Function at 0x51b4e0
Capabilities:
Delete registry value
Read .ini file
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x54c8
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x54c4], eax
mov eax, dword [esp + 0x54d0]
mov ecx, dword [esp + 0x54d8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x54dc]
xor ebx, ebx
push 0x207
lea edx, [esp + 0x13a5]
push ebx
push edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov byte [esp + 0x13ac], bl
call fcn.005dfd60
push 0x207
lea eax, [esp + 0x11a9]
push ebx
push eax
mov byte [esp + 0x11b0], bl
call fcn.005dfd60
push 0x207
lea ecx, [esp + 0xda5]
push ebx
push ecx
mov byte [esp + 0xdac], bl
call fcn.005dfd60
push 0x207
lea edx, [esp + 0x1ae5]
push ebx
push edx
mov byte [esp + 0x1aec], bl
call fcn.005dfd60
push 0x207
lea eax, [esp + 0x1f01]
push ebx
push eax
mov byte [esp + 0x1f08], bl
call fcn.005dfd60
push 0x207
lea ecx, [esp + 0x15e9]
push ebx
push ecx
mov byte [esp + 0x15f0], bl
call fcn.005dfd60
add esp, 0x48
push 0x207
lea edx, [esp + 0xf95]
push ebx
push edx
mov byte [esp + 0xf9c], bl
call fcn.005dfd60
push 0x207
lea eax, [esp + 0x1cd5]
push ebx
push eax
mov byte [esp + 0x1cdc], bl
call fcn.005dfd60
push 0x207
lea ecx, [esp + 0x18d1]
push ebx
push ecx
mov byte [esp + 0x18d8], bl
call fcn.005dfd60
push 0x103
lea edx, [esp + 0x17d9]
push ebx
push edx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x17e0], bl
call fcn.005dfd60
push 0x103
push ebx
lea eax, [esp + 0x2e5]
mov byte [esp + 0x2e4], bl
push eax
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0x835]
push ebx
push ecx
mov byte [esp + 0x83c], bl
call fcn.005dfd60
add esp, 0x48
push 0x103
lea edx, [esp + 0x8fd]
push ebx
push edx
mov byte [esp + 0x904], bl
call fcn.005dfd60
push 0x103
lea eax, [esp + 0xa0d]
push ebx
push eax
mov byte [esp + 0xa14], bl
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0xca1]
push ebx
push ecx
mov byte [esp + 0xca8], bl
call fcn.005dfd60
xor esi, esi
add esp, 0x24
mov dword [esp + 0x18], ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x54], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea edx, [esp + 0x9fc]
mov ebp, eax
push edx
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x28], ebx
call fcn.004ef9d0
cmp eax, 1
je 0x51b6fe
lea eax, [esp + 0x9fc]
push eax
call fcn.004efb60
push 0x208
lea ecx, [esp + 0xf94]
push ecx
lea edx, [esp + 0xa04]
push edx
call fcn.004e82a0
add esp, 0xc
lea eax, [esp + 0xf90]
push eax
lea ecx, [esp + 0xa00]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0x9fc], bl
je 0x51b769
lea eax, [esp + 0x9fc]
inc eax
cmp byte [eax], bl
jne 0x51b741
lea edx, [esp + 0x9fc]
sub eax, edx
je 0x51b769
cmp byte [esp + eax + 0x9fb], 0x5c
je 0x51b769
push 0x66da34
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0xc84]
push ecx
call fcn.004eefa0
add esp, 4
cmp eax, ebx
je 0x51b85a
cmp byte [esp + 0xc84], bl
je 0x51b85a
lea edx, [esp + 0xc84]
push edx
call fcn.004e24e0
add esp, 4
lea eax, [esp + 0xc84]
push eax
lea ecx, [esp + 0x8fc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x8f8]
push edx
call fcn.004e24e0
add esp, 4
push str.mailscan.ini
lea eax, [esp + 0x8fc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
push ebx
push ebx
push ebx
lea ecx, [esp + 0x908]
push ebx
push ecx
call fcn.004e8950
add esp, 0x18
test eax, eax
je 0x51b7fa
mov byte [esp + 0x8f8], bl
jmp 0x51b82d
push 0x208
lea edx, [esp + 0xf94]
push edx
lea eax, [esp + 0xc8c]
push eax
call fcn.004e82a0
add esp, 0xc
lea ecx, [esp + 0xf90]
push ecx
lea edx, [esp + 0xc88]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0xc84], bl
je 0x51b85a
lea eax, [esp + 0xc84]
push eax
lea ecx, [esp + 0xa00]
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x51b85a
mov dword [esp + 0x24], 1
cmp dword [esp + 0x54ec], ebx
je 0x51b877
mov edx, dword [esp + 0x20]
push edx
push edi
push str._CBD__BDC_s__CVD_s_
push ebx
call fcn.004f0f30
add esp, 0x10
lea eax, [esp + 0x17b0]
push eax
call fcn.004ef9d0
test eax, eax
je 0x51b996
lea ecx, [esp + 0x17b0]
push ecx
lea edx, [esp + 0x2b0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0x2ac], bl
je 0x51b8de
lea eax, [esp + 0x2ac]
inc eax
cmp byte [eax], bl
jne 0x51b8b2
lea ecx, [esp + 0x2ac]
sub eax, ecx
je 0x51b8de
cmp byte [esp + eax + 0x2ab], 0x5c
je 0x51b8de
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x66da34
mov edx, ecx
push edx
call edi
jmp 0x51b8e4
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.eupdate.ini
lea eax, [esp + 0x2b0]
push eax
call edi
push 1
push ebx
push ebx
push ebx
lea ecx, [esp + 0x2bc]
push ebx
push ecx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x51b915
mov dword [esp + 0x18], 1
lea edx, [esp + 0x17b0]
push edx
lea eax, [esp + 0x7f8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0x7f4], bl
je 0x51b964
lea eax, [esp + 0x7f4]
jmp 0x51b940
inc eax
cmp byte [eax], bl
jne 0x51b940
lea ecx, [esp + 0x7f4]
sub eax, ecx
je 0x51b964
cmp byte [esp + eax + 0x7f3], 0x5c
je 0x51b964
push 0x66da34
mov edx, ecx
push edx
call edi
push str.iupdate.ini
lea eax, [esp + 0x7f8]
push eax
call edi
push 1
push ebx
push ebx
push ebx
lea ecx, [esp + 0x804]
push ebx
push ecx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x51b996
mov esi, 1
mov dword [esp + 0x34], esi
cmp dword [esp + 0x54ec], ebx
je 0x51b9bb
mov eax, dword [esp + 0x18]
push esi
lea edx, [esp + 0x2b0]
push edx
push eax
push str._CBD__EUI_d__EI_s__IUI_d
push ebx
call fcn.004f0f30
add esp, 0x14
cmp dword [0x690ad8], 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jne 0x51beb9
call fcn.004f0de0
mov esi, dword [esp + 0x54ec]
mov dword [0x690ad8], eax
cmp esi, ebx
je 0x51b9f7
push eax
push str._CBD__SMBCorp_d
push ebx
call fcn.004f0f30
mov eax, dword [0x690ad8]
add esp, 0xc
cmp eax, ebx
je 0x51bdc9
push 0x103
lea ecx, [esp + 0x6f5]
push ebx
push ecx
mov byte [esp + 0x6fc], bl
call fcn.005dfd60
push ebx
push 0x104
lea edx, [esp + 0x704]
push edx
push 0x60c81c
push str.server
push 0x60c810
call fcn.004edfd0
add esp, 0x24
cmp byte [esp + 0x6f0], 0x30
jne 0x51bccd
push 0x8000
mov dword [0x74fb00], 1
call fcn.005e20e4
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x51bab9
push 0x8000
push esi
push ebp
mov byte [esi], bl
call fcn.005035a0
cmp byte [esi], bl
je 0x51bab0
push ebx
push 0x634d2c
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x51bab0
cmp dword [esp + 0x54ec], ebx
je 0x51baa6
push str._CBD__UpdatesFromInternet__TRUE___i_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [0x74fafc], 1
push esi
call fcn.005e0865
add esp, 4
cmp dword [0x74fafc], ebx
jne 0x51bc9e
push 0x103
lea eax, [esp + 0x3e9]
push ebx
push eax
mov byte [esp + 0x3f0], bl
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0xb11]
push ebx
push ecx
mov byte [esp + 0xb18], bl
call fcn.005dfd60
lea edx, [esp + 0xb18]
push edx
call fcn.0050c480
mov ebp, dword [esp + 0x5508]
add esp, 0x1c
mov esi, eax
cmp ebp, ebx
je 0x51bb2d
lea eax, [esp + 0xb00]
push eax
push esi
push str._CBD__FromCloud___u__CH___s_
push ebx
call fcn.004f0f30
add esp, 0x10
cmp dword [0x74fafc], ebx
jne 0x51bca5
lea ecx, [esp + 0x2ac]
push ecx
push 0x104
lea edx, [esp + 0x3ec]
push edx
push 0x60cf3c
push str.SecServer
push 0x60da74
call edi
cmp byte [esp + 0x3e4], 0x31
jne 0x51bbc9
cmp ebp, ebx
je 0x51bb7b
push str._CBD__SecServer__1
push ebx
call fcn.004f0f30
add esp, 8
lea eax, [esp + 0x2ac]
push eax
push 0x104
lea ecx, [esp + 0x3ec]
push ecx
push 0x615678
push str.SecServerAVUpdateFromInternet
push 0x60da74
call edi
cmp byte [esp + 0x3e4], 0x31
jne 0x51bbb6
cmp ebp, ebx
je 0x51bc0b
push str._CBD__UpdatesFromInternet__TRUE__SecServerAVUpdateFromInternet_
jmp 0x51bc02
cmp esi, ebx
je 0x51bca5
cmp ebp, ebx
je 0x51bc0b
push str._CBD__UpdatesFromInternet__TRUE__FromCloud_
jmp 0x51bc02
lea edx, [esp + 0x2ac]
push edx
push 0x104
lea eax, [esp + 0x3ec]
push eax
push 0x60c81c
push str.SecServerAVUpdateFromInternet
push 0x60da74
call edi
cmp byte [esp + 0x3e4], 0x32
jne 0x51bc1a
cmp ebp, ebx
je 0x51bc0b
push str._CBD__UpdatesFromInternet__TRUE__SecServerAVUpdateFromInternet2_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [0x74fafc], 1
jmp 0x51bca5
cmp esi, ebx
je 0x51bca5
push 0x3ff
lea ecx, [esp + 0x2cd9]
push ebx
push ecx
mov byte [esp + 0x2ce0], bl
call fcn.005dfd60
add esp, 0xc
lea edx, [esp + 0x2ac]
push edx
push 0x400
lea eax, [esp + 0x2cdc]
push eax
push 0x60c81c
push str.httphost
push 0x60da74
call edi
cmp byte [esp + 0x2cd4], bl
je 0x51bca5
push ebx
lea ecx, [esp + 0xb04]
push ecx
lea edx, [esp + 0x2cdc]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x51bca5
cmp ebp, ebx
je 0x51bc0b
push str._CBD__UpdatesFromInternet__TRUE__FromCloudHost_
jmp 0x51bc02
mov ebp, dword [esp + 0x54ec]
cmp ebp, ebx
je 0x51beb9
mov eax, dword [0x74fafc]
mov ecx, dword [0x74fb00]
push eax
push ecx
push str._CBD__EI1_d__EI2_d
push ebx
call fcn.004f0f30
add esp, 0x10
jmp 0x51beb9
cmp dword [esp + 0x18], ebx
je 0x51beb9
push 0x3ff
lea edx, [esp + 0x28d9]
push ebx
push edx
mov byte [esp + 0x28e0], bl
call fcn.005dfd60
add esp, 0xc
lea eax, [esp + 0x2ac]
push eax
push 0x400
lea ecx, [esp + 0x28dc]
push ecx
push 0x60c81c
push str.DownloadFromAnotherServer
push 0x60da74
call edi
cmp byte [esp + 0x28d4], 0x31
jne 0x51beb9
lea edx, [esp + 0x2ac]
push edx
push 0x400
lea eax, [esp + 0x28dc]
push eax
push 0x60c81c
push str.httphost
push 0x60da74
call edi
push ebx
lea ecx, [esp + 0x28d8]
push str.mwti.
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x51beb9
push ebx
lea edx, [esp + 0x28d8]
push str.escanav.
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x51beb9
push ebx
lea eax, [esp + 0x28d8]
push str.microworldsystems.
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x51beb9
mov dword [0x74fb00], 1
cmp esi, ebx
je 0x51beb9
push 1
push str._CBD__EI4_d
jmp 0x51beb0
cmp dword [esp + 0x18], ebx
je 0x51bf38
push 0x103
lea ecx, [esp + 0x3e9]
push ebx
push ecx
mov byte [esp + 0x3f0], bl
call fcn.005dfd60
add esp, 0xc
lea edx, [esp + 0x2ac]
push edx
push 0x104
lea eax, [esp + 0x3ec]
push eax
push 0x60c81c
push str.DownloadFromAnotherServer
push 0x60da74
call edi
cmp byte [esp + 0x3e4], 0x31
jne 0x51beb9
lea ecx, [esp + 0x2ac]
push ecx
push 0x104
lea edx, [esp + 0x3ec]
push edx
push 0x60c81c
push str.httphost
push 0x60da74
call edi
push ebx
lea eax, [esp + 0x3e8]
push str.mwti.
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x51beb9
push ebx
lea ecx, [esp + 0x3e8]
push str.escanav.
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x51beb9
push ebx
lea edx, [esp + 0x3e8]
push str.microworldsystems.
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x51beb9
mov dword [0x74fb00], 1
cmp esi, ebx
je 0x51beb9
push 1
push str._CBD__EI5_d
push ebx
call fcn.004f0f30
add esp, 0xc
cmp dword [0x690ad8], ebx
je 0x51bf38
cmp dword [esp + 0x18], ebx
je 0x51bf38
push 0x103
lea eax, [esp + 0x6f5]
push ebx
push eax
mov byte [esp + 0x6fc], bl
call fcn.005dfd60
add esp, 0xc
lea ecx, [esp + 0x2ac]
push ecx
push 0x104
lea edx, [esp + 0x6f8]
push edx
push 0x60c81c
push str.IsOtherOSBuild
push 0x60da74
call edi
cmp byte [esp + 0x6f0], 0x31
jne 0x51bf1c
mov dword [esp + 0x54], 1
cmp dword [esp + 0x54ec], ebx
je 0x51bf38
mov eax, dword [esp + 0x54]
push eax
push str._CBD__DLinux_d
push ebx
call fcn.004f0f30
add esp, 0xc
cmp dword [0x74fafc], ebx
jne 0x51c0f5
cmp dword [0x74fb00], ebx
jne 0x51bfca
cmp dword [esp + 0x18], ebx
je 0x51c0f5
push 0x103
lea ecx, [esp + 0x6f5]
push ebx
push ecx
mov byte [esp + 0x6fc], bl
call fcn.005dfd60
add esp, 0xc
lea edx, [esp + 0x2ac]
push edx
push 0x104
lea eax, [esp + 0x6f8]
push eax
push 0x60c81c
push str.DownloadType
push 0x60da74
call edi
cmp byte [esp + 0x6f0], 0x33
jne 0x51c0f5
mov dword [0x74fb00], 1
cmp dword [esp + 0x54ec], ebx
je 0x51c0f5
push 1
push str._CBD__EI6_d
jmp 0x51c0ec
cmp dword [esp + 0x18], ebx
je 0x51c0f5
push 0x103
lea ecx, [esp + 0x1ad]
push ebx
push ecx
mov byte [esp + 0x1b4], bl
call fcn.005dfd60
add esp, 0xc
lea edx, [esp + 0x2ac]
push edx
push 0x104
lea eax, [esp + 0x1b0]
push eax
push 0x60c81c
push str.DownloadType
push 0x60da74
call edi
cmp byte [esp + 0x1a8], 0x32
jne 0x51c0f5
lea ecx, [esp + 0x2ac]
push ecx
push 0x104
lea edx, [esp + 0x1b0]
push edx
push 0x60c81c
push str.httphost
push 0x60da74
mov byte [esp + 0x1c0], bl
call edi
cmp byte [esp + 0x1a8], bl
je 0x51c0f5
push str.http:__
call fcn.004dd6c0
mov esi, eax
push esi
lea eax, [esp + 0x1b0]
push str.http:__
push eax
call fcn.004dd670
add esp, 0x10
test eax, eax
jne 0x51c09f
lea eax, [esp + esi + 0x1a8]
lea edx, [esp + 0x1a8]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x51c095
lea ecx, [esp + 0x1a8]
push 0x2f
push ecx
call fcn.005e0940
add esp, 8
cmp eax, ebx
je 0x51c0b7
mov byte [eax], bl
lea edx, [esp + 0x1a8]
push edx
push 0x74f9f8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [0x74f9f8], bl
je 0x51c0f5
mov dword [0x74f9f0], 1
cmp dword [esp + 0x54ec], ebx
je 0x51c0f5
push 1
push str._CBD__EC7_d
push ebx
call fcn.004f0f30
add esp, 0xc
cmp dword [esp + 0x54e4], 2
mov eax, dword [0x74fb00]
jne 0x51c127
cmp eax, ebx
je 0x51c11d
cmp eax, 1
jne 0x51dade
cmp dword [0x74fafc], eax
jne 0x51dade
mov eax, 1
jmp 0x51dae0
cmp eax, ebx
je 0x51c19b
cmp eax, 1
jne 0x51c138
cmp dword [0x74fafc], eax
je 0x51c19b
push 0x103
lea eax, [esp + 0x6f5]
push ebx
push eax
mov byte [esp + 0x6fc], bl
call fcn.005dfd60
push ebx
lea ecx, [esp + 0x700]
push ebx
push ecx
call fcn.005098d0
lea edx, [esp + 0x17c8]
push edx
lea eax, [esp + 0x70c]
push eax
call fcn.004dd620
add esp, 0x20
test eax, eax
je 0x51c19b
mov dword [0x74fb00], ebx
cmp dword [esp + 0x54ec], ebx
je 0x51c19b
push ebx
push str._CBD__EC8_d
push ebx
call fcn.004f0f30
add esp, 0xc
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
cmp esi, ebx
je 0x51dad0
cmp edi, ebx
je 0x51dad0
cmp byte [esi], bl
je 0x51dad0
push ebx
push esi
call fcn.004e8c10
add esp, 8
test eax, eax
je 0x51dad0
mov eax, dword [esp + 0x20]
mov byte [esp + 0x1ecc], bl
mov byte [esp + 0x18b4], bl
mov byte [esp + 0xf90], bl
mov byte [esp + 0x1198], bl
mov byte [esp + 0x13a0], bl
mov byte [edi], bl
mov byte [esp + 0xd88], bl
mov byte [esp + 0x1cc4], bl
cmp eax, ebx
je 0x51c21d
cmp byte [eax], bl
je 0x51c21d
push eax
lea ecx, [esp + 0x13a4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x51c24f
push esi
lea edx, [esp + 0x13a4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x13a0]
push eax
call fcn.004e24e0
add esp, 4
push str.versions.dat
lea ecx, [esp + 0x13a4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [esp + 0x54ec], ebx
je 0x51c26e
lea edx, [esp + 0x13a0]
push edx
push str._CBD__VD_s
push ebx
call fcn.004f0f30
add esp, 0xc
push 1
lea eax, [esp + 0x6c]
push eax
push ebx
push ebx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x13b4]
push edx
call fcn.004e8950
add esp, 0x18
test eax, eax
je 0x51c2ab
lea eax, [esp + 0x13a0]
push eax
push str.Unable_to_find__s_
push edi
call fcn.005dfb23
add esp, 0xc
jmp 0x51dade
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0x13a4]
push edx
call fcn.004dd310
add esp, 8
cmp dword [esp + 0x10], ebx
ja 0x51c2ee
lea eax, [esp + 0x13a0]
push eax
push str._s_is_of_zero_bytes_
push edi
call fcn.005dfb23
lea ecx, [esp + 0x13ac]
push ecx
call fcn.004e0670
add esp, 0x10
jmp 0x51dade
mov dx, word [0x60cf0c]
mov al, byte [0x60cf0e]
push 0x20
lea ecx, [esp + 0x54]
mov word [esp + 0x54], dx
push ecx
lea edx, [esp + 0x13a8]
push edx
mov byte [esp + 0x5e], al
call fcn.005dffe9
mov ebp, eax
add esp, 0xc
mov dword [esp + 0x44], ebp
cmp ebp, ebx
jne 0x51c341
lea eax, [esp + 0x13a0]
push eax
mov ecx, edi
push str.Unable_to_OpenFile__s_
push ecx
call fcn.005dfb23
add esp, 0xc
jmp 0x51dade
mov edx, esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edx
lea eax, [esp + 0xd8c]
push eax
call esi
lea ecx, [esp + 0xd88]
push ecx
call fcn.004e24e0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 4
push str.UAGChnge.ini
lea edx, [esp + 0xd8c]
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x1ac0]
push ecx
call esi
lea edx, [esp + 0x1abc]
push edx
call fcn.004e24e0
add esp, 4
push str.MailScan.ini
lea eax, [esp + 0x1ac0]
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x15ac]
push edx
call esi
lea eax, [esp + 0x15a8]
push eax
call fcn.004e24e0
add esp, 4
push str.filelist.dat
lea ecx, [esp + 0x15ac]
push ecx
call edi
cmp dword [esp + 0x54ec], ebx
je 0x51c408
push 1
push ebx
push ebx
push ebx
lea edx, [esp + 0x15b8]
push ebx
push edx
call fcn.004e8950
push eax
lea eax, [esp + 0x15c4]
push eax
push str._CBD__FLD_s__isf___d_
push ebx
call fcn.004f0f30
add esp, 0x28
push 1
push ebx
push ebx
push ebx
lea ecx, [esp + 0x15b8]
push ebx
push ecx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x51c623
mov eax, dword [esp + 0x58]
cmp eax, ebx
jbe 0x51c623
cmp dword [0x74f9ec], eax
jne 0x51c623
push 1
push ebx
push ebx
push ebx
lea edx, [esp + 0xd98]
push ebx
push edx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x51c610
push 0x103
lea eax, [esp + 0x1ad]
push ebx
push eax
mov byte [esp + 0x1b4], bl
call fcn.005dfd60
add esp, 0xc
cmp dword [esp + 0x18], ebx
je 0x51c555
push 0x104
lea ecx, [esp + 0x1ac]
push ecx
lea edx, [esp + 0x2b4]
push edx
call fcn.004ffec0
add esp, 0xc
test eax, eax
je 0x51c4e5
lea eax, [esp + 0x2ac]
push eax
lea ecx, [esp + 0x1ac]
push ecx
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
lea edx, [esp + 0xd98]
push edx
lea eax, [esp + 0x2c0]
push eax
push str.EupdateIni
push str.General
call fcn.004e0cb0
add esp, 0x20
cmp dword [0x74fafc], ebx
je 0x51c555
cmp dword [esp + 0x34], ebx
je 0x51c555
push 0x104
lea ecx, [esp + 0x1ac]
push ecx
lea edx, [esp + 0x7fc]
push edx
call fcn.004ffec0
add esp, 0xc
test eax, eax
je 0x51c555
lea eax, [esp + 0x7f4]
push eax
lea ecx, [esp + 0x1ac]
push ecx
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
lea edx, [esp + 0xd98]
push edx
lea eax, [esp + 0x808]
push eax
push str.IupdateIni
push str.General
call fcn.004e0cb0
add esp, 0x20
cmp dword [esp + 0x24], ebx
je 0x51c610
cmp byte [esp + 0x8f8], bl
je 0x51c610
push 0x104
lea ecx, [esp + 0x1ac]
push ecx
lea edx, [esp + 0x900]
push edx
call fcn.004ffec0
add esp, 0xc
test eax, eax
je 0x51c610
lea eax, [esp + 0x8f8]
push eax
lea ecx, [esp + 0x1ac]
push ecx
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
lea edx, [esp + 0x1acc]
push edx
lea eax, [esp + 0x1bc]
push eax
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
lea ecx, [esp + 0xda8]
push ecx
lea edx, [esp + 0x91c]
push edx
push str.MailScanIni
push str.General
call fcn.004e0cb0
lea eax, [esp + 0xdb8]
push eax
lea ecx, [esp + 0x1af0]
push ecx
push str.MailScanIniBDC
push str.General
call fcn.004e0cb0
add esp, 0x40
push ebp
call fcn.005dff6d
add esp, 4
mov eax, 1
jmp 0x51dae0
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x119c]
push eax
call esi
lea ecx, [esp + 0x1198]
push ecx
call fcn.004e24e0
add esp, 4
push str.filelist.da_
lea edx, [esp + 0x119c]
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x1ed0]
push ecx
call esi
lea edx, [esp + 0x1ecc]
push edx
call fcn.004e24e0
add esp, 4
push str.filelist.da
lea eax, [esp + 0x1ed0]
push eax
call edi
lea ecx, [esp + 0x15a8]
push ecx
call fcn.004e0670
lea edx, [esp + 0x119c]
push edx
call fcn.004e0670
lea eax, [esp + 0x1ed4]
push eax
call fcn.004e0670
lea ecx, [esp + 0x11a4]
push 0x60cf08
push ecx
call fcn.005e00ad
mov esi, eax
add esp, 0x14
mov dword [esp + 0x3c], esi
cmp esi, ebx
jne 0x51c6ea
push ebp
call fcn.005dff6d
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x119c]
push edx
push str.Unable_to_OpenFile__s_
push eax
call fcn.005dfb23
add esp, 0x10
jmp 0x51dade
lea ecx, [esp + 0x1ecc]
push 0x60cf08
push ecx
call fcn.005e00ad
mov edi, eax
add esp, 8
mov dword [esp + 0x30], edi
cmp edi, ebx
jne 0x51c734
push ebp
call fcn.005dff6d
push esi
call fcn.005dff6d
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x1ed4]
push edx
push str.Unable_to_OpenFile__s_
push eax
call fcn.005dfb23
add esp, 0x14
jmp 0x51dade
call fcn.004dd120
test eax, eax
je 0x51c7bb
push 0x103
lea ecx, [esp + 0x3e9]
push ebx
push ecx
mov byte [esp + 0x3f0], bl
call fcn.005dfd60
add esp, 0xc
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x3e8]
push eax
push str.WinPEWindows
push 0x60d9ec
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x5c], 0x104
call fcn.004d5770
cmp byte [esp + 0x3e4], bl
je 0x51c7bb
lea ecx, [esp + 0x3e4]
push ebx
push ecx
call fcn.004e8c10
add esp, 8
test eax, eax
je 0x51c7bb
lea edx, [esp + 0x3e4]
push edx
lea eax, [esp + 0xf94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0xf90], bl
jne 0x51c7d7
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0xf94]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0xf90]
push eax
call fcn.004e24e0
add esp, 4
push 0x625698
lea ecx, [esp + 0xf94]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0xf90]
push ebx
push edx
call fcn.004e8c10
add esp, 8
cmp eax, 1
je 0x51c86d
lea eax, [esp + 0xf90]
push ebx
push eax
call fcn.004dabc0
add esp, 8
test eax, eax
jne 0x51c86d
push ebp
call fcn.005dff6d
push esi
call fcn.005dff6d
push edi
call fcn.005dff6d
lea ecx, [esp + 0x11a4]
push ecx
call fcn.004e0670
mov edx, dword [esp + 0x24]
push edx
call fcn.004ebb50
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0xfa4]
push eax
push str.Unable_to_Create_TempFolder__s_
push ecx
call fcn.005dfb23
add esp, 0x20
jmp 0x51dade
cmp dword [esp + 0x54ec], ebx
je 0x51c88c
lea edx, [esp + 0xf90]
push edx
push str._CBD__Temp_FLD_s
push ebx
call fcn.004f0f30
add esp, 0xc
lea eax, [esp + 0xf90]
push eax
lea ecx, [esp + 0x1cc8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x1cc4]
push edx
call fcn.004e24e0
add esp, 4
push 0x61292c
lea eax, [esp + 0x1cc8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x1cc4]
push ebx
push ecx
call fcn.004e8c10
add esp, 8
cmp eax, 1
je 0x51c938
lea edx, [esp + 0x1cc4]
push ebx
push edx
call fcn.004dabc0
add esp, 8
test eax, eax
jne 0x51c938
push ebp
call fcn.005dff6d
push esi
call fcn.005dff6d
push edi
call fcn.005dff6d
lea eax, [esp + 0x11a4]
push eax
call fcn.004e0670
mov ecx, dword [esp + 0x24]
push ecx
call fcn.004ebb50
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x1cd8]
push edx
push str.Unable_to_Create_Plugins_Sub_folder_inside_TempFolder__s_
push eax
call fcn.005dfb23
add esp, 0x20
jmp 0x51dade
cmp dword [esp + 0x54ec], ebx
je 0x51c957
lea ecx, [esp + 0x1cc4]
push ecx
push str._CBD__Temp_FLD_Plug_s
push ebx
call fcn.004f0f30
add esp, 0xc
push ebx
push 1
push ebx
push ebx
push ebp
lea edx, [esp + 0x18c8]
push 0x207
push edx
call fcn.004e1760
add esp, 0x1c
test eax, eax
je 0x51d938
lea ebx, [ebx]
push 0x31
lea eax, [esp + 0x3b5]
push ebx
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x4c], 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x54], ebx
mov byte [esp + 0x3bc], bl
call fcn.005dfd60
push 0x3ff
lea ecx, [esp + 0x28e5]
push ebx
push ecx
mov byte [esp + 0x28ec], bl
call fcn.005dfd60
push 0x3ff
lea edx, [esp + 0x20f1]
push ebx
push edx
mov byte [esp + 0x20f8], bl
call fcn.005dfd60
push 0x3ff
lea eax, [esp + 0x30fd]
push ebx
push eax
mov byte [esp + 0x3104], bl
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0x419]
push ebx
push ecx
mov byte [esp + 0x420], bl
call fcn.005dfd60
push 0x103
lea edx, [esp + 0x1e9]
push ebx
push edx
mov byte [esp + 0x1f0], bl
call fcn.005dfd60
add esp, 0x48
push 0x3ff
lea eax, [esp + 0x2cd9]
push ebx
push eax
mov byte [esp + 0x2ce0], bl
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0x5fd]
push ebx
push ecx
mov byte [esp + 0x604], bl
call fcn.005dfd60
lea edx, [esp + 0x18cc]
push edx
call fcn.004e1290
add esp, 0x1c
cmp byte [esp + 0x18b4], bl
je 0x51d905
inc dword [esp + 0x4c]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28d8]
push ecx
lea edx, [esp + 0x18bc]
push edx
call fcn.004e1960
or esi, 0xffffffff
add esp, 0xc
cmp dword [esp + 0x10], esi
je 0x51cb0e
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20d8]
push ecx
lea edx, [esp + 0x18bc]
push edx
call fcn.004e1960
add esp, 0xc
cmp dword [esp + 0x10], esi
je 0x51cb0e
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30d8]
push ecx
lea edx, [esp + 0x18bc]
push edx
call fcn.004e1960
add esp, 0xc
cmp dword [esp + 0x10], esi
je 0x51cb0e
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2cd8]
push ecx
lea edx, [esp + 0x18bc]
push edx
call fcn.004e1960
add esp, 0xc
cmp byte [esp + 0x28d4], bl
je 0x51d9c6
cmp byte [esp + 0x20d4], bl
je 0x51d9c6
cmp byte [esp + 0x30d4], bl
je 0x51d9c6
cmp byte [esp + 0x2cd4], bl
je 0x51d9c6
lea eax, [esp + 0x28d4]
push eax
call fcn.004dd6c0
add esp, 4
cmp eax, 1
jne 0x51d9c6
lea ecx, [esp + 0x20d4]
push ecx
call fcn.004dd6c0
add esp, 4
cmp eax, 0x20
jne 0x51d9c6
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x30d4]
push edx
lea eax, [esp + 0x3e8]
push eax
call esi
push ebx
push 0x66da34
lea ecx, [esp + 0x30dc]
push 0x60cf1c
push ecx
call fcn.004e1b10
mov ebp, dword [esp + 0x24]
add esp, 0x10
push ebp
lea edx, [esp + 0x1ac]
push edx
call esi
lea eax, [esp + 0x1a8]
push eax
call fcn.004e24e0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 4
lea ecx, [esp + 0x30d4]
push ecx
lea edx, [esp + 0x1ac]
push edx
call edi
lea eax, [esp + 0x30d4]
push 0x5c
push eax
call fcn.005e0a00
add esp, 8
cmp eax, ebx
je 0x51cbf7
inc eax
jmp 0x51cbfe
lea eax, [esp + 0x30d4]
push str.update.txt
push eax
mov dword [esp + 0x64], eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x51cc1c
mov dword [esp + 0x48], 1
lea ecx, [esp + 0xf90]
push ecx
lea edx, [esp + 0x5f0]
push edx
call esi
lea eax, [esp + 0x5ec]
push eax
call fcn.004e24e0
add esp, 4
lea ecx, [esp + 0x30d4]
push ecx
lea edx, [esp + 0x5f0]
push edx
call edi
mov esi, dword [esp + 0x54ec]
cmp esi, ebx
je 0x51cc71
lea eax, [esp + 0x5ec]
push eax
push str._CBD__Dest_s
push ebx
call fcn.004f0f30
add esp, 0xc
cmp byte [esp + 0x28d4], 0x30
jne 0x51cd52
cmp dword [esp + 0x54], ebx
jne 0x51cd52
push ebx
lea ecx, [esp + 0x30d8]
push str.linux
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x51cd52
push 0x3ff
lea edx, [esp + 0x24d9]
push ebx
push edx
mov byte [esp + 0x24e0], bl
call fcn.005dfd60
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x608]
push ebx
push eax
call fcn.004e8950
add esp, 0x24
test eax, eax
jne 0x51cced
lea ecx, [esp + 0x5ec]
push ebx
push ecx
call fcn.00506950
add esp, 8
lea edx, [esp + 0x5ec]
push edx
lea eax, [esp + 0x24d8]
push str._s.gzip
push eax
call fcn.005dfb23
push 1
push ebx
push ebx
push ebx
lea ecx, [esp + 0x24f0]
push ebx
push ecx
call fcn.004e8950
add esp, 0x24
test eax, eax
jne 0x51cd32
lea edx, [esp + 0x24d4]
push ebx
push edx
call fcn.00506950
add esp, 8
cmp esi, ebx
je 0x51d905
lea eax, [esp + 0x5ec]
push eax
push str._CBD__NotDownloading_s
push ebx
call fcn.004f0f30
jmp 0x51d902
cmp esi, ebx
je 0x51cd6c
lea ecx, [esp + 0x1a8]
push ecx
push str._CBD__ActFN_s
push ebx
call fcn.004f0f30
add esp, 0xc
push 1
lea edx, [esp + 0x6c]
push edx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1bc]
push ecx
mov dword [esp + 0x28], ebx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x51ce36
cmp dword [esp + 0x10], ebx
jbe 0x51ce01
cmp byte [esp + 0x28d4], 0x2d
je 0x51ce01
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x1ac]
push eax
call fcn.004dd310
add esp, 8
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x3c0]
push ecx
lea edx, [esp + 0x1bc]
push edx
call fcn.004fe960
test eax, eax
je 0x51d976
lea eax, [esp + 0x3b0]
push eax
lea ecx, [esp + 0x20d8]
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x51ced7
jmp 0x51cedb
lea edx, [esp + 0x1a8]
push ebx
push edx
call fcn.00506950
add esp, 8
cmp byte [esp + 0x28d4], 0x2d
jne 0x51ced7
lea eax, [esp + 0x5ec]
push ebx
push eax
call fcn.00506950
add esp, 8
jmp 0x51d905
cmp byte [esp + 0x28d4], 0x2d
jne 0x51ced7
push 0x3ff
lea ecx, [esp + 0x24d9]
push ebx
push ecx
mov byte [esp + 0x24e0], bl
call fcn.005dfd60
push 1
push ebx
push ebx
push ebx
lea edx, [esp + 0x608]
push ebx
push edx
call fcn.004e8950
add esp, 0x24
test eax, eax
jne 0x51ce89
lea eax, [esp + 0x5ec]
push ebx
push eax
call fcn.00506950
add esp, 8
lea ecx, [esp + 0x5ec]
push ecx
lea edx, [esp + 0x24d8]
push str._s.gzip
push edx
call fcn.005dfb23
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x24f0]
push ebx
push eax
call fcn.004e8950
add esp, 0x24
test eax, eax
jne 0x51d905
lea ecx, [esp + 0x24d4]
push ebx
push ecx
call fcn.00506950
add esp, 8
jmp 0x51d905
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], ebx
cmp eax, ebx
je 0x51d905
mov esi, 1
push esi
lea edx, [esp + 0x6c]
push edx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x600]
push ecx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x51cf7c
cmp dword [esp + 0x10], ebx
jbe 0x51cf6b
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x5f0]
push eax
call fcn.004dd310
add esp, 8
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x3c0]
push ecx
lea edx, [esp + 0x600]
push edx
call fcn.004fe960
cmp eax, esi
jne 0x51cf7c
lea eax, [esp + 0x3b0]
push eax
lea ecx, [esp + 0x20d8]
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x51cf7c
mov dword [esp + 0x20], esi
mov dword [esp + 0x60], esi
jmp 0x51cf7c
lea edx, [esp + 0x5ec]
push ebx
push edx
call fcn.00506950
add esp, 8
push 0x207
lea eax, [esp + 0x24d9]
push ebx
push eax
mov byte [esp + 0x24e0], bl
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0x701]
push ebx
push ecx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x708], bl
call fcn.005dfd60
add esp, 0x18
mov dword [esp + 0x40], ebx
cmp dword [esp + 0x20], ebx
jne 0x51cfc5
mov dword [esp + 0x28], esi
cmp byte [0x74f8e8], bl
jne 0x51d2c7
push 0x103
lea edx, [esp + 0xb05]
push ebx
push edx
mov byte [esp + 0xb0c], bl
call fcn.005dfd60
add esp, 0xc
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0xb04]
push ecx
push str.MonitorCLB
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x78], 0x104
xor ebp, ebp
call fcn.004d5770
cmp byte [esp + 0xb00], bl
je 0x51d036
cmp byte [esp + 0xb09], 0x4f
jne 0x51d036
cmp byte [esp + 0xb08], 0x52
je 0x51d08c
push 0x7f
lea edx, [esp + 0xc09]
push ebx
push edx
mov byte [esp + 0xc10], bl
call fcn.005dfd60
lea eax, [esp + 0xc10]
push eax
call fcn.004dd850
lea ecx, [esp + 0xc14]
push str.0200
push ecx
call fcn.004dd620
add esp, 0x18
test eax, eax
je 0x51d08c
lea edx, [esp + 0xc04]
push str.0300
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x51d08e
mov ebp, esi
push ebx
push 0x104
push 0x74f8e8
push 0x60c81c
push str.DBHost
push str.General
call fcn.004edfd0
add esp, 0x18
lea eax, [esp + 0x38]
push eax
push str.MonitorCLY
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x48], ebx
call fcn.004d5820
mov eax, dword [esp + 0x38]
cmp eax, 2
jne 0x51d11e
mov ecx, dword [str.download1.mwti.net]
mov edx, dword [0x61be9c]
mov eax, dword [0x61bea0]
mov dword [0x74f8e8], ecx
mov ecx, dword [0x61bea4]
mov dword [0x74f8ec], edx
mov dx, word [0x61bea8]
mov dword [0x74f8f0], eax
mov al, byte [0x61beaa]
mov dword [0x74f8f4], ecx
mov word [0x74f8f8], dx
mov byte [0x74f8fa], al
jmp 0x51d128
cmp eax, 4
je 0x51d128
cmp eax, 5
jne 0x51d134
cmp byte [0x74f8e8], bl
jne 0x51d288
push 0x103
lea ecx, [esp + 0x4ed]
push ebx
push ecx
mov byte [esp + 0x4f4], bl
call fcn.005dfd60
add esp, 0xc
cmp ebp, ebx
jne 0x51d1bc
cmp dword [esp + 0x24], ebx
jne 0x51d16c
call fcn.004dd0c0
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x51d1bc
push str.upgr_mmxiv.cdn.bitdefender.net
push 0x74f8e8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.004dd0c0
cdq
mov ecx, 0xa
idiv ecx
cmp edx, ebx
jne 0x51d1a4
mov ecx, 6
mov esi, str.www.microworldsystems.com
lea edi, [esp + 0x4e8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x51d20f
push edx
lea edx, [esp + 0x4ec]
push str.update_u.mwti.net
push edx
call fcn.005dfb23
add esp, 0xc
jmp 0x51d20f
call fcn.004dd0c0
cdq
mov ecx, 0xa
idiv ecx
cmp edx, ebx
jne 0x51d1e2
mov ecx, 6
mov esi, str.www.microworldsystems.com
mov edi, 0x74f8e8
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x51d1f5
push edx
push str.update_u.mwti.net
push 0x74f8e8
call fcn.005dfb23
add esp, 0xc
cmp ebp, ebx
jne 0x51d20f
mov ecx, 7
mov esi, str.upgr_mmxiv.cdn.bitdefender.net
lea edi, [esp + 0x4e8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x74f8e8
push str.DBHost
push str.General
mov dword [esp + 0x44], 5
call fcn.004ee3d0
add esp, 0xc
cmp byte [esp + 0x4e8], bl
je 0x51d251
lea edx, [esp + 0x4e8]
push edx
push str.AltDBHost
push str.General
call fcn.004ee3d0
add esp, 0xc
mov eax, dword [esp + 0x38]
push eax
push str.MonitorCLY
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp byte [0x74f8e8], bl
jne 0x51d288
cmp ebp, ebx
je 0x51d2a0
push str.microworld_24c34601_b5df_4e60_9465_592191c17dae.2d7dd.cdn.bitdefender.net
push 0x74f8e8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x51d2c7
push ebx
push str.mmxiii
push 0x74f8e8
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x51d2c7
push str.upgr_mmxiv.cdn.bitdefender.net
push 0x74f8e8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x74f8e8
push str.DBHost
push str.General
call fcn.004ee3d0
add esp, 0xc
mov eax, dword [0x74fb00]
mov esi, 1
cmp eax, ebx
je 0x51d541
cmp eax, esi
jne 0x51d2e9
cmp dword [0x74fafc], esi
je 0x51d541
cmp dword [0x74f9f0], ebx
je 0x51d318
lea ecx, [esp + 0x3e4]
push ecx
push 0x74f9f8
lea edx, [esp + 0x24dc]
push str.http:___s_avx__s
push edx
call fcn.005dfb23
add esp, 0x10
jmp 0x51d807
push ebx
lea eax, [esp + 0x5f0]
push str.mac_
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x51d370
push ebx
lea ecx, [esp + 0x5f0]
push str.mdm_
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x51d370
lea edx, [esp + 0x3e4]
push edx
lea eax, [esp + 0x24d8]
push str.http:__microworld_24c34601_b5df_4e60_9465_592191c17dae.2d7dd.cdn.bitdefender.net_av32bit_avx__s.gzip
push eax
call fcn.005dfb23
add esp, 0xc
jmp 0x51d807
cmp dword [esp + 0x2c], ebx
jne 0x51d532
push 0x103
lea ecx, [esp + 0x4ed]
push ebx
push ecx
mov byte [esp + 0x4f4], bl
call fcn.005dfd60
add esp, 0xc
mov dword [esp + 0x2c], esi
cmp dword [esp + 0x18], ebx
je 0x51d477
push 0x104
lea edx, [esp + 0x4ec]
push edx
lea eax, [esp + 0x2b4]
push eax
call fcn.004ffec0
add esp, 0xc
test eax, eax
je 0x51d407
lea ecx, [esp + 0x2ac]
push ecx
lea edx, [esp + 0x4ec]
push edx
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
lea eax, [esp + 0xd98]
push eax
lea ecx, [esp + 0x2c0]
push ecx
push str.EupdateIni
push str.General
call fcn.004e0cb0
add esp, 0x20
cmp dword [0x74fafc], ebx
je 0x51d477
cmp dword [esp + 0x34], ebx
je 0x51d477
push 0x104
lea edx, [esp + 0x4ec]
push edx
lea eax, [esp + 0x7fc]
push eax
call fcn.004ffec0
add esp, 0xc
test eax, eax
je 0x51d477
lea ecx, [esp + 0x7f4]
push ecx
lea edx, [esp + 0x4ec]
push edx
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
lea eax, [esp + 0xd98]
push eax
lea ecx, [esp + 0x808]
push ecx
push str.IupdateIni
push str.General
call fcn.004e0cb0
add esp, 0x20
cmp dword [esp + 0x24], ebx
je 0x51d532
cmp byte [esp + 0x8f8], bl
je 0x51d532
push 0x104
lea edx, [esp + 0x4ec]
push edx
lea eax, [esp + 0x900]
push eax
call fcn.004ffec0
add esp, 0xc
test eax, eax
je 0x51d532
lea ecx, [esp + 0x8f8]
push ecx
lea edx, [esp + 0x4ec]
push edx
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
lea eax, [esp + 0x1acc]
push eax
lea ecx, [esp + 0x4fc]
push ecx
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
lea edx, [esp + 0xda8]
push edx
lea eax, [esp + 0x91c]
push eax
push str.MailScanIni
push str.General
call fcn.004e0cb0
lea ecx, [esp + 0xdb8]
push ecx
lea edx, [esp + 0x1af0]
push edx
push str.MailScanIniBDC
push str.General
call fcn.004e0cb0
add esp, 0x40
push 0x2f
lea eax, [esp + 0x3e8]
push eax
jmp 0x51d785
mov ecx, dword [esp + 0x5c]
push ecx
lea edx, [esp + 0x6f4]
push str.SOFTWAREMicroWorldeScan_for_WindowsUpdates_s
push edx
call fcn.005dfb23
lea eax, [esp + 0x1c]
push eax
push esi
push ebx
lea ecx, [esp + 0x708]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x20
test eax, eax
jne 0x51d5b9
lea edx, [esp + 0x40]
push edx
push str.2011
lea eax, [esp + 0x6f8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
je 0x51d5ae
cmp dword [esp + 0x40], esi
je 0x51d5ae
mov ecx, dword [esp + 0x10]
push str.2011
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x2c], ebx
jne 0x51d77b
push 0x103
lea eax, [esp + 0x4ed]
push ebx
push eax
mov byte [esp + 0x4f4], bl
call fcn.005dfd60
add esp, 0xc
mov dword [esp + 0x2c], esi
cmp dword [esp + 0x18], ebx
je 0x51d6c0
push 0x104
lea ecx, [esp + 0x4ec]
push ecx
lea edx, [esp + 0x2b4]
push edx
call fcn.004ffec0
add esp, 0xc
test eax, eax
je 0x51d650
lea eax, [esp + 0x2ac]
push eax
lea ecx, [esp + 0x4ec]
push ecx
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
lea edx, [esp + 0xd98]
push edx
lea eax, [esp + 0x2c0]
push eax
push str.EupdateIni
push str.General
call fcn.004e0cb0
add esp, 0x20
cmp dword [0x74fafc], ebx
je 0x51d6c0
cmp dword [esp + 0x34], ebx
je 0x51d6c0
push 0x104
lea ecx, [esp + 0x4ec]
push ecx
lea edx, [esp + 0x7fc]
push edx
call fcn.004ffec0
add esp, 0xc
test eax, eax
je 0x51d6c0
lea eax, [esp + 0x7f4]
push eax
lea ecx, [esp + 0x4ec]
push ecx
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
lea edx, [esp + 0xd98]
push edx
lea eax, [esp + 0x808]
push eax
push str.IupdateIni
push str.General
call fcn.004e0cb0
add esp, 0x20
cmp dword [esp + 0x24], ebx
je 0x51d77b
cmp byte [esp + 0x8f8], bl
je 0x51d77b
push 0x104
lea ecx, [esp + 0x4ec]
push ecx
lea edx, [esp + 0x900]
push edx
call fcn.004ffec0
add esp, 0xc
test eax, eax
je 0x51d77b
lea eax, [esp + 0x8f8]
push eax
lea ecx, [esp + 0x4ec]
push ecx
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
lea edx, [esp + 0x1acc]
push edx
lea eax, [esp + 0x4fc]
push eax
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
lea ecx, [esp + 0xda8]
push ecx
lea edx, [esp + 0x91c]
push edx
push str.MailScanIni
push str.General
call fcn.004e0cb0
lea eax, [esp + 0xdb8]
push eax
lea ecx, [esp + 0x1af0]
push ecx
push str.MailScanIniBDC
push str.General
call fcn.004e0cb0
add esp, 0x40
push 0x2f
lea edx, [esp + 0x3e8]
push edx
call fcn.005e0940
add esp, 8
cmp eax, ebx
jne 0x51d79a
lea eax, [esp + 0x3e4]
jmp 0x51d79c
add eax, esi
movsx edx, byte [esp + 0x20d7]
lea ecx, [esp + 0x20d4]
push ecx
push eax
push edx
call fcn.005e3ae6
add esp, 4
push eax
movsx eax, byte [esp + 0x20e2]
push eax
call fcn.005e3ae6
movsx ecx, byte [esp + 0x20e5]
add esp, 4
push eax
push ecx
call fcn.005e3ae6
movsx edx, byte [esp + 0x20e8]
add esp, 4
push eax
push edx
call fcn.005e3ae6
add esp, 4
push eax
push 0x74f8e8
lea eax, [esp + 0x24f0]
push str.http:___s_v2_repository__c__c__c__c__s._s.gzip
push eax
call fcn.005dfb23
add esp, 0x24
cmp dword [0x74f9f0], ebx
je 0x51d849
lea ecx, [esp + 0x20d4]
push ecx
lea edx, [esp + 0x2cd8]
push edx
lea eax, [esp + 0x1b0]
push eax
lea ecx, [esp + 0x5f8]
push ecx
mov edx, ecx
push edx
lea eax, [esp + 0x24e8]
push eax
push str._s___s___s___s___s___s
lea ecx, [esp + 0x34f0]
push ecx
jmp 0x51d881
lea edx, [esp + 0x20d4]
push edx
lea eax, [esp + 0x2cd8]
push eax
lea ecx, [esp + 0x1b0]
push ecx
lea edx, [esp + 0x5f8]
push edx
mov eax, edx
push eax
lea ecx, [esp + 0x24e8]
push ecx
push str._s___s.gzip___s___s___s___s
lea edx, [esp + 0x34f0]
push edx
call fcn.005dfb23
add esp, 0x20
cmp dword [esp + 0x20], ebx
jne 0x51d8eb
cmp dword [esp + 0x48], ebx
je 0x51d8d7
lea eax, [esp + 0x34d4]
push eax
lea ecx, [esp + 0x44d8]
push str._s_r_n
push ecx
call fcn.005dfb23
lea edx, [esp + 0x44e0]
push edx
call fcn.004dd6c0
push eax
lea eax, [esp + 0x44e8]
push eax
lea ecx, [esp + 0x15c0]
push ecx
call fcn.005170e0
add esp, 0x1c
jmp 0x51d905
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x34d4]
push edx
push 0x60c990
push eax
jmp 0x51d8fd
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x34d4]
push ecx
push 0x60c990
push edx
call fcn.005dfdda
add esp, 0xc
mov eax, dword [esp + 0x44]
push ebx
push 1
push ebx
push ebx
push eax
lea ecx, [esp + 0x18c8]
push 0x207
push ecx
call fcn.004e1760
add esp, 0x1c
test eax, eax
jne 0x51c980
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x3c]
push ebp
call fcn.005dff6d
push esi
call fcn.005dff6d
push edi
call fcn.005dff6d
add esp, 0xc
cmp dword [esp + 0x28], ebx
jne 0x51da1f
lea ecx, [esp + 0x1198]
push ecx
call fcn.004e0670
mov edx, dword [esp + 0x18]
push edx
call fcn.004ebb50
add esp, 8
jmp 0x51daa9
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1a8]
push edx
push str.Error_getting_MD5_of__s_
push eax
call fcn.005dfb23
mov ecx, dword [esp + 0x50]
push ecx
call fcn.005dff6d
mov edx, dword [esp + 0x4c]
push edx
call fcn.005dff6d
mov eax, dword [esp + 0x44]
push eax
call fcn.005dff6d
lea ecx, [esp + 0x11b0]
push ecx
call fcn.004e0670
push ebp
call fcn.004ebb50
add esp, 0x20
jmp 0x51dade
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x13a0]
push edx
push eax
push str.Error_reading_Line__d_of__s_
push ecx
call fcn.005dfb23
mov edx, dword [esp + 0x54]
push edx
call fcn.005dff6d
mov eax, dword [esp + 0x50]
push eax
call fcn.005dff6d
mov ecx, dword [esp + 0x48]
push ecx
call fcn.005dff6d
lea edx, [esp + 0x11b4]
push edx
call fcn.004e0670
mov eax, dword [esp + 0x34]
push eax
call fcn.004ebb50
add esp, 0x24
jmp 0x51dade
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x15b8]
push ebx
push eax
call fcn.004e8950
add esp, 0x18
lea edx, [esp + 0x1198]
test eax, eax
jne 0x51da71
lea ecx, [esp + 0x28]
push ecx
push edx
mov dword [esp + 0x30], ebx
call fcn.004f1610
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x51da83
push eax
lea eax, [esp + 0x15ac]
push esi
push eax
call fcn.005170e0
push esi
call fcn.005e0865
add esp, 0x10
jmp 0x51da83
push ebx
lea ecx, [esp + 0x15ac]
push ecx
push edx
call fcn.004edd70
add esp, 0xc
lea eax, [esp + 0x1198]
push eax
call fcn.004e0670
push ebx
lea ecx, [esp + 0x11a0]
push ecx
lea edx, [esp + 0x15b4]
push edx
call fcn.004edd70
add esp, 0x10
cmp dword [esp + 0x60], ebx
jne 0x51dabf
lea eax, [esp + 0x1ecc]
push eax
call fcn.004e0670
add esp, 4
mov ecx, dword [esp + 0x58]
mov dword [0x74f9ec], ecx
mov eax, 1
jmp 0x51dae0
push str.Invalid_Parameters_
push edi
call fcn.005dfb23
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x54d4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x54c8
ret