Function at 0x451620
Capabilities:
Act as tcp client
Check os version
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Get installed programs
Query or enumerate registry value
Resolve dns
Resolve function by parsing pe exports
Send data
Send data on socket
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5e11b1
mov eax, dword fs:[0]
push eax
sub esp, 0xa7c
mov eax, dword [0x6d26f8]
xor eax, esp
mov dword [esp + 0xa78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0xa90]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xa98], 0
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x2f], 0
call fcn.0040b7e0
mov byte [esp + 0xa98], 1
lea ebp, [esi + 0x30]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esi + 0x24]
lea edi, [esp + 0x38]
call fcn.0040daa0
mov esi, dword [esi + 0x28]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
or ebp, 0xffffffff
mov dword [esp + 0x84], edi
cmp edi, ebp
jne 0x45170a
cmp dword [0x6d138c], 3
jl 0x4516df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.socket_error____i
push str.Reporter::SendReport
push 3
call fcn.00552bc2
add esp, 0x10
mov byte [esp + 0xa98], 0
lea ecx, [esp + 0x38]
call fcn.0040b950
mov dword [esp + 0xa98], ebp
lea ecx, [esp + 0xaa0]
call fcn.0040b950
xor al, al
jmp 0x453363
mov ecx, 2
push esi
mov word [esp + 0x1d8], cx
call dword [sym.imp.WS2_32.dll_htons]
push ecx
mov word [esp + 0x1da], ax
mov edx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0x3c]
push eax
push edx
call fcn.0040b840
mov byte [esp + 0xa9c], 2
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0xaa0], 1
call fcn.00405ba0
add esp, 8
mov ebx, 3
mov byte [esp + 0xa98], bl
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x1d8], eax
mov byte [esp + 0xa98], 1
lea ecx, [esp + 0x20]
call fcn.0040b720
cmp dword [esp + 0x1d8], ebp
jne 0x45182b
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0x3c]
push eax
push edx
call fcn.0040b840
mov byte [esp + 0xa9c], 4
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0xaa0], 1
call fcn.00405ba0
add esp, 8
mov byte [esp + 0xa98], 5
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
mov byte [esp + 0xa98], 1
lea ecx, [esp + 0x20]
call fcn.0040b720
test esi, esi
jne 0x451810
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [0x6d138c], ebx
jl 0x4516df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.gethostbyname_error____i
push str.Reporter::SendReport
push ebx
jmp 0x4516d7
movsx edx, word [esi + 0xa]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
push edx
push ecx
lea edx, [esp + 0x1e0]
push edx
call fcn.005986a0
add esp, 0xc
push 0x10
lea eax, [esp + 0x1d8]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, ebp
jne 0x45184c
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x4516df
push 0x69b3c0
lea ecx, [esp + 0xaa4]
push ecx
call fcn.004379c0
mov edx, dword [0x6eaed4]
push edx
lea eax, [esp + 0xaa4]
push eax
call fcn.004379c0
push 0x100000
call fcn.0059409d
add esp, 4
push 0x100000
mov ebp, eax
push 0
push ebp
call fcn.005985f0
add esp, 8
mov ecx, esp
mov dword [esp + 0x28], esp
lea edx, [esp + 0xaa4]
push edx
push ecx
call fcn.0040b840
mov byte [esp + 0xa9c], 6
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xaa0], 1
call fcn.00405ba0
add esp, 8
mov byte [esp + 0xa98], 7
mov ecx, dword [eax]
mov edx, ebp
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4518d0
mov byte [esp + 0xa98], 1
lea ecx, [esp + 0x20]
call fcn.0040b720
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4518f0
sub eax, edx
xor edi, edi
mov esi, eax
xor ebx, ebx
mov edx, dword [esp + 0x84]
push 0
push esi
lea ecx, [edi + ebp]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
je 0x451930
mov byte [esp + 0x2b], 1
cmp eax, 0xffffffff
je 0x451930
add edi, eax
cmp eax, esi
je 0x451930
inc ebx
sub esi, eax
cmp ebx, 0xa
jl 0x4518ff
push ebp
call fcn.00593fc0
add esp, 4
test edi, edi
je 0x4532fb
cmp byte [esp + 0xaa4], 0
je 0x4532fb
mov ebx, dword [esp + 0x84]
lea eax, [esp + 0x30]
push eax
call fcn.004512f0
mov byte [esp + 0xa98], 8
mov edi, 1
cmp dword [0x6d138c], edi
jl 0x4519e9
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
lea edx, [esp + 0x34]
push edx
push ecx
call fcn.0040b840
mov byte [esp + 0xa9c], 9
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xaa0], 8
call fcn.00405ba0
add esp, 8
mov esi, eax
mov byte [esp + 0xa98], 0xa
mov eax, dword [esi]
sub eax, 0x10
cmp dword [eax + 0xc], edi
jle 0x4519c2
mov ecx, dword [eax + 4]
push ecx
push esi
call fcn.0040da00
mov esi, dword [esi]
push esi
push str.Receive_data:__s
push str.Reporter::SendReport
push edi
call fcn.00552bc2
add esp, 0x10
mov byte [esp + 0xa98], 8
lea ecx, [esp + 0x20]
call fcn.0040b720
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx - 0xc]
test eax, eax
jle 0x4532d3
push str.set_keywords:
push ecx
call fcn.0059472a
add esp, 8
test eax, eax
je 0x451e60
sub eax, dword [esp + 0x30]
sar eax, 1
jne 0x451e60
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.0040b840
mov byte [esp + 0xa98], 0xb
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
jge 0x451a40
or eax, 0xffffffff
jmp 0x451a5d
push 0x699688
push eax
call fcn.0059472a
add esp, 8
test eax, eax
jne 0x451a57
or eax, 0xffffffff
jmp 0x451a5d
sub eax, dword [esp + 0x18]
sar eax, 1
inc eax
lea ebx, [esp + 0x18]
call fcn.00437940
lea ecx, [esp + 0xfc]
push ecx
call fcn.0044cbf0
mov byte [esp + 0xa98], 0xc
push ecx
mov esi, esp
mov dword [esp + 0x28], esp
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
mov eax, ebx
push eax
push edx
call fcn.0040b840
mov byte [esp + 0xaa0], 0xd
push esi
mov byte [esp + 0xaa4], 0xc
call fcn.00405ba0
add esp, 8
mov byte [esp + 0xa9c], 0xe
lea ecx, [esp + 0x100]
push ecx
mov byte [esp + 0xaa0], 0xc
call fcn.0044cca0
call fcn.00448ca0
mov ebp, eax
mov dword [esp + 0x20], ebp
test ebp, ebp
je 0x451e1a
mov edx, dword [ebp]
mov edx, dword [edx + 8]
lea eax, [esp + 0xfc]
push eax
mov ecx, ebp
call edx
mov eax, dword [esp + 0x17c]
mov ebx, dword [eax]
mov edi, dword [esp + 0x164]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], edi
jmp 0x451b10
mov esi, dword [esp + 0x17c]
test edi, edi
je 0x451b24
cmp edi, dword [esp + 0x164]
je 0x451b29
call fcn.0059471a
cmp ebx, esi
je 0x451c08
push 0xa7
lea ecx, [esp + 0x1e9]
push 0
push ecx
mov byte [esp + 0x1f0], 0
call fcn.005985f0
add esp, 0xc
lea edx, [esp + 0x1e4]
push edx
test edi, edi
jne 0x451bfd
call fcn.0059471a
xor eax, eax
cmp ebx, dword [eax + 0x18]
jne 0x451b71
call fcn.0059471a
push ecx
lea esi, [ebx + 0xc]
lea eax, [esi + 4]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
push ecx
call fcn.00417690
mov byte [esp + 0xaa0], 0xf
mov byte [esp + 0xaa0], 0xc
call fcn.004308b0
add esp, 8
push 0xa8
lea edx, [esp + 0x1e8]
push edx
test edi, edi
jne 0x451c04
call fcn.0059471a
cmp ebx, dword [edi + 0x18]
jne 0x451bbd
call fcn.0059471a
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
push esi
push eax
call fcn.00417690
mov byte [esp + 0xaa4], 0x10
mov eax, dword [ebp]
add eax, 0xc
mov byte [esp + 0xaa4], 0xc
mov edx, dword [eax]
mov ecx, ebp
call edx
lea esi, [esp + 0x3c]
call fcn.00447b10
mov ebx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
jmp 0x451b10
mov eax, dword [edi]
jmp 0x451b67
mov edi, dword [edi]
jmp 0x451bb3
lea eax, [esp + 0x1b4]
push eax
call fcn.00416f80
mov byte [esp + 0xa98], 0x11
push 0
lea ecx, [esp + 0x1b8]
call fcn.00418010
test al, al
je 0x451e05
lea ecx, [esp + 0x1b4]
push ecx
call fcn.00419da0
mov ecx, dword [esp + 0x10c]
sub ecx, dword [esp + 0x108]
mov eax, 0x7a44c6b
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
xor ebx, ebx
add eax, edx
je 0x451cbd
xor ebp, ebp
cmp ebx, eax
jb 0x451c6e
call fcn.0059471a
mov edx, dword [esp + 0x108]
sub esp, 0x218
lea esi, [edx + ebp]
mov edi, esp
mov ecx, 0x86
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x3cc]
call fcn.00419ca0
mov ecx, dword [esp + 0x10c]
sub ecx, dword [esp + 0x108]
mov eax, 0x7a44c6b
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
add ebp, 0x218
cmp ebx, eax
jb 0x451c6e
mov eax, dword [esp + 0x15c]
mov edi, dword [eax]
mov esi, dword [esp + 0x144]
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], esi
lea esp, [esp]
mov ebx, dword [esp + 0x15c]
test esi, esi
je 0x451cf4
cmp esi, dword [esp + 0x144]
je 0x451cf9
call fcn.0059471a
cmp edi, ebx
je 0x451d83
test esi, esi
jne 0x451d7b
call fcn.0059471a
xor eax, eax
cmp edi, dword [eax + 0x18]
jne 0x451d16
call fcn.0059471a
movzx ecx, byte [edi + 0x10]
push ecx
test esi, esi
jne 0x451d7f
call fcn.0059471a
cmp edi, dword [esi + 0x18]
jne 0x451d2e
call fcn.0059471a
mov eax, dword [edi + 0xc]
push ecx
mov esi, esp
sub eax, 0x10
mov dword [esp + 0x2c], esp
mov dword [esp + 0x28], esi
call fcn.0040f5a0
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xaa0], 0x13
mov eax, dword [ebp]
add eax, 0x10
mov byte [esp + 0xaa0], 0x11
mov edx, dword [eax]
mov ecx, ebp
call edx
lea esi, [esp + 0x3c]
call fcn.00447b10
mov edi, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
jmp 0x451ce0
mov eax, dword [esi]
jmp 0x451d0c
mov esi, dword [esi]
jmp 0x451d24
mov eax, dword [esp + 0x194]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push eax
push 0x6d49e8
call esi
mov ecx, dword [esp + 0x194]
push ecx
push ecx
mov edx, esp
mov dword [esp + 0x2c], esp
push edx
mov ecx, str.ShowBandwidth90p
call fcn.0040b8a0
mov byte [esp + 0xaa0], 0x14
mov byte [esp + 0xaa0], 0x11
call fcn.00441df0
mov eax, dword [esp + 0x198]
push eax
push 0x6d49ec
call esi
mov ecx, dword [esp + 0x198]
push ecx
push ecx
mov edx, esp
mov dword [esp + 0x2c], esp
push edx
mov ecx, str.ShowBandwidth100p
call fcn.0040b8a0
mov byte [esp + 0xaa0], 0x15
mov byte [esp + 0xaa0], 0x11
call fcn.00441df0
mov byte [esp + 0xa98], 0xc
lea eax, [esp + 0x1b4]
push eax
call fcn.00416fe0
mov byte [esp + 0xa98], 0xb
lea ecx, [esp + 0xfc]
push ecx
call fcn.00453390
mov byte [esp + 0xa98], 8
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4532d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4532d3
lea ecx, [esp + 0xb4]
push ecx
call fcn.0041d3b0
mov byte [esp + 0xa98], 0x17
mov eax, dword [esp + 0x30]
cmp dword [eax - 4], 1
jle 0x451e91
mov edx, dword [eax - 0xc]
push edx
lea eax, [esp + 0x34]
push eax
call fcn.0040db00
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x1b4]
call fcn.0040b2d0
mov byte [esp + 0xa98], 0x18
lea ecx, [esp + 0x1b4]
push ecx
mov esi, 0x3b
lea edi, [esp + 0xb8]
call fcn.0042b150
add esp, 4
mov byte [esp + 0xa98], 0x17
lea esi, [esp + 0x1b4]
call fcn.00440d90
mov ecx, dword [esp + 0xc4]
sub ecx, dword [esp + 0xc0]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
xor ebp, ebp
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x7c], ebp
je 0x4532be
cmp ebp, eax
jb 0x451f0b
call fcn.0059471a
mov eax, dword [esp + 0xc0]
lea edx, [ebp*8]
sub edx, ebp
cmp dword [eax + edx*4 + 0x18], 8
lea eax, [eax + edx*4]
jb 0x451f2a
mov eax, dword [eax + 4]
jmp 0x451f2d
add eax, 4
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.0040b8a0
mov byte [esp + 0xa98], 0x19
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x453268
jl 0x451fca
push str.Quick_Scan
push ecx
call fcn.0059472a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x451fca
sub eax, ecx
sar eax, 1
jne 0x451fca
call fcn.004798f0
push 0
push 0
push 1
push ecx
mov edx, esp
mov dword [esp + 0x2c], esp
push edx
mov ecx, 0x69b454
mov esi, eax
call fcn.00417060
mov byte [esp + 0xaa8], 0x1a
push esi
mov byte [esp + 0xaac], 0x19
call fcn.004827d0
push eax
mov ecx, esi
call fcn.0048cb90
push 0
push 0
mov esi, eax
push esi
push 0x47f200
push 0
push 0
call fcn.005957cb
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x30]
add esp, 0x18
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.Full_Scan
push ecx
call fcn.0059472a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x45204c
sub eax, ecx
sar eax, 1
jne 0x45204c
call fcn.004798f0
push 0
push 0
push 1
push ecx
mov esi, eax
mov eax, esp
mov dword [esp + 0x2c], esp
push eax
mov ecx, 0x69b470
call fcn.00417060
mov byte [esp + 0xaa8], 0x1b
push esi
mov byte [esp + 0xaac], 0x19
call fcn.004827d0
push eax
mov ecx, esi
call fcn.0048cb90
push 0
push 0
mov esi, eax
push esi
push 0x47f200
push 0
push 0
call fcn.005957cb
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x30]
add esp, 0x18
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.Custom_Scan
push ecx
call fcn.0059472a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x452130
sub eax, ecx
sar eax, 1
jne 0x452130
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x54]
push edx
call fcn.0040b840
mov byte [esp + 0xa98], 0x1c
mov eax, dword [esp + 0x50]
cmp dword [eax - 0xc], 0
jge 0x4520a0
or eax, 0xffffffff
jmp 0x4520bd
push 0x699688
push eax
call fcn.0059472a
add esp, 8
test eax, eax
jne 0x4520b7
or eax, 0xffffffff
jmp 0x4520bd
sub eax, dword [esp + 0x50]
sar eax, 1
inc eax
lea ebx, [esp + 0x50]
call fcn.00437940
call fcn.004798f0
push 0
push 0
push 1
push ecx
mov esi, eax
mov eax, esp
mov dword [esp + 0x2c], esp
mov ecx, ebx
push ecx
push eax
call fcn.0040b840
mov byte [esp + 0xaa8], 0x1d
push esi
mov byte [esp + 0xaac], 0x1c
call fcn.004827d0
push eax
mov ecx, esi
call fcn.0048cb90
push 0
push 0
mov esi, eax
push esi
push 0x47f200
push 0
push 0
call fcn.005957cb
add esp, 0x18
mov dword [esi + 0xc], eax
mov byte [esp + 0xa98], 0x19
mov ecx, ebx
call fcn.0040b950
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.Device_Allow
push ecx
call fcn.0059472a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x452178
sub eax, ecx
sar eax, 1
jne 0x452178
call fcn.004798f0
xor cl, cl
call fcn.00487210
mov edx, dword [0x6eaa30]
add edx, 0xc0
push edx
call fcn.00496750
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.Device_Block
push ecx
call fcn.0059472a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x4521be
sub eax, ecx
sar eax, 1
jne 0x4521be
call fcn.004798f0
mov cl, 1
call fcn.00487210
mov eax, dword [0x6eaa30]
add eax, 0xc0
push eax
call fcn.00496750
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.fw_enable
push ecx
call fcn.0059472a
add esp, 8
test eax, eax
je 0x4521f8
mov ecx, dword [esp + 0x18]
sub eax, ecx
sar eax, 1
jne 0x4521fc
call fcn.00448ca0
test eax, eax
je 0x4521f8
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
push 1
call eax
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.fw_disable
push ecx
call fcn.0059472a
add esp, 8
test eax, eax
je 0x452236
mov ecx, dword [esp + 0x18]
sub eax, ecx
sar eax, 1
jne 0x45223a
call fcn.00448ca0
test eax, eax
je 0x452236
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
push 0
call eax
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.ssl_enable
push ecx
call fcn.0059472a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x4522a4
sub eax, ecx
sar eax, 1
jne 0x4522a4
push 1
push 0x6d4a08
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [0x6d4a08]
push ecx
push ecx
mov edx, esp
mov dword [esp + 0x24], esp
push edx
mov ecx, str.EnableSSL
call fcn.0040b8a0
mov byte [esp + 0xaa0], 0x1e
mov byte [esp + 0xaa0], 0x19
call fcn.00441df0
call fcn.00449310
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.ssl_disable
push ecx
call fcn.0059472a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x45230d
sub eax, ecx
sar eax, 1
jne 0x45230d
push 0
push 0x6d4a08
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [0x6d4a08]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push ecx
mov ecx, str.EnableSSL
call fcn.0040b8a0
mov byte [esp + 0xaa0], 0x1f
mov byte [esp + 0xaa0], 0x19
call fcn.00441df0
call fcn.00449310
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.USB_Protection:
push ecx
call fcn.0059472a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x45293a
sub eax, ecx
sar eax, 1
jne 0x45293a
lea edx, [esp + 0xe4]
push edx
call fcn.0041d3b0
mov byte [esp + 0xa98], 0x20
or eax, 0xffffffff
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x58]
push ecx
call fcn.0040b840
mov byte [esp + 0xa98], 0x21
lea edx, [esp + 0xcc]
push edx
call fcn.0041d3b0
mov bl, 0x22
mov byte [esp + 0xa98], bl
mov eax, dword [esp + 0x54]
cmp dword [eax - 4], 1
jle 0x4523a8
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x58]
push ecx
call fcn.0040db00
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0x1b4]
call fcn.0040b2d0
mov byte [esp + 0xa98], 0x23
lea edx, [esp + 0x1b4]
push edx
mov esi, 0xd
lea edi, [esp + 0xd0]
call fcn.0042b150
add esp, 4
mov byte [esp + 0xa98], bl
cmp dword [esp + 0x1cc], 8
jb 0x4523f9
mov eax, dword [esp + 0x1b8]
push eax
call fcn.0059392f
add esp, 4
mov esi, dword [esp + 0xd8]
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x1c8], eax
mov dword [esp + 0x78], eax
mov word [esp + 0x1b8], cx
mov ecx, dword [esp + 0xdc]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x1cc], 7
je 0x452891
mov dword [esp + 0x34], 0
cmp dword [esp + 0x78], eax
jb 0x45245e
call fcn.0059471a
mov esi, dword [esp + 0xd8]
mov eax, dword [esp + 0x34]
cmp dword [esi + eax + 0x18], 8
jb 0x45246f
mov ecx, dword [esi + eax + 4]
jmp 0x452473
lea ecx, [esi + eax + 4]
lea edx, [esp + 0x4c]
push edx
call fcn.0040b8a0
mov byte [esp + 0xa98], 0x24
lea ebx, [esp + 0x4c]
call fcn.00439db0
mov ebx, eax
call fcn.00439e30
lea eax, [esp + 0x58]
push eax
call fcn.0041d3b0
mov byte [esp + 0xa98], 0x25
mov eax, dword [esp + 0x4c]
cmp dword [eax - 4], 1
jle 0x4524c3
mov ecx, dword [eax - 0xc]
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.0040db00
mov eax, dword [esp + 0x4c]
xor ebx, ebx
xor ecx, ecx
mov word [esp + 0x9c], cx
mov ebp, 7
mov ecx, eax
mov dword [esp + 0xb0], ebp
mov dword [esp + 0xac], ebx
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x4524e7
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x9c]
call fcn.0040d4e0
mov byte [esp + 0xa98], 0x26
mov edx, esi
push edx
mov esi, 0x3a
lea edi, [esp + 0x5c]
call fcn.0042b150
add esp, 4
mov byte [esp + 0xa98], 0x25
cmp dword [esp + 0xb0], 8
jb 0x452541
mov eax, dword [esp + 0x9c]
push eax
call fcn.0059392f
add esp, 4
mov esi, dword [esp + 0x68]
xor ecx, ecx
mov word [esp + 0x9c], cx
mov ecx, dword [esp + 0x64]
sub esi, ecx
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0xb0], ebp
mov dword [esp + 0xac], ebx
cmp eax, 2
jne 0x4527ff
lea edi, [eax + 0xc]
mov eax, dword [ecx + 0x14]
push str.USB_Protection
call fcn.0040d8c0
test eax, eax
jne 0x4525ec
mov ecx, dword [esp + 0x68]
mov esi, dword [esp + 0x64]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 1
ja 0x4525be
call fcn.0059471a
mov esi, dword [esp + 0x64]
mov ebp, 8
cmp dword [esi + 0x34], ebp
jb 0x4525da
mov esi, dword [esi + 0x20]
push esi
call fcn.00593fb5
add esp, 4
mov dword [esp + 0x2c], eax
jmp 0x4525f1
add esi, 0x20
push esi
call fcn.00593fb5
add esp, 4
mov dword [esp + 0x2c], eax
jmp 0x4525f1
mov ebp, 8
mov esi, dword [esp + 0x68]
mov ecx, dword [esp + 0x64]
sub esi, ecx
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x452619
call fcn.0059471a
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx + 0x14]
push str.delay
mov edi, 5
call fcn.0040d8c0
test eax, eax
jne 0x452674
mov ecx, dword [esp + 0x68]
mov esi, dword [esp + 0x64]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 1
ja 0x45265a
call fcn.0059471a
mov esi, dword [esp + 0x64]
cmp dword [esi + 0x34], ebp
jb 0x452664
mov esi, dword [esi + 0x20]
jmp 0x452667
add esi, 0x20
push esi
call fcn.00593fb5
add esp, 4
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x68]
mov ecx, dword [esp + 0x64]
sub esi, ecx
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x45269c
call fcn.0059471a
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx + 0x14]
push str.password
mov edi, ebp
call fcn.0040d8c0
mov esi, dword [esp + 0x68]
mov ebx, dword [esp + 0x64]
test eax, eax
jne 0x4526ec
mov ecx, esi
sub ecx, ebx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 1
ja 0x4526e0
call fcn.0059471a
mov esi, dword [esp + 0x68]
mov ebx, dword [esp + 0x64]
lea eax, [ebx + 0x1c]
call fcn.004515e0
mov dword [esp + 0x70], eax
sub esi, ebx
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x45270c
call fcn.0059471a
mov ebx, dword [esp + 0x64]
mov eax, dword [ebx + 0x14]
push str.excluded
mov edi, ebp
mov ecx, ebx
call fcn.0040d8c0
test eax, eax
jne 0x4527ff
lea ecx, [esp + 0x88]
push ecx
mov ecx, 0x694264
call fcn.0040b8a0
mov byte [esp + 0xa98], 0x27
mov ecx, dword [esp + 0x68]
mov esi, dword [esp + 0x64]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
ja 0x45276a
call fcn.0059471a
mov esi, dword [esp + 0x64]
cmp dword [esi + 0x34], ebp
jb 0x452774
mov ecx, dword [esi + 0x20]
jmp 0x452777
lea ecx, [esi + 0x20]
lea edx, [esp + 0x8c]
push edx
call fcn.0040b8a0
mov bl, 0x28
mov byte [esp + 0xa98], bl
lea eax, [esp + 0x88]
push eax
push 0x2c
lea edx, [esp + 0x94]
lea ecx, [esp + 0x1a4]
call fcn.00499910
add esp, 8
mov byte [esp + 0xa98], 0x29
push eax
lea ecx, [esp + 0xe8]
push ecx
call fcn.004565d0
mov byte [esp + 0xa98], bl
lea edx, [esp + 0x19c]
push edx
call fcn.0041cd80
mov byte [esp + 0xa98], 0x27
lea ecx, [esp + 0x8c]
call fcn.0040b950
mov byte [esp + 0xa98], 0x25
lea ecx, [esp + 0x88]
call fcn.0040b950
mov byte [esp + 0xa98], 0x24
lea eax, [esp + 0x58]
push eax
call fcn.00456ba0
mov byte [esp + 0xa98], 0x22
lea ecx, [esp + 0x4c]
call fcn.0040b950
mov ecx, dword [esp + 0xdc]
mov esi, dword [esp + 0xd8]
mov edi, dword [esp + 0x78]
add dword [esp + 0x34], 0x1c
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
mov dword [esp + 0x78], edi
cmp edi, eax
jb 0x45244c
mov esi, dword [esp + 0x70]
cmp esi, 0xffffffff
je 0x45286f
call fcn.004798f0
push eax
call fcn.00489220
mov edi, dword [esp + 0x2c]
cmp edi, 0xffffffff
je 0x452891
mov esi, dword [esp + 0x1c]
cmp esi, 0xffffffff
je 0x452891
call fcn.004798f0
push esi
push edi
push 1
mov edi, eax
call fcn.00488a20
call fcn.004798f0
mov edi, eax
mov eax, dword [esp + 0xf4]
sub eax, dword [esp + 0xf0]
xor esi, esi
sar eax, 2
test eax, eax
jbe 0x4528e0
cmp esi, eax
jb 0x4528b8
call fcn.0059471a
mov ecx, dword [esp + 0xf0]
lea edx, [ecx + esi*4]
push edx
mov ecx, edi
call fcn.00488ce0
mov eax, dword [esp + 0xf4]
sub eax, dword [esp + 0xf0]
inc esi
sar eax, 2
cmp esi, eax
jb 0x4528b8
mov byte [esp + 0xa98], 0x21
lea eax, [esp + 0xcc]
push eax
call fcn.00456ba0
mov byte [esp + 0xa98], 0x20
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45291d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xa98], 0x19
lea ecx, [esp + 0xe4]
push ecx
call fcn.0041cd80
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x7c]
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.Exclude_drive:
push ecx
call fcn.0059472a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x452a0d
sub eax, ecx
sar eax, 1
jne 0x452a0d
add ecx, 0xfffffff0
mov eax, ecx
call fcn.0040f770
add eax, 0x10
mov dword [esp + 0x48], eax
mov byte [esp + 0xa98], 0x2c
mov eax, dword [esp + 0x48]
cmp dword [eax - 0xc], 0
jge 0x452990
or eax, 0xffffffff
jmp 0x4529ad
push 0x699688
push eax
call fcn.0059472a
add esp, 8
test eax, eax
jne 0x4529a7
or eax, 0xffffffff
jmp 0x4529ad
sub eax, dword [esp + 0x48]
sar eax, 1
inc eax
lea ebx, [esp + 0x48]
call fcn.00437940
mov eax, dword [esp + 0x48]
push ecx
mov esi, esp
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov dword [esp + 0x30], esi
call fcn.0040f770
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xa9c], 0x2e
mov byte [esp + 0xa9c], 0x2c
call fcn.0042a7e0
add esp, 4
mov esi, eax
call fcn.004798f0
push esi
mov edi, eax
call fcn.00488ba0
mov byte [esp + 0xa98], 0x19
mov ecx, ebx
call fcn.0040b950
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.Unexclude_drive:
push ecx
call fcn.0059472a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x452ae0
sub eax, ecx
sar eax, 1
jne 0x452ae0
add ecx, 0xfffffff0
mov eax, ecx
call fcn.0040f770
add eax, 0x10
mov dword [esp + 0x44], eax
mov byte [esp + 0xa98], 0x30
mov eax, dword [esp + 0x44]
cmp dword [eax - 0xc], 0
jge 0x452a63
or eax, 0xffffffff
jmp 0x452a80
push 0x699688
push eax
call fcn.0059472a
add esp, 8
test eax, eax
jne 0x452a7a
or eax, 0xffffffff
jmp 0x452a80
sub eax, dword [esp + 0x44]
sar eax, 1
inc eax
lea ebx, [esp + 0x44]
call fcn.00437940
mov eax, dword [esp + 0x44]
push ecx
mov esi, esp
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov dword [esp + 0x30], esi
call fcn.0040f770
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xa9c], 0x32
mov byte [esp + 0xa9c], 0x30
call fcn.0042a7e0
add esp, 4
mov esi, eax
call fcn.004798f0
push esi
mov edi, eax
call fcn.00489000
mov byte [esp + 0xa98], 0x19
mov ecx, ebx
call fcn.0040b950
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.opt_prot
push ecx
call fcn.0059472a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x452b0a
sub eax, ecx
sar eax, 1
je 0x452baa
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.opt_scan
push ecx
call fcn.0059472a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x452b30
sub eax, ecx
sar eax, 1
je 0x452baa
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.opt_update
push ecx
call fcn.0059472a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x452b56
sub eax, ecx
sar eax, 1
je 0x452baa
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.opt_sch
push ecx
call fcn.0059472a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x452b7c
sub eax, ecx
sar eax, 1
je 0x452baa
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.opt_logs
push ecx
call fcn.0059472a
add esp, 8
test eax, eax
je 0x452f0b
mov ecx, dword [esp + 0x18]
sub eax, ecx
sar eax, 1
jne 0x452f0f
add ecx, 0xfffffff0
mov eax, ecx
call fcn.0040f770
lea esi, [eax + 0x10]
mov dword [esp + 0x74], esi
mov byte [esp + 0xa98], 0x34
cmp dword [esi - 0xc], 0
jge 0x452bce
or eax, 0xffffffff
jmp 0x452be9
push 0x699688
push esi
call fcn.0059472a
add esp, 8
test eax, eax
jne 0x452be5
or eax, 0xffffffff
jmp 0x452be9
sub eax, esi
sar eax, 1
inc eax
lea ebx, [esp + 0x74]
call fcn.00437940
mov ecx, ebx
call fcn.00405cc0
mov ecx, dword [0x6eae0c]
sub ecx, dword [0x6eae08]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x452ee3
mov ecx, dword [0x6eaa30]
add ecx, 0xc0
push ecx
call fcn.00496620
call fcn.004021b0
mov ecx, dword [0x6eae0c]
sub ecx, dword [0x6eae08]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
xor ebp, ebp
add eax, edx
je 0x452ebc
mov dword [esp + 0x34], ebp
cmp ebp, eax
jb 0x452c6a
call fcn.0059471a
mov eax, dword [esp + 0x34]
mov edx, dword [0x6eae08]
lea esi, [edx + eax]
mov eax, dword [esi]
test eax, eax
jne 0x452c94
movzx edx, byte [esi + 0xc]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push edx
push eax
push ecx
call fcn.00401ce0
jmp 0x452e8f
cmp eax, 1
jne 0x452caf
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push edx
push eax
push ecx
call fcn.00401ac0
jmp 0x452e8f
cmp eax, 2
jne 0x452d0b
push ecx
mov ecx, dword [esi + 0x14]
lea eax, [esi + 0x14]
mov edi, esp
mov dword [esp + 0x20], esp
mov dword [edi], ecx
cmp eax, edi
jne 0x452cde
push 0x2d6
push str.c:qt4.8.6includeqtcore.._.._src_corelib_tools_qstring.h
push str.other___this
call fcn.004d1bd0
add esp, 0xc
mov edx, dword [edi]
mov eax, 1
lock xadd dword [edx], eax
mov byte [esp + 0xa9c], 0x35
mov eax, dword [esi + 8]
mov esi, dword [esi + 4]
push eax
push esi
mov byte [esp + 0xaa4], 0x34
call fcn.00401f10
jmp 0x452e8f
cmp eax, 3
jne 0x452e8f
mov eax, dword [esi + 4]
push str.Realtime
push eax
call fcn.005956b3
add esp, 8
test eax, eax
sete al
test al, al
je 0x452e2f
mov eax, dword [esi + 8]
lea edi, [esi + 8]
push str.RealtimeNew
push eax
call fcn.005956b3
add esp, 8
test eax, eax
sete al
test al, al
je 0x452e2f
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
call fcn.00401130
mov byte [esp + 0xa9c], 0x36
push ecx
mov dword [esp + 0x34], esp
mov ebx, esp
push 0xffffffffffffffff
push str.RealtimeNew
call fcn.004dbef0
add esp, 8
mov dword [ebx], eax
mov byte [esp + 0xaa0], 0x37
push str.Realtime
lea ecx, [esp + 0x8c]
push ecx
mov byte [esp + 0xaa8], 0x34
call fcn.00401550
mov byte [esp + 0xa98], 0x38
lea edx, [esi + 0x18]
push edx
lea ecx, [esp + 0x84]
call fcn.004572d0
push ecx
lea eax, [esp + 0x84]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00401190
mov byte [esp + 0xa9c], 0x39
mov eax, dword [edi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x452dea
mov ecx, dword [eax + 4]
push ecx
push edi
call fcn.0040da00
mov edi, dword [edi]
push ecx
mov dword [esp + 0x34], esp
mov ebx, esp
push 0xffffffffffffffff
push edi
call fcn.004dbef0
add esp, 8
mov dword [ebx], eax
mov byte [esp + 0xaa0], 0x3a
mov esi, dword [esi + 4]
push esi
mov byte [esp + 0xaa4], 0x38
call fcn.00401890
mov byte [esp + 0xa98], 0x34
lea ecx, [esp + 0x80]
call fcn.00401200
jmp 0x452e8f
push ecx
lea edx, [esi + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.00401190
mov byte [esp + 0xa9c], 0x3b
mov eax, dword [esi + 8]
lea edi, [esi + 8]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x452e60
mov eax, dword [eax + 4]
push eax
push edi
call fcn.0040da00
mov edi, dword [edi]
push ecx
mov dword [esp + 0x34], esp
mov ebx, esp
push 0xffffffffffffffff
push edi
call fcn.004dbef0
add esp, 8
mov dword [ebx], eax
mov byte [esp + 0xaa0], 0x3c
mov esi, dword [esi + 4]
push esi
mov byte [esp + 0xaa4], 0x34
call fcn.00401890
mov ecx, dword [0x6eae0c]
sub ecx, dword [0x6eae08]
add dword [esp + 0x34], 0x1c
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebp
add eax, edx
cmp ebp, eax
jb 0x452c6a
call fcn.004021b0
mov ecx, dword [0x6eaa30]
add ecx, 0xc0
push ecx
call fcn.00496620
call fcn.004798f0
mov ebx, eax
call fcn.00482b80
mov ebp, dword [esp + 0x7c]
mov byte [esp + 0xa98], 0x19
mov eax, dword [esp + 0x74]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x452f0b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.opt_pass
push ecx
call fcn.0059472a
add esp, 8
test eax, eax
je 0x45306a
mov ecx, dword [esp + 0x18]
sub eax, ecx
sar eax, 1
jne 0x45306e
add ecx, 0xfffffff0
mov eax, ecx
call fcn.0040f770
lea esi, [eax + 0x10]
mov dword [esp + 0x90], esi
mov byte [esp + 0xa98], 0x3f
cmp dword [esi - 0xc], 0
jge 0x452f64
or eax, 0xffffffff
jmp 0x452f7f
push 0x699688
push esi
call fcn.0059472a
add esp, 8
test eax, eax
jne 0x452f7b
or eax, 0xffffffff
jmp 0x452f7f
sub eax, esi
sar eax, 1
inc eax
lea ebx, [esp + 0x90]
call fcn.00437940
mov ecx, dword [0x6eaa30]
add ecx, 0xc0
push ecx
call fcn.00496620
call fcn.004021b0
push 1
push str.Locked
push str.Main
call fcn.00401ce0
mov esi, dword [esp + 0x90]
push esi
call fcn.00593fb5
add esp, 4
push eax
push str.Password
push str.Main
mov dword [esp + 0x30], eax
call fcn.00401ac0
mov edx, dword [0x6eac4c]
push edx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x45302f
lea eax, [esp + 0x94]
push eax
push 2
mov dword [esp + 0x9c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov eax, dword [esp + 0x94]
test eax, eax
je 0x453029
push 4
lea ecx, [esp + 0x28]
push ecx
push 4
push str.SP01
push str.SoftwareMicrosoftShared
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
call fcn.004021b0
mov edx, dword [0x6eaa30]
add edx, 0xc0
push edx
call fcn.00496620
mov byte [esp + 0xa98], 0x19
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45306a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.Download_Updates
push ecx
call fcn.0059472a
add esp, 8
test eax, eax
je 0x4530ee
mov ecx, dword [esp + 0x18]
sub eax, ecx
sar eax, 1
jne 0x4530f2
call fcn.004798f0
push 8
mov edi, eax
call fcn.005939b5
add esp, 4
test eax, eax
je 0x4530b4
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov esi, eax
jmp 0x4530b6
xor esi, esi
mov dword [esi], edi
mov byte [esi + 4], 0
mov ecx, dword [edi + 0x144]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4530ee
push 0
push 0
push esi
push 0x48b6a0
push 0
push 0
call fcn.005957cb
add esp, 0x18
mov dword [edi + 0x144], eax
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x453268
push str.Uninstall_Client
push ecx
call fcn.0059472a
add esp, 8
test eax, eax
je 0x453268
sub eax, dword [esp + 0x18]
sar eax, 1
jne 0x453268
cmp dword [0x6eac4c], 0
je 0x45324b
mov edx, dword [0x6e9718]
mov eax, dword [edx + 0xc]
mov ecx, 0x6e9718
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x20], esi
mov byte [esp + 0xa98], 0x42
mov ecx, dword [0x6eac4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x290]
push eax
push 0
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallVibranium_Threat_Security_is1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x54], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4531c7
mov ecx, dword [esp + 0x3c]
shr ecx, 1
xor edx, edx
lea eax, [esp + 0x28c]
mov word [esp + ecx*2 + 0x28c], dx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4531a1
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x28c]
mov ebx, eax
push ecx
lea eax, [esp + 0x24]
call fcn.0040f6d0
mov esi, dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [esi - 0xc], 0
je 0x453225
mov edi, dword [0x6eac4c]
push ecx
mov edx, esp
mov dword [esp + 0x20], esp
push edx
mov ecx, str._VERYSILENT
call fcn.0040b8a0
mov byte [esp + 0xa9c], 0x43
push ecx
mov ebx, esp
lea eax, [esi - 0x10]
mov dword [esp + 0x34], esp
mov dword [esp + 0x78], ebx
call fcn.0040f770
add eax, 0x10
mov dword [ebx], eax
mov byte [esp + 0xaa0], 0x45
mov byte [esp + 0xaa0], 0x42
mov ecx, edi
call fcn.004513f0
add esp, 8
mov byte [esp + 0xa98], 0x19
add esi, 0xfffffff0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453268
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
jmp 0x453268
cmp dword [0x6d138c], 3
jl 0x453268
push str.User_token_is_not_available
push str.Reporter::SendReport
push 3
call fcn.00552bc2
add esp, 0xc
mov byte [esp + 0xa98], 0x17
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x453290
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc4]
sub ecx, dword [esp + 0xc0]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebp
add eax, edx
mov dword [esp + 0x7c], ebp
cmp ebp, eax
jb 0x451f0b
mov byte [esp + 0xa98], 8
lea ecx, [esp + 0xb4]
push ecx
call fcn.00456ba0
mov byte [esp + 0xa98], 1
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4532fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x84]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov byte [esp + 0xa98], 0
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x453331
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xa98], 0xffffffff
mov eax, dword [esp + 0xaa0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45335f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, byte [esp + 0x2b]
mov ecx, dword [esp + 0xa90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa78]
xor ecx, esp
call fcn.0059393a
add esp, 0xa88
ret 8