Function at 0x1016f7c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x554
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x478], ebx
mov eax, dword [ebx + 0x28]
mov edx, dword [ebx + 0x24]
sub eax, edx
sar eax, 2
mov dword [ebp - 0x518], ecx
test eax, eax
je 0x10171438
lea esp, [esp]
lea esi, [edx + ecx*4]
mov ecx, 0x10204674
mov edx, dword [esi]
mov eax, edx
lea esp, [esp]
mov di, word [eax]
cmp di, word [ecx]
jne 0x1016f836
test di, di
je 0x1016f832
mov di, word [eax + 2]
cmp di, word [ecx + 2]
jne 0x1016f836
add eax, 4
add ecx, 4
test di, di
jne 0x1016f810
xor eax, eax
jmp 0x1016f83b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1016fbc2
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x47c]
push str.CExtHomePage
mov dword [ebp - 0x47c], eax
call fcn.10023e80
test al, al
jne 0x1016f87e
push 0xc
push str.CExtHomePage
lea ecx, [ebp - 0x47c]
call fcn.10003740
mov eax, dword [ebx]
lea ecx, [ebp - 0x4a0]
push ecx
mov ecx, ebx
call dword [eax + 8]
mov edi, dword [ebp - 0x478]
xor ebx, ebx
mov esi, dword [ebp - 0x47c]
mov dword [ebp - 0x480], ebx
mov eax, dword [edi + 0x18]
sub eax, dword [edi + 0x14]
sar eax, 2
test eax, eax
je 0x1016fb6b
mov dword [ebp - 0x4d4], 0
mov dword [ebp - 0x4d0], 0
mov dword [ebp - 0x4cc], 0
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x490]
push 0x10202ca0
mov dword [ebp - 0x490], eax
call fcn.10023e80
test al, al
jne 0x1016f90a
push 1
push 0x10202ca0
lea ecx, [ebp - 0x490]
call fcn.10003740
lea eax, [ebp - 0x4d4]
push eax
lea eax, [ebp - 0x490]
push eax
mov eax, dword [edi + 0x14]
lea eax, [eax + ebx*4]
push eax
call fcn.101b1a50
mov edx, dword [ebp - 0x490]
add esp, 0xc
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1016f945
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x4d0]
mov ebx, dword [ebp - 0x4d4]
sub edi, ebx
sar edi, 2
cmp edi, 2
jb 0x1016fb3c
mov ecx, dword [ebp - 0x4a0]
mov eax, dword [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1016f98d
test dx, dx
je 0x1016f989
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1016f98d
add eax, 4
add ecx, 4
test dx, dx
jne 0x1016f967
xor eax, eax
jmp 0x1016f992
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1016fb3c
mov eax, dword [ebx + 4]
mov ecx, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1016f9c6
test dx, dx
je 0x1016f9c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1016f9c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1016f9a0
xor eax, eax
jmp 0x1016f9cb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1016fb3c
cmp edi, 5
jb 0x1016fbac
cmp dword [0x1025ab60], eax
jne 0x1016fa4a
mov dword [ebp - 0x540], eax
mov ecx, 0x1024e5d0
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x474]
push eax
call fcn.101b11a0
test eax, eax
jne 0x1016fa1d
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x470]
mov dword [0x1025ab58], eax
mov eax, dword [ebp - 0x46c]
mov dword [0x1025ab5c], eax
call fcn.10009c50
mov ebx, dword [ebp - 0x4d4]
neg eax
sbb eax, eax
neg eax
inc eax
mov dword [0x1025ab60], eax
mov edi, dword [ebx + 8]
mov ecx, 0x1021aa50
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1016fa7a
test dx, dx
je 0x1016fa76
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1016fa7a
add eax, 4
add ecx, 4
test dx, dx
jne 0x1016fa54
xor eax, eax
jmp 0x1016fa7f
sbb eax, eax
or eax, 1
test eax, eax
je 0x1016fa9e
push edi
call sub.msvcrt.dll__wtoi
add esp, 4
cmp eax, dword [0x1025ab58]
jne 0x1016fb3c
mov ebx, dword [ebp - 0x4d4]
mov edi, dword [ebx + 0xc]
mov ecx, 0x1021aa50
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1016face
test dx, dx
je 0x1016faca
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1016face
add eax, 4
add ecx, 4
test dx, dx
jne 0x1016faa8
xor eax, eax
jmp 0x1016fad3
sbb eax, eax
or eax, 1
test eax, eax
je 0x1016faee
push edi
call sub.msvcrt.dll__wtoi
add esp, 4
cmp eax, dword [0x1025ab5c]
jne 0x1016fb3c
mov ebx, dword [ebp - 0x4d4]
mov edi, dword [ebx + 0x10]
mov ecx, 0x1021aa50
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1016fb1e
test dx, dx
je 0x1016fb1a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1016fb1e
add eax, 4
add ecx, 4
test dx, dx
jne 0x1016faf8
xor eax, eax
jmp 0x1016fb23
sbb eax, eax
or eax, 1
test eax, eax
je 0x1016fbac
push edi
call sub.msvcrt.dll__wtoi
add esp, 4
cmp eax, dword [0x1025ab60]
je 0x1016fbac
lea ecx, [ebp - 0x4d4]
call fcn.1002a3c0
mov edi, dword [ebp - 0x478]
mov ebx, dword [ebp - 0x480]
inc ebx
mov dword [ebp - 0x480], ebx
mov eax, dword [edi + 0x18]
sub eax, dword [edi + 0x14]
sar eax, 2
cmp ebx, eax
jb 0x1016f8b1
mov edx, dword [ebp - 0x4a0]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1016fb89
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x104
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x101706ee
mov ecx, eax
call fcn.100f2630
mov edi, eax
jmp 0x101706f0
lea ecx, [ebp - 0x4d4]
call fcn.1002a3c0
mov edx, dword [ebp - 0x4a0]
jmp 0x101706cb
mov ecx, 0x10211790
mov eax, edx
lea esp, [esp]
mov di, word [eax]
cmp di, word [ecx]
jne 0x1016fbf6
test di, di
je 0x1016fbf2
mov di, word [eax + 2]
cmp di, word [ecx + 2]
jne 0x1016fbf6
add eax, 4
add ecx, 4
test di, di
jne 0x1016fbd0
xor eax, eax
jmp 0x1016fbfb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1016ff82
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x47c]
push str.CExtCustomWebDestop
mov dword [ebp - 0x47c], eax
call fcn.10023e80
test al, al
jne 0x1016fc3e
push 0x13
push str.CExtCustomWebDestop
lea ecx, [ebp - 0x47c]
call fcn.10003740
mov eax, dword [ebx]
lea ecx, [ebp - 0x4a4]
push ecx
mov ecx, ebx
call dword [eax + 8]
mov edi, dword [ebp - 0x478]
xor ebx, ebx
mov esi, dword [ebp - 0x47c]
mov dword [ebp - 0x480], ebx
mov eax, dword [edi + 0x18]
sub eax, dword [edi + 0x14]
sar eax, 2
test eax, eax
je 0x1016ff2b
mov dword [ebp - 0x4c8], 0
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0x4c0], 0
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x494]
push 0x10202ca0
mov dword [ebp - 0x494], eax
call fcn.10023e80
test al, al
jne 0x1016fcca
push 1
push 0x10202ca0
lea ecx, [ebp - 0x494]
call fcn.10003740
lea eax, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x494]
push eax
mov eax, dword [edi + 0x14]
lea eax, [eax + ebx*4]
push eax
call fcn.101b1a50
mov edx, dword [ebp - 0x494]
add esp, 0xc
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1016fd05
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x4c4]
mov ebx, dword [ebp - 0x4c8]
sub edi, ebx
sar edi, 2
cmp edi, 2
jb 0x1016fefc
mov ecx, dword [ebp - 0x4a4]
mov eax, dword [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1016fd4d
test dx, dx
je 0x1016fd49
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1016fd4d
add eax, 4
add ecx, 4
test dx, dx
jne 0x1016fd27
xor eax, eax
jmp 0x1016fd52
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1016fefc
mov eax, dword [ebx + 4]
mov ecx, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1016fd86
test dx, dx
je 0x1016fd82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1016fd86
add eax, 4
add ecx, 4
test dx, dx
jne 0x1016fd60
xor eax, eax
jmp 0x1016fd8b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1016fefc
cmp edi, 5
jb 0x1016ff6c
cmp dword [0x1025ab60], eax
jne 0x1016fe0a
mov dword [ebp - 0x544], eax
mov ecx, 0x1024e5d0
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x358]
push eax
call fcn.101b11a0
test eax, eax
jne 0x1016fddd
lea eax, [ebp - 0x358]
mov dword [ebp - 0x358], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x354]
mov dword [0x1025ab58], eax
mov eax, dword [ebp - 0x350]
mov dword [0x1025ab5c], eax
call fcn.10009c50
mov ebx, dword [ebp - 0x4c8]
neg eax
sbb eax, eax
neg eax
inc eax
mov dword [0x1025ab60], eax
mov edi, dword [ebx + 8]
mov ecx, 0x1021aa50
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1016fe3a
test dx, dx
je 0x1016fe36
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1016fe3a
add eax, 4
add ecx, 4
test dx, dx
jne 0x1016fe14
xor eax, eax
jmp 0x1016fe3f
sbb eax, eax
or eax, 1
test eax, eax
je 0x1016fe5e
push edi
call sub.msvcrt.dll__wtoi
add esp, 4
cmp eax, dword [0x1025ab58]
jne 0x1016fefc
mov ebx, dword [ebp - 0x4c8]
mov edi, dword [ebx + 0xc]
mov ecx, 0x1021aa50
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1016fe8e
test dx, dx
je 0x1016fe8a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1016fe8e
add eax, 4
add ecx, 4
test dx, dx
jne 0x1016fe68
xor eax, eax
jmp 0x1016fe93
sbb eax, eax
or eax, 1
test eax, eax
je 0x1016feae
push edi
call sub.msvcrt.dll__wtoi
add esp, 4
cmp eax, dword [0x1025ab5c]
jne 0x1016fefc
mov ebx, dword [ebp - 0x4c8]
mov edi, dword [ebx + 0x10]
mov ecx, 0x1021aa50
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1016fede
test dx, dx
je 0x1016feda
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1016fede
add eax, 4
add ecx, 4
test dx, dx
jne 0x1016feb8
xor eax, eax
jmp 0x1016fee3
sbb eax, eax
or eax, 1
test eax, eax
je 0x1016ff6c
push edi
call sub.msvcrt.dll__wtoi
add esp, 4
cmp eax, dword [0x1025ab60]
je 0x1016ff6c
lea ecx, [ebp - 0x4c8]
call fcn.1002a3c0
mov edi, dword [ebp - 0x478]
mov ebx, dword [ebp - 0x480]
inc ebx
mov dword [ebp - 0x480], ebx
mov eax, dword [edi + 0x18]
sub eax, dword [edi + 0x14]
sar eax, 2
cmp ebx, eax
jb 0x1016fc71
mov edx, dword [ebp - 0x4a4]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1016ff49
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0xbc
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x101706ee
mov ecx, eax
call fcn.100e0a70
mov edi, eax
jmp 0x101706f0
lea ecx, [ebp - 0x4c8]
call fcn.1002a3c0
mov edx, dword [ebp - 0x4a4]
jmp 0x101706cb
mov ecx, 0x1021214c
mov eax, edx
lea esp, [esp]
mov di, word [eax]
cmp di, word [ecx]
jne 0x1016ffb6
test di, di
je 0x1016ffb2
mov di, word [eax + 2]
cmp di, word [ecx + 2]
jne 0x1016ffb6
add eax, 4
add ecx, 4
test di, di
jne 0x1016ff90
xor eax, eax
jmp 0x1016ffbb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10170342
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x47c]
push str.CExtDestopBSIco
mov dword [ebp - 0x47c], eax
call fcn.10023e80
test al, al
jne 0x1016fffe
push 0xf
push str.CExtDestopBSIco
lea ecx, [ebp - 0x47c]
call fcn.10003740
mov eax, dword [ebx]
lea ecx, [ebp - 0x48c]
push ecx
mov ecx, ebx
call dword [eax + 8]
mov edi, dword [ebp - 0x478]
xor ebx, ebx
mov esi, dword [ebp - 0x47c]
mov dword [ebp - 0x480], ebx
mov eax, dword [edi + 0x18]
sub eax, dword [edi + 0x14]
sar eax, 2
test eax, eax
je 0x101702eb
mov dword [ebp - 0x4b0], 0
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0x4a8], 0
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x498]
push 0x10202ca0
mov dword [ebp - 0x498], eax
call fcn.10023e80
test al, al
jne 0x1017008a
push 1
push 0x10202ca0
lea ecx, [ebp - 0x498]
call fcn.10003740
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x498]
push eax
mov eax, dword [edi + 0x14]
lea eax, [eax + ebx*4]
push eax
call fcn.101b1a50
mov edx, dword [ebp - 0x498]
add esp, 0xc
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x101700c5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x4ac]
mov ebx, dword [ebp - 0x4b0]
sub edi, ebx
sar edi, 2
cmp edi, 2
jb 0x101702bc
mov ecx, dword [ebp - 0x48c]
mov eax, dword [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1017010d
test dx, dx
je 0x10170109
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1017010d
add eax, 4
add ecx, 4
test dx, dx
jne 0x101700e7
xor eax, eax
jmp 0x10170112
sbb eax, eax
or eax, 1
test eax, eax
jne 0x101702bc
mov eax, dword [ebx + 4]
mov ecx, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10170146
test dx, dx
je 0x10170142
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10170146
add eax, 4
add ecx, 4
test dx, dx
jne 0x10170120
xor eax, eax
jmp 0x1017014b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x101702bc
cmp edi, 5
jb 0x1017032c
cmp dword [0x1025ab60], eax
jne 0x101701ca
mov dword [ebp - 0x554], eax
mov ecx, 0x1024e5d0
lea eax, [ebp - 0x554]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.101b11a0
test eax, eax
jne 0x1017019d
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x238]
mov dword [0x1025ab58], eax
mov eax, dword [ebp - 0x234]
mov dword [0x1025ab5c], eax
call fcn.10009c50
mov ebx, dword [ebp - 0x4b0]
neg eax
sbb eax, eax
neg eax
inc eax
mov dword [0x1025ab60], eax
mov edi, dword [ebx + 8]
mov ecx, 0x1021aa50
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x101701fa
test dx, dx
je 0x101701f6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x101701fa
add eax, 4
add ecx, 4
test dx, dx
jne 0x101701d4
xor eax, eax
jmp 0x101701ff
sbb eax, eax
or eax, 1
test eax, eax
je 0x1017021e
push edi
call sub.msvcrt.dll__wtoi
add esp, 4
cmp eax, dword [0x1025ab58]
jne 0x101702bc
mov ebx, dword [ebp - 0x4b0]
mov edi, dword [ebx + 0xc]
mov ecx, 0x1021aa50
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1017024e
test dx, dx
je 0x1017024a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1017024e
add eax, 4
add ecx, 4
test dx, dx
jne 0x10170228
xor eax, eax
jmp 0x10170253
sbb eax, eax
or eax, 1
test eax, eax
je 0x1017026e
push edi
call sub.msvcrt.dll__wtoi
add esp, 4
cmp eax, dword [0x1025ab5c]
jne 0x101702bc
mov ebx, dword [ebp - 0x4b0]
mov edi, dword [ebx + 0x10]
mov ecx, 0x1021aa50
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1017029e
test dx, dx
je 0x1017029a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1017029e
add eax, 4
add ecx, 4
test dx, dx
jne 0x10170278
xor eax, eax
jmp 0x101702a3
sbb eax, eax
or eax, 1
test eax, eax
je 0x1017032c
push edi
call sub.msvcrt.dll__wtoi
add esp, 4
cmp eax, dword [0x1025ab60]
je 0x1017032c
lea ecx, [ebp - 0x4b0]
call fcn.1002a3c0
mov edi, dword [ebp - 0x478]
mov ebx, dword [ebp - 0x480]
inc ebx
mov dword [ebp - 0x480], ebx
mov eax, dword [edi + 0x18]
sub eax, dword [edi + 0x14]
sar eax, 2
cmp ebx, eax
jb 0x10170031
mov edx, dword [ebp - 0x48c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10170309
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x504
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x101706ee
mov ecx, eax
call fcn.100e5250
mov edi, eax
jmp 0x101706f0
lea ecx, [ebp - 0x4b0]
call fcn.1002a3c0
mov edx, dword [ebp - 0x48c]
jmp 0x101706cb
mov eax, 0x1021467c
mov cx, word [edx]
cmp cx, word [eax]
jne 0x1017036d
test cx, cx
je 0x10170369
mov cx, word [edx + 2]
cmp cx, word [eax + 2]
jne 0x1017036d
add edx, 4
add eax, 4
test cx, cx
jne 0x10170347
xor eax, eax
jmp 0x10170372
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10170746
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x47c]
push str.CExtIEAssociateOption
mov dword [ebp - 0x47c], eax
call fcn.10023e80
test al, al
jne 0x101703b5
push 0x15
push str.CExtIEAssociateOption
lea ecx, [ebp - 0x47c]
call fcn.10003740
mov eax, dword [ebx]
lea ecx, [ebp - 0x484]
push ecx
mov ecx, ebx
call dword [eax + 8]
mov edi, dword [ebp - 0x478]
xor ebx, ebx
mov esi, dword [ebp - 0x47c]
mov dword [ebp - 0x480], ebx
mov eax, dword [edi + 0x18]
sub eax, dword [edi + 0x14]
sar eax, 2
test eax, eax
je 0x10170680
jmp 0x101703f0
mov dword [ebp - 0x4bc], 0
mov dword [ebp - 0x4b8], 0
mov dword [ebp - 0x4b4], 0
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x49c]
push 0x10202ca0
mov dword [ebp - 0x49c], eax
call fcn.10023e80
test al, al
jne 0x10170449
push 1
push 0x10202ca0
lea ecx, [ebp - 0x49c]
call fcn.10003740
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x49c]
push eax
mov eax, dword [edi + 0x14]
lea eax, [eax + ebx*4]
push eax
call fcn.101b1a50
mov edx, dword [ebp - 0x49c]
add esp, 0xc
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10170484
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x4b8]
mov ebx, dword [ebp - 0x4bc]
sub edi, ebx
sar edi, 2
cmp edi, 2
jb 0x10170651
mov ecx, dword [ebp - 0x484]
mov eax, dword [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x101704cc
test dx, dx
je 0x101704c8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x101704cc
add eax, 4
add ecx, 4
test dx, dx
jne 0x101704a6
xor eax, eax
jmp 0x101704d1
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10170651
mov eax, dword [ebx + 4]
mov ecx, esi
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10170506
test dx, dx
je 0x10170502
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10170506
add eax, 4
add ecx, 4
test dx, dx
jne 0x101704e0
xor eax, eax
jmp 0x1017050b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10170651
cmp edi, 5
jb 0x101706ba
cmp dword [0x1025ab60], eax
jne 0x1017058a
mov dword [ebp - 0x548], eax
mov ecx, 0x1024e5d0
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.101b11a0
test eax, eax
jne 0x1017055d
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x11c]
mov dword [0x1025ab58], eax
mov eax, dword [ebp - 0x118]
mov dword [0x1025ab5c], eax
call fcn.10009c50
mov ebx, dword [ebp - 0x4bc]
neg eax
sbb eax, eax
neg eax
inc eax
mov dword [0x1025ab60], eax
mov edi, dword [ebx + 8]
mov ecx, 0x1021aa50
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x101705ba
test dx, dx
je 0x101705b6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x101705ba
add eax, 4
add ecx, 4
test dx, dx
jne 0x10170594
xor eax, eax
jmp 0x101705bf
sbb eax, eax
or eax, 1
test eax, eax
je 0x101705da
push edi
call sub.msvcrt.dll__wtoi
add esp, 4
cmp eax, dword [0x1025ab58]
jne 0x10170651
mov ebx, dword [ebp - 0x4bc]
mov edi, dword [ebx + 0xc]
mov ecx, 0x1021aa50
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1017060a
test dx, dx
je 0x10170606
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1017060a
add eax, 4
add ecx, 4
test dx, dx
jne 0x101705e4
xor eax, eax
jmp 0x1017060f
sbb eax, eax
or eax, 1
test eax, eax
je 0x1017062a
push edi
call sub.msvcrt.dll__wtoi
add esp, 4
cmp eax, dword [0x1025ab5c]
jne 0x10170651
mov ebx, dword [ebp - 0x4bc]
lea edi, [ebx + 0x10]
push 0x1021aa50
push edi
call fcn.1005b7e0
add esp, 8
test al, al
jne 0x101706ba
push dword [edi]
call sub.msvcrt.dll__wtoi
add esp, 4
cmp eax, dword [0x1025ab60]
je 0x101706ba
lea ecx, [ebp - 0x4bc]
call fcn.1002a3c0
mov edi, dword [ebp - 0x478]
mov ebx, dword [ebp - 0x480]
inc ebx
mov dword [ebp - 0x480], ebx
mov eax, dword [edi + 0x18]
sub eax, dword [edi + 0x14]
sar eax, 2
cmp ebx, eax
jb 0x101703f0
mov edx, dword [ebp - 0x484]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1017069e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x318
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x101706ee
mov ecx, eax
call fcn.100fa250
mov edi, eax
jmp 0x101706f0
lea ecx, [ebp - 0x4bc]
call fcn.1002a3c0
mov edx, dword [ebp - 0x484]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1017073b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x478]
jmp 0x101708c9
xor edi, edi
mov dword [ebp - 0x480], edi
test edi, edi
je 0x1017073b
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x48]
test eax, eax
je 0x10170733
mov ebx, dword [ebp - 0x478]
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x10170721
mov dword [eax], edi
add dword [ecx + 4], 4
jmp 0x101708c9
lea edx, [ebp - 0x480]
push edx
push eax
call fcn.100cc490
jmp 0x101708c9
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov ebx, dword [ebp - 0x478]
jmp 0x101708c9
push esi
push 0x102151f8
call fcn.101613e0
add esp, 8
test al, al
je 0x101707ca
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x47c]
push str.CExtNetworkAssociate
mov dword [ebp - 0x47c], eax
call fcn.10023e80
test al, al
jne 0x10170793
push 0x14
push str.CExtNetworkAssociate
lea ecx, [ebp - 0x47c]
call fcn.10003740
mov esi, dword [ebp - 0x47c]
mov ecx, ebx
push esi
call fcn.101632d0
test eax, eax
jne 0x101708c9
push 0xd4
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x101708bf
mov ecx, eax
call fcn.1010c9f0
jmp 0x101708c1
push esi
push 0x10213e10
call fcn.101613e0
add esp, 8
test al, al
je 0x10170823
push str.CExtHostsFile
lea ecx, [ebp - 0x54c]
call fcn.10002490
mov esi, dword [ebp - 0x54c]
mov ecx, ebx
push esi
call fcn.101632d0
test eax, eax
jne 0x101708c9
push 0x5ac
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x101708bf
mov ecx, eax
call fcn.100f86e0
jmp 0x101708c1
push esi
push 0x102158f0
call fcn.101613e0
add esp, 8
test al, al
je 0x10170871
push str.CExtTrustedZone
lea ecx, [ebp - 0x550]
call fcn.10002490
mov esi, dword [ebp - 0x550]
mov ecx, ebx
push esi
call fcn.101632d0
test eax, eax
jne 0x101708c9
push 0xd4
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x101708bf
mov ecx, eax
call fcn.10116ae0
jmp 0x101708c1
push esi
push 0x1021640c
call fcn.101613e0
add esp, 8
test al, al
je 0x101708ea
push str.CExtWebHijack
lea ecx, [ebp - 0x488]
call fcn.10002490
mov esi, dword [ebp - 0x488]
mov ecx, ebx
push esi
call fcn.101632d0
test eax, eax
jne 0x101708c9
push 0x50c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x101708bf
mov ecx, eax
call fcn.1011b470
jmp 0x101708c1
xor eax, eax
push eax
mov ecx, ebx
call fcn.10161a20
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10171418
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10171418
push esi
push 0x10216ac8
call fcn.101613e0
add esp, 8
test al, al
je 0x1017095d
push str.CRMenuExtPlugin
lea ecx, [ebp - 0x4d8]
call fcn.10002490
push dword [ebp - 0x4d8]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10170952
push 0xc8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10170948
mov ecx, eax
call fcn.1013ffd0
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x4d8]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x4d8]
jmp 0x10171413
push esi
push 0x10214b28
call fcn.101613e0
add esp, 8
test al, al
je 0x101709d0
push str.CExtIEMenu
lea ecx, [ebp - 0x4dc]
call fcn.10002490
push dword [ebp - 0x4dc]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x101709c5
push 0xc8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x101709bb
mov ecx, eax
call fcn.10105580
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x4dc]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x4dc]
jmp 0x10171413
push esi
push 0x10215718
call fcn.101613e0
add esp, 8
test al, al
je 0x10170a43
push str.CExtToolbarReName
lea ecx, [ebp - 0x4e0]
call fcn.10002490
push dword [ebp - 0x4e0]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10170a38
push 0xd0
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10170a2e
mov ecx, eax
call fcn.10115840
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x4e0]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x4e0]
jmp 0x10171413
push esi
push 0x1021474c
call fcn.101613e0
add esp, 8
test al, al
je 0x10170ab6
push str.CExtIEError
lea ecx, [ebp - 0x4e4]
call fcn.10002490
push dword [ebp - 0x4e4]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10170aab
push 0xc4
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10170aa1
mov ecx, eax
call fcn.101013f0
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x4e4]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x4e4]
jmp 0x10171413
push esi
push 0x10206c68
call fcn.101613e0
add esp, 8
test al, al
je 0x10170b29
push str.AdwareScan
lea ecx, [ebp - 0x4e8]
call fcn.10002490
push dword [ebp - 0x4e8]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10170b1e
push 0x140
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10170b14
mov ecx, eax
call fcn.1013f940
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x4e8]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x4e8]
jmp 0x10171413
push esi
push 0x10211b44
call fcn.101613e0
add esp, 8
test al, al
je 0x10170b9c
push str.CExtDeepScan
lea ecx, [ebp - 0x4ec]
call fcn.10002490
push dword [ebp - 0x4ec]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10170b91
push 0xd18
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10170b87
mov ecx, eax
call fcn.100e1bc0
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x4ec]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x4ec]
jmp 0x10171413
push esi
push 0x10205244
call fcn.101613e0
add esp, 8
test al, al
je 0x10170c0f
push str.CActiveExtPlugin
lea ecx, [ebp - 0x4f0]
call fcn.10002490
push dword [ebp - 0x4f0]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10170c04
push 0xd0
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10170bfa
mov ecx, eax
call fcn.10020790
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x4f0]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x4f0]
jmp 0x10171413
push esi
push 0x1020f2e0
call fcn.101613e0
add esp, 8
test al, al
je 0x10170c82
push str.CExtAboutURL
lea ecx, [ebp - 0x4f4]
call fcn.10002490
push dword [ebp - 0x4f4]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10170c77
push 0xd4
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10170c6d
mov ecx, eax
call fcn.100a0920
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x4f4]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x4f4]
jmp 0x10171413
push esi
push 0x1020f4a4
call fcn.101613e0
add esp, 8
test al, al
je 0x10170cf5
push str.CExtAddedGroup
lea ecx, [ebp - 0x4f8]
call fcn.10002490
push dword [ebp - 0x4f8]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10170cea
push 0x304
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10170ce0
mov ecx, eax
call fcn.100a3810
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x4f8]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x4f8]
jmp 0x10171413
push esi
push 0x1020f654
call fcn.101613e0
add esp, 8
test al, al
je 0x10170d68
push str.CExtAddedOption
lea ecx, [ebp - 0x4fc]
call fcn.10002490
push dword [ebp - 0x4fc]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10170d5d
push 0x30c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10170d53
mov ecx, eax
call fcn.100a6480
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x4fc]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x4fc]
jmp 0x10171413
push esi
push 0x102108d4
call fcn.101613e0
add esp, 8
test al, al
je 0x10170ddb
push str.CExtAutoLoadDLL
lea ecx, [ebp - 0x53c]
call fcn.10002490
push dword [ebp - 0x53c]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10170dd0
push 0x2f4
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10170dc6
mov ecx, eax
call fcn.100d3d20
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x53c]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x53c]
jmp 0x10171413
push esi
push 0x10210bb8
call fcn.101613e0
add esp, 8
test al, al
je 0x10170e4e
push str.CExtClsidMgr
lea ecx, [ebp - 0x538]
call fcn.10002490
push dword [ebp - 0x538]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10170e43
push 0x308
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10170e39
mov ecx, eax
call fcn.100d5640
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x538]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x538]
jmp 0x10171413
push esi
push 0x102116b0
call fcn.101613e0
add esp, 8
test al, al
je 0x10170ec1
push str.CExtCSSHijack
lea ecx, [ebp - 0x534]
call fcn.10002490
push dword [ebp - 0x534]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10170eb6
push 0xd8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10170eac
mov ecx, eax
call fcn.100df1f0
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x534]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x534]
jmp 0x10171413
push esi
push 0x10218ee0
call fcn.101613e0
add esp, 8
test al, al
je 0x10170f34
push str.CExtDestopScanner
lea ecx, [ebp - 0x520]
call fcn.10002490
push dword [ebp - 0x520]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10170f29
push 0x220
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10170f1f
mov ecx, eax
call fcn.10188e50
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x520]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x520]
jmp 0x10171413
push esi
push 0x10218ee8
call fcn.101613e0
add esp, 8
test al, al
je 0x10170fa7
push str.CExtStartupmenuScanner
lea ecx, [ebp - 0x51c]
call fcn.10002490
push dword [ebp - 0x51c]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10170f9c
push 0x218
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10170f92
mov ecx, eax
call fcn.101a3340
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x51c]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x51c]
jmp 0x10171413
push esi
push 0x10218ef0
call fcn.101613e0
add esp, 8
test al, al
je 0x1017101a
push str.CExtQuicklanchScanner
lea ecx, [ebp - 0x528]
call fcn.10002490
push dword [ebp - 0x528]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x1017100f
push 0x228
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10171005
mov ecx, eax
call fcn.1018c530
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x528]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x528]
jmp 0x10171413
push esi
push 0x10218ef8
call fcn.101613e0
add esp, 8
test al, al
je 0x1017108d
push str.CExtFavoriteScanner
lea ecx, [ebp - 0x524]
call fcn.10002490
push dword [ebp - 0x524]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10171082
push 0x218
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10171078
mov ecx, eax
call fcn.1018ba80
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x524]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x524]
jmp 0x10171413
push esi
push 0x1020ee28
call fcn.101613e0
add esp, 8
test al, al
je 0x10171100
push str.CExtShareResource
lea ecx, [ebp - 0x52c]
call fcn.10002490
push dword [ebp - 0x52c]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x101710f5
push 0xd4
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x101710eb
mov ecx, eax
call fcn.1013ff50
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x52c]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x52c]
jmp 0x10171413
push esi
push 0x102152a4
call fcn.101613e0
add esp, 8
test al, al
je 0x1017117b
push str.CExtRemoteDesktop
lea ecx, [ebp - 0x530]
call fcn.10002490
push dword [ebp - 0x530]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10171170
push 0xc0
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x10171166
mov ecx, esi
call fcn.100cd220
push esi
mov ecx, ebx
mov dword [esi], vtable.CExtRemoteDesktop.0
call fcn.10161a20
lea ecx, [ebp - 0x530]
jmp 0x10171413
xor esi, esi
mov ecx, ebx
push esi
call fcn.10161a20
lea ecx, [ebp - 0x530]
jmp 0x10171413
push esi
push 0x10214e0c
call fcn.101613e0
add esp, 8
test al, al
je 0x101711ee
push str.CExtIeSettingScan
lea ecx, [ebp - 0x500]
call fcn.10002490
push dword [ebp - 0x500]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x101711e3
push 0x8ec
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x101711d9
mov ecx, eax
call fcn.10107420
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x500]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x500]
jmp 0x10171413
push esi
push 0x102147a8
call fcn.101613e0
add esp, 8
test al, al
je 0x10171261
push str.CExtIEKeyFileRepair
lea ecx, [ebp - 0x504]
call fcn.10002490
push dword [ebp - 0x504]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x10171256
push 0xf0
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x1017124c
mov ecx, eax
call fcn.101026d0
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x504]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x504]
jmp 0x10171413
push esi
push 0x102123c8
call fcn.101613e0
add esp, 8
test al, al
je 0x101712d6
push str.CExtExplorer
lea ecx, [ebp - 0x508]
call fcn.10002490
push dword [ebp - 0x508]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x101712cb
push 0xe8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x101712c1
push 0
mov ecx, eax
call fcn.100e9e10
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x508]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x508]
jmp 0x10171413
push esi
push 0x1020a68c
call fcn.101613e0
add esp, 8
test al, al
je 0x10171349
push str.CChromePlugin
lea ecx, [ebp - 0x50c]
call fcn.10002490
push dword [ebp - 0x50c]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x1017133e
push 0xbc
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10171334
mov ecx, eax
call fcn.10068350
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x50c]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x50c]
jmp 0x10171413
push esi
push 0x1020fe0c
call fcn.101613e0
add esp, 8
test al, al
je 0x101713b6
push str.CAdwareScanSogou
lea ecx, [ebp - 0x510]
call fcn.10002490
push dword [ebp - 0x510]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x101713ae
push 0x1ac
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x101713a4
mov ecx, eax
call fcn.1013fc70
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x510]
jmp 0x10171413
xor eax, eax
mov ecx, ebx
push eax
call fcn.10161a20
lea ecx, [ebp - 0x510]
jmp 0x10171413
push esi
push 0x10213c38
call fcn.101613e0
add esp, 8
test al, al
je 0x10171418
push str.CExtHomePage2
lea ecx, [ebp - 0x514]
call fcn.10002490
push dword [ebp - 0x514]
mov ecx, ebx
call fcn.101632d0
test eax, eax
jne 0x1017140d
push 0xc8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10171403
mov ecx, eax
call fcn.100f6df0
jmp 0x10171405
xor eax, eax
push eax
mov ecx, ebx
call fcn.10161a20
lea ecx, [ebp - 0x514]
call fcn.10007e10
mov eax, dword [ebx + 0x28]
mov ecx, dword [ebp - 0x518]
mov edx, dword [ebx + 0x24]
inc ecx
sub eax, edx
mov dword [ebp - 0x518], ecx
sar eax, 2
cmp ecx, eax
jb 0x1016f800
mov edi, dword [ebp - 0x478]
xor ebx, ebx
mov dword [ebp - 0x48c], ebx
mov eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x30]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x10171769
lea esp, [esp]
mov edx, dword [ecx + ebx*4]
mov ecx, 0x10204674
mov eax, edx
lea ebx, [ebx]
mov si, word [eax]
cmp si, word [ecx]
jne 0x10171496
test si, si
je 0x10171492
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x10171496
add eax, 4
add ecx, 4
test si, si
jne 0x10171470
xor eax, eax
jmp 0x1017149b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1017156e
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x484]
push str.CExtSystemPluginCreator
mov dword [ebp - 0x484], eax
call fcn.10023e80
test al, al
jne 0x101714de
push 0x17
push str.CExtSystemPluginCreator
lea ecx, [ebp - 0x484]
call fcn.10003740
mov esi, dword [ebp - 0x484]
mov ecx, edi
push esi
call fcn.101632d0
test eax, eax
jne 0x10171737
push 0x28
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x1017150d
mov ecx, eax
call fcn.10112300
mov edi, eax
jmp 0x1017150f
xor edi, edi
mov ecx, dword [ebp - 0x478]
mov dword [ebp - 0x488], edi
mov eax, dword [ecx + 0x20]
mov dword [edi + 0xc], eax
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x478]
mov eax, dword [eax + 4]
test eax, eax
je 0x10171539
mov dword [edi + 4], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, dword [ebp - 0x478]
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x1017155c
mov dword [eax], edi
add dword [ecx + 4], 4
jmp 0x10171731
lea edx, [ebp - 0x488]
push edx
push eax
call fcn.100cc490
jmp 0x10171731
mov ecx, 0x102104d0
mov eax, edx
mov si, word [eax]
cmp si, word [ecx]
jne 0x1017159b
test si, si
je 0x10171597
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x1017159b
add eax, 4
add ecx, 4
test si, si
jne 0x10171575
xor eax, eax
jmp 0x101715a0
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10171617
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x484]
push str.CExtLuaPluginCreator
mov dword [ebp - 0x484], eax
call fcn.10023e80
test al, al
jne 0x101715df
push 0x14
push str.CExtLuaPluginCreator
lea ecx, [ebp - 0x484]
call fcn.10003740
mov esi, dword [ebp - 0x484]
mov ecx, edi
push esi
call fcn.101632d0
test eax, eax
jne 0x10171737
push 0x20
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x1017150d
push 0
mov ecx, eax
call fcn.1014fb30
mov edi, eax
jmp 0x1017150f
mov eax, 0x1021b278
lea esp, [esp]
mov cx, word [edx]
cmp cx, word [eax]
jne 0x10171646
test cx, cx
je 0x10171642
mov cx, word [edx + 2]
cmp cx, word [eax + 2]
jne 0x10171646
add edx, 4
add eax, 4
test cx, cx
jne 0x10171620
xor eax, eax
jmp 0x1017164b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1017174f
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x484]
push str.CTpiExtPluginCreator
mov dword [ebp - 0x484], eax
call fcn.10023e80
test al, al
jne 0x1017168e
push 0x14
push str.CTpiExtPluginCreator
lea ecx, [ebp - 0x484]
call fcn.10003740
mov esi, dword [ebp - 0x484]
mov ecx, edi
push esi
call fcn.101632d0
test eax, eax
jne 0x10171737
push 0x1c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x101716dc
mov eax, dword [ebp - 0x478]
push ecx
mov edi, esp
mov ecx, dword [eax + 0x3c]
sub ecx, 0x10
push ecx
call fcn.10002a60
add esp, 4
add eax, 0x10
mov ecx, ebx
mov dword [edi], eax
call fcn.101b3ac0
mov edi, eax
jmp 0x101716de
xor edi, edi
mov ebx, dword [ebp - 0x478]
mov ecx, ebx
mov dword [ebp - 0x488], edi
mov eax, dword [ebx + 0x20]
mov dword [edi + 0xc], eax
mov eax, dword [ebx]
call dword [eax + 0xc]
mov dword [edi + 8], eax
mov eax, dword [ebx + 4]
test eax, eax
je 0x10171704
mov dword [edi + 4], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x1017171e
mov dword [eax], edi
add dword [ecx + 4], 4
jmp 0x1017172b
lea edx, [ebp - 0x488]
push edx
push eax
call fcn.100cc490
mov ebx, dword [ebp - 0x48c]
mov edi, dword [ebp - 0x478]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1017174f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 0x34]
inc ebx
mov ecx, dword [edi + 0x30]
sub eax, ecx
sar eax, 2
mov dword [ebp - 0x48c], ebx
cmp ebx, eax
jb 0x10171460
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret