Function at 0x4f8ce0
Capabilities:
Check if file exists
Create thread
Encode data using base64
Enumerate process modules
Enumerate services
Get disk information
Get disk size
Schedule task via itaskservice

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f5943
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x3050
call fcn.0041ead0
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2fcc], edi
mov esi, dword [ebx + 8]
xor ecx, ecx
mov dword [ebp - 0x2fb4], esi
call fcn.005d3930
test eax, eax
je 0x4f8d4a
push eax
call fcn.0041e1c3
add esp, 4
mov eax, dword [esi + 0xc]
xorps xmm0, xmm0
mov ecx, dword [esi + 8]
mov dword [ebp - 0x2fd0], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x2ff8], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x2fc0], eax
mov eax, dword [esi + 0x18]
push 1
mov dword [ebp - 0x2f94], ecx
mov dword [ebp - 0x2fa8], eax
mov eax, dword [esi + 0x1c]
push ecx
lea ecx, [ebp - 0x211c]
mov dword [ebp - 0x2ffc], eax
movq qword [ebp - 0x211c], xmm0
mov dword [ebp - 0x2114], 0
call fcn.005dc570
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1fa0]
xorps xmm0, xmm0
mov dword [ebp - 0x1f98], 0
movq qword [ebp - 0x1fa0], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1fb0]
xorps xmm0, xmm0
mov dword [ebp - 0x1fa8], 0
movq qword [ebp - 0x1fb0], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1f94]
xorps xmm0, xmm0
mov dword [ebp - 0x1f8c], 0
movq qword [ebp - 0x1f94], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2024]
xorps xmm0, xmm0
mov dword [ebp - 0x201c], 0
movq qword [ebp - 0x2024], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1ff0]
xorps xmm0, xmm0
mov dword [ebp - 0x1fe8], 0
movq qword [ebp - 0x1ff0], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1fc0]
xorps xmm0, xmm0
mov dword [ebp - 0x1fb8], 0
movq qword [ebp - 0x1fc0], xmm0
call fcn.005dc5e0
lea ecx, [ebp - 0x211c]
mov byte [ebp - 4], 6
call fcn.005dc3a0
mov ecx, eax
cmp ecx, 7
jl 0x4f8eb0
mov eax, dword [ebp - 0x2f94]
add eax, 0xfffffff8
push 0
lea edx, [eax + ecx*2]
mov ecx, 0x6674ec
call fcn.005d8ad0
test eax, eax
je 0x4f8ed6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6674ec
lea ecx, [ebp - 0x211c]
call fcn.005da780
xorps xmm0, xmm0
lea ecx, [ebp - 0x211c]
push 0
push 0x2a
movups xmmword [ebp - 0x2018], xmm0
movups xmmword [ebp - 0x2008], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e4770
lea ecx, [ebp - 0x2018]
mov byte [ebp - 4], 7
call fcn.005e4670
test eax, eax
jne 0x4f8f20
mov byte [ebp - 0x2f8d], al
jmp 0x4fa814
push str.Retrieving_system_info...
push 0
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._Scan_Log_File__r_n
lea ecx, [edi + 0x143c]
call fcn.005dc190
push eax
push str._r_n____
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov ecx, edi
call fcn.0045a870
test al, al
je 0x4f9149
push 0
push str._r_n____System_Info:_r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
xorps xmm0, xmm0
mov dword [ebp - 0x2144], 0
lea ecx, [ebp - 0x214c]
movq qword [ebp - 0x214c], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2158]
xorps xmm0, xmm0
mov dword [ebp - 0x2150], 0
movq qword [ebp - 0x2158], xmm0
call fcn.005dc5e0
push 0x38
lea eax, [ebp - 0x22a0]
mov byte [ebp - 4], 9
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [edi + 0x180]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x22a0]
call fcn.005dd680
lea eax, [ebp - 0x2094]
mov byte [ebp - 4], 0xa
push eax
push str.Basic_system_info
lea ecx, [ebp - 0x22a0]
mov dword [ebp - 0x2094], 0
call fcn.005dcc50
test eax, eax
je 0x4f9112
mov ecx, dword [ebp - 0x2094]
cmp ecx, eax
jbe 0x4f9112
push ecx
push eax
lea ecx, [ebp - 0x22a0]
call fcn.005dc700
mov dword [ebp - 0x2f94], eax
test eax, eax
je 0x4f9112
mov esi, eax
lea eax, [ebp - 0x2158]
push eax
lea eax, [ebp - 0x214c]
push eax
push esi
lea ecx, [ebp - 0x22a0]
call fcn.005dc660
test al, al
je 0x4f90f0
push str.Time__date
lea ecx, [ebp - 0x214c]
call fcn.005dc4c0
test al, al
je 0x4f90a1
mov dl, 1
lea ecx, [ebp - 0x2158]
call fcn.005cf7a0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2158]
call fcn.005dc190
push eax
push 0x678578
lea ecx, [ebp - 0x214c]
call fcn.005dc190
push eax
push str._r_n
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push dword [ebp - 0x2094]
lea ecx, [ebp - 0x22a0]
push esi
call fcn.005dc700
mov esi, eax
test esi, esi
jne 0x4f9062
mov esi, dword [ebp - 0x2fb4]
push 0
push 0x62781c
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
lea ecx, [ebp - 0x22a0]
call fcn.005dd5d0
lea ecx, [ebp - 0x2158]
call fcn.005dc430
lea ecx, [ebp - 0x214c]
mov byte [ebp - 4], 7
call fcn.005dc430
cmp byte [esi + 4], 0
je 0x4f915b
mov byte [ebp - 0x2f8d], 2
jmp 0x4fa814
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x2044], 0
push 0x1a
lea ecx, [ebp - 0x204c]
movq qword [ebp - 0x204c], xmm0
call fcn.004044a0
mov byte [ebp - 4], 0xb
mov ecx, 1
mov eax, dword [ebp - 0x204c]
test eax, eax
mov dword [ebp - 0x2f98], 1
cmove eax, ecx
mov ecx, dword [ebp - 0x2044]
mov dword [ebp - 0x204c], eax
lea eax, [edi + 0x1c]
push dword [eax]
mov dword [ebp - 0x2f94], eax
call fcn.005dc510
push 0
push 0
push 0x800
lea ecx, [ebp - 0x1fb0]
call fcn.005db9a0
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4f9414
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x1fb0]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], 0
call fcn.005dc190
mov dword [ebp - 0x2fa0], eax
cmp word [eax], 0
je 0x4f9402
mov dword [ebp - 0x2f98], 0xc
mov esi, eax
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x4f93b9
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [edi + 1]
mov dword [ebp - 0x2f8c], eax
cmp dword [ebp - 0x204c], edi
ja 0x4f926d
mov dword [ebp - 0x204c], eax
jmp 0x4f9273
mov dword [ebp - 0x2f8c], eax
mov ecx, dword [ebp - 0x2f98]
add ecx, dword [ebp - 0x2044]
push 1
push esi
call fcn.005dc260
mov eax, dword [ebp - 0x204c]
cmp eax, edi
mov ecx, dword [ebp - 0x2f98]
cmovbe eax, dword [ebp - 0x2f8c]
add ecx, dword [ebp - 0x2044]
push 1
mov dword [ebp - 0x204c], eax
call fcn.005dadc0
mov eax, dword [ebp - 0x204c]
cmp eax, edi
mov ecx, dword [ebp - 0x2f98]
cmovbe eax, dword [ebp - 0x2f8c]
add ecx, dword [ebp - 0x2044]
mov dword [ebp - 0x204c], eax
mov eax, dword [ebp - 0x2f94]
push dword [eax]
call fcn.005dc4c0
test al, al
jne 0x4f93b9
push 4
push 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2024]
push dword [ebp - 0x20]
call fcn.005daea0
mov eax, dword [ebp - 0x204c]
lea ecx, [ebp - 0x2024]
mov esi, dword [ebp - 0x2044]
cmp eax, edi
push 0
cmovbe eax, dword [ebp - 0x2f8c]
add esi, dword [ebp - 0x2f98]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x204c], eax
call fcn.005dc190
push eax
push 0x62889c
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n____Drive:
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
push 4
push 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2024]
push dword [ebp - 0x28]
call fcn.005daea0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2024]
call fcn.005dc190
push eax
push str._free_of
lea ecx, [ebp - 0x1fa0]
call fcn.005da780
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov esi, dword [ebp - 0x2fa0]
inc edi
add dword [ebp - 0x2f98], 0xc
mov eax, dword [ebp - 0x204c]
cmp eax, edi
ja 0x4f93d3
push 0
add eax, eax
lea ecx, [ebp - 0x204c]
push eax
call fcn.004042f0
mov ecx, esi
call fcn.005d8c40
lea esi, [esi + eax*2]
add esi, 2
mov dword [ebp - 0x2fa0], esi
cmp word [esi], 0
jne 0x4f9231
mov esi, dword [ebp - 0x2fb4]
mov dword [ebp - 0x2f98], edi
mov edi, dword [ebp - 0x2fcc]
push 0
push 0x62781c
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
cmp byte [esi + 4], 0
je 0x4f9426
mov byte [ebp - 0x2f8d], 2
jmp 0x4fa803
xor ecx, ecx
call fcn.0058c0c0
push 0x38
lea eax, [ebp - 0x2220]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x2220]
push 1
push str.ROOTCIMV2
call fcn.005889d0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2018]
cmp byte [ebp - 0x21f0], 0
push 0
je 0x4f9858
push str._r_n____WMI_state:_OK_r_n
call fcn.005e37e0
push str.SELECT_Name__L2CacheSize_FROM_Win32_Processor
lea ecx, [ebp - 0x2220]
call fcn.005887d0
test eax, eax
je 0x4f9595
lea ecx, [ebp - 0x2220]
call fcn.00588680
test eax, eax
je 0x4f9595
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Name
lea ecx, [ebp - 0x2220]
call fcn.00588410
push eax
push str._r_n____Processor:
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.L2CacheSize
lea ecx, [ebp - 0x2220]
call fcn.00588410
push eax
push str._r_n____L2_Cache_size:
lea ecx, [ebp - 0x1fa0]
call fcn.005da780
push dword [edi + 0xc8]
call dword [sym.imp.pdh.dll_PdhCollectQueryData]
lea eax, [ebp - 0x2f88]
push eax
push 0
push 0x200
push dword [edi + 0xcc]
call dword [sym.imp.pdh.dll_PdhGetFormattedCounterValue]
movsd xmm1, qword [ebp - 0x2f80]
lea ecx, [ebp - 0x1fb0]
push 2
call fcn.005db690
mov ecx, eax
call fcn.005d9b70
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._._r_n
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str.____Current_processor_usage:
lea ecx, [ebp - 0x1fa0]
call fcn.005da780
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push str.SELECT_NumberOfUsers__TotalVisibleMemorySize__FreePhysicalMemory__TotalVirtualMemorySize__FreeVirtualMemory__LastBootUpTime_FROM_Win32_OperatingSystem
lea ecx, [ebp - 0x2220]
call fcn.005887d0
test eax, eax
je 0x4f9862
lea ecx, [ebp - 0x2220]
call fcn.00588680
test eax, eax
je 0x4f9862
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.NumberOfUsers
lea ecx, [ebp - 0x2220]
call fcn.00588410
push eax
push str..____Number_of_users:
push 0
lea ecx, [edi + 0x1290]
call fcn.0057c300
push eax
push str..____Logged_on_user:
lea ecx, [edi + 0x198]
call fcn.005dc190
push eax
push str._r_n____Computer_name:_:
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push 4
push 0
push str.TotalVisibleMemorySize
lea ecx, [ebp - 0x2220]
call fcn.005883d0
push edx
push eax
lea ecx, [ebp - 0x1fb0]
call fcn.005daea0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str._r_n____Physical_memory:____Total:
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push 4
push 0
push str.FreePhysicalMemory
lea ecx, [ebp - 0x2220]
call fcn.005883d0
push edx
push eax
lea ecx, [ebp - 0x1fb0]
call fcn.005daea0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624288
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str..____Free:
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push 4
push 0
push str.TotalVirtualMemorySize
lea ecx, [ebp - 0x2220]
call fcn.005883d0
push edx
push eax
lea ecx, [ebp - 0x1fb0]
call fcn.005daea0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str._r_n____Virtual_memory:____Total:
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push 4
push 0
push str.FreeVirtualMemory
lea ecx, [ebp - 0x2220]
call fcn.005883d0
push edx
push eax
lea ecx, [ebp - 0x1fb0]
call fcn.005daea0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624288
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str..____Free:
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push 1
push 0
push str.LastBootUpTime
lea ecx, [ebp - 0x2220]
call fcn.00588410
push eax
lea ecx, [ebp - 0x1fb0]
call fcn.005dc260
mov edx, 0x13
lea ecx, [ebp - 0x1fb0]
call fcn.0058b3c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str._r_n____Last_boot_up_time:
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [ebp - 0x2018]
push 0
cmp eax, 1
jne 0x4f9845
push str..____Boot_type:_Fail_safe_boot_r_n
jmp 0x4f985d
cmp eax, 2
jne 0x4f9851
push str..____Boot_type:_Fail_safe_with_network_boot_r_n
jmp 0x4f985d
push str..____Boot_type:_Normal_boot_r_n
jmp 0x4f985d
push str._r_n____WMI_state:_Corrupted_r_n
call fcn.005e37e0
cmp byte [esi + 4], 0
je 0x4f9874
mov byte [ebp - 0x2f8d], 2
jmp 0x4fa7f8
push 0
push 0x20019
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerImmunization
lea ecx, [ebp - 0x1fa4]
mov dword [ebp - 0x1fa4], 0
call fcn.005d6a80
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1fb4]
mov dword [ebp - 0x1fb4], 0
call fcn.005d6aa0
lea eax, [ebp - 0x1fb0]
mov byte [ebp - 4], 0xe
push eax
push str.Immunized
lea ecx, [ebp - 0x1fa4]
call fcn.005d6740
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str._r_n____Immunized_areas:
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push 0
push str._r_n____Scan_mode:
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x2fa8]
test al, 4
je 0x4f9931
mov eax, str.Skip_all_digitally_signed_files_
jmp 0x4f994b
test al, 1
je 0x4f993c
mov eax, str.Skip_system_protected_files_
jmp 0x4f994b
test al, 2
mov ecx, str.Scan_all_files_
mov eax, str.Skip_all_Microsoft_files_
cmove eax, ecx
push 0
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
test byte [ebp - 0x2fa8], 0xc
mov ecx, str.Verify_file_signatures.
mov eax, str.Do_not_verify_file_signatures.
cmovne eax, ecx
lea ecx, [ebp - 0x2018]
push 0
push eax
call fcn.005e37e0
push 0
push str._r_n____Scan_options:
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x2fa8]
test al, 0x40
je 0x4f99af
push 0
push str.Scan_all_users_
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x2fa8]
mov esi, eax
test eax, 0x10
mov ecx, str.Include_MD5_hash_
mov eax, str.Do_not_include_MD5_hash_
cmovne eax, ecx
lea ecx, [ebp - 0x2018]
push 0
push eax
call fcn.005e37e0
test byte [ebp - 0x2fa8], 0x20
mov ecx, str.Include_recent_folders._r_n
mov eax, str.Do_not_include_recent_folders._r_n
cmovne eax, ecx
lea ecx, [ebp - 0x2018]
push 0
push eax
call fcn.005e37e0
push 0
push str._r_n_____End_of_System_Info.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
test byte [ebp - 0x2fa8], 8
mov ecx, str.__Publisher
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, str.__File_signature
mov edx, 0x62439c
cmove eax, ecx
mov ecx, str.__MD5_hash
push 0x62781c
test esi, 0x10
mov dword [ebp - 0x2fc8], eax
push eax
cmove ecx, edx
push ecx
push str.____Mode__autorun.inf__Destination_file__Description
mov dword [ebp - 0x2fc4], ecx
lea ecx, [ebp - 0x1fa0]
push str._r_n____Searching_for__autorun.inf__on_HD_partitions_root..._r_n_r_n
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov esi, dword [ebp - 0x2fb4]
cmp byte [esi + 4], 0
je 0x4f9a8c
mov byte [ebp - 0x2f8d], 2
jmp 0x4fa7e2
xorps xmm0, xmm0
mov dword [ebp - 0x1fc4], 0
lea ecx, [ebp - 0x1fcc]
movq qword [ebp - 0x1fcc], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1fd8]
xorps xmm0, xmm0
mov dword [ebp - 0x1fd0], 0
movq qword [ebp - 0x1fd8], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1fe4]
xorps xmm0, xmm0
mov dword [ebp - 0x1fdc], 0
movq qword [ebp - 0x1fe4], xmm0
call fcn.005dc5e0
cmp dword [ebp - 0x2f98], 0
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x2f8c], 0
jbe 0x4f9d3b
xor ecx, ecx
xor esi, esi
mov dword [ebp - 0x2fa0], ecx
nop dword [eax]
cmp dword [ebp - 0x204c], esi
ja 0x4f9b31
lea eax, [esi + 1]
mov dword [ebp - 0x204c], eax
add ecx, dword [ebp - 0x2044]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._autorun.inf
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb0]
call fcn.005dc200
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4f9d0f
push 0x800
push 0
push str.Open
push str.AUTORUN
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005db1d0
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
test al, al
jne 0x4f9d0f
push 3
lea edx, [edi + 0x1c]
lea ecx, [ebp - 0x1f94]
call fcn.005e88c0
test al, al
jne 0x4f9c2d
push 2
push 2
push 1
push 1
push 0x624518
lea ecx, [ebp - 0x1f94]
call fcn.005daa70
test eax, eax
jne 0x4f9c2d
cmp dword [ebp - 0x204c], esi
ja 0x4f9bf7
lea eax, [esi + 1]
mov dword [ebp - 0x204c], eax
mov ecx, dword [ebp - 0x2fa0]
add ecx, dword [ebp - 0x2044]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4f9c5e
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4f9d0f
push 0
push 0
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push 0x6558f0
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str._r_n_Autorun.inf__
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov eax, dword [ebp - 0x2f8c]
inc eax
mov dword [ebp - 0x2f8c], eax
jmp 0x4f9d15
mov eax, dword [ebp - 0x2f8c]
mov ecx, dword [ebp - 0x2fa0]
inc esi
add ecx, 0xc
mov dword [ebp - 0x2fa0], ecx
cmp esi, dword [ebp - 0x2f98]
jb 0x4f9b20
mov esi, dword [ebp - 0x2fb4]
test eax, eax
jne 0x4f9d4d
push 0
push str._r_nNo_autorun.inf_was_found_on_HD_partitions_root._r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
push 0
push str._r_n____Executable_file_extensions_state__Mode__Extension__Association__Command_:_r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
cmp byte [esi + 4], 0
jne 0x4fa7ba
mov dword [ebp - 0x2fec], 0x6243cc
xor edi, edi
mov dword [ebp - 0x2fe8], str..msi
mov dword [ebp - 0x2fe4], str..reg
mov dword [ebp - 0x2fe0], str..bat
mov dword [ebp - 0x2fdc], str..cmd
mov dword [ebp - 0x2fd8], str..com
mov dword [ebp - 0x2fd4], str..vbs
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + edi*4 - 0x2fec]
lea ecx, [ebp - 0x1ff0]
push str.HKCR_
call fcn.005dc200
lea eax, [ebp - 0x1fb0]
push eax
push 0x62439c
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d65d0
lea ecx, [ebp - 0x1fb0]
call fcn.005dbeb0
test al, al
je 0x4f9e1e
push str.No_association
lea ecx, [ebp - 0x1fb0]
call fcn.005dc510
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.ShellOpenCommand
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str.HKCR_
lea ecx, [ebp - 0x1ff0]
call fcn.005dc200
lea eax, [ebp - 0x1f94]
push eax
push 0x62439c
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d65d0
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
test al, al
je 0x4f9e93
push str.No_command
lea ecx, [ebp - 0x1f94]
call fcn.005dc510
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push 0x6558f0
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push 0x6558f0
push dword [ebp + edi*4 - 0x2fec]
lea ecx, [ebp - 0x1fa0]
push str._r_n_FileExtension__
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
inc edi
cmp edi, 7
jl 0x4f9db1
push 0
push str._r_n_r_n_____End_of_Executable_file_extensions_state.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov edx, dword [ebp - 0x2fc0]
mov edi, dword [ebp - 0x2fcc]
mov dword [ebp - 0x2f9c], 0
mov dword [ebp - 0x2fbc], 0x64
test edx, edx
je 0x4fa607
mov ecx, edx
and ecx, 1
test dl, 2
je 0x4f9f39
inc ecx
test dl, 4
lea eax, [ecx + 1]
cmove eax, ecx
test dl, 8
lea ecx, [eax + 1]
cmove ecx, eax
test dl, 0x10
lea eax, [ecx + 1]
cmove eax, ecx
test dl, 0x20
lea ecx, [eax + 1]
cmove ecx, eax
test dl, 0x40
lea eax, [ecx + 1]
cmove eax, ecx
test dl, 0x80
lea ecx, [eax + 1]
cmove ecx, eax
test edx, 0x100
lea eax, [ecx + 1]
cmove eax, ecx
mov dword [ebp - 0x2f94], eax
cmp eax, 1
jbe 0x4f9f9f
xor edx, edx
mov eax, 0x64
div dword [ebp - 0x2f94]
mov edx, dword [ebp - 0x2fc0]
mov dword [ebp - 0x2fbc], eax
test dl, 1
je 0x4fa607
push str.Scanning:_Running_processes...
push 0
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4fa7ba
lea eax, [ebp - 0x2034]
mov dword [ebp - 0x2034], 0
push eax
push 0x1f40
lea eax, [ebp - 0x1f88]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x4fa1cf
mov eax, dword [ebp - 0x2034]
lea ecx, [ebp - 0x2024]
shr eax, 2
push eax
mov dword [ebp - 0x2034], eax
call fcn.005db290
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
lea ecx, [ebp - 0x2024]
push dword [ebp - 0x2fc4]
push str._total_:_r_n_r_n____Format:_Mode__Executable_path__Description
call fcn.005dc190
push eax
push str._r_n____Running_processes__
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push 0
push 0
push 0x800
lea ecx, [ebp - 0x1f94]
call fcn.005db9a0
cmp dword [ebp - 0x2034], 0
mov dword [ebp - 0x2f8c], 0
jbe 0x4fa1aa
cmp byte [esi + 4], 0
jne 0x4fa7ba
lea ecx, [ebp - 0x1f94]
call fcn.005dc380
push 0x800
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
mov edx, eax
mov eax, dword [ebp - 0x2f8c]
mov ecx, dword [ebp + eax*4 - 0x1f88]
call fcn.005ce4c0
test al, al
je 0x4fa191
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fa191
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push str._r_n_RunningProcess__
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov eax, dword [ebp - 0x2fbc]
lea ecx, [edi + 0x14f0]
cdq
sub eax, edx
xor edx, edx
sar eax, 1
imul eax, dword [ebp - 0x2f8c]
push 0
div dword [ebp - 0x2034]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4fa7ba
mov eax, dword [ebp - 0x2f8c]
inc eax
mov dword [ebp - 0x2f8c], eax
cmp eax, dword [ebp - 0x2034]
jb 0x4fa085
push 0
push str._r_n_____End_of_the_running_processes_list.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x2fbc]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x2f9c], eax
jmp 0x4fa1d1
xor eax, eax
cmp dword [ebp - 0x2034], 0
je 0x4fa5ed
push str.Scanning_Memory_modules...
push eax
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4fa7ba
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x2fac], 0
push 0x7d0
lea ecx, [ebp - 0x2064]
mov dword [ebp - 0x2fa0], 0x7d0
movq qword [ebp - 0x2064], xmm0
mov dword [ebp - 0x205c], 0
call fcn.004044a0
mov dword [ebp - 0x2e68], 0xffffffff
xor ecx, ecx
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x2e50], 0x428
mov dword [ebp - 0x2f98], ecx
cmp dword [ebp - 0x2034], ecx
jbe 0x4fa3f3
cmp byte [esi + 4], 0
jne 0x4fa79e
push dword [ebp + ecx*4 - 0x1f88]
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push eax
lea ecx, [ebp - 0x2e68]
call fcn.00401070
mov eax, dword [ebp - 0x2e68]
cmp eax, 0xffffffff
je 0x4fa3da
test eax, eax
je 0x4fa3da
lea ecx, [ebp - 0x2e50]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x4fa3da
lea eax, [ebp - 0x2e50]
push eax
push dword [ebp - 0x2e68]
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
je 0x4fa3da
mov edx, dword [ebp - 0x2fac]
lea esi, [edx + edx*2]
shl esi, 2
mov dword [ebp - 0x2f8c], esi
jmp 0x4fa2e7
mov edx, dword [ebp - 0x2fac]
test edx, edx
je 0x4fa34c
xor esi, esi
test edx, edx
je 0x4fa346
xor ecx, ecx
mov dword [ebp - 0x2fa4], ecx
nop dword [eax]
cmp dword [ebp - 0x2064], esi
lea eax, [esi + 1]
mov esi, eax
ja 0x4fa313
mov dword [ebp - 0x2064], eax
add ecx, dword [ebp - 0x205c]
lea eax, [ebp - 0x2c30]
push eax
call fcn.005dc4c0
test al, al
jne 0x4fa3ad
mov ecx, dword [ebp - 0x2fa4]
mov edx, dword [ebp - 0x2fac]
add ecx, 0xc
mov dword [ebp - 0x2fa4], ecx
cmp esi, edx
jb 0x4fa300
mov esi, dword [ebp - 0x2f8c]
cmp dword [ebp - 0x2064], edx
ja 0x4fa35d
lea eax, [edx + 1]
mov dword [ebp - 0x2064], eax
mov ecx, dword [ebp - 0x205c]
lea eax, [ebp - 0x2c30]
push eax
lea ecx, [ecx + esi]
call fcn.005dc510
mov edi, dword [ebp - 0x2fac]
add esi, 0xc
mov eax, dword [ebp - 0x2fa0]
inc edi
mov dword [ebp - 0x2fac], edi
mov dword [ebp - 0x2f8c], esi
cmp edi, eax
jb 0x4fa3b3
add eax, 0x3e8
lea ecx, [ebp - 0x2064]
push 0
push eax
mov dword [ebp - 0x2fa0], eax
call fcn.004042f0
jmp 0x4fa3b3
mov esi, dword [ebp - 0x2f8c]
lea eax, [ebp - 0x2e50]
push eax
push dword [ebp - 0x2e68]
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x4fa2e1
mov edi, dword [ebp - 0x2fcc]
mov esi, dword [ebp - 0x2fb4]
mov ecx, dword [ebp - 0x2f98]
inc ecx
mov dword [ebp - 0x2f98], ecx
cmp ecx, dword [ebp - 0x2034]
jb 0x4fa260
push dword [ebp - 0x2fac]
lea ecx, [ebp - 0x2024]
call fcn.005db320
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
lea ecx, [ebp - 0x2024]
push dword [ebp - 0x2fc4]
push str._total_:_r_n_r_n____Format:_Mode__Module_path__Description
call fcn.005dc190
push eax
push str._r_n____Memory_modules__
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
xor ecx, ecx
mov dword [ebp - 0x2f8c], ecx
cmp dword [ebp - 0x2fac], ecx
jbe 0x4fa5bb
xor edx, edx
mov dword [ebp - 0x2f98], edx
cmp byte [esi + 4], 0
jne 0x4fa79e
lea eax, [ecx + 1]
mov dword [ebp - 0x2fa0], eax
cmp dword [ebp - 0x2064], ecx
ja 0x4fa493
mov dword [ebp - 0x2064], eax
jmp 0x4fa499
mov dword [ebp - 0x2fa0], eax
mov ecx, dword [ebp - 0x205c]
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ecx + edx]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fa594
mov eax, dword [ebp - 0x2064]
lea ecx, [ebp - 0x1fe4]
cmp eax, dword [ebp - 0x2f8c]
mov esi, dword [ebp - 0x205c]
cmovbe eax, dword [ebp - 0x2fa0]
add esi, dword [ebp - 0x2f98]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
mov dword [ebp - 0x2064], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_MemoryModules__
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov eax, dword [ebp - 0x2fbc]
lea ecx, [edi + 0x14f0]
cdq
sub eax, edx
xor edx, edx
sar eax, 1
imul eax, dword [ebp - 0x2f8c]
push 0
div dword [ebp - 0x2fac]
add eax, dword [ebp - 0x2f9c]
push eax
call fcn.005b66e0
mov esi, dword [ebp - 0x2fb4]
cmp byte [esi + 4], 0
jne 0x4fa79e
mov edx, dword [ebp - 0x2f98]
mov ecx, dword [ebp - 0x2fa0]
add edx, 0xc
mov dword [ebp - 0x2f8c], ecx
mov dword [ebp - 0x2f98], edx
cmp ecx, dword [ebp - 0x2fac]
jb 0x4fa470
push 0
push str._r_n_____End_of_the_Memory_modules_list.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
lea ecx, [ebp - 0x2e68]
call fcn.00401050
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x205c]
test ecx, ecx
je 0x4fa5ed
push 3
call fcn.00401e90
mov eax, dword [ebp - 0x2fbc]
lea ecx, [edi + 0x14f0]
push 0
push eax
mov dword [ebp - 0x2f9c], eax
call fcn.005b66e0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2030], xmm0
mov dword [ebp - 0x2030], 0
mov dword [ebp - 0x202c], 0
movlpd qword [ebp - 0x2054], xmm0
mov dword [ebp - 0x2054], 0
mov dword [ebp - 0x2050], 0
movlpd qword [ebp - 0x2090], xmm0
mov dword [ebp - 0x2090], 0
mov dword [ebp - 0x208c], 0
test byte [ebp - 0x2fa8], 0x40
mov byte [ebp - 4], 0x16
je 0x4fa69a
push 0
lea eax, [ebp - 0x2030]
push eax
lea edx, [ebp - 0x2090]
lea ecx, [ebp - 0x2054]
call fcn.0059d390
mov dword [ebp - 0x2fb8], eax
test eax, eax
jne 0x4fa70a
and dword [ebp - 0x2fa8], 0xffffffbf
push 0
lea ecx, [edi + 0x1290]
mov dword [ebp - 0x2fb8], 1
call fcn.0057c300
push eax
push 1
lea ecx, [ebp - 0x2030]
call fcn.00403af0
mov ecx, eax
call fcn.005dc510
push 0
lea ecx, [edi + 0x1290]
call fcn.0057c2d0
push eax
push 1
lea ecx, [ebp - 0x2054]
call fcn.00403af0
mov ecx, eax
call fcn.005dc510
push 0
lea ecx, [edi + 0x1290]
call fcn.0057c330
push eax
push 1
lea ecx, [ebp - 0x2090]
call fcn.00403af0
mov ecx, eax
call fcn.005dc510
xor eax, eax
lea ecx, [ebp - 0x1ff8]
cmp byte [edi + 0x28], al
xorps xmm0, xmm0
movlpd qword [ebp - 0x1ff8], xmm0
setne al
inc eax
add eax, dword [ebp - 0x2fb8]
mov dword [ebp - 0x2fac], eax
inc eax
push eax
call fcn.00403c80
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x2e5c]
xorps xmm0, xmm0
mov dword [ebp - 0x2e54], 0
movq qword [ebp - 0x2e5c], xmm0
call fcn.005d6ac0
test byte [ebp - 0x2fc0], 2
mov byte [ebp - 4], 0x18
je 0x4fb921
push str.Scanning_Winlogon_entries...
push dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
mov esi, dword [ebp - 0x2fb4]
cmp byte [esi + 4], 0
je 0x4fa89d
mov byte [ebp - 0x2f8d], 2
jmp 0x5010f6
lea ecx, [ebp - 0x2e68]
call fcn.00401050
mov ecx, dword [ebp - 0x205c]
test ecx, ecx
je 0x4fa7ba
push 3
call fcn.00401e90
mov byte [ebp - 0x2f8d], 2
lea ecx, [ebp - 0x1fe4]
call fcn.005dc430
lea ecx, [ebp - 0x1fd8]
call fcn.005dc430
lea ecx, [ebp - 0x1fcc]
call fcn.005dc430
lea ecx, [ebp - 0x1fb4]
call fcn.005d69e0
lea ecx, [ebp - 0x1fa4]
call fcn.005d69e0
lea ecx, [ebp - 0x2220]
call fcn.00588a50
mov ecx, dword [ebp - 0x2044]
test ecx, ecx
je 0x4fa814
push 3
call fcn.00401e90
lea ecx, [ebp - 0x2010]
call fcn.005d9280
lea ecx, [ebp - 0x2018]
call fcn.00401050
lea ecx, [ebp - 0x1fc0]
call fcn.005dc430
lea ecx, [ebp - 0x1ff0]
call fcn.005dc430
lea ecx, [ebp - 0x2024]
call fcn.005dc430
lea ecx, [ebp - 0x1f94]
call fcn.005dc430
lea ecx, [ebp - 0x1fb0]
call fcn.005dc430
lea ecx, [ebp - 0x1fa0]
call fcn.005dc430
lea ecx, [ebp - 0x211c]
call fcn.005dc430
mov al, byte [ebp - 0x2f8d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
lea ecx, [ebp - 0x1fa0]
push dword [ebp - 0x2fc4]
push str._r_n____Winlogon_entries:_r_n_r_n____Format:_Mode__Name__Destination_file__Description
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
xorps xmm0, xmm0
lea ecx, [ebp - 0x21b8]
movups xmmword [ebp - 0x21b8], xmm0
movq qword [ebp - 0x21a8], xmm0
call fcn.005d9320
mov eax, dword [ebp - 0x2fb8]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x4fa978
xor edi, edi
mov dword [ebp - 0x2fa4], eax
nop dword [eax]
nop word [eax + eax]
mov ecx, dword [ebp - 0x2054]
mov esi, dword [ebp - 0x1ff8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ecx + edi]
add esi, edi
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
call fcn.005dc190
push eax
push str.HKU_
mov ecx, esi
call fcn.005dc200
add edi, 0xc
sub dword [ebp - 0x2fa4], 1
jne 0x4fa920
mov edi, dword [ebp - 0x2fcc]
mov esi, dword [ebp - 0x2fb4]
mov eax, dword [ebp - 0x2fb8]
lea ecx, [eax + eax*2]
shl ecx, 2
mov dword [ebp - 0x2f94], ecx
add ecx, dword [ebp - 0x1ff8]
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
call fcn.005dc510
cmp byte [edi + 0x28], 0
je 0x4fa9b5
mov eax, dword [ebp - 0x1ff8]
mov ecx, dword [ebp - 0x2f94]
add eax, 0xc
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
add ecx, eax
call fcn.005dc510
mov eax, dword [ebp - 0x2fbc]
cdq
and edx, 3
mov dword [ebp - 0x2fa0], 0
add eax, edx
sar eax, 2
cmp dword [ebp - 0x2fac], 0
mov dword [ebp - 0x2f8c], eax
jbe 0x4fae5c
xor ecx, ecx
mov dword [ebp - 0x2f98], 0
mov dword [ebp - 0x2fa4], ecx
mov eax, ecx
xor edx, edx
div dword [ebp - 0x2fac]
push 0
add eax, dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4fb90a
mov eax, dword [ebp - 0x2fa0]
cmp eax, dword [ebp - 0x2fb8]
jae 0x4faa64
mov ecx, dword [ebp - 0x2f98]
add ecx, dword [ebp - 0x2030]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Winlogon_
call fcn.005dc190
push eax
push 0x67b260
lea ecx, [ebp - 0x1fc0]
call fcn.005dc200
jmp 0x4faa7d
lea ecx, [ebp - 0x1fc0]
jne 0x4faa73
push str._Winlogon_
jmp 0x4faa78
push str._Winlogon32_
call fcn.005dc510
mov ecx, dword [ebp - 0x2f98]
lea eax, [ebp - 0x1fb0]
add ecx, dword [ebp - 0x1ff8]
push eax
push str.Userinit
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d65d0
test al, al
je 0x4fac0c
push 1
push 0x624514
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21b8]
call fcn.005d9070
mov ecx, eax
call fcn.005d9210
test eax, eax
je 0x4fac0c
lea ecx, [ebp - 0x21b8]
mov dword [ebp - 0x2f94], 0
call fcn.005d9210
test eax, eax
je 0x4fac0c
mov esi, dword [ebp - 0x2f94]
nop
push 3
push 1
push esi
lea ecx, [ebp - 0x21b8]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc260
lea edx, [edi + 0x1c]
mov ecx, eax
call fcn.005e88c0
test al, al
jne 0x4fab50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fabf2
push 0
push 0
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push str.__Userinit_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
lea ecx, [ebp - 0x21b8]
inc esi
call fcn.005d9210
cmp esi, eax
jb 0x4fab00
mov esi, dword [ebp - 0x2fb4]
mov ecx, dword [ebp - 0x2f98]
lea eax, [ebp - 0x1f94]
add ecx, dword [ebp - 0x1ff8]
push eax
push 0x6417fc
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d65d0
test al, al
je 0x4fad1d
push 3
lea edx, [edi + 0x1c]
lea ecx, [ebp - 0x1f94]
call fcn.005e88c0
test al, al
jne 0x4fac77
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fae2a
push 0
push 0
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push str.__Shell_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov ecx, dword [ebp - 0x2f98]
lea eax, [ebp - 0x1f94]
add ecx, dword [ebp - 0x1ff8]
push eax
push str.UIHost
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d65d0
test al, al
je 0x4fae2a
push 3
lea edx, [edi + 0x1c]
lea ecx, [ebp - 0x1f94]
call fcn.005e88c0
test al, al
jne 0x4fad88
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fae2a
push 0
push 0
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push str.__UIHost_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov eax, dword [ebp - 0x2fa0]
mov ecx, dword [ebp - 0x2fa4]
inc eax
add ecx, dword [ebp - 0x2f8c]
add dword [ebp - 0x2f98], 0xc
mov dword [ebp - 0x2fa0], eax
mov dword [ebp - 0x2fa4], ecx
cmp eax, dword [ebp - 0x2fac]
jb 0x4fa9f3
movsd xmm0, qword [0x6edab0]
comisd xmm0, xmmword [edi + 8]
jbe 0x4fb000
push 0
push 0x20019
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
lea ecx, [ebp - 0x1fa4]
call fcn.005d6a30
test al, al
je 0x4fb000
lea eax, [ebp - 0x2e5c]
push eax
push 0
lea ecx, [ebp - 0x1fa4]
call fcn.005d6380
test al, al
je 0x4fb000
xor esi, esi
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x1ff0]
push 0x624284
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
call fcn.005dc200
lea eax, [ebp - 0x1f94]
push eax
push str.DllName
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb4]
call fcn.005d65d0
test al, al
je 0x4fafde
push 3
lea edx, [edi + 0x1c]
lea ecx, [ebp - 0x1f94]
call fcn.005e88c0
test al, al
jne 0x4faf42
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fafde
push 0
push 0
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push 0x6558f0
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x1fa0]
push str._r_n_WinLogon.Notify__
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
lea eax, [ebp - 0x2e5c]
inc esi
push eax
push esi
lea ecx, [ebp - 0x1fa4]
call fcn.005d6380
test al, al
jne 0x4faeb0
mov esi, dword [ebp - 0x2fb4]
push 0
push str._r_n_____End_of_the_Winlogon_entries_list.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x2f8c]
mov ecx, dword [ebp - 0x2f9c]
push str.Scanning:_Startup_entries...
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x2f9c], ecx
push ecx
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4fb90a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
lea ecx, [ebp - 0x1fa0]
push dword [ebp - 0x2fc4]
push str._r_n____Startup_entries:_r_n_r_n____Format:_Mode__Name__Destination_file__Description
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov eax, dword [ebp - 0x2fb8]
mov dword [ebp - 0x300c], 0x6484e0
jmp eax
test byte [eax + eax - 0x39], ah
test eax, edi
iretd
invalid
invalid
fdivr dword [eax + 0x66]
add bh, al
test esp, edi
iretd
invalid
invalid
call 0x85501722
invalid
je 0x4fb118
xor edi, edi
mov dword [ebp - 0x2fa4], eax
nop word [eax + eax]
mov ecx, dword [ebp - 0x2054]
mov esi, dword [ebp - 0x1ff8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ecx + edi]
add esi, edi
push str.SoftwareMicrosoftWindowsCurrentVersion_
call fcn.005dc190
push eax
push str.HKU_
mov ecx, esi
call fcn.005dc200
add edi, 0xc
sub dword [ebp - 0x2fa4], 1
jne 0x4fb0c0
mov edi, dword [ebp - 0x2fcc]
mov esi, dword [ebp - 0x2fb4]
mov eax, dword [ebp - 0x2fb8]
lea ecx, [eax + eax*2]
mov eax, dword [ebp - 0x1ff8]
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersion_
lea ecx, [eax + ecx*4]
call fcn.005dc510
cmp byte [edi + 0x28], 0
je 0x4fb151
mov eax, dword [ebp - 0x2fb8]
inc eax
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersion_
lea ecx, [eax + eax*2]
mov eax, dword [ebp - 0x1ff8]
lea ecx, [eax + ecx*4]
call fcn.005dc510
xor eax, eax
mov dword [ebp - 0x2fa4], eax
cmp dword [ebp - 0x2fac], eax
jbe 0x4fb444
xor ecx, ecx
mov dword [ebp - 0x2fa0], eax
mov dword [ebp - 0x2f94], ecx
mov eax, ecx
xor edx, edx
div dword [ebp - 0x2fac]
push 0
add eax, dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4fb90a
xor edx, edx
mov dword [ebp - 0x2fb0], edx
nop dword [eax]
nop word [eax + eax]
mov ecx, dword [ebp - 0x2fa4]
mov eax, dword [ebp + edx*4 - 0x300c]
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x2f98], eax
push 0
cmp ecx, dword [ebp - 0x2fb8]
jae 0x4fb1fd
mov ecx, dword [ebp - 0x2fa0]
add ecx, dword [ebp - 0x2030]
push 0x6299d4
push eax
push 0x624284
call fcn.005dc190
push eax
push 0x67b260
jmp 0x4fb215
push 0
push 0
push 0x6299d4
push eax
jne 0x4fb210
push str._HKLM...
jmp 0x4fb215
push str._HKLMW6432...
lea ecx, [ebp - 0x1fc0]
call fcn.005dc200
mov edx, dword [ebp - 0x2f98]
mov ecx, dword [ebp - 0x2fa0]
add ecx, dword [ebp - 0x1ff8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1ff0]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d6a30
test al, al
je 0x4fb3fc
lea eax, [ebp - 0x2e5c]
mov dword [ebp - 0x2f98], 0
push eax
push 0
lea ecx, [ebp - 0x1fa4]
call fcn.005d62e0
test al, al
je 0x4fb3fc
nop dword [eax]
nop dword [eax + eax]
lea eax, [ebp - 0x1f94]
push eax
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x1fa4]
call fcn.005d6740
test al, al
je 0x4fb3d4
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
test al, al
jne 0x4fb3d4
push 3
lea edx, [edi + 0x1c]
lea ecx, [ebp - 0x1f94]
call fcn.005e88c0
test al, al
jne 0x4fb31d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fb3d4
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push 0x6558f0
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x1fc0]
push 0x6558f0
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x4fb90a
mov eax, dword [ebp - 0x2f98]
lea ecx, [ebp - 0x2e5c]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x1fa4]
mov dword [ebp - 0x2f98], eax
call fcn.005d62e0
test al, al
jne 0x4fb2b0
mov edx, dword [ebp - 0x2fb0]
inc edx
mov dword [ebp - 0x2fb0], edx
cmp edx, 3
jb 0x4fb1b0
mov eax, dword [ebp - 0x2fa4]
mov ecx, dword [ebp - 0x2f94]
inc eax
add ecx, dword [ebp - 0x2f8c]
add dword [ebp - 0x2fa0], 0xc
mov dword [ebp - 0x2fa4], eax
mov dword [ebp - 0x2f94], ecx
cmp eax, dword [ebp - 0x2fac]
jb 0x4fb173
push 0
lea ecx, [edi + 0x1290]
call fcn.0057bdc0
push eax
lea ecx, [ebp - 0x1fb0]
call fcn.005dc510
push 0
lea ecx, [edi + 0x1290]
call fcn.0057c1c0
push eax
lea ecx, [ebp - 0x1fb0]
call fcn.005dad50
mov eax, dword [ebp - 0x2f9c]
add eax, dword [ebp - 0x2f8c]
mov dword [ebp - 0x2f9c], eax
mov eax, dword [ebp - 0x2fb8]
test eax, eax
je 0x4fb503
xor ecx, ecx
mov dword [ebp - 0x2fb0], eax
mov dword [ebp - 0x2f94], ecx
mov esi, dword [ebp - 0x2090]
mov edi, dword [ebp - 0x1ff8]
add esi, ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
add edi, ecx
lea ecx, [ebp - 0x1fb0]
push 0
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005dc200
mov ecx, dword [ebp - 0x2f94]
add ecx, 0xc
sub dword [ebp - 0x2fb0], 1
mov dword [ebp - 0x2f94], ecx
jne 0x4fb4a0
mov edi, dword [ebp - 0x2fcc]
mov eax, dword [ebp - 0x2fb8]
lea ecx, [eax + eax*2]
mov eax, dword [ebp - 0x1ff8]
push 0
lea esi, [eax + ecx*4]
lea ecx, [edi + 0x1290]
call fcn.0057be30
push eax
mov ecx, esi
call fcn.005dc510
push 0x250
xorps xmm0, xmm0
lea eax, [ebp - 0x27c8]
push 0
movups xmmword [ebp - 0x2578], xmm0
push eax
mov dword [ebp - 0x2578], 0xffffffff
call fcn.00420090
add esp, 0xc
push 0x4c
lea eax, [ebp - 0x22f8]
mov byte [ebp - 4], 0x1a
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x22f8]
call fcn.005e9520
mov eax, dword [ebp - 0x2fb8]
mov esi, dword [ebp - 0x2fb4]
inc eax
xor ecx, ecx
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x2fa4], 0
mov dword [ebp - 0x2fb0], eax
mov dword [ebp - 0x2f98], 0
mov dword [ebp - 0x2f94], ecx
mov eax, ecx
xor edx, edx
div dword [ebp - 0x2fb0]
push 0
add eax, dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4fb8ed
mov eax, dword [ebp - 0x2fb8]
cmp dword [ebp - 0x2fa4], eax
jne 0x4fb5eb
push str._CommonStartupFolder_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc510
jmp 0x4fb624
mov ecx, dword [ebp - 0x2f98]
add ecx, dword [ebp - 0x2030]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.StartupFolder_
call fcn.005dc190
push eax
push 0x67b260
lea ecx, [ebp - 0x1fc0]
call fcn.005dc200
mov ecx, dword [ebp - 0x2f98]
add ecx, dword [ebp - 0x1ff8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1ff0]
call fcn.005dc200
push 3
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x27c8]
call fcn.00401280
test al, al
je 0x4fb84e
nop dword [eax + eax]
push 0
mov edx, str.desktop.ini
lea ecx, [ebp - 0x279c]
call fcn.005d8ad0
test eax, eax
je 0x4fb83b
xor edx, edx
lea eax, [ebp - 0x279c]
cmp word [ebp - 0x279c], dx
je 0x4fb6c5
nop dword [eax + eax]
movzx ecx, word [eax + 2]
add eax, 2
cmp ecx, 0x2e
jne 0x4fb6c0
mov edx, eax
jmp 0x4fb6b0
test cx, cx
jne 0x4fb6b0
push edx
lea ecx, [ebp - 0x1fb0]
call fcn.005dc510
mov ecx, dword [ebp - 0x2f98]
lea eax, [ebp - 0x279c]
add ecx, dword [ebp - 0x1ff8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc200
push 0x630518
lea ecx, [ebp - 0x1fb0]
call fcn.005dc4c0
test al, al
je 0x4fb783
push 0
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x22f8]
call fcn.005e93e0
push 0
lea ecx, [ebp - 0x22f8]
call fcn.005e9390
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc510
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4fb783
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fb83b
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push 0x6558f0
lea eax, [ebp - 0x279c]
push eax
push 0x6558f0
lea ecx, [ebp - 0x1fc0]
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x4fb8ed
lea ecx, [ebp - 0x27c8]
call fcn.00401230
test al, al
jne 0x4fb680
mov eax, dword [ebp - 0x2fa4]
mov ecx, dword [ebp - 0x2f94]
inc eax
add ecx, dword [ebp - 0x2f8c]
add dword [ebp - 0x2f98], 0xc
mov dword [ebp - 0x2fa4], eax
mov dword [ebp - 0x2f94], ecx
cmp eax, dword [ebp - 0x2fb8]
jbe 0x4fb5a3
push 0
push str._r_n_____End_of_the_startup_entries_list.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x2f8c]
mov ecx, dword [ebp - 0x2fbc]
push 0
lea eax, [eax + eax*2]
sub ecx, eax
mov eax, dword [ebp - 0x2f9c]
add eax, ecx
lea ecx, [edi + 0x14f0]
push eax
mov dword [ebp - 0x2f9c], eax
call fcn.005b66e0
lea ecx, [ebp - 0x22f8]
call fcn.005e9080
mov eax, dword [ebp - 0x2578]
cmp eax, 0xffffffff
je 0x4fb8dc
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x21b8]
mov byte [ebp - 4], 0x18
call fcn.005d9280
jmp 0x4fb927
lea ecx, [ebp - 0x22f8]
call fcn.005e9080
mov eax, dword [ebp - 0x2578]
cmp eax, 0xffffffff
je 0x4fb90a
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x21b8]
call fcn.005d9280
mov byte [ebp - 0x2f8d], 2
jmp 0x5010f6
mov esi, dword [ebp - 0x2fb4]
xorps xmm0, xmm0
mov dword [ebp - 0x2080], 0
lea ecx, [ebp - 0x2088]
movq qword [ebp - 0x2088], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x2040]
xorps xmm0, xmm0
mov dword [ebp - 0x2038], 0
movq qword [ebp - 0x2040], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x2170]
xorps xmm0, xmm0
mov dword [ebp - 0x2168], 0
movq qword [ebp - 0x2170], xmm0
call fcn.005dc5e0
push 8
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x2e78]
push str.w8_w4_w4_w4_w12_
mov dword [ebp - 0x2e78], 0
call fcn.00401400
mov eax, dword [ebp - 0x2fc0]
mov byte [ebp - 4], 0x1f
test al, 4
je 0x4fca10
push str.Scanning:_IE__BHO_and_Shell_execute_hooks...
push dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x5011a4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
lea ecx, [ebp - 0x1fa0]
push dword [ebp - 0x2fc4]
push str._r_n____IE__BHO_and_Shell_execute_hooks:_r_n_r_n____Format:_Mode__Name__Destination_file_url__Description
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov eax, dword [ebp - 0x2fb8]
test eax, eax
je 0x4fba98
xor edi, edi
mov dword [ebp - 0x2f94], eax
nop word [eax + eax]
mov ecx, dword [ebp - 0x2054]
mov esi, dword [ebp - 0x1ff8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ecx + edi]
add esi, edi
push str.SoftwareMicrosoftInternet_ExplorerMain
call fcn.005dc190
push eax
push str.HKU_
mov ecx, esi
call fcn.005dc200
add edi, 0xc
sub dword [ebp - 0x2f94], 1
jne 0x4fba40
mov edi, dword [ebp - 0x2fcc]
mov esi, dword [ebp - 0x2fb4]
mov eax, dword [ebp - 0x2fb8]
lea ecx, [eax + eax*2]
shl ecx, 2
mov dword [ebp - 0x2f94], ecx
add ecx, dword [ebp - 0x1ff8]
push str.HKLMSOFTWAREMicrosoftInternet_ExplorerMain
call fcn.005dc510
cmp byte [edi + 0x28], 0
je 0x4fbad5
mov eax, dword [ebp - 0x1ff8]
mov ecx, dword [ebp - 0x2f94]
add eax, 0xc
push str.HKLMSOFTWAREWow6432NodeMicrosoftInternet_ExplorerMain
add ecx, eax
call fcn.005dc510
mov eax, dword [ebp - 0x2fbc]
cdq
and edx, 3
mov dword [ebp - 0x2fa4], 0
add eax, edx
sar eax, 2
cmp dword [ebp - 0x2fac], 0
mov dword [ebp - 0x2f98], eax
jbe 0x4fbdf3
xor ecx, ecx
mov dword [ebp - 0x2fa0], 0
mov dword [ebp - 0x2f94], ecx
mov eax, ecx
xor edx, edx
div dword [ebp - 0x2fac]
push 0
add eax, dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x5011a4
mov eax, dword [ebp - 0x2fa4]
cmp eax, dword [ebp - 0x2fb8]
jae 0x4fbb84
mov ecx, dword [ebp - 0x2fa0]
add ecx, dword [ebp - 0x2030]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.IEStartPages_
call fcn.005dc190
push eax
push 0x67b260
lea ecx, [ebp - 0x1fc0]
call fcn.005dc200
jmp 0x4fbb9d
lea ecx, [ebp - 0x1fc0]
jne 0x4fbb93
push str._IEStartPages_
jmp 0x4fbb98
push str._IEStartPages32_
call fcn.005dc510
mov ecx, dword [ebp - 0x2fa0]
add ecx, dword [ebp - 0x1ff8]
push 0
push 0x20019
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d6a30
test al, al
je 0x4fbdbb
lea eax, [ebp - 0x1f94]
push eax
push str.Start_Page
lea ecx, [ebp - 0x1fa4]
call fcn.005d6740
test al, al
je 0x4fbc45
lea ecx, [ebp - 0x1f94]
call fcn.005dc3a0
test eax, eax
je 0x4fbc45
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__IE_Start_Page_r_n
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push str.__Start_Page_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
lea eax, [ebp - 0x1f94]
push eax
push str.Start_Page_Redirect_Cache
lea ecx, [ebp - 0x1fa4]
call fcn.005d6740
test al, al
je 0x4fbcc1
lea ecx, [ebp - 0x1f94]
call fcn.005dc3a0
test eax, eax
je 0x4fbcc1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__IE_Start_Page_Redirect_Cache_r_n
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push str.__Start_Page_Redirect_Cache_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
lea eax, [ebp - 0x1f94]
push eax
push str.Local_Page
lea ecx, [ebp - 0x1fa4]
call fcn.005d6740
test al, al
je 0x4fbdbb
lea ecx, [ebp - 0x1f94]
call fcn.005dc3a0
test eax, eax
je 0x4fbdbb
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4fbd24
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
push str.__IE_local_page
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push str.__Local_Page_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x5011a4
mov eax, dword [ebp - 0x2fa4]
mov ecx, dword [ebp - 0x2f94]
inc eax
add ecx, dword [ebp - 0x2f98]
add dword [ebp - 0x2fa0], 0xc
mov dword [ebp - 0x2fa4], eax
mov dword [ebp - 0x2f94], ecx
cmp eax, dword [ebp - 0x2fac]
jb 0x4fbb13
mov eax, dword [ebp - 0x2f98]
mov ecx, dword [ebp - 0x2f9c]
mov esi, dword [ebp - 0x2fb8]
cdq
and edx, 3
add eax, edx
sar eax, 2
add ecx, eax
mov dword [ebp - 0x2f9c], ecx
mov dword [ebp - 0x2fa0], ecx
test esi, esi
je 0x4fbe74
xor edi, edi
mov dword [ebp - 0x2f94], esi
mov ecx, dword [ebp - 0x2054]
mov esi, dword [ebp - 0x1ff8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ecx + edi]
add esi, edi
push 0x64e328
call fcn.005dc190
push eax
push str.HKU_
mov ecx, esi
call fcn.005dc200
add edi, 0xc
sub dword [ebp - 0x2f94], 1
jne 0x4fbe22
mov edi, dword [ebp - 0x2fcc]
mov esi, dword [ebp - 0x2fb8]
mov eax, dword [ebp - 0x1ff8]
lea ecx, [esi + esi*2]
push str.HKLMSOFTWAREMicrosoftInternet_ExplorerSearchScopes
lea ecx, [eax + ecx*4]
call fcn.005dc510
cmp byte [edi + 0x28], 0
je 0x4fbea9
mov eax, dword [ebp - 0x1ff8]
lea ecx, [esi + 1]
lea ecx, [ecx + ecx*2]
push str.HKLMSOFTWAREWow6432NodeMicrosoftInternet_ExplorerSearchScopes
lea ecx, [eax + ecx*4]
call fcn.005dc510
cmp dword [ebp - 0x2fac], 0
mov esi, dword [ebp - 0x2fb4]
mov dword [ebp - 0x2fa4], 0
jbe 0x4fc6a8
xor ecx, ecx
mov dword [ebp - 0x2f8c], 0
mov dword [ebp - 0x2f94], ecx
nop dword [eax + eax]
mov eax, ecx
xor edx, edx
div dword [ebp - 0x2fac]
push 0
add eax, dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x5011a4
mov ecx, dword [ebp - 0x2f8c]
add ecx, dword [ebp - 0x1ff8]
push 0
push 0x20019
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d6a30
test al, al
je 0x4fc0ac
mov eax, dword [ebp - 0x2fa4]
cmp eax, dword [ebp - 0x2fb8]
jae 0x4fbf7d
mov ecx, dword [ebp - 0x2f8c]
add ecx, dword [ebp - 0x2030]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.IESearch_
call fcn.005dc190
push eax
push 0x67b260
lea ecx, [ebp - 0x1fc0]
call fcn.005dc200
jmp 0x4fbf96
lea ecx, [ebp - 0x1fc0]
jne 0x4fbf8c
push str._IESearch_
jmp 0x4fbf91
push str._IESearch32_
call fcn.005dc510
lea eax, [ebp - 0x2e5c]
mov dword [ebp - 0x2fb0], 0
push eax
push 0
lea ecx, [ebp - 0x1fa4]
call fcn.005d6380
test al, al
je 0x4fc0ac
mov esi, dword [ebp - 0x2fb0]
mov edi, dword [ebp - 0x2f8c]
nop dword [eax + eax]
mov ecx, dword [ebp - 0x1ff8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x2e5c]
lea ecx, [ecx + edi]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1ff0]
call fcn.005dc200
lea eax, [ebp - 0x1fb0]
push eax
push 0x65fd7c
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb4]
call fcn.005d65d0
test al, al
je 0x4fc084
lea ecx, [ebp - 0x1fb0]
call fcn.005dbeb0
test al, al
jne 0x4fc084
push 0
push 0
push 0
push 0
push 0
push str.__IE_search_provider_r_n
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push 0x6558f0
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x1fc0]
push 0x6558f0
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x2e5c]
inc esi
push eax
push esi
lea ecx, [ebp - 0x1fa4]
call fcn.005d6380
test al, al
jne 0x4fbfd0
mov edi, dword [ebp - 0x2fcc]
mov esi, dword [ebp - 0x2fb4]
mov eax, dword [ebp - 0x2fa4]
mov ecx, dword [ebp - 0x2f94]
inc eax
mov edx, dword [ebp - 0x2f98]
add ecx, edx
add dword [ebp - 0x2f8c], 0xc
mov dword [ebp - 0x2fa4], eax
mov dword [ebp - 0x2f94], ecx
cmp eax, dword [ebp - 0x2fac]
jb 0x4fbee0
mov eax, edx
mov dword [ebp - 0x2fa4], 0
cdq
and edx, 3
mov dword [ebp - 0x2f8c], 0
add eax, edx
sar eax, 2
add eax, dword [ebp - 0x2fa0]
xor ecx, ecx
mov dword [ebp - 0x2f9c], eax
mov eax, dword [ebp - 0x2fbc]
mov dword [ebp - 0x2fb0], ecx
mov dword [ebp - 0x2fbc], eax
nop
mov eax, ecx
xor edx, edx
div dword [ebp - 0x2fac]
push 0
add eax, dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x5011a4
mov eax, dword [ebp - 0x2fa4]
cmp eax, dword [ebp - 0x2fb8]
jae 0x4fc207
mov ecx, dword [ebp - 0x2f8c]
add ecx, dword [ebp - 0x2054]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerToolbar
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x1ff0]
call fcn.005dc200
mov ecx, dword [ebp - 0x2f8c]
add ecx, dword [ebp - 0x2054]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareClassesCLSID
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x2088]
call fcn.005dc200
mov ecx, dword [ebp - 0x2f8c]
add ecx, dword [ebp - 0x2030]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.IEToolbar_
call fcn.005dc190
push eax
push 0x67b260
lea ecx, [ebp - 0x1fc0]
call fcn.005dc200
jmp 0x4fc252
push 1
lea ecx, [ebp - 0x1ff0]
jne 0x4fc224
push str.HKLMSOFTWAREMicrosoftInternet_ExplorerToolbar
call fcn.005dc260
push 1
push str.HKLMSOFTWAREClassesCLSID
jmp 0x4fc235
push str.HKLMSOFTWAREWow6432NodeMicrosoftInternet_ExplorerToolbar
call fcn.005dc260
push 1
push str.HKLMSOFTWAREWow6432NodeClassesCLSID
lea ecx, [ebp - 0x2088]
call fcn.005dc260
push 1
push str._HKLM...IEToolbar_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc260
push 0
push 0x20019
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d6a30
test al, al
je 0x4fc53b
lea eax, [ebp - 0x2e5c]
mov dword [ebp - 0x2f94], 0
push eax
push 0
lea ecx, [ebp - 0x1fa4]
call fcn.005d62e0
test al, al
je 0x4fc53b
nop
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x1fb0]
call fcn.005dc510
push 0
push dword [ebp - 0x2e78]
lea ecx, [ebp - 0x1fb0]
call fcn.005d98d0
test al, al
je 0x4fc513
lea ecx, [ebp - 0x1f94]
call fcn.005dc400
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667770
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x2088]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc200
lea eax, [ebp - 0x1f94]
push eax
push 0x62439c
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb4]
call fcn.005d65d0
test al, al
je 0x4fc344
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
test al, al
je 0x4fc39e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667790
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x2088]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc200
lea eax, [ebp - 0x1f94]
push eax
push 0x62439c
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb4]
call fcn.005d65d0
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
test al, al
je 0x4fc407
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667790
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x2088]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc200
lea eax, [ebp - 0x1f94]
push eax
push 0x62439c
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb4]
call fcn.005d65d0
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
lea ecx, [ebp - 0x1f94]
test al, al
je 0x4fc428
push str.CLSID_not_found
call fcn.005dc510
jmp 0x4fc45c
push 3
lea edx, [edi + 0x1c]
call fcn.005e88c0
test al, al
jne 0x4fc45c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fc513
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push 0x6558f0
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x1fc0]
push 0x6558f0
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x5011a4
mov eax, dword [ebp - 0x2f94]
lea ecx, [ebp - 0x2e5c]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x1fa4]
mov dword [ebp - 0x2f94], eax
call fcn.005d62e0
test al, al
jne 0x4fc2a0
mov eax, dword [ebp - 0x2fa4]
mov ecx, dword [ebp - 0x2fb0]
inc eax
add ecx, dword [ebp - 0x2f98]
add dword [ebp - 0x2f8c], 0xc
mov dword [ebp - 0x2fa4], eax
mov dword [ebp - 0x2fb0], ecx
cmp eax, dword [ebp - 0x2fac]
jb 0x4fc120
mov ecx, dword [ebp - 0x2f9c]
mov eax, dword [ebp - 0x2f98]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
cdq
push 0
and edx, 3
mov dword [ebp - 0x2fe4], str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push 0
add eax, edx
mov dword [ebp - 0x2fe0], str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
sar eax, 2
push 0
add ecx, eax
mov dword [ebp - 0x2fdc], 0
push str.SoftwareMicrosoftInternet_ExplorerUrlSearchHooks
mov dword [ebp - 0x2f9c], ecx
lea ecx, [edi + 0x1290]
push 0
mov dword [ebp - 0x2fd4], str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x1fb0]
call fcn.005dc200
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
mov dword [ebp - 0x2fd8], eax
xor eax, eax
mov dword [ebp - 0x2f8c], eax
nop dword [eax]
push 0
push 0x20019
push dword [ebp + eax*4 - 0x2fe4]
lea ecx, [ebp - 0x1fa4]
call fcn.005d6a30
test al, al
je 0x4fc9b3
mov eax, dword [ebp - 0x2f8c]
lea ecx, [edi + 0x14f0]
imul eax, dword [ebp - 0x2f98]
xor edx, edx
push 0
div dword [ebp - 0x2fac]
add eax, dword [ebp - 0x2f9c]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x5011a4
mov eax, dword [ebp - 0x2f8c]
test eax, eax
jne 0x4fc6c4
push str._BHO_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc510
push str.HKLMSOFTWAREClassesCLSID
lea ecx, [ebp - 0x2088]
call fcn.005dc510
xor eax, eax
cmp dword [ebp - 0x2f8c], 2
lea ecx, [ebp - 0x2e5c]
push ecx
mov dword [ebp - 0x2f94], eax
lea ecx, [ebp - 0x1fa4]
push eax
jae 0x4fc721
call fcn.005d6380
jmp 0x4fc726
mov eax, dword [ebp - 0x2f98]
mov ecx, dword [ebp - 0x2f9c]
cdq
and edx, 3
add eax, edx
sar eax, 2
add ecx, eax
jmp 0x4fc573
cmp eax, 1
jne 0x4fc6e0
push str._BHOW6432_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc510
push str.HKLMSOFTWAREWow6432NodeClassesCLSID
jmp 0x4fc673
cmp eax, 2
jne 0x4fc6ef
push str._UrlSearchHooks_
jmp 0x4fc663
cmp eax, 3
jne 0x4fc6fe
push str._ShellExecuteHooks_
jmp 0x4fc663
cmp eax, 4
jne 0x4fc66e
push str._W6432ShellExecuteHooks_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc510
push str.HKLMSOFTWAREWow6432NodeClassesCLSID
jmp 0x4fc673
call fcn.005d62e0
test al, al
je 0x4fc9b3
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x1f94]
call fcn.005dc510
push 0
push dword [ebp - 0x2e78]
lea ecx, [ebp - 0x1f94]
call fcn.005d98d0
test al, al
je 0x4fc9a7
lea ecx, [ebp - 0x1f94]
call fcn.005dc400
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667770
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x2088]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc200
lea eax, [ebp - 0x1f94]
push eax
push 0x62439c
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb4]
call fcn.005d65d0
test al, al
je 0x4fc7d2
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
test al, al
je 0x4fc82c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667790
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x2088]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc200
lea eax, [ebp - 0x1f94]
push eax
push 0x62439c
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb4]
call fcn.005d65d0
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
test al, al
je 0x4fc895
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667790
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x2088]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc200
lea eax, [ebp - 0x1f94]
push eax
push 0x62439c
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb4]
call fcn.005d65d0
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
test al, al
je 0x4fc8b6
push str.CLSID_not_found
lea ecx, [ebp - 0x1f94]
call fcn.005dc510
jmp 0x4fc8f0
push 3
lea edx, [edi + 0x1c]
lea ecx, [ebp - 0x1fb0]
call fcn.005e88c0
test al, al
jne 0x4fc8f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fc9a7
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push 0x6558f0
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x1fc0]
push 0x6558f0
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x5011a4
mov eax, dword [ebp - 0x2f94]
inc eax
jmp 0x4fc680
mov eax, dword [ebp - 0x2f8c]
inc eax
mov dword [ebp - 0x2f8c], eax
cmp eax, 5
jb 0x4fc600
mov eax, dword [ebp - 0x2f98]
mov ecx, dword [ebp - 0x2fbc]
mov esi, dword [ebp - 0x2f9c]
push 0
lea eax, [eax + eax*2]
sub ecx, eax
add esi, ecx
lea ecx, [edi + 0x14f0]
push esi
mov dword [ebp - 0x2f9c], esi
call fcn.005b66e0
push 0
push str._r_n_____End_of_IE__BHO_and_Shell_execute_hooks_list.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x2fc0]
jmp 0x4fca16
mov esi, dword [ebp - 0x2f9c]
test al, 8
je 0x4fd1b7
push str.Scanning:_Image_hijacks_and_Global_context_menus:...
push esi
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
mov esi, dword [ebp - 0x2fb4]
cmp byte [esi + 4], 0
jne 0x5011a4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
lea ecx, [ebp - 0x1fa0]
push dword [ebp - 0x2fc4]
push str._r_n____Image_hijacks_and_Global_context_menus:_r_n_r_n____Format:_Mode__Name__File__Description
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov eax, dword [ebp - 0x2fbc]
cdq
sub eax, edx
sar eax, 1
xor ecx, ecx
mov dword [ebp - 0x2fa4], eax
mov dword [ebp - 0x2fb0], ecx
nop dword [eax + eax]
test ecx, ecx
lea ecx, [ebp - 0x1ff0]
jne 0x4fcabd
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
call fcn.005dc510
push 1
push str._ImageHijacks_
jmp 0x4fcace
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
call fcn.005dc510
push 1
push str._ImageHijacks6432_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc260
push 0
push 0x20019
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d6a30
test al, al
je 0x4fcc9b
xor eax, eax
cmp byte [esi + 4], 0
mov dword [ebp - 0x2f94], eax
jne 0x5011a4
lea ecx, [ebp - 0x2e5c]
push ecx
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d6380
test al, al
je 0x4fcc9b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x1ff0]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2170]
call fcn.005dc200
lea eax, [ebp - 0x1f94]
push eax
push str.Debugger
lea ecx, [ebp - 0x2170]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb4]
call fcn.005d65d0
test al, al
je 0x4fcc8f
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
test al, al
jne 0x4fcc8f
push 3
lea edx, [edi + 0x1c]
lea ecx, [ebp - 0x1f94]
call fcn.005e88c0
test al, al
jne 0x4fcbd8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fcc8f
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push 0x6558f0
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x1fc0]
push 0x6558f0
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x5011a4
mov eax, dword [ebp - 0x2f94]
inc eax
jmp 0x4fcb01
mov ecx, dword [ebp - 0x2fb0]
xor eax, eax
inc ecx
cmp byte [edi + 0x28], al
mov dword [ebp - 0x2fb0], ecx
setne al
inc eax
cmp ecx, eax
jl 0x4fcaa0
mov eax, dword [ebp - 0x2f9c]
lea ecx, [ebp - 0x2180]
add eax, dword [ebp - 0x2fa4]
xorps xmm0, xmm0
mov dword [ebp - 0x2f9c], eax
movq qword [ebp - 0x2180], xmm0
mov dword [ebp - 0x2178], 0
call fcn.005dc5e0
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x2ff0]
xor ecx, ecx
mov dword [ebp - 0x2ff0], str.HKCR_shell
mov dword [ebp - 0x2fec], str.HKCR_shellexContextMenuHandlers
lea edx, [edi + 0x14f0]
mov dword [ebp - 0x2fe8], str.HKCRAllFilesystemObjects_shell
mov dword [ebp - 0x2fe4], str.HKCRAllFilesystemObjects_shellexContextMenuHandlers
mov dword [ebp - 0x2fe0], str.HKCRFolder_shell
mov dword [ebp - 0x2fdc], str.HKCRFolder_shellexContextMenuHandlers
mov dword [ebp - 0x2fd8], str.HKCRDirectory_shell
mov dword [ebp - 0x2fd4], str.HKCRDirectory_shellexContextMenuHandlers
mov dword [ebp - 0x2fa0], 0
mov dword [ebp - 0x2fb0], ecx
mov dword [ebp - 0x2f8c], eax
mov eax, ecx
mov ecx, edx
shr eax, 3
add eax, dword [ebp - 0x2f9c]
push 0
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4fd1a0
cmp dword [ebp - 0x2fa0], 4
lea ecx, [ebp - 0x1fc0]
jae 0x4fcd98
push str._FileContextMenu_
jmp 0x4fcd9d
push str._FolderContextMenu_
call fcn.005dc510
mov eax, dword [ebp - 0x2f8c]
lea ecx, [ebp - 0x1fa4]
push 0
push 0x20019
push dword [eax]
call fcn.005d6a30
test al, al
je 0x4fd11a
lea eax, [ebp - 0x2e5c]
mov dword [ebp - 0x2f94], 0
push eax
push 0
lea ecx, [ebp - 0x1fa4]
call fcn.005d6380
test al, al
je 0x4fd11a
mov eax, dword [ebp - 0x2fa0]
and eax, 1
mov dword [ebp - 0x2f98], eax
nop dword [eax]
test eax, eax
jne 0x4fcf45
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
mov eax, dword [ebp - 0x2f8c]
lea ecx, [ebp - 0x1ff0]
push 0x627384
push dword [ebp - 0x2e5c]
push 0x624284
push dword [eax]
call fcn.005dc200
lea eax, [ebp - 0x1f94]
push eax
push 0x62439c
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb4]
call fcn.005d65d0
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
test al, al
je 0x4fcef1
lea eax, [ebp - 0x2040]
push eax
push str.DelegateExecute
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb4]
call fcn.005d65d0
lea ecx, [ebp - 0x2040]
call fcn.005dc3a0
test eax, eax
je 0x4fcef1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.InProcServer32
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
push str.HKCRCLSID_
lea ecx, [ebp - 0x1ff0]
call fcn.005dc200
lea eax, [ebp - 0x1f94]
push eax
push 0x62439c
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb4]
call fcn.005d65d0
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
test al, al
je 0x4fd025
mov eax, dword [ebp - 0x2f8c]
lea ecx, [ebp - 0x1ff0]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.DropTarget
push dword [ebp - 0x2e5c]
push 0x624284
push dword [eax]
call fcn.005dc200
lea eax, [ebp - 0x2040]
push eax
push 0x6451c0
jmp 0x4fcfa9
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x2040]
call fcn.005dc510
push 0
push dword [ebp - 0x2e78]
lea ecx, [ebp - 0x2040]
call fcn.005d98d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test al, al
jne 0x4fcfe1
push dword [ebp - 0x2e5c]
mov eax, dword [ebp - 0x2f8c]
lea ecx, [ebp - 0x1ff0]
push 0x624284
push dword [eax]
call fcn.005dc200
lea eax, [ebp - 0x2040]
push eax
push 0x62439c
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb4]
call fcn.005d65d0
lea ecx, [ebp - 0x2040]
call fcn.005dc3a0
test eax, eax
je 0x4fd025
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.InProcServer32
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
push str.HKCRCLSID_
lea ecx, [ebp - 0x1ff0]
call fcn.005dc200
lea eax, [ebp - 0x1f94]
push eax
push 0x62439c
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb4]
call fcn.005d65d0
push 3
lea edx, [edi + 0x1c]
lea ecx, [ebp - 0x1f94]
call fcn.005e88c0
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fd0ec
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push 0x6558f0
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x1fc0]
push 0x6558f0
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x4fd1a0
mov eax, dword [ebp - 0x2f94]
lea ecx, [ebp - 0x2e5c]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x1fa4]
mov dword [ebp - 0x2f94], eax
call fcn.005d6380
test al, al
mov eax, dword [ebp - 0x2f98]
jne 0x4fce00
mov eax, dword [ebp - 0x2fa0]
lea edx, [edi + 0x14f0]
mov ecx, dword [ebp - 0x2fb0]
inc eax
add ecx, dword [ebp - 0x2fa4]
add dword [ebp - 0x2f8c], 4
mov dword [ebp - 0x2fa0], eax
mov dword [ebp - 0x2fb0], ecx
cmp eax, 8
jb 0x4fcd63
mov eax, dword [ebp - 0x2fbc]
sub eax, dword [ebp - 0x2fa4]
mov ecx, dword [ebp - 0x2f9c]
add ecx, eax
push 0
mov dword [ebp - 0x2f9c], ecx
push ecx
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push str._r_n_____End_of_the_Image_hijacks_and_Global_context_menus_list.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
lea ecx, [ebp - 0x2180]
mov byte [ebp - 4], 0x1f
call fcn.005dc430
mov eax, dword [ebp - 0x2fc0]
jmp 0x4fd1bd
lea ecx, [ebp - 0x2180]
call fcn.005dc430
mov byte [ebp - 0x2f8d], 2
jmp 0x5010b8
mov esi, dword [ebp - 0x2fb4]
test al, 0x10
je 0x4fdcb3
push str.Scanning:_Services...
push dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
cmp byte [esi + 4], 0
je 0x4fd1ed
mov byte [ebp - 0x2f8d], 2
jmp 0x5010b8
mov eax, 0x55555556
xorps xmm0, xmm0
imul dword [ebp - 0x2fbc]
movlpd qword [ebp - 0x2e84], xmm0
mov dword [ebp - 0x2e84], 0
mov eax, edx
mov dword [ebp - 0x2e80], 0
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x2f98], eax
mov dword [ebp - 0x2058], 0
mov dword [ebp - 0x2028], 0
mov dword [ebp - 0x2e64], 0
push SysReAllocString
push 0
push 0
mov byte [ebp - 4], 0x22
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ecx, dword [ebp - 0x2e64]
mov dword [ebp - 0x2f94], eax
test ecx, ecx
je 0x4fd272
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x2f94]
mov dword [ebp - 0x2e64], eax
test eax, eax
je 0x4fd5b1
push 0
push 0
lea ecx, [ebp - 0x2028]
push ecx
lea ecx, [ebp - 0x2058]
push ecx
push 0
push 0
push 3
push 0x30
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x4fd5b1
cmp byte [esi + 4], 0
jne 0x4fd5b1
mov eax, dword [ebp - 0x2058]
lea ecx, [ebp - 0x2e84]
add eax, 0x400
push eax
mov dword [ebp - 0x2f94], eax
call fcn.00404560
test eax, eax
je 0x4fd5b1
push 0
push 0
lea eax, [ebp - 0x2028]
push eax
lea eax, [ebp - 0x2058]
push eax
push dword [ebp - 0x2f94]
push dword [ebp - 0x2e84]
push 3
push 0x30
push 0
push dword [ebp - 0x2e64]
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x4fd5b1
mov eax, dword [ebp - 0x2e84]
lea ecx, [ebp - 0x2024]
push dword [ebp - 0x2028]
mov dword [ebp - 0x2fa0], eax
call fcn.005db290
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
lea ecx, [ebp - 0x2024]
push dword [ebp - 0x2fc4]
push str._total_:_r_n_r_n____Format:_Mode__Service_name__Service_file__Description
call fcn.005dc190
push eax
push str._r_n____Services_
ret
add byte [di + 0x608d], cl
loopne 0x4fd36f
invalid
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov ecx, dword [ebp - 0x2028]
mov dword [ebp - 0x2f94], 0
test ecx, ecx
je 0x4fd59f
xor eax, eax
mov dword [ebp - 0x2fb0], eax
xor edx, edx
div ecx
push 0
add eax, dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4fdbc3
mov eax, dword [ebp - 0x2fa0]
lea ecx, [ebp - 0x1ff0]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Parameters
push dword [eax]
push str.HKLMSYSTEMCurrentControlSetServices_
call fcn.005dc200
lea eax, [ebp - 0x1f94]
push eax
push str.ServiceDll
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d65d0
test al, al
je 0x4fd42f
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
test al, al
je 0x4fd489
push 0
lea ecx, [ebp - 0x1ff0]
call fcn.005dbed0
lea eax, [ebp - 0x1f94]
push eax
push str.ServiceDll
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d65d0
test al, al
je 0x4fd472
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
test al, al
je 0x4fd489
lea eax, [ebp - 0x1f94]
push eax
push str.ImagePath
lea ecx, [ebp - 0x1fa4]
call fcn.005d6740
push 3
lea edx, [edi + 0x1c]
lea ecx, [ebp - 0x1f94]
call fcn.005e88c0
test al, al
jne 0x4fd4c3
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fd56b
push 0
push 0
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov eax, dword [ebp - 0x2fa0]
lea ecx, [ebp - 0x1fa0]
push 0x6558f0
push dword [eax]
push str._r_n_Services__
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x4fdbc3
mov edx, dword [ebp - 0x2f94]
mov eax, dword [ebp - 0x2fb0]
inc edx
add eax, dword [ebp - 0x2f98]
add dword [ebp - 0x2fa0], 0x2c
mov ecx, dword [ebp - 0x2028]
mov dword [ebp - 0x2f94], edx
mov dword [ebp - 0x2fb0], eax
cmp edx, ecx
jb 0x4fd3a8
push 0
push str._r_n_____End_of_the_Services_list.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
add eax, dword [ebp - 0x2f98]
push str.Scanning:__Driver_services...
push eax
mov dword [ebp - 0x2f9c], eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4fdbc3
push 0
push 0
lea eax, [ebp - 0x2028]
push eax
lea eax, [ebp - 0x2058]
push eax
push 0
push 0
push 3
push 0xb
push 0
push dword [ebp - 0x2e64]
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x4fd92e
cmp byte [esi + 4], 0
jne 0x4fd92e
mov eax, dword [ebp - 0x2058]
lea ecx, [ebp - 0x2e84]
add eax, 0x400
push eax
mov dword [ebp - 0x2f94], eax
call fcn.00404560
test eax, eax
je 0x4fd92e
push 0
push 0
lea eax, [ebp - 0x2028]
push eax
lea eax, [ebp - 0x2058]
push eax
push dword [ebp - 0x2f94]
push dword [ebp - 0x2e84]
push 3
push 0xb
push 0
push dword [ebp - 0x2e64]
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x4fd92e
mov eax, dword [ebp - 0x2e84]
lea ecx, [ebp - 0x2024]
push dword [ebp - 0x2028]
mov dword [ebp - 0x2f8c], eax
call fcn.005db290
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
lea ecx, [ebp - 0x2024]
push dword [ebp - 0x2fc4]
push str._total_:_r_n_r_n____Format:_Mode__Driver_service_name__Driver_file__Description
call fcn.005dc190
push eax
push str._r_n____Driver_services_
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624284
push dword [edi + 0x20]
lea ecx, [ebp - 0x1fb0]
call fcn.005dc200
mov ecx, dword [ebp - 0x2028]
mov dword [ebp - 0x2f94], 0
test ecx, ecx
je 0x4fd91c
xor eax, eax
mov dword [ebp - 0x2fb0], eax
xor edx, edx
div ecx
push 0
add eax, dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4fdbc3
mov eax, dword [ebp - 0x2f8c]
lea ecx, [ebp - 0x1ff0]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [eax]
push str.HKLMSYSTEMCurrentControlSetServices_
call fcn.005dc200
lea eax, [ebp - 0x1f94]
push eax
push str.ImagePath
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d65d0
test al, al
je 0x4fd7b6
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
test al, al
je 0x4fd7e6
mov eax, dword [ebp - 0x2f8c]
lea ecx, [ebp - 0x1f94]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..sys
push dword [eax]
push str.drivers_
push dword [edi + 0x24]
call fcn.005dc200
push 0
push 1
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str.SystemRoot_
lea ecx, [ebp - 0x1f94]
call fcn.005da270
push 3
lea edx, [edi + 0x1c]
lea ecx, [ebp - 0x1f94]
call fcn.005e88c0
test al, al
jne 0x4fd840
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fd8e8
push 0
push 0
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov eax, dword [ebp - 0x2f8c]
lea ecx, [ebp - 0x1fa0]
push 0x6558f0
push dword [eax]
push str._r_n_Drivers__
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x4fdbc3
mov edx, dword [ebp - 0x2f94]
mov eax, dword [ebp - 0x2fb0]
inc edx
add eax, dword [ebp - 0x2f98]
add dword [ebp - 0x2f8c], 0x2c
mov ecx, dword [ebp - 0x2028]
mov dword [ebp - 0x2f94], edx
mov dword [ebp - 0x2fb0], eax
cmp edx, ecx
jb 0x4fd732
push 0
push str._r_n_____End_of_the_Driver_services_list.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
add eax, dword [ebp - 0x2f98]
push str.Scanning:_Scheduled_tasks...
push eax
mov dword [ebp - 0x2f9c], eax
call fcn.005b66e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
lea ecx, [ebp - 0x1fa0]
push dword [ebp - 0x2fc4]
push str._r_nScheduled_tasks:_r_n_r_n____Format:_Mode__Task_name__Task_file__Description
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
movsd xmm0, qword [edi + 8]
comisd xmm0, xmmword [0x6edab8]
jb 0x4fdc2a
mov dword [ebp - 0x2e60], 0
lea eax, [ebp - 0x2e60]
push eax
push 0x61e720
push 1
push 0
push 0x61e730
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x4fd9d9
mov byte [ebp - 4], 0x24
jmp 0x4fdc12
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x3030]
push eax
call esi
movups xmm0, xmmword [ebp - 0x3030]
lea eax, [ebp - 0x3050]
push eax
movups xmmword [ebp - 0x3010], xmm0
call esi
movups xmm0, xmmword [ebp - 0x3050]
lea eax, [ebp - 0x3040]
push eax
movups xmmword [ebp - 0x3060], xmm0
call esi
movups xmm0, xmmword [ebp - 0x3040]
lea eax, [ebp - 0x3020]
push eax
movups xmmword [ebp - 0x2fe0], xmm0
call esi
mov byte [ebp - 4], 0x28
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x3010]
mov eax, dword [ebp - 0x2e60]
mov ecx, esp
sub esp, 0x10
mov edx, dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x3060]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x2fe0]
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [ebp - 0x3020]
push eax
mov eax, dword [edx + 0x28]
movups xmmword [ecx], xmm0
call eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
shr eax, 0x1f
mov dword [ebp - 0x2f94], eax
lea eax, [ebp - 0x3020]
push eax
call esi
lea eax, [ebp - 0x3040]
push eax
call esi
lea eax, [ebp - 0x3050]
push eax
call esi
lea eax, [ebp - 0x3030]
push eax
call esi
cmp byte [ebp - 0x2f94], 0
je 0x4fdadc
mov byte [ebp - 4], 0x29
mov eax, dword [ebp - 0x2e60]
test eax, eax
je 0x4fdacd
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 8]
call eax
mov esi, dword [ebp - 0x2fb4]
mov byte [ebp - 4], 0x22
jmp 0x4fdc4a
mov dword [ebp - 0x2e7c], 0
push 0x624284
lea ecx, [ebp - 0x2ff4]
mov byte [ebp - 4], 0x2a
call fcn.00401a90
mov byte [ebp - 4], 0x2b
mov eax, dword [eax]
test eax, eax
je 0x4fdb08
mov edx, dword [eax]
jmp 0x4fdb0a
xor edx, edx
mov eax, dword [ebp - 0x2e60]
lea esi, [ebp - 0x2e7c]
push esi
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x1c]
call eax
shr eax, 0x1f
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x2ff4]
mov dword [ebp - 0x2f94], eax
test ecx, ecx
je 0x4fdb4c
call fcn.00401c50
mov eax, dword [ebp - 0x2f94]
mov dword [ebp - 0x2ff4], 0
test al, al
je 0x4fdb6f
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x2e7c]
test eax, eax
je 0x4fdb66
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 8]
call eax
mov byte [ebp - 4], 0x2d
jmp 0x4fdabb
mov esi, dword [ebp - 0x2fb4]
mov ecx, edi
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x2018]
push eax
push dword [ebp - 0x2fa8]
push dword [ebp - 0x2e7c]
call fcn.004f8270
test al, al
jne 0x4fdbf8
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x2e7c]
test eax, eax
je 0x4fdbad
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 8]
call eax
mov byte [ebp - 4], 0x2f
mov eax, dword [ebp - 0x2e60]
test eax, eax
je 0x4fdbc3
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 8]
call eax
mov eax, dword [ebp - 0x2e64]
test eax, eax
je 0x4fdbd5
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
mov eax, dword [ebp - 0x2e84]
test eax, eax
je 0x5011a4
push eax
call fcn.0041e1c3
add esp, 4
mov byte [ebp - 0x2f8d], 2
jmp 0x5010b8
mov byte [ebp - 4], 0x30
mov eax, dword [ebp - 0x2e7c]
test eax, eax
je 0x4fdc0e
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 8]
call eax
mov byte [ebp - 4], 0x31
mov eax, dword [ebp - 0x2e60]
test eax, eax
je 0x4fdc24
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 8]
call eax
mov byte [ebp - 4], 0x22
jmp 0x4fdc4a
lea eax, [esi + 4]
mov ecx, edi
push eax
lea eax, [ebp - 0x2018]
push eax
push dword [ebp - 0x2fa8]
call fcn.004f7e60
test al, al
je 0x4fdbc3
mov eax, dword [ebp - 0x2fbc]
sub eax, dword [ebp - 0x2f98]
mov ecx, dword [ebp - 0x2f9c]
add ecx, eax
push 0
mov dword [ebp - 0x2f9c], ecx
push ecx
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push str._r_n_____End_of_the_Scheduled_tasks_list.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x2e64]
test eax, eax
je 0x4fdc96
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x2e84]
test eax, eax
je 0x4fdcad
push eax
call fcn.0041e1c3
add esp, 4
mov eax, dword [ebp - 0x2fc0]
test al, 0x20
je 0x4fe606
push str.Scanning:_Uninstall_entries...
push dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
cmp byte [esi + 4], 0
je 0x4fdce3
mov byte [ebp - 0x2f8d], 2
jmp 0x5010b8
push 1
push str._r_n____Uninstall_list:_r_n_r_n____Format:_Mode__Uninstall_entry__Name__Publisher__Uninstall_command_r_n
lea ecx, [ebp - 0x1fa0]
call fcn.005dc260
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov eax, dword [ebp - 0x2fb8]
test eax, eax
je 0x4fdd78
xor edi, edi
mov dword [ebp - 0x2f94], eax
nop dword [eax]
mov ecx, dword [ebp - 0x2054]
mov esi, dword [ebp - 0x1ff8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [edi + ecx]
add esi, edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
call fcn.005dc190
push eax
push str.HKU_
mov ecx, esi
call fcn.005dc200
add edi, 0xc
sub dword [ebp - 0x2f94], 1
jne 0x4fdd20
mov edi, dword [ebp - 0x2fcc]
mov esi, dword [ebp - 0x2fb4]
mov eax, dword [ebp - 0x2fb8]
lea ecx, [eax + eax*2]
shl ecx, 2
mov dword [ebp - 0x2f94], ecx
add ecx, dword [ebp - 0x1ff8]
push 0x67c8e0
call fcn.005dc510
cmp byte [edi + 0x28], 0
je 0x4fddb5
mov eax, dword [ebp - 0x1ff8]
mov ecx, dword [ebp - 0x2f94]
add eax, 0xc
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstall
add ecx, eax
call fcn.005dc510
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x215c], 0
push str.UpdateHotfix_HOTFIX_Security_update
lea ecx, [ebp - 0x2164]
movq qword [ebp - 0x2164], xmm0
call fcn.005dc570
mov eax, dword [ebp - 0x2fbc]
cdq
sub eax, edx
mov byte [ebp - 4], 0x32
sar eax, 1
cmp dword [ebp - 0x2fac], 0
mov dword [ebp - 0x2fa0], eax
mov dword [ebp - 0x2fa4], 0
jbe 0x4fe22f
xor ecx, ecx
mov dword [ebp - 0x2f8c], 0
mov dword [ebp - 0x2fb0], ecx
nop word [eax + eax]
mov eax, ecx
xor edx, edx
div dword [ebp - 0x2fac]
push 0
add eax, dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4fe7da
mov eax, dword [ebp - 0x2fa4]
cmp eax, dword [ebp - 0x2fb8]
jae 0x4fde91
mov ecx, dword [ebp - 0x2f8c]
add ecx, dword [ebp - 0x2030]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Uninstall_
call fcn.005dc190
push eax
push 0x67b260
lea ecx, [ebp - 0x1fc0]
call fcn.005dc200
jmp 0x4fdeaa
lea ecx, [ebp - 0x1fc0]
jne 0x4fdea0
push str._HKLM...Uninstall_
jmp 0x4fdea5
push str._HKLMW6432...Uninstall_
call fcn.005dc510
mov ecx, dword [ebp - 0x2f8c]
add ecx, dword [ebp - 0x1ff8]
push 0
push 0x20019
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d6a30
test al, al
je 0x4fe1fd
xor eax, eax
cmp byte [esi + 4], 0
mov dword [ebp - 0x2f94], eax
jne 0x4fe7da
lea ecx, [ebp - 0x2e5c]
push ecx
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d6380
test al, al
je 0x4fe1fd
mov ecx, dword [ebp - 0x2f8c]
add ecx, dword [ebp - 0x1ff8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x2e5c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1ff0]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb4]
call fcn.005d6a30
test al, al
je 0x4fe1f1
lea eax, [ebp - 0x1f94]
push eax
push str.UninstallString
lea ecx, [ebp - 0x1fb4]
call fcn.005d6740
test al, al
je 0x4fe1f1
lea ecx, [ebp - 0x1f94]
call fcn.005dbeb0
test al, al
jne 0x4fe1f1
lea eax, [ebp - 0x1fb0]
push eax
push str.DisplayName
lea ecx, [ebp - 0x1fb4]
call fcn.005d6740
test al, al
je 0x4fe1f1
lea ecx, [ebp - 0x1fb0]
call fcn.005dbeb0
test al, al
jne 0x4fe1f1
lea eax, [ebp - 0x2174]
push eax
push str.SystemComponent
lea ecx, [ebp - 0x1fb4]
call fcn.005d66b0
test al, al
je 0x4fdfef
cmp dword [ebp - 0x2174], 1
je 0x4fe1f1
lea eax, [ebp - 0x2024]
push eax
push str.ParentKeyName
lea ecx, [ebp - 0x1fb4]
call fcn.005d6740
test al, al
je 0x4fe01d
lea ecx, [ebp - 0x2024]
call fcn.005dc3a0
test eax, eax
jne 0x4fe1f1
lea eax, [ebp - 0x2024]
push eax
push str.ReleaseType
lea ecx, [ebp - 0x1fb4]
call fcn.005d6740
test al, al
je 0x4fe0a1
lea ecx, [ebp - 0x2024]
call fcn.005dc3a0
test eax, eax
je 0x4fe0a1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62794c
lea ecx, [ebp - 0x2024]
call fcn.005dc190
push eax
push 0x62794c
lea ecx, [ebp - 0x2024]
call fcn.005dc200
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x2024]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2164]
call fcn.005daa70
test eax, eax
jne 0x4fe1f1
lea eax, [ebp - 0x2024]
push eax
push str.Publisher
lea ecx, [ebp - 0x1fb4]
call fcn.005d6740
test al, al
je 0x4fe0cb
lea ecx, [ebp - 0x2024]
call fcn.005dbeb0
test al, al
je 0x4fe0db
push str.No_publisher
lea ecx, [ebp - 0x2024]
call fcn.005dc510
test byte [ebp - 0x2fa8], 2
je 0x4fe104
push 9
push 1
push 1
push 0
push 0x624a04
lea ecx, [ebp - 0x2024]
call fcn.005daa70
test eax, eax
jne 0x4fe1f1
push 3
lea edx, [edi + 0x1c]
lea ecx, [ebp - 0x1f94]
call fcn.005e88c0
test al, al
jne 0x4fe13e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fe1f1
push 0
push 0x62781c
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push 0x6558f0
lea ecx, [ebp - 0x2024]
call fcn.005dc190
push eax
push 0x6558f0
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push 0x6558f0
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x1fc0]
push 0x6558f0
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x4fe7da
mov eax, dword [ebp - 0x2f94]
inc eax
jmp 0x4fded8
mov eax, dword [ebp - 0x2fa4]
mov ecx, dword [ebp - 0x2fb0]
inc eax
add ecx, dword [ebp - 0x2fa0]
add dword [ebp - 0x2f8c], 0xc
mov dword [ebp - 0x2fa4], eax
mov dword [ebp - 0x2fb0], ecx
cmp eax, dword [ebp - 0x2fac]
jb 0x4fde20
push 0
push str._r_n_____End_of_the_Uninstall_list.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
add eax, dword [ebp - 0x2fa0]
push 0
push eax
mov dword [ebp - 0x2f9c], eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4fe7da
push str.Scanning:_Recently_accessed_programs...
push dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4fe7da
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
lea ecx, [ebp - 0x1fa0]
push dword [ebp - 0x2fc4]
push str._r_n____Recently_accessed_programs:_r_n_r_n____Format:_Mode__Path__Description
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push 8
push str.._FriendlyAppNameApplicationCompany__
lea ecx, [ebp - 0x2e6c]
mov dword [ebp - 0x2e6c], 0
call fcn.00401400
cmp dword [ebp - 0x2fb8], 0
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x2fb0], 0
jbe 0x4fe59a
xor ecx, ecx
mov dword [ebp - 0x2f8c], 0
mov dword [ebp - 0x2fa4], ecx
nop word [eax + eax]
mov eax, ecx
xor edx, edx
div dword [ebp - 0x2fb8]
push 0
add eax, dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4fe7bd
mov ecx, dword [ebp - 0x2f8c]
movsd xmm0, qword [0x6edab0]
add ecx, dword [ebp - 0x2054]
comisd xmm0, xmmword [edi + 8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
jbe 0x4fe37c
push str.SoftwareMicrosoftWindowsShellNoRoamMUICache
jmp 0x4fe381
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x1ff0]
call fcn.005dc200
mov ecx, dword [ebp - 0x2f8c]
add ecx, dword [ebp - 0x2030]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MuiCache_
call fcn.005dc190
push eax
push 0x67b260
lea ecx, [ebp - 0x1fc0]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1ff0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d6a30
test al, al
je 0x4fe568
xor eax, eax
cmp byte [esi + 4], 0
mov dword [ebp - 0x2f94], eax
jne 0x4fe7bd
lea ecx, [ebp - 0x2e5c]
push ecx
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005d62e0
test al, al
je 0x4fe568
push dword [ebp - 0x2e5c]
lea ecx, [ebp - 0x1f94]
call fcn.005dc510
push 2
push 2
push 1
push 1
push 0x624518
lea ecx, [ebp - 0x1f94]
call fcn.005daa70
test eax, eax
je 0x4fe55c
movsd xmm0, qword [edi + 8]
comisd xmm0, xmmword [0x6edac0]
jbe 0x4fe47b
push 0
push 0x62439c
push dword [ebp - 0x2e6c]
lea ecx, [ebp - 0x1f94]
call fcn.005d9500
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4fe4ac
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4fe55c
push 0
push 0
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push 0x6558f0
lea ecx, [ebp - 0x1fc0]
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x4fe7bd
mov eax, dword [ebp - 0x2f94]
inc eax
jmp 0x4fe3f8
mov eax, dword [ebp - 0x2fb0]
mov ecx, dword [ebp - 0x2fa4]
inc eax
add ecx, dword [ebp - 0x2fa0]
add dword [ebp - 0x2f8c], 0xc
mov dword [ebp - 0x2fb0], eax
mov dword [ebp - 0x2fa4], ecx
cmp eax, dword [ebp - 0x2fb8]
jb 0x4fe320
push 0
push str._r_n_____End_of_the_Recently_accessed_programs_list.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x2fbc]
sub eax, dword [ebp - 0x2fa0]
mov ecx, dword [ebp - 0x2f9c]
add ecx, eax
push 0
mov dword [ebp - 0x2f9c], ecx
push ecx
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
mov eax, dword [ebp - 0x2e6c]
test eax, eax
je 0x4fe5e7
push eax
call fcn.00418a90
add esp, 4
lea ecx, [ebp - 0x2164]
mov dword [ebp - 0x2e6c], 0
mov byte [ebp - 4], 0x1f
call fcn.005dc430
mov eax, dword [ebp - 0x2fc0]
test al, 0x40
je 0x4ff2b9
xor eax, eax
lea ecx, [ebp - 0x207c]
cmp byte [edi + 0x28], al
xorps xmm0, xmm0
movq qword [ebp - 0x207c], xmm0
setne al
mov dword [ebp - 0x2074], 0
add eax, 3
mov dword [ebp - 0x2f94], eax
mov eax, dword [ebp - 0x2fbc]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x2fa0], eax
call fcn.005dc5e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x20a0]
push dword [ebp - 0x2fc4]
xorps xmm0, xmm0
mov dword [ebp - 0x2098], 0
push str.____Format:_Mode__Folder_File_name__Size__Description
movq qword [ebp - 0x20a0], xmm0
call fcn.005dc520
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x20e8]
xorps xmm0, xmm0
mov dword [ebp - 0x20e0], 0
movq qword [ebp - 0x20e8], xmm0
call fcn.005dc5e0
push 0x250
xorps xmm0, xmm0
lea eax, [ebp - 0x2568]
push 0
movups xmmword [ebp - 0x2318], xmm0
push eax
mov dword [ebp - 0x2318], 0xffffffff
call fcn.00420090
add esp, 0xc
xor eax, eax
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x2f98], eax
lea ecx, [edi + 0x14f0]
nop word [eax + eax]
imul eax, dword [ebp - 0x2fa0]
push 0
cdq
idiv dword [ebp - 0x2f94]
add eax, dword [ebp - 0x2f9c]
push eax
call fcn.005b66e0
mov eax, dword [ebp - 0x2f98]
test eax, eax
jne 0x4fe7f1
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str...._r_nThis_may_take_a_few_minutes__be_patient.
push dword [edi + 0x1c]
lea ecx, [ebp - 0x1fb0]
push str.Scanning:_Contents_of
call fcn.005dc200
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push 0xffffffffffffffff
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x20a0]
call fcn.005dc190
push eax
push str.:_r_n_r_n
push dword [edi + 0x1c]
lea ecx, [ebp - 0x1fa0]
push str._r_n____Contents_of
call fcn.005dc200
push str._ContentsSystemDrive_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc510
push 1
push dword [edi + 0x1c]
lea ecx, [ebp - 0x207c]
call fcn.005dc260
jmp 0x4fe930
mov eax, dword [ebp - 0x2e6c]
test eax, eax
je 0x4fe7d0
push eax
call fcn.00418a90
add esp, 4
mov dword [ebp - 0x2e6c], 0
lea ecx, [ebp - 0x2164]
call fcn.005dc430
mov byte [ebp - 0x2f8d], 2
jmp 0x5010b8
cmp eax, 1
jne 0x4fe85a
push str.Scanning:_Contents_of_Common_Application_Data...
push 0xffffffffffffffff
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x20a0]
call fcn.005dc190
push eax
push str._r_n____Contents_of_Common_Application_Data::_r_n_r_n
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
push str._ContentsCommonAppData_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc510
push 0
lea ecx, [edi + 0x1290]
call fcn.0057c490
jmp 0x4fe924
cmp eax, 2
jne 0x4fe8c0
push str.Scanning:_Contents_of_Program_files...
push 0xffffffffffffffff
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x20a0]
call fcn.005dc190
push eax
push str._r_n____Contents_of_Program_files:_r_n_r_n
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
push str._ContentsProgramfiles_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc510
push 0
lea ecx, [edi + 0x1290]
call fcn.0057c120
jmp 0x4fe924
cmp eax, 3
jne 0x4fe930
push str.Scanning:_Contents_of_Program_files__x86_...
push 0xffffffffffffffff
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x20a0]
call fcn.005dc190
push eax
push str._r_n____Contents_of_Program_files__x86_:_r_n_r_n
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
push str._ContentsProgramfiles_x86__
lea ecx, [ebp - 0x1fc0]
call fcn.005dc510
push 0
lea ecx, [edi + 0x1290]
call fcn.0057c080
push eax
lea ecx, [ebp - 0x207c]
call fcn.005dc510
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x4ff27a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6249f8
lea ecx, [ebp - 0x207c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20e8]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x20e8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2568]
call fcn.00401280
test al, al
je 0x4feb4d
nop dword [eax]
cmp byte [esi + 4], 0
jne 0x4ff27a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x253c]
push eax
push 0x624284
lea ecx, [ebp - 0x207c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc200
test byte [ebp - 0x2568], 0x10
lea ecx, [ebp - 0x1f94]
je 0x4fea2f
push 1
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043ad10
mov ecx, eax
and ecx, edx
cmp ecx, 0xffffffff
je 0x4ff27a
push 4
push 0
push edx
push eax
lea ecx, [ebp - 0x2024]
call fcn.005daea0
push 0
push 0
push 0
push 0
push 0
push str.__Directory_r_n
jmp 0x4feae5
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4feb3a
push 4
push 0
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
mov ecx, eax
call fcn.005e0e70
push edx
push eax
lea ecx, [ebp - 0x2024]
call fcn.005daea0
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4feb3a
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2024]
call fcn.005dc190
push eax
push 0x6558f0
lea eax, [ebp - 0x253c]
push eax
push 0x6558f0
lea ecx, [ebp - 0x1fc0]
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x4ff27a
lea ecx, [ebp - 0x2568]
call fcn.00401230
test al, al
jne 0x4fe9a0
mov eax, dword [ebp - 0x2f98]
test eax, eax
jne 0x4feb8c
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str..__r_n_r_n
push dword [edi + 0x1c]
lea ecx, [ebp - 0x1fa0]
push str._r_n_____End_of_Contents_of
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
jmp 0x4febbf
cmp eax, 1
jne 0x4feb9a
push 0
push str._r_n_____End_of_Contents_of_Common_Application_Data.__r_n
jmp 0x4febb4
cmp eax, 2
jne 0x4feba8
push 0
push str._r_n_____End_of_Contents_of_Program_files.__r_n
jmp 0x4febb4
cmp eax, 3
jne 0x4febc5
push 0
push str._r_n_____End_of_Contents_of_Program_files__x86_.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x2f98]
inc eax
lea ecx, [edi + 0x14f0]
mov dword [ebp - 0x2f98], eax
cmp eax, dword [ebp - 0x2f94]
jl 0x4fe700
mov eax, dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
add eax, dword [ebp - 0x2fa0]
push 0
push eax
mov dword [ebp - 0x2f9c], eax
call fcn.005b66e0
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x212c], 0
push 0
lea ecx, [edi + 0x1290]
movq qword [ebp - 0x2134], xmm0
call fcn.0057be80
push eax
lea ecx, [ebp - 0x2134]
call fcn.005dc570
push 1
mov byte [ebp - 4], 0x38
lea ecx, [edi + 0x1290]
xorps xmm0, xmm0
mov dword [ebp - 0x2138], 0
push 0
movq qword [ebp - 0x2140], xmm0
call fcn.0057c260
push eax
lea ecx, [ebp - 0x2140]
call fcn.005dc570
push 0
lea ecx, [edi + 0x1290]
mov byte [ebp - 4], 0x39
call fcn.0057c1c0
inc eax
lea ecx, [ebp - 0x2134]
push eax
call fcn.005dad50
push 0
lea ecx, [edi + 0x1290]
call fcn.0057c1c0
inc eax
lea ecx, [ebp - 0x2140]
push eax
call fcn.005dad50
cmp dword [ebp - 0x2fb8], 0
mov dword [ebp - 0x2f94], 0
jbe 0x4ff1e7
mov esi, dword [ebp - 0x2fb4]
xor eax, eax
mov dword [ebp - 0x2fac], 0
mov dword [ebp - 0x2fb0], eax
xor edx, edx
lea ecx, [edi + 0x14f0]
div dword [ebp - 0x2fb8]
push 0
add eax, dword [ebp - 0x2f9c]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4ff264
xor eax, eax
mov dword [ebp - 0x2f8c], eax
nop word [eax + eax]
mov esi, dword [ebp - 0x2fac]
mov ecx, dword [ebp - 0x2030]
push 0
push 0
push 0
lea ecx, [esi + ecx]
push 0
push 0
push 0
push 0
push 0
push 0
test eax, eax
jne 0x4fede1
push str.s_Application_data_folder...
call fcn.005dc190
push eax
push str.Scanning:_Contents_of
lea ecx, [ebp - 0x1fb0]
call fcn.005dc200
add esi, dword [ebp - 0x2090]
lea ecx, [ebp - 0x2134]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
push 0x624284
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x207c]
call fcn.005dc200
mov esi, dword [ebp - 0x2fac]
lea ecx, [ebp - 0x20a0]
add esi, dword [ebp - 0x2030]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
push str.s_Application_data_folder.
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n____Contents_of
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Appdata_
jmp 0x4fee94
push str.s_Local_Application_data_folder...
call fcn.005dc190
push eax
push str.Scanning:_Contents_of
lea ecx, [ebp - 0x1fb0]
call fcn.005dc200
add esi, dword [ebp - 0x2090]
lea ecx, [ebp - 0x2140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
push 0x624284
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x207c]
call fcn.005dc200
mov esi, dword [ebp - 0x2fac]
lea ecx, [ebp - 0x20a0]
add esi, dword [ebp - 0x2030]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
push str.s_Local_Application_data_folder.
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n____Contents_of
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.LocalAppdata_
mov ecx, dword [ebp - 0x2fac]
add ecx, dword [ebp - 0x2030]
call fcn.005dc190
push eax
push 0x67b260
lea ecx, [ebp - 0x1fc0]
call fcn.005dc200
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push 0xffffffffffffffff
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
mov esi, dword [ebp - 0x2fb4]
cmp byte [esi + 4], 0
jne 0x4ff264
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x4ff264
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6249f8
lea ecx, [ebp - 0x207c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20e8]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x20e8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2568]
call fcn.00401280
test al, al
je 0x4ff0fd
nop dword [eax]
cmp byte [esi + 4], 0
jne 0x4ff264
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x253c]
push eax
push 0x624284
lea ecx, [ebp - 0x207c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc200
test byte [ebp - 0x2568], 0x10
lea ecx, [ebp - 0x1f94]
je 0x4fefdf
push 1
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043ad10
mov ecx, eax
and ecx, edx
cmp ecx, 0xffffffff
je 0x4ff264
push 4
push 0
push edx
push eax
lea ecx, [ebp - 0x2024]
call fcn.005daea0
push 0
push 0
push 0
push 0
push 0
push str.__Directory_r_n
jmp 0x4ff095
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4ff0ea
push 4
push 0
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
mov ecx, eax
call fcn.005e0e70
push edx
push eax
lea ecx, [ebp - 0x2024]
call fcn.005daea0
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4ff0ea
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2024]
call fcn.005dc190
push eax
push 0x6558f0
lea eax, [ebp - 0x253c]
push eax
push 0x6558f0
lea ecx, [ebp - 0x1fc0]
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x4ff264
lea ecx, [ebp - 0x2568]
call fcn.00401230
test al, al
jne 0x4fef50
cmp dword [ebp - 0x2f8c], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
jne 0x4ff166
mov ecx, dword [ebp - 0x2030]
mov esi, dword [ebp - 0x2fac]
push str.s_Application_data_folder.__r_n
lea ecx, [esi + ecx]
call fcn.005dc190
push eax
push str._r_n_____End_of_Contents_of
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov eax, dword [ebp - 0x2f8c]
inc eax
mov dword [ebp - 0x2f8c], eax
jmp 0x4fed06
mov ecx, dword [ebp - 0x2fac]
add ecx, dword [ebp - 0x2030]
push str.s_Local_Application_data_folder.__r_n
call fcn.005dc190
push eax
push str._r_n_____End_of_Contents_of
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov eax, dword [ebp - 0x2f8c]
inc eax
mov dword [ebp - 0x2f8c], eax
cmp eax, 2
jb 0x4fed00
mov ecx, dword [ebp - 0x2f94]
mov eax, dword [ebp - 0x2fb0]
inc ecx
add eax, dword [ebp - 0x2fa0]
add dword [ebp - 0x2fac], 0xc
mov dword [ebp - 0x2f94], ecx
mov dword [ebp - 0x2fb0], eax
cmp ecx, dword [ebp - 0x2fb8]
jb 0x4fecc9
mov eax, dword [ebp - 0x2fbc]
lea ecx, [edi + 0x14f0]
sub eax, dword [ebp - 0x2fa0]
mov esi, dword [ebp - 0x2f9c]
add esi, eax
push 0
push esi
mov dword [ebp - 0x2f9c], esi
call fcn.005b66e0
lea ecx, [ebp - 0x2140]
call fcn.005dc430
lea ecx, [ebp - 0x2134]
call fcn.005dc430
mov eax, dword [ebp - 0x2318]
cmp eax, 0xffffffff
je 0x4ff237
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x20e8]
call fcn.005dc430
lea ecx, [ebp - 0x20a0]
call fcn.005dc430
lea ecx, [ebp - 0x207c]
mov byte [ebp - 4], 0x1f
call fcn.005dc430
mov eax, dword [ebp - 0x2fc0]
jmp 0x4ff2bf
lea ecx, [ebp - 0x2140]
call fcn.005dc430
lea ecx, [ebp - 0x2134]
call fcn.005dc430
mov eax, dword [ebp - 0x2318]
cmp eax, 0xffffffff
je 0x4ff28c
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x20e8]
call fcn.005dc430
lea ecx, [ebp - 0x20a0]
call fcn.005dc430
lea ecx, [ebp - 0x207c]
call fcn.005dc430
mov byte [ebp - 0x2f8d], 2
jmp 0x5010b8
mov esi, dword [ebp - 0x2f9c]
test al, al
jns 0x4ffa68
push str.Scanning:_LSA_providers...
push esi
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
lea ecx, [ebp - 0x1fa0]
push dword [ebp - 0x2fc4]
push str._r_n____LSA_providers:_r_n_r_n____Format:_Mode__Name__Image_path__Description
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
xorps xmm0, xmm0
lea ecx, [ebp - 0x2104]
movups xmmword [ebp - 0x2104], xmm0
movq qword [ebp - 0x20f4], xmm0
call fcn.005d9320
mov eax, dword [ebp - 0x2fbc]
mov esi, dword [ebp - 0x2fb4]
cdq
sub eax, edx
mov byte [ebp - 4], 0x3a
mov edx, eax
sar edx, 1
xor eax, eax
mov dword [ebp - 0x2f98], edx
mov dword [ebp - 0x2fa4], eax
nop dword [eax]
imul eax, edx
lea ecx, [edi + 0x14f0]
push 0
shr eax, 2
add eax, dword [ebp - 0x2f9c]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x4ff5de
mov eax, dword [ebp - 0x2fa4]
test eax, eax
jne 0x4ff3c0
lea eax, [ebp - 0x1fb0]
push eax
push str.SecurityProviders
push str.HKLMSYSTEMCurrentControlSetControlSecurityProviders
lea ecx, [ebp - 0x1fa4]
call fcn.005d65d0
push 8
lea ecx, [ebp - 0x1fb0]
call fcn.005da0f0
push 0
push 0x624514
jmp 0x4ff412
cmp eax, 1
jne 0x4ff3cc
push str.Authentication_Packages
jmp 0x4ff3dd
cmp eax, 2
jne 0x4ff3d8
push str.Notification_Packages
jmp 0x4ff3dd
push str.Security_Packages
lea ecx, [ebp - 0x1f94]
call fcn.005dc510
lea eax, [ebp - 0x1fb0]
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push str.HKLMSYSTEMCurrentControlSetControlLsa
lea ecx, [ebp - 0x1fa4]
call fcn.005d65d0
push 0
push 0x627824
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2104]
call fcn.005d9070
lea ecx, [ebp - 0x2104]
mov dword [ebp - 0x2f8c], 0
call fcn.005d9210
test eax, eax
je 0x4ff61a
mov ecx, dword [ebp - 0x2f8c]
nop dword [eax]
push 3
push 1
push ecx
lea ecx, [ebp - 0x2104]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc260
mov ecx, eax
call fcn.005da0f0
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x4ff5fb
push 0x628ffc
lea ecx, [ebp - 0x1f94]
call fcn.005dc4c0
test al, al
jne 0x4ff5fb
push 0
push 1
push 1
push 0
push str..dll
lea ecx, [ebp - 0x1f94]
call fcn.005daa70
lea ecx, [ebp - 0x1f94]
mov esi, eax
call fcn.005dc3a0
sub eax, 3
cmp esi, eax
je 0x4ff4ec
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..dll
lea ecx, [ebp - 0x1f94]
call fcn.005da780
push 3
lea edx, [edi + 0x1c]
lea ecx, [ebp - 0x1f94]
call fcn.005e88c0
test al, al
jne 0x4ff526
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.File_not_found:
lea ecx, [ebp - 0x1f94]
call fcn.005da510
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x4ff5f5
push 0
push 0
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push 0x6558f0
push dword [ebp - 0x2f8c]
lea ecx, [ebp - 0x2104]
call fcn.005d9220
push eax
push str._r_n_LsaProviders__
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov esi, dword [ebp - 0x2fb4]
cmp byte [esi + 4], 0
je 0x4ff5fb
lea ecx, [ebp - 0x2104]
call fcn.005d9280
mov byte [ebp - 0x2f8d], 2
jmp 0x5010b8
mov esi, dword [ebp - 0x2fb4]
inc dword [ebp - 0x2f8c]
lea ecx, [ebp - 0x2104]
call fcn.005d9210
mov ecx, dword [ebp - 0x2f8c]
cmp ecx, eax
jb 0x4ff450
mov eax, dword [ebp - 0x2fa4]
mov edx, dword [ebp - 0x2f98]
inc eax
mov dword [ebp - 0x2fa4], eax
cmp eax, 4
jb 0x4ff360
push 0
push str._r_n_____End_of_LSA_providers_list.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x2f9c]
lea ecx, [edi + 0x14f0]
add eax, dword [ebp - 0x2f98]
push str.Scanning:_Blocked_hosts...
push eax
mov dword [ebp - 0x2f9c], eax
call fcn.005b66e0
push 0
push str._r_n____Blocked_hosts:_r_n_r_n____Format:_Mode__Domain__Line__Description_r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.driversetchosts
push dword [edi + 0x24]
lea ecx, [ebp - 0x1fb0]
call fcn.005dc200
xorps xmm0, xmm0
lea ecx, [ebp - 0x1fb0]
push 0
push 0
movups xmmword [ebp - 0x2248], xmm0
movups xmmword [ebp - 0x2238], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2248]
call fcn.005e4770
xorps xmm0, xmm0
mov dword [ebp - 0x2068], 0
movq qword [ebp - 0x2070], xmm0
mov dword [ebp - 0x2068], 0
mov dword [ebp - 0x2070], 0
mov dword [ebp - 0x206c], 0
push 8
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x2e70]
push str._S_h_S_
mov dword [ebp - 0x2e70], 0
call fcn.00401400
push 0
lea eax, [ebp - 0x1fb0]
mov byte [ebp - 4], 0x3d
push eax
lea ecx, [ebp - 0x2248]
call fcn.005e3f60
test eax, eax
je 0x4ff9db
push 0
push 0x62781c
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2104]
call fcn.005d9070
mov ecx, eax
call fcn.005d9210
test eax, eax
je 0x4ff9db
lea ecx, [ebp - 0x2104]
mov dword [ebp - 0x2fa0], 0
call fcn.005d9210
test eax, eax
je 0x4ff9db
mov dword [ebp - 0x2f8c], 0
nop word [eax + eax]
mov eax, dword [ebp - 0x2fbc]
lea ecx, [ebp - 0x2104]
push 0
mov dword [ebp - 0x2fa4], eax
call fcn.005d9210
mov ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x2f8c]
div ecx
lea ecx, [edi + 0x14f0]
add eax, dword [ebp - 0x2f9c]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x5000fb
push dword [ebp - 0x2fa0]
lea ecx, [ebp - 0x2104]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x1fb0]
call fcn.005dc510
push 3
lea ecx, [ebp - 0x1fb0]
call fcn.005da0f0
lea ecx, [ebp - 0x1fb0]
call fcn.005dbeb0
test al, al
jne 0x4ff9b2
push 0
lea ecx, [ebp - 0x1fb0]
call fcn.005dc440
cmp word [eax], 0x23
je 0x4ff9b2
push 0
push 8
lea eax, [ebp - 0x2070]
push eax
push dword [ebp - 0x2e70]
lea ecx, [ebp - 0x1fb0]
call fcn.005d96b0
lea ecx, [ebp - 0x1f94]
call fcn.005dc400
mov eax, dword [ebp - 0x2070]
cmp eax, 3
jae 0x4ff87c
push str.Invalid_line_in_the_hosts_file
lea ecx, [ebp - 0x1fcc]
call fcn.005dc510
jmp 0x4ff949
cmp eax, 1
mov ecx, 2
cmovbe eax, ecx
mov ecx, edi
mov dword [ebp - 0x2070], eax
mov eax, dword [ebp - 0x2068]
add eax, 0xc
push eax
call fcn.0044c770
cmp al, 1
jne 0x4ff8db
mov eax, dword [ebp - 0x2070]
mov ecx, 3
cmp eax, 2
push str.localhost
cmovbe eax, ecx
mov ecx, dword [ebp - 0x2068]
mov dword [ebp - 0x2070], eax
lea ecx, [ecx + 0x18]
call fcn.005dc4c0
test al, al
jne 0x4ff9b2
push str.Blocked_domain_in_the_hosts_file
jmp 0x4ff906
test al, al
jne 0x4ff8f1
push str.Invalid_IP_in_the_hosts_file
lea ecx, [ebp - 0x1fcc]
call fcn.005dc510
jmp 0x4ff91d
mov ecx, dword [ebp - 0x2fa4]
mov dword [ebp - 0x2fbc], ecx
cmp al, 2
jne 0x4ff91d
push str.Redirected_domain_in_the_hosts_file
lea ecx, [ebp - 0x1fcc]
call fcn.005dc510
mov eax, dword [ebp - 0x2fa4]
mov dword [ebp - 0x2fbc], eax
mov eax, dword [ebp - 0x2070]
mov ecx, 3
cmp eax, 2
cmovbe eax, ecx
lea ecx, [ebp - 0x1f94]
mov dword [ebp - 0x2070], eax
mov eax, dword [ebp - 0x2068]
add eax, 0x18
push eax
call fcn.005dc4e0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
push 0x6558f0
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push 0x6558f0
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push str._r_n_BlockedHosts__
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x5000fb
mov eax, dword [ebp - 0x2f98]
lea ecx, [ebp - 0x2104]
inc dword [ebp - 0x2fa0]
add dword [ebp - 0x2f8c], eax
call fcn.005d9210
cmp dword [ebp - 0x2fa0], eax
jb 0x4ff7a0
mov ecx, dword [ebp - 0x2fbc]
sub ecx, dword [ebp - 0x2f98]
mov eax, dword [ebp - 0x2f9c]
add eax, ecx
lea ecx, [edi + 0x14f0]
push 0
push eax
call fcn.005b66e0
push 0
push str._r_n_____End_of_the_Blocked_hosts_list.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x2e70]
test eax, eax
je 0x4ffa22
push eax
call fcn.00418a90
add esp, 4
mov ecx, dword [ebp - 0x2068]
mov dword [ebp - 0x2e70], 0
test ecx, ecx
je 0x4ffa3d
push 3
call fcn.00401e90
lea ecx, [ebp - 0x2240]
call fcn.005d9280
lea ecx, [ebp - 0x2248]
call fcn.00401050
lea ecx, [ebp - 0x2104]
mov byte [ebp - 4], 0x1f
call fcn.005d9280
mov eax, dword [ebp - 0x2fc0]
test eax, 0x100
je 0x4ffdd6
push 1
mov dword [ebp - 0x2ef0], edi
lea ecx, [ebp - 0x2eec]
push dword [edi + 0x1c]
call fcn.005dc570
push 0x2c
lea eax, [ebp - 0x2ed4]
mov byte [ebp - 0x2ee0], 0
push 0
push eax
mov dword [ebp - 0x2edc], 0
mov dword [ebp - 0x2ed8], 0
call fcn.00420090
xorps xmm0, xmm0
mov dword [ebp - 0x2ea8], 0
add esp, 0xc
mov dword [ebp - 0x2ea4], 0
movq qword [ebp - 0x2ea0], xmm0
mov dword [ebp - 0x2e98], 0xffffffff
push str.NtQueryInformationFile
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x2e90]
movlpd qword [ebp - 0x2e90], xmm0
push str.ntdll.dll
mov dword [ebp - 0x2e90], 0
mov dword [ebp - 0x2e8c], 0
call fcn.00404820
mov byte [ebp - 4], 0x3f
mov eax, dword [ebp - 0x2e90]
test eax, eax
je 0x4ffdc7
cmp dword [ebp - 0x2e8c], 0
je 0x4ffdbc
mov eax, dword [ebp - 0x2fa8]
mov ecx, eax
and ecx, 8
or ecx, 2
mov dword [ebp - 0x2edc], ecx
test al, 2
jne 0x4ffb55
or ecx, 0x10
mov dword [ebp - 0x2edc], ecx
test al, 0x10
je 0x4ffb62
or ecx, 4
mov dword [ebp - 0x2edc], ecx
push 8
push str..exe.dll.sys.com.raw.scr.cab.ocx.xpi.vbs.vbe.msi.jar.cpl.drv.bat.cmd.reg
lea ecx, [ebp - 0x1fb0]
call fcn.005d9980
mov ecx, dword [ebp - 0x2ed8]
mov esi, eax
test ecx, ecx
je 0x4ffb89
push ecx
call fcn.00418a90
add esp, 4
lea eax, [ebp - 0x2018]
mov dword [ebp - 0x2ed8], esi
xorps xmm0, xmm0
mov dword [ebp - 0x2ed0], eax
mov eax, dword [ebp - 0x2e8c]
lea ecx, [ebp - 0x2ea8]
push 0x800
mov dword [ebp - 0x2ed4], 0
mov byte [ebp - 0x2ecc], 0
movlpd qword [ebp - 0x2ec8], xmm0
movlpd qword [ebp - 0x2ec0], xmm0
movlpd qword [ebp - 0x2eb8], xmm0
mov dword [ebp - 0x2eb0], eax
mov dword [ebp - 0x2eac], 0x800
call fcn.00404560
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
lea eax, [ebp - 0x22a8]
push dword [ebp - 0x2fc4]
lea ecx, [ebp - 0x1fa0]
mov dword [ebp - 0x2e9c], eax
push str._r_n____Unsafe_alternate_data_streams:_r_n_r_n____Format:_Mode__Stream_path__Size__Description
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push str.Searching_for_Alternate_data_streams....
push 0xffffffffffffffb0
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push 0
lea eax, [ebp - 0x2ef0]
mov dword [ebp - 0x2e88], 0
push eax
push 0x440e90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x2e88], eax
test eax, eax
jne 0x4ffc85
or eax, 0xffffffff
mov dword [ebp - 0x2e88], eax
xor edx, edx
mov byte [ebp - 4], 0x40
mov ecx, eax
call fcn.005cca30
test al, al
je 0x4ffcd4
mov esi, dword [ebp - 0x2fb4]
mov edi, 1
cmp byte [esi + 4], 0
movzx eax, byte [ebp - 0x2ee0]
cmovne eax, edi
push 0xa
mov byte [ebp - 0x2ee0], al
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2e88]
xor edx, edx
call fcn.005cca30
test al, al
jne 0x4ffca1
mov edi, dword [ebp - 0x2fcc]
cmp byte [ebp - 0x2ee0], 0
mov ecx, str._r_nThe_scan_completed_successfully._r_n
mov eax, str._r_nThe_scan_was_cancelled._r_n
cmove eax, ecx
lea ecx, [ebp - 0x1fb0]
push eax
call fcn.005dc510
push fcn.005dc430
push fcn.005dc5e0
push 2
push 0xc
lea eax, [ebp - 0x48]
push eax
call fcn.0041e804
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x48]
push dword [ebp - 0x2ec4]
push dword [ebp - 0x2ec8]
call fcn.005db580
push dword [ebp - 0x2ebc]
lea ecx, [ebp - 0x3c]
push dword [ebp - 0x2ec0]
call fcn.005db580
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._streams_found_with_the_selected_filter._r_n
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push str._file_objects_scanned._r_n
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
push 0x62781c
lea ecx, [ebp - 0x1fb0]
call fcn.005da780
lea eax, [ebp - 0x1fb0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push 0
push str._r_n_____End_of_Unsafe_ADS_scan.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
push fcn.005dc430
push 2
push 0xc
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0x40
push eax
call fcn.0041e45b
lea ecx, [ebp - 0x2e88]
call fcn.00401050
mov eax, dword [ebp - 0x2e90]
test eax, eax
je 0x4ffdc7
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x2ef0]
mov byte [ebp - 4], 0x1f
call fcn.00402790
mov eax, dword [ebp - 0x2fc0]
test eax, 0x200
je 0x50018c
lea ecx, [ebp - 0x2f78]
call fcn.004027e0
mov eax, dword [ebp - 0x2fa8]
lea ecx, [edi + 0x14f0]
push str.Preparing_to_scan_recent_files__please_wait...
mov byte [ebp - 4], 0x42
push 0xffffffffffffffb0
mov dword [ebp - 0x2f78], eax
call fcn.005b66e0
mov esi, dword [ebp - 0x2fb4]
mov ecx, edi
lea eax, [esi + 4]
push eax
push dword [edi + 0x1c]
call fcn.004f7650
mov dword [ebp - 0x2f70], eax
mov dword [ebp - 0x2f6c], edx
cmp eax, 0xffffffff
jne 0x4ffe41
cmp edx, eax
je 0x5000e4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
lea ecx, [ebp - 0x1fa0]
push dword [ebp - 0x2fc4]
push str.____Format:__RecentFiles___Last_write_date__Path__Description
push str._r_n____Recent_files_search:_r_n_r_n
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
mov eax, dword [ebp - 0x2ffc]
xorps xmm0, xmm0
mov dword [ebp - 0x2f48], eax
lea eax, [ebp - 0x2228]
push eax
movlpd qword [ebp - 0x2f68], xmm0
movlpd qword [ebp - 0x2f60], xmm0
movlpd qword [ebp - 0x2f58], xmm0
movlpd qword [ebp - 0x2f50], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea ecx, [ebp - 0x2228]
call fcn.005e4840
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x2f44], eax
lea ecx, [edi + 0x150]
push 0
lea eax, [ebp - 0x2308]
mov dword [ebp - 0x2108], 0
mov dword [ebp - 0x2f40], eax
xorps xmm0, xmm0
push 0
lea eax, [ebp - 0x2018]
movq qword [ebp - 0x2110], xmm0
push str.UVKRecentFoldersLog.txt
mov dword [ebp - 0x2f3c], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2110]
call fcn.005dc520
xorps xmm0, xmm0
mov byte [ebp - 4], 0x43
push 0
push 0x22
lea ecx, [ebp - 0x2110]
movups xmmword [ebp - 0x21a0], xmm0
movups xmmword [ebp - 0x2190], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21a0]
call fcn.005e4770
push dword [ebp - 0x2fd0]
lea eax, [ebp - 0x21a0]
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x2f34]
mov dword [ebp - 0x2f38], eax
call fcn.004014b0
push str.Recent_files_and_folders_scan...
push 0
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
lea eax, [esi + 4]
push eax
mov eax, dword [ebp - 0x2fa8]
shr eax, 5
not al
mov ecx, edi
and al, 1
movzx eax, al
push eax
lea eax, [ebp - 0x2f78]
push eax
push dword [edi + 0x1c]
call fcn.004f79a0
push 0
push str._r_n_r_n_____End_of_the_Recent_files_list.__r_n
lea ecx, [ebp - 0x2018]
mov byte [ebp - 0x2f8d], al
call fcn.005e37e0
push 0
lea ecx, [ebp - 0x21a0]
call fcn.005e36a0
push 0
push 0x20
lea ecx, [ebp - 0x2110]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21a0]
call fcn.005e4120
test eax, eax
je 0x500090
push 0
lea eax, [ebp - 0x1fb0]
push eax
lea ecx, [ebp - 0x21a0]
call fcn.005e3f60
cmp eax, 2
jbe 0x500090
cmp dword [ebp - 0x2f70], 0xffffffff
jne 0x500031
cmp dword [ebp - 0x2f6c], 0xffffffff
je 0x5000c3
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.____Format:__RecentFolder___Creation_date__Path_r_n_r_n
push str._r_n____Recent_folders_search:_r_n_r_n
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
lea eax, [ebp - 0x1fb0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push 0
push str._r_n_r_n_____End_of_Recent_folders_list.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
push 0
lea ecx, [ebp - 0x21a0]
call fcn.005e36a0
push 2
lea ecx, [ebp - 0x2110]
call fcn.005dc190
push eax
lea ecx, [edi + 0x1290]
call fcn.005771e0
cmp byte [ebp - 0x2f8d], 0
jne 0x500156
lea ecx, [ebp - 0x2198]
call fcn.005d9280
lea ecx, [ebp - 0x21a0]
call fcn.00401050
lea ecx, [ebp - 0x2110]
call fcn.005dc430
lea ecx, [ebp - 0x2f78]
call fcn.00402820
mov byte [ebp - 0x2f8d], 2
jmp 0x5010b8
mov eax, dword [ebp - 0x2e70]
test eax, eax
je 0x50010e
push eax
call fcn.00418a90
add esp, 4
mov ecx, dword [ebp - 0x2068]
mov dword [ebp - 0x2e70], 0
test ecx, ecx
je 0x500129
push 3
call fcn.00401e90
lea ecx, [ebp - 0x2240]
call fcn.005d9280
lea ecx, [ebp - 0x2248]
call fcn.00401050
lea ecx, [ebp - 0x2104]
call fcn.005d9280
mov byte [ebp - 0x2f8d], 2
jmp 0x5010b8
lea ecx, [ebp - 0x2198]
call fcn.005d9280
lea ecx, [ebp - 0x21a0]
call fcn.00401050
lea ecx, [ebp - 0x2110]
call fcn.005dc430
lea ecx, [ebp - 0x2f78]
mov byte [ebp - 4], 0x1f
call fcn.00402820
mov eax, dword [ebp - 0x2fc0]
test eax, 0x400
je 0x5010b1
mov ecx, dword [ebp - 0x2ff8]
call fcn.005d8c40
cmp eax, 9
jle 0x5010b1
xorps xmm0, xmm0
mov dword [ebp - 0x20b0], 0
lea ecx, [ebp - 0x20b8]
movq qword [ebp - 0x20b8], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x20ac]
xorps xmm0, xmm0
mov dword [ebp - 0x20a4], 0
movq qword [ebp - 0x20ac], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x20dc]
xorps xmm0, xmm0
mov dword [ebp - 0x20d4], 0
movq qword [ebp - 0x20dc], xmm0
call fcn.005dc5e0
lea ecx, [ebp - 0x1fc0]
mov byte [ebp - 4], 0x47
call fcn.005dc400
push 0
push 0x62781c
push dword [ebp - 0x2ff8]
xorps xmm0, xmm0
lea ecx, [ebp - 0x20d0]
movups xmmword [ebp - 0x20d0], xmm0
movq qword [ebp - 0x20c0], xmm0
call fcn.005d92a0
lea ecx, [ebp - 0x20d0]
mov byte [ebp - 4], 0x48
call fcn.005d9210
cmp eax, 1
jbe 0x501085
lea ecx, [ebp - 0x20d0]
call fcn.005d9210
test eax, eax
je 0x501085
xor esi, esi
xor edi, edi
nop dword [eax + eax]
push esi
lea ecx, [ebp - 0x20d0]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x1fb0]
call fcn.005dc510
lea ecx, [ebp - 0x1fb0]
call fcn.005dc3a0
test eax, eax
je 0x500318
push 3
lea ecx, [ebp - 0x1fb0]
call fcn.005da0f0
push 0
lea ecx, [ebp - 0x1fb0]
call fcn.005dc440
cmp word [eax], 0x3c
jne 0x5002f9
lea ecx, [ebp - 0x1fb0]
call fcn.005dc3a0
dec eax
lea ecx, [ebp - 0x1fb0]
push eax
call fcn.005dc440
cmp word [eax], 0x3e
jne 0x5002f9
lea eax, [ebp - 0x1fb0]
push eax
lea ecx, [ebp - 0x1fc0]
call fcn.005dc4e0
jmp 0x500318
lea ecx, [ebp - 0x1fc0]
call fcn.005dc3a0
test eax, eax
je 0x500318
lea ecx, [ebp - 0x1fb0]
call fcn.005dc3a0
test eax, eax
je 0x500318
inc edi
lea ecx, [ebp - 0x20d0]
inc esi
call fcn.005d9210
cmp esi, eax
jb 0x500280
mov esi, dword [ebp - 0x2fb4]
test edi, edi
mov edi, dword [ebp - 0x2fcc]
je 0x501085
push str.Processing_the_custom_scans__please_wait...
push 0
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
lea ecx, [ebp - 0x20d0]
mov dword [ebp - 0x2fc0], 0
call fcn.005d9210
test eax, eax
je 0x501073
mov dword [ebp - 0x2f98], 0
nop dword [eax]
lea eax, [ebp - 0x1fc0]
push eax
lea ecx, [ebp - 0x20b8]
call fcn.005dc4e0
push dword [ebp - 0x2fc0]
lea ecx, [ebp - 0x20d0]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x1fb0]
call fcn.005dc510
push 3
lea ecx, [ebp - 0x1fb0]
call fcn.005da0f0
lea ecx, [ebp - 0x1fb0]
call fcn.005dc3a0
test eax, eax
je 0x500435
push 0
lea ecx, [ebp - 0x1fb0]
call fcn.005dc440
cmp word [eax], 0x3c
jne 0x500435
lea ecx, [ebp - 0x1fb0]
call fcn.005dc3a0
dec eax
lea ecx, [ebp - 0x1fb0]
push eax
call fcn.005dc440
cmp word [eax], 0x3e
jne 0x500435
lea eax, [ebp - 0x1fb0]
push eax
lea ecx, [ebp - 0x1fc0]
call fcn.005dc4e0
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x1fc0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fb0]
call fcn.005daa70
mov dword [ebp - 0x2f8c], eax
jmp 0x50043f
mov dword [ebp - 0x2f8c], 0
push str._Reg_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc480
test al, al
je 0x500460
push 0
lea ecx, [ebp - 0x1fb0]
call fcn.005dbc20
push str._Reg_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc4c0
test al, al
je 0x5007c2
cmp dword [ebp - 0x2f8c], 0
je 0x500498
push 0
push str._r_n_r_n____Registry:_r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
jmp 0x500e62
lea ecx, [ebp - 0x1fb0]
call fcn.005dc3a0
cmp eax, 3
jle 0x500e62
lea eax, [ebp - 0x1fb0]
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc4e0
push 1
lea ecx, [ebp - 0x1f94]
call fcn.005dbf40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._registry_key...
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push str.Exporting_the
lea ecx, [ebp - 0x1f94]
call fcn.005dc200
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20d0]
call fcn.005d9210
mov ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x2f98]
div ecx
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x501178
push 0
push 0
push 0
push 0
push 0
push 0
push str._temp.reg___y
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
push 0x629d60
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str._reg.exe_export__
push dword [edi + 0x24]
lea ecx, [ebp - 0x1f94]
call fcn.005dc200
push 0
push 0
mov dword [ebp - 0x2e74], 0
lea ecx, [ebp - 0x1f94]
push dword [edi + 0x24]
call fcn.005dc190
mov edx, eax
xor ecx, ecx
call fcn.005e2ad0
mov dword [ebp - 0x2e74], eax
mov ecx, eax
test eax, eax
jne 0x5005b4
or eax, 0xffffffff
mov dword [ebp - 0x2e74], eax
or ecx, eax
mov byte [ebp - 4], 0x49
cmp ecx, 0xffffffff
je 0x500769
test ecx, ecx
je 0x500769
xor edx, edx
mov ecx, eax
call fcn.005cca30
test al, al
je 0x5005f9
cmp byte [esi + 4], 0
jne 0x50114e
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2e74]
xor edx, edx
call fcn.005cca30
test al, al
jne 0x5005d6
lea eax, [ebp - 0x20ec]
mov dword [ebp - 0x20ec], 0
push eax
push dword [ebp - 0x2e74]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x20ec], 0
jne 0x500769
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._temp.reg
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc200
xorps xmm0, xmm0
lea ecx, [ebp - 0x1f94]
push 0
push 0x20
movups xmmword [ebp - 0x2268], xmm0
movups xmmword [ebp - 0x2258], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2268]
call fcn.005e4770
push 0
lea eax, [ebp - 0x1f94]
mov byte [ebp - 4], 0x4a
push eax
lea ecx, [ebp - 0x2268]
call fcn.005e3f60
push 0
lea ecx, [ebp - 0x2268]
call fcn.005e36a0
push 2
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
lea ecx, [edi + 0x1290]
call fcn.005771e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.:_r_n_r_n
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str._r_n_r_n____Registry_entries_under
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push 8
push 0
push 0x62439c
push str.A.__r_n___r_n_z
lea ecx, [ebp - 0x1f94]
call fcn.005d9660
lea eax, [ebp - 0x1f94]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
push 0
push 0x62781c
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
lea ecx, [ebp - 0x2260]
call fcn.005d9280
lea ecx, [ebp - 0x2268]
call fcn.00401050
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x2e74]
call fcn.00401050
jmp 0x500e62
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._registry_key_could_not_be_exported._r_n
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str._r_nThe
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
lea ecx, [ebp - 0x2e74]
mov byte [ebp - 4], 0x48
call fcn.00401050
jmp 0x500e62
push str._Dir_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc4c0
test al, al
je 0x500b7f
cmp dword [ebp - 0x2f8c], 0
je 0x50082b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
lea ecx, [ebp - 0x1fa0]
push dword [ebp - 0x2fc4]
push str._r_n_r_n____Contents_of_folders:_r_n_r_n____Format:_Mode__Path__Description
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
jmp 0x500e62
lea ecx, [ebp - 0x1fb0]
call fcn.005dc3a0
cmp eax, 1
jle 0x500e62
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str....
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str.Scanning:_Contents_of_
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea ecx, [ebp - 0x1fa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20d0]
call fcn.005d9210
mov ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x2f98]
div ecx
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x501178
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x67e404
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str._r_n_r_n____Contents_of
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
lea eax, [ebp - 0x1fb0]
mov dword [ebp - 0x2120], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x2128]
push eax
movq qword [ebp - 0x2128], xmm0
call fcn.005dc5b0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6249f8
push 0x5c
lea ecx, [ebp - 0x2128]
mov byte [ebp - 4], 0x4b
call fcn.005da0a0
mov ecx, eax
call fcn.005da040
mov ecx, eax
call fcn.005da780
push 0x250
xorps xmm0, xmm0
lea eax, [ebp - 0x2a28]
push 0
movups xmmword [ebp - 0x27d8], xmm0
push eax
mov dword [ebp - 0x27d8], 0xffffffff
call fcn.00420090
add esp, 0xc
push 1
lea ecx, [ebp - 0x2128]
mov byte [ebp - 4], 0x4c
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2a28]
call fcn.00401280
test al, al
je 0x500b47
cmp byte [esi + 4], 0
jne 0x50115b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x29fc]
push eax
push 0x624284
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f94]
call fcn.005dc200
test byte [ebp - 0x2a28], 0x10
lea ecx, [ebp - 0x1f94]
je 0x500a33
push 1
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043ad10
mov ecx, eax
and ecx, edx
cmp ecx, 0xffffffff
je 0x50115b
push 4
push 0
push edx
push eax
lea ecx, [ebp - 0x2024]
call fcn.005daea0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__Directory_r_n
jmp 0x500ae9
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x500b32
push 4
push 0
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
mov ecx, eax
call fcn.005e0e70
push edx
push eax
lea ecx, [ebp - 0x2024]
call fcn.005daea0
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
push dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
test al, al
je 0x500b32
push 0
push 0
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2024]
call fcn.005dc190
push eax
push 0x6558f0
lea ecx, [ebp - 0x1f94]
call fcn.005dc190
push eax
push str._r_n_File_Folder__
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
cmp byte [esi + 4], 0
jne 0x50115b
lea ecx, [ebp - 0x2a28]
call fcn.00401230
test al, al
jne 0x5009a0
jmp 0x500b59
push 0
push str._r_nThe_specified_directory_could_not_be_found._r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
mov eax, dword [ebp - 0x27d8]
cmp eax, 0xffffffff
je 0x500b6b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x2128]
mov byte [ebp - 4], 0x48
call fcn.005dc430
jmp 0x500e62
push str._File_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc4c0
test al, al
je 0x500d32
cmp dword [ebp - 0x2f8c], 0
je 0x500be8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push dword [ebp - 0x2fc8]
lea ecx, [ebp - 0x1fa0]
push dword [ebp - 0x2fc4]
push str._r_n_r_n____Files:_r_n_r_n____Format:_Mode__Path__Size__Description
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
jmp 0x500e62
lea ecx, [ebp - 0x1fb0]
call fcn.005dc3a0
cmp eax, 3
jle 0x500e62
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x635758
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str.Scanning:
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea ecx, [ebp - 0x1fa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20d0]
call fcn.005d9210
mov ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x2f98]
div ecx
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x501178
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x1fd8]
push eax
lea eax, [ebp - 0x1fcc]
push eax
mov eax, dword [ebp - 0x2fa8]
lea ecx, [ebp - 0x1fb0]
and eax, 0x18
push eax
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004f8ac0
push 4
push 0
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
mov ecx, eax
call fcn.005e0e70
push edx
push eax
lea ecx, [ebp - 0x2024]
call fcn.005daea0
push 0
push 0
push 0
push 0
push 0x62781c
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fcc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2024]
call fcn.005dc190
push eax
push 0x6558f0
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
push str._r_n_File_Folder__
lea ecx, [ebp - 0x1fa0]
call fcn.005dc200
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
jmp 0x500e62
push str._VtReport_
lea ecx, [ebp - 0x1fc0]
call fcn.005dc4c0
test al, al
je 0x500e62
cmp dword [ebp - 0x2f8c], 0
je 0x500df3
push 1
push str._r_n_r_n____VirusTotal_reports:_r_n_r_n____Format:_Mode__Path__VirusTotal_result_r_n
lea ecx, [ebp - 0x1fa0]
call fcn.005dc260
lea eax, [ebp - 0x1fa0]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
lea ecx, [ebp - 0x1fc0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20b8]
call fcn.005dc480
test al, al
je 0x500e62
push 1
push str.Creating_the_VirusTotal_report_of_the_requested_items...
lea ecx, [ebp - 0x1fa0]
call fcn.005dc260
lea ecx, [ebp - 0x1fa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20d0]
call fcn.005d9210
mov ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x2f98]
div ecx
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
lea ecx, [ebp - 0x20ac]
call fcn.005dc400
lea ecx, [ebp - 0x20dc]
call fcn.005dc400
jmp 0x500e62
lea ecx, [ebp - 0x1fb0]
call fcn.005dc3a0
cmp eax, 3
jle 0x500e62
push 0
lea ecx, [ebp - 0x20d0]
call fcn.005d9210
mov ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x2f98]
div ecx
lea ecx, [edi + 0x14f0]
push eax
call fcn.005b66e0
cmp byte [esi + 4], 0
jne 0x501178
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627824
lea ecx, [ebp - 0x1fb0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20ac]
call fcn.005da780
lea ecx, [ebp - 0x20ac]
call fcn.005dc3a0
cmp eax, 4
jle 0x50104f
push str._VtReport_
lea ecx, [ebp - 0x20b8]
call fcn.005dc4c0
test al, al
je 0x50104f
lea ecx, [ebp - 0x20b8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fc0]
call fcn.005dc480
test al, al
jne 0x500ec1
lea ecx, [ebp - 0x20d0]
call fcn.005d9210
dec eax
cmp dword [ebp - 0x2fc0], eax
jne 0x50104f
mov ecx, edi
call fcn.00435850
or eax, 8
lea ecx, [ebp - 0x20dc]
push eax
push 0
push 0
push 0xffff
call fcn.005db9a0
push eax
lea ecx, [ebp - 0x20ac]
call fcn.005dc190
mov edx, str.HKLM64SOFTWARECarifredVirusTotal_reports
mov ecx, eax
call fcn.005a9a80
xorps xmm0, xmm0
lea ecx, [ebp - 0x21e8]
movups xmmword [ebp - 0x21e8], xmm0
movq qword [ebp - 0x21d8], xmm0
call fcn.005d9320
xorps xmm0, xmm0
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x21d0]
movq qword [ebp - 0x21c0], xmm0
movups xmmword [ebp - 0x21d0], xmm0
call fcn.005d9320
push 0
push 0x627824
lea ecx, [ebp - 0x20ac]
mov byte [ebp - 4], 0x4e
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e8]
call fcn.005d9070
push 0
push 0x627824
lea ecx, [ebp - 0x20dc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21d0]
call fcn.005d9070
lea ecx, [ebp - 0x21e8]
call fcn.005d9210
lea ecx, [ebp - 0x21d0]
mov dword [ebp - 0x2fa0], eax
call fcn.005d9210
cmp eax, dword [ebp - 0x2fa0]
jae 0x500fad
lea ecx, [ebp - 0x21d0]
call fcn.005d9210
mov dword [ebp - 0x2fa0], eax
jmp 0x500fb3
mov eax, dword [ebp - 0x2fa0]
mov dword [ebp - 0x2fd0], 0
test eax, eax
je 0x501035
mov esi, dword [ebp - 0x2fd0]
mov edi, dword [ebp - 0x2fa0]
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
push esi
lea ecx, [ebp - 0x21d0]
call fcn.005d9220
push eax
push 0x6558f0
push esi
lea ecx, [ebp - 0x21e8]
call fcn.005d9220
push eax
push str._r_n_VtReport__
lea ecx, [ebp - 0x1f94]
call fcn.005dc200
lea eax, [ebp - 0x1f94]
push eax
lea ecx, [ebp - 0x2018]
call fcn.005e3a10
inc esi
cmp esi, edi
jb 0x500fd0
mov edi, dword [ebp - 0x2fcc]
mov esi, dword [ebp - 0x2fb4]
lea ecx, [ebp - 0x21d0]
call fcn.005d9280
lea ecx, [ebp - 0x21e8]
mov byte [ebp - 4], 0x48
call fcn.005d9280
inc dword [ebp - 0x2fc0]
lea ecx, [ebp - 0x20d0]
add dword [ebp - 0x2f98], 0x64
call fcn.005d9210
cmp dword [ebp - 0x2fc0], eax
jb 0x500380
push 0
push str._r_n_____End_of_the_custom_scans.__r_n
lea ecx, [ebp - 0x2018]
call fcn.005e37e0
lea ecx, [ebp - 0x20d0]
call fcn.005d9280
lea ecx, [ebp - 0x20dc]
call fcn.005dc430
lea ecx, [ebp - 0x20ac]
call fcn.005dc430
lea ecx, [ebp - 0x20b8]
call fcn.005dc430
mov byte [ebp - 0x2f8d], 1
mov eax, dword [ebp - 0x2e78]
test eax, eax
je 0x5010cb
push eax
call fcn.00418a90
add esp, 4
lea ecx, [ebp - 0x2170]
mov dword [ebp - 0x2e78], 0
call fcn.005dc430
lea ecx, [ebp - 0x2040]
call fcn.005dc430
lea ecx, [ebp - 0x2088]
call fcn.005dc430
lea ecx, [ebp - 0x2e5c]
call fcn.005d6ab0
mov ecx, dword [ebp - 0x1ff8]
test ecx, ecx
je 0x501112
push 3
call fcn.00401e90
mov ecx, dword [ebp - 0x2090]
test ecx, ecx
je 0x501123
push 3
call fcn.00401e90
mov ecx, dword [ebp - 0x2054]
test ecx, ecx
je 0x501134
push 3
call fcn.00401e90
mov ecx, dword [ebp - 0x2030]
test ecx, ecx
je 0x4fa7c1
push 3
call fcn.00401e90
jmp 0x4fa7c1
lea ecx, [ebp - 0x2e74]
call fcn.00401050
jmp 0x501178
mov eax, dword [ebp - 0x27d8]
cmp eax, 0xffffffff
je 0x50116d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x2128]
call fcn.005dc430
lea ecx, [ebp - 0x20d0]
call fcn.005d9280
lea ecx, [ebp - 0x20dc]
call fcn.005dc430
lea ecx, [ebp - 0x20ac]
call fcn.005dc430
lea ecx, [ebp - 0x20b8]
call fcn.005dc430
mov byte [ebp - 0x2f8d], 2
jmp 0x5010b8