Function at 0x4b33f0
Capabilities:
Check for software breakpoints
Contain obfuscated stackstrings
Get number of processors
Get process heap flags
Get process heap force flags
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x54d00a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, dword [0x5ab980]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], eax
xor ebx, ebx
push 0xffffb163
push str.LoadFSettings
mov dword [esp + 0x54], ebx
call fcn.004227e0
add esp, 8
lea esi, [edi + 0x60]
mov ecx, esi
push 1
call fcn.004b0e90
mov ecx, edi
call fcn.004b5990
mov ecx, 0x5bc7a4
call fcn.004e68e0
mov ecx, 0x5bc7a4
call fcn.004ea380
mov ecx, 0x5bc7a4
call fcn.004e6970
push 0xffffb168
push str.LoadFSettings
call fcn.004227e0
add esp, 8
lea ecx, [esp + 0x28]
push str.Desktop
call fcn.00512952
push str.ROOT
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 1
call fcn.00512952
push str.ROOT.DESKTOP
lea ecx, [esp + 0x20]
mov byte [esp + 0x50], 2
call fcn.00512952
push ebx
push 1
lea ecx, [esp + 0x30]
push 0x15604
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x64], 3
call fcn.004b1080
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], eax
mov byte [esp + 0x4c], 2
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 1
call fcn.005128e4
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Wallpaper__shortcuts__screensaver...
lea ecx, [esp + 0x2c]
call fcn.00512952
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 4
push ecx
mov ecx, dword [esp + 0x14]
call fcn.004b0490
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Desktop_Files_and_Shortcuts
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT.DESKTOP
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 5
call fcn.00512952
push str.Settings.Desktop.Files
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 6
call fcn.00512952
push 0x66
push 1
lea edx, [esp + 0x24]
push 9
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 7
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 6
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 5
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Start_Menu
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT.DESKTOP
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 8
call fcn.00512952
push str.Settings.Desktop.StartMenu
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 9
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push 0xc
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0xa
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 9
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 8
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Quick_Launch
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT.DESKTOP
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0xb
call fcn.00512952
push str.Settings.Desktop.QuickLaunch
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0xc
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push 7
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0xd
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0xc
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0xb
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Background_Wallpaper
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT.DESKTOP
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0xe
call fcn.00512952
push str.Settings.Desktop.WallPaper
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0xf
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push 0x3f
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x10
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0xf
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0xe
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Screen_Saver
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT.DESKTOP
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x11
call fcn.00512952
push str.Settings.Desktop.ScreenSaver
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x12
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push 0x3e
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov byte [esp + 0x64], 0x13
mov ecx, esi
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x12
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x11
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Appearance
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT.DESKTOP
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x14
call fcn.00512952
push str.Settings.Desktop.Appearance
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x15
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push 0x3c
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x16
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x15
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x14
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Effects
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT.DESKTOP
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x17
call fcn.00512952
push str.Settings.Desktop.Effects
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x18
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push ebx
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x19
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x18
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x17
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.My_Documents
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x1a
call fcn.00512952
push str.ROOT.MYDOCS
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x1b
call fcn.00512952
push ebx
push 1
lea edx, [esp + 0x24]
push 0x15609
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x1c
call fcn.004b1080
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], eax
mov byte [esp + 0x4c], 0x1b
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x1a
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.All_files_contained_within_your__My_Documents__folder
lea ecx, [esp + 0x2c]
call fcn.00512952
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x50], 0x1d
call fcn.004b0490
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], bl
call fcn.005128e4
mov eax, dword [0x5b8cb0]
lea edx, [esp + 0x20]
mov ecx, dword [eax + 0xfc]
push ecx
push str._My_Documents__Folder_for__s
push edx
call fcn.0050e6c7
add esp, 0xc
lea ecx, [esp + 0x24]
push str.ROOT.MYDOCS
call fcn.00512952
push str.Files.MyDocs.CU
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x1e
call fcn.00512952
push 0x66
push 1
lea eax, [esp + 0x28]
push 0x15605
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x64], 0x1f
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x1e
call fcn.005128e4
mov byte [esp + 0x4c], bl
lea ecx, [esp + 0x24]
call fcn.005128e4
push str.Windows_Settings
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x20
call fcn.00512952
push str.ROOT.WINSETTINGS
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x21
call fcn.00512952
push ebx
push 1
lea eax, [esp + 0x24]
push 0x1560c
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x64], 0x22
call fcn.004b1080
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], eax
mov byte [esp + 0x4c], 0x21
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x20
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Accessibility__display__printer_Settings...
lea ecx, [esp + 0x2c]
call fcn.00512952
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x50], 0x23
call fcn.004b0490
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Accessibility_Options
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT.WINSETTINGS
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x24
call fcn.00512952
push str.Settings.Windows.AccessOptions
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x25
call fcn.00512952
push 0x64
push 1
lea ecx, [esp + 0x24]
push 0x20
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x64], 0x26
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x25
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x24
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Folder_Options
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT.WINSETTINGS
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x27
call fcn.00512952
push str.Settings.Windows.Folder
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x28
call fcn.00512952
push ebx
push 1
lea ecx, [esp + 0x24]
push 0x27
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x64], 0x29
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x28
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x27
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.General_or_Folder_tab
lea ecx, [esp + 0x20]
call fcn.00512952
push str.Settings.Windows.Folder
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x2a
call fcn.00512952
push str.Settings.Windows.Folder.Gen
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x2b
call fcn.00512952
push 0x64
push 1
lea ecx, [esp + 0x24]
push 0xa
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x64], 0x2c
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x2b
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x2a
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.View_tab
lea ecx, [esp + 0x20]
call fcn.00512952
push str.Settings.Windows.Folder
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x2d
call fcn.00512952
push str.Settings.Windows.Folder.View
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x2e
call fcn.00512952
push 0x64
push 1
lea ecx, [esp + 0x24]
push ebx
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x64], 0x2f
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x2e
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x2d
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Mouse
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT.WINSETTINGS
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x30
call fcn.00512952
push str.Settings.Windows.Mouse
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x31
call fcn.00512952
push 0x64
push 1
lea ecx, [esp + 0x24]
push 0x2d
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x64], 0x32
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x31
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x30
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.ODBC_Data_Sources__32bit_
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT.WINSETTINGS
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x33
call fcn.00512952
push str.Settings.Windows.ODBC
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x34
call fcn.00512952
push 0x64
push 1
mov byte [esp + 0x54], 0x35
push 0x39
lea ecx, [esp + 0x28]
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, esi
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x34
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x33
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Sounds
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT.WINSETTINGS
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x36
call fcn.00512952
push str.Settings.Windows.Sound
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x37
call fcn.00512952
push ebx
push 1
lea ecx, [esp + 0x24]
push 0x35
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x64], 0x38
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x37
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x36
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Sound_Event
lea ecx, [esp + 0x20]
call fcn.00512952
push str.Settings.Windows.Sound
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x39
call fcn.00512952
push str.Settings.Windows.Sound.Events
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x3a
call fcn.00512952
push 0x64
push 1
lea ecx, [esp + 0x24]
push 0x35
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x64], 0x3b
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x3a
call fcn.005128e4
mov byte [esp + 0x4c], 0x39
lea ecx, [esp + 0x24]
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Printer_Settings
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT.WINSETTINGS
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x3c
call fcn.00512952
push str.Settings.Windows.Printers
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x3d
call fcn.00512952
push 0x64
push 1
lea ecx, [esp + 0x24]
push 6
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x64], 0x3e
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x3d
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x3c
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Internet_and_E_mail
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x3f
call fcn.00512952
push str.INET
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x40
call fcn.00512952
push ebx
push 1
lea ecx, [esp + 0x24]
push 0x15607
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x64], 0x41
call fcn.004b1080
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], eax
mov byte [esp + 0x4c], 0x40
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x3f
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Email__Internet_favorites__dial_up_settings...
lea ecx, [esp + 0x2c]
call fcn.00512952
mov byte [esp + 0x4c], 0x42
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x14]
call fcn.004b0490
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Windows_Internet_Settings
lea ecx, [esp + 0x20]
call fcn.00512952
push str.INET
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x43
call fcn.00512952
push str.INETWIN
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x44
call fcn.00512952
push ebx
push 1
lea edx, [esp + 0x24]
push 4
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x45
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x44
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x43
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Dial_up_Networking
lea ecx, [esp + 0x20]
call fcn.00512952
push str.INETWIN
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x46
call fcn.00512952
push str.DUNET
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x47
call fcn.00512952
push ebx
push 1
lea edx, [esp + 0x24]
push 0x2f
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x48
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x47
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x46
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Settings
lea ecx, [esp + 0x20]
call fcn.00512952
push str.DUNET
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x49
call fcn.00512952
push str.Settings.Network.Dialup
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x4a
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push 0x1560c
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x4b
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x4a
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x49
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Email
lea ecx, [esp + 0x20]
call fcn.00512952
push str.INET
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x4c
call fcn.00512952
push str.INET.EMAIL
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x4d
call fcn.00512952
push ebx
push 1
lea edx, [esp + 0x24]
push 0x2c
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x4e
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x4d
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x4c
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Outlook_Express
lea ecx, [esp + 0x20]
call fcn.00512952
push str.INET.EMAIL
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x4f
call fcn.00512952
push str.msimn.exe
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x50
call fcn.00512952
mov byte [esp + 0x4c], 0x51
push 0xc8
push 1
lea edx, [esp + 0x24]
push 0x11
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x50
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x4f
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Mail_Accounts
lea ecx, [esp + 0x20]
call fcn.00512952
push str.msimn.exe
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x52
call fcn.00512952
push str.settings.msimn
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x53
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push ebx
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x54
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x53
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x52
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Microsoft_Outlook
lea ecx, [esp + 0x20]
call fcn.00512952
push str.INET.EMAIL
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x55
call fcn.00512952
push str.outlook.exe
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x56
call fcn.00512952
push 0xc8
push 1
lea edx, [esp + 0x24]
push 0x44
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x57
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x56
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x55
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Mail_Accounts
lea ecx, [esp + 0x20]
call fcn.00512952
push str.outlook.exe
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x58
call fcn.00512952
push str.settings.outlook
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x59
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push ebx
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x5a
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x59
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x58
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Netscape_Messenger
lea ecx, [esp + 0x20]
call fcn.00512952
push str.INET.EMAIL
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x5b
call fcn.00512952
push str._netscape.mail.exe
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x5c
call fcn.00512952
push 0xc8
push 1
lea edx, [esp + 0x24]
push 0x12
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x5d
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x5c
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x5b
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Settings__Profiles__Mail_Accounts__Bookmarks_
lea ecx, [esp + 0x20]
call fcn.00512952
push str._netscape.mail.exe
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x5e
call fcn.00512952
push str.Settings.email.ns
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x5f
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push ebx
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x60
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x5f
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x5e
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push 0x5a5268
lea ecx, [esp + 0x20]
call fcn.00512952
push str.INET
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x61
call fcn.00512952
push str.INET.WEB
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x62
call fcn.00512952
push ebx
push 1
lea edx, [esp + 0x24]
push 0x3d
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x63
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x62
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x61
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Internet_Explorer
lea ecx, [esp + 0x20]
call fcn.00512952
push str.INET.WEB
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x64
call fcn.00512952
push str.iexplore.exe
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x65
call fcn.00512952
push 0xc8
push 1
lea edx, [esp + 0x24]
push 0x10
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x66
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x65
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x64
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Internet_Explorer_Favorites
lea ecx, [esp + 0x20]
call fcn.00512952
push str.iexplore.exe
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x67
call fcn.00512952
push str.Settings.Browser.IE.Favorites
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x68
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push 0x13
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x69
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x68
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x67
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.User_History__pages_visited_
lea ecx, [esp + 0x20]
call fcn.00512952
push str.iexplore.exe
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x6a
call fcn.00512952
push str.Settings.Browser.IE.History
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x6b
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push 0x10
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
mov byte [esp + 0x60], 0x6c
push ecx
mov ecx, esi
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x6b
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x6a
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.User_Cookies
lea ecx, [esp + 0x20]
call fcn.00512952
push str.iexplore.exe
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x6d
call fcn.00512952
push str.Settings.Browser.IE.Cookies
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x6e
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push 0x10
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x6f
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x6e
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x6d
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.User_Temporary_Internet_Files
lea ecx, [esp + 0x20]
call fcn.00512952
push str.iexplore.exe
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x70
call fcn.00512952
push str.Settings.Browser.IE.Cache
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x71
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push 0x10
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x72
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x71
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x70
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Internet_Options
lea ecx, [esp + 0x20]
call fcn.00512952
push str.iexplore.exe
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x73
call fcn.00512952
push str.Settings.iexplore
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x74
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push 0x2a
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x75
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x74
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x73
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Netscape_Navigator
lea ecx, [esp + 0x20]
call fcn.00512952
push str.INET.WEB
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x76
call fcn.00512952
push str._netscape.comm.exe
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x77
call fcn.00512952
push 0xc8
push 1
lea edx, [esp + 0x24]
push 0x12
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x78
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x77
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x76
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Settings__Profiles__Mail_Accounts__Bookmarks_
lea ecx, [esp + 0x20]
call fcn.00512952
push str._netscape.comm.exe
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x79
call fcn.00512952
mov byte [esp + 0x4c], 0x7a
push str.Settings.Browser.NS.BookMarks
lea ecx, [esp + 0x2c]
call fcn.00512952
push 0x64
push 1
lea edx, [esp + 0x24]
push 0x12
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x7b
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x7a
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x79
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Internet
lea ecx, [esp + 0x20]
call fcn.00512952
push str.INET
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x7c
call fcn.00512952
push str.INET.OTHER
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x7d
call fcn.00512952
push ebx
push 1
lea edx, [esp + 0x24]
push 0x3d
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0x7e
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x7d
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x7c
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Office_and_Productivity
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x7f
call fcn.00512952
push str.OFFICEPROD
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x80
call fcn.00512952
push ebx
push 1
lea edx, [esp + 0x24]
push 0x1560a
lea eax, [esp + 0x30]
push edx
mov byte [esp + 0x5c], 0x81
push eax
lea ecx, [esp + 0x3c]
push ecx
mov ecx, esi
call fcn.004b1080
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], eax
mov byte [esp + 0x4c], 0x80
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x7f
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Word_processing__spreadsheets__presentations...
lea ecx, [esp + 0x2c]
call fcn.00512952
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x50], 0x82
call fcn.004b0490
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str._Microsoft_Office_
lea ecx, [esp + 0x20]
call fcn.00512952
push str.OFFICEPROD
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x83
call fcn.00512952
push str.OFFICEPROD.MSO_2000
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x84
call fcn.00512952
push ebx
push 1
lea eax, [esp + 0x24]
push 0x40
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x64], 0x85
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x84
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x83
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str._Corel_WordPerfect_Office_
lea ecx, [esp + 0x20]
call fcn.00512952
push str.OFFICEPROD
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x86
call fcn.00512952
push str.OFFICEPROD.COREL_WPO
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x87
call fcn.00512952
push ebx
push 1
lea eax, [esp + 0x24]
push 0x4e
mov byte [esp + 0x58], 0x88
push eax
lea ecx, [esp + 0x34]
lea edx, [esp + 0x38]
push ecx
push edx
mov ecx, esi
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x87
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x86
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str._Lotus_SmartSuite_
lea ecx, [esp + 0x20]
call fcn.00512952
push str.OFFICEPROD
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x89
call fcn.00512952
push str.OFFICEPROD.LOTUS_STE
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x8a
call fcn.00512952
push ebx
push 1
lea eax, [esp + 0x24]
push 0x4f
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x64], 0x8b
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x8a
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x89
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Music__Pictures__Video
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x8c
call fcn.00512952
push str.MULTIMEDIA
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x8d
call fcn.00512952
push ebx
push 1
lea eax, [esp + 0x24]
push 0x15608
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x64], 0x8e
call fcn.004b1080
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], eax
mov byte [esp + 0x4c], 0x8d
call fcn.005128e4
mov byte [esp + 0x4c], 0x8c
lea ecx, [esp + 0x24]
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Multimedia_programs_and_files
lea ecx, [esp + 0x2c]
call fcn.00512952
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x50], 0x8f
call fcn.004b0490
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Finance
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x90
call fcn.00512952
push str.FINANCE
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x91
call fcn.00512952
push ebx
push 1
lea ecx, [esp + 0x24]
push 0x15606
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x64], 0x92
call fcn.004b1080
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], eax
mov byte [esp + 0x4c], 0x91
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x90
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Accounting__tax__and_personal_finance...
lea ecx, [esp + 0x2c]
call fcn.00512952
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x93
push ecx
mov ecx, dword [esp + 0x14]
call fcn.004b0490
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Other_Programs_and_Data
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x94
call fcn.00512952
push str.OTHER
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x95
call fcn.00512952
mov byte [esp + 0x4c], 0x96
push ebx
push 1
lea edx, [esp + 0x24]
push 0x1560b
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
call fcn.004b1080
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], eax
mov byte [esp + 0x4c], 0x95
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x94
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Other_recognized_programs__files__and_settings...
lea ecx, [esp + 0x2c]
call fcn.00512952
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x50], 0x97
call fcn.004b0490
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str._Known_File_Types_
lea ecx, [esp + 0x20]
call fcn.00512952
push str.OTHER
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x98
call fcn.00512952
push str.Files.Other
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x99
call fcn.00512952
push 0x65
push 1
lea eax, [esp + 0x24]
push 0x15605
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x64], 0x9a
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x99
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x98
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.System
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x9b
call fcn.00512952
push str.OTHER.WINOS
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0x9c
call fcn.00512952
push ebx
push 1
lea eax, [esp + 0x24]
push 0x1560d
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x64], 0x9d
call fcn.004b1080
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], eax
mov byte [esp + 0x4c], 0x9c
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x9b
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Including_certain_protected_and_hidden_files...
lea ecx, [esp + 0x2c]
call fcn.00512952
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x50], 0x9e
call fcn.004b0490
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Unclassified
lea ecx, [esp + 0x20]
call fcn.00512952
push str.ROOT
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0x9f
call fcn.00512952
push str.OTHER.NR
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0xa0
call fcn.00512952
push ebx
push 1
lea ecx, [esp + 0x24]
push 0x14e62
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x64], 0xa1
call fcn.004b1080
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], eax
mov byte [esp + 0x4c], 0xa0
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x9f
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.Items_not_associated_with_any_programs...
lea ecx, [esp + 0x2c]
call fcn.00512952
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0xa2
push ecx
mov ecx, dword [esp + 0x14]
call fcn.004b0490
mov byte [esp + 0x4c], bl
lea ecx, [esp + 0x28]
call fcn.005128e4
push str.___Missing_Programs_
lea ecx, [esp + 0x20]
call fcn.00512952
push str.OTHER.NR
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0xa3
call fcn.00512952
push str.OTHER.MISSING
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0xa4
call fcn.00512952
push ebx
push 1
lea edx, [esp + 0x24]
push 0x1560b
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0xa5
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0xa4
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0xa3
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push str.___Unregistered_File_Types_
lea ecx, [esp + 0x20]
call fcn.00512952
push str.OTHER.NR
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 0xa6
call fcn.00512952
push str.Files.Other.NR
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0xa7
call fcn.00512952
push ebx
push 1
lea edx, [esp + 0x24]
push 0x15605
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x64], 0xa8
call fcn.004b1080
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0xa7
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0xa6
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], bl
call fcn.005128e4
push ebx
push str.INITSTATE.OTHER.WINOS
mov ecx, 0x5bc868
call fcn.0046b110
push ebx
push str.INITSTATE.OTHER.NR
mov ecx, 0x5bc868
call fcn.0046b110
push ebx
push str.INITSTATE.Settings.Windows.Printers
mov ecx, 0x5bc868
call fcn.0046b110
push ebx
push str.INITSTATE.Settings.Browser.IE.Cache
mov ecx, 0x5bc868
call fcn.0046b110
push str.Core.LoadSettings
lea ecx, [esp + 0x28]
call fcn.00512952
push str.CORE_RSL
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0xa9
call fcn.00512952
lea edx, [esp + 0x24]
lea eax, [esp + 0x28]
push edx
push eax
mov ecx, 0x5bc868
mov byte [esp + 0x54], 0xaa
call fcn.0046aa90
mov ebp, eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x38], ebp
mov byte [esp + 0x4c], 0xa9
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], bl
call fcn.005128e4
cmp ebp, ebx
jg 0x4b514b
push 0xffffb167
push str.Core.LoadSettings_CORE_RSL
call fcn.004227e0
add esp, 8
mov ecx, edi
call fcn.004b3360
mov ecx, edi
call fcn.004b2e90
mov ecx, dword [0x5ab980]
mov dword [esp + 0x18], ecx
mov eax, dword [edi + 0x6c]
mov byte [esp + 0x4c], 0xab
neg eax
sbb eax, eax
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x4b52fa
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.005125ee
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
je 0x4b52f0
mov eax, dword [0x5bc5c0]
xor edx, edx
test al, 0x80
jne 0x4b51b5
cmp dword [ecx], 0xcc
jne 0x4b51b5
mov edx, 1
test ah, 1
jne 0x4b51c6
mov eax, dword [ecx]
sub eax, 0x64
je 0x4b51ce
sub eax, 0x67
je 0x4b51ce
cmp edx, ebx
je 0x4b52f0
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.00512659
mov ecx, esi
call fcn.004b65d0
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov dword [esp + 0x34], eax
je 0x4b52f0
lea ebp, [eax + 0x8c]
mov dword [esp + 0x3c], ebp
mov dword [ebp], method.CCommandLineInfo.virtual_0
mov eax, dword [ebp + 4]
mov byte [esp + 0x4c], 0xb2
cmp eax, ebx
je 0x4b525d
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp eax, ebx
mov dword [esp + 0x2c], ecx
jbe 0x4b525d
mov eax, dword [ebp + 4]
mov eax, dword [eax + ecx*4]
cmp eax, ebx
mov dword [esp + 0x1c], eax
je 0x4b5251
jmp 0x4b5234
mov eax, dword [esp + 0x1c]
add eax, 8
push 1
push eax
call fcn.0050e92f
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
cmp eax, ebx
mov dword [esp + 0x1c], eax
jne 0x4b5230
mov ecx, dword [esp + 0x2c]
mov eax, dword [ebp + 8]
inc ecx
cmp ecx, eax
mov dword [esp + 0x2c], ecx
jb 0x4b5220
mov eax, dword [ebp + 4]
push eax
call fcn.00516a3e
mov ecx, dword [ebp + 0x14]
add esp, 4
mov dword [ebp + 4], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], ebx
call fcn.005115f0
mov dword [ebp + 0x14], ebx
mov ebp, dword [esp + 0x34]
lea eax, [ebp + 0x40]
mov dword [esp + 0x2c], eax
lea ecx, [eax + 0x2c]
mov byte [esp + 0x4c], 0xb3
call fcn.00510e5f
mov edx, dword [esp + 0x2c]
mov byte [esp + 0x4c], 0xb0
lea ecx, [edx + 0x10]
call fcn.00510e5f
lea ecx, [ebp + 0x20]
mov byte [esp + 0x4c], 0xaf
call fcn.005114b2
lea ecx, [ebp + 0x10]
mov byte [esp + 0x4c], 0xae
call fcn.005128e4
lea ecx, [ebp + 0xc]
mov byte [esp + 0x4c], 0xad
call fcn.005128e4
lea ecx, [ebp + 8]
mov byte [esp + 0x4c], 0xac
call fcn.005128e4
lea ecx, [ebp + 4]
mov byte [esp + 0x4c], 0xab
call fcn.005128e4
push ebp
call fcn.00516a3e
add esp, 4
cmp dword [esp + 0x14], ebx
jne 0x4b517b
mov eax, dword [edi + 0x6c]
neg eax
sbb eax, eax
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x4b5378
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, esi
call fcn.005125ee
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4b5372
lea ecx, [esp + 0x30]
add eax, 8
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.00512659
mov ecx, esi
call fcn.004b64f0
cmp eax, ebx
je 0x4b5372
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x4b5372
mov edx, dword [esp + 0x10]
push ebx
push edx
lea ecx, [eax + 0x20]
call fcn.00510d6c
test eax, eax
jne 0x4b5372
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
push edx
lea ecx, [eax + 0x20]
call fcn.0051154c
cmp dword [esp + 0x14], ebx
jne 0x4b5309
lea ebp, [edi + 0x7c]
mov ecx, esi
push ebp
mov dword [esp + 0x38], ebp
call fcn.004b6690
mov ecx, esi
call fcn.004b1530
mov edi, dword [edi + 0x80]
mov eax, edi
cmp edi, ebx
mov dword [esp + 0x14], eax
je 0x4b54f8
jmp 0x4b53a8
mov ebp, dword [esp + 0x34]
mov edi, eax
mov ecx, eax
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov ecx, dword [ecx + 8]
cmp ecx, ebx
mov dword [esp + 0x10], ecx
je 0x4b54f0
cmp dword [ecx + 0x2c], ebx
jne 0x4b54f0
push ecx
lea eax, [ecx + 4]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.00512659
mov ecx, esi
call fcn.004b65d0
push edi
mov ecx, ebp
call fcn.00511599
mov edi, dword [esp + 0x10]
mov ebp, edi
cmp edi, ebx
mov dword [esp + 0x3c], ebp
je 0x4b54ec
add edi, 0x8c
mov dword [esp + 0x40], edi
mov dword [edi], method.CCommandLineInfo.virtual_0
mov eax, dword [edi + 4]
mov byte [esp + 0x4c], 0xba
cmp eax, ebx
je 0x4b5461
mov eax, dword [edi + 8]
xor ecx, ecx
cmp eax, ebx
mov dword [esp + 0x2c], ecx
jbe 0x4b5461
mov edx, dword [edi + 4]
mov eax, dword [edx + ecx*4]
cmp eax, ebx
mov dword [esp + 0x1c], eax
je 0x4b5455
jmp 0x4b5438
mov eax, dword [esp + 0x1c]
add eax, 8
push 1
push eax
call fcn.0050e92f
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
cmp eax, ebx
mov dword [esp + 0x1c], eax
jne 0x4b5434
mov ecx, dword [esp + 0x2c]
mov eax, dword [edi + 8]
inc ecx
cmp ecx, eax
mov dword [esp + 0x2c], ecx
jb 0x4b5424
mov eax, dword [edi + 4]
push eax
call fcn.00516a3e
mov ecx, dword [edi + 0x14]
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
call fcn.005115f0
mov dword [edi + 0x14], ebx
lea edi, [ebp + 0x40]
mov dword [esp + 0x40], edi
lea ecx, [edi + 0x2c]
mov byte [esp + 0x4c], 0xbb
call fcn.00510e5f
lea ecx, [edi + 0x10]
mov byte [esp + 0x4c], 0xb8
call fcn.00510e5f
lea ecx, [ebp + 0x20]
mov byte [esp + 0x4c], 0xb7
call fcn.005114b2
lea ecx, [ebp + 0x10]
mov byte [esp + 0x4c], 0xb6
call fcn.005128e4
lea ecx, [ebp + 0xc]
mov byte [esp + 0x4c], 0xb5
call fcn.005128e4
lea ecx, [ebp + 8]
mov byte [esp + 0x4c], 0xb4
call fcn.005128e4
lea ecx, [ebp + 4]
mov byte [esp + 0x4c], 0xab
call fcn.005128e4
push ebp
call fcn.00516a3e
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, ebx
jne 0x4b53a4
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c], bl
call fcn.005128e4
lea ecx, [esp + 0x20]
mov dword [esp + 0x4c], 0xffffffff
call fcn.005128e4
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x38]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x40
ret