Function at 0x5081a0
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f6106
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x230
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1f8], edi
push 3
push str.Alternate_Streams_Manager
call fcn.0045f680
mov ecx, edi
mov dword [ebp - 0x208], eax
call fcn.0043e530
test al, al
je 0x50a106
mov esi, dword [edi + 0x14e4]
lea ecx, [edi + 0x119c]
push 1
push str.https:__www.carifred.com_uvk_help_streams_manager.php
mov dword [ebp - 0x1f4], esi
call fcn.005dc260
push 0x400
mov ecx, esi
call fcn.005c4340
push 0xffffffffffffffff
push 0x5f
push 0xa5
push 0xa
push 0x64
push 0x78
mov ecx, edi
call fcn.0043ccb0
push 0x8800
mov ecx, esi
call fcn.005c4340
movsd xmm1, qword [0x6edb20]
push 0
push str.Arial
push 1
push 0x320
call fcn.005c42b0
push 0x37
push 0x50
push 3
push 0xa
mov ecx, edi
call fcn.0045fec0
push str.Alternate_Streams_Manager
lea ecx, [edi + 0x1448]
call fcn.005dc510
push 0xffffffffffffffff
push 0x10000001
push 0x2d
push 0x5a
push 0x3c
push 5
push str.Streams_manager
mov ecx, esi
call fcn.005c0890
push dword [edi + 0x1438]
mov ecx, esi
push 0xffffffffffffffff
call fcn.005bec70
movsd xmm1, qword [0x6edaf8]
mov ecx, esi
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
push 0x10000001
push 0x10
push 0x91
push 0x14
push 0x6e
push str.Scan_options:
mov ecx, esi
call fcn.005c0890
push dword [edi + 0x1438]
mov ecx, esi
push 0xffffffffffffffff
call fcn.005bec70
push ecx
push 0xaf5030
push ecx
push esi
push 0
push 0
push ecx
push 0x87
push 0x28
push 0x6e
push str._Scan_all_ADS
mov ecx, edi
call fcn.0045fbe0
push ecx
push 0xaf5030
push ecx
push esi
push str.Recommended._This_will_ignore_streams_commonly_used_by_the_system_and_trusted_applications.
push 1
push ecx
push 0x87
push 0x3c
push 0x6e
push str._Skip_common_ADS
mov ecx, edi
call fcn.0045fbe0
push ecx
push 0xaf5030
push ecx
push esi
push str.Use_this_option_if_you_want_to_list_only_binary_and_script__r_nstream_files__.exe__.dll__.scr__.sys__.bat__.com__etc_.
push 0
push ecx
push 0x87
push 0x50
push 0x6e
push str._Only_unsafe_ADS
mov ecx, edi
mov dword [ebp - 0x238], eax
call fcn.0045fbe0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Start_a_scan_for_streams._Youll_be_prompted_to_choose_the_drive_or_folder_to_scan.
push 0x5f
push 0x50
push 0xa
push 0x10e
push 0x99
push str.Start_scan
mov dword [ebp - 0x234], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Show_information_on_the_selected_stream__like_its_size__description_or_digital_signature
push 0x5f
push 0x50
push 0xa
push 0x163
push 0x8b
push str.Stream_properties
mov dword [ebp - 0x1fc], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Delete_the_selected_streams.
push 0x5f
push 0x4b
push 0xa
push 0x1b8
push 0x72
push str.Delete_streams
mov dword [ebp - 0x200], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Extract_the_selected_stream_and_save_it_to_a_file.
push 0x5f
push 0x4b
push 0xa
push 0x208
push 0x98
push str.Save_stream_file_as...
mov dword [ebp - 0x23c], eax
call fcn.0045fdf0
mov dword [ebp - 0x204], eax
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Show_online_help__F1_
push 0x5f
push 0x41
push 0xa
push 0x258
push 0x7d
push str.Help
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Go_back_to_the_Home_page__Esc_
push 0x5f
push 0x4b
push 0xa
push 0x29e
push 0xb3
push str.Home
mov dword [edi + 0x11bc], eax
call fcn.0045fdf0
push 0
push 0x10800080
push 0x19
push 0xb9
push 0x23
push 0x2f3
push str.Find_a_stream__CtrlF_
mov ecx, esi
mov dword [edi + 0x11c0], eax
call fcn.005c0a40
push 0x909090
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x1ec], eax
call fcn.005bec70
movsd xmm0, qword [0x6edb08]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push 0
push ecx
push 0x190
push 0xffffffffffffffff
mov ecx, esi
call fcn.005beb10
push 0x40
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bd3f0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Show_the_lists_right_click_menu
push 0x28
push 0x5a
push 0x41
push 0x2f3
push 0x86
push str.List_menu
call fcn.0045fd50
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Find_next__F3_
push 0x28
push 0x5a
push 0x41
push 0x352
push 0x99
push str.Find_next
mov dword [ebp - 0x1e4], eax
call fcn.0045fd50
movsd xmm0, qword [edi + 8]
mov esi, 0x10020
mov dword [ebp - 0x210], eax
mov eax, 0x8010024
comisd xmm0, xmmword [0x6edab0]
mov ecx, dword [ebp - 0x1f4]
push 0
push str.Arial
push 1
push 0x190
movsd xmm1, qword [0x6edaf8]
cmova esi, eax
