Function at 0x4db3c0
Capabilities:
Shutdown system

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4676
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x150
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x98], esi
push str.System_Booster
lea ecx, [esi + 0x1448]
call fcn.005dc510
push 0
push str.System_Booster
mov ecx, esi
call fcn.0045f680
mov ecx, esi
mov dword [ebp - 0xac], eax
call fcn.0043e530
test al, al
je 0x4dc4fa
push 1
push str.https:__www.carifred.com_uvk_help_system_booster.php
lea ecx, [esi + 0x119c]
call fcn.005dc260
mov ecx, dword [esi + 0x100]
mov edi, dword [esi + 0x14e4]
call fcn.005d2f10
push ecx
push 4
push dword [esi + 0x50]
mov edx, 0xe1
mov dword [ebp - 0x30], eax
push dword [esi + 0x4c]
mov ecx, eax
push 0x1bd
push 0x208
push 0x64
call fcn.005d22b0
push ecx
mov ecx, dword [ebp - 0x30]
mov edx, 0xfa
push 4
push dword [esi + 0x50]
push dword [esi + 0x4c]
push 0x3c
push 0x8c
push 0x1cc
call fcn.005d22b0
push 0x226
push 0x2ee
push dword [ebp - 0x30]
mov ecx, edi
call fcn.005c44c0
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x4db4c6
mov eax, dword [ecx]
push 1
call dword [eax]
push 0xc8
push 0xcd
push 0xa
push 0xa
mov ecx, esi
call fcn.0045fec0
push 0x400
mov ecx, edi
call fcn.005c4340
movsd xmm1, qword [0x6edb38]
push 0
push str.Arial
push 1
push 0x320
call fcn.005c42b0
push dword [esi + 0x1438]
mov ecx, edi
call fcn.005c44a0
push 0xffffffffffffffff
push 0x10000101
push 0x1e
push 0x17c
push 0xa
push 0x104
push str.System_Booster
call fcn.005c0890
movsd xmm1, qword [0x6edb08]
mov ecx, edi
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
push 0x10000101
push 0x23
push 0x208
push 0x32
push 0xe1
push str.This_will_scan_your_system_for_application_leftovers_and_other_orphan_items._r_nThe_results_will_be_displayed_in_a_list__where_you_can_choose_what_to_remove.
mov ecx, edi
call fcn.005c0890
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Show_online_help__F1_
push 0x1e
push 0x50
push 4
push 0x294
push 0x7d
push str.Help
call fcn.0045fd50
push 0x20
push 0x53
mov ecx, esi
mov dword [esi + 0x11bc], eax
call fcn.00436320
push 0x10
mov dword [ebp - 0xa4], eax
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov dword [ebp - 0xa8], eax
test eax, eax
je 0x4db5f1
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
movups xmmword [eax], xmm0
mov dword [eax], vtable.Gdiplus::Bitmap.0
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0xa4]
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHICON]
mov ecx, dword [ebp - 0xa8]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ecx + 4], eax
jmp 0x4db5f9
xor ecx, ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0x90], ecx
push edi
push ecx
mov dword [ebp - 4], 0
mov dword [esp], 0x41500000
push str.Run_the_system_protected_resources_scan.
push 0x4b
push 0x69
push 0xdc
push 5
push ecx
push str.Run_SFC_scan
mov ecx, esi
call fcn.0045fda0
push edi
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Register_all_Windows_DLL_and_OCX_files.
push 0x4b
push 0x69
push 0xdc
push 0x73
push dword [ebp - 0xa8]
mov dword [ebp - 0xb4], eax
push str.Register_System_DLLs
call fcn.0045fda0
push edi
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Create_a_registry_backup.
push 0x4b
push 0x69
push 0x12c
push 5
push 0x98
push str.Registry_backup
mov dword [ebp - 0xb8], eax
call fcn.0045fdf0
push edi
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Restore_a_previously_created_registry_backup.
