Function at 0x1001c8c0
Capabilities:
Contain obfuscated stackstrings
Gather cuteftp information
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10074f6b
mov eax, dword fs:[0]
push eax
sub esp, 0x208
push esi
push edi
mov eax, dword [0x1009e034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], 0x100a55ec
mov dword [0x100a55ec], 0
mov dword [0x100a55f0], 0
mov dword [0x100a55f4], 0
push 1
push str.7_Zip
mov dword [ebp - 4], 0
call fcn.1001db00
mov esi, eax
push 8
push str.7zFm.exe
lea ecx, [esi + 0x20]
call fcn.10003de0
push 0x24
xor eax, eax
push str.HKCUSoftware7_ZipFM_FolderHistory
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.10003de0
mov byte [ebp - 4], 1
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 2
call fcn.100245c0
cmp dword [ebp - 0x10], 8
mov edi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
jb 0x1001c9a8
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001c9cd
push dword [ebp - 0x40]
call edi
add esp, 4
push 0x20
xor eax, eax
push str.HKCUSoftware7_ZipFM_PanelPath
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.10003de0
mov byte [ebp - 4], 3
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 4
call fcn.100245c0
cmp dword [ebp - 0x10], 8
jb 0x1001ca3c
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001ca61
push dword [ebp - 0x40]
call edi
add esp, 4
push 1
push str.Acrobat_Reader
call fcn.1001db00
mov esi, eax
push 0x40
xor eax, eax
push str.HKCUSoftwareAdobeAcrobat_Reader4.0AdobeViewer_avpRecentFile
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.10003de0
mov byte [ebp - 4], 5
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
add esi, 0x38
push eax
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.100245c0
cmp dword [ebp - 0x10], 8
jb 0x1001cae0
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001cb05
push dword [ebp - 0x40]
call edi
add esp, 4
push 0x3f
xor eax, eax
push str.HKCUSoftwareAdobeAcrobat_Reader5.0AVGeneralcRecentFiles_c
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.10003de0
mov byte [ebp - 4], 7
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.100245c0
cmp dword [ebp - 0x10], 8
jb 0x1001cb73
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001cb98
push dword [ebp - 0x40]
call edi
add esp, 4
push 0x41
xor eax, eax
push str.HKCUSoftwareAdobeAcrobat_Reader6.0AVGeneralcRecentFiles_all
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.10003de0
mov byte [ebp - 4], 9
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov byte [ebp - 4], 0xa
call fcn.100245c0
cmp dword [ebp - 0x10], 8
jb 0x1001cc06
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001cc2b
push dword [ebp - 0x40]
call edi
add esp, 4
push 0x41
xor eax, eax
push str.HKCUSoftwareAdobeAcrobat_Reader7.0AVGeneralcRecentFiles_all
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.10003de0
mov byte [ebp - 4], 0xb
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov byte [ebp - 4], 0xc
call fcn.100245c0
cmp dword [ebp - 0x10], 8
jb 0x1001cc99
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001ccbe
push dword [ebp - 0x40]
call edi
add esp, 4
push 0x41
xor eax, eax
push str.HKCUSoftwareAdobeAcrobat_Reader8.0AVGeneralcRecentFiles_all
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.10003de0
mov byte [ebp - 4], 0xd
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov byte [ebp - 4], 0xe
call fcn.100245c0
cmp dword [ebp - 0x10], 8
jb 0x1001cd2c
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001cd51
push dword [ebp - 0x40]
call edi
add esp, 4
push 0x41
xor eax, eax
push str.HKCUSoftwareAdobeAcrobat_Reader9.0AVGeneralcRecentFiles_all
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.10003de0
mov byte [ebp - 4], 0xf
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x10
call fcn.100245c0
cmp dword [ebp - 0x10], 8
jb 0x1001cdbf
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001cde4
push dword [ebp - 0x40]
call edi
add esp, 4
push str.HKCUSoftwareAdobeAcrobat_Reader10.0AVGeneralcRecentFiles_all
lea ecx, [ebp - 0x40]
call fcn.10008e70
mov byte [ebp - 4], 0x11
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x12
call fcn.100245c0
cmp dword [ebp - 0x10], 8
jb 0x1001ce3c
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001ce61
push dword [ebp - 0x40]
call edi
add esp, 4
push str.HKCUSoftwareAdobeAcrobat_Reader11.0AVGeneralcRecentFiles_all
lea ecx, [ebp - 0x40]
call fcn.10008e70
mov byte [ebp - 4], 0x13
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x14
call fcn.100245c0
cmp dword [ebp - 0x10], 8
jb 0x1001ceb9
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001cede
push dword [ebp - 0x40]
call edi
add esp, 4
push str.HKCUSoftwareAdobeAcrobat_Reader12.0AVGeneralcRecentFiles_all
lea ecx, [ebp - 0x40]
call fcn.10008e70
mov byte [ebp - 4], 0x15
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x16
call fcn.100245c0
cmp dword [ebp - 0x10], 8
jb 0x1001cf36
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001cf5b
push dword [ebp - 0x40]
call edi
add esp, 4
push 1
push str.Acoustica_Cd_Label_Maker
call fcn.1001db00
push str.HKCUSoftwareAcousticaCD_Label_MakerMRU_all
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.10008e70
mov byte [ebp - 4], 0x17
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x18
call fcn.100245c0
cmp dword [ebp - 0x10], 8
jb 0x1001cfc2
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001cfe7
push dword [ebp - 0x40]
call edi
add esp, 4
push 1
push str.Advanced_Browser
call fcn.1001db00
push str._appdata_Advanced_Browserkeywords.dat
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.10008e70
mov byte [ebp - 4], 0x19
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
add esi, 0x38
push eax
mov ecx, esi
mov byte [ebp - 4], 0x1a
call fcn.100245c0
cmp dword [ebp - 0x10], 8
jb 0x1001d050
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001d075
push dword [ebp - 0x40]
call edi
add esp, 4
push str._appdata_Advanced_Browserpages.dat
lea ecx, [ebp - 0x40]
call fcn.10008e70
mov byte [ebp - 4], 0x1b
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x1c
call fcn.100245c0
cmp dword [ebp - 0x10], 8
jb 0x1001d0cd
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001d0f2
push dword [ebp - 0x40]
call edi
add esp, 4
push str._appdata_Advanced_Browser_recents.dat
lea ecx, [ebp - 0x40]
call fcn.10008e70
mov byte [ebp - 4], 0x1d
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x1e
call fcn.100245c0
cmp dword [ebp - 0x10], 8
jb 0x1001d14a
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001d16f
push dword [ebp - 0x40]
call edi
add esp, 4
push 0
push str.CuteFTP
call fcn.1001db00
mov esi, eax
push str.cuteftp.exe
lea ecx, [esi + 0x20]
call fcn.10003960
push str._appdata_GlobalSCAPECuteFTP_sm.dat
lea ecx, [ebp - 0x40]
call fcn.10008e70
mov byte [ebp - 4], 0x1f
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
call fcn.10001f80
lea eax, [ebp - 0x28]
add esi, 0x38
push eax
mov ecx, esi
mov byte [ebp - 4], 0x20
call fcn.100245c0
cmp dword [ebp - 0x10], 8
jb 0x1001d1e5
push dword [ebp - 0x24]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x1001d20a
push dword [ebp - 0x40]
call edi
add esp, 4
push str._appdata_GlobalSCAPECuteFTP_sm.bak
lea ecx, [ebp - 0x40]
call fcn.10008e70
mov byte [ebp - 4], 0x21
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x58], ax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
call fcn.10001f80
lea eax, [ebp - 0x5c]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x22
call fcn.100245c0
cmp dword [ebp - 0x44], 8
jb 0x1001d262
push dword [ebp - 0x58]
call edi
add esp, 4
xor eax, eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
mov byte [ebp - 4], al
call fcn.10001a00
push str._appdata_GlobalSCAPECuteFTPlog.
lea ecx, [ebp - 0x40]
call fcn.10008e70
lea eax, [ebp - 0x40]
push eax
push 0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x23
call fcn.1001c880
push eax
mov ecx, esi
mov byte [ebp - 4], 0x24
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10001a00
push str._appdata_GlobalSCAPECuteFTP9.0_sm.dat
lea ecx, [ebp - 0x40]
call fcn.10008e70
lea eax, [ebp - 0x40]
push eax
push 0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x25
call fcn.1001c880
push eax
mov ecx, esi
mov byte [ebp - 4], 0x26
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10001a00
push str._appdata_GlobalSCAPECuteFTP9.0_sm.bak
lea ecx, [ebp - 0x40]
call fcn.10008e70
lea eax, [ebp - 0x40]
push eax
push 0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x27
call fcn.1001c880
push eax
mov ecx, esi
mov byte [ebp - 4], 0x28
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10001a00
push str._appdata_GlobalSCAPECuteFTP9.0log.
lea ecx, [ebp - 0x40]
call fcn.10008e70
lea eax, [ebp - 0x40]
push eax
push 0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x29
call fcn.1001c880
mov byte [ebp - 4], 0x2a
push eax
mov ecx, esi
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10001a00
push 1
push str.Word_Pad
call fcn.1001db00
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionAppletsWordpadRecent_File_List_all
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.10008e70
lea eax, [ebp - 0x40]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x2b
call fcn.1001c880
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x2c
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10001a00
push 1
push str.Windows_Movie_Maker
call fcn.1001db00
push str.HKEY_CURRENT_USERSoftwareMicrosoftMM20Recent_Document_List_all
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.10008e70
lea eax, [ebp - 0x40]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x2d
call fcn.1001c880
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x2e
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10001a00
push str._USERPROFILE_Local_SettingsApplication_DataMicrosoftMovie_MakerMEDIATAB1.DAT
lea ecx, [ebp - 0x40]
call fcn.10008e70
lea eax, [ebp - 0x40]
push eax
push 0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x2f
call fcn.1001c880
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x30
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10001a00
push 1
push str.WinAce
call fcn.1001db00
push str.HKEY_CURRENT_USERSoftwaree_mergeWinAce2.0MRU_Items_all
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.10008e70
lea eax, [ebp - 0x40]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x31
call fcn.1001c880
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x32
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10001a00
push str.HKEY_CURRENT_USERSoftwaree_mergeWinAce2.0Favorites_all
lea ecx, [ebp - 0x40]
call fcn.10008e70
lea eax, [ebp - 0x40]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x33
call fcn.1001c880
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x34
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10001a00
push 1
push str.WebFerret
call fcn.1001db00
push str.HKEY_CURRENT_USERSoftwareFerretSoftNetFerretCurrentVersionWeb_Search_History
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.10008e70
lea eax, [ebp - 0x40]
push eax
push 4
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x35
call fcn.1001c880
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x36
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10001a00
push 1
push str.VirtualDub
call fcn.1001db00
push str.HKEY_CURRENT_USERSoftwareFreewareVirtualDubMRU_List
lea ecx, [ebp - 0x198]
mov esi, eax
call fcn.10008e70
lea eax, [ebp - 0x198]
push eax
push 2
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x37
call fcn.1001c880
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x38
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0
call fcn.10001a00
push 1
push str.Ulead_PhotoImpact_10
call fcn.1001db00
push str.HKEY_CURRENT_USERSoftwareUlead_SystemsUlead_PhotoImpact10.0Recent_File_List_all
lea ecx, [ebp - 0x1e0]
mov esi, eax
call fcn.10008e70
lea eax, [ebp - 0x1e0]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x39
call fcn.1001c880
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x3a
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x1e0]
mov byte [ebp - 4], 0
call fcn.10001a00
push 1
push str.Ulead_Photo_Explorer_8.5
call fcn.1001db00
push str.HKEY_CURRENT_USERSoftwareUlead_SystemsUlead_Photo_Explorer8.5Folder_all
lea ecx, [ebp - 0x210]
mov esi, eax
call fcn.10008e70
lea eax, [ebp - 0x210]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x3b
call fcn.1001c880
add esi, 0x38
push eax
mov ecx, esi
mov byte [ebp - 4], 0x3c
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 0
call fcn.10001a00
push str.HKEY_CURRENT_USERSoftwareUlead_SystemsUlead_Photo_Explorer8.5Recent_Path_all
lea ecx, [ebp - 0xa8]
call fcn.10008e70
lea eax, [ebp - 0xa8]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x3d
call fcn.1001c880
push eax
mov ecx, esi
mov byte [ebp - 4], 0x3e
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0
call fcn.10001a00
push str.HKEY_CURRENT_USERSoftwareUlead_SystemsUlead_Photo_Explorer8.5Recent_UES_all
lea ecx, [ebp - 0x168]
call fcn.10008e70
lea eax, [ebp - 0x168]
push eax
mov byte [ebp - 4], 0x3f
push 1
lea ecx, [ebp - 0x5c]
call fcn.1001c880
push eax
mov ecx, esi
mov byte [ebp - 4], 0x40
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 0
call fcn.10001a00
push 1
push str.Ulead_GIF_Animator_5.0
call fcn.1001db00
push str.HKEY_CURRENT_USERSoftwareUlead_SystemsUlead_GIF_Animator5.0Recent_File_List_all
lea ecx, [ebp - 0xd8]
mov esi, eax
call fcn.10008e70
lea eax, [ebp - 0xd8]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x41
call fcn.1001c880
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x42
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0
call fcn.10001a00
push str.HKEY_CURRENT_USERSoftwareUlead_SystemsUlead_GIF_Animator5.05Recent_File_List_all
lea ecx, [ebp - 0x1c8]
call fcn.10008e70
lea eax, [ebp - 0x1c8]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x43
call fcn.1001c880
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x44
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 0
call fcn.10001a00
push 1
push str.TeXnicCenter
call fcn.1001db00
push str.HKEY_CURRENT_USERSoftwareToolsCenterTeXnicCenterSettingsOptions_LastOpenedFolder
lea ecx, [ebp - 0x108]
mov esi, eax
call fcn.10008e70
lea eax, [ebp - 0x108]
push eax
push 4
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x45
call fcn.1001c880
add esi, 0x38
push eax
mov ecx, esi
mov byte [ebp - 4], 0x46
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0
call fcn.10001a00
push str.HKEY_CURRENT_USERSoftwareToolsCenterTeXnicCenterRecent_File_List_all
lea ecx, [ebp - 0x78]
call fcn.10008e70
lea eax, [ebp - 0x78]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x47
call fcn.1001c880
push eax
mov ecx, esi
mov byte [ebp - 4], 0x48
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0
call fcn.10001a00
push str.HKEY_CURRENT_USERSoftwareToolsCenterTeXnicCenterRecent_Project_List_all
lea ecx, [ebp - 0x138]
call fcn.10008e70
lea eax, [ebp - 0x138]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x49
call fcn.1001c880
push eax
mov ecx, esi
mov byte [ebp - 4], 0x4a
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0
call fcn.10001a00
push str.HKEY_CURRENT_USERSoftwareToolsCenterTeXnicCenterSession_all
lea ecx, [ebp - 0x1f8]
call fcn.10008e70
lea eax, [ebp - 0x1f8]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x4b
call fcn.1001c880
push eax
mov ecx, esi
mov byte [ebp - 4], 0x4c
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 0
call fcn.10001a00
push str.HKEY_CURRENT_USERSoftwareToolsCenterTeXnicCenterNTSettingsOptions_LastOpenedFolder
lea ecx, [ebp - 0x90]
call fcn.10008e70
lea eax, [ebp - 0x90]
push eax
push 4
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x4d
call fcn.1001c880
push eax
mov ecx, esi
mov byte [ebp - 4], 0x4e
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0
call fcn.10001a00
push str.HKEY_CURRENT_USERSoftwareToolsCenterTeXnicCenterNTRecent_File_List_all
lea ecx, [ebp - 0xc0]
call fcn.10008e70
lea eax, [ebp - 0xc0]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x4f
call fcn.1001c880
push eax
mov ecx, esi
mov byte [ebp - 4], 0x50
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0
call fcn.10001a00
push str.HKEY_CURRENT_USERSoftwareToolsCenterTeXnicCenterNTRecent_Project_List_all
lea ecx, [ebp - 0xf0]
call fcn.10008e70
lea eax, [ebp - 0xf0]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x51
call fcn.1001c880
push eax
mov ecx, esi
mov byte [ebp - 4], 0x52
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0
call fcn.10001a00
push str.HKEY_CURRENT_USERSoftwareToolsCenterTeXnicCenterNTSession_all
lea ecx, [ebp - 0x120]
call fcn.10008e70
lea eax, [ebp - 0x120]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x53
call fcn.1001c880
push eax
mov ecx, esi
mov byte [ebp - 4], 0x54
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0
call fcn.10001a00
push 1
push str.SWiSH_2.0
call fcn.1001db00
push str.HKEY_CURRENT_USERSoftwareDJJ_HoldingsSWiSHRecent_File_List_all
lea ecx, [ebp - 0x150]
mov esi, eax
call fcn.10008e70
lea eax, [ebp - 0x150]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x55
call fcn.1001c880
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x56
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x150]
call fcn.10001a00
push str.HKEY_CURRENT_USERSoftwareSwiSHzone.comSWiSHRecent_File_List_all
lea ecx, [ebp - 0x180]
call fcn.10008e70
lea eax, [ebp - 0x180]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x57
call fcn.1001c880
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x58
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0
call fcn.10001a00
push 1
push str.Ares
call fcn.1001db00
push str.HKEY_CURRENT_USERSoftwareDJJ_HoldingsSWiSHRecent_File_List_all
lea ecx, [ebp - 0x1b0]
mov esi, eax
call fcn.10008e70
lea eax, [ebp - 0x1b0]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x59
call fcn.1001c880
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x5a
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x1b0]
mov byte [ebp - 4], 0
call fcn.10001a00
push str.HKEY_CURRENT_USERSoftwareSwiSHzone.comSWiSHRecent_File_List_all
lea ecx, [ebp - 0x24]
call fcn.10008e70
lea eax, [ebp - 0x24]
push eax
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x5b
call fcn.1001c880
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x5c
call fcn.100245c0
lea ecx, [ebp - 0x5c]
call fcn.1001dc50
lea ecx, [ebp - 0x24]
call fcn.10001a00
mov eax, 0x100a55ec
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret