Function at 0x4cad00
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create thread
Set file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f3957
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3b8
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x320], edi
push 0
lea ecx, [ebp - 0x280]
mov byte [ebp - 0x321], 0
mov byte [ebp - 0x319], 0
call fcn.005d0610
push str.Smart_Uninstaller
lea ecx, [edi + 0x1448]
call fcn.005dc510
push ecx
call fcn.0046e060
push 0
lea ecx, [edi + 0x1448]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0046f160
push 1
lea ecx, [edi + 0x1448]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0045f680
mov ecx, edi
mov dword [ebp - 0x358], eax
call fcn.0043e530
test al, al
je 0x4ceadc
mov esi, dword [edi + 0x14e4]
lea ecx, [edi + 0x119c]
push 1
push str.https:__www.carifred.com_uvk_help_smart_uninstaller.php
mov dword [ebp - 0x314], esi
call fcn.005dc260
push 0
mov ecx, esi
call fcn.005c44a0
sub esp, 8
mov dword [ebp - 0xe0], 0
xorps xmm0, xmm0
mov dword [ebp - 0xd4], 0
lea ecx, [edi + 0x1448]
movq qword [ebp - 0xdc], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
push 0x624284
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer
lea ecx, [ebp - 0xdc]
call fcn.005dc520
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
xorps xmm0, xmm0
mov dword [ebp - 0x224], 0
movq qword [ebp - 0x22c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x134], 0
lea ecx, [ebp - 0x13c]
movq qword [ebp - 0x13c], xmm0
call fcn.005dc5e0
push 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xdc]
push 0xffffffffffffffff
mov dword [ebp - 0xcc], 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0xcc]
call fcn.005d6a80
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xec], 0
call fcn.005d6aa0
push 0xffffffffffffffff
push 0x5e
push 0xc8
push 0xa
push 0x6e
mov byte [ebp - 4], 4
mov ecx, edi
push dword [edi + 0x68]
call fcn.0043ccb0
push 0x8800
mov ecx, esi
call fcn.005c4340
movsd xmm1, qword [0x6edb20]
push 0
push str.Arial
push 1
push 0x320
call fcn.005c42b0
push 0x37
push 0x5a
push 3
push 0xa
mov ecx, edi
call fcn.0045fec0
push 0xffffffffffffffff
push 0x10000001
push 0x2d
push 0x6e
push 0x3c
push 0
lea ecx, [edi + 0x1448]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005c0890
push dword [edi + 0x1438]
mov ecx, esi
push 0xffffffffffffffff
call fcn.005bec70
movsd xmm1, qword [0x6edb08]
mov ecx, esi
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
lea eax, [ebp - 0xe0]
push eax
push str.ForceUninstall
lea ecx, [ebp - 0xcc]
call fcn.005d66b0
cmp dword [ebp - 0xe0], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Force_uninstall_of_the_selected_programs._r_nUseful_to_remove_adware_and_stubborn_software.
setne al
movzx eax, al
push eax
push ecx
push 0xb4
push 0x14
push 0x78
push str._Use_forced_uninstall
mov ecx, edi
call fcn.0045fc60
mov dword [ebp - 0x364], eax
lea ecx, [ebp - 0xcc]
lea eax, [ebp - 0xe0]
push eax
push str.ScanRemnants
call fcn.005d66b0
cmp dword [ebp - 0xe0], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Scan_and_remove_leftover_registry_entries_and_files_after_uninstall.
setne al
movzx eax, al
push eax
push ecx
push 0xb4
push 0x28
push 0x78
push str._Scan_and_remove_remnants
mov ecx, edi
call fcn.0045fc60
mov dword [ebp - 0x374], eax
lea ecx, [ebp - 0xcc]
lea eax, [ebp - 0xe0]
push eax
push str.UnattendUninstall
call fcn.005d66b0
cmp dword [ebp - 0xe0], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Automate_the_uninstall_process_to_reduce_user_interaction.
setne al
movzx eax, al
push eax
push ecx
push 0xb4
push 0x3c
push 0x78
push str._Try_unattended_uninstall
mov ecx, edi
call fcn.0045fc60
mov dword [ebp - 0x370], eax
lea ecx, [ebp - 0xcc]
lea eax, [ebp - 0xe0]
push eax
push str.HideMSSignedFiles
call fcn.005d66b0
cmp dword [ebp - 0xe0], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_hide_the_Microsoft_signed_files_from_the_list._r_nThe_file_signatures_will_be_verified__so_it_may_take_a_few_seconds.
setne al
movzx eax, al
push eax
push ecx
push 0xb4
push 0x50
push 0x78
push str._Hide_Microsoft_signed_files
mov ecx, edi
call fcn.0045fc60
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Uninstall_the_selected_programs._Use_the_options_to_the_left_to_set_automated_mode_when_possible__r_nand_whether_to_search_for_uninstall_leftovers_after_uninstalling.
push 0x5f
push 0x55
push 0xa
push 0x13b
push 0xa7
push str.Uninstall_selected
mov dword [ebp - 0x330], eax
call fcn.0045fdf0
mov dword [ebp - 0x338], eax
mov eax, dword [edi + 0x1f70]
test al, 1
je 0x4cb12f
test al, 2
mov ecx, esi
mov eax, 0
sete al
lea eax, [eax*4 + 4]
push eax
push dword [ebp - 0x364]
call fcn.005bd3f0
test byte [edi + 0x1f70], 4
mov eax, 0
mov ecx, esi
sete al
lea eax, [eax*4 + 4]
push eax
push dword [ebp - 0x370]
call fcn.005bd3f0
test byte [edi + 0x1f70], 8
mov eax, 0
mov ecx, esi
sete al
lea eax, [eax*4 + 4]
push eax
push dword [ebp - 0x374]
call fcn.005bd3f0
movsd xmm0, qword [edi + 8]
comisd xmm0, xmmword [0x6edac8]
push 0
push ecx
mov dword [ebp - 0x3a0], 0xfffe7960
mov ecx, edi
mov dword [ebp - 0x348], 0xfff0bdc0
mov dword [esp], 0x41500000
jb 0x4cb185
push str.Uninstal_Windows_Store_apps_instead
push 0x5f
push 0x55
push 0xa
push 0x195
push 0xcd
push str.Windows_Store_apps
call fcn.0045fdf0
mov dword [ebp - 0x3a0], eax
jmp 0x4cb1aa
push str.View_information_about_the_selected_uninstall_entry.
push 0x5f
push 0x55
push 0xa
push 0x195
push 0x8b
push str.Uninstall_entry_properties
call fcn.0045fdf0
mov dword [ebp - 0x348], eax
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Create_a_new_uninstall_entry_and_add_it_to_the_list._r_nTip:_drag_an_uninstaller_file_or_a_program_folder_to_the_list_to_quickly_create_an_uninstall_entry.
push 0x5f
push 0x55
push 0xa
push 0x1ef
push 0x78
push str.Create_uninstall_entry
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Show_online_help__F1_
push 0x5f
push 0x4b
push 0xa
push 0x249
push 0x7d
push str.Help
mov dword [ebp - 0x3c0], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Go_back_to_the_Home_page__Esc_
push 0x5f
push 0x4b
push 0xa
push 0x299
push 0xb3
push str.Home
mov dword [edi + 0x11bc], eax
call fcn.0045fdf0
push 0
push 0x10800080
push 0x19
push 0xb9
push 0x23
push 0x2f3
push str.Find_a_program__CtrlF_
mov ecx, esi
mov dword [edi + 0x11c0], eax
call fcn.005c0a40
push 0x909090
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x334], eax
call fcn.005bec70
movsd xmm0, qword [0x6edb08]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push 0
push ecx
push 0x190
push 0xffffffffffffffff
mov ecx, esi
call fcn.005beb10
push 0x40
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bd3f0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.List_menu
push 0x28
push 0x5a
push 0x41
push 0x2f3
push 0x86
push str.List_menu
call fcn.0045fd50
push 0
mov dword [ebp - 0x368], eax
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Find_next__F3_
push 0x28
push 0x5a
push 0x41
push 0x352
push 0x99
push str.Find_next
call fcn.0045fd50
movsd xmm1, qword [0x6edaf8]
mov ecx, esi
push 0
push str.Arial
push 1
push 0x190
mov dword [ebp - 0x360], eax
call fcn.005c42b0
movsd xmm0, qword [edi + 8]
xor eax, eax
comisd xmm0, xmmword [0x6edab8]
mov ecx, 0x8200004
cmovae eax, ecx
mov ecx, esi
or eax, 0x10021
push eax
push 0x10000109
push 0x1b3
push 0x2ee
push 0x73
push 0
push 0x62794c
push str._Display_name_Publisher_Threat_level_Install_date_Size_Version_Uninstall_string_Uninstall_key_Uninstall_file
call fcn.005c0620
push 0x433
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x318], eax
call fcn.005bda80
movsd xmm0, qword [edi + 8]
mov ecx, esi
comisd xmm0, xmmword [0x6edac8]
mov eax, dword [ebp - 0x348]
push dword [ebp - 0x318]
cmovae eax, dword [ebp - 0x338]
mov dword [ebp - 0x33c], eax
call fcn.005c5730
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x328], eax
push ecx
push eax
push str.Smart_Uninstaller
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x38], 0x136
mov dword [ebp - 0x34], 0xb4
mov dword [ebp - 0x30], 0x55
mov dword [ebp - 0x2c], 0x55
mov dword [ebp - 0x28], 0x43
mov dword [ebp - 0x24], 0x56
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.0045b1e0
lea eax, [ebp - 0xe4]
push eax
push str.CurrentView
lea ecx, [ebp - 0xcc]
call fcn.005d66b0
test al, al
je 0x4cb424
mov eax, dword [ebp - 0xe4]
test eax, eax
je 0x4cb42f
cmp eax, 3
je 0x4cb42f
cmp eax, 4
je 0x4cb42f
mov eax, 1
mov dword [ebp - 0xe4], eax
push 0
push eax
push 0x108e
push dword [ebp - 0x328]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x28
push eax
push 0
push 0x10a2
push dword [ebp - 0x328]
xorps xmm0, xmm0
mov dword [ebp - 0x250], 2
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
movups xmmword [ebp - 0x23c], xmm0
mov dword [ebp - 0x240], 2
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x48
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esp, 8
mov dword [ebp - 0x288], eax
xorps xmm0, xmm0
mov dword [ebp - 0x1c4], 0
lea ecx, [ebp - 0x1cc]
movq qword [ebp - 0x1cc], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.msiexec.exe
push dword [edi + 0x24]
call fcn.005dc520
push 0x14
push 0
lea ecx, [ebp - 0x1cc]
mov byte [ebp - 4], 5
call fcn.005dc190
push eax
push 1
push dword [ebp - 0x318]
mov ecx, esi
call fcn.005bea70
push 0x20
push 0
lea ecx, [ebp - 0x1cc]
call fcn.005dc190
push eax
push 0
push dword [ebp - 0x318]
mov ecx, esi
call fcn.005bea70
movsd xmm0, qword [edi + 8]
comisd xmm0, xmmword [0x6edab0]
jbe 0x4cb54f
sub esp, 8
mov ecx, esi
push 0x14
push dword [ebp - 0x318]
call fcn.005ba470
push 1
push dword [ebp - 0x318]
mov ecx, esi
call fcn.005ba360
mov eax, dword [ebp - 0x328]
lea ecx, [ebp - 0x300]
mov dword [ebp - 0x30c], eax
xor eax, eax
cmp dword [ebp - 0xe0], eax
mov dword [ebp - 0x310], edi
setne al
mov byte [ebp - 0x304], 0
mov dword [ebp - 0x308], eax
call fcn.005dd740
mov byte [ebp - 4], 6
test byte [edi + 0x1f70], 1
je 0x4cb5c2
lea esi, [edi + 0x1460]
mov ecx, esi
call fcn.005dc3a0
test eax, eax
je 0x4cb5c2
push esi
lea ecx, [ebp - 0x13c]
call fcn.005dc4e0
jmp 0x4cb69d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x693eec
lea ecx, [edi + 0x174]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x13c]
call fcn.005dc200
lea ecx, [ebp - 0x13c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4cb61e
lea ecx, [edi + 0x174]
call fcn.005dc190
mov ecx, eax
call fcn.005ddc10
test al, al
jne 0x4cb69d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Smart_uninstaller
lea ecx, [edi + 0x15c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x13c]
call fcn.005dc200
lea ecx, [ebp - 0x13c]
call fcn.005dc190
or edx, 0xffffffff
mov ecx, eax
call fcn.005e0f30
push 2
lea ecx, [ebp - 0x13c]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Whitelist.ini
lea ecx, [ebp - 0x13c]
call fcn.005da780
push 1
lea ecx, [ebp - 0x13c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x300]
call fcn.005dd360
lea ecx, [edi + 0x1460]
call fcn.005dc400
push 0
push str.Smart_Uninstaller
mov ecx, edi
call fcn.0045f4d0
mov ecx, edi
call fcn.0045f300
push 0
push 1
mov ecx, edi
call fcn.0043d720
or esi, 0xffffffff
mov dword [ebp - 0x32c], esi
mov dword [ebp - 0x290], esi
lea eax, [ebp - 0x310]
mov byte [ebp - 4], 7
push eax
mov ecx, edi
call fcn.004cab70
movsd xmm0, qword [0x6edab8]
comisd xmm0, xmmword [edi + 8]
jb 0x4cb720
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
or eax, 0xff000000
jmp 0x4cb722
xor eax, eax
push eax
mov dword [ebp - 0xd0], eax
mov ecx, edi
mov eax, dword [ebp - 0x288]
push eax
push eax
push 0x8b
call fcn.00436420
push eax
lea ecx, [ebp - 0x294]
call fcn.005c6520
mov ecx, dword [ebp - 0x314]
mov byte [ebp - 4], 8
push dword [ebp - 0x294]
push str.Uninstall_entry_properties_tCtrlEnter
push dword [ebp - 0x318]
call fcn.005c1450
mov ecx, dword [ebp - 0x314]
push 0
push eax
push eax
mov dword [ebp - 0x35c], eax
call fcn.005c56e0
push eax
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
push dword [ebp - 0xd0]
mov eax, dword [ebp - 0x288]
mov ecx, edi
push eax
push eax
push 0xa7
call fcn.00436420
push eax
lea ecx, [ebp - 0x2ac]
call fcn.005c6520
mov ecx, dword [ebp - 0x314]
push 0
mov byte [ebp - 4], 9
push dword [ebp - 0x2ac]
push 0
push 0x32
push str.Uninstall_selected_programs_tCtrlDel
push dword [ebp - 0x318]
call fcn.005c0400
push dword [ebp - 0xd0]
mov dword [ebp - 0x3bc], eax
mov ecx, edi
mov eax, dword [ebp - 0x288]
push eax
push eax
push 0xfc
call fcn.00436420
push eax
lea ecx, [ebp - 0x2b0]
call fcn.005c6520
mov ecx, dword [ebp - 0x314]
push 0
mov byte [ebp - 4], 0xa
push dword [ebp - 0x2b0]
push 0
push 0x32
push str.Modify_selected_programs_tAltM
push dword [ebp - 0x318]
call fcn.005c0400
push dword [ebp - 0xd0]
mov dword [ebp - 0x38c], eax
mov ecx, edi
mov eax, dword [ebp - 0x288]
push eax
push eax
push 0x72
call fcn.00436420
push eax
lea ecx, [ebp - 0x2a8]
call fcn.005c6520
mov byte [ebp - 4], 0xb
push 0
push dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x314]
push 0
push 0x32
push str.Delete_uninstall_entry_tDel
push dword [ebp - 0x318]
call fcn.005c0400
mov ecx, dword [ebp - 0x314]
push 0
push 0
push 8
push 0x32
push 0
push dword [ebp - 0x318]
mov dword [ebp - 0x3a8], eax
call fcn.005c0400
push dword [ebp - 0xd0]
mov eax, dword [ebp - 0x288]
mov ecx, edi
push eax
push eax
push 0x7c
call fcn.00436420
push eax
lea ecx, [ebp - 0x2c0]
call fcn.005c6520
mov ecx, dword [ebp - 0x314]
push 0
mov byte [ebp - 4], 0xc
push dword [ebp - 0x2c0]
push 0
push 0x32
push str.Google_uninstall_entry_tCtrlG
push dword [ebp - 0x318]
call fcn.005c0400
push dword [ebp - 0xd0]
mov dword [ebp - 0x3ac], eax
mov ecx, edi
mov eax, dword [ebp - 0x288]
push eax
push eax
push 0xac
call fcn.00436420
push eax
lea ecx, [ebp - 0x298]
call fcn.005c6520
mov ecx, dword [ebp - 0x314]
push 0
mov byte [ebp - 4], 0xd
push dword [ebp - 0x298]
push 0
push 0x32
push str.Open_file_location_tCtrlL
push dword [ebp - 0x318]
call fcn.005c0400
push dword [ebp - 0xd0]
mov dword [ebp - 0x3b4], eax
mov ecx, edi
mov eax, dword [ebp - 0x288]
push eax
push eax
push 0x8e
call fcn.00436420
push eax
lea ecx, [ebp - 0x2bc]
call fcn.005c6520
mov ecx, dword [ebp - 0x314]
push 0
mov byte [ebp - 4], 0xe
push dword [ebp - 0x2bc]
push 0
push 0x32
push str.Go_to_the_registry_key_tCtrlR
push dword [ebp - 0x318]
call fcn.005c0400
push 0
push dword [ebp - 0x294]
mov dword [ebp - 0x378], eax
mov ecx, dword [ebp - 0x314]
push 0
push 0x32
push str.File_properties_tCtrlP
push dword [ebp - 0x318]
call fcn.005c0400
push dword [ebp - 0xd0]
mov dword [ebp - 0x3b0], eax
mov ecx, edi
mov eax, dword [ebp - 0x288]
push eax
push eax
push 0x80
call fcn.00436420
push eax
lea ecx, [ebp - 0x2a4]
call fcn.005c6520
mov ecx, dword [ebp - 0x314]
push 0
mov byte [ebp - 4], 0xf
push dword [ebp - 0x2a4]
push 0
push 0x32
push str.Verify_file_signature_tAltV
push dword [ebp - 0x318]
call fcn.005c0400
push dword [ebp - 0xd0]
mov dword [ebp - 0x3a4], eax
mov ecx, edi
mov eax, dword [ebp - 0x288]
push eax
push eax
push 0x95
call fcn.00436420
push eax
lea ecx, [ebp - 0x2b8]
call fcn.005c6520
mov edi, dword [ebp - 0x314]
mov ecx, edi
push 0
mov byte [ebp - 4], 0x10
push dword [ebp - 0x2b8]
push 0
push 0x32
push str.Report_as_unwanted_program_tAltU
push dword [ebp - 0x318]
call fcn.005c0400
push 0
push 0
push 8
push 0x32
push 0
push dword [ebp - 0x318]
mov ecx, edi
mov dword [ebp - 0x340], eax
call fcn.005c0400
push 0
push dword [ebp - 0x298]
mov ecx, edi
push 4
push 0x32
push str.Change_list_view
push dword [ebp - 0x318]
call fcn.005c0400
mov ecx, dword [ebp - 0x314]
mov edi, eax
push 0
push 0
push 0
push 0x32
push str.Icons
push edi
call fcn.005c0400
push 0
push 0
push 0
push 0x32
mov dword [ebp - 0x390], eax
push str.Details
mov ecx, dword [ebp - 0x314]
push edi
call fcn.005c0400
mov ecx, dword [ebp - 0x314]
push 0
push 0
push 0
push 0x32
push str.List
push edi
mov dword [ebp - 0x3b8], eax
call fcn.005c0400
mov ecx, dword [ebp - 0x314]
push 0
push 0
push 0
push 0x32
push str.Tiles
push edi
mov dword [ebp - 0x398], eax
call fcn.005c0400
push dword [ebp - 0xd0]
mov edi, dword [ebp - 0x320]
mov ecx, edi
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x288]
push eax
push eax
push 0x94
call fcn.00436420
push eax
