Function at 0x5bba20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xb4]
sub esp, 0xb4
push 0xffffffffffffffff
push 0x662ba4
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x755898]
xor eax, ebp
mov dword [ebp + 0xb0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x34], esi
mov eax, dword [ebp + 0xc4]
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x930], ebx
je 0x5bba91
push ebx
push ebx
mov ecx, dword [esi + 0x4e8]
push ecx
lea ecx, [esi + 0x20]
call fcn.005ce820
mov dword [esi + 0x930], ebx
cmp dword [esi + 0xacc], ebx
je 0x5bbaa3
mov dword [esi + 0xabc], 0x7540
cmp dword [esi + 0xabc], 0x7573
jne 0x5bbac8
push 3
mov ecx, esi
call fcn.005b4090
lea ecx, [esi + 0x51c]
call fcn.00569030
jmp 0x5bc198
cmp dword [esi + 4], ebx
jne 0x5bbad5
push ebx
mov ecx, esi
call fcn.005b4090
cmp dword [esi + 0xacc], ebx
je 0x5bbb18
push ebx
mov ecx, esi
call fcn.005b4090
push 1
mov edx, dword [esi + 0x4e8]
push edx
mov eax, dword [0x75bbd4]
push eax
mov ecx, dword [esi + 0xabc]
push ecx
lea ecx, [esi + 0x20]
call fcn.005c88c0
push str.Cancel_by_user._n
lea ecx, [esi + 0x51c]
call fcn.00568c40
jmp 0x5bc198
mov ecx, dword [esi + 0xabc]
cmp ecx, 0x7540
jne 0x5bbb44
push str.Cancel_by_user._n
lea ecx, [esi + 0x51c]
call fcn.00568c40
push 2
mov ecx, esi
call fcn.005b4090
jmp 0x5bc198
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x23], 1
mov eax, ecx
cmp eax, 0x753b
jg 0x5bbbe8
je case.0x5bbbf9.30040
cmp eax, 0x80090304
je case.0x5bbbf9.30018
cmp eax, 0x17
je case.0x5bbbf9.30040
cmp eax, 0x70
je case.0x5bbbf9.30040
cmp byte [esi + 0x34a], bl
jne case.0x5bbbf9.30040
cmp byte [esi + 0xaef], bl
jne 0x5bbd69
cmp byte [0x75b73d], bl
je 0x5bbd61
cmp dword [esi + 4], ebx
jne 0x5bbd61
test dword [esi + 0x174], 0x80000
je 0x5bbd61
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00402500
mov byte [ebp - 4], 2
cmp byte [esi + 0xaa8], 0
je 0x5bbc00
mov eax, dword [esi + 0xa90]
push eax
mov ecx, dword [esi + 0xa8c]
push ecx
jmp 0x5bbc17
sub eax, 0x7542
cmp eax, 0x40
ja case.0x5bbbf9.30019
movzx edx, byte [eax + 0x5bd6c8]
jmp dword [edx*4 + 0x5bd6bc]
mov eax, dword [esi + 0x94c]
cmp eax, ebx
jne 0x5bbc0f
mov eax, 0x676974
mov ecx, dword [esi + 0x950]
push ecx
push eax
push str._s:_ld
lea edx, [ebp - 0x14]
push edx
call fcn.00402f70
add esp, 0x10
mov byte [esi + 0xaef], 1
push esi
call fcn.004b25d0
push esi
call fcn.004b5f60
add esp, 8
cmp byte [esi + 0xaa8], 0
je 0x5bbc57
mov eax, dword [esi + 0xa90]
push eax
mov ecx, dword [esi + 0xa8c]
push ecx
jmp 0x5bbc6e
mov eax, dword [esi + 0x94c]
cmp eax, ebx
jne 0x5bbc66
mov eax, 0x676974
mov ecx, dword [esi + 0x950]
push ecx
push eax
push str._s:_ld
lea edx, [ebp - 0x20]
push edx
call fcn.00402f70
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.0061ee1e
add esp, 8
test eax, eax
je 0x5bbd20
lea edi, [esi + 0x51c]
push str.Try_via_the_same_proxy_as_in_browser_request._n
mov ecx, edi
call fcn.00568c40
mov edx, dword [esi + 0xabc]
mov dword [esi + 0xaf4], edx
mov edi, dword [edi]
cmp edi, ebx
je 0x5bbcd0
push edi
push 0x675ea0
lea eax, [esi + 0xaf8]
push eax
call fcn.00402f70
add esp, 0xc
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
je 0x5bbcf5
mov eax, dword [esi + 0x4e8]
cmp eax, ebx
je 0x5bbcf5
push eax
push 0x1431
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x5bbd03
mov dword [esi + 0x948], ebx
push ebx
mov ecx, esi
call fcn.005c4ba0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5bc198
mov byte [esi + 0xaef], 0
cmp byte [esi + 0xaf0], 0
je 0x5bbd44
push str.Cannot_detect_proxy_in_browser_proxy_script_:__n
lea ecx, [esi + 0x51c]
call fcn.00568c40
mov byte [ebp - 0x19], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5bbdb8
mov byte [ebp - 0x23], bl
cmp byte [esi + 0xaef], bl
je 0x5bbdb8
cmp ecx, 0x756f
je 0x5bbd79
cmp ecx, 0x7559
jne 0x5bbdb2
mov ecx, dword [esi + 0xaf4]
mov dword [esi + 0xabc], ecx
mov edx, dword [esi + 0xaf8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5bbd90
lea ecx, [esi + 0x51c]
sub eax, edi
je 0x5bbda9
push edx
call fcn.00569300
jmp 0x5bbdae
call fcn.005690a0
mov byte [ebp - 0x19], 1
mov byte [esi + 0xaef], bl
mov byte [ebp - 0x1a], 0
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x5c], ebx
xor edx, edx
mov word [ebp + 0x58], dx
mov byte [ebp - 4], 3
mov eax, dword [esi + 0xabc]
cmp eax, 0x7532
jg 0x5bc156
je case.0x5bc007.10060
cmp eax, 0x271d
jg 0x5bbfe1
je 0x5bbfd9
cmp eax, 0xffffffff
jg 0x5bbee9
je 0x5bbe5b
cmp eax, 0x80090304
je case.0x5bc16b.30009
cmp eax, 0x8009030e
je case.0x5bc16b.30009
cmp eax, 0xfffffffc
je case.0x5bc16b.30009
mov eax, dword [esi + 0x44]
cmp eax, 4
je 0x5bc9b3
cmp eax, 5
je 0x5bc9b3
lea edx, [esi + 0x520]
push edx
lea ecx, [ebp + 0x48]
call fcn.00402180
mov byte [ebp - 4], 0x17
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jne 0x5bbe50
lea eax, [ebp + 0x4c]
mov edx, dword [0x75b988]
jmp 0x5bc912
mov eax, dword [esi + 0x44]
cmp eax, 4
je case.0x5bc16b.30009
cmp eax, 5
je case.0x5bc16b.30009
lea eax, [esi + 0x520]
push eax
lea ecx, [ebp + 0x3c]
call fcn.00402180
mov bl, 0x15
mov byte [ebp - 4], bl
lea ecx, [esi + 0xb14]
push ecx
lea ecx, [ebp + 0x48]
call fcn.00402180
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp + 0x48]
test ecx, ecx
jne 0x5bbe99
lea ecx, [ebp + 0x4c]
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5bbea3
lea eax, [ebp + 0x40]
mov edx, dword [0x75ad10]
push edx
push ecx
push eax
mov eax, dword [0x75b984]
push eax
lea ecx, [ebp + 0x54]
call fcn.00402320
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x3c]
call fcn.00401210
jmp 0x5bc9c8
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75b990]
push edx
jmp 0x5bc9c0
cmp eax, 5
je 0x5bbfc6
cmp eax, 0x17
je 0x5bbfb4
cmp eax, 0x70
jne case.0x5bc16b.30004
mov eax, dword [0x75ad10]
push eax
mov ecx, dword [0x75beac]
push ecx
lea ecx, [ebp + 0x48]
call fcn.0045e060
mov bl, 0x11
mov byte [ebp - 4], bl
xor edi, edi
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x20], edi
xor edx, edx
mov word [ebp + 0x1c], dx
mov byte [ebp - 4], 0x12
push edi
push edi
lea eax, [ebp - 0x18]
push eax
push 0x400
push 0x70
push edi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp + 0x48]
cmp eax, edi
jne 0x5bbf53
lea eax, [ebp + 0x4c]
push edi
mov ecx, dword [ebp - 0x18]
push ecx
push eax
push str._r_n_r_n_s_s
lea ecx, [ebp + 0x18]
call fcn.00402320
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x75ad10]
push eax
mov ecx, dword [0x75b990]
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov eax, dword [ebp + 0x18]
cmp eax, edi
jne 0x5bbf8f
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405300
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x18]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
call fcn.00401210
jmp 0x5bc9c8
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75c434]
push eax
jmp 0x5bc9c0
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75bfc4]
push edx
jmp 0x5bc9c0
mov ecx, dword [0x75b99c]
jmp 0x5bc014
cmp eax, 0x2af9
jg 0x5bc102
je 0x5bc0f7
sub eax, 0x2726
cmp eax, 0x2b
ja case.0x5bc16b.30004
movzx edx, byte [eax + 0x5bd738]
jmp dword [edx*4 + 0x5bd70c]
mov ecx, dword [0x75b998]
mov eax, dword [0x75ad10]
push eax
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [esi + 0x35d], 1
jmp 0x5bc9c8
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0xb
mov eax, dword [0x75b990]
mov edx, dword [0x75c0c0]
push edx
push eax
push str._s_r_n_r_n_s
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f70
add esp, 0x10
mov edx, dword [0x75ad10]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [esi + 0x35d], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5bc9c8
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75b9a0]
push edx
jmp 0x5bc9c0
mov ecx, dword [0x75b9a4]
jmp 0x5bc9b9
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75b9a8]
push eax
jmp 0x5bc9c0
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75b9b0]
push edx
jmp 0x5bc9c0
mov ecx, dword [0x75b9b4]
jmp 0x5bc9b9
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75b9b8]
push eax
jmp 0x5bc9c0
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75b9bc]
push edx
jmp 0x5bc9c0
mov ecx, dword [0x75b9ac]
jmp 0x5bc014
sub eax, 0x2afa
je case.0x5bc16b.30009
sub eax, 2
jne case.0x5bc16b.30004
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0xc
mov eax, dword [0x75bbb0]
jmp 0x5bc040
mov eax, dword [esi + 0x174]
test al, 8
jne 0x5bc13d
test eax, 0x100
je case.0x5bc16b.30003
mov byte [esi + 0x35d], 1
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75bbf0]
push eax
jmp 0x5bc9c0
sub eax, 0x7533
cmp eax, 0x57
ja case.0x5bc16b.30004
movzx ecx, byte [eax + 0x5bd7d8]
jmp dword [ecx*4 + 0x5bd764]
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75b9c0]
push eax
jmp 0x5bc9c0
push ebx
mov ecx, esi
call fcn.005b4090
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x54]
call fcn.00401210
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xb0]
xor ecx, ebp
call fcn.0061d2ff
add ebp, 0xb4
mov esp, ebp
pop ebp
ret 0xc
push ebx
mov ecx, esi
call fcn.005b4090
cmp dword [esi + 8], ebx
jne 0x5bc3d8
cmp dword [esi + 4], ebx
jne 0x5bc3d8
cmp byte [ebp + 0xbc], 0
je 0x5bc3d8
mov eax, dword [esi + 0x518]
cmp eax, ebx
je 0x5bc211
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5bc211
mov edx, dword [esi + 0x518]
mov eax, dword [edx + 0x20]
push eax
call fcn.005f610f
mov edi, eax
jmp 0x5bc213
xor edi, edi
mov ecx, dword [esi + 0x44]
push ecx
call fcn.0049ba20
add esp, 4
push eax
lea ecx, [ebp - 0x20]
call fcn.004030b0
mov byte [ebp - 4], 4
mov eax, dword [esi + 0x1d0]
lea ebx, [esi + 0x20]
push edi
push 0
push 0
push eax
mov edx, dword [ebx]
push edx
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0xec]
call fcn.004f8240
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xec]
call fcn.005f3511
cmp eax, 1
jne 0x5bc3bd
mov eax, dword [esi + 0x10]
test eax, eax
je 0x5bc27f
push 0
push 0x1472
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x10], 0
mov ecx, dword [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0x78]
push edx
mov ecx, esi
call fcn.005b43b0
mov eax, dword [esi + 0x4e8]
test eax, eax
je 0x5bc32b
cmp dword [esi + 0x49c], 0
jne 0x5bc2b4
push eax
mov ecx, ebx
call fcn.005cc020
mov edx, dword [esi + 0x49c]
test edx, edx
je 0x5bc32b
mov edi, dword [ebp - 0x78]
mov eax, edi
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5bc2c6
sub eax, ebx
inc eax
push eax
push edi
push 1
push 0
push 0x68976c
push edx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call edi
cmp byte [esi + 0x1c0], 0
je 0x5bc30c
mov dword [ebp - 0x28], 1
push 4
lea eax, [ebp - 0x28]
push eax
push 4
push 0
push str.bUNRA
mov ecx, dword [esi + 0x49c]
push ecx
call edi
push 0
mov edx, dword [ebp - 0x74]
push edx
push str.EncPassword
push 0x69809c
mov eax, dword [esi + 0x49c]
push eax
call fcn.005b7490
add esp, 0x14
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 6
mov ecx, dword [esi + 0xabc]
push ecx
mov edx, dword [0x75b97c]
push edx
push str._r_n_s_r_ndownlResult___ldsetting_new_login_r_n
lea eax, [ebp - 0x14]
push eax
call fcn.00402f70
add esp, 0x10
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [esi + 0x51c]
call fcn.00568c40
cmp byte [ebp + 0xc0], 0
je 0x5bc391
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5bc391
mov esi, dword [esi + 0x4e8]
test esi, esi
je 0x5bc391
push esi
push 0x1431
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x14]
call fcn.00402570
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xec]
call fcn.004b9730
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.00402570
jmp 0x5bc18c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xec]
call fcn.004b9730
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.00402570
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75b97c]
push eax
jmp 0x5bc9c0
push 0x676974
lea ecx, [esi + 0x3ac]
call fcn.0054e080
cmp dword [esi + 8], ebx
jne 0x5bc59f
cmp dword [esi + 4], ebx
jne 0x5bc59f
cmp byte [ebp + 0xbc], 0
je 0x5bc59f
push ebx
mov ecx, esi
call fcn.005b4090
mov eax, dword [esi + 0x518]
cmp eax, ebx
je 0x5bc44c
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5bc44c
mov edx, dword [esi + 0x518]
mov eax, dword [edx + 0x20]
push eax
call fcn.005f610f
mov ebx, eax
jmp 0x5bc44e
xor ebx, ebx
mov ecx, dword [esi + 0x44]
push ecx
call fcn.0049ba20
add esp, 4
push eax
lea ecx, [ebp - 0x18]
call fcn.004030b0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.00402500
mov byte [ebp - 4], 8
cmp byte [esi + 0xa82], 0
jne 0x5bc4b3
cmp dword [0x75b734], 2
jne 0x5bc48e
test byte [0x75b748], 0x10
jne 0x5bc4b3
lea edi, [esi + 0x94c]
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
test eax, eax
je 0x5bc4a5
push eax
call fcn.0054e080
jmp 0x5bc4e8
lea edx, [esi + 0xa8c]
push edx
call fcn.004058f0
jmp 0x5bc4e8
lea edi, [esi + 0x94c]
mov eax, dword [edi]
lea edx, [ebp - 0x20]
test eax, eax
je 0x5bc4cc
mov ecx, dword [esi + 0x950]
push ecx
push eax
jmp 0x5bc4da
mov eax, dword [esi + 0xa90]
push eax
mov ecx, dword [esi + 0xa8c]
push ecx
push str._s:_ld
push edx
call fcn.00402f70
add esp, 0x10
mov eax, dword [esi + 0xa6c]
push ebx
movzx ecx, byte [esi + 0xa82]
push ecx
push 1
push eax
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xec]
call fcn.004f8240
mov bl, 9
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xec]
call fcn.005f3511
cmp eax, 1
jne 0x5bc578
mov byte [esi + 0xa85], al
mov eax, dword [esi + 0x10]
test eax, eax
je 0x5bc542
push 0
push 0x1472
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x10], 0
mov byte [ebp - 0x24], 1
cmp dword [edi], 0
je 0x5bc5c1
mov ecx, dword [ebp - 0x78]
push ecx
mov ecx, edi
call fcn.004b6cd0
test eax, eax
jne 0x5bc574
mov edx, dword [ebp - 0x74]
push edx
mov ecx, edi
call fcn.004b6d40
test eax, eax
je 0x5bc5f5
mov byte [ebp - 0x24], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xec]
call fcn.004b9730
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00402570
cmp byte [esi + 0xa82], 0
mov eax, 0x75c5f0
jne 0x5bc5b2
mov eax, 0x75b980
mov eax, dword [eax]
mov ecx, dword [0x75ad10]
push ecx
push eax
jmp 0x5bc9c0
mov byte [esi + 0xaa9], 1
mov eax, dword [ebp - 0x78]
push eax
push 0x675ea0
lea ecx, [esi + 0xa94]
push ecx
call fcn.00402f70
mov edx, dword [ebp - 0x74]
push edx
push 0x675ea0
lea eax, [esi + 0xa98]
push eax
call fcn.00402f70
add esp, 0x18
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0xa
cmp byte [esi + 0xa82], 0
mov eax, dword [0x75c5f0]
jne 0x5bc614
mov eax, dword [0x75b980]
mov ecx, dword [esi + 0xabc]
push ecx
push eax
push str._r_n_s_r_ndownlResult___ldsetting_new_login_r_n
lea edx, [ebp - 0x14]
push edx
call fcn.00402f70
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [esi + 0x51c]
call fcn.00568c40
cmp byte [ebp + 0xc0], 0
je 0x5bc668
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5bc668
mov esi, dword [esi + 0x4e8]
test esi, esi
je 0x5bc668
push esi
push 0x1431
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00402570
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xec]
call fcn.004b9730
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00402570
jmp 0x5bc18c
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75b994]
push eax
jmp 0x5bc9c0
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75bbc8]
push edx
jmp 0x5bc9c0
mov ecx, dword [0x75b98c]
jmp 0x5bc9b9
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75ba28]
push eax
jmp 0x5bc9c0
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75ba2c]
push edx
jmp 0x5bc9c0
mov ecx, dword [0x75ba30]
jmp 0x5bc9b9
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75b978]
push eax
jmp 0x5bc9c0
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75bb94]
push edx
jmp 0x5bc9c0
mov ecx, dword [0x75bbdc]
jmp 0x5bc9b9
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75bc2c]
push eax
jmp 0x5bc9c0
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75bbe4]
push edx
jmp 0x5bc9c0
mov ecx, dword [0x75bc74]
jmp 0x5bc9b9
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75bbec]
push eax
jmp 0x5bc9c0
lea ecx, [ebp + 0xa0]
push ecx
mov edx, dword [esi + 0x4fc]
push edx
mov eax, dword [esi + 0x4f8]
push eax
mov ecx, esi
call fcn.005b4a10
mov dword [ebp], ebx
mov dword [ebp + 8], ebx
xor ecx, ecx
mov word [ebp + 4], cx
mov byte [ebp - 4], 0xd
lea edx, [ebp]
push edx
mov ecx, esi
call fcn.005b5da0
lea eax, [ebp + 0xa0]
push eax
lea ecx, [ebp + 0x3c]
call fcn.00406f80
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
call fcn.00402500
mov byte [ebp - 4], 0xf
mov ecx, dword [esi + 0x4fc]
push ecx
mov edx, dword [esi + 0x4f8]
push edx
push str._I64d
lea eax, [ebp - 0x18]
push eax
call fcn.00402f70
add esp, 0x10
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp + 0x48]
call fcn.00406f80
mov byte [ebp - 4], 0x10
push str._I64d
mov edx, dword [0x75bbb4]
push edx
call fcn.0061e9a0
add esp, 8
test eax, eax
je 0x5bc81a
push 0x675ea0
push str._I64d
jmp 0x5bc83b
push 0x6765f4
mov eax, dword [0x75bbb4]
push eax
call fcn.0061e9a0
add esp, 8
test eax, eax
je 0x5bc845
push 0x675ea0
push 0x6765f4
mov ecx, 0x75bbb4
call fcn.00402c10
cmp dword [esi + 0x54], ebx
je 0x5bc84f
mov edi, dword [esi + 0x54]
jmp 0x5bc852
lea edi, [esi + 0x58]
mov edx, dword [ebp + 0x48]
cmp edx, ebx
jne 0x5bc85c
lea edx, [ebp + 0x4c]
mov ecx, dword [ebp + 0x3c]
cmp ecx, ebx
jne 0x5bc866
lea ecx, [ebp + 0x40]
mov eax, dword [ebp]
cmp eax, ebx
jne 0x5bc870
lea eax, [ebp + 4]
mov ebx, dword [0x75ad10]
push ebx
push edi
push edx
push ecx
push eax
mov ecx, dword [0x75bbb4]
push ecx
lea ecx, [ebp + 0x54]
call fcn.0043bc60
mov byte [ebp - 4], 0xf
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
call fcn.00402570
mov byte [ebp - 4], 0xd
lea ecx, [ebp + 0x3c]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp]
call fcn.00401210
jmp 0x5bc9c8
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75ba68]
push edx
jmp 0x5bc9c0
mov ecx, dword [0x75c3d8]
jmp 0x5bc9b9
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75c484]
push eax
jmp 0x5bc9c0
lea eax, [esi + 0x520]
push eax
lea ecx, [ebp + 0x48]
call fcn.00402180
mov byte [ebp - 4], 0x13
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jne 0x5bc90c
lea eax, [ebp + 0x4c]
mov edx, dword [0x75c0cc]
mov ecx, dword [0x75ad10]
push ecx
push eax
push edx
lea ecx, [ebp + 0x54]
call fcn.004021b0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
call fcn.00401210
jmp 0x5bc9c8
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0x14
mov eax, dword [0x75c5a0]
push eax
push 0x675ea0
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f70
push 0x678294
mov edx, dword [ebp - 0x14]
push edx
call fcn.0061fa60
add esp, 0x14
cmp eax, ebx
je 0x5bc96c
mov byte [eax], 0
mov eax, dword [0x75ad10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5bc9c8
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75c740]
push eax
jmp 0x5bc9c0
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75c744]
push edx
jmp 0x5bc9c0
mov ecx, dword [0x75c748]
jmp 0x5bc9b9
mov ecx, dword [0x75b990]
mov eax, dword [0x75ad10]
push eax
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5bc9e7
mov edx, dword [esi + 0x4e8]
push edx
push 0x13c7
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0xabc]
add eax, 0xffff8abe
cmp eax, 0x38
ja case.0x5bca02.30019
movzx eax, byte [eax + 0x5bd83c]
jmp dword [eax*4 + 0x5bd830]
mov ecx, dword [esi + 0x150]
or ecx, dword [esi + 0x154]
je case.0x5bca02.30019
push 0x676970
lea ecx, [ebp + 0x54]
call fcn.00405300
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75c484]
push eax
lea ecx, [ebp + 0x48]
call fcn.0045e060
mov byte [ebp - 4], 0x18
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x5bca4b
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405300
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
call fcn.00401210
mov cl, byte [esi + 0x195]
test cl, cl
jne 0x5bcbd6
mov eax, dword [esi + 0x158]
test eax, eax
jle 0x5bca89
mov edx, dword [esi + 0x15c]
sub edx, eax
cmp edx, 0x3c
jl 0x5bcbc1
cmp byte [0x75b27b], 0
jne 0x5bcb7b
mov eax, dword [esi + 0x108]
cmp eax, dword [esi + 0x150]
jne 0x5bcb7b
mov ecx, dword [esi + 0x10c]
cmp ecx, dword [esi + 0x154]
jne 0x5bcb7b
cmp dword [esi + 0xdc], 0
je 0x5bcb7b
mov ebx, dword [esi + 0x134]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5bcad2
sub eax, edx
je 0x5bcb7b
mov edi, dword [esi + 0x104]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5bcaf0
sub eax, edx
je 0x5bcb7b
mov edx, ebx
mov eax, edi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x5bcb23
test cl, cl
je 0x5bcb1f
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x5bcb23
add eax, 2
add edx, 2
test cl, cl
jne 0x5bcb03
xor eax, eax
jmp 0x5bcb28
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x5bcb7b
mov ecx, ebx
mov eax, dword [esi + 0xdc]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5bcb54
test dl, dl
je 0x5bcb50
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5bcb54
add eax, 2
add ecx, 2
test dl, dl
jne 0x5bcb34
xor eax, eax
jmp 0x5bcb59
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x5bcb7b
mov byte [ebp - 0x21], 1
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75c380]
push eax
lea ecx, [ebp + 0x54]
call fcn.00401980
jmp case.0x5bca02.30019
push str._r_n_r_n
lea ecx, [ebp + 0x54]
call fcn.00405300
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75c4a4]
push edx
lea ecx, [ebp + 0x48]
call fcn.0045e060
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x5bcbac
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405300
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
jmp 0x5bcd37
test cl, cl
jne 0x5bcbd6
push 1
mov eax, dword [esi + 0x4e8]
push eax
lea ecx, [esi + 0x20]
call fcn.005ce5f0
cmp dword [esi + 0x4fc], 0
jl 0x5bcc05
jg 0x5bcbea
cmp dword [esi + 0x4f8], 0
jbe 0x5bcc05
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75c4a8]
push edx
lea ecx, [ebp + 0x54]
call fcn.00401980
jmp case.0x5bca02.30019
xor bl, bl
test byte [esi + 0x174], 0x70
je 0x5bcc12
mov bl, 1
xor edi, edi
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x14], edi
xor eax, eax
mov word [ebp + 0x10], ax
mov byte [ebp - 4], 0x19
lea ecx, [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.005b5da0
test bl, bl
je 0x5bccf9
mov edx, dword [esi + 0xe8]
mov eax, edx
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5bcc42
mov ecx, 0x75b8f0
sub eax, ebx
je 0x5bcc5a
push edx
call fcn.00544a80
jmp 0x5bcc63
mov edx, dword [esi + 0x20]
push edx
call fcn.00544960
cmp dword [esi + 0x11c], edi
je 0x5bcc73
mov eax, dword [esi + 0x11c]
jmp 0x5bcc79
lea eax, [esi + 0x120]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x5bcc80
sub eax, edx
sar eax, 1
je 0x5bcca9
cmp dword [esi + 0x11c], edi
je 0x5bcca1
mov eax, dword [esi + 0x11c]
jmp 0x5bccb3
lea eax, [esi + 0x120]
jmp 0x5bccb3
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x5bccb3
lea eax, [ebp + 0x10]
mov ecx, dword [0x75ad10]
push ecx
push eax
mov edx, dword [0x75c384]
push edx
lea ecx, [ebp + 0x54]
call fcn.004021b0
test dword [esi + 0x174], 0x100
jne 0x5bcd30
mov eax, dword [esi + 0x158]
cmp eax, edi
jle 0x5bcd30
mov ecx, dword [esi + 0x15c]
sub ecx, eax
cmp ecx, 0x3c
jge 0x5bcd30
cmp byte [ebp - 0x19], 0
jne 0x5bcd30
mov byte [ebp - 0x1a], 1
jmp 0x5bcd30
cmp byte [esi + 0x193], 0
je 0x5bcd1a
cmp byte [0x75b27b], 0
jne 0x5bcd1a
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75c380]
push eax
jmp 0x5bcd28
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75c4a8]
push edx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [ebp - 4], 3
lea ecx, [ebp + 0xc]
call fcn.00401210
cmp dword [esi + 0xabc], 0x7582
je 0x5bcdfa
cmp dword [esi + 0x51c], 0
je 0x5bcdfa
push str._r_n_r_n
lea ecx, [ebp + 0x54]
call fcn.00405300
xor edi, edi
mov dword [ebp + 0xa4], edi
mov dword [ebp + 0xac], edi
xor eax, eax
mov word [ebp + 0xa8], ax
mov bl, 0x1b
mov byte [ebp - 4], bl
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75beac]
push edx
lea ecx, [ebp + 0xa4]
call fcn.00401980
mov eax, dword [ebp + 0xa4]
cmp eax, edi
jne 0x5bcdab
lea eax, [ebp + 0xa8]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405300
mov eax, dword [0x75ad10]
push eax
mov ecx, dword [esi + 0x51c]
push ecx
lea ecx, [ebp + 0x48]
call fcn.0045e060
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp + 0x48]
cmp eax, edi
jne 0x5bcdd7
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405300
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp + 0xa4]
call fcn.00401210
cmp byte [ebp - 0x19], 0
je 0x5bcf28
push str._r_n_r_n
lea ecx, [ebp + 0x54]
call fcn.00405300
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75c714]
push eax
lea ecx, [ebp + 0x3c]
call fcn.0045e060
mov bl, 0x1d
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5bce35
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405300
mov byte [ebp - 0x22], 0
mov edx, dword [esi + 0x148]
mov eax, edx
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5bce50
sub eax, edi
je 0x5bcf1c
push 0x5c
push edx
call fcn.0061faa0
add esp, 8
mov edi, eax
test edi, edi
je 0x5bce73
inc edi
jmp 0x5bce79
mov edi, dword [esi + 0x148]
push 0xa
push str.chromeexe
push edi
call fcn.00621d6d
add esp, 0xc
test eax, eax
je 0x5bced3
push str.idmbrbtn.dll
push edi
call fcn.0061ee1e
add esp, 8
test eax, eax
jne 0x5bcf1c
mov eax, dword [esi + 0x1ac]
push str.Chrome
push eax
call fcn.0061e9a0
add esp, 8
test eax, eax
je 0x5bcf1c
mov eax, dword [esi + 0x1ac]
push str.Firefox
push eax
call fcn.0061e9a0
add esp, 8
test eax, eax
jne 0x5bcf1c
mov byte [ebp - 0x22], 1
push 0x682c0c
lea ecx, [ebp + 0x54]
call fcn.00405300
mov ecx, dword [0x75ad10]
push ecx
mov edx, dword [0x75c718]
push edx
lea ecx, [ebp + 0x48]
call fcn.0045e060
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x5bcf08
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405300
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x3c]
call fcn.00401210
mov eax, dword [ebp + 0x54]
xor ebx, ebx
cmp eax, ebx
jne 0x5bcf34
lea eax, [ebp + 0x58]
mov ecx, dword [0x75ad10]
push ecx
push eax
lea edx, [ebp - 0x2c]
push edx
call fcn.00402a70
add esp, 0xc
mov byte [ebp - 4], 0x1f
lea ecx, [esi + 0x20]
push ebx
mov eax, dword [esi + 0x4e8]
push eax
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [esi + 0xabc]
push eax
call fcn.005c88c0
lea edi, [esi + 0x51c]
mov ecx, dword [ebp - 0x2c]
push ecx
mov ecx, edi
call fcn.00568c40
mov edx, dword [esi + 0xabc]
push edx
push str._r_ndownlResult___ld_r_n
lea eax, [ebp + 0x60]
push eax
call fcn.006201db
add esp, 0xc
lea ecx, [ebp + 0x60]
push ecx
mov ecx, edi
call fcn.00568c40
mov eax, dword [esi + 0xabc]
add eax, 0xffff8abe
cmp eax, 0x38
ja case.0x5bcfb6.30019
movzx edx, byte [eax + 0x5bd884]
jmp dword [edx*4 + 0x5bd878]
mov eax, dword [esi + 0x150]
or eax, dword [esi + 0x154]
je case.0x5bcfb6.30019
cmp dword [esi + 8], ebx
jne case.0x5bcfb6.30019
cmp dword [esi + 4], ebx
jne case.0x5bcfb6.30019
cmp byte [ebp + 0xbc], 0
je case.0x5bcfb6.30019
cmp dword [esi + 0x14], ebx
je case.0x5bcfb6.30019
cmp dword [esi + 0x4e8], ebx
je case.0x5bcfb6.30019
cmp byte [esi + 0x195], 0
jne case.0x5bcfb6.30019
cmp byte [ebp - 0x21], 0
jne case.0x5bcfb6.30019
push ebx
mov ecx, esi
call fcn.005b4090
mov ecx, dword [esi + 0x4e8]
push ecx
push 0x1463
push 0x111
mov edx, dword [esi + 0x14]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [esi + 0x35d], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00402570
jmp 0x5bc18c
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x2c], ebx
xor eax, eax
mov word [ebp + 0x28], ax
mov byte [ebp - 4], 0x20
lea ecx, [ebp + 0x24]
push ecx
mov ecx, esi
call fcn.005b5da0
cmp dword [esi + 8], ebx
jne 0x5bd502
cmp dword [esi + 4], ebx
jne 0x5bd502
cmp byte [ebp + 0xbc], 0
je 0x5bd502
cmp dword [esi + 0x4e8], ebx
je 0x5bd502
cmp dword [esi + 0x514], ebx
jne 0x5bd502
mov eax, dword [esi + 0xabc]
cmp eax, 0x7540
je 0x5bd502
cmp eax, 0x7553
jne 0x5bd0f6
mov eax, dword [ebp + 0x24]
cmp eax, ebx
mov ecx, eax
jne 0x5bd0ab
lea ecx, [ebp + 0x28]
mov eax, dword [ebp + 0x54]
cmp eax, ebx
jne 0x5bd0b5
lea eax, [ebp + 0x58]
push 0x10024
push ecx
push eax
push ebx
call fcn.004729e0
add esp, 0x10
cmp eax, 6
jne 0x5bd502
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x5bd502
mov edx, dword [esi + 0x4e8]
push edx
push 0x13bb
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x5bd502
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x38], ebx
xor eax, eax
mov word [ebp + 0x34], ax
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x5bd11f
mov ecx, dword [0x75ad10]
push ecx
push eax
lea ecx, [ebp + 0x30]
call fcn.00401980
jmp 0x5bd132
mov eax, dword [ebp + 0x24]
cmp eax, ebx
jne 0x5bd129
lea eax, [ebp + 0x28]
push eax
lea ecx, [ebp + 0x30]
call fcn.004017f0
cmp dword [esi + 0xabc], 0x80090326
jne 0x5bd1f0
cmp dword [0x75aba4], ebx
jne 0x5bd1f0
xor edi, edi
mov dword [ebp + 0x3c], edi
mov dword [ebp + 0x44], edi
xor edx, edx
mov word [ebp + 0x40], dx
mov bl, 0x22
mov byte [ebp - 4], bl
mov eax, dword [0x75ad10]
push eax
mov ecx, dword [0x75c6a8]
push ecx
lea ecx, [ebp + 0x48]
call fcn.0045e060
mov byte [ebp - 4], 0x23
mov eax, dword [ebp + 0x48]
cmp eax, edi
mov ecx, eax
jne 0x5bd186
lea ecx, [ebp + 0x4c]
mov eax, dword [ebp + 0x54]
cmp eax, edi
jne 0x5bd190
lea eax, [ebp + 0x58]
push edi
push ecx
push eax
push str._s_r_n_r_n_r_n_s
lea ecx, [ebp + 0x3c]
call fcn.00402320
mov eax, dword [ebp + 0x30]
cmp eax, edi
mov ecx, eax
jne 0x5bd1ac
lea ecx, [ebp + 0x34]
mov eax, dword [ebp + 0x3c]
cmp eax, edi
jne 0x5bd1b6
lea eax, [ebp + 0x40]
push 0x50034
push ecx
push eax
push edi
call fcn.004729e0
add esp, 0x10
cmp eax, 6
jne 0x5bd1d9
push str.https:__www.internetdownloadmanager.com_support_xp_https_problems.html
push edi
call fcn.004b3aa0
add esp, 8
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 0x21
lea ecx, [ebp + 0x3c]
jmp 0x5bd4ef
cmp byte [esi + 0x35d], 0
je 0x5bd331
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x50], ebx
xor edx, edx
mov word [ebp + 0x4c], dx
mov byte [ebp - 4], 0x24
mov eax, dword [0x75ad10]
push eax
mov ecx, dword [0x75c604]
push ecx
lea ecx, [ebp + 0x3c]
call fcn.0045e060
mov byte [ebp - 4], 0x25
mov eax, dword [ebp + 0x3c]
cmp eax, ebx
mov ecx, eax
jne 0x5bd232
lea ecx, [ebp + 0x40]
mov eax, dword [ebp + 0x54]
cmp eax, ebx
jne 0x5bd23c
lea eax, [ebp + 0x58]
push ebx
push ecx
push eax
push str._s_r_n_r_n_r_n_s
lea ecx, [ebp + 0x48]
call fcn.00402320
mov eax, dword [ebp + 0x30]
cmp eax, ebx
mov ecx, eax
jne 0x5bd258
lea ecx, [ebp + 0x34]
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jne 0x5bd262
lea eax, [ebp + 0x4c]
push 0x50034
push ecx
push eax
push ebx
call fcn.004729e0
add esp, 0x10
cmp eax, 6
jne 0x5bd320
lea ecx, [ebp - 0x14]
call fcn.00402500
mov bl, 0x26
mov byte [ebp - 4], bl
push 0
lea edx, [ebp - 0x14]
push edx
lea edi, [esi + 0x20]
mov ecx, edi
call fcn.0058fee0
lea ecx, [ebp - 0x18]
call fcn.00402500
mov byte [ebp - 4], 0x27
mov eax, dword [edi]
test eax, eax
mov ecx, eax
jne 0x5bd2b1
mov ecx, 0x676974
cmp byte [esi + 0xaa8], 0
jne 0x5bd2c7
cmp dword [esi + 0x94c], 0
jne 0x5bd2c7
xor eax, eax
jmp 0x5bd2cc
mov eax, 1
push ecx
push eax
xor eax, eax
cmp byte [esi + 0x19b], al
setne al
push eax
mov ecx, dword [esi + 0x1cc]
push ecx
mov edx, dword [esi + 0xabc]
push edx
push str.https:__www.internetdownloadmanager.com_register_new_faq_How_to_configure_Firewalls_for_IDM.html
push str._s_err_ldocr_ldv6_ldproxy_ldsrv_s
lea eax, [ebp - 0x18]
push eax
call fcn.00402f70
mov ecx, dword [ebp - 0x18]
push ecx
push 0
call fcn.004b3aa0
add esp, 0x28
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.00402570
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x14]
call fcn.00402570
mov byte [ebp - 4], 0x24
lea ecx, [ebp + 0x3c]
call fcn.00401210
jmp 0x5bd4e8
mov eax, dword [ebp + 0x54]
cmp eax, ebx
jne 0x5bd33b
lea eax, [ebp + 0x58]
push eax
lea ecx, [ebp + 0x48]
call fcn.00402180
mov bl, 0x28
mov byte [ebp - 4], bl
cmp byte [ebp - 0x1a], 0
je 0x5bd448
cmp byte [ebp - 0x21], 0
je 0x5bd362
mov byte [ebp - 0x1a], 0
jmp 0x5bd448
mov dword [ebp - 0x30], 1
test dword [esi + 0x174], 0x100000
jne 0x5bd448
mov edx, dword [esi + 0x148]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5bd384
sub eax, edi
je 0x5bd448
push 0x5c
push edx
call fcn.0061faa0
add esp, 8
mov edi, eax
test edi, edi
je 0x5bd3a7
inc edi
jmp 0x5bd3ad
mov edi, dword [esi + 0x148]
push 0xb
push str.firefox.exe
push edi
call fcn.00624a3f
add esp, 0xc
test eax, eax
je 0x5bd3fd
push 0xa
push str.chrome.exe
push edi
call fcn.00621d6d
add esp, 0xc
test eax, eax
je 0x5bd3fd
push 0xa
push str.msedge.exe
push edi
call fcn.00621d6d
add esp, 0xc
test eax, eax
je 0x5bd3fd
push 0x13
push str.MicrosoftEdgeCP.exe
push edi
call fcn.00621d6d
add esp, 0xc
test eax, eax
jne 0x5bd448
mov dword [ebp - 0x30], 0
mov edx, dword [0x75ad10]
push edx
mov eax, dword [0x75c70c]
push eax
lea ecx, [ebp + 0x3c]
call fcn.0045e060
mov byte [ebp - 4], 0x29
push str._r_n_r_n
lea ecx, [ebp + 0x48]
call fcn.00405300
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5bd434
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x48]
call fcn.00405300
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x3c]
call fcn.00401210
mov eax, dword [esi + 0xabc]
cmp eax, 0xffffffff
je 0x5bd45f
cmp eax, 0x753b
mov eax, 0x30
jne 0x5bd464
mov eax, 0x10
mov edx, dword [ebp + 0x30]
test edx, edx
jne 0x5bd46e
lea edx, [ebp + 0x34]
mov ecx, dword [ebp + 0x48]
test ecx, ecx
jne 0x5bd478
lea ecx, [ebp + 0x4c]
or eax, 0x50000
push eax
push edx
push ecx
push 0
call fcn.004729e0
add esp, 0x10
cmp byte [ebp - 0x1a], 0
je 0x5bd4d4
cmp byte [esi + 0x36b], 0
je 0x5bd4b9
cmp dword [esi + 0x49c], 0
jne 0x5bd4b1
mov ecx, dword [esi + 0x4e8]
push ecx
lea ecx, [esi + 0x20]
call fcn.005cc020
lea ecx, [esi + 0x20]
call fcn.005cf240
mov edx, dword [esi + 0x4e8]
push edx
push 0x14cd
push 0x111
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [esi + 0xabc], 0x757a
jne 0x5bd4e8
lea ecx, [esi + 0x20]
call fcn.005ca690
mov byte [ebp - 4], 0x21
lea ecx, [ebp + 0x48]
call fcn.00401210
mov byte [ebp - 4], 0x20
lea ecx, [ebp + 0x30]
call fcn.00401210
xor ebx, ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x5bd664
cmp eax, 3
jne 0x5bd522
cmp dword [esi + 0xabc], 0x756e
je 0x5bd5ca
cmp byte [ebp + 0xbc], 0
je 0x5bd5ca
cmp dword [esi + 0xabc], 0xffffffff
jne 0x5bd55f
push 0x50010
push 0x675d88
mov ecx, dword [0x75bbd8]
push ecx
push ebx
call fcn.00472580
add esp, 0x10
push ebx
mov ecx, esi
call fcn.005b4090
jmp 0x5bd66b
push 0x675d88
lea ecx, [ebp + 0x48]
call fcn.00406f80
mov byte [ebp - 4], 0x2a
mov eax, dword [esi + 0xabc]
cmp eax, 0xffffffff
je 0x5bd587
cmp eax, 0x753b
mov eax, 0x30
jne 0x5bd58c
mov eax, 0x10
mov edx, dword [ebp + 0x48]
cmp edx, ebx
jne 0x5bd596
lea edx, [ebp + 0x4c]
mov ecx, dword [ebp + 0x54]
cmp ecx, ebx
jne 0x5bd5a0
lea ecx, [ebp + 0x58]
or eax, 0x50000
push eax
push edx
push ecx
push ebx
call fcn.004729e0
add esp, 0x10
mov byte [ebp - 4], 0x20
lea ecx, [ebp + 0x48]
call fcn.00401210
push ebx
mov ecx, esi
call fcn.005b4090
jmp 0x5bd66b
cmp eax, 4
jne 0x5bd65a
cmp byte [esi + 0x35d], 0
je 0x5bd65a
mov byte [esi + 0x35d], 0
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push str.bHDIShwd
mov ecx, dword [0x75abd8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x5bd65a
mov dword [ebp - 0x18], 1
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push ebx
push str.bHDIShwd
mov eax, dword [0x75abd8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.00411520
push eax
lea ecx, [ebp - 0xc8]
call fcn.0052b840
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xc8]
call fcn.005f3511
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xc8]
call fcn.0052b8c0
push ebx
mov ecx, esi
call fcn.005b4090
jmp 0x5bd66b
mov byte [esi + 0x35d], 0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp + 0x24]
call fcn.00401210
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00402570
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x54]
call fcn.00401210
mov dword [ebp - 4], 0xffffffff
jmp 0x5bc198