Function at 0x4877d0
Capabilities:
Check if file exists
Create process on windows
Execute command
Get common file path
Get file attributes
Get hostname
Get proxy
Move file
Persist via app paths registry key
Persist via windows accessibility tools
Query or enumerate registry value
Schedule task via at
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a479e
mov eax, dword fs:[0]
push eax
sub esp, 0x5c8
mov eax, dword [0x4e3ec8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x570]
xor esi, esi
push eax
mov ecx, ebx
mov dword [ebp - 0x5b0], edi
mov dword [ebp - 0x588], ebx
mov dword [ebp - 0x57c], esi
call fcn.00420330
lea ecx, [ebp - 0x574]
push ecx
mov ecx, ebx
mov dword [ebp - 4], esi
call fcn.00448330
lea ecx, [ebp - 0x59c]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push esi
push str.Microsoft_Office
lea ecx, [ebp - 0x570]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x4879c5
push esi
push str.Program_Files__x86_
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
lea edx, [ebp - 0x570]
test eax, eax
jns 0x4878da
push edx
lea ecx, [ebp - 0x59c]
call dword [sym.imp.mfc100.dll_Ordinal_1313]
push str.Program_Files__x86_
push str.Program_Files
lea ecx, [ebp - 0x59c]
call dword [sym.imp.mfc100.dll_Ordinal_11627]
push ecx
lea eax, [ebp - 0x59c]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
cmp al, 1
jne 0x487932
lea ecx, [ebp - 0x59c]
push ecx
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_1313]
jmp 0x4879c5
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x487932
push str.Program_Files
push str.Program_Files__x86_
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_11627]
push ecx
lea eax, [ebp - 0x570]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
cmp al, 1
je 0x4879c5
push 0x5c
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_11744]
lea ecx, [ebp - 0x570]
mov esi, eax
call dword [sym.imp.mfc100.dll_Ordinal_5207]
sub eax, esi
dec eax
push eax
lea ecx, [ebp - 0x568]
push ecx
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_11781]
lea edx, [ebp - 0x564]
push edx
mov byte [ebp - 4], 3
call fcn.00485130
lea ecx, [ebp - 0x568]
push ecx
push eax
lea edx, [ebp - 0x56c]
push edx
mov byte [ebp - 4], 4
call fcn.004018e0
add esp, 0x10
push eax
lea ecx, [ebp - 0x570]
mov byte [ebp - 4], 5
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x5b4]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push 0
push str.Microsoft_Office
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 6
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x487b31
push 0
push 0x4c2160
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x487ae2
push ecx
lea eax, [ebp - 0x574]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x487ad6
push 0
push str.Program_Files__x86_
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x487ad6
push str.Program_Files
push str.Program_Files__x86_
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_11627]
push ecx
lea edx, [ebp - 0x574]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x487ad6
lea eax, [ebp - 0x568]
push eax
call fcn.00485130
push str.OUTLOOK.EXE
push eax
lea ecx, [ebp - 0x56c]
push ecx
mov byte [ebp - 4], 7
call fcn.004019e0
add esp, 0x10
push eax
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 8
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 6
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0x4ae26b
push str.OUTLOOK.EXE
jmp 0x487b25
push 0
push str.Program_Files__x86_
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x487b31
push ecx
lea edx, [ebp - 0x574]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x487b31
push str.Program_Files
push str.Program_Files__x86_
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_11627]
push 0
push str.SysWOW64
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x487bcc
push ecx
lea eax, [ebp - 0x570]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x487bcc
lea ecx, [ebp - 0x570]
push ecx
lea ecx, [ebp - 0x59c]
call dword [sym.imp.mfc100.dll_Ordinal_1313]
push str.System32
push str.SysWOW64
lea ecx, [ebp - 0x59c]
call dword [sym.imp.mfc100.dll_Ordinal_11627]
push ecx
lea edx, [ebp - 0x59c]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
cmp al, 1
jne 0x487bcc
lea eax, [ebp - 0x59c]
push eax
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_1313]
push 0
push str.mlcfg32.cpl
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
jle 0x487c45
push ecx
lea edx, [ebp - 0x570]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.004853b0
add esp, 4
push str.success
mov ecx, edi
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x5b4]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x59c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov eax, edi
jmp 0x48c5ee
push str.rundirectmailcfg
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x487d44
lea eax, [ebp - 0x5b0]
push eax
call fcn.00485130
push str.MLCFG32.CPL
push eax
lea ecx, [ebp - 0x58c]
push ecx
mov byte [ebp - 4], 9
call fcn.004019e0
add esp, 0x10
lea ecx, [ebp - 0x5b0]
mov byte [ebp - 4], 0xb
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea edx, [ebp - 0x58c]
push edx
lea eax, [ebp - 0x56c]
push 0x22
push eax
call fcn.00448d30
push 0x22
push eax
lea ecx, [ebp - 0x564]
push ecx
mov byte [ebp - 4], 0xc
call fcn.004223c0
add esp, 0x18
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 0xe
call dword [sym.imp.mfc100.dll_Ordinal_901]
push str.control.exe
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 1
push 0
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 0xf
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str.success
mov ecx, edi
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x58c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
jmp 0x487c0e
push str.displayswitch
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
test eax, eax
jne 0x487ed6
push str.C:WindowsSystem32DisplaySwitch.exe
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 0
push ecx
lea edx, [ebp - 0x568]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
mov byte [ebp - 4], 0x10
call dword [sym.imp.mfc100.dll_Ordinal_300]
lea eax, [ebp - 0x56c]
push eax
call fcn.0047d270
add esp, 0xc
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_901]
xor edi, edi
push edi
push str..cpl
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x487e3c
lea eax, [ebp - 0x570]
push eax
lea ecx, [ebp - 0x568]
push 0x22
push ecx
call fcn.00448d30
push 0x22
push eax
lea edx, [ebp - 0x56c]
push edx
mov byte [ebp - 4], 0x19
call fcn.004223c0
add esp, 0x18
push eax
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0x1a
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 6
call dword [sym.imp.mfc100.dll_Ordinal_901]
push str.control.exe
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push str.regdelete
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x487e6f
push ecx
lea eax, [ebp - 0x574]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.0047a6c0
add esp, 4
push str.openlyncTraceLocation
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x488271
push ecx
lea edx, [ebp - 0x570]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
lea eax, [ebp - 0x574]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push eax
mov byte [ebp - 4], 0x1b
call dword [sym.imp.mfc100.dll_Ordinal_300]
lea ecx, [ebp - 0x56c]
push ecx
mov byte [ebp - 4], 6
call fcn.0047bfa0
add esp, 0xc
lea ecx, [ebp - 0x56c]
jmp 0x48c5a3
push str.openPrinterdialog
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x487f78
lea ecx, [ebp - 0x584]
push ecx
call fcn.00479050
add esp, 4
push str.printerdialog.txt
lea ecx, [ebp - 0x584]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc100.dll_Ordinal_1483]
push 0x4aed30
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x487f43
push edi
push str.RUNDLL32.EXE_PRINTUI.DLL_PrintUIEntry__ip
call dword [sym.imp.MSVCR100.dll_fputs]
add esp, 8
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
push 5
push 0
push 0
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.open
push 0
call esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x584]
jmp 0x487db5
push str.runmailcfg
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x487dbb
lea edx, [ebp - 0x578]
push edx
call fcn.00485050
add esp, 4
mov byte [ebp - 4], 0x12
call fcn.004852f0
call fcn.00475490
test al, al
je 0x487fd8
push ecx
lea eax, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x48815a
push str.C:Program_Files__x86_Microsoft_OfficeOffice15MLCFG32.CPL
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push ecx
lea edx, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x48815a
push str.C:Program_Files__x86_Microsoft_OfficeOffice14MLCFG32.CPL
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push ecx
lea eax, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x48815a
push str.C:Program_Files__x86_Microsoft_OfficeOffice16MLCFG32.CPL
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push ecx
lea edx, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x48815a
push str.C:Program_FilesMicrosoft_Office_rootOffice16MLCFG32.CPL
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
call fcn.00475490
test al, al
je 0x4880bd
push ecx
lea eax, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x48815a
push str.C:Program_FilesMicrosoft_OfficeOffice15MLCFG32.CPL
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push ecx
lea edx, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x48815a
push str.C:Program_FilesMicrosoft_OfficeOffice14MLCFG32.CPL
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push ecx
lea eax, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x48815a
push str.C:Program_FilesMicrosoft_OfficeOffice16MLCFG32.CPL
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push ecx
lea edx, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
je 0x4881f4
lea eax, [ebp - 0x578]
push eax
lea ecx, [ebp - 0x56c]
push 0x22
push ecx
call fcn.00448d30
push 0x22
push eax
lea edx, [ebp - 0x564]
push edx
mov byte [ebp - 4], 0x13
call fcn.004223c0
add esp, 0x18
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 0x15
call dword [sym.imp.mfc100.dll_Ordinal_901]
push str.control.exe
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 1
push 0
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.open
push 0
call esi
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x578]
jmp 0x487db5
lea eax, [ebp - 0x5b0]
push eax
call fcn.00485130
push str.MLCFG32.CPL
push eax
lea ecx, [ebp - 0x568]
push ecx
mov byte [ebp - 4], 0x16
