Function at 0x52791c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x18c
mov eax, 0x67791a
call fcn.005b47af
mov al, byte [ebp + 8]
lea ecx, [ebp - 0xc8]
xor ebx, ebx
mov byte [ebp - 0x5c], al
push ebx
call fcn.00539837
sub esp, 0x18
mov dword [ebp - 4], ebx
mov ecx, esp
mov dword [ebp - 0x60], esp
push dword [ebp - 0x5c]
call fcn.005398f9
push str.detected
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 1
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], bl
call fcn.00539a88
push 6
lea ecx, [ebp - 0xe8]
call fcn.00539837
mov byte [ebp - 4], 2
call fcn.0043f559
push eax
lea ecx, [ebp - 0xb0]
call fcn.0043dde9
mov esi, dword [ebp - 0xb0]
mov byte [ebp - 4], 3
cmp esi, dword [ebp - 0xac]
je 0x527a4d
mov edi, dword [esi + 4]
mov ecx, dword [esi]
test edi, edi
je 0x5279b5
lock inc dword [edi + 4]
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x6c], ecx
mov al, byte [ecx + 0xc]
mov byte [ebp - 4], 4
test al, al
je 0x5279fc
mov al, byte [ecx + 0x71]
test al, al
je 0x5279d3
mov word [ecx + 0xc], 0
lea eax, [ebp - 0xa4]
push eax
call fcn.004b6374
push eax
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 5
call fcn.0053a402
lea ecx, [ebp - 0xa4]
call fcn.00539a16
mov bl, 1
mov byte [ebp - 4], 3
test edi, edi
je 0x527a0b
mov ecx, edi
call fcn.00418cb4
add esi, 8
cmp esi, dword [ebp - 0xac]
jne 0x5279a8
test bl, bl
je 0x527a4d
sub esp, 0x18
lea eax, [ebp - 0xe8]
mov ecx, esp
mov dword [ebp - 0x60], esp
push eax
call fcn.00539554
push str.apps
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 6
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00539a88
call fcn.00458c11
mov ecx, eax
call fcn.0046fa1b
test eax, eax
je 0x527b0f
push 6
lea ecx, [ebp - 0x28]
call fcn.00539837
mov byte [ebp - 4], 7
call fcn.00458c11
mov esi, dword [eax]
mov edi, dword [eax + 4]
jmp 0x527acf
mov ebx, dword [esi + 4]
mov ecx, dword [esi]
test ebx, ebx
je 0x527a88
lock inc dword [ebx + 4]
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], ecx
mov al, byte [ecx + 8]
mov byte [ebp - 4], 8
test al, al
je 0x527abd
lea eax, [ebp - 0xa4]
push eax
call fcn.00471b88
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0053a402
lea ecx, [ebp - 0xa4]
call fcn.00539a16
mov byte [ebp - 4], 7
test ebx, ebx
je 0x527acc
mov ecx, ebx
call fcn.00418cb4
add esi, 8
cmp esi, edi
jne 0x527a7b
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
mov dword [ebp - 0x60], esp
push eax
call fcn.00539554
push str.autostart
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0xa
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.00539a88
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00539a16
call fcn.0042a82f
mov ecx, eax
call fcn.00476d9c
test al, al
je 0x527e51
push 6
lea ecx, [ebp - 0xa4]
call fcn.00539837
mov byte [ebp - 4], 0xb
call fcn.0042a82f
mov ebx, dword [eax + 4]
mov edi, dword [eax]
mov dword [ebp - 0x70], ebx
jmp 0x527e07
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], esi
test eax, eax
je 0x527b59
lock inc dword [eax + 4]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xd0], esi
mov ecx, esi
mov byte [ebp - 4], 0xc
call fcn.00476d27
test al, al
je 0x527df4
xor ebx, ebx
lea ecx, [ebp - 0x28]
push ebx
call fcn.00539837
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0xd
push eax
mov ecx, esi
call fcn.0043f44d
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0xe
push eax
call fcn.0040d0f1
sub esp, 0x10
mov byte [ebp - 4], 0xf
mov ecx, esp
mov dword [ebp - 0x5c], esp
push eax
call fcn.00539672
push 0x690ed8
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x10
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 0xf
call fcn.00539a88
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00409d92
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.00409de7
lea eax, [ebp - 0x78]
mov ecx, esi
push eax
call fcn.0043f3a9
mov ecx, dword [eax]
mov byte [ebp - 4], 0x11
call fcn.00479b93
mov ecx, dword [ebp - 0x74]
mov bl, al
mov byte [ebp - 4], 0xd
test ecx, ecx
je 0x527c0c
call fcn.00418cb4
test bl, bl
je 0x527ce8
push 6
lea ecx, [ebp - 0x40]
call fcn.00539837
lea eax, [ebp - 0x6c]
mov ecx, esi
push eax
call fcn.0043f3a9
mov ebx, dword [ebp - 0x6c]
mov byte [ebp - 4], 0x13
mov esi, dword [ebx + 4]
mov ebx, dword [ebx + 8]
jmp 0x527c9c
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov dword [ebp - 0x5c], ecx
test ecx, ecx
je 0x527c48
lock inc dword [ecx + 4]
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], edx
mov al, byte [edx + 0xc]
mov byte [ebp - 4], 0x14
test al, al
je 0x527c8c
mov al, byte [edx + 0x88]
test al, al
je 0x527c69
mov word [edx + 0xc], 0
lea eax, [ebp - 0x58]
mov ecx, edx
push eax
call fcn.00479a69
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x15
call fcn.0053a402
lea ecx, [ebp - 0x58]
call fcn.00539a16
mov ecx, dword [ebp - 0x5c]
mov byte [ebp - 4], 0x13
test ecx, ecx
je 0x527c99
call fcn.00418cb4
add esi, 8
cmp esi, ebx
jne 0x527c38
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
mov dword [ebp - 0x5c], esp
push eax
call fcn.00539554
push 0x6883d0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x16
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 0x13
call fcn.00539a88
mov ecx, dword [ebp - 0x68]
test ecx, ecx
je 0x527cd9
call fcn.00418cb4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xd
call fcn.00539a16
mov esi, dword [ebp - 0x64]
mov ecx, dword [esi + 0x204]
lea eax, [ebp - 0x8c]
push eax
call fcn.004ad30a
mov eax, dword [ebp - 0x88]
sub eax, dword [ebp - 0x8c]
sar eax, 2
mov byte [ebp - 4], 0x17
test eax, eax
je 0x527d98
push 6
lea ecx, [ebp - 0x40]
call fcn.00539837
mov esi, dword [ebp - 0x8c]
mov ebx, dword [ebp - 0x88]
mov byte [ebp - 4], 0x18
jmp 0x527d58
mov ecx, dword [esi]
lea eax, [ebp - 0x58]
push eax
call fcn.004ad402
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x19
call fcn.0053a402
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x18
call fcn.00539a16
add esi, 4
cmp esi, ebx
jne 0x527d31
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
mov dword [ebp - 0x5c], esp
push eax
call fcn.00539554
push str.push
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 0x18
call fcn.00539a88
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x17
call fcn.00539a16
mov esi, dword [ebp - 0x64]
mov ecx, esi
call fcn.00473b6e
test eax, eax
je 0x527dcf
sub esp, 0x18
mov ecx, esi
mov eax, esp
mov dword [ebp - 0x5c], esp
push eax
call fcn.00478963
push str.parameters
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1b
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 0x17
call fcn.00539a88
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xa4]
call fcn.0053a402
lea ecx, [ebp - 0x8c]
call fcn.0042a707
lea ecx, [ebp - 0x28]
call fcn.00539a16
mov ebx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x60]
mov byte [ebp - 4], 0xb
test ecx, ecx
je 0x527e04
call fcn.00418cb4
add edi, 8
cmp edi, ebx
jne 0x527b46
sub esp, 0x18
lea eax, [ebp - 0xa4]
mov ecx, esp
mov dword [ebp - 0x60], esp
push eax
call fcn.00539554
push str.browsers
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x1c
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 0xb
call fcn.00539a88
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 3
call fcn.00539a16
call fcn.0043f63d
mov ecx, eax
call fcn.0051c2a7
test eax, eax
je 0x52801d
push 6
lea ecx, [ebp - 0xa4]
call fcn.00539837
mov byte [ebp - 4], 0x1d
call fcn.0043f63d
mov ebx, dword [eax + 4]
mov esi, dword [eax]
mov dword [ebp - 0x5c], ebx
jmp 0x527fd3
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x60], edi
test eax, eax
je 0x527e9b
lock inc dword [eax + 4]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], edi
mov ecx, edi
mov byte [ebp - 4], 0x1e
call fcn.0051d55d
test al, al
je 0x527fc0
mov ebx, dword [ebp - 0x60]
mov edi, dword [edi + 0x20]
mov ebx, dword [ebx + 0x24]
cmp edi, ebx
je 0x527fbd
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x64], eax
test ecx, ecx
je 0x527ed8
lock inc dword [ecx + 4]
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], eax
mov al, byte [eax + 0xc]
mov byte [ebp - 4], 0x1f
test al, al
je 0x527fac
push 0
lea ecx, [ebp - 0x28]
call fcn.00539837
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 0x20
call fcn.0051cf6c
sub esp, 0x18
mov byte [ebp - 4], 0x21
mov ecx, esp
mov dword [ebp - 0x68], esp
push eax
call fcn.005396a1
push str.reg_path
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x22
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 0x21
call fcn.00539a88
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x20
call fcn.00409de7
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x58]
push eax
lea ecx, [ecx + 4]
call fcn.0043f487
sub esp, 0x18
mov byte [ebp - 4], 0x23
mov ecx, esp
mov dword [ebp - 0x68], esp
push eax
call fcn.005396a1
push str.reg_value
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x24
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 0x23
call fcn.00539a88
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x20
call fcn.00409de7
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xa4]
call fcn.0053a402
lea ecx, [ebp - 0x28]
call fcn.00539a16
mov ecx, dword [ebp - 0x60]
test ecx, ecx
je 0x527fb5
call fcn.00418cb4
add edi, 8
jmp 0x527ebd
mov ebx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x70]
mov byte [ebp - 4], 0x1d
test ecx, ecx
je 0x527fd0
call fcn.00418cb4
add esi, 8
cmp esi, ebx
jne 0x527e88
sub esp, 0x18
lea eax, [ebp - 0xa4]
mov ecx, esp
mov dword [ebp - 0x68], esp
push eax
call fcn.00539554
push str.registry
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x25
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 0x1d
call fcn.00539a88
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 3
call fcn.00539a16
push 1
push 3
lea ecx, [ebp - 0x198]
call fcn.004078ff
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 0x26
push eax
lea eax, [ebp - 0x188]
push str.Scan_stat:
push eax
call fcn.0040710b
pop ecx
pop ecx
push eax
call fcn.004274bb
pop ecx
pop ecx
lea eax, [ebp - 0x198]
push eax
push str.ScanStat::create
push 0x9e
push str.D:_build6c589d3ff8507062_src_scannerScanStat.cpp
push 1
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 3
call fcn.0040843a
and dword [ebp - 0x18], 0
xor eax, eax
mov esi, str.scan
mov dword [ebp - 0x14], 7
push esi
mov word [ebp - 0x28], ax
call fcn.005ff18e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040a315
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x27
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00427e2b
mov ecx, eax
call fcn.004fe477
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00409de7
call fcn.00427e2b
mov ecx, eax
call fcn.00502d4b
lea ecx, [ebp - 0xb0]
call fcn.0043f246
lea ecx, [ebp - 0xe8]
call fcn.00539a16
lea ecx, [ebp - 0xc8]
call fcn.00539a16
call fcn.005b4759
ret 4