Function at 0x40e65d
Capabilities:
Get common file path
Parse pe header
Persist via run registry key

Disassembly:
push ebp
sub esp, 0x244
lea ebp, [esp - 4]
mov eax, dword [0x4a946c]
xor eax, ebp
mov dword [ebp + 0x244], eax
push 0x184
mov eax, 0x46f153
call fcn.004550bc
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0xd], bl
call fcn.00435c47
mov dword [ebp - 4], ebx
call fcn.00442144
push eax
lea ecx, [ebp - 0x38]
call fcn.0040132d
mov byte [ebp - 4], 1
call fcn.00442144
push eax
lea ecx, [ebp - 0x14]
call fcn.0040132d
mov byte [ebp - 4], 2
call fcn.00442144
push eax
lea ecx, [ebp - 0x30]
call fcn.0040132d
mov byte [ebp - 4], 3
call fcn.00442144
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040132d
mov eax, dword [ebp + 0x250]
mov ecx, 0x223a8
cmp eax, ecx
mov byte [ebp - 4], 4
ja 0x40f45f
je 0x40f32b
mov ecx, 0x1d655
cmp eax, ecx
ja 0x40ebdc
je 0x40ebc7
add ecx, 0xffffff97
cmp eax, ecx
ja 0x40eab7
je 0x40eaa2
mov ecx, 0x1d589
cmp eax, ecx
ja 0x40ea3a
je 0x40ea25
cmp eax, 0x18a24
je 0x40ea13
cmp eax, 0x1ae1b
je 0x40e9fe
cmp eax, 0x1ae77
jbe 0x411904
cmp eax, 0x1ae7d
jbe 0x40e84a
cmp eax, 0x1ae7e
je 0x40e781
cmp eax, 0x1d588
jne 0x411904
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push str.SOFTWAREMicrosoftOffice9.0
jmp 0x4118f3
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x411908
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push 0x477979
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.AppData
mov byte [ebp - 4], 0xa
call fcn.00401c93
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xb
call fcn.0040170c
mov ecx, dword [ebp - 0xd4]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x411908
push str.Opera
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0xc
call fcn.0040170c
mov ecx, dword [ebp - 0x168]
add ecx, 0xfffffff0
call fcn.004010af
push ebx
push dword [ebp - 0x38]
call fcn.00456885
pop ecx
pop ecx
cmp eax, 0xffffffff
jmp 0x411902
mov esi, 0x80000002
push esi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMozillaMozilla_Firefox
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
jne 0x411904
push 0x80000001
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, 0x477979
je 0x40e955
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.AppData
mov byte [ebp - 4], 5
call fcn.00401c93
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call fcn.0040170c
mov ecx, dword [ebp - 0x170]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x40e955
push str.MozillaFirefoxprofiles.ini
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call fcn.0040170c
mov ecx, dword [ebp - 0x178]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
lea eax, [ebp]
push eax
push dword [ebp - 0x1c]
call edi
cmp eax, 0xffffffff
je 0x40e955
mov byte [ebp - 0xd], 1
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallFoxPlus
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x411908
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.DisplayIcon
mov byte [ebp - 4], 8
call fcn.00401c93
lea eax, [ebp - 0x180]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.0040170c
mov ecx, dword [ebp - 0x180]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x411908
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
lea eax, [ebp]
push eax
push dword [ebp - 0x1c]
call edi
cmp eax, 0xffffffff
jmp 0x411902
mov ecx, edi
call fcn.0040de60
cmp eax, 0x68
jne 0x411908
jmp 0x411904
mov ecx, edi
call fcn.0040de60
cmp eax, 0x67
je 0x411904
jmp 0x40ea05
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice9.0Word
jmp 0x4118f3
sub eax, 0x1d58a
je 0x40ea8d
dec eax
je 0x40ea78
dec eax
je 0x40ea63
dec eax
jne 0x411904
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice9.0CommonOpen_FindMicrosoft_FrontPage
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice9.0PowerPoint
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice9.0Access
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice9.0Excel
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREMicrosoftOffice10.0
jmp 0x4118f3
mov ecx, 0x1d650
cmp eax, ecx
ja 0x40eb5f
je 0x40eb4a
sub eax, 0x1d5ed
je 0x40eb35
dec eax
je 0x40eb20
dec eax
je 0x40eb0b
dec eax
je 0x40eaf6
dec eax
jne 0x411904
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice10.0CommonOpen_FindMicrosoft_FrontPage
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice10.0PowerPoint
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice10.0Access
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice10.0Excel
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice10.0Word
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice11.0
jmp 0x4118f3
sub eax, 0x1d651
je 0x40ebb2
dec eax
je 0x40eb9d
dec eax
je 0x40eb88
dec eax
jne 0x411904
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice11.0PowerPoint
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice11.0Access
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice11.0Excel
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice11.0Word
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice11.0CommonOpen_FindMicrosoft_Office_FrontPage
jmp 0x4118f3
mov ecx, 0x1d8a8
cmp eax, ecx
ja 0x40ee85
je 0x40ee4d
mov ecx, 0x1d65b
cmp eax, ecx
ja 0x40ec97
je 0x40ec82
sub eax, 0x1d656
je 0x40ec6d
dec eax
je 0x40ec58
dec eax
je 0x40ec43
dec eax
je 0x40ec2e
dec eax
jne 0x411904
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice11.0Clip_Organizer
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice11.0Visio
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice11.0MS_Project
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice11.0InfoPath
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice11.0Publisher
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice11.0OIS
jmp 0x4118f3
sub eax, 0x1d65c
je 0x40ee38
dec eax
je 0x40ee23
sub eax, 0x183
je 0x40edec
sub eax, 0x64
jne 0x411904
mov edi, 0x80000001
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAdobeAcrobat_Reader7.0InstallPath
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
jne 0x40ecfc
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAdobeAdobe_Acrobat7.0InstallPath
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
je 0x40ed00
mov byte [ebp - 0xd], 1
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAdobeAcrobat_Reader8.0InstallPath
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
jne 0x40ed3a
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAdobeAdobe_Acrobat8.0InstallPath
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
je 0x40ed3e
mov byte [ebp - 0xd], 1
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAdobeAcrobat_Reader6.0InstallPath
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
jne 0x40ed78
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAdobeAdobe_Acrobat6.0InstallPath
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
je 0x40ed7c
mov byte [ebp - 0xd], 1
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAdobeAcrobat_Reader5.0InstallPath
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
jne 0x40edb6
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAdobeAdobe_Acrobat5.0InstallPath
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
je 0x40edba
mov byte [ebp - 0xd], 1
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAdobeAcrobat_Reader4.0InstallPath
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
jne 0x411904
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAdobeAdobe_Acrobat4.0InstallPath
jmp 0x4118f3
mov edi, 0x80000001
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareLocal_AppWizard_Generated_ApplicationsFoxit_PDF_Reader
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
jne 0x411904
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareFoxit_SoftwareFoxit_Reader
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftOffice12.0
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftMSPaper_11.0
jmp 0x4118f3
push 0x104
lea eax, [ebp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp + 0x140]
push str.uedit32.INI
push eax
call fcn.00457470
lea eax, [ebp + 0x140]
push ebx
push eax
call fcn.00456885
add esp, 0x10
jmp 0x40e842
mov ecx, 0x1fe96
cmp eax, ecx
ja 0x40eff0
je 0x40efdb
sub eax, 0x1d90c
je 0x40efc6
sub eax, 0x64
je 0x40efb1
sub eax, 0x64
je 0x40ef9c
sub eax, 0x22c4
je 0x40eedc
sub eax, 0x1f4
jne 0x411904
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAdobePhotoshop_Elements2.0
jmp 0x4118f3
mov esi, 0x80000002
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsACDSee.exe
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
je 0x40ef02
mov byte [ebp - 0xd], 1
mov edi, 0x80000001
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareACD_SystemsACDSee
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
je 0x40ef28
mov byte [ebp - 0xd], 1
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareACD_SystemsACDSee50
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
je 0x40ef49
mov byte [ebp - 0xd], 1
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareACD_SystemsACDSee60
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
je 0x40ef6a
mov byte [ebp - 0xd], 1
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareACD_SystemsACDSee70
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
je 0x40ef8b
mov byte [ebp - 0xd], 1
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsACDSee6.exe
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftHTML_Help_Workshop
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareScooter_SoftwareBeyond_Compare
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareES_ComputingEditPlus_2
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAdobePhotoshop
jmp 0x4118f3
sub eax, 0x1fef0
je 0x40f316
sub eax, 0x64
je 0x40f301
sub eax, 0x64
je 0x40f2ec
sub eax, 0x238c
jne 0x411904
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
mov ecx, edi
call fcn.00419559
dec eax
je 0x40f141
dec eax
jne 0x40f23b
push 0x80000003
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str..DEFAULTSoftwareMicrosoftKeyboardNative_Media_PlayersWMP
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
mov edi, str.ExePath
je 0x40f0c0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push edi
mov byte [ebp - 4], 0xd
call fcn.00401c93
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xe
call fcn.0040170c
mov ecx, dword [ebp - 0x188]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
jne 0x40f23b
push 0x80000003
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.S_1_5_21_1715567821_1960408961_839522115_500SoftwareMicrosoftKeyboardNative_Media_PlayersWMP
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x40f23b
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push edi
mov byte [ebp - 4], 0xf
call fcn.00401c93
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x10
call fcn.0040170c
mov ecx, dword [ebp - 0x190]
jmp 0x40f22f
push 0x80000003
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str..DEFAULTSoftwareMicrosoftKeyboardNative_Media_PlayersWMP
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x40f1bd
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.ExePath
mov byte [ebp - 4], 0x11
call fcn.00401c93
lea eax, [ebp - 0xec]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x12
call fcn.0040170c
mov ecx, dword [ebp - 0xec]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
jne 0x40f23b
push 0x80000001
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftMediaPlayerSetupCreatedLinks
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x40f23b
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.AppName
mov byte [ebp - 4], 0x13
call fcn.00401c93
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x14
call fcn.0040170c
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x40f25f
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40f25f
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040130b
test eax, eax
je 0x411908
push 0x78
call fcn.004412cb
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0x15
je 0x40f293
push ebx
push ebx
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.00402579
mov esi, eax
jmp 0x40f295
xor esi, esi
lea eax, [ebp - 0x17c]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040285a
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x16
call fcn.0040170c
mov ecx, dword [ebp - 0x17c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
cmp esi, ebx
je 0x40f2d8
mov ecx, esi
call fcn.0040e4f1
push esi
call fcn.004412f6
pop ecx
push 0x47e4dc
lea ecx, [ebp - 0x30]
call fcn.0040130b
test eax, eax
jmp 0x40ea08
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareTechSmithSnagIt
jmp 0x4118f3
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareHyperionicsHyperSnap_6
jmp 0x4118f3
push 0x80000002
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREJascPaint_Shop_Pro_9Installer
jmp 0x4118f3
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000003
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str..DEFAULTSoftwareMicrosoftKeyboardNative_Media_PlayersWMP
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x40f3b8
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.ExePath
mov byte [ebp - 4], 0x17
call fcn.00401c93
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x18
call fcn.0040170c
mov ecx, dword [ebp - 0x54]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x40f3dc
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40f3dc
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040130b
test eax, eax
je 0x411908
push 0x78
call fcn.004412cb
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0x19
je 0x40f410
push ebx
push ebx
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.00402579
mov esi, eax
jmp 0x40f412
xor esi, esi
lea eax, [ebp - 0xf4]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040285a
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x1a
call fcn.0040170c
mov ecx, dword [ebp - 0xf4]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
cmp esi, ebx
je 0x40f455
mov ecx, esi
call fcn.0040e4f1
push esi
call fcn.004412f6
pop ecx
push 0x47e46c
jmp 0x40f2dd
mov ecx, 0x27290
cmp eax, ecx
ja 0x410a9f
je 0x41094d
mov ecx, 0x227f4
cmp eax, ecx
ja 0x410304
je 0x4102e6
mov ecx, 0x22600
cmp eax, ecx
ja 0x40fd47
je 0x40fb9b
sub eax, 0x2240c
je 0x40f92c
sub eax, 0x64
je 0x40f6b2
sub eax, 0x64
je 0x40f69d
sub eax, 0x64
je 0x40f688
sub eax, 0x64
jne 0x411904
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREClassesRealJukebox.ACP.1DefaultIcon
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x40f594
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x2b
call fcn.00401c93
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x2c
call fcn.0040170c
mov ecx, dword [ebp - 0x5c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push str.RealPlay.exe
lea ecx, [ebp - 0x14]
call fcn.0040226b
add eax, 0xd
push eax
push ebx
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402305
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x2d
call fcn.0040170c
mov ecx, dword [ebp - 0x144]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x40f5b8
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40f5b8
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040130b
test eax, eax
je 0x411908
push 0x78
call fcn.004412cb
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0x2e
je 0x40f5ec
push ebx
push ebx
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.00402579
mov esi, eax
jmp 0x40f5ee
xor esi, esi
lea eax, [ebp - 0x64]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040285a
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x2f
call fcn.0040170c
mov ecx, dword [ebp - 0x64]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push 0x47e428
lea ecx, [ebp - 0x30]
call fcn.0040130b
test eax, eax
jne 0x40f66d
lea eax, [ebp - 0xfc]
push eax
mov ecx, esi
call fcn.00402830
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x30
call fcn.0040170c
mov ecx, dword [ebp - 0xfc]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push str.RealOne_Player
lea ecx, [ebp - 0x30]
call fcn.0040226b
test eax, eax
jne 0x40f66d
mov byte [ebp - 0xd], 1
cmp esi, ebx
je 0x411908
mov ecx, esi
call fcn.0040e4f1
push esi
call fcn.004412f6
pop ecx
jmp 0x411908
push 0x80000002
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREClassesidpfile_shellopencommand
jmp 0x4118f3
push 0x80000002
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREApple_Computer__Inc.QuickTime
jmp 0x4118f3
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallWindows_Media_Player
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
test eax, eax
mov ebx, 0x47a710
mov edi, str.wmplayer.exe
je 0x40f796
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.DisplayIcon
mov byte [ebp - 4], 0x23
call fcn.00401c93
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x24
call fcn.0040170c
mov ecx, dword [ebp - 0x6c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push esi
push ebx
lea ecx, [ebp - 0x14]
call fcn.00406586
push 0
push edi
lea ecx, [ebp - 0x14]
call fcn.0040226b
add eax, 0xd
push eax
push 0
lea eax, [ebp - 0x16c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402305
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x25
call fcn.0040170c
mov ecx, dword [ebp - 0x16c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x40f871
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREMicrosoftMultimediaWMPlayer
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
test eax, eax
je 0x40f871
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.Player.Path
mov byte [ebp - 4], 0x26
call fcn.00401c93
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x27
call fcn.0040170c
mov ecx, dword [ebp - 0x74]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push esi
push ebx
lea ecx, [ebp - 0x14]
call fcn.00406586
xor ebx, ebx
push ebx
push edi
lea ecx, [ebp - 0x14]
call fcn.0040226b
push ebx
push edi
lea ecx, [ebp - 0x14]
call fcn.0040226b
add eax, 0xd
push eax
push ebx
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402305
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x28
call fcn.0040170c
mov ecx, dword [ebp - 0x104]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x40f898
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40f898
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040130b
test eax, eax
je 0x411908
push 0x78
call fcn.004412cb
pop ecx
mov dword [ebp - 0x18], eax
test eax, eax
mov byte [ebp - 4], 0x29
je 0x40f8ce
push 0
push 0
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.00402579
mov esi, eax
jmp 0x40f8d0
xor esi, esi
lea eax, [ebp - 0x7c]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040285a
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x2a
call fcn.0040170c
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
test esi, esi
je 0x40f90d
mov ecx, esi
call fcn.0040e4f1
push esi
call fcn.004412f6
pop ecx
push 0x47e32c
lea ecx, [ebp - 0x30]
call fcn.0040130b
test eax, eax
je 0x411904
push 0x47e328
jmp 0x40f2dd
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREClassesWMP.DVR_MSFileDefaultIcon
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
test eax, eax
mov ebx, 0x47a710
mov edi, str.wmplayer.exe
je 0x40fa12
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x1b
call fcn.00401c93
lea eax, [ebp - 0x14c]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x1c
call fcn.0040170c
mov ecx, dword [ebp - 0x14c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push esi
push ebx
lea ecx, [ebp - 0x14]
call fcn.00406586
push 0
push edi
lea ecx, [ebp - 0x14]
call fcn.0040226b
add eax, 0xd
push eax
push 0
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402305
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x1d
call fcn.0040170c
mov ecx, dword [ebp - 0x84]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x40faef
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareCLASSESWVXFile_shellplaycommand
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
test eax, eax
je 0x40faef
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x1e
call fcn.00401c93
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x1f
call fcn.0040170c
mov ecx, dword [ebp - 0x10c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push esi
push ebx
lea ecx, [ebp - 0x14]
call fcn.00406586
xor ebx, ebx
push ebx
push edi
lea ecx, [ebp - 0x14]
call fcn.0040226b
push ebx
push edi
lea ecx, [ebp - 0x14]
call fcn.0040226b
add eax, 0xd
push eax
push ebx
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402305
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x20
call fcn.0040170c
mov ecx, dword [ebp - 0x8c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x40fb16
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40fb16
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040130b
test eax, eax
je 0x411908
push 0x78
call fcn.004412cb
pop ecx
mov dword [ebp - 0x18], eax
test eax, eax
mov byte [ebp - 4], 0x21
je 0x40fb4c
push 0
push 0
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.00402579
mov esi, eax
jmp 0x40fb4e
xor esi, esi
lea eax, [ebp - 0x18c]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040285a
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x22
call fcn.0040170c
mov ecx, dword [ebp - 0x18c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
test esi, esi
je 0x40fb91
mov ecx, esi
call fcn.0040e4f1
push esi
call fcn.004412f6
pop ecx
push 0x47e2cc
jmp 0x40f2dd
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsRealPlay.exe
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x40fc6e
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x31
call fcn.00401c93
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x32
call fcn.0040170c
mov ecx, dword [ebp - 0x94]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push str._realplay.exe
lea ecx, [ebp - 0x14]
call fcn.0040226b
add eax, 0xd
push eax
push ebx
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402305
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x33
call fcn.0040170c
mov ecx, dword [ebp - 0x114]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x40fc92
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40fc92
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040130b
test eax, eax
je 0x411908
push 0x78
call fcn.004412cb
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0x34
je 0x40fcc6
push ebx
push ebx
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.00402579
mov esi, eax
jmp 0x40fcc8
xor esi, esi
lea eax, [ebp - 0x9c]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.00402806
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x35
call fcn.0040170c
mov ecx, dword [ebp - 0x9c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push str.6.0.9.
lea ecx, [ebp - 0x30]
call fcn.0040226b
test eax, eax
jne 0x40f66d
lea eax, [ebp - 0x154]
push eax
mov ecx, esi
call fcn.00402830
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x36
call fcn.0040170c
mov ecx, dword [ebp - 0x154]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push str.RealPlayer
jmp 0x40f65d
sub eax, 0x22664
je 0x410148
sub eax, 0x64
je 0x40ffd8
sub eax, 0x64
je 0x40fed5
sub eax, 0x64
jne 0x411904
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREClassesWinamp.FileDefaultIcon
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x40fe40
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x45
call fcn.00401c93
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x46
call fcn.0040170c
mov ecx, dword [ebp - 0xa4]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push str.Winamp.exe
lea ecx, [ebp - 0x14]
call fcn.0040226b
add eax, 0xb
push eax
push ebx
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402305
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x47
call fcn.0040170c
mov ecx, dword [ebp - 0x11c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x40fe64
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40fe64
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040130b
test eax, eax
je 0x411908
push 0x78
call fcn.004412cb
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0x48
je 0x40fe98
push ebx
push ebx
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.00402579
mov esi, eax
jmp 0x40fe9a
xor esi, esi
lea eax, [ebp - 0xac]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040285a
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x49
call fcn.0040170c
mov ecx, dword [ebp - 0xac]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push 0x47e228
jmp 0x41013b
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareCLASSESWinamp3.File_shellopencommand
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x40ffba
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x42
call fcn.00401c93
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x43
call fcn.0040170c
mov ecx, dword [ebp - 0x174]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push str.Studio.exe
lea ecx, [ebp - 0x14]
call fcn.0040226b
add eax, 0xb
cmp eax, 0xa
jne 0x40ff8e
push ebx
push str.Winamp3.exe
lea ecx, [ebp - 0x14]
call fcn.0040226b
add eax, 0xc
push eax
push ebx
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402305
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x44
call fcn.0040170c
mov ecx, dword [ebp - 0xb4]
add ecx, 0xfffffff0
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x411908
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
jmp 0x40e9f6
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000000
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Winamp.FileDefaultIcon
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x4100ab
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x3d
call fcn.00401c93
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x3e
call fcn.0040170c
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push str.Winamp.exe
lea ecx, [ebp - 0x14]
call fcn.0040226b
add eax, 0xb
push eax
push ebx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402305
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x3f
call fcn.0040170c
mov ecx, dword [ebp - 0xbc]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x4100cf
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4100cf
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040130b
test eax, eax
je 0x411908
push 0x78
call fcn.004412cb
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0x40
je 0x410103
push ebx
push ebx
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.00402579
mov esi, eax
jmp 0x410105
xor esi, esi
lea eax, [ebp - 0x15c]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040285a
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x41
call fcn.0040170c
mov ecx, dword [ebp - 0x15c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push 0x47e1bc
lea ecx, [ebp - 0x30]
call fcn.0040130b
jmp 0x40f665
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallRealPlayer_6.0
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x41021f
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.DisplayIcon
mov byte [ebp - 4], 0x37
call fcn.00401c93
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x38
call fcn.0040170c
mov ecx, dword [ebp - 0xc4]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push str._realplay.exe
lea ecx, [ebp - 0x14]
call fcn.0040226b
add eax, 0xd
push eax
push ebx
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402305
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x39
call fcn.0040170c
mov ecx, dword [ebp - 0x12c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x410243
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x410243
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040130b
test eax, eax
je 0x411908
push 0x78
call fcn.004412cb
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0x3a
je 0x410277
push ebx
push ebx
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.00402579
mov esi, eax
jmp 0x410279
xor esi, esi
lea eax, [ebp - 0xcc]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.00402806
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x3b
call fcn.0040170c
mov ecx, dword [ebp - 0xcc]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push str.6.0.12.
lea ecx, [ebp - 0x30]
call fcn.0040226b
test eax, eax
jne 0x40f66d
lea eax, [ebp - 0x184]
push eax
mov ecx, esi
call fcn.00402830
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x3c
call fcn.0040170c
mov ecx, dword [ebp - 0x184]
jmp 0x40fd30
push 0x80000001
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x47e154
jmp 0x4118f3
mov ecx, 0x24ab8
cmp eax, ecx
ja 0x410560
je 0x4104db
sub eax, 0x22858
je 0x4104bd
sub eax, 0x64
je 0x41049f
sub eax, 0x64
je 0x410410
sub eax, 0x64
je 0x4103d9
sub eax, 0x20d0
jne 0x411904
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsWinRAR.exe
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x4103c3
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
mov esi, 0x477979
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x4a
call fcn.00401c93
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x4b
call fcn.0040170c
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x411908
lea ecx, [ebp]
push ecx
push eax
jmp 0x40ffcd
mov edi, 0x80000001
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAdaptecEasy_CD_Creator
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
jne 0x411904
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAdaptecEasy_CD_Creator_4
jmp 0x4118f3
push str.ProgramFiles
call fcn.00459582
pop ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00401abe
push str.KMPlayer
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x134]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x8d
call fcn.004017e2
mov ecx, dword [ebp - 0x134]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push dword [ebp - 0x38]
call fcn.00456885
cmp eax, 0xffffffff
pop ecx
pop ecx
je 0x41046f
mov byte [ebp - 0xd], 1
push str.The_KMPlayer
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x8e
call fcn.004017e2
mov ecx, dword [ebp - 0xdc]
jmp 0x40e82f
push 0x80000001
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareGabestMedia_Player_Classic
jmp 0x4118f3
push 0x80000001
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMacromediaFlashPlayer
jmp 0x4118f3
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000001
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareNico_Mak_ComputingWinZipPrograms
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x4103c3
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x477979
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.zip2exe
mov byte [ebp - 4], 0x4e
call fcn.00401c93
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x4f
call fcn.0040170c
mov ecx, dword [ebp - 0x164]
jmp 0x4103bb
sub eax, 0x24b1c
je 0x4108d1
sub eax, 0x2648
je 0x410848
sub eax, 0x64
je 0x4106e4
sub eax, 0x64
jne 0x411904
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWARESymantecInstalledApps
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x410655
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push 0x47e000
mov byte [ebp - 4], 0x57
call fcn.00401c93
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x58
call fcn.0040170c
mov ecx, dword [ebp - 0xe4]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push str.Navw32.exe
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x59
call fcn.0040170c
mov ecx, dword [ebp - 0x13c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x410679
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x410679
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040130b
test eax, eax
je 0x411908
push 0x78
call fcn.004412cb
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0x5a
je 0x4106ad
push ebx
push ebx
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.00402579
mov esi, eax
jmp 0x4106af
xor esi, esi
lea eax, [ebp - 0x44]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040285a
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x5b
call fcn.0040170c
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push 0x47e328
jmp 0x41013b
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREClassesNavScanFileDefaultIcon
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x4107ac
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x52
call fcn.00401c93
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x53
call fcn.0040170c
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push 0x47a5a4
lea ecx, [ebp - 0x14]
call fcn.0040226b
cmp eax, ebx
jle 0x4107ac
push eax
push ebx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402305
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x54
call fcn.0040170c
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x4107d0
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4107d0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040130b
test eax, eax
je 0x411908
push 0x78
call fcn.004412cb
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0x55
je 0x410804
push ebx
push ebx
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.00402579
mov esi, eax
jmp 0x410806
xor esi, esi
lea eax, [ebp - 0x58]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040285a
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x56
call fcn.0040170c
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push dword [ebp - 0x30]
call fcn.00459616
cmp eax, 0xa
pop ecx
jg 0x40f66d
jmp 0x40f669
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREZone_LabsZoneAlarm
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x4108c6
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x477979
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.InstallDirectory
mov byte [ebp - 4], 0x50
call fcn.00401c93
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x51
call fcn.0040170c
mov ecx, dword [ebp - 0x60]
add ecx, 0xfffffff0
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
jmp 0x411902
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths7zFM.exe
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x40ffba
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
mov esi, 0x477979
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x4c
call fcn.00401c93
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x4d
call fcn.0040170c
mov ecx, dword [ebp - 0x68]
jmp 0x40ffb2
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareSymantecInstalledApps
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x410a0a
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.Norton_Internet_Security
mov byte [ebp - 4], 0x5c
call fcn.00401c93
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x5d
call fcn.0040170c
mov ecx, dword [ebp - 0x70]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push str.HNetWiz.exe
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x5e
call fcn.0040170c
mov ecx, dword [ebp - 0x78]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x410a2e
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x410a2e
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040130b
test eax, eax
je 0x411908
push 0x78
call fcn.004412cb
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0x5f
je 0x410a62
push ebx
push ebx
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.00402579
mov esi, eax
jmp 0x410a64
xor esi, esi
lea eax, [ebp - 0x80]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040285a
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x60
call fcn.0040170c
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push dword [ebp - 0x30]
call fcn.00459616
cmp eax, 7
jmp 0x41083c
mov ecx, 0x29a68
cmp eax, ecx
ja 0x411650
je 0x41157d
mov ecx, 0x29874
cmp eax, ecx
ja 0x4111fd
je 0x411049
sub eax, 0x272f4
je 0x410ee7
sub eax, 0x64
je 0x410d96
sub eax, 0x64
je 0x410c45
sub eax, 0x12c
je 0x410c30
sub eax, 0x64
jne 0x411904
push str.ProgramFiles
call fcn.00459582
pop ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00401759
push str.AntiVir_PersonalEdition_Classic
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x70
call fcn.0040170c
mov ecx, dword [ebp - 0x88]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push dword [ebp - 0x38]
call fcn.00456885
or esi, 0xffffffff
cmp eax, esi
pop ecx
pop ecx
je 0x410b57
mov byte [ebp - 0xd], 1
push str.AntiVir_PersonalEdition_Premium
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x71
call fcn.0040170c
mov ecx, dword [ebp - 0x90]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push dword [ebp - 0x38]
call fcn.00456885
cmp eax, esi
pop ecx
pop ecx
je 0x410ba1
mov byte [ebp - 0xd], 1
push str.AviraAntiVir_PersonalEdition_Classic
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x72
call fcn.0040170c
mov ecx, dword [ebp - 0x98]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push dword [ebp - 0x38]
call fcn.00456885
cmp eax, esi
pop ecx
pop ecx
je 0x410beb
mov byte [ebp - 0xd], 1
push str.AviraAntiVir_PersonalEdition_Premium
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x73
call fcn.0040170c
mov ecx, dword [ebp - 0xa0]
add ecx, 0xfffffff0
call fcn.004010af
push ebx
push dword [ebp - 0x38]
call fcn.00456885
pop ecx
pop ecx
cmp eax, esi
jmp 0x411902
push 0x80000002
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREEsetNodCurrentVersionModulesImon
jmp 0x4118f3
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareSymantecInstalledApps
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x410d12
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.Norton_Internet_Security
mov byte [ebp - 4], 0x6b
call fcn.00401c93
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x6c
call fcn.0040170c
mov ecx, dword [ebp - 0xa8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push str.AlertAst.exe
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x6d
call fcn.0040170c
mov ecx, dword [ebp - 0xb0]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x410d36
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x410d36
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040130b
test eax, eax
je 0x411908
push 0x78
call fcn.004412cb
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0x6e
je 0x410d6a
push ebx
push ebx
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.00402579
mov esi, eax
jmp 0x410d6c
xor esi, esi
lea eax, [ebp - 0xb8]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040285a
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x6f
call fcn.0040170c
mov ecx, dword [ebp - 0xb8]
jmp 0x411033
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareSymantecInstalledApps
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x410e63
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.Norton_Internet_Security
mov byte [ebp - 4], 0x66
call fcn.00401c93
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x67
call fcn.0040170c
mov ecx, dword [ebp - 0xc0]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push str.AlertAst.exe
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x68
call fcn.0040170c
mov ecx, dword [ebp - 0xc8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x410e87
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x410e87
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040130b
test eax, eax
je 0x411908
push 0x78
call fcn.004412cb
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0x69
je 0x410ebb
push ebx
push ebx
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.00402579
mov esi, eax
jmp 0x410ebd
xor esi, esi
lea eax, [ebp - 0xd0]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040285a
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x6a
call fcn.0040170c
mov ecx, dword [ebp - 0xd0]
jmp 0x410a83
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareSymantecInstalledApps
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x410fb4
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.Norton_Internet_Security
mov byte [ebp - 4], 0x61
call fcn.00401c93
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x62
call fcn.0040170c
mov ecx, dword [ebp - 0xd8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push str.HNetWiz.exe
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x63
call fcn.0040170c
mov ecx, dword [ebp - 0xe0]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x410fd8
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x410fd8
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040170c
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040130b
test eax, eax
je 0x411908
push 0x78
call fcn.004412cb
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0x64
je 0x41100c
push ebx
push ebx
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.00402579
mov esi, eax
jmp 0x41100e
xor esi, esi
lea eax, [ebp - 0xe8]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040285a
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x65
call fcn.0040170c
mov ecx, dword [ebp - 0xe8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push 0x47e46c
jmp 0x41013b
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallNet_Transport_is1
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
mov edi, str.NetTransport.exe
je 0x411117
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.Inno_Setup:_App_Path
mov byte [ebp - 4], 0x74
call fcn.00401c93
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x75
call fcn.0040170c
mov ecx, dword [ebp - 0xf0]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x76
call fcn.0040170c
mov ecx, dword [ebp - 0xf8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x411133
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x411133
mov byte [ebp - 0xd], 1
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000002
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREXiNetTransport_2
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x4111ea
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.Path
mov byte [ebp - 4], 0x77
call fcn.00401c93
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x78
call fcn.0040170c
mov ecx, dword [ebp - 0x100]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x79
call fcn.0040170c
mov ecx, dword [ebp - 0x108]
add ecx, 0xfffffff0
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x411908
push ebx
push eax
jmp 0x40e83b
sub eax, 0x298d8
je 0x4114ee
sub eax, 0x64
je 0x411428
sub eax, 0x64
je 0x41134d
sub eax, 0x64
jne 0x411904
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
push esi
lea ecx, [ebp - 0x14]
call fcn.00401759
push 0x80000001
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x411908
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.AppData
mov byte [ebp - 4], 0x81
call fcn.00401c93
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x82
call fcn.0040170c
mov ecx, dword [ebp - 0x110]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x411908
push str.Free_Download_Managerhistory.sav
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x83
call fcn.0040170c
mov ecx, dword [ebp - 0x118]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push ebx
push dword [ebp - 0x1c]
call fcn.00456885
cmp eax, 0xffffffff
pop ecx
pop ecx
jne 0x411904
push str.Free_Download_Manager_flag.txt
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x84
call fcn.0040170c
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
call fcn.004010af
push ebx
push dword [ebp - 0x1c]
jmp 0x40e83b
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
mov edi, 0x80000001
push edi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareDownloadManager
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x4113e0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.ExePath
mov byte [ebp - 4], 0x7f
call fcn.00401c93
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x80
call fcn.0040170c
mov ecx, dword [ebp - 0x128]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x411908
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x411904
push edi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareDownloadManager
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
jmp 0x411908
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000001
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareNetAnts
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x4103c3
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.Location
mov byte [ebp - 4], 0x7c
call fcn.00401c93
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x7d
call fcn.0040170c
mov ecx, dword [ebp - 0x130]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push str.NetAnts.exe
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x7e
call fcn.0040170c
mov ecx, dword [ebp - 0x138]
jmp 0x4103bb
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
lea ecx, [ebp - 0x14]
call fcn.0040135c
push 0x80000001
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareJetCarJetCarGeneral
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x4103c3
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.AppPath
mov byte [ebp - 4], 0x7a
call fcn.00401c93
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x7b
call fcn.0040170c
mov ecx, dword [ebp - 0x140]
jmp 0x4103bb
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401759
push esi
lea ecx, [ebp - 0x14]
call fcn.00401759
push 0x80000001
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x411908
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.AppData
mov byte [ebp - 4], 0x85
call fcn.00401c93
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x86
call fcn.0040170c
mov ecx, dword [ebp - 0x148]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x411908
push str.Orbitconf.dat
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x87
call fcn.0040170c
mov ecx, dword [ebp - 0x150]
jmp 0x41133c
mov ecx, 0x2c04c
cmp eax, ecx
ja 0x411895
je 0x41187a
sub eax, 0x29acc
je 0x411846
sub eax, 0x64
je 0x411831
sub eax, 0x64
je 0x4117f3
sub eax, 0x23f0
je 0x4116ae
sub eax, 0x64
jne 0x411904
push 0x80000001
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAlcohol_SoftAlcohol_120_
jmp 0x4118f3
mov esi, 0x477979
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401abe
lea ecx, [ebp - 0x14]
call fcn.0040135c
mov edi, 0x80000001
push edi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAheadNero___Burning_RomGeneral
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x411741
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.RegisteredTypesNeroPath
mov byte [ebp - 4], 0x89
call fcn.00401c93
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x8a
call fcn.004017e2
mov ecx, dword [ebp - 0x158]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x41175d
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41175d
mov byte [ebp - 0xd], 1
lea ecx, [ebp - 0x14]
call fcn.0040135c
push edi
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAheadNero___Burning_RomDatabase
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, ebx
je 0x4103c3
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.LocalDbPath
mov byte [ebp - 4], 0x8b
call fcn.00401c93
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00436249
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x8c
call fcn.004017e2
mov ecx, dword [ebp - 0x160]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010af
push str..DLL
lea ecx, [ebp - 0x14]
call fcn.004041f7
jmp 0x4103c3
push str.ProgramFiles
call fcn.00459582
pop ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00401abe
push str.Mass_DownloaderINDEX
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x88
call fcn.004017e2
mov ecx, dword [ebp - 0x3c]
jmp 0x40e82f
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareHeadlightGetRight
jmp 0x4118f3
mov edi, 0x80000001
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareReGet_SoftwareReGetPro
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
jne 0x411904
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareReGet_SoftwareReGetDx
jmp 0x4118f3
push 0x80000001
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareAdaptecEasy_CD_Creator
jmp 0x4118f3
sub eax, 0x2c0b0
je 0x4118da
sub eax, 0x64
je 0x4118c8
sub eax, 0x4c2c
je 0x4118af
sub eax, 0x2710
jne 0x411904
mov ecx, edi
call fcn.0040de60
cmp eax, 0x67
je 0x411904
cmp eax, 0x68
je 0x411904
cmp eax, 0x6a
jmp 0x40ea08
push 0x80000001
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareDVD_Shrink
jmp 0x4118f3
push 0x80000001
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareEasyBoot_SystemsUltraISO
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435d31
cmp eax, ebx
je 0x411908
mov byte [ebp - 0xd], 1
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004010af
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.004010af
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004010af
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.004010af
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00435c67
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x244]
xor ecx, ebp
call fcn.004550ad
add ebp, 0x248
leave
ret 4