Function at 0x4b6850
Capabilities:
Check for time delay via queryperformancecounter
Check if file exists
Create thread
Delete registry value
Get common file path
Link many functions at runtime
Query or enumerate registry value
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x4d0
mov esi, dword [ebp + 8]
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [esp + 0x4c8], eax
mov dword [esp + 0x64], 0
call dword [sym.imp.KERNEL32.dll_IsThreadAFiber]
test eax, eax
jne 0x4b68f0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiberEx]
test eax, eax
je 0x4b68f7
lea ecx, [esp + 0xa0]
mov dword [ecx], esi
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ecx + 8], eax
push ecx
push 0x4b9c50
push 1
push 0x400000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFiberEx]
test eax, eax
je 0x4b68fb
mov esi, eax
push eax
call dword [sym.imp.KERNEL32.dll_SwitchToFiber]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFiber]
call dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov edi, dword [esp + 0xa8]
mov ecx, dword [esp + 0x4c8]
xor ecx, ebp
call fcn.00512ee3
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov esi, 2
jmp 0x4b6913
xor esi, esi
jmp 0x4b68fe
xor esi, esi
inc esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x64]
mov dword [ecx], eax
push ecx
call fcn.004ee170
add esp, 4
mov dword [esp + 0x24], esi
mov ecx, dword [fcn.00509260]
cmp ecx, 0x50efc0
jne 0x4b69f1
xor eax, eax
lea edi, [esp + 0xa0]
mov dword [edi + 4], eax
mov dword [edi], eax
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [edi]
mov edi, dword [edi + 4]
cmp eax, 0x7bd05af7
mov ecx, edi
sbb ecx, 0x863
jl 0x4b8b17
mov esi, dword [0x6c02b0]
mov ecx, dword [0x6c02b4]
mov dword [esp + 0xc], ecx
push ecx
push esi
push edi
push eax
mov dword [esp + 0x20], eax
call fcn.00517110
mov ebx, eax
mov dword [esp + 0x14], edi
mov edi, edx
mov dword [esp + 0x1c], esi
mul esi
mov ecx, ebx
imul ecx, dword [esp + 0xc]
add edx, ecx
imul ecx, edi, 0xf4240
mov dword [esp + 0x18], ecx
imul edi, esi
add edi, edx
mov esi, dword [esp + 0x10]
sub esi, eax
mov ecx, dword [esp + 0x14]
sbb ecx, edi
mov edi, 0xf4240
mov eax, ebx
mul edi
mov dword [esp + 0x10], eax
add edx, dword [esp + 0x18]
mov dword [esp + 0x14], edx
mov eax, esi
mul edi
imul ecx, ecx, 0xf4240
add edx, ecx
push dword [esp + 0xc]
push dword [esp + 0x20]
push edx
push eax
call fcn.00517110
mov edi, eax
mov ebx, edx
add edi, dword [esp + 0x10]
adc ebx, dword [esp + 0x14]
mov dword [esp + 0x2b0], edi
mov dword [esp + 0x2b4], ebx
jmp 0x4b6a09
call dword [section..00cfg]
lea esi, [esp + 0x2b0]
push esi
call ecx
add esp, 4
mov edi, dword [esi]
mov ebx, dword [esi + 4]
lea esi, [esp + 0xa0]
mov ecx, esi
push str.exe_entry_point:placeholder
call fcn.00547270
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edi
mov eax, dword [0x5f83a4]
cmp eax, dword [0x5f83a8]
jae 0x4b6a5e
mov ecx, dword [esp + 0xa8]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0xa0]
movsd qword [eax], xmm0
movq xmm0, qword [esp + 0xb0]
movq qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x5f83a4], eax
jmp 0x4b6a82
mov ecx, 0x5f83a0
push esi
call fcn.004bebf0
cmp byte [esp + 0xab], 0
jns 0x4b6a82
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
call fcn.004b9c80
xor edi, edi
test eax, eax
jne 0x4b68d6
mov ebx, 0x208
xor edi, edi
push ebx
push edi
push esi
call fcn.005191b0
add esp, 0xc
lea eax, [esp + 0x2b0]
push ebx
mov ebx, eax
push edi
push eax
call fcn.005191b0
add esp, 0xc
push 0x104
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4b6ae2
cmp word [esp + eax*2 + 0x2ae], 0x5c
je 0x4b6ad8
dec eax
jne 0x4b6ac8
jmp 0x4b6ae2
mov word [esp + eax*2 + 0x2b0], 0
lea edi, [esp + 0x40]
push 0xb
push 0x5e22a3
push edi
call fcn.004fb440
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x4b6b00
mov edi, dword [esp + 0x40]
push edi
push ebx
push str._s_schrome_elf.dll
push 0x104
push esi
call fcn.00549e40
add esp, 0x14
cmp byte [esp + 0x4b], 0
jns 0x4b6b28
push dword [esp + 0x40]
call fcn.0050fc7c
add esp, 4
push 0
push esi
call fcn.0052fa2d
add esp, 8
cmp eax, 0xffffffff
jne 0x4b6b53
lea eax, [esp + 0x2b0]
push eax
push str._schrome_elf.dll
push 0x104
push esi
call fcn.00549e40
add esp, 0x10
call fcn.004f9f70
mov eax, dword [0x6bfaf4]
cmp dword [eax], 0x15
jl 0x4b6bb3
xor eax, eax
push eax
push eax
call fcn.0040dc60
add esp, 8
mov ecx, dword [0x6bedd8]
xor eax, eax
dec eax
lea edi, [esp + 0x40]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
push 4
push str.type
push edi
call fcn.00500040
movzx eax, byte [edi + 0xb]
mov edi, eax
and edi, 0x7f
test al, al
jns 0x4b6ba1
mov edi, dword [esp + 0x44]
jns 0x4b6baf
push dword [esp + 0x40]
call fcn.0050fc7c
add esp, 4
test edi, edi
jne 0x4b6bc4
push esi
call fcn.00578760
add esp, 4
test eax, eax
je 0x4b7e47
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4b6c28
push str.SignalInitializeCrashReporting
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b6be9
mov ecx, eax
call dword [section..00cfg]
call ecx
push str.chrome_elf.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x5d9f94
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b6c28
mov ecx, eax
call dword [section..00cfg]
call ecx
mov edi, eax
push 8
call fcn.00510d64
add esp, 4
mov dword [eax], 0x5d6598
mov dword [eax + 4], edi
mov dword [0x5f83b0], eax
mov ecx, dword [fcn.00509260]
cmp ecx, 0x50efc0
mov dword [esp + 0x34], ebx
jne 0x4b6d11
xor eax, eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa0], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0xa0]
mov edi, dword [esp + 0xa4]
cmp eax, 0x7bd05af7
mov ecx, edi
sbb ecx, 0x863
jl 0x4b8cc0
mov ebx, dword [0x6c02b0]
mov ecx, dword [0x6c02b4]
mov dword [esp + 0xc], ecx
push ecx
push ebx
push edi
push eax
mov dword [esp + 0x20], eax
call fcn.00517110
mov esi, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], edi
mov edi, edx
mul ebx
mov dword [esp + 0x1c], ebx
imul esi, dword [esp + 0xc]
add edx, esi
imul esi, edi, 0xf4240
mov dword [esp + 0x18], esi
imul edi, ebx
add edi, edx
mov ecx, dword [esp + 0x10]
sub ecx, eax
mov esi, dword [esp + 0x14]
sbb esi, edi
mov edi, 0xf4240
mov eax, dword [esp + 0x20]
mul edi
mov dword [esp + 0x10], eax
mov ebx, edx
add ebx, dword [esp + 0x18]
mov eax, ecx
mul edi
imul ecx, esi, 0xf4240
add edx, ecx
push dword [esp + 0xc]
push dword [esp + 0x20]
push edx
push eax
call fcn.00517110
mov esi, eax
mov edi, edx
add esi, dword [esp + 0x10]
adc edi, ebx
mov dword [esp + 0x2b0], esi
mov dword [esp + 0x2b4], edi
jmp 0x4b6d2b
call dword [section..00cfg]
push ebx
call ecx
add esp, 4
mov esi, dword [esp + 0x2b0]
mov edi, dword [esp + 0x2b4]
lea ebx, [esp + 0xa0]
mov ecx, ebx
push str.load_elf
call fcn.00547270
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x10], esi
mov eax, dword [0x5f83a4]
cmp eax, dword [0x5f83a8]
jae 0x4b6d84
mov ecx, dword [esp + 0xa8]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0xa0]
movsd qword [eax], xmm0
movq xmm0, qword [esp + 0xb0]
movq qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x5f83a4], eax
mov esi, dword [esp + 0x24]
jmp 0x4b6dac
mov ecx, 0x5f83a0
push ebx
call fcn.004bebf0
cmp byte [esp + 0xab], 0
mov esi, dword [esp + 0x24]
jns 0x4b6dac
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
cmp esi, 2
jne 0x4b8c60
push 0x56e690
call fcn.0051131b
add esp, 4
mov dword [0x6c0258], 1
mov byte [0x6c0254], 1
cmp dword [0x6cebcc], 0
jne 0x4b6de6
mov dword [0x6cebcc], fcn.004d1f90
xor edi, edi
push edi
push edi
call fcn.0040dc60
add esp, 8
mov esi, dword [0x6bedd8]
push esi
call fcn.004c04d0
add esp, 4
test al, al
jne 0x4b68d6
xor eax, eax
dec eax
lea edi, [esp + 0x58]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, esi
push 4
push str.type
push edi
call fcn.00500040
mov dword [esp + 0x10], edi
movzx eax, byte [edi + 0xb]
test al, al
mov dword [esp + 0xc], esi
jns 0x4b6e3d
mov eax, dword [esp + 0x5c]
jmp 0x4b6e40
and eax, 0x7f
test eax, eax
jne 0x4b6f13
push ebx
call fcn.005093a0
add esp, 4
mov esi, dword [esp + 0xa0]
mov ecx, dword [esp + 0xa4]
xor eax, eax
mov edx, esi
or edx, ecx
mov edx, 0
je 0x4b6f08
mov eax, esi
add eax, 0xffffffff
mov edx, ecx
adc edx, 0x7fffffff
mov edi, 0xb779bffd
cmp edi, eax
mov eax, 0xffd6a169
sbb eax, edx
mov edi, 0x7fffffff
jb 0x4b6ef0
add esi, 0xb779c000
adc ecx, 0xffd6a169
seto al
mov edi, ecx
sar edi, 0x1f
test al, al
cmovne esi, edi
add edi, 0x80000000
test al, al
cmove edi, ecx
xor ecx, ecx
dec ecx
add ecx, esi
mov eax, 0x7fffffff
adc eax, edi
add ecx, 2
mov dword [esp + 0x14], ecx
adc eax, 0
mov dword [esp + 0x1c], eax
push 0
push 0xf4240
push edi
push esi
call fcn.00517110
cmp dword [esp + 0x14], 2
sbb dword [esp + 0x1c], 0
cmovb edx, edi
cmovb eax, esi
jmp 0x4b6f08
xor esi, esi
dec esi
mov eax, esi
add eax, 1
mov edx, 0x7fffffff
adc edx, 0
test ecx, ecx
cmovns eax, esi
cmovns edx, edi
mov dword [0x5f8398], eax
mov dword [0x5f839c], edx
push str.chrome_elf.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test eax, eax
jne 0x4b6f59
lea esi, [esp + 0xa0]
mov ecx, esi
push str.chrome_elf.dll
call fcn.005477d0
mov ecx, esi
call fcn.004b9d00
mov edi, eax
cmp byte [esi + 0xb], 0
jns 0x4b6f55
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
test edi, edi
je 0x4b6f73
push str.SignalChromeElf
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b6f73
mov ecx, eax
call dword [section..00cfg]
call ecx
mov edi, 0x863
mov esi, 0x7bd05af7
mov ecx, dword [fcn.00509260]
cmp ecx, 0x50efc0
jne 0x4b705c
xor eax, eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa0], eax
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0xa0]
mov ebx, dword [esp + 0xa4]
cmp eax, esi
mov ecx, ebx
sbb ecx, edi
jl 0x4b903c
mov edi, dword [0x6c02b0]
mov ecx, dword [0x6c02b4]
mov dword [esp + 0x1c], ecx
push ecx
push edi
push ebx
push eax
mov dword [esp + 0x34], eax
call fcn.00517110
mov dword [esp + 0x18], ebx
mov ebx, eax
mov esi, edx
mov dword [esp + 0x14], edi
mul edi
mov ecx, ebx
imul ecx, dword [esp + 0x1c]
add edx, ecx
imul ecx, esi, 0xf4240
mov dword [esp + 0x20], ecx
imul esi, edi
add esi, edx
mov ecx, dword [esp + 0x24]
sub ecx, eax
mov edi, dword [esp + 0x18]
sbb edi, esi
mov edx, 0xf4240
mov eax, ebx
mul edx
mov ebx, 0xf4240
mov dword [esp + 0x18], eax
mov esi, edx
add esi, dword [esp + 0x20]
mov eax, ecx
mul ebx
imul ecx, edi, 0xf4240
add edx, ecx
push dword [esp + 0x1c]
push dword [esp + 0x18]
push edx
push eax
call fcn.00517110
mov edi, eax
mov ebx, edx
add edi, dword [esp + 0x18]
adc ebx, esi
mov dword [esp + 0x2b0], edi
mov dword [esp + 0x2b4], ebx
jmp 0x4b707d
call dword [section..00cfg]
lea eax, [esp + 0x2b0]
push eax
call ecx
add esp, 4
mov edi, dword [esp + 0x2b0]
mov ebx, dword [esp + 0x2b4]
lea esi, [esp + 0xa0]
mov ecx, esi
push str.chksig:elf
call fcn.00547270
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edi
mov eax, dword [0x5f83a4]
cmp eax, dword [0x5f83a8]
jae 0x4b70d4
mov ebx, esi
mov ecx, dword [esp + 0xa8]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0xa0]
movsd qword [eax], xmm0
movq xmm0, qword [esp + 0xb0]
movq qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x5f83a4], eax
jmp 0x4b70fa
mov ecx, 0x5f83a0
mov ebx, esi
push esi
call fcn.004bebf0
cmp byte [esp + 0xab], 0
jns 0x4b70fa
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
mov dword [esp + 0x54], 0xffffffff
pxor xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
mov dword [esp + 0x50], 0
mov esi, dword [0x6bedd4]
mov eax, esi
shr eax, 0xe
mov ecx, esi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x6c24fc]
bt ecx, eax
jb 0x4b902e
mov eax, esi
shr eax, 0x15
mov byte [eax + 0x6ca4fc], 1
lea eax, [esp + 0x40]
mov dword [eax + 0x14], esi
mov dword [0x6bedd4], eax
movzx eax, byte [esp + 0x63]
test al, al
jns 0x4b715b
mov ecx, dword [esp + 0x5c]
jmp 0x4b7160
mov ecx, eax
and ecx, 0x7f
mov esi, dword [esp + 0xc]
test ecx, ecx
je 0x4b7190
cmp ecx, 0xb
jne 0x4b7195
test al, al
jns 0x4b7179
mov eax, dword [esp + 0x58]
mov dword [esp + 0x10], eax
push 0xb
push str.gpu_process
push dword [esp + 0x18]
call fcn.0050fd3d
add esp, 0xc
test eax, eax
jne 0x4b7195
call fcn.0041da90
cmp dword [esi + 0x20], 1
ja 0x4b72b9
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
add eax, 0x1c
cmp ecx, eax
je 0x4b723f
movzx edx, byte [ecx + 0x1b]
test dl, dl
jns 0x4b71be
mov esi, dword [ecx + 0x14]
jmp 0x4b71c3
mov esi, edx
and esi, 0x7f
cmp esi, 0x11
jne 0x4b72b9
test dl, dl
jns 0x4b71d5
mov edx, dword [ecx + 0x10]
jmp 0x4b71d8
lea edx, [ecx + 0x10]
movdqu xmm0, xmmword [edx]
movdqu xmm1, xmmword [str.profile_directory]
pcmpeqb xmm1, xmm0
movzx edx, byte [edx + 0x10]
movzx esi, byte [0x5e2258]
movd xmm0, edx
movd xmm2, esi
pcmpeqb xmm2, xmm0
pand xmm2, xmm1
pmovmskb edx, xmm2
cmp edx, 0xffff
jne 0x4b72b9
test ecx, ecx
je 0x4b8bb1
mov esi, dword [ecx + 4]
test esi, esi
je 0x4b722c
mov edx, esi
mov esi, dword [esi]
test esi, esi
jne 0x4b7222
jmp 0x4b7235
mov edx, dword [ecx + 8]
cmp dword [edx], ecx
mov ecx, edx
jne 0x4b722c
mov ecx, edx
cmp edx, eax
jne 0x4b71b1
xor eax, eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa8], eax
push ebx
call fcn.0057fe50
add esp, 4
test al, al
je 0x4b72a0
push ebx
call fcn.0057f5b0
add esp, 4
test eax, eax
je 0x4b72a0
push eax
call fcn.0057f690
add esp, 4
mov esi, eax
cmp byte [esp + 0xab], 0
jns 0x4b7294
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
xor edi, edi
test esi, esi
je 0x4b75f8
jmp 0x4b72b9
cmp byte [esp + 0xab], 0
jns 0x4b72b9
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
mov ecx, dword [fcn.00509260]
cmp ecx, 0x50efc0
jne 0x4b73a2
xor eax, eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa0], eax
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [esp + 0xa0]
mov esi, dword [esp + 0xa4]
mov eax, 0x7bd05af7
cmp edx, eax
mov eax, esi
mov ecx, 0x863
sbb eax, ecx
jl 0x4b9067
mov edi, dword [0x6c02b0]
mov ecx, dword [0x6c02b4]
mov dword [esp + 0x1c], ecx
push ecx
push edi
push esi
push edx
mov dword [esp + 0x24], edx
call fcn.00517110
mov ebx, eax
mov dword [esp + 0x18], esi
mov esi, edx
mov dword [esp + 0x10], edi
mul edi
mov ecx, ebx
imul ecx, dword [esp + 0x1c]
add edx, ecx
imul ecx, esi, 0xf4240
mov dword [esp + 0x24], ecx
imul esi, edi
add esi, edx
mov edi, dword [esp + 0x14]
sub edi, eax
mov ecx, dword [esp + 0x18]
sbb ecx, esi
mov edx, 0xf4240
mov eax, ebx
mul edx
mov ebx, 0xf4240
mov dword [esp + 0x14], eax
mov esi, edx
add esi, dword [esp + 0x24]
mov eax, edi
mul ebx
imul ecx, ecx, 0xf4240
add edx, ecx
push dword [esp + 0x1c]
push dword [esp + 0x14]
push edx
push eax
call fcn.00517110
mov edi, eax
mov ebx, edx
add edi, dword [esp + 0x14]
adc ebx, esi
mov dword [esp + 0x2b0], edi
mov dword [esp + 0x2b4], ebx
jmp 0x4b73c3
call dword [section..00cfg]
lea eax, [esp + 0x2b0]
push eax
call ecx
add esp, 4
mov edi, dword [esp + 0x2b0]
mov ebx, dword [esp + 0x2b4]
lea esi, [esp + 0xa0]
mov ecx, esi
push str.1390
call fcn.00547270
mov dword [esi + 0x14], ebx
mov ebx, esi
mov dword [esi + 0x10], edi
mov eax, dword [0x5f83a4]
cmp eax, dword [0x5f83a8]
jae 0x4b741a
mov ecx, dword [esp + 0xa8]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0xa0]
movsd qword [eax], xmm0
movq xmm0, qword [esp + 0xb0]
movq qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x5f83a4], eax
jmp 0x4b743e
mov ecx, 0x5f83a0
push ebx
call fcn.004bebf0
cmp byte [esp + 0xab], 0
jns 0x4b743e
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
mov ecx, dword [esp + 0xc]
cmp dword [ecx + 0x20], 0
jne 0x4b74b7
xor esi, esi
push 0x20a
push esi
push ebx
call fcn.005191b0
add esp, 0xc
push esi
push 0x1a
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4b74a3
push ebx
call fcn.0052fcdf
add esp, 4
push ebx
call fcn.00510eb5
add esp, 4
cmp eax, 4
jb 0x4b74a3
push str.system32config_systemprofile
push ebx
call fcn.005196eb
add esp, 8
test eax, eax
jne 0x4b74a3
push 0x5d6e86
push ebx
call fcn.005196eb
add esp, 8
test eax, eax
je 0x4b74b3
call fcn.004c1d00
test al, al
je 0x4b74b3
xor edi, edi
jmp 0x4b75f8
mov ecx, dword [esp + 0xc]
lea ebx, [esp + 0x90]
xor eax, eax
dec eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
push 0xd
push str.windows10_f12
push ebx
call fcn.00500040
movzx eax, byte [ebx + 0xb]
mov ecx, eax
and ecx, 0x7f
test al, al
mov edx, dword [ebx + 4]
mov esi, ecx
cmovs esi, edx
test esi, esi
je 0x4b758a
test al, al
mov edi, dword [esp + 0x90]
cmovs ebx, edi
mov dword [esp + 0x1c], esi
add esi, ebx
dec esi
cmp ebx, esi
jae 0x4b7538
inc ebx
mov al, byte [ebx - 1]
mov cl, byte [esi]
mov byte [ebx - 1], cl
mov byte [esi], al
dec esi
lea eax, [ebx + 1]
cmp ebx, esi
mov ebx, eax
jb 0x4b7509
movzx eax, byte [esp + 0x9b]
mov edi, dword [esp + 0x90]
mov edx, dword [esp + 0x94]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs ecx, edx
lea esi, [esp + 0x80]
mov dword [esi], 0
lea ebx, [esp + 0x90]
cmovns edi, ebx
push esi
push ecx
push edi
call fcn.004f9e40
add esp, 0xc
mov edi, dword [esi]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4b757f
call fcn.004f9f70
mov eax, dword [0x6bfaf4]
cmp dword [eax], 7
jge 0x4b761d
mov al, byte [esp + 0x9b]
mov esi, dword [esp + 0x1c]
test al, al
jns 0x4b759d
push dword [esp + 0x90]
call fcn.0050fc7c
add esp, 4
xor edi, edi
test esi, esi
jne 0x4b75f8
call fcn.004c09c0
test al, al
jne 0x4b75f8
mov dword [esp + 0x1c], ebx
movzx eax, byte [esp + 0x63]
test al, al
jns 0x4b75bf
mov eax, dword [esp + 0x5c]
jmp 0x4b75c2
and eax, 0x7f
test eax, eax
lea eax, [esp + 0xa0]
jne 0x4b76da
mov byte [esp + 0xa0], 1
push eax
call fcn.004c0af0
add esp, 4
test al, al
je 0x4b76da
cmp byte [esp + 0xa0], 0
je 0x4b76da
lea ecx, [esp + 0x40]
call fcn.00563f20
cmp byte [esp + 0x63], 0
jns 0x4b68d6
push dword [esp + 0x58]
call fcn.0050fc7c
add esp, 4
jmp 0x4b68d6
xor esi, esi
lea ebx, [esp + 0x74]
mov dword [ebx], esi
push ebx
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, 0x104
push eax
push esi
lea edi, [esp + 0x2b8]
push edi
call fcn.005191b0
add esp, 0xc
push dword [esp + 0x80]
push dword [ebx]
push str._d__X
push edi
call fcn.00549ea0
add esp, 0x10
push 0x208
push esi
lea esi, [esp + 0xa8]
push esi
call fcn.005191b0
add esp, 0xc
mov eax, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.F12F12AppFrame.dll
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b76ce
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4b76ce
push str.AttachTools
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b76ce
mov ecx, eax
call dword [section..00cfg]
xor eax, eax
push eax
lea edx, [esp + 0x2b4]
push edx
push eax
push eax
call ecx
lea ebx, [esp + 0x90]
jmp 0x4b757f
mov ecx, dword [fcn.00509260]
cmp ecx, 0x50efc0
jne 0x4b77db
xor eax, eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [esp + 0xa0]
mov ecx, dword [esp + 0xa4]
mov eax, 0x7bd05af7
mov ebx, edx
cmp edx, eax
mov esi, ecx
mov eax, ecx
mov ecx, 0x863
sbb eax, ecx
jl 0x4b959b
mov eax, dword [0x6c02b0]
mov dword [esp + 0x14], eax
mov ecx, dword [0x6c02b4]
mov dword [esp + 0x10], ecx
push ecx
push eax
mov dword [esp + 0x20], esi
push esi
mov dword [esp + 0x30], ebx
push ebx
call fcn.00517110
mov esi, edx
mov ecx, eax
mov ebx, dword [esp + 0x14]
mul ebx
mov dword [esp + 0x28], eax
mov eax, ecx
imul ecx, dword [esp + 0x10]
add edx, ecx
imul ecx, esi, 0xf4240
mov dword [esp + 0x20], ecx
imul esi, ebx
add esi, edx
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x18]
sbb ebx, esi
mov edx, 0xf4240
mul edx
mov dword [esp + 0x18], eax
mov esi, edx
add esi, dword [esp + 0x20]
mov eax, ecx
mov ecx, 0xf4240
mul ecx
imul ecx, ebx, 0xf4240
add edx, ecx
push dword [esp + 0x10]
push dword [esp + 0x18]
push edx
push eax
call fcn.00517110
mov ebx, edx
add eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
adc ebx, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2b0], eax
mov dword [esp + 0x2b4], ebx
jmp 0x4b7800
call dword [section..00cfg]
lea eax, [esp + 0x2b0]
push eax
call ecx
add esp, 4
mov eax, dword [esp + 0x2b0]
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x2b4]
lea esi, [esp + 0xa0]
mov ecx, esi
push str.1433
call fcn.00547270
mov dword [esi + 0x14], ebx
mov ebx, esi
mov eax, dword [esp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [0x5f83a4]
cmp eax, dword [0x5f83a8]
jae 0x4b7872
movsd xmm0, qword [esp + 0xa0]
movsd qword [eax], xmm0
mov ecx, dword [esp + 0xa8]
mov dword [eax + 8], ecx
xor ecx, ecx
mov dword [esp + 0xa4], ecx
mov dword [esp + 0xa0], ecx
mov dword [esp + 0xa8], ecx
movq xmm0, qword [esp + 0xb0]
movq qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x5f83a4], eax
jmp 0x4b7896
mov ecx, 0x5f83a0
push ebx
call fcn.004bebf0
cmp byte [esp + 0xab], 0
jns 0x4b7896
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
mov ecx, dword [esp + 0xc]
push str.in_chromeie
call fcn.004fd6b0
test al, al
je 0x4b78ad
call fcn.004c2f90
movzx eax, byte [esp + 0x63]
test al, al
jns 0x4b78bc
mov eax, dword [esp + 0x5c]
jmp 0x4b78bf
and eax, 0x7f
test eax, eax
jne 0x4b78f8
mov ecx, dword [esp + 0xc]
push str.show_tray_icon_ex
call fcn.004fd6b0
test al, al
jne 0x4b7c19
call fcn.004c16f0
test eax, eax
je 0x4b78f8
mov ecx, dword [esp + 0xc]
push str.make_default_browser
call fcn.004fd6b0
test al, al
je 0x4b7ebc
mov ecx, dword [esp + 0xc]
push str.360seautoupdate
call fcn.004fd6b0
test al, al
jne 0x4b7962
mov ecx, dword [esp + 0xc]
push str.360se_safe_browsing_autoupdate
call fcn.004fd6b0
test al, al
jne 0x4b79a0
mov ecx, dword [esp + 0xc]
push str.360se_safe_browsing_white
call fcn.004fd6b0
test al, al
jne 0x4b79de
mov ecx, dword [esp + 0xc]
push str.secorepending
call fcn.004fd6b0
test al, al
jne 0x4b75f8
movzx eax, byte [esp + 0x63]
test al, al
jns 0x4b7aab
mov eax, dword [esp + 0x5c]
jmp 0x4b7aae
lea ecx, [esp + 0xa0]
xor ebx, ebx
dec ebx
mov dword [ecx + 0x24], ebx
mov dword [ecx + 0x20], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
push dword [esp + 0xc]
call fcn.00564360
lea esi, [esp + 0x2b0]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov ecx, esi
push str.v3autoupdate
jmp 0x4b7a1a
lea ecx, [esp + 0xa0]
xor ebx, ebx
dec ebx
mov dword [ecx + 0x24], ebx
mov dword [ecx + 0x20], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
push dword [esp + 0xc]
call fcn.00564360
lea esi, [esp + 0x2b0]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov ecx, esi
push str.v3safe_browsing_autoupdate
jmp 0x4b7a1a
lea ecx, [esp + 0xa0]
xor ebx, ebx
dec ebx
mov dword [ecx + 0x24], ebx
mov dword [ecx + 0x20], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
push dword [esp + 0xc]
call fcn.00564360
lea esi, [esp + 0x2b0]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov ecx, esi
push str.v3safe_browsing_white
call fcn.00547270
movzx eax, byte [esi + 0xb]
test al, al
jns 0x4b7a37
mov esi, dword [esp + 0x2b0]
mov eax, dword [esp + 0x2b4]
jmp 0x4b7a3a
and eax, 0x7f
lea ebx, [esp + 0xa0]
mov ecx, ebx
push 1
push 0x5d793c
push eax
push esi
call fcn.005495b0
lea esi, [esp + 0x90]
mov ecx, ebx
push esi
call fcn.00410210
push esi
push dword [ebp + 8]
call fcn.004c1900
add esp, 8
cmp byte [esi + 0xb], 0
jns 0x4b7a81
push dword [esp + 0x90]
call fcn.0050fc7c
add esp, 4
cmp byte [esp + 0x2bb], 0
jns 0x4b7a9a
push dword [esp + 0x2b0]
call fcn.0050fc7c
add esp, 4
lea ecx, [esp + 0xa0]
call fcn.005644d0
jmp 0x4b75f8
and eax, 0x7f
test eax, eax
jne 0x4b7b22
mov ecx, dword [esp + 0xc]
push str.360seautoupdate
call fcn.004fd6b0
test al, al
jne 0x4b7b22
mov ecx, dword [esp + 0xc]
push str.360se_safe_browsing_autoupdate
call fcn.004fd6b0
test al, al
jne 0x4b7b22
mov ecx, dword [esp + 0xc]
push str.360se_safe_browsing_white
call fcn.004fd6b0
test al, al
jne 0x4b7b22
mov ecx, dword [esp + 0xc]
push str.uninstall_cud_disabledlg
call fcn.004fd6b0
test al, al
jne 0x4b7b22
mov ecx, dword [esp + 0xc]
push str.make_default_browser
call fcn.004fd6b0
test al, al
jne 0x4b7b22
mov ecx, dword [esp + 0xc]
push 0x5d6fc3
call fcn.004fd6b0
test al, al
je 0x4b8848
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], 0
mov ecx, dword [fcn.00509260]
cmp ecx, 0x50efc0
jne 0x4b7c75
xor eax, eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa0], eax
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 0xa0]
mov ecx, dword [esp + 0xa4]
mov eax, 0x7bd05af7
mov ebx, esi
cmp esi, eax
mov edi, ecx
mov eax, ecx
mov ecx, 0x863
sbb eax, ecx
jl 0x4b9b17
mov eax, dword [0x6c02b0]
mov dword [esp + 0x14], eax
mov ecx, dword [0x6c02b4]
mov dword [esp + 0x10], ecx
push ecx
push eax
mov dword [esp + 0x28], edi
push edi
push ebx
call fcn.00517110
mov esi, edx
mov ecx, eax
mov edi, dword [esp + 0x14]
mul edi
mov dword [esp + 0x2c], eax
mov eax, ecx
imul ecx, dword [esp + 0x10]
add edx, ecx
imul ecx, esi, 0xf4240
mov dword [esp + 0x28], ecx
imul esi, edi
add esi, edx
sub ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x20]
sbb edi, esi
mov ecx, 0xf4240
mul ecx
mov dword [esp + 0x20], eax
mov esi, edx
add esi, dword [esp + 0x28]
mov eax, ebx
mul ecx
imul ecx, edi, 0xf4240
add edx, ecx
push dword [esp + 0x10]
push dword [esp + 0x18]
push edx
push eax
call fcn.00517110
mov ebx, eax
mov edi, edx
add ebx, dword [esp + 0x20]
adc edi, esi
mov dword [esp + 0x2b0], ebx
mov dword [esp + 0x2b4], edi
jmp 0x4b7c96
lea ebx, [esp + 0xa0]
mov ecx, ebx
push str.SeTrayNotify.dll
call fcn.005477d0
mov ecx, ebx
call fcn.004b9d00
mov esi, eax
cmp byte [ebx + 0xb], 0
jns 0x4b7c4a
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
test esi, esi
je 0x4b75f8
push str.ForceShowTrayIcon
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b75f8
mov ecx, eax
call dword [section..00cfg]
call ecx
jmp 0x4b75f8
call dword [section..00cfg]
lea eax, [esp + 0x2b0]
push eax
call ecx
add esp, 4
mov ebx, dword [esp + 0x2b0]
mov edi, dword [esp + 0x2b4]
lea esi, [esp + 0xa0]
mov ecx, esi
push str.handle_cmdline
call fcn.00547270
mov dword [esi + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esi + 0x10], ebx
mov eax, dword [0x5f83a4]
cmp eax, dword [0x5f83a8]
jae 0x4b7d06
movsd xmm0, qword [esp + 0xa0]
movsd qword [eax], xmm0
mov ecx, dword [esp + 0xa8]
mov dword [eax + 8], ecx
xor ecx, ecx
mov dword [esp + 0xa4], ecx
mov dword [esp + 0xa0], ecx
mov dword [esp + 0xa8], ecx
movq xmm0, qword [esp + 0xb0]
movq qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x5f83a4], eax
jmp 0x4b7d31
mov ecx, 0x5f83a0
lea eax, [esp + 0xa0]
push eax
call fcn.004bebf0
cmp byte [esp + 0xab], 0
jns 0x4b7d31
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
movzx eax, byte [esp + 0x63]
test al, al
jns 0x4b7d40
mov eax, dword [esp + 0x5c]
jmp 0x4b7d43
and eax, 0x7f
test eax, eax
je 0x4b8236
mov ecx, dword [esp + 0xc]
push str.in_chromeie
call fcn.004fd6b0
test al, al
jne 0x4b8236
movzx eax, byte [esp + 0x63]
test al, al
jns 0x4b7d70
mov ecx, dword [esp + 0x5c]
jmp 0x4b7d75
mov ecx, eax
and ecx, 0x7f
cmp ecx, 8
je 0x4b7e36
test ecx, ecx
jne 0x4b7fbb
mov eax, dword [0x6bedd8]
mov dword [esp + 0xc], eax
xor ebx, ebx
push ebx
push str.360se6_Frame
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x4b84f1
mov dword [esp + 0x90], ebx
lea ecx, [esp + 0x90]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor esi, esi
dec esi
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], esi
push ebx
push dword [esp + 0x94]
lea eax, [esp + 0xa8]
push eax
call fcn.00575820
add esp, 0xc
mov dword [esp + 0x2b0], esi
mov dword [esp + 0x2b4], esi
mov dword [esp + 0x2b8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
push eax
lea eax, [esp + 0x2b8]
push eax
call fcn.00575820
add esp, 0xc
movzx eax, byte [esp + 0xab]
test al, al
jns 0x4b837f
mov edx, dword [esp + 0xa4]
jmp 0x4b8384
test al, al
jns 0x4b7f77
mov eax, dword [esp + 0x58]
jmp 0x4b7f7b
call fcn.00578a50
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
xor ecx, ecx
test esi, esi
mov edx, 0x5d773c
mov edi, 0x5d7014
cmove edi, edx
mov ebx, str.Main_program_file_that_the_360se_has_been_damaged__not_the_original_file.__r_nFor_your_safe__the_program_will_automatically_exit.__r_nSuggest_you_re_install__and_the_Trojan_scan.
mov edx, str.Main_program_file_that_the_360se_has_been_damaged__not_the_original_file.__r_nFor_your_safe__the_program_will_automatically_exit.__r_nSuggest_you_re_install__and_the_Trojan_scan._Download_the_latest_version_
cmove edx, ebx
movzx eax, ax
setne cl
cmp eax, 0x804
cmove edx, edi
mov eax, 0x5d7728
mov edi, str.Tips
cmove edi, eax
lea eax, [ecx*4 + 0x40]
push eax
push edi
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
test esi, esi
je 0x4b7eb5
cmp eax, 6
jne 0x4b7eb5
push str.http:__se.360.cn_
call fcn.00578b70
add esp, 4
push 0
call fcn.00527b55
lea ecx, [esp + 0xa0]
xor esi, esi
dec esi
mov dword [ecx + 0x24], esi
mov dword [ecx + 0x20], esi
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
push dword [esp + 0xc]
call fcn.00564360
lea ecx, [esp + 0x2b0]
mov dword [ecx], esi
mov dword [ecx + 4], esi
mov dword [ecx + 8], esi
push str.v3pendupdate
call fcn.00547270
lea ecx, [esp + 0x90]
mov dword [ecx], esi
mov dword [ecx + 4], esi
mov dword [ecx + 8], esi
mov dword [esp + 0x14], ecx
push str.v3reboot
call fcn.00547270
lea ecx, [esp + 0x80]
mov dword [ecx], esi
mov dword [ecx + 4], esi
mov dword [ecx + 8], esi
mov dword [esp + 0x18], ecx
push str.v3highprivilidge
call fcn.00547270
lea ecx, [esp + 0x74]
mov dword [ecx], esi
mov dword [ecx + 4], esi
mov dword [ecx + 8], esi
mov dword [esp + 0x10], ecx
push str.v3seProcId
call fcn.00547270
lea eax, [esp + 0x2b0]
mov esi, eax
movzx eax, byte [eax + 0xb]
test al, al
jns 0x4b814a
mov esi, dword [esp + 0x2b0]
mov eax, dword [esp + 0x2b4]
jmp 0x4b814d
lea eax, [esp + 0x58]
mov ecx, 0x646e6572
xor ecx, dword [eax]
mov edx, 0x72657265
xor edx, dword [eax + 4]
or edx, ecx
jne 0x4b7fbb
mov ecx, dword [esp + 0xc]
push str.360se_crash_renderer
call fcn.004fd6b0
test al, al
je 0x4b7fbb
mov ecx, dword [esp + 0xc]
push str.no_sandbox
call fcn.004fd6b0
mov edi, 0x360
test al, al
je 0x4b75f8
mov ebx, 0x863
push 0x14
call fcn.00510d64
add esp, 4
pxor xmm0, xmm0
movdqu xmmword [eax + 4], xmm0
mov dword [esp + 0xc], eax
mov dword [eax], 0x5d58a8
mov ecx, dword [fcn.00509260]
cmp ecx, 0x50efc0
jne 0x4b80ac
xor eax, eax
lea esi, [esp + 0xa0]
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [esi]
mov ecx, dword [esi + 4]
mov eax, 0x7bd05af7
mov esi, edx
cmp edx, eax
mov edi, ecx
mov eax, ecx
sbb eax, ebx
jl 0x4b9b44
mov eax, dword [0x6c02b0]
mov dword [esp + 0x10], eax
mov ecx, dword [0x6c02b4]
mov dword [esp + 0x1c], ecx
push ecx
push eax
mov dword [esp + 0x1c], edi
push edi
mov edi, esi
push esi
call fcn.00517110
mov ebx, edx
mov ecx, eax
mov esi, dword [esp + 0x10]
mul esi
mov dword [esp + 0x24], eax
mov eax, ecx
imul ecx, dword [esp + 0x1c]
add edx, ecx
imul ecx, ebx, 0xf4240
mov dword [esp + 0x18], ecx
imul ebx, esi
add ebx, edx
sub edi, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
sbb esi, ebx
mov ecx, 0xf4240
mul ecx
mov dword [esp + 0x14], eax
mov ebx, edx
add ebx, dword [esp + 0x18]
mov eax, edi
mul ecx
imul ecx, esi, 0xf4240
add edx, ecx
push dword [esp + 0x1c]
push dword [esp + 0x14]
push edx
push eax
call fcn.00517110
add eax, dword [esp + 0x14]
adc edx, ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
jmp 0x4b80c1
call dword [section..00cfg]
lea esi, [esp + 0x38]
push esi
call ecx
add esp, 4
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov esi, dword [esp + 0xc]
mov ecx, esi
push edx
push eax
push dword [ebp + 8]
call fcn.004bf6b0
mov edi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x4b810f
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 0x13]
test cl, cl
jns 0x4b80ed
mov ecx, dword [esp + 0xc]
mov ecx, dword [ecx + 0xc]
test ecx, ecx
jne 0x4b810f
push str.RelaunchChromeBrowserWithNewCommandLineIfNeeded
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b9b6d
mov ecx, eax
call dword [section..00cfg]
call ecx
cmp dword [esp + 0xc], 0
je 0x4b891d
mov eax, dword [esp + 0xc]
mov dword [eax], 0x5d58a0
cmp byte [eax + 0x13], 0
jns 0x4b8139
mov eax, dword [esp + 0xc]
push dword [eax + 8]
call fcn.0050fc7c
add esp, 4
push dword [esp + 0xc]
call fcn.0050fc7c
add esp, 4
jmp 0x4b891d
and eax, 0x7f
xor edx, edx
inc edx
lea ecx, [esp + 0xa0]
push edx
mov edx, 0x5d793c
push edx
push eax
push esi
call fcn.005495b0
movzx eax, byte [esp + 0x9b]
test al, al
jns 0x4b8185
mov eax, dword [esp + 0x90]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x94]
jmp 0x4b8188
and eax, 0x7f
lea ecx, [esp + 0xa0]
xor edx, edx
inc edx
push edx
mov edx, 0x5d793c
push edx
push eax
push dword [esp + 0x20]
call fcn.005495b0
xor eax, eax
lea esi, [esp + 0x4b8]
mov dword [esi + 4], eax
mov dword [esi], eax
mov word [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x5d6f20
push esi
call fcn.00549ea0
add esp, 0xc
push esi
call fcn.005338e0
add esp, 4
movzx edx, byte [esp + 0x7f]
test dl, dl
jns 0x4b81ec
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x78]
jmp 0x4b81ef
and edx, 0x7f
lea ecx, [esp + 0xa0]
push eax
push esi
push edx
push dword [esp + 0x1c]
call fcn.005495b0
call fcn.0054efc0
test eax, eax
je 0x4b83c3
movzx eax, byte [esp + 0x8b]
test al, al
jns 0x4b83a8
mov eax, dword [esp + 0x80]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
jmp 0x4b83ab
push 0x14
call fcn.00510d64
add esp, 4
mov ebx, eax
pxor xmm0, xmm0
movdqu xmmword [eax + 4], xmm0
mov dword [eax], 0x5d58a8
xor eax, eax
lea edx, [esp + 0x2b0]
mov dword [edx + 4], eax
mov dword [edx], eax
mov dword [edx + 8], eax
lea esi, [esp + 0x90]
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
mov ecx, ebx
push esi
push edx
call fcn.004bf0a0
test ebx, ebx
je 0x4b829e
mov dword [ebx], 0x5d58a0
cmp byte [ebx + 0x13], 0
jns 0x4b8295
push dword [ebx + 8]
call fcn.0050fc7c
add esp, 4
push ebx
call fcn.0050fc7c
add esp, 4
mov ecx, dword [fcn.00509260]
cmp ecx, 0x50efc0
jne 0x4b85b0
xor eax, eax
lea esi, [esp + 0xa0]
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [esi]
mov ecx, dword [esi + 4]
mov eax, 0x7bd05af7
mov edi, edx
cmp edx, eax
mov ebx, ecx
mov eax, ecx
mov ecx, 0x863
sbb eax, ecx
jl 0x4b9b70
mov eax, dword [0x6c02b0]
mov dword [esp + 0x20], eax
mov ecx, dword [0x6c02b4]
mov dword [esp + 0x14], ecx
push ecx
push eax
mov dword [esp + 0x30], ebx
push ebx
mov ebx, edi
push edi
call fcn.00517110
mov esi, edx
mov ecx, eax
mov edi, dword [esp + 0x20]
mul edi
mov dword [esp + 0x30], eax
mov eax, ecx
imul ecx, dword [esp + 0x14]
add edx, ecx
imul ecx, esi, 0xf4240
mov dword [esp + 0x2c], ecx
imul esi, edi
add esi, edx
sub ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
sbb edi, esi
mov ecx, 0xf4240
mul ecx
mov dword [esp + 0x28], eax
mov esi, edx
add esi, dword [esp + 0x2c]
mov eax, ebx
mul ecx
imul ecx, edi, 0xf4240
add edx, ecx
push dword [esp + 0x14]
push dword [esp + 0x24]
push edx
push eax
call fcn.00517110
mov ebx, eax
mov edi, edx
add ebx, dword [esp + 0x28]
adc edi, esi
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], edi
jmp 0x4b85c8
mov edx, eax
and edx, 0x7f
movzx ecx, byte [esp + 0x2bb]
test edx, edx
je 0x4b84bc
test cl, cl
jns 0x4b8470
mov edi, dword [esp + 0x2b4]
jmp 0x4b8475
and eax, 0x7f
lea ecx, [esp + 0xa0]
push 1
push 0x5d793c
push eax
push dword [esp + 0x24]
call fcn.005495b0
lea esi, [esp + 0x68]
lea ecx, [esp + 0xa0]
push esi
call fcn.00410210
push esi
push dword [ebp + 8]
call fcn.004c1900
add esp, 8
mov dword [esp + 0x10], eax
cmp byte [esi + 0xb], 0
jns 0x4b83f6
push dword [esp + 0x68]
call fcn.0050fc7c
add esp, 4
cmp byte [esp + 0x7f], 0
jns 0x4b8409
push dword [esp + 0x74]
call fcn.0050fc7c
add esp, 4
cmp byte [esp + 0x8b], 0
jns 0x4b8422
push dword [esp + 0x80]
call fcn.0050fc7c
add esp, 4
cmp byte [esp + 0x9b], 0
jns 0x4b843b
push dword [esp + 0x90]
call fcn.0050fc7c
add esp, 4
cmp byte [esp + 0x2bb], 0
jns 0x4b8454
push dword [esp + 0x2b0]
call fcn.0050fc7c
add esp, 4
lea ecx, [esp + 0xa0]
call fcn.005644d0
cmp dword [esp + 0x10], 0
jne 0x4b78f8
jmp 0x4b74ac
mov edi, ecx
and edi, 0x7f
cmp edx, edi
jne 0x4b84ba
test cl, cl
jns 0x4b8488
mov esi, dword [esp + 0x2b0]
mov dword [esp + 0x34], esi
test al, al
jns 0x4b8497
mov esi, dword [esp + 0xa0]
mov dword [esp + 0x10], esi
dec edx
xor edi, edi
mov esi, dword [esp + 0x10]
movzx ebx, word [esi + edi*2]
mov esi, dword [esp + 0x34]
cmp bx, word [esi + edi*2]
sete bl
jne 0x4b84bc
lea esi, [edi + 1]
cmp edx, edi
mov edi, esi
jne 0x4b849a
jmp 0x4b84bc
xor ebx, ebx
test cl, cl
jns 0x4b84d6
push dword [esp + 0x2b0]
call fcn.0050fc7c
add esp, 4
mov al, byte [esp + 0xab]
test al, al
jns 0x4b84e9
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
test bl, bl
jne 0x4b88da
mov ecx, dword [esp + 0xc]
push str.uninstall_cud_disabledlg
call fcn.004fd6b0
test al, al
jne 0x4b88da
mov ecx, dword [esp + 0xc]
push str.set_adfilter_mode
call fcn.004fd6b0
test al, al
jne 0x4b88da
mov ecx, dword [esp + 0xc]
push str.uninstall
call fcn.004fd6b0
test al, al
jne 0x4b88da
mov ecx, dword [esp + 0xc]
push str.make_default_browser
call fcn.004fd6b0
test al, al
jne 0x4b88da
mov ecx, dword [esp + 0xc]
push str.disable_precreate_frame
call fcn.004fd6b0
test al, al
jne 0x4b88da
mov ecx, dword [esp + 0xc]
push str.no_startup_window
call fcn.004fd6b0
test al, al
jne 0x4b88da
lea edi, [esp + 0xa0]
xor eax, eax
dec eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, dword [esp + 0xc]
push 0xe
push str.silent_install
push edi
call fcn.0050a790
movzx eax, byte [edi + 0xb]
test al, al
jns 0x4b88a0
mov ecx, dword [esp + 0xa4]
jmp 0x4b88a5
call dword [section..00cfg]
lea esi, [esp + 0x80]
push esi
call ecx
add esp, 4
mov ebx, dword [esi]
mov edi, dword [esi + 4]
lea esi, [esp + 0xa0]
mov ecx, esi
push str.main_dll_loader:get_dll_info
call fcn.00547270
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov eax, dword [0x5f83a4]
cmp eax, dword [0x5f83a8]
jae 0x4b8634
movsd xmm0, qword [esp + 0xa0]
movsd qword [eax], xmm0
mov ecx, dword [esp + 0xa8]
mov dword [eax + 8], ecx
xor ecx, ecx
mov dword [esp + 0xa4], ecx
mov dword [esp + 0xa0], ecx
mov dword [esp + 0xa8], ecx
movq xmm0, qword [esp + 0xb0]
movq qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x5f83a4], eax
jmp 0x4b8658
mov ecx, 0x5f83a0
push esi
call fcn.004bebf0
cmp byte [esp + 0xab], 0
jns 0x4b8658
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
lea ecx, [esp + 0x90]
push 0xb
push 0x5d77c2
call fcn.00410600
cmp byte [eax + 0xb], 0
jns 0x4b8673
mov eax, dword [eax]
push eax
call fcn.004d27e0
add esp, 4
mov ecx, dword [fcn.00509260]
cmp ecx, 0x50efc0
jne 0x4b8765
xor eax, eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa0], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [esp + 0xa0]
mov ecx, dword [esp + 0xa4]
mov eax, 0x7bd05af7
mov edi, edx
cmp edx, eax
mov ebx, ecx
mov eax, ecx
mov ecx, 0x863
sbb eax, ecx
jl 0x4b9b9d
mov eax, dword [0x6c02b0]
mov dword [esp + 0x20], eax
mov ecx, dword [0x6c02b4]
mov dword [esp + 0x14], ecx
push ecx
push eax
mov dword [esp + 0x30], ebx
push ebx
mov ebx, edi
push edi
call fcn.00517110
mov esi, edx
mov ecx, eax
mov edi, dword [esp + 0x20]
mul edi
mov dword [esp + 0x30], eax
mov eax, ecx
imul ecx, dword [esp + 0x14]
add edx, ecx
imul ecx, esi, 0xf4240
mov dword [esp + 0x2c], ecx
imul esi, edi
add esi, edx
sub ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
sbb edi, esi
mov ecx, 0xf4240
mul ecx
mov dword [esp + 0x28], eax
mov esi, edx
add esi, dword [esp + 0x2c]
mov eax, ebx
mul ecx
imul ecx, edi, 0xf4240
add edx, ecx
push dword [esp + 0x14]
push dword [esp + 0x24]
push edx
push eax
call fcn.00517110
mov ebx, eax
mov edi, edx
add ebx, dword [esp + 0x28]
adc edi, esi
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], edi
jmp 0x4b877d
call dword [section..00cfg]
lea esi, [esp + 0x80]
push esi
call ecx
add esp, 4
mov ebx, dword [esi]
mov edi, dword [esi + 4]
lea esi, [esp + 0xa0]
mov ecx, esi
push str.chksig:360base
call fcn.00547270
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov eax, dword [0x5f83a4]
cmp eax, dword [0x5f83a8]
jae 0x4b87e9
movsd xmm0, qword [esp + 0xa0]
movsd qword [eax], xmm0
mov ecx, dword [esp + 0xa8]
mov dword [eax + 8], ecx
xor ecx, ecx
mov dword [esp + 0xa4], ecx
mov dword [esp + 0xa0], ecx
mov dword [esp + 0xa8], ecx
movq xmm0, qword [esp + 0xb0]
movq qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x5f83a4], eax
jmp 0x4b880d
mov ecx, 0x5f83a0
push esi
call fcn.004bebf0
cmp byte [esp + 0xab], 0
jns 0x4b880d
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
cmp byte [esp + 0x9b], 0
jns 0x4b8826
push dword [esp + 0x90]
call fcn.0050fc7c
add esp, 4
cmp byte [esp + 0x2bb], 0
jns 0x4b7d61
push dword [esp + 0x2b0]
call fcn.0050fc7c
add esp, 4
jmp 0x4b7d61
call fcn.0054fe90
mov esi, eax
test al, al
jne 0x4b8888
mov byte [0x5f8390], 1
mov dword [esp + 0xa0], 0
push ebx
call fcn.0054f670
add esp, 4
mov eax, dword [esp + 0xa0]
or eax, 4
mov dword [esp + 0xa0], eax
push eax
call fcn.004c3930
add esp, 4
mov eax, esi
xor al, 1
mov dword [esp + 0x18], eax
call fcn.00550010
mov al, 1
mov dword [esp + 0x24], eax
jmp 0x4b7b32
mov ecx, eax
and ecx, 0x7f
cmp ecx, 5
jne 0x4b88bd
test al, al
jns 0x4b88b5
mov edi, dword [esp + 0xa0]
mov bl, 1
cmp word [edi], 0x33
je 0x4b88bf
xor ebx, ebx
test al, al
jns 0x4b88d2
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
test bl, bl
je 0x4b899d
push dword [ebp + 8]
call fcn.004b9e10
add esp, 4
mov edi, eax
cmp byte [esp + 0x24], 0
je 0x4b88f3
call fcn.0054ff50
cmp byte [esp + 0x18], 0
je 0x4b890f
mov eax, dword [0x5f845c]
test eax, eax
je 0x4b890f
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
movzx eax, byte [esp + 0x63]
test al, al
jns 0x4b892c
mov ecx, dword [esp + 0x5c]
jmp 0x4b8931
mov ecx, eax
and ecx, 0x7f
cmp ecx, 5
je 0x4b8949
cmp ecx, 7
jne 0x4b75f8
test al, al
jns 0x4b8953
mov eax, dword [esp + 0x58]
jmp 0x4b8957
test al, al
jns 0x4b896a
mov eax, dword [esp + 0x58]
jmp 0x4b896e
lea eax, [esp + 0x58]
mov ecx, dword [eax]
xor ecx, dword [str.utility]
mov eax, dword [eax + 3]
xor eax, dword [0x5da000]
jmp 0x4b8982
lea eax, [esp + 0x58]
mov ecx, dword [eax]
xor ecx, dword [str.ppapi]
mov al, byte [eax + 4]
xor al, byte [0x5d9ff6]
movzx eax, al
or eax, ecx
jne 0x4b75f8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4b75f8
xor edi, edi
lea esi, [esp + 0xa0]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
lea ebx, [esp + 0x2b0]
mov dword [ebx], 0xffffffff
mov ecx, esi
push 0x2001f
push ebx
push 0x5d7482
push 0x80000001
call fcn.0056f9f0
mov eax, 4
mov dword [ebx], eax
mov dword [esp + 0x90], eax
lea ecx, [esp + 0x80]
mov dword [ecx], edi
mov esi, dword [esi]
lea eax, [esp + 0x90]
push eax
mov dword [esp + 0x18], ecx
push ecx
mov dword [esp + 0x18], ebx
push ebx
push edi
push str.clean_snap_shot
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b8a35
mov eax, dword [esp + 0x2b0]
add eax, 0xfffffffd
cmp eax, 1
ja 0x4b8a35
cmp dword [esp + 0x90], 4
jne 0x4b8a35
cmp dword [esp + 0x80], 1
je 0x4b8bb4
test esi, esi
je 0x4b8a40
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [esp + 0xa8]
test ebx, ebx
jne 0x4b9bca
mov ecx, dword [esp + 0xc]
push str.programid
call fcn.004fd6b0
test al, al
jne 0x4b88da
xor eax, eax
dec eax
mov dword [esp + 0x4b8], eax
mov dword [esp + 0x4bc], eax
mov dword [esp + 0x4c0], eax
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0xa0]
push eax
call fcn.0041c3b0
mov ebx, dword [esp + 0xa0]
mov eax, dword [esp + 0xa4]
mov ecx, eax
sub ecx, ebx
cmp ecx, 0xc
je 0x4b8ceb
xor eax, eax
mov dword [esp + 0x4bc], eax
mov dword [esp + 0x4b8], eax
mov dword [esp + 0x4c0], eax
test ebx, ebx
je 0x4b8b02
mov eax, dword [esp + 0xa4]
mov ecx, ebx
cmp eax, ebx
je 0x4b8af2
lea edi, [eax - 0xc]
cmp byte [eax - 1], 0
jns 0x4b8ae5
push dword [eax - 0xc]
call fcn.0050fc7c
add esp, 4
mov eax, edi
cmp edi, ebx
jne 0x4b8ad1
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa4], ebx
push ecx
call fcn.0050fc7c
add esp, 4
movzx ecx, byte [esp + 0x4c3]
test cl, cl
jns 0x4b8b42
mov eax, dword [esp + 0x4bc]
jmp 0x4b8b47
mov ecx, 0xf4240
mul ecx
imul ecx, edi, 0xf4240
add ecx, edx
push dword [0x6c02b4]
push dword [0x6c02b0]
push ecx
push eax
call fcn.00517110
mov edi, eax
mov ebx, edx
jmp 0x4b69e1
mov eax, ecx
and eax, 0x7f
test eax, eax
je 0x4b9864
test cl, cl
jns 0x4b8b5c
mov esi, dword [esp + 0x4b8]
jmp 0x4b8b63
lea esi, [esp + 0x4b8]
cmp eax, 3
jl 0x4b9864
lea edi, [esi + eax]
mov ebx, esi
add eax, 0xfffffffe
push eax
push 0x3a
push ebx
call fcn.0050fc90
add esp, 0xc
test eax, eax
je 0x4b9864
mov ebx, eax
movzx eax, word [eax]
xor eax, 0x2f3a
movzx ecx, byte [ebx + 2]
xor ecx, 0x2f
or cx, ax
je 0x4b8c63
inc ebx
mov eax, edi
sub eax, ebx
cmp eax, 3
jge 0x4b8b71
jmp 0x4b9864
int3
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.clean_snap_shot
push esi
call edi
push 0x5d74d8
push esi
call edi
push 0x5d74de
push esi
call edi
xor eax, eax
lea edi, [esp + 0x2b0]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
lea eax, [esp + 0x90]
mov dword [eax], 0xffffffff
mov ecx, edi
push 0x2001f
push eax
push 0x5d74e4
push 0x80000001
call fcn.0056f9f0
mov ecx, edi
push str.ui_persist_value
call fcn.0056fa90
mov eax, dword [edi]
test eax, eax
je 0x4b8c20
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [esp + 0x2b8]
test ebx, ebx
jne 0x4b9be1
test esi, esi
je 0x4b8c3a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0xa8]
test esi, esi
je 0x4b88da
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 1
call edi
jmp 0x4b88da
int3
cmp ebx, edi
je 0x4b9864
sub ebx, esi
cmp ebx, 0xffffffff
je 0x4b9864
lea edi, [esp + 0xa0]
xor eax, eax
dec eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
lea eax, [esp + 0x4c4]
lea edx, [esp + 0x4b8]
mov ecx, edi
mov esi, eax
push eax
push ebx
push 0
mov dword [esp + 0x2c], edx
push edx
call fcn.0040ef40
movzx eax, byte [edi + 0xb]
test al, al
jns 0x4b8ece
mov ecx, dword [esp + 0xa4]
jmp 0x4b8ed3
mov ecx, 0xf4240
mul ecx
imul ecx, edi, 0xf4240
add ecx, edx
push dword [0x6c02b4]
push dword [0x6c02b0]
push ecx
push eax
call fcn.00517110
mov esi, eax
mov edi, edx
jmp 0x4b6d01
xor ecx, ecx
dec ecx
mov dword [esp + 0x2b0], ecx
mov dword [esp + 0x2b4], ecx
mov dword [esp + 0x2b8], ecx
cmp eax, ebx
je 0x4b9bf8
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4b8d1a
mov eax, dword [ebx + 4]
mov ebx, dword [ebx]
jmp 0x4b8d1d
and eax, 0x7f
lea esi, [esp + 0x2b0]
mov ecx, esi
push eax
push ebx
call fcn.0040e660
xor eax, eax
mov ecx, esi
push eax
push eax
call fcn.00501f10
cmp eax, 0xffffffff
jne 0x4b9bfb
lea edi, [esp + 0x90]
xor eax, eax
dec eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
lea ecx, [esp + 0x2b0]
push edi
call fcn.00567940
movzx ebx, byte [edi + 0xb]
test bl, bl
jns 0x4b8d78
mov edi, dword [esp + 0x90]
mov ebx, dword [esp + 0x94]
jmp 0x4b8d7b
and ebx, 0x7f
mov ecx, 6
mov eax, str._t_v_f__n_r
push 0
push ecx
push eax
push ebx
push edi
call fcn.005082b0
add esp, 0x14
mov esi, eax
xor eax, eax
dec eax
push eax
mov eax, 6
push eax
mov eax, str._t_v_f__n_r
push eax
push ebx
push edi
call fcn.00508410
add esp, 0x14
cmp esi, ebx
cmovb ebx, esi
add ebx, edi
je 0x4b9c0f
push ebx
call fcn.005338e0
add esp, 4
lea esi, [esp + 0x90]
mov ecx, esi
push eax
push ebx
call fcn.00508180
lea ebx, [esp + 0x80]
mov ecx, ebx
push str.https:__
call fcn.00547270
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4b8e00
mov ebx, dword [esp + 0x80]
mov eax, dword [esp + 0x84]
jmp 0x4b8e03
and eax, 0x7f
movzx ecx, byte [esp + 0x9b]
test cl, cl
jns 0x4b8e1f
mov esi, dword [esp + 0x90]
mov ecx, dword [esp + 0x94]
jmp 0x4b8e22
and ecx, 0x7f
push 1
push eax
push ebx
push ecx
push esi
call fcn.00504de0
add esp, 0x14
test al, al
je 0x4b9094
xor ebx, ebx
cmp byte [esp + 0x8b], 0
jns 0x4b8e53
push dword [esp + 0x80]
call fcn.0050fc7c
add esp, 4
test bl, bl
je 0x4b8e89
xor eax, eax
mov dword [esp + 0x4bc], eax
mov dword [esp + 0x4b8], eax
mov dword [esp + 0x4c0], eax
cmp byte [esp + 0x9b], 0
jns 0x4b8ea9
push dword [esp + 0x90]
call fcn.0050fc7c
add esp, 4
jmp 0x4b8ea9
mov eax, dword [esp + 0x98]
mov dword [esp + 0x4c0], eax
movq xmm0, qword [esp + 0x90]
movq qword [esp + 0x4b8], xmm0
cmp byte [esp + 0x2bb], 0
jns 0x4b8ec2
push dword [esp + 0x2b0]
call fcn.0050fc7c
add esp, 4
mov ebx, dword [esp + 0xa0]
jmp 0x4b8ac0
mov ecx, eax
and ecx, 0x7f
cmp ecx, 5
je 0x4b8efd
cmp ecx, 4
jne 0x4b8ef0
test al, al
jns 0x4b8ee8
mov edi, dword [esp + 0xa0]
cmp dword [edi], 0x70747468
je 0x4b8f23
mov dword [esp + 0x10], 0
jmp 0x4b9848
test al, al
jns 0x4b8f0a
mov ecx, dword [esp + 0xa0]
jmp 0x4b8f11
lea ecx, [esp + 0xa0]
mov edx, 0x70747468
xor edx, dword [ecx]
movzx ecx, byte [ecx + 4]
xor ecx, 0x73
or ecx, edx
jne 0x4b8ef0
add ebx, 3
xor eax, eax
dec eax
mov dword [esp + 0x2b0], eax
mov dword [esp + 0x2b4], eax
mov dword [esp + 0x2b8], eax
lea edi, [esp + 0x2b0]
mov ecx, edi
push esi
push eax
push ebx
lea eax, [esp + 0x4c4]
push eax
call fcn.0040ef40
movzx ecx, byte [esp + 0x2bb]
mov eax, ecx
and eax, 0x7f
mov dword [esp + 0x2c], ecx
test cl, cl
mov ecx, dword [esp + 0x2b0]
mov edx, dword [esp + 0x2b4]
mov esi, edi
mov dword [esp + 0x28], ecx
cmovs esi, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], edx
cmovs eax, edx
test eax, eax
jle 0x4b8fb9
lea edi, [esi + eax]
mov ebx, esi
push eax
push 0x2f
push ebx
call fcn.0050fc90
add esp, 0xc
test eax, eax
je 0x4b8fb9
mov ebx, eax
cmp byte [eax], 0x2f
je 0x4b9101
inc ebx
mov eax, edi
sub eax, ebx
test eax, eax
jg 0x4b8f95
xor eax, eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x98], eax
cmp byte [esp + 0x2c], 0
lea eax, [esp + 0x2b0]
mov ecx, dword [esp + 0x28]
cmovns ecx, eax
mov eax, dword [esp + 0x34]
cmovs eax, dword [esp + 0x30]
push 1
push 8
push str.e.so.com
push eax
push ecx
call fcn.0050b420
add esp, 0x14
test al, al
jne 0x4b9274
movzx eax, byte [esp + 0x2bb]
test al, al
jns 0x4b90bd
mov eax, dword [esp + 0x2b0]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2b4]
jmp 0x4b90c0
push esi
call fcn.004e3a80
add esp, 4
jmp 0x4b7140
mov ecx, 0xf4240
mul ecx
imul ecx, ebx, 0xf4240
add ecx, edx
push dword [0x6c02b4]
push dword [0x6c02b0]
push ecx
push eax
call fcn.00517110
mov edi, eax
mov ebx, edx
jmp 0x4b704c
mov ecx, 0xf4240
mov eax, edx
mul ecx
imul ecx, esi, 0xf4240
add ecx, edx
push dword [0x6c02b4]
push dword [0x6c02b0]
push ecx
push eax
call fcn.00517110
mov edi, eax
mov ebx, edx
jmp 0x4b7392
lea ebx, [esp + 0x74]
mov ecx, ebx
push str.http:__
call fcn.00547270
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4b91fb
mov ebx, dword [esp + 0x74]
mov eax, dword [esp + 0x78]
jmp 0x4b91fe
and eax, 0x7f
push 1
push 0xb
push str..mediav.com
push eax
push dword [esp + 0x20]
call fcn.0050b420
add esp, 0x14
test al, al
jne 0x4b9274
movzx eax, byte [esp + 0x2bb]
test al, al
jns 0x4b924f
mov ecx, dword [esp + 0x2b0]
mov eax, dword [esp + 0x2b4]
jmp 0x4b9259
xor eax, eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x98], eax
cmp ebx, edi
je 0x4b8fd0
sub ebx, esi
cmp ebx, 0xffffffff
je 0x4b8fd0
lea edi, [esp + 0x2bc]
lea ecx, [esp + 0x80]
push edi
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x2bc]
push eax
call fcn.0040ef40
cmp byte [esp + 0x9b], 0
jns 0x4b9163
push dword [esp + 0x90]
call fcn.0050fc7c
add esp, 4
lea ecx, [esp + 0x80]
mov eax, dword [ecx + 8]
mov dword [esp + 0x98], eax
movsd xmm0, qword [ecx]
movsd qword [esp + 0x90], xmm0
push edi
push ebx
push 0
lea eax, [esp + 0x2bc]
push eax
call fcn.0040ef40
cmp byte [esp + 0x2bb], 0
jns 0x4b91ab
push dword [esp + 0x2b0]
call fcn.0050fc7c
add esp, 4
mov eax, dword [esp + 0x88]
mov dword [esp + 0x2b8], eax
movq xmm0, qword [esp + 0x80]
movq qword [esp + 0x2b0], xmm0
movzx ecx, byte [esp + 0x2bb]
mov eax, dword [esp + 0x2b0]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2b4]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
mov eax, ecx
and eax, 0x7f
mov dword [esp + 0x34], eax
jmp 0x4b8fd0
and eax, 0x7f
movzx ecx, byte [esp + 0x9b]
test cl, cl
jns 0x4b921a
mov edx, dword [esp + 0x90]
mov ecx, dword [esp + 0x94]
jmp 0x4b9224
and ecx, 0x7f
lea edx, [esp + 0x90]
push 1
push eax
push ebx
push ecx
push edx
call fcn.00504de0
add esp, 0x14
mov ebx, eax
cmp byte [esp + 0x7f], 0
jns 0x4b9247
push dword [esp + 0x74]
call fcn.0050fc7c
add esp, 4
xor bl, 1
jmp 0x4b8e3a
and eax, 0x7f
lea ecx, [esp + 0x2b0]
push 1
push 9
push str.tf.360.cn
push eax
push ecx
call fcn.0050b420
add esp, 0x14
test al, al
je 0x4b9304
movzx ecx, byte [esp + 0x4c3]
test cl, cl
jns 0x4b9294
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x4bc]
jmp 0x4b9297
and ecx, 0x7f
cmp ecx, 7
jl 0x4b9807
mov eax, dword [esp + 0x20]
lea edi, [eax + ecx]
mov esi, 0x4d515f5f
mov ebx, 0x5f5f4d4d
add ecx, 0xfffffffa
push ecx
push 0x5f
push eax
call fcn.0050fc90
add esp, 0xc
test eax, eax
je 0x4b9807
mov ecx, dword [eax]
xor ecx, esi
mov edx, dword [eax + 3]
xor edx, ebx
or edx, ecx
je 0x4b92e4
inc eax
mov ecx, edi
sub ecx, eax
cmp ecx, 7
jge 0x4b92b1
jmp 0x4b9807
cmp eax, edi
je 0x4b9807
sub eax, dword [esp + 0x20]
mov cl, 1
mov dword [esp + 0x10], ecx
cmp eax, 0xffffffff
jne 0x4b980f
jmp 0x4b9807
movzx ecx, byte [esp + 0x2bb]
test cl, cl
jns 0x4b9320
mov edi, dword [esp + 0x2b0]
mov esi, dword [esp + 0x2b4]
jmp 0x4b932e
mov eax, ecx
and eax, 0x7f
mov esi, eax
lea edi, [esp + 0x2b0]
mov eax, esi
cmp esi, 0xc
jne 0x4b9516
xor edx, edx
movzx ebx, byte [edx + str.so.mp.360.cn]
movzx eax, byte [edi + edx]
mov ecx, eax
add cl, 0xbf
mov ch, al
add ch, 0x20
cmp cl, 0x1a
movzx ecx, ch
cmovae ecx, eax
mov eax, ebx
add al, 0xbf
mov ah, bl
add ah, 0x20
cmp al, 0x1a
movzx eax, ah
cmovae eax, ebx
cmp cl, al
jne 0x4b9516
inc edx
mov eax, esi
cmp esi, edx
jne 0x4b933b
movzx eax, byte [esp + 0x9b]
test al, al
jns 0x4b9399
mov eax, dword [esp + 0x90]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x94]
jmp 0x4b939c
and eax, 0x7f
test eax, eax
jle 0x4b9807
mov edi, dword [esp + 0x1c]
lea esi, [edi + eax]
push eax
push 0x3f
push edi
call fcn.0050fc90
add esp, 0xc
test eax, eax
je 0x4b9807
mov edi, eax
cmp byte [eax], 0x3f
je 0x4b93dc
inc edi
mov eax, esi
sub eax, edi
mov dword [esp + 0x10], 0
test eax, eax
jg 0x4b93ab
jmp 0x4b980f
mov dword [esp + 0x10], 0
cmp edi, esi
je 0x4b980f
sub edi, dword [esp + 0x1c]
cmp edi, 0xffffffff
je 0x4b980f
xor eax, eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x88], eax
lea ebx, [esp + 0x9c]
lea esi, [esp + 0x90]
lea ecx, [esp + 0x74]
push ebx
push 0xffffffffffffffff
push edi
push esi
call fcn.0040ef40
cmp byte [esp + 0x8b], 0
jns 0x4b9445
push dword [esp + 0x80]
call fcn.0050fc7c
add esp, 4
lea ecx, [esp + 0x74]
mov eax, dword [ecx + 8]
mov dword [esp + 0x88], eax
movsd xmm0, qword [ecx]
movsd qword [esp + 0x80], xmm0
push ebx
push edi
push 0
push esi
call fcn.0040ef40
cmp byte [esp + 0x9b], 0
jns 0x4b9483
push dword [esp + 0x90]
call fcn.0050fc7c
add esp, 4
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x98], eax
movq xmm0, qword [esp + 0x74]
movq qword [esp + 0x90], xmm0
cmp byte [esp + 0x9b], 0
jns 0x4b94ae
mov esi, dword [esp + 0x90]
test esi, esi
je 0x4b9c12
push esi
call fcn.005338e0
add esp, 4
mov edi, eax
cmp eax, 8
je 0x4b95ca
cmp edi, 7
jne 0x4b97da
xor ecx, ecx
movzx edx, byte [ecx + str._mp.htm]
movzx eax, byte [esi + ecx]
mov ebx, eax
add bl, 0xbf
mov bh, al
add bh, 0x20
cmp bl, 0x1a
movzx ebx, bh
cmovae ebx, eax
mov eax, edx
add al, 0xbf
mov ah, dl
add ah, 0x20
cmp al, 0x1a
movzx eax, ah
cmovae eax, edx
cmp bl, al
jne 0x4b97da
inc ecx
cmp edi, ecx
jne 0x4b94d5
jmp 0x4b9608
lea ebx, [esp + 0x80]
xor eax, eax
dec eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
lea edi, [esp + 0x74]
mov ecx, edi
push str.360APP084DFF939E0341E6AD76B20424999C4E
call fcn.00547270
lea edx, [esp + 0x4b8]
mov ecx, ebx
push edi
call fcn.004bab20
add esp, 4
cmp byte [edi + 0xb], 0
jns 0x4b955c
push dword [esp + 0x74]
call fcn.0050fc7c
add esp, 4
movzx eax, byte [esp + 0x8b]
test al, al
jns 0x4b9571
mov ecx, dword [esp + 0x84]
jmp 0x4b9576
mov ecx, eax
and ecx, 0x7f
cmp ecx, 0x15
jae 0x4b9686
test al, al
jns 0x4b9807
push dword [esp + 0x80]
call fcn.0050fc7c
add esp, 4
jmp 0x4b9807
mov ecx, 0xf4240
mov eax, ebx
mul ecx
imul ecx, esi, 0xf4240
add ecx, edx
push dword [0x6c02b4]
push dword [0x6c02b0]
push ecx
push eax
call fcn.00517110
mov dword [esp + 0x10], eax
mov ebx, edx
jmp 0x4b77c7
xor ecx, ecx
movzx edx, byte [ecx + str._mp.html]
movzx eax, byte [esi + ecx]
mov ebx, eax
add bl, 0xbf
mov bh, al
add bh, 0x20
cmp bl, 0x1a
movzx ebx, bh
cmovae ebx, eax
mov eax, edx
add al, 0xbf
mov ah, dl
add ah, 0x20
cmp al, 0x1a
movzx eax, ah
cmovae eax, edx
cmp bl, al
jne 0x4b97da
inc ecx
cmp edi, ecx
jne 0x4b95cc
movzx eax, byte [esp + 0x8b]
mov dword [esp + 0x1c], eax
test al, al
jns 0x4b962c
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x84]
jmp 0x4b9633
mov edi, dword [esp + 0x1c]
and edi, 0x7f
cmp edi, 7
jl 0x4b97da
mov eax, dword [esp + 0x14]
lea ebx, [eax + edi]
mov ecx, edi
mov esi, 0x3d646970
add ecx, 0xfffffffa
push ecx
push 0x3f
push eax
call fcn.0050fc90
add esp, 0xc
test eax, eax
je 0x4b978f
mov ecx, dword [eax]
mov edx, 0x7070613f
xor ecx, edx
mov edx, dword [eax + 3]
xor edx, esi
or edx, ecx
je 0x4b9782
inc eax
mov ecx, ebx
sub ecx, eax
cmp ecx, 7
jge 0x4b964a
jmp 0x4b978f
mov ecx, edi
push 0x5d75b3
call fcn.00547270
lea ebx, [esp + 0x68]
mov ecx, ebx
push 0x5d75b5
call fcn.00547270
lea ecx, [esp + 0x80]
mov edx, ebx
push edi
call fcn.004bb120
add esp, 4
cmp byte [ebx + 0xb], 0
jns 0x4b96c6
push dword [esp + 0x68]
call fcn.0050fc7c
add esp, 4
cmp byte [esp + 0x7f], 0
jns 0x4b96d9
push dword [esp + 0x74]
call fcn.0050fc7c
add esp, 4
mov ecx, edi
push 0x5d75b9
call fcn.00547270
lea ebx, [esp + 0x68]
mov ecx, ebx
push 0x5d75bb
call fcn.00547270
lea ecx, [esp + 0x80]
mov edx, ebx
push edi
call fcn.004bb120
add esp, 4
cmp byte [ebx + 0xb], 0
jns 0x4b9719
push dword [esp + 0x68]
call fcn.0050fc7c
add esp, 4
cmp byte [esp + 0x7f], 0
jns 0x4b972c
push dword [esp + 0x74]
call fcn.0050fc7c
add esp, 4
lea edi, [esp + 0x74]
xor eax, eax
dec eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, ebx
push str.appid
call fcn.00547270
lea edx, [esp + 0x80]
mov ecx, edi
push ebx
call fcn.004bab20
add esp, 4
cmp byte [esp + 0x73], 0
jns 0x4b976c
push dword [esp + 0x68]
call fcn.0050fc7c
add esp, 4
movzx eax, byte [esp + 0x7f]
test al, al
jns 0x4b9abd
mov ecx, dword [esp + 0x78]
jmp 0x4b9ac2
cmp eax, ebx
je 0x4b978f
sub eax, dword [esp + 0x14]
cmp eax, 0xffffffff
jne 0x4b97d6
mov esi, 0x3d646970
mov eax, dword [esp + 0x14]
add edi, 0xfffffffa
push edi
push 0x26
push eax
call fcn.0050fc90
add esp, 0xc
test eax, eax
je 0x4b97da
mov ecx, dword [eax]
mov edx, 0x70706126
xor ecx, edx
mov edx, dword [eax + 3]
xor edx, esi
or edx, ecx
je 0x4b97c9
inc eax
mov edi, ebx
sub edi, eax
cmp edi, 7
jge 0x4b9798
jmp 0x4b97da
cmp eax, ebx
je 0x4b97da
sub eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4b97da
xor ebx, ebx
jmp 0x4b97e7
mov bl, 1
mov al, byte [esp + 0x8b]
mov dword [esp + 0x1c], eax
cmp byte [esp + 0x1c], 0
jns 0x4b97fd
push dword [esp + 0x80]
call fcn.0050fc7c
add esp, 4
mov al, 1
mov dword [esp + 0x10], eax
test bl, bl
je 0x4b980f
mov dword [esp + 0x10], 0
cmp byte [esp + 0x9b], 0
jns 0x4b9828
push dword [esp + 0x90]
call fcn.0050fc7c
add esp, 4
cmp byte [esp + 0x2bb], 0
jns 0x4b9841
push dword [esp + 0x2b0]
call fcn.0050fc7c
add esp, 4
mov al, byte [esp + 0xab]
test al, al
jns 0x4b985b
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
mov bl, 1
cmp byte [esp + 0x10], 0
jne 0x4b9866
xor ebx, ebx
cmp byte [esp + 0x4c3], 0
jns 0x4b987f
push dword [esp + 0x4b8]
call fcn.0050fc7c
add esp, 4
test bl, bl
jne 0x4b88da
mov ecx, dword [esp + 0xc]
push 0x5d6fc3
call fcn.004fd6b0
test al, al
jne 0x4b88da
mov ecx, dword [esp + 0xc]
push 0x5e2232
call fcn.004fd6b0
test al, al
jne 0x4b88da
mov eax, dword [ebp + 8]
mov dword [0x5f83ac], eax
xor edi, edi
call fcn.0041c270
mov esi, 0
test al, al
jne 0x4b98e3
sub esp, 0x10
movdqa xmm0, xmmword [0x5d6dd0]
movdqu xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
mov dword [esp + 0xa0], edi
lea eax, [esp + 0xa0]
push eax
push edi
push esi
push 0x4be970
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4b991f
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [fcn.00509260]
cmp ecx, 0x50efc0
jne 0x4b9a09
xor eax, eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 0xa0]
mov ecx, dword [esp + 0xa4]
mov eax, 0x7bd05af7
mov edx, esi
cmp esi, eax
mov esi, ecx
mov eax, ecx
mov ecx, 0x863
sbb eax, ecx
jl 0x4b9c15
mov ebx, dword [0x6c02b0]
mov dword [esp + 0x10], ebx
mov eax, dword [0x6c02b4]
mov dword [esp + 0xc], eax
push eax
push ebx
mov dword [esp + 0x24], esi
push esi
mov esi, edx
push edx
call fcn.00517110
mov ecx, eax
mov edi, edx
mul ebx
mov ebx, ecx
imul ebx, dword [esp + 0xc]
add edx, ebx
imul ebx, edi, 0xf4240
mov dword [esp + 0x20], ebx
imul edi, dword [esp + 0x10]
add edi, edx
sub esi, eax
sbb dword [esp + 0x1c], edi
mov edi, 0xf4240
mov eax, ecx
mul edi
mov dword [esp + 0x14], eax
mov ebx, edx
add ebx, dword [esp + 0x20]
mov eax, esi
mul edi
imul ecx, dword [esp + 0x1c], 0xf4240
add edx, ecx
push dword [esp + 0xc]
push dword [esp + 0x14]
push edx
push eax
call fcn.00517110
mov esi, eax
mov edi, edx
add esi, dword [esp + 0x14]
adc edi, ebx
mov dword [esp + 0x2b0], esi
mov dword [esp + 0x2b4], edi
jmp 0x4b9a21
call dword [section..00cfg]
lea edi, [esp + 0x2b0]
push edi
call ecx
add esp, 4
mov esi, dword [edi]
mov edi, dword [edi + 4]
lea ebx, [esp + 0xa0]
mov ecx, ebx
push str.presetui
call fcn.00547270
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x10], esi
mov eax, dword [0x5f83a4]
cmp eax, dword [0x5f83a8]
jae 0x4b9a90
movsd xmm0, qword [esp + 0xa0]
movsd qword [eax], xmm0
mov ecx, dword [esp + 0xa8]
mov dword [eax + 8], ecx
xor ecx, ecx
mov dword [esp + 0xa4], ecx
mov dword [esp + 0xa0], ecx
mov dword [esp + 0xa8], ecx
movq xmm0, qword [esp + 0xb0]
movq qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x5f83a4], eax
jmp 0x4b88da
mov ecx, 0x5f83a0
push ebx
call fcn.004bebf0
cmp byte [esp + 0xab], 0
jns 0x4b88da
push dword [esp + 0xa0]
call fcn.0050fc7c
add esp, 4
jmp 0x4b88da
mov ecx, eax
and ecx, 0x7f
cmp ecx, 0x12
jne 0x4b9afb
test al, al
jns 0x4b9ad7
push dword [esp + 0x74]
call fcn.0050fc7c
add esp, 4
cmp byte [esp + 0x8b], 0
jns 0x4b9af0
push dword [esp + 0x80]
call fcn.0050fc7c
add esp, 4
mov al, 1
mov dword [esp + 0x10], eax
jmp 0x4b980f
test al, al
jns 0x4b9b0b
push dword [esp + 0x74]
call fcn.0050fc7c
add esp, 4
mov al, byte [esp + 0x8b]
jmp 0x4b957f
mov ecx, 0xf4240
mov eax, ebx
mul ecx
imul ecx, edi, 0xf4240
add ecx, edx
push dword [0x6c02b4]
push dword [0x6c02b0]
push ecx
push eax
call fcn.00517110
mov ebx, eax
mov edi, edx
jmp 0x4b7c09
mov ecx, 0xf4240
mov eax, esi
mul ecx
imul ecx, edi, 0xf4240
add ecx, edx
push dword [0x6c02b4]
push dword [0x6c02b0]
push ecx
push eax
call fcn.00517110
jmp 0x4b80a2
int3
mov ecx, 0xf4240
mov eax, edi
mul ecx
imul ecx, ebx, 0xf4240
add ecx, edx
push dword [0x6c02b4]
push dword [0x6c02b0]
push ecx
push eax
call fcn.00517110
mov ebx, eax
mov edi, edx
jmp 0x4b836c
mov ecx, 0xf4240
mov eax, edi
mul ecx
imul ecx, ebx, 0xf4240
add ecx, edx
push dword [0x6c02b4]
push dword [0x6c02b0]
push ecx
push eax
call fcn.00517110
mov ebx, eax
mov edi, edx
jmp 0x4b8755
mov eax, dword [ebx]
mov esi, dword [eax]
mov ecx, esi
call dword [section..00cfg]
mov ecx, ebx
push 1
call esi
jmp 0x4b8a4f
mov eax, dword [ebx]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
push 1
call edi
jmp 0x4b8c2f
int3
lea ecx, [esp + 0x2b0]
push 0xffffffffffffffff
push eax
call fcn.00561c50
jmp 0x4b8d41
int3
int3
mov ecx, 0xf4240
mov eax, edx
mul ecx
imul ecx, esi, 0xf4240
add ecx, edx
push dword [0x6c02b4]
push dword [0x6c02b0]
push ecx
push eax
call fcn.00517110
mov esi, eax
mov edi, edx
jmp 0x4b99f9