Function at 0x4de970
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f48d7
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x198
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x15c], edi
push 1
push str.Registry_Seeker
call fcn.0045f680
mov ecx, edi
mov dword [ebp - 0x164], eax
call fcn.0043e530
test al, al
je 0x4dfe56
push 1
push str.https:__www.carifred.com_uvk_help_registry_seeker.php
lea ecx, [edi + 0x119c]
call fcn.005dc260
mov esi, dword [edi + 0x14e4]
mov ecx, esi
push 0
mov dword [ebp - 0x150], esi
call fcn.005c44a0
push 0xffffffffffffffff
push 0x5e
push 0x87
push 0xb
push 0x64
push 0x75
mov ecx, edi
call fcn.0043ccb0
movsd xmm1, qword [0x6edb20]
mov ecx, esi
push 0
push str.Arial
push 1
push 0x320
call fcn.005c42b0
push 0x37
push 0x50
push 3
push 0xa
mov ecx, edi
call fcn.0045fec0
push 0xffffffffffffffff
push 0x10000001
push 0x2d
push 0x5a
push 0x3c
push 5
push str.Registry_Seeker
mov ecx, esi
call fcn.005c0890
push dword [edi + 0x1438]
mov ecx, esi
push 0xffffffffffffffff
call fcn.005bec70
movsd xmm1, qword [0x6edaf8]
mov ecx, esi
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
push 0x10000001
push 0xf
push 0x7d
push 0x14
push 0x69
push str.Removal_options:
mov ecx, esi
call fcn.005c0890
push dword [edi + 0x1438]
mov ecx, esi
push 0xffffffffffffffff
call fcn.005bec70
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Backup_the_registry_entries_before_removal.
push 1
push ecx
push 0x6e
push 0x32
push 0x6e
push str._Create_backup
mov ecx, edi
call fcn.0045fc60
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
mov dword [ebp - 0x1a4], eax
push 0
push str.If_unsuccessful_removal__grant_access_and_try_again.
push 0
push ecx
push 0x6e
push 0x4b
push 0x6e
push str._Force_removal
mov ecx, edi
call fcn.0045fc60
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Start_new_scan._Youll_be_prompted_to_choose_the_root_key_s__for_the_scan
push 0x5f
push 0x50
push 0xa
push 0xf0
push 0x99
push str.Start_scan
mov dword [ebp - 0x1a8], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Show_information_about_the_selected_registry_entry
push 0x5f
push 0x50
push 0xa
push 0x145
push 0x8b
push str.Entry_properties
mov dword [ebp - 0x194], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Delete_the_selected_registry_keys_values.
push 0x5f
push 0x50
push 0xa
push 0x19a
push 0x72
push str.Delete_selected
mov dword [ebp - 0x158], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Perform_common_actions_on_the_Registry_seeker_backups__such_as__r_nrestore_previously_deleted_registry_entries__or_permanently_delete_them.
push 0x5f
push 0x50
push 0xa
push 0x1ef
push 0x98
push str.Manage_backups
mov dword [ebp - 0x1a0], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Show_online_help__F1_
push 0x5f
push 0x50
push 0xa
push 0x244
push 0x7d
push str.Help
mov dword [ebp - 0x198], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
push str.Go_back_to_the_Home_page__Esc_
push 0x5f
mov dword [edi + 0x11bc], eax
push 0x50
push 0xa
push 0x299
push 0xb3
push str.Home
mov ecx, edi
call fcn.0045fdf0
push 0
push 0x10800080
push 0x19
push 0xb9
push 0x23
push 0x2f3
push str.Find_an_entry...
mov ecx, esi
mov dword [edi + 0x11c0], eax
call fcn.005c0a40
push 0x7f7f7f
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x144], eax
call fcn.005bec70
movsd xmm0, qword [0x6edb08]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push 0
push ecx
push 0x190
push 0xffffffffffffffff
mov ecx, esi
call fcn.005beb10
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.List_menu
push 0x28
push 0x5a
push 0x41
push 0x2f3
push 0x86
push str.List_menu
call fcn.0045fd50
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Find_next__F3_
push 0x28
push 0x5a
push 0x41
push 0x352
push 0x99
push str.Find_next
mov dword [ebp - 0x178], eax
call fcn.0045fd50
movsd xmm1, qword [0x6edaf8]
mov ecx, esi
push 0
push str.Arial
push 1
push 0x190
mov dword [ebp - 0x17c], eax
call fcn.005c42b0
push 0x433
mov ecx, esi
call fcn.005c4340
push 0x10025
push 0x1000000d
push 0x1b3
push 0x2ee
push 0x73
push 0
push 0x62794c
push str._____Key_path_Value_name_Size_Type_Data
call fcn.005c0620
push 0
push str.Tick_the_check_marks_next_to_the_items_you_want_to_remove.
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x134], eax
call fcn.0045b370
push dword [ebp - 0x134]
mov ecx, esi
call fcn.005c5730
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x148], eax
push ecx
push eax
push str.Registry_seeker
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x28], 0x12c
mov dword [ebp - 0x24], 0xaa
mov dword [ebp - 0x20], 0x5a
mov dword [ebp - 0x1c], 0x64
mov dword [ebp - 0x18], 0x258
call fcn.0045b1e0
push 1
push dword [ebp - 0x134]
mov ecx, esi
call fcn.005bb910
push 0x48
call dword [sym.imp.USER32.dll_GetSystemMetrics]
movsd xmm0, qword [0x6edab8]
mov ecx, eax
comisd xmm0, xmmword [edi + 8]
mov dword [ebp - 0x14c], ecx
jb 0x4dedd2
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [ebp - 0x14c]
or eax, 0xff000000
jmp 0x4dedd4
xor eax, eax
push eax
push ecx
push ecx
push 0x8b
mov ecx, edi
mov dword [ebp - 0x13c], eax
call fcn.00436420
push eax
lea ecx, [ebp - 0x120]
call fcn.005c6520
mov dword [ebp - 4], 0
mov ecx, esi
push dword [ebp - 0x120]
push str.Entry_properties_tCtrlEnter
push dword [ebp - 0x134]
call fcn.005c1450
push 0
push eax
push eax
mov ecx, esi
mov dword [ebp - 0x174], eax
call fcn.005c56e0
push eax
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
push dword [ebp - 0x13c]
mov eax, dword [ebp - 0x14c]
mov ecx, edi
push eax
push eax
push 0x72
call fcn.00436420
push eax
lea ecx, [ebp - 0x130]
call fcn.005c6520
push 0
mov byte [ebp - 4], 1
mov ecx, esi
push dword [ebp - 0x130]
push 0
push 0x32
push str.Delete_the_selected_entries_tDel
push dword [ebp - 0x134]
call fcn.005c0400
push 0
push 0
push 8
push 0x32
push 0
push dword [ebp - 0x134]
mov ecx, esi
mov dword [ebp - 0x18c], eax
call fcn.005c0400
push dword [ebp - 0x13c]
mov eax, dword [ebp - 0x14c]
mov ecx, edi
push eax
push eax
push 0x7c
call fcn.00436420
push eax
lea ecx, [ebp - 0x124]
call fcn.005c6520
push 0
mov byte [ebp - 4], 2
mov ecx, esi
push dword [ebp - 0x124]
push 0
push 0x32
push str.Google_key_path_tCtrlG
push dword [ebp - 0x134]
call fcn.005c0400
push dword [ebp - 0x13c]
mov dword [ebp - 0x180], eax
mov ecx, edi
mov eax, dword [ebp - 0x14c]
push eax
push eax
push 0xac
call fcn.00436420
push eax
lea ecx, [ebp - 0x12c]
call fcn.005c6520
push 0
mov byte [ebp - 4], 3
mov ecx, esi
push dword [ebp - 0x12c]
push 0
push 0x32
push str.Open_entry_location_tCtrlO
push dword [ebp - 0x134]
call fcn.005c0400
push 0
push 0
push 8
push 0x32
push 0
push dword [ebp - 0x134]
mov ecx, esi
mov dword [ebp - 0x160], eax
call fcn.005c0400
push dword [ebp - 0x13c]
mov eax, dword [ebp - 0x14c]
mov ecx, edi
push eax
push eax
push 0x99
call fcn.00436420
push eax
lea ecx, [ebp - 0x128]
call fcn.005c6520
push 0
mov byte [ebp - 4], 4
mov ecx, esi
push dword [ebp - 0x128]
push 0
push 0x32
push str.New_scan_tF5
push dword [ebp - 0x134]
call fcn.005c0400
push 0
push 0
push 8
push 0x32
push 0
push dword [ebp - 0x134]
mov ecx, esi
mov dword [ebp - 0x190], eax
call fcn.005c0400
push 0
push dword [ebp - 0x120]
mov ecx, esi
push 0
push 0x32
push str.Select_all_tCtrlA
push dword [ebp - 0x134]
call fcn.005c0400
push 0
push dword [edi + 0xe8]
mov ecx, esi
mov dword [ebp - 0x16c], eax
push 0
push 0x32
push str.Select_none_tCtrtN
push dword [ebp - 0x134]
call fcn.005c0400
push 0
push 0
push 8
push 0x32
push 0
push dword [ebp - 0x134]
mov ecx, esi
mov dword [ebp - 0x184], eax
call fcn.005c0400
push 0
push dword [edi + 0xe4]
push 0
push 0x32
push str.Select_all_in_this_group_tAltA
push dword [ebp - 0x134]
mov ecx, esi
call fcn.005c0400
push 0
push dword [edi + 0xe8]
mov ecx, esi
mov dword [ebp - 0x14c], eax
push 0
push 0x32
push str.Select_none_in_this_group_tAltN
push dword [ebp - 0x134]
call fcn.005c0400
push 0
push 0
push 8
push 0x32
push 0
push dword [ebp - 0x134]
mov ecx, esi
mov dword [ebp - 0x170], eax
call fcn.005c0400
push 0
mov ecx, edi
call fcn.0045f170
mov edx, eax
movzx ecx, word [edi + 0x11bc]
mov eax, 0x70
mov word [ebp - 0x7c], cx
mov word [ebp - 0x7e], ax
mov eax, 0x1b
mov word [ebp - 0x78], ax
mov eax, 0x72
mov word [ebp - 0x72], ax
mov eax, dword [ebp - 0x17c]
mov word [ebp - 0x70], ax
mov eax, 0xd
movzx ecx, word [edi + 0x11c0]
mov edi, 0x41
mov word [ebp - 0x6c], ax
mov eax, dword [ebp - 0x174]
mov word [ebp - 0x6a], ax
mov eax, 0x2e
mov word [ebp - 0x66], ax
mov eax, dword [ebp - 0x18c]
mov word [ebp - 0x64], ax
mov eax, 0x47
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0x180]
mov word [ebp - 0x5e], ax
mov eax, 0x4f
mov word [ebp - 0x5a], ax
mov eax, dword [ebp - 0x160]
mov word [ebp - 0x58], ax
mov eax, 0x74
mov word [ebp - 0x54], ax
mov eax, dword [ebp - 0x190]
mov word [ebp - 0x52], ax
mov eax, dword [ebp - 0x16c]
mov word [ebp - 0x4c], ax
mov eax, dword [ebp - 0x184]
mov word [ebp - 0x76], cx
mov ecx, 0x4e
mov word [ebp - 0x46], ax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x19c], edx
mov byte [ebp - 0x80], 1
mov byte [ebp - 0x7a], 1
mov byte [ebp - 0x74], 1
mov byte [ebp - 0x6e], 9
mov byte [ebp - 0x68], 1
mov byte [ebp - 0x62], 9
mov byte [ebp - 0x5c], 9
mov byte [ebp - 0x56], 1
mov byte [ebp - 0x50], 9
mov word [ebp - 0x4e], di
mov byte [ebp - 0x4a], 9
mov word [ebp - 0x48], cx
mov byte [ebp - 0x44], 0x11
mov word [ebp - 0x42], di
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x170]
mov word [ebp - 0x3a], ax
mov eax, 0x46
mov word [ebp - 0x36], ax
lea eax, [ebp - 0x80]
push 0xd
mov word [ebp - 0x3c], cx
mov ecx, esi
push eax
mov byte [ebp - 0x3e], 0x11
mov byte [ebp - 0x38], 9
mov word [ebp - 0x34], dx
call fcn.005c47a0
push 5
push 2
push 0x21
push 0x10
push 0x10
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov ecx, dword [ebp - 0x15c]
mov edi, eax
push 0
push 0x10
push 0x10
push 0x8f
call fcn.00436420
push eax
lea ecx, [ebp - 0x11c]
call fcn.005c6520
push 0
mov byte [ebp - 4], 5
push dword [ebp - 0x11c]
mov esi, dword [sym.imp.COMCTL32.dll_ImageList_Add]
push edi
call esi
mov ecx, dword [ebp - 0x15c]
push 0
push 0x10
push 0x10
push 0x91
call fcn.00436420
push eax
lea ecx, [ebp - 0x11c]
call fcn.005c6480
push 0
push dword [ebp - 0x11c]
push edi
call esi
push edi
push 1
push 0x1003
push dword [ebp - 0x148]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
lea ecx, [ebp - 0x11c]
call fcn.005c64e0
mov esi, dword [ebp - 0x150]
mov ecx, esi
push 1
push dword [ebp - 0x134]
call fcn.005ba360
mov edi, dword [ebp - 0x15c]
mov ecx, edi
push 0
push str.Registry_seeker
call fcn.0045f4d0
mov ecx, edi
call fcn.0045f300
push str.Registry_Seeker
lea ecx, [edi + 0x1448]
call fcn.005dc510
push dword [ebp - 0x148]
call dword [sym.imp.USER32.dll_SetFocus]
push 1
lea ecx, [ebp - 0x118]
mov byte [ebp - 0x135], 0
mov byte [ebp - 0x13d], 0
call fcn.005d0610
xorps xmm0, xmm0
lea ecx, [ebp - 0x98]
movq qword [ebp - 0x98], xmm0
mov dword [ebp - 0x90], 0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x9c], 0
lea ecx, [ebp - 0xa4]
movq qword [ebp - 0xa4], xmm0
call fcn.005dc5e0
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x188], 0xffffffff
mov dword [ebp - 0x84], 0
call fcn.005d6aa0
push dword [ebp - 0x17c]
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.005c4370
mov eax, dword [ebp - 0x158]
mov ecx, edi
push eax
push eax
push dword [ebp - 0x134]
call fcn.0046af40
push 0
mov ecx, edi
call fcn.004771c0
test eax, eax
je 0x4dfdcf
mov eax, dword [edi + 0x14a8]
cmp eax, 0xfffffffa
je 0x4dfdcf
cmp dword [edi + 0x14d8], esi
jne 0x4dfdbe
cmp eax, dword [ebp - 0x194]
je 0x4dfda5
cmp eax, dword [ebp - 0x190]
je 0x4dfda5
cmp eax, dword [ebp - 0x198]
jne 0x4df377
mov ecx, edi
call fcn.004dc520
jmp 0x4dfdb2
cmp eax, dword [edi + 0x11c0]
je 0x4dfe74
mov edx, dword [ebp - 0x144]
cmp eax, 0xffffffb3
jne 0x4df396
cmp dword [edi + 0x14b4], edx
je 0x4df3a2
cmp eax, dword [ebp - 0x19c]
jne 0x4df437
mov ecx, edi
call fcn.0046c220
push dword [ebp - 0x144]
mov ecx, esi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x98]
call fcn.005dc1c0
push 0x80
push dword [ebp - 0x144]
mov ecx, esi
call fcn.005bd3f0
push str.Find_an_entry...
lea ecx, [ebp - 0x98]
call fcn.005dc4c0
test al, al
je 0x4dfdbe
push 0
push 0
push dword [ebp - 0x144]
mov ecx, esi
call fcn.005bcd30
push 0
push dword [ebp - 0x144]
mov ecx, esi
call fcn.005bec70
movsd xmm0, qword [0x6edb20]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push 0
push ecx
push 0x190
push dword [ebp - 0x144]
mov ecx, esi
call fcn.005beb10
jmp 0x4dfdbe
cmp eax, 0xffffffb4
jne 0x4df48f
cmp dword [edi + 0x14b4], edx
jne 0x4df48f
push edx
mov ecx, esi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x98]
call fcn.005dc1c0
lea ecx, [ebp - 0x98]
call fcn.005dc3a0
cmp eax, 3
jl 0x4dfdbe
push 0xffffffffffffffff
push 6
push 0xffffffffffffffff
lea ecx, [ebp - 0x98]
call fcn.005dc190
mov ecx, dword [ebp - 0x148]
mov edx, eax
call fcn.005c9ea0
jmp 0x4dfdbe
mov ecx, eax
mov dword [ebp - 0x154], ecx
cmp ecx, dword [ebp - 0x17c]
jne 0x4df57a
push edx
mov ecx, esi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x98]
call fcn.005dc1c0
push str.Find_an_entry...
lea ecx, [ebp - 0x98]
call fcn.005dc4c0
test al, al
jne 0x4df4da
lea ecx, [ebp - 0x98]
call fcn.005dbeb0
test al, al
je 0x4df532
push 0
push 0
push dword [ebp - 0x144]
mov ecx, esi
call fcn.005bcd30
push 0
push dword [ebp - 0x144]
mov ecx, esi
call fcn.005bec70
movsd xmm0, qword [0x6edb20]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push 0
push ecx
push 0x190
push dword [ebp - 0x144]
mov ecx, esi
call fcn.005beb10
push 0x80
push dword [ebp - 0x144]
mov ecx, esi
call fcn.005bd3f0
push dword [ebp - 0x188]
lea ecx, [ebp - 0x98]
push 0x1e
push 0xffffffffffffffff
call fcn.005dc190
mov ecx, dword [ebp - 0x148]
mov edx, eax
call fcn.005c9ea0
mov dword [ebp - 0x188], eax
cmp eax, 0xffffffff
je 0x4dfdbe
push 0x80
push dword [ebp - 0x134]
mov ecx, esi
call fcn.005bd3f0
jmp 0x4dfdbe
cmp byte [ebp - 0x135], 1
jne 0x4df5a2
cmp ecx, 0xffffff31
jne 0x4df5a2
lea ecx, [ebp - 0x118]
call fcn.005d05f0
mov byte [ebp - 0x135], 2
jmp 0x4dfdbe
mov eax, dword [ebp - 0x134]
cmp ecx, 0xffffffea
jne 0x4df5b5
cmp dword [edi + 0x14b4], eax
je 0x4df5c1
cmp ecx, dword [ebp - 0x178]
jne 0x4df6f7
cmp ecx, dword [ebp - 0x178]
jne 0x4df60d
push dword [ebp - 0x148]
call dword [sym.imp.USER32.dll_SetFocus]
cmp byte [ebp - 0x135], 2
jne 0x4df606
xorps xmm1, xmm1
lea ecx, [ebp - 0x118]
call fcn.005d05a0
movsd xmm1, qword [0x6edb98]
comisd xmm1, xmm0
jbe 0x4df606
mov byte [ebp - 0x135], 0
jmp 0x4dfdbe
mov byte [ebp - 0x135], 1
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ebp - 0x148]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
mov ecx, 0x20
mov eax, 0x40
cmove ecx, eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x13c], ecx
cmp eax, dword [ebp - 0x160]
jg 0x4df666
mov edi, eax
push ecx
push edi
mov ecx, esi
call fcn.005bd3f0
mov ecx, dword [ebp - 0x13c]
inc edi
cmp edi, dword [ebp - 0x160]
jle 0x4df648
mov edi, dword [ebp - 0x15c]
push ecx
push dword [ebp - 0x14c]
mov ecx, esi
call fcn.005bd3f0
push dword [ebp - 0x13c]
mov ecx, esi
push dword [ebp - 0x170]
call fcn.005bd3f0
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x154], eax
jne 0x4df6db
lea ecx, [ebp - 0xfc]
push ecx
push eax
mov ecx, esi
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x4df6db
mov eax, dword [ebp - 0xf8]
mov ecx, 8
mov edx, dword [ebp - 0xfc]
add eax, 0x2d
push eax
add edx, 0x5a
push edx
push ecx
push dword [ebp - 0x134]
mov ecx, esi
call fcn.005bbfd0
jmp 0x4dfdbe
or edx, 0xffffffff
xor ecx, ecx
or eax, edx
push eax
push edx
push ecx
push dword [ebp - 0x134]
mov ecx, esi
call fcn.005bbfd0
jmp 0x4dfdbe
cmp ecx, 0xffffffd3
je 0x4df701
cmp ecx, 0xffffffd2
jne 0x4df71e
cmp dword [edi + 0x14b4], eax
jne 0x4df71e
mov ecx, dword [ebp - 0x158]
push ecx
push ecx
push eax
mov ecx, edi
call fcn.0046af40
jmp 0x4dfdbe
cmp ecx, 0xfffffff2
jne 0x4df72b
cmp dword [edi + 0x14b4], eax
je 0x4df733
cmp ecx, dword [ebp - 0x174]
jne 0x4df790
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0xd0]
push eax
push dword [ebp - 0x158]
movups xmmword [ebp - 0xd0], xmm0
push esi
movups xmmword [ebp - 0xc0], xmm0
call fcn.005b8800
push dword [ebp - 0x134]
mov ecx, edi
mov byte [ebp - 4], 9
call fcn.004dcda0
push dword [ebp - 0x164]
call dword [sym.imp.USER32.dll_BringWindowToTop]
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 8
call fcn.005b8790
jmp 0x4dfdbe
cmp ecx, dword [ebp - 0x1a0]
je 0x4df9ee
cmp ecx, dword [ebp - 0x18c]
je 0x4df9ee
cmp ecx, dword [ebp - 0x180]
jne 0x4df7f7
push 2
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.005bb4c0
cmp eax, 0xffffffff
je 0x4dfdbe
push 0
push 0
push eax
push dword [ebp - 0x134]
mov ecx, esi
call fcn.005bb510
push eax
lea ecx, [ebp - 0x98]
call fcn.005dc1c0
mov ecx, eax
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0045ee00
jmp 0x4dfdbe
cmp ecx, dword [ebp - 0x16c]
je 0x4df9af
cmp ecx, dword [ebp - 0x184]
je 0x4df9af
cmp ecx, dword [ebp - 0x14c]
je 0x4df8cf
cmp ecx, dword [ebp - 0x170]
je 0x4df8cf
mov ecx, dword [ebp - 0x160]
cmp dword [edi + 0x14a8], ecx
jne 0x4dfdbe
push 2
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.005bb4c0
mov dword [ebp - 0x150], eax
cmp eax, 0xffffffff
je 0x4dfdbe
push 1
push eax
push dword [ebp - 0x134]
mov ecx, esi
call fcn.005bb510
push eax
lea ecx, [ebp - 0xa4]
call fcn.005dc1c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xa4]
call fcn.005dc190
push eax
push 0x62bd28
push 0
push dword [ebp - 0x150]
mov ecx, esi
push dword [ebp - 0x134]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x98]
call fcn.005dc1c0
mov ecx, eax
call fcn.005da780
mov ecx, eax
call fcn.005dc190
push eax
call fcn.0043bf00
jmp 0x4dfdbe
push 2
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.005bb4c0
cmp eax, 0xffffffff
je 0x4dfdbe
push eax
push dword [ebp - 0x134]
mov ecx, esi
call fcn.005bb5c0
push 0
push 0
push 0x1004
push dword [ebp - 0x148]
mov dword [ebp - 0x150], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
mov eax, dword [edi + 0x14a8]
mov dword [ebp - 0x154], eax
xor eax, eax
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x13c], eax
test ecx, ecx
jle 0x4dfdbe
mov edi, dword [ebp - 0x134]
push eax
push edi
mov ecx, esi
call fcn.005bb5c0
cmp eax, dword [ebp - 0x150]
jne 0x4df98f
mov ecx, dword [ebp - 0x14c]
mov eax, 0x1000
cmp dword [ebp - 0x154], ecx
mov ecx, 0x2000
mov dword [ebp - 0xdc], 0xf000
cmove eax, ecx
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0xec]
push eax
push dword [ebp - 0x13c]
push 0x102b
push dword [ebp - 0x148]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp eax, dword [ebp - 0x168]
jl 0x4df937
mov edi, dword [ebp - 0x15c]
jmp 0x4dfdbe
push 0
push 0
push 0x1004
push dword [ebp - 0x148]
call dword [sym.imp.USER32.dll_SendMessageW]
push ecx
dec eax
mov ecx, esi
push eax
mov eax, dword [ebp - 0x16c]
cmp dword [edi + 0x14a8], eax
push 0
sete al
movzx eax, al
push eax
push dword [ebp - 0x134]
call fcn.005bba40
jmp 0x4dfdbe
push 0xd
push dword [edi + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0xd0]
push eax
push dword [ebp - 0x158]
movups xmmword [ebp - 0xd0], xmm0
push esi
movups xmmword [ebp - 0xc0], xmm0
call fcn.005b8800
push dword [ebp - 0x134]
xorps xmm0, xmm0
mov byte [ebp - 4], 0xa
mov ecx, esi
movlpd qword [ebp - 0x8c], xmm0
call fcn.005bb7f0
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], 0
sub esp, 8
mov byte [ebp - 4], 0xb
cmp dword [eax], 0
mov ecx, edi
push 0x8c
push 0x190
push 0
push esi
jne 0x4dfa72
push 4
push str.There_are_no_items_selected._r_n_r_nTo_select_one_or_several_items__tick_the_respective_checkbox.
call fcn.0043e2e0
jmp 0x4dfd86
push 1
push str.Are_you_sure_you_want_to_delete_the_selected_registry_entries__r_n_r_nNote:_Deleting_registry_entries_can_cause_severe_damage_to_your_operating_system_
call fcn.0043e2e0
test eax, eax
je 0x4dfd86
xorps xmm0, xmm0
mov dword [ebp - 0x150], 0
lea ecx, [ebp - 0xb0]
movq qword [ebp - 0xb0], xmm0
mov dword [ebp - 0xa8], 0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.005dc5e0
push 4
push dword [ebp - 0x1a8]
mov ecx, esi
mov byte [ebp - 4], 0xd
call fcn.005bc500
push 4
push dword [ebp - 0x1a4]
mov ecx, esi
mov dword [ebp - 0x154], eax
call fcn.005bc500
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x168], eax
mov eax, dword [ecx]
mov dword [ebp - 0x13c], eax
test eax, eax
jle 0x4dfcf0
nop dword [eax + eax]
push 0
push dword [ecx + eax*4]
mov ecx, esi
push dword [ebp - 0x134]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xb0]
call fcn.005dc1c0
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x8c]
push 1
push dword [ecx + eax*4]
mov ecx, esi
push dword [ebp - 0x134]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xa4]
call fcn.005dc1c0
cmp dword [ebp - 0x168], 0
je 0x4dfbfa
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc4e0
push str._Default_
lea ecx, [ebp - 0xa4]
call fcn.005dc4c0
test al, al
je 0x4dfba0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
jmp 0x4dfbcf
lea ecx, [ebp - 0xa4]
call fcn.005dc3a0
test eax, eax
je 0x4dfbdc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xa4]
call fcn.005dc190
push eax
push 0x62bd28
lea ecx, [ebp - 0x20]
call fcn.005da780
push 0
lea ecx, [ebp - 0xa4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043c8f0
lea ecx, [ebp - 0xa4]
call fcn.005dbeb0
test al, al
je 0x4dfc40
cmp dword [ebp - 0x154], 0
lea ecx, [ebp - 0xb0]
je 0x4dfc2d
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x84]
call fcn.005d55d0
jmp 0x4dfc92
call fcn.005dc190
push eax
lea ecx, [ebp - 0x84]
call fcn.005d5740
jmp 0x4dfc92
push str._Default_
lea ecx, [ebp - 0xa4]
call fcn.005dc4c0
test al, al
je 0x4dfc5f
lea ecx, [ebp - 0xa4]
call fcn.005dc400
lea ecx, [ebp - 0xa4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xb0]
call fcn.005dc190
cmp dword [ebp - 0x154], 0
lea ecx, [ebp - 0x84]
push eax
je 0x4dfc8d
call fcn.005d55d0
jmp 0x4dfc92
call fcn.005d5da0
mov byte [ebp - 0x136], al
test al, al
je 0x4dfcba
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x8c]
push 0
push dword [ecx + eax*4]
mov ecx, esi
push dword [ebp - 0x134]
call fcn.005bb970
mov edx, dword [ebp - 0x150]
xor eax, eax
cmp byte [ebp - 0x136], al
mov ecx, dword [ebp - 0x8c]
setne al
add edx, eax
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x13c], eax
test eax, eax
jg 0x4dfb10
jmp 0x4dfcf2
xor edx, edx
sub esp, 8
push 0x8c
push 0x190
push 0
push esi
push 4
cmp edx, dword [ecx]
jne 0x4dfd0f
push str.Operation_complete._All_selected_items_were_successfully_deleted.
jmp 0x4dfd57
push 0
push 0
push 0
push 0
push 0
push 0
push 0
xor ecx, ecx
mov eax, str._You_can_tick__Force_removal__and_try_again.
cmp dword [ebp - 0x154], ecx
push 0
push 0
cmovne eax, ecx
lea ecx, [ebp - 0x98]
push eax
push str.The_remaining_checked_items_could_not_be_deleted.
push str._items_were_successfully_deleted._r_n_r_n
push edx
call fcn.005db320
mov ecx, eax
call fcn.005da780
mov ecx, eax
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043e2e0
mov eax, dword [ebp - 0x158]
mov ecx, edi
push eax
push eax
push dword [ebp - 0x134]
call fcn.0046af40
lea ecx, [ebp - 0x20]
call fcn.005dc430
lea ecx, [ebp - 0xb0]
call fcn.005dc430
push dword [ebp - 0x8c]
call fcn.0041e1c3
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xd0]
call fcn.005b8790
jmp 0x4dfdbe
push dword [ebp - 0x134]
mov ecx, edi
call fcn.004dd9d0
push dword [ebp - 0x164]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 0
mov ecx, edi
call fcn.004771c0
test eax, eax
jne 0x4df330
push dword [ebp - 0x148]
push str.Registry_seeker
call fcn.0045b060
push 0
push str.Registry_seeker
mov ecx, edi
call fcn.0045f380
lea ecx, [ebp - 0x84]
call fcn.005d69e0
lea ecx, [ebp - 0xa4]
call fcn.005dc430
lea ecx, [ebp - 0x98]
call fcn.005dc430
lea ecx, [ebp - 0x11c]
call fcn.005c6500
lea ecx, [ebp - 0x128]
call fcn.005c6500
lea ecx, [ebp - 0x12c]
call fcn.005c6500
lea ecx, [ebp - 0x124]
call fcn.005c6500
lea ecx, [ebp - 0x130]
call fcn.005c6500
lea ecx, [ebp - 0x120]
call fcn.005c6500
mov al, byte [ebp - 0x13d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push dword [ebp - 0x148]
mov byte [ebp - 0x13d], 1
push str.Registry_seeker
call fcn.0045b060
push 0
push str.Registry_seeker
mov ecx, edi
call fcn.0045f380
push 0
mov ecx, edi
call fcn.0045f260
jmp 0x4dfded