Function at 0x52eba0
Capabilities:
Authenticate hmac
Check if file exists
Contain obfuscated stackstrings
Get common file path
Get startup folder
Move file
Parse credit card information
Parse pe header
Schedule task via itaskscheduler
Schedule task via itaskservice
Write file to startup folder

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f813d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x960
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x8e8], edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
xor ecx, ecx
mov dword [ebp - 0x8e0], 0
call fcn.005d3930
test eax, eax
je 0x52ec0f
push eax
call fcn.0041e1c3
add esp, 4
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 4
push dword [eax + 0x3c]
call fcn.005bc500
test eax, eax
je 0x52ecae
push str.Creating_a_restore_point...
push 0xffffffffffffffb0
lea ecx, [edi + 0x940]
call fcn.005b66e0
push 0xc
lea ecx, [ebp - 0x600]
call fcn.00401d40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._threat_removal
lea ecx, [edi + 0x354]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x600]
call fcn.005dc520
push 0
push 0
push 0
push 0xc
lea ecx, [ebp - 0x600]
mov dword [ebp - 4], 0
call fcn.005dc190
mov edx, 0x64
mov ecx, eax
call fcn.0058c540
lea ecx, [ebp - 0x600]
mov dword [ebp - 4], 0xffffffff
call fcn.005dc430
push str.Preparing_to_repair_the_selected_issues...
push 0xffffffffffffffff
lea ecx, [edi + 0x940]
call fcn.005b66e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push str.Cleaning_up...
push dword [eax + 0x38]
call fcn.005bcd30
push 0xc
lea ecx, [ebp - 0x250]
call fcn.00401d40
lea ecx, [ebp - 0x250]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x298]
mov dword [ebp - 4], 1
call fcn.00401d40
lea ecx, [ebp - 0x298]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 2
call fcn.00401d40
lea ecx, [ebp - 0x334]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x20c]
mov byte [ebp - 4], 3
call fcn.00401d40
lea ecx, [ebp - 0x20c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 4
call fcn.00401d40
lea ecx, [ebp - 0x580]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x498]
mov byte [ebp - 4], 5
call fcn.00401d40
lea ecx, [ebp - 0x498]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x3e8]
mov byte [ebp - 4], 6
call fcn.00401d40
lea ecx, [ebp - 0x3e8]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 7
call fcn.00401d40
lea ecx, [ebp - 0x568]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x55c]
mov byte [ebp - 4], 8
call fcn.00401d40
lea ecx, [ebp - 0x55c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x48c]
mov byte [ebp - 4], 9
call fcn.00401d40
lea ecx, [ebp - 0x48c]
call fcn.005dc5e0
mov byte [ebp - 4], 0xa
push 0xc
lea ecx, [ebp - 0x3f4]
call fcn.00401d40
lea ecx, [ebp - 0x3f4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x550]
mov byte [ebp - 4], 0xb
call fcn.00401d40
lea ecx, [ebp - 0x550]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 0xc
call fcn.00401d40
lea ecx, [ebp - 0x544]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 0xd
call fcn.00401d40
lea ecx, [ebp - 0x538]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x480]
mov byte [ebp - 4], 0xe
call fcn.00401d40
lea ecx, [ebp - 0x480]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x400]
mov byte [ebp - 4], 0xf
call fcn.00401d40
lea ecx, [ebp - 0x400]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x5d0]
mov byte [ebp - 4], 0x10
call fcn.00401d40
lea ecx, [ebp - 0x5d0]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 0x11
call fcn.00401d40
lea ecx, [ebp - 0x52c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x40c]
mov byte [ebp - 4], 0x12
call fcn.00401d40
lea ecx, [ebp - 0x40c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x520]
mov byte [ebp - 4], 0x13
call fcn.00401d40
lea ecx, [ebp - 0x520]
call fcn.005dc5e0
mov byte [ebp - 4], 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.005e17c0
mov ecx, eax
mov edx, str.HKLM
test ecx, ecx
mov dword [ebp - 0x128], ecx
mov eax, str.HKLM64
cmove eax, edx
mov edx, 0x62439c
mov dword [ebp - 0x8e4], eax
mov eax, str.HKLM32
push 0
push 0
cmove eax, edx
lea ecx, [ebp - 0x250]
push 0x104
mov dword [ebp - 0x8f0], eax
call fcn.005db9a0
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push eax
push 1
push dword [edi + 0x38]
push 0x1a
push 0
call esi
push 0
push 0
push 0x104
lea ecx, [ebp - 0x298]
call fcn.005db9a0
push eax
push 1
push dword [edi + 0x38]
push 0x1c
push 0
call esi
push 0
push 0
push 0x104
lea ecx, [ebp - 0x20c]
call fcn.005db9a0
push eax
push 1
push dword [edi + 0x38]
push 2
push 0
call esi
push 0
push 0
push 0x104
lea ecx, [ebp - 0x498]
call fcn.005db9a0
push eax
push 1
push dword [edi + 0x38]
push 0
push 0
call esi
push 0
push 0
push 0x104
lea ecx, [ebp - 0x480]
call fcn.005db9a0
push eax
push 1
push dword [edi + 0x38]
push 0x23
push 0
call esi
push 0
push 0
push 0x104
lea ecx, [ebp - 0x568]
call fcn.005db9a0
push eax
push 1
push dword [edi + 0x38]
push 7
push 0
call esi
push 0
push 0
push 0x104
lea ecx, [ebp - 0x55c]
call fcn.005db9a0
push eax
push 1
push dword [edi + 0x38]
push 5
push 0
call esi
push 0x400
push 0
push 0
push 0x400
lea ecx, [ebp - 0x3e8]
call fcn.005db9a0
push eax
push str._TEMP_
push dword [edi + 0x38]
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserW]
push 0x400
lea ecx, [ebp - 0x3e8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3e8]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0x104
push 0
push 0
push 0x104
lea ecx, [ebp - 0x48c]
call fcn.005db9a0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
cmp dword [ebp - 0x128], 0
je 0x52f101
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SysNative
lea ecx, [ebp - 0x48c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3f4]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6674a0
lea ecx, [ebp - 0x48c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x550]
call fcn.005dc200
jmp 0x52f133
push 0x104
push 0
push 0
push 0x104
lea ecx, [ebp - 0x3f4]
call fcn.005db9a0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x3f4]
push eax
lea ecx, [ebp - 0x550]
call fcn.005dc4e0
push dword [ebp - 0x128]
lea edx, [ebp - 0x538]
lea ecx, [ebp - 0x544]
call fcn.005dddf0
push 0
push 0
push 0x104
lea ecx, [ebp - 0x400]
call fcn.005db9a0
push eax
push 1
push 0
push 0x2b
push 0
call esi
push 0
push 0
push 0x104
lea ecx, [ebp - 0x40c]
call fcn.005db9a0
push eax
push 1
push 0
push 0x17
push 0
call esi
push 0
push 0
push 0x104
lea ecx, [ebp - 0x520]
call fcn.005db9a0
push eax
push 1
push 0
push 0x19
push 0
call esi
push 0
push 0
push 0x104
lea ecx, [ebp - 0x5d0]
call fcn.005db9a0
push eax
push 1
push 0
push 0x18
push 0
call esi
push 0xc
lea ecx, [ebp - 0x220]
call fcn.00401d40
lea ecx, [ebp - 0x220]
call fcn.005dc5e0
push 0
push 0
push 0x104
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0x15
call fcn.005db9a0
push eax
push 1
push 0
push 0x28
push 0
call esi
lea ecx, [ebp - 0x220]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x250]
call fcn.005dad50
lea ecx, [ebp - 0x220]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x298]
call fcn.005dad50
push 1
push str.AppDataLocalLow
lea ecx, [ebp - 0x334]
call fcn.005dc260
lea ecx, [ebp - 0x220]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x20c]
call fcn.005dad50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MicrosoftInternet_ExplorerQuick_Launch
lea ecx, [ebp - 0x250]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x580]
call fcn.005dc200
lea ecx, [ebp - 0x220]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x498]
call fcn.005dad50
lea ecx, [ebp - 0x220]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x3e8]
call fcn.005dad50
lea ecx, [ebp - 0x220]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x568]
call fcn.005dad50
lea ecx, [ebp - 0x220]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x55c]
call fcn.005dad50
push 1
lea ecx, [ebp - 0x400]
call fcn.005dbf40
lea eax, [ebp - 0x400]
push eax
lea ecx, [ebp - 0x52c]
call fcn.005dc4e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624284
lea ecx, [ebp - 0x544]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x400]
call fcn.005da510
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624284
lea ecx, [ebp - 0x538]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x52c]
call fcn.005da510
push fcn.005d69e0
push fcn.005d6aa0
push 3
push 4
lea eax, [ebp - 0x20]
push eax
call fcn.0041e804
push fcn.005d6ab0
push fcn.005d6ac0
push 3
push 0xc
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x16
push eax
call fcn.0041e804
push fcn.005d6b00
push fcn.005d6b10
push 2
push 0x10
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 0x17
push eax
call fcn.0041e804
push 0xc
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 0x18
call fcn.00401d40
lea ecx, [ebp - 0x28c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x19
call fcn.00401d40
lea ecx, [ebp - 0x10c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x1a
call fcn.00401d40
lea ecx, [ebp - 0x70]
call fcn.005dc5e0
push 0x38
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x1b
call fcn.00401e60
lea ecx, [ebp - 0x450]
call fcn.005dd740
mov byte [ebp - 4], 0x1c
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push dword [eax + 0xa0]
call fcn.005c5730
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xa0]
call fcn.005ba360
push 8
lea ecx, [ebp - 0xbc]
call fcn.00401f90
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xa0]
call fcn.005bb7f0
push eax
lea ecx, [ebp - 0xbc]
call fcn.00403d20
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 4], 0x1d
call fcn.005d04b0
call fcn.005d0460
push edx
push eax
lea ecx, [edi + 0x128]
call fcn.005db3f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6674ec
lea ecx, [edi + 0x128]
call fcn.005dc190
push eax
push str.UAKrem
lea ecx, [edi + 0x134]
call fcn.005dc190
push eax
lea ecx, [edi + 0x128]
call fcn.005dc200
push 0x20
lea ecx, [ebp - 0xe8]
call fcn.00401e40
push 0
push 0x22
lea ecx, [edi + 0x128]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xe8]
call fcn.005e4770
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x1e
call fcn.005e4670
test eax, eax
jne 0x52f512
lea ecx, [edi + 0x128]
call fcn.005dc400
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._threat_removal_report__r_n_r_n
lea ecx, [edi + 0x354]
call fcn.005dc190
push eax
push 0x66754c
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0xe8]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push str.bits_._r_n
push 0x627dcc
push 0x62d7ec
push str.10.9.4.0
push str._version:
lea ecx, [edi + 0x354]
call fcn.005dc190
push eax
push 0x629bbc
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0xe8]
call fcn.005e3a10
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x4b0]
call fcn.005d0520
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.._r_n_r_n
lea ecx, [ebp - 0x70]
call fcn.005dc190
push eax
push str._tRemoval_start_time:
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0xe8]
call fcn.005e3a10
push 0
push str.__Begin_removal_of_the_selected_programs..._r_n_r_n
lea ecx, [ebp - 0xe8]
call fcn.005e37e0
mov dword [edi + 0x2c], 0
lea ecx, [ebp - 0xbc]
push 0
mov dword [edi + 0x28], 0
call fcn.00404240
cmp dword [eax], 0
je 0x531f50
push str.Removing_selected_programs...
