Function at 0x5b6890
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xb4]
sub esp, 0xb4
push 0xffffffffffffffff
push 0x65d814
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x74f8a0]
xor eax, ebp
mov dword [ebp + 0xb0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x34], esi
mov eax, dword [ebp + 0xc4]
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x930], ebx
je 0x5b6901
push ebx
push ebx
mov ecx, dword [esi + 0x4e8]
push ecx
lea ecx, [esi + 0x20]
call fcn.005c9670
mov dword [esi + 0x930], ebx
cmp dword [esi + 0xacc], ebx
je 0x5b6913
mov dword [esi + 0xabc], 0x7540
cmp dword [esi + 0xabc], 0x7573
jne 0x5b6938
push 3
mov ecx, esi
call fcn.005aef40
lea ecx, [esi + 0x51c]
call fcn.00564410
jmp 0x5b7008
cmp dword [esi + 4], ebx
jne 0x5b6945
push ebx
mov ecx, esi
call fcn.005aef40
cmp dword [esi + 0xacc], ebx
je 0x5b6988
push ebx
mov ecx, esi
call fcn.005aef40
push 1
mov edx, dword [esi + 0x4e8]
push edx
mov eax, dword [0x755bdc]
push eax
mov ecx, dword [esi + 0xabc]
push ecx
lea ecx, [esi + 0x20]
call fcn.005c3700
push str.Cancel_by_user._n
lea ecx, [esi + 0x51c]
call fcn.00564020
jmp 0x5b7008
mov ecx, dword [esi + 0xabc]
cmp ecx, 0x7540
jne 0x5b69b4
push str.Cancel_by_user._n
lea ecx, [esi + 0x51c]
call fcn.00564020
push 2
mov ecx, esi
call fcn.005aef40
jmp 0x5b7008
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x23], 1
mov eax, ecx
cmp eax, 0x753b
jg 0x5b6a58
je case.0x5b6a69.30040
cmp eax, 0x80090304
je case.0x5b6a69.30018
cmp eax, 0x17
je case.0x5b6a69.30040
cmp eax, 0x70
je case.0x5b6a69.30040
cmp byte [esi + 0x34a], bl
jne case.0x5b6a69.30040
cmp byte [esi + 0xaef], bl
jne 0x5b6bd9
cmp byte [0x755745], bl
je 0x5b6bd1
cmp dword [esi + 4], ebx
jne 0x5b6bd1
test dword [esi + 0x174], 0x80000
je 0x5b6bd1
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00402500
mov byte [ebp - 4], 2
cmp byte [esi + 0xaa8], 0
je 0x5b6a70
mov eax, dword [esi + 0xa90]
push eax
mov ecx, dword [esi + 0xa8c]
push ecx
jmp 0x5b6a87
sub eax, 0x7542
cmp eax, 0x40
ja case.0x5b6a69.30019
movzx edx, byte [eax + 0x5b8538]
jmp dword [edx*4 + 0x5b852c]
mov eax, dword [esi + 0x94c]
cmp eax, ebx
jne 0x5b6a7f
mov eax, 0x670984
mov ecx, dword [esi + 0x950]
push ecx
push eax
push str._s:_ld
lea edx, [ebp - 0x14]
push edx
call fcn.00402f70
add esp, 0x10
mov byte [esi + 0xaef], 1
push esi
call fcn.004adb50
push esi
call fcn.004b1530
add esp, 8
cmp byte [esi + 0xaa8], 0
je 0x5b6ac7
mov eax, dword [esi + 0xa90]
push eax
mov ecx, dword [esi + 0xa8c]
push ecx
jmp 0x5b6ade
mov eax, dword [esi + 0x94c]
cmp eax, ebx
jne 0x5b6ad6
mov eax, 0x670984
mov ecx, dword [esi + 0x950]
push ecx
push eax
push str._s:_ld
lea edx, [ebp - 0x20]
push edx
call fcn.00402f70
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00619b9e
add esp, 8
test eax, eax
je 0x5b6b90
lea edi, [esi + 0x51c]
push str.Try_via_the_same_proxy_as_in_browser_request._n
mov ecx, edi
call fcn.00564020
mov edx, dword [esi + 0xabc]
mov dword [esi + 0xaf4], edx
mov edi, dword [edi]
cmp edi, ebx
je 0x5b6b40
push edi
push 0x66fea8
lea eax, [esi + 0xaf8]
push eax
call fcn.00402f70
add esp, 0xc
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
je 0x5b6b65
mov eax, dword [esi + 0x4e8]
cmp eax, ebx
je 0x5b6b65
push eax
push 0x1431
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x5b6b73
mov dword [esi + 0x948], ebx
push ebx
mov ecx, esi
call fcn.005bfa10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5b7008
mov byte [esi + 0xaef], 0
cmp byte [esi + 0xaf0], 0
je 0x5b6bb4
push str.Cannot_detect_proxy_in_browser_proxy_script_:__n
lea ecx, [esi + 0x51c]
call fcn.00564020
mov byte [ebp - 0x19], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5b6c28
mov byte [ebp - 0x23], bl
cmp byte [esi + 0xaef], bl
je 0x5b6c28
cmp ecx, 0x756f
je 0x5b6be9
cmp ecx, 0x7559
jne 0x5b6c22
mov ecx, dword [esi + 0xaf4]
mov dword [esi + 0xabc], ecx
mov edx, dword [esi + 0xaf8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b6c00
lea ecx, [esi + 0x51c]
sub eax, edi
je 0x5b6c19
push edx
call fcn.005646e0
jmp 0x5b6c1e
call fcn.00564480
mov byte [ebp - 0x19], 1
mov byte [esi + 0xaef], bl
mov byte [ebp - 0x1a], 0
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x5c], ebx
xor edx, edx
mov word [ebp + 0x58], dx
mov byte [ebp - 4], 3
mov eax, dword [esi + 0xabc]
cmp eax, 0x7532
jg 0x5b6fc6
je case.0x5b6e77.10060
cmp eax, 0x271d
jg 0x5b6e51
je 0x5b6e49
cmp eax, 0xffffffff
jg 0x5b6d59
je 0x5b6ccb
cmp eax, 0x80090304
je case.0x5b6fdb.30009
cmp eax, 0x8009030e
je case.0x5b6fdb.30009
cmp eax, 0xfffffffc
je case.0x5b6fdb.30009
mov eax, dword [esi + 0x44]
cmp eax, 4
je 0x5b7823
cmp eax, 5
je 0x5b7823
lea edx, [esi + 0x520]
push edx
lea ecx, [ebp + 0x48]
call fcn.00402180
mov byte [ebp - 4], 0x17
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jne 0x5b6cc0
lea eax, [ebp + 0x4c]
mov edx, dword [0x755990]
jmp 0x5b7782
mov eax, dword [esi + 0x44]
cmp eax, 4
je case.0x5b6fdb.30009
cmp eax, 5
je case.0x5b6fdb.30009
lea eax, [esi + 0x520]
push eax
lea ecx, [ebp + 0x3c]
call fcn.00402180
mov bl, 0x15
mov byte [ebp - 4], bl
lea ecx, [esi + 0xb14]
push ecx
lea ecx, [ebp + 0x48]
call fcn.00402180
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp + 0x48]
test ecx, ecx
jne 0x5b6d09
lea ecx, [ebp + 0x4c]
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5b6d13
lea eax, [ebp + 0x40]
mov edx, dword [0x754d20]
push edx
push ecx
push eax
mov eax, dword [0x75598c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00402320
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x3c]
call fcn.00401210
jmp 0x5b7838
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x755998]
push edx
jmp 0x5b7830
cmp eax, 5
je 0x5b6e36
cmp eax, 0x17
je 0x5b6e24
cmp eax, 0x70
jne case.0x5b6fdb.30004
mov eax, dword [0x754d20]
push eax
mov ecx, dword [0x755eb4]
push ecx
lea ecx, [ebp + 0x48]
call fcn.0045b2d0
mov bl, 0x11
mov byte [ebp - 4], bl
xor edi, edi
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x20], edi
xor edx, edx
mov word [ebp + 0x1c], dx
mov byte [ebp - 4], 0x12
push edi
push edi
lea eax, [ebp - 0x18]
push eax
push 0x400
push 0x70
push edi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp + 0x48]
cmp eax, edi
jne 0x5b6dc3
lea eax, [ebp + 0x4c]
push edi
mov ecx, dword [ebp - 0x18]
push ecx
push eax
push str._r_n_r_n_s_s
lea ecx, [ebp + 0x18]
call fcn.00402320
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x754d20]
push eax
mov ecx, dword [0x755998]
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov eax, dword [ebp + 0x18]
cmp eax, edi
jne 0x5b6dff
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405340
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x18]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
call fcn.00401210
jmp 0x5b7838
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x75643c]
push eax
jmp 0x5b7830
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x755fcc]
push edx
jmp 0x5b7830
mov ecx, dword [0x7559a4]
jmp 0x5b6e84
cmp eax, 0x2af9
jg 0x5b6f72
je 0x5b6f67
sub eax, 0x2726
cmp eax, 0x2b
ja case.0x5b6fdb.30004
movzx edx, byte [eax + 0x5b85a8]
jmp dword [edx*4 + 0x5b857c]
mov ecx, dword [0x7559a0]
mov eax, dword [0x754d20]
push eax
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [esi + 0x35d], 1
jmp 0x5b7838
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0xb
mov eax, dword [0x755998]
mov edx, dword [0x7560c8]
push edx
push eax
push str._s_r_n_r_n_s
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f70
add esp, 0x10
mov edx, dword [0x754d20]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [esi + 0x35d], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5b7838
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x7559a8]
push edx
jmp 0x5b7830
mov ecx, dword [0x7559ac]
jmp 0x5b7829
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x7559b0]
push eax
jmp 0x5b7830
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x7559b8]
push edx
jmp 0x5b7830
mov ecx, dword [0x7559bc]
jmp 0x5b7829
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x7559c0]
push eax
jmp 0x5b7830
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x7559c4]
push edx
jmp 0x5b7830
mov ecx, dword [0x7559b4]
jmp 0x5b6e84
sub eax, 0x2afa
je case.0x5b6fdb.30009
sub eax, 2
jne case.0x5b6fdb.30004
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0xc
mov eax, dword [0x755bb8]
jmp 0x5b6eb0
mov eax, dword [esi + 0x174]
test al, 8
jne 0x5b6fad
test eax, 0x100
je case.0x5b6fdb.30003
mov byte [esi + 0x35d], 1
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x755bf8]
push eax
jmp 0x5b7830
sub eax, 0x7533
cmp eax, 0x57
ja case.0x5b6fdb.30004
movzx ecx, byte [eax + 0x5b8648]
jmp dword [ecx*4 + 0x5b85d4]
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x7559c8]
push eax
jmp 0x5b7830
push ebx
mov ecx, esi
call fcn.005aef40
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x54]
call fcn.00401210
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xb0]
xor ecx, ebp
call fcn.0061807e
add ebp, 0xb4
mov esp, ebp
pop ebp
ret 0xc
push ebx
mov ecx, esi
call fcn.005aef40
cmp dword [esi + 8], ebx
jne 0x5b7248
cmp dword [esi + 4], ebx
jne 0x5b7248
cmp byte [ebp + 0xbc], 0
je 0x5b7248
mov eax, dword [esi + 0x518]
cmp eax, ebx
je 0x5b7081
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5b7081
mov edx, dword [esi + 0x518]
mov eax, dword [edx + 0x20]
push eax
call fcn.005f0f3e
mov edi, eax
jmp 0x5b7083
xor edi, edi
mov ecx, dword [esi + 0x44]
push ecx
call fcn.00497190
add esp, 4
push eax
lea ecx, [ebp - 0x20]
call fcn.004030b0
mov byte [ebp - 4], 4
mov eax, dword [esi + 0x1d0]
lea ebx, [esi + 0x20]
push edi
push 0
push 0
push eax
mov edx, dword [ebx]
push edx
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0xec]
call fcn.004f3a90
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xec]
call fcn.005ee341
cmp eax, 1
jne 0x5b722d
mov eax, dword [esi + 0x10]
test eax, eax
je 0x5b70ef
push 0
push 0x1472
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x10], 0
mov ecx, dword [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0x78]
push edx
mov ecx, esi
call fcn.005af260
mov eax, dword [esi + 0x4e8]
test eax, eax
je 0x5b719b
cmp dword [esi + 0x49c], 0
jne 0x5b7124
push eax
mov ecx, ebx
call fcn.005c6e60
mov edx, dword [esi + 0x49c]
test edx, edx
je 0x5b719b
mov edi, dword [ebp - 0x78]
mov eax, edi
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b7136
sub eax, ebx
inc eax
push eax
push edi
push 1
push 0
push 0x6836bc
push edx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call edi
cmp byte [esi + 0x1c0], 0
je 0x5b717c
mov dword [ebp - 0x28], 1
push 4
lea eax, [ebp - 0x28]
push eax
push 4
push 0
push str.bUNRA
mov ecx, dword [esi + 0x49c]
push ecx
call edi
push 0
mov edx, dword [ebp - 0x74]
push edx
push str.EncPassword
push 0x691fec
mov eax, dword [esi + 0x49c]
push eax
call fcn.005b2340
add esp, 0x14
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 6
mov ecx, dword [esi + 0xabc]
push ecx
mov edx, dword [0x755984]
push edx
push str._r_n_s_r_ndownlResult___ldsetting_new_login_r_n
lea eax, [ebp - 0x14]
push eax
call fcn.00402f70
add esp, 0x10
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [esi + 0x51c]
call fcn.00564020
cmp byte [ebp + 0xc0], 0
je 0x5b7201
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5b7201
mov esi, dword [esi + 0x4e8]
test esi, esi
je 0x5b7201
push esi
push 0x1431
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x14]
call fcn.00402570
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xec]
call fcn.004b4c50
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.00402570
jmp 0x5b6ffc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xec]
call fcn.004b4c50
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.00402570
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x755984]
push eax
jmp 0x5b7830
push 0x670984
lea ecx, [esi + 0x3ac]
call fcn.005494d0
cmp dword [esi + 8], ebx
jne 0x5b740f
cmp dword [esi + 4], ebx
jne 0x5b740f
cmp byte [ebp + 0xbc], 0
je 0x5b740f
push ebx
mov ecx, esi
call fcn.005aef40
mov eax, dword [esi + 0x518]
cmp eax, ebx
je 0x5b72bc
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5b72bc
mov edx, dword [esi + 0x518]
mov eax, dword [edx + 0x20]
push eax
call fcn.005f0f3e
mov ebx, eax
jmp 0x5b72be
xor ebx, ebx
mov ecx, dword [esi + 0x44]
push ecx
call fcn.00497190
add esp, 4
push eax
lea ecx, [ebp - 0x18]
call fcn.004030b0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.00402500
mov byte [ebp - 4], 8
cmp byte [esi + 0xa82], 0
jne 0x5b7323
cmp dword [0x75573c], 2
jne 0x5b72fe
test byte [0x755750], 0x10
jne 0x5b7323
lea edi, [esi + 0x94c]
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
test eax, eax
je 0x5b7315
push eax
call fcn.005494d0
jmp 0x5b7358
lea edx, [esi + 0xa8c]
push edx
call fcn.00405930
jmp 0x5b7358
lea edi, [esi + 0x94c]
mov eax, dword [edi]
lea edx, [ebp - 0x20]
test eax, eax
je 0x5b733c
mov ecx, dword [esi + 0x950]
push ecx
push eax
jmp 0x5b734a
mov eax, dword [esi + 0xa90]
push eax
mov ecx, dword [esi + 0xa8c]
push ecx
push str._s:_ld
push edx
call fcn.00402f70
add esp, 0x10
mov eax, dword [esi + 0xa6c]
push ebx
movzx ecx, byte [esi + 0xa82]
push ecx
push 1
push eax
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xec]
call fcn.004f3a90
mov bl, 9
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xec]
call fcn.005ee341
cmp eax, 1
jne 0x5b73e8
mov byte [esi + 0xa85], al
mov eax, dword [esi + 0x10]
test eax, eax
je 0x5b73b2
push 0
push 0x1472
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x10], 0
mov byte [ebp - 0x24], 1
cmp dword [edi], 0
je 0x5b7431
mov ecx, dword [ebp - 0x78]
push ecx
mov ecx, edi
call fcn.004b22a0
test eax, eax
jne 0x5b73e4
mov edx, dword [ebp - 0x74]
push edx
mov ecx, edi
call fcn.004b2310
test eax, eax
je 0x5b7465
mov byte [ebp - 0x24], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xec]
call fcn.004b4c50
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00402570
cmp byte [esi + 0xa82], 0
mov eax, 0x7565f8
jne 0x5b7422
mov eax, 0x755988
mov eax, dword [eax]
mov ecx, dword [0x754d20]
push ecx
push eax
jmp 0x5b7830
mov byte [esi + 0xaa9], 1
mov eax, dword [ebp - 0x78]
push eax
push 0x66fea8
lea ecx, [esi + 0xa94]
push ecx
call fcn.00402f70
mov edx, dword [ebp - 0x74]
push edx
push 0x66fea8
lea eax, [esi + 0xa98]
push eax
call fcn.00402f70
add esp, 0x18
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0xa
cmp byte [esi + 0xa82], 0
mov eax, dword [0x7565f8]
jne 0x5b7484
mov eax, dword [0x755988]
mov ecx, dword [esi + 0xabc]
push ecx
push eax
push str._r_n_s_r_ndownlResult___ldsetting_new_login_r_n
lea edx, [ebp - 0x14]
push edx
call fcn.00402f70
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [esi + 0x51c]
call fcn.00564020
cmp byte [ebp + 0xc0], 0
je 0x5b74d8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5b74d8
mov esi, dword [esi + 0x4e8]
test esi, esi
je 0x5b74d8
push esi
push 0x1431
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00402570
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xec]
call fcn.004b4c50
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00402570
jmp 0x5b6ffc
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x75599c]
push eax
jmp 0x5b7830
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x755bd0]
push edx
jmp 0x5b7830
mov ecx, dword [0x755994]
jmp 0x5b7829
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x755a30]
push eax
jmp 0x5b7830
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x755a34]
push edx
jmp 0x5b7830
mov ecx, dword [0x755a38]
jmp 0x5b7829
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x755980]
push eax
jmp 0x5b7830
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x755b9c]
push edx
jmp 0x5b7830
mov ecx, dword [0x755be4]
jmp 0x5b7829
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x755c34]
push eax
jmp 0x5b7830
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x755bec]
push edx
jmp 0x5b7830
mov ecx, dword [0x755c7c]
jmp 0x5b7829
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x755bf4]
push eax
jmp 0x5b7830
lea ecx, [ebp + 0xa0]
push ecx
mov edx, dword [esi + 0x4fc]
push edx
mov eax, dword [esi + 0x4f8]
push eax
mov ecx, esi
call fcn.005af8c0
mov dword [ebp], ebx
mov dword [ebp + 8], ebx
xor ecx, ecx
mov word [ebp + 4], cx
mov byte [ebp - 4], 0xd
lea edx, [ebp]
push edx
mov ecx, esi
call fcn.005b0c50
lea eax, [ebp + 0xa0]
push eax
lea ecx, [ebp + 0x3c]
call fcn.00406fc0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
call fcn.00402500
mov byte [ebp - 4], 0xf
mov ecx, dword [esi + 0x4fc]
push ecx
mov edx, dword [esi + 0x4f8]
push edx
push str._I64d
lea eax, [ebp - 0x18]
push eax
call fcn.00402f70
add esp, 0x10
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp + 0x48]
call fcn.00406fc0
mov byte [ebp - 4], 0x10
push str._I64d
mov edx, dword [0x755bbc]
push edx
call fcn.00619720
add esp, 8
test eax, eax
je 0x5b768a
push 0x66fea8
push str._I64d
jmp 0x5b76ab
push 0x670604
mov eax, dword [0x755bbc]
push eax
call fcn.00619720
add esp, 8
test eax, eax
je 0x5b76b5
push 0x66fea8
push 0x670604
mov ecx, 0x755bbc
call fcn.00402c10
cmp dword [esi + 0x54], ebx
je 0x5b76bf
mov edi, dword [esi + 0x54]
jmp 0x5b76c2
lea edi, [esi + 0x58]
mov edx, dword [ebp + 0x48]
cmp edx, ebx
jne 0x5b76cc
lea edx, [ebp + 0x4c]
mov ecx, dword [ebp + 0x3c]
cmp ecx, ebx
jne 0x5b76d6
lea ecx, [ebp + 0x40]
mov eax, dword [ebp]
cmp eax, ebx
jne 0x5b76e0
lea eax, [ebp + 4]
mov ebx, dword [0x754d20]
push ebx
push edi
push edx
push ecx
push eax
mov ecx, dword [0x755bbc]
push ecx
lea ecx, [ebp + 0x54]
call fcn.0043bb70
mov byte [ebp - 4], 0xf
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
call fcn.00402570
mov byte [ebp - 4], 0xd
lea ecx, [ebp + 0x3c]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp]
call fcn.00401210
jmp 0x5b7838
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x755a70]
push edx
jmp 0x5b7830
mov ecx, dword [0x7563e0]
jmp 0x5b7829
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x75648c]
push eax
jmp 0x5b7830
lea eax, [esi + 0x520]
push eax
lea ecx, [ebp + 0x48]
call fcn.00402180
mov byte [ebp - 4], 0x13
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jne 0x5b777c
lea eax, [ebp + 0x4c]
mov edx, dword [0x7560d4]
mov ecx, dword [0x754d20]
push ecx
push eax
push edx
lea ecx, [ebp + 0x54]
call fcn.004021b0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
call fcn.00401210
jmp 0x5b7838
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0x14
mov eax, dword [0x7565a8]
push eax
push 0x66fea8
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f70
push 0x6722a4
mov edx, dword [ebp - 0x14]
push edx
call fcn.0061a7e0
add esp, 0x14
cmp eax, ebx
je 0x5b77dc
mov byte [eax], 0
mov eax, dword [0x754d20]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5b7838
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x756748]
push eax
jmp 0x5b7830
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x75674c]
push edx
jmp 0x5b7830
mov ecx, dword [0x756750]
jmp 0x5b7829
mov ecx, dword [0x755998]
mov eax, dword [0x754d20]
push eax
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5b7857
mov edx, dword [esi + 0x4e8]
push edx
push 0x13c7
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0xabc]
add eax, 0xffff8abe
cmp eax, 0x38
ja case.0x5b7872.30019
movzx eax, byte [eax + 0x5b86ac]
jmp dword [eax*4 + 0x5b86a0]
mov ecx, dword [esi + 0x150]
or ecx, dword [esi + 0x154]
je case.0x5b7872.30019
push 0x670980
lea ecx, [ebp + 0x54]
call fcn.00405340
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x75648c]
push eax
lea ecx, [ebp + 0x48]
call fcn.0045b2d0
mov byte [ebp - 4], 0x18
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x5b78bb
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405340
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
call fcn.00401210
mov cl, byte [esi + 0x195]
test cl, cl
jne 0x5b7a46
mov eax, dword [esi + 0x158]
test eax, eax
jle 0x5b78f9
mov edx, dword [esi + 0x15c]
sub edx, eax
cmp edx, 0x3c
jl 0x5b7a31
cmp byte [0x755287], 0
jne 0x5b79eb
mov eax, dword [esi + 0x108]
cmp eax, dword [esi + 0x150]
jne 0x5b79eb
mov ecx, dword [esi + 0x10c]
cmp ecx, dword [esi + 0x154]
jne 0x5b79eb
cmp dword [esi + 0xdc], 0
je 0x5b79eb
mov ebx, dword [esi + 0x134]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b7942
sub eax, edx
je 0x5b79eb
mov edi, dword [esi + 0x104]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b7960
sub eax, edx
je 0x5b79eb
mov edx, ebx
mov eax, edi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x5b7993
test cl, cl
je 0x5b798f
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x5b7993
add eax, 2
add edx, 2
test cl, cl
jne 0x5b7973
xor eax, eax
jmp 0x5b7998
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x5b79eb
mov ecx, ebx
mov eax, dword [esi + 0xdc]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5b79c4
test dl, dl
je 0x5b79c0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5b79c4
add eax, 2
add ecx, 2
test dl, dl
jne 0x5b79a4
xor eax, eax
jmp 0x5b79c9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x5b79eb
mov byte [ebp - 0x21], 1
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x756388]
push eax
lea ecx, [ebp + 0x54]
call fcn.00401980
jmp case.0x5b7872.30019
push str._r_n_r_n
lea ecx, [ebp + 0x54]
call fcn.00405340
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x7564ac]
push edx
lea ecx, [ebp + 0x48]
call fcn.0045b2d0
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x5b7a1c
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405340
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
jmp 0x5b7ba7
test cl, cl
jne 0x5b7a46
push 1
mov eax, dword [esi + 0x4e8]
push eax
lea ecx, [esi + 0x20]
call fcn.005c9440
cmp dword [esi + 0x4fc], 0
jl 0x5b7a75
jg 0x5b7a5a
cmp dword [esi + 0x4f8], 0
jbe 0x5b7a75
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x7564b0]
push edx
lea ecx, [ebp + 0x54]
call fcn.00401980
jmp case.0x5b7872.30019
xor bl, bl
test byte [esi + 0x174], 0x70
je 0x5b7a82
mov bl, 1
xor edi, edi
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x14], edi
xor eax, eax
mov word [ebp + 0x10], ax
mov byte [ebp - 4], 0x19
lea ecx, [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.005b0c50
test bl, bl
je 0x5b7b69
mov edx, dword [esi + 0xe8]
mov eax, edx
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b7ab2
mov ecx, 0x7558f8
sub eax, ebx
je 0x5b7aca
push edx
call fcn.0053fe60
jmp 0x5b7ad3
mov edx, dword [esi + 0x20]
push edx
call fcn.0053fd40
cmp dword [esi + 0x11c], edi
je 0x5b7ae3
mov eax, dword [esi + 0x11c]
jmp 0x5b7ae9
lea eax, [esi + 0x120]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x5b7af0
sub eax, edx
sar eax, 1
je 0x5b7b19
cmp dword [esi + 0x11c], edi
je 0x5b7b11
mov eax, dword [esi + 0x11c]
jmp 0x5b7b23
lea eax, [esi + 0x120]
jmp 0x5b7b23
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x5b7b23
lea eax, [ebp + 0x10]
mov ecx, dword [0x754d20]
push ecx
push eax
mov edx, dword [0x75638c]
push edx
lea ecx, [ebp + 0x54]
call fcn.004021b0
test dword [esi + 0x174], 0x100
jne 0x5b7ba0
mov eax, dword [esi + 0x158]
cmp eax, edi
jle 0x5b7ba0
mov ecx, dword [esi + 0x15c]
sub ecx, eax
cmp ecx, 0x3c
jge 0x5b7ba0
cmp byte [ebp - 0x19], 0
jne 0x5b7ba0
mov byte [ebp - 0x1a], 1
jmp 0x5b7ba0
cmp byte [esi + 0x193], 0
je 0x5b7b8a
cmp byte [0x755287], 0
jne 0x5b7b8a
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x756388]
push eax
jmp 0x5b7b98
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x7564b0]
push edx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [ebp - 4], 3
lea ecx, [ebp + 0xc]
call fcn.00401210
cmp dword [esi + 0xabc], 0x7582
je 0x5b7c6a
cmp dword [esi + 0x51c], 0
je 0x5b7c6a
push str._r_n_r_n
lea ecx, [ebp + 0x54]
call fcn.00405340
xor edi, edi
mov dword [ebp + 0xa4], edi
mov dword [ebp + 0xac], edi
xor eax, eax
mov word [ebp + 0xa8], ax
mov bl, 0x1b
mov byte [ebp - 4], bl
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x755eb4]
push edx
lea ecx, [ebp + 0xa4]
call fcn.00401980
mov eax, dword [ebp + 0xa4]
cmp eax, edi
jne 0x5b7c1b
lea eax, [ebp + 0xa8]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405340
mov eax, dword [0x754d20]
push eax
mov ecx, dword [esi + 0x51c]
push ecx
lea ecx, [ebp + 0x48]
call fcn.0045b2d0
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp + 0x48]
cmp eax, edi
jne 0x5b7c47
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405340
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp + 0xa4]
call fcn.00401210
cmp byte [ebp - 0x19], 0
je 0x5b7d98
push str._r_n_r_n
lea ecx, [ebp + 0x54]
call fcn.00405340
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x75671c]
push eax
lea ecx, [ebp + 0x3c]
call fcn.0045b2d0
mov bl, 0x1d
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5b7ca5
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405340
mov byte [ebp - 0x22], 0
mov edx, dword [esi + 0x148]
mov eax, edx
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b7cc0
sub eax, edi
je 0x5b7d8c
push 0x5c
push edx
call fcn.0061a820
add esp, 8
mov edi, eax
test edi, edi
je 0x5b7ce3
inc edi
jmp 0x5b7ce9
mov edi, dword [esi + 0x148]
push 0xa
push str.chromeexe
push edi
call fcn.0061caaf
add esp, 0xc
test eax, eax
je 0x5b7d43
push str.idmbrbtn.dll
push edi
call fcn.00619b9e
add esp, 8
test eax, eax
jne 0x5b7d8c
mov eax, dword [esi + 0x1ac]
push str.Chrome
push eax
call fcn.00619720
add esp, 8
test eax, eax
je 0x5b7d8c
mov eax, dword [esi + 0x1ac]
push str.Firefox
push eax
call fcn.00619720
add esp, 8
test eax, eax
jne 0x5b7d8c
mov byte [ebp - 0x22], 1
push 0x67cb5c
lea ecx, [ebp + 0x54]
call fcn.00405340
mov ecx, dword [0x754d20]
push ecx
mov edx, dword [0x756720]
push edx
lea ecx, [ebp + 0x48]
call fcn.0045b2d0
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x5b7d78
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405340
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x3c]
call fcn.00401210
mov eax, dword [ebp + 0x54]
xor ebx, ebx
cmp eax, ebx
jne 0x5b7da4
lea eax, [ebp + 0x58]
mov ecx, dword [0x754d20]
push ecx
push eax
lea edx, [ebp - 0x2c]
push edx
call fcn.00402a70
add esp, 0xc
mov byte [ebp - 4], 0x1f
lea ecx, [esi + 0x20]
push ebx
mov eax, dword [esi + 0x4e8]
push eax
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [esi + 0xabc]
push eax
call fcn.005c3700
lea edi, [esi + 0x51c]
mov ecx, dword [ebp - 0x2c]
push ecx
mov ecx, edi
call fcn.00564020
mov edx, dword [esi + 0xabc]
push edx
push str._r_ndownlResult___ld_r_n
lea eax, [ebp + 0x60]
push eax
call fcn.0061af5b
add esp, 0xc
lea ecx, [ebp + 0x60]
push ecx
mov ecx, edi
call fcn.00564020
mov eax, dword [esi + 0xabc]
add eax, 0xffff8abe
cmp eax, 0x38
ja case.0x5b7e26.30019
movzx edx, byte [eax + 0x5b86f4]
jmp dword [edx*4 + 0x5b86e8]
mov eax, dword [esi + 0x150]
or eax, dword [esi + 0x154]
je case.0x5b7e26.30019
cmp dword [esi + 8], ebx
jne case.0x5b7e26.30019
cmp dword [esi + 4], ebx
jne case.0x5b7e26.30019
cmp byte [ebp + 0xbc], 0
je case.0x5b7e26.30019
cmp dword [esi + 0x14], ebx
je case.0x5b7e26.30019
cmp dword [esi + 0x4e8], ebx
je case.0x5b7e26.30019
cmp byte [esi + 0x195], 0
jne case.0x5b7e26.30019
cmp byte [ebp - 0x21], 0
jne case.0x5b7e26.30019
push ebx
mov ecx, esi
call fcn.005aef40
mov ecx, dword [esi + 0x4e8]
push ecx
push 0x1463
push 0x111
mov edx, dword [esi + 0x14]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [esi + 0x35d], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00402570
jmp 0x5b6ffc
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x2c], ebx
xor eax, eax
mov word [ebp + 0x28], ax
mov byte [ebp - 4], 0x20
lea ecx, [ebp + 0x24]
push ecx
mov ecx, esi
call fcn.005b0c50
cmp dword [esi + 8], ebx
jne 0x5b8372
cmp dword [esi + 4], ebx
jne 0x5b8372
cmp byte [ebp + 0xbc], 0
je 0x5b8372
cmp dword [esi + 0x4e8], ebx
je 0x5b8372
cmp dword [esi + 0x514], ebx
jne 0x5b8372
mov eax, dword [esi + 0xabc]
cmp eax, 0x7540
je 0x5b8372
cmp eax, 0x7553
jne 0x5b7f66
mov eax, dword [ebp + 0x24]
cmp eax, ebx
mov ecx, eax
jne 0x5b7f1b
lea ecx, [ebp + 0x28]
mov eax, dword [ebp + 0x54]
cmp eax, ebx
jne 0x5b7f25
lea eax, [ebp + 0x58]
push 0x10024
push ecx
push eax
push ebx
call fcn.0046f920
add esp, 0x10
cmp eax, 6
jne 0x5b8372
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x5b8372
mov edx, dword [esi + 0x4e8]
push edx
push 0x13bb
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x5b8372
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x38], ebx
xor eax, eax
mov word [ebp + 0x34], ax
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x5b7f8f
mov ecx, dword [0x754d20]
push ecx
push eax
lea ecx, [ebp + 0x30]
call fcn.00401980
jmp 0x5b7fa2
mov eax, dword [ebp + 0x24]
cmp eax, ebx
jne 0x5b7f99
lea eax, [ebp + 0x28]
push eax
lea ecx, [ebp + 0x30]
call fcn.004017f0
cmp dword [esi + 0xabc], 0x80090326
jne 0x5b8060
cmp dword [0x754bbc], ebx
jne 0x5b8060
xor edi, edi
mov dword [ebp + 0x3c], edi
mov dword [ebp + 0x44], edi
xor edx, edx
mov word [ebp + 0x40], dx
mov bl, 0x22
mov byte [ebp - 4], bl
mov eax, dword [0x754d20]
push eax
mov ecx, dword [0x7566b0]
push ecx
lea ecx, [ebp + 0x48]
call fcn.0045b2d0
mov byte [ebp - 4], 0x23
mov eax, dword [ebp + 0x48]
cmp eax, edi
mov ecx, eax
jne 0x5b7ff6
lea ecx, [ebp + 0x4c]
mov eax, dword [ebp + 0x54]
cmp eax, edi
jne 0x5b8000
lea eax, [ebp + 0x58]
push edi
push ecx
push eax
push str._s_r_n_r_n_r_n_s
lea ecx, [ebp + 0x3c]
call fcn.00402320
mov eax, dword [ebp + 0x30]
cmp eax, edi
mov ecx, eax
jne 0x5b801c
lea ecx, [ebp + 0x34]
mov eax, dword [ebp + 0x3c]
cmp eax, edi
jne 0x5b8026
lea eax, [ebp + 0x40]
push 0x50034
push ecx
push eax
push edi
call fcn.0046f920
add esp, 0x10
cmp eax, 6
jne 0x5b8049
push str.https:__www.internetdownloadmanager.com_support_xp_https_problems.html
push edi
call fcn.004af020
add esp, 8
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 0x21
lea ecx, [ebp + 0x3c]
jmp 0x5b835f
cmp byte [esi + 0x35d], 0
je 0x5b81a1
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x50], ebx
xor edx, edx
mov word [ebp + 0x4c], dx
mov byte [ebp - 4], 0x24
mov eax, dword [0x754d20]
push eax
mov ecx, dword [0x75660c]
push ecx
lea ecx, [ebp + 0x3c]
call fcn.0045b2d0
mov byte [ebp - 4], 0x25
mov eax, dword [ebp + 0x3c]
cmp eax, ebx
mov ecx, eax
jne 0x5b80a2
lea ecx, [ebp + 0x40]
mov eax, dword [ebp + 0x54]
cmp eax, ebx
jne 0x5b80ac
lea eax, [ebp + 0x58]
push ebx
push ecx
push eax
push str._s_r_n_r_n_r_n_s
lea ecx, [ebp + 0x48]
call fcn.00402320
mov eax, dword [ebp + 0x30]
cmp eax, ebx
mov ecx, eax
jne 0x5b80c8
lea ecx, [ebp + 0x34]
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jne 0x5b80d2
lea eax, [ebp + 0x4c]
push 0x50034
push ecx
push eax
push ebx
call fcn.0046f920
add esp, 0x10
cmp eax, 6
jne 0x5b8190
lea ecx, [ebp - 0x14]
call fcn.00402500
mov bl, 0x26
mov byte [ebp - 4], bl
push 0
lea edx, [ebp - 0x14]
push edx
lea edi, [esi + 0x20]
mov ecx, edi
call fcn.0058ae10
lea ecx, [ebp - 0x18]
call fcn.00402500
mov byte [ebp - 4], 0x27
mov eax, dword [edi]
test eax, eax
mov ecx, eax
jne 0x5b8121
mov ecx, 0x670984
cmp byte [esi + 0xaa8], 0
jne 0x5b8137
cmp dword [esi + 0x94c], 0
jne 0x5b8137
xor eax, eax
jmp 0x5b813c
mov eax, 1
push ecx
push eax
xor eax, eax
cmp byte [esi + 0x19b], al
setne al
push eax
mov ecx, dword [esi + 0x1cc]
push ecx
mov edx, dword [esi + 0xabc]
push edx
push str.https:__www.internetdownloadmanager.com_register_new_faq_How_to_configure_Firewalls_for_IDM.html
push str._s_err_ldocr_ldv6_ldproxy_ldsrv_s
lea eax, [ebp - 0x18]
push eax
call fcn.00402f70
mov ecx, dword [ebp - 0x18]
push ecx
push 0
call fcn.004af020
add esp, 0x28
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.00402570
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x14]
call fcn.00402570
mov byte [ebp - 4], 0x24
lea ecx, [ebp + 0x3c]
call fcn.00401210
jmp 0x5b8358
mov eax, dword [ebp + 0x54]
cmp eax, ebx
jne 0x5b81ab
lea eax, [ebp + 0x58]
push eax
lea ecx, [ebp + 0x48]
call fcn.00402180
mov bl, 0x28
mov byte [ebp - 4], bl
cmp byte [ebp - 0x1a], 0
je 0x5b82b8
cmp byte [ebp - 0x21], 0
je 0x5b81d2
mov byte [ebp - 0x1a], 0
jmp 0x5b82b8
mov dword [ebp - 0x30], 1
test dword [esi + 0x174], 0x100000
jne 0x5b82b8
mov edx, dword [esi + 0x148]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b81f4
sub eax, edi
je 0x5b82b8
push 0x5c
push edx
call fcn.0061a820
add esp, 8
mov edi, eax
test edi, edi
je 0x5b8217
inc edi
jmp 0x5b821d
mov edi, dword [esi + 0x148]
push 0xb
push str.firefox.exe
push edi
call fcn.0061f7bf
add esp, 0xc
test eax, eax
je 0x5b826d
push 0xa
push str.chrome.exe
push edi
call fcn.0061caaf
add esp, 0xc
test eax, eax
je 0x5b826d
push 0xa
push str.msedge.exe
push edi
call fcn.0061caaf
add esp, 0xc
test eax, eax
je 0x5b826d
push 0x13
push str.MicrosoftEdgeCP.exe
push edi
call fcn.0061caaf
add esp, 0xc
test eax, eax
jne 0x5b82b8
mov dword [ebp - 0x30], 0
mov edx, dword [0x754d20]
push edx
mov eax, dword [0x756714]
push eax
lea ecx, [ebp + 0x3c]
call fcn.0045b2d0
mov byte [ebp - 4], 0x29
push str._r_n_r_n
lea ecx, [ebp + 0x48]
call fcn.00405340
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5b82a4
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x48]
call fcn.00405340
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x3c]
call fcn.00401210
mov eax, dword [esi + 0xabc]
cmp eax, 0xffffffff
je 0x5b82cf
cmp eax, 0x753b
mov eax, 0x30
jne 0x5b82d4
mov eax, 0x10
mov edx, dword [ebp + 0x30]
test edx, edx
jne 0x5b82de
lea edx, [ebp + 0x34]
mov ecx, dword [ebp + 0x48]
test ecx, ecx
jne 0x5b82e8
lea ecx, [ebp + 0x4c]
or eax, 0x50000
push eax
push edx
push ecx
push 0
call fcn.0046f920
add esp, 0x10
cmp byte [ebp - 0x1a], 0
je 0x5b8344
cmp byte [esi + 0x36b], 0
je 0x5b8329
cmp dword [esi + 0x49c], 0
jne 0x5b8321
mov ecx, dword [esi + 0x4e8]
push ecx
lea ecx, [esi + 0x20]
call fcn.005c6e60
lea ecx, [esi + 0x20]
call fcn.005ca090
mov edx, dword [esi + 0x4e8]
push edx
push 0x14cd
push 0x111
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [esi + 0xabc], 0x757a
jne 0x5b8358
lea ecx, [esi + 0x20]
call fcn.005c54d0
mov byte [ebp - 4], 0x21
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 0x20
lea ecx, [ebp + 0x30]
call fcn.00401210
xor ebx, ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x5b84d4
cmp eax, 3
jne 0x5b8392
cmp dword [esi + 0xabc], 0x756e
je 0x5b843a
cmp byte [ebp + 0xbc], 0
je 0x5b843a
cmp dword [esi + 0xabc], 0xffffffff
jne 0x5b83cf
push 0x50010
push 0x66fd88
mov ecx, dword [0x755be0]
push ecx
push ebx
call fcn.0046f4c0
add esp, 0x10
push ebx
mov ecx, esi
call fcn.005aef40
jmp 0x5b84db
push 0x66fd88
lea ecx, [ebp + 0x48]
call fcn.00406fc0
mov byte [ebp - 4], 0x2a
mov eax, dword [esi + 0xabc]
cmp eax, 0xffffffff
je 0x5b83f7
cmp eax, 0x753b
mov eax, 0x30
jne 0x5b83fc
mov eax, 0x10
mov edx, dword [ebp + 0x48]
cmp edx, ebx
jne 0x5b8406
lea edx, [ebp + 0x4c]
mov ecx, dword [ebp + 0x54]
cmp ecx, ebx
jne 0x5b8410
lea ecx, [ebp + 0x58]
or eax, 0x50000
push eax
push edx
push ecx
push ebx
call fcn.0046f920
add esp, 0x10
mov byte [ebp - 4], 0x20
lea ecx, [ebp + 0x48]
call fcn.00401210
push ebx
mov ecx, esi
call fcn.005aef40
jmp 0x5b84db
cmp eax, 4
jne 0x5b84ca
cmp byte [esi + 0x35d], 0
je 0x5b84ca
mov byte [esi + 0x35d], 0
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push str.bHDIShwd
mov ecx, dword [0x754bec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x5b84ca
mov dword [ebp - 0x18], 1
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push ebx
push str.bHDIShwd
mov eax, dword [0x754bec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.00411420
push eax
lea ecx, [ebp - 0xc8]
call fcn.00526cc0
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xc8]
call fcn.005ee341
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xc8]
call fcn.00526d40
push ebx
mov ecx, esi
call fcn.005aef40
jmp 0x5b84db
mov byte [esi + 0x35d], 0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp + 0x24]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00402570
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x54]
call fcn.00401210
mov dword [ebp - 4], 0xffffffff
jmp 0x5b7008