push 0x4b
push 0x69
push 0x12c
push 0x73
push 0x8e
push str.Registry_restore
mov dword [ebp - 0xc8], eax
call fcn.0045fdf0
push edi
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Empty_all_users_temporary_folders_and_the_recycle_bin.
push 0x4b
push 0x69
push 0x17c
push 5
push dword [ebp - 0xa8]
mov dword [ebp - 0xcc], eax
push str.Empty_temp_folders
call fcn.0045fda0
push edi
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Empty_all_installed_browsers_cache.
push 0x4b
push 0x69
push 0x17c
push 0x73
push dword [ebp - 0xa8]
mov dword [ebp - 0xbc], eax
push str.Clean_browser_cache
call fcn.0045fda0
mov dword [ebp - 0xc0], eax
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Create_a_system_restore_point__just_in_case_something_goes_wrong.
push 0x4b
push 0x69
push 0x1cc
push 5
push 0xa2
push str.Create_restore_point
call fcn.0045fdf0
push edi
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Defragment_the_registry_to_improve_performance.
push 0x4b
push 0x69
push 0x1cc
push 0x73
push 0x71
push str.Defragment_the_registry
mov dword [ebp - 0xc4], eax
call fcn.0045fdf0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0x1d6
push 0x6e
push 0xfa
push str.Choose_the_areas_to_scan_below._When_ready__press__Start_Scan_.
mov ecx, edi
mov dword [ebp - 0xd0], eax
call fcn.005c0890
movsd xmm1, qword [0x6edb08]
mov ecx, edi
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0
push 0xffffffffffffffff
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerSystemBooster
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x150], str._Orphan_activeX_COM_objects
mov dword [ebp - 0x14c], str._Orphan_file_extensions
mov dword [ebp - 0x148], str._Orphan_shell_extensions
mov dword [ebp - 0x144], str._Orphan_OpenWith_entries
mov dword [ebp - 0x140], str._Orphan_shared_DLLs
mov dword [ebp - 0x13c], str._Orphan_application_keys_paths
mov dword [ebp - 0x138], str._Orphan_Windows_fonts
mov dword [ebp - 0x134], str._Orphan_uninstall_entries
mov dword [ebp - 0x130], str._Orphan_ShellMUICache_entries
mov dword [ebp - 0x12c], str._Orphan_Autorun_entries
mov dword [ebp - 0x128], str._Orphan_Services
mov dword [ebp - 0x124], str._Orphan_shortcuts
mov dword [ebp - 0x120], str._Discardable_files
mov dword [ebp - 0x11c], str._Restore_points
mov dword [ebp - 0x74], str.Whether_to_search_for_orphan_activeX_COM_objects.
mov dword [ebp - 0x70], str.Whether_to_search_for_orphan_file_extensions.
mov dword [ebp - 0x6c], str.Whether_to_search_for_orphan_shell_extensions.
mov dword [ebp - 0x68], str.Whether_to_search_for_orphan_OpenWith_entries.
mov dword [ebp - 0x64], str.Whether_to_search_for_orphan_shared_DLLs.
mov dword [ebp - 0x60], str.Whether_to_search_for_orphan_application_keys_paths.
mov dword [ebp - 0x5c], str.Whether_to_search_for_orphan_Windows_fonts.
mov dword [ebp - 0x58], str.Whether_to_search_for_orphan_uninstall_entries.
mov dword [ebp - 0x54], str.Whether_to_search_for_orphan_ShellMUICache_entries.
mov dword [ebp - 0x50], str.Whether_to_search_for_orphan_Autorun_entries_and_sheduled_tasks.
mov dword [ebp - 0x4c], str.Whether_to_search_for_orphan_Win32_services.
mov dword [ebp - 0x48], str.Whether_to_search_for_orphan_shortcuts.
mov dword [ebp - 0x44], str.Whether_to_search_for_junk_files.
mov dword [ebp - 0x40], str.Whether_to_list_system_restore_points.
mov dword [ebp - 0x3c], 0x10e
mov dword [ebp - 0xa0], 0x96
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 0
call fcn.005d6a80
mov byte [ebp - 4], 1
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push eax
push str.ScanAreas
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x91], 0
call fcn.005d66b0
test al, al
jne 0x4db90a
mov dword [ebp - 0x34], 0xfff
xor ecx, ecx
mov dword [ebp - 0x9c], ecx
cmp ecx, 7
jne 0x4db928
mov dword [ebp - 0xa0], 0x96
mov dword [ebp - 0x3c], 0x1fe
mov edx, ecx
mov ecx, 2
call fcn.00404860
call fcn.005e9c20
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push edi
mov esi, eax
mov eax, dword [ebp - 0x9c]
test dword [ebp - 0x34], esi
setne cl
push dword [ebp + eax*4 - 0x74]
movzx ecx, cl
push ecx
push ecx
mov ecx, dword [ebp - 0x98]
push 0xdc
push dword [ebp - 0xa0]
push dword [ebp - 0x3c]
push dword [ebp + eax*4 - 0x150]
call fcn.0045fc60
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x30]
test dword [ebp - 0x34], esi
mov dword [ebp + ecx*4 - 0x118], eax
lea eax, [edx + 1]
cmove eax, edx
add dword [ebp - 0xa0], 0x23
inc ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x9c], ecx
cmp ecx, 0xe
jl 0x4db912
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x10
push 0x15e
push 0x18e
push 0xfa
push str.Discardable_file_extensions__separate_with__:
mov ecx, edi
call fcn.005c0890
mov esi, dword [ebp - 0x98]
mov ecx, edi
push dword [esi + 0x1438]
push 0xffffffffffffffff
call fcn.005bec70
xorps xmm0, xmm0
mov dword [ebp - 0x84], 0
lea ecx, [ebp - 0x8c]
movq qword [ebp - 0x8c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x78], 0
lea ecx, [ebp - 0x80]
movq qword [ebp - 0x80], xmm0
call fcn.005dc5e0
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 3
push eax
push str.JunkFileExtensions
lea ecx, [ebp - 0x38]
call fcn.005d6740
test al, al
jne 0x4dba43
push str.___chkdmpdumphdmplogmdmpncholdtemptmpwri
lea ecx, [ebp - 0x8c]
call fcn.005dc510
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x16
push 0x1d6
push 0x19f
push 0xfa
lea ecx, [ebp - 0x8c]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005c0a40
movsd xmm0, qword [0x6edb08]
sub esp, 0xc
mov dword [ebp - 0xd8], eax
movsd qword [esp + 4], xmm0
push str.courier_new
push ecx
push 0
push 0xffffffffffffffff
mov ecx, edi
call fcn.005beb10
push 0xffffffffffffffff
push 0x10000101
push 0x10
push 0x50
push 0x1d1
push 0x113
push str.Select:
mov ecx, edi
call fcn.005c0890
cmp dword [ebp - 0x30], 0xe
push ecx
push 0xffffffffffffffff
push ecx
push 0
push str.Select_all__CtrlA_
sete al
movzx eax, al
push eax
push ecx
push 0x32
push 0x1ea
push 0x109
push str._All
mov ecx, esi
call fcn.0045fbe0
cmp dword [ebp - 0x30], 0
push ecx
push 0xffffffffffffffff
push ecx
push 0
push str.Select_none__CtrlN_
sete cl
mov dword [ebp - 0x9c], eax
movzx ecx, cl
push ecx
push ecx
push 0x32
push 0x1ea
push 0x145
push str._None
mov ecx, esi
call fcn.0045fbe0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Start_scanning_your_system_for_issues.
push 0x50
push 0x6e
push 0x1c2
push 0x1ae
push 0x99
push str.Start_Scan
mov dword [ebp - 0xa0], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov dword [ebp - 0xd4], eax
push str.Schedule_automatic_registry_and_junk_files_cleanup.
push 0x50
push 0x55
push 0x1c2
push 0x221
push 0xa0
push str.Auto_schedule
mov ecx, esi
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Go_back_to_the_Home_page__Esc_.
push 0x50
push 0x55
push 0x1c2
push 0x27b
push 0xb3
push str.Home
mov dword [ebp - 0xdc], eax
call fcn.0045fdf0
mov dword [ebp - 0xb0], eax
mov ecx, 0x70
mov word [ebp - 0x22], ax
mov eax, 0x41
mov word [ebp - 0x2a], cx
mov cx, word [esi + 0x11bc]
mov word [ebp - 0x1e], ax
mov eax, 0x4e
mov word [ebp - 0x28], cx
mov ecx, 0x1b
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0xa0]
mov word [ebp - 0x24], cx
mov ecx, dword [ebp - 0x9c]
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x2c]
push 4
mov word [ebp - 0x1c], cx
mov ecx, edi
push eax
mov byte [ebp - 0x2c], 1
mov byte [ebp - 0x26], 1
mov byte [ebp - 0x20], 9
mov byte [ebp - 0x1a], 9
call fcn.005c47a0
mov ecx, esi
call fcn.0045f300
push 0
mov ecx, esi
call fcn.004771c0
test eax, eax
je 0x4dc439
nop word [eax + eax]
mov esi, dword [esi + 0x14a8]
mov dword [ebp - 0xe0], esi
cmp esi, 0xfffffffa
je 0x4dc439
mov eax, dword [ebp - 0x98]
cmp dword [eax + 0x14d8], edi
jne 0x4dc3ab
mov eax, dword [ebp - 0xb0]
cmp esi, eax
je 0x4dc432
mov ecx, dword [ebp - 0xb4]
cmp esi, ecx
jne 0x4dbcfd
push 0xd
push 0
push eax
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x5c]
push edi
movups xmmword [ebp - 0x5c], xmm0
movups xmmword [ebp - 0x4c], xmm0
call fcn.005b8800
mov esi, dword [ebp - 0x98]
mov ecx, esi
push 1
push str.Cancel
push 0
push 0xffffffffffffffba
sub esp, 8
mov byte [ebp - 4], 4
push 0x46
push 0x1c2
push 0
push 0
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b64a0
push ecx
lea ecx, [esi + 0x1290]
call fcn.00546c60
mov ecx, esi
push 2
lea ecx, [ecx + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
call fcn.005b8790
jmp 0x4dc3ab
cmp esi, dword [ebp - 0xb8]
jne 0x4dbd5a
mov esi, dword [ebp - 0x98]
mov ecx, esi
push 1
push str.Cancel
push 0
push 0xffffffffffffffba
sub esp, 8
push 0x46
push 0x1c2
push edi
push 0x62439c
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b64a0
lea ecx, [esi + 0x1290]
call fcn.0056b2b0
mov ecx, esi
push 2
lea ecx, [ecx + 0x14f0]
call fcn.005b6250
jmp 0x4dc3ab
cmp esi, dword [ebp - 0xbc]
jne 0x4dbdec
push 0xd
push 0
push eax
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x5c]
push edi
movups xmmword [ebp - 0x5c], xmm0
movups xmmword [ebp - 0x4c], xmm0
call fcn.005b8800
mov esi, dword [ebp - 0x98]
sub esp, 8
mov ecx, esi
mov byte [ebp - 4], 5
push 0x46
push 0x1c2
push 0
push str.Emptying_the_temporary_folders_and_the_recycle_bin...
call fcn.0043da60
push 1
push str.Cancel
push 0
push 0xffffffffffffffba
lea ecx, [esi + 0x14f0]
call fcn.005b66e0
mov ecx, eax
call fcn.005b64a0
mov ecx, esi
push 7
lea ecx, [ecx + 0x1290]
call fcn.00579ce0
push 2
lea ecx, [esi + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
call fcn.005b8790
jmp 0x4dc3ab
cmp esi, dword [ebp - 0xc0]
jne 0x4dbe7a
push 0xd
push 0
push eax
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x5c]
push edi
movups xmmword [ebp - 0x5c], xmm0
movups xmmword [ebp - 0x4c], xmm0
call fcn.005b8800
mov esi, dword [ebp - 0x98]
mov ecx, esi
push 1
push str.Cancel
push 0
push 0xffffffffffffffba
sub esp, 8
mov byte [ebp - 4], 6
push 0x46
push 0x1c2
push 0
push str.Emptying_the_internet_browsers_cache_for_all_users...
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b64a0
push 1
lea ecx, [esi + 0x1290]
call fcn.00563140
mov ecx, esi
push 2
lea ecx, [ecx + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
call fcn.005b8790
jmp 0x4dc3ab
cmp esi, dword [ebp - 0xc4]
jne 0x4dbf45
push 0xd
push 0
push eax
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x5c]
push edi
movups xmmword [ebp - 0x5c], xmm0
movups xmmword [ebp - 0x4c], xmm0
call fcn.005b8800
mov esi, dword [ebp - 0x98]
mov ecx, esi
push 0
push 0xffffffffffffffba
sub esp, 8
mov byte [ebp - 4], 7
push 0x46
push 0x1c2
push 0
push 0
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
sub esp, 8
lea ecx, [esi + 0x143c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._System_Booster
call fcn.005dc190
push eax
lea ecx, [ebp - 0x15c]
call fcn.005dc520
sub esp, 8
mov byte [ebp - 4], 8
push 0xc
push ecx
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [esi + 0x1290]
call fcn.00564a40
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 7
call fcn.005dc430
mov ecx, esi
push 2
lea ecx, [ecx + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
call fcn.005b8790
jmp 0x4dc3ab
cmp esi, dword [ebp - 0xc8]
jne 0x4dbf87
push 0xd
push 0
push eax
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x5c]
push edi
movups xmmword [ebp - 0x5c], xmm0
movups xmmword [ebp - 0x4c], xmm0
call fcn.005b8800
mov ecx, dword [ebp - 0x98]
mov byte [ebp - 4], 9
call fcn.00431db0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
call fcn.005b8790
jmp 0x4dc3ab
cmp esi, dword [ebp - 0xcc]
jne 0x4dc023
push 0xd
push 0
push eax
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x5c]
push edi
movups xmmword [ebp - 0x5c], xmm0
movups xmmword [ebp - 0x4c], xmm0
call fcn.005b8800
mov ecx, dword [ebp - 0x98]
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 0xa
push eax
mov dword [ebp - 0x3c], 0
call fcn.00431470
test eax, eax
je 0x4dc2aa
cmp dword [ebp - 0x3c], 0
je 0x4dc2aa
mov ecx, dword [ebp - 0x98]
sub esp, 8
push 0xaa
push 0x1c2
push 0
push edi
push 0
push str.The_computer_must_be_restarted_to_complete_the_registry_restore_operation._r_n_r_nAny_changes_made_to_the_registry_before_rebooting_will_have_no_effect__r_n_r_nPress_OK_to_reboot_now.
call fcn.0043e2e0
mov eax, dword [ebp - 0x98]
push 0
push 0x12
mov byte [eax + 0x1f80], 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
call fcn.005b8790
jmp 0x4dc439
cmp esi, dword [ebp - 0xd0]
jne 0x4dc0bf
push 0xd
push 0
push eax
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x5c]
push edi
movups xmmword [ebp - 0x5c], xmm0
movups xmmword [ebp - 0x4c], xmm0
call fcn.005b8800
mov ecx, dword [ebp - 0x98]
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0xb
push eax
mov dword [ebp - 0x30], 0
call fcn.00432660
test eax, eax
je 0x4dc2aa
cmp dword [ebp - 0x30], 0
je 0x4dc2aa
mov ecx, dword [ebp - 0x98]
sub esp, 8
push 0xaa
push 0x1c2
push 0
push edi
push 0
push str.The_computer_must_be_restarted_to_complete_the_registry_defragmentation._r_n_r_nAny_changes_made_to_the_registry_before_rebooting_will_have_no_effect__r_n_r_nPress_OK_to_reboot_now.
call fcn.0043e2e0
mov eax, dword [ebp - 0x98]
push 0
push 0x12
mov byte [eax + 0x1f80], 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
call fcn.005b8790
jmp 0x4dc439
cmp esi, dword [ebp - 0x118]
je 0x4dc337
cmp esi, dword [ebp - 0x114]
je 0x4dc337
cmp esi, dword [ebp - 0x110]
je 0x4dc337
cmp esi, dword [ebp - 0x10c]
je 0x4dc337
cmp esi, dword [ebp - 0x108]
je 0x4dc337
cmp esi, dword [ebp - 0x104]
je 0x4dc337
cmp esi, dword [ebp - 0x100]
je 0x4dc337
cmp esi, dword [ebp - 0xfc]
je 0x4dc337
cmp esi, dword [ebp - 0xf8]
je 0x4dc337
cmp esi, dword [ebp - 0xf4]
je 0x4dc337
cmp esi, dword [ebp - 0xf0]
je 0x4dc337
cmp esi, dword [ebp - 0xec]
je 0x4dc337
cmp esi, dword [ebp - 0xe8]
je 0x4dc337
cmp esi, dword [ebp - 0xe4]
je 0x4dc337
cmp esi, dword [ebp - 0xd4]
jne 0x4dc279
push 0xd
push 0
push eax
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x5c]
push edi
movups xmmword [ebp - 0x5c], xmm0
movups xmmword [ebp - 0x4c], xmm0
call fcn.005b8800
mov byte [ebp - 4], 0xc
xor esi, esi
mov dword [ebp - 0x34], 0
nop word [eax + eax]
push 4
push dword [ebp + esi*4 - 0x118]
mov ecx, edi
call fcn.005bc500
test eax, eax
je 0x4dc1c8
mov edx, esi
mov ecx, 2
call fcn.00404860
call fcn.005e9c20
or dword [ebp - 0x34], eax
inc esi
cmp esi, 0xe
jl 0x4dc1a0
cmp dword [ebp - 0x34], 0
jne 0x4dc207
mov ecx, dword [ebp - 0x98]
sub esp, 8
push 0x8c
push 0x190
push 0
push edi
push 4
push str.You_must_select_at_least_one_area_to_be_scanned_
call fcn.0043e2e0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
call fcn.005b8790
jmp 0x4dc3ab
mov esi, dword [ebp - 0xd8]
mov ecx, edi
push esi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x80]
call fcn.005dc1c0
mov ecx, eax
call fcn.005dc3a0
cmp eax, 2
jge 0x4dc41d
mov ecx, dword [ebp - 0x98]
sub esp, 8
push 0x8c
push 0x190
push 0
push edi
push 1
push str.Youre_using_an_invalid_junk_file_extension_pattern._r_n_r_nDo_you_wish_to_revert_to_the_default_pattern_
call fcn.0043e2e0
cmp eax, 1
jne 0x4dc3c4
push 0
push str.___chkdmpdumphdmplogmdmpncholdtemptmpwri
push esi
mov ecx, edi
call fcn.005bcd30
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
call fcn.005b8790
jmp 0x4dc3ab
cmp esi, dword [ebp - 0xdc]
jne 0x4dc2c7
push 0xd
push 0
push eax
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x5c]
push edi
movups xmmword [ebp - 0x5c], xmm0
movups xmmword [ebp - 0x4c], xmm0
call fcn.005b8800
mov ecx, dword [ebp - 0x98]
mov byte [ebp - 4], 0xd
call fcn.004d8980
push dword [ebp - 0xac]
call dword [sym.imp.USER32.dll_BringWindowToTop]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
call fcn.005b8790
jmp 0x4dc3ab
mov ecx, dword [ebp - 0x9c]
cmp esi, ecx
je 0x4dc2dd
cmp esi, dword [ebp - 0xa0]
jne 0x4dc3ab
xor eax, eax
cmp esi, ecx
setne al
xor esi, esi
lea eax, [eax*4 + 4]
mov dword [ebp - 0xa4], eax
push eax
push dword [ebp + esi*4 - 0x118]
mov ecx, edi
call fcn.005bd3f0
mov eax, dword [ebp - 0xa4]
inc esi
cmp esi, 0xe
jl 0x4dc2f3
mov esi, dword [ebp - 0xe0]
mov ecx, edi
push eax
push dword [ebp - 0x9c]
call fcn.005bd3f0
xor eax, eax
cmp esi, dword [ebp - 0x9c]
sete al
lea eax, [eax*4 + 4]
push eax
jmp 0x4dc39e
mov dword [ebp - 0xa4], 0
xor esi, esi
push 4
push dword [ebp + esi*4 - 0x118]
mov ecx, edi
call fcn.005bc500
mov edx, dword [ebp - 0xa4]
test eax, eax
lea ecx, [edx + 1]
cmove ecx, edx
inc esi
mov eax, ecx
mov dword [ebp - 0xa4], eax
cmp esi, 0xe
jl 0x4dc343
mov ecx, edi
test eax, eax
jne 0x4dc386
push 8
push dword [ebp - 0x9c]
call fcn.005bd3f0
push 4
jmp 0x4dc39e
cmp eax, 0xe
jne 0x4dc38f
push 4
jmp 0x4dc391
push 8
push dword [ebp - 0x9c]
call fcn.005bd3f0
push 8
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bd3f0
mov esi, dword [ebp - 0x98]
mov ecx, esi
push 0
call fcn.004771c0
test eax, eax
jne 0x4dbc40
jmp 0x4dc439
lea ecx, [ebp - 0x8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x80]
call fcn.005dc480
test al, al
je 0x4dc41d
mov ecx, dword [ebp - 0x98]
sub esp, 8
push 0x8c
push 0x190
push 0
push edi
push 1
push str.Do_you_wish_to_save_the_new_junk_file_extensions_pattern_for_the_next_scans_
call fcn.0043e2e0
cmp eax, 1
jne 0x4dc41d
push 0
lea ecx, [ebp - 0x80]
call fcn.005dc190
push eax
push 1
push str.JunkFileExtensions
lea ecx, [ebp - 0x38]
call fcn.005d5f20
lea ecx, [ebp - 0x5c]
mov byte [ebp - 0x91], 0xe
mov byte [ebp - 4], 3
call fcn.005b8790
jmp 0x4dc439
mov byte [ebp - 0x91], 1
mov dword [ebp - 0x34], 0
xor esi, esi
push 4
push dword [ebp + esi*4 - 0x118]
mov ecx, edi
call fcn.005bc500
test eax, eax
je 0x4dc46a
mov edx, esi
mov ecx, 2
call fcn.00404860
call fcn.005e9c20
or dword [ebp - 0x34], eax
inc esi
cmp esi, 0xe
jl 0x4dc442
push 0
lea eax, [ebp - 0x34]
push eax
push 4
push str.ScanAreas
lea ecx, [ebp - 0x38]
call fcn.005d5f20
cmp byte [ebp - 0x91], 0
mov edi, dword [ebp - 0x98]
je 0x4dc4be
push 0
mov ecx, edi
call fcn.0045f260
cmp byte [ebp - 0x91], 0xe
jne 0x4dc4be
push 0
lea eax, [ebp - 0x80]
mov ecx, edi
push eax
push dword [ebp - 0x34]
call fcn.004d9770
mov byte [ebp - 0x91], al
jmp 0x4dc4c9
lea ecx, [edi + 0x1460]
call fcn.005dc400
lea ecx, [ebp - 0x80]
call fcn.005dc430
lea ecx, [ebp - 0x8c]
call fcn.005dc430
lea ecx, [ebp - 0x38]
call fcn.005d69e0
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
je 0x4dc4f4
mov eax, dword [ecx]
push 1
call dword [eax]
mov al, byte [ebp - 0x91]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret