Function at 0x4952a0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Create directory
Create thread
Delete registry key
Get common file path
Get number of processors
Get process heap flags
Get process heap force flags
Parse pe header
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x615c79
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x21e0
call fcn.005c95e0
mov eax, dword [0x711ab8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x205c], esi
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [ebp - 4], ebx
lea eax, [esi + 0x24]
push eax
call fcn.0040b8d0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x28]
push ecx
call fcn.0040b8d0
mov byte [ebp - 4], 2
lea eax, [esi + 0x2c]
mov dword [ebp - 0x204c], eax
mov dword [eax], 0x70f094
mov edx, 0x70f094
mov eax, 1
lock xadd dword [edx], eax
mov byte [ebp - 4], 4
lea eax, [esi + 0x30]
mov dword [ebp - 0x204c], eax
mov dword [eax], edx
mov ecx, edx
mov edx, 1
lock xadd dword [ecx], edx
mov byte [ebp - 4], 6
lea eax, [esi + 0x34]
mov dword [ebp - 0x204c], eax
mov dword [eax], ecx
mov eax, ecx
mov ecx, 1
lock xadd dword [eax], ecx
mov byte [ebp - 4], 8
lea eax, [esi + 0x38]
mov dword [ebp - 0x204c], eax
mov dword [eax], 0x70f094
mov edx, 0x70f094
mov eax, 1
lock xadd dword [edx], eax
mov byte [ebp - 4], 0xa
lea eax, [esi + 0x3c]
mov dword [ebp - 0x204c], eax
mov dword [eax], edx
mov ecx, edx
mov edx, 1
lock xadd dword [ecx], edx
mov byte [ebp - 4], 0xc
lea eax, [esi + 0x40]
mov dword [ebp - 0x204c], eax
mov dword [eax], ecx
mov eax, ecx
mov ecx, 1
lock xadd dword [eax], ecx
mov byte [ebp - 4], 0xe
lea eax, [esi + 0x44]
mov dword [ebp - 0x204c], eax
mov dword [eax], 0x70f094
mov edx, 0x70f094
mov eax, 1
lock xadd dword [edx], eax
mov byte [ebp - 4], 0x10
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x68], bl
mov dword [esi + 0x6c], 0xffffffff
mov dword [esi + 0x70], 0xd
mov dword [esi + 0x74], 0x1e
mov dword [esi + 0x78], ebx
mov byte [esi + 0x7c], bl
mov dword [esi + 0x80], 1
mov byte [esi + 0x84], 1
lea ecx, [esi + 0x88]
push ecx
mov ecx, 0x6d6e0c
call fcn.0040b990
mov byte [ebp - 4], 0x11
lea edi, [esi + 0x8c]
mov dword [ebp - 0x204c], edi
mov dword [edi], 0x70f094
mov edx, 0x70f094
mov eax, 1
lock xadd dword [edx], eax
mov byte [ebp - 4], 0x13
mov dword [esi + 0x90], 1
lea ecx, [esi + 0x94]
push ecx
call fcn.004af1d0
mov byte [ebp - 4], 0x14
lea eax, [esi + 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x15
mov dword [esi + 0xcc], ebx
lea eax, [esi + 0xd0]
mov dword [ebp - 0x2198], eax
push eax
call fcn.00425110
mov byte [ebp - 4], 0x16
lea eax, [esi + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x17
lea edx, [esi + 0x108]
push edx
call fcn.004af3a0
mov byte [ebp - 4], 0x18
lea eax, [esi + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x19
mov dword [esi + 0x140], 0x64
mov dword [esi + 0x144], ebx
mov bl, 0x1a
mov byte [ebp - 4], bl
push 0x494d30
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.0041e020
call fcn.004bdc40
push 4
call fcn.005c39f5
add esp, 4
mov dword [ebp - 0x2110], eax
mov byte [ebp - 4], 0x1b
test eax, eax
je 0x495515
mov dword [eax], 0
push eax
push 0x6d99b0
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov eax, dword [ebp - 0x2110]
jmp 0x495517
xor eax, eax
mov byte [ebp - 4], bl
mov dword [0x729b74], eax
call fcn.00458ec0
call fcn.00494d70
call fcn.0045c4b0
push 0xffffffffffffffff
push 0x6d6f10
call fcn.00502e60
mov dword [ebp - 0x211c], eax
mov byte [ebp - 4], 0x1c
push 0xffffffffffffffff
push 0x6d6f0c
call fcn.00502e60
mov dword [ebp - 0x2114], eax
mov byte [ebp - 4], 0x1d
push 0xffffffffffffffff
push 0x6d6f08
call fcn.00502e60
mov dword [ebp - 0x210c], eax
mov byte [ebp - 4], 0x1e
push 0xffffffffffffffff
push 0x6d6f04
call fcn.00502e60
mov dword [ebp - 0x2104], eax
mov byte [ebp - 4], 0x1f
push 0xffffffffffffffff
push 0x6d6f00
call fcn.00502e60
mov dword [ebp - 0x20fc], eax
mov byte [ebp - 4], 0x20
push 0xffffffffffffffff
push 0x6d6efc
call fcn.00502e60
mov dword [ebp - 0x20f4], eax
mov byte [ebp - 4], 0x21
push 0xffffffffffffffff
push 0x6d6ef8
call fcn.00502e60
mov dword [ebp - 0x20ec], eax
mov byte [ebp - 4], 0x22
push 0xffffffffffffffff
push 0x6d6ef4
call fcn.00502e60
add esp, 0x40
mov dword [ebp - 0x20e4], eax
mov byte [ebp - 4], 0x23
push 0xffffffffffffffff
push 0x6d6ef0
call fcn.00502e60
mov dword [ebp - 0x20dc], eax
mov byte [ebp - 4], 0x24
push 0xffffffffffffffff
push 0x6d6eec
call fcn.00502e60
mov dword [ebp - 0x20d4], eax
mov byte [ebp - 4], 0x25
push 0xffffffffffffffff
push 0x6d6ee8
call fcn.00502e60
mov dword [ebp - 0x20cc], eax
mov byte [ebp - 4], 0x26
push 0xffffffffffffffff
push 0x6d6ee4
call fcn.00502e60
mov dword [ebp - 0x20c4], eax
mov byte [ebp - 4], 0x27
push 0xffffffffffffffff
push 0x6d6ee0
call fcn.00502e60
mov dword [ebp - 0x20bc], eax
mov byte [ebp - 4], 0x28
push 0xffffffffffffffff
push 0x6d6edc
call fcn.00502e60
mov dword [ebp - 0x20b4], eax
mov byte [ebp - 4], 0x29
push 0xffffffffffffffff
push 0x6d6ed8
call fcn.00502e60
mov dword [ebp - 0x20b0], eax
mov byte [ebp - 4], 0x2a
push 0xffffffffffffffff
push 0x6d6ed4
call fcn.00502e60
add esp, 0x40
mov dword [ebp - 0x2160], eax
mov byte [ebp - 4], 0x2b
push 0xffffffffffffffff
push 0x6d6ed0
call fcn.00502e60
mov dword [ebp - 0x2108], eax
mov byte [ebp - 4], 0x2c
push 0xffffffffffffffff
push 0x6d6ecc
call fcn.00502e60
mov dword [ebp - 0x2138], eax
mov byte [ebp - 4], 0x2d
push 0xffffffffffffffff
push 0x6d6ec8
call fcn.00502e60
mov dword [ebp - 0x2100], eax
mov byte [ebp - 4], 0x2e
push 0xffffffffffffffff
push 0x6d6ec4
call fcn.00502e60
mov dword [ebp - 0x2150], eax
mov byte [ebp - 4], 0x2f
push 0xffffffffffffffff
push 0x6d6ec0
call fcn.00502e60
mov dword [ebp - 0x20f8], eax
mov byte [ebp - 4], 0x30
push 0xffffffffffffffff
push 0x6d6ebc
call fcn.00502e60
mov dword [ebp - 0x2130], eax
mov byte [ebp - 4], 0x31
push 0xffffffffffffffff
push 0x6d6eb8
call fcn.00502e60
mov dword [ebp - 0x20f0], eax
mov byte [ebp - 4], 0x32
push 0xffffffffffffffff
push 0x6d6eb4
call fcn.00502e60
add esp, 0x40
mov dword [ebp - 0x2168], eax
mov byte [ebp - 4], 0x33
push 0xffffffffffffffff
push 0x6d6eb0
call fcn.00502e60
mov dword [ebp - 0x20e8], eax
mov byte [ebp - 4], 0x34
push 0xffffffffffffffff
push 0x6d6eac
call fcn.00502e60
mov dword [ebp - 0x2128], eax
mov byte [ebp - 4], 0x35
push 0xffffffffffffffff
push 0x6d6ea8
call fcn.00502e60
mov dword [ebp - 0x20e0], eax
mov byte [ebp - 4], 0x36
push 0xffffffffffffffff
push 0x6d6ea4
call fcn.00502e60
mov dword [ebp - 0x2148], eax
mov byte [ebp - 4], 0x37
push 0xffffffffffffffff
push 0x6d6ea0
call fcn.00502e60
mov dword [ebp - 0x20d8], eax
mov byte [ebp - 4], 0x38
push 0xffffffffffffffff
push 0x6d6e9c
call fcn.00502e60
mov dword [ebp - 0x2120], eax
mov byte [ebp - 4], 0x39
push 0xffffffffffffffff
push 0x6d6e98
call fcn.00502e60
mov dword [ebp - 0x20d0], eax
mov byte [ebp - 4], 0x3a
push 0xffffffffffffffff
push 0x6d6e94
call fcn.00502e60
add esp, 0x40
mov dword [ebp - 0x2158], eax
mov byte [ebp - 4], 0x3b
push 0xffffffffffffffff
push 0x6d6e90
call fcn.00502e60
mov dword [ebp - 0x20c8], eax
mov byte [ebp - 4], 0x3c
push 0xffffffffffffffff
push 0x6d6e8c
call fcn.00502e60
mov dword [ebp - 0x2118], eax
mov byte [ebp - 4], 0x3d
push 0xffffffffffffffff
push 0x6d6e88
call fcn.00502e60
mov dword [ebp - 0x20c0], eax
mov byte [ebp - 4], 0x3e
push 0xffffffffffffffff
push 0x6d6e84
call fcn.00502e60
mov dword [ebp - 0x2140], eax
mov byte [ebp - 4], 0x3f
push 0xffffffffffffffff
push 0x6d6e80
call fcn.00502e60
mov dword [ebp - 0x2134], eax
mov byte [ebp - 4], 0x40
push 0xffffffffffffffff
push 0x6d6e7c
call fcn.00502e60
mov dword [ebp - 0x20b8], eax
mov byte [ebp - 4], 0x41
push 0xffffffffffffffff
push 0x6d6e78
call fcn.00502e60
mov dword [ebp - 0x216c], eax
mov byte [ebp - 4], 0x42
push 0xffffffffffffffff
push 0x6d6e74
call fcn.00502e60
add esp, 0x40
mov dword [ebp - 0x2164], eax
mov byte [ebp - 4], 0x43
push 0xffffffffffffffff
push 0x6d6e70
call fcn.00502e60
mov dword [ebp - 0x215c], eax
mov byte [ebp - 4], 0x44
push 0xffffffffffffffff
push str.HTML
call fcn.00502e60
mov dword [ebp - 0x2154], eax
mov byte [ebp - 4], 0x45
push 0xffffffffffffffff
push 0x6d6e64
call fcn.00502e60
mov dword [ebp - 0x214c], eax
mov byte [ebp - 4], 0x46
push 0xffffffffffffffff
push 0x6d6e60
call fcn.00502e60
mov dword [ebp - 0x2144], eax
mov byte [ebp - 4], 0x47
push 0xffffffffffffffff
push 0x6d6e5c
call fcn.00502e60
mov dword [ebp - 0x213c], eax
mov byte [ebp - 4], 0x48
push 0xffffffffffffffff
push 0x6d6e58
call fcn.00502e60
mov dword [ebp - 0x2064], eax
mov byte [ebp - 4], 0x49
push 0xffffffffffffffff
push 0x6d6e54
call fcn.00502e60
mov dword [ebp - 0x2088], eax
mov byte [ebp - 4], 0x4a
push 0xffffffffffffffff
push 0x6d6e50
call fcn.00502e60
add esp, 0x40
mov dword [ebp - 0x2098], eax
mov byte [ebp - 4], 0x4b
push 0xffffffffffffffff
push 0x6d6e4c
call fcn.00502e60
mov dword [ebp - 0x2080], eax
mov byte [ebp - 4], 0x4c
push 0xffffffffffffffff
push 0x6d6e48
call fcn.00502e60
mov dword [ebp - 0x20a0], eax
mov byte [ebp - 4], 0x4d
push 0xffffffffffffffff
push 0x6d6e44
call fcn.00502e60
mov dword [ebp - 0x2078], eax
mov byte [ebp - 4], 0x4e
push 0xffffffffffffffff
push 0x6d6e40
call fcn.00502e60
mov dword [ebp - 0x2090], eax
mov byte [ebp - 4], 0x4f
push 0xffffffffffffffff
push 0x6d6e3c
call fcn.00502e60
mov dword [ebp - 0x2070], eax
mov byte [ebp - 4], 0x50
push 0xffffffffffffffff
push 0x6d6e38
call fcn.00502e60
mov dword [ebp - 0x2060], eax
mov byte [ebp - 4], 0x51
push 0xffffffffffffffff
push 0x6d6e34
call fcn.00502e60
mov dword [ebp - 0x2068], eax
mov byte [ebp - 4], 0x52
push 0xffffffffffffffff
push 0x6d6e30
call fcn.00502e60
add esp, 0x40
mov dword [ebp - 0x20ac], eax
mov byte [ebp - 4], 0x53
push 0xffffffffffffffff
push 0x6d6e2c
call fcn.00502e60
mov dword [ebp - 0x20a4], eax
mov byte [ebp - 4], 0x54
push 0xffffffffffffffff
push 0x6d6e28
call fcn.00502e60
mov dword [ebp - 0x209c], eax
mov byte [ebp - 4], 0x55
push 0xffffffffffffffff
push 0x6d6e24
call fcn.00502e60
mov dword [ebp - 0x2094], eax
mov byte [ebp - 4], 0x56
push 0xffffffffffffffff
push 0x6d6e20
call fcn.00502e60
mov dword [ebp - 0x208c], eax
mov byte [ebp - 4], 0x57
push 0xffffffffffffffff
push 0x6d6e1c
call fcn.00502e60
mov dword [ebp - 0x2084], eax
mov byte [ebp - 4], 0x58
push 0xffffffffffffffff
push 0x6d6e18
call fcn.00502e60
mov dword [ebp - 0x207c], eax
mov byte [ebp - 4], 0x59
push 0xffffffffffffffff
push 0x6d6e14
call fcn.00502e60
mov dword [ebp - 0x2074], eax
mov byte [ebp - 4], 0x5a
push 0xffffffffffffffff
push 0x6d6e10
call fcn.00502e60
add esp, 0x40
mov dword [ebp - 0x20a8], eax
mov byte [ebp - 4], 0x5b
mov eax, edi
mov dword [ebp - 0x203c], eax
mov eax, dword [eax]
mov eax, dword [eax]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp eax, 1
je 0x495afc
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x20a8]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495b1e
lea edx, [ebp - 0x20a8]
push edx
lea eax, [ebp - 0x2170]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x2170]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495b4c
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x2074]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495b6e
lea edx, [ebp - 0x2074]
push edx
lea eax, [ebp - 0x219c]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x219c]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495b9c
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x207c]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495bbe
lea edx, [ebp - 0x207c]
push edx
lea eax, [ebp - 0x21a0]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x21a0]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495bec
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x2084]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495c0e
lea edx, [ebp - 0x2084]
push edx
lea eax, [ebp - 0x21c4]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x21c4]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495c3c
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x208c]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495c5e
lea edx, [ebp - 0x208c]
push edx
lea eax, [ebp - 0x21cc]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x21cc]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495c8c
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x2094]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495cae
lea edx, [ebp - 0x2094]
push edx
lea eax, [ebp - 0x21d4]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x21d4]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495cdc
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x209c]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495cfe
lea edx, [ebp - 0x209c]
push edx
lea eax, [ebp - 0x21dc]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x21dc]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495d2c
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x20a4]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495d4e
lea edx, [ebp - 0x20a4]
push edx
lea eax, [ebp - 0x21e4]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x21e4]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495d7c
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x20ac]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495d9e
lea edx, [ebp - 0x20ac]
push edx
lea eax, [ebp - 0x21d8]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x21d8]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495dcc
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x2068]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495dee
lea edx, [ebp - 0x2068]
push edx
lea eax, [ebp - 0x21bc]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x21bc]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495e1c
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x2060]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495e3e
lea edx, [ebp - 0x2060]
push edx
lea eax, [ebp - 0x217c]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x217c]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495e6c
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x2070]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495e8e
lea edx, [ebp - 0x2070]
push edx
lea eax, [ebp - 0x21b8]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x21b8]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495ebc
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x2090]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495ede
lea edx, [ebp - 0x2090]
push edx
lea eax, [ebp - 0x2184]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x2184]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495f0c
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x2078]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495f2e
lea edx, [ebp - 0x2078]
push edx
lea eax, [ebp - 0x21d0]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x21d0]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495f5c
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x20a0]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495f7e
lea edx, [ebp - 0x20a0]
push edx
lea eax, [ebp - 0x218c]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x218c]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495fac
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x2080]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x495fce
lea edx, [ebp - 0x2080]
push edx
lea eax, [ebp - 0x21c0]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x21c0]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x495ffc
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x2098]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x49601e
lea edx, [ebp - 0x2098]
push edx
lea eax, [ebp - 0x2194]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x2194]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x49604c
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x2088]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x49606e
lea edx, [ebp - 0x2088]
push edx
lea eax, [ebp - 0x21e0]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x21e0]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x49609c
push 1
push closesocket
call fcn.00402330
lea ecx, [ebp - 0x2064]
push ecx
push eax
mov ecx, edi
call fcn.00402450
jmp 0x4960be
lea edx, [ebp - 0x2064]
push edx
lea eax, [ebp - 0x2040]
push eax
call fcn.00402450
mov ecx, edi
call fcn.004fc280
mov ecx, dword [ebp - 0x2040]
mov dword [eax], ecx
lea edx, [ebp - 0x211c]
push edx
lea eax, [ebp - 0x2114]
push eax
lea ecx, [ebp - 0x210c]
push ecx
lea edx, [ebp - 0x2104]
push edx
lea eax, [ebp - 0x20fc]
push eax
lea ecx, [ebp - 0x20f4]
push ecx
lea edx, [ebp - 0x20ec]
push edx
lea eax, [ebp - 0x20e4]
push eax
lea ecx, [ebp - 0x20dc]
push ecx
lea edx, [ebp - 0x20d4]
push edx
lea eax, [ebp - 0x20cc]
push eax
lea ecx, [ebp - 0x20c4]
push ecx
lea edx, [ebp - 0x20bc]
push edx
lea eax, [ebp - 0x20b4]
push eax
lea ecx, [ebp - 0x20b0]
push ecx
lea edx, [ebp - 0x2160]
push edx
lea eax, [ebp - 0x2108]
push eax
lea ecx, [ebp - 0x2138]
push ecx
lea edx, [ebp - 0x2100]
push edx
lea eax, [ebp - 0x2150]
push eax
lea ecx, [ebp - 0x20f8]
push ecx
lea edx, [ebp - 0x2130]
push edx
lea eax, [ebp - 0x20f0]
push eax
lea ecx, [ebp - 0x2168]
push ecx
lea edx, [ebp - 0x20e8]
push edx
lea eax, [ebp - 0x2128]
push eax
lea ecx, [ebp - 0x20e0]
push ecx
lea edx, [ebp - 0x2148]
push edx
lea eax, [ebp - 0x20d8]
push eax
lea ecx, [ebp - 0x2120]
push ecx
lea edx, [ebp - 0x20d0]
push edx
lea eax, [ebp - 0x2158]
push eax
lea ecx, [ebp - 0x20c8]
push ecx
lea edx, [ebp - 0x2118]
push edx
lea eax, [ebp - 0x20c0]
push eax
lea ecx, [ebp - 0x2140]
push ecx
lea edx, [ebp - 0x2134]
push edx
lea eax, [ebp - 0x20b8]
push eax
lea ecx, [ebp - 0x216c]
push ecx
lea edx, [ebp - 0x2164]
push edx
lea eax, [ebp - 0x215c]
push eax
lea ecx, [ebp - 0x2154]
push ecx
lea edx, [ebp - 0x214c]
push edx
lea eax, [ebp - 0x2144]
push eax
lea ecx, [ebp - 0x213c]
push ecx
mov ecx, edi
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov ecx, eax
call fcn.00491de0
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x20a8]
call fcn.00401110
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x2074]
call fcn.00401110
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x207c]
call fcn.00401110
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x2084]
call fcn.00401110
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x208c]
call fcn.00401110
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x2094]
call fcn.00401110
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x209c]
call fcn.00401110
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x20a4]
call fcn.00401110
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x20ac]
call fcn.00401110
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x2068]
call fcn.00401110
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x2060]
call fcn.00401110
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x2070]
call fcn.00401110
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x2090]
call fcn.00401110
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x2078]
call fcn.00401110
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x20a0]
call fcn.00401110
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x2080]
call fcn.00401110
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x2098]
call fcn.00401110
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x2088]
call fcn.00401110
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x2064]
call fcn.00401110
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x213c]
call fcn.00401110
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x2144]
call fcn.00401110
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x214c]
call fcn.00401110
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x2154]
call fcn.00401110
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x215c]
call fcn.00401110
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x2164]
call fcn.00401110
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x216c]
call fcn.00401110
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x20b8]
call fcn.00401110
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x2134]
call fcn.00401110
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x2140]
call fcn.00401110
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x20c0]
call fcn.00401110
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x2118]
call fcn.00401110
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x20c8]
call fcn.00401110
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x2158]
call fcn.00401110
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x20d0]
call fcn.00401110
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x2120]
call fcn.00401110
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x20d8]
call fcn.00401110
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x2148]
call fcn.00401110
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x20e0]
call fcn.00401110
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x2128]
call fcn.00401110
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x20e8]
call fcn.00401110
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x2168]
call fcn.00401110
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x20f0]
call fcn.00401110
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x2130]
call fcn.00401110
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x20f8]
call fcn.00401110
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x2150]
call fcn.00401110
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2100]
call fcn.00401110
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x2138]
call fcn.00401110
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x2108]
call fcn.00401110
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x2160]
call fcn.00401110
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x20b0]
call fcn.00401110
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x20b4]
call fcn.00401110
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x20bc]
call fcn.00401110
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x20c4]
call fcn.00401110
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x20cc]
call fcn.00401110
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x20d4]
call fcn.00401110
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x20dc]
call fcn.00401110
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x20e4]
call fcn.00401110
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x20ec]
call fcn.00401110
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x20f4]
call fcn.00401110
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x20fc]
call fcn.00401110
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x2104]
call fcn.00401110
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x210c]
call fcn.00401110
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x2114]
call fcn.00401110
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x211c]
call fcn.00401110
xor edi, edi
push ecx
mov edx, esp
mov dword [ebp - 0x2040], esp
push edx
mov ecx, 0x6d6f14
call fcn.0040b990
mov byte [ebp - 4], 0x5c
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
test eax, eax
jne 0x496741
call fcn.00491d90
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x2040], esp
push eax
mov ecx, 0x6d6f14
call fcn.0040b990
mov byte [ebp - 4], 0x5d
mov byte [ebp - 4], bl
call fcn.0044f000
cmp dword [0x71038c], 1
jl 0x49675e
push 0x6d6f34
push str.CIkAV::CIkAV
push 1
call fcn.00579a92
add esp, 0xc
xor edi, edi
push ecx
mov ecx, esp
mov dword [ebp - 0x2040], esp
push ecx
mov ecx, str.RealTimeFound
call fcn.0040b990
mov byte [ebp - 4], 0x5e
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x72a4e8], eax
push ecx
mov edx, esp
mov dword [ebp - 0x2040], esp
push edx
mov ecx, str.RealTimeScanned
call fcn.0040b990
mov byte [ebp - 4], 0x5f
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x72a4e4], eax
push ecx
mov eax, esp
mov dword [ebp - 0x2040], esp
push eax
mov ecx, str.ManualFound
call fcn.0040b990
mov byte [ebp - 4], 0x60
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x72a4e0], eax
push ecx
mov ecx, esp
mov dword [ebp - 0x2040], esp
push ecx
mov ecx, str.ManualScanned
call fcn.0040b990
mov byte [ebp - 4], 0x61
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x72a4dc], eax
push ecx
mov edx, esp
mov dword [ebp - 0x2040], esp
push edx
mov ecx, str.CloudFound
call fcn.0040b990
mov byte [ebp - 4], 0x62
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x72a4ec], eax
mov edi, 1
push ecx
mov eax, esp
mov dword [ebp - 0x2040], esp
push eax
mov ecx, str.RealtimeKeygen
call fcn.0040b990
mov byte [ebp - 4], 0x63
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x713dd4], eax
push ecx
mov ecx, esp
mov dword [ebp - 0x2040], esp
push ecx
mov ecx, str.ScanKeygen
call fcn.0040b990
mov byte [ebp - 4], 0x64
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x713dd8], eax
push ecx
mov edx, esp
mov dword [ebp - 0x2040], esp
push edx
mov ecx, str.Beh1
call fcn.0040b990
mov byte [ebp - 4], 0x65
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x713ddc], eax
xor edi, edi
push ecx
mov eax, esp
mov dword [ebp - 0x2040], esp
push eax
mov ecx, str.Beh21
call fcn.0040b990
mov byte [ebp - 4], 0x66
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x713de0], eax
mov edi, 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2040], esp
push ecx
mov ecx, str.EnableSSL
call fcn.0040b990
mov byte [ebp - 4], 0x67
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x713de4], eax
or edi, 0xffffffff
push ecx
mov edx, esp
mov dword [ebp - 0x2040], esp
push edx
mov ecx, str.AVCategories
call fcn.0040b990
mov byte [ebp - 4], 0x68
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x713e44], eax
mov edi, 1
push ecx
mov eax, esp
mov dword [ebp - 0x2040], esp
push eax
mov ecx, str.ShowBandwidth90p
call fcn.0040b990
mov byte [ebp - 4], 0x69
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x713dc4], eax
push ecx
mov ecx, esp
mov dword [ebp - 0x2040], esp
push ecx
mov ecx, str.ShowBandwidth100p
call fcn.0040b990
mov byte [ebp - 4], 0x6a
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x713dc8], eax
push ecx
mov edx, esp
mov dword [ebp - 0x2040], esp
push edx
mov ecx, str.SuperUSB
call fcn.0040b990
mov byte [ebp - 4], 0x6b
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x713de8], eax
xor edi, edi
push ecx
mov eax, esp
mov dword [ebp - 0x2040], esp
push eax
mov ecx, str.ExeUSB2
call fcn.0040b990
mov byte [ebp - 4], 0x6c
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x72a4f8], eax
mov edi, 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2040], esp
push ecx
mov ecx, str.AllowUSBSigned
call fcn.0040b990
mov byte [ebp - 4], 0x6d
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [0x713da4], eax
push 0x20
call fcn.005c39f5
add esp, 4
mov dword [ebp - 0x21a8], eax
mov byte [ebp - 4], 0x6e
test eax, eax
je 0x496a0b
push eax
call fcn.00416fa0
jmp 0x496a0d
xor eax, eax
mov byte [ebp - 4], bl
mov dword [0x72a52c], eax
push str._restorem.db
push ecx
mov edx, esp
mov dword [ebp - 0x21a8], esp
push edx
call fcn.004c12a0
add esp, 4
mov byte [ebp - 4], 0x6f
lea eax, [ebp - 0x21a4]
push eax
mov byte [ebp - 4], bl
call fcn.00405b60
add esp, 8
mov byte [ebp - 4], 0x70
lea ecx, [ebp - 0x21c8]
push ecx
mov ecx, eax
call fcn.00424670
add esp, 8
mov byte [ebp - 4], 0x71
mov eax, dword [eax]
push eax
mov ecx, dword [0x72a52c]
call fcn.0041ec60
mov byte [ebp - 4], 0x70
lea ecx, [ebp - 0x21c8]
call fcn.0040b810
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x21a4]
call fcn.0040b810
call fcn.004344f0
mov dword [ebp - 0x21e8], 0x72a7c8
push 0x72a7c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x72
lea edx, [ebp - 0x21ac]
push edx
call fcn.004c12a0
add esp, 4
mov byte [ebp - 4], 0x73
push eax
lea eax, [ebp - 0x21b0]
push eax
mov ebx, str.pc2.db
call fcn.0041e2b0
add esp, 8
mov byte [ebp - 4], 0x74
mov eax, dword [eax]
push eax
call fcn.00468250
mov byte [ebp - 4], 0x73
lea ecx, [ebp - 0x21b0]
call fcn.0040ba40
mov byte [ebp - 4], 0x72
lea ecx, [ebp - 0x21ac]
call fcn.0040ba40
call fcn.00468340
test al, al
jne 0x496b38
push 0
push 0
push 0
push 0x4973c0
push 0
push 0
call fcn.005c4af6
add esp, 0x18
mov dword [0x72a528], eax
cmp dword [0x71038c], 1
jl 0x496b38
push str.PCDB_ready
push str.CIkAV::CIkAV
push 1
call fcn.00579a92
add esp, 0xc
mov byte [ebp - 4], 0x1a
push 0x72a7c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x72a51c], eax
mov byte [esi + 0x50], 0
push 0x729b78
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x400
lea ecx, [ebp - 0x2018]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea edx, [ebp - 0x2018]
push edx
call fcn.005c6653
add esp, 8
xor ecx, ecx
mov word [eax], cx
lea edx, [ebp - 0x2058]
push edx
lea ecx, [ebp - 0x2018]
call fcn.0040b990
mov byte [ebp - 4], 0x75
lea eax, [ebp - 0x2058]
push eax
lea ecx, [ebp - 0x21b4]
push ecx
mov ebx, str.msav.db
call fcn.0041e2b0
add esp, 8
mov byte [ebp - 4], 0x76
mov edi, 0x72b5cc
call fcn.0040ddb0
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x21b4]
call fcn.0040ba40
push 0
push 0x23
lea edx, [ebp - 0x818]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x818]
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x496c00
mov ecx, dword [str.AVHome]
mov dword [eax], ecx
mov edx, dword [0x6d6fec]
mov dword [eax + 4], edx
mov ecx, dword [0x6d6ff0]
mov dword [eax + 8], ecx
mov edx, dword [0x6d6ff4]
mov dword [eax + 0xc], edx
lea eax, [ebp - 0x2174]
push eax
lea ecx, [ebp - 0x818]
call fcn.0040b990
mov byte [ebp - 4], 0x77
push eax
lea ecx, [ebp - 0x204c]
push ecx
mov ebx, str.cache.db
call fcn.0041e2b0
add esp, 8
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x2174]
call fcn.0040ba40
push 0
lea edx, [ebp - 0x818]
push edx
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call edi
lea eax, [ebp - 0x818]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x496c83
mov ecx, dword [0x6d700c]
mov dword [eax], ecx
mov dx, word [0x6d7010]
mov word [eax + 4], dx
push 0
lea eax, [ebp - 0x818]
push eax
call edi
lea ecx, [ebp - 0x2058]
push ecx
lea edx, [ebp - 0x2178]
push edx
mov ebx, str._sc6.db
call fcn.0041e2b0
add esp, 8
mov byte [ebp - 4], 0x7a
mov edi, 0x72b530
call fcn.0040ddb0
mov bl, 0x79
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2178]
call fcn.0040ba40
push 0x3c
call fcn.005c39f5
add esp, 4
mov dword [ebp - 0x21ec], eax
mov byte [ebp - 4], 0x7b
test eax, eax
je 0x496d06
push eax
call fcn.004d0310
jmp 0x496d08
xor eax, eax
mov byte [ebp - 4], bl
mov dword [0x72a504], eax
push 0
mov ecx, dword [0x72b530]
push ecx
mov ecx, eax
call fcn.004d07c0
lea edx, [ebp - 0x2058]
push edx
lea eax, [ebp - 0x2180]
push eax
mov ebx, str._scr4.db
call fcn.0041e2b0
add esp, 8
mov byte [ebp - 4], 0x7c
mov edi, 0x72b4ac
call fcn.0040ddb0
mov bl, 0x79
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2180]
call fcn.0040ba40
push 0x3c
call fcn.005c39f5
add esp, 4
mov dword [ebp - 0x21f0], eax
mov byte [ebp - 4], 0x7d
test eax, eax
je 0x496d79
push eax
call fcn.004d0310
jmp 0x496d7b
xor eax, eax
mov byte [ebp - 4], bl
mov dword [0x72a508], eax
push 0
mov ecx, dword [0x72b4ac]
push ecx
mov ecx, eax
call fcn.004d07c0
lea edx, [ebp - 0x2058]
push edx
lea eax, [ebp - 0x2188]
push eax
mov ebx, str._scai4.db
call fcn.0041e2b0
add esp, 8
mov byte [ebp - 4], 0x7e
mov edi, 0x72ae94
call fcn.0040ddb0
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x2188]
call fcn.0040ba40
push 0x3c
call fcn.005c39f5
add esp, 4
mov dword [ebp - 0x2054], eax
mov byte [ebp - 4], 0x7f
test eax, eax
je 0x496deb
push eax
call fcn.004d0310
jmp 0x496ded
xor eax, eax
mov byte [ebp - 4], 0x79
mov dword [0x72a50c], eax
xor ebx, ebx
push ebx
mov ecx, dword [0x72ae94]
push ecx
mov ecx, eax
call fcn.004d07c0
lea edx, [ebp - 0x818]
push edx
call fcn.0046be10
add esp, 4
call fcn.00459160
mov dword [0x72a518], esi
mov byte [ebp - 0x2041], bl
mov dword [ebp - 0x2050], ebx
mov dword [ebp - 0x2048], 0x400
xor eax, eax
mov word [ebp - 0x1818], ax
push 0x7fe
push ebx
lea ecx, [ebp - 0x1816]
push ecx
call fcn.005c8fb0
add esp, 0xc
lea edx, [ebp - 0x2048]
push edx
lea eax, [ebp - 0x1818]
push eax
lea ecx, [ebp - 0x2050]
push ecx
push 0x6d704c
push str.Softwarepchiktmp
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
call edi
test eax, eax
jne 0x496f01
mov eax, dword [ebp - 0x2048]
cmp eax, ebx
je 0x496f01
shr eax, 1
xor edx, edx
mov word [ebp + eax*2 - 0x1818], dx
lea eax, [ebp - 0x1818]
push eax
lea ecx, [ebp - 0x2124]
push ecx
call fcn.004c1430
add esp, 8
mov byte [ebp - 4], 0x80
lea esi, [ebp - 0x2124]
call fcn.0040b8b0
push ecx
mov dword [ebp - 0x2054], esp
mov esi, esp
call fcn.00401030
mov byte [ebp - 4], 0x81
push 0x6d39f4
push str.Main
mov byte [ebp - 4], 0x80
call fcn.00401f20
mov byte [ebp - 0x2041], 1
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x2124]
call fcn.0040b810
mov esi, dword [ebp - 0x205c]
mov dword [ebp - 0x2050], ebx
mov dword [ebp - 0x2048], 0x400
lea edx, [ebp - 0x2048]
push edx
lea eax, [ebp - 0x1818]
push eax
lea ecx, [ebp - 0x2050]
push ecx
push 0x6d7078
push str.Softwarepchiktmp
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x496faf
mov eax, dword [ebp - 0x2048]
cmp eax, ebx
je 0x496faf
shr eax, 1
xor edx, edx
mov word [ebp + eax*2 - 0x1818], dx
lea eax, [ebp - 0x1818]
push eax
lea ecx, [ebp - 0x2190]
push ecx
call fcn.004c1430
mov bl, 0x82
mov byte [ebp - 4], bl
mov eax, dword [eax]
add esp, 4
mov dword [ebp - 0x2054], esp
mov esi, esp
call fcn.00401030
mov byte [ebp - 4], 0x83
push str.Port
push str.Main
mov byte [ebp - 4], bl
call fcn.00401f20
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x2190]
call fcn.0040b810
mov byte [ebp - 0x2041], 1
mov esi, dword [ebp - 0x205c]
xor ebx, ebx
mov dword [ebp - 0x206c], 0xffffffff
mov dword [ebp - 0x2050], ebx
mov dword [ebp - 0x2048], 4
lea edx, [ebp - 0x2048]
push edx
lea eax, [ebp - 0x206c]
push eax
lea ecx, [ebp - 0x2050]
push ecx
push 0x6d7080
push str.Softwarepchiktmp
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov eax, dword [ebp - 0x206c]
cmp eax, 0xffffffff
je 0x49717c
cmp eax, 1
jne 0x497155
push ebx
push str.IsGlobal
push str.Update
call fcn.00401cf0
xor edx, edx
mov word [ebp - 0x1018], dx
push 0x7fe
push ebx
lea eax, [ebp - 0x1016]
push eax
call fcn.005c8fb0
add esp, 0xc
mov dword [ebp - 0x2050], ebx
mov dword [ebp - 0x2048], 0x400
lea ecx, [ebp - 0x2048]
push ecx
lea edx, [ebp - 0x1018]
push edx
lea eax, [ebp - 0x2050]
push eax
push 0x6d7088
push str.Softwarepchiktmp
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x4970e4
mov eax, dword [ebp - 0x2048]
cmp eax, ebx
je 0x4970e4
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x1018], cx
lea edx, [ebp - 0x1018]
push edx
lea eax, [ebp - 0x212c]
push eax
call fcn.004c1430
add esp, 8
mov byte [ebp - 4], 0x84
lea esi, [ebp - 0x212c]
call fcn.0040b8b0
push ecx
mov dword [ebp - 0x2054], esp
mov esi, esp
call fcn.00401030
mov byte [ebp - 4], 0x85
push str.LocalServer
push str.Update
mov byte [ebp - 4], 0x84
call fcn.00401f20
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x212c]
call fcn.0040b810
mov esi, dword [ebp - 0x205c]
mov dword [ebp - 0x2050], ebx
mov dword [ebp - 0x2048], 0x400
lea ecx, [ebp - 0x2048]
push ecx
lea edx, [ebp - 0x1018]
push edx
lea eax, [ebp - 0x2050]
push eax
push 0x6d34a8
push str.Softwarepchiktmp
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x497166
mov eax, dword [ebp - 0x2048]
cmp eax, ebx
je 0x497166
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x1018], cx
lea edx, [ebp - 0x1018]
push edx
call fcn.005c3ff5
add esp, 4
push eax
push str.LocalPort
push str.Update
call fcn.00401bd0
jmp 0x497166
push 1
push str.IsGlobal
push str.Update
call fcn.00401cf0
push str.Softwarepchiktmp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [ebp - 0x206c]
cmp byte [ebp - 0x2041], 0
jne 0x49718a
cmp eax, 0xffffffff
je 0x49718f
call fcn.004021c0
mov ecx, esi
call fcn.004a9d10
push esi
call fcn.004aa380
call fcn.004ae8d0
push 0
push 0
mov ebx, 1
call fcn.00497aa0
xor edi, edi
add esp, 4
mov eax, esp
mov dword [ebp - 0x2054], esp
push eax
mov ecx, 0x6d7090
call fcn.0040b990
mov byte [ebp - 4], 0x86
mov bl, 0x79
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
cmp eax, 1
jne 0x4971e2
push eax
call fcn.00497ef0
lea ecx, [ebp - 0x2038]
push ecx
call fcn.00416fa0
mov byte [ebp - 4], 0x87
push 0
lea ecx, [ebp - 0x2038]
call fcn.0041ec60
test al, al
je 0x497221
mov edx, dword [ebp - 0x2198]
push edx
lea eax, [ebp - 0x2038]
push eax
call fcn.00421c20
lea ecx, [ebp - 0x2038]
call fcn.004230f0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2038]
push ecx
call fcn.00417000
call fcn.00475700
mov ecx, esi
call fcn.004a4660
xor edi, edi
push ecx
mov edx, esp
mov dword [ebp - 0x2054], esp
push edx
mov ecx, str.USBPassword
call fcn.0040b990
mov byte [ebp - 4], 0x88
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0044ef10
mov dword [esi + 0xcc], eax
push edi
push edi
push esi
push 0x497960
push edi
push edi
call fcn.005c4af6
push edi
push edi
push esi
push 0x4976a0
push edi
push edi
call fcn.005c4af6
push edi
push edi
push esi
push 0x497430
push edi
push edi
call fcn.005c4af6
add esp, 0x48
call fcn.00487370
call fcn.0041c0b0
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x204c]
call fcn.0040ba40
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x2058]
call fcn.0040ba40
mov dword [ebp - 4], 0x19
jmp 0x4972f7
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005c397a
mov esp, ebp
pop ebp
ret