Function at 0x4d9770
Capabilities:
Contain obfuscated stackstrings
Create thread
Get graphical window text

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f45ce
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x440
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x3e0], edi
mov eax, dword [ebx + 0xc]
lea ecx, [edi + 0x1448]
push str.System_Booster
mov dword [ebp - 0x3f8], eax
call fcn.005dc510
push 0
lea ecx, [ebp - 0xe8]
mov byte [ebp - 0x3e2], 0
mov byte [ebp - 0x3e1], 0
call fcn.005d0610
push 1
push str.System_Booster_Scan
mov ecx, edi
call fcn.0045f680
mov ecx, edi
mov dword [ebp - 0x43c], eax
call fcn.0043e530
test al, al
je 0x4db356
mov esi, dword [edi + 0x14e4]
lea eax, [ebp - 0x358]
push 0x270
push 0
push eax
mov dword [ebp - 0x408], esi
call fcn.00420090
add esp, 0xc
lea eax, [edi + 0x14a8]
lea ecx, [ebp - 0x358]
push eax
call fcn.005c6300
push 0xffffffffffffffff
lea ecx, [ebp - 0x358]
mov dword [ebp - 4], 0
call fcn.005c4720
push 1
push str.https:__www.carifred.com_uvk_help_system_booster.php
lea ecx, [edi + 0x119c]
call fcn.005dc260
push 0xffffffffffffffff
mov ecx, esi
call fcn.005c44b0
push 0
call fcn.005c44a0
push 0xfffffffffffffffe
push 0x5f
push 0x96
push 0xb
push 0x78
push 0x75
mov ecx, edi
call fcn.0043ccb0
push 0x400
mov ecx, esi
call fcn.005c4340
movsd xmm1, qword [0x6edb20]
push 0
push str.Arial
push 1
push 0x320
call fcn.005c42b0
push 0x37
push 0x64
push 3
push 0xa
mov ecx, edi
call fcn.0045fec0
push 0xffffffffffffffff
push 0x10000001
push 0x2d
push 0x72
push 0x3c
push 3
push str.System_Booster_Scan
mov ecx, esi
call fcn.005c0890
push dword [edi + 0x1438]
mov ecx, esi
push 0xffffffffffffffff
call fcn.005bec70
push 0xfffffffffffffffe
mov ecx, esi
call fcn.005c44b0
movsd xmm1, qword [0x6edb08]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
push 0x10000001
push 0xf
push 0x82
push 0x19
push 0x82
push str.Scan_result:
mov ecx, esi
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x28
push 0x82
push 0x37
push 0x82
push str.Total_issues:_0._r_nJunk_size:_0_bytes.
mov ecx, esi
call fcn.005c0890
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x428], eax
call fcn.005c44b0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Delete_all_the_checked_entries._This_option_is_only_available_to_registered_users.
push 0x5f
push 0x96
push 0xa
push 0x113
push 0x72
push str.Delete_selected_items_r_n_r_n
call fcn.0045fdf0
push eax
mov ecx, esi
mov dword [ebp - 0x400], eax
call fcn.005c5730
push eax
lea ecx, [ebp - 0x358]
call fcn.005c5fe0
push 0xfffffffffffffffe
lea ecx, [ebp - 0x358]
call fcn.005c44b0
push 0xfffffffffffffffe
push 0xffffffffffffffff
push dword [edi + 0x1438]
mov eax, ecx
push eax
push str.Whether_to_create_a_system_restore_point_before_deleting_the_checked_entries.
push 1
push ecx
push 0x8c
push 0x49
push 5
push str._Create_restore_point
mov ecx, edi
call fcn.0045fc60
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Show_information_about_the_selected_item.
push 0x5f
push 0x50
push 0xa
push 0x1ae
push 0x8b
push str.Item_properties
mov dword [ebp - 0x44c], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Start_a_new_scan
push 0x5f
push 0x50
push 0xa
push 0x203
push 0x99
push str.New_scan
mov dword [ebp - 0x420], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
push str.Show_online_help__F1_
push 0x5f
mov dword [ebp - 0x448], eax
push 0x46
push 0xa
push 0x258
push 0x7d
push str.Help
mov ecx, edi
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Go_back_to_the_Home_page__Esc_
push 0x5f
push 0x46
push 0xa
push 0x2a3
push 0xb3
push str.Home
mov dword [edi + 0x11bc], eax
call fcn.0045fdf0
movsd xmm1, qword [0x6edaf8]
mov ecx, esi
push 0
push str.Arial
push 1
push 0x190
mov dword [edi + 0x11c0], eax
call fcn.005c42b0
push 0x833
mov ecx, esi
call fcn.005c4340
push ecx
push 0x10001137
push 0x1b3
push 0x2ee
push 0x73
push ecx
call fcn.005bfa50
mov edi, eax
push ecx
push edi
mov ecx, esi
mov dword [ebp - 0x3ec], edi
call fcn.005b9fe0
push edi
mov ecx, esi
call fcn.005c5730
push 0
push 0x16
push 0x111b
push eax
mov dword [ebp - 0x404], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 2
push 0x21
push 0x12
push 0x12
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
sub esp, 8
mov edx, 1
mov edi, eax
mov dword [ebp - 0x424], edi
push 0xff005f00
lea ecx, [edx + 0x11]
call fcn.005d28c0
push eax
lea ecx, [ebp - 0x438]
call fcn.005c6510
sub esp, 8
xor edx, edx
push 0xff005f00
lea ecx, [edx + 0x12]
call fcn.005d28c0
push eax
lea ecx, [ebp - 0x434]
call fcn.005c6510
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x434]
push 0
push esi
push edi
mov edi, dword [sym.imp.COMCTL32.dll_ImageList_Add]
call edi
push 0
push esi
mov esi, dword [ebp - 0x424]
push esi
call edi
push 0
push dword [ebp - 0x438]
push esi
call edi
push esi
push 2
push 0x1109
push dword [ebp - 0x404]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [ebp - 0x3e0]
mov ecx, edi
push 0
push str.SystemBooster
call fcn.0045f4d0
mov ecx, edi
call fcn.0045f300
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0xcc]
push dword [edi + 0x11c0]
movups xmmword [ebp - 0xcc], xmm0
push dword [ebp - 0x400]
movups xmmword [ebp - 0xbc], xmm0
push dword [ebp - 0x408]
call fcn.005b8800
push 1
push str.Cancel
sub esp, 8
mov byte [ebp - 4], 3
mov ecx, edi
push 0x46
push 0x1c2
push 0
push 0x62439c
call fcn.0043da60
mov ecx, eax
call fcn.005b64a0
cmp byte [ebx + 0x10], 0
je 0x4d9e2a
lea ecx, [edi + 0x1460]
call fcn.005dafe0
test eax, eax
mov dword [edi + 0x1f70], 0
mov ecx, 1
cmove eax, ecx
lea ecx, [edi + 0x1460]
mov dword [ebp - 0x3e8], eax
call fcn.005dc400
push 0
push 0xffffffffffffffba
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
test byte [ebp - 0x3e8], 1
je 0x4d9ca2
push str.Creating_a_system_restore_point...
push 0xffffffffffffffff
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
sub esp, 8
push 0
push ecx
push str.System_booster_auto_scan
lea ecx, [edi + 0x1290]
call fcn.00564a40
push 1
lea ecx, [edi + 0x14f0]
call fcn.005b6180
push 0
push 1
mov ecx, edi
call fcn.0043d720
test eax, eax
jne 0x4d9e1e
test byte [ebp - 0x3e8], 2
je 0x4d9cd6
lea ecx, [edi + 0x1290]
call fcn.0055ec70
push 0
push 1
mov ecx, edi
call fcn.0043d720
test eax, eax
jne 0x4d9e1e
test byte [ebp - 0x3e8], 4
je 0x4d9cfe
push eax
lea ecx, [edi + 0x1290]
call fcn.00546320
push 0
push 1
mov ecx, edi
call fcn.0043d720
test eax, eax
jne 0x4d9e1e
test byte [ebp - 0x3e8], 8
je 0x4d9d27
push 2
lea ecx, [edi + 0x1290]
call fcn.00579ce0
push 0
push 1
mov ecx, edi
call fcn.0043d720
test eax, eax
jne 0x4d9e1e
test byte [ebp - 0x3e8], 0x10
je 0x4d9d4f
push eax
lea ecx, [edi + 0x1290]
call fcn.00563140
push 0
push 1
mov ecx, edi
call fcn.0043d720
test eax, eax
jne 0x4d9e1e
test byte [ebp - 0x3e8], 0x20
je 0x4d9d76
lea ecx, [edi + 0x1290]
call fcn.00560bb0
push 0
push 1
mov ecx, edi
call fcn.0043d720
test eax, eax
jne 0x4d9e1e
test byte [ebp - 0x3e8], 0x40
je 0x4d9d9d
lea ecx, [edi + 0x1290]
call fcn.00560860
push 0
push 1
mov ecx, edi
call fcn.0043d720
test eax, eax
jne 0x4d9e1e
test byte [ebp - 0x3e8], 0x80
je 0x4d9dc0
lea ecx, [edi + 0x1290]
call fcn.00545cf0
push 0
push 1
mov ecx, edi
call fcn.0043d720
test eax, eax
jne 0x4d9e1e
test dword [ebp - 0x3e8], 0x100
je 0x4d9de7
push eax
lea ecx, [edi + 0x1290]
call fcn.00545770
push 0
push 1
mov ecx, edi
call fcn.0043d720
test eax, eax
jne 0x4d9e1e
test dword [ebp - 0x3e8], 0x200
je 0x4d9e0f
push 1
lea ecx, [edi + 0x1290]
call fcn.00571220
push 0
push 1
mov ecx, edi
call fcn.0043d720
test eax, eax
je 0x4d9e2a
mov byte [ebp - 0x3e2], 0
jmp 0x4db324
push str.Preparing_to_scan__please_wait...
push 0xffffffffffffffba
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push 0
lea ecx, [edi + 0x14f0]
call fcn.005b6220
push eax
push 0x5c6c90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [ebp - 0x410], esi
test esi, esi
jne 0x4d9e72
or esi, 0xffffffff
or eax, esi
mov dword [ebp - 0x410], eax
push 0x60
lea eax, [ebp - 0x3d8]
mov byte [ebp - 4], 4
push 0
push eax
call fcn.00420090
mov eax, dword [ebp - 0x428]
add esp, 0xc
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0x3f8]
push 0
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x3ec]
push 0
mov dword [ebp - 0x3c8], eax
lea eax, [ebp - 0x3d8]
push eax
push 0x4bc760
push 0
push 0
mov dword [ebp - 0x3d8], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
mov eax, dword [ebp - 0x410]
cmp eax, 0xffffffff
je 0x4d9eee
test eax, eax
je 0x4d9eee
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
test edi, edi
cmove edi, eax
xor edx, edx
mov ecx, edi
mov dword [ebp - 0x3dc], edi
call fcn.005cca30
mov esi, dword [ebp - 0x3e0]
test al, al
je 0x4d9f7c
nop
push 0
push 0
mov ecx, esi
call fcn.0043d720
test eax, eax
je 0x4d9f6f
cmp byte [ebp - 0x3cc], 0
jne 0x4d9f6f
sub esp, 8
mov ecx, esi
push 0x8c
push 0x190
push 0
push 0
push 1
push str.Are_you_sure_you_want_to_cancel_the_scan_
call fcn.0043e2e0
test eax, eax
jne 0x4d9f56
push 1
mov ecx, esi
call fcn.0043d8e0
jmp 0x4d9f6f
push str.Cancelling_the_scan__please_wait...
push 0xffffffffffffffff
lea ecx, [esi + 0x14f0]
mov byte [ebp - 0x3cc], 1
call fcn.005b66e0
xor edx, edx
mov ecx, edi
call fcn.005cca30
test al, al
jne 0x4d9f10
push 2
lea ecx, [esi + 0x14f0]
call fcn.005b6250
cmp byte [ebp - 0x3cc], 0
je 0x4d9fc7
cmp byte [ebx + 0x10], 0
jne 0x4d9fa1
cmp byte [esi + 0x11c9], 2
jne 0x4d9fc7
mov ecx, dword [ebp - 0x408]
push 1
push 0
call fcn.005c3f80
push 0
push 1
mov ecx, esi
call fcn.0043d720
mov byte [ebp - 0x3e2], 0
jmp 0x4db314
push 1
mov ecx, esi
call fcn.0043d8e0
test byte [ebx + 0x10], 2
je 0x4d9ff5
push 2
lea eax, [ebp - 0x3d8]
mov ecx, esi
push eax
call fcn.004d7bc0
mov dword [esi + 0x6c], eax
mov byte [ebp - 0x3e2], 0
jmp 0x4db314
xorps xmm0, xmm0
mov dword [ebp - 0x68], 0
lea ecx, [ebp - 0x70]
movq qword [ebp - 0x70], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x74], 0
lea ecx, [ebp - 0x7c]
movq qword [ebp - 0x7c], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 6
mov ecx, str.The_scan_completed_successfully.
cmp byte [ebp - 0x3cc], 0
mov eax, str.The_scan_was_cancelled.
push 1
cmove eax, ecx
lea ecx, [ebp - 0x70]
push eax
call fcn.005dc260
mov ecx, dword [ebp - 0x3c0]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test ecx, ecx
jne 0x4da070
push str._r_n_r_nNo_issues_found.
jmp 0x4da0ff
cmp ecx, 1
mov edx, str._items
mov eax, str._item
cmovne eax, edx
push eax
push ecx
lea ecx, [ebp - 0x7c]
call fcn.005db320
mov ecx, eax
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._found._r_n_r_n
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push 0x629230
lea ecx, [ebp - 0x70]
call fcn.005da780
test dword [ebx + 8], 0x1000
je 0x4da107
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._of_junk_size.
push ecx
push 0
push dword [ebp - 0x3b4]
lea ecx, [ebp - 0x7c]
push dword [ebp - 0x3b8]
call fcn.005daea0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x70]
call fcn.005da780
lea ecx, [esi + 0x1460]
mov dword [esi + 0x1f70], 0
call fcn.005dc400
mov esi, dword [ebp - 0x408]
mov ecx, esi
push 0x400
call fcn.005c4340
push 0
push 0x10800080
push 0x19
push 0xb9
push 0x23
push 0x2f3
push str.Find_an_item__CtrlF_
call fcn.005c0a40
push 0x909090
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x3f4], eax
call fcn.005bec70
movsd xmm0, qword [0x6edb08]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push 0
push ecx
push 0x190
push 0xffffffffffffffff
mov ecx, esi
call fcn.005beb10
push 0
push ecx
mov ecx, dword [ebp - 0x3e0]
mov dword [esp], 0x41500000
push str.Open_up_the_trees_context_menu
push 0x28
push 0x5a
push 0x41
push 0x2f3
push 0x86
push str.Tree_menu
call fcn.0045fd50
push 0
push ecx
mov ecx, dword [ebp - 0x3e0]
mov dword [esp], 0x41500000
push str.Find_next__F3_
push 0x28
push 0x5a
push 0x41
push 0x352
push 0x99
push str.Find_next
mov dword [ebp - 0x430], eax
call fcn.0045fd50
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x3e0]
test dword [eax + 0x1f68], 1
jne 0x4da225
sub esp, 8
lea ecx, [ebp - 0x70]
push 0x96
push 0x1c2
push 0
push esi
push 4
call fcn.005dc190
mov ecx, dword [ebp - 0x3e0]
push eax
call fcn.0043e2e0
push 0
push 0
push 0
push 0
push 0
push 0x62438c
push 0x629230
lea ecx, [ebp - 0x70]
call fcn.005da270
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x3e0]
push eax
call fcn.0045a700
push 0x48
call dword [sym.imp.USER32.dll_GetSystemMetrics]
movsd xmm0, qword [0x6edab8]
mov edx, eax
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x3f0], edx
comisd xmm0, xmmword [eax + 8]
jb 0x4da297
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp - 0x3f0]
mov ecx, eax
mov eax, dword [ebp - 0x3e0]
or ecx, 0xff000000
jmp 0x4da299
xor ecx, ecx
push ecx
push edx
push edx
mov dword [ebp - 0x64], ecx
mov ecx, eax
push 0x8b
call fcn.00436420
push eax
lea ecx, [ebp - 0x370]
call fcn.005c6520
mov byte [ebp - 4], 7
mov ecx, esi
push dword [ebp - 0x370]
push str.Item_properties_tCtrlEnter
push dword [ebp - 0x3ec]
call fcn.005c1450
push 0
push eax
push dword [ebp - 0x3ec]
mov ecx, esi
mov dword [ebp - 0x3e8], eax
call fcn.005c56e0
push eax
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
push dword [ebp - 0x64]
mov eax, dword [ebp - 0x3f0]
mov ecx, dword [ebp - 0x3e0]
push eax
push eax
push 0x72
call fcn.00436420
push eax
lea ecx, [ebp - 0x378]
call fcn.005c6520
push 0
mov byte [ebp - 4], 8
mov ecx, esi
push dword [ebp - 0x378]
push 0
push 0x32
push str.Delete_selected_items_tCtrlDel
push dword [ebp - 0x3e8]
call fcn.005c0400
push dword [ebp - 0x64]
mov ecx, dword [ebp - 0x3e0]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x3f0]
push eax
push eax
push 0xac
call fcn.00436420
push eax
lea ecx, [ebp - 0x36c]
call fcn.005c6520
push 0
mov byte [ebp - 4], 9
mov ecx, esi
push dword [ebp - 0x36c]
push 0
push 0x32
push str.Open_item_location_tCtrlO
push dword [ebp - 0x3e8]
call fcn.005c0400
push dword [ebp - 0x64]
mov ecx, dword [ebp - 0x3e0]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x3f0]
push eax
push eax
push 0x7c
call fcn.00436420
push eax
lea ecx, [ebp - 0x368]
call fcn.005c6520
push 0
mov byte [ebp - 4], 0xa
push dword [ebp - 0x368]
push 0
push 0x32
push str.Google_selected_item_tCtrlG
push dword [ebp - 0x3e8]
mov ecx, esi
call fcn.005c0400
push 0
push 0
push 8
push 0x32
push 0
push dword [ebp - 0x3e8]
mov ecx, esi
mov dword [ebp - 0x410], eax
call fcn.005c0400
push dword [ebp - 0x64]
mov eax, dword [ebp - 0x3f0]
mov ecx, dword [ebp - 0x3e0]
push eax
push eax
push 0x99
call fcn.00436420
push eax
lea ecx, [ebp - 0x364]
call fcn.005c6520
push 0
mov byte [ebp - 4], 0xb
mov ecx, esi
push dword [ebp - 0x364]
push 0
push 0x32
push str.Start_a_new_scan_tCtrlS
push dword [ebp - 0x3e8]
call fcn.005c0400
push dword [ebp - 0x64]
mov ecx, dword [ebp - 0x3e0]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x3f0]
push eax
push eax
push 0x98
call fcn.00436420
push eax
lea ecx, [ebp - 0x360]
call fcn.005c6520
push 0
mov byte [ebp - 4], 0xc
mov ecx, esi
push dword [ebp - 0x360]
push 0
push 0x32
push str.Export_to_text_file_tCtrlE
push dword [ebp - 0x3e8]
call fcn.005c0400
push 0
push 0
push 8
push 0x32
push 0
push dword [ebp - 0x3e8]
mov ecx, esi
mov dword [ebp - 0x40c], eax
call fcn.005c0400
push dword [ebp - 0x64]
mov eax, dword [ebp - 0x3f0]
mov ecx, dword [ebp - 0x3e0]
push eax
push eax
push 0x9e
call fcn.00436420
push eax
lea ecx, [ebp - 0x35c]
call fcn.005c6520
push 0
mov byte [ebp - 4], 0xd
push dword [ebp - 0x35c]
push 0
push 0x32
push str.Never_list_this_item_again_tCtrlI
push dword [ebp - 0x3e8]
mov ecx, esi
call fcn.005c0400
push dword [ebp - 0x64]
mov ecx, dword [ebp - 0x3e0]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x3f0]
push eax
push eax
push 0x94
call fcn.00436420
push eax
lea ecx, [ebp - 0x374]
call fcn.005c6520
push 0
mov byte [ebp - 4], 0xe
mov ecx, esi
push dword [ebp - 0x374]
push 0
push 0x32
push str.Reset_ignore_list_tAltI
push dword [ebp - 0x3e8]
call fcn.005c0400
mov ecx, dword [ebp - 0x3e0]
push 0
mov dword [ebp - 0x428], eax
call fcn.0045f170
mov edx, eax
mov byte [ebp - 0x60], 1
mov eax, 0x1b
mov dword [ebp - 0x440], edx
mov word [ebp - 0x5e], ax
mov eax, dword [ebp - 0x3e0]
mov byte [ebp - 0x5a], 1
mov byte [ebp - 0x54], 1
mov byte [ebp - 0x4e], 9
movzx ecx, word [eax + 0x11c0]
mov word [ebp - 0x5c], cx
mov ecx, 0x70
mov word [ebp - 0x58], cx
movzx ecx, word [eax + 0x11bc]
mov eax, 0x72
mov word [ebp - 0x52], ax
mov eax, dword [ebp - 0x3fc]
mov word [ebp - 0x50], ax
mov eax, 0x46
mov word [ebp - 0x4c], ax
mov eax, 0xd
mov word [ebp - 0x46], ax
mov eax, dword [ebp - 0x3e8]
mov word [ebp - 0x44], ax
mov eax, 0x2e
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x414]
mov word [ebp - 0x3e], ax
mov eax, 0x4f
mov word [ebp - 0x3a], ax
mov eax, dword [ebp - 0x42c]
mov word [ebp - 0x38], ax
mov eax, 0x47
mov word [ebp - 0x34], ax
mov eax, dword [ebp - 0x410]
mov word [ebp - 0x32], ax
mov eax, 0x53
mov word [ebp - 0x2e], ax
mov eax, dword [ebp - 0x424]
mov word [ebp - 0x2c], ax
mov eax, 0x45
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x40c]
mov word [ebp - 0x56], cx
mov word [ebp - 0x4a], dx
mov byte [ebp - 0x48], 9
mov byte [ebp - 0x42], 9
mov byte [ebp - 0x3c], 9
mov byte [ebp - 0x36], 9
mov byte [ebp - 0x30], 9
mov byte [ebp - 0x2a], 9
mov word [ebp - 0x26], ax
mov eax, dword [ebp - 0x41c]
mov ecx, 0x49
mov word [ebp - 0x22], cx
mov word [ebp - 0x20], ax
mov eax, dword [ebp - 0x428]
mov word [ebp - 0x1c], cx
lea ecx, [ebp - 0xcc]
mov byte [ebp - 0x24], 9
mov byte [ebp - 0x1e], 0x11
mov word [ebp - 0x1a], ax
call fcn.005b8600
push 0xc
lea eax, [ebp - 0x60]
mov ecx, esi
push eax
call fcn.005c47a0
cmp dword [ebp - 0x3c0], 0
jne 0x4da6f1
push 0x40
push dword [ebp - 0x400]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x414]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x41c]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x420]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x40c]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x3f4]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x3fc]
mov ecx, esi
call fcn.005bd3f0
push dword [ebp - 0x3fc]
mov ecx, esi
mov dword [ebp - 0x3f0], 0
call fcn.005c4370
mov ecx, dword [ebp - 0x3e0]
push 0
call fcn.004771c0
test eax, eax
je 0x4db29a
nop dword [eax]
mov eax, dword [ebp - 0x3e0]
lea ecx, [ebp - 0x358]
mov edx, dword [eax + 0x14d8]
cmp edx, ecx
jne 0x4da75a
cmp dword [eax + 0x14a8], 0xfffffff5
jne 0x4da75a
mov ecx, dword [ebp - 0x400]
mov edx, esi
mov dword [eax + 0x14d8], esi
mov dword [eax + 0x14a8], ecx
mov byte [ebp - 0x3e1], 0
mov ecx, dword [eax + 0x14a8]
cmp ecx, 0xfffffffa
je 0x4db29a
cmp edx, esi
jne 0x4db289
mov edx, dword [ebp - 0x3f4]
cmp ecx, 0xffffffb3
jne 0x4da784
cmp dword [eax + 0x14b4], edx
je 0x4da790
cmp ecx, dword [ebp - 0x440]
jne 0x4da834
mov ecx, eax
call fcn.0046c220
push 0x80
push dword [ebp - 0x3f4]
mov ecx, esi
call fcn.005bd3f0
push dword [ebp - 0x3f4]
mov ecx, esi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x70]
call fcn.005dc1c0
push str.Find_an_item__CtrlF_
lea ecx, [ebp - 0x70]
call fcn.005dc4c0
mov ecx, esi
test al, al
je 0x4da81b
push 0
push 0
push dword [ebp - 0x3f4]
call fcn.005bcd30
push 0
push dword [ebp - 0x3f4]
mov ecx, esi
call fcn.005bec70
movsd xmm0, qword [0x6edb20]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push 0
push ecx
push 0x190
push dword [ebp - 0x3f4]
mov ecx, esi
call fcn.005beb10
jmp 0x4db283
push 0xffffffffffffffff
push 0
push 0xb1
push dword [ebp - 0x3f4]
call fcn.005befd0
jmp 0x4db283
cmp ecx, 0xffffffb4
jne 0x4da921
cmp dword [eax + 0x14b4], edx
jne 0x4da921
push edx
mov ecx, esi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x70]
call fcn.005dc1c0
lea ecx, [ebp - 0x70]
call fcn.005dc3a0
cmp eax, 3
jl 0x4db283
cmp dword [ebp - 0x3f0], 0
jne 0x4da889
push 0
push 9
push 0x110a
push dword [ebp - 0x404]
call dword [sym.imp.USER32.dll_SendMessageW]
push ecx
lea ecx, [ebp - 0x70]
call fcn.005dc190
push eax
push 0
push dword [ebp - 0x3ec]
mov ecx, esi
call fcn.005ba1b0
mov dword [ebp - 0x3f0], eax
test eax, eax
je 0x4da8e8
push eax
push 9
push 0x110b
push dword [ebp - 0x404]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x3f0]
push 0
push 0x1114
push dword [ebp - 0x404]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x3f0], 0
jmp 0x4db283
push 0x80
push dword [ebp - 0x3f4]
mov ecx, esi
call fcn.005bd3f0
mov ecx, dword [ebp - 0x3e0]
sub esp, 8
push 0x8c
push 0x190
push 0
push esi
push 4
push str.Find_reached_the_end_of_the_list.
call fcn.0043e2e0
jmp 0x4db283
cmp ecx, dword [ebp - 0x3fc]
jne 0x4da9f3
push edx
mov ecx, esi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x70]
call fcn.005dc1c0
push str.Find_an_item__CtrlF_
lea ecx, [ebp - 0x70]
call fcn.005dc4c0
test al, al
jne 0x4da9d8
lea ecx, [ebp - 0x70]
call fcn.005dbeb0
test al, al
jne 0x4da9d8
call fcn.005dbeb0
test al, al
jne 0x4db283
push ecx
call fcn.005dc190
push eax
push dword [ebp - 0x3f0]
mov ecx, esi
push dword [ebp - 0x3ec]
call fcn.005ba1b0
mov dword [ebp - 0x3f0], eax
test eax, eax
je 0x4da8e8
push eax
push 9
push 0x110b
push dword [ebp - 0x404]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x3f0]
push 0
push 0x1114
push dword [ebp - 0x404]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x80
push dword [ebp - 0x3ec]
mov ecx, esi
call fcn.005bd3f0
jmp 0x4db283
push 0
push 0
push 0x201
push dword [ebp - 0x440]
mov ecx, esi
call fcn.005befd0
jmp 0x4db283
mov edx, dword [ebp - 0x3ec]
cmp ecx, 0xffffffeb
jne 0x4daa19
cmp dword [eax + 0x14b4], edx
jne 0x4daa19
push dword [ebp - 0x3f4]
mov ecx, eax
push edx
call fcn.0043e280
jmp 0x4db283
cmp byte [ebp - 0x3e1], 1
jne 0x4daa41
cmp ecx, 0xffffff31
jne 0x4daa41
lea ecx, [ebp - 0xe8]
call fcn.005d05f0
mov byte [ebp - 0x3e1], 2
jmp 0x4db283
mov dword [ebp - 0x3f8], ecx
cmp ecx, 0xffffffea
jne 0x4daa54
cmp dword [eax + 0x14b4], edx
je 0x4daa60
cmp ecx, dword [ebp - 0x430]
jne 0x4dabc0
cmp ecx, dword [ebp - 0x430]
jne 0x4daaac
push dword [ebp - 0x404]
call dword [sym.imp.USER32.dll_SetFocus]
cmp byte [ebp - 0x3e1], 2
jne 0x4daaa5
xorps xmm1, xmm1
lea ecx, [ebp - 0xe8]
call fcn.005d05a0
movsd xmm1, qword [0x6edb98]
comisd xmm1, xmm0
jbe 0x4daaa5
mov byte [ebp - 0x3e1], 0
jmp 0x4db283
mov byte [ebp - 0x3e1], 1
push 0
push 9
push dword [ebp - 0x3ec]
mov ecx, esi
call fcn.005ba020
test eax, eax
je 0x4daad3
push eax
push 3
push dword [ebp - 0x3ec]
mov ecx, esi
call fcn.005ba020
jmp 0x4daad5
xor eax, eax
mov ecx, dword [ebp - 0x408]
test eax, eax
mov eax, 0x20
mov esi, 0x40
cmovne esi, eax
push esi
push dword [ebp - 0x3e8]
call fcn.005bd3f0
mov ecx, dword [ebp - 0x408]
push esi
push dword [ebp - 0x42c]
call fcn.005bd3f0
mov ecx, dword [ebp - 0x408]
push esi
push dword [ebp - 0x410]
call fcn.005bd3f0
push esi
push dword [ebp - 0x41c]
mov esi, dword [ebp - 0x408]
mov ecx, esi
call fcn.005bd3f0
cmp dword [ebp - 0x3c0], 0
mov ecx, 0x20
mov eax, 0x40
cmovne eax, ecx
mov ecx, esi
push eax
push dword [ebp - 0x40c]
call fcn.005bd3f0
mov eax, dword [ebp - 0x430]
cmp dword [ebp - 0x3f8], eax
jne 0x4daba4
lea ecx, [ebp - 0xac]
push ecx
push eax
mov ecx, esi
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x4daba4
mov eax, dword [ebp - 0xa8]
mov ecx, 8
mov edx, dword [ebp - 0xac]
add eax, 0x2d
push eax
add edx, 0x5a
push edx
push ecx
push dword [ebp - 0x3ec]
mov ecx, esi
call fcn.005bbfd0
jmp 0x4db283
or edx, 0xffffffff
xor ecx, ecx
or eax, edx
push eax
push edx
push ecx
push dword [ebp - 0x3ec]
mov ecx, esi
call fcn.005bbfd0
jmp 0x4db283
cmp ecx, dword [ebp - 0x400]
je 0x4db18b
cmp ecx, dword [ebp - 0x414]
je 0x4db18b
cmp ecx, dword [ebp - 0x41c]
jne 0x4dadc6
push 0
push 9
push edx
mov ecx, esi
call fcn.005ba020
mov dword [ebp - 0x3f8], eax
test eax, eax
je 0x4db283
push eax
push 3
push dword [ebp - 0x3ec]
mov ecx, esi
call fcn.005ba020
mov dword [ebp - 0x418], eax
test eax, eax
je 0x4db283
push eax
lea eax, [ebp - 0x3d8]
push eax
call fcn.004d73e0
mov dword [ebp - 0x444], eax
cmp eax, 0xffffffff
je 0x4db283
push dword [ebp - 0x3f8]
mov ecx, esi
push dword [ebp - 0x3ec]
call fcn.005ba070
push eax
lea ecx, [ebp - 0x70]
call fcn.005dc1c0
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x4db283
push 0
push 0xffffffffffffffff
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backupsSystemBoosterSkipList
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], 0
call fcn.005d6a80
push 0
push 0x62439c
push 1
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x10
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005d5f20
test al, al
jne 0x4dacae
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xe
call fcn.005d69e0
jmp 0x4db283
mov ecx, dword [ebp - 0x3e0]
lea eax, [ebp - 0x3d8]
push 1
push dword [ebp - 0x444]
push dword [ebp - 0x3f8]
push eax
call fcn.004d7880
test al, al
jne 0x4dace3
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xe
call fcn.005d69e0
jmp 0x4db283
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627930
sub esp, 0xc
lea ecx, [ebp - 0x70]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
push dword [ebp - 0x3bc]
lea ecx, [ebp - 0x7c]
call fcn.005db320
mov ecx, eax
call fcn.005da510
mov ecx, eax
call fcn.005da780
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push dword [ebp - 0x418]
mov ecx, esi
push dword [ebp - 0x3c8]
call fcn.005b99d0
cmp dword [ebp - 0x3c0], 0
jne 0x4dadb5
push 0x40
push dword [ebp - 0x400]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x414]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x420]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x40c]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x3f4]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x3fc]
mov ecx, esi
call fcn.005bd3f0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xe
call fcn.005d69e0
jmp 0x4db283
cmp ecx, dword [ebp - 0x428]
jne 0x4dae62
push 0x1d
push dword [eax + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0x9c]
push dword [ebp - 0x3fc]
movups xmmword [ebp - 0x9c], xmm0
push dword [ebp - 0x400]
movups xmmword [ebp - 0x8c], xmm0
push esi
call fcn.005b8800
mov ecx, dword [ebp - 0x3e0]
sub esp, 8
mov byte [ebp - 4], 0x11
push 0x8c
push 0x190
push 0
push esi
push 1
push str.This_will_clear_the_list_of_items_to_skip_during_the_scan._r_n_r_nAe_you_sure_you_want_to_proceed_
call fcn.0043e2e0
test eax, eax
je 0x4db274
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backupsSystemBoosterSkipList
call fcn.0043c390
mov ecx, dword [ebp - 0x3e0]
sub esp, 8
push 0x8c
push 0x190
push 0
push esi
push 4
push str.The_list_of_items_to_skip_was_successfully_reset._r_nPlease_scan_again_to_show_skipped_items.
call fcn.0043e2e0
jmp 0x4db274
cmp ecx, dword [ebp - 0x420]
je 0x4db133
cmp ecx, dword [ebp - 0x3e8]
je 0x4db133
cmp ecx, 0xfffffff2
jne 0x4dae8b
cmp dword [eax + 0x14b4], edx
je 0x4db133
cmp ecx, dword [ebp - 0x448]
je 0x4db37f
cmp ecx, dword [ebp - 0x424]
je 0x4db37f
cmp ecx, dword [eax + 0x11c0]
je 0x4db376
cmp ecx, dword [ebp - 0x42c]
jne 0x4daff2
push 0
push 9
push edx
mov ecx, esi
call fcn.005ba020
mov dword [ebp - 0x418], eax
test eax, eax
je 0x4db283
push eax
push 3
push dword [ebp - 0x3ec]
mov ecx, esi
call fcn.005ba020
test eax, eax
je 0x4db283
push eax
lea eax, [ebp - 0x3d8]
push eax
call fcn.004d73e0
cmp eax, 0xffffffff
je 0x4db283
cmp eax, 0xd
jge 0x4daf56
push dword [ebp - 0x418]
mov ecx, esi
push dword [ebp - 0x3ec]
call fcn.005ba070
push eax
lea ecx, [ebp - 0x70]
call fcn.005dc1c0
push 0
push 1
push 0xffffffffffffffff
push 1
push 0x68fb68
lea ecx, [ebp - 0x70]
call fcn.005daa70
dec eax
lea ecx, [ebp - 0x70]
push eax
call fcn.005dae00
lea ecx, [ebp - 0x70]
call fcn.005dc190
push eax
call fcn.0043bf00
jmp 0x4db283
mov eax, dword [ebp - 0x3e0]
add eax, 0x1290
mov ecx, eax
mov dword [ebp - 0x64], eax
call fcn.00553420
test eax, eax
je 0x4daf7d
push ecx
mov ecx, dword [ebp - 0x64]
push 0x62439c
call fcn.00571730
mov eax, dword [ebp - 0x3e0]
push 5
mov ecx, dword [eax + 0x24]
movsd xmm0, qword [eax + 8]
comisd xmm0, xmmword [0x6edab8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
jb 0x4dafcf
push str._rstrui.exe
push ecx
lea ecx, [ebp - 0x70]
call fcn.005dc200
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x64]
push eax
call fcn.00579420
jmp 0x4db283
push str.Restore_rstrui.exe
push ecx
lea ecx, [ebp - 0x70]
call fcn.005dc200
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x64]
push eax
call fcn.00579420
jmp 0x4db283
cmp ecx, dword [ebp - 0x410]
jne 0x4db108
push 0
push 9
push edx
mov ecx, esi
call fcn.005ba020
mov dword [ebp - 0x418], eax
test eax, eax
je 0x4db283
push eax
push 3
push dword [ebp - 0x3ec]
mov ecx, esi
call fcn.005ba020
test eax, eax
je 0x4db283
push eax
lea eax, [ebp - 0x3d8]
push eax
call fcn.004d73e0
mov dword [ebp - 0x3f8], eax
cmp eax, 0xffffffff
je 0x4db283
push dword [ebp - 0x418]
mov ecx, esi
push dword [ebp - 0x3ec]
call fcn.005ba070
push eax
lea ecx, [ebp - 0x70]
call fcn.005dc1c0
cmp dword [ebp - 0x3f8], 0xd
lea ecx, [ebp - 0x70]
push 0
push 1
push 0xffffffffffffffff
push 1
jge 0x4db0ac
push 0x68fb68
call fcn.005daa70
dec eax
lea ecx, [ebp - 0x70]
push eax
call fcn.005dae00
xor eax, eax
mov ecx, 2
cmp dword [ebp - 0x3f8], 0xc
cmove eax, ecx
mov dword [ebp - 0x3f8], eax
lea eax, [ebp - 0x70]
jmp 0x4db0ea
push 0x62d7ec
mov dword [ebp - 0x3f8], 2
call fcn.005daa70
dec eax
lea ecx, [ebp - 0x70]
push eax
push 0
push 1
push 0xffffffffffffffff
push 1
push 0x68fb68
call fcn.005daa70
add eax, 4
lea ecx, [ebp - 0x70]
push eax
call fcn.005dad50
mov ecx, eax
call fcn.005dae00
mov ecx, eax
call fcn.005dc190
push dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x3e0]
push eax
call fcn.0045ee00
jmp 0x4db283
cmp ecx, dword [ebp - 0x40c]
jne 0x4db289
lea ecx, [ebp - 0x3d8]
push ecx
mov ecx, eax
call fcn.004d7410
push dword [ebp - 0x43c]
call dword [sym.imp.USER32.dll_BringWindowToTop]
jmp 0x4db283
push 0x1d
push dword [eax + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0x9c]
push dword [ebp - 0x3fc]
movups xmmword [ebp - 0x9c], xmm0
push dword [ebp - 0x400]
movups xmmword [ebp - 0x8c], xmm0
push esi
call fcn.005b8800
mov ecx, dword [ebp - 0x3e0]
lea eax, [ebp - 0x3d8]
push eax
mov byte [ebp - 4], 0x12
call fcn.004d80a0
push dword [ebp - 0x43c]
call dword [sym.imp.USER32.dll_BringWindowToTop]
jmp 0x4db274
push 0
push ecx
mov ecx, eax
call fcn.00477170
test al, al
mov eax, dword [ebp - 0x3e0]
je 0x4db289
push 0x1d
push dword [eax + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0x9c]
push dword [ebp - 0x3fc]
movups xmmword [ebp - 0x9c], xmm0
push dword [ebp - 0x400]
movups xmmword [ebp - 0x8c], xmm0
push esi
call fcn.005b8800
push 4
push dword [ebp - 0x44c]
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 0xf
call fcn.005bc500
xor ecx, ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x3e0]
sbb eax, eax
neg eax
push eax
lea eax, [ebp - 0x3d8]
push eax
call fcn.004d7bc0
lea ecx, [ebp - 0x9c]
call fcn.005b8600
cmp dword [ebp - 0x3c0], 0
jne 0x4db274
push 0x40
push dword [ebp - 0x400]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x414]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x420]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x40c]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x3f4]
mov ecx, esi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x3fc]
mov ecx, esi
call fcn.005bd3f0
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0xe
call fcn.005b8790
mov eax, dword [ebp - 0x3e0]
push 0
mov ecx, eax
call fcn.004771c0
test eax, eax
jne 0x4da720
mov ecx, dword [ebp - 0x3e0]
push 0
push str.SystemBooster
call fcn.0045f380
lea ecx, [ebp - 0x374]
call fcn.005c6500
lea ecx, [ebp - 0x35c]
call fcn.005c6500
lea ecx, [ebp - 0x360]
call fcn.005c6500
lea ecx, [ebp - 0x364]
call fcn.005c6500
lea ecx, [ebp - 0x368]
call fcn.005c6500
lea ecx, [ebp - 0x36c]
call fcn.005c6500
lea ecx, [ebp - 0x378]
call fcn.005c6500
lea ecx, [ebp - 0x370]
call fcn.005c6500
lea ecx, [ebp - 0x7c]
call fcn.005dc430
lea ecx, [ebp - 0x70]
call fcn.005dc430
cmp edi, 0xffffffff
je 0x4db324
test edi, edi
je 0x4db324
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xcc]
call fcn.005b8790
lea ecx, [ebp - 0x434]
call fcn.005c6500
lea ecx, [ebp - 0x438]
call fcn.005c6500
lea ecx, [ebp - 0x358]
call fcn.005c1c60
mov al, byte [ebp - 0x3e2]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
mov byte [ebp - 0x3e2], 1
jmp 0x4db386
mov byte [ebp - 0x3e2], 0xe
push 0
mov ecx, eax
push str.SystemBooster
call fcn.0045f380
cmp byte [ebp - 0x3e2], 0
mov ecx, dword [ebp - 0x3e0]
sete al
movzx eax, al
push eax
call fcn.0045f260
jmp 0x4db2ac