeyMgr
push 0x627e5c
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Performance_monitor
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xa1
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push str.mmc.exe_perfmon.msc
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Personalization
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xed
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._desk.cpl__2
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Power_options
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xe7
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._powercfg.cpl
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Power_shell
mov ecx, edi
call fcn.005bbb80
mov esi, eax
push 0
mov ecx, dword [ebp - 0x448]
push 0x20
push 0x20
push 0xc4
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push 0x6847c4
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Printers
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xf2
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
mov ecx, dword [ebp - 0x460]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Rundll32_Shell32.dll_SHHelpShortcuts_RunDLL_PrintersFolder
push 0
call fcn.0057c540
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Problem_steps_recorder
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xc5
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
mov ecx, dword [ebp - 0x460]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.psr.exe
push 0
call fcn.0057c540
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Programs_and_features
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xde
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._appwiz.cpl__0
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Quick_assist
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xd6
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.quickassist.exe
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Region
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xe8
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._intl.cpl__1
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Registry_editor
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0x8e
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push str._regedit.exe
push dword [eax + 0x20]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Reliability_monitor
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xa1
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.perfmon.exe__rel
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Resource_monitor
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xa1
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.perfmon.exe__res
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Safely_remove_hardware
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xea
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._hotplug.dll
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Security_and_maintenance
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xec
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._wscui.cpl
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Security_policy_editor
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xd1
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov ecx, dword [ebp - 0x448]
push 0
push 0
push 0
mov eax, dword [ecx + 0x24]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push str._secpol.msc_
push eax
push str.mmc.exe__
push eax
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Service_manager
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xc7
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.mmc.exe_services.msc
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Set_up_backup
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xe3
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
mov ecx, dword [ebp - 0x460]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._sdclt.exe__configure
push 0
call fcn.0057c540
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
mov eax, dword [ebp - 0x448]
movsd xmm0, qword [eax + 8]
comisd xmm0, xmmword [0x6edac8]
jbe 0x4e85ca
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Settings
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0x106
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str.ms_settings:
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.SFX_creator__IExpress.exe_
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xd0
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.IExpress.exe
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Sigcheck__tv
mov ecx, edi
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov esi, eax
lea ecx, [ebp - 0x3c]
mov eax, dword [ebp - 0x448]
push 0
push str._sigverif.exe
push dword [eax + 0x24]
call fcn.005dc200
push 0x20
push 0x20
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005baf80
push 0
mov ecx, dword [ebp - 0x464]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.cleanup_tool_sigcheck.exe___tv
call fcn.005dc190
push eax
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push str.cmd.exe__k__
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Snipping_tool
mov ecx, edi
call fcn.005bbb80
mov esi, dword [ebp - 0x448]
mov ecx, esi
push 0
push 0x20
push 0x20
push 0xd7
mov dword [ebp - 0x450], eax
call fcn.00436420
push eax
push eax
push dword [ebp - 0x450]
mov ecx, edi
push 0xffffffffffffffff
call fcn.005ba970
movsd xmm0, qword [0x6edb18]
lea ecx, [ebp - 0x3c]
comisd xmm0, xmmword [esi + 8]
jbe 0x4e876a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SnippingTool.exe
push dword [esi + 0x24]
call fcn.005dc200
jmp 0x4e8776
push 1
push str.ms_screensketch:
call fcn.005dc260
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push dword [ebp - 0x450]
mov ecx, edi
push 0xffffffffffffffff
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Sound_control_panel
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xe0
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._Mmsys.cpl__0
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Start_menu_settings
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xdf
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
mov ecx, dword [ebp - 0x460]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Rundll32.exe_shell32.dll_Options_RunDLL_3
push 0
call fcn.0057c540
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.System_configuration__msconfig_
mov ecx, edi
call fcn.005bbb80
mov esi, dword [ebp - 0x448]
mov ecx, esi
push 0
push 0x20
push 0x20
push 0xb7
mov dword [ebp - 0x450], eax
call fcn.00436420
push eax
push eax
push dword [ebp - 0x450]
mov ecx, edi
push 0xffffffffffffffff
call fcn.005ba970
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MSConfig.exe
push dword [esi + 0x24]
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e8993
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.PCHealthHelpCtrBinariesMSConfig.exe
push dword [esi + 0x20]
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoftShared_ToolsMSConfig
push 0
lea ecx, [esi + 0x1290]
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc200
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x78], 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x78]
call fcn.005d6a80
push 0
push 0xffffffffffffffff
push str.HKLMSOFTWAREMicrosoftShared_ToolsMSConfig
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 4
call fcn.005d6a30
movsd xmm0, qword [0x6edab8]
comisd xmm0, xmmword [esi + 8]
jbe 0x4e8987
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push 1
push 0x62439c
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionApp_PathsMSCONFIG.EXE
lea ecx, [ebp - 0x78]
call fcn.005d5e20
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 3
call fcn.005d69e0
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push dword [ebp - 0x450]
mov ecx, edi
push 0xffffffffffffffff
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.System_information
mov ecx, edi
call fcn.005bbb80
push 0
push 0x20
push 0x20
push 0xbf
mov ecx, esi
mov dword [ebp - 0x450], eax
call fcn.00436420
push eax
push eax
push dword [ebp - 0x450]
mov ecx, edi
push 0xffffffffffffffff
call fcn.005ba970
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.msinfo32.exe
push dword [esi + 0x24]
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e8a4d
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.Common_FilesMicrosoft_SharedMSInfomsinfo32.exe
push ecx
push eax
lea ecx, [esi + 0x1290]
call fcn.0057c120
add esp, 4
lea ecx, [ebp - 0x3c]
push eax
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push dword [ebp - 0x450]
mov ecx, edi
push 0xffffffffffffffff
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.System_properties
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xc1
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._sysdm.cpl
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.System_restore
mov ecx, edi
call fcn.005bbb80
mov esi, dword [ebp - 0x448]
mov ecx, esi
push 0
push 0x20
push 0x20
push 0xa2
mov dword [ebp - 0x450], eax
call fcn.00436420
push eax
push eax
push dword [ebp - 0x450]
mov ecx, edi
push 0xffffffffffffffff
call fcn.005ba970
movsd xmm0, qword [esi + 8]
lea ecx, [ebp - 0x3c]
comisd xmm0, xmmword [0x6edab8]
mov eax, dword [esi + 0x24]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
jb 0x4e8b2b
push 0
push str._rstrui.exe
jmp 0x4e8b35
push str._rstrui.exe
push str.Restore
push eax
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push dword [ebp - 0x450]
mov ecx, edi
push 0xffffffffffffffff
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Tablet_PC_settings
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xdd
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._tabletpc.cpl__1
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Taskbar_settings
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xdf
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
mov ecx, dword [ebp - 0x460]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Rundll32.exe_shell32.dll_Options_RunDLL_1
push 0
call fcn.0057c540
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Task_manager
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xb6
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._taskmgr.exe
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Task_scheduler
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xd8
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x460]
push str._taskschd.msc
push 0
call fcn.0057c540
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.User_accounts
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xeb
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._nusrmgr.cpl
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Windows_features
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xde
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._appwiz.cpl__2
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Windows_firewall
mov ecx, edi
call fcn.005bbb80
mov esi, eax
mov ecx, dword [ebp - 0x448]
push 0
push 0x20
push 0x20
push 0xcf
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 1
push str._firewall.cpl
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Windows_Installer_cleanup
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x464]
mov esi, eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.cleanup_toolmsicuu.exe
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 0x20
push 0x20
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005baf80
mov ecx, dword [ebp - 0x464]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.cleanup_toolmsicuu.exe
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Windows_to_go_creator
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xd5
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.pwcreator.exe
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.Windows_troubleshooting
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xbe
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x3c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Microsoft.Troubleshooting
push str.control.exe__name
push dword [eax + 0x24]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str.WordPad
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 0
push 0x20
push 0x20
push 0xd9
call fcn.00436420
push eax
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba970
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Windows_NTAccessorieswordpad.exe
push ecx
mov ecx, dword [ebp - 0x460]
push 0
call fcn.0057c120
add esp, 4
lea ecx, [ebp - 0x3c]
push eax
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba4f0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0
push str..NET_Framework_cleanup_tool
mov ecx, edi
call fcn.005bbb80
mov ecx, dword [ebp - 0x464]
mov esi, eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.cleanup_toolcleanup.exe
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 0x20
push 0x20
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
push 0xffffffffffffffff
mov ecx, edi
call fcn.005baf80
push 1
push 0xffffffffffffffff
mov ecx, edi
call fcn.005bb910
push str.File_tools
push 1
push dword [ebp - 0x480]
mov ecx, edi
call fcn.005bfb00
mov esi, dword [ebp - 0x448]
mov ecx, esi
push 0x10
push 0x10
push 0
push 0
push 0
push 0x78
call fcn.00436420
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, edi
call fcn.005be310
movsd xmm1, qword [0x6edaf8]
mov ecx, edi
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x78
push 0x2d0
push 0x14
push 5
push str.Manage_a_file__drag__drop_supported_
mov ecx, edi
call fcn.005c0950
movsd xmm0, qword [0x6edaf8]
sub esp, 8
mov ecx, edi
movsd qword [esp], xmm0
push 0
push 0
push 0
push 0x190
push 0xffffffffffffffff
call fcn.005beb10
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x32
push 0x39
push 0x14
push str.Path:
mov ecx, edi
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x16
push 0x1fe
push 0x36
push 0x46
push 0
mov ecx, edi
call fcn.005c0a40
push edi
push ecx
mov dword [ebp - 0x490], eax
mov dword [esp], 0x41500000
push str.Locate_the_file_using_the_Windows_file_explorer
push 0x1a
push 0x7d
push 0x34
push 0x249
push 0x78
push str.Browse
mov ecx, esi
call fcn.0045fd50
push edi
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.View_information_on_the_selected_file
push 0x1c
push 0xa0
push 0x60
push 0x23
push 0x80
push str.File_information
mov dword [ebp - 0x508], eax
call fcn.0045fd50
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x5a
push 0x68
push 0xe6
push str.More_actions
mov ecx, edi
mov dword [ebp - 0x504], eax
call fcn.005c0890
push 0
push 0xffffffffffffffff
push 0x10000043
push 0x19
push 0xdc
push 0x63
push 0x145
push str.VirusTotal_report_nGoogle_file_name_nLock_file__deny_access__nUnlock_file__grant_access__nUnlock_and_delete_file_nScan_with_the_system_file_checker
mov ecx, edi
call fcn.005c1540
push 0x48
mov dword [ebp - 0x47c], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push eax
push str.IMAGE
push 0xb1
push dword [esi + 4]
mov ecx, edi
mov dword [ebp - 0x454], eax
push 0
push dword [ebp - 0x47c]
call fcn.005be260
mov eax, dword [ebp - 0x454]
mov ecx, edi
push eax
push eax
push str.IMAGE
push 0x7c
push dword [esi + 4]
push 1
push dword [ebp - 0x47c]
call fcn.005be260
mov eax, dword [ebp - 0x454]
mov ecx, edi
push eax
push eax
push str.IMAGE
push 0x83
push dword [esi + 4]
push 2
push dword [ebp - 0x47c]
call fcn.005be260
mov eax, dword [ebp - 0x454]
push eax
push eax
push str.IMAGE
push 0xa8
push dword [esi + 4]
push 3
push dword [ebp - 0x47c]
mov ecx, edi
call fcn.005be260
mov eax, dword [ebp - 0x454]
mov ecx, edi
push eax
push eax
push str.IMAGE
push 0x72
push dword [esi + 4]
push 4
push dword [ebp - 0x47c]
call fcn.005be260
mov eax, dword [ebp - 0x454]
mov ecx, edi
push eax
push eax
push str.IMAGE
push 0x99
push dword [esi + 4]
push 5
push dword [ebp - 0x47c]
call fcn.005be260
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Perform_the_selected_action_with_the_selected_file
push 0x1c
push 0x96
push 0x60
push 0x230
push 0x97
push str.Perform_action
call fcn.0045fd50
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x78
push 0x2d0
push 0xaa
push 5
push str.Unlock_a_locked_folder__drag__drop_supported_
mov ecx, edi
mov dword [ebp - 0x4a4], eax
call fcn.005c0950
movsd xmm0, qword [0x6edaf8]
sub esp, 8
mov ecx, edi
movsd qword [esp], xmm0
push 0
push 0
push 0
push 0x190
push 0xffffffffffffffff
call fcn.005beb10
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x32
push 0xcf
push 0x14
push str.Path:
mov ecx, edi
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x16
push 0x1fe
push 0xcc
push 0x46
push 0
mov ecx, edi
call fcn.005c0a40
push edi
push ecx
mov dword [esp], 0x41500000
push str.Locate_the_folder_to_unlock_using_the_Windows_shell
push 0x1a
mov dword [ebp - 0x484], eax
push 0x7d
push 0xca
push 0x249
push 0x78
push str.Browse
mov ecx, esi
call fcn.0045fd50
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x208
push 0xff
push 0x23
push str.Press_the__Unlock_folder__button_to_the_right__to_grant_everyone_access_to_the_selected_folder.
mov ecx, edi
mov dword [ebp - 0x500], eax
call fcn.005c0890
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Grant_access_to_the_selected_folder_now
push 0x1c
push 0x96
push 0xf6
push 0x230
push 0xa8
push str.Unlock_folder
call fcn.0045fd50
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x50
push 0x2d0
push 0x140
push 5
push str.Fix_and_protect_the_executable_file_associations
mov ecx, edi
mov dword [ebp - 0x4c0], eax
call fcn.005c0950
movsd xmm0, qword [0x6edaf8]
sub esp, 8
mov ecx, edi
movsd qword [esp], xmm0
push 0
push 0
push 0
push 0x190
push 0xffffffffffffffff
call fcn.005beb10
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x46
push 0x168
push 0x1e
push str.Extension:
mov ecx, edi
call fcn.005c0890
push 0
push 0xffffffffffffffff
push 0x10000043
push 0x19
push 0x50
push 0x164
push 0x64
push str..exe_n.msi_n.reg_n.bat_n.cmd_n.com_n.vbs_nAll
mov ecx, edi
call fcn.005c1650
push 0
push 0
push 0x14e
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x4d0], eax
call fcn.005befd0
push 0x20
push 0x53
mov ecx, esi
call fcn.00436320
push 0x10
mov dword [ebp - 0x4a0], eax
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov dword [ebp - 0x40c], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x4e94dc
push dword [ebp - 0x4a0]
xorps xmm0, xmm0
mov ecx, eax
movups xmmword [eax], xmm0
call fcn.00401a30
jmp 0x4e94de
xor eax, eax
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x440], eax
push edi
push ecx
mov byte [ebp - 4], 6
mov ecx, esi
mov dword [esp], 0x41500000
push str.Fix_the_selected_file_extension_s_.
push 0x1a
push 0x91
push 0x162
push 0xc8
push eax
push str.Fix_extension_s_
call fcn.0045fd00
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Prevent_the_file_associations_from_being_changed.
push 0x1a
push 0x9b
push 0x162
push 0x177
push 0x83
push str.Lock_extensions
mov dword [ebp - 0x4e4], eax
call fcn.0045fd50
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Allow_the_file_associations_to_be_changed.
push 0x1a
push 0x9b
push 0x162
push 0x226
push 0xa8
push str.Unlock_extensions
mov dword [ebp - 0x4fc], eax
call fcn.0045fd50
push str.Registry_tweaks
push 2
push dword [ebp - 0x480]
mov ecx, edi
mov dword [ebp - 0x4f8], eax
call fcn.005bfb00
push 0x10
push 0x10
push 0
push 0
push 0
push 0x8e
mov ecx, esi
call fcn.00436420
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, edi
call fcn.005be310
movsd xmm1, qword [0x6edaf8]
mov ecx, edi
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x69
push 0x2d0
push 0xa
push 5
push str.Manage_a_registry_key
mov ecx, edi
call fcn.005c0950
movsd xmm0, qword [0x6edaf8]
sub esp, 8
movsd qword [esp], xmm0
push 0
push 0
push 0
push 0x190
push 0xffffffffffffffff
mov ecx, edi
call fcn.005beb10
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x28
push 0x2a
push 0x14
push str.Key:
mov ecx, edi
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0x208
push 0x28
push 0x3c
push 0
mov ecx, edi
call fcn.005c0a40
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Locate_the_key_to_manage_in_the_registry
push 0x1a
push 0x7d
push 0x25
push 0x249
push 0x78
push str.Browse_key
mov dword [ebp - 0x49c], eax
call fcn.0045fd50
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x96
push 0x55
push 0xa0
push str.Select_action_to_perform:
mov ecx, edi
mov dword [ebp - 0x4ec], eax
call fcn.005c0890
push 0
push 0xffffffffffffffff
push 0x10000043
push 0x19
push 0xdc
push 0x4f
push 0x136
push str.Google_key_name_nProtect_key_from_changes_nUnlock_key__grant_access__nUnlock_and_delete_key
mov ecx, edi
call fcn.005c1540
mov ecx, eax
mov eax, dword [ebp - 0x454]
push eax
push eax
push str.IMAGE
push 0x7c
push dword [esi + 4]
mov dword [ebp - 0x498], ecx
push 0
push ecx
mov ecx, edi
call fcn.005be260
mov eax, dword [ebp - 0x454]
mov ecx, edi
push eax
push eax
push str.IMAGE
push 0x83
push dword [esi + 4]
push 1
push dword [ebp - 0x498]
call fcn.005be260
mov eax, dword [ebp - 0x454]
push eax
push eax
push str.IMAGE
push 0xa8
push dword [esi + 4]
mov ecx, edi
push 2
push dword [ebp - 0x498]
call fcn.005be260
mov eax, dword [ebp - 0x454]
mov ecx, edi
push eax
push eax
push str.IMAGE
push 0x72
push dword [esi + 4]
push 3
push dword [ebp - 0x498]
call fcn.005be260
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Perform_the_selected_action_with_the_selected_registry_key
push 0x1c
push 0x96
push 0x4c
push 0x230
push 0x97
push str.Perform_action
call fcn.0045fd50
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x154
push 0x2d0
push 0x7d
push 5
push str.Registry_tweaks__the_default_in_Windows_10_is_none_checked__check_to_change_
mov ecx, edi
mov dword [ebp - 0x4d4], eax
call fcn.005c0950
movsd xmm0, qword [0x6edaf8]
sub esp, 8
mov ecx, edi
movsd qword [esp], xmm0
push 0
push 0
push 0
push 0x190
push 0xffffffffffffffff
call fcn.005beb10
push 0x10024
push 0x1000010d
push 0xff
push 0x2c1
push 0x91
push 0xf
push 0x627824
push str.Fix_name_nNeeds_reboot
mov ecx, edi
call fcn.005c0620
push eax
mov ecx, edi
mov dword [ebp - 0x444], eax
call fcn.005c5730
movsd xmm0, qword [0x6edab0]
xor ecx, ecx
comisd xmm0, xmmword [esi + 8]
push 0
mov dword [ebp - 0x4b4], eax
setbe cl
add ecx, 3
push ecx
push 0x108e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
movsd xmm0, qword [esi + 8]
comisd xmm0, xmmword [0x6edab0]
jbe 0x4e989f
movaps xmm0, xmmword [0x6edc80]
lea eax, [ebp - 0xe0]
push eax
push 0
push 0x10a2
push dword [ebp - 0x4b4]
mov dword [ebp - 0xe0], 0x28
mov dword [ebp - 0xdc], 7
mov dword [ebp - 0xd8], 3
movups xmmword [ebp - 0xd4], xmm0
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 1
call dword [sym.imp.USER32.dll_SendMessageW]
movsd xmm0, qword [0x6edaf8]
sub esp, 8
mov ecx, edi
movsd qword [esp], xmm0
push 0
push 0
push 0
push 0x190
push 0xffffffffffffffff
call fcn.005beb10
push 0
push str.Check_Uncheck_an_item_to_automatically_apply_the_tweak.
push 0xffffffffffffffff
mov ecx, esi
call fcn.0045b370
push 0xff203000
push 0
push 0x12
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba470
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0
call fcn.005d6aa0
push 0xffffffffffffffff
push 0
push 8
push 0xffffffffffffffff
push 0
push str.Visual_tweaks
push 1
push dword [ebp - 0x444]
mov ecx, edi
mov byte [ebp - 4], 7
call fcn.005bbd80
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0
push str.Enable_view_hidden_files_and_folders
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x44c], eax
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005d6a30
lea eax, [ebp - 0x30]
push eax
push str.Hidden
lea ecx, [ebp - 0x40]
call fcn.005d66b0
test al, al
je 0x4e99b3
cmp dword [ebp - 0x30], 1
jne 0x4e99b3
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0
push str.Enable_view_system_files
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.ShowSuperHidden
call fcn.005d66b0
test al, al
je 0x4e9a09
cmp dword [ebp - 0x30], 0
je 0x4e9a09
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0
push str.Enable_view_known_file_extensions
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.HideFileExt
call fcn.005d66b0
test al, al
je 0x4e9a46
cmp dword [ebp - 0x30], 0
jne 0x4e9a5f
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0
push str.Disable_file_and_folder_info_tips
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.ShowInfoTip
call fcn.005d66b0
test al, al
je 0x4e9a9c
cmp dword [ebp - 0x30], 0
jne 0x4e9ab5
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0
push str.Disable_baloon_tip_notifications
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.EnableBalloonTips
call fcn.005d66b0
test al, al
je 0x4e9b0b
cmp dword [ebp - 0x30], 0
jne 0x4e9b0b
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0
push str.Disable_desktop_preview__aero_peek_
call fcn.005bbb80
mov dword [ebp - 0x450], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.DisablePreviewDesktop
call fcn.005d66b0
test al, al
je 0x4e9b61
cmp dword [ebp - 0x30], 1
jne 0x4e9b61
push 0xffffffffffffffff
push 0
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 1
push str.This_tweak_requires_a_shell_restart_to_take_effect.
push dword [ebp - 0x450]
mov ecx, edi
push dword [ebp - 0x444]
call fcn.005ba4f0
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0
push str.Enable_fast_taskbar_thumbnails
call fcn.005bbb80
mov dword [ebp - 0x450], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.ExtendedUIHoverTime
call fcn.005d66b0
test al, al
je 0x4e9bd1
cmp dword [ebp - 0x30], 1
jne 0x4e9bd1
push 0xffffffffffffffff
push 0
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 1
push str.This_tweak_requires_a_shell_restart_to_take_effect.
push dword [ebp - 0x450]
mov ecx, edi
push dword [ebp - 0x444]
call fcn.005ba4f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.CurrentVersionThemesPersonalize
push str.SoftwareMicrosoftWindows_
push 0
lea ecx, [esi + 0x1290]
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0
push str.Disable_transparency_effects
call fcn.005bbb80
mov dword [ebp - 0x450], eax
lea ecx, [ebp - 0x3c]
lea eax, [ebp - 0x30]
push eax
push str.EnableTransparency
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4e9c7c
cmp dword [ebp - 0x30], 0
jne 0x4e9c7c
push 0xffffffffffffffff
push 0
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 1
push str.This_tweak_requires_a_shell_restart_to_take_effect.
push dword [ebp - 0x450]
mov ecx, edi
push dword [ebp - 0x444]
call fcn.005ba4f0
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0
push str.Enable_quick_menu_show
call fcn.005bbb80
mov dword [ebp - 0x450], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x5c]
push eax
push str.MenuShowDelay
call fcn.005d6740
test al, al
je 0x4e9cf5
lea ecx, [ebp - 0x5c]
call fcn.005dafe0
cmp eax, 0xc8
ja 0x4e9cf5
push 0xffffffffffffffff
push 0
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 1
push str.This_tweak_requires_a_shell_restart_to_take_effect.
push dword [ebp - 0x450]
mov ecx, edi
push dword [ebp - 0x444]
call fcn.005ba4f0
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0
push str.Enable_the_screen_saver
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x5c]
push eax
push str.ScreenSaveActive
call fcn.005d6740
test al, al
je 0x4e9d6b
lea ecx, [ebp - 0x5c]
call fcn.005dafe0
test eax, eax
je 0x4e9d6b
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0
push str.Enable_right_to_left_explorer_menus
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push 0
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x450], eax
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea eax, [ebp - 0x30]
push eax
push str.MenuDropAlignment
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
jne 0x4e9df9
test byte [ebp - 0x30], 1
je 0x4e9df9
push 0xffffffffffffffff
push 0
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 1
push str.This_tweak_requires_a_shell_restart_to_take_effect.
push dword [ebp - 0x450]
mov ecx, edi
push dword [ebp - 0x444]
call fcn.005ba4f0
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0
push str.Enable_Show_All_Folders_in_navigation_pane
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.CurrentVersionExplorerAdvanced
push str.SOFTWAREMicrosoftWindows
push 0
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x450], eax
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea eax, [ebp - 0x30]
push eax
push str.NavPaneShowAllFolders
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4e9ea4
cmp dword [ebp - 0x30], 1
jne 0x4e9ea4
push 0xffffffffffffffff
push 0
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 1
push str.This_tweak_requires_a_shell_restart_to_take_effect.
push dword [ebp - 0x450]
mov ecx, edi
push dword [ebp - 0x444]
call fcn.005ba4f0
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0
push str.Disable_scrolling_inactive_windows
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x63bc40
push 0
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x450], eax
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea eax, [ebp - 0x30]
push eax
push str.MouseWheelRouting
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4e9f33
cmp dword [ebp - 0x30], 2
je 0x4e9f4c
push 0xffffffffffffffff
push 0
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 1
push str.This_tweak_requires_a_shell_restart_to_take_effect.
push dword [ebp - 0x450]
mov ecx, edi
push dword [ebp - 0x444]
call fcn.005ba4f0
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0
push str.Enable_control_panel_icon_view
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.CurrentVersionPoliciesExplorer
push str.SOFTWAREMicrosoftWindows
push 0
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x44c], eax
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea eax, [ebp - 0x30]
push eax
push str.ForceClassicControlPanel
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4e9ff7
cmp dword [ebp - 0x30], 0
je 0x4e9ff7
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0xffffffffffffffff
push 0
push 8
push 0xffffffffffffffff
push 0
push str.Explorer__desktop_and_taskbar_tweaks
push 2
push dword [ebp - 0x444]
mov ecx, edi
call fcn.005bbd80
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push 0
push str.Disable_appending___Shortcut_to_new_shortcuts
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6495b0
push 0
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x450], eax
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
xorps xmm0, xmm0
lea ecx, [ebp - 0x428]
movups xmmword [ebp - 0x428], xmm0
call fcn.005d6b10
lea eax, [ebp - 0x428]
mov byte [ebp - 4], 8
push eax
push str.link
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005d6880
cmp dword [ebp - 0x420], 3
jne 0x4ea0c9
mov eax, dword [ebp - 0x428]
cmp byte [eax], 0x1e
je 0x4ea0c9
push 0xffffffffffffffff
push 0
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 1
push str.This_tweak_requires_a_shell_restart_to_take_effect.
push dword [ebp - 0x450]
mov ecx, edi
push dword [ebp - 0x444]
call fcn.005ba4f0
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push 0
push str.Enable__Recycle_bin__in__This_PC_
call fcn.005bbb80
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerMyComputerNameSpace645FF040_5081_101B_9F08_00AA002F954E
mov ecx, esi
mov dword [ebp - 0x44c], eax
call fcn.0043c1d0
test al, al
je 0x4ea12e
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push 0
push str.Enable__Control_panel__in__This_PC_
call fcn.005bbb80
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerMyComputerNameSpace21EC2020_3AEA_1069_A2DD_08002B30309D
mov ecx, esi
mov dword [ebp - 0x44c], eax
call fcn.0043c1d0
test al, al
je 0x4ea179
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push 0
push str.Enable__This_PC__icon_in_the_Desktop
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.CurrentVersionExplorerHideDesktopIconsNewStartPanel
push str.SoftwareMicrosoftWindows_
push 0
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x44c], eax
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea eax, [ebp - 0x30]
push eax
push str.20D04FE0_3AEA_1069_A2D8_08002B30309D
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4ea20a
cmp dword [ebp - 0x30], 0
jne 0x4ea20a
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push 0
push str.Enable__Username__icon_in_the_Desktop
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.CurrentVersionExplorerHideDesktopIconsNewStartPanel
push str.SoftwareMicrosoftWindows_
push 0
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x44c], eax
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea eax, [ebp - 0x30]
push eax
push str.59031a47_3f72_44a7_89c5_5595fe6b30ee
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4ea29b
cmp dword [ebp - 0x30], 0
jne 0x4ea29b
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push 0
push str.Enable__Network__icon_in_the_Desktop
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.CurrentVersionExplorerHideDesktopIconsNewStartPanel
push str.SoftwareMicrosoftWindows_
push 0
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x44c], eax
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea eax, [ebp - 0x30]
push eax
push str.F02C1A0D_BE21_4350_88B0_7367FC96EF3C
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4ea32c
cmp dword [ebp - 0x30], 0
jne 0x4ea32c
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push 0
push str.Enable__Recycle_bin__icon_in_the_Desktop
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.CurrentVersionExplorerHideDesktopIconsNewStartPanel
push str.SoftwareMicrosoftWindows_
push 0
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x44c], eax
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea eax, [ebp - 0x30]
push eax
push str.645FF040_5081_101B_9F08_00AA002F954E
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4ea3a4
cmp dword [ebp - 0x30], 0
jne 0x4ea3bd
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push 0
push str.Enable__Control_panel__icon_in_the_Desktop
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.CurrentVersionExplorerHideDesktopIconsNewStartPanel
push str.SoftwareMicrosoftWindows_
push 0
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x44c], eax
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea eax, [ebp - 0x30]
push eax
push str.5399E694_6CE5_4D6C_8FCE_1D8870FDCBA0
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4ea44e
cmp dword [ebp - 0x30], 0
jne 0x4ea44e
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push 0
push str.Enable__OneDrive__icon_in_the_Desktop
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.CurrentVersionExplorerHideDesktopIconsNewStartPanel
push str.SoftwareMicrosoftWindows_
push 0
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x44c], eax
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea eax, [ebp - 0x30]
push eax
push str.018D5C66_4533_4307_9B53_224DE2ED1FE6
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4ea4df
cmp dword [ebp - 0x30], 0
jne 0x4ea4df
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push 0
push str.Enable__NumLock__at_logon_for_all_users
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x3c]
push eax
push str.InitialKeyboardIndicators
push str.HKU.DEFAULTControl_PanelKeyboard
call fcn.005d65d0
test al, al
je 0x4ea545
push 0x62fdc4
lea ecx, [ebp - 0x3c]
call fcn.005dc4c0
test al, al
je 0x4ea545
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push 0
push str.Enable_old_Explorer_ribon_on_Windows_11
call fcn.005bbb80
mov edx, str.e2bf9676_5f8f_435c_97eb_11607a5bedf7
mov dword [ebp - 0x450], eax
mov ecx, str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionShell_ExtensionsBlocked
call fcn.005d3780
test al, al
je 0x4ea593
push 0xffffffffffffffff
push 0
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 1
push str.This_tweak_requires_a_shell_restart_to_take_effect.
push dword [ebp - 0x450]
mov ecx, edi
push dword [ebp - 0x444]
call fcn.005ba4f0
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push 0
push str.Enable_old_Explorer_menus_on_Windows_11
call fcn.005bbb80
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x450], eax
call fcn.005dc400
push eax
push 0x62439c
push str.HKCRCLSID86ca1aa0_34aa_4e8b_a509_50c905bae2a2InProcServer32
lea ecx, [ebp - 0x40]
call fcn.005d65d0
test al, al
je 0x4ea613
lea ecx, [ebp - 0x3c]
call fcn.005dbeb0
test al, al
je 0x4ea613
push 0xffffffffffffffff
push 0
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 1
push str.This_tweak_requires_a_shell_restart_to_take_effect.
push dword [ebp - 0x450]
mov ecx, edi
push dword [ebp - 0x444]
call fcn.005ba4f0
push 0xffffffffffffffff
push 0
push 8
push 0xffffffffffffffff
push 0
push str.Performance_and_productivity_tweaks
push 3
push dword [ebp - 0x444]
mov ecx, edi
call fcn.005bbd80
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push 0
push str.Disable_hibernation
call fcn.005bbb80
push 0x4c
mov dword [ebp - 0x450], eax
lea eax, [ebp - 0x1a8]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea eax, [ebp - 0x1a8]
push 0x4c
push eax
push 0
push 0
push 4
call dword [sym.imp.POWRPROF.dll_CallNtPowerInformation]
test eax, eax
jne 0x4ea6b9
cmp byte [ebp - 0x1a0], al
jne 0x4ea6b9
push 0xffffffffffffffff
push eax
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
lea eax, [ebp - 0x30]
push eax
push str.HibernateEnabled
push str.HKLMSYSTEMCurrentControlSetControlPower
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4ea6f2
cmp dword [ebp - 0x30], 0
jne 0x4ea6f2
push 0xffffffffffffffff
push 0
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push 0
push str.Disable_hybrid_shutdown
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.HiberbootEnabled
push str.HKLMSYSTEMCurrentControlSetControlSession_ManagerPower
call fcn.005d6580
test al, al
je 0x4ea734
cmp dword [ebp - 0x30], 0
jne 0x4ea74d
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push 0
push str.Disable_auto_installing_unwanted_apps
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.AutoDownload
push str.HKLMSOFTWAREPoliciesMicrosoftWindowsStore
call fcn.005d6580
test al, al
je 0x4ea7a8
cmp dword [ebp - 0x30], 2
jne 0x4ea7a8
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push 0
push str.Disable_service:_Downloaded_Maps_Manager
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.Start
push str.HKLMSYSTEMCurrentControlSetServicesMapsBroker
call fcn.005d6580
test al, al
je 0x4ea803
cmp dword [ebp - 0x30], 4
jne 0x4ea803
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push 0
push str.Disable_service:_Delivery_Optimization
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.Start
push str.HKLMSYSTEMCurrentControlSetServicesDoSvc
call fcn.005d6580
test al, al
je 0x4ea85e
cmp dword [ebp - 0x30], 4
jne 0x4ea85e
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push 0
push str.Disable_service:_Windows_Search
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.Start
push str.HKLMSYSTEMCurrentControlSetServicesWSearch
call fcn.005d6580
test al, al
je 0x4ea8b9
cmp dword [ebp - 0x30], 4
jne 0x4ea8b9
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push 0
push str.Disable_and_hide_Cortana
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.AllowCortana
push str.HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Search
call fcn.005d6580
test al, al
je 0x4ea914
cmp dword [ebp - 0x30], 0
jne 0x4ea914
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push 0
push str.Enable_auto_ending_hunging_tasks
call fcn.005bbb80
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x63bc40
push 0
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x44c], eax
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea eax, [ebp - 0x5c]
push eax
push str.AutoEndTasks
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005d65d0
test al, al
je 0x4ea9a8
lea ecx, [ebp - 0x5c]
call fcn.005dafe0
test eax, eax
je 0x4ea9a8
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push 0
push str.Disable_the_lock_screen__Win_8_
call fcn.005bbb80
movsd xmm0, qword [esi + 8]
comisd xmm0, xmmword [0x6edac8]
mov dword [ebp - 0x44c], eax
jb 0x4eaa12
lea eax, [ebp - 0x30]
push eax
push str.NoLockScreen
push str.HKLMSOFTWAREPoliciesMicrosoftWindowsPersonalization
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4eaa12
cmp dword [ebp - 0x30], 0
je 0x4eaa12
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push 0
push str.Disable_require_password_on_wake_up
call fcn.005bbb80
mov dword [ebp - 0x450], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.ACSettingIndex
push str.HKLMSOFTWAREPoliciesMicrosoftPowerPowerSettings0e796bdb_100d_47d6_a2d5_f7d2daa51f51
call fcn.005d6580
test al, al
je 0x4eaa73
cmp dword [ebp - 0x30], 0
jne 0x4eaae4
push 0xffffffffffffffff
push 0
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
jmp 0x4eaae4
mov dword [ebp - 0x418], 0
lea edx, [ebp - 0x418]
mov byte [ebp - 4], 9
xor ecx, ecx
call fcn.0058c0f0
mov edx, dword [ebp - 0x418]
lea eax, [ebp - 0x30]
push eax
push 0x604c20
push 0x604b80
xor ecx, ecx
mov dword [ebp - 0x30], 0
call fcn.0058c1a0
cmp dword [ebp - 0x30], 0
jne 0x4eaacf
push 0xffffffffffffffff
push 0
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x4eaae4
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push 0
push str.Enable_the_Autoplay_function_for_all_drives
call fcn.005bbb80
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x44c], eax
call fcn.00570910
test eax, eax
je 0x4eab2e
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push 0
push str.Disable_OneDrive
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.DisableFileSync
push str.HKLMSoftwarePoliciesMicrosoftWindowsOneDrive
call fcn.005d6580
test al, al
je 0x4eab89
cmp dword [ebp - 0x30], 0
je 0x4eab89
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push 0
push str.Disable_Office_saving_to_OneDrive
call fcn.005bbb80
push str.HKCUSoftwareMicrosoftOffice
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x44c], eax
call fcn.00570370
test eax, eax
je 0x4eabd8
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0xffffffffffffffff
push 0
push 8
push 0xffffffffffffffff
push 0
push str.System_and_security_tweaks
push 4
push dword [ebp - 0x444]
mov ecx, edi
call fcn.005bbd80
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Disable_the_User_Account_Control__UAC_
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.ConsentPromptBehaviorAdmin
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
call fcn.005d6580
test al, al
je 0x4eac53
cmp dword [ebp - 0x30], 0
je 0x4eac53
lea eax, [ebp - 0x30]
push eax
push str.EnableLUA
lea ecx, [ebp - 0x40]
call fcn.005d66b0
test al, al
je 0x4eac53
cmp dword [ebp - 0x30], 0
jne 0x4eac6c
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Disable_Store_Apps_AutoUpdates
call fcn.005bbb80
mov dword [ebp - 0x450], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.AutoDownload
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsStoreWindowsUpdate
call fcn.005d6580
test al, al
je 0x4eacc7
cmp dword [ebp - 0x30], 2
jne 0x4eacc7
push 0xffffffffffffffff
push 0
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 1
push str.This_tweak_only_takes_effect_after_you_log_off_and_on_again.
push dword [ebp - 0x450]
mov ecx, edi
push dword [ebp - 0x444]
call fcn.005ba4f0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push str.Enable_Store_Apps_access_to_admins
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.FilterAdministratorToken
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
call fcn.005d6580
test al, al
je 0x4ead3c
cmp dword [ebp - 0x30], 1
jne 0x4ead3c
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Disable_Windows_Defender
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.DisableAntiSpyware
push str.HKLMSoftwarePoliciesMicrosoftWindows_Defender
call fcn.005d6580
test al, al
je 0x4ead97
cmp dword [ebp - 0x30], 0
je 0x4ead97
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Enable_Windows_Defender_PUP_detection
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.MpEnablePus
push str.HKLMSoftwarePoliciesMicrosoftWindows_DefenderMpEngine
call fcn.005d6580
test al, al
je 0x4eadf2
cmp dword [ebp - 0x30], 0
je 0x4eadf2
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Disable_post_update_reboot_warnings
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.NoAutoRebootWithLoggedOnUsers
push str.HKLMSoftwarePoliciesMicrosoftWindowsWindowsUpdateAU
call fcn.005d6580
test al, al
je 0x4eae4d
cmp dword [ebp - 0x30], 0
je 0x4eae4d
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Enable_defer_windows_upgrades
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.DeferFeatureUpdates
push str.HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
call fcn.005d6580
test al, al
je 0x4eaea8
cmp dword [ebp - 0x30], 1
jne 0x4eaea8
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Enable_Windows_Installer_in_Safe_Mode
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x3c]
push eax
push 0x62439c
push str.HKLMSYSTEMCurrentControlSetControlSafeBootMinimalmsiserver
call fcn.005d65d0
lea eax, [ebp - 0x5c]
push eax
push 0x62439c
push str.HKLMSYSTEMCurrentControlSetControlSafeBootNetworkmsiserver
lea ecx, [ebp - 0x40]
call fcn.005d65d0
push str.Service
lea ecx, [ebp - 0x3c]
call fcn.005dc4c0
test al, al
je 0x4eaf31
push str.Service
lea ecx, [ebp - 0x5c]
call fcn.005dc4c0
test al, al
je 0x4eaf31
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Disable_auto_install_network_devices
call fcn.005bbb80
movsd xmm1, qword [esi + 8]
mov ecx, str.NcdAutoSetup
mov dword [ebp - 0x44c], eax
call fcn.0058f8c0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc510
push str.Disabled
lea ecx, [ebp - 0x3c]
call fcn.005dc4c0
test al, al
je 0x4eaf95
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Disable_auto_install_device_drivers
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.SearchOrderConfig
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionDriverSearching
call fcn.005d6580
test al, al
je 0x4eaff0
cmp dword [ebp - 0x30], 0
jne 0x4eaff0
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Disable_driver_updates_from_Windows_Update
call fcn.005bbb80
lea ecx, [esi + 0x1290]
mov dword [ebp - 0x44c], eax
call fcn.00554da0
cmp eax, 0x3aab
mov edx, str.HKLMSOFTWAREPoliciesMicrosoftWindowsUpdateUXSettings
lea eax, [ebp - 0x30]
mov ecx, str.HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
push eax
cmovbe ecx, edx
push str.ExcludeWUDriversInQualityUpdate
push ecx
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4eb064
cmp dword [ebp - 0x30], 0
je 0x4eb064
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Disable_Windows_10_Startup_Delay
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.StartupDelayInMSec
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerSerialize
call fcn.005d6580
test al, al
je 0x4eb0bf
cmp dword [ebp - 0x30], 0
jne 0x4eb0bf
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Enable_auto_reboot_on_BSOD
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.AutoReboot
push str.HKLMSYSTEMCurrentControlSetControlCrashControl
call fcn.005d6580
test al, al
je 0x4eb11a
cmp dword [ebp - 0x30], 0
je 0x4eb11a
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Disable_create_memory_dump_on_BSOD
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.CrashDumpEnabled
push str.HKLMSYSTEMCurrentControlSetControlCrashControl
call fcn.005d6580
test al, al
je 0x4eb175
cmp dword [ebp - 0x30], 0
jne 0x4eb175
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Disable_Windows_automatic_updates
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.NoAutoUpdate
push str.HKLMSoftwarePoliciesMicrosoftWindowsWindowsUpdateAU
call fcn.005d6580
test al, al
je 0x4eb1b7
cmp dword [ebp - 0x30], 0
jne 0x4eb1d7
lea eax, [ebp - 0x30]
push eax
push str.Start
push str.HKLMSYSTEMCurrentControlSetServiceswuauserv
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4eb1f0
cmp dword [ebp - 0x30], 4
jne 0x4eb1f0
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Disable_the_Windows_Firewall
call fcn.005bbb80
mov ecx, 2
mov dword [ebp - 0x44c], eax
call fcn.005ce740
test al, al
jne 0x4eb239
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Disable_user_and_application_telemetry
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.AllowTelemetry
push str.HKLMSoftwarePoliciesMicrosoftWindowsDataCollection
call fcn.005d6580
test al, al
je 0x4eb27b
cmp dword [ebp - 0x30], 0
je 0x4eb2c2
lea eax, [ebp - 0x30]
push eax
push str.Start
push str.HKLMSYSTEMCurrentControlSetServicesDiagTrack
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4eb29b
cmp dword [ebp - 0x30], 4
je 0x4eb2c2
lea eax, [ebp - 0x3c]
push eax
push str.Debugger
push str.HKLMSoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsCompatTelRunner.exe
lea ecx, [ebp - 0x40]
call fcn.005d65d0
test al, al
je 0x4eb2db
lea ecx, [ebp - 0x3c]
call fcn.005dc3a0
cmp eax, 0xa
jle 0x4eb2db
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Disable_Windows_Hello_pin_setup
call fcn.005bbb80
push 1
push str.HKLMSoftwarePoliciesMicrosoftWindowsSystem
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x450], eax
call fcn.005dc260
lea eax, [ebp - 0x30]
push eax
push str.AllowDomainPINLogon
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005d6580
test al, al
je 0x4eb349
cmp dword [ebp - 0x30], 0
jne 0x4eb349
push 0xffffffffffffffff
push 0
push dword [ebp - 0x450]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 1
push str.This_tweak_only_takes_effect_after_you_log_off_and_on_again.
push dword [ebp - 0x450]
mov ecx, edi
push dword [ebp - 0x444]
call fcn.005ba4f0
push 0
push dword [ebp - 0x444]
mov ecx, edi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0
push str.Disable_auto_upgrading_to_Windows_11
call fcn.005bbb80
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push str.TargetReleaseVersion
push str.HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
call fcn.005d6580
test al, al
je 0x4eb3be
cmp dword [ebp - 0x30], 1
jne 0x4eb3be
push 0xffffffffffffffff
push 0
push dword [ebp - 0x44c]
mov ecx, edi
push 1
push dword [ebp - 0x444]
call fcn.005bba40
push 1
push dword [ebp - 0x444]
mov ecx, edi
call fcn.005bb910
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x140
push 0x19a
push 0xf
push 0
mov ecx, edi
call fcn.005c0890
push 0xf0e0d0
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x4c4], eax
call fcn.005bedc0
push 0
push 0x10800080
push 0x16
push 0x127
push 0x198
push 0x154
push str.Find_a_tweak__CtrlF_
mov ecx, edi
call fcn.005c0a40
push 0x909090
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x478], eax
call fcn.005bec70
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x17
push 0x50
push 0x197
push 0x280
push str.Find_next
mov ecx, edi
call fcn.005c1a50
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x46
push 0x1b8
push 0x14
push str.Quick_load:
mov ecx, edi
mov dword [ebp - 0x4b8], eax
call fcn.005c0890
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x19
push 0x1c2
push 0x1b3
push 0x5a
push str._nSelect_file
mov ecx, edi
call fcn.005c1650
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x19
push 0x50
push 0x1b2
push 0x22b
push str.Load_from...
mov ecx, edi
mov dword [ebp - 0x488], eax
call fcn.005c1a50
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x19
push 0x50
push 0x1b2
push 0x280
push str.Save_to...
mov ecx, edi
mov dword [ebp - 0x4e8], eax
call fcn.005c1a50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x518], eax
lea eax, [esi + 0x174]
push 0
push 0x686418
mov ecx, eax
mov dword [ebp - 0x450], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 0x260
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x3c]
push 3
call fcn.005dc190
push eax
lea ecx, [ebp - 0x408]
call fcn.00401130
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x1b8], 0xffffffff
je 0x4eb5ba
mov esi, dword [ebp - 0x488]
nop word [eax + eax]
mov ecx, dword [ebp - 0x450]
lea eax, [ebp - 0x3dc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
mov ecx, edi
call fcn.005bcd30
lea ecx, [ebp - 0x408]
call fcn.00401230
test al, al
jne 0x4eb560
mov esi, dword [ebp - 0x448]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x686418
lea ecx, [esi + 0x168]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 3
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x408]
call fcn.00401280
test al, al
je 0x4eb66a
mov esi, dword [ebp - 0x488]
nop word [eax + eax]
mov ecx, dword [ebp - 0x450]
lea eax, [ebp - 0x3dc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push esi
mov ecx, edi
call fcn.005bcd30
lea ecx, [ebp - 0x408]
call fcn.00401230
test al, al
jne 0x4eb610
mov esi, dword [ebp - 0x448]
mov eax, dword [ebp - 0x1b8]
cmp eax, 0xffffffff
je 0x4eb67c
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.System_restore_tools
push 3
push dword [ebp - 0x480]
mov ecx, edi
mov dword [ebp - 0x1b8], 0xffffffff
call fcn.005bfb00
push 0x10
push 0x10
push 0
push 0
push 0
push 0xa2
mov ecx, esi
call fcn.00436420
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, edi
call fcn.005be310
movsd xmm1, qword [0x6edb20]
mov ecx, edi
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
push 0x10000101
push 0x14
push 0x1f4
push 0xa0
push 0x78
push str.Retrieving_System_restore_points...
mov ecx, edi
call fcn.005c0890
movsd xmm1, qword [0x6edaf8]
mov ecx, edi
push 0
push str.Arial
push 1
push 0x190
mov dword [ebp - 0x44c], eax
call fcn.005c42b0
push 0x10024
push 0x80000d
push 0x190
push 0x2d0
push 0xa
push 5
push 0x62794c
push str._Index_System_restore_point_description_Creation_date
mov ecx, edi
call fcn.005c0620
push eax
mov ecx, edi
mov dword [ebp - 0x454], eax
call fcn.005c5730
push 0x46
push 0
mov esi, eax
push 0x101e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x1db
push 1
push 0x101e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x87
push 2
push 0x101e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [ebp - 0x448]
push 0x20
push 0x20
push 0x12
push 0x12
push str.IMAGE
push 0xa2
push dword [esi + 4]
push 0xffffffffffffffff
push dword [ebp - 0x454]
mov ecx, edi
call fcn.005ba9e0
push 1
push dword [ebp - 0x454]
mov ecx, edi
call fcn.005ba360
push 0xff203000
push 0
push 0x12
push 0xffffffffffffffff
mov ecx, edi
call fcn.005ba470
movsd xmm1, qword [0x6edaf8]
mov ecx, edi
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x1f4
push 0x19f
push 0x1e
push str.Tick_the_restore_points_you_wish_to_delete._Select_one_to_restore_to.
mov ecx, edi
call fcn.005c0890
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Restore_this_computer_to_the_selected_restore_point
push 0x1e
push 0x96
push 0x1b3
push 0x1e
push 0xcc
push str.Restore_selected
call fcn.0045fd50
push 0x40
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x4c8], eax
call fcn.005bd3f0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Delete_the_ticked_restore_points
push 0x1e
push 0x96
push 0x1b3
push 0xc8
push 0x72
push str.Delete_checked
call fcn.0045fd50
push 0x40
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x4cc], eax
call fcn.005bd3f0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Create_a_new_system_restore_point
push 0x1e
push 0x96
push 0x1b3
push 0x172
push 0xa2
push str.Create_new
call fcn.0045fd50
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
mov dword [ebp - 0x4bc], eax
push 0x6e
push 0x1a9
push 0x226
push str.Check_all_none
mov ecx, edi
call fcn.005c19a0
push edi
push str.Check_all_or_none_of_the_system_restore_points_in_the_list
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x4f0], eax
call fcn.0045b370
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0xb4
push 0x1bd
push 0x226
push str.Disable_the_System_restore
mov ecx, edi
call fcn.005c19a0
push edi
push str.Disable_or_enable_the_System_Restore
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x464], eax
call fcn.0045b370
lea ecx, [esi + 0x1290]
call fcn.00553420
test eax, eax
je 0x4eb94a
push 4
push 0xffffffffffffffff
mov ecx, edi
call fcn.005bd3f0
push 0
mov ecx, esi
call fcn.0045f170
push 0
mov ecx, esi
mov dword [ebp - 0x4e0], eax
call fcn.0045f170
mov ecx, 0x70
mov byte [ebp - 0x2c], 1
mov word [ebp - 0x2a], cx
mov cx, word [esi + 0x11bc]
mov word [ebp - 0x28], cx
mov ecx, 0x1b
mov dword [ebp - 0x4d8], eax
mov word [ebp - 0x1c], ax
mov eax, 0x72
mov word [ebp - 0x24], cx
mov ecx, dword [ebp - 0x4e0]
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x4b8]
mov word [ebp - 0x22], cx
mov ecx, 0x46
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x2c]
push 4
mov word [ebp - 0x1e], cx
mov ecx, edi
push eax
mov byte [ebp - 0x26], 1
mov byte [ebp - 0x20], 9
mov byte [ebp - 0x1a], 1
call fcn.005c47a0
push dword [ebp - 0x4b0]
mov ecx, edi
call fcn.005c4370
mov ecx, esi
call fcn.0045f300
push 0
push 1
mov ecx, esi
call fcn.0043d720
push 0x80
push dword [ebp - 0x470]
mov ecx, edi
call fcn.005bd3f0
xorps xmm0, xmm0
mov byte [ebp - 0x455], 0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 0x465], 0
movq qword [ebp - 0x4c], xmm0
mov dword [ebp - 0x44], 0
call fcn.005dc5e0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x68]
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0
movq qword [ebp - 0x68], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x88]
xorps xmm0, xmm0
mov dword [ebp - 0x80], 0
movq qword [ebp - 0x88], xmm0
call fcn.005dc5e0
push 0
mov ecx, esi
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x4dc], 0xffffffff
mov dword [ebp - 0x450], 0
call fcn.004771c0
test eax, eax
je 0x4eded7
nop word [eax + eax]
mov eax, dword [esi + 0x14a8]
cmp eax, 0xfffffffa
je 0x4eded7
cmp dword [esi + 0x14d8], edi
jne 0x4ee0df
cmp eax, dword [ebp - 0x4e0]
je 0x4eded0
mov ecx, dword [ebp - 0x478]
cmp eax, 0xffffffb3
jne 0x4ebaca
cmp dword [esi + 0x14b4], ecx
je 0x4ebad2
cmp eax, dword [ebp - 0x4d8]
jne 0x4ebb4a
push 0x80
push ecx
mov ecx, edi
call fcn.005bd3f0
push dword [ebp - 0x478]
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc1c0
push str.Find_a_tweak__CtrlF_
lea ecx, [ebp - 0x3c]
call fcn.005dc4c0
mov ecx, edi
test al, al
je 0x4ebb31
push 0
push 0
push dword [ebp - 0x478]
call fcn.005bcd30
push 0
push dword [ebp - 0x478]
mov ecx, edi
call fcn.005bec70
push dword [ebp - 0x4b8]
jmp 0x4ee0d8
push 0xffffffffffffffff
push 0
push 0xb1
push dword [ebp - 0x478]
call fcn.005befd0
jmp 0x4ee0df
cmp eax, 0xffffffb4
jne 0x4ebb99
cmp dword [esi + 0x14b4], ecx
jne 0x4ebb99
push ecx
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc1c0
lea ecx, [ebp - 0x3c]
call fcn.005dc3a0
cmp eax, 3
jl 0x4ee0df
push 0xffffffffffffffff
push 6
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c]
call fcn.005dc190
mov ecx, dword [ebp - 0x4b4]
mov edx, eax
call fcn.005c9ea0
jmp 0x4ee0df
cmp eax, dword [ebp - 0x4b8]
jne 0x4ebc5e
push ecx
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc1c0
push str.Find_a_tweak__CtrlF_
lea ecx, [ebp - 0x3c]
call fcn.005dc4c0
test al, al
jne 0x4ebc43
lea ecx, [ebp - 0x3c]
call fcn.005dbeb0
test al, al
jne 0x4ebc43
push dword [ebp - 0x4dc]
lea ecx, [ebp - 0x3c]
push 0x1e
push 0xffffffffffffffff
call fcn.005dc190
mov ecx, dword [ebp - 0x4b4]
mov edx, eax
call fcn.005c9ea0
mov dword [ebp - 0x4dc], eax
mov ecx, edi
push 0x80
cmp eax, 0xffffffff
je 0x4ebc14
push dword [ebp - 0x444]
call fcn.005bd3f0
jmp 0x4ee0df
push dword [ebp - 0x478]
call fcn.005bd3f0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push edi
push 4
push str.Find_reached_the_end_of_the_list.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
push 0
push 0
push 0x201
push dword [ebp - 0x4d8]
mov ecx, edi
call fcn.005befd0
jmp 0x4ee0df
cmp eax, 0xffffffbf
jne 0x4ebd17
mov eax, dword [ebp - 0x488]
cmp dword [esi + 0x14b4], eax
jne 0x4ebd17
push 0
push 0
push 0x157
push eax
mov ecx, edi
call fcn.005befd0
test eax, eax
je 0x4ebcbf
mov esi, dword [ebp - 0x460]
push 1
push 0xa
mov ecx, esi
call fcn.00546ef0
push 0
push 0
push 0x157
push dword [ebp - 0x488]
mov ecx, edi
call fcn.005befd0
test eax, eax
jne 0x4ebc94
mov esi, dword [ebp - 0x448]
push dword [ebp - 0x488]
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc1c0
push str.Select_file
lea ecx, [ebp - 0x3c]
call fcn.005dc4c0
lea ecx, [ebp - 0x3c]
test al, al
je 0x4ebd61
push dword [ebp - 0x48c]
push str.uvktweaks
push 0
push 0x1000
push str.UVK_tweaks_file__.uvktweaks_
push 0
call fcn.005dc400
mov edx, str.Select_tweaks_file_to_load
mov ecx, eax
call fcn.005e1e60
test al, al
jmp 0x4ebd6f
mov eax, dword [esi + 0x14a8]
cmp eax, dword [ebp - 0x4e8]
jne 0x4ebe1f
push dword [ebp - 0x48c]
lea ecx, [ebp - 0x3c]
push str.uvktweaks
push 0
push 0x1000
push str.UVK_tweaks_file__.uvktweaks_
push 0
call fcn.005dc400
mov edx, str.Select_tweaks_file_to_load
mov ecx, eax
call fcn.005e1e60
test al, al
je 0x4ee0df
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ee0df
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push edi
push 1
push str.Are_you_sure_you_want_to_apply_the_tweaks_from_the_selected_file_
mov ecx, esi
call fcn.0043e2e0
test eax, eax
je 0x4ee0df
push 0
push dword [ebp - 0x444]
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.004e6580
mov esi, eax
lea ecx, [ebp - 0x3c]
push esi
call fcn.005db320
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
cmp esi, 1
mov ecx, str._tweaks
mov eax, str._tweak
cmovne eax, ecx
lea ecx, [ebp - 0x3c]
push str.were_successfully_applied.
push eax
call fcn.005da780
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push edi
push 4
lea ecx, [ebp - 0x3c]
call fcn.005dc190
mov esi, dword [ebp - 0x448]
mov ecx, esi
push eax
call fcn.0043e2e0
jmp 0x4ee0df
cmp eax, dword [ebp - 0x518]
jne 0x4ebee3
push dword [ebp - 0x48c]
lea ecx, [ebp - 0x3c]
push str.uvktweaks
push str.Tweaks
push 0
push str.UVK_tweaks_file__.uvktweaks_
push 0
call fcn.005dc400
mov edx, str.Select_tweaks_file_to_save_to
mov ecx, eax
call fcn.005e1da0
test al, al
je 0x4ee0df
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push dword [ebp - 0x444]
mov ecx, esi
call fcn.004e6420
mov esi, eax
lea ecx, [ebp - 0x3c]
push esi
call fcn.005db320
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
cmp esi, 1
mov ecx, str._tweaks
mov eax, str._tweak
cmovne eax, ecx
lea ecx, [ebp - 0x3c]
push str.were_successfully_exported.
push eax
call fcn.005da780
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push edi
push 4
lea ecx, [ebp - 0x3c]
call fcn.005dc190
mov esi, dword [ebp - 0x448]
mov ecx, esi
push eax
call fcn.0043e2e0
jmp 0x4ee0df
cmp eax, 0xffffffdc
jne 0x4ebfdb
push 0
push 0
push 0x132f
push dword [ebp - 0x480]
mov ecx, edi
call fcn.005befd0
test eax, eax
jne 0x4ebf1d
push 0x80
push dword [ebp - 0x470]
mov ecx, edi
call fcn.005bd3f0
jmp 0x4ee0df
cmp eax, 2
jne 0x4ebf4b
push 0x80
push dword [ebp - 0x444]
mov ecx, edi
call fcn.005bd3f0
push 0x80
push dword [ebp - 0x480]
mov ecx, edi
call fcn.005bd3f0
jmp 0x4ee0df
cmp eax, 3
jne 0x4ee0df
cmp byte [ebp - 0x465], 0
jne 0x4ee0df
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x46
push 0x1c2
push 0
push str.Listing_system_restore_points__please_wait...
mov ecx, esi
mov byte [ebp - 0x465], 1
call fcn.0043da60
push 0
push 0xffffffffffffffba
lea ecx, [esi + 0x14f0]
call fcn.005b66e0
mov ecx, dword [ebp - 0x448]
push 0
push 1
call fcn.0043d720
push dword [ebp - 0x4a8]
mov ecx, dword [ebp - 0x448]
push dword [ebp - 0x464]
push dword [ebp - 0x44c]
push dword [ebp - 0x454]
push edi
call fcn.004e67d0
push 2
lea ecx, [esi + 0x14f0]
call fcn.005b6250
mov esi, dword [ebp - 0x448]
jmp 0x4ee0df
cmp eax, 0xfffffffb
jne 0x4ec092
mov ecx, dword [esi + 0x14b4]
cmp ecx, dword [ebp - 0x490]
je 0x4ec008
cmp ecx, dword [ebp - 0x484]
je 0x4ec008
mov edx, dword [ebp - 0x470]
cmp ecx, edx
jne 0x4ec098
push 1
push dword [esi + 0x14b8]
lea ecx, [ebp - 0x4c]
call fcn.005dc260
mov eax, dword [esi + 0x14b4]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x46c], eax
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ee0df
mov eax, dword [ebp - 0x484]
cmp dword [ebp - 0x46c], eax
jne 0x4ec060
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4ee0df
mov ecx, dword [ebp - 0x470]
xor eax, eax
cmp dword [ebp - 0x46c], ecx
mov ecx, 3
cmove eax, ecx
lea ecx, [ebp - 0x4c]
push eax
call fcn.005dc190
push eax
push dword [ebp - 0x46c]
mov ecx, edi
call fcn.005bcd30
jmp 0x4ee0df
mov edx, dword [ebp - 0x470]
cmp eax, 0xffffffbc
je 0x4ec0a2
cmp eax, 0xffffffbd
jne 0x4ec0b5
cmp dword [esi + 0x14b4], edx
jne 0x4ec0b5
push dword [ebp - 0x4b0]
jmp 0x4ee0d8
mov eax, dword [esi + 0x14a8]
cmp eax, dword [ebp - 0x514]
jne 0x4ec0eb
push 0
push 0
push 0x14b
push dword [ebp - 0x474]
call dword [sym.imp.USER32.dll_SendMessageW]
push 2
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerRunHistory
mov ecx, esi
call fcn.00438360
jmp 0x4ee0df
cmp eax, dword [ebp - 0x510]
jne 0x4ec13f
push 0
mov ecx, edi
call fcn.005c5730
push eax
push 0
push 0
push 0x10800800
push 0x630fe0
push 0
mov edx, str.Select_the_file_you_want_to_run_or_open
lea ecx, [ebp - 0x4c]
call fcn.005e1e60
test al, al
je 0x4ee0df
push 3
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
push dword [ebp - 0x470]
mov ecx, edi
call fcn.005bcd30
jmp 0x4ee0df
cmp eax, dword [ebp - 0x4b0]
jne 0x4ec220
push edx
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc1c0
mov ecx, eax
call fcn.005dbeb0
test al, al
je 0x4ec19d
push 0x80
push dword [ebp - 0x470]
mov ecx, edi
call fcn.005bd3f0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push edi
push 4
push str.Please_specify_a_file_or_protocol_to_open_before_using_this_feature.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
push 0
push 5
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dbc20
mov ecx, eax
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005e26a0
test eax, eax
je 0x4ee0df
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push 0
push 0x14c
push dword [ebp - 0x474]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x4ec1f9
push 0
push eax
push 0x144
push dword [ebp - 0x474]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4ec1ff
je 0x4ee0df
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push 0
push 0x14a
push dword [ebp - 0x474]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4ee0df
cmp eax, dword [ebp - 0x50c]
jne 0x4ec291
push edx
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc1c0
mov ecx, eax
call fcn.005dbeb0
test al, al
je 0x4ec27a
push 0x80
push dword [ebp - 0x470]
mov ecx, edi
call fcn.005bd3f0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push edi
push 4
push str.Please_specify_the_search_keywords_before_using_this_feature.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0045ee00
jmp 0x4ee0df
cmp eax, 0xffffffb3
je 0x4ee0a4
cmp eax, 0xffffffb5
je 0x4ee0a4
cmp eax, 0xffffffb4
je 0x4ee0a4
cmp eax, 0xfffffff2
jne 0x4eca75
mov ecx, dword [ebp - 0x494]
cmp dword [esi + 0x14b4], ecx
jne 0x4eca75
push 2
push 0xffffffffffffffff
push ecx
mov ecx, edi
call fcn.005bb4c0
cmp eax, 0xffffffff
je 0x4ee0df
push 1
push eax
push dword [ebp - 0x494]
mov ecx, edi
call fcn.005bb510
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc1c0
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x6c], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x74]
push eax
movq qword [ebp - 0x74], xmm0
call fcn.005dc5b0
push 0
push 1
push 1
push 0
push 0x624518
push 0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0xe
call fcn.005dbed0
mov ecx, eax
call fcn.005daa70
test eax, eax
jne 0x4ec34b
push eax
lea ecx, [esi + 0x1290]
call fcn.0057c540
push eax
lea ecx, [ebp - 0x74]
call fcn.005dc510
push 0
push 1
push 1
push 0
push str._netplwiz.dll_UsersRunDll
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
jne 0x4ec9bb
push str.Certificate_manager
lea ecx, [ebp - 0x3c]
call fcn.005dc4c0
test al, al
je 0x4ec3cb
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x43c]
push eax
mov dword [ebp - 0x43c], 0x14
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], str.Certificates
mov dword [ebp - 0x42c], 0
call dword [sym.imp.CRYPTUI.dll_CryptUIDlgCertMgr]
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0xd
call fcn.005dc430
jmp 0x4ee0df
push 0
push 1
push 1
push 0
push str.GodMode.ED7BA470_8E54_465E_825C_99712043E01C
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec44e
movsd xmm0, qword [0x6edab8]
comisd xmm0, xmmword [esi + 8]
jbe 0x4ec404
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0xd
call fcn.005dc430
jmp 0x4ee0df
lea ecx, [ebp - 0x3c]
call fcn.005dc190
or edx, 0xffffffff
mov ecx, eax
call fcn.005e0f30
test al, al
je 0x4ec43d
push 0
push 5
push 0
lea ecx, [esi + 0x1290]
call fcn.0057bbe0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005e2950
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0xd
call fcn.005dc430
jmp 0x4ee0df
push 0
push 1
push 1
push 0
push str.gpedit.msc__s
lea ecx, [ebp - 0x3c]
call fcn.005daa70
push 0
test eax, eax
je 0x4ec4ee
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.gpedit.msc
push dword [esi + 0x24]
lea ecx, [ebp - 0x4c]
call fcn.005dc200
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ec528
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push eax
push edi
push 1
push str.The_Local_Group_Policy_Editor_is_not_installed_on_this_system._r_n_r_n_Do_you_want_to_install_it_now_
mov ecx, esi
call fcn.0043e2e0
test eax, eax
jne 0x4ec4d9
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0xd
call fcn.005dc430
jmp 0x4ee0df
lea ecx, [esi + 0x1290]
call fcn.005543d0
push 0x686cdc
jmp 0x4ec9c0
push 1
push 1
push 0
push str.cmd.exe_
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec50f
push 0x64f4e8
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push str.mmc.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec532
push 0x686cdc
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push 0x627e5c
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
jne 0x4ec9bb
push eax
push 1
push 1
push eax
push str.Sigverif.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec570
push str.Sigverif
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push str._shell32.dll_Options_RunDLL
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec5a3
push 0x63c62c
push str.NoFolderOptions
lea ecx, [esi + 0x1290]
call fcn.0056ad20
jmp 0x4ec9cb
push 0
push 1
push 1
push 0
push str.mip.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec5c6
push 0x686d40
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push str.osk.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec5e9
push 0x686d48
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push str.powershell.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec60c
push str.powershell
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push str.psr.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
lea ecx, [ebp - 0x3c]
test eax, eax
je 0x4ec66a
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ec649
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0xd
call fcn.005dc430
jmp 0x4ee0df
push 0x686d88
lea ecx, [esi + 0x1290]
call fcn.0055baa0
push 0
push 5
lea ecx, [ebp - 0x74]
call fcn.005dc190
jmp 0x4ec42b
push 0
push 1
push 1
push 0
push str.MSConfig.exe
call fcn.005daa70
test eax, eax
je 0x4ec68a
push str.MSConfig
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push str.msinfo32.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec6ad
push str.msinfo32
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push str.quickassist.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec6d0
push str.quickassist
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push str._regedit.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec6f3
push str.regedit
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push str.perfmon.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec716
push str.perfmon
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push str.IExpress.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec739
push str.IExpress
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push str.SnippingTool.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec75c
push str.SnippingTool
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push str._rstrui.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec79c
lea ecx, [esi + 0x1290]
call fcn.00553420
test eax, eax
je 0x4ec9cb
push 0
push 0
lea ecx, [esi + 0x1290]
call fcn.00571730
jmp 0x4ec9cb
push 0
push 1
push 1
push 0
push str._taskmgr.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec7bf
push str.taskmgr
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push str.cleanup_toolmsicuu.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
push 0
test eax, eax
je 0x4ec8c6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64c718
lea ecx, [esi + 0x150]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x74]
call fcn.005dc200
push 5
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [esi + 0x1290]
call fcn.00579420
push 0
push 1
push str.PcaSvc
mov ecx, esi
call fcn.00437d40
push 0
push 0x80
push str.PcaSvc
mov ecx, esi
call fcn.00437d40
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xa0
push 0x1c2
push 0
push edi
push 1
push str.After_cleaning_up_Windows_installer_entries_with_the_Windows_installer_cleanup_tool__you_should_run_the__Fix_install_problems__fix__because_msicuu.exe_may_block_some_of_the_installer_database_keys._r_n_r_nDo_you_wish_to_run_the__Fix_install_problems__fix_now_
mov ecx, esi
call fcn.0043e2e0
cmp eax, 1
jne 0x4ec43d
push eax
push 5
push 0
push 0xffffffffffffffba
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x46
push 0x1c2
push edi
push 0
mov ecx, esi
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b62b0
lea ecx, [esi + 0x1290]
call fcn.0056a3b0
push 2
lea ecx, [esi + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0xd
call fcn.005dc430
jmp 0x4ee0df
push 1
push 1
push 0
push str.pwcreator.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec8e7
push str.pwcreator
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push str.control.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec90a
push str.control
jmp 0x4ec9c0
push 0
push 1
push 1
push 0
push str.wordpad.exe
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
je 0x4ec92d
push str.rundll32
lea ecx, [esi + 0x1290]
call fcn.0055baa0
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dc440
cmp word [eax], 0x20
jne 0x4eca0f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._rundll32.exe_shell32.dll_Control_RunDLL
push dword [esi + 0x24]
lea ecx, [ebp - 0x3c]
call fcn.005da510
push str.rundll32
lea ecx, [esi + 0x1290]
call fcn.0055baa0
push 5
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [esi + 0x1290]
call fcn.00579420
test eax, eax
jne 0x4ec43d
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4eca64
push eax
push 1
push 1
push eax
push 0x624284
lea ecx, [ebp - 0x3c]
call fcn.005daa70
test eax, eax
jne 0x4ec43d
push 0
push 5
lea ecx, [ebp - 0x74]
call fcn.005dc190
jmp 0x4ec42b
cmp eax, dword [ebp - 0x508]
jne 0x4ecacf
push 0
mov ecx, edi
call fcn.005c5730
push eax
push 0
push 0
push 0x10800800
push 0x630fe0
push 0
mov edx, str.Select_the_file_you_want_to_manage
lea ecx, [ebp - 0x4c]
call fcn.005e1e60
test al, al
je 0x4ee0df
push 0
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
push dword [ebp - 0x490]
mov ecx, edi
call fcn.005bcd30
push dword [ebp - 0x4a4]
jmp 0x4ee0d8
mov eax, dword [esi + 0x14a8]
cmp eax, dword [ebp - 0x504]
jne 0x4ecb13
push dword [ebp - 0x490]
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc1c0
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.00438d80
push 6
push 5
mov ecx, edi
call fcn.005c3f80
jmp 0x4ee0df
cmp eax, dword [ebp - 0x4a4]
jne 0x4ece82
push 0
push ecx
push dword [ebp - 0x490]
mov ecx, edi
call fcn.005bc230
add esp, 4
lea ecx, [ebp - 0x4c]
push eax
call fcn.005dc1c0
mov ecx, eax
call fcn.005dbc20
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ecb78
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push eax
push eax
push 4
push str.The_selected_path_does_not_correspond_to_a_valid_file.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
push 0
push 0
push 0x147
push dword [ebp - 0x47c]
mov ecx, edi
call fcn.005befd0
test eax, eax
jne 0x4ecbac
push 0x627824
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.004359c0
jmp 0x4ee0df
cmp eax, 1
jne 0x4ecbc8
push 2
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0045ee00
jmp 0x4ee0df
cmp eax, 2
jne 0x4ecc8a
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 1
push str.Are_you_sure_you_want_to_deny_everyone_access_to_this_file_
mov ecx, esi
call fcn.0043e2e0
test eax, eax
je 0x4ee0df
push 0
push 4
lea ecx, [ebp - 0x4c]
call fcn.005dc190
mov edx, 1
mov ecx, eax
call fcn.005d74c0
lea ecx, [ebp - 0x4c]
push 0
push 0
test al, al
je 0x4ecc53
call fcn.005dc190
push eax
push str.Successfully_denied_access_to_file:
mov ecx, esi
call fcn.0045a700
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 4
push str.The_selected_file_was_successfully_locked.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
call fcn.005dc190
push eax
push str.Failed_to_deny_access_to_file:
mov ecx, esi
call fcn.0045a700
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 4
push str.The_selected_file_could_not_be_locked.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
cmp eax, 3
jne 0x4ecd4c
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 1
push str.Are_you_sure_you_want_to_grant_everyone_access_to_this_file_
mov ecx, esi
call fcn.0043e2e0
test eax, eax
je 0x4ee0df
push 0
push 4
lea ecx, [ebp - 0x4c]
call fcn.005dc190
mov edx, 1
mov ecx, eax
call fcn.005d76e0
lea ecx, [ebp - 0x4c]
push 0
push 0
test al, al
je 0x4ecd15
call fcn.005dc190
push eax
push str.Successfully_granted_access_to_file:
mov ecx, esi
call fcn.0045a700
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 4
push str.The_selected_file_was_successfully_unlocked.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
call fcn.005dc190
push eax
push str.Failed_to_grant_access_to_file:
mov ecx, esi
call fcn.0045a700
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 4
push str.The_selected_file_could_not_be_unlocked.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
cmp eax, 4
jne 0x4ecdf4
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 1
push str.Are_you_sure_you_want_to_permanently_delete_this_file__r_n_r_n
mov ecx, esi
call fcn.0043e2e0
test eax, eax
je 0x4ee0df
push 0
push 4
lea ecx, [ebp - 0x4c]
call fcn.005dc190
mov edx, 1
mov ecx, eax
call fcn.005d76e0
push 0
push 2
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0045a0e0
mov ecx, esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 4
cmp al, 1
jne 0x4ecdd2
push str.The_selected_file_was_successfully_deleted.
call fcn.0043e2e0
jmp 0x4ee0df
cmp al, 2
jne 0x4ecde5
push str.The_selected_file_was_scheduled_for_removal_on_reboot.
call fcn.0043e2e0
jmp 0x4ee0df
push str.Sorry__this_file_could_not_be_removed._See_the_application_log_for_more_details.
call fcn.0043e2e0
jmp 0x4ee0df
cmp eax, 5
jne 0x4ee0df
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0xa4], 0
push 0x624388
lea ecx, [ebp - 0x4c]
movq qword [ebp - 0xac], xmm0
call fcn.005dc190
push eax
push str.__k_sfc.exe__scanfile_
push 0
lea ecx, [esi + 0x1290]
call fcn.0057bcc0
push eax
lea ecx, [ebp - 0xac]
call fcn.005dc520
push 5
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xac]
push dword [esi + 0x24]
call fcn.005dc190
push eax
lea ecx, [esi + 0x1290]
call fcn.00579420
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0xd
call fcn.005dc430
jmp 0x4ee0df
cmp eax, dword [ebp - 0x500]
jne 0x4eced9
push 0
mov ecx, edi
call fcn.005c5730
push eax
push 0
push 1
push 0
lea ecx, [ebp - 0x4c]
call fcn.005dc400
mov edx, str.Select_the_folder_you_want_to_unlock
mov ecx, eax
call fcn.005e1b00
test al, al
je 0x4ee0df
push 0
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
push dword [ebp - 0x484]
mov ecx, edi
call fcn.005bcd30
push dword [ebp - 0x4c0]
jmp 0x4ee0d8
cmp eax, dword [ebp - 0x4c0]
jne 0x4ed102
push 0
push ecx
push dword [ebp - 0x484]
mov ecx, edi
call fcn.005bc230
add esp, 4
lea ecx, [ebp - 0x4c]
push eax
call fcn.005dc1c0
mov ecx, eax
call fcn.005dbc20
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov ecx, esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push edi
test eax, eax
jne 0x4ecf3f
push 4
push str.Please_indicate_a_valid_folder_before_using_this_feature.
call fcn.0043e2e0
jmp 0x4ee0df
push 1
push str.Are_you_sure_you_want_to_grant_everyone_access_to_the_selected_folder_
call fcn.0043e2e0
test eax, eax
je 0x4ee0df
push 1
mov ecx, esi
call fcn.0043d8e0
push 0
push str.Cancel__not_recommended_
push 0
push 0xffffffffffffffba
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x46
push 0x1c2
push edi
push str.Unlocking_the_selected_folder...
mov ecx, esi
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b64a0
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], 0
call fcn.005d80d0
push 0x1a
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0x10
call fcn.005d8190
push 3
push 0x10000000
push 1
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x50]
push dword [ebp - 0x414]
call fcn.005d7f50
push 3
push 0x10000000
push 1
push 0x16
lea ecx, [ebp - 0x50]
call fcn.005d7f80
push 3
push 0x10000000
push 1
push 1
lea ecx, [ebp - 0x50]
call fcn.005d7f80
call fcn.005d8790
comisd xmm0, xmmword [0x6edac0]
jbe 0x4ed029
push 3
push 0xa0000000
push 1
push str.S_1_15_2_1
lea ecx, [ebp - 0x50]
call fcn.005d8000
push 3
push 0xa0000000
push 1
push str.S_1_15_2_2
lea ecx, [ebp - 0x50]
call fcn.005d8000
push dword [ebp - 0x414]
lea ecx, [ebp - 0x4c]
push 5
push 1
call fcn.005dc190
push eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [esi + 0x1290]
call fcn.0056a780
mov dword [ebp - 0x45c], eax
test eax, eax
jne 0x4ed07d
push dword [ebp - 0x414]
lea ecx, [ebp - 0x4c]
push 5
push 1
call fcn.005dc190
push eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [esi + 0x1290]
call fcn.0056a780
mov dword [ebp - 0x45c], eax
push 2
lea ecx, [esi + 0x14f0]
call fcn.005b6250
push 0
push 1
mov ecx, esi
call fcn.0043d720
mov eax, dword [ebp - 0x45c]
cmp eax, 0xffffffff
jne 0x4ed0bc
lea ecx, [ebp - 0x414]
call fcn.005d8100
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0xd
call fcn.005d80c0
jmp 0x4ee0df
mov ecx, esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push edi
push 4
test eax, eax
je 0x4ed0dc
push str.The_selected_folder_was_successfully_unlocked.
jmp 0x4ed0e1
push str.Sorry__this_folder_could_not_be_unlocked._Please_try_again.
call fcn.0043e2e0
lea ecx, [ebp - 0x414]
call fcn.005d8100
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0xd
call fcn.005d80c0
ret
scasd eax, dword es:[edi]
push cs
add cl, ch
fisttp qword [edi]
add byte [eax], al
cmp eax, 0xffffffbc
je 0x4ed10c
cmp eax, 0xffffffbd
jne 0x4ed125
mov ecx, dword [ebp - 0x4d0]
cmp dword [esi + 0x14b4], ecx
jne 0x4ed12b
push dword [ebp - 0x4e4]
jmp 0x4ee0d8
mov ecx, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x4e4]
jne 0x4ed1e6
push ecx
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc1c0
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [esi + 0x1290]
call fcn.0055bc70
test eax, eax
je 0x4ed1b1
push 0x624cbc
lea ecx, [ebp - 0x3c]
call fcn.005dc4c0
test al, al
je 0x4ed182
push 1
push str.All_seven_file_extensions_were_successfully_fixed.
lea ecx, [ebp - 0x5c]
call fcn.005dc260
jmp 0x4ed1be
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._file_extension_was_successfully_fixed.
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push str.The
lea ecx, [ebp - 0x5c]
call fcn.005dc200
jmp 0x4ed1be
push str.The_registry_entries_could_not_be_created._r_n_r_nPlease_press__Unlock_extensions__and_try_again.
lea ecx, [ebp - 0x5c]
call fcn.005dc510
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push edi
push 4
lea ecx, [ebp - 0x5c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
cmp eax, dword [ebp - 0x4fc]
jne 0x4ed222
push 0x624cbc
lea ecx, [esi + 0x1290]
call fcn.0055c040
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push edi
push 4
push str.The_exe__msi__reg__bat__cmd__com_and_vbs_file_extensions_have_been_successfully_protected_from_changes.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
cmp eax, dword [ebp - 0x4f8]
jne 0x4ed25e
push 0x624cbc
lea ecx, [esi + 0x1290]
call fcn.0055bcd0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push edi
push 4
push str.The_exe__msi__reg__bat__cmd__com_and_vbs_file_extensions_have_been_successfully_unlocked.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
mov ecx, dword [esi + 0x14a8]
cmp ecx, dword [ebp - 0x4ec]
jne 0x4ed2cc
push dword [ebp - 0x49c]
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x68]
call fcn.005dc1c0
push 0
lea ecx, [ebp - 0x68]
call fcn.005dc190
push eax
push 0x2710
lea ecx, [ebp - 0x68]
call fcn.005db9a0
push eax
mov edx, str.Select_the_registry_key_to_manage
mov ecx, edi
call fcn.0050b1c0
test al, al
je 0x4ee0df
push 0
lea ecx, [ebp - 0x68]
call fcn.005dc190
push eax
push dword [ebp - 0x49c]
mov ecx, edi
call fcn.005bcd30
jmp 0x4ee0df
cmp ecx, dword [ebp - 0x4d4]
jne 0x4ed5b9
push dword [ebp - 0x49c]
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x68]
call fcn.005dc1c0
lea ecx, [ebp - 0x68]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x4ed328
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 4
push str.The_selected_path_does_not_correspond_to_a_valid_registry_key.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
push 0
push 0
push 0x147
push dword [ebp - 0x498]
mov ecx, edi
call fcn.005befd0
mov dword [ebp - 0x45c], eax
test eax, eax
jle 0x4ed59c
push 0
push 1
push 1
push 0
push 0x624284
lea ecx, [ebp - 0x68]
call fcn.005daa70
test eax, eax
jne 0x4ed388
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push eax
push eax
push 4
push str.You_can_not_perform_this_action_to_a_root_key.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
mov eax, dword [ebp - 0x45c]
cmp eax, 1
jne 0x4ed44d
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push eax
push str.Are_you_sure_you_want_to_prevent_changes_to_this_registry_key_
mov ecx, esi
call fcn.0043e2e0
test eax, eax
je 0x4ee0df
push 0xe
lea ecx, [ebp - 0x68]
call fcn.005dc190
push eax
lea ecx, [esi + 0x1290]
call fcn.0055e500
lea ecx, [ebp - 0x68]
push 0
push 0
test eax, eax
je 0x4ed416
call fcn.005dc190
push eax
push str.Successfully_prevented_key_from_changes:
mov ecx, esi
call fcn.0045a700
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 4
push str.The_operation_completed_successfully.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
call fcn.005dc190
push eax
push str.Failed_to_prevent_key_from_changes:
mov ecx, esi
call fcn.0045a700
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 4
push str.The_operation_could_not_be_completed.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
cmp eax, 2
jne 0x4ed50d
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 1
push str.Are_you_sure_you_want_to_grant_everyone_access_to_this_key_
mov ecx, esi
call fcn.0043e2e0
test eax, eax
je 0x4ee0df
push 0xc
lea ecx, [ebp - 0x68]
call fcn.005dc190
push eax
lea ecx, [esi + 0x1290]
call fcn.0055e500
lea ecx, [ebp - 0x68]
push 0
push 0
test eax, eax
je 0x4ed4d6
call fcn.005dc190
push eax
push str.Successfully_unlocked_registry_key:
mov ecx, esi
call fcn.0045a700
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 4
push str.The_selected_registry_key_was_successfully_unlocked.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
call fcn.005dc190
push eax
push str.Failed_to_unlock_registry_key:
mov ecx, esi
call fcn.0045a700
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 4
push str.The_selected_registry_key_could_not_be_unlocked.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
cmp eax, 3
jne 0x4ee0df
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 1
push str.Are_you_sure_you_want_to_delete_this_registry_key_
mov ecx, esi
call fcn.0043e2e0
test eax, eax
je 0x4ee0df
push 0xc
lea ecx, [ebp - 0x68]
call fcn.005dc190
push eax
lea ecx, [esi + 0x1290]
call fcn.0055e500
lea ecx, [ebp - 0x68]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0043c350
mov ecx, esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 4
test al, al
je 0x4ed58d
push str.The_selected_registry_key_was_successfully_deleted.
call fcn.0043e2e0
jmp 0x4ee0df
push str.The_selected_registry_key_could_not_be_deleted.
call fcn.0043e2e0
jmp 0x4ee0df
jne 0x4ee0df
push 2
lea ecx, [ebp - 0x68]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0045ee00
jmp 0x4ee0df
cmp ecx, 0xffffffd3
je 0x4ed5c7
cmp ecx, 0xffffffd2
jne 0x4ed64b
mov eax, dword [ebp - 0x444]
cmp dword [esi + 0x14b4], eax
jne 0x4ed651
push 2
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.005bb4c0
mov ecx, edi
cmp eax, 0xffffffff
jne 0x4ed5ff
push 0
push 0x62439c
push dword [ebp - 0x4c4]
call fcn.005bcd30
jmp 0x4ee0df
push 1
push eax
push dword [ebp - 0x444]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc1c0
mov ecx, eax
call fcn.005dbeb0
test al, al
je 0x4ed62e
push str.This_tweak_takes_effect_instantly.
lea ecx, [ebp - 0x3c]
call fcn.005dc510
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push dword [ebp - 0x4c4]
mov ecx, edi
call fcn.005bcd30
jmp 0x4ee0df
mov eax, dword [ebp - 0x444]
cmp ecx, 0xffffffd1
je 0x4ed65f
cmp ecx, 0xffffffd0
jne 0x4ed818
cmp dword [esi + 0x14b4], eax
jne 0x4ed818
mov ecx, dword [esi + 0x14b8]
mov dword [ebp - 0x46c], ecx
cmp ecx, 0xffffffff
je 0x4ee0df
push 0xf000
push ecx
push 0x102c
push eax
mov ecx, edi
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [ebp - 0x46c]
shr eax, 0xd
mov ecx, edi
push dword [ebp - 0x444]
and eax, 0xffffff01
mov dword [ebp - 0x45c], eax
call fcn.005bb510
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc1c0
push str.This_tweak_requires_a_shell_restart_to_take_effect.
lea ecx, [ebp - 0x3c]
call fcn.005dc4c0
push 0
push dword [ebp - 0x46c]
movzx eax, al
mov ecx, edi
push dword [ebp - 0x444]
add dword [ebp - 0x450], eax
call fcn.005bb510
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc1c0
push 0
push dword [ebp - 0x45c]
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [esi + 0x1290]
call fcn.0054f030
cmp eax, 0xfffffffe
jne 0x4ed785
mov eax, dword [ebp - 0x45c]
mov ecx, edi
movzx eax, al
xor eax, 1
mov dword [ebp - 0x148], 0xf000
inc eax
shl eax, 0xc
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x158]
push eax
push dword [ebp - 0x46c]
push 0x102b
push dword [ebp - 0x444]
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push edi
push 4
push str.Sorry__this_tweak_does_not_work_for_the_current_Windows_version.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
cmp eax, 1
jge 0x4ed7f4
mov eax, dword [ebp - 0x45c]
mov ecx, edi
movzx eax, al
xor eax, 1
mov dword [ebp - 0x10c], 0xf000
inc eax
shl eax, 0xc
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x46c]
push 0x102b
push dword [ebp - 0x444]
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push edi
push 4
push str.Sorry__this_tweak_could_not_be_applied.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push edi
push 4
push str.The_selected_tweak_was_successfully_applied.
mov ecx, esi
call fcn.0043e2e0
jmp 0x4ee0df
mov eax, dword [ebp - 0x4f0]
cmp ecx, eax
jne 0x4ed853
push 4
push eax
mov ecx, edi
call fcn.005bc500
push 0xffffffffffffffff
push 0xffffffffffffffff
test eax, eax
mov ecx, edi
push 0
setne byte [ebp - 0x4f4]
push dword [ebp - 0x4f4]
push dword [ebp - 0x454]
call fcn.005bba40
jmp 0x4ee0df
cmp ecx, 0xffffffd1
je 0x4ed861
cmp dword [esi + 0x14a8], 0xffffffd0
jne 0x4ed895
mov eax, dword [ebp - 0x454]
cmp dword [esi + 0x14b4], eax
jne 0x4ed89b
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.005bb420
sar eax, 0x1f
mov ecx, edi
and eax, 0x20
add eax, 0x20
push eax
push dword [ebp - 0x4cc]
call fcn.005bd3f0
jmp 0x4ee0df
mov eax, dword [ebp - 0x454]
mov ecx, dword [esi + 0x14a8]
cmp ecx, 0xffffffd3
je 0x4ed8ab
cmp ecx, 0xffffffd2
jne 0x4ed8db
cmp dword [esi + 0x14b4], eax
jne 0x4ed8db
push 2
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.005bb4c0
sar eax, 0x1f
mov ecx, edi
and eax, 0x20
add eax, 0x20
push eax
push dword [ebp - 0x4c8]
call fcn.005bd3f0
jmp 0x4ee0df
cmp ecx, dword [ebp - 0x4c8]
jne 0x4ed9e8
push 2
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.005bb4c0
mov dword [ebp - 0x45c], eax
mov ecx, esi
push 0xffffffffffffffff
push 0xffffffffffffffff
test eax, eax
jns 0x4ed922
push 0x8c
push 0x190
push 0
push 0
push 4
push str.Please_select__click_on__the_desired_restore_point_in_the_list_before_using_this_feature.
call fcn.0043e2e0
jmp 0x4ee0df
push 0xa0
push 0x1c2
push 0
push 0
push 1
push str.Important:_The_computer_will_be_automatically_restarted_to_complete_the_restore_operation._r_n_r_nAre_you_sure_you_want_to_restore_the_computers_state_to_the_selected_restore_point_
call fcn.0043e2e0
test eax, eax
je 0x4ee0df
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x46
push 0x1f4
push 0
push str.Scheduling_a_system_restore...
mov ecx, esi
call fcn.0043da60
push 0
push dword [ebp - 0x45c]
mov ecx, edi
push dword [ebp - 0x454]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x88]
call fcn.005dc1c0
lea ecx, [ebp - 0x88]
call fcn.005dafb0
push eax
lea ecx, [esi + 0x1290]
call fcn.00553250
mov ecx, dword [ebp - 0x448]
mov esi, eax
push 2
lea ecx, [ecx + 0x14f0]
call fcn.005b6250
test esi, esi
mov esi, dword [ebp - 0x448]
jne 0x4ee0f5
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xaa
push 0x1c2
push 0
push edi
push 0
push str.Sorry__the_system_restore_operation_could_not_be_scheduled.
mov ecx, esi
call fcn.0043e2e0
push dword [ebp - 0x48c]
call dword [sym.imp.USER32.dll_BringWindowToTop]
jmp 0x4ee0df
cmp ecx, dword [ebp - 0x4cc]
jne 0x4edb5e
xorps xmm0, xmm0
mov ecx, edi
push eax
movlpd qword [ebp - 0x410], xmm0
call fcn.005bb7f0
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
mov byte [ebp - 4], 0x12
mov ecx, esi
cmp dword [eax], 0
push 0
push 0
jne 0x4eda60
push 4
push str.Please_check_one_or_more_restore_points_in_the_list_before_using_this_feature.
call fcn.0043e2e0
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x410]
test eax, eax
je 0x4ee0df
push eax
call fcn.0041e1c3
add esp, 4
jmp 0x4ee0df
push 1
push str.Are_you_sure_you_want_to_remove_the_selected_system_restore_points_
call fcn.0043e2e0
test eax, eax
je 0x4eda40
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x46
push 0x1f4
push 0
push str.Deleting_the_selected_restore_points...
mov ecx, esi
call fcn.0043da60
push 0
push str.Cancel
push 0
push 0xffffffffffffffba
lea ecx, [esi + 0x14f0]
call fcn.005b66e0
mov ecx, eax
call fcn.005b64a0
mov ecx, dword [ebp - 0x410]
mov eax, dword [ecx]
mov dword [ebp - 0x45c], eax
test eax, eax
je 0x4edb3a
mov esi, dword [ebp - 0x460]
jmp 0x4edaca
push 0
push dword [ecx + eax*4]
mov ecx, edi
push dword [ebp - 0x454]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x88]
call fcn.005dc1c0
lea ecx, [ebp - 0x88]
call fcn.005dafe0
push eax
mov ecx, esi
call fcn.00564cd0
cmp eax, 0xffffffff
je 0x4edb34
cmp eax, 1
jne 0x4edb23
mov esi, dword [ebp - 0x448]
push 2
lea ecx, [esi + 0x14f0]
call fcn.005b6250
mov byte [ebp - 4], 0xd
push dword [ebp - 0x410]
call fcn.0041e1c3
add esp, 4
jmp 0x4ee0df
cmp ecx, dword [ebp - 0x4bc]
jne 0x4edd27
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x98], 0
push str._restore_point
lea ecx, [esi + 0x143c]
movq qword [ebp - 0xa0], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0xa0]
call fcn.005dc520
push 0
push 0x96
push 0x186
xorps xmm0, xmm0
mov byte [ebp - 4], 0x13
push 0
lea ecx, [ebp - 0xa0]
movlpd qword [ebp - 0x410], xmm0
call fcn.005dc190
push eax
push str.Please_enter_the_name_for_the_restore_point.
mov ecx, esi
call fcn.0043d160
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], 0
mov byte [ebp - 4], 0x14
test eax, eax
jne 0x4edc10
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0xd
call fcn.005dc430
jmp 0x4ee0df
mov ecx, eax
call fcn.005d8c40
mov ecx, esi
cmp eax, 1
jge 0x4edc5e
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 4
push str.The_system_restore_points_name_can_not_be_an_empty_string.
call fcn.0043e2e0
push dword [ebp - 0x410]
call fcn.0041e1c3
add esp, 4
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xa0]
call fcn.005dc430
jmp 0x4ee0df
push 0
push 0xffffffffffffffba
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x46
push 0x1c2
push 0
push 0
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
push 0
push 0
push 0
push 0x64
push dword [ebp - 0x410]
lea ecx, [esi + 0x1290]
call fcn.00564a40
mov ecx, dword [ebp - 0x448]
mov edi, eax
push 2
mov esi, edx
lea ecx, [ecx + 0x14f0]
call fcn.005b6250
or edi, esi
mov esi, dword [ebp - 0x448]
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, esi
je 0x4edd02
push 0xa0
push 0x19a
push 0
push 0
push 4
push str.The_system_restore_point_was_successfully_created._r_n_r_nHowever__it_may_take_a_while_to_be_available._r_nIf_it_doesnt_show_up_in_the_list__please_check_back_later.
call fcn.0043e2e0
push dword [ebp - 0x4a8]
mov edi, dword [ebp - 0x4ac]
mov ecx, esi
push dword [ebp - 0x464]
push dword [ebp - 0x44c]
push dword [ebp - 0x454]
push edi
call fcn.004e67d0
jmp 0x4edc3c
push 0x8c
push 0x190
push 0
push 0
push 4
push str.Sorry__an_error_occurred_while_creating_the_system_restore_point.
call fcn.0043e2e0
mov edi, dword [ebp - 0x4ac]
jmp 0x4edc3c
cmp ecx, dword [ebp - 0x464]
jne 0x4edec4
push 0
push 1
mov ecx, esi
call fcn.0043d720
push 4
push dword [ebp - 0x464]
mov ecx, edi
call fcn.005bc500
movsd xmm0, qword [0x6edac0]
comisd xmm0, xmmword [esi + 8]
mov dword [ebp - 0x45c], eax
jbe 0x4edd89
push 0
push 0xffffffffffffffba
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x46
push 0x1c2
push 0
push 0
mov ecx, esi
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
mov eax, dword [ebp - 0x45c]
lea ecx, [esi + 0x1290]
push 0
push 0
test eax, eax
je 0x4edd9e
call fcn.005700e0
jmp 0x4edda3
call fcn.00571730
movsd xmm0, qword [0x6edac0]
comisd xmm0, xmmword [esi + 8]
mov dword [ebp - 0x45c], eax
jbe 0x4eddc5
push 2
lea ecx, [esi + 0x14f0]
call fcn.005b6250
push 4
push dword [ebp - 0x464]
mov ecx, edi
call fcn.005bc500
mov ecx, eax
mov dword [ebp - 0x8c], 0
xor eax, eax
mov dword [ebp - 0x46c], ecx
test ecx, ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x94]
movq qword [ebp - 0x94], xmm0
setne al
lea eax, [eax*4 + 4]
mov dword [ebp - 0x40c], eax
call fcn.005dc5e0
cmp dword [ebp - 0x45c], 1
mov eax, 0x688bcc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov byte [ebp - 4], 0x15
mov ecx, 0x688bd4
push str.abled.
je 0x4ede6e
cmp ecx, dword [ebp - 0x4a8]
jne 0x4ee0df
mov byte [ebp - 0x455], 1
push 0
push 0
push 0x146
push dword [ebp - 0x474]
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
mov dword [ebp - 0x4bc], eax
test eax, eax
jle 0x4edfbd
xor esi, esi
nop
push 0
push edi
push 0x149
push dword [ebp - 0x474]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x40c], eax
cmp eax, 1
jl 0x4edfaa
push 0
lea ecx, [eax + 2]
push 0
push ecx
lea ecx, [ebp - 0x5c]
call fcn.005db9a0
push eax
push edi
push 0x148
push dword [ebp - 0x474]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4edfaa
push dword [ebp - 0x40c]
lea ecx, [ebp - 0x5c]
call fcn.005dc440
xor ecx, ecx
push ecx
mov word [eax], cx
lea ecx, [ebp - 0x5c]
call fcn.005dc190
push eax
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6838d8
push esi
lea ecx, [ebp - 0x3c]
call fcn.005db320
mov ecx, eax
call fcn.005da510
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x7c]
call fcn.005d5f20
inc esi
cmp esi, 0x1d
jg 0x4edfb7
inc edi
cmp edi, dword [ebp - 0x4bc]
jl 0x4edf00
mov esi, dword [ebp - 0x448]
cmp dword [ebp - 0x450], 0
jle 0x4edff8
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8c
push 0x190
push 0
push 0
push 1
push str.Some_of_the_applied_tweaks_require_a_Windows_shell_retart._r_n_r_nDo_you_want_to_restart_the_Windows_shell_now_
mov ecx, esi
call fcn.0043e2e0
cmp eax, 1
jne 0x4edff8
push 0
lea ecx, [esi + 0x1290]
call fcn.00578c60
mov al, byte [ebp - 0x455]
mov ecx, esi
xor al, 1
movzx eax, al
push eax
call fcn.0045f260
lea ecx, [ebp - 0x88]
call fcn.005dc430
lea ecx, [ebp - 0x68]
call fcn.005dc430
lea ecx, [ebp - 0x4c]
call fcn.005dc430
mov eax, dword [ebp - 0x1b8]
cmp eax, 0xffffffff
je 0x4ee038
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x428]
call fcn.005d6b00
lea ecx, [ebp - 0x40]
call fcn.005d69e0
mov ecx, dword [ebp - 0x4a0]
test ecx, ecx
je 0x4ee05d
mov eax, dword [ecx]
push 1
mov eax, dword [eax]
call eax
lea ecx, [ebp - 0xb8]
call fcn.005d6ab0
lea ecx, [ebp - 0x7c]
call fcn.005d69e0
lea ecx, [ebp - 0x5c]
call fcn.005dc430
lea ecx, [ebp - 0x3c]
call fcn.005dc430
mov al, byte [ebp - 0x455]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, dword [esi + 0x14b4]
cmp eax, dword [ebp - 0x490]
jne 0x4ee0ba
push dword [ebp - 0x4a4]
jmp 0x4ee0d8
cmp eax, dword [ebp - 0x484]
jne 0x4ee0ca
push dword [ebp - 0x4c0]
jmp 0x4ee0d8
cmp eax, dword [ebp - 0x49c]
jne 0x4ee0df
push dword [ebp - 0x4d4]
mov ecx, edi
call fcn.005c4370
push 0
mov ecx, esi
call fcn.004771c0
test eax, eax
jne 0x4eba90
jmp 0x4eded7
push 0
push 0x12
mov byte [esi + 0x1f80], 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x4eded7