call fcn.005c42b0
push esi
mov esi, dword [ebp - 0x1f4]
mov ecx, esi
push 0x10000009
push 0x1b3
push 0x2ee
push 0x73
push 0
push 0x62794c
push str._____Stream_file_Size_Name_Extension
call fcn.005c0620
push eax
mov ecx, esi
mov dword [ebp - 0x1d0], eax
call fcn.005c5730
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x1f0], eax
push ecx
push eax
push str.StreamsManager
mov dword [ebp - 0x74], 4
mov dword [ebp - 0x70], 0x1f4
mov dword [ebp - 0x6c], 0x50
mov dword [ebp - 0x68], 0x5a
mov dword [ebp - 0x64], 0x46
call fcn.0045b1e0
push 0x433
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bda80
push ecx
mov ecx, dword [ebp - 0x1f0]
call fcn.005ca760
push 0
push 0
push 0x10
push 0x10
push 1
push 0x55
push dword [edi + 4]
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 1
push dword [ebp - 0x1d0]
mov ecx, esi
call fcn.005be460
push 1
push dword [ebp - 0x1d0]
mov ecx, esi
call fcn.005ba360
movsd xmm0, qword [edi + 8]
comisd xmm0, xmmword [0x6edab0]
jbe 0x50867b
sub esp, 8
mov ecx, esi
push 0x10
push dword [ebp - 0x1d0]
call fcn.005ba470
push 0
push str.StreamsManager
mov ecx, edi
call fcn.0045f4d0
sub esp, 8
mov dword [ebp - 0x78], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x80]
movq qword [ebp - 0x80], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x675498
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer
call fcn.005dc520
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x6c]
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0
movq qword [ebp - 0x6c], xmm0
call fcn.005dc5e0
push 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x80]
push 0xffffffffffffffff
mov dword [ebp - 0xac], 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0xac]
call fcn.005d6a80
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 2
push eax
push str.DisplayFlag
lea ecx, [ebp - 0xac]
call fcn.005d66b0
test al, al
jne 0x50872a
mov dword [ebp - 0xe8], 1
push 0
lea ecx, [ebp - 0x140]
mov byte [ebp - 0x1c9], 0
mov byte [ebp - 0x1dd], 0
call fcn.005d0610
push 0x48
call dword [sym.imp.USER32.dll_GetSystemMetrics]
movsd xmm0, qword [0x6edab8]
mov ecx, eax
comisd xmm0, xmmword [edi + 8]
mov dword [ebp - 0x1e8], ecx
jb 0x508779
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [ebp - 0x1e8]
or eax, 0xff000000
jmp 0x50877b
xor eax, eax
push eax
push ecx
push ecx
push 0x8b
mov ecx, edi
mov dword [ebp - 0x1d4], eax
call fcn.00436420
push eax
lea ecx, [ebp - 0x154]
call fcn.005c6520
mov byte [ebp - 4], 3
mov ecx, esi
push dword [ebp - 0x154]
push str.Stream_properties_tCtrlEnter
push dword [ebp - 0x1e4]
call fcn.005c1450
push 0
push eax
push dword [ebp - 0x1e4]
mov ecx, esi
mov dword [ebp - 0x20c], eax
call fcn.005c56e0
push eax
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
push dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x1e8]
mov ecx, edi
push eax
push eax
push 0x72
call fcn.00436420
push eax
lea ecx, [ebp - 0x150]
call fcn.005c6520
push 0
mov byte [ebp - 4], 4
mov ecx, esi
push dword [ebp - 0x150]
push 0
push 0x32
push str.Delete_the_selected_streams_tDel
push dword [ebp - 0x1e4]
call fcn.005c0400
push dword [ebp - 0x1d4]
mov dword [ebp - 0x22c], eax
mov ecx, edi
mov eax, dword [ebp - 0x1e8]
push eax
push eax
push 0x98
call fcn.00436420
push eax
lea ecx, [ebp - 0x158]
call fcn.005c6520
push 0
mov byte [ebp - 4], 5
mov ecx, esi
push dword [ebp - 0x158]
push 0
push 0x32
push str.Save_the_selected_streams_as..._tCtrlS
push dword [ebp - 0x1e4]
call fcn.005c0400
push dword [ebp - 0x1d4]
mov dword [ebp - 0x228], eax
mov ecx, edi
mov eax, dword [ebp - 0x1e8]
push eax
push eax
push 0xac
call fcn.00436420
push eax
lea ecx, [ebp - 0x15c]
call fcn.005c6520
push 0
mov byte [ebp - 4], 6
push dword [ebp - 0x15c]
push 0
push 0x32
push str.Read_first_200_characters..._tCtrlO
push dword [ebp - 0x1e4]
mov ecx, esi
call fcn.005c0400
push dword [ebp - 0x1d4]
mov dword [ebp - 0x224], eax
mov ecx, edi
mov eax, dword [ebp - 0x1e8]
push eax
push eax
push 0x80
call fcn.00436420
push eax
lea ecx, [ebp - 0x14c]
call fcn.005c6520
push 0
mov byte [ebp - 4], 7
mov ecx, esi
push dword [ebp - 0x14c]
push 0
push 0x32
push str.VirusTotal_report_tCtrlM
push dword [ebp - 0x1e4]
call fcn.005c0400
push dword [ebp - 0x1d4]
mov dword [ebp - 0x220], eax
mov ecx, edi
mov eax, dword [ebp - 0x1e8]
push eax
push eax
push 0x7c
call fcn.00436420
push eax
lea ecx, [ebp - 0x160]
call fcn.005c6520
push 0
mov byte [ebp - 4], 8
mov ecx, esi
push dword [ebp - 0x160]
push 0
push 0x32
push str.Google_stream_name_tCtrlG
push dword [ebp - 0x1e4]
call fcn.005c0400
push 0
push dword [ebp - 0x14c]
mov ecx, esi
mov dword [ebp - 0x21c], eax
push 0
push 0x32
push str.Verify_stream_file_signature_tAltV
push dword [ebp - 0x1e4]
call fcn.005c0400
push dword [ebp - 0x1d4]
mov dword [ebp - 0x230], eax
mov ecx, edi
mov eax, dword [ebp - 0x1e8]
push eax
push eax
push 0xac
call fcn.00436420
push eax
lea ecx, [ebp - 0x164]
call fcn.005c6520
push 0
mov byte [ebp - 4], 9
mov ecx, esi
push dword [ebp - 0x164]
push 0
push 0x32
push str.Open_stream_location_tCtrlL
push dword [ebp - 0x1e4]
call fcn.005c0400
mov dword [ebp - 0x1e8], eax
mov ecx, edi
push 0
call fcn.0045f170
mov dword [ebp - 0x218], eax
mov ecx, 0x1b
mov word [ebp - 0x4a], ax
mov eax, 0xd
mov word [ebp - 0x46], ax
mov eax, dword [ebp - 0x20c]
mov word [ebp - 0x44], ax
mov eax, 0x2e
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x22c]
mov word [ebp - 0x3e], ax
mov eax, 0x53
mov word [ebp - 0x3a], ax
mov eax, dword [ebp - 0x228]
mov word [ebp - 0x38], ax
mov eax, 0x4f
mov word [ebp - 0x34], ax
mov eax, dword [ebp - 0x224]
mov word [ebp - 0x32], ax
mov eax, 0x4d
mov word [ebp - 0x2e], ax
mov eax, dword [ebp - 0x220]
mov word [ebp - 0x5e], cx
movzx ecx, word [edi + 0x11c0]
mov word [ebp - 0x2c], ax
mov eax, 0x47
mov word [ebp - 0x5c], cx
mov ecx, 0x70
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x21c]
mov word [ebp - 0x26], ax
mov eax, 0x56
mov word [ebp - 0x58], cx
movzx ecx, word [edi + 0x11bc]
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x230]
mov word [ebp - 0x56], cx
mov ecx, 0x72
mov word [ebp - 0x20], ax
mov eax, 0x4c
mov word [ebp - 0x52], cx
mov ecx, dword [ebp - 0x210]
mov word [ebp - 0x1c], ax
mov eax, dword [ebp - 0x1e8]
mov word [ebp - 0x50], cx
mov ecx, 0x46
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x60]
push 0xc
mov word [ebp - 0x4c], cx
mov ecx, esi
push eax
mov byte [ebp - 0x60], 1
mov byte [ebp - 0x5a], 1
mov byte [ebp - 0x54], 1
mov byte [ebp - 0x4e], 9
mov byte [ebp - 0x48], 9
mov byte [ebp - 0x42], 1
mov byte [ebp - 0x3c], 9
mov byte [ebp - 0x36], 9
mov byte [ebp - 0x30], 9
mov byte [ebp - 0x2a], 9
mov byte [ebp - 0x24], 0x11
mov byte [ebp - 0x1e], 9
call fcn.005c47a0
push 0x20
push dword [ebp - 0x1ec]
mov ecx, esi
call fcn.005bd3f0
push 0x80
push dword [ebp - 0x1fc]
mov ecx, esi
call fcn.005bd3f0
mov dword [ebp - 0x214], 0xffffffff
mov dword [ebp - 0x10c], 0xffffffff
mov ecx, edi
mov byte [ebp - 4], 0xa
call fcn.0045f300
push 0
mov ecx, edi
call fcn.004771c0
test eax, eax
je 0x50a077
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [edi + 0x14a8]
mov dword [ebp - 0x1d8], eax
cmp eax, 0xfffffffa
je 0x50a077
cmp dword [edi + 0x14d8], esi
jne 0x50a05d
cmp eax, dword [edi + 0x11c0]
je 0x50a070
cmp byte [ebp - 0x1c9], 1
jne 0x508ba4
cmp eax, 0xffffff31
jne 0x508ba4
lea ecx, [ebp - 0x140]
call fcn.005d05f0
mov byte [ebp - 0x1c9], 2
jmp 0x50a05d
mov ecx, dword [ebp - 0x1d0]
cmp eax, 0xffffffea
jne 0x508bb7
cmp dword [edi + 0x14b4], ecx
je 0x508bc3
cmp eax, dword [ebp - 0x1e4]
jne 0x508cfd
cmp eax, dword [ebp - 0x1e4]
jne 0x508c0f
push dword [ebp - 0x1f0]
call dword [sym.imp.USER32.dll_SetFocus]
cmp byte [ebp - 0x1c9], 2
jne 0x508c08
xorps xmm1, xmm1
lea ecx, [ebp - 0x140]
call fcn.005d05a0
movsd xmm1, qword [0x6edb98]
comisd xmm1, xmm0
jbe 0x508c08
mov byte [ebp - 0x1c9], 0
jmp 0x50a05d
mov byte [ebp - 0x1c9], 1
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ebp - 0x1f0]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
mov ecx, 0x20
mov eax, 0x40
cmove ecx, eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x1dc], ecx
cmp eax, dword [ebp - 0x1e8]
jg 0x508c6e
mov edi, eax
nop word [eax + eax]
push ecx
push edi
mov ecx, esi
call fcn.005bd3f0
mov ecx, dword [ebp - 0x1dc]
inc edi
cmp edi, dword [ebp - 0x1e8]
jle 0x508c50
mov edi, dword [ebp - 0x1f8]
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x1d8], eax
jne 0x508ce0
lea ecx, [ebp - 0x11c]
push ecx
push eax
mov ecx, esi
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x508cda
mov eax, dword [ebp - 0x11c]
mov edx, 8
mov ecx, dword [ebp - 0x1e4]
add eax, 0x5a
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x118]
add eax, 0x2d
mov dword [ebp - 0x1dc], eax
push dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x84]
push eax
push edx
push ecx
mov ecx, esi
call fcn.005bbfd0
jmp 0x50a05d
mov eax, dword [ebp - 0x1e4]
mov ecx, eax
xor edx, edx
or eax, 0xffffffff
push eax
push eax
push edx
push ecx
mov ecx, esi
mov dword [ebp - 0x1dc], eax
call fcn.005bbfd0
jmp 0x50a05d
mov edx, dword [ebp - 0x1ec]
cmp eax, 0xffffffb3
jne 0x508d10
cmp dword [edi + 0x14b4], edx
je 0x508d22
mov eax, dword [edi + 0x14a8]
cmp eax, dword [ebp - 0x218]
jne 0x508dc6
mov ecx, edi
call fcn.0046c220
push 0x80
push dword [ebp - 0x1ec]
mov ecx, esi
call fcn.005bd3f0
push dword [ebp - 0x1ec]
mov ecx, esi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x80]
call fcn.005dc1c0
push str.Find_a_stream__CtrlF_
lea ecx, [ebp - 0x80]
call fcn.005dc4c0
mov ecx, esi
test al, al
je 0x508dad
push 0
push 0
push dword [ebp - 0x1ec]
call fcn.005bcd30
push 0
push dword [ebp - 0x1ec]
mov ecx, esi
call fcn.005bec70
movsd xmm0, qword [0x6edb20]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push 0
push ecx
push 0x190
push dword [ebp - 0x1ec]
mov ecx, esi
call fcn.005beb10
jmp 0x50a05d
push 0xffffffffffffffff
push 0
push 0xb1
push dword [ebp - 0x1ec]
call fcn.005befd0
jmp 0x50a05d
cmp eax, 0xffffffb4
jne 0x508e22
cmp dword [edi + 0x14b4], edx
jne 0x508e22
push edx
mov ecx, esi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x80]
call fcn.005dc1c0
lea ecx, [ebp - 0x80]
call fcn.005dc3a0
cmp eax, 3
jl 0x50a05d
push dword [ebp - 0x210]
mov ecx, esi
call fcn.005c4370
push 0xffffffffffffffff
push 6
push 0xffffffffffffffff
lea ecx, [ebp - 0x80]
call fcn.005dc190
mov ecx, dword [ebp - 0x1f0]
mov edx, eax
call fcn.005c9ea0
jmp 0x50a05d
cmp eax, dword [ebp - 0x210]
jne 0x508ee3
push edx
mov ecx, esi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x80]
call fcn.005dc1c0
push str.Find_a_stream__CtrlF_
lea ecx, [ebp - 0x80]
call fcn.005dc4c0
test al, al
jne 0x508ec8
lea ecx, [ebp - 0x80]
call fcn.005dbeb0
test al, al
jne 0x508ec8
push dword [ebp - 0x214]
push 0x1e
push 0xffffffffffffffff
call fcn.005dc190
mov ecx, dword [ebp - 0x1f0]
mov edx, eax
call fcn.005c9ea0
mov dword [ebp - 0x214], eax
mov ecx, esi
push 0x80
cmp eax, 0xffffffff
je 0x508e9a
push dword [ebp - 0x1d0]
call fcn.005bd3f0
jmp 0x50a05d
push dword [ebp - 0x1ec]
call fcn.005bd3f0
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push 0
push esi
push 4
push str.Find_reached_the_end_of_the_list.
call fcn.0043e2e0
jmp 0x50a05d
push 0
push 0
push 0x201
push dword [ebp - 0x218]
mov ecx, esi
call fcn.005befd0
jmp 0x50a05d
cmp eax, 0xffffffeb
jne 0x508efe
cmp dword [edi + 0x14b4], ecx
jne 0x508f10
push edx
push ecx
mov ecx, edi
call fcn.0043e280
jmp 0x50a05d
cmp eax, 0xffffffd3
je 0x50a049
cmp eax, 0xffffffd2
je 0x50a049
mov edx, dword [ebp - 0x1fc]
cmp eax, edx
jne 0x5094c0
push 1
push dword [edi + 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0xa0], 0
lea ecx, [ebp - 0xa8]
movq qword [ebp - 0xa8], xmm0
call fcn.005dc570
push dword [ebp - 0x208]
mov byte [ebp - 4], 0xb
mov edx, str.Please_select_the_root_directory_to_scan
push dword [edi + 0x1c]
push 1
push ecx
lea ecx, [ebp - 0xa8]
call fcn.005e1b00
lea ecx, [ebp - 0xa8]
test al, al
jne 0x508f7b
mov byte [ebp - 4], 0xa
call fcn.005dc430
jmp 0x50a05d
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
jne 0x508f9f
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0xa
call fcn.005dc430
jmp 0x50a05d
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0xcc]
push dword [ebp - 0x1d0]
movups xmmword [ebp - 0xcc], xmm0
push dword [ebp - 0x1fc]
movups xmmword [ebp - 0xbc], xmm0
push esi
call fcn.005b8800
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0xc
call fcn.005dc3a0
dec eax
lea ecx, [ebp - 0xa8]
push eax
call fcn.005dc440
cmp word [eax], 0x5c
jne 0x508fff
push 1
lea ecx, [ebp - 0xa8]
call fcn.005dadc0
lea eax, [ebp - 0xa8]
mov dword [ebp - 0x1c8], edi
push eax
lea ecx, [ebp - 0x1c4]
call fcn.005dc5b0
push 0x2c
lea eax, [ebp - 0x1ac]
mov byte [ebp - 0x1b8], 0
push 0
push eax
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b0], 0
call fcn.00420090
xorps xmm0, xmm0
mov dword [ebp - 0x180], 0
add esp, 0xc
mov dword [ebp - 0x17c], 0
movq qword [ebp - 0x178], xmm0
mov dword [ebp - 0x170], 0xffffffff
xor eax, eax
movlpd qword [ebp - 0x148], xmm0
push str.ntdll.dll
mov dword [ebp - 0x144], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, eax
mov dword [ebp - 0x148], ecx
test ecx, ecx
je 0x5090af
push str.NtQueryInformationFile
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x148]
mov dword [ebp - 0x144], eax
jmp 0x5090b1
xor eax, eax
mov byte [ebp - 4], 0xe
test ecx, ecx
je 0x5090c4
test eax, eax
jne 0x509134
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x170]
cmp eax, 0xffffffff
je 0x5090da
test eax, eax
je 0x5090da
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x180]
test eax, eax
je 0x5090ed
push eax
call fcn.0041e1c3
add esp, 4
mov eax, dword [ebp - 0x1b0]
test eax, eax
je 0x509100
push eax
call fcn.00418a90
add esp, 4
lea ecx, [ebp - 0x1c4]
mov dword [ebp - 0x1b0], 0
call fcn.005dc430
lea ecx, [ebp - 0xcc]
call fcn.005b8790
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0xa
call fcn.005dc430
jmp 0x50a05d
push 4
push dword [ebp - 0x234]
mov ecx, esi
call fcn.005bc500
test eax, eax
je 0x50915a
push 8
mov dword [ebp - 0x1b4], 2
push str..exe.dll.sys.com.raw.scr.cab.ocx.xpi.vbs.vbe.msi.jar.cpl.drv.bat.cmd.reg
jmp 0x50917e
push 4
push dword [ebp - 0x238]
mov ecx, esi
call fcn.005bc500
test eax, eax
je 0x5091a0
push 8
mov dword [ebp - 0x1b4], 1
push str.:OECustomProperty:OEStandardProperty:encryptable:favicon:Zone.Identifier:Win32App_1
call fcn.005d9980
mov ecx, dword [ebp - 0x1b0]
mov esi, eax
test ecx, ecx
je 0x509198
push ecx
call fcn.00418a90
add esp, 4
mov dword [ebp - 0x1b0], esi
jmp 0x5091aa
mov dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x1d0]
xorps xmm0, xmm0
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x180]
mov byte [ebp - 0x1a4], 1
movlpd qword [ebp - 0x1a0], xmm0
movlpd qword [ebp - 0x198], xmm0
movlpd qword [ebp - 0x190], xmm0
mov dword [ebp - 0x184], 0x800
test eax, eax
je 0x509201
push eax
call fcn.0041e1c3
add esp, 4
push 0x800
call fcn.0041e7cf
push ecx
push 0x50
push 0x1f4
mov dword [ebp - 0x180], eax
mov ecx, edi
push 0
lea eax, [ebp - 0x124]
mov dword [ebp - 0x17c], 0x800
push str.Searching_for_Alternate_data_streams....
mov dword [ebp - 0x174], eax
call fcn.0043da60
push 1
push str.Cancel
push 0
push 0xffffffffffffffb0
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
mov ecx, eax
call fcn.005b64a0
push 0
push 0
push 0x1009
push dword [ebp - 0x1f0]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
lea eax, [ebp - 0x1c8]
push eax
push 0x440e90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x84], esi
xor edx, edx
mov byte [ebp - 4], 0xf
mov ecx, esi
call fcn.005cca30
test al, al
je 0x509318
nop dword [eax]
push 0
push 0
mov ecx, edi
call fcn.0043d720
test eax, eax
je 0x50930b
cmp byte [ebp - 0x1b8], 0
jne 0x50930b
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push 0
push dword [ebp - 0x1f4]
push 1
push str.Are_you_sure_you_want_to_cancel_the_scan_
call fcn.0043e2e0
movzx ecx, byte [ebp - 0x1b8]
cmp eax, 1
mov eax, 1
cmove ecx, eax
mov byte [ebp - 0x1b8], cl
mov ecx, edi
push eax
call fcn.0043d8e0
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x5092b0
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
cmp byte [ebp - 0x1b8], 0
mov ecx, str.The_scan_completed_successfully._r_n_r_n
mov eax, str.The_scan_was_cancelled._r_n_r_n
cmove eax, ecx
lea ecx, [ebp - 0x80]
push eax
call fcn.005dc510
push fcn.005dc430
push fcn.005dc5e0
push 2
push 0xc
lea eax, [ebp - 0x100]
push eax
call fcn.0041e804
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x100]
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
call fcn.005db580
push dword [ebp - 0x194]
lea ecx, [ebp - 0xf4]
push dword [ebp - 0x198]
call fcn.005db580
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._streams_found_with_the_selected_filter.
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
push str._file_objects_scanned._r_n_r_n
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x80]
call fcn.005da780
sub esp, 8
lea ecx, [ebp - 0x80]
push 0x8c
push 0x190
push 0
push 0
push 4
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043e2e0
lea ecx, [ebp - 0xcc]
call fcn.005b8600
push dword [ebp - 0x204]
mov ecx, edi
push dword [ebp - 0x200]
push dword [ebp - 0x1d0]
call fcn.0046af40
push fcn.005dc430
push 2
push 0xc
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0xf
push eax
call fcn.0041e45b
cmp esi, 0xffffffff
je 0x50943c
test esi, esi
je 0x50943c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x509442
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x170]
cmp eax, 0xffffffff
je 0x509460
test eax, eax
je 0x509460
push eax
call esi
mov eax, dword [ebp - 0x180]
test eax, eax
je 0x509473
push eax
call fcn.0041e1c3
add esp, 4
mov eax, dword [ebp - 0x1b0]
test eax, eax
je 0x509486
push eax
call fcn.00418a90
add esp, 4
lea ecx, [ebp - 0x1c4]
mov dword [ebp - 0x1b0], 0
call fcn.005dc430
lea ecx, [ebp - 0xcc]
call fcn.005b8790
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0xa
call fcn.005dc430
mov esi, dword [ebp - 0x1f4]
jmp 0x50a05d
cmp eax, dword [ebp - 0x200]
je 0x509ff4
mov eax, dword [edi + 0x14a8]
cmp eax, dword [ebp - 0x20c]
je 0x509ff4
cmp eax, 0xfffffff2
jne 0x5094ef
cmp dword [edi + 0x14b4], ecx
je 0x509ff4
cmp eax, dword [ebp - 0x22c]
je 0x509e13
cmp eax, dword [ebp - 0x23c]
je 0x509e13
cmp eax, dword [ebp - 0x228]
je 0x5099dd
cmp eax, dword [ebp - 0x204]
je 0x5099dd
cmp eax, dword [ebp - 0x224]
jne 0x509573
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
push ecx
push edx
push esi
lea ecx, [ebp - 0xcc]
movups xmmword [ebp - 0xcc], xmm0
movups xmmword [ebp - 0xbc], xmm0
call fcn.005b8800
push dword [ebp - 0x1d0]
mov ecx, edi
mov byte [ebp - 4], 0x1b
call fcn.00507230
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0xa
call fcn.005b8790
jmp 0x50a05d
cmp eax, dword [ebp - 0x220]
jne 0x50958f
push 0
push dword [ebp - 0x1f0]
mov ecx, edi
call fcn.00435a20
jmp 0x50a05d
cmp eax, dword [ebp - 0x21c]
jne 0x50965c
xorps xmm0, xmm0
push ecx
mov ecx, esi
movlpd qword [ebp - 0x90], xmm0
call fcn.005bb360
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], 0
mov byte [ebp - 4], 0x1c
mov ecx, dword [eax]
test ecx, ecx
jne 0x5095da
push eax
mov byte [ebp - 4], 0xa
call fcn.0041e1c3
add esp, 4
jmp 0x50a05d
mov dword [ebp - 0x1dc], 1
cmp ecx, 1
jl 0x50964a
mov ecx, 4
mov dword [ebp - 0x1d8], ecx
push 0
push dword [ecx + eax]
mov ecx, esi
push dword [ebp - 0x1d0]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x80]
call fcn.005dc1c0
push 0
push 0
lea eax, [ebp - 0x80]
push eax
call fcn.00508120
push eax
mov ecx, edi
call fcn.0045ee00
mov edx, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x90]
inc edx
mov ecx, dword [ebp - 0x1d8]
add ecx, 4
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 0x1d8], ecx
cmp edx, dword [eax]
jle 0x5095f4
push eax
mov byte [ebp - 4], 0xa
call fcn.0041e1c3
add esp, 4
jmp 0x50a05d
mov eax, dword [edi + 0x14a8]
cmp eax, dword [ebp - 0x230]
jne 0x509902
xorps xmm0, xmm0
push ecx
mov ecx, esi
movlpd qword [ebp - 0x88], xmm0
call fcn.005bb360
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], 0
mov byte [ebp - 4], 0x1d
cmp dword [eax], 0
jne 0x5096ac
push eax
mov byte [ebp - 4], 0xa
call fcn.0041e1c3
add esp, 4
jmp 0x50a05d
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0xcc]
push dword [ebp - 0x1d0]
movups xmmword [ebp - 0xcc], xmm0
push dword [ebp - 0x1fc]
movups xmmword [ebp - 0xbc], xmm0
push esi
call fcn.005b8800
push 0
push str.Cancel
sub esp, 8
mov byte [ebp - 4], 0x1e
mov ecx, edi
push 0x46
push 0x258
push 0
push 0x62439c
call fcn.0043da60
mov ecx, eax
call fcn.005b64a0
push 1
lea ecx, [edi + 0x14f0]
push str.Next_stream
call fcn.005b64a0
xorps xmm0, xmm0
mov dword [ebp - 0xdc], 0
lea ecx, [ebp - 0xe4]
movq qword [ebp - 0xe4], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x1f
mov ecx, 1
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x1d4], ecx
mov eax, dword [eax]
cmp eax, ecx
jl 0x5098c8
mov dword [ebp - 0x1d8], 0x64
cmp ecx, eax
jne 0x50978d
push 2
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b61c0
push str.Close
push 1
lea ecx, [edi + 0x14f0]
call fcn.005b6150
mov ecx, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x88]
push 0
push dword [eax + ecx*4]
mov ecx, esi
push dword [ebp - 0x1d0]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x80]
call fcn.005dc1c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x635758
lea ecx, [ebp - 0x80]
call fcn.005dc190
push eax
push str.Verifying
lea ecx, [ebp - 0xe4]
call fcn.005dc200
lea ecx, [ebp - 0xe4]
call fcn.005dc190
mov ecx, dword [ebp - 0x88]
push eax
mov eax, dword [ebp - 0x1d8]
cdq
idiv dword [ecx]
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
push 0
push 1
mov ecx, edi
call fcn.0043d720
lea ecx, [ebp - 0x80]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.00594240
push eax
lea ecx, [ebp - 0xe4]
call fcn.005dc1c0
lea ecx, [edi + 0x14f0]
call fcn.005b6220
push eax
mov edx, 0x1f4
lea ecx, [ebp - 0x80]
call fcn.0058e5e0
sub esp, 0xc
lea ecx, [ebp - 0x80]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
call fcn.005dc190
push eax
lea ecx, [ebp - 0xe4]
call fcn.005da510
lea ecx, [ebp - 0xe4]
call fcn.005dc190
push eax
push 0xffffffffffffffff
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
nop dword [eax]
push 0
push 0
mov ecx, edi
call fcn.0043d720
test eax, eax
je 0x509890
cmp eax, 1
jg 0x5098c8
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x1d4]
add dword [ebp - 0x1d8], 0x64
inc ecx
mov dword [ebp - 0x1d4], ecx
mov eax, dword [eax]
cmp ecx, eax
jle 0x509764
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0xe4]
call fcn.005dc430
lea ecx, [ebp - 0xcc]
call fcn.005b8790
mov byte [ebp - 4], 0xa
push dword [ebp - 0x88]
call fcn.0041e1c3
add esp, 4
jmp 0x50a05d
cmp eax, dword [ebp - 0x1e8]
jne 0x50a05d
xorps xmm0, xmm0
push ecx
mov ecx, esi
movlpd qword [ebp - 0x90], xmm0
call fcn.005bb360
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], 0
mov byte [ebp - 4], 0x20
mov ecx, dword [eax]
test ecx, ecx
jne 0x50994d
push eax
mov byte [ebp - 4], 0xa
call fcn.0041e1c3
add esp, 4
jmp 0x50a05d
mov dword [ebp - 0x1dc], 1
cmp ecx, 1
jl 0x5099cb
mov edi, dword [ebp - 0x90]
mov eax, 4
mov dword [ebp - 0x1d8], eax
nop dword [eax]
push 0
push dword [eax + edi]
mov ecx, esi
push dword [ebp - 0x1d0]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x80]
call fcn.005dc1c0
push 1
lea eax, [ebp - 0x80]
push eax
call fcn.00508120
xor edx, edx
mov ecx, eax
call fcn.00590c10
mov ecx, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x1d8]
inc ecx
add eax, 4
mov dword [ebp - 0x1dc], ecx
mov dword [ebp - 0x1d8], eax
cmp ecx, dword [edi]
jle 0x509970
mov edi, dword [ebp - 0x1f8]
mov eax, dword [ebp - 0x90]
push eax
mov byte [ebp - 4], 0xa
call fcn.0041e1c3
add esp, 4
jmp 0x50a05d
xorps xmm0, xmm0
push ecx
mov ecx, esi
movlpd qword [ebp - 0x148], xmm0
call fcn.005bb360
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], 0
mov ecx, dword [eax]
test ecx, ecx
jne 0x509a18
push eax
mov byte [ebp - 4], 0xa
call fcn.0041e1c3
add esp, 4
jmp 0x50a05d
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0
movq qword [ebp - 0x9c], xmm0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x1d8], 1
cmp ecx, 1
jl 0x509dfb
mov edx, 4
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x1d4], edx
lea ecx, [ebp - 0x9c]
push ecx
push dword [edx + eax]
push dword [ebp - 0x1d0]
push esi
call fcn.0045afd0
cmp eax, 3
jb 0x509d8e
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x1d4]
push 0
push dword [ecx + eax]
mov ecx, esi
push dword [ebp - 0x1d0]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x80]
call fcn.005dc1c0
mov edi, dword [ebp - 0x9c]
mov eax, 3
mov ecx, dword [ebp - 0x94]
cmp edi, 2
xorps xmm0, xmm0
mov dword [ebp - 0xd0], 0
cmovbe edi, eax
movq qword [ebp - 0xd8], xmm0
sub esp, 8
mov dword [ebp - 0x9c], edi
add ecx, 0x18
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
push str.Please_select_the_path_to_save
lea ecx, [ebp - 0xd8]
call fcn.005dc520
mov ecx, dword [ebp - 0x1d8]
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x148]
push 2
push dword [eax + ecx*4]
mov ecx, esi
push dword [ebp - 0x1d0]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x80]
call fcn.005dc1c0
push 1
lea ecx, [ebp - 0x80]
call fcn.005dad50
push dword [ebp - 0x208]
lea ecx, [ebp - 0x80]
push 0
call fcn.005dc190
push eax
push 8
push str.Al_files__._
push 0
lea ecx, [ebp - 0xd8]
call fcn.005dc190
mov edx, eax
lea ecx, [ebp - 0x80]
call fcn.005e1da0
test al, al
jne 0x509b99
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x15
call fcn.005dc430
mov edi, dword [ebp - 0x1f8]
jmp 0x509d8e
mov ecx, dword [ebp - 0x94]
test edi, edi
mov eax, 1
cmove edi, eax
mov dword [ebp - 0x9c], edi
call fcn.005dc190
mov ecx, eax
call fcn.005e0e70
xorps xmm0, xmm0
mov dword [ebp - 0x1dc], eax
movlpd qword [ebp - 0x90], xmm0
lea esi, [eax + 1]
push esi
call fcn.0041e7cf
add esp, 4
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], esi
mov byte [ebp - 4], 0x17
test edi, edi
mov ecx, dword [ebp - 0x94]
mov eax, 1
xorps xmm0, xmm0
cmove edi, eax
push 0
push 0x10
movups xmmword [ebp - 0x108], xmm0
mov dword [ebp - 0x9c], edi
movups xmmword [ebp - 0xf8], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x108]
call fcn.005e4770
xorps xmm0, xmm0
mov byte [ebp - 4], 0x18
push 0
push 0x1a
lea ecx, [ebp - 0x80]
movups xmmword [ebp - 0xcc], xmm0
movups xmmword [ebp - 0xbc], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0xcc]
call fcn.005e4770
mov esi, dword [ebp - 0x1dc]
lea ecx, [ebp - 0x108]
push esi
mov byte [ebp - 4], 0x19
push dword [ebp - 0x90]
call fcn.005e40c0
cmp eax, esi
jne 0x509ca9
push esi
push dword [ebp - 0x90]
lea ecx, [ebp - 0xcc]
call fcn.005e3780
cmp eax, esi
jne 0x509ca9
cmp edi, 2
mov dword [ebp - 0x1dc], str._stream_was_successfully_saved.
mov eax, 3
cmovbe edi, eax
mov dword [ebp - 0x9c], edi
mov edi, str.The
jmp 0x509cc9
cmp edi, 2
mov dword [ebp - 0x1dc], str._stream_could_not_be_saved.
mov eax, 3
cmovbe edi, eax
mov dword [ebp - 0x9c], edi
mov edi, str.Sorry__the
mov ecx, dword [ebp - 0x94]
lea esi, [ebp - 0xd8]
add ecx, 0x18
call fcn.005dc190
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x1dc]
mov ecx, esi
push eax
push edi
call fcn.005dc200
mov esi, dword [ebp - 0x1f4]
lea ecx, [ebp - 0xd8]
sub esp, 8
push 0x8c
push 0x190
push 0
push esi
push 4
call fcn.005dc190
mov edi, dword [ebp - 0x1f8]
mov ecx, edi
push eax
call fcn.0043e2e0
lea ecx, [ebp - 0xc4]
call fcn.005d9280
mov eax, dword [ebp - 0xcc]
cmp eax, 0xffffffff
je 0x509d50
test eax, eax
je 0x509d50
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x100]
call fcn.005d9280
mov eax, dword [ebp - 0x108]
cmp eax, 0xffffffff
je 0x509d71
test eax, eax
je 0x509d71
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x90]
call fcn.0041e1c3
add esp, 4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xd8]
call fcn.005dc430
mov ecx, dword [ebp - 0x1d8]
mov eax, dword [ebp - 0x148]
inc ecx
mov edx, dword [ebp - 0x84]
add dword [ebp - 0x1d4], 4
add edx, 4
mov dword [ebp - 0x1d8], ecx
mov dword [ebp - 0x84], edx
cmp ecx, dword [eax]
jle 0x509a73
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x509df5
push fcn.005dc430
lea esi, [eax - 4]
mov byte [ebp - 4], 0x1a
push dword [esi]
push 0xc
push eax
call fcn.0041e45b
mov eax, dword [esi]
lea eax, [eax + eax*2]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.0041e1c8
add esp, 8
mov eax, dword [ebp - 0x148]
push eax
mov byte [ebp - 4], 0xa
call fcn.0041e1c3
mov esi, dword [ebp - 0x1f4]
add esp, 4
jmp 0x50a05d
xorps xmm0, xmm0
push ecx
mov ecx, esi
movlpd qword [ebp - 0x148], xmm0
call fcn.005bb360
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], 0
mov byte [ebp - 4], 0x12
mov ecx, dword [eax]
test ecx, ecx
jne 0x509e52
push eax
mov byte [ebp - 4], 0xa
call fcn.0041e1c3
add esp, 4
jmp 0x50a05d
cmp ecx, 1
mov eax, str.Are_you_sure_you_want_to_delete_the_selected_streams_
mov ecx, str.Are_you_sure_you_want_to_delete_the_selected_stream_
cmove eax, ecx
lea ecx, [ebp - 0x80]
push eax
call fcn.005dc510
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0xcc]
push dword [ebp - 0x1d0]
movups xmmword [ebp - 0xcc], xmm0
push dword [ebp - 0x1fc]
movups xmmword [ebp - 0xbc], xmm0
push esi
call fcn.005b8800
sub esp, 8
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x80]
push 0x8c
push 0x190
push 0
push esi
push 1
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043e2e0
test eax, eax
jne 0x509ee9
lea ecx, [ebp - 0xcc]
call fcn.005b8790
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x148]
push eax
call fcn.0041e1c3
add esp, 4
jmp 0x50a05d
mov ecx, dword [ebp - 0x148]
xor edx, edx
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov eax, dword [ecx]
test eax, eax
je 0x509fa7
mov edi, eax
jmp 0x509f1b
mov ecx, dword [ebp - 0x148]
push 0
push dword [ecx + edi*4]
mov ecx, esi
push dword [ebp - 0x1d0]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x80]
call fcn.005dc1c0
lea ecx, [ebp - 0x80]
call fcn.005dc190
mov ecx, eax
call fcn.005cc690
push 3
lea ecx, [ebp - 0x80]
call fcn.005dc190
push eax
call fcn.005771e0
cmp al, 2
jne 0x509f68
mov edx, dword [ebp - 0x1d4]
inc edx
mov dword [ebp - 0x1d4], edx
jmp 0x509f98
cmp al, 1
jne 0x509f8c
mov eax, dword [ebp - 0x148]
mov ecx, esi
inc dword [ebp - 0x1dc]
push 0
push dword [eax + edi*4]
push dword [ebp - 0x1d0]
call fcn.005bb970
jmp 0x509f92
inc dword [ebp - 0x1d8]
mov edx, dword [ebp - 0x1d4]
sub edi, 1
jne 0x509f15
mov edi, dword [ebp - 0x1f8]
push ecx
push dword [ebp - 0x1d8]
mov ecx, edi
push edx
push dword [ebp - 0x1dc]
call fcn.00503000
push dword [ebp - 0x204]
mov ecx, edi
push dword [ebp - 0x200]
push dword [ebp - 0x1d0]
call fcn.0046af40
lea ecx, [ebp - 0xcc]
call fcn.005b8790
mov byte [ebp - 4], 0xa
push dword [ebp - 0x148]
call fcn.0041e1c3
add esp, 4
jmp 0x50a05d
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
push ecx
push edx
push esi
lea ecx, [ebp - 0xcc]
movups xmmword [ebp - 0xcc], xmm0
movups xmmword [ebp - 0xbc], xmm0
call fcn.005b8800
push dword [ebp - 0x1d0]
mov ecx, edi
mov byte [ebp - 4], 0x11
call fcn.00506600
push dword [ebp - 0x208]
call dword [sym.imp.USER32.dll_BringWindowToTop]
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0xa
call fcn.005b8790
jmp 0x50a05d
push dword [ebp - 0x204]
push dword [ebp - 0x200]
push ecx
mov ecx, edi
call fcn.0046af40
push 0
mov ecx, edi
call fcn.004771c0
test eax, eax
jne 0x508b50
jmp 0x50a077
mov byte [ebp - 0x1dd], 1
push 0
push str.StreamsManager
mov ecx, edi
call fcn.0045f380
mov al, byte [ebp - 0x1dd]
mov ecx, edi
xor al, 1
movzx eax, al
push eax
call fcn.0045f260
lea ecx, [ebp - 0x164]
call fcn.005c6500
lea ecx, [ebp - 0x160]
call fcn.005c6500
lea ecx, [ebp - 0x14c]
call fcn.005c6500
lea ecx, [ebp - 0x15c]
call fcn.005c6500
lea ecx, [ebp - 0x158]
call fcn.005c6500
lea ecx, [ebp - 0x150]
call fcn.005c6500
lea ecx, [ebp - 0x154]
call fcn.005c6500
lea ecx, [ebp - 0xac]
call fcn.005d69e0
lea ecx, [ebp - 0x6c]
call fcn.005dc430
lea ecx, [ebp - 0x80]
call fcn.005dc430
mov al, byte [ebp - 0x1dd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret