Function at 0x4d2890
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f3fb5
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov cl, byte [ebp + 0xc]
mov edx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
mov esi, dword [ebp + 8]
test cl, cl
mov eax, str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionApp_Paths
mov byte [ebp - 0x81], cl
push 1
cmove eax, edx
mov byte [ebp - 0x80], cl
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push eax
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.005dc570
push 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push 0x20019
mov dword [ebp - 0x14], 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d6a80
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
call fcn.005d6aa0
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0
call fcn.005d6aa0
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x3c]
movq qword [ebp - 0x3c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x5c], 0
lea ecx, [ebp - 0x64]
movq qword [ebp - 0x64], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x48]
movq qword [ebp - 0x48], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x2c]
movq qword [ebp - 0x2c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x58]
movq qword [ebp - 0x58], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x7c]
xorps xmm0, xmm0
mov dword [ebp - 0x74], 0
movq qword [ebp - 0x7c], xmm0
call fcn.005d6ac0
lea edx, [esi + 0xc]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x88], edx
call fcn.005d6a00
test eax, eax
je 0x4d2af4
xor edi, edi
cmp byte [edx], 0
jne 0x4d2df0
nop
lea eax, [ebp - 0x7c]
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.005d6380
test al, al
je 0x4d2afa
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x20]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea ecx, [ebp - 0x3c]
call fcn.005dc190
mov ecx, eax
call fcn.005d3ec0
lea ecx, [ebp - 0x3c]
test al, al
jne 0x4d2a63
push 1
push 5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Empty_Application_path_key
jmp 0x4d2abf
lea eax, [ebp - 0x2c]
push eax
push 0x62439c
call fcn.005dc190
push eax
lea ecx, [ebp - 0x30]
call fcn.005d65d0
test al, al
je 0x4d2ae2
lea ecx, [ebp - 0x2c]
call fcn.005dc3a0
cmp eax, 4
jl 0x4d2ae2
push dword [ebp - 0x80]
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x2c]
call fcn.005d4680
test al, al
jne 0x4d2ae2
push 1
push 5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
push 0x68fb68
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
mov ecx, eax
call fcn.005dc190
push eax
push esi
mov ecx, ebx
call fcn.004ceb00
inc edi
cmp byte [esi + 0xc], 0
je 0x4d29f0
xor bl, bl
jmp 0x4d36a4
mov dword [ebp - 0x88], edx
cmp byte [ebp - 0x81], 0
jne 0x4d2d07
push ecx
push 0x20019
push str.HKCRApplications
lea ecx, [ebp - 0x14]
call fcn.005d6a30
test al, al
je 0x4d2d07
mov ecx, dword [ebp - 0x88]
xor eax, eax
mov dword [ebp - 0x80], eax
cmp byte [ecx], al
jne 0x4d2df0
lea ecx, [ebp - 0x7c]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.005d6380
test al, al
je 0x4d2d07
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x3c]
push 0x624284
push str.HKCRApplications
call fcn.005dc200
lea ecx, [ebp - 0x3c]
call fcn.005dc190
mov ecx, eax
call fcn.005d3ec0
lea ecx, [ebp - 0x3c]
test al, al
jne 0x4d2bca
push 1
push 5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Empty_Application_key
push 0x68fb68
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
mov ecx, eax
call fcn.005dc190
push eax
push esi
mov ecx, ebx
call fcn.004ceb00
jmp 0x4d2cea
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Shell
call fcn.005da780
push ecx
push 0x20019
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x30]
call fcn.005d6a30
test al, al
je 0x4d2cea
lea eax, [ebp - 0x7c]
xor edi, edi
push eax
push edi
lea ecx, [ebp - 0x30]
call fcn.005d6380
test al, al
je 0x4d2cea
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627384
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x3c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc200
lea eax, [ebp - 0x2c]
push eax
push 0x62439c
lea ecx, [ebp - 0x64]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005d65d0
test al, al
je 0x4d2cd4
lea ecx, [ebp - 0x2c]
call fcn.005dc3a0
cmp eax, 4
jl 0x4d2cd4
push 0
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x2c]
call fcn.005d4680
test al, al
jne 0x4d2cd4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
push 0x68fb68
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x3c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
push 1
push 5
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
push esi
mov ecx, ebx
call fcn.004ceb00
lea eax, [ebp - 0x7c]
inc edi
push eax
push edi
lea ecx, [ebp - 0x30]
call fcn.005d6380
test al, al
jne 0x4d2c20
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp byte [ecx], 0
je 0x4d2b35
xor bl, bl
jmp 0x4d36a4
cmp byte [ebp - 0x81], 0
mov ecx, str.HKLMSOFTWARE
mov eax, str.HKLMSOFTWAREWow6432Node
cmove eax, ecx
lea ecx, [ebp - 0x20]
push eax
call fcn.005dc510
push ecx
push 0x20019
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d6a30
test al, al
je 0x4d2df7
xor edi, edi
cmp byte [esi + 0xc], 0
jne 0x4d2df0
nop
lea eax, [ebp - 0x7c]
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.005d6380
test al, al
je 0x4d2df7
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x20]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea ecx, [ebp - 0x3c]
call fcn.005dc190
mov ecx, eax
call fcn.005d3ec0
test al, al
jne 0x4d2de5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Empty_Software_key
push 0x68fb68
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
push 1
push 5
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
push esi
mov ecx, ebx
call fcn.004ceb00
inc edi
cmp byte [esi + 0xc], 0
je 0x4d2d50
xor bl, bl
jmp 0x4d36a4
cmp byte [ebp - 0x81], 0
je 0x4d2e07
mov bl, 1
jmp 0x4d36a4
xor eax, eax
mov dword [ebp - 0x80], eax
nop dword [eax]
test eax, eax
jne 0x4d2e3e
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.Software
push ecx
lea ecx, [ebx + 0x1290]
call fcn.0057c2d0
push eax
push str.HKU_
lea ecx, [ebp - 0x20]
call fcn.005dc200
jmp 0x4d2e5f
cmp eax, 1
jne 0x4d2e4b
push eax
push str.HKU.DEFAULTSoftware
jmp 0x4d2e57
cmp eax, 2
jne 0x4d2e5f
push 1
push str.HKUS_1_5_18Software
lea ecx, [ebp - 0x20]
call fcn.005dc260
push ecx
push 0x20019
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d6a30
test al, al
je 0x4d2f5e
xor edi, edi
cmp byte [esi + 0xc], 0
jne 0x4d2df0
lea eax, [ebp - 0x7c]
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.005d6380
test al, al
je 0x4d2f5e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x20]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea ecx, [ebp - 0x3c]
call fcn.005dc190
mov ecx, eax
call fcn.005d3ec0
test al, al
jne 0x4d2f58
mov ecx, dword [ebp - 0x7c]
mov edx, str.Policies
push 0
call fcn.005d8ad0
test eax, eax
je 0x4d2f58
mov ecx, dword [ebp - 0x7c]
mov edx, str.Classes
push 0
call fcn.005d8ad0
test eax, eax
je 0x4d2f58
mov ecx, dword [ebp - 0x7c]
mov edx, 0x624a04
push 0
call fcn.005d8ad0
test eax, eax
je 0x4d2f58
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Empty_Software_key
push 0x68fb68
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
push 1
push 5
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
push esi
mov ecx, ebx
call fcn.004ceb00
inc edi
jmp 0x4d2e80
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp eax, 3
jl 0x4d2e10
xorps xmm0, xmm0
mov dword [ebp - 0x68], 0
lea ecx, [ebp - 0x70]
movq qword [ebp - 0x70], xmm0
call fcn.005dc5e0
push ecx
push 0x20019
push str.HKLMSYSTEM
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xa
call fcn.005d6a30
test al, al
je 0x4d329f
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x88], 0
push eax
push 0
lea ecx, [ebp - 0x30]
call fcn.005d6380
test al, al
je 0x4d329f
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x20]
call fcn.005dc510
push 0
push 1
push 1
push 0
push str.ControlSet
lea ecx, [ebp - 0x20]
call fcn.005daa70
cmp eax, 1
jne 0x4d327d
sub esp, 0xc
lea ecx, [ebp - 0x20]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.HKLMSYSTEM_
call fcn.005da510
movsd xmm0, qword [ebx + 8]
comisd xmm0, xmmword [0x6edab8]
jb 0x4d3178
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._servicesSharedAccessParametersFirewallPolicyFirewallRules
lea ecx, [ebp - 0x20]
call fcn.005da780
push ecx
push 0x20019
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d6a30
test al, al
je 0x4d327d
xor edi, edi
cmp byte [esi + 0xc], 0
jne 0x4d32c7
lea eax, [ebp - 0x7c]
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.005d62e0
test al, al
je 0x4d327d
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x14]
call fcn.005d6740
test al, al
je 0x4d3172
lea ecx, [ebp - 0x2c]
call fcn.005dc3a0
cmp eax, 0x19
jl 0x4d3172
push 0
push 1
push 1
push 0
push str.App
lea ecx, [ebp - 0x2c]
call fcn.005daa70
test eax, eax
je 0x4d3172
push 0
push 1
push 1
push 0
push 0x627800
add eax, 4
lea ecx, [ebp - 0x2c]
push eax
call fcn.005dad50
mov ecx, eax
call fcn.005daa70
test eax, eax
je 0x4d30f5
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dae00
push 0
push 1
push 0xffffffffffffffff
push 1
push 0x62794c
lea ecx, [ebp - 0x2c]
call fcn.005daa70
test eax, eax
je 0x4d3172
push 0
dec eax
lea ecx, [ebp - 0x2c]
push eax
call fcn.005dae00
lea edx, [ebp - 0x58]
mov ecx, eax
call fcn.005d4680
test al, al
jne 0x4d3172
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
push str.____Unexisting_file:
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x20]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
push 1
push 5
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
push esi
mov ecx, ebx
call fcn.004ceb00
inc edi
jmp 0x4d3064
xor eax, eax
mov dword [ebp - 0x80], eax
nop dword [eax]
test eax, eax
jne 0x4d3195
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.ServicesSharedAccessParametersFirewallPolicyDomainProfileAuthorizedApplicationsList
jmp 0x4d31b3
cmp eax, 1
jne 0x4d31c4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.ServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d6a30
test al, al
je 0x4d326d
xor edi, edi
cmp byte [esi + 0xc], 0
jne 0x4d32c7
lea eax, [ebp - 0x7c]
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.005d62e0
test al, al
je 0x4d326d
push 0
push 1
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x2c]
call fcn.005dc260
lea edx, [ebp - 0x58]
mov ecx, eax
call fcn.005d4680
test al, al
jne 0x4d3267
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
push str.____Unexisting_file:
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x3c]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
push 1
push 5
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
push esi
mov ecx, ebx
call fcn.004ceb00
inc edi
jmp 0x4d31e5
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp eax, 2
jl 0x4d3180
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x7c]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x88], eax
call fcn.005d6380
test al, al
jne 0x4d2fc4
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor eax, eax
mov dword [ebp - 0x88], eax
nop dword [eax]
test eax, eax
jne 0x4d32ce
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
jmp 0x4d3358
xor bl, bl
jmp 0x4d369c
cmp eax, 1
jne 0x4d32ec
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
jmp 0x4d3358
cmp eax, 2
jne 0x4d3300
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
lea ecx, [ebp - 0x20]
call fcn.005dc510
jmp 0x4d3372
cmp eax, 3
jne 0x4d3314
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
lea ecx, [ebp - 0x20]
call fcn.005dc510
jmp 0x4d3372
cmp eax, 4
jne 0x4d3328
push str.HKLMSOFTWAREMicrosoftFTHState
lea ecx, [ebp - 0x20]
call fcn.005dc510
jmp 0x4d3372
cmp eax, 5
jne 0x4d333c
push str.HKLMSOFTWAREWow6432NodeMicrosoftFTHState
lea ecx, [ebp - 0x20]
call fcn.005dc510
jmp 0x4d3372
cmp eax, 6
jne 0x4d3372
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerStartPageNewShortcuts
push ecx
lea ecx, [ebx + 0x1290]
call fcn.0057c2d0
push eax
push str.HKU_
lea ecx, [ebp - 0x20]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d6a30
test al, al
je 0x4d341e
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], 0
push eax
push 0
lea ecx, [ebp - 0x14]
call fcn.005d62e0
test al, al
je 0x4d341e
nop word [eax + eax]
mov ecx, dword [ebp - 0x7c]
call fcn.005d8c40
cmp eax, 3
jl 0x4d3406
cmp word [ecx + 2], 0x3a
jne 0x4d3406
push ecx
call edi
test eax, eax
jne 0x4d3406
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.____Unexisting_file
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x20]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
push 1
push 5
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
push esi
mov ecx, ebx
call fcn.004ceb00
mov eax, dword [ebp - 0x80]
lea ecx, [ebp - 0x7c]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x80], eax
call fcn.005d62e0
test al, al
jne 0x4d33b0
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp eax, 7
jl 0x4d32b0
xor eax, eax
mov dword [ebp - 0x88], eax
nop dword [eax]
test eax, eax
jne 0x4d344d
push 1
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerFolders
jmp 0x4d3458
cmp eax, 1
jne 0x4d3460
push eax
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionInstallerFolders
lea ecx, [ebp - 0x20]
call fcn.005dc260
push ecx
push 0x20019
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d6a30
test al, al
je 0x4d3525
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], 0
push eax
push 0
lea ecx, [ebp - 0x14]
call fcn.005d62e0
test al, al
je 0x4d3525
nop dword [eax]
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x2c]
call fcn.005dc510
push dword [ebp - 0x7c]
call edi
test eax, eax
jne 0x4d3509
mov ecx, dword [ebp - 0x7c]
call fcn.005d8c40
cmp eax, 3
jl 0x4d3509
cmp word [ecx + 2], 0x3a
jne 0x4d3509
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.____Unexisting_folder
push ecx
push 0x62bd28
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
push 1
push 5
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
push esi
mov ecx, ebx
call fcn.004ceb00
mov eax, dword [ebp - 0x80]
lea ecx, [ebp - 0x7c]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x80], eax
call fcn.005d62e0
test al, al
jne 0x4d34a0
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp eax, 2
jl 0x4d3440
xor eax, eax
mov dword [ebp - 0x88], eax
test eax, eax
jne 0x4d3550
push 1
push str.HKLMSOFTWAREMicrosoftWindowsHelp
jmp 0x4d355b
cmp eax, 1
jne 0x4d3563
push eax
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsHelp
lea ecx, [ebp - 0x20]
call fcn.005dc260
push ecx
push 0x20019
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d6a30
test al, al
je 0x4d367f
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], 0
push eax
push 0
lea ecx, [ebp - 0x14]
call fcn.005d62e0
test al, al
je 0x4d367f
nop
mov eax, dword [ebp - 0x78]
cmp eax, 1
je 0x4d35b1
cmp eax, 2
jne 0x4d3663
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x14]
call fcn.005d6740
test al, al
je 0x4d3663
lea ecx, [ebp - 0x2c]
call fcn.005dbeb0
test al, al
jne 0x4d35f8
push 0
call fcn.005dbc20
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
call edi
test eax, eax
jne 0x4d3663
push 1
lea ecx, [ebp - 0x2c]
call fcn.005e8620
test al, al
jne 0x4d3663
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x2c]
call fcn.005dc510
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
call edi
test eax, eax
jne 0x4d3663
push 1
lea ecx, [ebp - 0x2c]
call fcn.005e8620
test al, al
jne 0x4d3663
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.____Unexisting_help_file_path
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x20]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
push 1
push 5
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
push esi
mov ecx, ebx
call fcn.004ceb00
mov eax, dword [ebp - 0x80]
lea ecx, [ebp - 0x7c]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x80], eax
call fcn.005d62e0
test al, al
jne 0x4d35a0
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp eax, 2
jl 0x4d3543
cmp byte [esi + 0xc], 0
sete bl
lea ecx, [ebp - 0x70]
call fcn.005dc430
lea ecx, [ebp - 0x7c]
call fcn.005d6ab0
lea ecx, [ebp - 0x58]
call fcn.005dc430
lea ecx, [ebp - 0x2c]
call fcn.005dc430
lea ecx, [ebp - 0x48]
call fcn.005dc430
lea ecx, [ebp - 0x64]
call fcn.005dc430
lea ecx, [ebp - 0x3c]
call fcn.005dc430
lea ecx, [ebp - 0x4c]
call fcn.005d69e0
lea ecx, [ebp - 0x30]
call fcn.005d69e0
lea ecx, [ebp - 0x14]
call fcn.005d69e0
lea ecx, [ebp - 0x20]
call fcn.005dc430
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8