Function at 0x5b3fe0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xb4]
sub esp, 0xb4
push 0xffffffffffffffff
push 0x65ab54
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x74d890]
xor eax, ebp
mov dword [ebp + 0xb0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x34], esi
mov eax, dword [ebp + 0xc4]
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x930], ebx
je 0x5b4051
push ebx
push ebx
mov ecx, dword [esi + 0x4e8]
push ecx
lea ecx, [esi + 0x20]
call fcn.005c6df0
mov dword [esi + 0x930], ebx
cmp dword [esi + 0xacc], ebx
je 0x5b4063
mov dword [esi + 0xabc], 0x7540
cmp dword [esi + 0xabc], 0x7573
jne 0x5b4088
push 3
mov ecx, esi
call fcn.005ac6d0
lea ecx, [esi + 0x51c]
call fcn.00561b10
jmp 0x5b4758
cmp dword [esi + 4], ebx
jne 0x5b4095
push ebx
mov ecx, esi
call fcn.005ac6d0
cmp dword [esi + 0xacc], ebx
je 0x5b40d8
push ebx
mov ecx, esi
call fcn.005ac6d0
push 1
mov edx, dword [esi + 0x4e8]
push edx
mov eax, dword [0x753bbc]
push eax
mov ecx, dword [esi + 0xabc]
push ecx
lea ecx, [esi + 0x20]
call fcn.005c0e80
push str.Cancel_by_user._n
lea ecx, [esi + 0x51c]
call fcn.00561720
jmp 0x5b4758
mov ecx, dword [esi + 0xabc]
cmp ecx, 0x7540
jne 0x5b4104
push str.Cancel_by_user._n
lea ecx, [esi + 0x51c]
call fcn.00561720
push 2
mov ecx, esi
call fcn.005ac6d0
jmp 0x5b4758
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x23], 1
mov eax, ecx
cmp eax, 0x753b
jg 0x5b41a8
je case.0x5b41b9.30040
cmp eax, 0x80090304
je case.0x5b41b9.30018
cmp eax, 0x17
je case.0x5b41b9.30040
cmp eax, 0x70
je case.0x5b41b9.30040
cmp byte [esi + 0x34a], bl
jne case.0x5b41b9.30040
cmp byte [esi + 0xaef], bl
jne 0x5b4329
cmp byte [0x753725], bl
je 0x5b4321
cmp dword [esi + 4], ebx
jne 0x5b4321
test dword [esi + 0x174], 0x80000
je 0x5b4321
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00402500
mov byte [ebp - 4], 2
cmp byte [esi + 0xaa8], 0
je 0x5b41c0
mov eax, dword [esi + 0xa90]
push eax
mov ecx, dword [esi + 0xa8c]
push ecx
jmp 0x5b41d7
sub eax, 0x7542
cmp eax, 0x40
ja case.0x5b41b9.30019
movzx edx, byte [eax + 0x5b5c88]
jmp dword [edx*4 + 0x5b5c7c]
mov eax, dword [esi + 0x94c]
cmp eax, ebx
jne 0x5b41cf
mov eax, 0x66e97c
mov ecx, dword [esi + 0x950]
push ecx
push eax
push str._s:_ld
lea edx, [ebp - 0x14]
push edx
call fcn.00402f70
add esp, 0x10
mov byte [esi + 0xaef], 1
push esi
call fcn.004ac120
push esi
call fcn.004afb00
add esp, 8
cmp byte [esi + 0xaa8], 0
je 0x5b4217
mov eax, dword [esi + 0xa90]
push eax
mov ecx, dword [esi + 0xa8c]
push ecx
jmp 0x5b422e
mov eax, dword [esi + 0x94c]
cmp eax, ebx
jne 0x5b4226
mov eax, 0x66e97c
mov ecx, dword [esi + 0x950]
push ecx
push eax
push str._s:_ld
lea edx, [ebp - 0x20]
push edx
call fcn.00402f70
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.006172ee
add esp, 8
test eax, eax
je 0x5b42e0
lea edi, [esi + 0x51c]
push str.Try_via_the_same_proxy_as_in_browser_request._n
mov ecx, edi
call fcn.00561720
mov edx, dword [esi + 0xabc]
mov dword [esi + 0xaf4], edx
mov edi, dword [edi]
cmp edi, ebx
je 0x5b4290
push edi
push 0x66dea8
lea eax, [esi + 0xaf8]
push eax
call fcn.00402f70
add esp, 0xc
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
je 0x5b42b5
mov eax, dword [esi + 0x4e8]
cmp eax, ebx
je 0x5b42b5
push eax
push 0x1431
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x5b42c3
mov dword [esi + 0x948], ebx
push ebx
mov ecx, esi
call fcn.005bd160
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5b4758
mov byte [esi + 0xaef], 0
cmp byte [esi + 0xaf0], 0
je 0x5b4304
push str.Cannot_detect_proxy_in_browser_proxy_script_:__n
lea ecx, [esi + 0x51c]
call fcn.00561720
mov byte [ebp - 0x19], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5b4378
mov byte [ebp - 0x23], bl
cmp byte [esi + 0xaef], bl
je 0x5b4378
cmp ecx, 0x756f
je 0x5b4339
cmp ecx, 0x7559
jne 0x5b4372
mov ecx, dword [esi + 0xaf4]
mov dword [esi + 0xabc], ecx
mov edx, dword [esi + 0xaf8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b4350
lea ecx, [esi + 0x51c]
sub eax, edi
je 0x5b4369
push edx
call fcn.00561de0
jmp 0x5b436e
call fcn.00561b80
mov byte [ebp - 0x19], 1
mov byte [esi + 0xaef], bl
mov byte [ebp - 0x1a], 0
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x5c], ebx
xor edx, edx
mov word [ebp + 0x58], dx
mov byte [ebp - 4], 3
mov eax, dword [esi + 0xabc]
cmp eax, 0x7532
jg 0x5b4716
je case.0x5b45c7.10060
cmp eax, 0x271d
jg 0x5b45a1
je 0x5b4599
cmp eax, 0xffffffff
jg 0x5b44a9
je 0x5b441b
cmp eax, 0x80090304
je case.0x5b472b.30009
cmp eax, 0x8009030e
je case.0x5b472b.30009
cmp eax, 0xfffffffc
je case.0x5b472b.30009
mov eax, dword [esi + 0x44]
cmp eax, 4
je 0x5b4f73
cmp eax, 5
je 0x5b4f73
lea edx, [esi + 0x520]
push edx
lea ecx, [ebp + 0x48]
call fcn.00402180
mov byte [ebp - 4], 0x17
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jne 0x5b4410
lea eax, [ebp + 0x4c]
mov edx, dword [0x753970]
jmp 0x5b4ed2
mov eax, dword [esi + 0x44]
cmp eax, 4
je case.0x5b472b.30009
cmp eax, 5
je case.0x5b472b.30009
lea eax, [esi + 0x520]
push eax
lea ecx, [ebp + 0x3c]
call fcn.00402180
mov bl, 0x15
mov byte [ebp - 4], bl
lea ecx, [esi + 0xb14]
push ecx
lea ecx, [ebp + 0x48]
call fcn.00402180
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp + 0x48]
test ecx, ecx
jne 0x5b4459
lea ecx, [ebp + 0x4c]
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5b4463
lea eax, [ebp + 0x40]
mov edx, dword [0x752d00]
push edx
push ecx
push eax
mov eax, dword [0x75396c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00402320
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x3c]
call fcn.00401210
jmp 0x5b4f88
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x753978]
push edx
jmp 0x5b4f80
cmp eax, 5
je 0x5b4586
cmp eax, 0x17
je 0x5b4574
cmp eax, 0x70
jne case.0x5b472b.30004
mov eax, dword [0x752d00]
push eax
mov ecx, dword [0x753e94]
push ecx
lea ecx, [ebp + 0x48]
call fcn.0045b1c0
mov bl, 0x11
mov byte [ebp - 4], bl
xor edi, edi
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x20], edi
xor edx, edx
mov word [ebp + 0x1c], dx
mov byte [ebp - 4], 0x12
push edi
push edi
lea eax, [ebp - 0x18]
push eax
push 0x400
push 0x70
push edi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp + 0x48]
cmp eax, edi
jne 0x5b4513
lea eax, [ebp + 0x4c]
push edi
mov ecx, dword [ebp - 0x18]
push ecx
push eax
push str._r_n_r_n_s_s
lea ecx, [ebp + 0x18]
call fcn.00402320
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x752d00]
push eax
mov ecx, dword [0x753978]
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov eax, dword [ebp + 0x18]
cmp eax, edi
jne 0x5b454f
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405300
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x18]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
call fcn.00401210
jmp 0x5b4f88
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x75441c]
push eax
jmp 0x5b4f80
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x753fac]
push edx
jmp 0x5b4f80
mov ecx, dword [0x753984]
jmp 0x5b45d4
cmp eax, 0x2af9
jg 0x5b46c2
je 0x5b46b7
sub eax, 0x2726
cmp eax, 0x2b
ja case.0x5b472b.30004
movzx edx, byte [eax + 0x5b5cf8]
jmp dword [edx*4 + 0x5b5ccc]
mov ecx, dword [0x753980]
mov eax, dword [0x752d00]
push eax
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [esi + 0x35d], 1
jmp 0x5b4f88
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0xb
mov eax, dword [0x753978]
mov edx, dword [0x7540a8]
push edx
push eax
push str._s_r_n_r_n_s
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f70
add esp, 0x10
mov edx, dword [0x752d00]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [esi + 0x35d], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5b4f88
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x753988]
push edx
jmp 0x5b4f80
mov ecx, dword [0x75398c]
jmp 0x5b4f79
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x753990]
push eax
jmp 0x5b4f80
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x753998]
push edx
jmp 0x5b4f80
mov ecx, dword [0x75399c]
jmp 0x5b4f79
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x7539a0]
push eax
jmp 0x5b4f80
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x7539a4]
push edx
jmp 0x5b4f80
mov ecx, dword [0x753994]
jmp 0x5b45d4
sub eax, 0x2afa
je case.0x5b472b.30009
sub eax, 2
jne case.0x5b472b.30004
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0xc
mov eax, dword [0x753b98]
jmp 0x5b4600
mov eax, dword [esi + 0x174]
test al, 8
jne 0x5b46fd
test eax, 0x100
je case.0x5b472b.30003
mov byte [esi + 0x35d], 1
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x753bd8]
push eax
jmp 0x5b4f80
sub eax, 0x7533
cmp eax, 0x57
ja case.0x5b472b.30004
movzx ecx, byte [eax + 0x5b5d98]
jmp dword [ecx*4 + 0x5b5d24]
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x7539a8]
push eax
jmp 0x5b4f80
push ebx
mov ecx, esi
call fcn.005ac6d0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x54]
call fcn.00401210
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xb0]
xor ecx, ebp
call fcn.006157d3
add ebp, 0xb4
mov esp, ebp
pop ebp
ret 0xc
push ebx
mov ecx, esi
call fcn.005ac6d0
cmp dword [esi + 8], ebx
jne 0x5b4998
cmp dword [esi + 4], ebx
jne 0x5b4998
cmp byte [ebp + 0xbc], 0
je 0x5b4998
mov eax, dword [esi + 0x518]
cmp eax, ebx
je 0x5b47d1
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5b47d1
mov edx, dword [esi + 0x518]
mov eax, dword [edx + 0x20]
push eax
call fcn.005ee68b
mov edi, eax
jmp 0x5b47d3
xor edi, edi
mov ecx, dword [esi + 0x44]
push ecx
call fcn.00495430
add esp, 4
push eax
lea ecx, [ebp - 0x20]
call fcn.004030b0
mov byte [ebp - 4], 4
mov eax, dword [esi + 0x1d0]
lea ebx, [esi + 0x20]
push edi
push 0
push 0
push eax
mov edx, dword [ebx]
push edx
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0xec]
call fcn.004f1cb0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xec]
call fcn.005eba8b
cmp eax, 1
jne 0x5b497d
mov eax, dword [esi + 0x10]
test eax, eax
je 0x5b483f
push 0
push 0x1472
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x10], 0
mov ecx, dword [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0x78]
push edx
mov ecx, esi
call fcn.005ac9f0
mov eax, dword [esi + 0x4e8]
test eax, eax
je 0x5b48eb
cmp dword [esi + 0x49c], 0
jne 0x5b4874
push eax
mov ecx, ebx
call fcn.005c45f0
mov edx, dword [esi + 0x49c]
test edx, edx
je 0x5b48eb
mov edi, dword [ebp - 0x78]
mov eax, edi
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b4886
sub eax, ebx
inc eax
push eax
push edi
push 1
push 0
push 0x681654
push edx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call edi
cmp byte [esi + 0x1c0], 0
je 0x5b48cc
mov dword [ebp - 0x28], 1
push 4
lea eax, [ebp - 0x28]
push eax
push 4
push 0
push str.bUNRA
mov ecx, dword [esi + 0x49c]
push ecx
call edi
push 0
mov edx, dword [ebp - 0x74]
push edx
push str.EncPassword
push 0x68ff84
mov eax, dword [esi + 0x49c]
push eax
call fcn.005afad0
add esp, 0x14
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 6
mov ecx, dword [esi + 0xabc]
push ecx
mov edx, dword [0x753964]
push edx
push str._r_n_s_r_ndownlResult___ldsetting_new_login_r_n
lea eax, [ebp - 0x14]
push eax
call fcn.00402f70
add esp, 0x10
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [esi + 0x51c]
call fcn.00561720
cmp byte [ebp + 0xc0], 0
je 0x5b4951
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5b4951
mov esi, dword [esi + 0x4e8]
test esi, esi
je 0x5b4951
push esi
push 0x1431
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x14]
call fcn.00402570
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xec]
call fcn.004b3210
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.00402570
jmp 0x5b474c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xec]
call fcn.004b3210
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.00402570
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x753964]
push eax
jmp 0x5b4f80
push 0x66e97c
lea ecx, [esi + 0x3ac]
call fcn.00546c40
cmp dword [esi + 8], ebx
jne 0x5b4b5f
cmp dword [esi + 4], ebx
jne 0x5b4b5f
cmp byte [ebp + 0xbc], 0
je 0x5b4b5f
push ebx
mov ecx, esi
call fcn.005ac6d0
mov eax, dword [esi + 0x518]
cmp eax, ebx
je 0x5b4a0c
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5b4a0c
mov edx, dword [esi + 0x518]
mov eax, dword [edx + 0x20]
push eax
call fcn.005ee68b
mov ebx, eax
jmp 0x5b4a0e
xor ebx, ebx
mov ecx, dword [esi + 0x44]
push ecx
call fcn.00495430
add esp, 4
push eax
lea ecx, [ebp - 0x18]
call fcn.004030b0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.00402500
mov byte [ebp - 4], 8
cmp byte [esi + 0xa82], 0
jne 0x5b4a73
cmp dword [0x75371c], 2
jne 0x5b4a4e
test byte [0x753730], 0x10
jne 0x5b4a73
lea edi, [esi + 0x94c]
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
test eax, eax
je 0x5b4a65
push eax
call fcn.00546c40
jmp 0x5b4aa8
lea edx, [esi + 0xa8c]
push edx
call fcn.004058f0
jmp 0x5b4aa8
lea edi, [esi + 0x94c]
mov eax, dword [edi]
lea edx, [ebp - 0x20]
test eax, eax
je 0x5b4a8c
mov ecx, dword [esi + 0x950]
push ecx
push eax
jmp 0x5b4a9a
mov eax, dword [esi + 0xa90]
push eax
mov ecx, dword [esi + 0xa8c]
push ecx
push str._s:_ld
push edx
call fcn.00402f70
add esp, 0x10
mov eax, dword [esi + 0xa6c]
push ebx
movzx ecx, byte [esi + 0xa82]
push ecx
push 1
push eax
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xec]
call fcn.004f1cb0
mov bl, 9
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xec]
call fcn.005eba8b
cmp eax, 1
jne 0x5b4b38
mov byte [esi + 0xa85], al
mov eax, dword [esi + 0x10]
test eax, eax
je 0x5b4b02
push 0
push 0x1472
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x10], 0
