Function at 0x485c2d
Capabilities:
Check if file exists
Parse pe header

Disassembly:
push 0x70
mov eax, 0x5d08e1
call fcn.00506dc7
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x64]
mov esi, dword [ebp + 0xc]
mov dword [edi], 1
and dword [esi], 0
call fcn.0042ca82
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.0042ca82
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
call fcn.00481f31
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
mov byte [ebp - 4], 2
call fcn.00411f3a
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp + 0x10]
call fcn.0043193c
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x602c74
call fcn.00413f09
push ecx
push esp
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 3
call fcn.0043e68b
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x64]
call fcn.00434114
mov eax, dword [ebp - 0x10]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 4], 4
cmp dword [eax - 0xc], 0
je 0x485cd9
push eax
call ebx
test eax, eax
je 0x485cd9
or dword [edi], 1
mov ecx, dword [ebp + 0x10]
push 0
push str.iexplore.exe
call fcn.0042ea61
test eax, eax
js 0x485cf3
xor eax, eax
inc eax
or dword [edi], eax
mov dword [esi], eax
call fcn.0042fb20
cmp eax, 0x1f
jl 0x485d79
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.SystemAppsMicrosoft.MicrosoftEdge_8wekyb3d8bbweMicrosoftEdge.exe
call fcn.00411dbd
push ecx
push esp
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 5
call fcn.004ed062
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x64]
call fcn.00434114
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.00411f3a
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x485d5d
push eax
call ebx
test eax, eax
je 0x485d5d
or dword [edi], 0x40000
mov ecx, dword [ebp + 0x10]
push 0
push str.launchwinapp.exe
call fcn.0042ea61
test eax, eax
js 0x485d79
mov eax, 0x40000
or dword [edi], eax
mov dword [esi], eax
push 0
push ecx
mov ecx, esp
push 0x602dbc
call fcn.00413f09
push SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x485e61
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x602df4
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 7
push 0x602e14
call fcn.00413f09
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 8
call fcn.00411f3a
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x485e61
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.SaaYaa.exe
call fcn.00413f09
push ecx
mov esi, esp
mov byte [ebp - 4], 9
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x14]
pop ecx
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.00434114
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xa
call fcn.00411f3a
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0
je 0x485e61
push eax
call ebx
test eax, eax
je 0x485e61
or dword [edi], 2
mov ecx, dword [ebp + 0x10]
push 0
push 0x602e64
call fcn.0042ea61
test eax, eax
js 0x485e7b
push 2
pop eax
or dword [edi], eax
mov dword [esi], eax
xor esi, esi
push esi
push ecx
mov ecx, esp
push str.SoftwareMaxthon3
call fcn.00413f09
push SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x485f61
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x602eb0
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xb
push str.Folder
call fcn.00413f09
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xc
call fcn.00411f3a
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
je 0x485f61
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x602ec8
call fcn.00413f09
push ecx
mov esi, esp
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x14]
pop ecx
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.00434114
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xe
call fcn.00411f3a
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
xor esi, esi
cmp dword [eax - 0xc], esi
je 0x485f61
push eax
call ebx
test eax, eax
je 0x485f61
or dword [edi], 4
mov ecx, dword [ebp + 0x10]
push esi
push str.maxthon.exe
call fcn.0042ea61
test eax, eax
js 0x485f7d
mov eax, dword [ebp + 0xc]
push 4
pop ecx
or dword [edi], ecx
mov dword [eax], ecx
push esi
push ecx
mov ecx, esp
push 0x602f20
call fcn.00413f09
push SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x486153
lea ecx, [ebp - 0x10]
call fcn.004124d1
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x4c]
call fcn.0048f12d
lea ecx, [ebp - 0x7c]
call fcn.0042ca82
cmp dword [ebp - 0x30], 0
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x14], esi
jle 0x48610b
mov edi, esi
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00480e90
push 0x602f70
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x11
push eax
call fcn.0042dfbd
add esp, 0xc
mov esi, eax
push edi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x12
call fcn.0042def1
push ecx
mov ecx, esp
push eax
push esi
push ecx
call fcn.0043910d
add esp, 0xc
lea ecx, [ebp - 0x7c]
push SysReAllocString
call fcn.0043fb03
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00412ac4
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x10
call fcn.00412ac4
test esi, esi
je 0x4860f9
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x602f8c
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x13
push 0x602f90
call fcn.00413f09
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x7c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x14
call fcn.00411f3a
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x10
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x486106
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x602fd4
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x15
push str.LastInstallerSuccessLaunchCmdLine
call fcn.00413f09
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x7c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x16
call fcn.00411f3a
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 4], 0x10
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x486106
inc edi
push 0
pop esi
cmp edi, dword [ebp - 0x30]
jl 0x485fdc
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, 0x60307c
lea ecx, [ebp - 0x10]
push eax
push eax
call fcn.00435cda
mov ecx, eax
call fcn.00435bf5
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x486134
push eax
call ebx
test eax, eax
je 0x486134
or dword [edi], 8
lea ecx, [ebp - 0x7c]
call fcn.0042e60b
mov ecx, dword [ebp - 0x6c]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.00434a10
call fcn.00430f47
push esi
push ecx
mov ecx, esp
test eax, eax
je 0x486167
push 0x6030c0
jmp 0x48616c
push str.SoftwareGoogleUpdateClientState
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x48633c
lea ecx, [ebp - 0x10]
call fcn.004124d1
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0x4c]
call fcn.0048f12d
lea ecx, [ebp - 0x7c]
call fcn.0042ca82
cmp dword [ebp - 0x30], 0
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x20], esi
jle 0x4862f4
mov edi, esi
push esi
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00480e90
push 0x603170
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 0x19
push eax
call fcn.0042dfbd
add esp, 0xc
mov esi, eax
push edi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x1a
call fcn.0042def1
push ecx
mov ecx, esp
push eax
push esi
push ecx
call fcn.0043910d
add esp, 0xc
lea ecx, [ebp - 0x7c]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043fb03
mov ecx, dword [ebp - 0x20]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00412ac4
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x18
call fcn.00412ac4
test esi, esi
je 0x4862e2
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x603178
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1b
push str.InstallerSuccessLaunchCmdLine
call fcn.00413f09
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0x7c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1c
call fcn.00411f3a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x18
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x4862ef
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x6031c0
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1d
push 0x6031d0
call fcn.00413f09
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0x7c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1e
call fcn.00411f3a
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x18
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x4862ef
inc edi
push 0
pop esi
cmp edi, dword [ebp - 0x30]
jl 0x4861c5
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, 0x6031cc
lea ecx, [ebp - 0x10]
push eax
push eax
call fcn.00435cda
mov ecx, eax
call fcn.00435bf5
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x48631d
push eax
call ebx
test eax, eax
je 0x48631d
or dword [edi], 8
lea ecx, [ebp - 0x7c]
call fcn.0042e60b
mov ecx, dword [ebp - 0x6c]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.00434a10
call fcn.00430f47
push esi
push ecx
mov ecx, esp
test eax, eax
je 0x486350
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
jmp 0x486355
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
call fcn.00413f09
mov esi, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x4c]
push esi
call fcn.0043fb03
test eax, eax
je 0x4863d4
lea ecx, [ebp - 0x10]
call fcn.004124d1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x603224
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1f
push 0x603374
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x20
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x4863d4
push eax
call ebx
test eax, eax
je 0x4863d4
or dword [edi], 8
mov ecx, dword [ebp + 0x10]
push 0
push 0x6033a8
call fcn.0042ea61
test eax, eax
js 0x4863f1
mov eax, dword [ebp + 0xc]
push 8
pop ecx
or dword [edi], ecx
mov dword [eax], ecx
call fcn.00430f47
push 0
push ecx
mov ecx, esp
test eax, eax
je 0x486406
push 0x603400
jmp 0x48640b
push str.SOFTWARESogouExplorer
call fcn.00413f09
push esi
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x4864e2
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x603448
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x21
push 0x603450
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x22
call fcn.00411f3a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x4864e2
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x603458
call fcn.00413f09
push ecx
mov esi, esp
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp + 8]
pop ecx
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.00434114
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x24
call fcn.00411f3a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x4864e2
push eax
call ebx
test eax, eax
je 0x4864e2
or dword [edi], 0x10
xor esi, esi
push esi
push ecx
mov ecx, esp
push 0x6034a4
call fcn.00413f09
push SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x4865c8
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x6034f0
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x25
push 0x603528
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x26
call fcn.00411f3a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
je 0x4865c8
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x6035cc
call fcn.00413f09
push ecx
mov esi, esp
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp + 8]
pop ecx
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.00434114
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x28
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
xor esi, esi
cmp dword [eax - 0xc], esi
je 0x4865c8
push eax
call ebx
test eax, eax
je 0x4865c8
or dword [edi], 0x10
mov ecx, dword [ebp + 0x10]
push esi
push str.sogouexplorer.exe
call fcn.0042ea61
test eax, eax
jns 0x4865ec
mov ecx, dword [ebp + 0x10]
push esi
push 0x60373c
call fcn.0042ea61
test eax, eax
js 0x4865f6
mov eax, dword [ebp + 0xc]
push 0x10
pop ecx
or dword [edi], ecx
mov dword [eax], ecx
call fcn.00430f47
push esi
push ecx
mov ecx, esp
test eax, eax
je 0x48660a
push str.SOFTWAREWow6432NodeMozillaMozilla_Firefox
jmp 0x48660f
push 0x603820
call fcn.00413f09
mov esi, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x4c]
push esi
call fcn.0043fb03
test eax, eax
je 0x486748
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x60386c
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x29
push 0x603874
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0x2a
cmp dword [eax - 0xc], 0
je 0x486726
call fcn.00430f47
test eax, eax
lea eax, [ebp + 8]
push 0
push eax
lea eax, [ebp - 0x20]
je 0x486699
push str.SOFTWAREWow6432NodeMozillaMozilla_Firefox_
push eax
call fcn.0042e01c
add esp, 8
mov byte [ebp - 4], 0x2b
mov ecx, esp
push 0x6038a8
jmp 0x4866b2
push str.SOFTWAREMozillaMozilla_Firefox_
push eax
call fcn.0042e01c
add esp, 8
mov byte [ebp - 4], 0x2c
mov ecx, esp
push str.Main
push eax
push ecx
call fcn.0042dfbd
add esp, 0xc
lea ecx, [ebp - 0x4c]
push esi
call fcn.0043fb03
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x14], eax
call fcn.00412ac4
cmp dword [ebp - 0x14], 0
je 0x486726
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x603984
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x2d
push str.PathToExe
call fcn.00413f09
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 0x2a
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x2e
call fcn.00411f3a
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x486739
push eax
call ebx
test eax, eax
je 0x486739
or dword [edi], 0x20
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp + 0x10]
push 0
push 0x6039d0
call fcn.0042ea61
test eax, eax
js 0x486765
mov eax, dword [ebp + 0xc]
push 0x20
pop ecx
or dword [edi], ecx
mov dword [eax], ecx
call fcn.00430f47
push 0
push ecx
mov ecx, esp
test eax, eax
je 0x48677a
push 0x6039f8
jmp 0x48677f
push 0x603a68
call fcn.00413f09
push esi
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x4867f1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x603af8
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x2f
push str.BrowserExe
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x30
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x4867f1
push eax
call ebx
test eax, eax
je 0x4867f1
or dword [edi], 0x40
mov ecx, dword [ebp + 0x10]
push 0
push str.safari.exe
call fcn.0042ea61
test eax, eax
js 0x48680e
mov eax, dword [ebp + 0xc]
push 0x40
pop ecx
or dword [edi], ecx
mov dword [eax], ecx
push 0
push ecx
mov ecx, esp
push str.SoftwareOpera_Software
call fcn.00413f09
push SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x4869a2
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x603bf4
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x31
push 0x603c08
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x32
call fcn.00411f3a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x4868e2
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x603c5c
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x33
push str.Last_Stable_Install_Path
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x34
call fcn.00411f3a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x4869a2
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x603ccc
call fcn.00413f09
push ecx
mov esi, esp
mov byte [ebp - 4], 0x35
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp + 8]
pop ecx
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.00434114
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x603ce8
mov byte [ebp - 4], 0x36
call fcn.00413f09
push ecx
mov esi, esp
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x20]
pop ecx
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x36
call fcn.00434114
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x38
call fcn.00411f3a
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x486988
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x48698e
or dword [edi], 0x80
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov esi, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp + 0x10]
push 0
push str.launcher.exe
call fcn.0042ea61
test eax, eax
jns 0x4869c8
mov ecx, dword [ebp + 0x10]
push 0
push str.opera.exe
call fcn.0042ea61
test eax, eax
js 0x4869d4
mov eax, dword [ebp + 0xc]
mov ecx, 0x80
or dword [edi], ecx
mov dword [eax], ecx
call fcn.00430f47
push 0
push ecx
mov ecx, esp
test eax, eax
je 0x4869e9
push 0x603ef8
jmp 0x4869ee
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall23F3F476_BE34_4f48_9C77_2806A8393EC4
call fcn.00413f09
push esi
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x486a63
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x6040d8
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x39
push 0x604110
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x3a
call fcn.00411f3a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x486a63
push eax
call ebx
test eax, eax
je 0x486a63
or dword [edi], 0x100
push 0
push ecx
mov ecx, esp
push 0x604178
call fcn.00413f09
push SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x486b42
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x60420c
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x3b
push 0x604234
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x3c
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 1
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.00434d0c
push 0x60426c
mov ecx, eax
mov byte [ebp - 4], 0x3d
call fcn.0042e677
mov ecx, dword [ebp - 0x20]
test eax, eax
mov byte [ebp - 4], 4
setne bl
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test bl, bl
je 0x486b17
push 0x604290
lea ecx, [ebp - 0x10]
call fcn.0042e473
push 0x6042ac
lea ecx, [ebp - 0x10]
call fcn.0042e473
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp dword [eax - 0xc], 0
je 0x486b48
push eax
call esi
test eax, eax
je 0x486b48
or dword [edi], 0x100
jmp 0x486b48
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp + 0x10]
push 0
push str.360se.exe
call fcn.0042ea61
test eax, eax
js 0x486b6a
mov eax, dword [ebp + 0xc]
or dword [edi], 0x100
mov dword [eax], 0x100
push 0
push ecx
mov ecx, esp
push str.Software360chromechrome
call fcn.00413f09
push SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x486c41
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x604358
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x3e
push str.last_install_path
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x3f
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 1
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.00434d0c
push 0x6043cc
mov ecx, eax
mov byte [ebp - 4], 0x40
call fcn.0042e677
mov ecx, dword [ebp - 0x20]
test eax, eax
mov byte [ebp - 4], 4
setne bl
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test bl, bl
je 0x486c1e
push 0x60447c
lea ecx, [ebp - 0x10]
call fcn.0042e473
push 0x6044e8
lea ecx, [ebp - 0x10]
call fcn.0042e473
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x486c41
push eax
call esi
test eax, eax
je 0x486c41
or dword [edi], 0x400
mov ecx, dword [ebp + 0x10]
push 0
push str.360chrome.exe
call fcn.0042ea61
mov ebx, dword [ebp + 0xc]
test eax, eax
js 0x486c63
or dword [edi], 0x400
mov dword [ebx], 0x400
call fcn.00430f47
push 0
push ecx
mov ecx, esp
test eax, eax
je 0x486c78
push str.SOFTWAREWow6432Nodeliebao
jmp 0x486c7d
push str.SOFTWAREliebao
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x486d73
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x6046d8
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x41
push str.Install_Path_Dir
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x42
call fcn.00411f3a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.00412ac4
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x60476c
call fcn.00413f09
push ecx
mov esi, esp
mov byte [ebp - 4], 0x43
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp + 8]
pop ecx
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.00434114
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x44
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push dword [ebp - 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
jne 0x486d5d
push 0x604864
push str.LBBrowser_
lea ecx, [ebp - 0x10]
call fcn.00434b1c
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x486d73
push eax
call esi
test eax, eax
je 0x486d73
or dword [edi], 0x200
mov ecx, dword [ebp + 0x10]
push 0
push str.liebao.exe
call fcn.0042ea61
test eax, eax
js 0x486d8f
mov eax, 0x200
or dword [edi], eax
mov dword [ebx], eax
push 0
push ecx
mov ecx, esp
push 0x604930
call fcn.00413f09
push SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x486e66
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x604980
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x45
push 0x60498c
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x46
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 1
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.00434d0c
push 0x604a64
mov ecx, eax
mov byte [ebp - 4], 0x47
call fcn.0042e677
mov ecx, dword [ebp - 0x20]
test eax, eax
mov byte [ebp - 4], 4
setne bl
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test bl, bl
je 0x486e43
push 0x604a74
lea ecx, [ebp - 0x10]
call fcn.0042e473
push 0x604a7c
lea ecx, [ebp - 0x10]
call fcn.0042e473
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x486e66
push eax
call esi
test eax, eax
je 0x486e66
or dword [edi], 0x800
mov ecx, dword [ebp + 0x10]
push 0
push str.hao123juzi.exe
call fcn.0042ea61
test eax, eax
js 0x486e88
mov eax, dword [ebp + 0xc]
or dword [edi], 0x800
mov dword [eax], 0x800
push 0
push ecx
mov ecx, esp
push str.SoftwareTencentQQBrowser
call fcn.00413f09
push SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x486f5f
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x604b68
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x48
push 0x604b78
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x49
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 1
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.00434d0c
push 0x604b8c
mov ecx, eax
mov byte [ebp - 4], 0x4a
call fcn.0042e677
mov ecx, dword [ebp - 0x20]
test eax, eax
mov byte [ebp - 4], 4
setne bl
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test bl, bl
je 0x486f3c
push 0x604b9c
lea ecx, [ebp - 0x10]
call fcn.0042e473
push str.QQBrowser.exe
lea ecx, [ebp - 0x10]
call fcn.0042e473
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x486f5f
push eax
call esi
test eax, eax
je 0x486f5f
or dword [edi], 0x1000
mov ecx, dword [ebp + 0x10]
push 0
push str.qqbrowser.exe
call fcn.0042ea61
test eax, eax
jns 0x486f85
mov ecx, dword [ebp + 0x10]
push 0
push 0x604c74
call fcn.0042ea61
test eax, eax
js 0x486f96
mov ebx, dword [ebp + 0xc]
or dword [edi], 0x1000
mov dword [ebx], 0x1000
jmp 0x486f99
mov ebx, dword [ebp + 0xc]
push 0
push ecx
mov ecx, esp
push str.SoftwareTheWorld6
call fcn.00413f09
push SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x487032
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x604ce0
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x4b
push 0x604d34
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x4c
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, 0x604d78
lea ecx, [ebp - 0x10]
push eax
push eax
call fcn.00435cda
mov ecx, eax
call fcn.00435bf5
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x487032
push eax
call esi
test eax, eax
je 0x487032
or dword [edi], 0x2000
mov ecx, dword [ebp + 0x10]
push 0
push str.theworld.exe
call fcn.0042ea61
test eax, eax
js 0x48704e
mov eax, 0x2000
or dword [edi], eax
mov dword [ebx], eax
call fcn.00430f47
push 0
push ecx
mov ecx, esp
test eax, eax
je 0x487063
push str.SOFTWAREWow6432Node2345Explorer
jmp 0x487068
push 0x604e04
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x487135
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x604ea0
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x4d
push 0x604ed0
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x4e
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 1
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.00434d0c
push 0x604f10
mov ecx, eax
mov byte [ebp - 4], 0x4f
call fcn.0042e677
mov ecx, dword [ebp - 0x20]
test eax, eax
mov byte [ebp - 4], 4
setne bl
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test bl, bl
je 0x487112
push 0x604f18
lea ecx, [ebp - 0x10]
call fcn.0042e473
push 0x604f20
lea ecx, [ebp - 0x10]
call fcn.0042e473
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x487135
push eax
call esi
test eax, eax
je 0x487135
or dword [edi], 0x4000
mov ecx, dword [ebp + 0x10]
push 0
push 0x604f54
call fcn.0042ea61
mov ebx, dword [ebp + 0xc]
test eax, eax
js 0x487157
or dword [edi], 0x4000
mov dword [ebx], 0x4000
push 0
push ecx
mov ecx, esp
push 0x604f9c
call fcn.00413f09
push SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x4871da
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x604fd8
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x50
push 0x604fe0
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x51
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x4871da
push eax
call esi
test eax, eax
je 0x4871da
or dword [edi], 0x8000
mov ecx, dword [ebp + 0x10]
push 0
push str.taobrowser.exe
call fcn.0042ea61
test eax, eax
js 0x4871f6
mov eax, 0x8000
or dword [edi], eax
mov dword [ebx], eax
push 0
push ecx
mov ecx, esp
push 0x605030
call fcn.00413f09
push SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x4872cd
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x6050a8
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x52
push 0x6050d4
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x53
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 1
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.00434d0c
push 0x605114
mov ecx, eax
mov byte [ebp - 4], 0x54
call fcn.0042e677
mov ecx, dword [ebp - 0x20]
test eax, eax
mov byte [ebp - 4], 4
setne bl
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test bl, bl
je 0x4872aa
push 0x60511c
lea ecx, [ebp - 0x10]
call fcn.0042e473
push str.avant.exe
lea ecx, [ebp - 0x10]
call fcn.0042e473
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x4872cd
push eax
call esi
test eax, eax
je 0x4872cd
or dword [edi], 0x10000
mov ecx, dword [ebp + 0x10]
push 0
push 0x605178
call fcn.0042ea61
test eax, eax
js 0x4872ef
mov eax, dword [ebp + 0xc]
or dword [edi], 0x10000
mov dword [eax], 0x10000
call fcn.00430f47
push 0
push ecx
mov ecx, esp
test eax, eax
je 0x487304
push 0x6051a8
jmp 0x487309
push str.SOFTWAREBaiduBaiduBrowser
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x487499
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x605284
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x55
push str.installDir
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x56
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x487499
push 1
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.00434d0c
push 0x6053c0
mov ecx, eax
mov byte [ebp - 4], 0x57
call fcn.0042e677
mov ecx, dword [ebp + 8]
test eax, eax
mov byte [ebp - 4], 4
setne bl
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test bl, bl
je 0x4873c0
push 0x6053d0
lea ecx, [ebp - 0x10]
call fcn.0042e473
push 0x605400
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0042dfbd
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp + 8]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00412ac4
test esi, esi
je 0x4873f5
or dword [edi], 0x20000
jmp 0x487493
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x605428
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x58
push 0x605434
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0x59
cmp dword [eax - 0xc], 0
je 0x487484
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0043910d
push 0x605470
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 0x5a
push eax
call fcn.0042dfbd
add esp, 0x18
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 0x20]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00412ac4
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00412ac4
test esi, esi
je 0x487484
or dword [edi], 0x20000
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp + 0x10]
push 0
push str.baidubrowser.exe
call fcn.0042ea61
test eax, eax
js 0x4874bb
mov eax, dword [ebp + 0xc]
or dword [edi], 0x20000
mov dword [eax], 0x20000
push 0
push ecx
mov ecx, esp
push str.SOFTWARERuanMeiQiyu
call fcn.00413f09
push SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x487592
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x605504
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x5b
push 0x605514
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x5c
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 1
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.00434d0c
push 0x605560
mov ecx, eax
mov byte [ebp - 4], 0x5d
call fcn.0042e677
mov ecx, dword [ebp - 0x20]
test eax, eax
mov byte [ebp - 4], 4
setne bl
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test bl, bl
je 0x48756f
push 0x605570
lea ecx, [ebp - 0x10]
call fcn.0042e473
push 0x605578
lea ecx, [ebp - 0x10]
call fcn.0042e473
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x487592
push eax
call esi
test eax, eax
je 0x487592
or dword [edi], 0x80000
mov ecx, dword [ebp + 0x10]
push 0
push 0x605598
call fcn.0042ea61
test eax, eax
js 0x4875b4
mov eax, dword [ebp + 0xc]
or dword [edi], 0x80000
mov dword [eax], 0x80000
call fcn.00430f47
push 0
push ecx
mov ecx, esp
test eax, eax
je 0x4875c9
push str.SOFTWAREWow6432Node2345chrome
jmp 0x4875ce
push str.SOFTWARE2345chrome
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x48769b
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x605638
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x5e
push 0x605640
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x5f
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 1
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.00434d0c
push 0x605670
mov ecx, eax
mov byte [ebp - 4], 0x60
call fcn.0042e677
mov ecx, dword [ebp - 0x20]
test eax, eax
mov byte [ebp - 4], 4
setne bl
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test bl, bl
je 0x487678
push 0x60567c
lea ecx, [ebp - 0x10]
call fcn.0042e473
push 0x605684
lea ecx, [ebp - 0x10]
call fcn.0042e473
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x48769b
push eax
call esi
test eax, eax
je 0x48769b
or dword [edi], 0x100000
mov ecx, dword [ebp + 0x10]
push 0
push 0x605758
call fcn.0042ea61
test eax, eax
js 0x4876bd
mov eax, dword [ebp + 0xc]
or dword [edi], 0x100000
mov dword [eax], 0x100000
push 0
push ecx
mov ecx, esp
push 0x6057b0
call fcn.00413f09
push SysReAllocString
lea ecx, [ebp - 0x4c]
call fcn.0043fb03
test eax, eax
je 0x487794
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x605840
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x61
push str.Path
call fcn.00413f09
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00434880
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x62
call fcn.00411f3a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 1
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.00434d0c
push 0x605904
mov ecx, eax
mov byte [ebp - 4], 0x63
call fcn.0042e677
mov ecx, dword [ebp - 0x20]
test eax, eax
mov byte [ebp - 4], 4
setne bl
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test bl, bl
je 0x487771
push 0x605924
lea ecx, [ebp - 0x10]
call fcn.0042e473
push 0x605934
lea ecx, [ebp - 0x10]
call fcn.0042e473
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x487794
push eax
call esi
test eax, eax
je 0x487794
or dword [edi], 0x200000
mov ecx, dword [ebp + 0x10]
push 0
push str.ucbrowser.exe
call fcn.0042ea61
test eax, eax
js 0x4877b6
mov eax, dword [ebp + 0xc]
or dword [edi], 0x200000
mov dword [eax], 0x200000
call fcn.004806fe
mov ecx, dword [ebp - 0x10]
or dword [edi], eax
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x4c]
call fcn.0042e60b
mov ecx, dword [ebp - 0x3c]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x64]
call fcn.0042e60b
mov ecx, dword [ebp - 0x54]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
call fcn.00506d90
ret