call fcn.004019e0
add esp, 0x10
lea ecx, [ebp - 0x5b0]
mov byte [ebp - 4], 0x18
call dword [sym.imp.mfc100.dll_Ordinal_901]
push ecx
lea edx, [ebp - 0x568]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.004853b0
add esp, 4
push str.success
mov ecx, edi
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_901]
jmp 0x487c0e
push str.ChangeProxySetting
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48848b
push str._8.8.8.8:8080
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea edx, [ebp - 0x598]
push edx
push 0x2001f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
mov byte [ebp - 4], 0x1c
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x48846f
cmp dword [ebp - 0x598], edi
je 0x48846f
mov ebx, 1
push str.ProxyOverride
lea ecx, [ebp - 0x568]
mov dword [ebp - 0x564], ebx
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x56c], 0x400
call dword [sym.imp.mfc100.dll_Ordinal_1448]
lea ecx, [ebp - 0x110]
push 3
mov dword [ebp - 0x114], ecx
push eax
lea ecx, [ebp - 0x114]
call fcn.00406470
mov ecx, dword [ebp - 0x114]
lea edx, [ebp - 0x56c]
push edx
mov edx, dword [ebp - 0x598]
lea eax, [ebp - 0x55c]
push eax
push edi
push edi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 0x110]
cmp eax, ecx
je 0x48836c
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
cmp esi, edi
jne 0x488383
lea edx, [ebp - 0x55c]
push edx
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_1315]
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_13125]
push edi
push str._local_
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
jns 0x4883b6
push str._local_
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_1483]
mov ecx, dword [ebp - 0x598]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x564]
push eax
push 4
push edi
push str.ProxyEnable
push ecx
call esi
push ebx
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_4498]
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_5207]
push eax
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
mov edx, dword [ebp - 0x598]
push eax
push ebx
push edi
push str.ProxyServer
push edx
call esi
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_5207]
push eax
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
mov eax, dword [ebp - 0x598]
push ebx
push edi
push str.ProxyOverride
push eax
call esi
mov edx, dword [ebp - 0x598]
push 4
lea ecx, [ebp - 0x564]
push ecx
push 4
push edi
push str.AutoDetect
push edx
mov dword [ebp - 0x564], ebx
call esi
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov eax, dword [ebp - 0x598]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x584]
jmp 0x48c5a3
push str.proxydialog
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x4884ec
push 0x4c8f8c
lea ecx, [ebp - 0x574]
xor bl, bl
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x4884b9
mov bl, 1
push 0
lea ecx, [ebp - 0x15c]
call fcn.00408c00
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 0x1f
mov byte [ebp - 0x24], bl
call sub.mfc100.dll_Ordinal_3620
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 6
call fcn.00408cb0
jmp 0x48c5a9
push str.AntiVirus
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x4885a4
push str.HDBFS
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48c5a9
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push str.AnakageProactive.exe
call dword [sym.imp.mfc100.dll_Ordinal_310]
call fcn.004766d0
add esp, 8
test al, al
jne 0x48c5a9
push str.c:WindowsIAssist
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 0x4c8f5c
lea ecx, [ebp - 0x568]
push ecx
lea edx, [ebp - 0x56c]
push edx
mov byte [ebp - 4], 0x20
call fcn.004019e0
add esp, 0xc
push 0
push 0
push str.action
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.open
push 0
call esi
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
jmp 0x48c59d
push str.PrinterDriver
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x488908
push str.C:Program_Files__x86_
lea ecx, [ebp - 0x58c]
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x58c]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
lea ecx, [ebp - 0x584]
setne bl
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push 0x4b170c
push str.C:WindowsiassistPrinterDriver.txt
mov byte [ebp - 4], 0x23
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x488757
push str.PassBook
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x4886a4
call fcn.00475490
test al, al
mov eax, str.Win10_
jne 0x488648
mov eax, str.Win7_
push eax
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
mov eax, str.64bit
test bl, bl
jne 0x488663
mov eax, str.32bit
push eax
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_1483]
push str.Compuprint_SP40Plus_P2
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
lea eax, [ebp - 0x588]
push eax
lea ecx, [ebp - 0x56c]
push str._SystemRoot_System32_rundll32.exe_printui.dll_PrintUIEntry__if__b__Compuprint_SP40Plus_P2___f__C:Follow_me_printingSpeed_40_Plus__Windows_driverCompuprint_Drivers_InstallationdriversCompuprint_SP40_SP40Plus_SP40PlusT_
push ecx
call fcn.00401a70
mov byte [ebp - 4], 0x24
push str.Sp40Plus.INF___r__USB001___m__Compuprint_SP40Plus_
jmp 0x48870a
push 0x4c8da8
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48874d
mov eax, str.WINX64
test bl, bl
jne 0x4886cb
mov eax, str.WINX86
push eax
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push str.EPSON_LQ_310_ESC_P2
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
lea eax, [ebp - 0x588]
push eax
lea ecx, [ebp - 0x56c]
push str._SystemRoot_System32_rundll32.exe_printui.dll_PrintUIEntry__if__b__EPSON_LQ_310_ESC_P2___f__C:Follow_me_printingDriversEpson_LQ_310_DD_PrinterDriverPrinter_
push ecx
call fcn.00401a70
mov byte [ebp - 4], 0x25
push str.EBSD053M.INF___r__USB002___m__EPSON_LQ_310_ESC_P2_
push eax
lea edx, [ebp - 0x568]
push edx
call fcn.004019e0
add esp, 0x18
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 0x23
call dword [sym.imp.mfc100.dll_Ordinal_901]
push esi
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.MSVCR100.dll_fputs]
add esp, 8
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_901]
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push 0x4ae26b
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x57c], esp
push 0x4c8ca4
mov byte [ebp - 4], 0x26
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 0x23
call fcn.00485a00
add esp, 8
mov ecx, esp
mov dword [ebp - 0x560], esp
push 0x4ae26b
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x57c], esp
push 0x4c8ca0
mov byte [ebp - 4], 0x27
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 0x23
call fcn.00485a00
add esp, 0xc
push 0
lea eax, [ebp - 0x584]
push eax
lea ecx, [ebp - 0x56c]
push str._SystemRoot_System32RUNDLL32_PRINTUI.DLL_PrintUIEntry__y__n__
push ecx
call fcn.00401a70
add esp, 8
mov edx, esp
mov dword [ebp - 0x560], esp
push 0x4aed8c
push eax
push edx
mov byte [ebp - 4], 0x28
call fcn.004019e0
lea eax, [ebp - 0x594]
add esp, 0xc
push eax
call fcn.0047d270
add esp, 0xc
mov bl, 0x2a
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push 0x4af974
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
mov ecx, esp
mov dword [ebp - 0x57c], esp
push str.installed_printer_is_making_to_default_failed
mov byte [ebp - 4], 0x2b
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], bl
call fcn.0047c140
lea ecx, [ebp - 0x564]
push ecx
call fcn.00474100
add esp, 0x10
mov bl, 0x2c
mov byte [ebp - 4], bl
push 0
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x4888c9
call fcn.00486b70
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push 0x4af974
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
mov ecx, esp
mov dword [ebp - 0x57c], esp
push str.installed_printer_is_now_default
mov byte [ebp - 4], 0x2d
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x58c]
jmp 0x48c5a3
push str.deletebrowsinghistory
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48896a
push str.sitel
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x488945
push edi
push 1
call fcn.00486340
push edi
push 1
call fcn.00486750
add esp, 0x10
call fcn.00475580
push edi
push 1
call fcn.00475630
push edi
push 1
call fcn.00486340
push edi
push 1
call fcn.00486750
add esp, 0x18
jmp 0x48c5a9
push str.ChangeProxyinMozilla
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x488b74
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push str.type__Appdata_MozillaFirefoxprofiles.ini
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea edx, [ebp - 0x578]
push edx
call fcn.0047d270
add esp, 0xc
push 0
mov bl, 0x2e
push 0x4b1625
lea ecx, [ebp - 0x578]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_4144]
push 0
push str.Default1
lea ecx, [ebp - 0x578]
mov edi, eax
call dword [sym.imp.mfc100.dll_Ordinal_4144]
sub eax, edi
push eax
lea eax, [ebp - 0x56c]
push eax
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_11781]
push eax
lea ecx, [ebp - 0x578]
mov byte [ebp - 4], 0x2f
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_5207]
add eax, 0xfffffff3
push eax
lea ecx, [ebp - 0x564]
push ecx
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_7487]
push eax
lea ecx, [ebp - 0x578]
mov byte [ebp - 4], 0x30
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea edx, [ebp - 0x58c]
push edx
call fcn.004810a0
push str.AnakageFilesVBScriptsEnableMozillaProxy.bat
push eax
lea eax, [ebp - 0x568]
push eax
mov byte [ebp - 4], 0x31
call fcn.004019e0
add esp, 0x10
lea ecx, [ebp - 0x58c]
mov byte [ebp - 4], 0x33
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x568]
push ecx
lea edx, [ebp - 0x594]
push 0x4b0194
push edx
call fcn.00401a70
push 0x4ae8b4
push eax
lea eax, [ebp - 0x588]
push eax
mov byte [ebp - 4], 0x34
call fcn.004019e0
push 0x4ae8b4
push eax
lea ecx, [ebp - 0x584]
push ecx
mov byte [ebp - 4], 0x35
call fcn.004019e0
push 0x4ae8b4
push eax
lea edx, [ebp - 0x564]
push edx
mov byte [ebp - 4], 0x36
call fcn.004019e0
lea ecx, [ebp - 0x578]
push ecx
push eax
lea edx, [ebp - 0x56c]
push edx
mov byte [ebp - 4], 0x37
call fcn.004018e0
add esp, 0x3c
push 0
push 0
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.cmd.exe
push str.open
push 0
call esi
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x578]
jmp 0x48c5a3
push str.SelectFolder
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x488c8f
push 0x103
mov byte [ebp - 0x114], al
lea eax, [ebp - 0x113]
push edi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x5d4]
lea ecx, [ebp - 0x114]
push edx
mov dword [ebp - 0x5d4], edi
mov dword [ebp - 0x5d0], edi
mov dword [ebp - 0x5cc], ecx
mov dword [ebp - 0x5c8], str.Please__select_a_folder
mov dword [ebp - 0x5c4], edi
mov dword [ebp - 0x5c0], edi
mov dword [ebp - 0x5bc], edi
mov dword [ebp - 0x5b8], 0xffffffff
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
cmp eax, edi
je 0x488c6f
lea ecx, [ebp - 0x114]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov bl, 0x38
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_13125]
push eax
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1313]
push ecx
lea eax, [ebp - 0x114]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 0x39
call sub.mfc100.dll_Ordinal_1929
mov ecx, dword [eax + 4]
mov byte [ebp - 4], bl
call fcn.00420000
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x564]
jmp 0x48c5a3
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push str.You_have_cancelled_the_process__Please_exit_the_solution_by_clicking_on_the_cross_Button
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov ecx, ebx
call fcn.00420480
jmp 0x48c5a9
push str.CreateRegKey
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x488edf
lea ecx, [ebp - 0x564]
push ecx
push 0xf003f
push edi
push str.SoftwareMicrosoftOffice16.0ExcelSecurity
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x580], edi
cmp eax, edi
jne 0x48c5a9
lea edx, [ebp - 0x56c]
push edx
mov edx, dword [ebp - 0x564]
lea eax, [ebp - 0x568]
push eax
lea ecx, [ebp - 0x598]
push ecx
push 0
push str.ExtensionHardening
push edx
mov dword [ebp - 0x568], 0
mov dword [ebp - 0x598], 4
mov dword [ebp - 0x56c], 0x3ff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x594]
mov esi, eax
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x58c]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push ecx
lea eax, [ebp - 0x594]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
mov byte [ebp - 4], 0x3c
call dword [sym.imp.mfc100.dll_Ordinal_300]
lea ecx, [ebp - 0x588]
push ecx
call fcn.004739c0
push str.Temp
lea edx, [ebp - 0x588]
push edx
lea eax, [ebp - 0x578]
mov bl, 0x3d
push eax
mov byte [ebp - 4], bl
call fcn.004019e0
add esp, 0x14
push eax
lea ecx, [ebp - 0x584]
mov byte [ebp - 4], 0x3e
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x578]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push str.BackupValue.txt
lea ecx, [ebp - 0x584]
push ecx
lea edx, [ebp - 0x590]
push edx
call fcn.004019e0
add esp, 0xc
push eax
lea ecx, [ebp - 0x58c]
mov byte [ebp - 4], 0x3f
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x590]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 1
push 0x40
push 2
lea ecx, [ebp - 0x58c]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp - 0xb8]
call fcn.0040ac40
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + eax - 0xac]
lea eax, [ebp + eax - 0xb8]
mov byte [ebp - 4], 0x40
and cl, 6
movsx edx, cl
neg edx
sbb edx, edx
not edx
test eax, edx
je 0x488e67
test esi, esi
jne 0x488e53
mov eax, dword [ebp - 0x568]
push eax
lea ecx, [ebp - 0xb8]
push str.The_Original_value_of_ExtensionHardening_is_:
push ecx
call fcn.00449f60
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
jmp 0x488e67
lea edx, [ebp - 0xb8]
push str.The_key_ExtensionHardening_is_not_present
push edx
call fcn.00449f60
add esp, 8
lea ecx, [ebp - 0xb8]
call fcn.0040abd0
mov ecx, dword [ebp - 0x564]
push 4
lea eax, [ebp - 0x580]
push eax
push 4
push 0
push str.ExtensionHardening
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x564]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], bl
call fcn.0040adf0
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x58c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x594]
jmp 0x48c5a3
push str.updateSymantec
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x488ff4
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x590]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea eax, [ebp - 0x580]
push eax
mov byte [ebp - 4], 0x43
call fcn.004810a0
push str.AnakageFilesVBScriptsSymantecLiveUpdate.bat
push eax
lea ecx, [ebp - 0x568]
push ecx
mov byte [ebp - 4], 0x44
call fcn.004019e0
add esp, 0x10
mov bl, 0x46
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push 0x4ae26b
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
lea edx, [ebp - 0x568]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push edx
mov byte [ebp - 4], 0x47
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov byte [ebp - 4], bl
call fcn.0047cff0
add esp, 0xc
call sub.mfc100.dll_Ordinal_1929
mov eax, dword [eax + 4]
cmp dword [eax + 0x140], 0
jne 0x488fc1
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push str.You_have_cancelled_the_process__so_problem_might_not_be_resolved._Please_contact_IT_Support_team.
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov ecx, dword [ebp - 0x588]
call fcn.00420480
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x590]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x564]
jmp 0x48c5a3
push str.CheckDefaultEmailAppIsOutlook
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x4890f2
lea ecx, [ebp - 0x580]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellAssociationsUrlAssociationsmailtoUserChoice
lea ecx, [ebp - 0x58c]
mov byte [ebp - 4], 0x48
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea eax, [ebp - 0x564]
push eax
lea ecx, [ebp - 0x58c]
push ecx
mov byte [ebp - 4], 0x4a
call fcn.0047a520
add esp, 8
lea edx, [ebp - 0x584]
push edx
push 0x20019
push edi
lea ecx, [ebp - 0x58c]
mov dword [ebp - 0x584], eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
mov eax, dword [ebp - 0x584]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x4890be
lea ecx, [ebp - 0x560]
push ecx
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x57c]
push eax
push 0xffff
push str.ProgId
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
mov ecx, dword [ebp - 0x584]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov edx, dword [ebp - 0x584]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x58c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x580]
jmp 0x48c5a3
push str.LaunchMirrorOP
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x489164
call fcn.00475270
push str.C:Program_FilesMirrorOpMirrorOp.exe
lea ecx, [ebp - 0x564]
mov bl, al
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 0x4b
cmp bl, 1
jne 0x489139
push str.C:Program_Files__x86_MirrorOpMirrorOp.exe
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push 1
push 0
push 0
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.open
push 0
call esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x564]
jmp 0x48c5a3
push str.CloseChrome
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48921d
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
mov bl, 0x4c
push str.taskkill__F__IM_chrome.exe__T
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea eax, [ebp - 0x580]
push eax
call fcn.0047d270
add esp, 0xc
push eax
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 0x4d
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0xffffffffffffffff
push ecx
lea edx, [ebp - 0x564]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
mov ecx, esp
mov dword [ebp - 0x57c], esp
mov byte [ebp - 4], 0x4e
push str.closing_chrome_browser_forcefully
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x564]
jmp 0x48c5a3
push str.CloseZoom
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x4892bb
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
mov bl, 0x4f
push str.taskkill__F__IM_Zoom.exe__T
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea eax, [ebp - 0x580]
push eax
call fcn.0047d270
add esp, 0xc
push eax
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 0x50
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0xffffffffffffffff
push ecx
lea edx, [ebp - 0x564]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
mov ecx, esp
mov dword [ebp - 0x57c], esp
mov byte [ebp - 4], 0x51
push str.closing_Zoom_meetings_forcefully
jmp 0x4891fd
push str.Closeoutlook
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x489359
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
mov bl, 0x52
push str.taskkill__F__IM_outlook.exe__T
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea eax, [ebp - 0x580]
push eax
call fcn.0047d270
add esp, 0xc
push eax
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 0x53
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0xffffffffffffffff
push ecx
lea edx, [ebp - 0x564]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
mov ecx, esp
mov dword [ebp - 0x57c], esp
mov byte [ebp - 4], 0x54
push str.closing_outlook_meetings_forcefully
jmp 0x4891fd
push str.Zoom
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x4895ab
push 0x4ae26b
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_310]
push str.Zoom_binzoom.exe
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push 0x4ae26b
mov byte [ebp - 4], 0x55
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea eax, [ebp - 0x580]
push eax
call fcn.004739c0
add esp, 8
push eax
lea ecx, [ebp - 0x578]
push ecx
mov byte [ebp - 4], 0x56
call fcn.004019e0
add esp, 0xc
mov bl, 0x58
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push str.Roaming
push str.Local
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_11627]
push ecx
lea edx, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x48950e
push str.C:Program_Files__x86_Zoom_binzoom.exe
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push ecx
lea eax, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
push 0
cmp al, 1
jne 0x489471
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push str.C:_Program_Files__x86__Zoom_binzoom.exe
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x590]
push ecx
call fcn.0047d270
add esp, 0xc
mov byte [ebp - 4], 0x59
jmp 0x489539
push str.Program_Files__x86_
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x489555
push str.Program_Files
push str.Program_Files__x86_
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_11627]
push ecx
lea edx, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
cmp al, 1
jne 0x4894ed
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push str.C:_Program_Files_Zoom_binzoom.exe
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea eax, [ebp - 0x590]
push eax
call fcn.0047d270
add esp, 0xc
mov byte [ebp - 4], 0x5a
jmp 0x489539
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push str.We_are_not_able_to_find_zoom_application_in_your_system._Please_close_the_solution_and_contact_HelpDesk.
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov ecx, dword [ebp - 0x588]
call fcn.00420480
jmp 0x489555
push 0
push ecx
lea edx, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
lea eax, [ebp - 0x590]
push eax
call fcn.0047d270
add esp, 0xc
mov byte [ebp - 4], 0x5b
push eax
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x590]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0xffffffffffffffff
push ecx
lea edx, [ebp - 0x584]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
mov ecx, esp
mov dword [ebp - 0x57c], esp
push str.Checking_zoom_meeting_opening_request:
mov byte [ebp - 4], 0x5c
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x584]
jmp 0x48c5a3
push str.CloseIE
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x489649
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
mov bl, 0x5d
push str.taskkill__F__IM_iexplore.exe__T
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea eax, [ebp - 0x580]
push eax
call fcn.0047d270
add esp, 0xc
push eax
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 0x5e
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0xffffffffffffffff
push ecx
lea edx, [ebp - 0x564]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
mov ecx, esp
mov dword [ebp - 0x57c], esp
mov byte [ebp - 4], 0x5f
push str.closing_Internet_explorer_forcefully
jmp 0x4891fd
push str.systemRestart
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x4896e7
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
mov bl, 0x60
push str.shutdown__r__t_600
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea eax, [ebp - 0x580]
push eax
call fcn.0047d270
add esp, 0xc
push eax
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 0x61
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0xffffffffffffffff
push ecx
lea edx, [ebp - 0x564]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
mov ecx, esp
mov dword [ebp - 0x57c], esp
mov byte [ebp - 4], 0x62
push str.Restarting_machine_in_a_time_interval_of_10_minutes
jmp 0x4891fd
push str.symantecManualUpdate
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x489776
lea eax, [ebp - 0x580]
push eax
call fcn.004810a0
push str.AnakageFilesVBScriptsSymantecManualUpdate.bat
push eax
lea ecx, [ebp - 0x568]
push ecx
mov byte [ebp - 4], 0x63
call fcn.004019e0
add esp, 0x10
mov bl, 0x65
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push 0x4ae26b
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
lea edx, [ebp - 0x568]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push edx
mov byte [ebp - 4], 0x66
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov byte [ebp - 4], bl
call fcn.0047cff0
add esp, 0xc
mov byte [ebp - 4], 6
jmp 0x48c59d
push str.officeRepair
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48a0ae
lea eax, [ebp - 0x588]
push eax
call fcn.00485050
add esp, 4
mov byte [ebp - 4], 0x67
call fcn.00485830
mov byte [ebp - 0x59d], al
call fcn.00475270
lea ecx, [ebp - 0x594]
mov byte [ebp - 0x59e], al
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x598]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov bl, 0x6b
lea ecx, [ebp - 0x588]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_7832]
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_7832]
push str.office
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x489c13
lea ecx, [ebp - 0x590]
push ecx
call fcn.004810a0
push str.AnakageFilesVBScriptsOfficeConfig.xml
push eax
lea edx, [ebp - 0x580]
push edx
mov byte [ebp - 4], 0x6c
call fcn.004019e0
add esp, 0x10
push eax
lea ecx, [ebp - 0x598]
mov byte [ebp - 4], 0x6d
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x580]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x590]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea eax, [ebp - 0x598]
push eax
lea ecx, [ebp - 0x56c]
push 0x4aed8c
push ecx
call fcn.00401a70
push 0x4aed8c
push eax
lea edx, [ebp - 0x580]
push edx
mov byte [ebp - 4], 0x6e
call fcn.004019e0
add esp, 0x18
push eax
lea ecx, [ebp - 0x598]
mov byte [ebp - 4], 0x6f
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x580]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0
push str.office15
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x4898e6
push str.office13
jmp 0x48993e
push 0
push str.office16
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x489904
push str.office16
jmp 0x48993e
push 0
push str.office14
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x489922
push str.office10
jmp 0x48993e
push 0
push str.office12
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x48994a
push str.office12
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push 0
push str.root
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
lea ecx, [ebp - 0x564]
test eax, eax
js 0x48996e
push str.ClickToRun
jmp 0x489973
push 0x4c859c
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push 0x4c859c
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x489a6a
push str.office13
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x4899b1
push str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE15Office_Setup_ControllerSetup.exe
jmp 0x489a36
push str.office16
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x4899cd
push str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE16Office_Setup_ControllerSetup.exe
jmp 0x489a36
push str.office10
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x4899e9
push str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE14Office_Setup_ControllerSetup.exe
jmp 0x489a36
push str.office12
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x489a42
push str.C:Program_Files__x86_Common_FilesMicrosoft_SharedOFFICE12Office_Setup_ControllerSETUP.EXE
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push ecx
lea eax, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x489a42
push str.C:Program_FilesCommon_FilesMicrosoft_SharedOFFICE12Office_Setup_ControllerSETUP.EXE
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
cmp byte [ebp - 0x59d], 0
je 0x489a6a
cmp byte [ebp - 0x59e], 0
je 0x489a6a
push str.Program_Files__x86_
push str.Program_Files
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_11627]
push ecx
lea edx, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
je 0x489bd3
lea eax, [ebp - 0x578]
push eax
lea ecx, [ebp - 0x590]
push 0x4aed8c
push ecx
call fcn.00401a70
push 0x4aed8c
push eax
lea edx, [ebp - 0x580]
push edx
mov byte [ebp - 4], 0x70
call fcn.004019e0
add esp, 0x18
push eax
lea ecx, [ebp - 0x578]
mov byte [ebp - 4], 0x71
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x580]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x590]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push str.__repair_standard__config
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1483]
lea eax, [ebp - 0x598]
push eax
lea ecx, [ebp - 0x578]
push ecx
lea edx, [ebp - 0x58c]
push edx
call fcn.004018e0
add esp, 0xc
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
mov bl, 0x72
push 0x4af974
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
lea eax, [ebp - 0x58c]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push eax
mov byte [ebp - 4], 0x73
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
push str.C:windowsiassistlogsAnk.bat
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 0x4b170c
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 0x74
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x489baf
lea ecx, [ebp - 0x58c]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push esi
call dword [sym.imp.MSVCR100.dll_fprintf]
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0xc
push 0x88
call fcn.0047c820
add esp, 4
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x58c]
jmp 0x48a069
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push str.NotFound
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
lea edx, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push edx
mov byte [ebp - 4], 0x75
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
jmp 0x48a06f
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_7832]
push str.skype
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48a06f
lea eax, [ebp - 0x590]
push eax
call fcn.004810a0
push str.AnakageFilesVBScriptsSkypeConfig.xml
push eax
lea ecx, [ebp - 0x580]
push ecx
mov byte [ebp - 4], 0x76
call fcn.004019e0
add esp, 0x10
push eax
lea ecx, [ebp - 0x598]
mov byte [ebp - 4], 0x77
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x580]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x590]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea edx, [ebp - 0x598]
push edx
lea eax, [ebp - 0x568]
push 0x4aed8c
push eax
call fcn.00401a70
push 0x4aed8c
push eax
lea ecx, [ebp - 0x580]
push ecx
mov byte [ebp - 4], 0x78
call fcn.004019e0
add esp, 0x18
push eax
lea ecx, [ebp - 0x598]
mov byte [ebp - 4], 0x79
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x580]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_PathsLync.EXEPath
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 0x7a
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea edx, [ebp - 0x584]
push edx
push ecx
lea eax, [ebp - 0x56c]
mov ecx, esp
mov dword [ebp - 0x57c], esp
mov bl, 0x7c
push eax
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00484540
add esp, 8
test eax, eax
jne 0x48a04b
push 0xffffffffffffffff
push ecx
lea edx, [ebp - 0x584]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
mov ecx, esp
mov dword [ebp - 0x580], esp
push str.Office_Lync_Path
mov byte [ebp - 4], 0x7d
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
push 0
push str.office16
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_7832]
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x489d9f
push str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE16Office_Setup_Controller_setup.exe
jmp 0x489de9
push 0
push str.office15
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_7832]
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x489dc5
push str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE15Office_Setup_Controller_setup.exe
jmp 0x489de9
push 0
push str.office14
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_7832]
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x489df5
push str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE14Office_Setup_Controller_setup.exe
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
cmp byte [ebp - 0x59d], 0
je 0x489e1d
cmp byte [ebp - 0x59e], 0
je 0x489e1d
push str.Program_Files__x86
push str.Program_Files
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_11627]
push ecx
lea eax, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
je 0x48a010
lea ecx, [ebp - 0x578]
push ecx
lea edx, [ebp - 0x590]
push 0x4aed8c
push edx
call fcn.00401a70
push 0x4aed8c
push eax
lea eax, [ebp - 0x580]
push eax
mov byte [ebp - 4], 0x7e
call fcn.004019e0
add esp, 0x18
push eax
lea ecx, [ebp - 0x578]
mov byte [ebp - 4], 0x7f
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x580]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x590]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push str.__repair_Lync__config
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1483]
lea ecx, [ebp - 0x598]
push ecx
lea edx, [ebp - 0x578]
push edx
lea eax, [ebp - 0x58c]
push eax
call fcn.004018e0
add esp, 0xc
push 0xffffffffffffffff
push ecx
lea edx, [ebp - 0x58c]
mov ecx, esp
mov dword [ebp - 0x580], esp
mov bl, 0x80
push edx
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
mov ecx, esp
mov dword [ebp - 0x590], esp
push str.CommandToRun_with_xml_file
mov byte [ebp - 4], 0x81
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x580], esp
push 0x4af974
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
lea eax, [ebp - 0x58c]
mov ecx, esp
mov dword [ebp - 0x590], esp
push eax
mov byte [ebp - 4], 0x82
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov byte [ebp - 4], bl
call fcn.0047c140
lea ecx, [ebp - 0x57c]
push ecx
call fcn.00479050
push str.Ank.bat
push eax
lea edx, [ebp - 0x568]
push edx
mov byte [ebp - 4], 0x83
call fcn.004019e0
add esp, 0x1c
mov bl, 0x85
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0x4b170c
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x489fbb