mov byte [ebp - 0x24], 1
cmp dword [edi], 0
je 0x5b4b81
mov ecx, dword [ebp - 0x78]
push ecx
mov ecx, edi
call fcn.004b0870
test eax, eax
jne 0x5b4b34
mov edx, dword [ebp - 0x74]
push edx
mov ecx, edi
call fcn.004b08e0
test eax, eax
je 0x5b4bb5
mov byte [ebp - 0x24], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xec]
call fcn.004b3210
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00402570
cmp byte [esi + 0xa82], 0
mov eax, 0x7545d8
jne 0x5b4b72
mov eax, 0x753968
mov eax, dword [eax]
mov ecx, dword [0x752d00]
push ecx
push eax
jmp 0x5b4f80
mov byte [esi + 0xaa9], 1
mov eax, dword [ebp - 0x78]
push eax
push 0x66dea8
lea ecx, [esi + 0xa94]
push ecx
call fcn.00402f70
mov edx, dword [ebp - 0x74]
push edx
push 0x66dea8
lea eax, [esi + 0xa98]
push eax
call fcn.00402f70
add esp, 0x18
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0xa
cmp byte [esi + 0xa82], 0
mov eax, dword [0x7545d8]
jne 0x5b4bd4
mov eax, dword [0x753968]
mov ecx, dword [esi + 0xabc]
push ecx
push eax
push str._r_n_s_r_ndownlResult___ldsetting_new_login_r_n
lea edx, [ebp - 0x14]
push edx
call fcn.00402f70
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [esi + 0x51c]
call fcn.00561720
cmp byte [ebp + 0xc0], 0
je 0x5b4c28
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5b4c28
mov esi, dword [esi + 0x4e8]
test esi, esi
je 0x5b4c28
push esi
push 0x1431
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00402570
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xec]
call fcn.004b3210
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00402570
jmp 0x5b474c
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x75397c]
push eax
jmp 0x5b4f80
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x753bb0]
push edx
jmp 0x5b4f80
mov ecx, dword [0x753974]
jmp 0x5b4f79
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x753a10]
push eax
jmp 0x5b4f80
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x753a14]
push edx
jmp 0x5b4f80
mov ecx, dword [0x753a18]
jmp 0x5b4f79
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x753960]
push eax
jmp 0x5b4f80
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x753b7c]
push edx
jmp 0x5b4f80
mov ecx, dword [0x753bc4]
jmp 0x5b4f79
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x753c14]
push eax
jmp 0x5b4f80
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x753bcc]
push edx
jmp 0x5b4f80
mov ecx, dword [0x753c5c]
jmp 0x5b4f79
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x753bd4]
push eax
jmp 0x5b4f80
lea ecx, [ebp + 0xa0]
push ecx
mov edx, dword [esi + 0x4fc]
push edx
mov eax, dword [esi + 0x4f8]
push eax
mov ecx, esi
call fcn.005ad050
mov dword [ebp], ebx
mov dword [ebp + 8], ebx
xor ecx, ecx
mov word [ebp + 4], cx
mov byte [ebp - 4], 0xd
lea edx, [ebp]
push edx
mov ecx, esi
call fcn.005ae3e0
lea eax, [ebp + 0xa0]
push eax
lea ecx, [ebp + 0x3c]
call fcn.00406f90
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
call fcn.00402500
mov byte [ebp - 4], 0xf
mov ecx, dword [esi + 0x4fc]
push ecx
mov edx, dword [esi + 0x4f8]
push edx
push str._I64d
lea eax, [ebp - 0x18]
push eax
call fcn.00402f70
add esp, 0x10
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp + 0x48]
call fcn.00406f90
mov byte [ebp - 4], 0x10
push str._I64d
mov edx, dword [0x753b9c]
push edx
call fcn.00616e70
add esp, 8
test eax, eax
je 0x5b4dda
push 0x66dea8
push str._I64d
jmp 0x5b4dfb
push 0x66e5fc
mov eax, dword [0x753b9c]
push eax
call fcn.00616e70
add esp, 8
test eax, eax
je 0x5b4e05
push 0x66dea8
push 0x66e5fc
mov ecx, 0x753b9c
call fcn.00402c10
cmp dword [esi + 0x54], ebx
je 0x5b4e0f
mov edi, dword [esi + 0x54]
jmp 0x5b4e12
lea edi, [esi + 0x58]
mov edx, dword [ebp + 0x48]
cmp edx, ebx
jne 0x5b4e1c
lea edx, [ebp + 0x4c]
mov ecx, dword [ebp + 0x3c]
cmp ecx, ebx
jne 0x5b4e26
lea ecx, [ebp + 0x40]
mov eax, dword [ebp]
cmp eax, ebx
jne 0x5b4e30
lea eax, [ebp + 4]
mov ebx, dword [0x752d00]
push ebx
push edi
push edx
push ecx
push eax
mov ecx, dword [0x753b9c]
push ecx
lea ecx, [ebp + 0x54]
call fcn.0043b9c0
mov byte [ebp - 4], 0xf
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
call fcn.00402570
mov byte [ebp - 4], 0xd
lea ecx, [ebp + 0x3c]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp]
call fcn.00401210
jmp 0x5b4f88
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x753a50]
push edx
jmp 0x5b4f80
mov ecx, dword [0x7543c0]
jmp 0x5b4f79
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x75446c]
push eax
jmp 0x5b4f80
lea eax, [esi + 0x520]
push eax
lea ecx, [ebp + 0x48]
call fcn.00402180
mov byte [ebp - 4], 0x13
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jne 0x5b4ecc
lea eax, [ebp + 0x4c]
mov edx, dword [0x7540b4]
mov ecx, dword [0x752d00]
push ecx
push eax
push edx
lea ecx, [ebp + 0x54]
call fcn.004021b0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
call fcn.00401210
jmp 0x5b4f88
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0x14
mov eax, dword [0x754588]
push eax
push 0x66dea8
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f70
push 0x67029c
mov edx, dword [ebp - 0x14]
push edx
call fcn.00617f30
add esp, 0x14
cmp eax, ebx
je 0x5b4f2c
mov byte [eax], 0
mov eax, dword [0x752d00]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5b4f88
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x754728]
push eax
jmp 0x5b4f80
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x75472c]
push edx
jmp 0x5b4f80
mov ecx, dword [0x754730]
jmp 0x5b4f79
mov ecx, dword [0x753978]
mov eax, dword [0x752d00]
push eax
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5b4fa7
mov edx, dword [esi + 0x4e8]
push edx
push 0x13c7
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0xabc]
add eax, 0xffff8abe
cmp eax, 0x38
ja case.0x5b4fc2.30019
movzx eax, byte [eax + 0x5b5dfc]
jmp dword [eax*4 + 0x5b5df0]
mov ecx, dword [esi + 0x150]
or ecx, dword [esi + 0x154]
je case.0x5b4fc2.30019
push 0x66e978
lea ecx, [ebp + 0x54]
call fcn.00405300
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x75446c]
push eax
lea ecx, [ebp + 0x48]
call fcn.0045b1c0
mov byte [ebp - 4], 0x18
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x5b500b
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405300
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
call fcn.00401210
mov cl, byte [esi + 0x195]
test cl, cl
jne 0x5b5196
mov eax, dword [esi + 0x158]
test eax, eax
jle 0x5b5049
mov edx, dword [esi + 0x15c]
sub edx, eax
cmp edx, 0x3c
jl 0x5b5181
cmp byte [0x753267], 0
jne 0x5b513b
mov eax, dword [esi + 0x108]
cmp eax, dword [esi + 0x150]
jne 0x5b513b
mov ecx, dword [esi + 0x10c]
cmp ecx, dword [esi + 0x154]
jne 0x5b513b
cmp dword [esi + 0xdc], 0
je 0x5b513b
mov ebx, dword [esi + 0x134]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b5092
sub eax, edx
je 0x5b513b
mov edi, dword [esi + 0x104]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b50b0
sub eax, edx
je 0x5b513b
mov edx, ebx
mov eax, edi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x5b50e3
test cl, cl
je 0x5b50df
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x5b50e3
add eax, 2
add edx, 2
test cl, cl
jne 0x5b50c3
xor eax, eax
jmp 0x5b50e8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x5b513b
mov ecx, ebx
mov eax, dword [esi + 0xdc]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5b5114
test dl, dl
je 0x5b5110
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5b5114
add eax, 2
add ecx, 2
test dl, dl
jne 0x5b50f4
xor eax, eax
jmp 0x5b5119
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x5b513b
mov byte [ebp - 0x21], 1
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x754368]
push eax
lea ecx, [ebp + 0x54]
call fcn.00401980
jmp case.0x5b4fc2.30019
push str._r_n_r_n
lea ecx, [ebp + 0x54]
call fcn.00405300
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x75448c]
push edx
lea ecx, [ebp + 0x48]
call fcn.0045b1c0
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x5b516c
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405300
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
jmp 0x5b52f7
test cl, cl
jne 0x5b5196
push 1
mov eax, dword [esi + 0x4e8]
push eax
lea ecx, [esi + 0x20]
call fcn.005c6bc0
cmp dword [esi + 0x4fc], 0
jl 0x5b51c5
jg 0x5b51aa
cmp dword [esi + 0x4f8], 0
jbe 0x5b51c5
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x754490]
push edx
lea ecx, [ebp + 0x54]
call fcn.00401980
jmp case.0x5b4fc2.30019
xor bl, bl
test byte [esi + 0x174], 0x70
je 0x5b51d2
mov bl, 1
xor edi, edi
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x14], edi
xor eax, eax
mov word [ebp + 0x10], ax
mov byte [ebp - 4], 0x19
lea ecx, [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.005ae3e0
test bl, bl
je 0x5b52b9
mov edx, dword [esi + 0xe8]
mov eax, edx
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b5202
mov ecx, 0x7538d8
sub eax, ebx
je 0x5b521a
push edx
call fcn.0053d5c0
jmp 0x5b5223
mov edx, dword [esi + 0x20]
push edx
call fcn.0053d4a0
cmp dword [esi + 0x11c], edi
je 0x5b5233
mov eax, dword [esi + 0x11c]
jmp 0x5b5239
lea eax, [esi + 0x120]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x5b5240
sub eax, edx
sar eax, 1
je 0x5b5269
cmp dword [esi + 0x11c], edi
je 0x5b5261
mov eax, dword [esi + 0x11c]
jmp 0x5b5273
lea eax, [esi + 0x120]
jmp 0x5b5273
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x5b5273
lea eax, [ebp + 0x10]
mov ecx, dword [0x752d00]
push ecx
push eax
mov edx, dword [0x75436c]
push edx
lea ecx, [ebp + 0x54]
call fcn.004021b0
test dword [esi + 0x174], 0x100
jne 0x5b52f0
mov eax, dword [esi + 0x158]
cmp eax, edi
jle 0x5b52f0
mov ecx, dword [esi + 0x15c]
sub ecx, eax
cmp ecx, 0x3c
jge 0x5b52f0
cmp byte [ebp - 0x19], 0
jne 0x5b52f0
mov byte [ebp - 0x1a], 1
jmp 0x5b52f0
cmp byte [esi + 0x193], 0
je 0x5b52da
cmp byte [0x753267], 0
jne 0x5b52da
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x754368]
push eax
jmp 0x5b52e8
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x754490]
push edx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [ebp - 4], 3
lea ecx, [ebp + 0xc]
call fcn.00401210
cmp dword [esi + 0xabc], 0x7582
je 0x5b53ba
cmp dword [esi + 0x51c], 0
je 0x5b53ba
push str._r_n_r_n
lea ecx, [ebp + 0x54]
call fcn.00405300
xor edi, edi
mov dword [ebp + 0xa4], edi
mov dword [ebp + 0xac], edi
xor eax, eax
mov word [ebp + 0xa8], ax
mov bl, 0x1b
mov byte [ebp - 4], bl
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x753e94]
push edx
lea ecx, [ebp + 0xa4]
call fcn.00401980
mov eax, dword [ebp + 0xa4]
cmp eax, edi
jne 0x5b536b
lea eax, [ebp + 0xa8]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405300
mov eax, dword [0x752d00]
push eax
mov ecx, dword [esi + 0x51c]
push ecx
lea ecx, [ebp + 0x48]
call fcn.0045b1c0
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp + 0x48]
cmp eax, edi
jne 0x5b5397
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405300
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp + 0xa4]
call fcn.00401210
cmp byte [ebp - 0x19], 0
je 0x5b54e8
push str._r_n_r_n
lea ecx, [ebp + 0x54]
call fcn.00405300
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x7546fc]
push eax
lea ecx, [ebp + 0x3c]
call fcn.0045b1c0
mov bl, 0x1d
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5b53f5
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405300
mov byte [ebp - 0x22], 0
mov edx, dword [esi + 0x148]
mov eax, edx
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b5410
sub eax, edi
je 0x5b54dc
push 0x5c
push edx
call fcn.00617f70
add esp, 8
mov edi, eax
test edi, edi
je 0x5b5433
inc edi
jmp 0x5b5439
mov edi, dword [esi + 0x148]
push 0xa
push str.chromeexe
push edi
call fcn.0061a1ff
add esp, 0xc
test eax, eax
je 0x5b5493
push str.idmbrbtn.dll
push edi
call fcn.006172ee
add esp, 8
test eax, eax
jne 0x5b54dc
mov eax, dword [esi + 0x1ac]
push str.Chrome
push eax
call fcn.00616e70
add esp, 8
test eax, eax
je 0x5b54dc
mov eax, dword [esi + 0x1ac]
push str.Firefox
push eax
call fcn.00616e70
add esp, 8
test eax, eax
jne 0x5b54dc
mov byte [ebp - 0x22], 1
push 0x67ab14
lea ecx, [ebp + 0x54]
call fcn.00405300
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x754700]
push edx
lea ecx, [ebp + 0x48]
call fcn.0045b1c0
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x5b54c8
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405300
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x3c]
call fcn.00401210
mov eax, dword [ebp + 0x54]
xor ebx, ebx
cmp eax, ebx
jne 0x5b54f4
lea eax, [ebp + 0x58]
mov ecx, dword [0x752d00]
push ecx
push eax
lea edx, [ebp - 0x2c]
push edx
call fcn.00402a70
add esp, 0xc
mov byte [ebp - 4], 0x1f
lea ecx, [esi + 0x20]
push ebx
mov eax, dword [esi + 0x4e8]
push eax
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [esi + 0xabc]
push eax
call fcn.005c0e80
lea edi, [esi + 0x51c]
mov ecx, dword [ebp - 0x2c]
push ecx
mov ecx, edi
call fcn.00561720
mov edx, dword [esi + 0xabc]
push edx
push str._r_ndownlResult___ld_r_n
lea eax, [ebp + 0x60]
push eax
call fcn.006186ab
add esp, 0xc
lea ecx, [ebp + 0x60]
push ecx
mov ecx, edi
call fcn.00561720
mov eax, dword [esi + 0xabc]
add eax, 0xffff8abe
cmp eax, 0x38
ja case.0x5b5576.30019
movzx edx, byte [eax + 0x5b5e44]
jmp dword [edx*4 + 0x5b5e38]
mov eax, dword [esi + 0x150]
or eax, dword [esi + 0x154]
je case.0x5b5576.30019
cmp dword [esi + 8], ebx
jne case.0x5b5576.30019
cmp dword [esi + 4], ebx
jne case.0x5b5576.30019
cmp byte [ebp + 0xbc], 0
je case.0x5b5576.30019
cmp dword [esi + 0x14], ebx
je case.0x5b5576.30019
cmp dword [esi + 0x4e8], ebx
je case.0x5b5576.30019
cmp byte [esi + 0x195], 0
jne case.0x5b5576.30019
cmp byte [ebp - 0x21], 0
jne case.0x5b5576.30019
push ebx
mov ecx, esi
call fcn.005ac6d0
mov ecx, dword [esi + 0x4e8]
push ecx
push 0x1463
push 0x111
mov edx, dword [esi + 0x14]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [esi + 0x35d], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00402570
jmp 0x5b474c
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x2c], ebx
xor eax, eax
mov word [ebp + 0x28], ax
mov byte [ebp - 4], 0x20
lea ecx, [ebp + 0x24]
push ecx
mov ecx, esi
call fcn.005ae3e0
cmp dword [esi + 8], ebx
jne 0x5b5ac2
cmp dword [esi + 4], ebx
jne 0x5b5ac2
cmp byte [ebp + 0xbc], 0
je 0x5b5ac2
cmp dword [esi + 0x4e8], ebx
je 0x5b5ac2
cmp dword [esi + 0x514], ebx
jne 0x5b5ac2
mov eax, dword [esi + 0xabc]
cmp eax, 0x7540
je 0x5b5ac2
cmp eax, 0x7553
jne 0x5b56b6
mov eax, dword [ebp + 0x24]
cmp eax, ebx
mov ecx, eax
jne 0x5b566b
lea ecx, [ebp + 0x28]
mov eax, dword [ebp + 0x54]
cmp eax, ebx
jne 0x5b5675
lea eax, [ebp + 0x58]
push 0x10024
push ecx
push eax
push ebx
call fcn.0046f700
add esp, 0x10
cmp eax, 6
jne 0x5b5ac2
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x5b5ac2
mov edx, dword [esi + 0x4e8]
push edx
push 0x13bb
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x5b5ac2
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x38], ebx
xor eax, eax
mov word [ebp + 0x34], ax
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x5b56df
mov ecx, dword [0x752d00]
push ecx
push eax
lea ecx, [ebp + 0x30]
call fcn.00401980
jmp 0x5b56f2
mov eax, dword [ebp + 0x24]
cmp eax, ebx
jne 0x5b56e9
lea eax, [ebp + 0x28]
push eax
lea ecx, [ebp + 0x30]
call fcn.004017f0
cmp dword [esi + 0xabc], 0x80090326
jne 0x5b57b0
cmp dword [0x752b9c], ebx
jne 0x5b57b0
xor edi, edi
mov dword [ebp + 0x3c], edi
mov dword [ebp + 0x44], edi
xor edx, edx
mov word [ebp + 0x40], dx
mov bl, 0x22
mov byte [ebp - 4], bl
mov eax, dword [0x752d00]
push eax
mov ecx, dword [0x754690]
push ecx
lea ecx, [ebp + 0x48]
call fcn.0045b1c0
mov byte [ebp - 4], 0x23
mov eax, dword [ebp + 0x48]
cmp eax, edi
mov ecx, eax
jne 0x5b5746
lea ecx, [ebp + 0x4c]
mov eax, dword [ebp + 0x54]
cmp eax, edi
jne 0x5b5750
lea eax, [ebp + 0x58]
push edi
push ecx
push eax
push str._s_r_n_r_n_r_n_s
lea ecx, [ebp + 0x3c]
call fcn.00402320
mov eax, dword [ebp + 0x30]
cmp eax, edi
mov ecx, eax
jne 0x5b576c
lea ecx, [ebp + 0x34]
mov eax, dword [ebp + 0x3c]
cmp eax, edi
jne 0x5b5776
lea eax, [ebp + 0x40]
push 0x50034
push ecx
push eax
push edi
call fcn.0046f700
add esp, 0x10
cmp eax, 6
jne 0x5b5799
push str.https:__www.internetdownloadmanager.com_support_xp_https_problems.html
push edi
call fcn.004ad5f0
add esp, 8
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 0x21
lea ecx, [ebp + 0x3c]
jmp 0x5b5aaf
cmp byte [esi + 0x35d], 0
je 0x5b58f1
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x50], ebx
xor edx, edx
mov word [ebp + 0x4c], dx
mov byte [ebp - 4], 0x24
mov eax, dword [0x752d00]
push eax
mov ecx, dword [0x7545ec]
push ecx
lea ecx, [ebp + 0x3c]
call fcn.0045b1c0
mov byte [ebp - 4], 0x25
mov eax, dword [ebp + 0x3c]
cmp eax, ebx
mov ecx, eax
jne 0x5b57f2
lea ecx, [ebp + 0x40]
mov eax, dword [ebp + 0x54]
cmp eax, ebx
jne 0x5b57fc
lea eax, [ebp + 0x58]
push ebx
push ecx
push eax
push str._s_r_n_r_n_r_n_s
lea ecx, [ebp + 0x48]
call fcn.00402320
mov eax, dword [ebp + 0x30]
cmp eax, ebx
mov ecx, eax
jne 0x5b5818
lea ecx, [ebp + 0x34]
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jne 0x5b5822
lea eax, [ebp + 0x4c]
push 0x50034
push ecx
push eax
push ebx
call fcn.0046f700
add esp, 0x10
cmp eax, 6
jne 0x5b58e0
lea ecx, [ebp - 0x14]
call fcn.00402500
mov bl, 0x26
mov byte [ebp - 4], bl
push 0
lea edx, [ebp - 0x14]
push edx
lea edi, [esi + 0x20]
mov ecx, edi
call fcn.005886e0
lea ecx, [ebp - 0x18]
call fcn.00402500
mov byte [ebp - 4], 0x27
mov eax, dword [edi]
test eax, eax
mov ecx, eax
jne 0x5b5871
mov ecx, 0x66e97c
cmp byte [esi + 0xaa8], 0
jne 0x5b5887
cmp dword [esi + 0x94c], 0
jne 0x5b5887
xor eax, eax
jmp 0x5b588c
mov eax, 1
push ecx
push eax
xor eax, eax
cmp byte [esi + 0x19b], al
setne al
push eax
mov ecx, dword [esi + 0x1cc]
push ecx
mov edx, dword [esi + 0xabc]
push edx
push str.https:__www.internetdownloadmanager.com_register_new_faq_How_to_configure_Firewalls_for_IDM.html
push str._s_err_ldocr_ldv6_ldproxy_ldsrv_s
lea eax, [ebp - 0x18]
push eax
call fcn.00402f70
mov ecx, dword [ebp - 0x18]
push ecx
push 0
call fcn.004ad5f0
add esp, 0x28
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.00402570
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x14]
call fcn.00402570
mov byte [ebp - 4], 0x24
lea ecx, [ebp + 0x3c]
call fcn.00401210
jmp 0x5b5aa8
mov eax, dword [ebp + 0x54]
cmp eax, ebx
jne 0x5b58fb
lea eax, [ebp + 0x58]
push eax
lea ecx, [ebp + 0x48]
call fcn.00402180
mov bl, 0x28
mov byte [ebp - 4], bl
cmp byte [ebp - 0x1a], 0
je 0x5b5a08
cmp byte [ebp - 0x21], 0
je 0x5b5922
mov byte [ebp - 0x1a], 0
jmp 0x5b5a08
mov dword [ebp - 0x30], 1
test dword [esi + 0x174], 0x100000
jne 0x5b5a08
mov edx, dword [esi + 0x148]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b5944
sub eax, edi
je 0x5b5a08
push 0x5c
push edx
call fcn.00617f70
add esp, 8
mov edi, eax
test edi, edi
je 0x5b5967
inc edi
jmp 0x5b596d
mov edi, dword [esi + 0x148]
push 0xb
push str.firefox.exe
push edi
call fcn.0061cf0f
add esp, 0xc
test eax, eax
je 0x5b59bd
push 0xa
push str.chrome.exe
push edi
call fcn.0061a1ff
add esp, 0xc
test eax, eax
je 0x5b59bd
push 0xa
push str.msedge.exe
push edi
call fcn.0061a1ff
add esp, 0xc
test eax, eax
je 0x5b59bd
push 0x13
push str.MicrosoftEdgeCP.exe
push edi
call fcn.0061a1ff
add esp, 0xc
test eax, eax
jne 0x5b5a08
mov dword [ebp - 0x30], 0
mov edx, dword [0x752d00]
push edx
mov eax, dword [0x7546f4]
push eax
lea ecx, [ebp + 0x3c]
call fcn.0045b1c0
mov byte [ebp - 4], 0x29
push str._r_n_r_n
lea ecx, [ebp + 0x48]
call fcn.00405300
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5b59f4
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x48]
call fcn.00405300
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x3c]
call fcn.00401210
mov eax, dword [esi + 0xabc]
cmp eax, 0xffffffff
je 0x5b5a1f
cmp eax, 0x753b
mov eax, 0x30
jne 0x5b5a24
mov eax, 0x10
mov edx, dword [ebp + 0x30]
test edx, edx
jne 0x5b5a2e
lea edx, [ebp + 0x34]
mov ecx, dword [ebp + 0x48]
test ecx, ecx
jne 0x5b5a38
lea ecx, [ebp + 0x4c]
or eax, 0x50000
push eax
push edx
push ecx
push 0
call fcn.0046f700
add esp, 0x10
cmp byte [ebp - 0x1a], 0
je 0x5b5a94
cmp byte [esi + 0x36b], 0
je 0x5b5a79
cmp dword [esi + 0x49c], 0
jne 0x5b5a71
mov ecx, dword [esi + 0x4e8]
push ecx
lea ecx, [esi + 0x20]
call fcn.005c45f0
lea ecx, [esi + 0x20]
call fcn.005c7810
mov edx, dword [esi + 0x4e8]
push edx
push 0x14cd
push 0x111
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [esi + 0xabc], 0x757a
jne 0x5b5aa8
lea ecx, [esi + 0x20]
call fcn.005c2c60
mov byte [ebp - 4], 0x21
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 0x20
lea ecx, [ebp + 0x30]
call fcn.00401210
xor ebx, ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x5b5c24
cmp eax, 3
jne 0x5b5ae2
cmp dword [esi + 0xabc], 0x756e
je 0x5b5b8a
cmp byte [ebp + 0xbc], 0
je 0x5b5b8a
cmp dword [esi + 0xabc], 0xffffffff
jne 0x5b5b1f
push 0x50010
push 0x66dd88
mov ecx, dword [0x753bc0]
push ecx
push ebx
call fcn.0046f2a0
add esp, 0x10
push ebx
mov ecx, esi
call fcn.005ac6d0
jmp 0x5b5c2b
push 0x66dd88
lea ecx, [ebp + 0x48]
call fcn.00406f90
mov byte [ebp - 4], 0x2a
mov eax, dword [esi + 0xabc]
cmp eax, 0xffffffff
je 0x5b5b47
cmp eax, 0x753b
mov eax, 0x30
jne 0x5b5b4c
mov eax, 0x10
mov edx, dword [ebp + 0x48]
cmp edx, ebx
jne 0x5b5b56
lea edx, [ebp + 0x4c]
mov ecx, dword [ebp + 0x54]
cmp ecx, ebx
jne 0x5b5b60
lea ecx, [ebp + 0x58]
or eax, 0x50000
push eax
push edx
push ecx
push ebx
call fcn.0046f700
add esp, 0x10
mov byte [ebp - 4], 0x20
lea ecx, [ebp + 0x48]
call fcn.00401210
push ebx
mov ecx, esi
call fcn.005ac6d0
jmp 0x5b5c2b
cmp eax, 4
jne 0x5b5c1a
cmp byte [esi + 0x35d], 0
je 0x5b5c1a
mov byte [esi + 0x35d], 0
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push str.bHDIShwd
mov ecx, dword [0x752bcc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x5b5c1a
mov dword [ebp - 0x18], 1
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push ebx
push str.bHDIShwd
mov eax, dword [0x752bcc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.004110e0
push eax
lea ecx, [ebp - 0xc8]
call fcn.00524390
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xc8]
call fcn.005eba8b
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xc8]
call fcn.00524410
push ebx
mov ecx, esi
call fcn.005ac6d0
jmp 0x5b5c2b
mov byte [esi + 0x35d], 0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp + 0x24]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00402570
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x54]
call fcn.00401210
mov dword [ebp - 4], 0xffffffff
jmp 0x5b4758