Function at 0x585c90
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x650d80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
mov ebx, ecx
xor eax, eax
push esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0xb0]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], ebx
mov cl, byte [eax + 0x16b]
test cl, cl
je 0x585cdd
mov cl, byte [eax + 0x323]
mov eax, 5
test cl, cl
jne 0x585ce2
mov eax, 0xf
mov edx, dword [ebx]
lea esi, [ebx + 0x31e0]
push eax
mov ecx, ebx
mov eax, dword [esi]
push eax
call dword [edx + 0x1c]
mov edi, eax
mov eax, dword [ebx + 0x31e8]
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x585d22
lea ecx, [eax + 0x28]
call fcn.00565cf0
mov eax, 0x7540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edi, 0x2751
je 0x585d36
cmp edi, 0x2743
jne 0x585e34
mov eax, dword [ebx + 0xb0]
test dword [eax + 0x14c], 0x2400000
jne 0x585e34
mov dl, byte [eax + 0x16b]
mov esi, edi
test dl, dl
sete cl
mov byte [eax + 0x16b], cl
mov edx, dword [ebx]
lea eax, [ebx + 0x31e0]
mov ecx, ebx
push eax
call dword [edx + 0x18]
mov ecx, dword [ebx + 0x31e0]
mov eax, dword [ebx]
push 0x1e
push ecx
mov ecx, ebx
call dword [eax + 0x1c]
mov edi, eax
mov eax, dword [ebx + 0x31e8]
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x585dac
lea ecx, [eax + 0x28]
call fcn.00565cf0
mov eax, 0x7540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, edi
jne 0x585dc7
mov eax, dword [ebx + 0xb0]
mov cl, byte [eax + 0x16b]
test cl, cl
sete dl
mov byte [eax + 0x16b], dl
test edi, edi
je 0x585edd
xor esi, esi
push edi
mov ecx, ebx
call fcn.00569870
test eax, eax
jne 0x585ec4
inc esi
cmp esi, 5
jg 0x585ec4
mov edx, dword [ebx]
lea edi, [ebx + 0x31e0]
push edi
mov ecx, ebx
call dword [edx + 0x18]
mov ecx, dword [edi]
mov eax, dword [ebx]
push 0x1e
push ecx
mov ecx, ebx
call dword [eax + 0x1c]
mov edi, eax
mov eax, dword [ebx + 0x31e8]
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x585dd1
lea ecx, [eax + 0x28]
call fcn.00565cf0
mov eax, 0x7540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edi, 0x274c
jne 0x585dc7
mov eax, dword [ebx + 0xb0]
mov cl, byte [eax + 0x16b]
test cl, cl
je 0x585dcf
test dword [eax + 0x14c], 0x400000
jne 0x585dcf
mov byte [eax + 0x16b], 0
mov eax, dword [ebx]
push esi
mov ecx, ebx
call dword [eax + 0x18]
mov eax, dword [esi]
mov edx, dword [ebx]
push 0x1e
push eax
mov ecx, ebx
call dword [edx + 0x1c]
mov edi, eax
mov eax, dword [ebx + 0x31e8]
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x585ea6
lea ecx, [eax + 0x28]
call fcn.00565cf0
mov eax, 0x7540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edi, 0x274c
jne 0x585dc7
mov ecx, dword [ebx + 0xb0]
mov byte [ecx + 0x16b], 1
jmp 0x585dcf
test edi, edi
je 0x585edd
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx + 0x3230], 1
mov eax, dword [ebx + 0x184]
test eax, eax
je 0x585f25
mov cl, byte [eax + 0x15c]
test cl, cl
mov byte [ebp - 0x12], cl
je 0x585f29
mov ecx, ebx
call fcn.005859e0
mov esi, eax
test esi, esi
je 0x5860c9
cmp esi, 0x7585
jne 0x585fca
push str.Restart_type_002_n
jmp 0x587ab9
mov byte [ebp - 0x12], 0
test eax, eax
je 0x5860c9
mov cl, byte [eax + 0x137]
test cl, cl
je 0x5860c9
mov ecx, dword [ebx + 0x344c]
test ecx, ecx
je 0x5860c9
mov eax, dword [ecx + 0x335c]
lea edx, [ecx + 0x3308]
push edx
push eax
call fcn.005ed870
test eax, eax
jne 0x587dc0
mov ecx, dword [ebx + 0x344c]
push 1
lea esi, [ebx + 0x31e0]
lea edx, [ecx + 0x3318]
lea eax, [ecx + 0x3310]
push edx
mov edx, dword [ebx + 0x184]
push eax
mov eax, dword [edx]
lea edx, [ecx + 0x3308]
push eax
mov eax, dword [esi]
push edx
push eax
call fcn.005eddc0
test eax, eax
je 0x5860b7
cmp eax, 0x757e
jne 0x587dc0
push str.Restart_type_005_n
mov ecx, ebx
call fcn.00567a50
mov ecx, ebx
call fcn.0057fa50
mov edx, dword [ebx]
push esi
jmp 0x587ad0
mov ecx, dword [ebx + 0x184]
mov al, byte [ecx + 0x15d]
test al, al
jne 0x58602d
cmp esi, 0x7559
jne 0x58602d
cmp dword [ecx + 0x154], 5
jne 0x58602d
mov dl, byte [ecx + 0x15e]
test dl, dl
jne 0x58602d
mov dl, byte [ecx + 0x15f]
test dl, dl
jne 0x58602d
mov byte [ecx + 0x15e], 1
mov ecx, dword [ebx + 0x184]
push str.Restart_type_003_n
mov byte [ecx + 0x15f], 1
mov edx, dword [ebx + 0x184]
mov dword [edx + 0x154], 4
jmp 0x587ab9
mov edx, dword [ecx + 0x154]
cmp edx, 5
jne 0x58606a
cmp esi, 0x7580
jne 0x58606a
cmp byte [ecx + 0x15e], 0
jne 0x58606a
mov byte [ecx + 0x15e], 1
mov ecx, dword [ebx + 0x184]
push str.Restart_type_004_n
mov dword [ecx + 0x154], 4
jmp 0x587ab9
test al, al
jne 0x587310
cmp edx, 4
jne 0x587310
mov al, byte [ecx + 0x15e]
test al, al
je 0x587310
mov al, byte [ecx + 0x15f]
test al, al
je 0x587310
mov esi, 0x7559
mov dword [ecx + 0x154], edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebx + 0x344c]
lea edx, [ecx + 0x3310]
push edx
call fcn.005ef090
mov eax, dword [ebx + 0xb4]
mov byte [ebp - 0x11], 1
test eax, eax
je 0x5860dc
mov eax, dword [eax + 0x10]
jmp 0x5860e5
mov eax, dword [ebx + 0xb0]
mov eax, dword [eax + 0x24]
cmp eax, 2
jne 0x5861c2
mov ecx, dword [ebx + 0x184]
mov byte [ebp - 0x11], 0
cmp dword [ecx], 0
je 0x58614e
push 1
mov ecx, ebx
call fcn.005890d0
test eax, eax
jne 0x587dc0
cmp dword [ebx + 0x3238], 0xc8
je 0x586144
mov edx, dword [ebx + 0x3220]
mov ecx, dword [ebx + 0x9c]
push edx
call fcn.00570270
mov eax, 0x756d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx + 0x8c], 0x10
mov eax, dword [ebx + 0x335c]
lea esi, [ebx + 0x3308]
push esi
push eax
mov ecx, ebx
call fcn.005ed870
test eax, eax
jne 0x587dc0
mov eax, dword [ebx + 0xb4]
test eax, eax
je 0x586179
mov eax, dword [eax]
jmp 0x586181
mov ecx, dword [ebx + 0xb0]
mov eax, dword [ecx]
lea edx, [ebx + 0x3318]
lea edi, [ebx + 0x3310]
push 1
push edx
push edi
push eax
mov eax, dword [ebx + 0x31e0]
push esi
push eax
mov ecx, ebx
call fcn.005eddc0
test eax, eax
je 0x5861ba
cmp eax, 0x757e
jne 0x587dc0
push str.Restart_type_006_n
jmp 0x587ab9
push edi
mov ecx, ebx
call fcn.005ef090
mov edi, dword [ebp + 8]
test edi, edi
je 0x5861d2
mov ecx, ebx
call fcn.005880e0
jmp 0x5861db
mov edx, dword [ebx]
push 0
mov ecx, ebx
call dword [edx + 0x20]
test eax, eax
jne 0x587dc0
push edi
mov ecx, ebx
call fcn.00587de0
mov esi, eax
mov al, byte [ebp - 0x11]
test al, al
je 0x586261
cmp esi, 0x757e
jne 0x586261
mov eax, dword [ebx + 0xb4]
test eax, eax
je 0x58620b
mov eax, dword [eax + 0x10]
jmp 0x586214
mov eax, dword [ebx + 0xb0]
mov eax, dword [eax + 0x24]
cmp eax, 2
jne 0x58633f
push str.Restart_type_007_n
mov ecx, ebx
call fcn.00567a50
mov ecx, ebx
call fcn.0057fa50
mov edx, dword [ebx]
lea eax, [ebx + 0x31e0]
push eax
mov ecx, ebx
call dword [edx + 0x18]
test eax, eax
jne 0x587dc0
push edi
mov ecx, ebx
call fcn.00585c90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x7586
jne 0x586291
mov eax, dword [ebx + 0xb4]
test eax, eax
je 0x586278
mov eax, dword [eax + 0x10]
jmp 0x586281
mov eax, dword [ebx + 0xb0]
mov eax, dword [eax + 0x24]
cmp eax, 2
jne 0x58633f
push str.Restart_type_007b_n
jmp 0x586222
test esi, esi
jne 0x58633f
cmp dword [ebx + 0x3238], 0xce
jne 0x58633f
mov edi, dword [ebx + 0x3244]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x58633f
mov eax, dword [ebx + 0xb4]
test eax, eax
jne 0x5862de
mov eax, dword [ebx + 0xb0]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00622df8
or dword [ebp - 0x28], 1
mov eax, dword [eax]
push str.sciencedirect.com
push eax
call fcn.00609cc0
mov edi, eax
mov al, byte [ebp - 0x28]
add esp, 8
test al, 1
je 0x5862ff
lea ecx, [ebp - 0x2c]
call fcn.00622d8a
test edi, edi
je 0x58633f
cmp dword [ebx + 0x31dc], 2
je 0x58633f
mov ecx, dword [ebx + 0x31e8]
test ecx, ecx
je 0x58631d
mov edx, dword [ecx]
push 2
call dword [edx + 0xc]
mov ecx, ebx
mov dword [ebx + 0x31dc], 2
call fcn.0057fa50
push str.Restart_type_11_n
mov ecx, ebx
call fcn.00567a50
jmp 0x587ac7
cmp dword [ebx + 0x3238], 0xc8
jne 0x58659c
mov ecx, dword [ebx + 0x48]
mov eax, dword [ebx + 0x4c]
or ecx, eax
jne 0x58659c
mov eax, dword [ebx + 0x54]
test eax, eax
jg 0x58659c
jl 0x586375
mov eax, dword [ebx + 0x50]
test eax, eax
ja 0x58659c
mov al, byte [ebx + 0x31ed]
test al, al
jne 0x58659c
mov eax, dword [ebx + 0x3258]
mov ecx, dword [ebx + 0x325c]
mov edx, eax
or edx, ecx
je 0x58659c
mov edx, dword [ebx + 0x31f8]
add eax, 1
adc ecx, 0
cmp eax, edx
jne 0x58659c
cmp ecx, dword [ebx + 0x31fc]
jne 0x58659c
mov esi, 0x7542
mov eax, dword [ebx + 0xb0]
mov ecx, dword [eax + 0x2fc]
test ecx, ecx
jne 0x586664
mov ecx, dword [eax + 0x14c]
test ch, 1
je 0x586664
test esi, esi
je 0x586664
mov eax, dword [eax]
push str.youtube.com
push eax
call fcn.00609cc0
add esp, 8
test eax, eax
jne 0x58641b
mov ecx, dword [ebx + 0xb0]
push str.googlevideo.com
mov edx, dword [ecx]
push edx
call fcn.00609cc0
add esp, 8
test eax, eax
je 0x586664
mov eax, dword [ebx + 0xb0]
push str.sourceyt_otf
mov ecx, dword [eax + 8]
push ecx
call fcn.00609cc0
add esp, 8
test eax, eax
jne 0x586455
mov edx, dword [ebx + 0xb0]
push str._sourceyt_otf
mov eax, dword [edx + 8]
push eax
call fcn.00609cc0
add esp, 8
test eax, eax
je 0x586664
mov ecx, dword [ebx + 0xb0]
push str.otf1
mov edx, dword [ecx + 8]
push edx
call fcn.00609cc0
add esp, 8
test eax, eax
jne 0x58648f
mov eax, dword [ebx + 0xb0]
push str._otf1
mov ecx, dword [eax + 8]
push ecx
call fcn.00609cc0
add esp, 8
test eax, eax
je 0x586664
mov edx, dword [ebx + 0xb0]
push str.sq
mov eax, dword [edx + 8]
push eax
call fcn.00609cc0
add esp, 8
test eax, eax
jne 0x586664
mov ecx, dword [ebx + 0xb0]
push str._sq
mov edx, dword [ecx + 8]
push edx
call fcn.00609cc0
add esp, 8
test eax, eax
jne 0x586664
mov ecx, ebx
call fcn.0057fa50
push str.Restart_type_s020y_n
mov ecx, ebx
call fcn.00567a50
mov eax, dword [ebx + 0xb0]
mov dword [eax + 0x2fc], 0x200
mov ecx, dword [ebx + 0xb0]
mov byte [ecx + 0x300], 1
mov eax, dword [ebx + 0x31e8]
test eax, eax
je 0x58651d
mov eax, dword [eax + 0xb8]
test eax, eax
je 0x58651d
mov ecx, dword [ebx + 0xb0]
push eax
call fcn.005e1bc0
mov edx, dword [0x6f7b78]
mov dword [ebp - 0x28], edx
mov eax, dword [ebx + 0xb0]
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
mov ecx, dword [eax + 8]
push ecx
push str._ssq0
push edx
call fcn.0061fae1
mov eax, dword [ebx + 0xb0]
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
add esp, 0xc
mov eax, dword [eax + 8]
test eax, eax
je 0x586561
push eax
call fcn.00622af4
add esp, 4
mov al, byte [0x6fc418]
test esi, esi
mov byte [ebp - 0x12], al
jne 0x586570
lea esi, [ebp - 0x12]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00622acb
mov ecx, dword [ebp - 0x2c]
mov edx, eax
add esp, 4
test edx, edx
mov dword [ecx + 8], edx
jne 0x5865e2
push str.URL::set_fileName__:_Not_enough_memory__n
call fcn.005df030
jmp 0x586601
test esi, esi
je 0x586be1
cmp esi, 0x7563
jne 0x5865c1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x7581
jne 0x5863be
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx]
lea eax, [ebx + 0x31e0]
push eax
mov ecx, ebx
call dword [edx + 0x18]
mov esi, eax
test esi, esi
je 0x586636
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00622d8a
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.00585c90
lea ecx, [ebp - 0x28]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.00622d8a
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x7566
jne 0x58683a
mov ecx, dword [ebx + 0xb0]
push str..dailymotion.com
mov edx, dword [ecx]
push edx
call fcn.00609cc0
add esp, 8
test eax, eax
jne 0x5866a8
mov eax, dword [ebx + 0xb0]
push str..dmcdn.net
mov ecx, dword [eax]
push ecx
call fcn.00609cc0
add esp, 8
test eax, eax
je 0x58683a
mov ecx, dword [ebx + 0xb0]
mov eax, dword [ecx + 8]
test eax, eax
je 0x58683a
mov edx, dword [ecx + 0x14c]
test dh, 1
je 0x58683a
push 0x2e
push eax
call fcn.0060ab40
add esp, 8
test eax, eax
je 0x58683a
push 0x6cda0c
push eax
call fcn.0060a000
add esp, 8
test eax, eax
jne 0x58683a
mov edx, dword [0x6f7b78]
mov dword [ebp - 0x28], edx
mov eax, dword [ebx + 0xb0]
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 2
mov ecx, dword [eax + 8]
push ecx
push 0x6c910c
push edx
call fcn.0061fae1
mov eax, dword [ebp - 0x28]
add esp, 0xc
push 0x2e
push eax
call fcn.0060ab40
add esp, 8
test eax, eax
je 0x58682e
mov byte [eax], 0
mov ecx, dword [0x6f7b78]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
push edx
push str._s.mnft
push eax
mov byte [ebp - 4], 3
call fcn.0061fae1
mov eax, dword [ebx + 0xb0]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
add esp, 0xc
mov eax, dword [eax + 8]
test eax, eax
je 0x586770
push eax
call fcn.00622af4
add esp, 4
mov cl, byte [0x6fc418]
test esi, esi
mov byte [ebp - 0x12], cl
jne 0x586780
lea esi, [ebp - 0x12]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00622acb
mov ecx, dword [ebp - 0x2c]
mov edx, eax
add esp, 4
test edx, edx
mov dword [ecx + 8], edx
jne 0x5867ac
push str.URL::set_fileName__:_Not_enough_memory__n
call fcn.005df030
jmp 0x5867cb
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.0057fa50
push str.Restart_type_12_n
mov ecx, ebx
call fcn.00567a50
mov edx, dword [ebx]
lea eax, [ebx + 0x31e0]
push eax
mov ecx, ebx
call dword [edx + 0x18]
mov esi, eax
test esi, esi
je 0x58681f
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.00622d8a
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00622d8a
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.00585c90
mov esi, eax
jmp 0x5867f2
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00622d8a
mov eax, dword [ebx + 0x54]
test eax, eax
jg 0x5868b3
jl 0x58684a
mov eax, dword [ebx + 0x50]
test eax, eax
ja 0x5868b3
mov edx, dword [ebx + 0xb0]
or ecx, 0xffffffff
xor eax, eax
mov edi, dword [edx + 0x350]
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5868b3
mov al, byte [edx + 0x321]
test al, al
jne 0x5868b3
cmp esi, 0x7565
je 0x586894
cmp esi, 0x7566
je 0x586894
cmp esi, 0x7542
je 0x586894
cmp esi, 0x756e
je 0x586894
cmp esi, 0x755e
jne 0x5868b3
mov ecx, ebx
mov byte [edx + 0x321], 1
call fcn.0057fa50
push str.Restart__type_18_n
mov ecx, ebx
call fcn.00567a50
jmp 0x587ac7
mov ecx, dword [0x6f7b78]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebx + 0xb0]
lea edx, [ebp - 0x18]
push 0
push edx
mov byte [ebp - 4], 4
call fcn.0059de90
mov eax, dword [ebp - 0x18]
push eax
call fcn.004a92c0
add esp, 4
cmp esi, 0x7565
je 0x5868f1
cmp esi, 0x7542
jne 0x586a67
mov ecx, dword [ebx + 0xb0]
mov dl, byte [ecx + 0x303]
test dl, dl
jne 0x5869cf
test al, al
je 0x5869cf
mov ecx, ebx
call fcn.0057fa50
push str.Restart_type_14_n
mov ecx, ebx
call fcn.00567a50
cmp esi, 0x7542
jne 0x58695f
mov eax, dword [ebx + 0xb4]
test eax, eax
je 0x586937
mov eax, dword [eax + 0x10]
jmp 0x586940
mov ecx, dword [ebx + 0xb0]
mov eax, dword [ecx + 0x24]
cmp eax, 2
jne 0x58695f
mov eax, dword [ebx + 0xb0]
mov ecx, dword [eax + 0x158]
test ecx, ecx
jne 0x58695f
mov dword [eax + 0x158], 1
mov edx, dword [ebx]
lea eax, [ebx + 0x31e0]
push eax
mov ecx, ebx
call dword [edx + 0x18]
mov edi, eax
test edi, edi
je 0x586994
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00622d8a
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0xb0]
mov ecx, dword [ebp + 8]
push ecx
mov byte [eax + 0x303], 1
mov ecx, ebx
call fcn.00585c90
mov esi, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00622d8a
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x7542
jne 0x586a67
mov eax, dword [ebp + 8]
test eax, eax
jne 0x586a67
mov eax, dword [ebx + 0x54]
test eax, eax
jl 0x586a7f
jg 0x5869fa
mov eax, dword [ebx + 0x50]
test eax, eax
jbe 0x586a67
mov eax, dword [ecx + 0x2dc]
test eax, eax
je 0x586a67
mov edx, dword [ebx + 0x31e8]
mov eax, dword [edx + 0xb8]
push eax
push 0
call fcn.005e6160
mov ecx, ebx
call fcn.0057fa50
push str.Restart_type_15_n
mov ecx, ebx
call fcn.00567a50
mov edx, dword [ebx]
lea eax, [ebx + 0x31e0]
push eax
mov ecx, ebx
call dword [edx + 0x18]
mov edi, eax
test edi, edi
je 0x586a60
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00622d8a
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
jmp 0x5869a5
mov eax, dword [ebx + 0x54]
test eax, eax
jg 0x586b8a
jl 0x586a7f
mov eax, dword [ebx + 0x50]
test eax, eax
ja 0x586b8a
mov al, byte [ebx + 0x31ed]
test al, al
jne 0x586b8a
mov eax, dword [ebx + 0xb0]
mov cl, byte [eax + 0x31a]
test cl, cl
je 0x586b8a
mov cl, byte [eax + 0x31c]
test cl, cl
jne 0x586b8a
cmp esi, 0x7565
je 0x586adb
cmp esi, 0x7566
je 0x586adb
cmp esi, 0x7542
je 0x586adb
cmp esi, 0x756e
je 0x586adb
cmp esi, 0x755e
jne 0x586b8a
mov byte [ebx + 0x31ec], 1
mov byte [ebx + 0x31ed], 1
mov cl, byte [eax + 0x31a]
test cl, cl
je 0x586afa
mov byte [eax + 0x31c], 1
mov ecx, ebx
call fcn.0057fa50
push str.Restart_type_16_n
mov ecx, ebx
call fcn.00567a50
cmp esi, 0x7542
jne 0x586b4c
mov eax, dword [ebx + 0xb4]
test eax, eax
je 0x586b24
mov eax, dword [eax + 0x10]
jmp 0x586b2d
mov eax, dword [ebx + 0xb0]
mov eax, dword [eax + 0x24]
cmp eax, 2
jne 0x586b4c
mov eax, dword [ebx + 0xb0]
mov ecx, dword [eax + 0x158]
test ecx, ecx
jne 0x586b4c
mov dword [eax + 0x158], 1
mov edx, dword [ebx]
lea eax, [ebx + 0x31e0]
push eax
mov ecx, ebx
call dword [edx + 0x18]
mov edi, eax
test edi, edi
je 0x586b81
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00622d8a
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
push eax
jmp 0x5869a5
mov ecx, dword [ebx + 0x3200]
test ecx, ecx
je 0x5869ae
call fcn.005b9b90
test al, al
jne 0x5869ae
mov eax, dword [ebx + 0xb0]
mov cl, byte [eax + 0x31b]
test cl, cl
je 0x5869ae
mov cl, byte [eax + 0x31c]
test cl, cl
jne 0x5869ae
mov cl, byte [eax + 0x31d]
test cl, cl
jne 0x5869ae
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00622d8a
mov eax, dword [ebx + 0x3200]
test eax, eax
je 0x58736d
mov ecx, dword [ebx + 0xb0]
mov eax, dword [ecx + 0xbc]
test eax, eax
jne 0x586c0b
test esi, esi
je 0x58736d
test eax, eax
je 0x586c21
push str.text_html
push eax
call fcn.0060a000
add esp, 8
test eax, eax
sete byte [ebp - 0x11]
jmp 0x586c25
mov byte [ebp - 0x11], 0
mov ecx, dword [ebx + 0x3200]
call fcn.005b9b90
test al, al
jne 0x58736d
mov eax, dword [ebx + 0xb0]
mov cl, byte [eax + 0x31b]
test cl, cl
je 0x58736d
mov cl, byte [eax + 0x31c]
test cl, cl
jne 0x58736d
mov cl, byte [eax + 0x31d]
test cl, cl
jne 0x58736d
mov al, byte [ebp - 0x11]
test al, al
jne 0x586c77
test esi, esi
je 0x58736d
mov eax, dword [0x6f7b78]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], eax
mov word [ebp - 0x48], ax
lea edx, [ebp - 0x4c]
lea eax, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x28]
push eax
lea edx, [ebp - 0x34]
push ecx
lea eax, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
push ecx
mov ecx, dword [ebx + 0x3200]
lea eax, [ebp - 0x24]
push edx
push eax
mov byte [ebp - 4], 0xa
call fcn.005b9ab0
test al, al
je 0x587325
mov ecx, dword [ebx + 0xb0]
mov byte [ecx + 0x31c], 1
mov edx, dword [ebx + 0xb0]
mov byte [edx + 0x31a], 1
mov eax, dword [ebx + 0xb0]
mov byte [eax + 0x31d], 1
mov ecx, dword [ebx + 0x3200]
call fcn.005b9a80
mov eax, dword [ebx + 0xb0]
mov ecx, dword [ebp - 0x34]
mov dword [eax + 0x24], ecx
mov eax, dword [ebx + 0xb0]
mov edx, dword [ebp - 0x38]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x24]
mov esi, dword [ebx + 0xb0]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], esi
mov eax, dword [esi]
test eax, eax
je 0x586d36
push eax
call fcn.00622af4
add esp, 4
mov edi, dword [ebp - 0x2c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00622acb
mov edx, eax
add esp, 4
test edx, edx
mov dword [esi], edx
jne 0x586dbf
push str.URL::set_serverName__:_Not_enough_memory__n
mov ecx, esi
call fcn.005df030
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 9
call fcn.00401070
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.00622d8a
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 7
call fcn.00622d8a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 6
call fcn.00622d8a
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.00622d8a
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.00622d8a
mov eax, 0x753b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx + 0x190], 0
mov edi, dword [ebx + 0xb0]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edi
mov eax, dword [edi + 4]
test eax, eax
je 0x586e08
push eax
call fcn.00622af4
add esp, 4
xor edx, edx
cmp esi, edx
jne 0x586e13
mov dword [edi + 4], edx
jmp 0x586e72
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x586e29
mov eax, dword [ebp - 0x2c]
mov dword [eax + 4], edx
jmp 0x586e72
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00622acb
mov ecx, dword [ebp - 0x2c]
mov edx, eax
add esp, 4
test edx, edx
mov dword [ecx + 4], edx
jne 0x586e53
push str.URL::set_serverPath__:_Not_enough_memory__n
jmp 0x586d5a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0xb0]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [eax + 8]
test eax, eax
je 0x586e8e
push eax
call fcn.00622af4
add esp, 4
mov cl, byte [0x6fc418]
test esi, esi
mov byte [ebp - 0x12], cl
jne 0x586e9e
lea esi, [ebp - 0x12]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00622acb
mov ecx, dword [ebp - 0x3c]
mov edx, eax
add esp, 4
test edx, edx
mov dword [ecx + 8], edx
jne 0x586ec8
push str.URL::set_fileName__:_Not_enough_memory__n
jmp 0x586d5a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0xb0]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edi
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x586f03
push eax
call fcn.00622af4
add esp, 4
xor edx, edx
cmp esi, edx
jne 0x586f0e
mov dword [edi + 0x1c], edx
jmp 0x586f6f
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x586f24
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x1c], edx
jmp 0x586f6f
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00622acb
mov ecx, dword [ebp - 0x2c]
mov edx, eax
add esp, 4
test edx, edx
mov dword [ecx + 0x1c], edx
jne 0x586f50
push str.URL::set_Cookie__:_Not_enough_memory__n
call fcn.005df030
jmp 0x586f6f
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0xb0]
push 0x6fc418
add ecx, 0xc4
call fcn.00622f13
mov ecx, dword [ebx + 0xb0]
mov byte [ecx + 0x309], 0
mov esi, dword [ebx + 0xb0]
mov eax, dword [esi + 0x18]
test eax, eax
je 0x586fa8
push eax
call fcn.00622af4
add esp, 4
mov edx, 0x6fc418
test edx, edx
jne 0x586fb6
mov dword [esi + 0x18], edx
jmp 0x58701c
mov edi, 0x6fc418
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x586fcc
mov dword [esi + 0x18], eax
jmp 0x58701c
mov edi, 0x6fc418
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00622acb
mov edx, eax
add esp, 4
test edx, edx
mov dword [esi + 0x18], edx
jne 0x586ffa
push str.URL::set_Referer__:_Not_enough_memory__n
mov ecx, esi
call fcn.005df030
jmp 0x58701c
mov edi, 0x6fc418
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x31e8]
test eax, eax
je 0x587062
mov eax, dword [eax + 0xb8]
test eax, eax
je 0x587062
mov ecx, dword [ebx + 0xb0]
mov edx, dword [ecx + 0x43c]
test edx, edx
jne 0x587046
push eax
call fcn.005e6030
mov ecx, dword [ebx + 0xb0]
mov eax, dword [ecx + 0x43c]
test eax, eax
je 0x587062
push str.Referer
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x58706c
lea eax, [ebp - 0x48]
push eax
call fcn.00609a4e
add esp, 4
test eax, eax
je 0x5870da
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x587083
lea eax, [ebp - 0x48]
mov ecx, dword [ebx + 0xb0]
push eax
call fcn.005e3ff0
mov eax, dword [ebx + 0x31e8]
test eax, eax
je 0x5870da
mov eax, dword [eax + 0xb8]
test eax, eax
je 0x5870af
mov ecx, dword [ebx + 0xb0]
push eax
call fcn.005e1b90
mov eax, dword [ebx + 0x31e8]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x5870da
mov edx, dword [eax + 0xb8]
mov eax, dword [ecx]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edx
push 0x13c9
push 0x111
push eax
call esi
jmp 0x5870e0
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebx + 0xb0]
push 0x6fc418
mov byte [ecx + 0x18a], 1
mov ecx, dword [ebx + 0xb0]
add ecx, 0x174
call fcn.00622f13
mov edx, dword [ebx + 0xb0]
mov byte [edx + 0x170], 0
mov eax, dword [ebx + 0xb0]
mov byte [eax + 0x30f], 0
mov ecx, dword [ebx + 0xb0]
push ecx
mov byte [ebx + 0xc8], 0
call fcn.0051a120
add esp, 4
mov ecx, ebx
call fcn.0057ffb0
mov eax, dword [ebx + 0xac]
test eax, eax
jne 0x5871cf
mov edx, dword [ebx + 0xa0]
mov eax, dword [edx]
mov eax, dword [eax]
test eax, eax
je 0x587165
push 0
push 0x1478
push 0x111
push eax
call esi
mov eax, dword [ebx + 0x31e8]
test eax, eax
je 0x5871cf
mov eax, dword [eax + 0xb8]
test eax, eax
je 0x5871cf
mov ecx, dword [ebx + 0xb0]
push 0
push 0
push eax
call fcn.005e13f0
mov eax, dword [ebx + 0x31e8]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x5871ac
mov edx, dword [eax + 0xb8]
mov eax, dword [ecx]
push edx
push 0x1395
push 0x111
push eax
call esi
mov eax, dword [ebx + 0x31e8]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x5871cf
mov edx, dword [eax + 0xb8]
mov eax, dword [ecx]
push edx
push 0x1395
push 0x111
push eax
call esi
mov eax, dword [ebx + 0x31d8]
test eax, eax
je 0x5871f8
push eax
mov byte [ebp - 4], 0xb
call fcn.00622af4
add esp, 4
jmp 0x5871f1
mov dword [ebp - 4], 0xa
mov ecx, dword [ebx + 0xb0]
mov dword [ebx + 0x31d8], 0
call fcn.005e45d0
mov ecx, ebx
call fcn.0057fa50
push str.Restart_type_17_n
mov ecx, ebx
call fcn.00567a50
mov edx, dword [ebx]
lea eax, [ebx + 0x31e0]
push eax
mov ecx, ebx
call dword [edx + 0x18]
mov esi, eax
test esi, esi
jne 0x5872c8
mov ecx, dword [ebp + 8]
push ecx
mov ecx, ebx
call fcn.00585c90
mov esi, eax
test esi, esi
jne 0x5872c8
mov edx, dword [ebx + 0xb0]
mov eax, dword [edx + 0xbc]
test eax, eax
je 0x5872c8
push str.text_html
push eax
call fcn.0060a000
add esp, 8
test eax, eax
je 0x5872c8
mov eax, dword [ebx + 0x31e8]
test eax, eax
je 0x5872c8
mov eax, dword [eax + 0xb8]
test eax, eax
je 0x5872c8
mov ecx, dword [ebx + 0xb0]
mov edx, dword [ecx + 0x43c]
test edx, edx
jne 0x587295
push eax
call fcn.005e6030
mov ebx, dword [ebx + 0xb0]
mov eax, dword [ebx + 0x43c]
test eax, eax
je 0x5872c8
lea eax, [ebp + 8]
push 4
push eax
mov dword [ebp + 8], 1
mov ecx, dword [ebx + 0x43c]
push 4
push 0
push str.noSyntRef
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 9
call fcn.00401070
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.00622d8a
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 7
call fcn.00622d8a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 6
call fcn.00622d8a
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.00622d8a
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.00622d8a
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 9
call fcn.00401070
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.00622d8a
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 7
call fcn.00622d8a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 6
call fcn.00622d8a
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.00622d8a
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.00622d8a
mov edx, dword [ebx + 0x3238]
cmp edx, 0xc8
jne 0x587397
mov eax, dword [ebx + 0x48]
mov ecx, dword [ebx + 0x4c]
or eax, ecx
jne 0x587397
mov ecx, dword [ebx + 0x31f8]
mov eax, dword [ebx + 0x31fc]
mov dword [ebx + 0x48], ecx
mov dword [ebx + 0x4c], eax
cmp edx, 0xce
jne 0x587496
mov ecx, dword [ebx + 0x48]
mov eax, dword [ebx + 0x4c]
or ecx, eax
jne 0x5873e5
mov eax, dword [ebx + 0x54]
test eax, eax
jg 0x5873e5
jl 0x5873bd
mov eax, dword [ebx + 0x50]
test eax, eax
ja 0x5873e5
mov eax, dword [ebx + 0x31f8]
mov ecx, dword [ebx + 0x31fc]
mov esi, eax
or esi, ecx
je 0x5873e5
mov esi, dword [ebx + 0x3258]
mov edi, dword [ebx + 0x325c]
or esi, edi
jne 0x5873e5
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], ecx
cmp edx, 0xce
jne 0x587496
mov edx, dword [ebx + 0x48]
mov eax, dword [ebx + 0x4c]
or edx, eax
jne 0x587496
mov edi, dword [ebx + 0x54]
mov eax, dword [ebx + 0x50]
test edi, edi
jg 0x587484
jl 0x58740f
test eax, eax
ja 0x58743f
mov esi, dword [ebx + 0x3258]
mov ecx, dword [ebx + 0x325c]
mov eax, esi
or eax, ecx
je 0x58743f
mov eax, dword [ebx + 0x31fc]
mov edx, dword [ebx + 0x31f8]
cmp ecx, eax
jg 0x58743f
jl 0x587437
cmp esi, edx
jae 0x58743f
mov dword [ebx + 0x48], edx
mov dword [ebx + 0x4c], eax
jmp 0x587496
test edi, edi
jg 0x587484
jl 0x58744c
mov eax, dword [ebx + 0x50]
test eax, eax
ja 0x587484
mov edx, dword [ebx + 0x31f8]
mov edi, dword [ebx + 0x31fc]
mov ecx, edx
or ecx, edi
je 0x587484
mov esi, dword [ebx + 0x3258]
mov eax, edx
add eax, 1
mov ecx, edi
adc ecx, 0
cmp esi, eax
jne 0x587484
mov eax, dword [ebx + 0x325c]
cmp eax, ecx
jne 0x587484
mov dword [ebx + 0x48], edx
mov dword [ebx + 0x4c], edi
jmp 0x587496
mov ecx, dword [ebx + 0x3258]
mov edx, dword [ebx + 0x325c]
mov dword [ebx + 0x48], ecx
mov dword [ebx + 0x4c], edx
mov edx, dword [ebx + 0x3238]
cmp edx, 0xc8
je 0x5874ac
cmp edx, 0xce
jne 0x5874d2
mov eax, dword [ebx + 0x48]
mov ecx, dword [ebx + 0x4c]
or eax, ecx
jne 0x5874d2
mov eax, dword [ebx + 0x3274]
mov ecx, dword [ebx + 0x3270]
test eax, eax
jl 0x5874d2
jg 0x5874cc
test ecx, ecx
jbe 0x5874d2
mov dword [ebx + 0x48], ecx
mov dword [ebx + 0x4c], eax
mov edi, dword [ebx + 0xb0]
xor esi, esi
mov dword [ebp - 0x24], edi
cmp dword [edi + 0x2fc], esi
je 0x587523
mov eax, dword [ebx + 0x31e8]
cmp eax, esi
je 0x587523
cmp dword [eax + 0x40], esi
je 0x587523
cmp edx, 0xc8
jne 0x58751d
mov eax, dword [ebx + 0x31fc]
mov ecx, dword [ebx + 0x31f8]
cmp eax, esi
jl 0x58751d
jg 0x587512
cmp ecx, esi
jbe 0x58751d
sub ecx, 1
sbb eax, esi
mov dword [ebx + 0x60], ecx
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x48], esi
mov dword [ebx + 0x4c], esi
mov esi, dword [ebx + 0x48]
mov eax, dword [ebx + 0x4c]
mov ecx, esi
or ecx, eax
je 0x58760f
mov eax, dword [ebx + 0x31e8]
mov ecx, dword [eax + 0xd0]
mov edx, dword [eax + 0xd4]
mov edi, ecx
or edi, edx
je 0x58760c
cmp ecx, esi
jne 0x58755c
cmp edx, dword [ebx + 0x4c]
je 0x58760c
mov esi, dword [eax + 0xc8]
mov edi, dword [eax + 0xcc]
or esi, edi
je 0x58760c
cmp byte [ebx + 0x3240], 0
jne 0x58760c
cmp dword [ebx + 0x3238], 0xce
jne 0x5875bf
mov edi, dword [ebx + 0x3258]
mov esi, dword [ebx + 0x325c]
sub ecx, 1
sbb edx, 0
cmp edi, ecx
jne 0x5875bf
cmp esi, edx
jne 0x5875bf
mov edx, dword [ebx + 0x3260]
mov ecx, dword [ebx + 0x3264]
or edx, ecx
jne 0x5875bf
mov dword [ebx + 0x3260], edi
mov dword [ebx + 0x3264], esi
mov esi, dword [ebx + 0x3260]
mov ecx, dword [ebx + 0x3264]
mov edi, dword [ebp - 0x24]
mov edx, esi
or edx, ecx
je 0x58794a
mov edi, dword [eax + 0xd0]
mov edx, dword [eax + 0xd4]
mov ecx, edi
mov dword [ebp - 0x3c], edx
sub ecx, 1
sbb edx, 0
cmp esi, ecx
jne 0x587947
cmp dword [ebx + 0x3264], edx
jne 0x587947
mov eax, dword [ebp - 0x3c]
mov dword [ebx + 0x48], edi
mov dword [ebx + 0x4c], eax
mov edi, dword [ebp - 0x24]
mov al, byte [ebx + 0x3240]
test al, al
jne 0x587b80
mov esi, dword [edi + 0xbc]
test esi, esi
je 0x587b5a
mov edx, dword [edi + 0x108]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x587b5a
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x587b5a
push 0x3b
push edx
mov dword [ebp - 0x2c], 1
call fcn.00609c00
add esp, 8
test eax, eax
je 0x5876b4
mov ecx, dword [ebx + 0xb0]
push 0x3b
mov edx, dword [ecx + 0xbc]
push edx
call fcn.00609c00
add esp, 8
test eax, eax
jne 0x5876b4
mov eax, dword [ebx + 0xb0]
or ecx, 0xffffffff
mov edx, dword [eax + 0xbc]
mov esi, dword [eax + 0x108]
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call fcn.0060d550
add esp, 0xc
test eax, eax
jne 0x5876b4
mov dword [ebp - 0x2c], eax
mov edx, dword [ebx + 0xb0]
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [edx + 0x108]
mov edi, esi
repne scasb al, byte es:[edi]
mov eax, dword [edx + 0xbc]
not ecx
dec ecx
push ecx
push eax
push esi
call fcn.0060d550
add esp, 0xc
test eax, eax
je 0x587b5a
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x587b5a
mov ecx, dword [ebx + 0xb0]
push 9
push str.text_html
mov byte [ebp - 0x11], 1
mov eax, dword [ecx + 0x108]
push eax
call fcn.0060bf70
add esp, 0xc
test eax, eax
jne 0x587738
mov edx, dword [ebx + 0xb0]
push 9
push str.text_html
mov eax, dword [edx + 0xbc]
push eax
call fcn.0060bf70
add esp, 0xc
test eax, eax
je 0x587738
mov byte [ebp - 0x11], 0
mov ecx, dword [ebx + 0xb0]
push 0xa
push 0x6cc3d8
mov eax, dword [ecx + 0x108]
push eax
call fcn.0060bf70
add esp, 0xc
test eax, eax
jne 0x58777c
mov edx, dword [ebx + 0xb0]
push 9
push str.text_html
mov eax, dword [edx + 0xbc]
push eax
call fcn.0060bf70
add esp, 0xc
test eax, eax
je 0x58777c
mov byte [ebp - 0x11], 0
mov ecx, dword [ebx + 0xb0]
push 0x15
push str.application_x_mpegURL
mov eax, dword [ecx + 0x108]
push eax
call fcn.0060d550
add esp, 0xc
test eax, eax
jne 0x5877f4
mov edx, dword [ebx + 0xb0]
push 0x1d
push str.application_vnd.apple.mpegurl
mov eax, dword [edx + 0xbc]
push eax
call fcn.0060d550
add esp, 0xc
test eax, eax
je 0x5877da
mov ecx, dword [ebx + 0xb0]
push str.video_MP2T
mov edx, dword [ecx + 0xbc]
push edx
call fcn.0060a000
add esp, 8
test eax, eax
jne 0x5877f4
mov ecx, dword [ebx + 0xb0]
push 0x6fc418
add ecx, 0x108
mov byte [ebp - 0x11], 0
call fcn.00622f13
mov eax, dword [ebx + 0xb0]
push 9
push str.text_html
mov ecx, dword [eax + 0xbc]
push ecx
call fcn.0060bf70
add esp, 0xc
test eax, eax
je 0x5878e4
mov edx, dword [ebx + 0xb0]
push str..youtube.com
mov eax, dword [edx]
push eax
call fcn.00609cc0
add esp, 8
test eax, eax
jne 0x587850
mov ecx, dword [ebx + 0xb0]
push str..googlevideo.com
mov edx, dword [ecx]
push edx
call fcn.00609cc0
add esp, 8
test eax, eax
je 0x5878e4
mov eax, dword [ebx + 0xb0]
mov esi, dword [eax + 8]
test esi, esi
je 0x5878e4
mov ecx, 7
mov edi, str.videoplayback_
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x5878e4
mov eax, dword [eax + 0xbc]
push 6
push str.video_
push eax
call fcn.0060bf70
add esp, 0xc
test eax, eax
jne 0x5878ca
mov ecx, dword [ebx + 0xb0]
push 6
push str.audio_
mov edx, dword [ecx + 0xbc]
push edx
call fcn.0060bf70
add esp, 0xc
test eax, eax
jne 0x5878ca
mov eax, dword [ebx + 0xb0]
push str.application_octet_stream
mov ecx, dword [eax + 0xbc]
push ecx
call fcn.0060a000
add esp, 8
test eax, eax
jne 0x5878e4
mov ecx, dword [ebx + 0xb0]
push 0x6fc418
add ecx, 0x108
mov byte [ebp - 0x11], 0
call fcn.00622f13
mov al, byte [ebp - 0x11]
test al, al
je 0x587b5a
mov ecx, dword [ebx + 0x31e8]
mov eax, dword [ecx + 0x13c]
test eax, eax
je 0x587afb
mov eax, dword [ebx + 0xb0]
mov dl, byte [eax + 0x31f]
test dl, dl
jne 0x587921
mov dl, byte [eax + 0x16a]
test dl, dl
je 0x587afb
mov edx, dword [ecx + 0xc8]
lea eax, [ecx + 0xc8]
mov ecx, dword [ecx + 0xcc]
or edx, ecx
je 0x587b5a
mov byte [ebx + 0x3240], 1
jmp 0x587b5a
mov edi, dword [ebp - 0x24]
cmp dword [ebx + 0x3238], 0xce
jne 0x5879a8
mov esi, dword [ebx + 0x3278]
mov ecx, dword [ebx + 0x327c]
mov edx, esi
or edx, ecx
je 0x5879a8
mov edi, dword [eax + 0xd0]
mov edx, dword [eax + 0xd4]
mov ecx, edi
mov dword [ebp - 0x3c], edx
sub ecx, esi
mov esi, dword [ebx + 0x327c]
sbb edx, esi
mov esi, dword [ebx + 0x31f8]
cmp esi, ecx
jne 0x5879a5
mov ecx, dword [ebx + 0x31fc]
cmp ecx, edx
jne 0x5879a5
mov edx, dword [ebp - 0x3c]
mov dword [ebx + 0x48], edi
mov dword [ebx + 0x4c], edx
jmp 0x58760c
mov edi, dword [ebp - 0x24]
mov ecx, dword [eax + 0x13c]
test ecx, ecx
je 0x5879d2
mov cl, byte [edi + 0x31f]
test cl, cl
jne 0x5879c6
mov cl, byte [edi + 0x16a]
test cl, cl
je 0x5879d2
mov byte [ebx + 0x3240], 1
jmp 0x58760f
mov dl, byte [ebx + 0x324d]
test dl, dl
je 0x587a13
mov ecx, dword [eax + 0xd0]
mov esi, dword [ebx + 0x3258]
mov eax, dword [eax + 0xd4]
cmp esi, ecx
jne 0x587a13
mov esi, dword [ebx + 0x325c]
cmp esi, eax
jne 0x587a13
cmp dword [ebx + 0x3238], 0xce
jne 0x587a13
mov dword [ebx + 0x48], ecx
mov dword [ebx + 0x4c], eax
jmp 0x58760f
mov eax, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
test eax, eax
jg 0x587a76
jl 0x587a23
test ecx, ecx
ja 0x587a64
cmp byte [ebx + 0x31ed], 0
jne 0x587a64
cmp byte [edi + 0x31a], 0
je 0x587a64
cmp byte [edi + 0x31c], 0
jne 0x587a64
mov byte [ebx + 0x31ec], 1
mov byte [ebx + 0x31ed], 1
mov al, byte [edi + 0x31a]
test al, al
je 0x587a5d
mov byte [edi + 0x31c], 1
push str.Restart_type_21a_n
jmp 0x587ab9
test eax, eax
jl 0x587b3b
jg 0x587a76
test ecx, ecx
jbe 0x587b3b
mov al, byte [ebx + 0x31f4]
test al, al
jne 0x587b3b
test dl, dl
jne 0x587b3b
mov byte [ebx + 0x324d], 1
mov dword [edi + 0x2dc], 1
mov eax, dword [ebx + 0xb0]
mov cl, byte [eax + 0x31a]
test cl, cl
je 0x587ab4
mov byte [eax + 0x31c], 1
push str.Restart_type_21b_n
mov ecx, ebx
call fcn.00567a50
mov ecx, ebx
call fcn.0057fa50
mov edx, dword [ebx]
lea eax, [ebx + 0x31e0]
push eax
mov ecx, ebx
call dword [edx + 0x18]
test eax, eax
jne 0x587dc0
mov eax, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.00585c90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0xb0]
push 9
push str.text_html
mov ecx, dword [eax + 0xbc]
push ecx
call fcn.0060bf70
add esp, 0xc
test eax, eax
je 0x587b3b
mov ecx, dword [ebx + 0x48]
mov edx, dword [ebx + 0x4c]
mov eax, ecx
or eax, edx
je 0x587b3b
mov eax, dword [ebx + 0xb0]
add eax, 0x128
cmp ecx, dword [eax]
jne 0x587b3b
cmp edx, dword [eax + 4]
je 0x587b5a
mov ecx, ebx
call fcn.0057fa50
mov eax, 0x757a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, byte [ebx + 0x3240]
test al, al
jne 0x587b80
mov edx, dword [ebx + 0x320c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x587b80
push edx
mov ecx, ebx
call fcn.005919f0
push 0x6fc418
lea ecx, [ebx + 0x320c]
xor edi, edi
call fcn.00622f13
mov al, byte [ebx + 0x3240]
test al, al
je 0x587d07
lea ecx, [ebx + 0x10]
mov byte [ebx + 0x3240], 0
call fcn.00570460
mov eax, dword [ebx + 0x31e8]
mov ecx, dword [eax + 0xb0]
cmp ecx, edi
lea ecx, [eax + 0x28]
setne byte [ebp - 0x12]
call fcn.0055c4a0
mov ecx, dword [ebx + 0x31e8]
mov dword [ecx + 0xc8], edi
mov dword [ecx + 0xcc], edi
mov edx, dword [ebx + 0x31e8]
mov dword [edx + 0xd0], edi
mov dword [edx + 0xd4], edi
mov eax, dword [ebx + 0x31e8]
mov dword [eax + 0x1c0], edi
mov dword [eax + 0x1c4], edi
mov eax, dword [ebx + 0x31e8]
mov dword [ebx + 0x50], edi
mov dword [ebx + 0x60], edi
mov dword [ebx + 0x68], edi
mov dword [ebx + 0x70], edi
mov dword [ebx + 0x58], edi
mov dword [ebx + 0x31f8], edi
mov dword [ebx + 0x3250], edi
mov dword [ebx + 0x3258], edi
mov dword [ebx + 0x3260], edi
mov dword [ebx + 0x48], edi
mov dword [ebx + 0x3270], edi
cmp eax, edi
mov dword [ebx + 0x323c], edi
mov dword [ebx + 0x90], edi
mov dword [ebx + 0x54], edi
mov dword [ebx + 0x64], edi
mov dword [ebx + 0x6c], edi
mov dword [ebx + 0x74], edi
mov dword [ebx + 0x5c], edi
mov dword [ebx + 0x31fc], edi
mov dword [ebx + 0x3254], edi
mov dword [ebx + 0x325c], edi
mov dword [ebx + 0x3264], edi
mov dword [ebx + 0x4c], edi
mov dword [ebx + 0x3274], edi
je 0x587c7c
mov byte [eax + 0x85d], 0
push str.Restart_type_008_n
mov ecx, ebx
call fcn.00567a50
mov ecx, ebx
call fcn.0057fa50
mov edx, dword [ebx]
lea eax, [ebx + 0x31e0]
push eax
mov ecx, ebx
call dword [edx + 0x18]
cmp eax, edi
jne 0x587dc0
mov eax, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.00585c90
mov esi, eax
cmp esi, edi
je 0x587cc9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, byte [ebp - 0x12]
test al, al
je 0x587ceb
mov ecx, dword [ebx + 0xb0]
mov edx, dword [ecx + 0x30]
mov ecx, dword [ebx + 0x31e8]
push edx
push ebx
add ecx, 0x28
call fcn.0055e520
mov esi, eax
mov ecx, ebx
call fcn.0056bd00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx + 0x8c], 6
mov dword [ebx + 0xa8], edi
mov eax, dword [0x6fde58]
push 1
push eax
mov ecx, ebx
call fcn.00567980
cmp dword [ebx + 0xac], edi
jne 0x587d55
mov eax, dword [ebx + 0x31e8]
mov ecx, dword [eax + 0x18]
cmp ecx, edi
je 0x587d55
mov edx, dword [eax + 0xb8]
mov eax, dword [ecx]
push edx
push 0
nop
nop
nop
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, byte [ebp - 0x12]
test al, al
je 0x587d95
mov ebx, dword [ebx + 0x184]
mov eax, 4
cmp dword [ebx + 0x154], eax
jne 0x587d95
mov cl, byte [ebx + 0x15e]
test cl, cl
je 0x587d95
mov edx, dword [0x6fcafc]
lea ecx, [ebp + 8]
push eax
push ecx
push eax
push edi
push str.SocksType
push edx
mov dword [ebp + 8], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4