Function at 0x53abc0
Capabilities:
Check if file exists
Get common file path
Get graphical window text
Resolve function by parsing pe exports
Shutdown system

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f83ed
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1568
call fcn.0041ead0
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x154c], edi
mov esi, dword [ebx + 8]
mov dword [ebp - 0x1518], esi
cmp dword [esi], 0
jne 0x53ac23
or eax, 0xffffffff
jmp 0x53f456
xor edx, edx
mov ecx, str.HKLM64SOFTWAREUVK___Ultra_virus_killer_backupsVirusTotal_reports
call fcn.005d3780
test al, al
je 0x53ac44
push 1
mov edx, str.HKLM64SOFTWARECarifredVirusTotal_reports
mov ecx, str.HKLM64SOFTWAREUVK___Ultra_virus_killer_backupsVirusTotal_reports
call fcn.005d3c40
xor edx, edx
mov ecx, str.HKLM64SOFTWAREUVK___Ultra_virus_killer_backups
call fcn.005d3780
test al, al
je 0x53ac65
push 1
mov edx, str.HKLM64SOFTWARECarifredUVK___Ultra_virus_killer_backups
mov ecx, str.HKLM64SOFTWAREUVK___Ultra_virus_killer_backups
call fcn.005d3c40
mov dword [edi + 0x628], esi
mov eax, dword [esi + 4]
test eax, eax
je 0x53ac87
mov ecx, dword [eax]
test ecx, ecx
je 0x53ac87
push 0
call fcn.005c5730
mov dword [ebp - 0x1534], eax
jmp 0x53ac91
mov dword [ebp - 0x1534], 0
mov ecx, dword [esi]
call fcn.005c4310
mov ecx, dword [ebp - 0x1518]
mov esi, eax
push esi
mov dword [ebp - 0x1530], esi
mov eax, dword [ecx]
lea ecx, [edi + 0x698]
mov dword [ebp - 0x1538], eax
call fcn.005b7660
lea ecx, [edi + 0x940]
push esi
call fcn.005b6130
push esi
lea ecx, [edi + 0x3a0]
call fcn.005c4320
mov eax, dword [ebp - 0x1518]
mov ecx, dword [eax + 0x108]
test ecx, ecx
jne 0x53ad2a
push pe_nt_image_headers32
call fcn.0041e3d6
mov esi, eax
add esp, 4
mov dword [ebp - 0x1568], esi
push pe_nt_image_headers32
push 0
push esi
mov dword [ebp - 4], 0
call fcn.00420090
add esp, 0xc
mov ecx, esi
call fcn.0057cb00
mov esi, dword [ebp - 0x1530]
mov ecx, eax
mov eax, dword [ebp - 0x1518]
mov dword [ebp - 4], 0xffffffff
push esi
lea edx, [edi + 0x698]
mov dword [edi + 0x1c94], ecx
push edx
push dword [eax]
lea eax, [edi + 0x940]
push eax
lea eax, [edi + 0x3c]
push eax
call fcn.0057c740
mov ecx, dword [edi + 0x1c94]
lea eax, [ebp - 0x14e8]
push eax
push 0x50b230
push 0x50b260
mov dword [ebp - 0x14e8], edi
call fcn.0057c690
mov ecx, dword [edi + 0x1c94]
push 1
call fcn.0057c620
mov ecx, dword [edi + 0x1c94]
push 0
call fcn.0057c630
mov ecx, dword [edi + 0x1c94]
push 0
call fcn.0057bc50
push eax
lea ecx, [edi + 0x348]
call fcn.005dc510
mov eax, dword [ebp - 0x1518]
lea ecx, [ebp - 0x260]
add eax, 0xb8
mov dword [ebp - 0x258], 0
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x260], xmm0
call fcn.005dc5b0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x26c]
xorps xmm0, xmm0
mov dword [ebp - 0x264], 0
movq qword [ebp - 0x26c], xmm0
call fcn.005dc5e0
push 0
push 1
lea ecx, [edi + 0x348]
mov byte [ebp - 4], 2
call fcn.005dc190
push eax
lea ecx, [ebp - 0x260]
call fcn.005dc260
mov ecx, eax
call fcn.005dbed0
push str._ThirdParty_
lea ecx, [ebp - 0x26c]
call fcn.005dbc20
mov ecx, dword [edi + 0x1c94]
lea eax, [ebp - 0x26c]
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.0057c6f0
xorps xmm0, xmm0
mov dword [ebp - 0x210], 0
lea ecx, [ebp - 0x218]
movq qword [ebp - 0x218], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 3
cmp byte [edi + 0x399], 0
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
je 0x53aec9
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MicrosoftEdgeApplicationmsedge.exe
push ecx
mov ecx, dword [edi + 0x1c94]
push 0
call fcn.0057c080
add esp, 4
lea ecx, [ebp - 0x218]
push eax
call fcn.005dc200
lea ecx, [ebp - 0x218]
call fcn.005dc190
push eax
call esi
test eax, eax
setne al
mov byte [edi + 0x398], al
cmp byte [edi + 0x398], 0
jne 0x53af21
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MicrosoftEdgeApplicationmsedge.exe
push ecx
mov ecx, dword [edi + 0x1c94]
push 0
call fcn.0057c120
add esp, 4
lea ecx, [ebp - 0x218]
push eax
call fcn.005dc200
lea ecx, [ebp - 0x218]
call fcn.005dc190
push eax
call esi
test eax, eax
setne al
mov byte [edi + 0x398], al
mov eax, dword [ebp - 0x1518]
cmp dword [eax + 0x7c], 5
je 0x53af40
test dword [eax + 0x8c], 0x10
jne 0x53af40
mov dword [eax + 0x7c], 5
movsd xmm0, qword [0x6edab8]
mov ecx, str.Segoe_UI
comisd xmm0, xmmword [edi + 0x390]
mov esi, dword [ebp - 0x1538]
mov eax, str.Arial
push 5
push str.Arial
push 0
push 0x190
movsd xmm1, qword [0x6edb08]
cmovbe eax, ecx
mov ecx, esi
mov dword [ebp - 0x155c], eax
call fcn.005c42b0
push 0
mov ecx, esi
call fcn.005c44a0
mov eax, dword [ebp - 0x1518]
mov ecx, esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [eax + 8]
call fcn.005c44c0
push 0
mov ecx, esi
call fcn.005c5730
movaps xmm0, xmmword [0x6eddd0]
mov edi, eax
mov eax, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
push 0xfffffffffffffff0
push edi
mov dword [ebp - 0x1558], edi
movups xmmword [ebp - 0x1498], xmm0
mov dword [ebp - 0x1568], eax
call eax
push eax
lea eax, [ebp - 0x1498]
push eax
call dword [sym.imp.USER32.dll_AdjustWindowRect]
mov eax, dword [ebp - 0x148c]
mov ecx, dword [ebp - 0x1490]
sub eax, dword [ebp - 0x1494]
sub ecx, dword [ebp - 0x1498]
push 0
push 0
push eax
mov dword [ebp - 0x1490], ecx
push ecx
mov ecx, esi
mov dword [ebp - 0x148c], eax
call fcn.005c40c0
lea eax, [ebp - 0x1498]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
or eax, 0xffffffff
lea edi, [ebp - 0x148]
mov ecx, 0x4b
rep stosd dword es:[edi], eax
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x156c], eax
mov eax, dword [ebp - 0x1490]
mov dword [ebp - 0x1550], eax
mov eax, dword [ebp - 0x148c]
push 0x400
mov dword [ebp - 0x1564], eax
call fcn.005c4340
movsd xmm1, qword [0x6edb08]
mov ecx, esi
push 5
push str.Arial
push 0
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x40
push 0x40
push 8
mov edi, dword [ebp - 0x1518]
mov ecx, esi
push 5
push dword [edi + 0xc]
call fcn.005c0240
lea ecx, [edi + 0xc4]
mov dword [ebp - 0x148], eax
call fcn.005dc3a0
cmp eax, 5
jle 0x53b0b9
lea ecx, [edi + 0xc4]
call fcn.005dc190
jmp 0x53b0be
mov eax, 0x66430c
mov edi, dword [ebp - 0x154c]
push eax
lea ecx, [edi + 0x354]
call fcn.005dc510
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x19
push 0xc8
push 0xa
push 0x50
lea ecx, [edi + 0x354]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005c0890
mov eax, dword [edi + 0x628]
mov ecx, esi
push dword [eax + 0x100]
push 0xffffffffffffffff
call fcn.005bec70
movsd xmm0, qword [0x6edb38]
sub esp, 8
mov ecx, esi
movsd qword [esp], xmm0
push 0
push 0
push 0
push 0x320
push 0xffffffffffffffff
call fcn.005beb10
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0x6e
push 0x28
push 0x50
push str.Version_10.9.4.0
mov ecx, esi
call fcn.005c0890
mov eax, dword [edi + 0x628]
mov ecx, esi
push dword [eax + 0x100]
push 0xffffffffffffffff
call fcn.005bec70
mov eax, dword [ebp - 0x1550]
mov ecx, esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x4b
push 0x1bd
push 5
add eax, 0xfffffe3e
push eax
call fcn.005bfd30
push 0x402
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x1560], eax
call fcn.005bda80
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
mov dword [ebp - 0x1540], esi
test esi, esi
je 0x53b1e1
lea eax, [ebp - 0x147c]
mov dword [ebp - 0x147c], 0
push eax
push 0
push 0x26200a
push 0
xorps xmm0, xmm0
push 0x4b
movups xmmword [esi], xmm0
push 0x1bd
mov dword [esi], vtable.Gdiplus::Bitmap.0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromScan0]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x147c]
mov dword [esi + 4], eax
jmp 0x53b1eb
mov dword [ebp - 0x1540], 0
push 8
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
mov dword [ebp - 0x1c4], eax
test esi, esi
je 0x53b235
mov eax, dword [ebp - 0x1540]
xor ecx, ecx
mov dword [ebp - 0x147c], ecx
xorps xmm0, xmm0
movq qword [esi], xmm0
test eax, eax
je 0x53b231
lea ecx, [ebp - 0x147c]
push ecx
push dword [eax + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageGraphicsContext]
mov ecx, dword [ebp - 0x147c]
mov dword [esi + 4], eax
mov dword [esi], ecx
jmp 0x53b23d
xor esi, esi
mov dword [ebp - 0x1c4], esi
mov eax, dword [ebp - 0x1518]
mov eax, dword [eax + 8]
test eax, eax
je 0x53b267
push 0x4b
push 0x1bd
push 0
push 0
push dword [eax + 4]
push dword [esi]
call dword [sym.imp.gdiplus.dll_GdipDrawImageRectI]
test eax, eax
je 0x53b267
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0x1540]
xor edx, edx
push 2
push 4
push 0xfff8f8ff
push 0xff000008
push 0x4b
push 0x1bd
push 0
call fcn.005d22b0
push 8
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov dword [ebp - 0x1484], eax
test eax, eax
je 0x53b2cd
push eax
push 0
push ecx
xorps xmm0, xmm0
mov dword [esp], 0x40800000
movq qword [eax], xmm0
push 0xff909090
mov dword [eax], 0
call dword [sym.imp.gdiplus.dll_GdipCreatePen1]
mov ecx, dword [ebp - 0x1484]
mov dword [ecx + 4], eax
mov eax, ecx
jmp 0x53b2d5
xor eax, eax
mov dword [ebp - 0x1484], eax
push 0x46
push 0xe6
push 5
push 0xe6
push dword [eax]
push dword [esi]
call dword [sym.imp.gdiplus.dll_GdipDrawLineI]
test eax, eax
je 0x53b2f4
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0x1484]
push 0x46
push 0x172
push 5
push 0x172
push dword [ecx]
push dword [esi]
call dword [sym.imp.gdiplus.dll_GdipDrawLineI]
test eax, eax
je 0x53b319
mov dword [esi + 4], eax
mov esi, dword [ebp - 0x1484]
push dword [esi]
call dword [sym.imp.gdiplus.dll_GdipDeletePen]
push esi
mov esi, dword [sym.imp.gdiplus.dll_GdipFree]
call esi
mov eax, dword [ebp - 0x1c4]
push dword [eax]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
push dword [ebp - 0x1c4]
call esi
mov ecx, dword [ebp - 0x1540]
mov dl, 1
push 0
call fcn.005d3470
mov esi, dword [ebp - 0x1538]
mov ecx, esi
push eax
push dword [ebp - 0x1560]
call fcn.005bef90
push 0xfff8f8
mov ecx, esi
call fcn.005c44b0
mov eax, dword [edi + 0x628]
mov edx, str.Scan
add eax, 0xdc
mov ecx, esi
push eax
mov eax, dword [ebp - 0x1518]
push str.Start_searching_for_adware_and_malware
push 0x41
push 0x3c
push 5
push 5
push dword [eax + 0x10]
call fcn.005c7740
ret
or byte [eax], al
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x11c], eax
call fcn.005c4370
mov eax, dword [edi + 0x628]
mov edx, str.Stop
add eax, 0xdc
mov ecx, esi
push eax
mov eax, dword [ebp - 0x1518]
push str.Stop_the_current_scan
push 0x41
push 0x3c
push 5
push 5
push dword [eax + 0x14]
call fcn.005c7740
push 1
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x118], eax
call fcn.005bd3f0
mov eax, dword [edi + 0x628]
mov edx, str.Clean
add eax, 0xdc
mov ecx, esi
push eax
mov eax, dword [ebp - 0x1518]
push str.Start_removing_the_selected_items
push 0x41
push 0x3c
push 5
push 5
push dword [eax + 0x18]
call fcn.005c7740
movsd xmm1, qword [0x6edaf8]
mov ecx, esi
push 5
push str.Arial
push 0
push 0x190
mov dword [ebp - 0x108], eax
call fcn.005c42b0
push 0xaf5030
push 0
push 8
push 0xe
push 0x96
push 6
push 0x46
push dword [edi + 0x1c8c]
mov ecx, esi
push dword [edi + 0x1c88]
push str._Scan_all_users
call fcn.005c11d0
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x1518]
test dword [eax + 0x8c], 0x200
jne 0x53b491
push 4
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bd3f0
push 0x186a0
push 0
push str.Whether_to_scan_all_user_accounts_or_just_the_current_user
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bcaf0
push 0xaf5030
push 0
push 8
push 0xe
push 0x96
push 0x18
push 0x46
push dword [edi + 0x1c8c]
mov ecx, esi
push dword [edi + 0x1c88]
push str._Dont_scan_malware
call fcn.005c11d0
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x1518]
test byte [eax + 0x8c], 0x40
je 0x53b4f2
push 4
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bd3f0
push 0x186a0
push 0
push str.Check_this_option_if_you_want_to_skip_searching_for_malware_r_nThis_will_cause_the_application_to_search_for_adware_only.
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bcaf0
push 0xaf5030
push 0
push 8
push 0xe
push 0x96
push 6
push 0x46
push dword [edi + 0x1c8c]
mov ecx, esi
push dword [edi + 0x1c88]
push str._Create_restore_point
call fcn.005c11d0
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x1518]
test dword [eax + 0x8c], 0x20
jne 0x53b556
push 4
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bd3f0
push 0x186a0
push 0
push str.Whether_to_create_a_restore_point_before_removing_the_selected_items
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bcaf0
push 0xaf5030
push 0
push 8
push 0xe
push 0x96
push 0x18
push 0x46
push dword [edi + 0x1c8c]
mov ecx, esi
push dword [edi + 0x1c88]
push str._Auto_reboot_if_needed
call fcn.005c11d0
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x1518]
test byte [eax + 0x8c], 0x80
je 0x53b5b7
push 4
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bd3f0
push 0x186a0
push 0
push str.Whether_to_automatically_reboot_the_computer_after_the_removal_r_nprocess__if_some_files_are_scheduled_for_removal_on_reboot
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bcaf0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 6
push 0x91
push 0x2f
push 0x46
mov ecx, esi
call fcn.005bff60
push 0x186a0
push 0
push str.Current_scan_progress
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x114], eax
call fcn.005bcaf0
push 0x62439c
push 0x62439c
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bccf0
push 0xff2020
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bec70
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 6
push 0x91
push 0x2f
push 0x46
mov ecx, esi
call fcn.005bff60
push 0x186a0
push 0
push str.Cleanup_operation_progress
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x104], eax
call fcn.005bcaf0
push 0x62439c
push 0x62439c
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bccf0
push 0xff2020
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bec70
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x10
push 0x9b
push 0x39
push 0x46
push str.Press__Scan_...
mov ecx, esi
call fcn.005c0890
movsd xmm0, qword [0x6edae8]
sub esp, 8
mov ecx, esi
mov dword [ebp - 0x110], eax
movsd qword [esp], xmm0
push 0
push 0
push 0
push 0x190
push 0xffffffffffffffff
call fcn.005beb10
movsd xmm1, qword [0x6edaf8]
push 5
push str.Arial
push 0
push 0x190
mov ecx, esi
call fcn.005c42b0
mov eax, dword [ebp - 0x1518]
mov ecx, esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0x14
push 0xa
push 0xf0
push dword [eax + 0x20]
call fcn.005c0240
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x64
push 0xc
push 0x109
push str._a_Online_help__F1___a_
mov ecx, esi
call fcn.005c07e0
push 0x186a0
push 0
push str.View_the_Help_page__online_
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x13c], eax
call fcn.005bcaf0
mov ecx, dword [ebp - 0x1518]
push 0x5e
mov dword [ebp - 0x1478], 3
mov dword [ebp - 0x1474], 0
mov eax, dword [ecx + 0x8c]
mov dword [edi + 0x34], eax
xor eax, eax
push eax
mov word [ebp - 0x1468], ax
lea eax, [ebp - 0x1466]
push eax
mov dword [ebp - 0x1470], 0x10
mov dword [ebp - 0x146c], 0x10
call fcn.00420090
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1408], ax
push 0x1046
push eax
lea eax, [ebp - 0x1406]
push eax
call fcn.00420090
mov eax, dword [ebp - 0x1518]
add esp, 0xc
mov ecx, esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0x14
push 0x28
push 0xf0
push dword [eax + 0x2c]
call fcn.005c0240
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x64
push 0x2a
push 0x109
push str._a_Home__a_
mov ecx, esi
call fcn.005c07e0
push 0x186a0
push 0
push str.Go_back_to_the_Home_section.
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x138], eax
call fcn.005bcaf0
mov eax, dword [ebp - 0x1518]
test byte [eax + 0x8c], 8
je 0x53b80e
push 0x40
push dword [ebp - 0x138]
mov ecx, esi
call fcn.005bd3f0
lea eax, [ebp - 0x1478]
mov ecx, esi
push eax
push 0
push 0x702
push dword [ebp - 0x144]
call fcn.005befd0
lea eax, [ebp - 0x1478]
mov ecx, esi
push eax
push 0
push 0x702
push dword [ebp - 0x13c]
call fcn.005befd0
lea eax, [ebp - 0x1478]
mov ecx, esi
push eax
push 0
push 0x702
push dword [ebp - 0x138]
call fcn.005befd0
mov eax, dword [edi + 0x628]
mov edx, str.Menu
mov edi, dword [ebp - 0x1518]
add eax, 0xdc
push eax
push str.New_scan__Custom_scan__logs__list_menu__whitelist__settings
push 0x41
push 0x3c
push 5
push 0x17c
push dword [edi + 0x38]
mov ecx, esi
call fcn.005c7740
mov dword [ebp - 0x100], eax
mov edi, 0xf
nop dword [eax + eax]
push 1
push dword [ebp + edi*4 - 0x148]
mov ecx, esi
call fcn.005bd3f0
inc edi
cmp edi, 0x12
jl 0x53b8a0
push 1
push dword [ebp - 0xf8]
mov ecx, esi
call fcn.005bd3f0
push 0x833
mov ecx, esi
call fcn.005c4340
push 0
mov ecx, esi
call fcn.005c3f10
movsd xmm1, qword [0x6edb08]
mov ecx, esi
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
mov ecx, esi
call fcn.005c44a0
push 0xffffffffffffffff
mov ecx, esi
call fcn.005c44b0
mov eax, dword [ebp - 0x1564]
mov ecx, esi
push 0xffffffffffffffff
push 0xffffffffffffffff
add eax, 0xffffffab
push eax
push dword [ebp - 0x1550]
push 0x55
push 0
call fcn.005bfc70
push 0x433
mov ecx, esi
mov dword [ebp - 0xe4], eax
call fcn.005c4340
xorps xmm0, xmm0
mov dword [ebp - 0x2d0], 0
lea ecx, [ebp - 0x2d8]
movq qword [ebp - 0x2d8], xmm0
call fcn.005dc5e0
push 0x62e530
push 0
mov byte [ebp - 4], 4
mov ecx, esi
push dword [ebp - 0xe4]
call fcn.005bfb00
mov edi, dword [ebp - 0x1518]
mov ecx, esi
push 0x12
push 0x12
mov dword [ebp - 0xd0], eax
push dword [edi + 0x50]
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.005be310
push 0x664994
push 1
push dword [ebp - 0xe4]
mov ecx, esi
call fcn.005bfb00
push 0x12
push 0x12
push dword [edi + 0x54]
mov ecx, esi
mov dword [ebp - 0xcc], eax
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.005be310
push str.Internet_browsers
push 2
push dword [ebp - 0xe4]
mov ecx, esi
call fcn.005bfb00
push 0x12
push 0x12
push dword [edi + 0x6c]
mov dword [ebp - 0xc8], eax
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, esi
call fcn.005be310
push str.Malware
push 3
push dword [ebp - 0xe4]
mov ecx, esi
call fcn.005bfb00
push 0x12
push 0x12
push dword [edi + 0x68]
mov ecx, esi
mov dword [ebp - 0xb8], eax
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.005be310
push dword [ebp - 0xe4]
mov ecx, esi
call fcn.005c5730
lea ecx, [ebp - 0x1498]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x1498]
mov ecx, esi
push eax
push 0
push 0x1328
push dword [ebp - 0xe4]
call fcn.005befd0
mov esi, dword [ebp - 0x1490]
mov edi, dword [ebp - 0x148c]
sub esi, dword [ebp - 0x1498]
sub edi, dword [ebp - 0x1494]
movsd xmm1, qword [0x6edaf0]
mov ecx, dword [ebp - 0x1538]
push 0
push dword [ebp - 0x155c]
mov dword [ebp - 0x1540], esi
push 1
push 0x190
mov dword [ebp - 0x1560], edi
call fcn.005c42b0
push dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x1538]
call fcn.005c3f10
mov ecx, dword [ebp - 0x1538]
push 0x10024
push 0x1000000d
push edi
push esi
push 0
push 0
push 0x627824
push str.Name_nPublisher_nUser_name
call fcn.005c0620
mov ecx, dword [ebp - 0x1538]
push eax
mov dword [ebp - 0xa8], eax
call fcn.005c5730
mov ecx, dword [ebp - 0x1540]
mov esi, eax
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
add ecx, 0xffffff06
movzx ecx, cx
push ecx
push 0
push 0x101e
push esi
mov dword [ebp - 0x1528], eax
call eax
push 0x82
push 1
push 0x101e
push esi
call dword [ebp - 0x1528]
push 0x64
push 2
push 0x101e
push esi
call dword [ebp - 0x1528]
xorps xmm0, xmm0
mov dword [ebp - 0x228], 0
lea ecx, [ebp - 0x230]
movq qword [ebp - 0x230], xmm0
call fcn.005dc5e0
push 0x104
push 0
push 0
push 0x104
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 5
call fcn.005db9a0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.msiexec.exe
lea ecx, [ebp - 0x230]
call fcn.005da780
push 0x10
push 0
lea ecx, [ebp - 0x230]
call fcn.005dc190
mov esi, dword [ebp - 0x1538]
mov ecx, esi
push eax
push 1
push dword [ebp - 0xa8]
call fcn.005bea70
push dword [ebp - 0xcc]
mov ecx, esi
call fcn.005c3f10
push 0x10024
push 0x1000000d
push edi
push dword [ebp - 0x1540]
mov ecx, esi
push 0
push 0
push 0x627824
push str.Name_nUser_name_nPath
call fcn.005c0620
push eax
mov ecx, esi
mov dword [ebp - 0xa4], eax
call fcn.005c5730
push 0xc8
push 0
mov esi, eax
push 0x101e
push esi
call dword [ebp - 0x1528]
push 0x64
push 1
push 0x101e
push esi
call dword [ebp - 0x1528]
push 0x1f4
push 2
push 0x101e
push esi
call dword [ebp - 0x1528]
mov eax, dword [ebp - 0x1518]
mov edx, 0x10
mov ecx, dword [eax + 0x54]
call fcn.005d33b0
push eax
lea ecx, [ebp - 0x14ac]
call fcn.005c6590
mov byte [ebp - 4], 6
mov esi, dword [ebp - 0x1538]
mov ecx, esi
push 0
push dword [ebp - 0x14ac]
push 1
push dword [ebp - 0xa4]
call fcn.005be460
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Registry_autostart_entries
push 0xb
push dword [ebp - 0xa4]
mov ecx, esi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Startup_folder_items
push 0xc
push dword [ebp - 0xa4]
mov ecx, esi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Scheduled_tasks__root_folder_only_
push 0xd
push dword [ebp - 0xa4]
mov ecx, esi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.AppInit_DLLs
push 0xe
push dword [ebp - 0xa4]
mov ecx, esi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.DNS_hijackers
push 0xf
push dword [ebp - 0xa4]
mov ecx, esi
call fcn.005bbd80
push 1
push dword [ebp - 0xa4]
mov ecx, esi
call fcn.005bb910
push dword [ebp - 0xc8]
mov ecx, esi
call fcn.005c3f10
push 0x10024
push 0x1000000d
push edi
push dword [ebp - 0x1540]
mov ecx, esi
push 0
push 0
push 0x627824
push str.Name_nUser_name_nPath_URL
call fcn.005c0620
push eax
mov ecx, esi
mov dword [ebp - 0xa0], eax
call fcn.005c5730
push 0xc8
mov esi, eax
push 0
mov edi, dword [ebp - 0x1528]
push 0x101e
push esi
call edi
push 0x64
push 1
push 0x101e
push esi
call edi
push 0x1f4
push 2
push 0x101e
push esi
call edi
mov edi, dword [ebp - 0x1518]
mov edx, 0x10
mov ecx, dword [edi + 0x58]
call fcn.005d33b0
push eax
lea ecx, [ebp - 0x14e4]
call fcn.005c6590
mov byte [ebp - 4], 7
mov edx, 0x10
mov ecx, dword [edi + 0x5c]
call fcn.005d33b0
push eax
lea ecx, [ebp - 0x14b0]
call fcn.005c6590
mov byte [ebp - 4], 8
mov edx, 0x10
mov ecx, dword [edi + 0x60]
call fcn.005d33b0
push eax
lea ecx, [ebp - 0x14dc]
call fcn.005c6590
mov byte [ebp - 4], 9
mov edx, 0x10
mov ecx, dword [edi + 0x64]
call fcn.005d33b0
push eax
lea ecx, [ebp - 0x14d8]
call fcn.005c6590
mov byte [ebp - 4], 0xa
mov edx, 0x10
mov ecx, dword [edi + 0x70]
call fcn.005d33b0
push eax
lea ecx, [ebp - 0x14d4]
call fcn.005c6590
mov byte [ebp - 4], 0xb
mov edx, 0x10
mov ecx, dword [edi + 0x6c]
call fcn.005d33b0
push eax
lea ecx, [ebp - 0x14d0]
call fcn.005c6590
mov ecx, dword [ebp - 0x1538]
push 0
mov byte [ebp - 4], 0xc
push dword [ebp - 0x14e4]
push 1
push dword [ebp - 0xa0]
call fcn.005be460
push 0
push 1
push 0x1002
push esi
call dword [ebp - 0x1528]
push dword [ebp - 0x14b0]
mov esi, dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov edi, eax
push 0xffffffffffffffff
push edi
call esi
push dword [ebp - 0x14dc]
push 0xffffffffffffffff
push edi
call esi
push dword [ebp - 0x14d8]
push 0xffffffffffffffff
push edi
call esi
push dword [ebp - 0x14d4]
push 0xffffffffffffffff
push edi
call esi
push dword [ebp - 0x14d0]
push 0xffffffffffffffff
push edi
call esi
mov edi, dword [ebp - 0x1538]
mov ecx, edi
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Edge__UWP__Startup_and_Home_Pages
push 0x16
push dword [ebp - 0xa0]
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Edge__UWP__Search_Providers
push 0x17
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Edge__UWP__non_standard_Shortcuts
push 0x19
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Edge__UWP__extensions
push 0x18
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Edge__UWP__Group_Policies
push 0x1b
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Edge__UWP__reset_options
push 0x1a
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.MS_Edges_Startup_and_Home_Pages
push 0x6f
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.MS_Edges_Search_Providers
push 0x70
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.MS_Edges_non_standard_Shortcuts
push 0x72
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.MS_Edges_extensions
push 0x71
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.MS_Edges_Group_Policies
push 0x74
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.MS_Edges_reset_options
push 0x73
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 1
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bb910
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Internet_Explorer_Home_And_Search_Pages
push 0x1f
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Internet_Explorer_Search_Providers
push 0x20
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Internet_Explorer_Ad_ons
push 0x21
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Internet_Explorers_non_standard_Shortcuts
push 0x23
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Internet_Explorers_Group_Policies
push 0x25
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Internet_Explorer_and_Shell_Reset_Options
push 0x24
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Chromes_Startup_and_Home_Pages
push 0x2a
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Chromes_Search_Providers
push 0x2b
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Chromes_non_standard_Shortcuts
push 0x2d
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Chrome_Extensions
push 0x2c
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Chromes_Group_Policies
push 0x2f
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Chrome_Reset_Options
push 0x2e
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Firefox_Startup_Pages
push 0x33
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Firefox_Search_Plug_ins
push 0x34
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Firefox_Extensions
push 0x35
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Firefox_non_standard_Shortcuts
push 0x37
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Firefox_Reset_Options
push 0x38
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Other_Chromium_Browsers_Startup_and_Home_Pages
push 0x3e
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Other_Chromium_Browsers_Search_Providers
push 0x3f
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Other_Chromium_Browsers_non_standard_Shortcuts
push 0x41
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Other_Chromium_Browsers_Extensions
push 0x40
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Other_Chromium_Browsers_Group_Policies
push 0x43
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Other_Chromium_Browsers_Reset_Options
push 0x42
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Other_Firefox_browsers_Startup_Pages
push 0x47
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Other_Firefox_browsers_Search_Plug_ins
push 0x48
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Other_Firefox_browsers_Extensions
push 0x49
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Other_Firefox_browsers_non_standard_Shortcuts
push 0x4b
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Other_Firefox_browsers_Reset_Options
push 0x4c
push dword [ebp - 0xa0]
mov ecx, edi
call fcn.005bbd80
push dword [ebp - 0xb8]
mov ecx, edi
call fcn.005c3f10
push 0x10024
push 0x1000000d
push dword [ebp - 0x1560]
mov ecx, edi
push dword [ebp - 0x1540]
push 0
push 0
push 0x627824
push str.Item_nThreat_level_nMalware_type_nModified_in
call fcn.005c0620
push eax
mov ecx, edi
mov dword [ebp - 0x90], eax
call fcn.005c5730
push 0x1a4
push 0
mov esi, eax
push 0x101e
push esi
call dword [ebp - 0x1528]
push 0x50
push 1
push 0x101e
push esi
call dword [ebp - 0x1528]
push 0x6e
push 2
push 0x101e
push esi
call dword [ebp - 0x1528]
push 0x78
push 3
push 0x101e
push esi
call dword [ebp - 0x1528]
mov esi, dword [ebp - 0x1518]
mov edx, 0x10
mov ecx, dword [esi + 0x68]
call fcn.005d33b0
push eax
lea ecx, [ebp - 0x14cc]
call fcn.005c6590
push 0
mov byte [ebp - 4], 0xd
mov ecx, edi
push dword [ebp - 0x14cc]
push 1
push dword [ebp - 0x90]
call fcn.005be460
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Infected_file_objects
push 0x51
push dword [ebp - 0x90]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Infected_registry_entries
push 0x52
push dword [ebp - 0x90]
mov ecx, edi
call fcn.005bbd80
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Malware_related_fixes
push 0x53
push dword [ebp - 0x90]
mov ecx, edi
call fcn.005bbd80
push 1
push dword [ebp - 0x90]
mov ecx, edi
call fcn.005bb910
movaps xmm0, xmmword [0x6edc30]
lea eax, [ebp - 0x1514]
push eax
push 1
push 0x1060
push dword [ebp - 0x90]
movups xmmword [ebp - 0x1510], xmm0
mov dword [ebp - 0x1514], 1
mov ecx, edi
xorps xmm0, xmm0
mov dword [ebp - 0x1500], 0
mov dword [ebp - 0x14fc], 0
movups xmmword [ebp - 0x14f8], xmm0
call fcn.005befd0
mov eax, 0x28
mov dword [ebp - 0x147c], eax
nop
mov ecx, dword [ebp + eax*4 - 0x148]
test ecx, ecx
jle 0x53c50b
push 1
push ecx
mov ecx, edi
call fcn.005ba360
mov eax, dword [ebp - 0x147c]
inc eax
mov dword [ebp - 0x147c], eax
cmp eax, 0x2f
jl 0x53c4f0
push 0
mov ecx, edi
call fcn.005c3f10
mov edi, dword [ebp - 0x154c]
mov eax, dword [ebp - 0x1530]
push 3
mov ecx, dword [edi + 0x1c94]
mov dword [edi], eax
mov eax, dword [ebp - 0x1538]
mov dword [edi + 4], eax
lea eax, [ebp - 0x148]
mov dword [edi + 8], eax
call fcn.00554030
mov eax, dword [esi + 0xc]
lea ecx, [edi + 0x134]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x88]
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov eax, dword [esi + 0x8c]
mov dword [edi + 0x34], eax
lea eax, [esi + 0xb8]
push eax
mov dword [edi + 0x30], 0
mov dword [edi + 0x38], 0
call fcn.005dc4e0
mov dword [ebp - 0x1480], 0xffffffff
mov dword [ebp - 0x149c], 0xffffffff
mov dword [ebp - 0x1488], 0xffffffff
mov byte [ebp - 4], 0x10
test byte [esi + 0x8c], 4
mov dword [ebp - 0x1c8], 0
je 0x53c5e2
cmp dword [esi + 0x7c], 0
mov byte [ebp - 0x1541], 1
je 0x53c5e9
mov byte [ebp - 0x1541], 0
push 0x48
call dword [sym.imp.USER32.dll_GetSystemMetrics]
movsd xmm0, qword [0x6edab8]
comisd xmm0, xmmword [edi + 0x390]
mov dword [ebp - 0x153c], eax
jb 0x53c621
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, eax
mov eax, dword [ebp - 0x153c]
or ecx, 0xff000000
jmp 0x53c623
xor ecx, ecx
push ecx
mov dword [ebp - 0x1520], ecx
mov edx, eax
mov ecx, dword [esi + 0x10]
push eax
call fcn.005d0f70
mov esi, eax
mov dword [ebp - 0x1484], esi
push esi
lea ecx, [ebp - 0x14c8]
mov byte [ebp - 4], 0x11
call fcn.005c6520
mov ecx, dword [ebp - 0x1538]
mov byte [ebp - 4], 0x12
push dword [ebp - 0x14c8]
push str.New_scan_tAltN
push dword [ebp - 0xe4]
call fcn.005c1450
push dword [ebp - 0x1520]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x153c]
mov edx, eax
push eax
mov eax, dword [ebp - 0x1518]
mov ecx, dword [eax + 0x34]
call fcn.005d0f70
mov dword [ebp - 0x147c], eax
test esi, esi
je 0x53c6a5
mov edx, dword [esi]
mov ecx, esi
push 1
call dword [edx]
mov eax, dword [ebp - 0x147c]
push eax
lea ecx, [ebp - 0x14c4]
mov dword [ebp - 0x1484], eax
call fcn.005c6520
mov esi, dword [ebp - 0x1538]
mov ecx, esi
push 0
mov byte [ebp - 4], 0x13
push dword [ebp - 0x14c4]
push 0
push 0x64
push str.Custom_scan_tAltF
push dword [ebp - 0xe4]
call fcn.005c0400
push dword [ebp - 0x1520]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x153c]
mov edx, eax
push eax
mov eax, dword [ebp - 0x1518]
mov ecx, dword [eax + 0x30]
call fcn.005d0f70
mov ecx, dword [ebp - 0x147c]
mov dword [ebp - 0x1548], eax
test ecx, ecx
je 0x53c71b
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [ebp - 0x1548]
push eax
lea ecx, [ebp - 0x14c0]
mov dword [ebp - 0x1484], eax
call fcn.005c6520
push 0
mov byte [ebp - 4], 0x14
mov ecx, esi
push dword [ebp - 0x14c0]
push 0
push 0x64
push str.Malware_detection_settings_tAltM
push dword [ebp - 0xe4]
call fcn.005c0400
push dword [ebp - 0x1520]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x153c]
mov edx, eax
push eax
mov eax, dword [ebp - 0x1518]
mov ecx, dword [eax + 0x28]
call fcn.005d0f70
mov ecx, eax
mov eax, dword [ebp - 0x1548]
mov dword [ebp - 0x147c], ecx
test eax, eax
je 0x53c78f
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov ecx, dword [ebp - 0x147c]
mov dword [ebp - 0x1484], ecx
push ecx
lea ecx, [ebp - 0x14a8]
call fcn.005c6520
push 0
mov byte [ebp - 4], 0x15
mov ecx, esi
push dword [ebp - 0x14a8]
push 0
push 0x64
push str.View_last_scan_log_tAltS
push dword [ebp - 0xe4]
call fcn.005c0400
push 0
push dword [ebp - 0x14a8]
mov ecx, esi
mov dword [ebp - 0x54], eax
push 0
push 0x64
push str.View_last_cleanup_log_tAltC
push dword [ebp - 0xe4]
call fcn.005c0400
mov dword [ebp - 0x50], eax
mov edi, 0x3d
nop dword [eax]
push 0x40
push dword [ebp + edi*4 - 0x148]
mov ecx, esi
call fcn.005bd3f0
inc edi
cmp edi, 0x3f
jl 0x53c7f0
push dword [ebp - 0x1520]
mov eax, dword [ebp - 0x153c]
mov edx, eax
push eax
mov eax, dword [ebp - 0x1518]
mov ecx, dword [eax + 0x48]
call fcn.005d0f70
mov ecx, dword [ebp - 0x147c]
mov edi, dword [ebp - 0x154c]
mov dword [ebp - 0x1548], eax
test ecx, ecx
je 0x53c845
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [ebp - 0x1548]
push eax
lea ecx, [ebp - 0x14a4]
mov dword [ebp - 0x1484], eax
call fcn.005c6520
push 0
mov byte [ebp - 4], 0x16
mov ecx, esi
push dword [ebp - 0x14a4]
push 0
push 0x64
push str.Open_logs_folder_tCtrlL
push dword [ebp - 0xe4]
call fcn.005c0400
push dword [ebp - 0x1520]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x153c]
mov edx, eax
push eax
mov eax, dword [ebp - 0x1518]
mov ecx, dword [eax + 0x3c]
call fcn.005d0f70
mov ecx, dword [ebp - 0x1548]
mov dword [ebp - 0x147c], eax
test ecx, ecx
je 0x53c8b5
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [ebp - 0x147c]
push eax
lea ecx, [ebp - 0x14a0]
mov dword [ebp - 0x1484], eax
