Function at 0x49dc90
Capabilities:
Contain obfuscated stackstrings
Persist via active setup registry key
Persist via appinit_dlls registry key
Persist via winlogon helper dll registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d442f
mov eax, dword fs:[0]
push eax
mov eax, 0xb4e0
call fcn.0055b970
mov eax, dword [0x6385e0]
xor eax, ebp
mov dword [ebp - 0x84], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb440], ecx
lea ecx, [ebp - 0x58]
call fcn.004b34a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.004b34a0
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp - 0x40]
call fcn.00430200
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6c]
call fcn.00432460
mov byte [ebp - 4], 3
push 0
push 0x6009a8
call fcn.00414b30
mov ecx, eax
call fcn.00414830
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x49dde5
push 0
lea ecx, [ebp - 0x78]
call fcn.00430200
mov byte [ebp - 4], 4
lea eax, [ebp - 0x78]
push eax
mov ecx, dword [ebp - 0x5c]
call fcn.00414060
movzx ecx, al
test ecx, ecx
je 0x49dd95
mov dword [ebp - 0x7c], 0
jmp 0x49dd50
mov edx, dword [ebp - 0x7c]
add edx, 1
mov dword [ebp - 0x7c], edx
lea ecx, [ebp - 0x78]
call fcn.004b9730
cmp dword [ebp - 0x7c], eax
jge 0x49dd95
push 0
push str.ControlSet0
mov eax, dword [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x78]
call fcn.00430700
mov ecx, eax
call fcn.004b68a0
movzx ecx, al
test ecx, ecx
je 0x49dd93
mov edx, dword [ebp - 0x7c]
push edx
lea ecx, [ebp - 0x78]
call fcn.00430700
push eax
lea ecx, [ebp - 0x6c]
call fcn.00441810
jmp 0x49dd47
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xb270], eax
mov ecx, dword [ebp - 0xb270]
mov dword [ebp - 0xb26c], ecx
cmp dword [ebp - 0xb26c], 0
je 0x49ddcf
push 1
mov edx, dword [ebp - 0xb26c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xb26c]
mov edx, dword [eax]
call edx
mov dword [ebp - 0xb444], eax
jmp 0x49ddd9
mov dword [ebp - 0xb444], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x78]
call fcn.00430250
lea ecx, [ebp - 0x6c]
call fcn.004b9730
test eax, eax
jne 0x49de25
push str.CurrentControlSet
lea ecx, [ebp - 0xb27c]
call fcn.004b3550
mov byte [ebp - 4], 5
lea eax, [ebp - 0xb27c]
push eax
lea ecx, [ebp - 0x6c]
call fcn.00441810
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb27c]
call fcn.004b3860
jmp 0x49de44
lea ecx, [ebp - 0x6c]
call fcn.004b9730
push eax
lea ecx, [ebp - 0x40]
call fcn.004303b0
push 0
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x6c]
call fcn.004a1c70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6c]
call fcn.004324a0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
lea ecx, [ebp - 0x58]
call fcn.004b38f0
lea edx, [ebp - 0x30]
push edx
push 0x20019
push 0
lea ecx, [ebp - 0x58]
call fcn.004553f0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49deb6
push str.HKLM_
lea ecx, [ebp - 0x4c]
call fcn.004b38f0
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x4c]
call fcn.004b3ad0
lea ecx, [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0xb440]
call fcn.0049cd60
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x888], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x888]
push ecx
push 0
push 0
push 0
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x80], 0
mov edx, dword [ebp - 0x80]
cmp edx, dword [ebp - 0x888]
jae 0x49dfdb
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xb448], eax
push 0x400
lea ecx, [ebp - 0x884]
push ecx
mov edx, dword [ebp - 0xb448]
push edx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x80]
add eax, 1
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x34], 0
jne 0x49dfcb
push 0x5fc5a0
push 0x400
lea ecx, [ebp - 0x884]
push ecx
call fcn.0054eb7c
add esp, 0xc
lea ecx, [ebp - 0x58]
call fcn.004553f0
push eax
push 0x400
lea edx, [ebp - 0x884]
push edx
call fcn.0054eb7c
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x884]
push ecx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49dfc9
push str.HKU_
lea ecx, [ebp - 0x4c]
call fcn.004b38f0
lea edx, [ebp - 0x884]
push edx
lea ecx, [ebp - 0x4c]
call fcn.004b3b40
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0xb440]
call fcn.0049cd60
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x49dfd6
cmp dword [ebp - 0x34], 0x103
jne 0x49dfd6
jmp 0x49dfdb
jmp 0x49deed
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
lea ecx, [ebp - 0x58]
call fcn.004b38f0
mov dword [ebp - 0x88c], 0
jmp 0x49e003
mov eax, dword [ebp - 0x88c]
add eax, 1
mov dword [ebp - 0x88c], eax
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.004b9730
cmp dword [ebp - 0x88c], eax
jg 0x49e228
lea ecx, [ebp - 0x8a0]
call fcn.004b34a0
mov byte [ebp - 4], 6
xor ecx, ecx
cmp dword [ebp - 0x88c], 0
setne cl
add ecx, 0x80000002
mov dword [ebp - 0x890], ecx
cmp dword [ebp - 0x88c], 0
jne 0x49e05e
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x8a0]
call fcn.004b3890
jmp 0x49e09e
mov eax, dword [ebp - 0x88c]
sub eax, 1
push eax
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.00430700
push eax
lea ecx, [ebp - 0x8a0]
call fcn.004b3890
push 0x5c
lea ecx, [ebp - 0x8a0]
call fcn.004b3a80
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x8a0]
call fcn.004b3ad0
lea edx, [ebp - 0x894]
push edx
push 0x20019
push 0
lea ecx, [ebp - 0x8a0]
call fcn.004553f0
push eax
mov eax, dword [ebp - 0x890]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e214
mov dword [ebp - 0x10a8], 0x800
lea ecx, [ebp - 0x10a8]
push ecx
lea edx, [ebp - 0x10a4]
push edx
push 0
push 0
push 0x608bc4
mov eax, dword [ebp - 0x894]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x49e104
jmp 0x49e207
cmp dword [ebp - 0x10a8], 0
jbe 0x49e207
lea ecx, [ebp - 0x10a4]
push ecx
lea ecx, [ebp - 0x10b8]
call fcn.004b3550
mov byte [ebp - 4], 7
lea edx, [ebp - 0x10b8]
push edx
mov ecx, dword [ebp - 0xb440]
call fcn.0049d750
push 1
lea eax, [ebp - 0x10b8]
push eax
mov ecx, dword [ebp - 0xb440]
mov ecx, dword [ecx + 4]
call fcn.0041e0d0
mov dword [ebp - 0x10ac], eax
cmp dword [ebp - 0x10ac], 0
je 0x49e1f8
cmp dword [ebp - 0x890], 0x80000002
jne 0x49e17b
mov dword [ebp - 0xb44c], 0x6083d4
jmp 0x49e185
mov dword [ebp - 0xb44c], 0x6083cc
mov edx, dword [ebp - 0xb44c]
push edx
lea ecx, [ebp - 0x10c4]
call fcn.004b3550
mov byte [ebp - 4], 8
push 0x5c
lea ecx, [ebp - 0x10c4]
call fcn.004b3a80
lea eax, [ebp - 0x8a0]
push eax
lea ecx, [ebp - 0x10c4]
call fcn.004b3ad0
push 0x5c
lea ecx, [ebp - 0x10c4]
call fcn.004b3a80
push 0x608bc4
lea ecx, [ebp - 0x10c4]
call fcn.004b3b40
lea ecx, [ebp - 0x10c4]
push ecx
mov ecx, dword [ebp - 0x10ac]
call fcn.00412ce0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x10c4]
call fcn.004b3860
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x10b8]
call fcn.004b3860
mov edx, dword [ebp - 0x894]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8a0]
call fcn.004b3860
jmp 0x49dff4
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
lea ecx, [ebp - 0x58]
call fcn.004b38f0
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x58]
call fcn.004553f0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e44f
mov dword [ebp - 0x18d0], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x18d0]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x10c8], 0
mov eax, dword [ebp - 0x10c8]
cmp eax, dword [ebp - 0x18d0]
jae 0x49e445
mov ecx, dword [ebp - 0x10c8]
mov dword [ebp - 0xb450], ecx
push 0x400
lea edx, [ebp - 0x18cc]
push edx
mov eax, dword [ebp - 0xb450]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x10c8]
add edx, 1
mov dword [ebp - 0x10c8], edx
cmp dword [ebp - 0x34], 0
jne 0x49e435
lea eax, [ebp - 0x18d4]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x18cc]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e433
mov dword [ebp - 0x18d8], 0x800
lea eax, [ebp - 0x18d8]
push eax
lea ecx, [ebp - 0x20dc]
push ecx
push 0
push 0
push str.DLLName
mov edx, dword [ebp - 0x18d4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49e426
lea eax, [ebp - 0x20dc]
push eax
lea ecx, [ebp - 0x20e8]
call fcn.004b3550
mov byte [ebp - 4], 9
mov dword [ebp - 0x20ec], 0
lea ecx, [ebp - 0x20e8]
push ecx
mov ecx, dword [ebp - 0xb440]
call fcn.0049d750
push 1
lea edx, [ebp - 0x20e8]
push edx
mov eax, dword [ebp - 0xb440]
mov ecx, dword [eax + 4]
call fcn.0041e0d0
mov dword [ebp - 0x20ec], eax
cmp dword [ebp - 0x20ec], 0
je 0x49e417
push str.HKLM_
lea ecx, [ebp - 0x20f8]
call fcn.004b3550
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x20f8]
call fcn.004b3ad0
push 0x5fc5a0
lea ecx, [ebp - 0x20f8]
call fcn.004b3b40
lea edx, [ebp - 0x18cc]
push edx
lea ecx, [ebp - 0x20f8]
call fcn.004b3b40
push 0x5fc5a0
lea ecx, [ebp - 0x20f8]
call fcn.004b3b40
lea eax, [ebp - 0x20f8]
push eax
mov ecx, dword [ebp - 0x20ec]
call fcn.00412ce0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x20f8]
call fcn.004b3860
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20e8]
call fcn.004b3860
mov ecx, dword [ebp - 0x18d4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x49e440
cmp dword [ebp - 0x34], 0x103
jne 0x49e440
jmp 0x49e445
jmp 0x49e295
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea ecx, [ebp - 0x58]
call fcn.004b38f0
mov dword [ebp - 0x20fc], 0
jmp 0x49e477
mov eax, dword [ebp - 0x20fc]
add eax, 1
mov dword [ebp - 0x20fc], eax
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.004b9730
cmp dword [ebp - 0x20fc], eax
jg 0x49e9be
lea ecx, [ebp - 0x210c]
call fcn.004b34a0
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x20fc], 0
jne 0x49e4c4
mov dword [ebp - 0x2100], 0x80000002
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x210c]
call fcn.004b3890
jmp 0x49e50e
mov dword [ebp - 0x2100], 0x80000003
mov edx, dword [ebp - 0x20fc]
sub edx, 1
push edx
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.00430700
push eax
lea ecx, [ebp - 0x210c]
call fcn.004b3890
push 0x5c
lea ecx, [ebp - 0x210c]
call fcn.004b3a80
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x210c]
call fcn.004b3ad0
lea ecx, [ebp - 0x30]
push ecx
push 0x20019
push 0
lea ecx, [ebp - 0x210c]
call fcn.004553f0
push eax
mov edx, dword [ebp - 0x2100]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49e9aa
mov dword [ebp - 0x2118], str.Shell
mov dword [ebp - 0x2114], str.System
mov dword [ebp - 0x2110], str.UserInit
mov dword [ebp - 0x211c], 0
jmp 0x49e573
mov eax, dword [ebp - 0x211c]
add eax, 1
mov dword [ebp - 0x211c], eax
cmp dword [ebp - 0x211c], 3
jae 0x49e9a0
mov dword [ebp - 0x2920], 0x800
lea ecx, [ebp - 0x2920]
push ecx
lea edx, [ebp - 0x291c]
push edx
push 0
push 0
mov eax, dword [ebp - 0x211c]
mov ecx, dword [ebp + eax*4 - 0x2118]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49e99b
lea eax, [ebp - 0x291c]
mov dword [ebp - 0x2924], eax
cmp dword [ebp - 0x2924], 0
je 0x49e99b
cmp dword [ebp - 0x211c], 0
jne 0x49e68f
push 0x20
mov ecx, dword [ebp - 0x2924]
push ecx
call fcn.00404ac0
add esp, 8
mov dword [ebp - 0x3128], eax
cmp dword [ebp - 0x3128], 0
je 0x49e665
mov edx, dword [ebp - 0x3128]
sub edx, dword [ebp - 0x2924]
sar edx, 1
mov dword [ebp - 0x312c], edx
mov eax, dword [ebp - 0x312c]
push eax
mov ecx, dword [ebp - 0x2924]
push ecx
push 0x400
lea edx, [ebp - 0x3124]
push edx
call fcn.0054f7b5
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 0x312c]
mov word [ebp + ecx*2 - 0x3124], ax
mov edx, dword [ebp - 0x3128]
add edx, 2
mov dword [ebp - 0x3128], edx
mov eax, dword [ebp - 0x3128]
mov dword [ebp - 0x2924], eax
jmp 0x49e68a
mov ecx, dword [ebp - 0x2924]
push ecx
push 0x400
lea edx, [ebp - 0x3124]
push edx
call fcn.0054d766
add esp, 0xc
mov dword [ebp - 0x2924], 0
jmp 0x49e841
cmp dword [ebp - 0x211c], 2
jne 0x49e81c
push 0x3a
mov eax, dword [ebp - 0x2924]
push eax
call fcn.00404ac0
add esp, 8
mov dword [ebp - 0x3130], eax
cmp dword [ebp - 0x3130], 0
je 0x49e76d
push 0x2c
mov ecx, dword [ebp - 0x2924]
push ecx
call fcn.00404ac0
add esp, 8
mov dword [ebp - 0x3130], eax
cmp dword [ebp - 0x3130], 0
je 0x49e743
mov edx, dword [ebp - 0x3130]
sub edx, dword [ebp - 0x2924]
sar edx, 1
mov dword [ebp - 0x3134], edx
mov eax, dword [ebp - 0x3134]
push eax
mov ecx, dword [ebp - 0x2924]
push ecx
push 0x400
lea edx, [ebp - 0x3124]
push edx
call fcn.0054f7b5
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 0x3134]
mov word [ebp + ecx*2 - 0x3124], ax
mov edx, dword [ebp - 0x3130]
add edx, 2
mov dword [ebp - 0x3130], edx
mov eax, dword [ebp - 0x3130]
mov dword [ebp - 0x2924], eax
jmp 0x49e768
mov ecx, dword [ebp - 0x2924]
push ecx
push 0x400
lea edx, [ebp - 0x3124]
push edx
call fcn.0054d766
add esp, 0xc
mov dword [ebp - 0x2924], 0
jmp 0x49e81a
push 0x607654
mov eax, dword [ebp - 0x2924]
push eax
call fcn.004a1d00
add esp, 8
mov dword [ebp - 0x3130], eax
cmp dword [ebp - 0x3130], 0
je 0x49e7f3
mov ecx, dword [ebp - 0x3130]
sub ecx, dword [ebp - 0x2924]
sar ecx, 1
mov dword [ebp - 0x3138], ecx
mov edx, dword [ebp - 0x3138]
push edx
mov eax, dword [ebp - 0x2924]
push eax
push 0x400
lea ecx, [ebp - 0x3124]
push ecx
call fcn.0054f7b5
add esp, 0x10
xor edx, edx
mov eax, dword [ebp - 0x3138]
mov word [ebp + eax*2 - 0x3124], dx
mov ecx, dword [ebp - 0x3130]
add ecx, 2
mov dword [ebp - 0x3130], ecx
mov edx, dword [ebp - 0x3130]
mov dword [ebp - 0x2924], edx
jmp 0x49e81a
mov eax, dword [ebp - 0x2924]
push eax
push 0x400
lea ecx, [ebp - 0x3124]
push ecx
call fcn.0054d766
add esp, 0xc
mov edx, dword [ebp - 0x3130]
mov dword [ebp - 0x2924], edx
jmp 0x49e841
mov eax, dword [ebp - 0x2924]
push eax
push 0x400
lea ecx, [ebp - 0x3124]
push ecx
call fcn.0054d766
add esp, 0xc
mov dword [ebp - 0x2924], 0
lea edx, [ebp - 0x3124]
mov dword [ebp - 0xb454], edx
mov eax, dword [ebp - 0xb454]
add eax, 2
mov dword [ebp - 0xb458], eax
mov ecx, dword [ebp - 0xb454]
mov dx, word [ecx]
mov word [ebp - 0xb45a], dx
add dword [ebp - 0xb454], 2
cmp word [ebp - 0xb45a], 0
jne 0x49e85c
mov eax, dword [ebp - 0xb454]
sub eax, dword [ebp - 0xb458]
sar eax, 1
mov dword [ebp - 0xb460], eax
je 0x49e996
lea ecx, [ebp - 0x3124]
push ecx
lea ecx, [ebp - 0x3148]
call fcn.004b3550
mov byte [ebp - 4], 0xc
lea edx, [ebp - 0x3148]
push edx
mov ecx, dword [ebp - 0xb440]
call fcn.0049d750
push 1
lea eax, [ebp - 0x3148]
push eax
mov ecx, dword [ebp - 0xb440]
mov ecx, dword [ecx + 4]
call fcn.0041e0d0
mov dword [ebp - 0x313c], eax
cmp dword [ebp - 0x313c], 0
je 0x49e987
cmp dword [ebp - 0x2100], 0x80000002
jne 0x49e901
mov dword [ebp - 0xb464], 0x6083d4
jmp 0x49e90b
mov dword [ebp - 0xb464], 0x6083cc
mov edx, dword [ebp - 0xb464]
push edx
lea ecx, [ebp - 0x3154]
call fcn.004b3550
mov byte [ebp - 4], 0xd
push 0x5c
lea ecx, [ebp - 0x3154]
call fcn.004b3a80
lea eax, [ebp - 0x210c]
push eax
lea ecx, [ebp - 0x3154]
call fcn.004b3ad0
push 0x5c
lea ecx, [ebp - 0x3154]
call fcn.004b3a80
mov ecx, dword [ebp - 0x211c]
mov edx, dword [ebp + ecx*4 - 0x2118]
push edx
lea ecx, [ebp - 0x3154]
call fcn.004b3b40
lea eax, [ebp - 0x3154]
push eax
mov ecx, dword [ebp - 0x313c]
call fcn.00412ce0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3154]
call fcn.004b3860
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3148]
call fcn.004b3860
jmp 0x49e5c8
jmp 0x49e564
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x210c]
call fcn.004b3860
jmp 0x49e468
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
lea ecx, [ebp - 0x58]
call fcn.004b38f0
lea edx, [ebp - 0x30]
push edx
push 0x20019
push 0
lea ecx, [ebp - 0x58]
call fcn.004553f0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49ec26
mov dword [ebp - 0x3958], 0x800
lea eax, [ebp - 0x3958]
push eax
lea ecx, [ebp - 0x3954]
push ecx
push 0
push 0
push 0x608c5c
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49ec1c
lea eax, [ebp - 0x3954]
mov dword [ebp - 0x395c], eax
cmp dword [ebp - 0x395c], 0
je 0x49ec1c
push 0x607654
mov ecx, dword [ebp - 0x395c]
push ecx
call fcn.004a1d00
add esp, 8
mov dword [ebp - 0x4160], eax
cmp dword [ebp - 0x4160], 0
je 0x49eac4
mov edx, dword [ebp - 0x4160]
sub edx, dword [ebp - 0x395c]
sar edx, 1
mov dword [ebp - 0x4164], edx
mov eax, dword [ebp - 0x4164]
push eax
mov ecx, dword [ebp - 0x395c]
push ecx
push 0x400
lea edx, [ebp - 0x415c]
push edx
call fcn.0054f7b5
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 0x4164]
mov word [ebp + ecx*2 - 0x415c], ax
mov edx, dword [ebp - 0x4160]
add edx, 2
mov dword [ebp - 0x4160], edx
mov eax, dword [ebp - 0x4160]
mov dword [ebp - 0x395c], eax
jmp 0x49eaeb
mov ecx, dword [ebp - 0x395c]
push ecx
push 0x400
lea edx, [ebp - 0x415c]
push edx
call fcn.0054d766
add esp, 0xc
mov eax, dword [ebp - 0x4160]
mov dword [ebp - 0x395c], eax
lea ecx, [ebp - 0x415c]
mov dword [ebp - 0xb468], ecx
mov edx, dword [ebp - 0xb468]
add edx, 2
mov dword [ebp - 0xb46c], edx
mov eax, dword [ebp - 0xb468]
mov cx, word [eax]
mov word [ebp - 0xb46e], cx
add dword [ebp - 0xb468], 2
cmp word [ebp - 0xb46e], 0
jne 0x49eb06
mov edx, dword [ebp - 0xb468]
sub edx, dword [ebp - 0xb46c]
sar edx, 1
mov dword [ebp - 0xb474], edx
je 0x49ec17
lea eax, [ebp - 0x415c]
push eax
lea ecx, [ebp - 0x4174]
call fcn.004b3550
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x4174]
push ecx
mov ecx, dword [ebp - 0xb440]
call fcn.0049d750
lea edx, [ebp - 0x415c]
push edx
lea ecx, [ebp - 0xb288]
call fcn.004b3550
mov byte [ebp - 4], 0xf
push 1
lea eax, [ebp - 0xb288]
push eax
mov ecx, dword [ebp - 0xb440]
mov ecx, dword [ecx + 4]
call fcn.0041e0d0
mov dword [ebp - 0x4168], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xb288]
call fcn.004b3860
cmp dword [ebp - 0x4168], 0
je 0x49ec08
push str.HKLM_
lea ecx, [ebp - 0x4180]
call fcn.004b3550
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x4180]
call fcn.004b3ad0
push str.AppInit_DLLs
lea ecx, [ebp - 0x4180]
call fcn.004b3b40
lea eax, [ebp - 0x4180]
push eax
mov ecx, dword [ebp - 0x4168]
call fcn.00412ce0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x4180]
call fcn.004b3860
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4174]
call fcn.004b3860
jmp 0x49ea31
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4184], 0
jmp 0x49ec41
mov edx, dword [ebp - 0x4184]
add edx, 1
mov dword [ebp - 0x4184], edx
lea ecx, [ebp - 0x40]
call fcn.004b9730
cmp dword [ebp - 0x4184], eax
jge 0x49ee26
mov eax, dword [ebp - 0x4184]
push eax
lea ecx, [ebp - 0x40]
call fcn.00430700
mov ecx, eax
call fcn.004553f0
push eax
push str.SYSTEM_sControlSession_ManagerAppCertDlls
lea ecx, [ebp - 0xb294]
push ecx
call fcn.004b4d50
add esp, 0xc
mov dword [ebp - 0xb478], eax
mov edx, dword [ebp - 0xb478]
mov dword [ebp - 0xb47c], edx
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0xb47c]
push eax
lea ecx, [ebp - 0x58]
call fcn.004b3890
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb294]
call fcn.004b3860
push 0
lea ecx, [ebp - 0x58]
push ecx
call fcn.00414b30
mov ecx, eax
call fcn.00414800
mov dword [ebp - 0x4188], eax
cmp dword [ebp - 0x4188], 0
je 0x49ee21
lea ecx, [ebp - 0x4194]
call fcn.004b34a0
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0x4194]
push edx
push str.AppSecDll
mov ecx, dword [ebp - 0x4188]
call fcn.004141d0
movzx eax, al
test eax, eax
je 0x49edcb
lea ecx, [ebp - 0x4194]
push ecx
lea ecx, [ebp - 0x41a4]
call fcn.004b34d0
mov byte [ebp - 4], 0x13
lea edx, [ebp - 0x41a4]
push edx
mov ecx, dword [ebp - 0xb440]
call fcn.0049d750
push 1
lea eax, [ebp - 0x41a4]
push eax
mov ecx, dword [ebp - 0xb440]
mov ecx, dword [ecx + 4]
call fcn.0041e0d0
mov dword [ebp - 0x4198], eax
cmp dword [ebp - 0x4198], 0
je 0x49edbc
push str.HKLM_
lea ecx, [ebp - 0x41b0]
call fcn.004b3550
mov byte [ebp - 4], 0x14
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x41b0]
call fcn.004b3ad0
push 0x5fc5a0
lea ecx, [ebp - 0x41b0]
call fcn.004b3b40
push str.AppSecDll
lea ecx, [ebp - 0x41b0]
call fcn.004b3b40
lea eax, [ebp - 0x41b0]
push eax
mov ecx, dword [ebp - 0x4198]
call fcn.00412ce0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x41b0]
call fcn.004b3860
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x41a4]
call fcn.004b3860
mov ecx, dword [ebp - 0x4188]
mov dword [ebp - 0xb29c], ecx
mov edx, dword [ebp - 0xb29c]
mov dword [ebp - 0xb298], edx
cmp dword [ebp - 0xb298], 0
je 0x49ee08
push 1
mov eax, dword [ebp - 0xb298]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xb298]
mov eax, dword [edx]
call eax
mov dword [ebp - 0xb480], eax
jmp 0x49ee12
mov dword [ebp - 0xb480], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4194]
call fcn.004b3860
jmp 0x49ec32
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
lea ecx, [ebp - 0x58]
call fcn.004b38f0
lea ecx, [ebp - 0x30]
push ecx
push 0x20019
push 0
lea ecx, [ebp - 0x58]
call fcn.004553f0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49f04c
mov dword [ebp - 0x49bc], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x49bc]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x49b8], 0
mov ecx, dword [ebp - 0x49b8]
cmp ecx, dword [ebp - 0x49bc]
jae 0x49f042
mov edx, dword [ebp - 0x49b8]
mov dword [ebp - 0xb484], edx
push 0x400
lea eax, [ebp - 0x49b4]
push eax
mov ecx, dword [ebp - 0xb484]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 0x49c0], eax
mov eax, dword [ebp - 0x49b8]
add eax, 1
mov dword [ebp - 0x49b8], eax
cmp dword [ebp - 0x49c0], 0
jne 0x49f02f
lea ecx, [ebp - 0x49c4]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x49b4]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49f020
mov dword [ebp - 0x51c8], 0x800
lea ecx, [ebp - 0x51c8]
push ecx
lea edx, [ebp - 0x51c4]
push edx
push 0
push 0
push 0x605ad0
mov eax, dword [ebp - 0x49c4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49f020
lea ecx, [ebp - 0x51c4]
push ecx
lea ecx, [ebp - 0x51d8]
call fcn.004b3550
mov byte [ebp - 4], 0x15
lea edx, [ebp - 0x51d8]
push edx
mov ecx, dword [ebp - 0xb440]
call fcn.0049d750
push 1
lea eax, [ebp - 0x51d8]
push eax
mov ecx, dword [ebp - 0xb440]
mov ecx, dword [ecx + 4]
call fcn.0041e0d0
mov dword [ebp - 0x51cc], eax
cmp dword [ebp - 0x51cc], 0
je 0x49f011
push str.HKLM_
lea ecx, [ebp - 0x51e4]
call fcn.004b3550
mov byte [ebp - 4], 0x16
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x51e4]
call fcn.004b3ad0
push 0x5fc5a0
lea ecx, [ebp - 0x51e4]
call fcn.004b3b40
lea eax, [ebp - 0x49b4]
push eax
lea ecx, [ebp - 0x51e4]
call fcn.004b3b40
push str.Debugger
lea ecx, [ebp - 0x51e4]
call fcn.004b3b40
lea ecx, [ebp - 0x51e4]
push ecx
mov ecx, dword [ebp - 0x51cc]
call fcn.00412ce0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x51e4]
call fcn.004b3860
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x51d8]
call fcn.004b3860
mov edx, dword [ebp - 0x49c4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x49f03d
cmp dword [ebp - 0x49c0], 0x103
jne 0x49f03d
jmp 0x49f042
jmp 0x49ee93
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
lea ecx, [ebp - 0x58]
call fcn.004b38f0
lea ecx, [ebp - 0x30]
push ecx
push 0x20019
push 0
lea ecx, [ebp - 0x58]
call fcn.004553f0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49f1d9
mov dword [ebp - 0x59f0], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x59f0]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x51e8], 0
mov ecx, dword [ebp - 0x51e8]
cmp ecx, dword [ebp - 0x59f0]
jae 0x49f1cf
mov edx, dword [ebp - 0x51e8]
mov dword [ebp - 0xb488], edx
push 0x400
lea eax, [ebp - 0x59ec]
push eax
mov ecx, dword [ebp - 0xb488]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 0x59f4], eax
mov eax, dword [ebp - 0x51e8]
add eax, 1
mov dword [ebp - 0x51e8], eax
cmp dword [ebp - 0x59f4], 0
jne 0x49f1bc
push str.HKLM_
lea ecx, [ebp - 0x5a00]
call fcn.004b3550
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x5a00]
call fcn.004b3ad0
push 0x5fc5a0
lea ecx, [ebp - 0x5a00]
call fcn.004b3b40
lea edx, [ebp - 0x59ec]
push edx
lea ecx, [ebp - 0x5a00]
call fcn.004b3b40
push 0x5fc5a0
lea ecx, [ebp - 0x5a00]
call fcn.004b3b40
lea eax, [ebp - 0x59ec]
push eax
lea ecx, [ebp - 0xb2a8]
call fcn.004b3550
mov byte [ebp - 4], 0x18
push 0
lea ecx, [ebp - 0x5a00]
push ecx
lea edx, [ebp - 0xb2a8]
push edx
mov ecx, dword [ebp - 0xb440]
call fcn.0049c350
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xb2a8]
call fcn.004b3860
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5a00]
call fcn.004b3860
jmp 0x49f1ca
cmp dword [ebp - 0x59f4], 0x103
jne 0x49f1ca
jmp 0x49f1cf
jmp 0x49f0b9
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SOFTWAREMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
lea ecx, [ebp - 0x58]
call fcn.004b38f0
lea ecx, [ebp - 0x30]
push ecx
push 0x20019
push 0
lea ecx, [ebp - 0x58]
call fcn.004553f0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49f36a
mov dword [ebp - 0x6208], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x6208]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x5a04], 0
mov ecx, dword [ebp - 0x5a04]
cmp ecx, dword [ebp - 0x6208]
jae 0x49f360
mov dword [ebp - 0x620c], 0x400
mov edx, dword [ebp - 0x5a04]
mov dword [ebp - 0xb48c], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x620c]
push eax
lea ecx, [ebp - 0x6204]
push ecx
mov edx, dword [ebp - 0xb48c]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x6210], eax
mov ecx, dword [ebp - 0x5a04]
add ecx, 1
mov dword [ebp - 0x5a04], ecx
cmp dword [ebp - 0x6210], 0
jne 0x49f34d
push str.HKLM_
lea ecx, [ebp - 0x621c]
call fcn.004b3550
mov byte [ebp - 4], 0x19
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x621c]
call fcn.004b3ad0
push 0x5fc5a0
lea ecx, [ebp - 0x621c]
call fcn.004b3b40
lea eax, [ebp - 0x6204]
push eax
lea ecx, [ebp - 0x621c]
call fcn.004b3b40
lea ecx, [ebp - 0x6204]
push ecx
lea ecx, [ebp - 0xb2b4]
call fcn.004b3550
mov byte [ebp - 4], 0x1a
push 0
lea edx, [ebp - 0x621c]
push edx
lea eax, [ebp - 0xb2b4]
push eax
mov ecx, dword [ebp - 0xb440]
call fcn.0049c350
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xb2b4]
call fcn.004b3860
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x621c]
call fcn.004b3860
jmp 0x49f35b
cmp dword [ebp - 0x6210], 0x103
jne 0x49f35b
jmp 0x49f360
jmp 0x49f246
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6224], str.ShellServiceObjectDelayLoad
mov dword [ebp - 0x6220], str.SharedTaskScheduler
mov dword [ebp - 0x6228], 0
jmp 0x49f399
mov edx, dword [ebp - 0x6228]
add edx, 1
mov dword [ebp - 0x6228], edx
cmp dword [ebp - 0x6228], 2
jae 0x49f695
mov eax, dword [ebp - 0x6228]
mov ecx, dword [ebp + eax*4 - 0x6224]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersion_s
lea edx, [ebp - 0xb2c0]
push edx
call fcn.004b4d50
add esp, 0xc
mov dword [ebp - 0xb490], eax
mov eax, dword [ebp - 0xb490]
mov dword [ebp - 0xb494], eax
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0xb494]
push ecx
lea ecx, [ebp - 0x58]
call fcn.004b3890
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb2c0]
call fcn.004b3860
mov dword [ebp - 0x622c], 0
jmp 0x49f417
mov edx, dword [ebp - 0x622c]
add edx, 1
mov dword [ebp - 0x622c], edx
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.004b9730
cmp dword [ebp - 0x622c], eax
jg 0x49f690
lea ecx, [ebp - 0x623c]
call fcn.004b34a0
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x622c], 0
jne 0x49f464
mov dword [ebp - 0x6230], 0x80000002
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x623c]
call fcn.004b3890
jmp 0x49f4ae
mov dword [ebp - 0x6230], 0x80000003
mov ecx, dword [ebp - 0x622c]
sub ecx, 1
push ecx
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.00430700
push eax
lea ecx, [ebp - 0x623c]
call fcn.004b3890
push 0x5c
lea ecx, [ebp - 0x623c]
call fcn.004b3a80
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x623c]
call fcn.004b3ad0
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x623c]
call fcn.004553f0
push eax
mov ecx, dword [ebp - 0x6230]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49f67c
mov dword [ebp - 0x6a44], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x6a44]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x6a40], 0
mov ecx, dword [ebp - 0x6a40]
cmp ecx, dword [ebp - 0x6a44]
jae 0x49f672
mov dword [ebp - 0x724c], 0x400
mov dword [ebp - 0x7248], 0x800
mov edx, dword [ebp - 0x6a40]
mov dword [ebp - 0xb498], edx
lea eax, [ebp - 0x7248]
push eax
lea ecx, [ebp - 0x6a3c]
push ecx
push 0
push 0
lea edx, [ebp - 0x724c]
push edx
lea eax, [ebp - 0x7244]
push eax
mov ecx, dword [ebp - 0xb498]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x7250], eax
mov eax, dword [ebp - 0x6a40]
add eax, 1
mov dword [ebp - 0x6a40], eax
cmp dword [ebp - 0x7250], 0
jne 0x49f65f
cmp dword [ebp - 0x6230], 0x80000002
jne 0x49f5b0
mov dword [ebp - 0xb49c], 0x6083d4
jmp 0x49f5ba
mov dword [ebp - 0xb49c], 0x6083cc
mov ecx, dword [ebp - 0xb49c]
push ecx
lea ecx, [ebp - 0x725c]
call fcn.004b3550
mov byte [ebp - 4], 0x1d
push 0x5c
lea ecx, [ebp - 0x725c]
call fcn.004b3a80
lea edx, [ebp - 0x623c]
push edx
lea ecx, [ebp - 0x725c]
call fcn.004b3ad0
push 0x5c
lea ecx, [ebp - 0x725c]
call fcn.004b3a80
lea eax, [ebp - 0x7244]
push eax
lea ecx, [ebp - 0x725c]
call fcn.004b3b40
lea ecx, [ebp - 0x6a3c]
push ecx
lea ecx, [ebp - 0xb2cc]
call fcn.004b3550
mov byte [ebp - 4], 0x1e
push 0
lea edx, [ebp - 0x725c]
push edx
lea eax, [ebp - 0xb2cc]
push eax
mov ecx, dword [ebp - 0xb440]
call fcn.0049c350
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xb2cc]
call fcn.004b3860
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x725c]
call fcn.004b3860
jmp 0x49f66d
cmp dword [ebp - 0x7250], 0x103
jne 0x49f66d
jmp 0x49f672
jmp 0x49f513
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x623c]
call fcn.004b3860
jmp 0x49f408
jmp 0x49f38a
push str.SOFTWAREMicrosoftActive_SetupInstalled_Components
lea ecx, [ebp - 0x58]
call fcn.004b38f0
lea edx, [ebp - 0x30]
push edx
push 0x20019
push 0
lea ecx, [ebp - 0x58]
call fcn.004553f0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49fae0
mov dword [ebp - 0x7a64], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x7a64]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x7a60], 0
mov edx, dword [ebp - 0x7a60]
cmp edx, dword [ebp - 0x7a64]
jae 0x49fad6
mov eax, dword [ebp - 0x7a60]
mov dword [ebp - 0xb4a0], eax
push 0x400
lea ecx, [ebp - 0x7a5c]
push ecx
mov edx, dword [ebp - 0xb4a0]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 0x7a68], eax
mov ecx, dword [ebp - 0x7a60]
add ecx, 1
mov dword [ebp - 0x7a60], ecx
cmp dword [ebp - 0x7a68], 0
jne 0x49fac3
lea edx, [ebp - 0x7a6c]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x7a5c]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49fab4
mov dword [ebp - 0x8270], 0x800
lea edx, [ebp - 0x8270]
push edx
lea eax, [ebp - 0x826c]
push eax
push 0
push 0
push str.StubPath
mov ecx, dword [ebp - 0x7a6c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49fab4
lea edx, [ebp - 0x826c]
mov dword [ebp - 0x8274], edx
cmp dword [ebp - 0x8274], 0
je 0x49fab4
mov dword [ebp - 0x8278], 0
mov eax, dword [ebp - 0x8274]
movzx ecx, word [eax]
cmp ecx, 0x22
jne 0x49f815
mov edx, dword [ebp - 0x8274]
add edx, 2
mov dword [ebp - 0x8274], edx
push 0x22
mov eax, dword [ebp - 0x8274]
push eax
call fcn.00404ac0
add esp, 8
mov dword [ebp - 0x8278], eax
jmp 0x49f82f
push 0x609010
mov ecx, dword [ebp - 0x8274]
push ecx
call fcn.004a1d00
add esp, 8
mov dword [ebp - 0x8278], eax
cmp dword [ebp - 0x8278], 0
je 0x49f877
mov edx, dword [ebp - 0x8278]
movzx eax, word [edx]
cmp eax, 0x2c
jne 0x49f85d
xor ecx, ecx
mov edx, dword [ebp - 0x8278]
mov word [edx], cx
mov dword [ebp - 0x8278], 0
jmp 0x49f877
xor eax, eax
mov ecx, dword [ebp - 0x8278]
mov word [ecx], ax
mov edx, dword [ebp - 0x8278]
add edx, 2
mov dword [ebp - 0x8278], edx
mov eax, dword [ebp - 0x8274]
push eax
lea ecx, [ebp - 0x8284]
call fcn.004b3550
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x8284]
push ecx
mov ecx, dword [ebp - 0xb440]
call fcn.0049d750
lea ecx, [ebp - 0x8284]
call fcn.00404b70
cmp eax, 3
jge 0x49f8b4
jmp 0x49f977
push 2
push 0x605aa8
lea ecx, [ebp - 0x8284]
call fcn.004553f0
add eax, 2
push eax
call fcn.005525f7
add esp, 0xc
test eax, eax
je 0x49f8db
jmp 0x49f977
push 1
lea edx, [ebp - 0x8284]
push edx
mov eax, dword [ebp - 0xb440]
mov ecx, dword [eax + 4]
call fcn.0041e0d0
mov dword [ebp - 0x8288], eax
cmp dword [ebp - 0x8288], 0
je 0x49f977
push str.HKLM_
lea ecx, [ebp - 0x8294]
call fcn.004b3550
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x8294]
call fcn.004b3ad0
push 0x5fc5a0
lea ecx, [ebp - 0x8294]
call fcn.004b3b40
lea edx, [ebp - 0x7a5c]
push edx
lea ecx, [ebp - 0x8294]
call fcn.004b3b40
push 0x5fc5a0
lea ecx, [ebp - 0x8294]
call fcn.004b3b40
lea eax, [ebp - 0x8294]
push eax
mov ecx, dword [ebp - 0x8288]
call fcn.00412ce0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x8294]
call fcn.004b3860
cmp dword [ebp - 0x8278], 0
jne 0x49f999
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8284]
call fcn.004b3860
jmp 0x49fab4
push 0x609018
mov ecx, dword [ebp - 0x8278]
push ecx
call fcn.004a1d00
add esp, 8
mov dword [ebp - 0x8274], eax
cmp dword [ebp - 0x8274], 0
jne 0x49faa0
push 0x3a
mov edx, dword [ebp - 0x8278]
push edx
call fcn.00404aa0
add esp, 8
mov dword [ebp - 0x8274], eax
cmp dword [ebp - 0x8274], 0
jne 0x49fa07
mov eax, dword [ebp - 0x8278]
movzx ecx, word [eax]
push ecx
call fcn.0054f9c1
add esp, 4
test eax, eax
je 0x49fa02
mov edx, dword [ebp - 0x8278]
mov dword [ebp - 0x8274], edx
jmp 0x49faa0
mov eax, dword [ebp - 0x8274]
movzx ecx, word [eax]
cmp ecx, 0x3a
jne 0x49fa94
mov edx, dword [ebp - 0x8274]
movzx eax, word [edx - 4]
test eax, eax
jne 0x49fa34
mov ecx, dword [ebp - 0x8274]
sub ecx, 2
mov dword [ebp - 0x8274], ecx
jmp 0x49fa92
mov edx, dword [ebp - 0x8274]
movzx eax, word [edx - 4]
cmp eax, 0x20
jne 0x49fa54
mov ecx, dword [ebp - 0x8274]
sub ecx, 4
mov dword [ebp - 0x8274], ecx
jmp 0x49fa92
mov edx, dword [ebp - 0x8274]
movzx eax, word [edx - 4]
cmp eax, 0x2f
jne 0x49fa92
push 0x20
mov ecx, dword [ebp - 0x8274]
push ecx
call fcn.00404aa0
add esp, 8
mov dword [ebp - 0x8274], eax
cmp dword [ebp - 0x8274], 0
je 0x49fa92
mov edx, dword [ebp - 0x8274]
add edx, 2
mov dword [ebp - 0x8274], edx
jmp 0x49faa0
mov eax, dword [ebp - 0x8278]
mov dword [ebp - 0x8274], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8284]
call fcn.004b3860
jmp 0x49f7c8
mov ecx, dword [ebp - 0x7a6c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x49fad1
cmp dword [ebp - 0x7a68], 0x103
jne 0x49fad1
jmp 0x49fad6
jmp 0x49f702
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
lea ecx, [ebp - 0x58]
call fcn.004b38f0
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x58]
call fcn.004553f0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49fca0
mov dword [ebp - 0x829c], 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x829c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x8298], 0
mov eax, dword [ebp - 0x8298]
cmp eax, dword [ebp - 0x829c]
jae 0x49fc96
mov dword [ebp - 0x8aa0], 0x400
mov ecx, dword [ebp - 0x8298]
mov dword [ebp - 0xb4a4], ecx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x8aa0]
push edx
lea eax, [ebp - 0x8a9c]
push eax
mov ecx, dword [ebp - 0xb4a4]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x8aa4], eax
mov eax, dword [ebp - 0x8298]
add eax, 1
mov dword [ebp - 0x8298], eax
cmp dword [ebp - 0x8aa4], 0
jne 0x49fc83
lea ecx, [ebp - 0x8a9c]
push ecx
lea ecx, [ebp - 0x8ab4]
call fcn.004b3550
mov byte [ebp - 4], 0x21
lea edx, [ebp - 0x8ab4]
push edx
mov ecx, dword [ebp - 0xb440]
call fcn.0049d750
push 1
lea eax, [ebp - 0x8ab4]
push eax
mov ecx, dword [ebp - 0xb440]
mov ecx, dword [ecx + 4]
call fcn.0041e0d0
mov dword [ebp - 0x8aa8], eax
cmp dword [ebp - 0x8aa8], 0
je 0x49fc72
push str.HKLM_
lea ecx, [ebp - 0x8ac0]
call fcn.004b3550
mov byte [ebp - 4], 0x22
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x8ac0]
call fcn.004b3ad0
push 0x5fc5a0
lea ecx, [ebp - 0x8ac0]
call fcn.004b3b40
lea eax, [ebp - 0x8a9c]
push eax
lea ecx, [ebp - 0x8ac0]
call fcn.004b3b40
lea ecx, [ebp - 0x8ac0]
push ecx
mov ecx, dword [ebp - 0x8aa8]
call fcn.00412ce0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x8ac0]
call fcn.004b3860
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8ab4]
call fcn.004b3860
jmp 0x49fc91
cmp dword [ebp - 0x8aa4], 0x103
jne 0x49fc91
jmp 0x49fc96
jmp 0x49fb4d
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SYSTEMCurrentControlSetControlSecurityProviders
lea ecx, [ebp - 0x58]
call fcn.004b38f0
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x58]
call fcn.004553f0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49fe6c
mov dword [ebp - 0x92c8], 0x800
lea ecx, [ebp - 0x92c8]
push ecx
lea edx, [ebp - 0x92c4]
push edx
push 0
push 0
push str.SecurityProviders
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49fe62
lea ecx, [ebp - 0x92c4]
mov dword [ebp - 0x92cc], ecx
mov edx, 1
test edx, edx
je 0x49fe62
push 0x20
mov eax, dword [ebp - 0x92cc]
push eax
call fcn.00404ac0
add esp, 8
mov dword [ebp - 0x92d0], eax
cmp dword [ebp - 0x92d0], 0
je 0x49fd75
mov dword [ebp - 0x92e4], 0
mov ecx, dword [ebp - 0x92d0]
movzx edx, word [ecx - 2]
cmp edx, 0x2c
jne 0x49fd63
mov dword [ebp - 0x92e4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x92e4]
mov edx, dword [ebp - 0x92d0]
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 0x92cc]
push eax
lea ecx, [ebp - 0x92e0]
call fcn.004b3550
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x92e0]
push ecx
mov ecx, dword [ebp - 0xb440]
call fcn.0049d750
push 1
lea edx, [ebp - 0x92e0]
push edx
mov eax, dword [ebp - 0xb440]
mov ecx, dword [eax + 4]
call fcn.0041e0d0
mov dword [ebp - 0x92d4], eax
cmp dword [ebp - 0x92d4], 0
je 0x49fe17
lea ecx, [ebp - 0x58]
call fcn.004553f0
push eax
push str.HKLM_wsSecurityProviders
lea ecx, [ebp - 0xb2d8]
push ecx
call fcn.004b4d50
add esp, 0xc
mov dword [ebp - 0xb4a8], eax
mov edx, dword [ebp - 0xb4a8]
mov dword [ebp - 0xb4ac], edx
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0xb4ac]
push eax
mov ecx, dword [ebp - 0x92d4]
call fcn.00412ce0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xb2d8]
call fcn.004b3860
cmp dword [ebp - 0x92d0], 0
je 0x49fe3d
mov ecx, dword [ebp - 0x92d0]
add ecx, 2
mov dword [ebp - 0x92d0], ecx
mov edx, dword [ebp - 0x92d0]
mov dword [ebp - 0x92cc], edx
jmp 0x49fe4e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x92e0]
call fcn.004b3860
jmp 0x49fe62
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x92e0]
call fcn.004b3860
jmp 0x49fd13
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x2c]
call fcn.0042fe80
mov byte [ebp - 4], 0x25
push str.SOFTWAREMicrosoftInternet_ExplorerToolbar
lea ecx, [ebp - 0xb2e4]
call fcn.004b3550
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xb2e4]
push ecx
lea edx, [ebp - 0xb2f0]
push edx
lea ecx, [ebp - 0x2c]
call fcn.0042feb0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xb2e4]
call fcn.004b3860
push str.SOFTWAREMicrosoftInternet_ExplorerToolbarExplorer
lea ecx, [ebp - 0xb2fc]
call fcn.004b3550
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0xb2fc]
push eax
lea ecx, [ebp - 0xb308]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0042feb0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xb2fc]
call fcn.004b3860
push str.SOFTWAREMicrosoftInternet_ExplorerToolbarShellBrowser
lea ecx, [ebp - 0xb314]
call fcn.004b3550
mov byte [ebp - 4], 0x28
lea edx, [ebp - 0xb314]
push edx
lea eax, [ebp - 0xb320]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0042feb0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xb314]
call fcn.004b3860
push str.SOFTWAREMicrosoftInternet_ExplorerToolbarWebBrowser
lea ecx, [ebp - 0xb32c]
call fcn.004b3550
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0xb32c]
push ecx
lea edx, [ebp - 0xb338]
push edx
lea ecx, [ebp - 0x2c]
call fcn.0042feb0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xb32c]
call fcn.004b3860
push str.SOFTWAREMicrosoftInternet_ExplorerUrlSearchHooks
lea ecx, [ebp - 0xb344]
call fcn.004b3550
mov byte [ebp - 4], 0x2a
lea eax, [ebp - 0xb344]
push eax
lea ecx, [ebp - 0xb350]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0042feb0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xb344]
call fcn.004b3860
mov dword [ebp - 0x92e8], 0
jmp 0x49ffb0
mov edx, dword [ebp - 0x92e8]
add edx, 1
mov dword [ebp - 0x92e8], edx
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.004b9730
cmp dword [ebp - 0x92e8], eax
jg 0x4a029f
xor eax, eax
cmp dword [ebp - 0x92e8], 0
setne al
add eax, 0x80000002
mov dword [ebp - 0x92ec], eax
lea ecx, [ebp - 0x92f4]
call fcn.0047f810
lea ecx, [ebp - 0xb358]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00435230
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x92f4], edx
mov dword [ebp - 0x92f0], eax
jmp 0x4a0019
lea ecx, [ebp - 0x92f4]
call fcn.0040c980
lea ecx, [ebp - 0xb360]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0040c9a0
push eax
lea ecx, [ebp - 0x92f4]
call fcn.0047f720
movzx edx, al
test edx, edx
je 0x4a029a
lea ecx, [ebp - 0x92f4]
call fcn.0047f6d0
push eax
lea ecx, [ebp - 0x58]
call fcn.004b3890
lea ecx, [ebp - 0x9300]
call fcn.004b34a0
mov byte [ebp - 4], 0x2b
cmp dword [ebp - 0x92e8], 0
jne 0x4a007c
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x9300]
call fcn.004b3890
jmp 0x4a00bc
mov ecx, dword [ebp - 0x92e8]
sub ecx, 1
push ecx
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.00430700
push eax
lea ecx, [ebp - 0x9300]
call fcn.004b3890
push 0x5c
lea ecx, [ebp - 0x9300]
call fcn.004b3a80
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x9300]
call fcn.004b3ad0
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x9300]
call fcn.004553f0
push eax
mov ecx, dword [ebp - 0x92ec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a0286
mov dword [ebp - 0x9304], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x9304]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x9b08], 0
mov ecx, dword [ebp - 0x9b08]
cmp ecx, dword [ebp - 0x9304]
jae 0x4a027c
mov dword [ebp - 0x9b0c], 0x400
mov edx, dword [ebp - 0x9b08]
mov dword [ebp - 0xb4b0], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x9b0c]
push eax
lea ecx, [ebp - 0x9b04]
push ecx
mov edx, dword [ebp - 0xb4b0]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x9b10], eax
mov ecx, dword [ebp - 0x9b08]
add ecx, 1
mov dword [ebp - 0x9b08], ecx
cmp dword [ebp - 0x9b10], 0
jne 0x4a0269
movzx edx, word [ebp - 0x9b04]
cmp edx, 0x7b
jne 0x4a0267
cmp dword [ebp - 0x92ec], 0x80000002
jne 0x4a01ba
mov dword [ebp - 0xb4b4], 0x6083d4
jmp 0x4a01c4
mov dword [ebp - 0xb4b4], 0x6083cc
mov eax, dword [ebp - 0xb4b4]
push eax
lea ecx, [ebp - 0x9b1c]
call fcn.004b3550
mov byte [ebp - 4], 0x2c
push 0x5c
lea ecx, [ebp - 0x9b1c]
call fcn.004b3a80
lea ecx, [ebp - 0x9300]
push ecx
lea ecx, [ebp - 0x9b1c]
call fcn.004b3ad0
push 0x5c
lea ecx, [ebp - 0x9b1c]
call fcn.004b3a80
lea edx, [ebp - 0x9b04]
push edx
lea ecx, [ebp - 0x9b1c]
call fcn.004b3b40
lea eax, [ebp - 0x9b04]
push eax
lea ecx, [ebp - 0xb36c]
call fcn.004b3550
mov byte [ebp - 4], 0x2d
push 0
lea ecx, [ebp - 0x9b1c]
push ecx
lea edx, [ebp - 0xb36c]
push edx
mov ecx, dword [ebp - 0xb440]
call fcn.0049c350
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0xb36c]
call fcn.004b3860
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x9b1c]
call fcn.004b3860
jmp 0x4a0277
cmp dword [ebp - 0x9b10], 0x103
jne 0x4a0277
jmp 0x4a027c
jmp 0x4a0121
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x9300]
call fcn.004b3860
jmp 0x4a000e
jmp 0x49ffa1
lea ecx, [ebp - 0x2c]
call fcn.0040f520
push str.SOFTWAREMicrosoftInternet_ExplorerExplorer_Bars
lea ecx, [ebp - 0xb378]
call fcn.004b3550
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0xb378]
push ecx
lea edx, [ebp - 0xb384]
push edx
lea ecx, [ebp - 0x2c]
call fcn.0042feb0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xb378]
call fcn.004b3860
push str.SOFTWAREMicrosoftInternet_ExplorerExtensions
lea ecx, [ebp - 0xb390]
call fcn.004b3550
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0xb390]
push eax
lea ecx, [ebp - 0xb39c]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0042feb0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xb390]
call fcn.004b3860
mov dword [ebp - 0x9b20], 0
jmp 0x4a0334
mov edx, dword [ebp - 0x9b20]
add edx, 1
mov dword [ebp - 0x9b20], edx
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.004b9730
cmp dword [ebp - 0x9b20], eax
jg 0x4a0623
xor eax, eax
cmp dword [ebp - 0x9b20], 0
setne al
add eax, 0x80000002
mov dword [ebp - 0x9b24], eax
lea ecx, [ebp - 0x9b2c]
call fcn.0047f810
lea ecx, [ebp - 0xb3a4]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00435230
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x9b2c], edx
mov dword [ebp - 0x9b28], eax
jmp 0x4a039d
lea ecx, [ebp - 0x9b2c]
call fcn.0040c980
lea ecx, [ebp - 0xb3ac]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0040c9a0
push eax
lea ecx, [ebp - 0x9b2c]
call fcn.0047f720
movzx edx, al
test edx, edx
je 0x4a061e
lea ecx, [ebp - 0x9b2c]
call fcn.0047f6d0
push eax
lea ecx, [ebp - 0x58]
call fcn.004b3890
lea ecx, [ebp - 0x9b38]
call fcn.004b34a0
mov byte [ebp - 4], 0x30
cmp dword [ebp - 0x9b20], 0
jne 0x4a0400
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x9b38]
call fcn.004b3890
jmp 0x4a0440
mov ecx, dword [ebp - 0x9b20]
sub ecx, 1
push ecx
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.00430700
push eax
lea ecx, [ebp - 0x9b38]
call fcn.004b3890
push 0x5c
lea ecx, [ebp - 0x9b38]
call fcn.004b3a80
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x9b38]
call fcn.004b3ad0
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x9b38]
call fcn.004553f0
push eax
mov ecx, dword [ebp - 0x9b24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a060a
mov dword [ebp - 0xa340], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xa340]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x9b3c], 0
mov ecx, dword [ebp - 0x9b3c]
cmp ecx, dword [ebp - 0xa340]
jae 0x4a0600
mov dword [ebp - 0xa344], 0x800
mov edx, dword [ebp - 0x9b3c]
mov dword [ebp - 0xb4b8], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xa344]
push eax
lea ecx, [ebp - 0xa33c]
push ecx
mov edx, dword [ebp - 0xb4b8]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0xa348], eax
mov ecx, dword [ebp - 0x9b3c]
add ecx, 1
mov dword [ebp - 0x9b3c], ecx
cmp dword [ebp - 0xa348], 0
jne 0x4a05ed
movzx edx, word [ebp - 0xa33c]
cmp edx, 0x7b
jne 0x4a05eb
cmp dword [ebp - 0x9b24], 0x80000002
jne 0x4a053e
mov dword [ebp - 0xb4bc], 0x6083d4
jmp 0x4a0548
mov dword [ebp - 0xb4bc], 0x6083cc
mov eax, dword [ebp - 0xb4bc]
push eax
lea ecx, [ebp - 0xa354]
call fcn.004b3550
mov byte [ebp - 4], 0x31
push 0x5c
lea ecx, [ebp - 0xa354]
call fcn.004b3a80
lea ecx, [ebp - 0x9b38]
push ecx
lea ecx, [ebp - 0xa354]
call fcn.004b3ad0
push 0x5c
lea ecx, [ebp - 0xa354]
call fcn.004b3a80
lea edx, [ebp - 0xa33c]
push edx
lea ecx, [ebp - 0xa354]
call fcn.004b3b40
lea eax, [ebp - 0xa33c]
push eax
lea ecx, [ebp - 0xb3b8]
call fcn.004b3550
mov byte [ebp - 4], 0x32
push 0
lea ecx, [ebp - 0xa354]
push ecx
lea edx, [ebp - 0xb3b8]
push edx
mov ecx, dword [ebp - 0xb440]
call fcn.0049c350
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0xb3b8]
call fcn.004b3860
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xa354]
call fcn.004b3860
jmp 0x4a05fb
cmp dword [ebp - 0xa348], 0x103
jne 0x4a05fb
jmp 0x4a0600
jmp 0x4a04a5
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x9b38]
call fcn.004b3860
jmp 0x4a0392
jmp 0x4a0325
mov dword [ebp - 0xa364], str.ControlPanel
mov dword [ebp - 0xa360], str.Desktop
mov dword [ebp - 0xa35c], str.MyComputer
mov dword [ebp - 0xa358], str.NetworkNeighborhood
mov dword [ebp - 0xa368], 0
jmp 0x4a0666
mov ecx, dword [ebp - 0xa368]
add ecx, 1
mov dword [ebp - 0xa368], ecx
cmp dword [ebp - 0xa368], 4
jae 0x4a0a6e
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorer
lea ecx, [ebp - 0xa378]
call fcn.004b3550
mov byte [ebp - 4], 0x33
push 0x5c
lea ecx, [ebp - 0xa378]
call fcn.004b3a80
mov edx, dword [ebp - 0xa368]
mov eax, dword [ebp + edx*4 - 0xa364]
push eax
lea ecx, [ebp - 0xa378]
call fcn.004b3b40
push 0x5c
lea ecx, [ebp - 0xa378]
call fcn.004b3a80
push str.NameSpace
lea ecx, [ebp - 0xa378]
call fcn.004b3b40
push 0
lea ecx, [ebp - 0xa378]
push ecx
call fcn.00414b30
mov ecx, eax
call fcn.00414800
mov dword [ebp - 0xa36c], eax
cmp dword [ebp - 0xa36c], 0
je 0x4a0a5a
push 0
lea ecx, [ebp - 0xa384]
call fcn.00430200
mov byte [ebp - 4], 0x34
lea edx, [ebp - 0xa384]
push edx
mov ecx, dword [ebp - 0xa36c]
call fcn.00414060
movzx eax, al
test eax, eax
je 0x4a0a04
mov dword [ebp - 0xa388], 0
jmp 0x4a073b
mov ecx, dword [ebp - 0xa388]
add ecx, 1
mov dword [ebp - 0xa388], ecx
lea ecx, [ebp - 0xa384]
call fcn.004b9730
cmp dword [ebp - 0xa388], eax
jge 0x4a0a04
push 0x5ff03c
mov edx, dword [ebp - 0xa388]
push edx
lea ecx, [ebp - 0xa384]
call fcn.00430700
mov ecx, eax
call fcn.004b6880
movzx eax, al
test eax, eax
je 0x4a09ff
mov ecx, dword [ebp - 0xa388]
push ecx
lea ecx, [ebp - 0xa384]
call fcn.00430700
mov ecx, eax
call fcn.004553f0
push eax
push str.HKLMSOFTWAREClassesCLSID_s_
lea edx, [ebp - 0xa394]
push edx
call fcn.004b4d50
add esp, 0xc
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0xa394]
push eax
lea ecx, [ebp - 0xa3a4]
call fcn.004b34d0
mov byte [ebp - 4], 0x36
push str.ShellOpenCommand
lea ecx, [ebp - 0xa3a4]
call fcn.004b3b40
push 0
lea ecx, [ebp - 0xa3a4]
push ecx
call fcn.00414b70
add esp, 8
mov dword [ebp - 0xa398], eax
cmp dword [ebp - 0xa398], 0
je 0x4a09e1
lea ecx, [ebp - 0xa3b0]
call fcn.004b34a0
mov byte [ebp - 4], 0x37
lea edx, [ebp - 0xa3b0]
push edx
mov eax, dword [0x63e870]
push eax
mov ecx, dword [ebp - 0xa398]
call fcn.004141d0
movzx ecx, al
test ecx, ecx
je 0x4a098b
lea edx, [ebp - 0xa3b0]
push edx
mov ecx, dword [ebp - 0xb440]
call fcn.0049d750
lea ecx, [ebp - 0xa3b0]
call fcn.00404b70
cmp eax, 2
jle 0x4a098b
push 2
push 0x5fc5a4
lea ecx, [ebp - 0xa3b0]
call fcn.004b5060
mov dword [ebp - 0xa3b4], eax
cmp dword [ebp - 0xa3b4], 0
jle 0x4a08c3
mov eax, dword [ebp - 0xa3b4]
sub eax, 1
push eax
lea ecx, [ebp - 0xb3c4]
push ecx
lea ecx, [ebp - 0xa3b0]
call fcn.004b64e0
mov dword [ebp - 0xb4c0], eax
mov edx, dword [ebp - 0xb4c0]
mov dword [ebp - 0xb4c4], edx
mov byte [ebp - 4], 0x38
mov eax, dword [ebp - 0xb4c4]
push eax
lea ecx, [ebp - 0xa3b0]
call fcn.004b3890
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xb3c4]
call fcn.004b3860
push 1
lea ecx, [ebp - 0xa3b0]
push ecx
mov edx, dword [ebp - 0xb440]
mov ecx, dword [edx + 4]
call fcn.0041e0d0
mov dword [ebp - 0xa3b8], eax
cmp dword [ebp - 0xa3b8], 0
je 0x4a098b
lea eax, [ebp - 0xa394]
push eax
mov ecx, dword [ebp - 0xa3b8]
call fcn.00412b10
push 0x6083d4
lea ecx, [ebp - 0xa3c4]
call fcn.004b3550
mov byte [ebp - 4], 0x39
push 0x5c
lea ecx, [ebp - 0xa3c4]
call fcn.004b3a80
lea ecx, [ebp - 0xa378]
push ecx
lea ecx, [ebp - 0xa3c4]
call fcn.004b3ad0
push 0x5c
lea ecx, [ebp - 0xa3c4]
call fcn.004b3a80
mov edx, dword [ebp - 0xa388]
push edx
lea ecx, [ebp - 0xa384]
call fcn.00430700
push eax
lea ecx, [ebp - 0xa3c4]
call fcn.004b3ad0
push 0x5c
lea ecx, [ebp - 0xa3c4]
call fcn.004b3a80
lea eax, [ebp - 0xa3c4]
push eax
mov ecx, dword [ebp - 0xa3b8]
call fcn.00412b10
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xa3c4]
call fcn.004b3860
mov ecx, dword [ebp - 0xa398]
mov dword [ebp - 0xb3cc], ecx
mov edx, dword [ebp - 0xb3cc]
mov dword [ebp - 0xb3c8], edx
cmp dword [ebp - 0xb3c8], 0
je 0x4a09c8
push 1
mov eax, dword [ebp - 0xb3c8]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xb3c8]
mov eax, dword [edx]
call eax
mov dword [ebp - 0xb4c8], eax
jmp 0x4a09d2
mov dword [ebp - 0xb4c8], 0
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xa3b0]
call fcn.004b3860
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xa3a4]
call fcn.004b3860
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0xa394]
call fcn.004b3860
jmp 0x4a072c
mov ecx, dword [ebp - 0xa36c]
mov dword [ebp - 0xb3d4], ecx
mov edx, dword [ebp - 0xb3d4]
mov dword [ebp - 0xb3d0], edx
cmp dword [ebp - 0xb3d0], 0
je 0x4a0a41
push 1
mov eax, dword [ebp - 0xb3d0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xb3d0]
mov eax, dword [edx]
call eax
mov dword [ebp - 0xb4cc], eax
jmp 0x4a0a4b
mov dword [ebp - 0xb4cc], 0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xa384]
call fcn.00430250
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xa378]
call fcn.004b3860
jmp 0x4a0657
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionexplorerShellIconOverlayIdentifiers_
lea ecx, [ebp - 0xa3d4]
call fcn.004b3550
mov byte [ebp - 4], 0x3a
push 0
lea ecx, [ebp - 0xa3d4]
push ecx
call fcn.00414b70
add esp, 8
mov dword [ebp - 0xa3c8], eax
cmp dword [ebp - 0xa3c8], 0
je 0x4a0d3b
push 0
lea ecx, [ebp - 0xa3e0]
call fcn.00430200
mov byte [ebp - 4], 0x3b
lea edx, [ebp - 0xa3e0]
push edx
mov ecx, dword [ebp - 0xa3c8]
call fcn.00414060
movzx eax, al
test eax, eax
je 0x4a0ce5
mov dword [ebp - 0xa3e4], 0
jmp 0x4a0aef
mov ecx, dword [ebp - 0xa3e4]
add ecx, 1
mov dword [ebp - 0xa3e4], ecx
lea ecx, [ebp - 0xa3e0]
call fcn.004b9730
cmp dword [ebp - 0xa3e4], eax
jge 0x4a0ce5
push 0x5ff03c
mov edx, dword [ebp - 0xa3e4]
push edx
lea ecx, [ebp - 0xa3e0]
call fcn.00430700
mov ecx, eax
call fcn.004b6880
movzx eax, al
test eax, eax
je 0x4a0ba7
lea ecx, [ebp - 0xa3d4]
push ecx
lea ecx, [ebp - 0xa3f0]
call fcn.004b34d0
mov byte [ebp - 4], 0x3c
mov edx, dword [ebp - 0xa3e4]
push edx
lea ecx, [ebp - 0xa3e0]
call fcn.00430700
push eax
lea ecx, [ebp - 0xa3f0]
call fcn.004b3ad0
push 0x5c
lea ecx, [ebp - 0xa3f0]
call fcn.004b3a80
push 0
lea eax, [ebp - 0xa3f0]
push eax
mov ecx, dword [ebp - 0xa3e4]
push ecx
lea ecx, [ebp - 0xa3e0]
call fcn.00430700
push eax
mov ecx, dword [ebp - 0xb440]
call fcn.0049c350
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0xa3f0]
call fcn.004b3860
jmp 0x4a0ce0
push 0
mov edx, dword [ebp - 0xa3e4]
push edx
lea ecx, [ebp - 0xa3e0]
call fcn.00430700
push eax
mov ecx, dword [ebp - 0xa3c8]
call fcn.00414800
mov dword [ebp - 0xa3f4], eax
cmp dword [ebp - 0xa3f4], 0
je 0x4a0ce0
lea ecx, [ebp - 0xa400]
call fcn.004b34a0
mov byte [ebp - 4], 0x3d
lea eax, [ebp - 0xa400]
push eax
push 0
mov ecx, dword [ebp - 0xa3f4]
call fcn.004141d0
movzx ecx, al
test ecx, ecx
je 0x4a0c8a
push 0x5ff03c
lea ecx, [ebp - 0xa400]
call fcn.004b6880
movzx edx, al
test edx, edx
je 0x4a0c8a
lea eax, [ebp - 0xa3d4]
push eax
lea ecx, [ebp - 0xa40c]
call fcn.004b34d0
mov byte [ebp - 4], 0x3e
mov ecx, dword [ebp - 0xa3e4]
push ecx
lea ecx, [ebp - 0xa3e0]
call fcn.00430700
push eax
lea ecx, [ebp - 0xa40c]
call fcn.004b3ad0
push 0x5c
lea ecx, [ebp - 0xa40c]
call fcn.004b3a80
push 0
lea edx, [ebp - 0xa40c]
push edx
lea eax, [ebp - 0xa400]
push eax
mov ecx, dword [ebp - 0xb440]
call fcn.0049c350
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0xa40c]
call fcn.004b3860
mov ecx, dword [ebp - 0xa3f4]
mov dword [ebp - 0xb3dc], ecx
mov edx, dword [ebp - 0xb3dc]
mov dword [ebp - 0xb3d8], edx
cmp dword [ebp - 0xb3d8], 0
je 0x4a0cc7
push 1
mov eax, dword [ebp - 0xb3d8]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xb3d8]
mov eax, dword [edx]
call eax
mov dword [ebp - 0xb4d0], eax
jmp 0x4a0cd1
mov dword [ebp - 0xb4d0], 0
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0xa400]
call fcn.004b3860
jmp 0x4a0ae0
mov ecx, dword [ebp - 0xa3c8]
mov dword [ebp - 0xb3e4], ecx
mov edx, dword [ebp - 0xb3e4]
mov dword [ebp - 0xb3e0], edx
cmp dword [ebp - 0xb3e0], 0
je 0x4a0d22
push 1
mov eax, dword [ebp - 0xb3e0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xb3e0]
mov eax, dword [edx]
call eax
mov dword [ebp - 0xb4d4], eax
jmp 0x4a0d2c
mov dword [ebp - 0xb4d4], 0
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0xa3e0]
call fcn.00430250
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xa3d4]
call fcn.004b3860
lea ecx, [ebp - 0x2c]
call fcn.0040f520
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_
lea ecx, [ebp - 0xb3f0]
call fcn.004b3550
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0xb3f0]
push ecx
lea edx, [ebp - 0xb3fc]
push edx
lea ecx, [ebp - 0x2c]
call fcn.0042feb0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xb3f0]
call fcn.004b3860
mov dword [ebp - 0xa410], 0
jmp 0x4a0da6
mov eax, dword [ebp - 0xa410]
add eax, 1
mov dword [ebp - 0xa410], eax
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.004b9730
cmp dword [ebp - 0xa410], eax
jg 0x4a103b
xor ecx, ecx
cmp dword [ebp - 0xa410], 0
setne cl
add ecx, 0x80000002
mov dword [ebp - 0xa414], ecx
lea ecx, [ebp - 0xa41c]
call fcn.0047f810
lea edx, [ebp - 0xb404]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00435230
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0xa41c], ecx
mov dword [ebp - 0xa418], edx
jmp 0x4a0e10
lea ecx, [ebp - 0xa41c]
call fcn.0040c980
lea eax, [ebp - 0xb40c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040c9a0
push eax
lea ecx, [ebp - 0xa41c]
call fcn.0047f720
movzx ecx, al
test ecx, ecx
je 0x4a1036
lea ecx, [ebp - 0xa41c]
call fcn.0047f6d0
push eax
lea ecx, [ebp - 0x58]
call fcn.004b3890
lea ecx, [ebp - 0xa428]
call fcn.004b34a0
mov byte [ebp - 4], 0x40
cmp dword [ebp - 0xa410], 0
jne 0x4a0e73
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0xa428]
call fcn.004b3890
jmp 0x4a0eb3
mov eax, dword [ebp - 0xa410]
sub eax, 1
push eax
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.00430700
push eax
lea ecx, [ebp - 0xa428]
call fcn.004b3890
push 0x5c
lea ecx, [ebp - 0xa428]
call fcn.004b3a80
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0xa428]
call fcn.004b3ad0
lea edx, [ebp - 0x30]
push edx
push 0x20019
push 0
lea ecx, [ebp - 0xa428]
call fcn.004553f0
push eax
mov eax, dword [ebp - 0xa414]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a1022
mov dword [ebp - 0xac30], 0x800
lea ecx, [ebp - 0xac30]
push ecx
lea edx, [ebp - 0xac2c]
push edx
push 0
push 0
push str.load
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4a0f13
jmp 0x4a1018
cmp dword [ebp - 0xac30], 0
jbe 0x4a1018
lea ecx, [ebp - 0xac2c]
push ecx
lea ecx, [ebp - 0xac3c]
call fcn.004b3550
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xac3c]
call fcn.00404b70
test eax, eax
jle 0x4a1009
lea edx, [ebp - 0xac3c]
push edx
mov ecx, dword [ebp - 0xb440]
call fcn.0049d750
cmp dword [ebp - 0xa414], 0x80000002
jne 0x4a0f73
mov dword [ebp - 0xb4d8], 0x6083d4
jmp 0x4a0f7d
mov dword [ebp - 0xb4d8], 0x6083cc
mov eax, dword [ebp - 0xb4d8]
push eax
lea ecx, [ebp - 0xac4c]
call fcn.004b3550
mov byte [ebp - 4], 0x42
push 0x5c
lea ecx, [ebp - 0xac4c]
call fcn.004b3a80
lea ecx, [ebp - 0xa428]
push ecx
lea ecx, [ebp - 0xac4c]
call fcn.004b3ad0
push str.load
lea ecx, [ebp - 0xac4c]
call fcn.004b3b40
push 1
lea edx, [ebp - 0xac3c]
push edx
mov eax, dword [ebp - 0xb440]
mov ecx, dword [eax + 4]
call fcn.0041e0d0
mov dword [ebp - 0xac40], eax
cmp dword [ebp - 0xac40], 0
je 0x4a0ffa
lea ecx, [ebp - 0xac4c]
push ecx
mov ecx, dword [ebp - 0xac40]
call fcn.00412ce0
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xac4c]
call fcn.004b3860
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0xac3c]
call fcn.004b3860
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xa428]
call fcn.004b3860
jmp 0x4a0e05
jmp 0x4a0d97
mov dword [ebp - 0xac50], 0
jmp 0x4a1056
mov eax, dword [ebp - 0xac50]
add eax, 1
mov dword [ebp - 0xac50], eax
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.004b9730
cmp dword [ebp - 0xac50], eax
jg 0x4a12f2
lea ecx, [ebp - 0xac68]
call fcn.004b34a0
mov byte [ebp - 4], 0x43
cmp dword [ebp - 0xac50], 0
jne 0x4a10a4
mov dword [ebp - 0xac54], 0x80000002
push 0x5ffc9c
lea ecx, [ebp - 0xac68]
call fcn.004b38f0
jmp 0x4a10df
mov dword [ebp - 0xac54], 0x80000003
mov ecx, dword [ebp - 0xac50]
sub ecx, 1
push ecx
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.00430700
push eax
lea ecx, [ebp - 0xac68]
call fcn.004b3890
push 0x5c
lea ecx, [ebp - 0xac68]
call fcn.004b3a80
push str.SOFTWAREClasses
lea ecx, [ebp - 0xac68]
call fcn.004b3b40
lea edx, [ebp - 0xac58]
push edx
push 0x20019
push 0
lea ecx, [ebp - 0xac68]
call fcn.004553f0
push eax
mov eax, dword [ebp - 0xac54]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xac5c], eax
cmp dword [ebp - 0xac5c], 0
jne 0x4a12de
mov dword [ebp - 0xac6c], 0x100
lea ecx, [ebp - 0xac6c]
push ecx
lea edx, [ebp - 0xad6c]
push edx
push str..exe
mov eax, dword [ebp - 0xac58]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x4a12d1
lea ecx, [ebp - 0xad6c]
push ecx
push str._s_shellopencommand
lea edx, [ebp - 0xb178]
push edx
call fcn.004b4d50
add esp, 0xc
mov byte [ebp - 4], 0x44
mov dword [ebp - 0xb17c], 0x400
lea eax, [ebp - 0xb17c]
push eax
lea ecx, [ebp - 0xb16c]
push ecx
lea ecx, [ebp - 0xb178]
call fcn.004553f0
push eax
mov edx, dword [ebp - 0xac58]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x4a12c2
lea eax, [ebp - 0xb16c]
push eax
lea ecx, [ebp - 0xb188]
call fcn.004b3550
mov byte [ebp - 4], 0x45
push str.__1_
lea ecx, [ebp - 0xb188]
call fcn.004b6880
movzx ecx, al
test ecx, ecx
jne 0x4a12b3
lea edx, [ebp - 0xb188]
push edx
mov ecx, dword [ebp - 0xb440]
call fcn.0049d750
cmp dword [ebp - 0xac54], 0x80000002
jne 0x4a120e
mov dword [ebp - 0xb4dc], 0x6083d4
jmp 0x4a1218
mov dword [ebp - 0xb4dc], 0x6083cc
mov eax, dword [ebp - 0xb4dc]
push eax
lea ecx, [ebp - 0xb198]
call fcn.004b3550
mov byte [ebp - 4], 0x46
push 0x5c
lea ecx, [ebp - 0xb198]
call fcn.004b3a80
lea ecx, [ebp - 0xac68]
push ecx
lea ecx, [ebp - 0xb198]
call fcn.004b3ad0
push 0x5c
lea ecx, [ebp - 0xb198]
call fcn.004b3a80
lea edx, [ebp - 0xb178]
push edx
lea ecx, [ebp - 0xb198]
call fcn.004b3ad0
push 1
lea eax, [ebp - 0xb188]
push eax
mov ecx, dword [ebp - 0xb440]
mov ecx, dword [ecx + 4]
call fcn.0041e0d0
mov dword [ebp - 0xb18c], eax
cmp dword [ebp - 0xb18c], 0
je 0x4a12a4
lea edx, [ebp - 0xb198]
push edx
mov ecx, dword [ebp - 0xb18c]
call fcn.00412ce0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0xb198]
call fcn.004b3860
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0xb188]
call fcn.004b3860
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0xb178]
call fcn.004b3860
mov eax, dword [ebp - 0xac58]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xac68]
call fcn.004b3860
jmp 0x4a1047
push str.HKLMSOFTWAREMozillaPlugins
lea ecx, [ebp - 0xb1a8]
call fcn.004b3550
mov byte [ebp - 4], 0x47
push 0
lea ecx, [ebp - 0xb1a8]
push ecx
call fcn.00414b70
add esp, 8
mov dword [ebp - 0xb19c], eax
cmp dword [ebp - 0xb19c], 0
je 0x4a15ab
push 0
lea ecx, [ebp - 0xb1b4]
call fcn.00430200
mov byte [ebp - 4], 0x48
lea edx, [ebp - 0xb1b4]
push edx
mov ecx, dword [ebp - 0xb19c]
call fcn.00414060
movzx eax, al
test eax, eax
je 0x4a1555
mov dword [ebp - 0xb1b8], 0
jmp 0x4a1373
mov ecx, dword [ebp - 0xb1b8]
add ecx, 1
mov dword [ebp - 0xb1b8], ecx
lea ecx, [ebp - 0xb1b4]
call fcn.004b9730
cmp dword [ebp - 0xb1b8], eax
jge 0x4a1555
push 0
mov edx, dword [ebp - 0xb1b8]
push edx
lea ecx, [ebp - 0xb1b4]
call fcn.00430700
push eax
mov ecx, dword [ebp - 0xb19c]
call fcn.00414800
mov dword [ebp - 0xb1bc], eax
cmp dword [ebp - 0xb1bc], 0
je 0x4a1550
lea ecx, [ebp - 0xb1d4]
call fcn.004b34a0
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0xb1c8]
call fcn.004b34a0
mov byte [ebp - 4], 0x4a
lea eax, [ebp - 0xb1d4]
push eax
push str.Path
mov ecx, dword [ebp - 0xb1bc]
call fcn.004141d0
movzx ecx, al
test ecx, ecx
jne 0x4a13fe
jmp 0x4a14eb
push 0
push str.disabled
lea ecx, [ebp - 0xb1d4]
call fcn.004b4b20
movzx edx, al
test edx, edx
je 0x4a141c
jmp 0x4a14eb
push 1
lea eax, [ebp - 0xb1d4]
push eax
mov ecx, dword [ebp - 0xb440]
mov ecx, dword [ecx + 4]
call fcn.0041e0d0
mov dword [ebp - 0xb1d8], eax
cmp dword [ebp - 0xb1d8], 0
je 0x4a14eb
lea edx, [ebp - 0xb1a8]
push edx
lea ecx, [ebp - 0xb1e4]
call fcn.004b34d0
mov byte [ebp - 4], 0x4b
push 0x5fc5a0
lea ecx, [ebp - 0xb1e4]
call fcn.004b3b40
mov eax, dword [ebp - 0xb1b8]
push eax
lea ecx, [ebp - 0xb1b4]
call fcn.00430700
push eax
lea ecx, [ebp - 0xb1e4]
call fcn.004b3ad0
push 0x5fc5a0
lea ecx, [ebp - 0xb1e4]
call fcn.004b3b40
lea ecx, [ebp - 0xb1e4]
push ecx
mov ecx, dword [ebp - 0xb1d8]
call fcn.00412ce0
lea edx, [ebp - 0xb1c8]
push edx
push str.XPTPath
mov ecx, dword [ebp - 0xb1bc]
call fcn.004141d0
movzx eax, al
test eax, eax
je 0x4a14dc
lea ecx, [ebp - 0xb1c8]
push ecx
mov ecx, dword [ebp - 0xb1d8]
call fcn.00412b10
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0xb1e4]
call fcn.004b3860
mov edx, dword [ebp - 0xb1bc]
mov dword [ebp - 0xb414], edx
mov eax, dword [ebp - 0xb414]
mov dword [ebp - 0xb410], eax
cmp dword [ebp - 0xb410], 0
je 0x4a1528
push 1
mov ecx, dword [ebp - 0xb410]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb410]
mov eax, dword [edx]
call eax
mov dword [ebp - 0xb4e0], eax
jmp 0x4a1532
mov dword [ebp - 0xb4e0], 0
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0xb1c8]
call fcn.004b3860
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0xb1d4]
call fcn.004b3860
jmp 0x4a1364
mov ecx, dword [ebp - 0xb19c]
mov dword [ebp - 0xb41c], ecx
mov edx, dword [ebp - 0xb41c]
mov dword [ebp - 0xb418], edx
cmp dword [ebp - 0xb418], 0
je 0x4a1592
push 1
mov eax, dword [ebp - 0xb418]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xb418]
mov eax, dword [edx]
call eax
mov dword [ebp - 0xb4e4], eax
jmp 0x4a159c
mov dword [ebp - 0xb4e4], 0
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0xb1b4]
call fcn.00430250
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xb1a8]
call fcn.004b3860
mov dword [ebp - 0xb1ec], 0
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0xb1ec], eax
cmp dword [ebp - 0xb1ec], 1
je 0x4a15f6
cmp dword [ebp - 0xb1ec], 0
je 0x4a15f6
cmp dword [ebp - 0xb1ec], 0x80010119
jne 0x4a193a
lea ecx, [ebp - 0xb1e8]
push ecx
push 0x5d684c
push 1
push 0
push 0x5d685c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0xb1ec], eax
cmp dword [ebp - 0xb1ec], 0
je 0x4a1639
mov edx, dword [ebp - 0xb1ec]
push edx
push str.CLSID_CTaskScheduler__08x_r_n
call fcn.0054d5e0
add esp, 8
jmp 0x4a193a
lea eax, [ebp - 0xb1f0]
push eax
mov ecx, dword [ebp - 0xb1e8]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xb1e8]
push eax
mov ecx, dword [edx + 0x14]
call ecx
mov dword [ebp - 0xb1ec], eax
cmp dword [ebp - 0xb1ec], 0
je 0x4a167c
mov edx, dword [ebp - 0xb1ec]
push edx
push str.TaskSheduler_enumerator_failed__08x_r_n
call fcn.0054d5e0
add esp, 8
jmp 0x4a1926
mov eax, dword [0x63e870]
push eax
lea ecx, [ebp - 0xb200]
call fcn.004b3550
mov byte [ebp - 4], 0x4c
push 0
push str.SOFTWAREMicrosoftSchedulingAgent
call fcn.00414b30
mov ecx, eax
call fcn.00414830
mov dword [ebp - 0xb1f4], eax
cmp dword [ebp - 0xb1f4], 0
je 0x4a172a
lea ecx, [ebp - 0xb200]
push ecx
push str.TasksFolder
mov ecx, dword [ebp - 0xb1f4]
call fcn.004141d0
movzx edx, al
test edx, edx
je 0x4a16e3
lea eax, [ebp - 0xb200]
push eax
mov ecx, dword [ebp - 0xb440]
call fcn.0049d750
mov ecx, dword [ebp - 0xb1f4]
mov dword [ebp - 0xb424], ecx
mov edx, dword [ebp - 0xb424]
mov dword [ebp - 0xb420], edx
cmp dword [ebp - 0xb420], 0
je 0x4a1720
push 1
mov eax, dword [ebp - 0xb420]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xb420]
mov eax, dword [edx]
call eax
mov dword [ebp - 0xb4e8], eax
jmp 0x4a172a
mov dword [ebp - 0xb4e8], 0
lea ecx, [ebp - 0xb200]
call fcn.00404b70
test eax, eax
jne 0x4a174b
push str.Unable_to_resolve_TaskFolder_r_n
call fcn.0054d5e0
add esp, 4
jmp 0x4a1903
push 0
lea ecx, [ebp - 0xb204]
push ecx
push 1
mov edx, dword [ebp - 0xb1f0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xb1f0]
push ecx
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0xb1ec], eax
cmp dword [ebp - 0xb1ec], 0
jne 0x4a18f6
lea eax, [ebp - 0xb208]
push eax
push 0x5d683c
mov ecx, dword [ebp - 0xb204]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0xb1e8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xb1e8]
push edx
mov eax, dword [ecx + 0x18]
call eax
mov dword [ebp - 0xb1ec], eax
cmp dword [ebp - 0xb1ec], 0
je 0x4a17d0
mov ecx, dword [ebp - 0xb204]
mov edx, dword [ecx]
push edx
push str.Failed_to_activate__ws_r_n
call fcn.0054d5e0
add esp, 8
jmp 0x4a18d0
lea eax, [ebp - 0xb20c]
push eax
mov ecx, dword [ebp - 0xb208]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xb208]
push eax
mov ecx, dword [edx + 0x84]
call ecx
mov dword [ebp - 0xb1ec], eax
cmp dword [ebp - 0xb1ec], 0
jne 0x4a18d0
mov edx, dword [ebp - 0xb20c]
push edx
lea ecx, [ebp - 0xb21c]
call fcn.004b3550
mov byte [ebp - 4], 0x4d
lea eax, [ebp - 0xb21c]
push eax
mov ecx, dword [ebp - 0xb440]
call fcn.0049d750
push 1
lea ecx, [ebp - 0xb21c]
push ecx
mov edx, dword [ebp - 0xb440]
mov ecx, dword [edx + 4]
call fcn.0041e0d0
mov dword [ebp - 0xb210], eax
cmp dword [ebp - 0xb210], 0
je 0x4a18b4
mov eax, dword [ebp - 0xb204]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0xb430]
call fcn.004b3550
mov byte [ebp - 4], 0x4e
lea edx, [ebp - 0xb430]
push edx
lea eax, [ebp - 0xb200]
push eax
lea ecx, [ebp - 0xb228]
push ecx
call fcn.00412f50
add esp, 0xc
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0xb430]
call fcn.004b3860
lea edx, [ebp - 0xb228]
push edx
mov ecx, dword [ebp - 0xb210]
call fcn.00412ce0
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0xb228]
call fcn.004b3860
mov eax, dword [ebp - 0xb20c]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0xb21c]
call fcn.004b3860
mov ecx, dword [ebp - 0xb204]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0xb204]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0xb1ec], 0
cmp dword [ebp - 0xb1ec], 0
je 0x4a174b
mov ecx, dword [ebp - 0xb1f0]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xb1f0]
push eax
mov ecx, dword [edx + 8]
call ecx
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xb200]
call fcn.004b3860
mov edx, dword [ebp - 0xb1e8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xb1e8]
push ecx
mov edx, dword [eax + 8]
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0xb440]
mov ecx, dword [eax + 4]
call fcn.00404b70
cmp eax, 1
je 0x4a1c09
mov dword [ebp - 0xb230], str.SoftwareMicrosoftWindowsShellNoRoamMUICache
mov dword [ebp - 0xb22c], str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov dword [ebp - 0xb234], 0
jmp 0x4a1986
mov ecx, dword [ebp - 0xb234]
add ecx, 1
mov dword [ebp - 0xb234], ecx
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.004b9730
cmp dword [ebp - 0xb234], eax
jge 0x4a1c09
mov dword [ebp - 0xb238], 0
jmp 0x4a19bb
mov edx, dword [ebp - 0xb238]
add edx, 1
mov dword [ebp - 0xb238], edx
cmp dword [ebp - 0xb238], 2
jae 0x4a1c04
push 0x6083cc
lea ecx, [ebp - 0xb248]
call fcn.004b3550
mov byte [ebp - 4], 0x51
push 0x5c
lea ecx, [ebp - 0xb248]
call fcn.004b3a80
mov eax, dword [ebp - 0xb234]
push eax
mov ecx, dword [ebp - 0xb440]
add ecx, 8
call fcn.00430700
push eax
lea ecx, [ebp - 0xb248]
call fcn.004b3ad0
push 0x5c
lea ecx, [ebp - 0xb248]
call fcn.004b3a80
mov ecx, dword [ebp - 0xb238]
mov edx, dword [ebp + ecx*4 - 0xb230]
push edx
lea ecx, [ebp - 0xb248]
call fcn.004b3b40
push 0
lea eax, [ebp - 0xb248]
push eax
call fcn.00414b70
add esp, 8
mov dword [ebp - 0xb23c], eax
cmp dword [ebp - 0xb23c], 0
je 0x4a1bf0
push 0
lea ecx, [ebp - 0xb254]
call fcn.00430200
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0xb254]
push ecx
mov ecx, dword [ebp - 0xb23c]
call fcn.00478880
movzx edx, al
test edx, edx
je 0x4a1b9a
mov dword [ebp - 0xb258], 0
jmp 0x4a1a9d
mov eax, dword [ebp - 0xb258]
add eax, 1
mov dword [ebp - 0xb258], eax
lea ecx, [ebp - 0xb254]
call fcn.004b9730
cmp dword [ebp - 0xb258], eax
jge 0x4a1b9a
mov ecx, dword [ebp - 0xb258]
push ecx
lea ecx, [ebp - 0xb254]
call fcn.00430700
mov ecx, eax
call fcn.00404b70
cmp eax, 2
jge 0x4a1ad7
jmp 0x4a1b95
push 1
mov edx, dword [ebp - 0xb258]
push edx
lea ecx, [ebp - 0xb254]
call fcn.00430700
mov ecx, eax
call fcn.004b3df0
movzx eax, ax
cmp eax, 0x3a
jne 0x4a1b95
push 1
mov ecx, dword [ebp - 0xb258]
push ecx
lea ecx, [ebp - 0xb254]
call fcn.00430700
push eax
mov edx, dword [ebp - 0xb440]
mov ecx, dword [edx + 4]
call fcn.0041e0d0
mov dword [ebp - 0xb25c], eax
cmp dword [ebp - 0xb25c], 0
je 0x4a1b95
lea eax, [ebp - 0xb248]
push eax
lea ecx, [ebp - 0xb268]
call fcn.004b34d0
mov byte [ebp - 4], 0x53
push 0x5fc5a0
lea ecx, [ebp - 0xb268]
call fcn.004b3b40
mov ecx, dword [ebp - 0xb258]
push ecx
lea ecx, [ebp - 0xb254]
call fcn.00430700
push eax
lea ecx, [ebp - 0xb268]
call fcn.004b3ad0
lea edx, [ebp - 0xb268]
push edx
mov ecx, dword [ebp - 0xb25c]
call fcn.00412b10
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0xb268]
call fcn.004b3860
jmp 0x4a1a8e
mov eax, dword [ebp - 0xb23c]
mov dword [ebp - 0xb438], eax
mov ecx, dword [ebp - 0xb438]
mov dword [ebp - 0xb434], ecx
cmp dword [ebp - 0xb434], 0
je 0x4a1bd7
push 1
mov edx, dword [ebp - 0xb434]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xb434]
mov edx, dword [eax]
call edx
mov dword [ebp - 0xb4ec], eax
jmp 0x4a1be1
mov dword [ebp - 0xb4ec], 0
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xb254]
call fcn.00430250
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xb248]
call fcn.004b3860
jmp 0x4a19ac
jmp 0x4a1977
mov byte [ebp - 0xb439], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.00409100
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00430250
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.004b3860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.004b3860
mov al, byte [ebp - 0xb439]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x84]
xor ecx, ebp
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret