Function at 0x46c500
Capabilities:
Create thread
Enumerate files on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5efa53
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x368
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x374], edi
push str.Health_Check
lea ecx, [edi + 0x1448]
call fcn.005dc510
push 0
push str.Health_Check
mov ecx, edi
call fcn.0045f680
mov ecx, edi
call fcn.0043e530
test al, al
jne 0x46c579
xor eax, eax
jmp 0x46dfec
mov esi, dword [edi + 0x14e4]
mov ecx, dword [edi + 0x100]
mov dword [ebp - 0x358], esi
call fcn.005d2f10
push ecx
push 4
push 0xffffffffffffffff
push 0xff000000
push 0x14a
push 0x2e4
push 0x28
mov edx, 5
mov dword [ebp - 0x360], eax
mov ecx, eax
call fcn.005d22b0
push ecx
mov ecx, dword [ebp - 0x360]
mov edx, 5
push 4
push 0xffffffffffffffff
push 0xff000000
push 0xaa
push 0x2e4
push 0x177
call fcn.005d22b0
push 0
push 0
push dword [ebp - 0x360]
mov ecx, esi
call fcn.005c44c0
mov ecx, dword [ebp - 0x360]
test ecx, ecx
je 0x46c602
mov eax, dword [ecx]
push 1
call dword [eax]
movsd xmm1, qword [0x6edb20]
mov ecx, esi
push 9
push str.Arial
push 0
push 0x320
call fcn.005c42b0
push dword [edi + 0x1438]
mov ecx, esi
call fcn.005c44a0
push ecx
push 0xffffffffffffffff
push 0x20
push 0x20
push 6
push 6
push 0
push 0x20
push 0x20
push 0x130
mov ecx, edi
call fcn.00436420
push eax
mov ecx, esi
call fcn.005c0240
push 0xffffffffffffffff
push 0x10000101
push 0x14
push 0x258
push 0xf
push 0x32
push str.A_quick_peek_into_your_computers_health_status
mov ecx, esi
call fcn.005c0890
push 0
mov ecx, esi
call fcn.005c44a0
movsd xmm1, qword [0x6edb08]
push 0
push str.Segoe_UI
push 1
push 0x190
call fcn.005c42b0
push 0
mov ecx, esi
call fcn.005c44a0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xf5
push 3
push 0x3c
push 0x174
push 0
call fcn.005c0890
push 0xa0a0a0
push 0xffffffffffffffff
mov ecx, esi
call fcn.005bedc0
push ecx
push 0xffffffffffffffff
push 0x28
push 0x28
push 0x41
push 0x1e
push 0
push 0x28
push 0x28
push 0x13c
mov ecx, edi
mov dword [ebp - 0x350], edi
mov byte [ebp - 0x34c], 0
call fcn.00436420
push eax
mov ecx, esi
call fcn.005c0240
push 0
push str.Windows_information
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x370], eax
call fcn.0045b370
push 0xffffffffffffffff
push 0x10000100
push 0x35
push 0xf0
push 0x3c
push 0x4b
push str.Retrieving_info__r_nplease_wait...
mov ecx, esi
call fcn.005c0890
push ecx
push 0xffffffffffffffff
push 0x1e
push 0x1e
push 0x46
push 0x140
push 0
mov ecx, esi
mov dword [ebp - 0x348], eax
call fcn.005c0240
push ecx
push 0xffffffffffffffff
push 0x28
push 0x28
push 0x41
push 0x190
push 0
push 0x28
push 0x28
push 0x136
mov ecx, edi
mov dword [ebp - 0x344], eax
call fcn.00436420
push eax
mov ecx, esi
call fcn.005c0240
push 0
push str.Security_information
push 0xffffffffffffffff
mov ecx, edi
call fcn.0045b370
push 0xffffffffffffffff
push 0x10000100
push 0x35
push 0xf0
push 0x3c
push 0x1bd
push str.Retrieving_info__r_nplease_wait...
mov ecx, esi
call fcn.005c0890
push ecx
push 0xffffffffffffffff
push 0x1e
push 0x1e
push 0x46
push 0x2b2
push 0
mov ecx, esi
mov dword [ebp - 0x33c], eax
call fcn.005c0240
push ecx
push 0xffffffffffffffff
push 0x28
push 0x28
push 0x82
push 0x1e
push 0
push 0x28
push 0x28
push 0x131
mov ecx, edi
mov dword [ebp - 0x338], eax
call fcn.00436420
push eax
mov ecx, esi
call fcn.005c0240
push 0
push str.Motherboard
push 0xffffffffffffffff
mov ecx, edi
call fcn.0045b370
push 0xffffffffffffffff
push 0x10000100
push 0x35
push 0xf0
push 0x7d
push 0x4b
push str.Retrieving_info__r_nplease_wait...
mov ecx, esi
call fcn.005c0890
push ecx
push 0xffffffffffffffff
push 0x1e
push 0x1e
push 0x87
push 0x140
push 0
mov ecx, esi
mov dword [ebp - 0x334], eax
call fcn.005c0240
push ecx
push 0xffffffffffffffff
push 0x28
push 0x28
push 0x82
push 0x190
push 0
push 0x28
push 0x28
push 0x135
mov ecx, edi
mov dword [ebp - 0x330], eax
call fcn.00436420
push eax
mov ecx, esi
call fcn.005c0240
push 0
push str.Storage
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x324], eax
call fcn.0045b370
push 0xffffffffffffffff
push 0x10000100
push 0x35
push 0xf0
push 0x7d
push 0x1bd
push str.Retrieving_info__r_nplease_wait...
mov ecx, esi
call fcn.005c0890
push ecx
push 0xffffffffffffffff
push 0x1e
push 0x1e
push 0x87
push 0x2b2
push 0
mov ecx, esi
mov dword [ebp - 0x32c], eax
call fcn.005c0240
push ecx
push 0xffffffffffffffff
push 0x28
push 0x28
push 0xc3
push 0x1e
push 0
push 0x28
push 0x28
push 0x133
mov ecx, edi
mov dword [ebp - 0x328], eax
call fcn.00436420
push eax
mov ecx, esi
call fcn.005c0240
push 0
push str.Processor__CPU_
push 0xffffffffffffffff
mov ecx, edi
call fcn.0045b370
push 0xffffffffffffffff
push 0x10000100
push 0x35
push 0xf0
push 0xbe
push 0x4b
push str.Retrieving_info__r_nplease_wait...
mov ecx, esi
call fcn.005c0890
push ecx
push 0xffffffffffffffff
push 0x1e
push 0x1e
push 0xc8
push 0x140
push 0
mov ecx, esi
mov dword [ebp - 0x320], eax
call fcn.005c0240
push ecx
push 0xffffffffffffffff
push 0x28
push 0x28
push 0xc3
push 0x190
push 0
push 0x28
push 0x28
push 0x132
mov ecx, edi
mov dword [ebp - 0x31c], eax
call fcn.00436420
push eax
mov ecx, esi
call fcn.005c0240
push 0
push str.Memory__RAM_
push 0xffffffffffffffff
mov ecx, edi
call fcn.0045b370
push 0xffffffffffffffff
push 0x10000100
push 0x35
push 0xf0
push 0xbe
push 0x1bd
push str.Retrieving_info__r_nplease_wait...
mov ecx, esi
call fcn.005c0890
push ecx
push 0xffffffffffffffff
push 0x1e
push 0x1e
push 0xc8
push 0x2b2
push 0
mov ecx, esi
mov dword [ebp - 0x318], eax
call fcn.005c0240
push ecx
push 0xffffffffffffffff
push 0x28
push 0x28
push 0x104
push 0x1e
push 0
push 0x28
push 0x28
push 0x137
mov ecx, edi
mov dword [ebp - 0x314], eax
call fcn.00436420
push eax
mov ecx, esi
call fcn.005c0240
push 0
push str.Craphics_card
push 0xffffffffffffffff
mov ecx, edi
call fcn.0045b370
push 0xffffffffffffffff
push 0x10000100
push 0x35
push 0xf0
push 0xff
push 0x4b
push str.Retrieving_info__r_nplease_wait...
mov ecx, esi
call fcn.005c0890
push ecx
push 0xffffffffffffffff
push 0x1e
push 0x1e
push 0x109
push 0x140
push 0
mov ecx, esi
mov dword [ebp - 0x310], eax
call fcn.005c0240
push ecx
push 0xffffffffffffffff
push 0x28
push 0x28
push 0x104
push 0x190
push 0
push 0x28
push 0x28
push 0x141
mov ecx, edi
mov dword [ebp - 0x30c], eax
call fcn.00436420
push eax
mov ecx, esi
call fcn.005c0240
push 0
push str.Windows_update_and_battery_state__unrelated_
push 0xffffffffffffffff
mov ecx, edi
call fcn.0045b370
push 0xffffffffffffffff
push 0x10000100
push 0x35
push 0xf0
push 0xff
push 0x1bd
push str.Retrieving_info__r_nplease_wait...
mov ecx, esi
call fcn.005c0890
push ecx
push 0xffffffffffffffff
push 0x1e
push 0x1e
push 0x109
push 0x2b2
push 0
mov ecx, esi
mov dword [ebp - 0x308], eax
call fcn.005c0240
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x73
push 0x14f
push 0x46
push str.Available_fixes:
mov ecx, esi
mov dword [ebp - 0x304], eax
call fcn.005c0890
sub esp, 8
mov ecx, esi
push 0x10000043
push 0x19
push 0xfa
push 0x14a
push 0xbe
push 0
call fcn.005c1650
push 0
push ecx
mov dword [esp], 0x41500000
mov dword [ebp - 0x340], eax
push str.Rescan_and_update_all_fields
push 0x1e
push 0x96
push 0x147
push 0x212
push 0x8d
push str.Refresh
mov ecx, edi
call fcn.0045fd50
push 0
push 0
mov dword [ebp - 0x378], eax
lea eax, [ebp - 0x350]
push eax
push 0x477340
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x368], esi
mov dword [ebp - 0x2f4], esi
push 0
push 0x18
push 0x40
push 0x13d
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00436420
push eax
lea ecx, [ebp - 0x2fc]
call fcn.005c6520
push 0
push 0x18
push 0x40
push 0x13e
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00436420
push eax
lea ecx, [ebp - 0x2f8]
call fcn.005c6520
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x30], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x58]
movq qword [ebp - 0x58], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0
lea ecx, [ebp - 0x6c]
movq qword [ebp - 0x6c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x44]
movq qword [ebp - 0x44], xmm0
call fcn.005dc5e0
push 0
push 0x2001f
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x38]
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerImmunization
mov dword [ebp - 0x38], 0
call fcn.005d6a80
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 7
push eax
push str.Immunize_all_users
lea ecx, [ebp - 0x38]
call fcn.005d66b0
lea ecx, [ebp - 0x30]
test al, al
je 0x46cc66
push dword [ebp - 0x48]
call fcn.005db290
jmp 0x46cc70
push 0x62796c
call fcn.005dc510
lea eax, [ebp - 0x58]
push eax
push str.Immunized
lea ecx, [ebp - 0x38]
call fcn.005d6740
test al, al
jne 0x46cc92
push 0x62439c
lea ecx, [ebp - 0x58]
call fcn.005dc510
lea eax, [ebp - 0x6c]
push eax
push str.PreviouslyImmunized
lea ecx, [ebp - 0x38]
call fcn.005d6740
test al, al
jne 0x46ccb4
push 0x62439c
lea ecx, [ebp - 0x6c]
call fcn.005dc510
mov ecx, dword [ebp - 0x358]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x21c
push 0x186
push 0x46
push str.System_immunization_is___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.
call fcn.005c0890
sub esp, 0x14
push 0x182
push ecx
push dword [ebp - 0x2f8]
mov ecx, dword [ebp - 0x358]
push dword [ebp - 0x2fc]
call fcn.005c10a0
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x36c], eax
call fcn.005dc3a0
xor ecx, ecx
cmp eax, 2
setle cl
lea ecx, [ecx*4 + 4]
push ecx
mov ecx, dword [ebp - 0x358]
push 0xffffffffffffffff
call fcn.005bd3f0
mov ecx, dword [ebp - 0x358]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x21c
push 0x1ae
push 0x46
push str.Execute_Prevent_is___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.___.
call fcn.005c0890
sub esp, 0x14
push 0x1aa
push ecx
push dword [ebp - 0x2f8]
mov ecx, dword [ebp - 0x358]
push dword [ebp - 0x2fc]
call fcn.005c10a0
xor edx, edx
mov dword [ebp - 0x360], eax
mov ecx, str.HKLM64SOFTWAREPoliciesMicrosoftWindows_saferExecutePreventBackup
call fcn.005d3780
test al, al
jne 0x46cde2
xor edx, edx
mov ecx, str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backupsExecute_Preventcodeidentifiers
call fcn.005d3780
test al, al
je 0x46cde2
lea ecx, [edi + 0x1290]
push 6
call fcn.0055e910
test al, al
je 0x46cdd1
push 0xc
push str.HKLM64SOFTWAREPoliciesMicrosoftWindows_safer
lea ecx, [edi + 0x1290]
call fcn.0055e500
push 0
mov edx, str.HKLM64SOFTWAREPoliciesMicrosoftWindows_saferExecutePreventBackup
mov ecx, str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backupsExecute_Preventcodeidentifiers
call fcn.005d3c40
push 0xd
push str.HKLM64SOFTWAREPoliciesMicrosoftWindows_safer
lea ecx, [edi + 0x1290]
call fcn.0055e500
jmp 0x46cde2
push 0
mov edx, str.HKLM64SOFTWAREPoliciesMicrosoftWindows_saferExecutePreventBackup
mov ecx, str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backupsExecute_Preventcodeidentifiers
call fcn.005d3c40
push 0
call fcn.004b12d0
xor ecx, ecx
test eax, eax
setle cl
lea ecx, [ecx*4 + 4]
push ecx
push dword [ebp - 0x360]
mov ecx, dword [ebp - 0x358]
call fcn.005bd3f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [edi + 0x1290]
mov dword [ebp - 0x34], 0
push str.UVKUltra_Adware_KilleruakScan.txt
push ecx
mov ecx, eax
mov dword [ebp - 0x35c], 0
mov dword [ebp - 0x24], eax
call fcn.0057c490
push eax
lea ecx, [ebp - 0x30]
call fcn.005dc200
push 0x260
lea eax, [ebp - 0x2f0]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x30]
call fcn.005dc190
push 0x250
mov edi, eax
lea eax, [ebp - 0x2f0]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea eax, [ebp - 0x2f0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edx, eax
mov dword [ebp - 0xa0], edx
cmp edx, 0xffffffff
je 0x46cf34
mov ecx, 3
mov dword [ebp - 0x9c], ecx
cmp word [ebp - 0x2c4], 0x2e
jne 0x46ced9
mov ax, word [ebp - 0x2c2]
test ax, ax
je 0x46cf03
cmp ax, 0x2e
jne 0x46ced9
cmp word [ebp - 0x2c0], 0
je 0x46cf03
test ecx, ecx
je 0x46cf34
mov eax, dword [ebp - 0x2f0]
test cl, 1
je 0x46ceef
test eax, 0x400
jne 0x46cf03
test cl, 2
je 0x46cefa
test al, 0x10
je 0x46cf34
jmp 0x46cf03
test cl, 4
je 0x46cf34
test al, 0x10
jne 0x46cf34
lea eax, [ebp - 0x2f0]
push eax
push edx
call edi
test eax, eax
je 0x46cf1f
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0xa0]
jmp 0x46ceb3
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_FindClose]
or edx, 0xffffffff
mov dword [ebp - 0xa0], edx
mov byte [ebp - 4], 8
cmp edx, 0xffffffff
jne 0x46d014
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Ultra_Adware_KilleruakScan.txt
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.0057c490
push eax
lea ecx, [ebp - 0x30]
call fcn.005dc200
lea ecx, [ebp - 0x30]
call fcn.005dc190
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x46cf8c
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x2f0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, eax
mov dword [ebp - 0xa0], edx
cmp edx, 0xffffffff
je 0x46d0b5
mov ecx, 3
mov dword [ebp - 0x9c], ecx
cmp word [ebp - 0x2c4], 0x2e
jne 0x46cfe4
mov ax, word [ebp - 0x2c2]
test ax, ax
je 0x46d080
cmp ax, 0x2e
jne 0x46cfe4
cmp word [ebp - 0x2c0], 0
je 0x46d080
test ecx, ecx
je 0x46d00b
mov eax, dword [ebp - 0x2f0]
test cl, 1
je 0x46cffe
test eax, 0x400
jne 0x46d080
test cl, 2
je 0x46d077
test al, 0x10
jne 0x46d080
cmp edx, 0xffffffff
je 0x46d0b5
push 7
push 1
lea eax, [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x30]
call fcn.005dc260
mov ecx, eax
call fcn.005dad50
mov ecx, eax
call fcn.005db080
cmp dword [ebp - 0x35c], edx
ja 0x46d04d
jb 0x46d044
cmp dword [ebp - 0x34], eax
jae 0x46d04d
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x35c], edx
mov eax, dword [ebp - 0xa0]
cmp eax, 0xffffffff
je 0x46d0b5
lea ecx, [ebp - 0x2f0]
push ecx
push eax
call edi
test eax, eax
je 0x46d09f
lea ecx, [ebp - 0x2f0]
call fcn.004011a0
test al, al
jne 0x46d014
jmp 0x46d0b5
test cl, 4
je 0x46d00b
test al, 0x10
jne 0x46d00b
lea eax, [ebp - 0x2f0]
push eax
push edx
call edi
test eax, eax
je 0x46d09f
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0xa0]
jmp 0x46cfb6
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0xa0], 0xffffffff
mov ecx, dword [ebp - 0x35c]
mov eax, dword [ebp - 0x34]
test ecx, ecx
jne 0x46d0c9
cmp eax, 0x15180
jbe 0x46d11f
mov dword [ebp - 0x5c], ecx
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], eax
call fcn.005d0520
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x262
push 0x1d1
push 0x46
sub esp, 0xc
lea ecx, [ebp - 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Last_threat_scan_performed_the
call fcn.005da510
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x358]
push eax
call fcn.005c0890
mov edi, dword [ebp - 0x374]
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Start_a_new_threat_scan_now
push 0x1e
push 0x96
push 0x1f4
push 0x168
push 0x68
push str.Start_threat_scan
call fcn.0045fd50
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Cancel_the_operation_and_go_back_to_the_Home_page.
push 0x1e
push 0x96
push 0x1f4
push 0x212
push 0xb3
push str.Home
mov dword [ebp - 0x5c], eax
call fcn.0045fd50
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Show_online_help__F1_
push 0x1b
push 0x46
push 0xa
push 0x29e
push 0x7d
push str.Help
mov dword [edi + 0x11c0], eax
call fcn.0045fd50
push 1
push str.https:__www.carifred.com_uvk_help_health_check.php
lea ecx, [edi + 0x119c]
mov dword [edi + 0x11bc], eax
call fcn.005dc260
mov ecx, edi
call fcn.0045f300
mov ecx, dword [ebp - 0x358]
mov eax, 0x1b
mov word [ebp - 0x1e], ax
movzx eax, word [edi + 0x11c0]
mov word [ebp - 0x1c], ax
mov eax, 0x70
mov word [ebp - 0x18], ax
movzx eax, word [edi + 0x11bc]
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x20]
push 2
push eax
mov byte [ebp - 0x20], 1
mov byte [ebp - 0x1a], 1
call fcn.005c47a0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 0x351], 0
mov dword [ebp - 0x4c], 0
call fcn.005d6aa0
push 0
mov ecx, edi
mov byte [ebp - 4], 9
call fcn.004771c0
test eax, eax
je 0x46df65
mov ecx, dword [edi + 0x14a8]
cmp ecx, 0xfffffffa
je 0x46df65
mov eax, dword [ebp - 0x358]
cmp dword [edi + 0x14d8], eax
jne 0x46df54
cmp ecx, 0xffffffbf
jne 0x46dab6
mov edx, dword [ebp - 0x340]
cmp dword [edi + 0x14b4], edx
jne 0x46dab6
push 0
push 0
push 0x157
push edx
mov ecx, eax
call fcn.005befd0
test eax, eax
je 0x46d2c2
mov esi, dword [ebp - 0x358]
push 3
push 1
mov ecx, edi
call fcn.0043d720
push 0
push 0
push 0x157
push dword [ebp - 0x340]
mov ecx, esi
call fcn.005befd0
test eax, eax
jne 0x46d297
mov esi, dword [ebp - 0x368]
push dword [ebp - 0x340]
mov ecx, dword [ebp - 0x358]
call fcn.005bc230
push eax
lea ecx, [ebp - 0x30]
call fcn.005dc1c0
push 0xd
push 0
push dword [edi + 0x11c0]
xorps xmm0, xmm0
mov dword [ebp - 0x35c], 0xffffffff
push dword [ebp - 0x370]
lea ecx, [ebp - 0x8c]
push dword [ebp - 0x358]
movups xmmword [ebp - 0x8c], xmm0
movups xmmword [ebp - 0x7c], xmm0
call fcn.005b8800
push str.Upgrade_Reinstall_Windows_10
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xa
call fcn.005dc4c0
test al, al
je 0x46d3be
sub esp, 8
mov ecx, edi
push 0
push 0xffffffffffffffb0
push 0
push str.Cancel
sub esp, 8
push 0x46
push 0x1c2
push dword [ebp - 0x358]
push 0x62439c
call fcn.0043da60
mov ecx, eax
call fcn.005b64a0
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b62b0
lea ecx, [edi + 0x1290]
call fcn.00578220
test eax, eax
jne 0x46d9af
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push eax
push eax
push 4
push str.Sorry__we_could_not_download_and_run_the_Windows_install_media_creator.
call fcn.0043e2e0
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x46df54
push str.Check_compatibility_with_Windows_11
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d463
sub esp, 8
mov ecx, edi
push 0
push 0xffffffffffffffb0
push 0
push str.Cancel
sub esp, 8
push 0x46
push 0x1c2
push dword [ebp - 0x358]
push 0x62439c
call fcn.0043da60
mov ecx, eax
call fcn.005b64a0
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b62b0
lea ecx, [edi + 0x1290]
call fcn.00577ec0
test eax, eax
jne 0x46d9af
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push eax
push eax
push 4
push str.Sorry__we_could_not_download_and_run_the_Windows_PCHealthCheck_tool.
call fcn.0043e2e0
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x46df54
push str.Upgrade_Reinstall_Windows_11
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d508
sub esp, 8
mov ecx, edi
push 0
push 0xffffffffffffffb0
push 0
push str.Cancel
sub esp, 8
push 0x46
push 0x1c2
push dword [ebp - 0x358]
push 0x62439c
call fcn.0043da60
mov ecx, eax
call fcn.005b64a0
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b62b0
lea ecx, [edi + 0x1290]
call fcn.00577d10
test eax, eax
jne 0x46d9af
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push eax
push eax
push 4
push str.Sorry__we_could_not_download_and_run_the_Windows_11_installation_assistant.
call fcn.0043e2e0
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x46df54
push str.Download_an_Antivirus_application
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d528
push ecx
push 5
push 0
mov ecx, str.https:__www.majorgeeks.com_mg_sortdate_all_in_one_anti_virus_suites.html
jmp 0x46d9a8
push str.Enable_Windows_Defender_Antivirus
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d607
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
push 4
push str.DisableAntiSpyware
push str.HKLMSOFTWAREPoliciesMicrosoftWindows_Defender
lea ecx, [ebp - 0x4c]
call fcn.005d5be0
sub esp, 8
movzx eax, al
mov dword [ebp - 0x35c], eax
mov ecx, edi
push 0x8c
push 0x190
push 0
push 0
push 4
test eax, eax
je 0x46d600
push str.Windows_defender_was_successfully_enabled.
call fcn.0043e2e0
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
cmp dword [ebp - 0x35c], 1
jl 0x46d5ec
push 0
push 0
lea eax, [ebp - 0x350]
push eax
push 0x477340
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x24], eax
cmp esi, 0xffffffff
je 0x46d5d4
test esi, esi
je 0x46d5d4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov esi, eax
test eax, eax
mov eax, 0xffffffff
cmove esi, eax
mov dword [ebp - 0x368], esi
mov dword [ebp - 0x2f4], esi
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x46df54
push str.Windows_defender_could_not_be_enabled_this_time.
jmp 0x46d589
push str.Uninstall_the_extra_Antivirus
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d6ba
lea eax, [ebp - 0x30]
push eax
push str.InstallDir
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x4c]
call fcn.005d65d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test al, al
je 0x46d663
push 0
push 0
push str.UVK_en.exe__SmartUninstaller
push ecx
lea ecx, [ebp - 0x30]
call fcn.005da0a0
mov ecx, eax
call fcn.005da780
jmp 0x46d682
push str._appwiz.cpl
push str._rundll32.exe_shell32.dll_Control_RunDLL
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057c540
push eax
lea ecx, [ebp - 0x30]
call fcn.005dc200
push 2
push 5
push 0
lea ecx, [ebp - 0x30]
call fcn.005dc190
mov edx, eax
xor ecx, ecx
call fcn.005e2a10
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x46df54
push str.Enable_Windows_Firewall
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d733
push 0
push 0
push str.Disable_the_Windows_Firewall
lea ecx, [edi + 0x1290]
call fcn.0054f030
sub esp, 8
mov dword [ebp - 0x35c], eax
mov ecx, edi
push 0x8c
push 0x190
push 0
push 0
push 4
test eax, eax
je 0x46d708
push str.The_Windows_Firewall_was_successfully_enabled.
jmp 0x46d589
push str.The_Windows_Firewall_could_not_be_enabled_this_time.
call fcn.0043e2e0
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x46df54
push str.Enable_the_User_Account_Control
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d7a3
lea ecx, [edi + 0x1290]
call fcn.005718a0
sub esp, 8
mov dword [ebp - 0x35c], eax
mov ecx, edi
push 0x8c
push 0x190
push 0
push 0
push 4
test eax, eax
je 0x46d778
push str.The_user_account_control_was_successfully_enabled.
jmp 0x46d589
push str.The_user_account_control_could_not_be_enabled_this_time.
call fcn.0043e2e0
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x46df54
push str.Enable_the_System_Restore
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d816
push ecx
push 0
lea ecx, [edi + 0x1290]
call fcn.00571730
sub esp, 8
mov dword [ebp - 0x35c], eax
mov ecx, edi
push 0x8c
push 0x190
push 0
push 0
push 4
test eax, eax
je 0x46d7eb
push str.The_system_restore_was_successfully_enabled.
jmp 0x46d589
push str.The_system_restore_could_not_be_enabled_this_time.
call fcn.0043e2e0
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x46df54
push str.How_to_upgrade_from_an_HDD_to_an_SSD
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d83a
push str.https:__www.laptopmag.com_articles_ssd_upgrade_tutorial
lea eax, [ebp - 0x44]
push eax
push str.SSDUpgradeURL
jmp 0x46d992
push str.How_to_replace_your_storage_device
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d85e
push str.https:__www.techradar.com_news_upgrades_computing_components_storage_how_to_replace_your_hard_drive_without_losing_data_488892
lea eax, [ebp - 0x44]
push eax
push str.ReplaceHDDURL
jmp 0x46d992
push str.How_to_replace_a_laptop_batery
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d882
push str.https:__www.computeruniverse.net_en_techblog_replace_laptop_battery
lea eax, [ebp - 0x44]
push eax
push str.ReplaceBattURL
jmp 0x46d992
push str.Free_storage_space
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d8a9
lea ecx, [edi + 0x1290]
call fcn.0055acb0
mov dword [ebp - 0x35c], eax
jmp 0x46d58e
push str.How_to_upgrade_your_CPU
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d8f8
push str.https:__www.tomsguide.com_us_how_to_upgrade_cpu_news_30226.html
lea eax, [ebp - 0x44]
mov ecx, edi
push eax
push str.CPUUpgradeURL1
call fcn.00438860
push ecx
push 5
push 0
lea ecx, [ebp - 0x44]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005e2950
push str.https:__www.pcworld.com_article_148910_laptop_cpu.html
lea eax, [ebp - 0x44]
push eax
push str.CPUUpgradeURL2
jmp 0x46d992
push str.How_to_upgrade_your_RAM
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d944
push str.https:__www.pcworld.com_article_2957195_how_to_install_new_memory_in_your_pc.html
lea eax, [ebp - 0x44]
mov ecx, edi
push eax
push str.RAMUpgradeURL
call fcn.00438860
push ecx
push 5
push 0
lea ecx, [ebp - 0x44]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005e2950
push str.https:__www.laptopmag.com_articles_ram_upgrade_tutorial
lea eax, [ebp - 0x44]
push eax
push str.RAMUpgradeURL2
jmp 0x46d992
push str.How_to_upgrade_your_graphics_card
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d9d0
push str.https:__www.tomsguide.com_us_how_to_upgrade_cpu_news_30226.html
lea eax, [ebp - 0x44]
mov ecx, edi
push eax
push str.GPUUpgradeURL
call fcn.00438860
push ecx
push 5
push 0
lea ecx, [ebp - 0x44]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005e2950
push str.https:__www.pcworld.com_article_148909_maxlap.htmlslide1
lea eax, [ebp - 0x44]
push eax
push str.GPUUpgradeURL2
mov ecx, edi
call fcn.00438860
push ecx
push 5
push 0
lea ecx, [ebp - 0x44]
call fcn.005dc190
mov ecx, eax
xor edx, edx
call fcn.005e2950
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x46df54
push str.Enable_Windows_updates
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46da2a
push 0
push 0
push str.Disable_Windows_automatic_updates
lea ecx, [edi + 0x1290]
call fcn.0054f030
sub esp, 8
mov dword [ebp - 0x35c], eax
mov ecx, edi
push 0x8c
push 0x190
push 0
push 0
push 4
test eax, eax
je 0x46da1e
push str.The_Windows_Automatic_Updates_were_successfully_enabled.
jmp 0x46d589
push str.The_Windows_Automatic_Updates_could_not_be_enabled_this_time.
call fcn.0043e2e0
jmp 0x46d9af
push str.Update_Windows_with_WAU_Manager
lea ecx, [ebp - 0x30]
call fcn.005dc4c0
test al, al
je 0x46d58e
sub esp, 8
mov ecx, edi
push 0
push 0xffffffffffffffb0
push 0
push str.Cancel
sub esp, 8
push 0x46
push 0x1c2
push dword [ebp - 0x358]
push str.Updating_Windows_with_WAU_Manager...
call fcn.0043da60
mov ecx, eax
call fcn.005b64a0
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b62b0
push 0
push ecx
push 1
push 0xb
mov ecx, edi
call fcn.0046a8d0
test eax, eax
jne 0x46d58e
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push eax
push eax
push 4
push str.Sorry__we_could_not_run_WAU_Manager.
call fcn.0043e2e0
jmp 0x46d9af
cmp ecx, dword [ebp - 0x5c]
je 0x46e044
cmp ecx, dword [ebp - 0x378]
jne 0x46db3e
cmp esi, 0xffffffff
je 0x46dae4
test esi, esi
je 0x46dae4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x46df54
push 0
push 0
lea eax, [ebp - 0x350]
push eax
push 0x477340
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x24], eax
cmp esi, 0xffffffff
je 0x46db14
test esi, esi
je 0x46db14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov esi, eax
mov dword [ebp - 0x368], esi
mov dword [ebp - 0x2f4], esi
test eax, eax
jne 0x46df54
or esi, 0xffffffff
mov dword [ebp - 0x368], esi
mov dword [ebp - 0x2f4], esi
jmp 0x46df54
cmp ecx, dword [ebp - 0x36c]
jne 0x46dce0
lea ecx, [ebp - 0x6c]
call fcn.005dc400
mov ecx, dword [ebp - 0x358]
push 4
push dword [ebp - 0x36c]
call fcn.005bc500
mov edi, eax
xor eax, eax
test edi, edi
push ecx
setne al
lea ecx, [ebp - 0x38]
push 0xffffffffffffffff
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerImmunization
lea eax, [eax*4 + 4]
mov dword [ebp - 0x24], eax
call fcn.005d6a30
test edi, edi
jne 0x46dbf4
lea eax, [ebp - 0x58]
push eax
push str.PreviouslyImmunized
lea ecx, [ebp - 0x38]
call fcn.005d6740
push 1
push edi
push 0x62794c
push 0x628eec
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x62794c
lea ecx, [ebp - 0x58]
call fcn.005dc190
push eax
push 0x62794c
lea ecx, [ebp - 0x58]
call fcn.005dc200
mov ecx, eax
call fcn.005da270
mov ecx, eax
call fcn.005dc3a0
cmp eax, 3
jge 0x46dc01
mov edi, dword [ebp - 0x374]
mov al, 0x11
mov byte [ebp - 0x351], al
jmp 0x46df6b
push 0x628eec
lea ecx, [ebp - 0x58]
call fcn.005dc510
mov edi, dword [ebp - 0x374]
lea ecx, [ebp - 0x8c]
push 0xd
push 0
xorps xmm0, xmm0
push dword [edi + 0x11c0]
movups xmmword [ebp - 0x8c], xmm0
push dword [ebp - 0x370]
movups xmmword [ebp - 0x7c], xmm0
push dword [ebp - 0x358]
call fcn.005b8800
sub esp, 8
mov byte [ebp - 4], 0xb
mov ecx, edi
push 0
push 0xffffffffffffffb0
sub esp, 8
push 0x46
push 0x1c2
push dword [ebp - 0x358]
push 0x62439c
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b62b0
lea eax, [ebp - 0x48]
push eax
push str.Immunize_all_users
lea ecx, [ebp - 0x38]
call fcn.005d66b0
test al, al
je 0x46dc87
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x46dc8a
mov eax, dword [ebp - 0x48]
test eax, eax
lea ecx, [ebp - 0x58]
setne al
movzx eax, al
push eax
call fcn.005dc190
push eax
lea ecx, [edi + 0x1290]
call fcn.0055e210
test eax, eax
je 0x46dcbf
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0x358]
push dword [ebp - 0x36c]
call fcn.005bd3f0
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x46df54
mov edx, dword [ebp - 0x360]
cmp ecx, edx
jne 0x46df48
push 8
push edx
mov ecx, eax
call fcn.005bc500
mov ecx, eax
xorps xmm0, xmm0
push 0xd
xor eax, eax
mov dword [ebp - 0x35c], ecx
push 0
push dword [edi + 0x11c0]
test ecx, ecx
lea ecx, [ebp - 0x8c]
push dword [ebp - 0x370]
sete al
push dword [ebp - 0x358]
movups xmmword [ebp - 0x8c], xmm0
lea eax, [eax*4 + 4]
mov dword [ebp - 0x24], eax
movups xmmword [ebp - 0x7c], xmm0
call fcn.005b8800
cmp dword [ebp - 0x35c], 0
mov byte [ebp - 4], 0xc
je 0x46dd9b
push 1
call fcn.004b12d0
test eax, eax
jne 0x46dd9b
push eax
mov ecx, edi
call fcn.004b1460
push 0
call fcn.004b12d0
xor ecx, ecx
test eax, eax
setle cl
lea ecx, [ecx*4 + 4]
push ecx
push dword [ebp - 0x360]
mov ecx, dword [ebp - 0x358]
call fcn.005bd3f0
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x46df54
cmp dword [ebp - 0x35c], 0
mov ecx, str.Disabling
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, str.Enabling
cmove eax, ecx
lea ecx, [ebp - 0x30]
push str._Execute_Prevent...
push eax
call fcn.005dc200
sub esp, 8
lea ecx, [ebp - 0x30]
push 0
push 0xffffffffffffffb0
sub esp, 8
push 0x46
push 0x1c2
push dword [ebp - 0x358]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b62b0
push 6
lea ecx, [edi + 0x1290]
call fcn.0055e910
mov byte [ebp - 0x361], al
test al, al
je 0x46de2f
push 0xc
push str.HKLM64SOFTWAREPoliciesMicrosoftWindows_safer
lea ecx, [edi + 0x1290]
call fcn.0055e500
xor esi, esi
push 1
mov ecx, edi
call fcn.004771c0
test eax, eax
jne 0x46de31
push 3
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x46de31
mov esi, dword [ebp - 0x368]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], 0
call fcn.005d6aa0
cmp dword [ebp - 0x35c], 0
mov byte [ebp - 4], 0xd
push 0
je 0x46de96
mov edx, str.HKLM64SOFTWAREPoliciesMicrosoftWindows_safercodeidentifiers
mov ecx, str.HKLM64SOFTWAREPoliciesMicrosoftWindows_saferExecutePreventBackup
call fcn.005d3c40
push 0
push str.HKLM64SOFTWAREPoliciesMicrosoftWindows_saferExecutePreventBackup
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x35c], eax
call fcn.005d55d0
jmp 0x46dee6
push str.HKLM64SOFTWAREPoliciesMicrosoftWindows_saferExecutePreventBackup
lea ecx, [ebp - 0x34]
call fcn.005d55d0
push 0
mov edx, str.HKLM64SOFTWAREPoliciesMicrosoftWindows_saferExecutePreventBackup
mov ecx, str.HKLM64SOFTWAREPoliciesMicrosoftWindows_safercodeidentifiers
call fcn.005d3c40
mov dword [ebp - 0x35c], eax
call fcn.004af0e0
add dword [ebp - 0x35c], eax
lea ecx, [ebp - 0x34]
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0
push eax
push 4
push str.ExecutePreventFlag
push str.HKLM64SOFTWAREPoliciesMicrosoftWindows_safercodeidentifiers
call fcn.005d5e20
cmp byte [ebp - 0x361], 0
je 0x46df01
push 0xd
push str.HKLM64SOFTWAREPoliciesMicrosoftWindows_safer
lea ecx, [edi + 0x1290]
call fcn.0055e500
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
cmp dword [ebp - 0x35c], 0
je 0x46e00a
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0x358]
push dword [ebp - 0x360]
call fcn.005bd3f0
lea ecx, [ebp - 0x34]
call fcn.005d69e0
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x46df54
cmp ecx, dword [edi + 0x11c0]
je 0x46e037
push 0
mov ecx, edi
call fcn.004771c0
test eax, eax
jne 0x46d240
mov al, byte [ebp - 0x351]
test al, al
mov ecx, edi
sete al
movzx eax, al
push eax
call fcn.0045f260
movzx edi, byte [ebp - 0x351]
lea ecx, [ebp - 0x4c]
call fcn.005d69e0
mov eax, dword [ebp - 0xa0]
cmp eax, 0xffffffff
je 0x46df9c
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x38]
call fcn.005d69e0
lea ecx, [ebp - 0x44]
call fcn.005dc430
lea ecx, [ebp - 0x6c]
call fcn.005dc430
lea ecx, [ebp - 0x58]
call fcn.005dc430
lea ecx, [ebp - 0x30]
call fcn.005dc430
lea ecx, [ebp - 0x2f8]
call fcn.005c6500
lea ecx, [ebp - 0x2fc]
call fcn.005c6500
cmp esi, 0xffffffff
je 0x46dfea
test esi, esi
je 0x46dfea
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x351], 0x11
mov dword [edi + 0x1f70], 1
call fcn.005d69e0
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x46df65
mov al, 1
mov byte [ebp - 0x351], al
jmp 0x46df6b
mov al, 0x13
mov dword [edi + 0x1f70], 1
mov byte [ebp - 0x351], al
jmp 0x46df6b