call fcn.005c6520
push 0
push 0
push 8
push 0x64
push 0
mov byte [ebp - 4], 0x17
mov ecx, esi
push dword [ebp - 0xe4]
call fcn.005c0400
push dword [ebp - 0x1520]
mov eax, dword [ebp - 0x153c]
mov edx, eax
push eax
mov eax, dword [ebp - 0x1518]
mov ecx, dword [eax + 0x4c]
call fcn.005d0f70
mov ecx, eax
mov eax, dword [ebp - 0x147c]
mov dword [ebp - 0x1548], ecx
test eax, eax
je 0x53c91f
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov ecx, dword [ebp - 0x1548]
mov dword [ebp - 0x1484], ecx
push ecx
lea ecx, [ebp - 0x14e0]
call fcn.005c6520
push 0
mov byte [ebp - 4], 0x18
mov ecx, esi
push dword [ebp - 0x14e0]
push 0
push 0x64
push str.Open_registry_location_tCtrlEnter
push dword [ebp - 0xe4]
call fcn.005c0400
push 0
push dword [ebp - 0x14a4]
mov ecx, esi
mov dword [ebp - 0x7c], eax
push 0
push 0x64
push str.Open_file_location_tAltEnter
push dword [ebp - 0xe4]
call fcn.005c0400
push dword [ebp - 0x1520]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x153c]
mov edx, eax
push eax
mov eax, dword [ebp - 0x1518]
mov ecx, dword [eax + 0x1c]
call fcn.005d0f70
mov ecx, eax
mov eax, dword [ebp - 0x1548]
mov dword [ebp - 0x1560], ecx
test eax, eax
je 0x53c9b4
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov ecx, dword [ebp - 0x1560]
mov dword [ebp - 0x1484], ecx
push ecx
lea ecx, [ebp - 0x14bc]
call fcn.005c6520
push 0
mov byte [ebp - 4], 0x19
mov ecx, esi
push dword [ebp - 0x14bc]
push 0
push 0x64
push str.Report_false_positive_tCtrlR
push dword [ebp - 0xe4]
call fcn.005c0400
mov ecx, dword [ebp - 0x153c]
mov edx, 1
push 0xffffffffffffffff
push 0xff000000
push 0xff005f00
mov dword [ebp - 0xc4], eax
call fcn.005d28c0
push eax
lea ecx, [ebp - 0x14b8]
call fcn.005c6510
mov ecx, dword [ebp - 0x153c]
xor edx, edx
push 0xffffffffffffffff
push 0xff000000
push 0xff005f00
mov byte [ebp - 4], 0x1a
call fcn.005d28c0
push eax
lea ecx, [ebp - 0x14b4]
call fcn.005c6510
push 0
mov byte [ebp - 4], 0x1b
mov ecx, esi
push dword [ebp - 0x14b8]
push 0
push 0x64
push str.Check_all_tCtrlA
push dword [ebp - 0xe4]
call fcn.005c0400
push 0
push dword [ebp - 0x14b4]
mov ecx, esi
mov dword [ebp - 0x74], eax
push 0
push 0x64
push str.Check_none_tCtrlN
push dword [ebp - 0xe4]
call fcn.005c0400
push 0
push 0
push 8
push 0x64
push 0
push dword [ebp - 0xe4]
mov ecx, esi
mov dword [ebp - 0x70], eax
call fcn.005c0400
push 0
push dword [ebp - 0x14a0]
mov ecx, esi
push 0
push 0x64
push str.Whitelist_highlighted_item_tCtrlW
push dword [ebp - 0xe4]
call fcn.005c0400
push 0
push dword [ebp - 0x14a4]
mov ecx, esi
mov dword [ebp - 0x6c], eax
push 0
push 0x64
push str.Whitelist_parent_folder_tAltP
push dword [ebp - 0xe4]
call fcn.005c0400
mov dword [ebp - 0x30], eax
push 0
push dword [ebp - 0x14a0]
mov ecx, esi
push 0
push 0x64
push str.Whitelist_checked_items_tAltW
push dword [ebp - 0xe4]
call fcn.005c0400
push 0
push dword [ebp - 0x14a0]
mov ecx, esi
mov dword [ebp - 0x40], eax
push 0
push 0x64
push str.Whitelist_checked__all_tabs__tAltA
push dword [ebp - 0xe4]
call fcn.005c0400
push 0
push dword [ebp - 0x14a0]
mov ecx, esi
mov dword [ebp - 0x3c], eax
push 0
push 0x64
push str.Whitelist_manager_tCtrlM
push dword [ebp - 0xe4]
call fcn.005c0400
push 0
push dword [ebp - 0x7c]
mov ecx, esi
mov dword [ebp - 0x44], eax
push dword [ebp - 0xe4]
call fcn.005c56e0
push eax
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov eax, 0x70
mov byte [ebp - 0x1c0], 1
mov word [ebp - 0x1be], ax
mov ecx, 0xd
movzx eax, word [ebp - 0x13c]
mov edx, 0x41
mov word [ebp - 0x1bc], ax
mov eax, 0x4e
mov word [ebp - 0x1b8], ax
movzx eax, word [ebp - 0x58]
mov word [ebp - 0x1b6], ax
mov eax, 0x46
mov word [ebp - 0x1b2], ax
movzx eax, word [ebp - 0x34]
mov word [ebp - 0x1b0], ax
mov eax, 0x4d
mov word [ebp - 0x1ac], ax
movzx eax, word [ebp - 0x2c]
mov word [ebp - 0x1aa], ax
mov eax, 0x53
mov word [ebp - 0x1a6], ax
movzx eax, word [ebp - 0x54]
mov word [ebp - 0x1a4], ax
mov eax, 0x43
mov word [ebp - 0x1a0], ax
movzx eax, word [ebp - 0x50]
mov word [ebp - 0x19e], ax
mov eax, 0x4c
mov word [ebp - 0x19a], ax
movzx eax, word [ebp - 0x4c]
mov word [ebp - 0x198], ax
movzx eax, word [ebp - 0x7c]
mov word [ebp - 0x192], ax
movzx eax, word [ebp - 0x78]
mov byte [ebp - 0x1ba], 0x11
mov byte [ebp - 0x1b4], 0x11
mov byte [ebp - 0x1ae], 0x11
mov byte [ebp - 0x1a8], 0x11
mov byte [ebp - 0x1a2], 0x11
mov byte [ebp - 0x19c], 9
mov byte [ebp - 0x196], 9
mov word [ebp - 0x194], cx
mov byte [ebp - 0x190], 0x11
mov word [ebp - 0x18e], cx
mov word [ebp - 0x18c], ax
mov byte [ebp - 0x18a], 9
mov word [ebp - 0x188], dx
movzx eax, word [ebp - 0x74]
mov ecx, 0x57
mov word [ebp - 0x186], ax
mov eax, 0x4e
mov word [ebp - 0x182], ax
movzx eax, word [ebp - 0x70]
mov word [ebp - 0x180], ax
movzx eax, word [ebp - 0x6c]
mov word [ebp - 0x17a], ax
mov eax, 0x4d
mov word [ebp - 0x176], ax
movzx eax, word [ebp - 0x44]
mov word [ebp - 0x174], ax
movzx eax, word [ebp - 0x40]
mov word [ebp - 0x16e], ax
movzx eax, word [ebp - 0x3c]
mov word [ebp - 0x168], ax
mov eax, 0x52
mov word [ebp - 0x164], ax
movzx eax, word [ebp - 0xc4]
mov word [ebp - 0x162], ax
mov eax, 0x50
mov word [ebp - 0x15e], ax
movzx eax, word [ebp - 0x30]
mov word [ebp - 0x15c], ax
mov eax, 0x53
mov word [ebp - 0x158], ax
movzx eax, word [ebp - 0x38]
mov word [ebp - 0x156], ax
mov eax, 0x55
mov word [ebp - 0x152], ax
movzx eax, word [ebp - 0x48]
mov word [ebp - 0x150], ax
lea eax, [ebp - 0x1c0]
push 0x12
mov word [ebp - 0x17c], cx
mov word [ebp - 0x170], cx
mov ecx, esi
push eax
mov byte [ebp - 0x184], 9
mov byte [ebp - 0x17e], 9
mov byte [ebp - 0x178], 9
mov byte [ebp - 0x172], 0x11
mov byte [ebp - 0x16c], 0x11
mov word [ebp - 0x16a], dx
mov byte [ebp - 0x166], 9
mov byte [ebp - 0x160], 0x11
mov byte [ebp - 0x15a], 9
mov byte [ebp - 0x154], 9
call fcn.005c47a0
push 0
lea ecx, [ebp - 0x2f8]
call fcn.005d0610
push 0
lea ecx, [ebp - 0x388]
call fcn.005d0610
push 0
lea ecx, [ebp - 0x3c0]
call fcn.005d0610
push 0
mov ecx, dword [edi + 0x1c94]
xorps xmm0, xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._notepad.exe
push 0
movq qword [ebp - 0x254], xmm0
mov dword [ebp - 0x24c], 0
call fcn.0057c540
push eax
lea ecx, [ebp - 0x254]
call fcn.005dc520
mov byte [ebp - 4], 0x1c
lea ecx, [edi + 0x134]
call fcn.005dbeb0
test al, al
je 0x53ce51
mov ecx, dword [edi + 0x1c94]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Ultra_Adware_Killer
push 0
call fcn.0057c490
push eax
push 0x624390
lea ecx, [edi + 0x134]
call fcn.005dc200
lea ecx, [edi + 0x134]
call fcn.005dc190
or edx, 0xffffffff
mov ecx, eax
call fcn.005e0f30
xorps xmm0, xmm0
mov dword [ebp - 0x2b8], 0
lea ecx, [ebp - 0x2c0]
movq qword [ebp - 0x2c0], xmm0
call fcn.005dc5e0
push 0x104
push 0
push 0
push 0x104
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 0x1d
call fcn.005db9a0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push 0
push 0xffffffffffffffff
push str.HKLM64SOFTWARECarifredUVK___Ultra_virus_killer
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 0x1d8], 0
call fcn.005d6a80
mov esi, dword [ebp - 0x1518]
lea ecx, [ebp - 0x1d8]
add esi, 0xd0
mov byte [ebp - 4], 0x1e
push esi
push str.InstallSource
call fcn.005d6740
test al, al
je 0x53cf31
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAK_White_list.ini
push 0
mov ecx, esi
call fcn.005dbed0
mov ecx, eax
call fcn.005da780
mov ecx, eax
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x53cf31
mov ecx, esi
call fcn.005dc400
mov ecx, esi
call fcn.005dbeb0
test al, al
je 0x53cf9d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x665a98
lea ecx, [edi + 0x134]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc200
mov ecx, esi
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e0f30
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.WhiteList.ini
mov ecx, esi
call fcn.005da780
push 1
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [edi + 0x164]
call fcn.005dd360
push 1
lea ecx, [edi + 0x164]
call fcn.005dd5c0
lea ecx, [edi + 0x348]
call fcn.005dc190
mov ecx, eax
call fcn.005963d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
mov byte [ebp - 0x1521], 0
push str.Settings_settings.ini
lea ecx, [edi + 0x134]
mov byte [ebp - 0x1519], 0
movq qword [ebp - 0x2b4], xmm0
mov dword [ebp - 0x2ac], 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2b4]
call fcn.005dc520
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x1f0]
xorps xmm0, xmm0
mov dword [ebp - 0x1e8], 0
movq qword [ebp - 0x1f0], xmm0
call fcn.005dc5e0
push 0x38
lea eax, [ebp - 0x330]
mov byte [ebp - 4], 0x20
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x2b4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x330]
call fcn.005dd680
push 0
push str.Maximized
push 0x665b10
lea ecx, [ebp - 0x330]
mov byte [ebp - 4], 0x21
call fcn.005dd290
push 0
push str.WindowCX
push 0x665b10
lea ecx, [ebp - 0x330]
call fcn.005dd290
push 0
push str.WindowCY
push 0x665b10
lea ecx, [ebp - 0x330]
mov dword [ebp - 0x155c], eax
call fcn.005dd290
push 0
mov dword [ebp - 0x1c4], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call esi
mov dword [ebp - 0x1548], eax
push 0xa
push edi
call esi
push edi
push 0
mov dword [ebp - 0x147c], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov esi, dword [ebp - 0x1550]
mov eax, dword [ebp - 0x155c]
cmp eax, esi
jle 0x53d113
cmp eax, dword [ebp - 0x1548]
cmovle esi, eax
mov edi, dword [ebp - 0x1564]
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x147c]
cmp eax, edi
jle 0x53d12e
cmp eax, ecx
cmovle edi, eax
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
mov eax, edi
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x1548]
push 0x10
push edi
cdq
push esi
push ecx
sub eax, edx
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
sub ecx, eax
push ecx
push 0
push dword [ebp - 0x1558]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp - 0x1518]
mov eax, dword [eax + 0x90]
test eax, eax
je 0x53d188
mov esi, dword [ebp - 0x154c]
mov dword [esi + 0x1c68], eax
jmp 0x53d1bf
push 0xc
push str.ScanSoftness
push str.SCAN
lea ecx, [ebp - 0x330]
call fcn.005dd290
mov esi, dword [ebp - 0x154c]
mov dword [esi + 0x1c68], eax
cmp eax, 0xa
je 0x53d1bf
cmp eax, 0xe
je 0x53d1bf
mov dword [esi + 0x1c68], 0xc
mov edi, dword [ebp - 0x1538]
mov ecx, edi
call fcn.005c6c50
push 0x3c
push 0
push dword [ebp - 0x1530]
call fcn.00420090
add esp, 0xc
mov ecx, edi
push dword [ebp - 0x1558]
call fcn.005c1cc0
mov eax, dword [ebp - 0x1518]
test byte [eax + 0x8c], 4
je 0x53d208
push 7
push dword [eax + 0x7c]
mov ecx, edi
call fcn.005c3f80
jmp 0x53d241
push 0
push 1
push 0xb
push dword [ebp - 0x1558]
call dword [ebp - 0x1528]
push 0x487
push 0
push 0
push dword [ebp - 0x1558]
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0
push 2
push 6
push dword [ebp - 0x1558]
call dword [ebp - 0x1528]
call fcn.005d8ff0
cmp dword [ebp - 0x1534], 0
je 0x53d25d
mov eax, dword [ebp - 0x1518]
mov ecx, dword [eax + 4]
call fcn.00403550
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.The_scans_progress_is_shown_here.
xorps xmm0, xmm0
mov dword [ebp - 0x234], 0
push str._is_scanning_your_system._r_n
lea ecx, [esi + 0x354]
movq qword [ebp - 0x23c], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x23c]
call fcn.005dc520
mov eax, dword [ebp - 0x1518]
mov byte [ebp - 4], 0x22
test byte [eax + 0x8c], 1
mov eax, dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebp - 0x1540], eax
mov eax, dword [sym.imp.USER32.dll_MapWindowPoints]
mov dword [ebp - 0x1564], eax
je 0x53d3d8
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push esi
push 0x5132d0
push 0
push 0
mov dword [ebp - 0x153c], eax
call eax
push eax
lea ecx, [ebp - 0x1480]
call fcn.00401070
mov eax, dword [ebp - 0x10c]
test eax, eax
jle 0x53d312
push 0x40
push eax
mov ecx, edi
call fcn.005bd3f0
push 0x22
push dword [ebp - 0x118]
mov ecx, edi
call fcn.005bd3f0
push 1
push dword [ebp - 0x11c]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x120]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0xfc]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x58]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x54]
mov ecx, edi
call fcn.005bd3f0
lea eax, [ebp - 0x1498]
mov ecx, edi
push eax
push dword [ebp - 0x114]
call fcn.005c5730
push eax
call dword [ebp - 0x1540]
test eax, eax
je 0x53d3cb
push 2
lea eax, [ebp - 0x1498]
push eax
push dword [ebp - 0x1558]
push 0
call dword [ebp - 0x1564]
mov eax, dword [ebp - 0x1494]
lea ecx, [ebp - 0x23c]
push 0
add eax, 2
push eax
mov eax, dword [ebp - 0x1498]
add eax, 0x78
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 4
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0050cce0
lea ecx, [ebp - 0x2f8]
call fcn.005d05f0
jmp 0x53d3fa
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x513240
push 0
push 0
mov dword [ebp - 0x153c], eax
call eax
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
lea ecx, [ebp - 0x3a8]
movups xmmword [ebp - 0x3a8], xmm0
movups xmmword [ebp - 0x398], xmm0
call fcn.005b8890
push 1
mov ecx, edi
mov byte [ebp - 4], 0x23
call fcn.005c6100
push 0
mov ecx, esi
call fcn.0053a1c0
test eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x147c], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebp - 0x1548], eax
je 0x53f0ef
mov eax, dword [ebp - 0x1518]
add eax, 0x48
mov dword [ebp - 0x1574], eax
mov eax, dword [sym.imp.USER32.dll_SetFocus]
mov dword [ebp - 0x1570], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov dword [ebp - 0x20c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [ebp - 0x155c], eax
nop word [eax + eax]
cmp byte [ebp - 0x1519], 1
jne 0x53d4b7
nop dword [eax]
push 1
mov ecx, esi
call fcn.0053a1c0
test eax, eax
jne 0x53d490
mov ecx, dword [ebp - 0x1530]
mov byte [ebp - 0x1519], 2
mov dword [ecx + 0x30], edi
mov eax, dword [ebp - 0x108]
mov dword [ecx], eax
jmp 0x53d4bd
mov ecx, dword [ebp - 0x1530]
mov eax, dword [ecx]
cmp eax, 0xfffffffa
je 0x53f033
cmp eax, 0xffffffe1
je 0x53f033
cmp dword [ecx + 0x30], edi
jne 0x53e287
cmp byte [ebp - 0x1521], 1
jne 0x53d501
cmp eax, 0xffffff31
jne 0x53d501
lea ecx, [ebp - 0x388]
call fcn.005d05f0
mov byte [ebp - 0x1521], 2
jmp 0x53f135
cmp eax, 0xffffffea
jne 0x53d529
mov edx, dword [ecx + 0xc]
cmp edx, dword [ebp - 0xa8]
je 0x53d535
cmp edx, dword [ebp - 0xa4]
je 0x53d535
cmp edx, dword [ebp - 0xa0]
je 0x53d535
cmp edx, dword [ebp - 0x90]
je 0x53d535
cmp eax, dword [ebp - 0x100]
jne 0x53d7d0
mov eax, dword [ebp - 0x100]
cmp dword [ecx], eax
sete byte [ebp - 0x1529]
cmp dword [esi + 0x1c60], 0
je 0x53d554
mov ecx, esi
call fcn.005124f0
push 0
push 0
push 0x130b
push dword [ebp - 0xe4]
mov ecx, edi
call fcn.005c5730
push eax
call dword [ebp - 0x1528]
push eax
mov ecx, esi
mov dword [ebp - 0x1534], eax
call fcn.0050bd90
push eax
mov ecx, edi
call fcn.005c5730
cmp byte [ebp - 0x1529], 0
mov dword [ebp - 0x1550], eax
je 0x53d5db
push eax
call dword [ebp - 0x1570]
cmp byte [ebp - 0x1521], 2
jne 0x53d5ce
xorps xmm1, xmm1
lea ecx, [ebp - 0x388]
call fcn.005d05a0
movsd xmm1, qword [0x6edb98]
comisd xmm1, xmm0
jbe 0x53d5ce
mov byte [ebp - 0x1521], 0
jmp 0x53f135
mov eax, dword [ebp - 0x1550]
mov byte [ebp - 0x1521], 1
cmp dword [ebp - 0x1534], 7
ja 0x53d6ff
push 0
push 0
push 0x1004
push eax
call dword [ebp - 0x1528]
test eax, eax
jne 0x53d61c
mov esi, 0x33
push 0x40
push dword [ebp + esi*4 - 0x148]
mov ecx, edi
call fcn.005bd3f0
inc esi
cmp esi, 0x38
jl 0x53d601
jmp 0x53d71a
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ebp - 0x1550]
call dword [ebp - 0x1528]
mov ecx, eax
mov eax, 0x20
cmp ecx, 0xffffffff
mov dword [ebp - 0x1554], ecx
mov ecx, 0x40
cmove eax, ecx
mov ecx, edi
push eax
push dword [ebp - 0x6c]
mov dword [ebp - 0x1520], eax
call fcn.005bd3f0
push dword [ebp - 0x1520]
mov ecx, edi
push dword [ebp - 0x7c]
call fcn.005bd3f0
push dword [ebp - 0x1520]
mov ecx, edi
push dword [ebp - 0x78]
call fcn.005bd3f0
push 0x20
push dword [ebp - 0x74]
mov ecx, edi
call fcn.005bd3f0
push 0x20
push dword [ebp - 0x70]
mov ecx, edi
call fcn.005bd3f0
push 0x20
push dword [ebp - 0x40]
mov ecx, edi
call fcn.005bd3f0
cmp dword [ebp - 0x1534], 3
je 0x53d6b4
mov ecx, 0x40
mov dword [ebp - 0x1520], ecx
jmp 0x53d6e9
mov edx, dword [ebp - 0x1554]
cmp edx, 0xffffffff
je 0x53d6e3
mov ecx, dword [ebp - 0x1550]
call fcn.005c9b10
mov ecx, dword [ebp - 0x1520]
cmp eax, 0x51
mov eax, 0x40
cmovne ecx, eax
mov dword [ebp - 0x1520], ecx
jmp 0x53d6e9
mov ecx, dword [ebp - 0x1520]
push ecx
push dword [ebp - 0xc4]
mov ecx, edi
call fcn.005bd3f0
push dword [ebp - 0x1520]
jmp 0x53d73d
mov esi, 0x33
push 0x40
push dword [ebp + esi*4 - 0x148]
mov ecx, edi
call fcn.005bd3f0
inc esi
cmp esi, 0x38
jl 0x53d704
mov esi, dword [ebp - 0x154c]
mov ecx, edi
push 0x40
push dword [ebp - 0x40]
call fcn.005bd3f0
push 0x40
push dword [ebp - 0xc4]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x30]
mov ecx, edi
call fcn.005bd3f0
lea ecx, [esi + 0x128]
call fcn.005dbeb0
test al, al
mov ecx, 0x20
mov eax, 0x40
cmovne ecx, eax
push ecx
push dword [ebp - 0x50]
mov ecx, edi
call fcn.005bd3f0
cmp byte [ebp - 0x1529], 0
je 0x53d7b8
lea eax, [ebp - 0x1498]
mov ecx, edi
push eax
push dword [ebp - 0x100]
call fcn.005c5730
push eax
call dword [ebp - 0x1540]
test eax, eax
je 0x53d7b8
mov eax, dword [ebp - 0x148c]
mov ecx, edi
inc eax
push eax
mov eax, dword [ebp - 0x1490]
inc eax
push eax
push 8
push dword [ebp - 0xe4]
call fcn.005bbfd0
jmp 0x53d899
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push dword [ebp - 0xe4]
mov ecx, edi
call fcn.005bbfd0
jmp 0x53d899
mov edx, dword [ebp - 0x120]
cmp eax, edx
jne 0x53d818
cmp dword [esi + 0x1c60], 0
je 0x53d7f0
mov ecx, esi
call fcn.005124f0
mov edx, dword [ebp - 0x120]
push 4
push edx
mov ecx, edi
call fcn.005bc500
mov edx, dword [esi + 0x34]
mov ecx, edx
or ecx, 0x200
and edx, 0xfffffdff
test eax, eax
cmove edx, ecx
mov dword [esi + 0x34], edx
jmp 0x53d899
mov edx, dword [ebp - 0xfc]
cmp eax, edx
jne 0x53d857
cmp dword [esi + 0x1c60], 0
je 0x53d838
mov ecx, esi
call fcn.005124f0
mov edx, dword [ebp - 0xfc]
push 4
push edx
mov ecx, edi
call fcn.005bc500
mov edx, dword [esi + 0x34]
mov ecx, edx
and ecx, 0xffffffbf
or edx, 0x40
test eax, eax
cmove edx, ecx
mov dword [esi + 0x34], edx
jmp 0x53d899
mov edx, dword [ebp - 0xf8]
cmp eax, edx
jne 0x53d89f
cmp dword [esi + 0x1c60], 0
je 0x53d877
mov ecx, esi
call fcn.005124f0
mov edx, dword [ebp - 0xf8]
push 4
push edx
mov ecx, edi
call fcn.005bc500
mov ecx, dword [esi + 0x34]
test eax, eax
je 0x53d890
or ecx, 0x80
jmp 0x53d896
and ecx, 0xffffff7f
mov dword [esi + 0x34], ecx
mov ecx, dword [ebp - 0x1530]
mov eax, dword [ecx]
mov edx, dword [ebp - 0x11c]
cmp eax, edx
jne 0x53da66
cmp dword [esi + 0x1c60], 0
je 0x53d8bf
mov ecx, esi
call fcn.005124f0
mov ecx, dword [ebp - 0x1488]
cmp ecx, 0xffffffff
je 0x53d8f2
test ecx, ecx
je 0x53d8f2
xor edx, edx
call fcn.005cca30
test al, al
je 0x53d8f2
push 0
push dword [ebp - 0x1488]
call dword [ebp - 0x1548]
lea ecx, [ebp - 0x1488]
call fcn.004010c0
mov ecx, dword [esi + 0x1c94]
push 1
call fcn.00554030
lea ecx, [esi + 0x158]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
call fcn.005dc400
lea eax, [ebp - 0x2dc]
push eax
push 0
push esi
push 0x5132d0
push 0
push 0
call dword [ebp - 0x153c]
push eax
lea ecx, [ebp - 0x1480]
call fcn.00401070
mov eax, 0xf
mov dword [ebp - 0x1534], eax
nop dword [eax + eax]
mov ecx, dword [ebp + eax*4 - 0x148]
test ecx, ecx
jle 0x53d96b
push 0x40
push ecx
mov ecx, edi
call fcn.005bd3f0
mov eax, dword [ebp - 0x1534]
inc eax
mov dword [ebp - 0x1534], eax
cmp eax, 0x11
jl 0x53d950
push 0x22
push dword [ebp - 0x118]
mov ecx, edi
call fcn.005bd3f0
mov ecx, dword [esi + 4]
push 0x186a0
push 0
push str.Stop_the_current_scan
push dword [ebp - 0x118]
call fcn.005bcaf0
push 1
push dword [ebp - 0x11c]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x120]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0xfc]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x58]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x54]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x34]
mov ecx, edi
call fcn.005bd3f0
lea eax, [ebp - 0x1498]
mov ecx, edi
push eax
push dword [ebp - 0x114]
call fcn.005c5730
push eax
call dword [ebp - 0x1540]
test eax, eax
je 0x53da56
push 2
lea eax, [ebp - 0x1498]
push eax
push dword [ebp - 0x1558]
push 0
call dword [ebp - 0x1564]
mov eax, dword [ebp - 0x1494]
lea ecx, [ebp - 0x23c]
push 0
add eax, 2
push eax
mov eax, dword [ebp - 0x1498]
add eax, 0x78
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 4
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0050cce0
lea ecx, [ebp - 0x2f8]
call fcn.005d05f0
jmp 0x53f135
cmp eax, dword [ebp - 0x34]
je 0x53e57a
cmp eax, 0xfffffffb
je 0x53e57a
cmp eax, dword [ebp - 0x2c]
jne 0x53dae5
cmp dword [esi + 0x1c60], 0
je 0x53da93
mov ecx, esi
call fcn.005124f0
mov edx, dword [ebp - 0x11c]
push 0xd
push dword [ebp - 0x13c]
xorps xmm0, xmm0
lea ecx, [ebp - 0x350]
push dword [ebp - 0xe4]
movups xmmword [ebp - 0x350], xmm0
push edx
push edi
movups xmmword [ebp - 0x340], xmm0
call fcn.005b8800
lea eax, [ebp - 0x330]
mov byte [ebp - 4], 0x28
push eax
mov ecx, esi
call fcn.0050d760
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 0x23
call fcn.005b8790
jmp 0x53e287
cmp eax, dword [ebp - 0x138]
jne 0x53dbbf
cmp dword [esi + 0x1c60], 0
je 0x53db01
mov ecx, esi
call fcn.005124f0
mov eax, dword [ebp - 0x1480]
cmp eax, 0xffffffff
je 0x53dba3
test eax, eax
je 0x53dba3
lea ecx, [esi + 0x698]
call fcn.005b7680
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xb4
push 1
push str.There_is_an_active_scan_in_progress._r_n_r_nAre_you_sure_you_want_to_exit_
mov ecx, esi
call fcn.0050cce0
test eax, eax
je 0x53f135
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push dword [ebp - 0x1480]
mov byte [esi + 0x41], 1
call edi
cmp eax, 0x102
jne 0x53db93
mov esi, dword [ebp - 0x1530]
mov dl, 1
mov ecx, esi
call fcn.005c8820
test eax, eax
jne 0x53db7c
push 0xa
call dword [ebp - 0x147c]
push 0
push dword [ebp - 0x1480]
call edi
cmp eax, 0x102
je 0x53db67
mov esi, dword [ebp - 0x154c]
lea ecx, [ebp - 0x1480]
call fcn.004010c0
jmp 0x53f0ef
mov eax, dword [ebp - 0x149c]
cmp eax, 0xffffffff
je 0x53f0ef
test eax, eax
je 0x53f0ef
jmp 0x53f135
cmp eax, dword [ebp - 0x118]
jne 0x53dbd0
mov byte [esi + 0x40], 1
jmp 0x53e287
cmp eax, dword [ebp - 0x108]
jne 0x53dcec
cmp dword [esi + 0x1c60], 0
je 0x53dbec
mov ecx, esi
call fcn.005124f0
mov cl, byte [ebp - 0x1519]
test cl, cl
jne 0x53dc1b
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xb4
push 1
push str.Are_you_sure_you_want_to_remove_the_selected_items__r_n_r_nOpen_internet_browsers_will_be_closed._Continue_
mov ecx, esi
call fcn.0050cce0
test eax, eax
je 0x53f135
jmp 0x53dc2f
movzx eax, cl
cmp cl, 1
mov ecx, 3
cmova eax, ecx
mov byte [ebp - 0x1519], al
push 0x40
push dword [ebp - 0x10c]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x108]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x100]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0xf8]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x34]
mov ecx, edi
call fcn.005bd3f0
push 0
push str.Cancel
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xfa
push 0x2a8
push edi
push str.Preparing_to_fix_the_selected_items
lea ecx, [esi + 0x940]
call fcn.005b6870
mov ecx, eax
call fcn.005b64a0
cmp byte [ebp - 0x1541], 0
jne 0x53dcc7
push 1
push 5
push 0
push 0xffffffffffffffb0
lea ecx, [esi + 0x940]
call fcn.005b66e0
mov ecx, eax
call fcn.005b62b0
push 0
push 0
push esi
push 0x52eb80
push 0
push 0
call dword [ebp - 0x153c]
push eax
lea ecx, [ebp - 0x149c]
call fcn.00401070
jmp 0x53e287
cmp eax, dword [ebp - 0x6c]
jne 0x53dd61
cmp dword [esi + 0x1c60], 0
je 0x53dd01
mov ecx, esi
call fcn.005124f0
push 0
push 0
push 0x130b
push dword [ebp - 0xe4]
mov ecx, edi
call fcn.005befd0
push eax
mov ecx, esi
call fcn.0050bd90
mov dword [ebp - 0x1554], eax
test eax, eax
je 0x53f135
push 2
push 0xffffffffffffffff
push 0x100c
push eax
mov ecx, edi
call fcn.005c5730
push eax
call dword [ebp - 0x1528]
cmp eax, 0xffffffff
je 0x53f135
push eax
push dword [ebp - 0x1554]
mov ecx, esi
call fcn.0050b770
jmp 0x53e287
cmp eax, dword [ebp - 0x30]
jne 0x53de99
cmp dword [esi + 0x1c60], 0
je 0x53dd7a
mov ecx, esi
call fcn.005124f0
push 0
push 0
push 0x130b
push dword [ebp - 0xe4]
mov ecx, edi
call fcn.005befd0
push eax
mov ecx, esi
call fcn.0050bd90
mov dword [ebp - 0x1550], eax
test eax, eax
je 0x53f135
push 2
push 0xffffffffffffffff
push 0x100c
push eax
mov ecx, edi
call fcn.005c5730
push eax
call dword [ebp - 0x1528]
mov dword [ebp - 0x1534], eax
cmp eax, 0xffffffff
je 0x53f135
mov ecx, dword [esi + 4]
push eax
push dword [ebp - 0x1550]
call fcn.005bb5c0
cmp eax, 0x51
jne 0x53f135
mov ecx, dword [esi + 4]
xorps xmm0, xmm0
push 0
push 0
push dword [ebp - 0x1534]
movq qword [ebp - 0x284], xmm0
push dword [ebp - 0x1550]
mov dword [ebp - 0x27c], 0
call fcn.005bb510
push eax
lea ecx, [ebp - 0x284]
call fcn.005dc570
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0x96
push 1
push str.Are_you_sure_you_want_to_whitelist_the_parent_directory_of_the_hilighted_item__r_n_r_nThis_action_can_be_undone_from_Menu____Whitelist_Manager.
mov ecx, esi
mov byte [ebp - 4], 0x29
call fcn.0050cce0
lea ecx, [ebp - 0x284]
test eax, eax
jne 0x53de55
mov byte [ebp - 4], 0x23
call fcn.005dc430
jmp 0x53f135
push 1
call fcn.005dbed0
mov ecx, eax
call fcn.005dc190
push eax
mov ecx, esi
call fcn.00511d80
test al, al
je 0x53de85
mov ecx, dword [esi + 4]
push 0
push dword [ebp - 0x1534]
push dword [ebp - 0x1550]
call fcn.005bb970
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 0x23
call fcn.005dc430
jmp 0x53e287
cmp eax, dword [ebp - 0x40]
jne 0x53dee1
cmp dword [esi + 0x1c60], 0
je 0x53deae
mov ecx, esi
call fcn.005124f0
push 0
push 0
push 0x130b
push dword [ebp - 0xe4]
mov ecx, edi
call fcn.005befd0
push eax
mov ecx, esi
call fcn.0050bd90
test eax, eax
je 0x53e287
push eax
mov ecx, esi
call fcn.0050bcd0
jmp 0x53e287
cmp eax, dword [ebp - 0x3c]
jne 0x53df04
cmp dword [esi + 0x1c60], 0
je 0x53def6
mov ecx, esi
call fcn.005124f0
push 0xffffffffffffffff
mov ecx, esi
call fcn.0050bcd0
jmp 0x53e287
cmp eax, dword [ebp - 0x58]
jne 0x53dfe2
cmp dword [esi + 0x1c60], 0
je 0x53df1d
mov ecx, esi
call fcn.005124f0
mov esi, 0x28
push 0
push 0
push 0x1009
push dword [ebp + esi*4 - 0x148]
mov ecx, edi
call fcn.005befd0
inc esi
cmp esi, 0x2f
jl 0x53df22
mov esi, 0xf
push 1
push dword [ebp + esi*4 - 0x148]
mov ecx, edi
call fcn.005bd3f0
inc esi
cmp esi, 0x12
jl 0x53df44
mov esi, dword [ebp - 0x154c]
mov ecx, edi
push 0x22
push dword [ebp - 0x120]
call fcn.005bd3f0
push 0x22
push dword [ebp - 0x11c]
mov ecx, edi
call fcn.005bd3f0
push 0x22
push dword [ebp - 0x114]
mov ecx, edi
call fcn.005bd3f0
push 0x22
push dword [ebp - 0xfc]
mov ecx, edi
call fcn.005bd3f0
push 1
push dword [ebp - 0x118]
mov ecx, edi
call fcn.005bd3f0
push 1
push dword [ebp - 0xf8]
mov ecx, edi
call fcn.005bd3f0
push 0
push dword [ebp - 0x114]
mov ecx, edi
call fcn.005b9910
push 0
push str.Press__Scan_...
push dword [ebp - 0x110]
mov ecx, edi
call fcn.005bcd30
jmp 0x53e287
cmp eax, dword [ebp - 0x54]
jne 0x53e092
cmp dword [esi + 0x1c60], 0
je 0x53dffb
mov ecx, esi
call fcn.005124f0
lea ecx, [esi + 0x11c]
call fcn.005dbeb0
test al, al
jne 0x53f135
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x2c4], 0
push 0x624388
lea ecx, [esi + 0x11c]
movq qword [ebp - 0x2cc], xmm0
call fcn.005dc190
push eax
push 0x62e4a8
lea ecx, [ebp - 0x254]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2cc]
call fcn.005dc520
push 2
push 5
push 0
lea ecx, [ebp - 0x2cc]
mov byte [ebp - 4], 0x2a
call fcn.005dc190
mov edx, eax
xor ecx, ecx
call fcn.005e2a10
lea ecx, [ebp - 0x2cc]
mov byte [ebp - 4], 0x23
call fcn.005dc430
jmp 0x53e287
cmp eax, dword [ebp - 0x50]
jne 0x53e142
cmp dword [esi + 0x1c60], 0
je 0x53e0ab
mov ecx, esi
call fcn.005124f0
lea ecx, [esi + 0x128]
call fcn.005dbeb0
test al, al
jne 0x53f135
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x2a0], 0
push 0x624388
lea ecx, [esi + 0x128]
movq qword [ebp - 0x2a8], xmm0
call fcn.005dc190
push eax
push 0x62e4a8
lea ecx, [ebp - 0x254]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2a8]
call fcn.005dc520
push 2
push 5
push 0
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0x2b
call fcn.005dc190
mov edx, eax
xor ecx, ecx
call fcn.005e2a10
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0x23
call fcn.005dc430
jmp 0x53e287
cmp eax, dword [ebp - 0x4c]
jne 0x53e1dd
cmp dword [esi + 0x1c60], 0
je 0x53e15b
mov ecx, esi
call fcn.005124f0
lea eax, [esi + 0x134]
mov dword [ebp - 0x240], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x248]
push eax
movq qword [ebp - 0x248], xmm0
call fcn.005dc5b0
push 4
push 1
push 1
push 1
push 0x624390
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0x2c
call fcn.005daa70
test eax, eax
je 0x53e1af
push 4
lea ecx, [ebp - 0x248]
call fcn.005dad50
push 0
push 5
push 0
lea ecx, [ebp - 0x248]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005e2950
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0x23
call fcn.005dc430
jmp 0x53e287
cmp eax, dword [ebp - 0x44]
jne 0x53e20a
cmp dword [esi + 0x1c60], 0
je 0x53e1f2
mov ecx, esi
call fcn.005124f0
mov eax, dword [ebp - 0x1518]
mov ecx, esi
push dword [eax + 0x3c]
push dword [ebp - 0x1574]
call fcn.0050bdf0
jmp 0x53e287
cmp eax, 0xfffffff2
je 0x53e553
cmp eax, dword [ebp - 0x7c]
je 0x53e553
cmp eax, dword [ebp - 0x78]
je 0x53e553
cmp eax, dword [ebp - 0xc4]
jne 0x53e45b
push 0
push 0
push 0x130b
push dword [ebp - 0xe4]
mov ecx, edi
call fcn.005befd0
push eax
mov ecx, esi
call fcn.0050bd90
mov ecx, dword [ebp - 0x90]
cmp ecx, eax
jne 0x53f135
push 0
push ecx
mov ecx, esi
call fcn.0050b5e0
mov ecx, esi
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 4
cmp al, 1
jne 0x53e443
push str.Thank_you_for_your_submission__r_nNo_personal_information_is_ever_sent_by_these_reports.
call fcn.0050cce0
mov eax, dword [ebp - 0x1480]
cmp eax, 0xffffffff
je 0x53ee33
test eax, eax
je 0x53ee33
xorps xmm1, xmm1
lea ecx, [ebp - 0x2f8]
call fcn.005d05a0
comisd xmm0, xmmword [0x6edbe8]
ja 0x53e305
mov eax, dword [ebp - 0x1530]
mov ecx, dword [eax]
test ecx, ecx
jg 0x53e305
cmp ecx, 0xffffffe5
jle 0x53e305
cmp ecx, 0xfffffffe
je 0x53e305
cmp ecx, 0xfffffff9
je 0x53e305
cmp ecx, 0xfffffff8
je 0x53e305
cmp ecx, 0xfffffff6
je 0x53e305
cmp ecx, 0xfffffff3
je 0x53e305
cmp ecx, 0xfffffff2
je 0x53e305
cmp ecx, 0xffffffee
je 0x53e305
cmp ecx, 0xffffffed
je 0x53e305
mov eax, ecx
cmp eax, 0xffffffec
je 0x53e305
cmp eax, 0xffffffe7
je 0x53e305
cmp eax, 0xfffffff5
je 0x53e305
cmp eax, 0xffffffea
jne 0x53e31b
lea ecx, [esi + 0x698]
call fcn.005b7680
lea ecx, [ebp - 0x2f8]
call fcn.005d05f0
mov ecx, dword [ebp - 0x1480]
xor edx, edx
call fcn.005cca30
test al, al
jne 0x53f135
lea eax, [ebp - 0x1c8]
push eax
push dword [ebp - 0x1480]
call dword [ebp - 0x155c]
lea ecx, [ebp - 0x1480]
call fcn.004010c0
lea ecx, [esi + 0x698]
call fcn.005b7680
lea ecx, [esi + 0xc30]
call fcn.005a8610
push 0
push 0
push esi
push 0x513280
push 0
push 0
mov dword [ebp - 0x1c4], 0
call dword [ebp - 0x153c]
mov dword [ebp - 0x1c4], eax
test eax, eax
jne 0x53e396
mov dword [ebp - 0x1c4], 0xffffffff
push 0
push 0
push esi
push 0x5132b0
push 0
push 0
mov byte [ebp - 4], 0x2d
call dword [ebp - 0x153c]
push eax
lea ecx, [ebp - 0x1488]
call fcn.00401070
xorps xmm0, xmm0
mov dword [ebp - 0x1cc], 0
lea ecx, [ebp - 0x1d4]
movq qword [ebp - 0x1d4], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1520], 0x96
cmp eax, 1
jne 0x53e998
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.The_scan_was_aborted._Please_report_this_error_back_to_us.
push str.Sorry__an_error_occurred_while_enumerating_user_accounts._r_n_r_n
lea ecx, [ebp - 0x1d4]
call fcn.005dc200
push 0
push str.Error_starting_scan.
push dword [ebp - 0x110]
mov ecx, edi
mov dword [ebp - 0x1520], 0xc8
call fcn.005bcd30
jmp 0x53ec09
cmp al, 3
jne 0x53e451
push str.Sorry_a_previous_submission_is_still_in_progress.
jmp 0x53e282
push str.Submission_failed._Please_try_later.
jmp 0x53e282
mov edx, dword [ebp - 0x74]
cmp eax, edx
je 0x53e46b
cmp eax, dword [ebp - 0x70]
jne 0x53e287
cmp dword [esi + 0x1c60], 0
je 0x53e484
mov ecx, esi
call fcn.005124f0
mov edx, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x1530]
cmp dword [ecx], edx
mov ecx, edi
push 0
push 0
push 0x130b
push dword [ebp - 0xe4]
sete byte [ebp - 0x1529]
call fcn.005c5730
push eax
call dword [ebp - 0x1528]
push eax
mov ecx, esi
call fcn.0050bd90
test eax, eax
je 0x53f135
push eax
mov ecx, edi
call fcn.005c5730
push 0
push 0
push 0x1004
push eax
mov dword [ebp - 0x1534], eax
call dword [ebp - 0x1528]
mov dword [ebp - 0x1550], eax
mov dword [ebp - 0x1554], 0
test eax, eax
jle 0x53e287
movzx esi, byte [ebp - 0x1529]
mov edi, dword [ebp - 0x1554]
inc esi
shl esi, 0xc
nop dword [eax]
nop word [eax + eax]
lea eax, [ebp - 0x36c]
mov dword [ebp - 0x35c], 0xf000
push eax
push edi
push 0x102b
push dword [ebp - 0x1534]
mov dword [ebp - 0x360], esi
call dword [ebp - 0x1528]
inc edi
cmp edi, dword [ebp - 0x1550]
jl 0x53e510
mov esi, dword [ebp - 0x154c]
mov edi, dword [ebp - 0x1538]
jmp 0x53e287
cmp dword [esi + 0x1c60], 0
je 0x53e569
mov ecx, esi
call fcn.005124f0
mov ecx, dword [ebp - 0x1530]
push dword [ecx + 0xc]
push dword [ecx]
mov ecx, esi
call fcn.005129e0
jmp 0x53e287
xorps xmm0, xmm0
mov dword [ebp - 0x1dc], 0
lea ecx, [ebp - 0x1e4]
movq qword [ebp - 0x1e4], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x278]
xorps xmm0, xmm0
mov dword [ebp - 0x270], 0
movq qword [ebp - 0x278], xmm0
call fcn.005dc5e0
mov eax, dword [ebp - 0x1530]
mov byte [ebp - 4], 0x25
cmp dword [eax], 0xfffffffb
jne 0x53e70d
mov ecx, edi
call fcn.005c57d0
push eax
lea ecx, [ebp - 0x1e4]
call fcn.005dc1c0
xorps xmm0, xmm0
lea ecx, [ebp - 0x1e4]
push 1
push 0x62781c
movups xmmword [ebp - 0x29c], xmm0
movq qword [ebp - 0x28c], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x29c]
call fcn.005d92a0
push 0
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 0x26
call fcn.005d9220
push eax
call dword [ebp - 0x20c]
lea ecx, [ebp - 0x29c]
test eax, eax
je 0x53e64e
push 0
call fcn.005d9220
push eax
lea ecx, [ebp - 0x1e4]
call fcn.005dc510
jmp 0x53e6fe
call fcn.005d9210
cmp eax, 1
jbe 0x53e6fe
push 0
push 1
push 0
lea ecx, [ebp - 0x29c]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x1e4]
call fcn.005dc260
mov ecx, eax
call fcn.005dbed0
lea ecx, [ebp - 0x29c]
mov dword [ebp - 0x1554], 0
call fcn.005d9210
test eax, eax
je 0x53e6fe
mov esi, dword [ebp - 0x1554]
nop
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x5c
push 1
push esi
lea ecx, [ebp - 0x29c]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x278]
call fcn.005dc260
mov ecx, eax
call fcn.005dbfc0
push eax
push 0x62794c
lea ecx, [ebp - 0x1e4]
call fcn.005da780
lea ecx, [ebp - 0x29c]
inc esi
call fcn.005d9210
cmp esi, eax
jb 0x53e6a0
mov esi, dword [ebp - 0x154c]
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 0x25
call fcn.005d9280
cmp dword [esi + 0x1c60], 0
je 0x53e71d
mov ecx, esi
call fcn.005124f0
push 0xd
push dword [ebp - 0x13c]
xorps xmm0, xmm0
lea ecx, [ebp - 0x350]
push dword [ebp - 0xe4]
movups xmmword [ebp - 0x350], xmm0
push dword [ebp - 0x11c]
movups xmmword [ebp - 0x340], xmm0
push edi
call fcn.005b8800
lea ecx, [ebp - 0x1e4]
mov byte [ebp - 4], 0x27
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0050ced0
cmp eax, 0xffffffff
jne 0x53e794
lea ecx, [ebp - 0x350]
call fcn.005b8790
lea ecx, [ebp - 0x278]
call fcn.005dc430
lea ecx, [ebp - 0x1e4]
mov byte [ebp - 4], 0x23
call fcn.005dc430
jmp 0x53f135
push 0
push 3
push 0x1330
push dword [ebp - 0xe4]
mov ecx, edi
call fcn.005befd0
mov ecx, dword [ebp - 0x1488]
cmp ecx, 0xffffffff
je 0x53e7dd
test ecx, ecx
je 0x53e7dd
xor edx, edx
call fcn.005cca30
test al, al
je 0x53e7dd
push 0
push dword [ebp - 0x1488]
call dword [ebp - 0x1548]
lea ecx, [ebp - 0x1488]
call fcn.004010c0
mov ecx, dword [esi + 0x1c94]
push 1
call fcn.00554030
lea eax, [ebp - 0x2e0]
mov dword [esi + 0x24], 0
push eax
push 0
push esi
push 0x513220
push 0
push 0
mov dword [esi + 0x28], 0
call dword [ebp - 0x153c]
push eax
lea ecx, [ebp - 0x1480]
call fcn.00401070
mov eax, 0xf
mov dword [ebp - 0x1534], eax
nop dword [eax + eax]
mov ecx, dword [ebp + eax*4 - 0x148]
test ecx, ecx
jle 0x53e84b
push 0x40
push ecx
mov ecx, edi
call fcn.005bd3f0
mov eax, dword [ebp - 0x1534]
inc eax
mov dword [ebp - 0x1534], eax
cmp eax, 0x11
jl 0x53e830
push 0x22
push dword [ebp - 0x118]
mov ecx, edi
call fcn.005bd3f0
push 0x22
push dword [ebp - 0x114]
mov ecx, edi
call fcn.005bd3f0
mov ecx, dword [esi + 4]
push 0x186a0
push 0
push str.Stop_the_current_scan
push dword [ebp - 0x118]
call fcn.005bcaf0
push 1
push dword [ebp - 0x11c]
mov ecx, edi
call fcn.005bd3f0
push 1
push dword [ebp - 0x108]
mov ecx, edi
call fcn.005bd3f0
push 1
push dword [ebp - 0x104]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x120]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0xfc]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x58]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x54]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x34]
mov ecx, edi
call fcn.005bd3f0
lea eax, [ebp - 0x1498]
mov ecx, edi
push eax
push dword [ebp - 0x114]
call fcn.005c5730
push eax
call dword [ebp - 0x1540]
test eax, eax
je 0x53e963
push 2
lea eax, [ebp - 0x1498]
push eax
push dword [ebp - 0x1558]
push 0
call dword [ebp - 0x1564]
mov eax, dword [ebp - 0x1494]
lea ecx, [ebp - 0x23c]
push 0
add eax, 2
push eax
mov eax, dword [ebp - 0x1498]
add eax, 0x78
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 4
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0050cce0
lea ecx, [ebp - 0x2f8]
call fcn.005d05f0
lea ecx, [ebp - 0x350]
call fcn.005b8790
lea ecx, [ebp - 0x278]
call fcn.005dc430
lea ecx, [ebp - 0x1e4]
mov byte [ebp - 4], 0x23
call fcn.005dc430
jmp 0x53f135
cmp eax, 3
jne 0x53e9ec
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Please_keep_in_mind_that_only_one_instance_of_this_application_can_run_at_a_time.
push str.The_scan_was_aborted__but_you_can_try_again_later._r_n_r_n
push str.Sorry__an_error_occurred_while_loading_the_definitions_database._r_n_r_n
lea ecx, [ebp - 0x1d4]
call fcn.005dc200
push 0
push str.Error_loading_definitions.
push dword [ebp - 0x110]
mov ecx, edi
mov dword [ebp - 0x1520], 0xfa
call fcn.005bcd30
jmp 0x53ec09
cmp dword [esi + 0x28], 0
jne 0x53ea6f
cmp dword [esi + 0x24], 0
jne 0x53ea6f
mov ecx, esi
call fcn.0050db30
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test al, al
jne 0x53ea48
push str.You_can_scan_again_anytime_you_wish.
push str._did_not_find_any_threats_this_time._r_n_r_n
lea ecx, [esi + 0x354]
call fcn.005dc190
push eax
push str.Congratulations__r_n_r_n
lea ecx, [ebp - 0x1d4]
call fcn.005dc200
mov dword [ebp - 0x1520], 0xdc
jmp 0x53ec09
xor ecx, ecx
mov eax, str.No_Items_were_found_so_far.
cmp dword [esi + 0x24], ecx
push 0
push 0
cmovne eax, ecx
lea ecx, [ebp - 0x1d4]
push eax
push str.The_scan_was_cancelled._r_n_r_n
call fcn.005dc200
jmp 0x53ec09
xorps xmm0, xmm0
mov dword [ebp - 0x200], 0
lea ecx, [ebp - 0x208]
movq qword [ebp - 0x208], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x1fc]
xorps xmm0, xmm0
mov dword [ebp - 0x1f4], 0
movq qword [ebp - 0x1fc], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x208]
push dword [esi + 0x28]
call fcn.005db290
mov eax, dword [esi + 0x28]
lea ecx, [ebp - 0x208]
test eax, eax
jne 0x53ead9
call fcn.005dc400
jmp 0x53eb0b
cmp eax, 1
jne 0x53eaeb
push eax
push str.one_recommended_item__which_is_already_checked__and
call fcn.005dc260
jmp 0x53eb0b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._recommended_items__which_are_already_checked__and
call fcn.005da780
mov eax, dword [esi + 0x24]
lea ecx, [ebp - 0x1fc]
sub eax, dword [esi + 0x28]
push eax
mov dword [ebp - 0x1554], eax
call fcn.005db290
cmp dword [esi + 0x24], 0
lea ecx, [ebp - 0x1fc]
jne 0x53eb3b
push str.no_threats_in_this_PC
call fcn.005dc510
jmp 0x53eb82
mov eax, dword [ebp - 0x1554]
test eax, eax
jne 0x53eb51
push str.no_optional_items
call fcn.005dc510
jmp 0x53eb82
cmp eax, 1
jne 0x53eb62
push str.one_optional_item
call fcn.005dc510
jmp 0x53eb82
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._optional_items
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push str.__check_the_items_you_want_to_remove__and_uncheck_the_ones_you_want_to_preserve._You_can_also_whitelist_items_you_never_want_to_see_listed_again._r_n_r_nWhen_ready__press_the__Clean__button_to_start_removing_the_selected_items._r_n_r_nWould_you_like_to_see_a_few_instructive_tips_
lea ecx, [esi + 0x158]
call fcn.005dc3a0
test eax, eax
mov ecx, str.the_Malware_tab
mov eax, str.all_the_tabs
cmove ecx, eax
push ecx
push str.._r_n_r_nTake_a_look_at
lea ecx, [ebp - 0x1fc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x208]
call fcn.005dc190
push eax
push str._found
lea ecx, [esi + 0x354]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1d4]
call fcn.005dc200
lea ecx, [ebp - 0x1fc]
mov dword [ebp - 0x1520], 0xfa
call fcn.005dc430
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0x2e
call fcn.005dc430
mov eax, dword [ebp - 0x1518]
test byte [eax + 0x8c], 0x10
je 0x53ec36
mov ecx, esi
call fcn.0050db30
test al, al
jne 0x53ec36
cmp dword [esi + 0x28], 0
je 0x53f148
mov byte [ebp - 0x1519], 1
jmp 0x53ecaa
cmp dword [esi + 0x28], 0
jne 0x53ec67
cmp dword [esi + 0x24], 0
jne 0x53ec67
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push dword [ebp - 0x1520]
lea ecx, [ebp - 0x1d4]
push 0
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0050cce0
jmp 0x53ecaa
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1c2
push dword [ebp - 0x1520]
lea ecx, [ebp - 0x1d4]
push 1
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0050cce0
cmp eax, 1
jne 0x53ecaa
cmp dword [esi + 0x1c60], 0
jne 0x53ecaa
cmp dword [esi + 0x1c64], 0
jne 0x53ecaa
mov dword [esi + 0x1c64], eax
cmp dword [esi + 0x24], 0
mov esi, 0xf
je 0x53ed20
push 0x22
push dword [ebp + esi*4 - 0x148]
mov ecx, edi
call fcn.005bd3f0
inc esi
cmp esi, 0x12
jl 0x53ecb5
mov esi, 0xa
push 1
push dword [ebp + esi*4 - 0x148]
mov ecx, edi
call fcn.005bd3f0
inc esi
cmp esi, 0xe
jl 0x53ecd0
mov esi, dword [ebp - 0x154c]
mov ecx, edi
push 0x22
push dword [ebp - 0xf8]
call fcn.005bd3f0
push 1
push dword [ebp - 0xfc]
mov ecx, edi
call fcn.005bd3f0
push 0
push str.Press__Clean_...
jmp 0x53edac
push 1
push dword [ebp + esi*4 - 0x148]
mov ecx, edi
call fcn.005bd3f0
inc esi
cmp esi, 0x12
jl 0x53ed20
mov esi, dword [ebp - 0x154c]
mov ecx, edi
push 0x22
push dword [ebp - 0x120]
call fcn.005bd3f0
push 0x22
push dword [ebp - 0x11c]
mov ecx, edi
call fcn.005bd3f0
push 0x22
push dword [ebp - 0x114]
mov ecx, edi
call fcn.005bd3f0
push 0x22
push dword [ebp - 0xf8]
mov ecx, edi
call fcn.005bd3f0
push 1
push dword [ebp - 0x118]
mov ecx, edi
call fcn.005bd3f0
push 1
push dword [ebp - 0xfc]
mov ecx, edi
call fcn.005bd3f0
push 0
push dword [ebp - 0x114]
mov ecx, edi
call fcn.005b9910
push 0
push str.Scan_complete._No_items_found.
push dword [ebp - 0x110]
mov ecx, edi
call fcn.005bcd30
mov ecx, dword [esi + 0x628]
mov eax, dword [esi + 0x28]
push 0x20
mov dword [ecx + 0x80], eax
mov ecx, edi
push dword [ebp - 0x58]
call fcn.005bd3f0
push 0x20
push dword [ebp - 0x54]
mov ecx, edi
call fcn.005bd3f0
push 0x20
push dword [ebp - 0x34]
mov ecx, edi
call fcn.005bd3f0
lea ecx, [esi + 0x11c]
call fcn.005dc3a0
test eax, eax
je 0x53ee07
push 0x20
push dword [ebp - 0x54]
mov ecx, edi
call fcn.005bd3f0
mov ecx, dword [esi + 0x1c94]
push 1
call fcn.00554030
lea ecx, [ebp - 0x1d4]
call fcn.005dc430
lea ecx, [ebp - 0x1c4]
mov byte [ebp - 4], 0x23
call fcn.00401050
jmp 0x53f135
mov ecx, dword [ebp - 0x149c]
cmp ecx, 0xffffffff
je 0x53f135
test ecx, ecx
je 0x53f135
xor edx, edx
call fcn.005cca30
test al, al
jne 0x53f135
lea eax, [ebp - 0x1c8]
push eax
push dword [ebp - 0x149c]
call dword [ebp - 0x155c]
lea ecx, [ebp - 0x149c]
call fcn.004010c0
push 0
push str.Cleanup_complete.
push dword [ebp - 0x110]
mov ecx, edi
call fcn.005bcd30
cmp byte [ebp - 0x1519], 3
je 0x53f182
cmp byte [ebp - 0x1541], 0
jne 0x53ef1d
push 0x628f54
push 1
lea ecx, [esi + 0x940]
call fcn.005b6150
push 1
lea ecx, [esi + 0x940]
call fcn.005b6ba0
lea ecx, [esi + 0x940]
mov dword [ebp - 0x1534], eax
call fcn.005b6be0
push 0
mov ecx, esi
mov dword [ebp - 0x1554], eax
call fcn.0053a1c0
test eax, eax
je 0x53ef1d
mov edi, dword [ebp - 0x1530]
nop
mov eax, dword [edi]
cmp eax, 0xfffffffa
je 0x53ef17
mov ecx, dword [ebp - 0x1554]
cmp dword [edi + 0x30], ecx
jne 0x53ef0a
cmp eax, dword [ebp - 0x1534]
je 0x53ef17
push 0
mov ecx, esi
call fcn.0053a1c0
test eax, eax
jne 0x53eef0
mov edi, dword [ebp - 0x1538]
lea ecx, [esi + 0x940]
call fcn.005b6b30
push 0x20
push dword [ebp - 0x10c]
mov ecx, edi
call fcn.005bd3f0
push 0x20
push dword [ebp - 0x108]
mov ecx, edi
call fcn.005bd3f0
push 0x20
push dword [ebp - 0x100]
mov ecx, edi
call fcn.005bd3f0
push 0x20
push dword [ebp - 0xf8]
mov ecx, edi
call fcn.005bd3f0
push 0x20
push dword [ebp - 0x50]
mov ecx, edi
call fcn.005bd3f0
push 0x20
push dword [ebp - 0x50]
mov ecx, edi
call fcn.005bd3f0
push 0x20
push dword [ebp - 0x34]
mov ecx, edi
call fcn.005bd3f0
mov ecx, dword [esi + 0x1c94]
push 1
call fcn.00554030
xorps xmm0, xmm0
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x224]
movq qword [ebp - 0x224], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x31
test byte [ebp - 0x1c8], 2
je 0x53f01f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._again__and_ensure_all_items_are_successfully_removed._r_n_r_nDo_you_want_to_reboot_now_
lea ecx, [esi + 0x354]
call fcn.005dc190
push eax
push str.Some_file_system_objects_were_scheduled_for_removal_on_reboot._r_n_r_nYou_should_reboot_your_computer_as_soon_as_possible._After_reboot__run
lea ecx, [ebp - 0x224]
call fcn.005dc200
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xfa
push 1
lea ecx, [ebp - 0x224]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0050cce0
test eax, eax
jne 0x53f164
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0x23
call fcn.005dc430
jmp 0x53f135
cmp dword [esi + 0x1c60], 0
je 0x53f049
mov ecx, esi
call fcn.005124f0
mov ecx, dword [ebp - 0x1530]
mov eax, dword [ebp - 0x1480]
cmp eax, 0xffffffff
je 0x53f122
test eax, eax
je 0x53f122
cmp dword [ecx], 0xfffffffa
jne 0x53f122
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0xb4
push 1
push str.There_is_an_active_scan_in_progress._r_n_r_nAre_you_sure_you_want_to_exit_
mov ecx, esi
call fcn.0050cce0
test eax, eax
je 0x53f135
mov ecx, dword [ebp - 0x1480]
xor edx, edx
mov byte [esi + 0x41], 1
call fcn.005cca30
test al, al
je 0x53f0cf
mov edi, dword [ebp - 0x147c]
push 1
mov ecx, esi
call fcn.0053a1c0
test eax, eax
jne 0x53f0b8
push 0xa
call edi
mov ecx, dword [ebp - 0x1480]
xor edx, edx
call fcn.005cca30
test al, al
jne 0x53f0a7
mov edi, dword [ebp - 0x1538]
lea ecx, [ebp - 0x1480]
call fcn.004010c0
push 1
push 0
mov ecx, edi
call fcn.005c3f80
mov dword [ebp - 0x156c], 1
mov edi, dword [ebp - 0x1558]
push 0xfffffffffffffff0
push edi
mov byte [esi + 0x19c], 1
call dword [ebp - 0x1568]
lea ecx, [ebp - 0x1f0]
push 1
test eax, 0x1000000
je 0x53f1b5
push 0x62a118
jmp 0x53f1ba
mov eax, dword [ebp - 0x149c]
cmp eax, 0xffffffff
je 0x53f0da
test eax, eax
je 0x53f0da
mov byte [esi + 0x40], 1
push 0
mov ecx, esi
call fcn.0053a1c0
test eax, eax
jne 0x53d480
jmp 0x53f0ef
lea ecx, [ebp - 0x1d4]
call fcn.005dc430
lea ecx, [ebp - 0x1c4]
mov byte [ebp - 4], 0x23
call fcn.00401050
jmp 0x53f0ef
push 0
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0x23
call fcn.005dc430
jmp 0x53f0ef
push 4
push dword [ebp - 0xf8]
mov ecx, edi
call fcn.005bc500
test eax, eax
je 0x53f0ef
test byte [ebp - 0x1c8], 2
je 0x53f0ef
push 0
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x53f0ef
push 0x62796c
call fcn.005dc260
push str.Maximized
push 0x665b10
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x1f0]
call fcn.005db130
push 0x62796c
lea ecx, [ebp - 0x1f0]
call fcn.005dc4c0
test al, al
je 0x53f25d
lea eax, [ebp - 0x1498]
push eax
push edi
call dword [ebp - 0x1540]
push str.WindowCX
push 0x665b10
lea eax, [ebp - 0x330]
push eax
mov eax, dword [ebp - 0x1490]
lea ecx, [ebp - 0x1f0]
sub eax, dword [ebp - 0x1498]
push eax
call fcn.005db320
mov ecx, eax
call fcn.005db130
push str.WindowCY
push 0x665b10
lea eax, [ebp - 0x330]
push eax
mov eax, dword [ebp - 0x148c]
lea ecx, [ebp - 0x1f0]
sub eax, dword [ebp - 0x1494]
push eax
call fcn.005db320
mov ecx, eax
call fcn.005db130
push 1
push 0
push 0
lea ecx, [ebp - 0x330]
call fcn.005dca80
mov eax, dword [ebp - 0x1518]
test byte [eax + 0x8c], 2
je 0x53f282
mov edi, dword [esi + 0x2c]
jmp 0x53f288
mov edi, dword [ebp - 0x156c]
mov ecx, dword [ebp - 0x1488]
cmp ecx, 0xffffffff
je 0x53f2b0
test ecx, ecx
je 0x53f2b0
xor edx, edx
call fcn.005cca30
test al, al
je 0x53f2b0
push 0
push dword [ebp - 0x1488]
call dword [ebp - 0x1548]
cmp dword [esi + 0x10], 1
jne 0x53f2c4
push 0x14
call dword [ebp - 0x147c]
cmp dword [esi + 0x10], 1
je 0x53f2b6
push edi
mov ecx, esi
call fcn.0053a660
lea ecx, [ebp - 0x3a8]
mov esi, eax
call fcn.005b8790
lea ecx, [ebp - 0x23c]
call fcn.005dc430
lea ecx, [ebp - 0x330]
call fcn.005dd5d0
lea ecx, [ebp - 0x1f0]
call fcn.005dc430
lea ecx, [ebp - 0x2b4]
call fcn.005dc430
lea ecx, [ebp - 0x1d8]
call fcn.005d69e0
lea ecx, [ebp - 0x2c0]
call fcn.005dc430
lea ecx, [ebp - 0x254]
call fcn.005dc430
lea ecx, [ebp - 0x14b4]
call fcn.005c6500
lea ecx, [ebp - 0x14b8]
call fcn.005c6500
lea ecx, [ebp - 0x14bc]
call fcn.005c6500
lea ecx, [ebp - 0x14e0]
call fcn.005c6500
lea ecx, [ebp - 0x14a0]
call fcn.005c6500
lea ecx, [ebp - 0x14a4]
call fcn.005c6500
lea ecx, [ebp - 0x14a8]
call fcn.005c6500
lea ecx, [ebp - 0x14c0]
call fcn.005c6500
lea ecx, [ebp - 0x14c4]
call fcn.005c6500
lea ecx, [ebp - 0x14c8]
call fcn.005c6500
mov ecx, dword [ebp - 0x1560]
test ecx, ecx
je 0x53f3a4
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [ebp - 0x1488]
call fcn.00401050
lea ecx, [ebp - 0x149c]
call fcn.00401050
lea ecx, [ebp - 0x1480]
call fcn.00401050
lea ecx, [ebp - 0x14cc]
call fcn.005c6580
lea ecx, [ebp - 0x14d0]
call fcn.005c6580
lea ecx, [ebp - 0x14d4]
call fcn.005c6580
lea ecx, [ebp - 0x14d8]
call fcn.005c6580
lea ecx, [ebp - 0x14dc]
call fcn.005c6580
lea ecx, [ebp - 0x14b0]
call fcn.005c6580
lea ecx, [ebp - 0x14e4]
call fcn.005c6580
lea ecx, [ebp - 0x14ac]
call fcn.005c6580
lea ecx, [ebp - 0x230]
call fcn.005dc430
lea ecx, [ebp - 0x2d8]
call fcn.005dc430
lea ecx, [ebp - 0x218]
call fcn.005dc430
lea ecx, [ebp - 0x26c]
call fcn.005dc430
lea ecx, [ebp - 0x260]
call fcn.005dc430
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4