lea ecx, [ebp - 0x2b4]
call fcn.005c6520
mov ecx, dword [ebp - 0x314]
push 0
mov byte [ebp - 4], 0x11
push dword [ebp - 0x2b4]
push 0
push 0x32
push str.Refresh_list_tF5
push dword [ebp - 0x318]
call fcn.005c0400
mov ecx, dword [ebp - 0x314]
push 0
push 0
push 8
push 0x32
push 0
push dword [ebp - 0x318]
mov dword [ebp - 0x384], eax
call fcn.005c0400
push dword [ebp - 0xd0]
mov eax, dword [ebp - 0x288]
mov ecx, edi
push eax
push eax
push 0x6a
call fcn.00436420
push eax
lea ecx, [ebp - 0x2a0]
call fcn.005c6520
mov ecx, dword [ebp - 0x314]
push 0
mov byte [ebp - 4], 0x12
push dword [ebp - 0x294]
push 0
push 0x32
push str.Whitelist_selected_tCtrlW
push dword [ebp - 0x318]
call fcn.005c0400
mov ecx, dword [ebp - 0x314]
push 0
push dword [ebp - 0x2a8]
mov dword [ebp - 0x34c], eax
push 0
push 0x32
push str.Blacklist_selected_tCtrlB
push dword [ebp - 0x318]
call fcn.005c0400
mov ecx, dword [ebp - 0x314]
push 0
push dword [ebp - 0x298]
mov dword [ebp - 0x350], eax
push 0
push 0x32
push str.Select_blacklisted_tAltB
push dword [ebp - 0x318]
call fcn.005c0400
mov ecx, dword [ebp - 0x314]
push 0
push dword [ebp - 0x2a0]
mov dword [ebp - 0x388], eax
push 0
push 0x32
push str.Whitelist__Blacklist_manager
push dword [ebp - 0x318]
call fcn.005c0400
mov ecx, dword [ebp - 0x314]
push 0
push dword [ebp - 0x2a0]
mov dword [ebp - 0x3c4], eax
push 0
push 0x32
push str.Ignore_Whitelist_once_tCtrlI
push dword [ebp - 0x318]
call fcn.005c0400
mov ecx, dword [ebp - 0x314]
push 0
push 0
push 8
push 0x32
push 0
push dword [ebp - 0x318]
mov dword [ebp - 0x39c], eax
call fcn.005c0400
mov ecx, dword [ebp - 0x314]
push 0
push dword [ebp - 0x2a4]
push 0
push 0x32
push str.VirusTotal_report_tCtrlM
push dword [ebp - 0x318]
call fcn.005c0400
push dword [ebp - 0xd0]
mov dword [ebp - 0x36c], eax
mov ecx, edi
mov eax, dword [ebp - 0x288]
push eax
push eax
push 0xb1
call fcn.00436420
push eax
lea ecx, [ebp - 0x29c]
call fcn.005c6520
mov ecx, dword [ebp - 0x314]
push 0
mov byte [ebp - 4], 0x13
push dword [ebp - 0x29c]
push 0
push 0x32
push str.Update_VirusTotal_results_tCtrlU
push dword [ebp - 0x318]
call fcn.005c0400
mov ecx, dword [ebp - 0x314]
push 0
push dword [ebp - 0x29c]
mov dword [ebp - 0x354], eax
push 0
push 0x32
push str.Hide_clean_VirusTotal_results_tCtrlH
push dword [ebp - 0x318]
call fcn.005c0400
push 0
mov ecx, edi
mov dword [ebp - 0x344], eax
call fcn.0045f170
mov ecx, eax
mov byte [ebp - 0xc0], 1
mov dword [ebp - 0x394], ecx
mov eax, 0x70
mov byte [ebp - 0xba], 1
mov word [ebp - 0xbe], ax
mov edx, 0x42
movzx eax, word [edi + 0x11bc]
mov word [ebp - 0xbc], ax
mov eax, 0x1b
mov word [ebp - 0xb8], ax
movzx eax, word [edi + 0x11c0]
mov word [ebp - 0xb6], ax
mov eax, 0x4d
mov word [ebp - 0xb2], ax
mov eax, dword [ebp - 0x38c]
mov word [ebp - 0xb0], ax
mov eax, 0xd
mov word [ebp - 0xac], ax
mov eax, dword [ebp - 0x35c]
mov word [ebp - 0xaa], ax
mov eax, 0x2e
mov word [ebp - 0xa6], ax
mov eax, dword [ebp - 0x3a8]
mov word [ebp - 0xa4], ax
mov eax, 0x47
mov word [ebp - 0xa0], ax
mov eax, dword [ebp - 0x3ac]
mov word [ebp - 0x9e], ax
mov eax, 0x4c
mov word [ebp - 0x9a], ax
mov eax, dword [ebp - 0x3b4]
mov word [ebp - 0x98], ax
mov eax, 0x52
mov word [ebp - 0x94], ax
mov eax, dword [ebp - 0x378]
mov word [ebp - 0x92], ax
mov eax, 0x50
mov word [ebp - 0x8e], ax
mov eax, dword [ebp - 0x3b0]
mov word [ebp - 0x8c], ax
mov eax, 0x56
mov word [ebp - 0x88], ax
mov eax, dword [ebp - 0x3a4]
mov word [ebp - 0x86], ax
mov eax, 0x55
mov word [ebp - 0x82], ax
mov eax, dword [ebp - 0x340]
mov word [ebp - 0x80], ax
mov eax, 0x74
mov word [ebp - 0x7c], ax
mov eax, dword [ebp - 0x384]
mov word [ebp - 0x7a], ax
mov eax, 0x57
mov word [ebp - 0x76], ax
mov eax, dword [ebp - 0x34c]
mov word [ebp - 0x74], ax
mov eax, dword [ebp - 0x350]
mov word [ebp - 0x6e], ax
mov eax, dword [ebp - 0x388]
mov word [ebp - 0x68], ax
mov eax, 0x49
mov word [ebp - 0x64], ax
mov eax, dword [ebp - 0x39c]
mov word [ebp - 0x62], ax
mov eax, 0x4d
mov byte [ebp - 0xb4], 0x11
mov byte [ebp - 0xae], 9
mov byte [ebp - 0xa8], 1
mov byte [ebp - 0xa2], 9
mov byte [ebp - 0x9c], 9
mov byte [ebp - 0x96], 9
mov byte [ebp - 0x90], 9
mov byte [ebp - 0x8a], 0x11
mov byte [ebp - 0x84], 0x11
mov byte [ebp - 0x7e], 1
mov byte [ebp - 0x78], 9
mov byte [ebp - 0x72], 9
mov word [ebp - 0x70], dx
mov byte [ebp - 0x6c], 0x11
mov word [ebp - 0x6a], dx
mov byte [ebp - 0x66], 9
mov byte [ebp - 0x60], 9
mov word [ebp - 0x5e], ax
mov eax, dword [ebp - 0x36c]
mov word [ebp - 0x5c], ax
mov eax, 0x55
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x354]
mov word [ebp - 0x56], ax
mov eax, 0x48
mov word [ebp - 0x52], ax
mov eax, dword [ebp - 0x344]
mov word [ebp - 0x50], ax
mov eax, 0x72
mov word [ebp - 0x4c], ax
mov eax, dword [ebp - 0x360]
mov word [ebp - 0x4a], ax
mov eax, 0x46
mov word [ebp - 0x46], ax
lea eax, [ebp - 0xc0]
push 0x15
mov word [ebp - 0x44], cx
mov ecx, dword [ebp - 0x314]
push eax
mov byte [ebp - 0x5a], 9
mov byte [ebp - 0x54], 9
mov byte [ebp - 0x4e], 1
mov byte [ebp - 0x48], 9
call fcn.005c47a0
push dword [ebp - 0x328]
mov dword [ebp - 0x380], 0xffffffff
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0x314]
push 0x20
push dword [ebp - 0x334]
call fcn.005bd3f0
xorps xmm0, xmm0
mov dword [ebp - 0x170], 0
lea ecx, [ebp - 0x178]
movq qword [ebp - 0x178], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x20c], 0
lea ecx, [ebp - 0x214]
movq qword [ebp - 0x214], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x200], 0
lea ecx, [ebp - 0x208]
movq qword [ebp - 0x208], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x108], 0
lea ecx, [ebp - 0x110]
movq qword [ebp - 0x110], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x1f4], 0
lea ecx, [ebp - 0x1fc]
movq qword [ebp - 0x1fc], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x1b8], 0
lea ecx, [ebp - 0x1c0]
movq qword [ebp - 0x1c0], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x124], 0
lea ecx, [ebp - 0x12c]
movq qword [ebp - 0x12c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x114], 0
lea ecx, [ebp - 0x11c]
movq qword [ebp - 0x11c], xmm0
call fcn.005dc5e0
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x120], 0
call fcn.005b0be0
push dword [ebp - 0x360]
mov ecx, dword [ebp - 0x314]
mov byte [ebp - 4], 0x1c
call fcn.005c4370
push dword [ebp - 0x33c]
mov ecx, edi
push dword [ebp - 0x338]
push dword [ebp - 0x318]
call fcn.0046af40
test byte [edi + 0x1f70], 0x80
jne 0x4ce8f2
nop
push 0
mov ecx, edi
call fcn.004771c0
mov edx, dword [edi + 0x14a8]
cmp edx, 0xfffffffa
je 0x4ce8f2
mov eax, dword [ebp - 0x314]
cmp dword [edi + 0x14d8], eax
jne 0x4ce881
cmp edx, dword [edi + 0x11c0]
je 0x4ce8eb
mov ecx, dword [ebp - 0x318]
cmp edx, 0xffffffeb
jne 0x4cc15c
cmp dword [edi + 0x14b4], ecx
jne 0x4cc15c
push dword [ebp - 0x334]
push ecx
mov ecx, edi
call fcn.0043e280
jmp 0x4ce881
test byte [edi + 0x1f70], 1
jne 0x4cdc81
cmp edx, dword [ebp - 0x3bc]
je 0x4cdc81
cmp edx, dword [ebp - 0x338]
je 0x4cdc81
cmp edx, dword [ebp - 0x38c]
jne 0x4cc58e
xorps xmm0, xmm0
push ecx
mov ecx, eax
movlpd qword [ebp - 0xc8], xmm0
call fcn.005bb360
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], 0
mov byte [ebp - 4], 0x21
cmp dword [eax], 1
jge 0x4cc1c3
mov byte [ebp - 4], 0x1c
push eax
jmp 0x4ce879
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0x34]
push dword [ebp - 0x318]
movups xmmword [ebp - 0x34], xmm0
push dword [ebp - 0x330]
movups xmmword [ebp - 0x24], xmm0
push dword [ebp - 0x314]
call fcn.005b8800
xorps xmm0, xmm0
mov dword [ebp - 0x17c], 0
lea ecx, [ebp - 0x184]
movq qword [ebp - 0x184], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x1e8], 0
lea ecx, [ebp - 0x1f0]
movq qword [ebp - 0x1f0], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x1ac], 0
lea ecx, [ebp - 0x1b4]
movq qword [ebp - 0x1b4], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x194], 0
lea ecx, [ebp - 0x19c]
movq qword [ebp - 0x19c], xmm0
call fcn.005dc5e0
push 0
push str.Cancel
push 0
push 0xffffffffffffffba
sub esp, 8
mov byte [ebp - 4], 0x26
mov ecx, edi
push 0x46
push 0x1c2
push dword [ebp - 0x314]
push str.Preparing_to_modify...
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b64a0
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ecx]
mov dword [ebp - 0x284], eax
test eax, eax
je 0x4cc47e
mov esi, dword [ebp - 0x314]
jmp 0x4cc2cd
mov ecx, dword [ebp - 0xc8]
push 7
mov dword [ebp - 0xd0], 0
push dword [ecx + eax*4]
mov ecx, esi
mov dword [ebp - 0x288], 0
push dword [ebp - 0x318]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x1f0]
call fcn.005dc1c0
push ecx
push 0x20019
lea ecx, [ebp - 0x1f0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xcc]
call fcn.005d6a30
test al, al
je 0x4cc385
lea eax, [ebp - 0xd0]
push eax
push str.NoModify
lea ecx, [ebp - 0xcc]
call fcn.005d66b0
test al, al
je 0x4cc344
cmp dword [ebp - 0xd0], 0
jne 0x4cc385
lea ecx, [ebp - 0x1b4]
call fcn.005dc400
push eax
push str.ModifyPath
lea ecx, [ebp - 0xcc]
call fcn.005d6740
test al, al
je 0x4cc385
lea ecx, [ebp - 0x1b4]
call fcn.005dbeb0
mov ecx, dword [ebp - 0x288]
test al, al
mov eax, 1
cmove ecx, eax
mov dword [ebp - 0x288], ecx
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0xc8]
push 0
push dword [ecx + eax*4]
mov ecx, esi
push dword [ebp - 0x318]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x19c]
call fcn.005dc1c0
cmp dword [ebp - 0x288], 0
lea ecx, [ebp - 0x19c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
je 0x4cc573
call fcn.005dc190
push eax
push str.Modifying_installed_program:_r_n
lea ecx, [ebp - 0xdc]
call fcn.005dc200
lea ecx, [ebp - 0xdc]
call fcn.005dc190
push eax
push 0xffffffffffffffff
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 5
push 0
lea ecx, [ebp - 0x1b4]
call fcn.005dc190
push eax
lea ecx, [edi + 0x1290]
call fcn.005793c0
mov edi, eax
mov eax, 0xffffffff
test edi, edi
cmove edi, eax
mov dword [ebp - 0x28c], edi
mov ecx, dword [ebp - 0x320]
lea eax, [ebp - 0xd0]
push eax
push edi
mov byte [ebp - 4], 0x27
call fcn.0043a9f0
mov byte [ebp - 4], 0x26
cmp edi, 0xffffffff
je 0x4cc45d
test edi, edi
je 0x4cc45d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x320]
mov eax, dword [ebp - 0x284]
sub eax, 1
mov dword [ebp - 0x284], eax
jne 0x4cc2c7
mov esi, dword [ebp - 0x32c]
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
push 2
lea ecx, [ebp - 0x184]
call fcn.005dadc0
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x4cc52e
push 0
push 1
push 1
push 0
push 0x62781c
lea ecx, [ebp - 0x184]
call fcn.005daa70
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x184]
mov edi, eax
call fcn.005dc190
push eax
test edi, edi
mov ecx, str.s_were
push str._not_modifiable:_r_n_r_n
mov eax, str._was
cmovne eax, ecx
lea ecx, [ebp - 0xdc]
push eax
push str.The_following_program
call fcn.005dc200
sub esp, 8
lea ecx, [ebp - 0xdc]
push 0x8c
push 0x190
push 0
push 0
push 4
call fcn.005dc190
mov edi, dword [ebp - 0x320]
mov ecx, edi
push eax
call fcn.0043e2e0
push dword [ebp - 0x33c]
mov ecx, edi
push dword [ebp - 0x338]
push dword [ebp - 0x318]
call fcn.0046af40
lea ecx, [ebp - 0x19c]
call fcn.005dc430
lea ecx, [ebp - 0x1b4]
call fcn.005dc430
lea ecx, [ebp - 0x1f0]
call fcn.005dc430
lea ecx, [ebp - 0x184]
jmp 0x4ce862
push 0x62781c
call fcn.005dc190
push eax
lea ecx, [ebp - 0x184]
call fcn.005da780
jmp 0x4cc463
cmp edx, dword [ebp - 0x3a8]
jne 0x4cc851
xorps xmm0, xmm0
push ecx
mov ecx, eax
movlpd qword [ebp - 0xc8], xmm0
call fcn.005bb360
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], 0
mov byte [ebp - 4], 0x28
cmp dword [eax], 1
jge 0x4cc5d0
mov byte [ebp - 4], 0x1c
push eax
jmp 0x4ce879
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0x34]
push dword [ebp - 0x318]
movups xmmword [ebp - 0x34], xmm0
push dword [ebp - 0x330]
movups xmmword [ebp - 0x24], xmm0
push dword [ebp - 0x314]
call fcn.005b8800
push 0
push 0
push 0
push 0
mov byte [ebp - 4], 0x29
mov eax, 0x62439c
mov edx, dword [ebp - 0xc8]
mov ecx, 0x694abc
push 0
push 0
push str.__and_it_can_not_be_undone.
cmp dword [edx], 1
mov edx, 0x648020
cmovne eax, edx
push eax
push str._the_associated_program
push str.__r_n_r_nThis_action_does_not_uninstall
mov eax, 0x694ab8
cmovne eax, ecx
lea ecx, [ebp - 0xdc]
push eax
push str.Are_you_sure_you_want_to_delete_the_selected_uninstall_entr
call fcn.005dc200
xorps xmm0, xmm0
mov dword [ebp - 0x164], 0
lea ecx, [ebp - 0x16c]
movq qword [ebp - 0x16c], xmm0
call fcn.005dc5e0
sub esp, 8
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xdc]
push 0x8c
push 0x190
push 0
push 0
push 1
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043e2e0
test eax, eax
jne 0x4cc6aa
lea ecx, [ebp - 0x16c]
jmp 0x4ce862
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ecx]
mov dword [ebp - 0x284], eax
test eax, eax
je 0x4cc78a
mov edi, dword [ebp - 0x314]
mov esi, dword [ebp - 0x318]
jmp 0x4cc6d6
mov ecx, dword [ebp - 0xc8]
push 7
push dword [ecx + eax*4]
mov ecx, edi
push esi
call fcn.005bb510
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
push 0
lea ecx, [ebp - 0xdc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xcc]
call fcn.005d55d0
mov ecx, dword [ebp - 0x284]
mov edx, dword [ebp - 0xc8]
push 0
mov ecx, dword [edx + ecx*4]
push ecx
mov ecx, edi
push esi
test al, al
jne 0x4cc764
call fcn.005bb510
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x628818
lea ecx, [ebp - 0xdc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x16c]
call fcn.005da780
jmp 0x4cc769
call fcn.005bb970
mov eax, dword [ebp - 0x284]
sub eax, 1
mov dword [ebp - 0x284], eax
jne 0x4cc6d0
mov esi, dword [ebp - 0x32c]
mov edi, dword [ebp - 0x320]
push 2
lea ecx, [ebp - 0x16c]
call fcn.005dadc0
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x4cc82d
push 0
push 1
push 1
push 0
push 0x628818
lea ecx, [ebp - 0x16c]
call fcn.005daa70
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x16c]
mov edi, eax
call fcn.005dc190
push eax
test edi, edi
mov ecx, 0x694abc
push str._could_not_be_deleted:_r_n_r_n
mov eax, 0x694ab8
cmovne eax, ecx
lea ecx, [ebp - 0xdc]
push eax
push str.The_following_entr
call fcn.005dc200
sub esp, 8
lea ecx, [ebp - 0xdc]
push 0x8c
push 0x190
push 0
push 0
push 4
call fcn.005dc190
mov edi, dword [ebp - 0x320]
mov ecx, edi
push eax
call fcn.0043e2e0
push dword [ebp - 0x33c]
mov ecx, edi
push dword [ebp - 0x338]
push dword [ebp - 0x318]
call fcn.0046af40
lea ecx, [ebp - 0x16c]
jmp 0x4ce862
cmp edx, dword [ebp - 0x3ac]
jne 0x4cc900
xorps xmm0, xmm0
push ecx
mov ecx, eax
movlpd qword [ebp - 0xc8], xmm0
call fcn.005bb360
mov ecx, eax
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc8], ecx
mov byte [ebp - 4], 0x2b
cmp dword [ecx], 1
jge 0x4cc895
mov byte [ebp - 4], 0x1c
push ecx
jmp 0x4ce879
mov esi, dword [ebp - 0x314]
mov eax, 1
mov dword [ebp - 0x284], eax
push 0
push dword [ecx + eax*4]
mov ecx, esi
push dword [ebp - 0x318]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
push 2
lea ecx, [ebp - 0xdc]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0045ee00
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0x284], eax
cmp eax, dword [ecx]
jle 0x4cc8a6
mov esi, dword [ebp - 0x32c]
mov byte [ebp - 4], 0x1c
push ecx
jmp 0x4ce879
mov edx, dword [edi + 0x14a8]
cmp edx, dword [ebp - 0x3b4]
jne 0x4cc9b8
xorps xmm0, xmm0
push ecx
mov ecx, eax
movlpd qword [ebp - 0xc8], xmm0
call fcn.005bb360
mov ecx, eax
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc8], ecx
mov byte [ebp - 4], 0x2c
cmp dword [ecx], 1
jge 0x4cc94a
mov byte [ebp - 4], 0x1c
push ecx
jmp 0x4ce879
mov edi, dword [ebp - 0x314]
mov eax, 1
mov esi, dword [ebp - 0x318]
mov dword [ebp - 0x284], eax
push 8
push dword [ecx + eax*4]
mov ecx, edi
push esi
call fcn.005bb510
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
lea ecx, [ebp - 0xdc]
call fcn.005dc190
push eax
call fcn.0043bf00
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0x284], eax
cmp eax, dword [ecx]
jle 0x4cc961
mov esi, dword [ebp - 0x32c]
mov edi, dword [ebp - 0x320]
mov byte [ebp - 4], 0x1c
push ecx
jmp 0x4ce879
cmp edx, dword [ebp - 0x378]
jne 0x4cca0a
push 2
push 0xffffffffffffffff
push ecx
mov ecx, eax
call fcn.005bb4c0
test eax, eax
js 0x4ce881
mov ecx, dword [ebp - 0x314]
push 7
push eax
push dword [ebp - 0x318]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
lea ecx, [ebp - 0xdc]
call fcn.005dc190
push eax
call fcn.0043bf00
jmp 0x4ce881
cmp edx, dword [ebp - 0x3b0]
jne 0x4ccac7
xorps xmm0, xmm0
push ecx
mov ecx, eax
movlpd qword [ebp - 0xc8], xmm0
call fcn.005bb360
mov ecx, eax
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc8], ecx
mov byte [ebp - 4], 0x2d
cmp dword [ecx], 1
jge 0x4cca4e
mov byte [ebp - 4], 0x1c
push ecx
jmp 0x4ce879
mov edi, dword [ebp - 0x314]
mov eax, 1
mov esi, dword [ebp - 0x318]
mov dword [ebp - 0x284], eax
push 8
push dword [ecx + eax*4]
mov ecx, edi
push esi
call fcn.005bb510
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
push 0
lea ecx, [ebp - 0xdc]
call fcn.005dc190
push eax
push 2
push dword [ebp - 0x358]
call dword [sym.imp.SHELL32.dll_SHObjectProperties]
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0x284], eax
cmp eax, dword [ecx]
jle 0x4cca65
mov esi, dword [ebp - 0x32c]
mov edi, dword [ebp - 0x320]
mov byte [ebp - 4], 0x1c
push ecx
jmp 0x4ce879
cmp edx, dword [ebp - 0x3a4]
jne 0x4ccd7e
xorps xmm0, xmm0
push ecx
mov ecx, eax
movlpd qword [ebp - 0xc8], xmm0
call fcn.005bb360
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], 0
mov byte [ebp - 4], 0x2e
cmp dword [eax], 1
jge 0x4ccb09
mov byte [ebp - 4], 0x1c
push eax
jmp 0x4ce879
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0x34]
push dword [ebp - 0x318]
movups xmmword [ebp - 0x34], xmm0
push dword [ebp - 0x330]
movups xmmword [ebp - 0x24], xmm0
push dword [ebp - 0x314]
call fcn.005b8800
push 0
push str.Next
sub esp, 8
mov byte [ebp - 4], 0x2f
mov ecx, edi
push 0x50
push 0x1f4
push 0
push 0
call fcn.0043da60
mov ecx, eax
call fcn.005b64a0
lea eax, [edi + 0x14f0]
push 1
push str.Cancel
mov ecx, eax
mov dword [ebp - 0x28c], eax
call fcn.005b64a0
xorps xmm0, xmm0
mov dword [ebp - 0x140], 0
lea ecx, [ebp - 0x148]
movq qword [ebp - 0x148], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x1d0], 0
lea ecx, [ebp - 0x1d8]
movq qword [ebp - 0x1d8], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x31
mov eax, 1
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x284], eax
cmp dword [ecx], eax
jl 0x4ccd5b
mov esi, dword [ebp - 0x314]
mov dword [ebp - 0x288], 0x64
push 8
push dword [ecx + eax*4]
mov ecx, esi
push dword [ebp - 0x318]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_nVerifying...
lea ecx, [ebp - 0xdc]
call fcn.005dc190
push eax
push 0x694bcc
lea ecx, [ebp - 0x148]
call fcn.005dc200
lea ecx, [ebp - 0x148]
call fcn.005dc190
mov ecx, dword [ebp - 0xc8]
push eax
mov eax, dword [ebp - 0x288]
cdq
idiv dword [ecx]
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
push 0
push 1
mov ecx, edi
call fcn.0043d720
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0xc8]
push 1
push dword [ecx + eax*4]
mov ecx, esi
push dword [ebp - 0x318]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x1d8]
call fcn.005dc1c0
lea ecx, [ebp - 0x1d8]
call fcn.005dc190
lea ecx, [ebp - 0xdc]
mov edi, eax
call fcn.005dc190
mov edx, edi
mov ecx, eax
call fcn.00594240
push eax
lea ecx, [ebp - 0x148]
call fcn.005dc1c0
sub esp, 0xc
lea ecx, [ebp - 0xdc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
call fcn.005dc190
push eax
push 0x694bcc
lea ecx, [ebp - 0x148]
call fcn.005da510
lea ecx, [ebp - 0x148]
call fcn.005dc190
mov ecx, dword [ebp - 0x28c]
push eax
push 0xffffffffffffffff
call fcn.005b66e0
mov edi, dword [ebp - 0x320]
push 3
mov ecx, edi
call fcn.0043d8e0
push 0
push 0
mov ecx, edi
call fcn.0043d720
test eax, eax
je 0x4ccd16
cmp eax, 2
jne 0x4ccd55
push 1
mov ecx, edi
call fcn.0043d8e0
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0xc8]
inc eax
add dword [ebp - 0x288], 0x64
mov dword [ebp - 0x284], eax
cmp eax, dword [ecx]
jle 0x4ccbe4
mov esi, dword [ebp - 0x32c]
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0x1d8]
call fcn.005dc430
lea ecx, [ebp - 0x148]
jmp 0x4ce862
cmp edx, dword [ebp - 0x340]
jne 0x4ccf79
xorps xmm0, xmm0
push ecx
mov ecx, eax
movlpd qword [ebp - 0xc8], xmm0
call fcn.005bb360
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], 0
mov byte [ebp - 4], 0x32
cmp dword [eax], 1
jge 0x4ccdc0
mov byte [ebp - 4], 0x1c
push eax
jmp 0x4ce879
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push 0
push dword [ebp - 0x314]
push 1
push str.Please_report_only_unwanted_programs_using_this_feature._You_can_report_several_items_at_once._r_n_r_nAre_you_sure_you_want_to_report_the_selected_programs_
call fcn.0043e2e0
test eax, eax
je 0x4ce86f
xorps xmm0, xmm0
mov dword [ebp - 0x1a0], 0
lea ecx, [ebp - 0x1a8]
movq qword [ebp - 0x1a8], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x188], 0
lea ecx, [ebp - 0x190]
movq qword [ebp - 0x190], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x34
mov eax, 1
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x284], eax
cmp dword [ecx], eax
jl 0x4ccebc
mov edi, dword [ebp - 0x314]
mov esi, dword [ebp - 0x318]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x637f9c
push 0
push dword [ecx + eax*4]
mov ecx, edi
push esi
call fcn.005bb510
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1a8]
call fcn.005da780
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0x284], eax
cmp eax, dword [ecx]
jle 0x4cce54
mov esi, dword [ebp - 0x32c]
mov edi, dword [ebp - 0x320]
push 0x2000
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x2c4], 0x1000
push eax
push 0
push 0
push 0x1000
lea ecx, [ebp - 0x190]
call fcn.005db9a0
push eax
lea ecx, [ebp - 0x1a8]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_UrlEscapeW]
test eax, eax
je 0x4ccf0f
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0x190]
call fcn.005dc4e0
sub esp, 0xc
lea ecx, [ebp - 0x190]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.https:__www.carifred.com_ultra_adware_killer_pup_report.php_ps
call fcn.005da510
push 0
push 0
push str.https:__www.google.com
push ecx
push 6
lea ecx, [ebp - 0x190]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005b40e0
push eax
lea ecx, [ebp - 0x120]
call fcn.005b0b90
lea ecx, [ebp - 0x190]
call fcn.005dc430
lea ecx, [ebp - 0x1a8]
call fcn.005dc430
jmp 0x4ce86f
cmp edx, dword [ebp - 0x3a0]
jne 0x4ccfcc
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
push ecx
push dword [ebp - 0x330]
lea ecx, [ebp - 0x34]
push eax
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call fcn.005b8800
mov ecx, edi
mov byte [ebp - 4], 0x35
call fcn.004c5a80
push dword [ebp - 0x358]
call dword [sym.imp.USER32.dll_BringWindowToTop]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x1c
call fcn.005b8790
jmp 0x4ce881
cmp byte [ebp - 0x319], 1
jne 0x4ccff4
cmp edx, 0xffffff31
jne 0x4ccff4
lea ecx, [ebp - 0x280]
call fcn.005d05f0
mov byte [ebp - 0x319], 2
jmp 0x4ce881
cmp edx, 0xffffffea
jne 0x4cd017
cmp dword [edi + 0x14b4], ecx
jne 0x4cd017
mov eax, dword [edi + 0x14a8]
mov dword [ebp - 0x284], eax
cmp eax, dword [ebp - 0x368]
jne 0x4cd075
jmp 0x4cd031
mov edx, dword [edi + 0x14a8]
cmp edx, dword [ebp - 0x368]
jne 0x4cd1d7
mov eax, edx
mov dword [ebp - 0x284], eax
push dword [ebp - 0x328]
call dword [sym.imp.USER32.dll_SetFocus]
cmp byte [ebp - 0x319], 2
jne 0x4cd06e
xorps xmm1, xmm1
lea ecx, [ebp - 0x280]
call fcn.005d05a0
movsd xmm1, qword [0x6edb98]
comisd xmm1, xmm0
jbe 0x4cd06e
mov byte [ebp - 0x319], 0
jmp 0x4ce881
mov byte [ebp - 0x319], 1
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ebp - 0x328]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
mov ecx, 0x20
mov eax, 0x40
cmove ecx, eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x288], ecx
cmp eax, dword [ebp - 0x340]
jg 0x4cd0da
mov edi, dword [ebp - 0x314]
mov esi, eax
push ecx
push esi
mov ecx, edi
call fcn.005bd3f0
mov ecx, dword [ebp - 0x288]
inc esi
cmp esi, dword [ebp - 0x340]
jle 0x4cd0b6
mov esi, dword [ebp - 0x32c]
mov edi, dword [ebp - 0x320]
push ecx
push dword [ebp - 0x34c]
mov ecx, dword [ebp - 0x314]
call fcn.005bd3f0
push dword [ebp - 0x288]
mov ecx, dword [ebp - 0x314]
push dword [ebp - 0x350]
call fcn.005bd3f0
push dword [ebp - 0x288]
mov ecx, dword [ebp - 0x314]
push dword [ebp - 0x36c]
call fcn.005bd3f0
push 0
mov ecx, edi
call fcn.004356c0
mov ecx, dword [ebp - 0x314]
test al, al
mov eax, 0x40
mov edi, 0x20
cmovne edi, eax
push edi
push dword [ebp - 0x354]
call fcn.005bd3f0
push edi
push dword [ebp - 0x344]
mov edi, dword [ebp - 0x314]
mov ecx, edi
call fcn.005bd3f0
mov eax, dword [ebp - 0x368]
cmp dword [ebp - 0x284], eax
jne 0x4cd1ab
lea ecx, [ebp - 0x264]
push ecx
push eax
mov ecx, edi
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x4cd1ab
mov eax, dword [ebp - 0x264]
mov edx, 8
add eax, 0x5a
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x260]
add eax, 0x2d
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x28c]
jmp 0x4cd1b6
xor edx, edx
or eax, 0xffffffff
mov dword [ebp - 0x284], eax
push dword [ebp - 0x284]
mov ecx, dword [ebp - 0x318]
push eax
push edx
push ecx
mov ecx, edi
call fcn.005bbfd0
mov edi, dword [ebp - 0x320]
jmp 0x4ce881
cmp edx, 0xffffffb3
jne 0x4cd1f0
mov eax, dword [ebp - 0x334]
cmp dword [edi + 0x14b4], eax
mov eax, dword [ebp - 0x314]
je 0x4cd1fc
cmp edx, dword [ebp - 0x394]
jne 0x4cd2ba
mov ecx, edi
call fcn.0046c220
mov ecx, dword [ebp - 0x314]
push 0x80
push dword [ebp - 0x334]
call fcn.005bd3f0
push dword [ebp - 0x334]
mov ecx, dword [ebp - 0x314]
call fcn.005bc230
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
push str.Find_a_program__CtrlF_
lea ecx, [ebp - 0xdc]
call fcn.005dc4c0
mov ecx, dword [ebp - 0x314]
test al, al
je 0x4cd2a1
push 0
push 0
push dword [ebp - 0x334]
call fcn.005bcd30
mov ecx, dword [ebp - 0x314]
push 0
push dword [ebp - 0x334]
call fcn.005bec70
movsd xmm0, qword [0x6edb20]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push 0
push ecx
mov ecx, dword [ebp - 0x314]
push 0x190
push dword [ebp - 0x334]
call fcn.005beb10
jmp 0x4ce881
push 0xffffffffffffffff
push 0
push 0xb1
push dword [ebp - 0x334]
call fcn.005befd0
jmp 0x4ce881
cmp edx, 0xffffffb4
jne 0x4cd323
mov eax, dword [ebp - 0x334]
cmp dword [edi + 0x14b4], eax
mov eax, dword [ebp - 0x314]
jne 0x4cd323
push dword [ebp - 0x334]
mov ecx, eax
call fcn.005bc230
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
lea ecx, [ebp - 0xdc]
call fcn.005dc3a0
cmp eax, 3
jl 0x4ce881
push 0xffffffffffffffff
push 6
push 0xffffffffffffffff
lea ecx, [ebp - 0xdc]
call fcn.005dc190
mov ecx, dword [ebp - 0x328]
mov edx, eax
call fcn.005c9ea0
jmp 0x4ce881
cmp edx, dword [ebp - 0x360]
jne 0x4cd403
push dword [ebp - 0x334]
mov ecx, eax
call fcn.005bc230
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
push str.Find_a_program__CtrlF_
lea ecx, [ebp - 0xdc]
call fcn.005dc4c0
test al, al
jne 0x4cd3e4
lea ecx, [ebp - 0xdc]
call fcn.005dbeb0
test al, al
jne 0x4cd3e4
push dword [ebp - 0x380]
push 0x1e
push 0xffffffffffffffff
call fcn.005dc190
mov ecx, dword [ebp - 0x328]
mov edx, eax
call fcn.005c9ea0
mov ecx, dword [ebp - 0x314]
mov dword [ebp - 0x380], eax
push 0x80
cmp eax, 0xffffffff
je 0x4cd3b1
push dword [ebp - 0x318]
call fcn.005bd3f0
jmp 0x4ce881
push dword [ebp - 0x334]
call fcn.005bd3f0
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push 0
push dword [ebp - 0x314]
push 4
push str.Find_reached_the_end_of_the_list.
call fcn.0043e2e0
jmp 0x4ce881
mov ecx, dword [ebp - 0x314]
push 0
push 0
push 0x201
push dword [ebp - 0x394]
call fcn.005befd0
jmp 0x4ce881
cmp edx, 0xffffffd3
je 0x4cdc68
cmp edx, 0xffffffd2
je 0x4cdc68
mov edx, dword [edi + 0x14a8]
cmp edx, dword [ebp - 0x35c]
je 0x4cdc0f
cmp edx, dword [ebp - 0x348]
je 0x4cdc0f
cmp edx, 0xfffffff2
jne 0x4cd444
cmp dword [edi + 0x14b4], ecx
je 0x4cdc0f
cmp edx, dword [ebp - 0x330]
jne 0x4cd4a5
push 4
push dword [ebp - 0x330]
mov ecx, eax
call fcn.005bc500
test eax, eax
je 0x4cd468
or dword [ebp - 0x308], 1
jmp 0x4cd46f
and dword [ebp - 0x308], 0xfffffffe
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0x34]
push dword [ebp - 0x318]
movups xmmword [ebp - 0x34], xmm0
push dword [ebp - 0x330]
movups xmmword [ebp - 0x24], xmm0
push dword [ebp - 0x314]
call fcn.005b8800
mov byte [ebp - 4], 0x37
jmp 0x4cd92c
cmp edx, dword [ebp - 0x390]
je 0x4cdb9c
cmp edx, dword [ebp - 0x3b8]
je 0x4cdb9c
cmp edx, dword [ebp - 0x398]
je 0x4cdb9c
cmp edx, dword [ebp - 0x37c]
je 0x4cdb9c
cmp edx, dword [ebp - 0x384]
jne 0x4cd509
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
push ecx
push dword [ebp - 0x330]
lea ecx, [ebp - 0x34]
push eax
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call fcn.005b8800
mov byte [ebp - 4], 0x38
jmp 0x4cd92c
mov edx, dword [edi + 0x14a8]
cmp edx, dword [ebp - 0x34c]
jne 0x4cd6ed
xorps xmm0, xmm0
push ecx
mov ecx, eax
movlpd qword [ebp - 0xc8], xmm0
call fcn.005bb360
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], 0
cmp dword [eax], 1
jge 0x4cd54d
mov byte [ebp - 4], 0x1c
push eax
jmp 0x4ce879
xorps xmm0, xmm0
mov dword [ebp - 0x158], 0
lea ecx, [ebp - 0x160]
movq qword [ebp - 0x160], xmm0
call fcn.005dc5e0
push 0
push str._sv_d_.w_
lea ecx, [ebp - 0x284]
mov dword [ebp - 0x284], 0
call fcn.00401450
push ecx
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 0x3b
call fcn.005dd5c0
mov ecx, dword [ebp - 0xc8]
mov edi, dword [ebp - 0x284]
mov eax, dword [ecx]
mov dword [ebp - 0x288], eax
test eax, eax
jle 0x4cd6bb
mov esi, dword [ebp - 0x314]
jmp 0x4cd5c6
mov ecx, dword [ebp - 0xc8]
push 0
push dword [ecx + eax*4]
mov ecx, esi
push dword [ebp - 0x318]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x160]
call fcn.005dc1c0
lea ecx, [ebp - 0x160]
call fcn.005dc190
push eax
push str.Blacklisted
lea ecx, [ebp - 0x300]
call fcn.005dcff0
push 0
push 0x62439c
push edi
lea ecx, [ebp - 0x160]
call fcn.005d9500
lea ecx, [ebp - 0x160]
call fcn.005dc190
push eax
push str.Blacklisted
lea ecx, [ebp - 0x300]
call fcn.005dcff0
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0xc8]
push 1
push dword [ecx + eax*4]
mov ecx, esi
push dword [ebp - 0x318]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
lea ecx, [ebp - 0x160]
call fcn.005dc190
push eax
push str.Whitelisted
lea eax, [ebp - 0x300]
push eax
lea ecx, [ebp - 0xdc]
call fcn.005db130
cmp byte [eax + 8], 0
je 0x4cd6a0
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0xc8]
push 0
push dword [ecx + eax*4]
mov ecx, esi
push dword [ebp - 0x318]
call fcn.005bb970
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
test eax, eax
jg 0x4cd5c0
mov esi, dword [ebp - 0x32c]
test edi, edi
je 0x4cd6c8
push edi
call fcn.00418a90
add esp, 4
lea ecx, [ebp - 0x160]
call fcn.005dc430
mov byte [ebp - 4], 0x1c
push dword [ebp - 0xc8]
call fcn.0041e1c3
mov edi, dword [ebp - 0x320]
jmp 0x4ce87e
cmp edx, dword [ebp - 0x350]
jne 0x4cd8a9
xorps xmm0, xmm0
push ecx
mov ecx, eax
movlpd qword [ebp - 0xc8], xmm0
call fcn.005bb360
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], 0
cmp dword [eax], 1
jge 0x4cd72b
mov byte [ebp - 4], 0x1c
push eax
jmp 0x4ce879
xorps xmm0, xmm0
mov dword [ebp - 0x14c], 0
lea ecx, [ebp - 0x154]
movq qword [ebp - 0x154], xmm0
call fcn.005dc5e0
push 0
push str._sv_d_.w_
lea ecx, [ebp - 0x288]
mov dword [ebp - 0x288], 0
call fcn.00401450
push ecx
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 0x3e
call fcn.005dd5c0
mov ecx, dword [ebp - 0xc8]
mov edi, dword [ebp - 0x288]
mov eax, dword [ecx]
mov dword [ebp - 0x284], eax
test eax, eax
jle 0x4cd877
mov esi, dword [ebp - 0x314]
jmp 0x4cd7a6
mov ecx, dword [ebp - 0xc8]
push 0
push dword [ecx + eax*4]
mov ecx, esi
push dword [ebp - 0x318]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x154]
call fcn.005dc1c0
lea ecx, [ebp - 0x154]
call fcn.005dc190
push eax
push str.Whitelisted
lea ecx, [ebp - 0x300]
call fcn.005dcff0
push 0
push 0x62439c
push edi
lea ecx, [ebp - 0x154]
call fcn.005d9500
lea ecx, [ebp - 0x154]
call fcn.005dc190
push eax
push str.Whitelisted
lea ecx, [ebp - 0x300]
call fcn.005dcff0
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0xc8]
push 1
push dword [ecx + eax*4]
mov ecx, esi
push dword [ebp - 0x318]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
lea ecx, [ebp - 0x154]
call fcn.005dc190
push eax
push str.Blacklisted
lea eax, [ebp - 0x300]
push eax
lea ecx, [ebp - 0xdc]
call fcn.005db130
mov eax, dword [ebp - 0x284]
dec eax
mov dword [ebp - 0x284], eax
test eax, eax
jg 0x4cd7a0
mov esi, dword [ebp - 0x32c]
test edi, edi
je 0x4cd884
push edi
call fcn.00418a90
add esp, 4
lea ecx, [ebp - 0x154]
call fcn.005dc430
mov byte [ebp - 4], 0x1c
push dword [ebp - 0xc8]
call fcn.0041e1c3
mov edi, dword [ebp - 0x320]
jmp 0x4ce87e
cmp edx, dword [ebp - 0x388]
jne 0x4cd8eb
mov ecx, dword [ebp - 0x328]
call fcn.005ca6e0
lea eax, [ebp - 0x300]
mov ecx, edi
push eax
push dword [ebp - 0x318]
call fcn.004ca750
mov ecx, dword [ebp - 0x314]
push 0x80
push dword [ebp - 0x318]
call fcn.005bd3f0
jmp 0x4ce881
cmp edx, dword [ebp - 0x3c4]
jne 0x4cd94b
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
push ecx
push dword [ebp - 0x330]
lea ecx, [ebp - 0x34]
push eax
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call fcn.005b8800
lea eax, [ebp - 0x300]
mov byte [ebp - 4], 0x3f
push eax
mov ecx, edi
call fcn.004c67c0
test eax, eax
je 0x4cd93a
lea eax, [ebp - 0x310]
mov ecx, edi
push eax
call fcn.004cab70
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x1c
call fcn.005b8790
jmp 0x4ce881
cmp edx, dword [ebp - 0x39c]
jne 0x4cd9a9
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], 0
push eax
push str.Whitelisted
lea ecx, [ebp - 0x300]
call fcn.005dcc50
test eax, eax
je 0x4ce881
cmp dword [ebp - 0x284], eax
jbe 0x4ce881
or dword [ebp - 0x308], 2
lea eax, [ebp - 0x310]
push eax
mov ecx, edi
call fcn.004cab70
and dword [ebp - 0x308], 0xfffffffd
jmp 0x4ce881
cmp edx, dword [ebp - 0x36c]
jne 0x4cd9c5
push 8
push dword [ebp - 0x328]
mov ecx, edi
call fcn.00435a20
jmp 0x4ce881
cmp edx, dword [ebp - 0x354]
jne 0x4cd9e7
push 0xffffffffffffffff
push 0x20
push 2
push 8
push dword [ebp - 0x328]
mov ecx, edi
call fcn.00435710
jmp 0x4ce881
cmp edx, dword [ebp - 0x344]
jne 0x4cda09
push 4
push 0
push 2
push 8
push dword [ebp - 0x328]
mov ecx, edi
call fcn.00435710
jmp 0x4ce881
cmp edx, dword [ebp - 0x3c0]
jne 0x4cda70
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
push ecx
push dword [ebp - 0x330]
lea ecx, [ebp - 0x34]
push eax
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call fcn.005b8800
push dword [ebp - 0x318]
mov ecx, edi
mov byte [ebp - 4], 0x40
push 0
call fcn.004c3b10
cmp eax, 1
jne 0x4cda5f
mov ecx, dword [ebp - 0x314]
push 0x20
push dword [ebp - 0x338]
call fcn.005bd3f0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x1c
call fcn.005b8790
jmp 0x4ce881
cmp edx, 0xfffffffb
jne 0x4ce881
cmp dword [edi + 0x14b4], ecx
jne 0x4ce881
mov ecx, eax
call fcn.005c57d0
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x4ce881
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0x34]
push dword [ebp - 0x318]
movups xmmword [ebp - 0x34], xmm0
push dword [ebp - 0x330]
movups xmmword [ebp - 0x24], xmm0
push dword [ebp - 0x314]
call fcn.005b8800
xorps xmm0, xmm0
mov byte [ebp - 4], 0x41
push 1
push 0x62781c
lea ecx, [ebp - 0xdc]
movq qword [ebp - 0xf4], xmm0
movups xmmword [ebp - 0x104], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x104]
call fcn.005d92a0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x104]
xor edx, edx
mov dword [ebp - 0x284], edx
call fcn.005d9210
test eax, eax
je 0x4cdb80
mov esi, dword [ebp - 0x314]
nop dword [eax]
push dword [ebp - 0x318]
lea ecx, [ebp - 0x104]
push edx
call fcn.005d9220
push eax
mov ecx, edi
call fcn.004c3b10
cmp eax, 1
jne 0x4cdb5e
push 0x20
push dword [ebp - 0x338]
mov ecx, esi
call fcn.005bd3f0
mov edx, dword [ebp - 0x284]
lea ecx, [ebp - 0x104]
inc edx
mov dword [ebp - 0x284], edx
call fcn.005d9210
cmp edx, eax
jb 0x4cdb30
mov esi, dword [ebp - 0x32c]
lea ecx, [ebp - 0x104]
call fcn.005d9280
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x1c
call fcn.005b8790
jmp 0x4ce881
mov ecx, dword [edi + 0x14a8]
cmp ecx, dword [ebp - 0x390]
jne 0x4cdbae
xor eax, eax
jmp 0x4cdbd0
cmp ecx, dword [ebp - 0x398]
jne 0x4cdbbd
mov eax, 3
jmp 0x4cdbd0
cmp ecx, dword [ebp - 0x37c]
mov eax, 1
mov ecx, 4
cmove eax, ecx
push 0
push eax
push 0x108e
push dword [ebp - 0x328]
mov dword [ebp - 0xe4], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
lea eax, [ebp - 0xe4]
push eax
push 4
push str.CurrentView
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerSmart_Uninstaller
lea ecx, [ebp - 0xcc]
call fcn.005d5e20
jmp 0x4ce881
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
push ecx
push dword [ebp - 0x330]
lea ecx, [ebp - 0x34]
push eax
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call fcn.005b8800
push dword [ebp - 0x318]
mov ecx, edi
mov byte [ebp - 4], 0x36
call fcn.004c8850
test al, al
jne 0x4ce890
push dword [ebp - 0x358]
call dword [sym.imp.USER32.dll_BringWindowToTop]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x1c
call fcn.005b8790
jmp 0x4ce881
push dword [ebp - 0x33c]
push dword [ebp - 0x338]
push ecx
mov ecx, edi
call fcn.0046af40
jmp 0x4ce881
push 1
mov ecx, edi
call fcn.0043d8e0
mov eax, dword [edi + 0x1f70]
test al, 1
je 0x4cdca2
and eax, 0xfffffffe
or eax, 0x80
mov dword [edi + 0x1f70], eax
push dword [ebp - 0x318]
mov ecx, dword [ebp - 0x314]
xorps xmm0, xmm0
movlpd qword [ebp - 0xc8], xmm0
call fcn.005bb360
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], 0
mov byte [ebp - 4], 0x1d
cmp dword [eax], 1
jge 0x4cdce1
mov byte [ebp - 4], 0x1c
push eax
jmp 0x4ce879
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0x34]
push dword [ebp - 0x318]
movups xmmword [ebp - 0x34], xmm0
push dword [ebp - 0x330]
movups xmmword [ebp - 0x24], xmm0
push dword [ebp - 0x314]
call fcn.005b8800
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0x1e
call fcn.005cf7a0
sub esp, 0xc
lea ecx, [ebp - 0x178]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerSmart_Uninstaller_
call fcn.005da510
xor eax, eax
mov dword [ebp - 0x100], edi
lea ecx, [ebp - 0xf8]
mov byte [ebp - 0xfc], 0
mov word [ebp - 0xfb], ax
mov byte [ebp - 0xf9], al
call fcn.005dc5e0
mov ecx, dword [ebp - 0x314]
push 4
push dword [ebp - 0x370]
mov byte [ebp - 4], 0x1f
call fcn.005bc500
mov ecx, dword [ebp - 0x314]
test eax, eax
push 4
push dword [ebp - 0x364]
setne byte [ebp - 0xfb]
call fcn.005bc500
mov ecx, dword [ebp - 0x314]
test eax, eax
push 4
push dword [ebp - 0x374]
setne byte [ebp - 0xfa]
call fcn.005bc500
cmp byte [ebp - 0xfb], 0
mov cl, byte [ebp - 0xfa]
mov dword [ebp - 0x28c], eax
jne 0x4cddd3
test cl, cl
je 0x4cde8a
mov edx, dword [ebp - 0xc8]
sub esp, 8
test cl, cl
mov dword [ebp - 0x1dc], 0
mov ecx, 0x62439c
mov eax, str._r_n_r_nNote:_Force_uninstall_is_enabled.
cmove eax, ecx
xorps xmm0, xmm0
cmp dword [edx], 1
mov ecx, 0x633f74
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov eax, 0x624a00
movq qword [ebp - 0x1e4], xmm0
cmovne eax, ecx
lea ecx, [ebp - 0x1e4]
push eax
push str.Are_you_sure_you_want_to_uninstall_the_selected_program
call fcn.005dc520
mov byte [ebp - 4], 0x20
test byte [edi + 0x1f70], 0x80
jne 0x4cde7b
sub esp, 8
lea ecx, [ebp - 0x1e4]
push 0x8c
push 0x190
push 0
push dword [ebp - 0x314]
push 1
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043e2e0
test eax, eax
jne 0x4cde7b
lea ecx, [ebp - 0x1e4]
call fcn.005dc430
jmp 0x4ce85c
lea ecx, [ebp - 0x1e4]
mov byte [ebp - 4], 0x1f
call fcn.005dc430
push str.Still_uninstalling_programs__please_cancel_shutdown.
mov ecx, edi
call fcn.0043dbb0
push 0
push 0xffffffffffffffba
sub esp, 0x10
mov ecx, edi
push dword [ebp - 0x314]
push str.Preparing_to_uninstall...
call fcn.0043d960
mov ecx, eax
call fcn.005b66e0
cmp byte [ebp - 0xfa], 0
jne 0x4cdee9
push 0
push str.Cancel_all
lea ecx, [edi + 0x14f0]
call fcn.005b64a0
push 1
push str.Stop_monitoring
lea ecx, [edi + 0x14f0]
call fcn.005b64a0
mov edi, dword [ebp - 0x320]
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0xd0], 0
mov eax, dword [ecx]
mov dword [ebp - 0x288], eax
test eax, eax
jle 0x4ce7ab
jmp 0x4cdf16
mov ecx, dword [ebp - 0xc8]
cmp byte [edi + 0x11c9], 0
jne 0x4ce7a5
push 7
push dword [ecx + eax*4]
mov ecx, dword [ebp - 0x314]
push dword [ebp - 0x318]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x11c]
call fcn.005dc1c0
lea ecx, [ebp - 0x11c]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
mov ecx, dword [ebp - 0x288]
mov edx, dword [ebp - 0xc8]
push 0
mov ecx, dword [edx + ecx*4]
push ecx
mov ecx, dword [ebp - 0x314]
push dword [ebp - 0x318]
test al, al
jne 0x4cdf85
call fcn.005bb970
jmp 0x4ce790
call fcn.005bb510
push eax
lea ecx, [ebp - 0x110]
call fcn.005dc1c0
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0xc8]
push 6
push dword [ecx + eax*4]
mov ecx, dword [ebp - 0x314]
push dword [ebp - 0x318]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x12c]
call fcn.005dc1c0
cmp byte [ebp - 0xfb], 0
jne 0x4ce04f
cmp byte [ebp - 0xfa], 0
jne 0x4ce04f
lea ecx, [ebp - 0x12c]
call fcn.005dbeb0
test al, al
je 0x4ce04f
test byte [edi + 0x1f70], 0x80
jne 0x4ce04f
sub esp, 8
lea ecx, [ebp - 0x110]
push 0x8c
push 0x190
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624a00
call fcn.005dc190
push eax
push str.Are_you_sure_you_want_to_uninstall
lea ecx, [ebp - 0xdc]
call fcn.005dc200
mov ecx, eax
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043e2e0
test eax, eax
je 0x4ce790
lea ecx, [ebp - 0x11c]
call fcn.005dc3a0
lea ecx, [ebp - 0x214]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x130]
push eax
push 0
push 0
push 0x80
call fcn.005db9a0
push eax
lea ecx, [ebp - 0x11c]
call fcn.005dc190
mov ecx, eax
call fcn.005e63d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x214]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x178]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xf8]
call fcn.005dc200
push ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0xf8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xcc]
call fcn.005d6a30
push 0
lea ecx, [ebp - 0x11c]
call fcn.005dc190
push eax
push 1
push str.FullKey
lea ecx, [ebp - 0xcc]
call fcn.005d5f20
push ecx
push 0x20019
lea ecx, [ebp - 0x11c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xec]
call fcn.005d6a30
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x11c]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004c8370
push 0
lea ecx, [ebp - 0x208]
call fcn.005dc190
push eax
push 1
push str.InstallLocation
lea ecx, [ebp - 0xcc]
call fcn.005d5f20
push 0
lea ecx, [ebp - 0x110]
call fcn.005dc190
push eax
push 1
push 0x62dfc8
lea ecx, [ebp - 0xcc]
call fcn.005d5f20
mov eax, dword [ebp - 0x288]
push 1
mov ecx, dword [ebp - 0xc8]
push dword [ecx + eax*4]
mov ecx, dword [ebp - 0x314]
push dword [ebp - 0x318]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x1c0]
call fcn.005dc1c0
push 0
lea ecx, [ebp - 0x1c0]
call fcn.005dc190
push eax
push 1
push str.Publisher
lea ecx, [ebp - 0xcc]
call fcn.005d5f20
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0xc8]
push 8
push dword [ecx + eax*4]
mov ecx, dword [ebp - 0x314]
push dword [ebp - 0x318]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x1fc]
call fcn.005dc1c0
push 0
lea ecx, [ebp - 0x1fc]
call fcn.005dc190
push eax
push 1
push str.UninstallFile
lea ecx, [ebp - 0xcc]
call fcn.005d5f20
push 0
lea ecx, [ebp - 0x12c]
call fcn.005dc190
push eax
push 1
push str.UninstallString
lea ecx, [ebp - 0xcc]
call fcn.005d5f20
lea eax, [ebp - 0xdc]
push eax
push str.QuietUninstallString
lea ecx, [ebp - 0xec]
call fcn.005d6740
test al, al
je 0x4ce287
lea ecx, [ebp - 0xdc]
call fcn.005dc3a0
cmp eax, 3
jle 0x4ce287
push 0
lea ecx, [ebp - 0x12c]
call fcn.005dc190
push eax
push 1
push str.QuietUninstallString
lea ecx, [ebp - 0xcc]
call fcn.005d5f20
mov eax, dword [ebp - 0x288]
push ecx
mov ecx, dword [ebp - 0xc8]
mov edx, dword [ecx + eax*4]
mov ecx, dword [ebp - 0x328]
call fcn.005c9a40
cmp dword [ebp - 0x28c], 0
cdq
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], edx
je 0x4ce2d3
push 0
lea eax, [ebp - 0x220]
push eax
push 0xb
push str.hicon
lea ecx, [ebp - 0xcc]
call fcn.005d5f20
lea eax, [ebp - 0x130]
push eax
push str.WindowInstaller
lea ecx, [ebp - 0xec]
call fcn.005d66b0
test al, al
je 0x4ce2f7
cmp dword [ebp - 0x130], 1
je 0x4ce30e
sub esp, 8
lea ecx, [ebp - 0x12c]
push str._.__msiexec_.exe___s
call fcn.005d9930
test al, al
je 0x4ce34c
push 0
push 1
push 1
lea ecx, [ebp - 0x11c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc260
mov ecx, eax
call fcn.005dbf40
mov ecx, eax
call fcn.005dc190
push eax
push 1
push str.MsiProduct
lea ecx, [ebp - 0xcc]
call fcn.005d5f20
lea ecx, [ebp - 0xcc]
call fcn.005d5440
cmp byte [ebp - 0xfa], 0
mov dword [ebp - 0xe8], 0
jne 0x4ce383
lea ecx, [ebp - 0x12c]
call fcn.005dbeb0
mov dword [ebp - 0x284], str.Uninstalling
test al, al
je 0x4ce38d
mov dword [ebp - 0x284], 0x694710
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x635758
lea ecx, [ebp - 0x110]
call fcn.005dc190
push eax
push dword [ebp - 0x284]
lea ecx, [ebp - 0xdc]
call fcn.005dc200
mov ecx, eax
call fcn.005dc190
push eax
push 0xffffffffffffffff
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
cmp byte [ebp - 0xfa], 0
jne 0x4ce66a
lea ecx, [ebp - 0x12c]
call fcn.005dbeb0
test al, al
jne 0x4ce66a
push 0
push 0
lea eax, [ebp - 0x100]
push eax
push 0x4bbcd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x284], eax
cmp esi, 0xffffffff
je 0x4ce42c
test esi, esi
je 0x4ce42c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x284]
mov esi, eax
mov dword [ebp - 0x290], esi
test eax, eax
jne 0x4ce443
or esi, 0xffffffff
mov dword [ebp - 0x290], esi
or eax, esi
mov byte [ebp - 0xfc], 0
mov byte [edi + 0x11c8], 0
cmp eax, 0xffffffff
je 0x4ce612
test eax, eax
je 0x4ce612
mov dword [ebp - 0x284], 0
nop dword [eax]
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
je 0x4ce4b5
nop dword [eax]
push 0
push 0
mov ecx, edi
call fcn.0043d720
test eax, eax
je 0x4ce4a8
mov al, byte [ebp - 0xfc]
movzx ecx, al
test al, al
mov eax, 1
cmove ecx, eax
mov byte [ebp - 0xfc], cl
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x4ce480
lea eax, [ebp - 0xe8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [ebp - 0xe8]
cmp edx, 3
je 0x4ce618
cmp byte [ebp - 0xfa], 0
jne 0x4ce6ca
lea ecx, [ebp - 0x12c]
call fcn.005dbeb0
test al, al
jne 0x4ce6ca
cmp dword [ebp - 0x284], 0
jg 0x4ce6ca
test edx, edx
jne 0x4ce618
test byte [edi + 0x1f70], 0x80
jne 0x4ce75d
sub esp, 8
lea ecx, [ebp - 0x110]
push 0x8c
push 0x190
push edx
push edx
push 1
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push str.._r_n_r_nDo_you_wish_to_force_uninstall_this_program_
call fcn.005dc190
push eax
push str.An_error_occurred_while_uninstalling
lea ecx, [ebp - 0xdc]
call fcn.005dc200
mov ecx, eax
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043e2e0
test eax, eax
je 0x4ce612
push 0
push 0
lea eax, [ebp - 0x100]
push eax
push 0x4bbca0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x290], eax
cmp esi, 0xffffffff
je 0x4ce59c
test esi, esi
je 0x4ce59c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x290]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov esi, eax
lea ecx, [ebp - 0x110]
test eax, eax
mov eax, 0xffffffff
push 0
cmove esi, eax
push 0
push 0x635758
mov dword [ebp - 0x32c], esi
mov dword [ebp - 0x290], esi
call fcn.005dc190
push eax
push str.Forced_uninstall_of
lea ecx, [ebp - 0xdc]
call fcn.005dc200
mov ecx, eax
call fcn.005dc190
push eax
push 0xffffffffffffffff
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp eax, 2
jl 0x4ce470
mov edx, dword [ebp - 0xe8]
cmp edx, 1
jne 0x4ce6e2
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0xc8]
push 0
push dword [ecx + eax*4]
mov ecx, dword [ebp - 0x314]
push dword [ebp - 0x318]
call fcn.005bb970
push 0
push 0
lea ecx, [ebp - 0x110]
call fcn.005dc190
push eax
push str.Successfully_uninstalled:
mov ecx, edi
call fcn.0045a700
inc dword [ebp - 0xd0]
jmp 0x4ce790
push 0
push 0
lea eax, [ebp - 0x100]
push eax
push 0x4bbca0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x284], eax
cmp esi, 0xffffffff
je 0x4ce6a0
test esi, esi
je 0x4ce6a0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x284]
mov esi, eax
mov dword [ebp - 0x290], esi
test eax, eax
jne 0x4ce443
or esi, 0xffffffff
mov byte [ebp - 0xfc], al
mov dword [ebp - 0x290], esi
mov byte [edi + 0x11c8], al
jmp 0x4ce612
cmp edx, 2
jne 0x4ce618
mov dword [ebp - 0xe8], 1
jmp 0x4ce621
cmp edx, 2
jne 0x4ce707
inc dword [ebp - 0xd0]
lea ecx, [ebp - 0x110]
push 0
push 0
call fcn.005dc190
push eax
push str.Already_uninstalled:
jmp 0x4ce789
cmp edx, 3
jne 0x4ce75d
push 0
push 0
lea ecx, [ebp - 0x110]
call fcn.005dc190
push eax
push str.Skipped_monitoring:
mov ecx, edi
call fcn.0045a700
lea ecx, [ebp - 0x11c]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
je 0x4ce65f
lea ecx, [ebp - 0xf8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xcc]
call fcn.005d5740
jmp 0x4ce790
lea ecx, [ebp - 0xf8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xcc]
call fcn.005d5740
push 0
push 0
lea ecx, [ebp - 0x110]
call fcn.005dc190
push eax
push str.Failed_to_uninstall:
mov ecx, edi
call fcn.0045a700
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
test eax, eax
jg 0x4cdf10
mov dword [ebp - 0x32c], esi
push 0
mov ecx, edi
call fcn.0043dbb0
push 1
mov ecx, edi
call fcn.0043d8e0
cmp dword [ebp - 0xd0], 0
jle 0x4ce7d3
cmp dword [ebp - 0x28c], 0
jne 0x4ce89e
test dword [edi + 0x1f68], 1
jne 0x4ce85c
push str.Uninstall_operation_complete
add edi, 0x14f0
push 0x64
mov ecx, edi
call fcn.005b66e0
push dword [ebp - 0x33c]
mov ecx, dword [ebp - 0x320]
push dword [ebp - 0x338]
push dword [ebp - 0x318]
call fcn.0046af40
push ecx
push 1
push ecx
push 2
mov ecx, edi
call fcn.005b6350
mov ecx, eax
call fcn.005b6350
push 0
push str.OK__close_this_dialog_box
mov ecx, edi
call fcn.005b64a0
mov edi, dword [ebp - 0x320]
nop dword [eax]
push 0
push 0
mov ecx, edi
call fcn.0043d720
test eax, eax
je 0x4ce840
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0xf8]
call fcn.005dc430
lea ecx, [ebp - 0x34]
call fcn.005b8790
mov byte [ebp - 4], 0x1c
push dword [ebp - 0xc8]
call fcn.0041e1c3
add esp, 4
test byte [edi + 0x1f70], 0x80
je 0x4cc100
jmp 0x4ce8f2
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x1c
call fcn.005b8790
jmp 0x4ce8f2
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
lea eax, [ebp - 0x178]
push eax
lea ecx, [edi + 0x1460]
call fcn.005dc4e0
lea ecx, [ebp - 0xf8]
mov byte [ebp - 0x321], 0x18
call fcn.005dc430
lea ecx, [ebp - 0x34]
call fcn.005b8790
mov byte [ebp - 4], 0x1c
push dword [ebp - 0xc8]
call fcn.0041e1c3
add esp, 4
jmp 0x4ce8f2
mov byte [ebp - 0x321], 1
push 0
push 1
mov ecx, edi
call fcn.0043d720
push 0
push 0
push 0x108f
push dword [ebp - 0x328]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0xe4], eax
cmp eax, 1
jne 0x4ce92d
push dword [ebp - 0x328]
push str.Smart_Uninstaller
call fcn.0045b060
push 0
lea eax, [ebp - 0xe4]
push eax
push 4
push str.CurrentView
lea ecx, [ebp - 0xcc]
call fcn.005d5f20
push dword [ebp - 0x330]
mov ecx, edi
push dword [ebp - 0x370]
push dword [ebp - 0x374]
push dword [ebp - 0x364]
call fcn.004bc7b0
push 0
push 1
mov ecx, edi
call fcn.0043d720
push 0
push str.Smart_Uninstaller
mov ecx, edi
call fcn.0045f380
cmp byte [ebp - 0x321], 0
je 0x4ce992
push 0
mov ecx, edi
call fcn.0045f260
lea ecx, [ebp - 0x120]
call fcn.005b0bc0
lea ecx, [ebp - 0x11c]
call fcn.005dc430
lea ecx, [ebp - 0x12c]
call fcn.005dc430
lea ecx, [ebp - 0x1c0]
call fcn.005dc430
lea ecx, [ebp - 0x1fc]
call fcn.005dc430
lea ecx, [ebp - 0x110]
call fcn.005dc430
lea ecx, [ebp - 0x208]
call fcn.005dc430
lea ecx, [ebp - 0x214]
call fcn.005dc430
lea ecx, [ebp - 0x178]
call fcn.005dc430
lea ecx, [ebp - 0x29c]
call fcn.005c6500
lea ecx, [ebp - 0x2a0]
call fcn.005c6500
lea ecx, [ebp - 0x2b4]
call fcn.005c6500
lea ecx, [ebp - 0x2b8]
call fcn.005c6500
lea ecx, [ebp - 0x2a4]
call fcn.005c6500
lea ecx, [ebp - 0x2bc]
call fcn.005c6500
lea ecx, [ebp - 0x298]
call fcn.005c6500
lea ecx, [ebp - 0x2c0]
call fcn.005c6500
lea ecx, [ebp - 0x2a8]
call fcn.005c6500
lea ecx, [ebp - 0x2b0]
call fcn.005c6500
lea ecx, [ebp - 0x2ac]
call fcn.005c6500
lea ecx, [ebp - 0x294]
call fcn.005c6500
cmp esi, 0xffffffff
je 0x4cea89
test esi, esi
je 0x4cea89
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x300]
call fcn.005dd5d0
lea ecx, [ebp - 0x1cc]
call fcn.005dc430
lea ecx, [ebp - 0xec]
call fcn.005d69e0
lea ecx, [ebp - 0xcc]
call fcn.005d69e0
lea ecx, [ebp - 0x13c]
call fcn.005dc430
lea ecx, [ebp - 0x22c]
call fcn.005dc430
lea ecx, [ebp - 0xdc]
call fcn.005dc430
mov al, byte [ebp - 0x321]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret