Function at 0x491710
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f1401
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x4b8
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x460], edi
push str.Reporting
lea ecx, [edi + 0x1448]
call fcn.005dc510
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x38]
movq qword [ebp - 0x38], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x64]
xorps xmm0, xmm0
mov dword [ebp - 0x5c], 0
movq qword [ebp - 0x64], xmm0
call fcn.005dc5e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [edi + 0x15c]
mov byte [ebp - 4], 1
push 0x68b498
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [edi + 0x1478]
push str.__WriteSysInfo__NP__Auto
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc200
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49181b
mov dword [ebp - 0x438], 0
jmp 0x491843
push 5
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc190
push eax
lea ecx, [edi + 0x1290]
call fcn.00579420
mov dword [ebp - 0x438], eax
push 0
push 0xffffffffffffffff
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerReporting
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
call fcn.005d6a80
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], 0
call fcn.005d6aa0
push 0
push str.Reporting
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.0045f680
mov ecx, edi
mov dword [ebp - 0x484], eax
call fcn.0043e530
test al, al
jne 0x491898
mov byte [ebp - 0x42d], al
jmp 0x494eab
mov esi, dword [edi + 0x14e4]
mov ecx, dword [edi + 0x100]
mov dword [ebp - 0x44c], esi
call fcn.005d2f10
push ecx
push 4
push 0xffffffffffffffff
push 0xff000000
push 0x5a
push 0x2e4
push 0x28
mov edx, 5
mov dword [ebp - 0x450], eax
mov ecx, eax
call fcn.005d22b0
push ecx
mov ecx, dword [ebp - 0x450]
mov edx, 5
push 4
push 0xffffffffffffffff
push 0xff000000
push 0x8c
push 0x2e4
push 0x87
call fcn.005d22b0
push ecx
mov ecx, dword [ebp - 0x450]
mov edx, 5
push 4
push 0xffffffffffffffff
push 0xff000000
push 0xe6
push 0x2e4
push 0x118
call fcn.005d22b0
push 0
push 0
push dword [ebp - 0x450]
mov ecx, esi
call fcn.005c44c0
mov ecx, dword [ebp - 0x450]
test ecx, ecx
je 0x491947
mov eax, dword [ecx]
push 1
call dword [eax]
push 1
push str.https:__www.carifred.com_uvk_help_reporting.php
lea ecx, [edi + 0x119c]
call fcn.005dc260
movsd xmm1, qword [0x6edb20]
mov ecx, esi
push 9
push str.Arial
push 0
push 0x320
call fcn.005c42b0
push dword [edi + 0x1438]
mov ecx, esi
call fcn.005c44a0
push ecx
push 0xffffffffffffffff
push 0x20
push 0x20
push 6
push 6
push 0
push 0x20
push 0x20
push 0x95
mov ecx, edi
call fcn.00436420
push eax
mov ecx, esi
call fcn.005c0240
push 0xffffffffffffffff
push 0x10000101
push 0x14
push 0x258
push 0xf
push 0x32
push str.Send_the_application_reports_to_your_email_address_or_FTP_server
mov ecx, esi
call fcn.005c0890
push 0
mov ecx, esi
call fcn.005c44a0
movsd xmm1, qword [0x6edaf8]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
lea eax, [ebp - 0x38]
push eax
push str.LastEmailSent
lea ecx, [ebp - 0x2c]
call fcn.005d6740
test al, al
je 0x491a3a
lea ecx, [ebp - 0x38]
call fcn.005dc3a0
test eax, eax
je 0x491a3a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627930
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
push str.Email_options:__last_report_emailed_at
lea ecx, [ebp - 0x38]
call fcn.005dc200
jmp 0x491a47
push str.Email_options:
lea ecx, [ebp - 0x38]
call fcn.005dc510
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x1f4
push 0x2d
push 0x28
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005c0890
push 0xff0000
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x4b0], eax
call fcn.005bec70
xorps xmm0, xmm0
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x8c]
movq qword [ebp - 0x8c], xmm0
mov dword [ebp - 0x84], 0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xb8], 0
lea ecx, [ebp - 0xc0]
movq qword [ebp - 0xc0], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
lea ecx, [ebp - 0x98]
movq qword [ebp - 0x98], xmm0
call fcn.005dc5e0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 6
push eax
push str.SendEmail
lea ecx, [ebp - 0x2c]
call fcn.005d66b0
cmp dword [ebp - 0x4c], 0
push 0xffffffffffffffff
push 0xff3020
push 0
push 0
push str.Enable_sending_the_reports_by_mail
setne al
movzx eax, al
push eax
push ecx
push 0xaa
push 0x46
push 0x14
push str._Send_reports_by_email
mov ecx, edi
call fcn.0045fc60
movsd xmm1, qword [0x6edaf8]
mov ecx, esi
push 0
push str.Arial
push 1
push 0x190
mov dword [ebp - 0x47c], eax
call fcn.005c42b0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x3c
push 0x48
push 0xc3
push str.Subject:
mov ecx, esi
call fcn.005c0890
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057c300
push eax
push 0x624284
lea ecx, [edi + 0x198]
call fcn.005dc190
push eax
push str.from
lea ecx, [ebp - 0x38]
call fcn.005dc200
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0xff
push 0x48
push 0x1ea
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x172
push 0x64
push 0x14
push str.Enter_the_email_address_you_wish_to_send_the_reports_to:
mov ecx, esi
call fcn.005c0890
lea eax, [ebp - 0x8c]
push eax
push str.Subject
lea ecx, [ebp - 0x2c]
call fcn.005d6740
test al, al
je 0x491c04
lea ecx, [ebp - 0x8c]
call fcn.005dbeb0
test al, al
je 0x491c37
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._Report
lea ecx, [edi + 0x143c]
call fcn.005dc190
push eax
push str.New
lea ecx, [ebp - 0x8c]
call fcn.005dc200
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0xe6
push 0x45
push 0xff
lea ecx, [ebp - 0x8c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005c0a40
push 0
push str.The_emails_subject._r_n_from_PC_NameUser_name__is_automatically_appended.
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x478], eax
call fcn.0045b370
lea eax, [ebp - 0xc0]
push eax
push str.EmailAddress
lea ecx, [ebp - 0x2c]
call fcn.005d6740
test al, al
je 0x491cac
lea ecx, [ebp - 0xc0]
call fcn.005dc3a0
cmp eax, 0x1e
jle 0x491cac
push ecx
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0xc0]
call fcn.00477530
push 0xffffffffffffffff
push 0x100000a0
push 0x14
push 0xf0
push 0x62
push 0x190
lea ecx, [ebp - 0x98]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005c0a40
push 0
push str.This_field_is_required_to_send_the_reports_by_email._r_nIt_must_contain_a_valid_email_address_to_receive_the_reports.
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x470], eax
call fcn.0045b370
push 0xffffffffffffffff
push 0xff3020
push 0
push 0
push str.Enable_showing_the_hidden_characters
push 0
push ecx
push 0x5a
push 0x66
push 0x285
push str._Show_chars
mov ecx, edi
call fcn.0045fc60
push dword [ebp - 0x470]
mov ecx, esi
mov dword [ebp - 0x45c], eax
call fcn.005c5730
push 0
push 0
push 0xd2
push eax
mov dword [ebp - 0x458], eax
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, ax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x48c], eax
lea eax, [ebp - 0x144]
push eax
push str.ShowEmailChars
call fcn.005d66b0
test al, al
je 0x491d89
cmp dword [ebp - 0x144], 0
je 0x491d89
push 0
push 0
push 0xcc
push dword [ebp - 0x458]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [ebp - 0x45c]
mov ecx, esi
call fcn.005bd3f0
cmp dword [ebp - 0x4c], 0
mov ecx, 0x20
mov eax, 0x40
cmovne eax, ecx
mov ecx, dword [ebp - 0x478]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x458], ecx
cmp ecx, dword [ebp - 0x45c]
jg 0x491dd0
mov edi, ecx
push eax
push edi
mov ecx, esi
call fcn.005bd3f0
inc edi
cmp edi, dword [ebp - 0x45c]
jg 0x491dca
mov eax, dword [ebp - 0x50]
jmp 0x491db3
mov edi, dword [ebp - 0x460]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0
push eax
push str.SendFTP
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x110], 0
call fcn.005d66b0
movsd xmm1, qword [0x6edaf8]
mov ecx, esi
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
xorps xmm0, xmm0
mov dword [ebp - 0x9c], 0
lea ecx, [ebp - 0xa4]
movq qword [ebp - 0xa4], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x138], 0
lea ecx, [ebp - 0x140]
movq qword [ebp - 0x140], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xc4], 0
lea ecx, [ebp - 0xcc]
movq qword [ebp - 0xcc], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xd0], 0
lea ecx, [ebp - 0xd8]
movq qword [ebp - 0xd8], xmm0
call fcn.005dc5e0
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 0xa
push eax
push str.LastFTPUpload
lea ecx, [ebp - 0x2c]
call fcn.005d6740
test al, al
je 0x491ef9
lea ecx, [ebp - 0xa4]
call fcn.005dc3a0
test eax, eax
je 0x491ef9
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627930
lea ecx, [ebp - 0xa4]
call fcn.005dc190
push eax
push str.FTP_options:__last_FTP_report_sent_at
lea ecx, [ebp - 0xa4]
call fcn.005dc200
jmp 0x491f09
push str.FTP_options:
lea ecx, [ebp - 0xa4]
call fcn.005dc510
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x1f4
push 0x91
push 0x28
lea ecx, [ebp - 0xa4]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005c0890
push 0xff0000
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x4b8], eax
call fcn.005bec70
cmp dword [ebp - 0x54], 0
push 0xffffffffffffffff
push 0xff3020
push 0
push 0
push str.Enable_sending_the_reports_to_an_FTP_server
setne al
movzx eax, al
push eax
push ecx
push 0xd2
push 0xaa
push 0x14
push str._Send_reports_to_your_FTP_server
mov ecx, edi
call fcn.0045fc60
movsd xmm1, qword [0x6edaf8]
mov ecx, esi
push 0
push str.Arial
push 1
push 0x190
mov dword [ebp - 0x488], eax
call fcn.005c42b0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x10
push 0x6e
push 0xad
push 0x122
push str.Connection_type:
mov ecx, esi
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x10
push 0x64
push 0xd0
push 0x14
push str.Server_name:
mov ecx, esi
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x10
push 0x64
push 0xd0
push 0x172
push str.Remote_location:
mov ecx, esi
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x10
push 0x64
push 0xf3
push 0x14
push str.FTP_user_name:
mov ecx, esi
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x10
push 0x64
push 0xf3
push 0x172
push str.FTP_password:
mov ecx, esi
call fcn.005c0890
sub esp, 8
mov ecx, esi
push 0x10000043
push 0x14
push 0x3c
push 0xa5
push 0x190
push str.FTP_nFTPS
call fcn.005c1650
push 0
push str.The_FTP_connection_type_to_use._r_nSelect_FTPS_only_if_the_server_supports_FTP_over_SSL.
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x46c], eax
call fcn.0045b370
movsd xmm0, qword [edi + 8]
comisd xmm0, xmmword [0x6edb10]
jbe 0x49207e
push 0x800
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bda80
lea eax, [ebp - 0x140]
push eax
push str.FTPType
lea ecx, [ebp - 0x2c]
call fcn.005d6740
test al, al
je 0x4920bc
push str.FTPS
lea ecx, [ebp - 0x140]
call fcn.005dc4c0
test al, al
je 0x4920bc
push 0
push 1
push 0x14e
push 0xffffffffffffffff
mov ecx, esi
call fcn.005befd0
lea eax, [ebp - 0x10c]
push eax
push str.FTPPassive
lea ecx, [ebp - 0x2c]
call fcn.005d66b0
cmp dword [ebp - 0x10c], 0
push 0xffffffffffffffff
push 0xff3020
push 0
push 0
push str.Whether_to_use_passive_FTP_connections.
setne al
movzx eax, al
push eax
push ecx
push 0x78
push 0xaa
push 0x208
push str._Use_passive_FTP
mov ecx, edi
call fcn.0045fc60
mov dword [ebp - 0x4c4], eax
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0xcc]
push eax
push str.FTPServer
call fcn.005d6740
test al, al
je 0x492147
lea ecx, [ebp - 0xcc]
call fcn.005dc3a0
cmp eax, 0x1e
jle 0x492147
push ecx
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0xcc]
call fcn.00477530
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0xc8
push 0xcd
push 0x78
lea ecx, [ebp - 0xd8]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005c0a40
push 0
push str.The_name_or_IP_address_of_the_FTP_server._r_ni.e._example.com_or_124.10.20.30._r_nNon_standard_port_numbers_can_be_appended._r_ni.e._example.com:2121_or_124.10.20.30:2121
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x494], eax
call fcn.0045b370
xorps xmm0, xmm0
mov dword [ebp - 0xdc], 0
lea ecx, [ebp - 0xe4]
movq qword [ebp - 0xe4], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x74], 0
lea ecx, [ebp - 0x7c]
movq qword [ebp - 0x7c], xmm0
call fcn.005dc5e0
lea eax, [ebp - 0xe4]
mov byte [ebp - 4], 0xc
push eax
push str.FTPLocation
lea ecx, [ebp - 0x2c]
call fcn.005d6740
test al, al
je 0x4921f4
lea ecx, [ebp - 0xe4]
call fcn.005dc3a0
cmp eax, 0x1e
jle 0x4921f4
push ecx
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0xe4]
call fcn.00477530
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0xfa
push 0xcd
push 0x1e0
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005c0a40
push 0
push str.The_remote_location_in_the_FTP_server_to_put_the_zipped_reports_in._r_ni.e._public_ftp_reports._r_n_r_nYou_can_also_specify_the_remote_file_name__including_the_zip_file_extension._r_ni.e._public_ftp_reports_RemoteFileName.zip.
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x4bc], eax
call fcn.0045b370
xorps xmm0, xmm0
mov dword [ebp - 0xe8], 0
lea ecx, [ebp - 0xf0]
movq qword [ebp - 0xf0], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xf4], 0
lea ecx, [ebp - 0xfc]
movq qword [ebp - 0xfc], xmm0
call fcn.005dc5e0
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 0xe
push eax
push str.FTPUser
lea ecx, [ebp - 0x2c]
call fcn.005d6740
test al, al
je 0x4922ad
lea ecx, [ebp - 0xf0]
call fcn.005dc3a0
cmp eax, 0x1e
jle 0x4922ad
push ecx
lea edx, [ebp - 0xfc]
lea ecx, [ebp - 0xf0]
call fcn.00477530
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0xc8
push 0xf0
push 0x78
lea ecx, [ebp - 0xfc]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005c0a40
push 0
push str.The_user_name_to_connect_to_the_FTP_server._r_ni.e._UserName_or_UserName_Domain.com.
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x4c0], eax
call fcn.0045b370
xorps xmm0, xmm0
mov dword [ebp - 0x100], 0
lea ecx, [ebp - 0x108]
movq qword [ebp - 0x108], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x114], 0
lea ecx, [ebp - 0x11c]
movq qword [ebp - 0x11c], xmm0
call fcn.005dc5e0
lea eax, [ebp - 0x108]
mov byte [ebp - 4], 0x10
push eax
push str.FTPPass
lea ecx, [ebp - 0x2c]
call fcn.005d6740
test al, al
je 0x492366
lea ecx, [ebp - 0x108]
call fcn.005dc3a0
cmp eax, 0x1e
jle 0x492366
push ecx
lea edx, [ebp - 0x11c]
lea ecx, [ebp - 0x108]
call fcn.00477530
push 0xffffffffffffffff
push 0x100000a0
push 0x14
push 0xa0
push 0xf0
push 0x1e0
lea ecx, [ebp - 0x11c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005c0a40
push 0
push str.The_password_to_connect_to_the_FTP_server.
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x474], eax
call fcn.0045b370
push 0xffffffffffffffff
push 0xff3020
push 0
push 0
push str.Enable_showing_the_hidden_characters
push 0
push ecx
push 0x5a
push 0xf4
push 0x285
push str._Show_chars
mov ecx, edi
call fcn.0045fc60
push dword [ebp - 0x474]
mov ecx, esi
mov dword [ebp - 0x450], eax
call fcn.005c5730
mov dword [ebp - 0x458], eax
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x110]
push eax
push str.ShowFTPPass
call fcn.005d66b0
test al, al
je 0x492430
cmp dword [ebp - 0x110], 0
je 0x492430
push 0
push 0
push 0xcc
push dword [ebp - 0x458]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [ebp - 0x450]
mov ecx, esi
call fcn.005bd3f0
cmp dword [ebp - 0x54], 0
mov ecx, 0x20
mov eax, 0x40
cmovne eax, ecx
mov ecx, dword [ebp - 0x46c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x458], ecx
cmp ecx, dword [ebp - 0x450]
jg 0x49247d
mov edi, ecx
nop word [eax + eax]
push eax
push edi
mov ecx, esi
call fcn.005bd3f0
inc edi
cmp edi, dword [ebp - 0x450]
jg 0x492477
mov eax, dword [ebp - 0x50]
jmp 0x492460
mov edi, dword [ebp - 0x460]
movsd xmm1, qword [0x6edaf8]
mov ecx, esi
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x96
push 0x122
push 0x28
push str.Zip_file_options:
mov ecx, esi
call fcn.005c0890
push 0xff0000
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bec70
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0xbe
push 0x122
push 0x226
push str.Current_zip_file_size:_0_bytes.
mov ecx, esi
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0xbe
push 0x136
push 0x226
push str.Max_zip_file_size:_15_MB.
mov ecx, esi
mov dword [ebp - 0x440], eax
call fcn.005c0890
movsd xmm1, qword [0x6edaf8]
mov ecx, esi
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0x10024
push 0xffffffffffffffff
push 0xbe
push 0x20d
push 0x136
push 0xa
push 0x62794c
push str._Items_currently_in_the_zip_Original_location
mov ecx, esi
call fcn.005c0620
push 0
push str.These_are_the_files_currently_inside_the_zip._r_nTip:_drag_and_drop_files_here_to_quickly_add_them.
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x434], eax
call fcn.0045b370
push 0x10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Shell32.dll
push dword [edi + 0x24]
lea ecx, [ebp - 0x38]
call fcn.005dc200
mov ecx, eax
call fcn.005dc190
push eax
push 1
push dword [ebp - 0x434]
mov ecx, esi
call fcn.005bea70
push ecx
push 0xffffffffffffffff
push 0x19
push 0xb4
push 0x14f
push 0x226
push str.Add_a_note
mov ecx, esi
call fcn.005c1a50
push ecx
push 0xffffffffffffffff
push 0x19
push 0xb4
push 0x16d
push 0x226
push str.Add_files...
mov ecx, esi
mov dword [ebp - 0x4a4], eax
call fcn.005c1a50
push 0
push str.Add_more_reports_or_other_files_to_the_zip.
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x4a0], eax
call fcn.0045b370
push ecx
push 0xffffffffffffffff
push 0x19
push 0xb4
push 0x18b
push 0x226
push str.Add_folder...
mov ecx, esi
call fcn.005c1a50
push 0
push str.Add_a_folder_with_files_to_the_zip.
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x49c], eax
call fcn.0045b370
push ecx
push 0xffffffffffffffff
push 0x19
push 0xb4
push 0x1a9
push 0x226
push str.Delete_checked_from_zip
mov ecx, esi
call fcn.005c1a50
push 0
push str.Delete_the_checked_items_from_the_zip.
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x498], eax
call fcn.0045b370
push ecx
push 0xffffffffffffffff
push 0x19
push 0xb4
push 0x1c7
push 0x226
push str.Add_System_info_html_log
mov ecx, esi
call fcn.005c1a50
push 0
push str.Create_the_System_Imfo_html_file_from_the_System_info_module_and_add_it_to_the_zip.
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x4b4], eax
call fcn.0045b370
lea eax, [ebp - 0x70]
mov dword [ebp - 0x70], 0
push eax
push str.DeleteAfterSending
lea ecx, [ebp - 0x2c]
call fcn.005d66b0
push 0xffffffffffffffff
cmp dword [ebp - 0x70], 0
push 0xff3020
push 0
push 0
push str.Whether_to_delete_the_local_files_after_successfully_sending_the_reports.
setne al
movzx eax, al
push eax
push ecx
push 0xb4
push 0x1e5
push 0x226
push str._Delete_files_after_sending
mov ecx, edi
call fcn.0045fc60
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Securely_save_the_current_email_and_FTP_settings_for_future_use.
push 0x1e
push 0x96
push 0x203
push 0x4b
push 0x98
push str.Save_settings
mov dword [ebp - 0x4ac], eax
call fcn.0045fd50
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Send_the_reports_to_your_email_address_and_or_FTP_server.
push 0x1e
push 0x96
push 0x203
push 0x12c
push 0x97
push str.Send_reports
mov dword [ebp - 0x468], eax
call fcn.0045fd50
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Cancel_the_operation_and_go_back_to_the_Home_page.
push 0x1e
push 0x96
push 0x203
push 0x20d
push 0xb3
push str.Close___Cancel
mov dword [ebp - 0x480], eax
call fcn.0045fd50
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Show_online_help__F1_
push 0x1b
push 0x46
push 0xa
push 0x29e
push 0x7d
push str.Help
mov dword [edi + 0x11c0], eax
call fcn.0045fd50
xorps xmm0, xmm0
mov dword [edi + 0x11bc], eax
lea ecx, [ebp - 0x48]
movq qword [ebp - 0x48], xmm0
mov dword [ebp - 0x40], 0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xa8], 0
lea ecx, [ebp - 0xb0]
movq qword [ebp - 0xb0], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x12
lea ecx, [edi + 0x1460]
call fcn.005dc3a0
test eax, eax
je 0x49282f
lea ecx, [edi + 0x1460]
call fcn.005dc3e0
push eax
lea ecx, [ebp - 0xb0]
call fcn.005dc1c0
jmp 0x492848
lea eax, [ebp - 0xb0]
push eax
push str.ReportID
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backupsSystemRepair
lea ecx, [ebp - 0x58]
call fcn.005d65d0
lea ecx, [ebp - 0xb0]
call fcn.005dc3a0
test eax, eax
je 0x49287a
sub esp, 0xc
lea ecx, [ebp - 0xb0]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x696640
call fcn.005da510
xor edx, edx
lea ecx, [ebp - 0x48]
call fcn.005cf610
sub esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0x696640
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057c300
push eax
push 0x696640
lea ecx, [edi + 0x198]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005da510
lea ecx, [ebp - 0x48]
call fcn.00590100
push 0
push 0
push 0x696640
push 0x62438c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb0]
call fcn.005dc190
push eax
push 7
lea ecx, [ebp - 0x48]
call fcn.005da0f0
mov ecx, eax
call fcn.005da780
mov ecx, eax
call fcn.005d9bd0
mov ecx, eax
call fcn.005da270
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..zip
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
lea ecx, [ebp - 0x48]
call fcn.005dc190
mov ecx, eax
call fcn.0059f430
mov ecx, edi
mov dword [ebp - 0x43c], eax
call fcn.0045f300
cmp dword [ebp - 0x43c], 0
mov byte [ebp - 0x42d], 0
jne 0x4929d1
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push 0
push esi
push 0
push str.Sorry__the_zip_file_for_the_reports_could_not_be_created._r_n_r_nPlease_try_again_later.
call fcn.0043e2e0
mov esi, dword [edi + 0x1f68]
mov ecx, edi
test esi, 3
setne al
movzx eax, al
push eax
call fcn.0045f260
test esi, 3
sete al
movzx eax, al
push eax
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.004909d0
mov byte [ebp - 0x42d], al
jmp 0x494e0c
mov edx, 2
mov ecx, 0x400
call fcn.00404860
call fcn.005e9c20
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, eax
mov esi, edx
shld esi, ecx, 4
push 0
push 0
shl ecx, 4
sub ecx, eax
push 0
push 0
mov dword [ebp - 0x444], ecx
sbb esi, edx
push str.Log.txt
lea ecx, [edi + 0x150]
mov dword [ebp - 0x448], esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
mov esi, dword [ebp - 0x43c]
lea ecx, [ebp - 0x48]
push esi
push dword [ebp - 0x448]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x678278
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
push esi
push dword [ebp - 0x448]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
push 0
push 1
mov ecx, edi
call fcn.0043d720
push 0
cmp eax, 1
jle 0x492aeb
push esi
lea eax, [ebp - 0x48]
push eax
call fcn.004909d0
mov byte [ebp - 0x42d], al
jmp 0x494e0c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [edi + 0x143c]
push str._Log.txt
call fcn.005dc190
push eax
push 0x624284
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057baa0
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
push esi
push dword [ebp - 0x448]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._Log.txt
lea ecx, [edi + 0x143c]
call fcn.005dc190
push eax
push 0x624284
push 0
lea ecx, [edi + 0x1290]
call fcn.0057bb00
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
push esi
push dword [ebp - 0x448]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
xorps xmm0, xmm0
mov dword [ebp - 0x424], 0
lea ecx, [ebp - 0x42c]
movq qword [ebp - 0x42c], xmm0
call fcn.005d6ac0
push ecx
push 0x20019
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerSystem_infoHTML_files
ret
push 0xa84d8d00
mov byte [ebp - 4], 0x13
call fcn.005d6a30
lea ecx, [ebp - 0x58]
call fcn.005d6280
test eax, eax
je 0x492c9f
lea esi, [eax - 1]
lea eax, [ebp - 0x42c]
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.005d62e0
test al, al
je 0x492c9f
push dword [ebp - 0x42c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x492c42
push dword [ebp - 0x42c]
lea ecx, [ebp - 0x58]
call fcn.005d5df0
jmp 0x492c76
push dword [ebp - 0x43c]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x448]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
push dword [ebp - 0x42c]
mov ecx, edi
call fcn.004906c0
push 0
push 1
mov ecx, edi
call fcn.0043d720
cmp eax, 1
jg 0x492d88
lea eax, [ebp - 0x42c]
dec esi
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.005d62e0
test al, al
jne 0x492c22
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._Report.htm
lea ecx, [edi + 0x143c]
call fcn.005dc190
push eax
push 0x624284
push 0
lea ecx, [edi + 0x1290]
call fcn.0057bb00
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
push 0x260
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x38]
call fcn.005dc190
push 0x250
mov esi, eax
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edx, eax
mov dword [ebp - 0x1d0], edx
cmp edx, 0xffffffff
je 0x492de1
mov ecx, 3
mov dword [ebp - 0x1cc], ecx
cmp word [ebp - 0x3f4], 0x2e
jne 0x492d67
mov ax, word [ebp - 0x3f2]
test ax, ax
je 0x492dad
cmp ax, 0x2e
jne 0x492d67
cmp word [ebp - 0x3f0], 0
je 0x492dad
test ecx, ecx
je 0x492de1
mov eax, dword [ebp - 0x420]
test cl, 1
je 0x492d7d
test eax, 0x400
jne 0x492dad
test cl, 2
je 0x492da4
test al, 0x10
je 0x492de1
jmp 0x492dad
push 0
push dword [ebp - 0x43c]
lea eax, [ebp - 0x48]
push eax
call fcn.004909d0
mov byte [ebp - 0x42d], al
jmp 0x494e01
test cl, 4
je 0x492de1
test al, 0x10
jne 0x492de1
lea eax, [ebp - 0x420]
push eax
push edx
call esi
test eax, eax
je 0x492dcc
mov ecx, dword [ebp - 0x1cc]
mov edx, dword [ebp - 0x1d0]
jmp 0x492d41
push dword [ebp - 0x1d0]
call dword [sym.imp.KERNEL32.dll_FindClose]
or edx, 0xffffffff
mov dword [ebp - 0x1d0], edx
mov esi, dword [ebp - 0x43c]
mov byte [ebp - 4], 0x14
cmp edx, 0xffffffff
je 0x492eb6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x3f4]
push eax
push 0x624284
push 0
lea ecx, [edi + 0x1290]
call fcn.0057bb00
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
push esi
push dword [ebp - 0x448]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
push 0
push 1
mov ecx, edi
call fcn.0043d720
cmp eax, 1
jg 0x4932cd
mov eax, dword [ebp - 0x1d0]
cmp eax, 0xffffffff
je 0x492eb6
lea ecx, [ebp - 0x420]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x492ea0
lea ecx, [ebp - 0x420]
call fcn.004011a0
test al, al
jne 0x492df4
jmp 0x492eb6
push dword [ebp - 0x1d0]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x1d0], 0xffffffff
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKRebootExecLog.txt
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057baa0
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
push esi
push dword [ebp - 0x448]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Ultra_Adware_Killer.txt
lea ecx, [edi + 0x15c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
lea ecx, [ebp - 0x38]
call fcn.005dc190
mov ecx, dword [ebp - 0x1d0]
mov esi, eax
cmp ecx, 0xffffffff
je 0x492f5f
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x420]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, eax
mov dword [ebp - 0x1d0], edx
cmp edx, 0xffffffff
je 0x493102
mov eax, 3
mov dword [ebp - 0x1cc], eax
nop dword [eax]
cmp word [ebp - 0x3f4], 0x2e
jne 0x492fbe
mov cx, word [ebp - 0x3f2]
test cx, cx
je 0x4930c9
cmp cx, 0x2e
jne 0x492fbe
cmp word [ebp - 0x3f0], 0
je 0x4930c9
test eax, eax
je 0x492ff0
mov ecx, dword [ebp - 0x420]
test al, 1
je 0x492fd8
test ecx, 0x400
jne 0x4930c9
test al, 2
je 0x4930b5
test cl, 0x10
jne 0x4930c9
nop dword [eax]
lea ecx, [ebp - 0x3f4]
call fcn.005d8c40
cmp eax, 0x14
jl 0x493084
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, ecx
lea ecx, [edi + 0x15c]
push eax
push str.Ultra_Adware_Killer_
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
mov esi, dword [ebp - 0x43c]
lea ecx, [ebp - 0x48]
push esi
push dword [ebp - 0x448]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
push 0
push 1
mov ecx, edi
call fcn.0043d720
cmp eax, 1
jg 0x4932cd
mov edx, dword [ebp - 0x1d0]
cmp edx, 0xffffffff
je 0x493102
lea eax, [ebp - 0x420]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4930ec
lea ecx, [ebp - 0x420]
call fcn.004011a0
test al, al
je 0x493102
mov edx, dword [ebp - 0x1d0]
jmp 0x492ff0
test al, 4
je 0x492ff0
test ecx, 0x10
jne 0x492ff0
lea eax, [ebp - 0x420]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4930ec
mov eax, dword [ebp - 0x1cc]
mov edx, dword [ebp - 0x1d0]
jmp 0x492f90
push dword [ebp - 0x1d0]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x1d0], 0xffffffff
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Ultra_Adware_Killer.txt
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057c490
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
lea ecx, [ebp - 0x38]
call fcn.005dc190
mov ecx, dword [ebp - 0x1d0]
mov esi, eax
cmp ecx, 0xffffffff
je 0x49314c
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x420]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, eax
mov dword [ebp - 0x1d0], edx
cmp edx, 0xffffffff
je 0x4932fa
mov eax, 3
mov dword [ebp - 0x1cc], eax
cmp word [ebp - 0x3f4], 0x2e
jne 0x4931a4
mov cx, word [ebp - 0x3f2]
test cx, cx
je 0x4932aa
cmp cx, 0x2e
jne 0x4931a4
cmp word [ebp - 0x3f0], 0
je 0x4932aa
test eax, eax
je 0x4931d0
mov ecx, dword [ebp - 0x420]
test al, 1
je 0x4931be
test ecx, 0x400
jne 0x4932aa
test al, 2
je 0x493296
test cl, 0x10
jne 0x4932aa
nop
lea ecx, [ebp - 0x3f4]
call fcn.005d8c40
cmp eax, 0x14
jl 0x493261
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, ecx
push eax
push str.Ultra_Adware_Killer_
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057c490
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
mov esi, dword [ebp - 0x43c]
lea ecx, [ebp - 0x48]
push esi
push dword [ebp - 0x448]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
push 0
push 1
mov ecx, edi
call fcn.0043d720
cmp eax, 1
jg 0x4932cd
mov edx, dword [ebp - 0x1d0]
cmp edx, 0xffffffff
je 0x4932fa
lea eax, [ebp - 0x420]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4932e4
lea ecx, [ebp - 0x420]
call fcn.004011a0
test al, al
je 0x4932fa
mov edx, dword [ebp - 0x1d0]
jmp 0x4931d0
test al, 4
je 0x4931d0
test ecx, 0x10
jne 0x4931d0
lea eax, [ebp - 0x420]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4932e4
mov eax, dword [ebp - 0x1cc]
mov edx, dword [ebp - 0x1d0]
jmp 0x493176
push 0
push esi
lea eax, [ebp - 0x48]
push eax
call fcn.004909d0
mov byte [ebp - 0x42d], al
jmp 0x494def
push dword [ebp - 0x1d0]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x1d0], 0xffffffff
push ecx
mov ecx, edi
call fcn.00495930
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Third_party_logs
lea ecx, [edi + 0x15c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
push dword [ebp - 0x43c]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x448]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
mov eax, dword [ebp - 0x438]
test eax, eax
je 0x4934c6
mov ecx, eax
call fcn.005cc910
mov esi, dword [ebp - 0x44c]
test al, al
je 0x4933d9
push 0
push 0xffffffffffffffba
sub esp, 8
mov ecx, edi
push 0x46
push 0x1c2
push esi
push str.Exporting_System_information...
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
mov ecx, dword [ebp - 0x438]
call fcn.005cc910
test al, al
je 0x4933d9
push 0
push 0
mov ecx, edi
call fcn.0043d720
cmp eax, 1
jg 0x4934aa
mov ecx, dword [ebp - 0x438]
call fcn.005cc910
test al, al
jne 0x4933b6
mov eax, dword [ebp - 0x438]
mov ecx, dword [edi + 0x1f70]
mov dword [ebp - 0x464], ecx
mov dword [edi + 0x1f70], 0
test ecx, ecx
je 0x4934f9
test eax, eax
jne 0x49347a
push eax
push 0xffffffffffffffba
sub esp, 8
mov ecx, edi
push 0x46
push 0x1c2
push esi
push str.Creating_the_System_Info_html_log...
