Function at 0x10049150
Capabilities:
Create process on windows
Self delete

Disassembly:
mov eax, 0x100d20cf
call fcn.100b286c
sub esp, 0x10c
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ebx
jne 0x10049178
xor eax, eax
inc eax
jmp 0x1004a543
push str.UNINSTALL
lea ecx, [ebp - 0x1c]
call fcn.1007e254
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
add esi, 8
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.1007f09b
or edi, 0xffffffff
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x100491fb
lea ecx, [ebp - 0x1c]
call fcn.1007e247
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], 1
call fcn.1001a51c
cmp eax, ebx
je 0x100491f3
push str.unwise.exe
lea ecx, [ebp - 0x1c]
call fcn.1007ee1f
push 5
push ebx
push ebx
lea ecx, [ebp - 0x1c]
call fcn.1007e49f
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x1c]
jmp 0x1004a530
push str.OPEN_EMAIL_SUPPORT
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049241
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
add eax, 0x14
push eax
call fcn.1004675e
jmp 0x1004a538
push str.OPEN_RADIO_SETTINGS_DLG
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 3
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x100492c8
push 0xd8
call fcn.100b29d4
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 4], 4
je 0x1004929e
push dword [esi + 4]
mov ecx, eax
call fcn.10069487
mov dword [ebp - 0x24], eax
jmp 0x100492a1
mov dword [ebp - 0x24], ebx
push dword [esi + 0x2c]
mov ecx, dword [ebp - 0x24]
push dword [esi + 0x30]
mov dword [ebp - 4], edi
call fcn.1002c5f4
mov ecx, dword [ebp - 0x24]
cmp ecx, ebx
je 0x1004a538
mov eax, dword [ecx]
push 1
call dword [eax]
jmp 0x1004a538
push str.EMAIL_NOTIFIER_OPTIONS
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 5
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x1004934b
push 0xa0
call fcn.100b29d4
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov dword [ebp - 4], 6
je 0x10049325
mov ecx, dword [ebp - 0x20]
push ebx
push dword [ecx + 4]
mov ecx, eax
call fcn.1002da41
mov esi, eax
jmp 0x10049327
xor esi, esi
cmp esi, ebx
mov dword [ebp - 4], edi
je 0x1004a538
mov eax, dword [ebp - 0x20]
push dword [eax + 0x2c]
mov ecx, esi
push dword [eax + 0x30]
call fcn.1002c5f4
mov eax, dword [esi]
mov ecx, esi
jmp 0x100492bf
push str.OPTIONS
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 7
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x100494c1
push str.Toolbar_Options
lea ecx, [ebp - 0x48]
call fcn.1007e254
mov esi, 0x100df794
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 8
call fcn.1007e254
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x14], ebx
mov byte [ebp - 4], 9
je 0x100493fa
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x10], esp
push esi
call fcn.1007e254
mov esi, dword [ebp - 0x20]
mov ecx, dword [esi + 0x14]
call fcn.1005d8c3
mov ecx, eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x10], ecx
call fcn.1007b1a7
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xa
call fcn.1007e46a
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 9
call fcn.1007e410
push dword [ebp - 0x10]
mov ecx, dword [esi + 0x14]
call fcn.1005d597
lea ecx, [ebp - 0x1c]
call fcn.1007e67a
test eax, eax
mov esi, dword [ebp - 0x20]
jne 0x10049467
cmp dword [esi + 0x10], ebx
je 0x10049467
push str.CTLP_STR_ID_OPTIONS_DLG_TITLE
lea ecx, [ebp - 0x54]
call fcn.1007e254
mov ecx, dword [esi + 0x10]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0xb
call fcn.10077be9
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xc
call fcn.1007e67a
test eax, eax
jne 0x1004944f
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x48]
call fcn.1007e46a
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xb
call fcn.1007e410
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 9
call fcn.1007e410
push ebx
push dword [esi + 4]
lea eax, [ebp - 0x48]
push 5
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.1007ed4f
push dword [esi + 0x2c]
lea ecx, [ebp - 0xcc]
push dword [esi + 0x30]
call fcn.1008cbaf
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0xd
call fcn.1008d197
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 9
call fcn.1008d00e
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call fcn.1007e410
lea ecx, [ebp - 0x48]
jmp 0x1004a530
push str.AUTOUPDATE
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0xe
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
jne 0x1004a538
push str.SHRINK_TOOLBAR
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0xf
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x1004956b
push 8
call fcn.100b29d4
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0x10
jmp 0x100495af
xor eax, eax
mov esi, dword [ebp - 0x20]
mov ecx, dword [esi + 0x34]
push eax
push dword [eax + 4]
mov dword [ebp - 4], edi
call fcn.1002bed9
push ebx
push 0x90
push dword [0x101213e8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1004a538
push str.UNSHRINK_TOOLBAR
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x11
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x100495be
push 8
call fcn.100b29d4
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0x12
cmp eax, ebx
je 0x1004953d
push 0x11
mov ecx, eax
call fcn.10033405
jmp 0x1004953f
push str.REFRESH_TOOLBAR_VIEW
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x13
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x100496b4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x10], ebx
call fcn.1001f28a
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x24], esp
mov esi, 0x100df794
push esi
call fcn.1007e254
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xc]
push ebx
call fcn.1002249b
push 0x48
call fcn.100b29d4
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, ebx
mov dword [ebp - 4], 0x14
je 0x10049647
mov ecx, eax
call fcn.10034999
mov dword [ebp - 0x24], eax
jmp 0x1004964a
mov dword [ebp - 0x24], ebx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x58], esp
push esi
mov dword [ebp - 4], edi
call fcn.1007e254
mov esi, dword [ebp - 0x20]
push 1
push ebx
sub esp, 0xc
lea eax, [esi + 0x88]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 4], 0x15
call fcn.1007ed4f
sub esp, 0xc
lea eax, [esi + 0x7c]
mov ecx, esp
mov dword [ebp - 0x38], esp
push eax
mov byte [ebp - 4], 0x16
call fcn.1007ed4f
mov ecx, dword [ebp - 0x24]
push dword [esi + 4]
mov eax, dword [ecx]
mov dword [ebp - 4], edi
call dword [eax + 0x14]
mov ecx, dword [ebp - 0x24]
cmp eax, ebx
mov eax, dword [ecx]
je 0x100492bf
call dword [eax + 8]
jmp 0x1004a538
push str.CLEAN_CACHE
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x17
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049731
lea ecx, [ebp - 0x3c]
call fcn.10007b92
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f02
push ebx
mov dword [ebp - 4], 0x18
call esi
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea ecx, [ebp - 0x3c]
call fcn.10007fc4
push 0x7f00
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], edi
call fcn.10007ba7
jmp 0x1004a538
push str.CLEAN_HISTORY
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x19
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x1004993e
lea ecx, [ebp - 0x3c]
call fcn.10007b92
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f02
push ebx
mov dword [ebp - 4], 0x1a
call esi
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea ecx, [ebp - 0x3c]
call fcn.10007fde
push 0x7f00
push ebx
mov dword [ebp - 0x10], eax
call esi
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp + 8]
add eax, 0x14
push eax
lea ecx, [ebp - 0x1c]
call fcn.1007ed4f
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x1b
call fcn.1007eb35
lea ecx, [ebp - 0x1c]
call fcn.1007e4d3
dec eax
push 0x24
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], eax
call fcn.1007eebb
mov esi, 0x100df794
push esi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x24], eax
call fcn.1007e254
push esi
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x1c
call fcn.1007e254
cmp dword [ebp - 0x10], ebx
mov byte [ebp - 4], 0x1d
je 0x10049915
lea ecx, [ebp - 0x1c]
call fcn.1007e67a
test eax, eax
jne 0x100498a9
mov eax, dword [ebp - 0x24]
cmp eax, edi
je 0x100498a9
mov esi, dword [ebp - 0x20]
cmp esi, eax
je 0x100498a9
cmp eax, ebx
je 0x100498a9
push eax
push ebx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1007ef13
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x20
call fcn.1007e46a
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x1d
call fcn.1007e410
lea ecx, [ebp - 0x48]
call fcn.1007eb35
mov eax, dword [ebp - 0x24]
sub esi, eax
push esi
inc eax
push eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1007ef13
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x21
call fcn.1007e46a
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x1d
call fcn.1007e410
lea ecx, [ebp - 0x54]
call fcn.1007eb35
lea ecx, [ebp - 0x48]
call fcn.1007e67a
test eax, eax
jne 0x10049915
lea ecx, [ebp - 0x54]
call fcn.1007e67a
test eax, eax
jne 0x10049915
jmp 0x100498fb
push str.History_Has_Been_Cleaned
lea ecx, [ebp - 0x34]
call fcn.1007e254
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x1e
call fcn.1007e46a
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x1d
call fcn.1007e410
push str.The_browser_history_cleaning_will_be_finalized_in_the_next_Internet_Explorer_window_that_you_open.
lea ecx, [ebp - 0x34]
call fcn.1007e254
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x1f
call fcn.1007e46a
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x1d
call fcn.1007e410
lea ecx, [ebp - 0x54]
push ebx
call fcn.1007e558
lea ecx, [ebp - 0x48]
push eax
call fcn.1007e558
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x1c
call fcn.1007e410
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x1b
call fcn.1007e410
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x1a
call fcn.1007e410
jmp 0x10049721
push str.CLEAR_COOKIES
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x22
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x100499a1
lea ecx, [ebp - 0x3c]
call fcn.10007b92
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f02
push ebx
mov dword [ebp - 4], 0x23
call esi
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea ecx, [ebp - 0x3c]
call fcn.10007fd1
jmp 0x10049712
push str.DELETE_SEARCH_HISTORY
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x24
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049a0c
push 0x54
call fcn.100b29d4
pop ecx
mov dword [ebp - 0x38], eax
cmp eax, ebx
mov dword [ebp - 4], 0x25
je 0x100499f4
push 7
mov ecx, eax
call fcn.10033d42
jmp 0x100499f6
xor eax, eax
push eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x34]
push 1
mov dword [ebp - 4], edi
call fcn.1002bed9
jmp 0x1004a538
push str.USER_DEFINE_COMPONENTS
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x26
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049a4b
mov ecx, dword [ebp - 0x20]
call fcn.10046dc2
jmp 0x1004a538
push str.DO_UPGRADE
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x27
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049a8a
mov ecx, dword [ebp - 0x20]
call fcn.10046365
jmp 0x1004a538
push str.TELLAFRIEND
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x28
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049ac9
mov ecx, dword [ebp - 0x20]
call fcn.1004670b
jmp 0x1004a538
push str.HELP
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x29
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049b08
mov ecx, dword [ebp - 0x20]
call fcn.10046666
jmp 0x1004a538
push str.HOMEPAGE
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2a
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049b47
mov ecx, dword [ebp - 0x20]
call fcn.1004651c
jmp 0x1004a538
push str.PRIVACY
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2b
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049b86
mov ecx, dword [ebp - 0x20]
call fcn.100465c1
jmp 0x1004a538
push str.ABOUT
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2c
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049bc5
mov ecx, dword [ebp - 0x20]
call fcn.100464d7
jmp 0x1004a538
push str.CONTACTUS
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2d
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049c04
mov ecx, dword [ebp - 0x20]
call fcn.10046457
jmp 0x1004a538
push str.WINWORD
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2e
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049c50
push 1
push ebx
push ebx
push str.winword
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1004a538
push str.NOTEPAD
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2f
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049c8d
push 1
push ebx
push ebx
push str.notepad
jmp 0x10049c3f
push str.CALC
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x30
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049ccd
push 1
push ebx
push ebx
push str.calc
jmp 0x10049c3f
push str.EXCEL
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x31
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049d0d
push 1
push ebx
push ebx
push str.excel
jmp 0x10049c3f
push str.PAINT
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x32
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049d4d
push 1
push ebx
push ebx
push str.mspaint
jmp 0x10049c3f
push str.NETMEETING
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x33
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049d8d
push 1
push ebx
push ebx
push str.conf
jmp 0x10049c3f
push str.OUTLOOK
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x34
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049dcd
push 1
push ebx
push ebx
push str.outlook
jmp 0x10049c3f
push str.DIALER
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x35
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049e0d
push 1
push ebx
push ebx
push str.dialer
jmp 0x10049c3f
push str.MSCONFIG
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x36
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049e4d
push 1
push ebx
push ebx
push str.msconfig
jmp 0x10049c3f
push str.FRONTPAGE
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x37
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049e8d
push 1
push ebx
push ebx
push str.frontpg
jmp 0x10049c3f
push str.HELPCENTER
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x38
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049ecd
push 1
push ebx
push ebx
push str.helpCtr
jmp 0x10049c3f
push str.HyperTerminal
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x39
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049f0d
push 1
push ebx
push ebx
push str.hypertrm
jmp 0x10049c3f
push str.MSMOVIEMAKER
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3a
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049f4d
push 1
push ebx
push ebx
push str.moviemk
jmp 0x10049c3f
push str.FileTransferWz
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3b
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049f8d
push 1
push ebx
push ebx
push str.migwiz
jmp 0x10049c3f
push str.MSACCESS
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3c
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x10049fcd
push 1
push ebx
push ebx
push str.msaccess
jmp 0x10049c3f
push str.MSDEV
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3d
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x1004a00d
push 1
push ebx
push ebx
push str.msdev
jmp 0x10049c3f
push str.OutlookExpress
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3e
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x1004a04d
push 1
push ebx
push ebx
push str.msimn
jmp 0x10049c3f
push str.MSINFO32
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3f
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x1004a08d
push 1
push ebx
push ebx
push str.msinfo32
jmp 0x10049c3f
push str.MSNMessenger
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x40
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x1004a0cd
push 1
push ebx
push ebx
push str.msnmsgr
jmp 0x10049c3f
push str.WinZip
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x41
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x1004a10d
push 1
push ebx
push ebx
push str.winzip
jmp 0x10049c3f
push str.WordPad
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x42
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x1004a14d
push 1
push ebx
push ebx
push str.wordpad
jmp 0x10049c3f
push str.WMPlayer
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x43
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x1004a18d
push 1
push ebx
push ebx
push str.wmplayer
jmp 0x10049c3f
push 0x100eed0c
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x44
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x1004a1cd
push 1
push ebx
push ebx
push str.inetmgr
jmp 0x10049c3f
push str.photoshop
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x45
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x1004a20d
push 1
push ebx
push ebx
push str.photoshop
jmp 0x10049c3f
push str.PowerPoint
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x46
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x1004a24d
push 1
push ebx
push ebx
push str.powerpnt
jmp 0x10049c3f
push str.QuickTimePlayer
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x47
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x1004a28d
push 1
push ebx
push ebx
push str.QuickTimePlayer
jmp 0x10049c3f
push str.REGISTRYEDITOR
lea ecx, [ebp - 0x1c]
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x48
call fcn.1007f09b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.1007e410
cmp dword [ebp - 0x10], ebx
je 0x1004a2cd
push 1
push ebx
push ebx
push str.regedit
jmp 0x10049c3f
mov ecx, esi
call fcn.1007e67a
test eax, eax
jne 0x1004a30a
push str.EB_SPECIAL
lea ecx, [ebp - 0x1c]
call fcn.1007e254
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
add ecx, 0x14
mov dword [ebp - 4], 0x49
mov dword [ebp - 0x24], 1
call fcn.1007f09b
test eax, eax
mov byte [ebp - 0x25], 1
jne 0x1004a30d
mov byte [ebp - 0x25], bl
test byte [ebp - 0x24], 1
mov dword [ebp - 4], edi
je 0x1004a31e
lea ecx, [ebp - 0x1c]
call fcn.1007e410
cmp byte [ebp - 0x25], bl
je 0x1004a475
lea ecx, [ebp - 0x24]
call fcn.1007c8e2
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0x4a
call fcn.1007e254
push 0x100e015c
mov ecx, esi
mov byte [ebp - 4], 0x4b
call fcn.1007eee7
cmp eax, ebx
jle 0x1004a3f6
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0x100e015c
call fcn.1007e254
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x58], esp
push esi
mov byte [ebp - 4], 0x4c
call fcn.1007ed4f
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x4b
call fcn.1007f6e6
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x4d
call fcn.100490cd
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x4f
call fcn.1007f64c
lea ecx, [ebp - 0x34]
call fcn.1007e247
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x50
call fcn.1007f5bd
lea ecx, [ebp - 0x34]
call fcn.1007e558
push eax
lea ecx, [ebp - 0x1c]
call fcn.1007ee1f
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x4f
call fcn.1007e410
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x4b
call fcn.1007f64c
jmp 0x1004a406
mov ecx, esi
call fcn.1007e558
push eax
lea ecx, [ebp - 0x1c]
call fcn.1007ee1f
lea ecx, [ebp - 0x1c]
call fcn.1007e558
push eax
push connect
lea ecx, [ebp - 0x24]
call fcn.1007caee
test eax, eax
je 0x1004a459
mov ecx, esi
call fcn.1007e558
push eax
lea ecx, [ebp - 0x34]
call fcn.1007e254
push 1
push ebx
push ebx
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x51
call fcn.1007e558
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x4b
call fcn.1007e410
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x4a
call fcn.1007e410
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], edi
call fcn.1007c8eb
jmp 0x1004a538
mov ecx, esi
call fcn.1007e67a
test eax, eax
jne 0x1004a538
push 0xd
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xc]
call fcn.10025f4d
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0x52
call fcn.1007e67a
test eax, eax
jne 0x1004a52d
push 0x100df794
lea ecx, [ebp - 0x64]
call fcn.1007e254
push str.command
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x53
call fcn.1007ee1f
mov ecx, esi
call fcn.1007e558
push eax
lea ecx, [ebp - 0x34]
call fcn.1007ee1f
push 0x18
call fcn.100b29d4
pop ecx
mov dword [ebp - 0x38], eax
cmp eax, ebx
mov byte [ebp - 4], 0x54
je 0x1004a4f8
mov ecx, eax
call fcn.100b1000
mov esi, eax
jmp 0x1004a4fa
xor esi, esi
lea eax, [ebp - 0x34]
push eax
lea ecx, [esi + 8]
mov byte [ebp - 4], 0x53
call fcn.1007e46a
mov eax, dword [ebp - 0x20]
push esi
push ebx
mov dword [esi + 0x14], ebx
push dword [0x101213ec]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x52
call fcn.1007e410
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], edi
call fcn.1007e410
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push 1
call dword [eax]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4