Function at 0x5a1d90
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xb4]
sub esp, 0xb4
push 0xffffffffffffffff
push 0x63cc64
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x70a308]
xor eax, ebp
mov dword [ebp + 0xb0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x38], esi
mov eax, dword [ebp + 0xc4]
mov dword [ebp - 0x2c], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x908], ebx
je 0x5a1e01
push ebx
push ebx
mov ecx, dword [esi + 0x4c0]
push ecx
lea ecx, [esi + 0x20]
call fcn.005b43f0
mov dword [esi + 0x908], ebx
cmp dword [esi + 0xaa4], ebx
je 0x5a1e13
mov dword [esi + 0xa94], 0x7540
cmp dword [esi + 0xa94], 0x7573
jne 0x5a1e38
push 3
mov ecx, esi
call fcn.0059ae20
lea ecx, [esi + 0x4f4]
call fcn.00554ba0
jmp 0x5a2508
cmp dword [esi + 4], ebx
jne 0x5a1e45
push ebx
mov ecx, esi
call fcn.0059ae20
cmp dword [esi + 0xaa4], ebx
je 0x5a1e88
push ebx
mov ecx, esi
call fcn.0059ae20
push 1
mov edx, dword [esi + 0x4c0]
push edx
mov eax, dword [0x710514]
push eax
mov ecx, dword [esi + 0xa94]
push ecx
lea ecx, [esi + 0x20]
call fcn.005ae840
push str.Cancel_by_user._n
lea ecx, [esi + 0x4f4]
call fcn.005547b0
jmp 0x5a2508
mov ecx, dword [esi + 0xa94]
cmp ecx, 0x7540
jne 0x5a1eb4
push str.Cancel_by_user._n
lea ecx, [esi + 0x4f4]
call fcn.005547b0
push 2
mov ecx, esi
call fcn.0059ae20
jmp 0x5a2508
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x27], 1
mov eax, ecx
cmp eax, 0x753b
jg 0x5a1f51
je case.0x5a1f62.30040
cmp eax, 0x17
je case.0x5a1f62.30040
cmp eax, 0x70
je case.0x5a1f62.30040
cmp byte [esi + 0x33a], bl
jne case.0x5a1f62.30040
cmp byte [esi + 0xac6], bl
jne 0x5a20d2
cmp byte [0x7100b5], bl
je 0x5a20ca
cmp dword [esi + 4], ebx
jne 0x5a20ca
test dword [esi + 0x16c], 0x80000
je 0x5a20ca
lea ecx, [ebp - 0x14]
call fcn.004024e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.004024e0
mov byte [ebp - 4], 2
cmp byte [esi + 0xa80], 0
je 0x5a1f69
mov eax, dword [esi + 0xa68]
push eax
mov ecx, dword [esi + 0xa64]
push ecx
jmp 0x5a1f80
sub eax, 0x7542
cmp eax, 0x40
ja case.0x5a1f62.30019
movzx edx, byte [eax + 0x5a396c]
jmp dword [edx*4 + 0x5a3960]
mov eax, dword [esi + 0x924]
cmp eax, ebx
jne 0x5a1f78
mov eax, 0x64f8bc
mov ecx, dword [esi + 0x928]
push ecx
push eax
push str._s:_ld
lea edx, [ebp - 0x14]
push edx
call fcn.00402f60
add esp, 0x10
mov byte [esi + 0xac6], 1
push esi
call fcn.004a3b80
push esi
call fcn.004a7510
add esp, 8
cmp byte [esi + 0xa80], 0
je 0x5a1fc0
mov eax, dword [esi + 0xa68]
push eax
mov ecx, dword [esi + 0xa64]
push ecx
jmp 0x5a1fd7
mov eax, dword [esi + 0x924]
cmp eax, ebx
jne 0x5a1fcf
mov eax, 0x64f8bc
mov ecx, dword [esi + 0x928]
push ecx
push eax
push str._s:_ld
lea edx, [ebp - 0x24]
push edx
call fcn.00402f60
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.005fa111
add esp, 8
test eax, eax
je 0x5a2089
lea edi, [esi + 0x4f4]
push str.Try_via_the_same_proxy_as_in_browser_request._n
mov ecx, edi
call fcn.005547b0
mov edx, dword [esi + 0xa94]
mov dword [esi + 0xac8], edx
mov edi, dword [edi]
cmp edi, ebx
je 0x5a2039
push edi
push 0x64edec
lea eax, [esi + 0xacc]
push eax
call fcn.00402f60
add esp, 0xc
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
je 0x5a205e
mov eax, dword [esi + 0x4c0]
cmp eax, ebx
je 0x5a205e
push eax
push 0x1431
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x5a206c
mov dword [esi + 0x920], ebx
push ebx
mov ecx, esi
call fcn.005aac70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00402550
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402550
jmp 0x5a2508
mov byte [esi + 0xac6], 0
cmp byte [esi + 0xac7], 0
je 0x5a20ad
push str.Cannot_detect_proxy_in_browser_proxy_script_:__n
lea ecx, [esi + 0x4f4]
call fcn.005547b0
mov byte [ebp - 0x15], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00402550
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402550
jmp 0x5a2128
mov byte [ebp - 0x27], bl
cmp byte [esi + 0xac6], bl
je 0x5a2128
cmp ecx, 0x756f
je 0x5a20e2
cmp ecx, 0x7559
jne 0x5a2122
mov ecx, dword [esi + 0xac8]
mov dword [esi + 0xa94], ecx
mov edx, dword [esi + 0xacc]
mov eax, edx
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5a2100
lea ecx, [esi + 0x4f4]
sub eax, edi
je 0x5a2119
push edx
call fcn.00554e70
jmp 0x5a211e
call fcn.00554c10
mov byte [ebp - 0x15], 1
mov byte [esi + 0xac6], bl
mov byte [ebp - 0x1d], 0
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x5c], ebx
xor edx, edx
mov word [ebp + 0x58], dx
mov byte [ebp - 4], 3
mov eax, dword [esi + 0xa94]
cmp eax, 0x7532
jg 0x5a24c6
je case.0x5a2377.10060
cmp eax, 0x271d
jg 0x5a2351
je 0x5a2349
cmp eax, 0xffffffff
jg 0x5a2259
je 0x5a21cb
cmp eax, 0x80090304
je case.0x5a24db.30009
cmp eax, 0x8009030e
je case.0x5a24db.30009
cmp eax, 0xfffffffc
je case.0x5a24db.30009
mov eax, dword [esi + 0x44]
cmp eax, 4
je 0x5a2d23
cmp eax, 5
je 0x5a2d23
lea edx, [esi + 0x4f8]
push edx
lea ecx, [ebp + 0x48]
call fcn.00402160
mov byte [ebp - 4], 0x17
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jne 0x5a21c0
lea eax, [ebp + 0x4c]
mov edx, dword [0x7102c8]
jmp 0x5a2c82
mov eax, dword [esi + 0x44]
cmp eax, 4
je case.0x5a24db.30009
cmp eax, 5
je case.0x5a24db.30009
lea eax, [esi + 0x4f8]
push eax
lea ecx, [ebp + 0x3c]
call fcn.00402160
mov bl, 0x15
mov byte [ebp - 4], bl
lea ecx, [esi + 0xae8]
push ecx
lea ecx, [ebp + 0x48]
call fcn.00402160
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp + 0x48]
test ecx, ecx
jne 0x5a2209
lea ecx, [ebp + 0x4c]
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5a2213
lea eax, [ebp + 0x40]
mov edx, dword [0x70f730]
push edx
push ecx
push eax
mov eax, dword [0x7102c4]
push eax
lea ecx, [ebp + 0x54]
call fcn.00402300
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.004011f0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x3c]
call fcn.004011f0
jmp 0x5a2d38
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x7102d0]
push edx
jmp 0x5a2d30
cmp eax, 5
je 0x5a2336
cmp eax, 0x17
je 0x5a2324
cmp eax, 0x70
jne case.0x5a24db.30004
mov eax, dword [0x70f730]
push eax
mov ecx, dword [0x7107ec]
push ecx
lea ecx, [ebp + 0x48]
call fcn.004583c0
mov bl, 0x11
mov byte [ebp - 4], bl
xor edi, edi
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x20], edi
xor edx, edx
mov word [ebp + 0x1c], dx
mov byte [ebp - 4], 0x12
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
push 0x400
push 0x70
push edi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp + 0x48]
cmp eax, edi
jne 0x5a22c3
lea eax, [ebp + 0x4c]
push edi
mov ecx, dword [ebp - 0x1c]
push ecx
push eax
push str._r_n_r_n_s_s
lea ecx, [ebp + 0x18]
call fcn.00402300
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x70f730]
push eax
mov ecx, dword [0x7102d0]
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401960
mov eax, dword [ebp + 0x18]
cmp eax, edi
jne 0x5a22ff
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405210
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x18]
call fcn.004011f0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
call fcn.004011f0
jmp 0x5a2d38
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x710d74]
push eax
jmp 0x5a2d30
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x710904]
push edx
jmp 0x5a2d30
mov ecx, dword [0x7102dc]
jmp 0x5a2384
cmp eax, 0x2af9
jg 0x5a2472
je 0x5a2467
sub eax, 0x2726
cmp eax, 0x2b
ja case.0x5a24db.30004
movzx edx, byte [eax + 0x5a39dc]
jmp dword [edx*4 + 0x5a39b0]
mov ecx, dword [0x7102d8]
mov eax, dword [0x70f730]
push eax
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401960
mov byte [esi + 0x34d], 1
jmp 0x5a2d38
lea ecx, [ebp - 0x14]
call fcn.004024e0
mov byte [ebp - 4], 0xb
mov eax, dword [0x7102d0]
mov edx, dword [0x710a00]
push edx
push eax
push str._s_r_n_r_n_s
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f60
add esp, 0x10
mov edx, dword [0x70f730]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp + 0x54]
call fcn.00401960
mov byte [esi + 0x34d], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00402550
jmp 0x5a2d38
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x7102e0]
push edx
jmp 0x5a2d30
mov ecx, dword [0x7102e4]
jmp 0x5a2d29
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x7102e8]
push eax
jmp 0x5a2d30
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x7102f0]
push edx
jmp 0x5a2d30
mov ecx, dword [0x7102f4]
jmp 0x5a2d29
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x7102f8]
push eax
jmp 0x5a2d30
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x7102fc]
push edx
jmp 0x5a2d30
mov ecx, dword [0x7102ec]
jmp 0x5a2384
sub eax, 0x2afa
je case.0x5a24db.30009
sub eax, 2
jne case.0x5a24db.30004
lea ecx, [ebp - 0x14]
call fcn.004024e0
mov byte [ebp - 4], 0xc
mov eax, dword [0x7104f0]
jmp 0x5a23b0
mov eax, dword [esi + 0x16c]
test al, 8
jne 0x5a24ad
test eax, 0x100
je case.0x5a24db.30003
mov byte [esi + 0x34d], 1
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x710530]
push eax
jmp 0x5a2d30
sub eax, 0x7533
cmp eax, 0x57
ja case.0x5a24db.30004
movzx ecx, byte [eax + 0x5a3a7c]
jmp dword [ecx*4 + 0x5a3a08]
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x710300]
push eax
jmp 0x5a2d30
push ebx
mov ecx, esi
call fcn.0059ae20
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x54]
call fcn.004011f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xb0]
xor ecx, ebp
call fcn.005f85e7
add ebp, 0xb4
mov esp, ebp
pop ebp
ret 0xc
push ebx
mov ecx, esi
call fcn.0059ae20
cmp dword [esi + 8], ebx
jne 0x5a2748
cmp dword [esi + 4], ebx
jne 0x5a2748
cmp byte [ebp + 0xbc], 0
je 0x5a2748
mov eax, dword [esi + 0x4f0]
cmp eax, ebx
je 0x5a2581
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5a2581
mov edx, dword [esi + 0x4f0]
mov eax, dword [edx + 0x20]
push eax
call fcn.005d4546
mov edi, eax
jmp 0x5a2583
xor edi, edi
mov ecx, dword [esi + 0x44]
push ecx
call fcn.0048d800
add esp, 4
push eax
lea ecx, [ebp - 0x24]
call fcn.004030e0
mov byte [ebp - 4], 4
mov eax, dword [esi + 0x1c0]
lea ebx, [esi + 0x20]
push edi
push 0
push 0
push eax
mov edx, dword [ebx]
push edx
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0xf0]
call fcn.004e9510
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xf0]
call fcn.005d199e
cmp eax, 1
jne 0x5a272d
mov eax, dword [esi + 0x10]
test eax, eax
je 0x5a25ef
push 0
push 0x1472
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x10], 0
mov ecx, dword [ebp - 0x78]
push ecx
mov edx, dword [ebp - 0x7c]
push edx
mov ecx, esi
call fcn.0059b150
mov eax, dword [esi + 0x4c0]
test eax, eax
je 0x5a269b
cmp dword [esi + 0x480], 0
jne 0x5a2624
push eax
mov ecx, ebx
call fcn.005b24a0
mov edx, dword [esi + 0x480]
test edx, edx
je 0x5a269b
mov edi, dword [ebp - 0x7c]
mov eax, edi
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5a2636
sub eax, ebx
inc eax
push eax
push edi
push 1
push 0
push 0x662174
push edx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call edi
cmp byte [esi + 0x1b8], 0
je 0x5a267c
mov dword [ebp - 0x2c], 1
push 4
lea eax, [ebp - 0x2c]
push eax
push 4
push 0
push str.bUNRA
mov ecx, dword [esi + 0x480]
push ecx
call edi
push 0
mov edx, dword [ebp - 0x78]
push edx
push str.EncPassword
push 0x6705d4
mov eax, dword [esi + 0x480]
push eax
call fcn.0059e550
add esp, 0x14
lea ecx, [ebp - 0x14]
call fcn.004024e0
mov byte [ebp - 4], 6
mov ecx, dword [esi + 0xa94]
push ecx
mov edx, dword [0x7102bc]
push edx
push str._r_n_s_r_ndownlResult___ldsetting_new_login_r_n
lea eax, [ebp - 0x14]
push eax
call fcn.00402f60
add esp, 0x10
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [esi + 0x4f4]
call fcn.005547b0
cmp byte [ebp + 0xc0], 0
je 0x5a2701
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5a2701
mov esi, dword [esi + 0x4c0]
test esi, esi
je 0x5a2701
push esi
push 0x1431
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x14]
call fcn.00402550
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf0]
call fcn.004aad10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.00402550
jmp 0x5a24fc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf0]
call fcn.004aad10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.00402550
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x7102bc]
push eax
jmp 0x5a2d30
push 0x64f8bc
lea ecx, [esi + 0x398]
call fcn.00402fc0
cmp dword [esi + 8], ebx
jne 0x5a290f
cmp dword [esi + 4], ebx
jne 0x5a290f
cmp byte [ebp + 0xbc], 0
je 0x5a290f
push ebx
mov ecx, esi
call fcn.0059ae20
mov eax, dword [esi + 0x4f0]
cmp eax, ebx
je 0x5a27bc
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5a27bc
mov edx, dword [esi + 0x4f0]
mov eax, dword [edx + 0x20]
push eax
call fcn.005d4546
mov ebx, eax
jmp 0x5a27be
xor ebx, ebx
mov ecx, dword [esi + 0x44]
push ecx
call fcn.0048d800
add esp, 4
push eax
lea ecx, [ebp - 0x1c]
call fcn.004030e0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x24]
call fcn.004024e0
mov byte [ebp - 4], 8
cmp byte [esi + 0xa5a], 0
jne 0x5a2823
cmp dword [0x7100ac], 2
jne 0x5a27fe
test byte [0x7100c0], 0x10
jne 0x5a2823
lea edi, [esi + 0x924]
mov eax, dword [edi]
lea ecx, [ebp - 0x24]
test eax, eax
je 0x5a2815
push eax
call fcn.00402fc0
jmp 0x5a2858
lea edx, [esi + 0xa64]
push edx
call fcn.00405800
jmp 0x5a2858
lea edi, [esi + 0x924]
mov eax, dword [edi]
lea edx, [ebp - 0x24]
test eax, eax
je 0x5a283c
mov ecx, dword [esi + 0x928]
push ecx
push eax
jmp 0x5a284a
mov eax, dword [esi + 0xa68]
push eax
mov ecx, dword [esi + 0xa64]
push ecx
push str._s:_ld
push edx
call fcn.00402f60
add esp, 0x10
mov eax, dword [esi + 0xa44]
push ebx
movzx ecx, byte [esi + 0xa5a]
push ecx
push 1
push eax
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xf0]
call fcn.004e9510
mov bl, 9
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xf0]
call fcn.005d199e
cmp eax, 1
jne 0x5a28e8
mov byte [esi + 0xa5d], al
mov eax, dword [esi + 0x10]
test eax, eax
je 0x5a28b2
push 0
push 0x1472
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x10], 0
mov byte [ebp - 0x28], 1
cmp dword [edi], 0
je 0x5a2931
mov ecx, dword [ebp - 0x7c]
push ecx
mov ecx, edi
call fcn.004a8280
test eax, eax
jne 0x5a28e4
mov edx, dword [ebp - 0x78]
push edx
mov ecx, edi
call fcn.004a82f0
test eax, eax
je 0x5a2965
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xf0]
call fcn.004aad10
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x24]
call fcn.00402550
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.00402550
cmp byte [esi + 0xa5a], 0
mov eax, 0x710f30
jne 0x5a2922
mov eax, 0x7102c0
mov eax, dword [eax]
mov ecx, dword [0x70f730]
push ecx
push eax
jmp 0x5a2d30
mov byte [esi + 0xa81], 1
mov eax, dword [ebp - 0x7c]
push eax
push 0x64edec
lea ecx, [esi + 0xa6c]
push ecx
call fcn.00402f60
mov edx, dword [ebp - 0x78]
push edx
push 0x64edec
lea eax, [esi + 0xa70]
push eax
call fcn.00402f60
add esp, 0x18
lea ecx, [ebp - 0x14]
call fcn.004024e0
mov byte [ebp - 4], 0xa
cmp byte [esi + 0xa5a], 0
mov eax, dword [0x710f30]
jne 0x5a2984
mov eax, dword [0x7102c0]
mov ecx, dword [esi + 0xa94]
push ecx
push eax
push str._r_n_s_r_ndownlResult___ldsetting_new_login_r_n
lea edx, [ebp - 0x14]
push edx
call fcn.00402f60
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [esi + 0x4f4]
call fcn.005547b0
cmp byte [ebp + 0xc0], 0
je 0x5a29d8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5a29d8
mov esi, dword [esi + 0x4c0]
test esi, esi
je 0x5a29d8
push esi
push 0x1431
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00402550
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xf0]
call fcn.004aad10
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x24]
call fcn.00402550
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.00402550
jmp 0x5a24fc
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x7102d4]
push eax
jmp 0x5a2d30
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x710508]
push edx
jmp 0x5a2d30
mov ecx, dword [0x7102cc]
jmp 0x5a2d29
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x710368]
push eax
jmp 0x5a2d30
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x71036c]
push edx
jmp 0x5a2d30
mov ecx, dword [0x710370]
jmp 0x5a2d29
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x7102b8]
push eax
jmp 0x5a2d30
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x7104d4]
push edx
jmp 0x5a2d30
mov ecx, dword [0x71051c]
jmp 0x5a2d29
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x71056c]
push eax
jmp 0x5a2d30
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x710524]
push edx
jmp 0x5a2d30
mov ecx, dword [0x7105b4]
jmp 0x5a2d29
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x71052c]
push eax
jmp 0x5a2d30
lea ecx, [ebp + 0xa0]
push ecx
mov edx, dword [esi + 0x4d4]
push edx
mov eax, dword [esi + 0x4d0]
push eax
mov ecx, esi
call fcn.0059b810
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x14], ebx
xor ecx, ecx
mov word [ebp + 0x10], cx
mov byte [ebp - 4], 0xd
lea edx, [ebp + 0xc]
push edx
mov ecx, esi
call fcn.0059cba0
lea eax, [ebp + 0xa0]
push eax
lea ecx, [ebp + 0x3c]
call fcn.00406ea0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1c]
call fcn.004024e0
mov byte [ebp - 4], 0xf
mov ecx, dword [esi + 0x4d4]
push ecx
mov edx, dword [esi + 0x4d0]
push edx
push str._I64d
lea eax, [ebp - 0x1c]
push eax
call fcn.00402f60
add esp, 0x10
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp + 0x48]
call fcn.00406ea0
mov byte [ebp - 4], 0x10
push str._I64d
mov edx, dword [0x7104f4]
push edx
call fcn.005f9c10
add esp, 8
test eax, eax
je 0x5a2b8a
push 0x64edec
push str._I64d
jmp 0x5a2bab
push 0x64f53c
mov eax, dword [0x7104f4]
push eax
call fcn.005f9c10
add esp, 8
test eax, eax
je 0x5a2bb5
push 0x64edec
push 0x64f53c
mov ecx, 0x7104f4
call fcn.00402bf0
cmp dword [esi + 0x54], ebx
je 0x5a2bbf
mov edi, dword [esi + 0x54]
jmp 0x5a2bc2
lea edi, [esi + 0x58]
mov edx, dword [ebp + 0x48]
cmp edx, ebx
jne 0x5a2bcc
lea edx, [ebp + 0x4c]
mov ecx, dword [ebp + 0x3c]
cmp ecx, ebx
jne 0x5a2bd6
lea ecx, [ebp + 0x40]
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jne 0x5a2be0
lea eax, [ebp + 0x10]
mov ebx, dword [0x70f730]
push ebx
push edi
push edx
push ecx
push eax
mov ecx, dword [0x7104f4]
push ecx
lea ecx, [ebp + 0x54]
call fcn.0043a620
mov byte [ebp - 4], 0xf
lea ecx, [ebp + 0x48]
call fcn.004011f0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1c]
call fcn.00402550
mov byte [ebp - 4], 0xd
lea ecx, [ebp + 0x3c]
call fcn.004011f0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0xc]
call fcn.004011f0
jmp 0x5a2d38
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x7103a8]
push edx
jmp 0x5a2d30
mov ecx, dword [0x710d18]
jmp 0x5a2d29
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x710dc4]
push eax
jmp 0x5a2d30
lea eax, [esi + 0x4f8]
push eax
lea ecx, [ebp + 0x48]
call fcn.00402160
mov byte [ebp - 4], 0x13
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jne 0x5a2c7c
lea eax, [ebp + 0x4c]
mov edx, dword [0x710a0c]
mov ecx, dword [0x70f730]
push ecx
push eax
push edx
lea ecx, [ebp + 0x54]
call fcn.00402190
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
call fcn.004011f0
jmp 0x5a2d38
lea ecx, [ebp - 0x14]
call fcn.004024e0
mov byte [ebp - 4], 0x14
mov eax, dword [0x710ee0]
push eax
push 0x64edec
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f60
push 0x6511cc
mov edx, dword [ebp - 0x14]
push edx
call fcn.005fad50
add esp, 0x14
cmp eax, ebx
je 0x5a2cdc
mov byte [eax], 0
mov eax, dword [0x70f730]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00402550
jmp 0x5a2d38
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x711080]
push eax
jmp 0x5a2d30
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x711084]
push edx
jmp 0x5a2d30
mov ecx, dword [0x711088]
jmp 0x5a2d29
mov ecx, dword [0x7102d0]
mov eax, dword [0x70f730]
push eax
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401960
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5a2d57
mov edx, dword [esi + 0x4c0]
push edx
push 0x13c7
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0xa94]
add eax, 0xffff8abe
cmp eax, 0x38
ja case.0x5a2d72.30019
movzx eax, byte [eax + 0x5a3ae0]
jmp dword [eax*4 + 0x5a3ad4]
mov ecx, dword [esi + 0x148]
or ecx, dword [esi + 0x14c]
je case.0x5a2d72.30019
push 0x64f8b8
lea ecx, [ebp + 0x54]
call fcn.00405210
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x710dc4]
push eax
lea ecx, [ebp + 0x48]
call fcn.004583c0
mov byte [ebp - 4], 0x18
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x5a2dbb
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405210
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
call fcn.004011f0
mov cl, byte [esi + 0x18d]
test cl, cl
jne 0x5a2f46
mov eax, dword [esi + 0x150]
test eax, eax
jle 0x5a2df9
mov edx, dword [esi + 0x154]
sub edx, eax
cmp edx, 0x3c
jl 0x5a2f31
cmp byte [0x70fc04], 0
jne 0x5a2eeb
mov eax, dword [esi + 0x108]
cmp eax, dword [esi + 0x148]
jne 0x5a2eeb
mov ecx, dword [esi + 0x10c]
cmp ecx, dword [esi + 0x14c]
jne 0x5a2eeb
cmp dword [esi + 0xdc], 0
je 0x5a2eeb
mov ebx, dword [esi + 0x128]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5a2e42
sub eax, edx
je 0x5a2eeb
mov edi, dword [esi + 0x104]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5a2e60
sub eax, edx
je 0x5a2eeb
mov edx, ebx
mov eax, edi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x5a2e93
test cl, cl
je 0x5a2e8f
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x5a2e93
add eax, 2
add edx, 2
test cl, cl
jne 0x5a2e73
xor eax, eax
jmp 0x5a2e98
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x5a2eeb
mov ecx, ebx
mov eax, dword [esi + 0xdc]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5a2ec4
test dl, dl
je 0x5a2ec0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5a2ec4
add eax, 2
add ecx, 2
test dl, dl
jne 0x5a2ea4
xor eax, eax
jmp 0x5a2ec9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x5a2eeb
mov byte [ebp - 0x25], 1
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x710cc0]
push eax
lea ecx, [ebp + 0x54]
call fcn.00401960
jmp case.0x5a2d72.30019
push str._r_n_r_n
lea ecx, [ebp + 0x54]
call fcn.00405210
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x710de4]
push edx
lea ecx, [ebp + 0x48]
call fcn.004583c0
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x5a2f1c
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405210
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
jmp 0x5a30a7
test cl, cl
jne 0x5a2f46
push 1
mov eax, dword [esi + 0x4c0]
push eax
lea ecx, [esi + 0x20]
call fcn.005b41c0
cmp dword [esi + 0x4d4], 0
jl 0x5a2f75
jg 0x5a2f5a
cmp dword [esi + 0x4d0], 0
jbe 0x5a2f75
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x710de8]
push edx
lea ecx, [ebp + 0x54]
call fcn.00401960
jmp case.0x5a2d72.30019
xor bl, bl
test byte [esi + 0x16c], 0x70
je 0x5a2f82
mov bl, 1
xor edi, edi
mov dword [ebp], edi
mov dword [ebp + 8], edi
xor eax, eax
mov word [ebp + 4], ax
mov byte [ebp - 4], 0x19
lea ecx, [ebp]
push ecx
mov ecx, esi
call fcn.0059cba0
test bl, bl
je 0x5a3069
mov edx, dword [esi + 0xe8]
mov eax, edx
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5a2fb2
mov ecx, 0x710250
sub eax, ebx
je 0x5a2fca
push edx
call fcn.00532350
jmp 0x5a2fd3
mov edx, dword [esi + 0x20]
push edx
call fcn.00532230
cmp dword [esi + 0x11c], edi
je 0x5a2fe3
mov eax, dword [esi + 0x11c]
jmp 0x5a2fe9
lea eax, [esi + 0x120]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x5a2ff0
sub eax, edx
sar eax, 1
je 0x5a3019
cmp dword [esi + 0x11c], edi
je 0x5a3011
mov eax, dword [esi + 0x11c]
jmp 0x5a3023
lea eax, [esi + 0x120]
jmp 0x5a3023
mov eax, dword [ebp]
cmp eax, edi
jne 0x5a3023
lea eax, [ebp + 4]
mov ecx, dword [0x70f730]
push ecx
push eax
mov edx, dword [0x710cc4]
push edx
lea ecx, [ebp + 0x54]
call fcn.00402190
test dword [esi + 0x16c], 0x100
jne 0x5a30a0
mov eax, dword [esi + 0x150]
cmp eax, edi
jle 0x5a30a0
mov ecx, dword [esi + 0x154]
sub ecx, eax
cmp ecx, 0x3c
jge 0x5a30a0
cmp byte [ebp - 0x15], 0
jne 0x5a30a0
mov byte [ebp - 0x1d], 1
jmp 0x5a30a0
cmp byte [esi + 0x18b], 0
je 0x5a308a
cmp byte [0x70fc04], 0
jne 0x5a308a
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x710cc0]
push eax
jmp 0x5a3098
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x710de8]
push edx
lea ecx, [ebp + 0x54]
call fcn.00401960
mov byte [ebp - 4], 3
lea ecx, [ebp]
call fcn.004011f0
cmp dword [esi + 0xa94], 0x7582
je 0x5a316a
cmp dword [esi + 0x4f4], 0
je 0x5a316a
push str._r_n_r_n
lea ecx, [ebp + 0x54]
call fcn.00405210
xor edi, edi
mov dword [ebp + 0xa4], edi
mov dword [ebp + 0xac], edi
xor eax, eax
mov word [ebp + 0xa8], ax
mov bl, 0x1b
mov byte [ebp - 4], bl
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x7107ec]
push edx
lea ecx, [ebp + 0xa4]
call fcn.00401960
mov eax, dword [ebp + 0xa4]
cmp eax, edi
jne 0x5a311b
lea eax, [ebp + 0xa8]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405210
mov eax, dword [0x70f730]
push eax
mov ecx, dword [esi + 0x4f4]
push ecx
lea ecx, [ebp + 0x48]
call fcn.004583c0
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp + 0x48]
cmp eax, edi
jne 0x5a3147
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405210
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.004011f0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0xa4]
call fcn.004011f0
cmp byte [ebp - 0x15], 0
je 0x5a3298
push str._r_n_r_n
lea ecx, [ebp + 0x54]
call fcn.00405210
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x711054]
push eax
lea ecx, [ebp + 0x3c]
call fcn.004583c0
mov bl, 0x1d
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5a31a5
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405210
mov byte [ebp - 0x26], 0
mov edx, dword [esi + 0x13c]
mov eax, edx
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5a31c0
sub eax, edi
je 0x5a328c
push 0x5c
push edx
call fcn.005fad90
add esp, 8
mov edi, eax
test edi, edi
je 0x5a31e3
inc edi
jmp 0x5a31e9
mov edi, dword [esi + 0x13c]
push 0xa
push str.chromeexe
push edi
call fcn.005fd020
add esp, 0xc
test eax, eax
je 0x5a3243
push str.idmbrbtn.dll
push edi
call fcn.005fa111
add esp, 8
test eax, eax
jne 0x5a328c
mov eax, dword [esi + 0x1a4]
push str.Chrome
push eax
call fcn.005f9c10
add esp, 8
test eax, eax
je 0x5a328c
mov eax, dword [esi + 0x1a4]
push str.Firefox
push eax
call fcn.005f9c10
add esp, 8
test eax, eax
jne 0x5a328c
mov byte [ebp - 0x26], 1
push 0x65b7f8
lea ecx, [ebp + 0x54]
call fcn.00405210
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x711058]
push edx
lea ecx, [ebp + 0x48]
call fcn.004583c0
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x5a3278
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405210
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.004011f0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x3c]
call fcn.004011f0
mov eax, dword [ebp + 0x54]
xor ebx, ebx
cmp eax, ebx
jne 0x5a32a4
lea eax, [ebp + 0x58]
mov ecx, dword [0x70f730]
push ecx
push eax
lea edx, [ebp - 0x30]
push edx
call fcn.00402a50
add esp, 0xc
mov byte [ebp - 4], 0x1f
lea ecx, [esi + 0x20]
push ebx
mov eax, dword [esi + 0x4c0]
push eax
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [esi + 0xa94]
push eax
call fcn.005ae840
lea edi, [esi + 0x4f4]
mov ecx, dword [ebp - 0x30]
push ecx
mov ecx, edi
call fcn.005547b0
mov edx, dword [esi + 0xa94]
push edx
push str._r_ndownlResult___ld_r_n
lea eax, [ebp + 0x60]
push eax
call fcn.005fb4cb
add esp, 0xc
lea ecx, [ebp + 0x60]
push ecx
mov ecx, edi
call fcn.005547b0
mov eax, dword [esi + 0xa94]
add eax, 0xffff8abe
cmp eax, 0x38
ja case.0x5a3326.30019
movzx edx, byte [eax + 0x5a3b28]
jmp dword [edx*4 + 0x5a3b1c]
mov eax, dword [esi + 0x148]
or eax, dword [esi + 0x14c]
je case.0x5a3326.30019
cmp dword [esi + 8], ebx
jne case.0x5a3326.30019
cmp dword [esi + 4], ebx
jne case.0x5a3326.30019
cmp byte [ebp + 0xbc], 0
je case.0x5a3326.30019
cmp dword [esi + 0x14], ebx
je case.0x5a3326.30019
cmp dword [esi + 0x4c0], ebx
je case.0x5a3326.30019
cmp byte [esi + 0x18d], 0
jne case.0x5a3326.30019
cmp byte [ebp - 0x25], 0
jne case.0x5a3326.30019
push ebx
mov ecx, esi
call fcn.0059ae20
mov ecx, dword [esi + 0x4c0]
push ecx
push 0x1463
push 0x111
mov edx, dword [esi + 0x14]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [esi + 0x34d], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.00402550
jmp 0x5a24fc
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x2c], ebx
xor eax, eax
mov word [ebp + 0x28], ax
mov byte [ebp - 4], 0x20
lea ecx, [ebp + 0x24]
push ecx
mov ecx, esi
call fcn.0059cba0
cmp dword [esi + 8], ebx
jne 0x5a379f
cmp dword [esi + 4], ebx
jne 0x5a379f
cmp byte [ebp + 0xbc], 0
je 0x5a379f
cmp dword [esi + 0x4c0], ebx
je 0x5a379f
cmp dword [esi + 0x4ec], ebx
jne 0x5a379f
mov eax, dword [esi + 0xa94]
cmp eax, 0x7540
je 0x5a379f
cmp eax, 0x7553
jne 0x5a3466
mov eax, dword [ebp + 0x24]
cmp eax, ebx
mov ecx, eax
jne 0x5a341b
lea ecx, [ebp + 0x28]
mov eax, dword [ebp + 0x54]
cmp eax, ebx
jne 0x5a3425
lea eax, [ebp + 0x58]
push 0x10024
push ecx
push eax
push ebx
call fcn.00469fc0
add esp, 0x10
cmp eax, 6
jne 0x5a379f
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x5a379f
mov edx, dword [esi + 0x4c0]
push edx
push 0x13bb
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x5a379f
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x38], ebx
xor eax, eax
mov word [ebp + 0x34], ax
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
je 0x5a348f
mov ecx, dword [0x70f730]
push ecx
push eax
lea ecx, [ebp + 0x30]
call fcn.00401960
jmp 0x5a34a2
mov eax, dword [ebp + 0x24]
cmp eax, ebx
jne 0x5a3499
lea eax, [ebp + 0x28]
push eax
lea ecx, [ebp + 0x30]
call fcn.004017d0
cmp dword [esi + 0xa94], 0x80090326
jne 0x5a3563
cmp dword [0x70f5d4], ebx
jne 0x5a3563
xor eax, eax
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x44], eax
xor edx, edx
mov word [ebp + 0x40], dx
mov bl, 0x22
mov byte [ebp - 4], bl
mov eax, dword [0x70f730]
push eax
mov ecx, dword [0x710fe8]
push ecx
lea ecx, [ebp + 0x48]
call fcn.004583c0
mov byte [ebp - 4], 0x23
mov eax, dword [ebp + 0x48]
test eax, eax
mov ecx, eax
jne 0x5a34f6
lea ecx, [ebp + 0x4c]
mov eax, dword [ebp + 0x54]
test eax, eax
jne 0x5a3500
lea eax, [ebp + 0x58]
push 0
push ecx
push eax
push str._s_r_n_r_n_r_n_s
lea ecx, [ebp + 0x3c]
call fcn.00402300
mov eax, dword [ebp + 0x30]
test eax, eax
mov ecx, eax
jne 0x5a351d
lea ecx, [ebp + 0x34]
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5a3527
lea eax, [ebp + 0x40]
push 0x50034
push ecx
push eax
push 0
call fcn.00469fc0
add esp, 0x10
cmp eax, 6
jne 0x5a354c
push str.https:__www.internetdownloadmanager.com_support_xp_https_problems.html
push 0
call fcn.004a5000
add esp, 8
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.004011f0
mov byte [ebp - 4], 0x21
lea ecx, [ebp + 0x3c]
jmp 0x5a378e
cmp byte [esi + 0x34d], 0
je 0x5a360b
xor edi, edi
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x50], edi
xor edx, edx
mov word [ebp + 0x4c], dx
mov bl, 0x24
mov byte [ebp - 4], bl
mov eax, dword [0x70f730]
push eax
mov ecx, dword [0x710f44]
push ecx
lea ecx, [ebp + 0x3c]
call fcn.004583c0
mov byte [ebp - 4], 0x25
mov eax, dword [ebp + 0x3c]
cmp eax, edi
mov ecx, eax
jne 0x5a35a8
lea ecx, [ebp + 0x40]
mov eax, dword [ebp + 0x54]
cmp eax, edi
jne 0x5a35b2
lea eax, [ebp + 0x58]
push edi
push ecx
push eax
push str._s_r_n_r_n_r_n_s
lea ecx, [ebp + 0x48]
call fcn.00402300
mov eax, dword [ebp + 0x30]
cmp eax, edi
mov ecx, eax
jne 0x5a35ce
lea ecx, [ebp + 0x34]
mov eax, dword [ebp + 0x48]
cmp eax, edi
jne 0x5a35d8
lea eax, [ebp + 0x4c]
push 0x50034
push ecx
push eax
push edi
call fcn.00469fc0
add esp, 0x10
cmp eax, 6
jne 0x5a35fb
push str.https:__www.internetdownloadmanager.com_register_new_faq_How_to_configure_Firewalls_for_IDM.html
push edi
call fcn.004a5000
add esp, 8
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x3c]
call fcn.004011f0
jmp 0x5a3787
mov eax, dword [ebp + 0x54]
cmp eax, ebx
jne 0x5a3615
lea eax, [ebp + 0x58]
push eax
lea ecx, [ebp + 0x48]
call fcn.00402160
mov bl, 0x26
mov byte [ebp - 4], bl
cmp byte [ebp - 0x1d], 0
je 0x5a3710
cmp byte [ebp - 0x25], 0
je 0x5a363c
mov byte [ebp - 0x1d], 0
jmp 0x5a3710
mov dword [ebp - 0x34], 1
test dword [esi + 0x16c], 0x100000
jne 0x5a3710
mov edx, dword [esi + 0x13c]
mov eax, edx
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5a3660
sub eax, edi
je 0x5a3710
push 0x5c
push edx
call fcn.005fad90
add esp, 8
mov edi, eax
test edi, edi
je 0x5a3683
inc edi
jmp 0x5a3689
mov edi, dword [esi + 0x13c]
push 0xb
push str.firefox.exe
push edi
call fcn.005ffd4c
add esp, 0xc
test eax, eax
je 0x5a36c5
push 0xa
push str.chrome.exe
push edi
call fcn.005fd020
add esp, 0xc
test eax, eax
je 0x5a36c5
push 0x13
push str.MicrosoftEdgeCP.exe
push edi
call fcn.005fd020
add esp, 0xc
test eax, eax
jne 0x5a3710
mov dword [ebp - 0x34], 0
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x71104c]
push eax
lea ecx, [ebp + 0x3c]
call fcn.004583c0
mov byte [ebp - 4], 0x27
push str._r_n_r_n
lea ecx, [ebp + 0x48]
call fcn.00405210
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5a36fc
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x48]
call fcn.00405210
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x3c]
call fcn.004011f0
mov eax, dword [esi + 0xa94]
cmp eax, 0xffffffff
je 0x5a3727
cmp eax, 0x753b
mov eax, 0x30
jne 0x5a372c
mov eax, 0x10
mov edx, dword [ebp + 0x30]
test edx, edx
jne 0x5a3736
lea edx, [ebp + 0x34]
mov ecx, dword [ebp + 0x48]
test ecx, ecx
jne 0x5a3740
lea ecx, [ebp + 0x4c]
or eax, 0x50000
push eax
push edx
push ecx
push 0
call fcn.00469fc0
add esp, 0x10
cmp byte [ebp - 0x1d], 0
je 0x5a3773
mov ecx, dword [esi + 0x4c0]
push ecx
push 0x14cd
push 0x111
mov edx, dword [esi + 0x14]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [esi + 0xa94], 0x757a
jne 0x5a3787
lea ecx, [esi + 0x20]
call fcn.005b0b10
mov byte [ebp - 4], 0x21
lea ecx, [ebp + 0x48]
call fcn.004011f0
mov byte [ebp - 4], 0x20
lea ecx, [ebp + 0x30]
call fcn.004011f0
mov eax, dword [esi + 4]
test eax, eax
je 0x5a3908
cmp eax, 3
jne 0x5a37bf
cmp dword [esi + 0xa94], 0x756e
je 0x5a386a
cmp byte [ebp + 0xbc], 0
je 0x5a386a
cmp dword [esi + 0xa94], 0xffffffff
jne 0x5a37fd
push 0x50010
push 0x64ed18
mov eax, dword [0x710518]
push eax
push 0
call fcn.00469b60
add esp, 0x10
push 0
mov ecx, esi
call fcn.0059ae20
jmp 0x5a390f
push 0x64ed18
lea ecx, [ebp + 0x48]
call fcn.00406ea0
mov byte [ebp - 4], 0x28
mov eax, dword [esi + 0xa94]
cmp eax, 0xffffffff
je 0x5a3825
cmp eax, 0x753b
mov eax, 0x30
jne 0x5a382a
mov eax, 0x10
mov edx, dword [ebp + 0x48]
test edx, edx
jne 0x5a3834
lea edx, [ebp + 0x4c]
mov ecx, dword [ebp + 0x54]
test ecx, ecx
jne 0x5a383e
lea ecx, [ebp + 0x58]
or eax, 0x50000
push eax
push edx
push ecx
push 0
call fcn.00469fc0
add esp, 0x10
mov byte [ebp - 4], 0x20
lea ecx, [ebp + 0x48]
call fcn.004011f0
push 0
mov ecx, esi
call fcn.0059ae20
jmp 0x5a390f
cmp eax, 4
jne 0x5a38fd
cmp byte [esi + 0x34d], 0
je 0x5a38fd
mov byte [esi + 0x34d], 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push str.bHDIShwd
mov eax, dword [0x70f604]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x5a38fd
mov dword [ebp - 0x1c], 1
push 4
lea ecx, [ebp - 0x1c]
push ecx
push 4
push 0
push str.bHDIShwd
mov edx, dword [0x70f604]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.00411640
push eax
lea ecx, [ebp - 0xcc]
call fcn.0051ad50
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0xcc]
call fcn.005d199e
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xcc]
call fcn.0051add0
push 0
mov ecx, esi
call fcn.0059ae20
jmp 0x5a390f
mov byte [esi + 0x34d], 0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp + 0x24]
call fcn.004011f0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.00402550
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x54]
call fcn.004011f0
mov dword [ebp - 4], 0xffffffff
jmp 0x5a2508