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__WriteSysInfo__NP__Auto
lea ecx, [edi + 0x1478]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc200
push 5
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc190
push eax
lea ecx, [edi + 0x1290]
call fcn.0057b4f0
cmp eax, 0xffffffff
je 0x4934aa
cmp dword [ebp - 0x4c], 0
je 0x49348f
lea ecx, [ebp - 0x98]
call fcn.005dbeb0
test al, al
je 0x4934f9
cmp dword [ebp - 0x54], 0
je 0x4934a1
lea ecx, [ebp - 0x7c]
call fcn.005dbeb0
test al, al
je 0x4934f9
test byte [edi + 0x1f68], 1
je 0x4934d1
push 0
push dword [ebp - 0x43c]
lea eax, [ebp - 0x48]
push eax
call fcn.004909d0
mov byte [ebp - 0x42d], al
jmp 0x494def
mov esi, dword [ebp - 0x44c]
jmp 0x4933df
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push 0
push esi
push 0
push str.Please_setup_your_Email_or_FTP_settings_before_sending_the_reports.
call fcn.0043e2e0
mov dword [ebp - 0x464], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x68b498
lea ecx, [edi + 0x15c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
push dword [ebp - 0x43c]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x448]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x68b210
push 0
lea ecx, [edi + 0x1290]
call fcn.0057bb00
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
push dword [ebp - 0x43c]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x448]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
lea ecx, [edi + 0x14f0]
push 2
call fcn.005b6250
mov ecx, dword [ebp - 0x43c]
call fcn.0059e8d0
push 1
push dword [ebp - 0x434]
mov ecx, esi
call fcn.005ba360
push dword [ebp - 0x434]
mov ecx, esi
call fcn.005c5730
push 0xfffffffffffffffe
xor edx, edx
mov dword [ebp - 0x43c], eax
mov ecx, eax
call fcn.005c8de0
mov cx, word [edi + 0x11c0]
mov eax, 0x1b
mov byte [ebp - 0x28], 1
mov word [ebp - 0x26], ax
mov word [ebp - 0x24], cx
mov eax, 0x70
mov byte [ebp - 0x22], 1
mov word [ebp - 0x20], ax
mov ecx, esi
mov ax, word [edi + 0x11bc]
mov word [ebp - 0x1e], ax
mov eax, 0xd
mov word [ebp - 0x1a], ax
mov eax, dword [ebp - 0x468]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x28]
push 3
push eax
mov byte [ebp - 0x1c], 9
call fcn.005c47a0
sub esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Current_zip_file_size:
push ecx
push 0
lea ecx, [ebp - 0x48]
call fcn.005dc190
mov ecx, eax
call fcn.005e0e70
push edx
push eax
lea ecx, [ebp - 0x38]
call fcn.005daea0
mov ecx, eax
call fcn.005da510
push 0
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
push dword [ebp - 0x440]
mov ecx, esi
call fcn.005bcd30
push 0
mov ecx, edi
mov byte [ebp - 0x451], 0
call fcn.004771c0
test eax, eax
je 0x494d1f
lea edx, [edi + 0x14a8]
mov dword [ebp - 0x458], edx
lea ecx, [edi + 0x14d8]
mov dword [ebp - 0x4a8], edx
nop
cmp dword [ebp - 0x464], 0
mov dword [ebp - 0x490], ecx
je 0x493707
mov eax, dword [ebp - 0x4a8]
mov edx, dword [ebp - 0x480]
mov dword [ecx], esi
mov dword [eax], edx
mov edx, eax
mov dword [ebp - 0x458], edx
mov eax, dword [edx]
cmp eax, 0xfffffffa
je 0x494d1f
cmp dword [ecx], esi
jne 0x494cda
mov ecx, dword [ebp - 0x47c]
cmp eax, ecx
jne 0x49377c
push 4
push ecx
mov ecx, esi
call fcn.005bc500
xor ecx, ecx
test eax, eax
setne cl
test eax, eax
mov dword [ebp - 0x4c], ecx
mov eax, 0x20
mov ecx, 0x40
cmovne ecx, eax
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x3c], eax
cmp eax, dword [ebp - 0x45c]
jg 0x494cda
mov edi, eax
push ecx
push edi
mov ecx, esi
call fcn.005bd3f0
inc edi
cmp edi, dword [ebp - 0x45c]
jg 0x4937f7
mov ecx, dword [ebp - 0x50]
jmp 0x493761
cmp eax, dword [ebp - 0x45c]
je 0x494c7a
cmp eax, dword [ebp - 0x450]
je 0x494c7a
mov ecx, dword [ebp - 0x488]
cmp eax, ecx
jne 0x493802
push 4
push ecx
mov ecx, esi
call fcn.005bc500
xor ecx, ecx
test eax, eax
setne cl
test eax, eax
mov dword [ebp - 0x54], ecx
mov eax, 0x20
mov ecx, 0x40
cmovne ecx, eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x3c], eax
cmp eax, dword [ebp - 0x450]
jg 0x494cda
mov edi, eax
nop dword [eax + eax]
push ecx
push edi
mov ecx, esi
call fcn.005bd3f0
inc edi
cmp edi, dword [ebp - 0x450]
jg 0x4937f7
mov ecx, dword [ebp - 0x50]
jmp 0x4937e0
mov edi, dword [ebp - 0x460]
jmp 0x494cda
cmp eax, dword [ebp - 0x4a4]
jne 0x493890
push 1
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.00490a00
cmp eax, 1
jl 0x494cda
push 0
push dword [ebp - 0x448]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push 0
push 0
test eax, eax
je 0x49387f
push 4
push str.The_new_note_was_successfully_added_to_the_zip_archive.
call fcn.0043e2e0
jmp 0x494cda
push 0
push str.Sossy__the_new_note_could_not_be_added_to_the_zip_archive.
call fcn.0043e2e0
jmp 0x494cda
cmp eax, dword [ebp - 0x4a0]
jne 0x493b07
push dword [ebp - 0x484]
mov edx, str.Hold_CTRL_down_to_select_several_files
lea ecx, [ebp - 0x38]
push 0
push 0
push 0x208
push str.All_files__._
push 0
call fcn.005e1e60
test al, al
je 0x494cda
lea ecx, [ebp - 0x38]
call fcn.005dbeb0
test al, al
jne 0x494cda
push 0
push str.Cancel
push 0
push 0xffffffffffffffba
sub esp, 8
mov dword [ebp - 0x438], 0
mov ecx, edi
push 0x46
push 0x1c2
push esi
push 0x62439c
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b64a0
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
lea ecx, [ebp - 0x38]
test eax, eax
je 0x493a59
call fcn.005dc3a0
mov esi, eax
lea ecx, [ebp - 0x38]
add esi, esi
call fcn.005dc190
add eax, 2
add esi, eax
mov ecx, esi
call fcn.005d8c40
test eax, eax
je 0x493a18
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x635758
push esi
push str.Compressing
lea ecx, [ebp - 0x64]
call fcn.005dc200
lea ecx, [ebp - 0x64]
call fcn.005dc190
push eax
push 0xffffffffffffffff
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0x624284
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc200
push 0
push dword [ebp - 0x448]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
mov ecx, esi
mov dword [ebp - 0x438], eax
call fcn.005d8c40
push 0
push 1
mov ecx, edi
lea esi, [esi + eax*2]
add esi, 2
call fcn.0043d720
test eax, eax
jne 0x493a18
mov ecx, esi
call fcn.005d8c40
test eax, eax
jne 0x493950
mov esi, dword [ebp - 0x44c]
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
cmp dword [ebp - 0x438], 0
je 0x494cda
mov ecx, dword [ebp - 0x43c]
xor edx, edx
push 0xfffffffffffffffe
call fcn.005c8de0
push dword [ebp - 0x438]
mov ecx, edi
call fcn.00490650
jmp 0x494cda
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x635758
sub esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Compressing
push 1
push 1
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc260
mov ecx, eax
call fcn.005dbf40
mov ecx, eax
call fcn.005da510
mov ecx, eax
call fcn.005da780
lea ecx, [ebp - 0x64]
call fcn.005dc190
push eax
push 0xffffffffffffffff
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push dword [ebp - 0x448]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
mov dword [ebp - 0x438], eax
jmp 0x493a1e
cmp eax, dword [ebp - 0x49c]
jne 0x493baa
push dword [ebp - 0x484]
push 0
push 1
push ecx
lea ecx, [ebp - 0x38]
call fcn.005dc400
mov edx, str.Select_a_folder_to_add_to_the_zip
mov ecx, eax
call fcn.005e1b00
test al, al
je 0x494cda
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x494cda
push 0
push dword [ebp - 0x448]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
mov dword [ebp - 0x3c], eax
test eax, eax
jle 0x493b9d
mov ecx, dword [ebp - 0x43c]
xor edx, edx
push 0xfffffffffffffffe
call fcn.005c8de0
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, edi
call fcn.00490650
jmp 0x494cda
mov ecx, dword [ebp - 0x434]
cmp eax, 0xfffffffb
jne 0x493d78
cmp dword [edi + 0x14b4], ecx
jne 0x493d78
mov ecx, esi
call fcn.005c57d0
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc1c0
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x494cda
xorps xmm0, xmm0
lea ecx, [ebp - 0x38]
push 1
push 0x62781c
movups xmmword [ebp - 0x1bc], xmm0
movq qword [ebp - 0x1ac], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1bc]
call fcn.005d92a0
push 0
push str.Cancel
push 0
push 0xffffffffffffffba
sub esp, 8
mov byte [ebp - 4], 0x15
mov ecx, edi
push 0x46
push 0x1c2
push esi
push 0x62439c
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b64a0
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x438], 0
call fcn.005d9210
test eax, eax
je 0x493d36
mov esi, dword [ebp - 0x438]
nop
push 1
push 1
push esi
lea ecx, [ebp - 0x1bc]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc260
mov ecx, eax
call fcn.005dbf40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x635758
lea ecx, [ebp - 0x64]
call fcn.005dc190
push eax
push str.Compressing
lea ecx, [ebp - 0x64]
call fcn.005dc200
lea ecx, [ebp - 0x64]
call fcn.005dc190
push eax
push 0xffffffffffffffff
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push dword [ebp - 0x448]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
push esi
lea ecx, [ebp - 0x1bc]
call fcn.005d9220
push eax
mov ecx, edi
call fcn.004906c0
push 0
push 1
mov ecx, edi
mov dword [ebp - 0x3c], eax
call fcn.0043d720
test eax, eax
jne 0x493d30
lea ecx, [ebp - 0x1bc]
inc esi
call fcn.005d9210
cmp esi, eax
jb 0x493c70
mov esi, dword [ebp - 0x44c]
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
mov eax, dword [ebp - 0x3c]
test eax, eax
jle 0x493d5c
mov ecx, dword [ebp - 0x43c]
xor edx, edx
push 0xfffffffffffffffe
call fcn.005c8de0
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, edi
call fcn.00490650
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 0x14
call fcn.005d9280
jmp 0x494cda
mov dword [ebp - 0x3c], eax
cmp eax, dword [ebp - 0x498]
jne 0x493f90
xorps xmm0, xmm0
push ecx
mov ecx, esi
movlpd qword [ebp - 0x6c], xmm0
call fcn.005bb7f0
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], 0
mov byte [ebp - 4], 0x16
cmp dword [eax], 1
jge 0x493dca
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push 0
push esi
push 0
push str.Please_select_a_file_to_delete_from_the_zip_before_using_this_feature._r_n_r_nTo_select_a_file__tick_the_corresponding_checkbox.
call fcn.0043e2e0
jmp 0x493e22
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, 0x62438c
mov eax, 0x677ea8
push str.form_the_zip_
cmovle eax, ecx
lea ecx, [ebp - 0x38]
push eax
push str.Are_you_sure_you_want_to_delete_the_selected_item
call fcn.005dc200
sub esp, 8
lea ecx, [ebp - 0x38]
push 0x8c
push 0x190
push 0
push esi
push 1
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043e2e0
test eax, eax
jne 0x493e37
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0041e1c3
add esp, 4
jmp 0x494cda
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x3c], 0
mov eax, dword [ecx]
test eax, eax
jle 0x493ec3
mov edi, eax
jmp 0x493e53
mov ecx, dword [ebp - 0x6c]
push 0
push dword [ecx + edi*4]
mov ecx, esi
push dword [ebp - 0x434]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc1c0
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x493eb8
lea ecx, [ebp - 0x48]
call fcn.005dc190
lea ecx, [ebp - 0x38]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0059e910
mov esi, dword [ebp - 0x44c]
test al, al
je 0x493eb5
mov eax, dword [ebp - 0x6c]
mov ecx, esi
push 0
push dword [eax + edi*4]
push dword [ebp - 0x434]
call fcn.005bb970
jmp 0x493eb8
inc dword [ebp - 0x3c]
dec edi
test edi, edi
jg 0x493e50
mov edi, dword [ebp - 0x460]
sub esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Current_zip_file_size:
push ecx
push 0
lea ecx, [ebp - 0x48]
call fcn.005dc190
mov ecx, eax
call fcn.005e0e70
push edx
push eax
lea ecx, [ebp - 0x38]
call fcn.005daea0
mov ecx, eax
call fcn.005da510
push 0
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
push dword [ebp - 0x440]
mov ecx, esi
call fcn.005bcd30
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x493f7c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
cmp ecx, 1
mov edx, 0x677ea8
push str.could_not_be_deleted_from_the_zip.
mov eax, 0x62438c
cmovne eax, edx
push eax
push str._item
push ecx
lea ecx, [ebp - 0x38]
call fcn.005db320
mov ecx, eax
call fcn.005da780
sub esp, 8
lea ecx, [ebp - 0x38]
push 0x8c
push 0x190
push 0
push esi
push 0
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043e2e0
mov byte [ebp - 4], 0x14
push dword [ebp - 0x6c]
call fcn.0041e1c3
add esp, 4
jmp 0x494cda
cmp eax, dword [ebp - 0x4b4]
jne 0x4940d2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__WriteSysInfo__NP__Passive
lea ecx, [edi + 0x1478]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc200
push 5
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc190
push eax
lea ecx, [edi + 0x1290]
call fcn.0057b4f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x68b210
push 0
lea ecx, [edi + 0x1290]
call fcn.0057bb00
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
push 0
push dword [ebp - 0x448]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x68b498
lea ecx, [edi + 0x15c]
mov esi, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc200
push 0
push dword [ebp - 0x448]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x444]
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004906c0
push esi
mov ecx, edi
call fcn.00490650
mov ecx, dword [ebp - 0x43c]
or edx, 0xffffffff
push 0xfffffffffffffffe
call fcn.005c8de0
mov esi, dword [ebp - 0x44c]
jmp 0x494cda
cmp eax, dword [ebp - 0x468]
je 0x4940fa
cmp eax, dword [ebp - 0x480]
je 0x4940fa
cmp eax, dword [edi + 0x11c0]
jne 0x494cda
mov byte [ebp - 0x42d], 1
jmp 0x494d1f
push 0
push ecx
mov ecx, edi
call fcn.00477170
test al, al
je 0x494cda
cmp dword [ebp - 0x464], 0
jne 0x494177
mov eax, dword [ebp - 0x468]
cmp dword [ebp - 0x3c], eax
je 0x494187
cmp dword [ebp - 0x4c], 0
jne 0x49414f
cmp dword [ebp - 0x54], 0
jne 0x49414f
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push 0
push esi
push 0
push str.You_need_to_select_either__Send_reports_by_email___or__Send_reports_to_your_ftp_server___or_both.
call fcn.0043e2e0
jmp 0x494cda
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push 0
push esi
push 1
push str.Are_you_sure_you_want_to_send_the_reports_
call fcn.0043e2e0
test eax, eax
je 0x494cda
jmp 0x494187
cmp dword [ebp - 0x4c], 0
jne 0x494187
cmp dword [ebp - 0x54], 0
je 0x494d1f
push dword [ebp - 0x478]
mov ecx, esi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x8c]
call fcn.005dc1c0
push dword [ebp - 0x470]
mov ecx, esi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x98]
call fcn.005dc1c0
push 0
push ecx
push dword [ebp - 0x46c]
xorps xmm0, xmm0
mov dword [ebp - 0x12c], 0
mov ecx, esi
movq qword [ebp - 0x134], xmm0
call fcn.005bc230
add esp, 4
lea ecx, [ebp - 0x134]
push eax
call fcn.005dc570
push dword [ebp - 0x494]
mov ecx, esi
mov byte [ebp - 4], 0x17
call fcn.005bc230
push eax
lea ecx, [ebp - 0xd8]
call fcn.005dc1c0
push dword [ebp - 0x4bc]
mov ecx, esi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x7c]
call fcn.005dc1c0
push dword [ebp - 0x4c0]
mov ecx, esi
call fcn.005bc230
push eax
lea ecx, [ebp - 0xfc]
call fcn.005dc1c0
push dword [ebp - 0x474]
mov ecx, esi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x11c]
call fcn.005dc1c0
mov eax, dword [ebp - 0x47c]
mov ecx, esi
push 4
push eax
call fcn.005bc500
neg eax
mov ecx, esi
push 4
sbb eax, eax
neg eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x488]
push eax
call fcn.005bc500
neg eax
mov ecx, esi
push 4
push dword [ebp - 0x4c4]
sbb eax, eax
neg eax
mov dword [ebp - 0x54], eax
call fcn.005bc500
neg eax
lea ecx, [ebp - 0x134]
push 0x6c22f0
sbb eax, eax
neg eax
mov dword [ebp - 0xb4], eax
call fcn.005dc4c0
mov ecx, dword [ebp - 0xb4]
movzx eax, al
neg ecx
push 4
push dword [ebp - 0x4ac]
sbb ecx, ecx
and ecx, 2
or ecx, eax
mov dword [ebp - 0x68], ecx
mov ecx, esi
call fcn.005bc500
neg eax
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x468]
cmp dword [ebp - 0x3c], eax
jne 0x494516
lea eax, [ebp - 0x4c]
push eax
push 4
push str.SendEmail
lea ecx, [ebp - 0x2c]
call fcn.005d5f20
push 0
lea ecx, [ebp - 0x8c]
call fcn.005dc190
push eax
push 1
push str.Subject
lea ecx, [ebp - 0x2c]
call fcn.005d5f20
push 0xfde9
lea edx, [ebp - 0xc0]
lea ecx, [ebp - 0x98]
call fcn.00477490
push 0
lea ecx, [ebp - 0xc0]
call fcn.005dc190
push eax
push 1
push str.EmailAddress
lea ecx, [ebp - 0x2c]
call fcn.005d5f20
push 4
push dword [ebp - 0x45c]
mov ecx, esi
call fcn.005bc500
neg eax
lea ecx, [ebp - 0x2c]
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
push eax
push 4
push str.ShowEmailChars
call fcn.005d5f20
push 0
lea eax, [ebp - 0x54]
push eax
push 4
push str.SendFTP
lea ecx, [ebp - 0x2c]
call fcn.005d5f20
push 0
lea ecx, [ebp - 0x134]
call fcn.005dc190
push eax
push 1
push str.FTPType
lea ecx, [ebp - 0x2c]
call fcn.005d5f20
push 0
lea eax, [ebp - 0xb4]
push eax
push 4
push str.FTPPassive
lea ecx, [ebp - 0x2c]
call fcn.005d5f20
push 0xfde9
lea edx, [ebp - 0xcc]
lea ecx, [ebp - 0xd8]
call fcn.00477490
push 0
lea ecx, [ebp - 0xcc]
call fcn.005dc190
push eax
push 1
push str.FTPServer
lea ecx, [ebp - 0x2c]
call fcn.005d5f20
push 0xfde9
lea edx, [ebp - 0xe4]
lea ecx, [ebp - 0x7c]
call fcn.00477490
push 0
lea ecx, [ebp - 0xe4]
call fcn.005dc190
push eax
push 1
push str.FTPLocation
lea ecx, [ebp - 0x2c]
call fcn.005d5f20
push 0xfde9
lea edx, [ebp - 0xf0]
lea ecx, [ebp - 0xfc]
call fcn.00477490
push 0
lea ecx, [ebp - 0xf0]
call fcn.005dc190
push eax
push 1
push str.FTPUser
lea ecx, [ebp - 0x2c]
call fcn.005d5f20
ret
sbb dl, byte [eax + eax]
push 0xfde9
lea edx, [ebp - 0x108]
lea ecx, [ebp - 0x11c]
call fcn.00477490
push 0
lea ecx, [ebp - 0x108]
call fcn.005dc190
push eax
push 1
push str.FTPPass
lea ecx, [ebp - 0x2c]
call fcn.005d5f20
push 4
push dword [ebp - 0x450]
mov ecx, esi
call fcn.005bc500
neg eax
lea ecx, [ebp - 0x2c]
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
push eax
push 4
push str.ShowFTPPass
call fcn.005d5f20
push 0
lea eax, [ebp - 0x70]
push eax
push 4
push str.DeleteAfterSending
lea ecx, [ebp - 0x2c]
call fcn.005d5f20
sub esp, 8
mov ecx, str.The_current_email_and_FTP_settings_were_securely_saved._r_n_r_nYou_can_save_the_settings_to_a_file__in_the__Options__module__and_load_back_them_when_you_install_the_application.
test al, al
mov eax, str.Some_settings_could_not_be_saved.
cmove ecx, eax
push 0x8c
push 0x190
push 0
push esi
push 4
push ecx
mov ecx, edi
call fcn.0043e2e0
lea ecx, [ebp - 0x134]
mov byte [ebp - 0x451], 1
mov byte [ebp - 4], 0x14
call fcn.005dc430
jmp 0x494cda
push 0xffffffffffffffba
sub esp, 8
mov ecx, edi
push 0x46
push 0x1c2
push esi
push 0
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x120], 0
push str.Report_sending_result:
lea ecx, [ebp - 0x128]
movq qword [ebp - 0x128], xmm0
call fcn.005dc570
mov byte [ebp - 4], 0x18
cmp dword [ebp - 0x4c], 0
mov dword [ebp - 0x438], 0
je 0x494915
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057c300
push eax
push 0x624284
lea ecx, [edi + 0x198]
call fcn.005dc190
push eax
push str._from
lea ecx, [ebp - 0x8c]
call fcn.005da780
push str.Sending_reports_to_your_email_address...
push 0xffffffffffffffff
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
lea ecx, [edi + 0x114]
call fcn.005dc190
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005909d0
mov esi, eax
mov dword [ebp - 0x438], esi
test esi, esi
jne 0x49484b
xorps xmm0, xmm0
mov dword [ebp - 0x16c], eax
lea ecx, [ebp - 0x174]
movq qword [ebp - 0x174], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x184], esi
lea ecx, [ebp - 0x18c]
movq qword [ebp - 0x18c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x178], esi
lea ecx, [ebp - 0x180]
movq qword [ebp - 0x180], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x160], esi
lea ecx, [ebp - 0x168]
movq qword [ebp - 0x168], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x154], esi
lea ecx, [ebp - 0x15c]
movq qword [ebp - 0x15c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x148], esi
lea ecx, [ebp - 0x150]
movq qword [ebp - 0x150], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x19c], esi
lea ecx, [ebp - 0x1a4]
movq qword [ebp - 0x1a4], xmm0
call fcn.005dc5e0
push 1
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x1f
call fcn.005dc190
push eax
lea ecx, [ebp - 0x180]
call fcn.005dc260
mov ecx, eax
call fcn.005dbf40
push 0x1b5
lea edx, [ebp - 0x15c]
lea ecx, [edi + 0x114]
call fcn.00477490
push 0x1b5
lea edx, [ebp - 0x174]
lea ecx, [ebp - 0x8c]
call fcn.00477490
push 0x1b5
lea edx, [ebp - 0x168]
lea ecx, [ebp - 0x180]
call fcn.00477490
push 0x1b5
lea edx, [ebp - 0x18c]
lea ecx, [ebp - 0x98]
call fcn.00477490
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x18c]
call fcn.005dc190
push eax
push str.email
lea ecx, [ebp - 0x168]
call fcn.005dc190
push eax
push str.fname
lea ecx, [ebp - 0x174]
call fcn.005dc190
push eax
push str.subject
lea ecx, [ebp - 0x15c]
call fcn.005dc190
push eax
push str.https:__www.carifred.com_uvk_reporting_index.php_user
lea ecx, [ebp - 0x150]
call fcn.005dc200
push esi
push esi
push str.https:__www.carifred.com
push ecx
push 7
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x3c], esi
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005b40e0
push eax
lea ecx, [ebp - 0x3c]
call fcn.005b0bd0
push 5
mov byte [ebp - 4], 0x20
call fcn.005b0b60
test eax, eax
jne 0x4947e7
push eax
push 1
push 1
push eax
push 0x628f54
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.005b0b50
push eax
lea ecx, [ebp - 0x1a4]
call fcn.005d9e30
mov ecx, eax
call fcn.005daa70
test eax, eax
jne 0x4947ec
mov esi, 5
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x438], esi
call fcn.005b0bc0
lea ecx, [ebp - 0x1a4]
call fcn.005dc430
lea ecx, [ebp - 0x150]
call fcn.005dc430
lea ecx, [ebp - 0x15c]
call fcn.005dc430
lea ecx, [ebp - 0x168]
call fcn.005dc430
lea ecx, [ebp - 0x180]
call fcn.005dc430
lea ecx, [ebp - 0x18c]
call fcn.005dc430
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 0x18
call fcn.005dc430
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x494915
test esi, esi
jne 0x4948cc
xor edx, edx
lea ecx, [ebp - 0x38]
call fcn.005cf610
push esi
push 3
lea ecx, [ebp - 0x38]
call fcn.005da0f0
mov ecx, eax
call fcn.005dc190
push eax
push 1
push str.LastEmailSent
lea ecx, [ebp - 0x2c]
call fcn.005d5f20
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x627930
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
push str.Email_options:__last_report_emailed_at
lea ecx, [ebp - 0x38]
call fcn.005dc200
push esi
lea ecx, [ebp - 0x38]
call fcn.005dc190
mov ecx, dword [ebp - 0x44c]
push eax
push dword [ebp - 0x4b0]
call fcn.005bcd30
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x494915
push 0
push 0
push 0
lea edx, [ebp - 0x38]
mov ecx, esi
call fcn.00477400
push eax
mov ecx, edi
call fcn.0045a700
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
push 0x629230
lea ecx, [ebp - 0x128]
call fcn.005da780
xor esi, esi
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x54], esi
je 0x494af5
xorps xmm0, xmm0
mov dword [ebp - 0x190], esi
lea ecx, [ebp - 0x198]
movq qword [ebp - 0x198], xmm0
call fcn.005dc5e0
push 1
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x21
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc260
push str..zip
push 1
push 1
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc260
mov ecx, eax
call fcn.005dc030
mov ecx, eax
call fcn.005dc4c0
test al, al
je 0x4949c9
push esi
push 1
push 0xffffffffffffffff
push 1
push 0x6287bc
lea ecx, [ebp - 0x7c]
call fcn.005daa70
mov esi, eax
push 0
lea ecx, [esi + 1]
push ecx
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x198]
call fcn.005d9d20
lea ecx, [ebp - 0x7c]
test esi, esi
je 0x4949c4
lea eax, [esi - 1]
push eax
call fcn.005dae00
jmp 0x4949c9
call fcn.005dc400
push str.Sending_reports_to_your_FTP_server...
push 0xffffffffffffffff
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push dword [ebp - 0x68]
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x198]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x11c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xfc]
call fcn.005dc190
lea ecx, [ebp - 0xd8]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005b2c90
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
jne 0x494aa1
xor edx, edx
lea ecx, [ebp - 0x38]
call fcn.005cf610
push esi
push 3
lea ecx, [ebp - 0x38]
call fcn.005da0f0
mov ecx, eax
call fcn.005dc190
push eax
push 1
push str.LastFTPUpload
lea ecx, [ebp - 0x2c]
call fcn.005d5f20
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x627930
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
push str.FTP_options:__last_FTP_report_sent_at
lea ecx, [ebp - 0x38]
call fcn.005dc200
push esi
lea ecx, [ebp - 0x38]
call fcn.005dc190
mov ecx, dword [ebp - 0x44c]
push eax
push dword [ebp - 0x4b8]
call fcn.005bcd30
push 0
push 0
push 0
lea edx, [ebp - 0x38]
mov ecx, esi
call fcn.00477370
push eax
mov ecx, edi
call fcn.0045a700
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
push 0x629230
lea ecx, [ebp - 0x128]
call fcn.005da780
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0x18
call fcn.005dc430
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
cmp dword [ebp - 0x70], 0
mov ecx, dword [ebp - 0x438]
je 0x494c23
lea eax, [ecx + esi]
test eax, eax
jne 0x494c23
push eax
push eax
push 0x1004
push dword [ebp - 0x43c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [ebp - 0x44c]
sub eax, 1
mov dword [ebp - 0x68], eax
js 0x494c1b
mov edi, eax
push 1
push edi
push dword [ebp - 0x434]
mov ecx, esi
call fcn.005bb510
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc1c0
sub esp, 0xc
lea ecx, [ebp - 0x64]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624284
call fcn.005dc190
push eax
push 0
push edi
push dword [ebp - 0x434]
mov ecx, esi
call fcn.005bb510
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc1c0
mov ecx, eax
call fcn.005da510
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x494c0c
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x494bfc
lea ecx, [ebp - 0x38]
call fcn.005dc190
mov ecx, eax
call fcn.005e71d0
test al, al
jne 0x494c0c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6249f8
lea ecx, [ebp - 0x38]
call fcn.005da780
push 0
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
call fcn.005771e0
sub edi, 1
jns 0x494b44
mov edi, dword [ebp - 0x460]
mov ecx, dword [ebp - 0x438]
jmp 0x494c29
mov esi, dword [ebp - 0x44c]
cmp dword [ebp - 0x464], 0
jne 0x494cf8
sub esp, 8
lea ecx, [ebp - 0x128]
push 0x8c
push 0x190
push 0
push esi
push 4
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043e2e0
lea ecx, [ebp - 0x128]
call fcn.005dc430
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 0x14
call fcn.005dc430
jmp 0x494cda
cmp eax, dword [ebp - 0x45c]
mov ecx, dword [ebp - 0x474]
cmove ecx, dword [ebp - 0x470]
push 4
mov dword [ebp - 0x3c], ecx
mov ecx, esi
push eax
call fcn.005bc500
test eax, eax
je 0x494ca2
xor eax, eax
jmp 0x494cab
mov eax, dword [ebp - 0x48c]
movzx eax, ax
push 0
movzx eax, ax
mov ecx, esi
push eax
push 0xcc
push dword [ebp - 0x3c]
call fcn.005befd0
push ecx
push dword [ebp - 0x3c]
mov ecx, esi
call fcn.005bf010
push 0x80
push dword [ebp - 0x3c]
mov ecx, esi
call fcn.005bd3f0
push 0
mov ecx, edi
call fcn.004771c0
test eax, eax
je 0x494d1f
mov ecx, dword [ebp - 0x490]
mov edx, dword [ebp - 0x458]
jmp 0x4936e0
mov eax, dword [ebp - 0x3c]
add eax, ecx
lea ecx, [ebp - 0x128]
neg eax
sbb eax, eax
inc eax
mov dword [edi + 0x6c], eax
call fcn.005dc430
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 0x14
call fcn.005dc430
cmp byte [edi + 0x13d8], 0
mov dword [ebp - 0x80], 0
je 0x494dcc
mov eax, dword [edi + 0x1f74]
and al, 3
cmp al, 1
jne 0x494dcc
cmp byte [ebp - 0x451], 0
je 0x494dcc
lea eax, [ebp - 0x80]
push eax
push str.SkipSettingsChangedWarning
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x58]
call fcn.005d6580
test al, al
je 0x494d74
cmp dword [ebp - 0x80], 0
jne 0x494dcc
push 1
mov ecx, edi
call fcn.004771c0
test eax, eax
jne 0x494d74
push eax
push 0xaa
push 0x190
push ecx
push 2
push str.You_are_using_CloudSync_to_load_settings_from_the_cloud._If_you_dont_upload_your_saved_changes_to_the_cloud_now__they_will_be_discarded_the_next_time_you_launch_this_application._r_n_r_nDo_you_want_to_upload_your_new_settings_to_the_cloud_now_
mov ecx, edi
call fcn.0043ddd0
test al, 1
je 0x494dac
push 2
push 0
mov ecx, edi
call fcn.0046f640
jmp 0x494dcc
test al, 4
je 0x494dcc
push 0
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 1
push eax
push 4
push str.SkipSettingsChangedWarning
lea ecx, [ebp - 0x58]
call fcn.005d5f20
push 3
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
call fcn.005771e0
mov al, byte [ebp - 0x42d]
mov ecx, edi
xor al, 1
movzx eax, al
push eax
call fcn.0045f260
mov eax, dword [ebp - 0x1d0]
cmp eax, 0xffffffff
je 0x494e01
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x42c]
call fcn.005d6ab0
lea ecx, [ebp - 0xb0]
call fcn.005dc430
lea ecx, [ebp - 0x48]
call fcn.005dc430
lea ecx, [ebp - 0x11c]
call fcn.005dc430
lea ecx, [ebp - 0x108]
call fcn.005dc430
lea ecx, [ebp - 0xfc]
call fcn.005dc430
lea ecx, [ebp - 0xf0]
call fcn.005dc430
lea ecx, [ebp - 0x7c]
call fcn.005dc430
lea ecx, [ebp - 0xe4]
call fcn.005dc430
lea ecx, [ebp - 0xd8]
call fcn.005dc430
lea ecx, [ebp - 0xcc]
call fcn.005dc430
lea ecx, [ebp - 0x140]
call fcn.005dc430
lea ecx, [ebp - 0xa4]
call fcn.005dc430
lea ecx, [ebp - 0x98]
call fcn.005dc430
lea ecx, [ebp - 0xc0]
call fcn.005dc430
lea ecx, [ebp - 0x8c]
call fcn.005dc430
lea ecx, [ebp - 0x58]
call fcn.005d69e0
lea ecx, [ebp - 0x2c]
call fcn.005d69e0
lea ecx, [ebp - 0x64]
call fcn.005dc430
lea ecx, [ebp - 0x38]
call fcn.005dc430
mov al, byte [ebp - 0x42d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret