Function at 0x4b1460
Capabilities:
Create thread
Get graphical window text

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f21f5
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3d8
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x3d8], edi
mov eax, dword [edi + 0x14e4]
mov dword [ebp - 0xc4], eax
test eax, eax
je 0x4b386c
push 0
mov ecx, eax
call fcn.005c5730
push 0x270
mov esi, eax
lea eax, [ebp - 0x390]
push 0
push eax
call fcn.00420090
add esp, 8
lea eax, [edi + 0x14a8]
lea ecx, [ebp - 0x390]
push esi
push 0xffffffffffffffff
push 0xc80000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1f4
push 0x258
push str.Execute_Prevent
push str.UVK_DLG_CLASS
push eax
call fcn.005c6220
push 0
push 0
lea ecx, [ebp - 0x390]
mov dword [ebp - 4], 0
call fcn.005c5730
mov edx, esi
mov ecx, eax
call fcn.005d3010
push 0
lea ecx, [ebp - 0x390]
call fcn.005c5730
mov ecx, dword [ebp - 0xc4]
push eax
call fcn.005c6150
movsd xmm1, qword [0x6edaf8]
lea ecx, [ebp - 0x390]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0x400
lea ecx, [ebp - 0x390]
call fcn.005c4340
sub esp, 8
push 0x1c2
push 0x258
push 0
push 0
call fcn.005bfc70
push 0
push 0
push 0x1331
mov esi, eax
lea ecx, [ebp - 0x390]
push 0xffffffffffffffff
mov dword [ebp - 0x3e4], esi
call fcn.005befd0
push 0
lea ecx, [ebp - 0x390]
call fcn.005c4340
push str.Execute_Prevent_settings
push 0
push esi
call fcn.005bfb00
push 0x12
push 0x12
push 0
push 0
push 0
push 0x77
mov ecx, edi
call fcn.00436420
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x390]
call fcn.005be310
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x28
push 0x244
push 0xa
push 0xa
push str.Execute_Prevent_helps_you_to_prevent_malware_execution_by_disallowing_running_files_in_specific_directories__and_optionally_their_sub_directories._Please_select_an_option_below.
lea ecx, [ebp - 0x390]
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0x78
push 0x3c
push 0x14
push str.Main_settings:
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x48], eax
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0xfa
push 0xc8
push 0x14
push str.Additional_directories__recommended_:
lea ecx, [ebp - 0x390]
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0x96
push 0x109
push 0x14
push str.Excluded_paths:
lea ecx, [ebp - 0x390]
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0x96
push 0x163
push 0x14
push str.Additional_options:
lea ecx, [ebp - 0x390]
call fcn.005c0890
movsd xmm1, qword [0x6edaf8]
lea ecx, [ebp - 0x390]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
sub esp, 8
lea ecx, [ebp - 0x390]
push 0x14
push 0xfa
push 0x55
push 0x1e
push str.Disable_Execute_Prevent
call fcn.005bfec0
sub esp, 8
mov dword [ebp - 0xb8], eax
lea ecx, [ebp - 0x390]
push 0x14
push 0x230
push 0x6e
push 0x1e
push str.Enable_Execute_Prevent_only_for_the_items_you_specify_in_the_Locked_and_Excluded_items_lists
call fcn.005bfec0
sub esp, 8
mov dword [ebp - 0xb4], eax
lea ecx, [ebp - 0x390]
push 0x14
push 0x1f4
push 0x87
push 0x1e
push str.Enable_Execute_Prevent_for_the_Application_data_folders__except_exclusions_
call fcn.005bfec0
mov dword [ebp - 0xb0], eax
sub esp, 8
lea ecx, [ebp - 0x390]
push 0x14
push 0x1f4
push 0xa0
push 0x1e
push str.Enable_Execute_Prevent_for_the_whole_user_profile__except_exclusions_
call fcn.005bfec0
sub esp, 8
mov dword [ebp - 0xac], eax
lea ecx, [ebp - 0x390]
push 0x14
push 0x64
push 0xe1
push 0x1e
push str.Fonts_folder
call fcn.005c19a0
sub esp, 8
mov dword [ebp - 0xa8], eax
lea ecx, [ebp - 0x390]
push 0x14
push 0x8c
push 0xe1
push 0x91
push str.Recycle_bin_folder
call fcn.005c19a0
sub esp, 8
mov dword [ebp - 0xa4], eax
lea ecx, [ebp - 0x390]
push 0x14
push 0xaa
push 0xe1
push 0x122
push str.Common_Application_data
call fcn.005c19a0
sub esp, 8
mov dword [ebp - 0xa0], eax
lea ecx, [ebp - 0x390]
push 0x14
push 0x64
push 0xe1
push 0x1e0
push str.Public_profile
call fcn.005c19a0
sub esp, 8
mov dword [ebp - 0x9c], eax
lea ecx, [ebp - 0x390]
push 0x14
push 0x96
push 0x122
push 0x1e
push str.Desktop_folders
call fcn.005c19a0
sub esp, 8
mov dword [ebp - 0x98], eax
lea ecx, [ebp - 0x390]
push 0x14
push 0xa0
push 0x122
push 0xe6
push str.Downloads_folder
call fcn.005c19a0
sub esp, 8
mov dword [ebp - 0x94], eax
lea ecx, [ebp - 0x390]
push 0x14
push 0xa0
push 0x122
push 0x1ae
push str.Documents_folder
call fcn.005c19a0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0x21c
push 0x13b
push 0x1e
push str.Temporary_folders_and_system_related_paths_are_automatically_excluded.
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x8c], eax
call fcn.005c0890
movsd xmm1, qword [0x6edaf8]
lea ecx, [ebp - 0x390]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
sub esp, 8
lea ecx, [ebp - 0x390]
push 0x14
push 0x12c
push 0x17c
push 0x1e
push str.Enable_Execute_Prevent_for_all_users
call fcn.005c19a0
push 0x186a0
push ecx
push str.Select_this_option_if_you_wish_to_enable_the_selected_preset_for_all_users.
push 0xffffffffffffffff
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x90], eax
call fcn.005bcaf0
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x78
push 0x179
push 0x1c2
push str.List_affected_files
lea ecx, [ebp - 0x390]
call fcn.005c1a50
push str.Locked_items_list
push 1
push esi
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x4c], eax
call fcn.005bfb00
push 0x12
push 0x12
push 0
push 0
push 0
push 0x73
mov ecx, edi
call fcn.00436420
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x390]
call fcn.005be310
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x28
push 0x244
push 0xa
push 0xa
push str.The_list_below_contains_the_disallowed_paths._These_paths_may_have_wild_cards._You_can_add_more_paths_to_the_list_and_edit_your_custom_paths.
lea ecx, [ebp - 0x390]
call fcn.005c0890
movsd xmm1, qword [0x6edaf8]
lea ecx, [ebp - 0x390]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0x10021
push 0x1080001d
push 0x14a
push 0x244
push 0x32
push 5
push 0
push str.__Disallowed_paths
lea ecx, [ebp - 0x390]
call fcn.005c0620
xorps xmm0, xmm0
mov dword [ebp - 0x88], eax
movq qword [ebp - 0x120], xmm0
sub esp, 8
mov dword [ebp - 0x118], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Shell32.dll
push dword [edi + 0x24]
lea ecx, [ebp - 0x120]
call fcn.005dc520
push 0x10
push 4
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 1
call fcn.005dc190
push eax
push 1
push 0xffffffffffffffff
lea ecx, [ebp - 0x390]
call fcn.005bea70
sub esp, 8
lea ecx, [ebp - 0x390]
push 0
sub esp, 8
push str.Execute_Prevent_selected_paths__read_only_:
push 1
push 0xffffffffffffffff
call fcn.005bbd80
sub esp, 8
lea ecx, [ebp - 0x390]
push 0
sub esp, 8
push str.Custom_paths__not_applied_if_Execute_Prevent_is_disabled_:
push 2
push 0xffffffffffffffff
call fcn.005bbd80
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x6e
push 0x183
push 0x20
push str.Edit_selected
lea ecx, [ebp - 0x390]
call fcn.005c1a50
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x6e
push 0x183
push 0xae
push str.Delete_selected
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x84], eax
call fcn.005c1a50
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x6e
push 0x183
push 0x13c
push str.Add_file_path
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x80], eax
call fcn.005c1a50
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x6e
push 0x183
push 0x1ca
push str.Add_folder_path
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x7c], eax
call fcn.005c1a50
push str.Excluded_items_list
mov dword [ebp - 0x78], eax
push 2
push esi
lea ecx, [ebp - 0x390]
call fcn.005bfb00
push 0x12
push 0x12
push 0
push 0
push 0
push 0x6d
mov ecx, edi
call fcn.00436420
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x390]
call fcn.005be310
movsd xmm1, qword [0x6edaf8]
lea ecx, [ebp - 0x390]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x28
push 0x244
push 0xa
push 0xa
push str.The_list_below_contains_the_unrestricted_paths._Files_in_these_paths_can_be_executed__even_if_they_are_sub_directories_of_the_disallowed_paths.
lea ecx, [ebp - 0x390]
call fcn.005c0890
movsd xmm1, qword [0x6edaf8]
lea ecx, [ebp - 0x390]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0x10021
push 0x1080001d
push 0x14a
push 0x244
push 0x32
push 5
push 0
push str.__Unrestricted_paths
lea ecx, [ebp - 0x390]
call fcn.005c0620
push 0x10
push 4
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x74], eax
call fcn.005dc190
push eax
push 1
push 0xffffffffffffffff
lea ecx, [ebp - 0x390]
call fcn.005bea70
sub esp, 8
lea ecx, [ebp - 0x390]
push 0
sub esp, 8
push str.Execute_Prevent_selected_paths__read_only_:
push 1
push 0xffffffffffffffff
call fcn.005bbd80
sub esp, 8
lea ecx, [ebp - 0x390]
push 0
sub esp, 8
push str.Custom_paths__not_applied_if_Execute_Prevent_is_disabled_:
push 2
push 0xffffffffffffffff
call fcn.005bbd80
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x6e
push 0x183
push 0x20
push str.Edit_selected
lea ecx, [ebp - 0x390]
call fcn.005c1a50
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x6e
push 0x183
push 0xae
push str.Delete_selected
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x70], eax
call fcn.005c1a50
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x6e
push 0x183
push 0x13c
push str.Add_file_path
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x6c], eax
call fcn.005c1a50
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x6e
push 0x183
push 0x1ca
push str.Add_folder_path
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x68], eax
call fcn.005c1a50
push 0
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x64], eax
call fcn.005c3f10
push ecx
push 0xffffffffffffffff
push 0x1c
push 0x78
push 0x1d1
push 0x3c
push str.Save_only
lea ecx, [ebp - 0x390]
call fcn.005c1a50
push ecx
push 0xffffffffffffffff
push 0x1e
push 0x78
push 0x1d0
push 0xf0
push str.Save__Apply
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x60], eax
call fcn.005c1a50
movsd xmm0, qword [0x6edb08]
sub esp, 0xc
mov dword [ebp - 0x5c], eax
movsd qword [esp + 4], xmm0
push 0
push ecx
push 0x190
push 0xffffffffffffffff
lea ecx, [ebp - 0x390]
call fcn.005beb10
push 0xffffffffffffffff
lea ecx, [ebp - 0x390]
call fcn.005c4370
push ecx
push 0xffffffffffffffff
push 0x1c
push 0x78
push 0x1d1
push 0x1a4
push str.Close_Cancel
lea ecx, [ebp - 0x390]
call fcn.005c1a50
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xe0], 0
push 0
push 0xffffffffffffffff
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerImmunization
lea ecx, [ebp - 0xe0]
call fcn.005d6a80
push 0
push 0x20019
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xe4]
push str.HKLMSOFTWAREPoliciesMicrosoftWindows_safercodeidentifiers
mov dword [ebp - 0xe4], 0
call fcn.005d6a80
lea eax, [ebp - 0xcc]
mov byte [ebp - 4], 3
push eax
push str.ExecutePreventFlag
lea ecx, [ebp - 0xe4]
call fcn.005d66b0
test al, al
jne 0x4b1dc9
lea eax, [ebp - 0xcc]
push eax
push str.ExecutePreventFlag
lea ecx, [ebp - 0xe0]
call fcn.005d66b0
test al, al
je 0x4b1dc9
push 0
lea eax, [ebp - 0xcc]
push eax
push 4
push str.ExecutePreventFlag
push str.HKLMSOFTWAREPoliciesMicrosoftWindows_safercodeidentifiers
lea ecx, [ebp - 0xe4]
call fcn.005d5be0
lea eax, [ebp - 0xcc]
mov ecx, edi
push eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x390]
push eax
call fcn.004b11b0
xorps xmm0, xmm0
mov dword [ebp - 0x10c], 0
lea ecx, [ebp - 0x114]
movq qword [ebp - 0x114], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x100], 0
lea ecx, [ebp - 0x108]
movq qword [ebp - 0x108], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xd4], 0
lea ecx, [ebp - 0xdc]
movq qword [ebp - 0xdc], xmm0
call fcn.005dc5e0
push 1
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x390]
push dword [ebp - 0x88]
call fcn.005bb910
push 1
push dword [ebp - 0x74]
lea ecx, [ebp - 0x390]
call fcn.005bb910
lea eax, [ebp - 0x114]
push eax
push str.ExecutePreventDisallowed
lea ecx, [ebp - 0xe0]
call fcn.005d6740
test al, al
je 0x4b1f42
lea ecx, [ebp - 0x114]
call fcn.005dc3a0
cmp eax, 1
jle 0x4b1f42
xorps xmm0, xmm0
lea ecx, [ebp - 0x114]
push 0
push 0x628b04
movups xmmword [ebp - 0xfc], xmm0
movq qword [ebp - 0xec], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0xfc]
call fcn.005d92a0
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 7
xor esi, esi
call fcn.005d9210
test eax, eax
je 0x4b1f33
push esi
lea ecx, [ebp - 0xfc]
call fcn.005d9220
mov ecx, eax
call fcn.005d8c40
test eax, eax
je 0x4b1f23
push 0
push dword [ebp - 0x88]
lea ecx, [ebp - 0xfc]
push 0
push 2
push 0xffffffffffffffff
push 0
push esi
call fcn.005d9220
push eax
lea ecx, [ebp - 0x390]
call fcn.005bbb80
lea ecx, [ebp - 0xfc]
inc esi
call fcn.005d9210
cmp esi, eax
jb 0x4b1ee4
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 6
call fcn.005d9280
lea eax, [ebp - 0x108]
push eax
push str.ExecutePreventAllowed
lea ecx, [ebp - 0xe0]
call fcn.005d6740
test al, al
je 0x4b2017
lea ecx, [ebp - 0x108]
call fcn.005dc3a0
cmp eax, 1
jle 0x4b2017
xorps xmm0, xmm0
lea ecx, [ebp - 0x108]
push 0
push 0x628b04
movups xmmword [ebp - 0xfc], xmm0
movq qword [ebp - 0xec], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0xfc]
call fcn.005d92a0
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 8
xor esi, esi
call fcn.005d9210
test eax, eax
je 0x4b200c
nop word [eax + eax]
push esi
lea ecx, [ebp - 0xfc]
call fcn.005d9220
mov ecx, eax
call fcn.005d8c40
test eax, eax
je 0x4b1ffc
push 0
push dword [ebp - 0x74]
lea ecx, [ebp - 0xfc]
push 0
push 2
push 0xffffffffffffffff
push 0
push esi
call fcn.005d9220
push eax
lea ecx, [ebp - 0x390]
call fcn.005bbb80
lea ecx, [ebp - 0xfc]
inc esi
call fcn.005d9210
cmp esi, eax
jb 0x4b1fc0
lea ecx, [ebp - 0xfc]
call fcn.005d9280
push 1
push dword [ebp - 0x88]
lea ecx, [ebp - 0x390]
call fcn.005bb910
push 1
push dword [ebp - 0x74]
lea ecx, [ebp - 0x390]
call fcn.005bb910
push 0x186a0
push ecx
push str.Remove_all_the_policies._To_quickly_remove_all_locked_and_excluded_paths__just_select_this_option_and_press_Save__Apply.
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Select_this_option_if_you_want_to_define_the_paths_to_lock_and_exclude_yourself._r_nUse_the_Locked_items_list_and_Excluded_items_list_tabs_to_add_the_desired_paths__and_press_Save__Apply
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.This_option_will_disallow_running_files_in_the_Local_and_Roaming_Application_data_folders__and_sub_directories._r_nIf_Execute_prevent_is_enabled_for_all_users__the_restrictions_will_be_effective_for_all_users._r_nOtherwise_they_will_be_applied_only_for_the_current_user._Commonly_used_folders_are_automatically_excluded.
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.This_option_will_disallow_running_files_in_any_folder_inside_the_user_profile._r_nIf_Execute_prevent_is_enabled_for_all_users__the_restrictions_will_be_effective_for_all_users._Otherwise_they_will_be_applied_only_for_the_current_user._Commonly_used_folders_are_automatically_excluded.
push dword [ebp - 0xac]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Restrict_running_files_in_the_Fonts_folder___Windir_Fonts_.
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Restrict_running_files_in_the_recycle_bin_folder._Each_user_is_granted_a_recycle_bin_folder._If_Execute_prevent_is_enabled_for_all_users__the_restrictions_will_be_effective_for_all_users.
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Restrict_running_files_in_the_common_application_data_folder__usually_C:ProgramData_.
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Restrict_running_files_in_the_public_profile_folder_folder__usually_C:UsersPublic_
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Allow_running_files_in_the_Users_desktop_folder__usually__USERPROFILE_Desktop_.
push dword [ebp - 0x98]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Allow_running_files_in_the_Users_Downloads_folder__usually__USERPROFILE_Downloads_.
push dword [ebp - 0x94]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Allow_running_files_in_the_Users_Documents_folder__usually__USERPROFILE_Documents_
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.List_the_files_blocked_by_the_current_Excute_prevent_paths.
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Edit_the_highlighted_path.
push dword [ebp - 0x84]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Delete_the_highlighted_path.
push dword [ebp - 0x80]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Add_a_file_path_to_the_list._This_file_will_be_blocked_from_execution.
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Add_a_folder_path_to_the_list._Executables_files_inside_this_folder_can_not_be_executed.
push dword [ebp - 0x78]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Edit_the_highlighted_path.
push dword [ebp - 0x70]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Delete_the_highlighted_path.
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Add_a_file_path_to_the_list._This_file_will_be_explicitly_allowed_to_be_executed.
push dword [ebp - 0x68]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Add_the_a_folder_path_to_the_list._Executables_files_inside_this_folder_will_be_explicitly_allowed_to_be_executed.
push dword [ebp - 0x64]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Save_the_current_settings_and_paths_so_you_can_load_them_back_later__but_dont_apply_them_yet.
push dword [ebp - 0x60]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Save_the_current_settings_and_paths_so_you_can_load_them_back_later__and_apply_the_policies.
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
push 0x186a0
push ecx
push str.Close_this_window__Esc_.
push dword [ebp - 0x58]
lea ecx, [ebp - 0x390]
call fcn.005bcaf0
movaps xmm0, xmmword [0x6edec0]
lea ecx, [ebp - 0x390]
mov eax, 0x1b
mov dword [ebp - 0x20], 0xffffffff
mov word [ebp - 0xbe], ax
mov ax, word [ebp - 0x58]
mov word [ebp - 0xbc], ax
lea eax, [ebp - 0xc0]
push 1
push eax
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x1c], 0xffffffff
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x18], 0xffffffff
mov byte [ebp - 0xc0], 1
call fcn.005c47a0
push 0x47
call dword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [ebp - 0x398]
mov esi, eax
call fcn.005c6550
lea ecx, [ebp - 0x394]
call fcn.005c6550
lea ecx, [ebp - 0x3d4]
call fcn.005c6550
lea ecx, [ebp - 0x3e0]
call fcn.005c6550
push 0
push esi
push esi
push 0xac
mov ecx, edi
mov byte [ebp - 4], 0xc
call fcn.00436420
push eax
lea ecx, [ebp - 0x398]
call fcn.005c6480
push 0
push esi
push esi
push 0x7a
mov ecx, edi
call fcn.00436420
push eax
lea ecx, [ebp - 0x394]
call fcn.005c6480
mov ecx, dword [edi + 0xe4]
mov edx, esi
push 0
push esi
call fcn.005d0d50
push eax
lea ecx, [ebp - 0x3d4]
call fcn.005c64e0
push 0
push esi
mov edx, esi
mov esi, dword [ebp - 0x3d8]
mov ecx, dword [esi + 0xe8]
call fcn.005d0d50
push eax
lea ecx, [ebp - 0x3e0]
call fcn.005c64e0
push 1
push 1
lea ecx, [ebp - 0x390]
call fcn.005c3f80
push 0
mov ecx, esi
call fcn.004771c0
test eax, eax
je 0x4b37f3
mov edi, dword [ebp - 0x3d4]
nop word [eax + eax]
mov eax, dword [esi + 0x14a8]
cmp eax, 0xfffffffa
je 0x4b37f3
lea ecx, [ebp - 0x390]
cmp dword [esi + 0x14d8], ecx
jne 0x4b37e2
cmp eax, 0xffffffd2
je 0x4b373c
cmp eax, 0xffffffd3
je 0x4b373c
mov ecx, dword [ebp - 0x34]
cmp eax, 0xfffffff2
jne 0x4b245f
cmp dword [esi + 0x14b4], ecx
jne 0x4b248c
cmp dword [ebp - 0x2c], 0xffffffff
je 0x4b37e2
push 2
push 0xffffffffffffffff
push ecx
lea ecx, [ebp - 0x390]
call fcn.005bb4c0
cmp eax, 0xffffffff
jne 0x4b2ee1
sub esp, 8
lea eax, [ebp - 0x390]
mov ecx, esi
push 0x8c
push 0x190
push 0
push eax
push 4
push str.Please_select_one_item_before_using_this_feature.
call fcn.0043e2e0
jmp 0x4b37e2
cmp eax, 0xffffffea
jne 0x4b248c
cmp dword [esi + 0x14b4], ecx
jne 0x4b248c
cmp ecx, 0xffffffff
je 0x4b37e2
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
lea ecx, [ebp - 0x390]
call fcn.005bbfd0
jmp 0x4b37e2
mov edx, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0xb8]
je 0x4b36ba
cmp eax, edx
je 0x4b36ba
cmp eax, dword [ebp - 0xb0]
je 0x4b36ba
cmp eax, dword [ebp - 0xac]
je 0x4b36ba
cmp eax, dword [ebp - 0xa8]
je 0x4b3648
cmp eax, dword [ebp - 0xa4]
je 0x4b3648
cmp eax, dword [ebp - 0xa0]
je 0x4b3648
cmp eax, dword [ebp - 0x9c]
je 0x4b3648
cmp eax, dword [ebp - 0x98]
je 0x4b3648
cmp eax, dword [ebp - 0x94]
je 0x4b3648
cmp eax, dword [ebp - 0x90]
je 0x4b3648
cmp eax, dword [ebp - 0x8c]
je 0x4b3648
mov edx, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x84]
je 0x4b35ee
cmp eax, 0xfffffff2
jne 0x4b2541
cmp dword [esi + 0x14b4], edx
je 0x4b35ee
cmp eax, dword [ebp - 0x80]
jne 0x4b25cd
push 2
push 0xffffffffffffffff
push edx
lea ecx, [ebp - 0x390]
call fcn.005bb4c0
mov dword [ebp - 0xc4], eax
test eax, eax
js 0x4b37e2
push eax
push dword [ebp - 0x88]
lea ecx, [ebp - 0x390]
call fcn.005bb5c0
cmp eax, 2
jne 0x4b37e2
sub esp, 8
lea eax, [ebp - 0x390]
mov ecx, esi
push 0x8c
push 0x190
push 0
push eax
push 1
push str.Are_you_sure_you_want_to_delete_the_selected_path_
call fcn.0043e2e0
test eax, eax
je 0x4b37e2
push 0
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x390]
push dword [ebp - 0x88]
call fcn.005bb970
jmp 0x4b37e2
cmp eax, dword [ebp - 0x7c]
je 0x4b3578
cmp eax, dword [ebp - 0x78]
je 0x4b35e9
mov edx, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x70]
je 0x4b3595
cmp eax, 0xfffffff2
jne 0x4b25fc
cmp dword [esi + 0x14b4], edx
je 0x4b3595
cmp eax, dword [ebp - 0x6c]
jne 0x4b267e
push 2
push 0xffffffffffffffff
push edx
lea ecx, [ebp - 0x390]
call fcn.005bb4c0
mov dword [ebp - 0xc4], eax
test eax, eax
js 0x4b37e2
push eax
push dword [ebp - 0x74]
lea ecx, [ebp - 0x390]
call fcn.005bb5c0
cmp eax, 2
jne 0x4b37e2
sub esp, 8
lea eax, [ebp - 0x390]
mov ecx, esi
push 0x8c
push 0x190
push 0
push eax
push 1
push str.Are_you_sure_you_want_to_delete_the_selected_path_
call fcn.0043e2e0
test eax, eax
je 0x4b37e2
push 0
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x390]
push dword [ebp - 0x74]
call fcn.005bb970
jmp 0x4b37e2
cmp eax, dword [ebp - 0x68]
je 0x4b3578
cmp eax, dword [ebp - 0x64]
je 0x4b3575
mov edx, dword [ebp - 0x60]
cmp eax, edx
je 0x4b30c1
cmp eax, dword [ebp - 0x5c]
je 0x4b30bf
cmp eax, dword [ebp - 0x58]
je 0x4b37f3
cmp eax, dword [ebp - 0x4c]
jne 0x4b2bd1
push 0
push 0
push 0xb
push 0
lea ecx, [ebp - 0x390]
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [ebp - 0x3e4]
lea ecx, [ebp - 0x390]
call fcn.005bd3f0
push 1
push dword [ebp - 0x60]
lea ecx, [ebp - 0x390]
call fcn.005bd3f0
push 1
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x390]
call fcn.005bd3f0
push 1
push dword [ebp - 0x58]
lea ecx, [ebp - 0x390]
call fcn.005bd3f0
movsd xmm1, qword [0x6edaf8]
lea ecx, [ebp - 0x390]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
push 0x10000300
push 0x1e
push 0x17c
push 0xa
push 0xa
push str.Execute_prevent_is_creating_the_list_of_affected_files__please_wait...
lea ecx, [ebp - 0x390]
call fcn.005c0890
push ecx
push 0xffffffffffffffff
push 0x28
push 0x28
push 5
push 0x1a9
push 0
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x40], eax
call fcn.005c00b0
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x46
push 0xc
push 0x208
push str.Cancel
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x3c], eax
call fcn.005c1a50
movsd xmm1, qword [0x6edaf8]
lea ecx, [ebp - 0x390]
push 0
push str.Arial
push 1
push 0x190
mov dword [ebp - 0x38], eax
call fcn.005c42b0
push 0x10025
push 0x1080000d
push 0x1a9
push 0x258
push 0x32
push 0
push 0
push str.Affected_file_path
lea ecx, [ebp - 0x390]
call fcn.005c0620
push 0x10
mov dword [ebp - 0x34], eax
push 0x10
push 0
push 0x10
push 0x10
push 0x78
mov ecx, esi
call fcn.00436420
push eax
push 1
push dword [ebp - 0x34]
lea ecx, [ebp - 0x390]
call fcn.005be310
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x14a
push 0x1df
push 0xa
push 0x62439c
lea ecx, [ebp - 0x390]
call fcn.005c0890
sub esp, 8
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x390]
push 0x12
push 0x104
push 0x1df
push 0x154
push str.Use_environment_strings_when_excluding
call fcn.005c19a0
push 4
push 0xffffffffffffffff
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x18], eax
call fcn.005bd3f0
push 0
push 1
push 0xb
push 0
lea ecx, [ebp - 0x390]
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x85
push 0
push 0
push 0
lea ecx, [ebp - 0x390]
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push ecx
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x390]
call fcn.005bf010
push 0
push 0
mov ecx, esi
call fcn.0043d720
lea eax, [ebp - 0x390]
mov dword [ebp - 0x3cc], esi
mov dword [ebp - 0x3c8], eax
lea ecx, [ebp - 0x3a4]
lea eax, [ebp - 0xb8]
mov word [ebp - 0x3bc], 0
mov dword [ebp - 0x3c4], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3a8], 0
mov dword [ebp - 0x3c0], eax
movups xmmword [ebp - 0x3b8], xmm0
call fcn.005dc5e0
push 0
push 0
lea eax, [ebp - 0x3cc]
push eax
push 0x495080
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
mov eax, 0xffffffff
cmove esi, eax
mov dword [ebp - 0xc4], esi
push 0xffffff
push 0x46
push 0xff000000
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x390]
push dword [ebp - 0x3c]
call fcn.005c5730
mov edx, 0x28
mov ecx, eax
call fcn.005d1e80
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
je 0x4b29c6
mov edi, dword [ebp - 0x3d8]
nop
push 0
mov ecx, edi
call fcn.004771c0
mov ecx, dword [edi + 0x14a8]
cmp ecx, 0xfffffffa
jne 0x4b298d
mov byte [ebp - 0x3bb], 2
jmp 0x4b29b3
lea eax, [ebp - 0x390]
cmp dword [edi + 0x14d8], eax
jne 0x4b29b3
cmp ecx, dword [ebp - 0x38]
mov ecx, 1
movzx eax, byte [ebp - 0x3bb]
cmove eax, ecx
mov byte [ebp - 0x3bb], al
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x4b2970
mov edi, dword [ebp - 0x3d4]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x390]
call fcn.005bf2f0
movsd xmm1, qword [0x6edaf8]
lea ecx, [ebp - 0x390]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x78
push 0xc
push 0x186
push str.Exclude_checked
lea ecx, [ebp - 0x390]
call fcn.005c1a50
push 0
push str.Close
push dword [ebp - 0x38]
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x3c], eax
call fcn.005bcd30
mov eax, dword [ebp - 0x3b8]
test eax, eax
je 0x4b2b75
sub esp, 0xc
lea ecx, [ebp - 0xdc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Execute_prevent_found
push eax
call fcn.005db320
mov ecx, eax
call fcn.005da510
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._affected_files_for_the_current_user._r_nCheck_what_you_want_to_exclude_and_press__Exclude_checked_.
lea ecx, [ebp - 0xdc]
call fcn.005da780
push dword [ebp - 0x40]
lea ecx, [ebp - 0x390]
sub esp, 8
call fcn.005c4060
push 0
lea ecx, [ebp - 0xdc]
call fcn.005dc190
push eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x390]
call fcn.005bcd30
push dword [ebp - 0x398]
lea ecx, [ebp - 0x390]
push str.Open_file_location
push dword [ebp - 0x34]
call fcn.005c1450
push 1
push 0
push eax
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x2c], eax
call fcn.005c56e0
push eax
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
push 0
push dword [ebp - 0x394]
lea ecx, [ebp - 0x390]
push 0
push 0x32
push str.Exclude_parent_folder
push dword [ebp - 0x2c]
call fcn.005c0400
push 0
push 0
push 8
push 0x32
push 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x28], eax
call fcn.005c0400
push 0
push edi
push 0
push 0x32
push str.Check_all
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x390]
call fcn.005c0400
push 0
push dword [ebp - 0x3e0]
mov dword [ebp - 0x24], eax
push 0
push 0x32
push str.Check_none
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x390]
call fcn.005c0400
push 1
push dword [ebp - 0x34]
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x20], eax
call fcn.005ba360
jmp 0x4b2b9a
push 0
push str.Execute_prevent_did_not_find_any_affected_files_for_the_current_user.
push dword [ebp - 0x40]
lea ecx, [ebp - 0x390]
call fcn.005bcd30
push 0x40
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x390]
call fcn.005bd3f0
push 0x80
push dword [ebp - 0x34]
lea ecx, [ebp - 0x390]
call fcn.005bd3f0
cmp esi, 0xffffffff
je 0x4b2bbd
test esi, esi
je 0x4b2bbd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x3a4]
mov byte [ebp - 4], 0xc
call fcn.005dc430
jmp 0x4b37dc
mov edx, dword [ebp - 0x3c]
cmp eax, edx
jne 0x4b2de1
cmp edx, 1
jl 0x4b37e2
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x390]
movlpd qword [ebp - 0xc8], xmm0
call fcn.005bb7f0
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], 0
mov byte [ebp - 4], 0x11
cmp dword [eax], 0
jne 0x4b2c51
sub esp, 8
lea eax, [ebp - 0x390]
mov ecx, esi
push 0x8c
push 0x190
push 0
push eax
push 4
push str.Please_check_one_or_more_items_before_using_this_feature.
call fcn.0043e2e0
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0xc8]
push eax
call fcn.0041e1c3
add esp, 4
jmp 0x4b37e2
push 4
push dword [ebp - 0x18]
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x3dc], 0
call fcn.005bc500
mov ecx, eax
mov eax, dword [ebp - 0xc8]
mov esi, dword [eax]
test esi, esi
jle 0x4b2d7b
mov edi, eax
test ecx, ecx
je 0x4b2d10
nop word [eax + eax]
push 0
push dword [edi + esi*4]
lea ecx, [ebp - 0x390]
push dword [ebp - 0x34]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
push 0x200
lea eax, [ebp - 0xdc]
push eax
call fcn.004afc60
push 0
push dword [ebp - 0x74]
lea ecx, [ebp - 0xdc]
push 0
push 2
push 0xffffffffffffffff
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x390]
call fcn.005bbb80
test eax, eax
je 0x4b2d01
push 0
push dword [edi + esi*4]
lea ecx, [ebp - 0x390]
push dword [ebp - 0x34]
call fcn.005bb970
inc dword [ebp - 0x3dc]
dec esi
test esi, esi
jg 0x4b2c90
jmp 0x4b2d75
push 0
push dword [edi + esi*4]
lea ecx, [ebp - 0x390]
push dword [ebp - 0x34]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
push 0
push dword [ebp - 0x74]
lea ecx, [ebp - 0xdc]
push 0
push 2
push 0xffffffffffffffff
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x390]
call fcn.005bbb80
test eax, eax
je 0x4b2d70
push 0
push dword [edi + esi*4]
lea ecx, [ebp - 0x390]
push dword [ebp - 0x34]
call fcn.005bb970
inc dword [ebp - 0x3dc]
dec esi
test esi, esi
jg 0x4b2d10
mov edi, dword [ebp - 0x3d4]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._items_successfully_excluded.
push dword [ebp - 0x3dc]
lea ecx, [ebp - 0xdc]
call fcn.005db320
mov ecx, eax
call fcn.005da780
push 0
lea ecx, [ebp - 0xdc]
call fcn.005dc190
push eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x390]
call fcn.005bcd30
mov byte [ebp - 4], 0xc
push dword [ebp - 0xc8]
call fcn.0041e1c3
add esp, 4
jmp 0x4b37dc
cmp eax, dword [ebp - 0x38]
jne 0x4b2eb8
push 0
push 0
push 0xb
push 0
lea ecx, [ebp - 0x390]
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 0xa
mov dword [ebp - 0xd0], eax
nop
mov ecx, dword [ebp + eax*4 - 0x40]
cmp ecx, 0xffffffff
je 0x4b2e33
push ecx
lea ecx, [ebp - 0x390]
call fcn.005bf2f0
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x40], 0xffffffff
sub eax, 1
mov dword [ebp - 0xd0], eax
jns 0x4b2e10
push 2
push dword [ebp - 0x3e4]
lea ecx, [ebp - 0x390]
call fcn.005bd3f0
push 2
push dword [ebp - 0x60]
lea ecx, [ebp - 0x390]
call fcn.005bd3f0
push 2
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x390]
call fcn.005bd3f0
push 2
push dword [ebp - 0x58]
lea ecx, [ebp - 0x390]
call fcn.005bd3f0
push 0
push 1
push 0xb
push 0
lea ecx, [ebp - 0x390]
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0
push 0
lea ecx, [ebp - 0x390]
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4b37e2
mov edx, dword [ebp - 0x2c]
cmp eax, edx
jne 0x4b2f14
cmp edx, 1
jl 0x4b37e2
push 2
push 0xffffffffffffffff
push ecx
lea ecx, [ebp - 0x390]
call fcn.005bb4c0
cmp eax, 0xffffffff
je 0x4b2436
push 0
push eax
push dword [ebp - 0x34]
lea ecx, [ebp - 0x390]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
lea ecx, [ebp - 0xdc]
call fcn.005dc190
push eax
call fcn.0043bf00
jmp 0x4b37e2
mov edx, dword [ebp - 0x28]
cmp eax, edx
jne 0x4b3090
cmp edx, 1
jl 0x4b37e2
push 2
push 0xffffffffffffffff
push ecx
lea ecx, [ebp - 0x390]
call fcn.005bb4c0
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b2f6e
mov esi, dword [ebp - 0x3d8]
lea eax, [ebp - 0x390]
sub esp, 8
mov ecx, esi
push 0x8c
push 0x190
push 0
push eax
push 4
push str.Please_select_one_or_more_items_before_using_this_feature.
call fcn.0043e2e0
jmp 0x4b37e2
push 4
push dword [ebp - 0x18]
lea ecx, [ebp - 0x390]
xor edi, edi
call fcn.005bc500
mov dword [ebp - 0xc4], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6249f8
push 0
push 0
push esi
push dword [ebp - 0x34]
lea ecx, [ebp - 0x390]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xdc]
call fcn.005dc1c0
mov ecx, eax
call fcn.005dbed0
mov ecx, eax
call fcn.005da780
cmp dword [ebp - 0xc4], 0
je 0x4b2fe8
push 0x200
lea eax, [ebp - 0xdc]
push eax
call fcn.004afc60
push 0
push dword [ebp - 0x74]
lea ecx, [ebp - 0xdc]
push 0
push 2
push 0xffffffffffffffff
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x390]
call fcn.005bbb80
test eax, eax
je 0x4b3027
push 0
push esi
push dword [ebp - 0x34]
lea ecx, [ebp - 0x390]
call fcn.005bb970
test eax, eax
je 0x4b3026
dec esi
inc edi
push 2
push esi
push dword [ebp - 0x34]
lea ecx, [ebp - 0x390]
call fcn.005bb4c0
mov esi, eax
not esi
shr esi, 0x1f
test esi, esi
jne 0x4b2f86
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str._folders_successfully_excluded.
push edi
lea ecx, [ebp - 0xdc]
call fcn.005db320
mov ecx, eax
call fcn.005da780
push esi
lea ecx, [ebp - 0xdc]
call fcn.005dc190
push eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x390]
call fcn.005bcd30
mov edi, dword [ebp - 0x3d4]
jmp 0x4b37dc
mov edx, dword [ebp - 0x24]
cmp eax, edx
je 0x4b30a0
cmp eax, dword [ebp - 0x20]
jne 0x4b37e2
push ecx
cmp eax, edx
push 0xffffffffffffffff
sete al
push 0
movzx eax, al
push eax
push ecx
lea ecx, [ebp - 0x390]
call fcn.005bba40
jmp 0x4b37e2
cmp eax, edx
sete byte [ebp - 0x3cd]
je 0x4b30f6
sub esp, 8
lea eax, [ebp - 0x390]
mov ecx, esi
push 0x8c
push 0x190
push 0
push eax
push 1
push str.Are_you_sure_you_want_to_apply_these_policies_
call fcn.0043e2e0
test eax, eax
je 0x4b37e2
lea ecx, [ebp - 0xdc]
call fcn.005dc400
xorps xmm0, xmm0
mov dword [ebp - 0xe8], 0
lea ecx, [ebp - 0xf0]
movq qword [ebp - 0xf0], xmm0
call fcn.005dc5e0
push 0
push 0
push 0x1004
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x390]
push dword [ebp - 0x88]
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0xc4], 0
test eax, eax
jle 0x4b31e8
mov edi, dword [ebp - 0xc4]
mov esi, eax
nop word [eax + eax]
push edi
push dword [ebp - 0x88]
lea ecx, [ebp - 0x390]
call fcn.005bb5c0
cmp eax, 2
jne 0x4b31d7
push 0
push edi
push dword [ebp - 0x88]
lea ecx, [ebp - 0x390]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xf0]
call fcn.005dc1c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x628b04
lea ecx, [ebp - 0xf0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xdc]
call fcn.005da780
inc edi
cmp edi, esi
jl 0x4b3170
mov edi, dword [ebp - 0x3d4]
mov esi, dword [ebp - 0x3d8]
push 0
push 1
lea ecx, [ebp - 0xdc]
call fcn.005dadc0
mov ecx, eax
call fcn.005dc190
push eax
push 1
push str.ExecutePreventDisallowed
lea ecx, [ebp - 0xe0]
call fcn.005d5f20
lea ecx, [ebp - 0xdc]
call fcn.005dc400
push 0
push 0
push 0x1004
push dword [ebp - 0x74]
lea ecx, [ebp - 0x390]
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xc4], 0
test eax, eax
jle 0x4b32c8
mov edi, dword [ebp - 0xc4]
mov esi, eax
push edi
push dword [ebp - 0x74]
lea ecx, [ebp - 0x390]
call fcn.005bb5c0
cmp eax, 2
jne 0x4b32b7
push 0
push edi
push dword [ebp - 0x74]
lea ecx, [ebp - 0x390]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xf0]
call fcn.005dc1c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x628b04
lea ecx, [ebp - 0xf0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xdc]
call fcn.005da780
inc edi
cmp edi, esi
jl 0x4b3256
mov edi, dword [ebp - 0x3d4]
mov esi, dword [ebp - 0x3d8]
push 0
push 1
lea ecx, [ebp - 0xdc]
call fcn.005dadc0
mov ecx, eax
call fcn.005dc190
push eax
push 1
push str.ExecutePreventAllowed
lea ecx, [ebp - 0xe0]
call fcn.005d5f20
push 0
lea eax, [ebp - 0xcc]
push eax
push 4
push str.ExecutePreventFlag
push str.HKLMSOFTWAREPoliciesMicrosoftWindows_safercodeidentifiers
lea ecx, [ebp - 0xe4]
call fcn.005d5be0
cmp byte [ebp - 0x3cd], 0
je 0x4b3352
sub esp, 8
lea eax, [ebp - 0x390]
mov ecx, esi
push 0x8c
push 0x190
push 0
push eax
push 4
push str.The_current_Execute_Prevent_paths_and_settings_were_successfully_saved._r_n_r_nTo_apply_the_corresponding_policies__press__Save__Apply_.
call fcn.0043e2e0
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0xc
call fcn.005dc430
jmp 0x4b37e2
push 6
lea ecx, [esi + 0x1290]
call fcn.0055e910
push 4
push str.HKLMSOFTWAREPolicies
lea ecx, [esi + 0x1290]
mov byte [ebp - 0x3cd], al
call fcn.0055e500
mov dword [ebp - 0xc4], 0
call fcn.004af0e0
test byte [ebp - 0xcc], 7
je 0x4b346b
call fcn.004aee10
xor esi, esi
cmp dword [ebp - 0x3dc], esi
jle 0x4b33ee
mov edi, dword [ebp - 0x3dc]
nop dword [eax + eax]
push 0
push esi
push dword [ebp - 0x88]
lea ecx, [ebp - 0x390]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xf0]
call fcn.005dc1c0
push 1
lea ecx, [ebp - 0xf0]
call fcn.005dc190
push eax
call fcn.004aef20
inc esi
cmp esi, edi
jl 0x4b33b0
mov edi, dword [ebp - 0x3d4]
xor esi, esi
cmp dword [ebp - 0xd0], esi
jle 0x4b343b
mov edi, dword [ebp - 0xd0]
nop
push 0
push esi
push dword [ebp - 0x74]
lea ecx, [ebp - 0x390]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xf0]
call fcn.005dc1c0
push 0
lea ecx, [ebp - 0xf0]
call fcn.005dc190
push eax
call fcn.004aef20
inc esi
cmp esi, edi
jl 0x4b3400
mov edi, dword [ebp - 0x3d4]
push 0
call fcn.004b12d0
mov esi, eax
mov dword [ebp - 0xc4], esi
test esi, esi
je 0x4b346b
xor edx, edx
mov ecx, str.HKLM64SOFTWAREPoliciesMicrosoftWindows_saferExecutePreventBackup
call fcn.005d5060
push 0
mov edx, str.HKLM64SOFTWAREPoliciesMicrosoftWindows_saferExecutePreventBackup
mov ecx, str.HKLM64SOFTWAREPoliciesMicrosoftWindows_safercodeidentifiers
call fcn.005d3c40
mov esi, dword [sym.imp.USERENV.dll_RefreshPolicyEx]
push 1
push 1
call esi
push 1
push 0
call esi
cmp byte [ebp - 0x3cd], 0
mov esi, dword [ebp - 0x3d8]
je 0x4b349e
push 0xd
push str.HKLMSOFTWAREPolicies
lea ecx, [esi + 0x1290]
call fcn.0055e500
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x114]
call fcn.005db320
push 0
push 0x20019
push str.HKLMSOFTWAREPoliciesMicrosoftWindows_safercodeidentifiers262144Paths
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xd0], 0
call fcn.005d6a80
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0xe
call fcn.005d6280
push eax
lea ecx, [ebp - 0x108]
call fcn.005db320
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624288
lea ecx, [ebp - 0x108]
call fcn.005dc190
push eax
push str.._r_nCurrent_number_of_unrestricted_paths:
lea ecx, [ebp - 0x114]
call fcn.005dc190
push eax
push str.Operation_complete._r_n_r_nCurrent_number_of_disallowed_paths:
lea ecx, [ebp - 0xdc]
call fcn.005dc200
sub esp, 8
lea eax, [ebp - 0x390]
lea ecx, [ebp - 0xdc]
push 0x8c
push 0x190
push 0x14
push eax
push 4
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0043e2e0
lea ecx, [ebp - 0xd0]
call fcn.005d69e0
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0xc
call fcn.005dc430
jmp 0x4b37e2
cmp eax, dword [ebp - 0x68]
push 0xffffffffffffffff
sete al
mov ecx, esi
movzx eax, al
push eax
push edx
lea eax, [ebp - 0x390]
push eax
call fcn.004af330
jmp 0x4b37e2
push 2
push 0xffffffffffffffff
push edx
lea ecx, [ebp - 0x390]
call fcn.005bb4c0
mov dword [ebp - 0xc4], eax
test eax, eax
js 0x4b37e2
push eax
push dword [ebp - 0x74]
lea ecx, [ebp - 0x390]
call fcn.005bb5c0
cmp eax, 2
jne 0x4b37e2
push dword [ebp - 0xc4]
lea eax, [ebp - 0x390]
mov ecx, esi
push 0
push dword [ebp - 0x74]
push eax
call fcn.004af330
jmp 0x4b37e2
cmp eax, dword [ebp - 0x7c]
jmp 0x4b3578
push 2
push 0xffffffffffffffff
push edx
lea ecx, [ebp - 0x390]
call fcn.005bb4c0
mov dword [ebp - 0xc4], eax
test eax, eax
js 0x4b37e2
push eax
push dword [ebp - 0x88]
lea ecx, [ebp - 0x390]
call fcn.005bb5c0
cmp eax, 2
jne 0x4b37e2
push dword [ebp - 0xc4]
lea eax, [ebp - 0x390]
mov ecx, esi
push 0
push dword [ebp - 0x88]
push eax
call fcn.004af330
jmp 0x4b37e2
and dword [ebp - 0xcc], 7
mov edi, 4
push 0
push 0
push 0xf0
push dword [ebp + edi*4 - 0xb8]
lea ecx, [ebp - 0x390]
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x4b368e
lea edx, [edi - 1]
call fcn.00404890
call fcn.005e9c20
or dword [ebp - 0xcc], eax
inc edi
cmp edi, 0xc
jb 0x4b3654
push dword [ebp - 0xcc]
lea eax, [ebp - 0xb8]
mov ecx, esi
push eax
lea eax, [ebp - 0x390]
push eax
call fcn.004b0e30
mov edi, dword [ebp - 0x3d4]
jmp 0x4b37e2
push 4
push edx
lea ecx, [ebp - 0x390]
call fcn.005bc500
test eax, eax
je 0x4b36d8
mov dword [ebp - 0xcc], 1
jmp 0x4b371b
push 4
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x390]
call fcn.005bc500
test eax, eax
je 0x4b36fb
mov dword [ebp - 0xcc], 2
jmp 0x4b371b
push 4
push dword [ebp - 0xac]
lea ecx, [ebp - 0x390]
call fcn.005bc500
neg eax
sbb eax, eax
and eax, 4
mov dword [ebp - 0xcc], eax
lea eax, [ebp - 0xcc]
mov ecx, esi
push eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x390]
push eax
call fcn.004b11b0
jmp 0x4b37e2
mov eax, dword [esi + 0x14b4]
mov dword [ebp - 0xc4], eax
cmp eax, dword [ebp - 0x88]
je 0x4b3759
cmp eax, dword [ebp - 0x74]
jne 0x4b37e2
push 2
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x390]
call fcn.005bb4c0
mov esi, eax
lea ecx, [ebp - 0x390]
push esi
push dword [ebp - 0xc4]
call fcn.005bb5c0
mov edx, eax
mov ecx, 0x12
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x88]
mov eax, 0xd
cmove ecx, eax
mov dword [ebp - 0xc4], ecx
cmp esi, 0xffffffff
je 0x4b37ab
lea esi, [eax + 0x13]
cmp edx, 2
je 0x4b37b0
mov esi, 0x40
push esi
push dword [ebp + ecx*4 - 0xb8]
lea ecx, [ebp - 0x390]
call fcn.005bd3f0
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0x390]
push esi
push dword [ebp + eax*4 - 0xb4]
call fcn.005bd3f0
mov esi, dword [ebp - 0x3d8]
push 0
mov ecx, esi
call fcn.004771c0
test eax, eax
jne 0x4b23d0
lea ecx, [ebp - 0x3e0]
call fcn.005c6500
lea ecx, [ebp - 0x3d4]
call fcn.005c6500
lea ecx, [ebp - 0x394]
call fcn.005c6500
lea ecx, [ebp - 0x398]
call fcn.005c6500
lea ecx, [ebp - 0xdc]
call fcn.005dc430
lea ecx, [ebp - 0x108]
call fcn.005dc430
lea ecx, [ebp - 0x114]
call fcn.005dc430
lea ecx, [ebp - 0xe4]
call fcn.005d69e0
lea ecx, [ebp - 0xe0]
call fcn.005d69e0
lea ecx, [ebp - 0x120]
call fcn.005dc430
lea ecx, [ebp - 0x390]
call fcn.005c1c60
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4