Function at 0x1004e570
Capabilities:
Authenticate hmac
Check if file exists
Check os version
Encode data using base64
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fa356
mov eax, dword fs:[0]
push eax
sub esp, 0xf3c
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xef8], ecx
mov esi, dword [0x1014e914]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov dword [ebp - 0xed8], ebx
cmp dword [esi], 0
je 0x1004e5e5
nop
cmp dword [esi + 4], 1
jne 0x1004e5dd
push str.RecentMetroApps
push dword [esi]
call fcn.100dc721
add esp, 8
test eax, eax
je 0x1004e713
add esi, 0x60
cmp dword [esi], 0
jne 0x1004e5c0
mov byte [ebp - 0xead], 0
mov eax, dword [0x1014c064]
mov eax, dword [eax]
add eax, 0xa0
mov dword [ebp - 0xec4], eax
mov eax, dword [ebp - 0xef8]
cmp byte [eax + 0x30], 0
jne 0x1004e61d
cmp dword [0x1014e1f8], 2
mov dword [ebp - 0xef0], 0x20
je 0x1004e627
mov dword [ebp - 0xef0], 0x10
mov eax, dword [0x1014b50c]
mov dword [ebp - 0xefc], 0xa
cmp eax, 1
jne 0x1004eef7
mov edi, dword [sym.imp.SHELL32.dll_ILFree]
xor esi, esi
mov dword [ebp - 0xebc], esi
nop dword [eax]
mov eax, dword [esi*4 + 0x1014c0c8]
cmp dword [eax - 0xc], 0
je 0x1004ecf5
mov dword [ebp - 0xeb4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xeac], 0
push 4
push str.APP:
push eax
mov byte [ebp - 4], 1
call fcn.100de413
add esp, 0xc
test eax, eax
sete bh
test eax, eax
jne 0x1004e745
mov eax, dword [esi*4 + 0x1014c0c8]
lea ecx, [ebp - 0xeb4]
push ecx
push 0x10103e10
add eax, 8
push eax
push 0
push 0x1013df98
call dword [sym.imp.SHELL32.dll_SHCreateItemInKnownFolder]
test eax, eax
js 0x1004e7ad
lea eax, [ebp - 0xeac]
push eax
push dword [ebp - 0xeb4]
call dword [sym.imp.SHELL32.dll_SHGetIDListFromObject]
test eax, eax
jns 0x1004e7ad
mov ecx, dword [ebp - 0xeb4]
test ecx, ecx
je 0x1004ec7f
mov eax, ecx
xor ecx, ecx
mov dword [ebp - 0xeb4], ecx
mov byte [ebp - 4], 3
test eax, eax
je 0x1004ec7f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1004e7ad
push 0x10158d3c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
cmp word [esi + 0x38], 3
jne 0x1004e732
cmp dword [esi + 0x40], 1
mov byte [ebp - 0xead], 1
je 0x1004e739
mov byte [ebp - 0xead], 0
push 0x10158d3c
call edi
jmp 0x1004e5ec
mov esi, dword [esi*4 + 0x1014c0c8]
push esi
mov dword [ebp - 0xeac], 0
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
je 0x1004e774
push esi
call dword [sym.imp.SHELL32.dll_SHSimpleIDListFromPath]
mov dword [ebp - 0xeac], eax
test eax, eax
jne 0x1004e78f
jmp 0x1004e7a7
push 0
push 0x20410000
lea edx, [ebp - 0xeac]
mov ecx, esi
call fcn.100b09d0
add esp, 8
test eax, eax
js 0x1004e7a7
lea eax, [ebp - 0xeb4]
push eax
push 0x10103e10
push dword [ebp - 0xeac]
call dword [sym.imp.SHELL32.dll_SHCreateItemFromIDList]
mov esi, dword [ebp - 0xebc]
mov ecx, dword [ebp - 0xeb4]
test ecx, ecx
je 0x1004ec7f
mov dword [ebp - 0xeb8], 0
lea edx, [ebp - 0xeb8]
mov byte [ebp - 4], 4
mov eax, dword [ecx]
push edx
push 0
push ecx
call dword [eax + 0x14]
test eax, eax
js 0x1004ec67
test bh, bh
je 0x1004e852
push 2
push 0x10111db4
push dword [ebp - 0xeb8]
call fcn.100de413
add esp, 0xc
test eax, eax
jne 0x1004e852
mov eax, dword [ebp - 0xeb8]
test eax, eax
je 0x1004e80e
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0xeac]
mov dword [ebp - 0xeb8], 0
test eax, eax
je 0x1004e825
push eax
call edi
mov dword [ebp - 0xeac], 0
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0xeb4]
test eax, eax
je 0x1004e846
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
jmp 0x1004ecdf
push 4
lea ecx, [ebp - 0xc88]
call fcn.10049550
mov eax, dword [ebp - 0xef0]
mov ecx, 0x1014be70
push 0
or eax, 7
mov byte [ebp - 4], 6
or byte [ebp - 0xc58], 2
push eax
push dword [ebp - 0xeac]
push dword [ebp - 0xeb4]
call fcn.1002ac30
mov edi, eax
xor bl, bl
push 0x1014be70
mov dword [ebp - 0xc78], edi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov ecx, dword [ebp - 0xec4]
mov esi, dword [ecx]
cmp esi, dword [ecx + 4]
je 0x1004e8f8
mov eax, ecx
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1004e9e9
cmp ecx, edi
je 0x1004e8f6
mov dl, byte [ecx + 0x2a]
test dl, dl
jne 0x1004e8cf
cmp byte [ecx + 0x2c], dl
je 0x1004e9e3
test bh, bh
je 0x1004e987
test dl, dl
je 0x1004e987
push dword [ecx + 0x48]
push dword [ebp - 0xeac]
call dword [sym.imp.SHELL32.dll_ILIsEqual]
test eax, eax
je 0x1004e9e3
mov bl, 1
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
push 0x1014be70
call esi
test bl, bl
je 0x1004e9fa
mov edx, dword [ebp - 0xc80]
add edx, 0xfffffff0
mov byte [ebp - 4], 7
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004e92f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xeb8]
test eax, eax
je 0x1004e941
push eax
mov eax, dword [sym.imp.ole32.dll_CoTaskMemFree]
call eax
mov eax, dword [ebp - 0xeac]
mov dword [ebp - 0xeb8], 0
test eax, eax
je 0x1004e95d
push eax
mov eax, dword [sym.imp.SHELL32.dll_ILFree]
call eax
mov dword [ebp - 0xeac], 0
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0xeb4]
test eax, eax
je 0x1004ecd2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1004ecd2
mov eax, dword [edi + 0x50]
cmp dword [eax - 0xc], 0
je 0x1004e99e
push dword [ecx + 0x50]
push eax
call fcn.100dc721
add esp, 8
jmp 0x1004e9db
mov eax, dword [edi + 0x4c]
cmp dword [eax - 0xc], 0
je 0x1004e9e3
mov ecx, dword [ecx + 0x4c]
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004e9d6
test dx, dx
je 0x1004e9d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004e9d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004e9b0
xor eax, eax
jmp 0x1004e9db
sbb eax, eax
or eax, 1
test eax, eax
je 0x1004e8f6
mov eax, dword [ebp - 0xec4]
add esi, 0x54
cmp esi, dword [eax + 4]
jne 0x1004e8b0
jmp 0x1004e8f8
push 0x1014be70
mov dword [ebp - 0xee4], 0x1014be70
mov byte [ebp - 0xee0], 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov bl, byte [ebp - 0xead]
mov byte [ebp - 4], 9
cmp byte [edi + 0x2c], 0
je 0x1004ea97
test bl, bl
jne 0x1004ea97
push 0x1014be70
call esi
mov edx, dword [ebp - 0xc80]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xa
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004ea53
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xeb8]
test eax, eax
je 0x1004ea65
push eax
mov eax, dword [sym.imp.ole32.dll_CoTaskMemFree]
call eax
mov eax, dword [ebp - 0xeac]
mov dword [ebp - 0xeb8], 0
test eax, eax
je 0x1004ea81
push eax
mov eax, dword [sym.imp.SHELL32.dll_ILFree]
call eax
mov dword [ebp - 0xeac], 0
mov dword [ebp - 4], 0xb
jmp 0x1004e96e
cmp byte [edi + 0x2b], 0
je 0x1004ebb5
test bl, bl
jne 0x1004eb12
push 0x1014be70
call esi
mov edx, dword [ebp - 0xc80]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xc
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004eace
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xeb8]
test eax, eax
je 0x1004eae0
push eax
mov eax, dword [sym.imp.ole32.dll_CoTaskMemFree]
call eax
mov eax, dword [ebp - 0xeac]
mov dword [ebp - 0xeb8], 0
test eax, eax
je 0x1004eafc
push eax
mov eax, dword [sym.imp.SHELL32.dll_ILFree]
call eax
mov dword [ebp - 0xeac], 0
mov dword [ebp - 4], 0xd
jmp 0x1004e96e
or byte [ebp - 0xc57], 4
push str.Microsoft.Windows.Desktop
push dword [edi + 0x50]
call fcn.100dc721
add esp, 8
test eax, eax
jne 0x1004eb9a
push 0x1014be70
call esi
mov edx, dword [ebp - 0xc80]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xe
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004eb56
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xeb8]
test eax, eax
je 0x1004eb68
push eax
mov eax, dword [sym.imp.ole32.dll_CoTaskMemFree]
call eax
mov eax, dword [ebp - 0xeac]
mov dword [ebp - 0xeb8], 0
test eax, eax
je 0x1004eb84
push eax
mov eax, dword [sym.imp.SHELL32.dll_ILFree]
call eax
mov dword [ebp - 0xeac], 0
mov dword [ebp - 4], 0xf
jmp 0x1004e96e
mov eax, dword [edi + 0x54]
lea ecx, [edi + 0x54]
cmp dword [eax - 0xc], 0
je 0x1004ebb5
push ecx
push ecx
lea ecx, [ebp - 0xc88]
call fcn.10049760
jmp 0x1004ebd5
mov eax, dword [ebp - 0xef8]
lea ecx, [ebp - 0xc88]
mov eax, dword [eax + 0x3c]
shr eax, 0x17
and al, 1
push eax
push dword [ebp - 0xeb8]
call fcn.10049630
mov eax, dword [ebp - 0xc78]
push 0x1014be70
mov cl, byte [eax + 0x2c]
mov al, byte [ebp - 0xc57]
shl cl, 3
xor cl, al
mov byte [ebp - 4], 6
and cl, 8
xor al, cl
mov byte [ebp - 0xc57], al
call esi
mov ebx, dword [ebp - 0xed8]
lea ecx, [ebp - 0xc88]
mov eax, dword [ebp - 0xeac]
mov dword [ebp - 0xc50], eax
mov dword [ebp - 0xeac], 0
mov eax, dword [ebx + 4]
push ecx
cmp dword [ebx + 8], eax
je 0x1004ec37
mov ecx, eax
call fcn.10046980
add dword [ebx + 4], 0x54
jmp 0x1004ec3f
push eax
mov ecx, ebx
call fcn.10063630
mov edx, dword [ebp - 0xc80]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x10
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004ec61
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [sym.imp.SHELL32.dll_ILFree]
mov eax, dword [ebp - 0xeb8]
test eax, eax
je 0x1004ec79
push eax
mov eax, dword [sym.imp.ole32.dll_CoTaskMemFree]
call eax
mov ecx, dword [ebp - 0xeb4]
mov ebx, dword [ebp - 0xed8]
mov eax, 0x30c30c31
mov edx, dword [ebx + 4]
sub edx, dword [ebx]
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, dword [ebp + 0xc]
mov eax, dword [ebp - 0xeac]
je 0x1004eec3
test eax, eax
je 0x1004ecb7
push eax
call edi
mov ecx, dword [ebp - 0xeb4]
mov dword [ebp - 0xeac], 0
mov dword [ebp - 4], 0x12
test ecx, ecx
je 0x1004ecd2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0xebc]
mov edi, dword [sym.imp.SHELL32.dll_ILFree]
inc esi
mov dword [ebp - 0xebc], esi
cmp esi, 0x28
jl 0x1004e650
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov ebx, dword [ebp - 0xed8]
mov esi, dword [0x1014e914]
cmp dword [esi], 0
je 0x1004ed46
nop dword [eax]
mov eax, dword [esi + 4]
cmp eax, 2
je 0x1004ed27
cmp eax, 3
je 0x1004ed27
cmp eax, 4
je 0x1004ed27
cmp eax, 5
jne 0x1004ed3e
push str.RecentProgKeys
push dword [esi]
call fcn.100dc721
add esp, 8
test eax, eax
je 0x10050aff
add esi, 0x60
cmp dword [esi], 0
jne 0x1004ed10
xor eax, eax
mov dword [ebp - 0xedc], eax
mov ecx, dword [ebp - 0xed8]
mov eax, 0x30c30c31
mov ebx, dword [ebx]
xor edi, edi
mov dword [ebp - 0xef0], edi
mov ecx, dword [ecx + 4]
sub ecx, ebx
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
test eax, eax
jle 0x1004eea5
xor esi, esi
mov dword [ebp - 0xee8], esi
nop dword [eax]
nop dword [eax + eax]
mov ecx, dword [ebp - 0xedc]
mov word [esi + ebx + 0x44], di
cmp ecx, 2
jne 0x1004edba
push 0x10111bf4
lea ecx, [ebx + 8]
add ecx, esi
push 0x10111bfc
call fcn.100624a0
mov ecx, dword [ebp - 0xedc]
cmp edi, 0xa
jge 0x1004ee6f
cmp ecx, 2
jl 0x1004ee6f
lea eax, [edi + 1]
or byte [esi + ebx + 0x31], 0x80
cdq
idiv dword [ebp - 0xefc]
add edx, 0x30
mov word [esi + ebx + 0x34], dx
cmp ecx, 2
jne 0x1004ee6f
lea edi, [esi + 8]
add edi, ebx
mov ecx, dword [edi]
sub ecx, 0x10
call fcn.10021e50
lea esi, [eax + 0x10]
mov dword [ebp - 0xee0], esi
mov eax, dword [ebp - 0xef0]
mov ecx, 0xa
inc eax
mov dword [ebp - 4], 0x42
cdq
idiv ecx
push esi
push edx
push str._d__s
push edi
call fcn.10020290
mov eax, dword [edi]
add esp, 0x10
mov ecx, dword [ebp - 0xee8]
mov eax, dword [eax - 0xc]
sub eax, dword [esi - 0xc]
add esi, 0xfffffff0
mov word [ecx + ebx + 0x46], ax
mov dword [ebp - 4], 0x43
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1004ee5c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0xef0]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0xee8]
mov eax, dword [ebp - 0xed8]
inc edi
add esi, 0x54
mov dword [ebp - 0xef0], edi
mov dword [ebp - 0xee8], esi
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
sub ecx, ebx
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jl 0x1004ed90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d4906
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x1004eed0
push eax
call edi
mov ecx, dword [ebp - 0xeb4]
mov dword [ebp - 0xeac], 0
mov dword [ebp - 4], 0x11
test ecx, ecx
je 0x1004eeeb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
jmp 0x1004ecf5
cmp eax, 2
jne 0x1004ed01
lea eax, [ebp - 0xf48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor eax, eax
xor edi, edi
mov dword [ebp - 0xeb4], eax
mov dword [ebp - 0xed4], eax
mov dword [ebp - 0xed0], edi
mov dword [ebp - 0xef4], eax
mov dword [ebp - 0xecc], eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 0xf20], edi
mov dword [ebp - 0xf1c], edi
mov dword [ebp - 0xf18], edi
xor esi, esi
mov dword [ebp - 0xf2c], esi
mov dword [ebp - 0xf28], esi
mov dword [ebp - 0xf24], esi
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssistCEBFF5CD_ACE2_4F4F_9178_9926F41749EACount
push SysReAllocString
lea ecx, [ebp - 0xf20]
mov byte [ebp - 4], 0x15
call fcn.10013210
test eax, eax
jne 0x10050ac6
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssistF4E57C4B_2036_45F0_A9AB_443BCFE33D9FCount
push SysReAllocString
lea ecx, [ebp - 0xf2c]
call fcn.10013210
test eax, eax
jne 0x10050ac0
push 0x220
push eax
lea eax, [ebp - 0xea8]
mov dword [ebp - 0xeac], esi
push eax
call fcn.100d6eb0
add esp, 0xc
mov dword [ebp - 0xec0], 0x104
lea eax, [ebp - 0xc80]
push 0x48
push esi
push eax
call fcn.100d6eb0
add esp, 0xc
mov dword [ebp - 0xebc], 0x48
lea eax, [ebp - 0xebc]
push eax
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xedc]
push eax
push esi
lea eax, [ebp - 0xec0]
push eax
lea eax, [ebp - 0xea8]
push eax
push esi
push dword [ebp - 0xf2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movss xmm0, dword [0x10123a28]
xorps xmm3, xmm3
movss xmm2, dword [0x10123a04]
movss xmm4, dword [0x10123a08]
movss xmm5, dword [0x10123a00]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x1004f85e
nop word [eax + eax]
cmp word [ebp - 0xea8], 0
je 0x1004f7bd
cmp dword [ebp - 0xedc], 3
je 0x1004f08d
test byte [0x1014b4cc], 8
je 0x1004f7bd
lea eax, [ebp - 0xea8]
push eax
push str.Not_binary:__s
call fcn.1003bea0
add esp, 8
jmp 0x1004f7bd
mov eax, dword [ebp - 0xebc]
cmp eax, 0x48
je 0x1004f0bf
test byte [0x1014b4cc], 8
je 0x1004f7bd
lea ecx, [ebp - 0xea8]
push ecx
push eax
push str.Wrong_size___d_:__s
call fcn.1003bea0
add esp, 0xc
jmp 0x1004f7bd
mov edx, 0x811c9dc5
lea ecx, [ebp - 0xea8]
call fcn.100b3790
lea ecx, [ebp - 0xea8]
mov dword [ebp - 0xc94], eax
call fcn.1002c7e0
cmp dword [ebp - 0xc44], 0
jne 0x1004f118
cmp dword [ebp - 0xc40], 0
jne 0x1004f118
test byte [0x1014b4cc], 8
je 0x1004f7bd
lea eax, [ebp - 0xea8]
push eax
push str.Zero_timestamp:__s
call fcn.1003bea0
add esp, 8
jmp 0x1004f7bd
movd xmm1, dword [ebp - 0xc7c]
xor ecx, ecx
cvtdq2ps xmm1, xmm1
mov edx, dword [ebp - 0xc48]
divss xmm1, xmm0
movss dword [ebp - 0xca0], xmm1
nop word [eax + eax]
movss xmm0, dword [ebp + edx*4 - 0xc70]
comiss xmm3, xmm0
ja 0x1004f177
comiss xmm0, xmm4
ja 0x1004f177
mulss xmm0, xmm2
lea eax, [edx + 9]
cdq
inc ecx
subss xmm2, xmm5
idiv dword [ebp - 0xefc]
addss xmm1, xmm0
movss dword [ebp - 0xca0], xmm1
cmp ecx, 0xa
jb 0x1004f140
ucomiss xmm1, xmm3
lahf
test ah, 0x44
jp 0x1004f1a6
test byte [0x1014b4cc], 8
je 0x1004f7bd
lea eax, [ebp - 0xea8]
push eax
push str.Zero_rank:__s
call fcn.1003bea0
add esp, 8
jmp 0x1004f7bd
lea eax, [ebp - 0xea8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp word [ebp - 0xea8], 0x7b
jne 0x1004f287
lea eax, [ebp - 0xea6]
push 0x7d
push eax
call fcn.100d61ed
add esp, 8
test eax, eax
je 0x1004f287
cmp word [eax + 2], 0x5c
lea esi, [eax + 2]
jne 0x1004f281
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0xc30]
push eax
lea eax, [ebp - 0xea8]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov ecx, 0x5c
mov word [esi], cx
test eax, eax
js 0x1004f281
lea eax, [ebp - 0xec8]
mov dword [ebp - 0xec8], 0
push eax
push 0
push 0x4000
lea eax, [ebp - 0xc30]
push eax
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x1004f270
push esi
push dword [ebp - 0xec8]
lea eax, [ebp - 0x218]
push 0x1010f314
push 0x104
push eax
call fcn.100a4830
add esp, 0x14
lea eax, [ebp - 0x218]
mov edx, 0x104
lea ecx, [ebp - 0xea8]
push eax
call fcn.100a4780
add esp, 4
mov eax, dword [ebp - 0xec8]
test eax, eax
je 0x1004f281
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, dword [ebp - 0xeac]
test byte [0x1014b4cc], 8
je 0x1004f2bd
movss xmm0, dword [ebp - 0xca0]
lea eax, [ebp - 0xea8]
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push dword [ebp - 0xc7c]
push eax
push str.UserAssist:__s___d___.3f
call fcn.1003bea0
add esp, 0x14
lea eax, [ebp - 0xea8]
mov edx, 0x104
push eax
lea ecx, [ebp - 0xc20]
xor bl, bl
call fcn.100a4780
add esp, 4
lea eax, [ebp - 0xc20]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
mov edx, 0x811c9dc5
lea ecx, [ebp - 0xc20]
call fcn.100b3790
mov ecx, dword [ebp - 0xeb4]
mov dword [ebp - 0xc90], eax
cmp ecx, edi
je 0x1004f326
nop word [eax + eax]
cmp eax, dword [ecx + 0x218]
je 0x1004f3b1
add ecx, 0x220
cmp ecx, edi
jne 0x1004f310
lea eax, [ebp - 0xc20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
xor esi, esi
nop word [eax + eax]
push dword [esi + 0x1010c0ec]
push edi
call fcn.100d62b4
add esp, 8
test eax, eax
jne 0x1004f795
add esi, 4
cmp esi, 0x2c
jb 0x1004f340
push eax
push 0x4007
push ecx
mov edi, esp
mov dword [ebp - 0xee0], edi
call fcn.100215d0
mov ecx, eax
test ecx, ecx
je 0x10050b1f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0xea8]
mov byte [ebp - 4], 0x16
test eax, 0xffff0000
jne 0x1004f3d0
movzx esi, ax
mov ecx, esi
call fcn.10027d50
test eax, eax
je 0x1004f3fe
push esi
push eax
mov ecx, edi
call fcn.10026d00
jmp 0x1004f3fe
test byte [0x1014b4cc], 8
je 0x1004f7b7
push str.UserAssist:_Dropping:_Already_in_list
call fcn.1003bea0
add esp, 4
jmp 0x1004f7b7
lea ecx, [ebp - 0xea8]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004f3e0
sub ecx, edx
lea eax, [ebp - 0xea8]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.10021eb0
mov byte [ebp - 4], 0x15
call fcn.1002b2c0
mov dword [ebp - 0xc8c], eax
test eax, eax
jne 0x1004f428
test byte [0x1014b4cc], 8
je 0x1004f7ab
push str.UserAssist:_Dropping:_File_missing
jmp 0x1004f7a3
push 0x1014be70
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov ecx, dword [ebp - 0xc8c]
mov eax, dword [ecx + 0x3c]
cmp eax, 1
je 0x1004f471
cmp eax, 5
je 0x1004f471
cmp eax, 2
je 0x1004f471
test byte [0x1014b4cc], 8
je 0x1004f461
push str.UserAssist:_Dropping:_Not_from_start_menu
call fcn.1003bea0
add esp, 4
push 0x1014be70
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
jmp 0x1004f7ab
cmp byte [ecx + 0x2e], 0
je 0x1004f487
test byte [0x1014b4cc], 8
je 0x1004f461
push str.UserAssist:_Dropping:_No_pin
jmp 0x1004f459
mov eax, dword [ecx + 0x50]
cmp dword [eax - 0xc], 0
jne 0x1004f4a0
test byte [0x1014b4cc], 8
je 0x1004f461
push str.UserAssist:_Dropping:_No_AppId
jmp 0x1004f459
mov eax, dword [ecx + 0x4c]
cmp dword [eax - 0xc], 0
je 0x1004f4f8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
xor esi, esi
push dword [esi + 0x1010c0e8]
push edi
call fcn.100d62b4
add esp, 8
test eax, eax
jne 0x1004f4d1
add esi, 4
cmp esi, 4
jb 0x1004f4b4
jmp 0x1004f4f2
test byte [0x1014b4cc], 8
je 0x1004f4f0
mov eax, dword [ebp - 0xc8c]
push dword [eax + 0x4c]
push str.UserAssist:_Dropping:_Target_contains_bad_word:__s
call fcn.1003bea0
add esp, 8
mov bl, 1
mov ecx, dword [ebp - 0xc8c]
cmp byte [ecx + 0x2b], 0
je 0x1004f56f
cmp byte [ebp - 0xead], 0
jne 0x1004f51e
test byte [0x1014b4cc], 8
je 0x1004f461
push str.UserAssist:_Dropping:_No_show_metro
jmp 0x1004f459
push str.Microsoft.Windows.Desktop
push dword [ecx + 0x50]
call fcn.100dc721
add esp, 8
test eax, eax
jne 0x1004f549
test byte [0x1014b4cc], 8
je 0x1004f461
push str.UserAssist:_Dropping:_Ignore_desktop
jmp 0x1004f459
mov ecx, dword [ebp - 0xc8c]
mov eax, dword [ecx + 0x54]
cmp dword [eax - 0xc], 0
jne 0x1004f56f
test byte [0x1014b4cc], 8
je 0x1004f461
push str.UserAssist:_Dropping:_No_Metro_name
jmp 0x1004f459
test bl, bl
jne 0x1004f461
mov edx, dword [ecx + 0x50]
mov esi, edx
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1004f580
sub esi, ecx
sar esi, 1
cmp esi, 0x103
jle 0x1004f59e
mov esi, 0x103
jmp 0x1004f5a2
test esi, esi
jle 0x1004f5bb
movzx eax, word [edx + esi*2]
mov ecx, 0xdc00
cmp ax, cx
jb 0x1004f5bb
mov ecx, 0xdfff
cmp ax, cx
ja 0x1004f5bb
dec esi
add esi, esi
lea eax, [ebp - 0xa18]
push esi
push edx
push eax
call fcn.100d7080
add esp, 0xc
xor eax, eax
mov word [ebp + esi - 0xa18], ax
push 0x1014be70
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov eax, dword [ebp - 0xc44]
lea ecx, [ebp - 0xa18]
mov dword [ebp - 0xc9c], eax
mov eax, dword [ebp - 0xc40]
mov dword [ebp - 0xc98], eax
mov dword [ebp - 0xebc], 0x48
call fcn.1002c7e0
lea eax, [ebp - 0xebc]
push eax
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xee8]
push eax
push 0
lea eax, [ebp - 0xa18]
push eax
push dword [ebp - 0xf20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1004f776
cmp dword [ebp - 0xee8], 3
jne 0x1004f776
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0xc9c]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jns 0x1004f67f
mov eax, dword [ebp - 0xc44]
mov dword [ebp - 0xc9c], eax
mov eax, dword [ebp - 0xc40]
mov dword [ebp - 0xc98], eax
movd xmm1, dword [ebp - 0xc7c]
xor ecx, ecx
movss xmm2, dword [0x10123a04]
xorps xmm3, xmm3
mov edx, dword [ebp - 0xc48]
movss xmm4, dword [0x10123a08]
movss xmm5, dword [0x10123a00]
lea ebx, [ecx + 0xa]
cvtdq2ps xmm1, xmm1
divss xmm1, dword [0x10123a28]
nop dword [eax + eax]
movss xmm0, dword [ebp + edx*4 - 0xc70]
comiss xmm3, xmm0
ja 0x1004f6ea
comiss xmm0, xmm4
ja 0x1004f6ea
lea eax, [edx + 9]
mulss xmm0, xmm2
cdq
inc ecx
subss xmm2, xmm5
idiv ebx
addss xmm1, xmm0
cmp ecx, ebx
jb 0x1004f6c0
comiss xmm1, dword [ebp - 0xca0]
jbe 0x1004f71c
test byte [0x1014b4cc], 8
movss dword [ebp - 0xca0], xmm1
je 0x1004f71c
cvtps2pd xmm0, xmm1
sub esp, 8
movsd qword [esp], xmm0
push str.UserAssist:_Corrected_rank:__.3f
call fcn.1003bea0
add esp, 0xc
mov eax, dword [ebp - 0xed0]
cmp dword [ebp - 0xef4], eax
je 0x1004f749
mov ecx, 0x88
lea esi, [ebp - 0xea8]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
add edi, 0x220
mov dword [ebp - 0xed0], edi
jmp 0x1004f7b1
lea ecx, [ebp - 0xea8]
push ecx
push eax
lea ecx, [ebp - 0xed4]
call fcn.10062ee0
mov eax, dword [ebp - 0xecc]
mov dword [ebp - 0xef4], eax
mov eax, dword [ebp - 0xed4]
mov dword [ebp - 0xeb4], eax
jmp 0x1004f7ab
test byte [0x1014b4cc], 8
je 0x1004f7ab
lea eax, [ebp - 0xa18]
push eax
push str.UserAssist:_Dropping:_Missing_appid_entry:__s
call fcn.1003bea0
add esp, 8
jmp 0x1004f7ab
test byte [0x1014b4cc], 8
je 0x1004f7ab
push str.UserAssist:_Dropping:_Contains_bad_word
call fcn.1003bea0
add esp, 4
mov edi, dword [ebp - 0xed0]
mov esi, dword [ebp - 0xeac]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push 0x220
lea eax, [ebp - 0xea8]
inc esi
push 0
push eax
mov dword [ebp - 0xeac], esi
call fcn.100d6eb0
add esp, 0xc
mov dword [ebp - 0xec0], 0x104
lea eax, [ebp - 0xc80]
push 0x48
push 0
push eax
call fcn.100d6eb0
add esp, 0xc
mov dword [ebp - 0xebc], 0x48
lea eax, [ebp - 0xebc]
push eax
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xedc]
push eax
push 0
lea eax, [ebp - 0xec0]
push eax
lea eax, [ebp - 0xea8]
push eax
push esi
push dword [ebp - 0xf2c]
call ebx
cmp eax, 0x103
je 0x1004f85e
movss xmm4, dword [0x10123a08]
xorps xmm3, xmm3
movss xmm5, dword [0x10123a00]
movss xmm0, dword [0x10123a28]
movss xmm2, dword [0x10123a04]
jmp 0x1004f050
mov cx, word [0x10159320]
test cx, cx
jne 0x1004f889
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
movzx eax, al
shr ecx, 8
movzx ecx, cl
shl ax, 8
or cx, ax
mov word [0x10159320], cx
mov eax, 0xa00
cmp cx, ax
jb 0x1004fd8a
cmp byte [ebp - 0xead], 0
je 0x1004fd8a
xor eax, eax
push 0x220
push eax
mov dword [ebp - 0xeb8], eax
lea eax, [ebp - 0x230]
push eax
call fcn.100d6eb0
add esp, 0xc
mov dword [ebp - 0xec0], 0x104
lea eax, [ebp - 0xc80]
push 0x48
push 0
push eax
call fcn.100d6eb0
add esp, 0xc
mov dword [ebp - 0xec8], 0x48
lea eax, [ebp - 0xec8]
push eax
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xedc]
push eax
push 0
lea eax, [ebp - 0xec0]
push eax
lea eax, [ebp - 0x230]
push eax
push 0
push dword [ebp - 0xf20]
call ebx
cmp eax, 0x103
je 0x1004fd8a
mov ebx, dword [sym.imp.SHELL32.dll_ILIsEqual]
nop dword [eax + eax]
cmp word [ebp - 0x230], 0
je 0x1004fcf2
cmp dword [ebp - 0xedc], 3
je 0x1004f965
test byte [0x1014b4cc], 8
je 0x1004fcf2
lea eax, [ebp - 0x230]
push eax
push str.Not_binary:__s
jmp 0x1004fcea
mov eax, dword [ebp - 0xec8]
cmp eax, 0x48
je 0x1004f997
test byte [0x1014b4cc], 8
je 0x1004fcf2
lea ecx, [ebp - 0x230]
push ecx
push eax
push str.Wrong_size___d_:__s
call fcn.1003bea0
add esp, 0xc
jmp 0x1004fcf2
mov edx, 0x811c9dc5
lea ecx, [ebp - 0x230]
call fcn.100b3790
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x1c], eax
call fcn.1002c7e0
cmp dword [ebp - 0xc44], 0
jne 0x1004f9e5
cmp dword [ebp - 0xc40], 0
jne 0x1004f9e5
test byte [0x1014b4cc], 8
je 0x1004fcf2
lea eax, [ebp - 0x230]
push eax
push str.Zero_timestamp:__s
jmp 0x1004fcea
movd xmm2, dword [ebp - 0xc7c]
xor ecx, ecx
cvtdq2ps xmm2, xmm2
mov edx, dword [ebp - 0xc48]
lea esi, [ecx + 0xa]
movss xmm1, dword [0x10123a04]
xorps xmm3, xmm3
divss xmm2, dword [0x10123a28]
movss xmm4, dword [0x10123a08]
movss dword [ebp - 0x28], xmm2
nop dword [eax + eax]
movss xmm0, dword [ebp + edx*4 - 0xc70]
comiss xmm3, xmm0
ja 0x1004fa53
comiss xmm0, xmm4
ja 0x1004fa53
mulss xmm0, xmm1
lea eax, [edx + 9]
cdq
inc ecx
subss xmm1, dword [0x10123a00]
idiv esi
addss xmm2, xmm0
movss dword [ebp - 0x28], xmm2
cmp ecx, esi
jb 0x1004fa20
ucomiss xmm2, xmm3
lahf
test ah, 0x44
jp 0x1004fa7a
test byte [0x1014b4cc], 8
je 0x1004fcf2
lea eax, [ebp - 0x230]
push eax
push str.Zero_rank:__s
jmp 0x1004fcea
mov esi, 0x101136bc
nop
push dword [esi]
lea eax, [ebp - 0x230]
push eax
call fcn.100dc721
add esp, 8
test eax, eax
je 0x1004fcd5
add esi, 4
cmp esi, 0x101136c4
jne 0x1004fa80
lea eax, [ebp - 0x230]
push eax
call fcn.1002c1a0
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1004fad5
test byte [0x1014b4cc], 8
je 0x1004fcf2
lea eax, [ebp - 0x230]
push eax
push str.UserAssist:_Dropping__s:_Not_a_valid_app
jmp 0x1004fcea
test byte [0x1014b4cc], 8
je 0x1004fb08
movss xmm0, dword [ebp - 0x28]
lea eax, [ebp - 0x230]
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push dword [ebp - 0xc7c]
push eax
push str.UserAssist:__s___d___.3f
call fcn.1003bea0
add esp, 0x14
push 0x1014be70
mov dword [ebp - 0xee4], 0x1014be70
mov byte [ebp - 0xee0], 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x54]
cmp dword [eax - 0xc], 0
je 0x1004fcbe
push 2
push 0x10111db4
push eax
call fcn.100de413
add esp, 0xc
test eax, eax
je 0x1004fcbe
mov ecx, dword [ebp - 0x14]
cmp byte [ecx + 0x2e], 0
je 0x1004fb7b
test byte [0x1014b4cc], 8
je 0x1004fb6b
push str.UserAssist:_Dropping:_No_pin
call fcn.1003bea0
add esp, 4
lea ecx, [ebp - 0xee4]
call fcn.100233f0
jmp 0x1004fcf2
mov eax, dword [ecx + 0x38]
cmp dword [eax - 0xc], 0
je 0x1004fca7
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1004fca7
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xebc]
add eax, 0x10
push eax
call fcn.10027f20
mov ecx, dword [ebp - 0xec4]
mov edi, dword [ebp - 0xebc]
mov esi, dword [ecx]
cmp esi, dword [ecx + 4]
je 0x1004fbe5
mov eax, ecx
nop
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1004fbdd
cmp byte [ecx + 0x2a], 0
je 0x1004fbd7
push dword [ecx + 0x48]
push edi
call ebx
test eax, eax
jne 0x1004fc47
mov eax, dword [ebp - 0xec4]
add esi, 0x54
cmp esi, dword [eax + 4]
jne 0x1004fbc0
test edi, edi
je 0x1004fbf0
push edi
call dword [sym.imp.SHELL32.dll_ILFree]
lea ecx, [ebp - 0xee4]
mov dword [ebp - 0xebc], 0
call fcn.100233f0
mov eax, dword [ebp - 0xc44]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc40]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xed0]
cmp dword [ebp - 0xef4], eax
je 0x1004fc86
mov ecx, 0x88
lea esi, [ebp - 0x230]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
add edi, 0x220
mov dword [ebp - 0xed0], edi
jmp 0x1004fcf8
test byte [0x1014b4cc], 8
je 0x1004fc64
lea eax, [ebp - 0x230]
push eax
push str.UserAssist:_Dropping__s__already_in_main_menu
call fcn.1003bea0
add esp, 8
test edi, edi
je 0x1004fc6f
push edi
call dword [sym.imp.SHELL32.dll_ILFree]
lea ecx, [ebp - 0xee4]
mov dword [ebp - 0xebc], 0
call fcn.100233f0
jmp 0x1004fcf2
lea ecx, [ebp - 0x230]
push ecx
push eax
lea ecx, [ebp - 0xed4]
call fcn.10062ee0
mov eax, dword [ebp - 0xecc]
mov dword [ebp - 0xef4], eax
jmp 0x1004fcf2
test byte [0x1014b4cc], 8
je 0x1004fb6b
push str.UserAssist:_Dropping:_Missing_package_path
jmp 0x1004fb63
test byte [0x1014b4cc], 8
je 0x1004fb6b
push str.UserAssist:_Dropping:_No_metro_name
jmp 0x1004fb63
test byte [0x1014b4cc], 8
je 0x1004fcf2
lea eax, [ebp - 0x230]
push eax
push str.UserAssist:_Dropping:_Ignore__s
call fcn.1003bea0
add esp, 8
mov edi, dword [ebp - 0xed0]
inc dword [ebp - 0xeb8]
lea eax, [ebp - 0x230]
push 0x220
push 0
push eax
call fcn.100d6eb0
add esp, 0xc
mov dword [ebp - 0xec0], 0x104
lea eax, [ebp - 0xc80]
push 0x48
push 0
push eax
call fcn.100d6eb0
add esp, 0xc
mov dword [ebp - 0xec8], 0x48
lea eax, [ebp - 0xec8]
push eax
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xedc]
push eax
push 0
lea eax, [ebp - 0xec0]
push eax
lea eax, [ebp - 0x230]
push eax
mov eax, dword [ebp - 0xeb8]
push eax
push dword [ebp - 0xf20]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x1004f930
mov ecx, dword [ebp - 0xed4]
mov dword [ebp - 0xeb4], ecx
push dword [ebp - 0xee0]
mov ecx, edi
mov eax, 0x78787879
sub ecx, dword [ebp - 0xeb4]
imul ecx
sar edx, 8
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, edi
mov edi, dword [ebp - 0xeb4]
mov ecx, edi
push ebx
mov dword [ebp - 0xeb8], ebx
call fcn.10064450
mov eax, dword [0x1014b60c]
add esp, 8
add eax, dword [0x1014b604]
mov ecx, 0x1014be70
cdq
sub eax, edx
mov edx, dword [0x1014b600]
mov esi, eax
mov eax, dword [0x1014b608]
sar esi, 1
mov dword [ebp - 0xee0], esi
lea eax, [eax + edx]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0xee4], eax
lea eax, [ebp - 0xee4]
push eax
call fcn.1002c5f0
xor eax, eax
test ebx, ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xedc], eax
jle 0x10050a49
mov eax, dword [ebp - 0xeb8]
xor ebx, ebx
imul ebx, ebx, 0x220
add ebx, edi
mov dword [ebp - 0xec0], ebx
cmp dword [ebx + 0x21c], 0
je 0x1005099f
mov byte [ebp - 4], 0x17
call fcn.100215d0
mov ecx, eax
test ecx, ecx
je 0x10050b1f
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0xee8], edi
mov byte [ebp - 4], 0x19
call fcn.100215d0
mov ecx, eax
test ecx, ecx
je 0x10050b1f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xeac], eax
mov byte [ebp - 4], 0x1b
call fcn.100215d0
mov ecx, eax
test ecx, ecx
je 0x10050b1f
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xebc], esi
push 0x1014be70
mov dword [ebp - 0xf34], 0x1014be70
mov byte [ebp - 0xf30], 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov byte [ebp - 4], 0x1d
mov eax, dword [ebx + 0x21c]
lea ebx, [edi - 0x10]
mov cl, byte [eax + 0x2b]
mov edx, dword [eax + 0x50]
mov byte [ebp - 0xead], cl
mov cl, byte [eax + 0x2c]
mov byte [ebp - 0xeea], cl
mov cl, byte [eax + 0x30]
mov byte [ebp - 0xee9], cl
lea ecx, [edx - 0x10]
cmp ecx, ebx
je 0x1004ff4e
mov eax, dword [ebx + 0xc]
lea edi, [ebx + 0xc]
shr eax, 0x1f
test al, al
jne 0x1004ff39
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x1004ff39
call fcn.10021e50
mov dword [ebp - 0xee0], eax
mov byte [ebp - 4], 0x1e
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x1004ff2a
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0xee0]
lea edi, [eax + 0x10]
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0xee8], edi
jmp 0x1004ff4e
push dword [edx - 0xc]
lea ecx, [ebp - 0xee8]
push edx
call fcn.10021eb0
mov edi, dword [ebp - 0xee8]
mov eax, dword [ebp - 0xec0]
mov ebx, dword [ebp - 0xeac]
add ebx, 0xfffffff0
mov eax, dword [eax + 0x21c]
mov edx, dword [eax + 0x4c]
lea ecx, [edx - 0x10]
cmp ecx, ebx
je 0x1004ffc7
mov eax, dword [ebx + 0xc]
shr eax, 0x1f
test al, al
jne 0x1004ffb8
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x1004ffb8
call fcn.10021e50
mov dword [ebp - 0xee0], eax
mov byte [ebp - 4], 0x1f
lea edx, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1004ffa9
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0xee0]
add eax, 0x10
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0xeac], eax
jmp 0x1004ffc7
push dword [edx - 0xc]
lea ecx, [ebp - 0xeac]
push edx
call fcn.10021eb0
cmp byte [ebp - 0xead], 0
je 0x10050045
mov eax, dword [ebp - 0xec0]
lea ebx, [esi - 0x10]
mov eax, dword [eax + 0x21c]
mov edx, dword [eax + 0x54]
lea ecx, [edx - 0x10]
cmp ecx, ebx
je 0x10050045
mov eax, dword [ebx + 0xc]
lea esi, [ebx + 0xc]
shr eax, 0x1f
test al, al
jne 0x10050030
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x10050030
call fcn.10021e50
mov dword [ebp - 0xee0], eax
mov byte [ebp - 4], 0x20
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x10050025
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0xee0]
lea esi, [eax + 0x10]
mov dword [ebp - 0xebc], esi
jmp 0x10050045
push dword [edx - 0xc]
lea ecx, [ebp - 0xebc]
push edx
call fcn.10021eb0
mov esi, dword [ebp - 0xebc]
mov eax, dword [ebp - 0xedc]
inc eax
mov dword [ebp - 0xee0], eax
cmp eax, dword [ebp - 0xeb8]
jge 0x100500bf
mov ebx, dword [ebp - 0xeb4]
mov esi, eax
imul eax, esi, 0x220
add ebx, 0x21c
add ebx, eax
mov eax, dword [ebx]
test eax, eax
je 0x100500aa
push dword [eax + 0x50]
push edi
call fcn.100dc721
add esp, 8
test eax, eax
jne 0x100500aa
test byte [0x1014b4cc], 8
je 0x100500a4
push edi
lea eax, [ebx - 0x21c]
push eax
push str.UserAssist:_Dropping__s__duplicate_appid__s
call fcn.1003bea0
add esp, 0xc
mov dword [ebx], 0
inc esi
add ebx, 0x220
cmp esi, dword [ebp - 0xeb8]
jl 0x10050070
mov esi, dword [ebp - 0xebc]
push 0x1014be70
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
cmp byte [ebp - 0xee9], 0
je 0x100501de
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileAssociationNoStartPageAppUserModelIDs
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0xf08]
mov dword [ebp - 0xf08], 0
mov dword [ebp - 0xf04], 0
mov dword [ebp - 0xf00], 0
call fcn.10013210
mov ebx, dword [ebp - 0xf08]
test eax, eax
jne 0x100501ba
push 0
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100501ba
test byte [0x1014b4cc], 8
je 0x10050151
push dword [ebp - 0xec0]
push str.UserAssist:_Dropping__s__NoStartPageAppUserModelIDs
call fcn.1003bea0
add esp, 8
test ebx, ebx
je 0x10050166
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xf08], 0
mov dword [ebp - 0xf04], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x21
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1005018c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xeac]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x22
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100501ae
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 0x23
jmp 0x1005097e
test ebx, ebx
je 0x100501cf
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xf08], 0
mov dword [ebp - 0xf04], 0
jmp 0x10050448
push dword [ebp - 0xeac]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push str.Applications_s
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.100a4830
add esp, 0x10
mov dword [ebp - 0xf14], 0
lea eax, [ebp - 0x810]
mov dword [ebp - 0xf10], 0
lea ecx, [ebp - 0xf14]
mov dword [ebp - 0xf0c], 0
push 0x20019
push eax
push SysReAllocString
call fcn.10013210
mov ebx, dword [ebp - 0xf14]
test eax, eax
jne 0x100502ed
push 0
push 0
push 0
push 0
push str.NoStartPage
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100502ed
test byte [0x1014b4cc], 8
je 0x10050284
push dword [ebp - 0xec0]
push str.UserAssist:_Dropping__s__NoStartPage
call fcn.1003bea0
add esp, 8
test ebx, ebx
je 0x10050299
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xf14], 0
mov dword [ebp - 0xf10], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x24
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100502bf
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xeac]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x25
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100502e1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 0x26
jmp 0x1005097e
test ebx, ebx
je 0x10050302
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xf14], 0
push 0x5c
push edi
mov dword [ebp - 0xf10], 0
call fcn.100d61ed
add esp, 8
test eax, eax
je 0x10050448
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push str.Applications_s
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.100a4830
add esp, 0x10
mov dword [ebp - 0xc2c], 0
lea eax, [ebp - 0x810]
mov dword [ebp - 0xc28], 0
lea ecx, [ebp - 0xc2c]
mov dword [ebp - 0xc24], 0
push 0x20019
push eax
push SysReAllocString
call fcn.10013210
mov ebx, dword [ebp - 0xc2c]
test eax, eax
jne 0x10050429
push 0
push 0
push 0
push 0
push str.NoStartPage
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10050429
test byte [0x1014b4cc], 8
je 0x100503c0
push dword [ebp - 0xec0]
push str.UserAssist:_Dropping__s__NoStartPage
call fcn.1003bea0
add esp, 8
test ebx, ebx
je 0x100503d5
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc2c], 0
mov dword [ebp - 0xc28], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x27
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100503fb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xeac]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x28
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1005041d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 0x29
jmp 0x1005097e
test ebx, ebx
je 0x1005043e
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc2c], 0
mov dword [ebp - 0xc28], 0
cmp byte [ebp - 0xead], 0
jne 0x1005053f
push 0x1014be70
mov dword [ebp - 0xf3c], 0x1014be70
mov byte [ebp - 0xf38], 1
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov byte [ebp - 4], 0x2a
mov edx, dword [0x1014bfb0]
mov esi, dword [edx]
cmp esi, edx
je 0x10050534
cmp byte [esi + 0x3e], 0
je 0x100504ef
cmp dword [esi + 0x50], 4
jne 0x100504ef
push 1
push 4
lea eax, [esi + 0x14]
mov ecx, 0x1014be70
push eax
call fcn.1002b890
mov eax, dword [esi + 0x64]
mov ecx, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100504ce
test dx, dx
je 0x100504ca
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100504ce
add eax, 4
add ecx, 4
test dx, dx
jne 0x100504a8
xor eax, eax
jmp 0x100504d3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100504e9
push dword [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100505ac
mov edx, dword [0x1014bfb0]
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x10050515
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x10050511
cmp esi, dword [eax + 8]
jne 0x10050511
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x10050501
mov esi, eax
jmp 0x1005052c
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x1005052c
nop
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x10050520
cmp esi, edx
jne 0x10050485
push 0x1014be70
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push 0x1014be70
xor bl, bl
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov ecx, dword [ebp - 0xec4]
mov esi, dword [ecx]
cmp esi, dword [ecx + 4]
je 0x1005064d
mov eax, ecx
nop
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1005059f
mov eax, dword [ebp - 0xec0]
cmp ecx, dword [eax + 0x21c]
je 0x10050634
cmp byte [ecx + 0x2a], 0
jne 0x10050585
cmp byte [ecx + 0x2c], 0
je 0x10050599
push dword [ecx + 0x50]
push edi
call fcn.100dc721
add esp, 8
test eax, eax
je 0x10050623
mov eax, dword [ebp - 0xec4]
add esi, 0x54
cmp esi, dword [eax + 4]
jne 0x10050560
jmp 0x1005064d
push 0x1014be70
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test byte [0x1014b4cc], 8
je 0x100505d3
push dword [ebp - 0xec0]
push str.UserAssist:_Dropping__s__pinned_to_taskbar
call fcn.1003bea0
add esp, 8
mov esi, dword [ebp - 0xebc]
add esi, 0xfffffff0
mov byte [ebp - 4], 0x2b
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100505f5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xeac]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x2c
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10050617
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 0x2d
jmp 0x1005097e
test byte [0x1014b4cc], 8
je 0x1005064b
push dword [ebp - 0xec0]
jmp 0x1005063e
test byte [0x1014b4cc], 8
je 0x1005064b
push eax
push str.UserAssist:_Dropping__s__already_in_main_menu
call fcn.1003bea0
add esp, 8
mov bl, 1
push 0x1014be70
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
test bl, bl
je 0x100506ac
mov esi, dword [ebp - 0xebc]
add esi, 0xfffffff0
mov byte [ebp - 4], 0x2e
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1005067e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xeac]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x2f
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100506a0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 0x30
jmp 0x1005097e
push 4
lea ecx, [ebp - 0xc88]
call fcn.10049550
mov dl, byte [ebp - 0xeea]
mov byte [ebp - 4], 0x31
and dl, 1
mov ebx, dword [ebp - 0xec0]
add dl, dl
or byte [ebp - 0xc58], 2
push 0
push dword [ebp - 0xef0]
mov eax, dword [ebx + 0x214]
mov ecx, dword [ebx + 0x21c]
mov dword [ebp - 0xc48], eax
mov al, byte [ebp - 0xead]
and al, 1
mov dword [ebp - 0xc78], ecx
or dl, al
mov al, byte [ebp - 0xc57]
shl dl, 2
and al, 0xf3
or dl, al
push ecx
mov ecx, 0x1014be70
mov byte [ebp - 0xc57], dl
call fcn.1002b890
xor ecx, ecx
mov dword [ebp - 0xec8], ecx
mov byte [ebp - 4], 0x32
cmp byte [ebp - 0xead], cl
je 0x100507fe
mov esi, dword [ebp - 0xebc]
mov ebx, dword [ebp - 0xc80]
add ebx, 0xfffffff0
lea ecx, [esi - 0x10]
cmp ecx, ebx
je 0x100507a5
mov eax, dword [ebx + 0xc]
shr eax, 0x1f
test al, al
jne 0x10050796
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x10050796
call fcn.10021e50
mov dword [ebp - 0xee0], eax
mov byte [ebp - 4], 0x36
lea edx, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10050787
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0xee0]
add eax, 0x10
mov byte [ebp - 4], 0x32
mov dword [ebp - 0xc80], eax
jmp 0x100507a5
push dword [ecx + 4]
lea ecx, [ebp - 0xc80]
push esi
call fcn.10021eb0
mov eax, dword [ebp - 0xec0]
mov eax, dword [eax + 0x21c]
push dword [eax + 0x10]
call dword [sym.imp.SHELL32.dll_ILClone]
mov ebx, dword [ebp - 0xed8]
lea ecx, [ebp - 0xc88]
mov dword [ebp - 0xc50], eax
push ecx
mov eax, dword [ebx + 4]
cmp dword [ebx + 8], eax
je 0x100507eb
mov ecx, eax
call fcn.10046980
add dword [ebx + 4], 0x54
mov ecx, dword [ebp - 0xec8]
jmp 0x100508ea
push eax
mov ecx, ebx
call fcn.10063630
mov ecx, dword [ebp - 0xec8]
jmp 0x100508ea
mov eax, dword [ebp - 0xc80]
cmp dword [eax - 0xc], 0
jne 0x100508de
mov eax, dword [ebx + 0x21c]
lea ecx, [ebp - 0xec8]
push ecx
push 0x10103e10
push dword [eax + 0x10]
call dword [sym.imp.SHELL32.dll_SHCreateItemFromIDList]
test eax, eax
js 0x100508d8
mov dword [ebp - 0xec0], 0
mov byte [ebp - 4], 0x37
lea edx, [ebp - 0xec0]
mov eax, dword [ebp - 0xec8]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
test eax, eax
js 0x100508b9
mov eax, dword [ebp - 0xef8]
lea ecx, [ebp - 0xc88]
mov eax, dword [eax + 0x3c]
shr eax, 0x17
and al, 1
push eax
push dword [ebp - 0xec0]
call fcn.10049630
mov eax, dword [ebx + 0x21c]
push dword [eax + 0x10]
call dword [sym.imp.SHELL32.dll_ILClone]
mov ebx, dword [ebp - 0xed8]
lea ecx, [ebp - 0xc88]
mov dword [ebp - 0xc50], eax
push ecx
mov eax, dword [ebx + 4]
cmp dword [ebx + 8], eax
je 0x100508af
mov ecx, eax
call fcn.10046980
add dword [ebx + 4], 0x54
jmp 0x100508bf
push eax
mov ecx, ebx
call fcn.10063630
jmp 0x100508bf
mov ebx, dword [ebp - 0xed8]
mov eax, dword [ebp - 0xec0]
test eax, eax
je 0x100508d8
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0xec8]
jmp 0x100508e4
mov ecx, dword [ebp - 0xec8]
mov ebx, dword [ebp - 0xed8]
mov esi, dword [ebp - 0xebc]
mov edx, dword [ebx + 4]
mov eax, 0x30c30c31
sub edx, dword [ebx]
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, dword [ebp + 0xc]
je 0x100509b9
mov byte [ebp - 4], 0x3d
test ecx, ecx
je 0x10050917
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0xc80]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x3e
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10050939
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 0x3f
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10050955
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xeac]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x40
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10050977
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 0x41
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10050993
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0xeb4]
mov eax, dword [ebp - 0xeb8]
mov ebx, dword [ebp - 0xedc]
inc ebx
mov dword [ebp - 0xedc], ebx
cmp ebx, eax
jl 0x1004fe22
jmp 0x10050a43
mov byte [ebp - 4], 0x38
test ecx, ecx
je 0x100509c7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0xc80]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x39
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100509e9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 0x3a
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10050a05
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xeac]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x3b
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10050a27
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 0x3c
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10050a43
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xf2c]
test eax, eax
je 0x10050a56
push eax
call ebx
mov eax, dword [ebp - 0xf20]
test eax, eax
je 0x10050a63
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp - 0xeb4]
test ebx, ebx
je 0x1004ecf5
mov ecx, dword [ebp - 0xef4]
mov eax, 0x78787879
sub ecx, ebx
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
imul ecx, eax, 0x220
mov eax, ebx
cmp ecx, 0x1000
jb 0x10050ab1
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10050b29
push ecx
push ebx
call fcn.100d4917
add esp, 8
jmp 0x1004ecf5
mov esi, dword [ebp - 0xf2c]
test byte [0x1014b4cc], 8
je 0x10050adc
push str.Failed_to_open_UserAssist_registry_key
call fcn.1003bea0
add esp, 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10050ae9
push esi
call edi
mov eax, dword [ebp - 0xf20]
test eax, eax
je 0x1004eea5
push eax
call edi
jmp 0x1004eea5
push 0x10158d3c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov eax, dword [esi + 0x40]
push 0x10158d3c
mov dword [ebp - 0xedc], eax
call edi
jmp 0x1004ed4e
push 0x80004005
call fcn.10013970
call fcn.100dca69
int3