lea ecx, [ebp - 0x58c]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push esi
call dword [sym.imp.MSVCR100.dll_fprintf]
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0xc
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x580], esp
push 0x4ae26b
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
lea eax, [ebp - 0x568]
mov ecx, esp
mov dword [ebp - 0x590], esp
push eax
mov byte [ebp - 4], 0x86
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov byte [ebp - 4], bl
call fcn.0047cff0
add esp, 0xc
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x58c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
jmp 0x48a04b
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x57c], esp
push str.NotFound
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
lea edx, [ebp - 0x578]
mov ecx, esp
mov dword [ebp - 0x580], esp
push edx
mov byte [ebp - 4], 0x87
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x598]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x594]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x588]
jmp 0x48c5a3
push str.deleteRegistry
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48a0da
push str.SoftwareSymantecPKI_Client
push SysReAllocStringLen
call fcn.0047bf20
add esp, 8
jmp 0x48c5a9
push str.regset
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48a2bc
push str.officedisablehardwareaccl
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48a1ff
xor esi, esi
mov dword [ebp - 0x5ac], esi
mov dword [ebp - 0x5a8], esi
mov dword [ebp - 0x5a4], esi
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea eax, [ebp - 0x560]
mov bl, 0x89
push eax
mov byte [ebp - 4], bl
call fcn.0047c3d0
add esp, 4
push eax
lea ecx, [ebp - 0x584]
mov byte [ebp - 4], 0x8a
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push str.commongraphics
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_1483]
push esi
push esi
push 0x2001f
push esi
push esi
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0x5ac]
call fcn.00473300
test eax, eax
je 0x48a1a6
lea ecx, [ebp - 0x5ac]
call fcn.004732d0
push 0x2001f
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0x5ac]
call fcn.004733a0
cmp eax, esi
jne 0x48a1f4
mov edx, dword [ebp - 0x5ac]
push 4
lea ecx, [ebp - 0x560]
push ecx
push 4
push esi
push str.DisableHardwareAcceleration
push edx
mov dword [ebp - 0x560], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x584]
jmp 0x48b7b3
push 0
push 0x4b5b94
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
mov esi, eax
push esi
lea eax, [ebp - 0x568]
push eax
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_7487]
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0x8b
call dword [sym.imp.mfc100.dll_Ordinal_5207]
sub eax, esi
dec eax
push eax
lea ecx, [ebp - 0x56c]
push ecx
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_11781]
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
mov bl, 0x8c
push str.DWORD
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
lea edx, [ebp - 0x56c]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push edx
mov byte [ebp - 4], 0x8d
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
lea eax, [ebp - 0x568]
mov ecx, esp
mov dword [ebp - 0x580], esp
push eax
mov byte [ebp - 4], 0x8e
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov byte [ebp - 4], bl
call fcn.00481bd0
add esp, 0xc
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
jmp 0x48c59d
push str.regstringset
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48a391
push eax
push 0x4b5b94
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
mov esi, eax
push esi
lea ecx, [ebp - 0x568]
push ecx
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_7487]
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0x8f
call dword [sym.imp.mfc100.dll_Ordinal_5207]
sub eax, esi
dec eax
push eax
lea edx, [ebp - 0x56c]
push edx
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_11781]
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
mov bl, 0x90
push str.string
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
lea eax, [ebp - 0x56c]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push eax
mov byte [ebp - 4], 0x91
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
lea edx, [ebp - 0x568]
mov ecx, esp
mov dword [ebp - 0x580], esp
push edx
mov byte [ebp - 4], 0x92
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov byte [ebp - 4], bl
call fcn.00481bd0
add esp, 0xc
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
jmp 0x48c59d
push str.outlookSettingChange
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48a641
push str.enabledesktopnotificaion
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48a558
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_316]
xor edi, edi
mov dword [ebp - 0x5ac], edi
mov dword [ebp - 0x5a8], edi
mov dword [ebp - 0x5a4], edi
lea eax, [ebp - 0x57c]
mov bl, 0x94
push eax
mov byte [ebp - 4], bl
call fcn.0047c3d0
push str.OutlookPreferences
push eax
lea ecx, [ebp - 0x560]
push ecx
mov byte [ebp - 4], 0x95
call fcn.004019e0
add esp, 0x10
push eax
lea ecx, [ebp - 0x584]
mov byte [ebp - 4], 0x96
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0x2001f
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0x5ac]
call fcn.004733a0
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, edi
jne 0x48a489
mov eax, dword [ebp - 0x5ac]
push 4
lea edx, [ebp - 0x560]
push edx
push 4
push edi
push str.NewmailDesktopAlerts
push eax
mov dword [ebp - 0x560], 1
call esi
lea ecx, [ebp - 0x57c]
push ecx
call fcn.0047c3d0
push str.OutlookOptionsReminders
push eax
lea edx, [ebp - 0x560]
push edx
mov byte [ebp - 4], 0x97
call fcn.004019e0
add esp, 0x10
push eax
lea ecx, [ebp - 0x584]
mov byte [ebp - 4], 0x98
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x57c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0x2001f
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0x5ac]
call fcn.004733a0
cmp eax, edi
jne 0x48a53e
mov edi, dword [ebp - 0x5ac]
push 4
lea eax, [ebp - 0x560]
push eax
push 4
push 0
push str.PlaySound
mov ebx, 1
push edi
mov dword [ebp - 0x560], ebx
call esi
push 4
lea ecx, [ebp - 0x560]
push ecx
push 4
push 0
push 0x4b6b00
push edi
mov dword [ebp - 0x560], ebx
call esi
lea ecx, [ebp - 0x5ac]
call fcn.00477610
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x584]
jmp 0x48c5a3
push str.AutoArchive
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48c5a9
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_316]
xor esi, esi
mov dword [ebp - 0x5ac], esi
mov dword [ebp - 0x5a8], esi
mov dword [ebp - 0x5a4], esi
lea edx, [ebp - 0x57c]
push edx
mov byte [ebp - 4], 0x9a
call fcn.0047c3d0
push str.OutlookPreferences
push eax
lea eax, [ebp - 0x560]
push eax
mov byte [ebp - 4], 0x9b
call fcn.004019e0
add esp, 0x10
push eax
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 0x9c
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x57c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0x2001f
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0x5ac]
call fcn.004733a0
cmp eax, esi
jne 0x48a62d
mov edx, dword [ebp - 0x5ac]
push 4
lea ecx, [ebp - 0x560]
push ecx
push 4
push esi
push str.DoAging
push edx
mov dword [ebp - 0x560], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x5ac]
call fcn.00477610
mov byte [ebp - 4], 6
jmp 0x48c59d
push str.runsep
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48a6a9
lea eax, [ebp - 0x568]
push eax
call fcn.00484db0
lea edx, [ebp - 0x568]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
mov byte [ebp - 4], 0x9d
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
je 0x48a6a0
push 1
push edi
push edi
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.open
push edi
call esi
mov byte [ebp - 4], 6
jmp 0x48c59d
push str.regremoveduplicate
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48a6e1
push ecx
lea eax, [ebp - 0x574]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.004846a0
add esp, 4
jmp 0x48c5a9
push str.runreg
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48a719
push ecx
lea edx, [ebp - 0x574]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00481b10
add esp, 4
jmp 0x48c5a9
push str.MsTeam
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48a831
push str.openteam
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
test eax, eax
je 0x48c5a9
lea eax, [ebp - 0x57c]
push eax
call fcn.00476b60
push eax
lea ecx, [ebp - 0x560]
push 0x4af5dc
push ecx
mov byte [ebp - 4], 0x9e
call fcn.00401a70
push str.AppDataLocalMicrosoftTeamscurrentTeams.exe
push eax
lea edx, [ebp - 0x568]
push edx
mov byte [ebp - 4], 0x9f
call fcn.004019e0
add esp, 0x1c
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov bl, 0xa2
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x580], esp
push 0x4af974
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
mov eax, esp
mov dword [ebp - 0x590], esp
lea ecx, [ebp - 0x568]
push ecx
push str.openteam__
push eax
mov byte [ebp - 4], 0xa3
call fcn.00401a70
add esp, 0xc
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
push 3
push 0
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.explorer.exe
push str.open
push 0
call esi
mov esi, dword [ebp - 0x5b0]
push str.success
mov ecx, esi
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_901]
jmp 0x48c5bc
push str.recentfolder
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48a8c5
lea edx, [ebp - 0x57c]
push edx
call fcn.00476b60
push eax
lea eax, [ebp - 0x560]
push str.c:users_
push eax
mov byte [ebp - 4], 0xa4
call fcn.00401a70
push str.Recent
push eax
lea ecx, [ebp - 0x56c]
push ecx
mov byte [ebp - 4], 0xa5
call fcn.004019e0
add esp, 0x1c
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], 6
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 3
push edi
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.explorer.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x56c]
jmp 0x48c5a3
push str.regreadanddelete
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48a9fb
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea edx, [ebp - 0x57c]
push edx
mov byte [ebp - 4], 0xa6
call fcn.0047c3d0
push eax
lea eax, [ebp - 0x560]
push str.HKEY_CURRENT_USER_
push eax
mov byte [ebp - 4], 0xa7
call fcn.00401a70
push str.OutlookSecurityOutlookSecureTempFolder
push eax
lea ecx, [ebp - 0x56c]
push ecx
mov byte [ebp - 4], 0xa8
call fcn.004019e0
add esp, 0x1c
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov bl, 0xab
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0xffffffffffffffff
push ecx
mov edx, esp
mov dword [ebp - 0x580], esp
push edx
call fcn.0047c3d0
mov ecx, esp
mov dword [ebp - 0x590], esp
push str.Outlook_version_found
mov byte [ebp - 4], 0xac
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
lea eax, [ebp - 0x564]
push eax
push ecx
lea edx, [ebp - 0x56c]
mov ecx, esp
mov dword [ebp - 0x580], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00484540
add esp, 8
test eax, eax
jne 0x488fd9
push 0xffffffffffffffff
push ecx
lea eax, [ebp - 0x564]
mov ecx, esp
mov dword [ebp - 0x580], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
mov ecx, esp
mov dword [ebp - 0x590], esp
push str.Outlook_temp_folder_location
mov byte [ebp - 4], 0xad
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call fcn.00475cf0
add esp, 4
jmp 0x488fd9
push str.notepad.exe
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48aaef
push 0x4ae26b
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
je 0x48aa77
push edi
push str.Program_Files__x86_
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x48aa77
push ecx
lea edx, [ebp - 0x574]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x48aa77
push str.Program_Files
push str.Program_Files__x86_
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_11627]
push ecx
lea eax, [ebp - 0x574]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
lea ecx, [ebp - 0x574]
cmp al, 1
jne 0x48aabb
push 3
push edi
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.notepad.exe
push str.open
push edi
call esi
jmp 0x48c5a9
push edi
push str.vpncl
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x48c5a9
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push str.It_looks_like_Cisco_VPN_Client_is_not_installed_on_your_system._Please_contact_helpdesk.
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov ecx, ebx
call fcn.00420480
jmp 0x48c5a9
push str.explorefile
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48abd6
lea ecx, [ebp - 0x564]
push ecx
mov ecx, ebx
call fcn.00448360
push ecx
lea edx, [ebp - 0x564]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
mov byte [ebp - 4], 0xae
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
jne 0x48abaa
push str.Program_Files
push str.Program_Files__x86_
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_11627]
push edi
push str..exe
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
jle 0x48abaa
push edi
push str.Microsoft_Office
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
jle 0x48abaa
lea eax, [ebp - 0x560]
push eax
call fcn.00485130
add esp, 4
push eax
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0xaf
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 1
push edi
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.explorer.exe
push str.open
push edi
call esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x564]
jmp 0x48c5a3
push str.renamefolder
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48ac5c
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push 0x4ae26b
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
lea edx, [ebp - 0x574]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push edx
mov byte [ebp - 4], 0xb0
call dword [sym.imp.mfc100.dll_Ordinal_300]
lea eax, [ebp - 0x56c]
push eax
mov byte [ebp - 4], 6
call fcn.0047bfa0
add esp, 8
lea edx, [ebp - 0x56c]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
mov byte [ebp - 4], 0xb1
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.004854f0
add esp, 4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x56c]
jmp 0x48c5a3
push str.renamefolderDeleteFiles
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48ad19
push ecx
mov ecx, esp
mov dword [ebp - 0x57c], esp
push 0x4ae26b
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
lea eax, [ebp - 0x574]
mov ecx, esp
mov dword [ebp - 0x580], esp
push eax
mov byte [ebp - 4], 0xb2
call dword [sym.imp.mfc100.dll_Ordinal_300]
lea ecx, [ebp - 0x568]
push ecx
mov byte [ebp - 4], 6
call fcn.0047bfa0
add esp, 8
lea edx, [ebp - 0x568]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push edx
mov byte [ebp - 4], 0xb3
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.004854f0
push str.Tracing
lea eax, [ebp - 0x568]
push eax
lea ecx, [ebp - 0x560]
push ecx
call fcn.004019e0
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 0xb4
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call fcn.00475760
add esp, 4
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
jmp 0x48c59d
push str.runvbscript
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48ae5a
lea edx, [ebp - 0x57c]
push edx
call fcn.004810a0
push str.AnakageFilesVBScripts_
push eax
lea eax, [ebp - 0x560]
push eax
mov byte [ebp - 4], 0xb5
call fcn.004019e0
lea ecx, [ebp - 0x574]
push ecx
push eax
lea edx, [ebp - 0x568]
push edx
mov byte [ebp - 4], 0xb6
call fcn.004018e0
add esp, 0x1c
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov bl, 0xb9
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push str.updateinventory.vbs
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48ae16
lea eax, [ebp - 0x56c]
push eax
call fcn.004810a0
push str.Accenture_Workstation_Security_ComplianceScripts_
push eax
lea ecx, [ebp - 0x590]
push ecx
mov byte [ebp - 4], 0xba
call fcn.004019e0
lea edx, [ebp - 0x574]
push edx
push eax
lea eax, [ebp - 0x580]
push eax
mov byte [ebp - 4], 0xbb
call fcn.004018e0
add esp, 0x1c
push eax
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 0xbc
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x580]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x590]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push ecx
mov ecx, esp
mov dword [ebp - 0x580], esp
push 0x4ae26b
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 1
push ecx
lea edx, [ebp - 0x568]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
mov byte [ebp - 4], 0xbd
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov byte [ebp - 4], bl
call fcn.00474370
add esp, 0xc
mov byte [ebp - 4], 6
jmp 0x48c59d
push str.deletefolder
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b194
push 0x4ae26b
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 0x4ae26b
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 0xbe
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov bl, 0xbf
push str.prefetch
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48aec9
push str.C:WindowsPrefetch_
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
jmp 0x48b157
push str.windowstemp
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48aef4
push str.C:WindowsTemp_
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
jmp 0x48b157
push str.recyclebin
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48af28
push eax
call fcn.004762e0
add esp, 4
push str.NULL
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
jmp 0x48b157
push str.msteam
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48afce
lea eax, [ebp - 0x580]
push eax
call fcn.00476b60
push eax
lea ecx, [ebp - 0x57c]
push 0x4af5dc
push ecx
mov byte [ebp - 4], 0xc0
call fcn.00401a70
push str.AppDataRoamingMicrosoftTeams
push eax
lea edx, [ebp - 0x560]
push edx
mov byte [ebp - 4], 0xc1
call fcn.004019e0
add esp, 0x1c
push eax
lea ecx, [ebp - 0x578]
mov byte [ebp - 4], 0xc2
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x57c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call fcn.004759f0
add esp, 4
jmp 0x48b157
push str.usertemp
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b03e
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_310]
push eax
lea ecx, [ebp - 0x578]
mov byte [ebp - 4], 0xc3
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push str.Anakage
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
jmp 0x48b157
push str.PTCTempFolder
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b0e6
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push ecx
lea edx, [ebp - 0x56c]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push edx
mov byte [ebp - 4], 0xc4
call dword [sym.imp.mfc100.dll_Ordinal_300]
lea eax, [ebp - 0x568]
push eax
call fcn.004739c0
add esp, 8
push str.Roaming
push str.Local
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 0xc5
call dword [sym.imp.mfc100.dll_Ordinal_11627]
push str.PTCProENGINEERWildfire.wf
lea ecx, [ebp - 0x568]
push ecx
lea edx, [ebp - 0x560]
push edx
call fcn.004019e0
add esp, 0xc
push eax
lea ecx, [ebp - 0x578]
mov byte [ebp - 4], 0xc6
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x568]
jmp 0x48b142
push str.outlookCache
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b157
lea eax, [ebp - 0x56c]
push 0x4c9940
push eax
call fcn.00476e10
push str.MicrosoftOutlookRoamCache
lea ecx, [ebp - 0x56c]
push ecx
lea edx, [ebp - 0x560]
push edx
mov byte [ebp - 4], 0xc7
call fcn.004019e0
add esp, 0x14
push eax
lea ecx, [ebp - 0x578]
mov byte [ebp - 4], 0xc8
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp - 0x578]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call fcn.00473e20
add esp, 8
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x578]
jmp 0x48c5a3
push str.PrintDemo
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b24d
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea eax, [ebp - 0x580]
push eax
mov byte [ebp - 4], 0xc9
call fcn.004810a0
push str.AnakageFilesSelfHealSolutionsiassist_
push eax
lea ecx, [ebp - 0x57c]
push ecx
mov byte [ebp - 4], 0xca
call fcn.004019e0
lea edx, [ebp - 0x574]
push edx
push eax
lea eax, [ebp - 0x560]
push eax
mov byte [ebp - 4], 0xcb
call fcn.004018e0
add esp, 0x1c
push eax
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 0xcc
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x57c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x580]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call fcn.00476310
add esp, 4
mov byte [ebp - 4], 6
jmp 0x48c59d
push str.addsite
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b283
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push 0x4ae8b4
call dword [sym.imp.mfc100.dll_Ordinal_310]
call fcn.00476350
add esp, 4
jmp 0x48c5a9
push str.sccm
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b2c0
push str.start_control_smscfgrc
call dword [sym.imp.MSVCR100.dll_system]
add esp, 4
push 1
push edi
push str.control_smscfgrc
push str.control.exe
push str.open
push edi
call esi
jmp 0x48c5a9
push str.openExplorer
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b3fb
push ecx
lea edx, [ebp - 0x574]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
lea eax, [ebp - 0x588]
push eax
call fcn.004739c0
add esp, 8
mov bl, 0xcd
push str.win10
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b339
push str.MicrosoftWindowsINetCache
lea ecx, [ebp - 0x588]
push ecx
lea edx, [ebp - 0x560]
push edx
call fcn.004019e0
add esp, 0xc
mov byte [ebp - 4], 0xce
jmp 0x48b36d
push str.win7
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b389
push str.MicrosoftWindowsTemporary_Internet_Files
lea eax, [ebp - 0x588]
push eax
lea ecx, [ebp - 0x560]
push ecx
call fcn.004019e0
add esp, 0xc
mov byte [ebp - 4], 0xcf
push eax
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0xffffffffffffffff
push ecx
lea edx, [ebp - 0x588]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
mov ecx, esp
mov dword [ebp - 0x57c], esp
push str.Internet_explorer_path
mov byte [ebp - 4], 0xd0
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 0xd1
call sub.mfc100.dll_Ordinal_1929
mov ecx, dword [eax + 4]
mov byte [ebp - 4], bl
call fcn.0041a0c0
push 3
push 0
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.explorer.exe
push str.open
push 0
call esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x588]
jmp 0x48c5a3
push str.renamefolderDeleteFiles
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b4b8
push ecx
mov ecx, esp
mov dword [ebp - 0x57c], esp
push 0x4ae26b
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
lea eax, [ebp - 0x574]
mov ecx, esp
mov dword [ebp - 0x580], esp
push eax
mov byte [ebp - 4], 0xd2
call dword [sym.imp.mfc100.dll_Ordinal_300]
lea ecx, [ebp - 0x568]
push ecx
mov byte [ebp - 4], 6
call fcn.0047bfa0
add esp, 8
lea edx, [ebp - 0x568]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push edx
mov byte [ebp - 4], 0xd3
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.004854f0
push str.Tracing
lea eax, [ebp - 0x568]
push eax
lea ecx, [ebp - 0x560]
push ecx
call fcn.004019e0
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 0xd4
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call fcn.00475760
add esp, 4
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
jmp 0x48c59d
push str.openChrome
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b618
push 0x4b37e8
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
je 0x48b58e
lea edx, [ebp - 0x57c]
push edx
call fcn.004810a0
push str.AnakageFilesVBScripts_
push eax
lea eax, [ebp - 0x560]
push eax
mov byte [ebp - 4], 0xd5
call fcn.004019e0
lea ecx, [ebp - 0x574]
push ecx
push eax
lea edx, [ebp - 0x56c]
push edx
mov byte [ebp - 4], 0xd6
call fcn.004018e0
add esp, 0x1c
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov bl, 0xd9
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push ecx
mov ecx, esp
mov dword [ebp - 0x580], esp
push 0x4ae26b
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 1
push ecx
lea eax, [ebp - 0x56c]
mov ecx, esp
mov dword [ebp - 0x560], esp
mov byte [ebp - 4], 0xda
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov byte [ebp - 4], bl
call fcn.00474370
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x56c]
jmp 0x48c5a3
push ecx
lea edx, [ebp - 0x574]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
lea eax, [ebp - 0x564]
push eax
call fcn.004739c0
push str._GoogleChromeUser_DataDefault
lea ecx, [ebp - 0x564]
push ecx
lea edx, [ebp - 0x560]
push edx
mov byte [ebp - 4], 0xdb
call fcn.004019e0
add esp, 0x14
push eax
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 0xdc
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 3
push edi
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.explorer.exe
push str.open
push edi
call esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x564]
jmp 0x48c5a3
push str.applicationiconsetting
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
lea ecx, [ebp - 0x574]
test eax, eax
jne 0x48b6d3
push 0x4b37e8
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
je 0x48c5a9
lea eax, [ebp - 0x57c]
push eax
call fcn.004810a0
push str.AnakageFilesVBScripts_
push eax
lea ecx, [ebp - 0x560]
push ecx
mov byte [ebp - 4], 0xdd
call fcn.004019e0
lea edx, [ebp - 0x574]
push edx
push eax
lea eax, [ebp - 0x56c]
push eax
mov byte [ebp - 4], 0xde
call fcn.004018e0
add esp, 0x1c
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov bl, 0xe1
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push ecx
mov ecx, esp
mov dword [ebp - 0x580], esp
push 0x4ae26b
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 1
push ecx
lea edx, [ebp - 0x56c]
mov ecx, esp
mov dword [ebp - 0x560], esp
mov byte [ebp - 4], 0xe2
push edx
jmp 0x48b56e
push str.HardwareAcceleration
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b7cd
mov dword [ebp - 0x5ac], eax
mov dword [ebp - 0x5a8], eax
mov dword [ebp - 0x5a4], eax
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea eax, [ebp - 0x560]
mov bl, 0xe4
push eax
mov byte [ebp - 4], bl
call fcn.0047c3d0
add esp, 4
push eax
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 0xe5
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push str.CommonGraphics
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1483]
push 0
push 0
push 0x2001f
push 0
push 0
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0x5ac]
call fcn.00473300
test eax, eax
je 0x48b784
lea ecx, [ebp - 0x5ac]
call fcn.004732d0
jmp 0x48b7ad
mov edx, dword [ebp - 0x5ac]
push 4
lea ecx, [ebp - 0x560]
push ecx
push 4
push 0
push str.DisableHardwareAcceleration
push edx
mov dword [ebp - 0x560], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x5ac]
mov byte [ebp - 4], 6
call fcn.00477610
jmp 0x48c5a9
push str.openLLFile
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
je 0x48c5a9
push str.runcompliancevbscript
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b888
lea eax, [ebp - 0x57c]
push eax
call fcn.004810a0
push str.Accenture_Workstation_Security_ComplianceScripts_
push eax
lea ecx, [ebp - 0x560]
push ecx
mov byte [ebp - 4], 0xe6
call fcn.004019e0
lea edx, [ebp - 0x574]
push edx
push eax
lea eax, [ebp - 0x56c]
push eax
mov byte [ebp - 4], 0xe7
call fcn.004018e0
add esp, 0x1c
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov bl, 0xea
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
push ecx
mov ecx, esp
mov dword [ebp - 0x580], esp
push 0x4ae26b
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 1
push ecx
lea edx, [ebp - 0x56c]
mov ecx, esp
mov dword [ebp - 0x560], esp
mov byte [ebp - 4], 0xeb
push edx
jmp 0x48b56e
push str.regnavigate
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b8a7
call fcn.0047bc10
jmp 0x48c5a9
push str.localappdataexplore
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48b946
push ecx
lea eax, [ebp - 0x574]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
lea ecx, [ebp - 0x564]
push ecx
call fcn.004739c0
push str.PKI_Client
lea edx, [ebp - 0x564]
push edx
lea eax, [ebp - 0x560]
mov bl, 0xec
push eax
mov byte [ebp - 4], bl
call fcn.004019e0
add esp, 0x14
push eax
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 0xed
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call fcn.004759f0
add esp, 4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x564]
jmp 0x48c5a3
push str.GetIPAndhostname
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48bb63
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x58c]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x58c]
push ecx
lea edx, [ebp - 0x56c]
push edx
lea eax, [ebp - 0x584]
push eax
mov byte [ebp - 4], 0xf1
call fcn.00475100
add esp, 0xc
call fcn.00476420
push eax
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
lea ecx, [ebp - 0x560]
push ecx
lea edx, [ebp - 0x114]
push edx
push 3
mov dword [ebp - 0x560], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 0xf2
call dword [sym.imp.mfc100.dll_Ordinal_13125]
push eax
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_300]
push str.ipandhostname
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0xf3
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48baba
lea ecx, [ebp - 0x564]
push ecx
lea edx, [ebp - 0x590]
push str.Your_Ip_Addressand_Host_Name_is
push edx
call fcn.00401a70
push 0x4aed3c
push eax
lea eax, [ebp - 0x580]
push eax
mov byte [ebp - 4], 0xf4
call fcn.004019e0
lea ecx, [ebp - 0x58c]
push ecx
push eax
lea edx, [ebp - 0x57c]
push edx
mov byte [ebp - 4], 0xf5
call fcn.004018e0
add esp, 0x20
mov ecx, esp
mov dword [ebp - 0x594], esp
push str._Click_on__NEXT_STEP__to_know_Domain
push eax
push ecx
mov byte [ebp - 4], 0xf6
call fcn.004019e0
add esp, 0xc
mov ecx, ebx
call fcn.00420480
lea ecx, [ebp - 0x57c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x580]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x590]
jmp 0x48bb12
push str.DomainName
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48bb18
lea edx, [ebp - 0x568]
push edx
lea eax, [ebp - 0x57c]
push str.Your_Domain_Name_is
push eax
call fcn.00401a70
add esp, 8
mov ecx, esp
mov dword [ebp - 0x580], esp
push str._Click_on__NEXT_STEP_
push eax
push ecx
mov byte [ebp - 4], 0xf7
call fcn.004019e0
add esp, 0xc
mov ecx, ebx
call fcn.00420480
lea ecx, [ebp - 0x57c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x58c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x584]
jmp 0x48c5a3
push str.Outlook_Print
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48bc31
lea edx, [ebp - 0x560]
push 0x4c9930
push edx
call fcn.00476e10
push str.MicrosoftOutlookoutlprnt
push eax
lea eax, [ebp - 0x564]
push eax
mov byte [ebp - 4], pe_nt_image_headers32
call fcn.004019e0
add esp, 0x14
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 0xfa
call dword [sym.imp.mfc100.dll_Ordinal_901]
push ecx
lea edx, [ebp - 0x564]
mov ecx, esp
mov dword [ebp - 0x57c], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
mov bl, al
push str..old
lea eax, [ebp - 0x564]
push eax
lea ecx, [ebp - 0x56c]
push ecx
call fcn.004019e0
add esp, 0x10
test bl, bl
je 0x48bc15
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.MSVCR100.dll_rename]
add esp, 8
push 1
push 0
push 0x4ae26b
push str.outlook.exe
push str.open
push 0
call esi
jmp 0x488fd9
push str.Ciscojabber
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
je 0x48c5a9
push str.openselectedfolder
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48bd5b
call sub.mfc100.dll_Ordinal_1929
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x588]
push edx
call fcn.004484d0
mov bl, 0xfb
lea ecx, [ebp - 0x588]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.openselectedfolder
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_11627]
push 0x5c
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_11744]
push eax
lea eax, [ebp - 0x560]
push eax
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_7487]
push eax
lea ecx, [ebp - 0x588]
mov byte [ebp - 4], 0xfc
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x588]
call dword [sym.imp.mfc100.dll_Ordinal_13125]
lea ecx, [ebp - 0x588]
push ecx
lea edx, [ebp - 0x57c]
push 0x4aed8c
push edx
call fcn.00401a70
push 0x4aed8c
push eax
lea eax, [ebp - 0x560]
push eax
mov byte [ebp - 4], 0xfd
call fcn.004019e0
add esp, 0x18
push 1
push 0
push 0x4ae26b
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.open
push 0
call esi
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x57c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x588]
jmp 0x48c5a3
push str.javacontrolpanel
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48be45
push 0x4ae26b
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x564]
push ecx
mov byte [ebp - 4], 0xfe
call fcn.00484b20
add esp, 4
cmp eax, 1
jne 0x48bde4
push 0x4ae26b
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
je 0x488fe5
push 1
push 0
push 0x4ae26b
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.open
push 0
call esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x564]
jmp 0x48c5a3
test eax, eax
jne 0x48be12
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push str._Java_Runtime__was_not_found_on_your_machine._Please_close_the_solution_and_contact_HelpDesk.
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov ecx, ebx
call fcn.00420480
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x564]
jmp 0x48c5a3
cmp eax, 1
jle 0x488fe5
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
push str.More_than_one__Java_Runtime__was_found_on_your_machine._Please_run__Java__from_control_panel._Wait_for_it_to_load_and_then_click__NEXT_STEP_
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov ecx, ebx
call fcn.00420480
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x564]
jmp 0x48c5a3
push str.customizedMessage
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48bef6
call sub.mfc100.dll_Ordinal_1929
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x568]
push edx
call fcn.004484d0
mov ebx, 0xff
mov byte [ebp - 4], bl
call sub.mfc100.dll_Ordinal_1929
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x56c]
push ecx
mov ecx, eax
call fcn.004018a0
lea ecx, [ebp - 0x574]
mov dword [ebp - 4], 0x100
call dword [sym.imp.mfc100.dll_Ordinal_13125]
push str.noteMsg
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_2611]
push ecx
mov ecx, esp
mov dword [ebp - 0x560], esp
test eax, eax
jne 0x48bec6
lea edx, [ebp - 0x56c]
push edx
jmp 0x48becd
lea eax, [ebp - 0x568]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov ecx, dword [ebp - 0x588]
call fcn.00420480
lea ecx, [ebp - 0x56c]
mov dword [ebp - 4], ebx
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 6
jmp 0x48c59d
push str.PrinterInformation
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48c38b
call sub.mfc100.dll_Ordinal_1929
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x144]
push str.Address
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48c0e7
lea ecx, [ebp - 0x564]
push ecx
mov ecx, edi
call fcn.0045fda0
lea edx, [ebp - 0x584]
push edx
mov dword [ebp - 4], 0x101
call fcn.00479050
add esp, 4
lea eax, [ebp - 0x580]
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00448500
lea ecx, [ebp - 0x560]
push ecx
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.00448500
push str.WIZARD
mov ecx, eax
mov byte [ebp - 4], 4
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
lea ecx, [ebp - 0x560]
sete bl
mov byte [ebp - 4], 3
call dword [sym.imp.mfc100.dll_Ordinal_901]
test bl, bl
je 0x48c003
lea edx, [ebp - 0x57c]
push edx
mov ecx, edi
call fcn.0041fdd0
push eax
lea eax, [ebp - 0x560]
push 0x4b0cd8
push eax
mov byte [ebp - 4], 5
call fcn.00401a70
add esp, 0xc
push eax
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 6
call dword [sym.imp.mfc100.dll_Ordinal_1479]
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x57c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x564]
jmp 0x48c0a7
push str.location.txt
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_1483]
push ecx
lea edx, [ebp - 0x584]
mov ecx, esp
mov dword [ebp - 0x560], esp
push edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00473a70
add esp, 4
test al, al
je 0x48c054
push ecx
lea eax, [ebp - 0x584]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
call fcn.00479c60
add esp, 4
push 0x4aed30
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x48c08c
push edi
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.MSVCR100.dll_fputs]
add esp, 8
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x584]
push 5
push 0
push 0
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.open
push 0
call esi
lea ecx, [ebp - 0x580]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x584]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x564]
jmp 0x48c5a3
push str.displayName
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48c1ed
lea ecx, [ebp - 0x564]
push ecx
mov ecx, edi
call fcn.0041ffd0
push 0
push 0x4ae8b4
lea ecx, [ebp - 0x564]
mov dword [ebp - 4], 0x107
call dword [sym.imp.mfc100.dll_Ordinal_4144]
push eax
lea edx, [ebp - 0x56c]
push edx
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc100.dll_Ordinal_7487]
lea eax, [ebp - 0x56c]
push eax
lea ecx, [ebp - 0x580]
push str.Please_Select_the_
push ecx
mov byte [ebp - 4], 8
call fcn.00401a70
push str._printer_manufacturers_and_then_select_this
push eax
lea edx, [ebp - 0x57c]
push edx
mov byte [ebp - 4], 9
call fcn.004019e0
lea ecx, [ebp - 0x564]
push ecx
push eax
lea edx, [ebp - 0x560]
push edx
mov byte [ebp - 4], 0xa
call fcn.004018e0
add esp, 0x20
mov ecx, esp
mov dword [ebp - 0x590], esp
push str.__printer_in_the_list_given_then_click_on__Next_._Click_on_NEXT_STEP.
push eax
push ecx
mov byte [ebp - 4], 0xb
call fcn.004019e0
add esp, 0xc
mov ecx, ebx
call fcn.00420480
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x57c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x580]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x564]
jmp 0x48c5a3
push str.color
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48c272
lea edx, [ebp - 0x56c]
push edx
mov ecx, edi
call fcn.0043ba40
lea eax, [ebp - 0x56c]
push eax
lea ecx, [ebp - 0x560]
push str.Please_Change_the_color_configration_to
push ecx
mov dword [ebp - 4], 0x10c
call fcn.00401a70
add esp, 8
mov edx, esp
mov dword [ebp - 0x57c], esp
mov byte [ebp - 4], 0xd
push str._Click_on__NEXT_STEP_
push eax
push edx
call fcn.004019e0
add esp, 0xc
mov ecx, ebx
call fcn.00420480
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x56c]
jmp 0x48c5a3
push str.port
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48c2cf
lea eax, [ebp - 0x56c]
push eax
mov ecx, edi
call fcn.004735b0
lea ecx, [ebp - 0x56c]
push ecx
lea edx, [ebp - 0x560]
push str.Please_set_the_port_number
push edx
mov dword [ebp - 4], 0x10e
call fcn.00401a70
add esp, 8
mov ecx, esp
mov dword [ebp - 0x57c], esp
push str._Click_on__NEXT_STEP_
push eax
mov byte [ebp - 4], 0xf
push ecx
jmp 0x48c245
push str.ipAddress
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48c32a
lea edx, [ebp - 0x56c]
push edx
mov ecx, edi
call fcn.0045f060
lea eax, [ebp - 0x56c]
push eax
lea ecx, [ebp - 0x560]
push str.Please_set_this_ip_address
push ecx
mov dword [ebp - 4], 0x110
call fcn.00401a70
add esp, 8
mov edx, esp
mov dword [ebp - 0x57c], esp
mov byte [ebp - 4], 0x11
push str._and_Click_on__NEXT_STEP_
jmp 0x48c243
push str.driverName
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48c5a9
lea eax, [ebp - 0x56c]
push eax
mov ecx, edi
call fcn.0041fdd0
lea ecx, [ebp - 0x56c]
push ecx
lea edx, [ebp - 0x560]
push str.Please_find_the_this_driver
push edx
mov dword [ebp - 4], 0x112
call fcn.00401a70
add esp, 8
mov ecx, esp
mov dword [ebp - 0x57c], esp
push str._and_open_it_then_click_on__OK_._Click_on__NEXT_STEP_
push eax
mov byte [ebp - 4], 0x13
push ecx
jmp 0x48c245
xor ebx, ebx
call sub.mfc100.dll_Ordinal_1929
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x568]
push edx
call fcn.00405ca0
push ebx
push str.msiexe
lea ecx, [ebp - 0x570]
mov dword [ebp - 4], 0x114
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
jns 0x48c3fc
push ebx
push str.control.exe
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
jns 0x48c3fc
push ebx
push str.olidays.exe
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
jns 0x48c3fc
push ebx
push str.ScnCfg32.exe
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
push str.rundll32.exe
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
jne 0x48c48f
mov ecx, dword [ebp - 0x588]
lea eax, [ebp - 0x580]
push eax
call fcn.00448360
mov edi, eax
push 0x4aed3c
lea ecx, [ebp - 0x574]
push ecx
lea edx, [ebp - 0x57c]
push edx
mov byte [ebp - 4], 0x15
call fcn.004019e0
push edi
push eax
lea eax, [ebp - 0x560]
push eax
mov byte [ebp - 4], 0x16
call fcn.004018e0
add esp, 0x18
push eax
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0x17
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x57c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 0x14
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0
push str.m_globalvar1
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x48c56f
call sub.mfc100.dll_Ordinal_1929
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x56c]
push ecx
mov ecx, eax
call fcn.004484d0
lea edx, [ebp - 0x56c]
push edx
lea eax, [ebp - 0x560]
push 0x4ae8b4
push eax
mov byte [ebp - 4], 0x18
call fcn.00401a70
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 0x19
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0x4c7808
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_11627]
lea ecx, [ebp - 0x560]
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0
push str.HDBFS
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x48c55f
push 0x4b170c
push str.C:Windowsiassistprinter.txt
call dword [sym.imp.MSVCR100.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x48c555
push edi
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.MSVCR100.dll_fputs]
add esp, 8
mov ebx, 1
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
lea ecx, [ebp - 0x56c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
test ebx, ebx
jne 0x48c596
push 1
push 0
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.open
push 0
call esi
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x568]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov esi, dword [ebp - 0x5b0]
push str.success
mov ecx, esi
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea ecx, [ebp - 0x5b4]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x59c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x574]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x570]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048e770
mov esp, ebp
pop ebp
ret