push 0xffffffffffffffff
lea ecx, [edi + 0x940]
mov dword [ebp - 0x8d0], 0
call fcn.005b66e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x40
push dword [eax + 0xa0]
call fcn.005bd3f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Programs
lea ecx, [edi + 0x140]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x28c]
call fcn.005dc200
lea ecx, [ebp - 0x28c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x531f62
push 1
lea ecx, [ebp - 0x28c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd360
push 8
lea ecx, [ebp - 0x828]
call fcn.00401f90
push 0
lea ecx, [ebp - 0xbc]
call fcn.00404240
lea ecx, [ebp - 0x828]
mov eax, dword [eax]
inc eax
push eax
call fcn.00403060
mov byte [ebp - 4], 0x1f
cmp dword [ebp - 0x828], 0
jne 0x52f6f8
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], 0x1e
call fcn.00402ff0
jmp 0x531f62
mov esi, 1
lea ecx, [ebp - 0xbc]
push 0
mov dword [ebp - 0x8d8], esi
call fcn.00404240
cmp dword [eax], esi
jl 0x52f9b5
nop dword [eax + eax]
push esi
lea ecx, [ebp - 0xbc]
call fcn.00404240
push dword [ebp - 0x8d8]
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.00402fe0
mov ecx, dword [esi]
mov esi, dword [ebp - 0x8d8]
push esi
mov dword [eax], ecx
lea ecx, [ebp - 0xbc]
call fcn.00404240
mov ecx, dword [edi + 4]
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa0]
call fcn.005bb110
test eax, eax
je 0x52f999
mov eax, dword [eax]
lea ecx, [ebp - 0x10c]
cdq
push edx
push eax
call fcn.005db580
push 0x62439c
push str.Path
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd2c0
push eax
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dc510
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dc3a0
add dword [ebp - 0x8d0], eax
lea ecx, [ebp - 0x10c]
push 0x62439c
push str.Registry_Key
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd2c0
push eax
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 0x10]
call fcn.005dc510
push 0x62439c
push str.Uninstall_String
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd2c0
push eax
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 0x1c]
call fcn.005dc510
push 0x62439c
push str.User_name
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd2c0
push eax
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 0x28]
call fcn.005dc510
push 0x62439c
push str.DBName
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd2c0
push eax
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 0x34]
call fcn.005dc510
push 0x62439c
push str.MSI_Product
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd2c0
push eax
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 0x4c]
call fcn.005dc510
push esi
lea ecx, [ebp - 0xbc]
call fcn.00404240
mov ecx, dword [edi + 4]
push 1
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa0]
call fcn.005bb510
push eax
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 0x40]
call fcn.005dc1c0
push str._Not_set_
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 0x40]
call fcn.005dc4c0
test al, al
je 0x52f945
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 0x40]
call fcn.005dc400
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
lea ecx, [ebp - 0x828]
push esi
test al, al
je 0x52f983
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005cc160
jmp 0x52f999
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005cc690
inc esi
lea ecx, [ebp - 0xbc]
push 0
mov dword [ebp - 0x8d8], esi
call fcn.00404240
cmp esi, dword [eax]
jle 0x52f720
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0xa
push dword [eax + 0x44]
call fcn.005b9910
push 0
lea ecx, [ebp - 0xbc]
call fcn.00404240
mov esi, dword [eax]
mov dword [ebp - 0x8d8], esi
test esi, esi
jle 0x5302b3
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 0x4c]
call fcn.005dc3a0
test eax, eax
je 0x52fa19
push 2
push 0
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 0x4c]
call fcn.005dc190
push eax
call dword [sym.imp.msi.dll_MsiDatabaseCommit]
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5302a4
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 0x28]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0052eab0
push str._All_users_
push esi
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x8d4], eax
call fcn.00402fe0
lea ecx, [eax + 0x28]
call fcn.005dc4c0
mov byte [ebp - 0x8c9], al
test al, al
jne 0x52fa88
cmp dword [ebp - 0x8d4], 0
jl 0x5302a4
push 0xc
lea ecx, [ebp - 0x5e8]
call fcn.00401d40
lea ecx, [ebp - 0x5e8]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x20
call fcn.00401d40
lea ecx, [ebp - 0x100]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x21
call fcn.00401d40
lea ecx, [ebp - 0x138]
call fcn.005dc5e0
push esi
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], 0x22
call fcn.00402fe0
lea ecx, [eax + 0x34]
call fcn.005dc3a0
lea ecx, [ebp - 0x828]
test eax, eax
je 0x52fb2f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624384
push esi
call fcn.00402fe0
lea ecx, [eax + 0x34]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x100]
call fcn.005dc200
jmp 0x52fb77
push esi
call fcn.00402fe0
add eax, 4
lea ecx, [ebp - 0x100]
push eax
call fcn.005dc4e0
push 1
lea ecx, [ebp - 0x100]
call fcn.005dbf40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624384
lea ecx, [ebp - 0x100]
call fcn.005da780
lea ecx, [ebp - 0x100]
call fcn.005dc3a0
cmp eax, 2
jl 0x53027f
push 0x667708
lea ecx, [ebp - 0x100]
call fcn.005dc4c0
test al, al
jne 0x53027f
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
add eax, 0x40
lea ecx, [ebp - 0x138]
push eax
call fcn.005dc4e0
lea ecx, [ebp - 0x138]
call fcn.005dc3a0
cmp eax, 4
jl 0x52fbf6
push str._Not_set_
lea ecx, [ebp - 0x138]
call fcn.005dc4c0
test al, al
jne 0x52fbf6
push 0x624a04
lea ecx, [ebp - 0x138]
call fcn.005dc4c0
test al, al
je 0x52fc01
lea ecx, [ebp - 0x138]
call fcn.005dc400
cmp byte [ebp - 0x8c9], 0
je 0x52ffe6
cmp dword [edi + 0x30], 0
mov dword [ebp - 0x8dc], 0
jbe 0x52fd44
push 0
push 0
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x250]
call fcn.005dc190
push dword [ebp - 0x8dc]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
push 0
push 0
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x298]
call fcn.005dc190
push dword [ebp - 0x8dc]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
push 0
push 0
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x334]
call fcn.005dc190
push dword [ebp - 0x8dc]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
push 0
push 0
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x20c]
call fcn.005dc190
push dword [ebp - 0x8dc]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
mov eax, dword [ebp - 0x8dc]
inc eax
mov dword [ebp - 0x8dc], eax
cmp eax, dword [edi + 0x30]
jb 0x52fc22
push 0
push 0
push 0
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20c]
call fcn.005dc190
mov edx, 0x624284
mov ecx, eax
call fcn.0050b290
push 0
push 0
push 0
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x480]
call fcn.005dc190
mov edx, 0x624284
mov ecx, eax
call fcn.0050b290
push 0
push 0
push 0
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40c]
call fcn.005dc190
mov edx, 0x624284
mov ecx, eax
call fcn.0050b290
lea ecx, [ebp - 0x138]
call fcn.005dc3a0
test eax, eax
je 0x530252
cmp dword [edi + 0x30], 0
mov dword [ebp - 0x8dc], 0
jbe 0x52ff46
nop word [eax + eax]
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x138]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x250]
call fcn.005dc190
push dword [ebp - 0x8dc]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x138]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x298]
call fcn.005dc190
push dword [ebp - 0x8dc]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x138]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x334]
call fcn.005dc190
push dword [ebp - 0x8dc]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x138]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x20c]
call fcn.005dc190
push dword [ebp - 0x8dc]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
mov eax, dword [ebp - 0x8dc]
inc eax
mov dword [ebp - 0x8dc], eax
cmp eax, dword [edi + 0x30]
jb 0x52fdf0
push 0
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x138]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20c]
call fcn.005dc190
mov edx, 0x624284
mov ecx, eax
call fcn.0050b290
push 0
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x138]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x480]
call fcn.005dc190
mov edx, 0x624284
mov ecx, eax
call fcn.0050b290
push 0
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x138]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40c]
call fcn.005dc190
mov edx, 0x624284
jmp 0x53024b
cmp dword [ebp - 0x8d4], 0
jl 0x530252
push 0
push 0
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x250]
call fcn.005dc190
push dword [ebp - 0x8d4]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
push 0
push 0
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x298]
call fcn.005dc190
push dword [ebp - 0x8d4]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
push 0
push 0
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x334]
call fcn.005dc190
push dword [ebp - 0x8d4]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
push 0
push 0
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x20c]
call fcn.005dc190
push dword [ebp - 0x8d4]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
lea ecx, [ebp - 0x138]
call fcn.005dc3a0
test eax, eax
je 0x530252
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x138]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x250]
call fcn.005dc190
push dword [ebp - 0x8d4]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x138]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x298]
call fcn.005dc190
push dword [ebp - 0x8d4]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x138]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x334]
call fcn.005dc190
push dword [ebp - 0x8d4]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
lea ecx, [ebp - 0x100]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x138]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x20c]
call fcn.005dc190
push dword [ebp - 0x8d4]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0050b290
lea ecx, [ebp - 0x138]
call fcn.005dc430
lea ecx, [ebp - 0x100]
call fcn.005dc430
lea ecx, [ebp - 0x5e8]
mov byte [ebp - 4], 0x1f
call fcn.005dc430
mov esi, dword [ebp - 0x8d8]
jmp 0x5302a4
lea ecx, [ebp - 0x138]
call fcn.005dc430
lea ecx, [ebp - 0x100]
call fcn.005dc430
lea ecx, [ebp - 0x5e8]
mov byte [ebp - 4], 0x1f
call fcn.005dc430
dec esi
mov dword [ebp - 0x8d8], esi
test esi, esi
jg 0x52f9e2
push 0xc
lea ecx, [ebp - 0x118]
call fcn.00401d40
lea ecx, [ebp - 0x118]
call fcn.005dc5e0
mov byte [ebp - 4], 0x23
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x14
push dword [eax + 0x44]
call fcn.005b9910
cmp dword [ebp - 0x8d0], 0
je 0x530581
push 0
push 0x20019
push str.HKCR64CLSID
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1b0], str.HKCR64CLSID
mov dword [ebp - 0x1ac], str.HKCR64Wow6432NodeCLSID
call fcn.005d6a30
push 0
push 0x20019
push str.HKCR64Wow6432NodeCLSID
lea ecx, [ebp - 0x1c]
call fcn.005d6a30
push 0xc
lea ecx, [ebp - 0x2b0]
call fcn.00401d40
lea ecx, [ebp - 0x2b0]
call fcn.005dc5e0
xor esi, esi
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x8d4], esi
nop dword [eax]
lea ecx, [ebp - 0x20]
add ecx, esi
call fcn.005d6280
test eax, eax
je 0x53055a
lea edi, [eax - 1]
test edi, edi
js 0x53055a
nop dword [eax]
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x20]
push edi
add ecx, esi
call fcn.005d6380
test al, al
je 0x530551
push 0
mov esi, dword [ebp + esi - 0x1b0]
lea ecx, [ebp - 0x118]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667770
push dword [ebp - 0x44]
push 0x624284
push esi
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x118]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
test al, al
je 0x5303f2
lea eax, [ebp - 0x2b0]
push eax
push 0x62439c
lea ecx, [ebp - 0x18]
call fcn.005d6740
test al, al
jne 0x5304ba
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667790
push dword [ebp - 0x44]
lea ecx, [ebp - 0x118]
push 0x624284
push esi
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x118]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
test al, al
je 0x530452
lea eax, [ebp - 0x2b0]
push eax
push 0x62439c
lea ecx, [ebp - 0x18]
call fcn.005d6740
test al, al
jne 0x5304ba
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6677b0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x118]
push 0x624284
push esi
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x118]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
test al, al
je 0x53054b
lea eax, [ebp - 0x2b0]
push eax
push 0x62439c
lea ecx, [ebp - 0x18]
call fcn.005d6740
test al, al
je 0x53054b
push 0
lea ecx, [ebp - 0x2b0]
call fcn.005dbc20
lea ecx, [ebp - 0x2b0]
call fcn.005dc3a0
cmp eax, 4
jl 0x53054b
push 0
lea ecx, [ebp - 0xbc]
mov esi, 1
call fcn.00404240
cmp dword [eax], esi
jl 0x53054b
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dbeb0
test al, al
jne 0x530539
push 0
push 1
push 1
push 0
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2b0]
call fcn.005daa70
test eax, eax
jne 0x53078f
push 0
lea ecx, [ebp - 0xbc]
inc esi
call fcn.00404240
cmp esi, dword [eax]
jle 0x5304f1
mov esi, dword [ebp - 0x8d4]
sub edi, 1
jns 0x530370
add esi, 4
mov dword [ebp - 0x8d4], esi
cmp esi, 8
jl 0x530350
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0x23
call fcn.005dc430
mov edi, dword [ebp - 0x8e8]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x1e
push dword [eax + 0x44]
call fcn.005b9910
cmp dword [ebp - 0x8d0], 0
je 0x530872
push 0
push 0x20019
push str.HKLMSYSTEMCurrentControlSet_services
lea ecx, [ebp - 0x20]
call fcn.005d6a30
lea ecx, [ebp - 0x20]
call fcn.005d6280
push 0xc
lea ecx, [ebp - 0x280]
mov esi, eax
call fcn.00401d40
lea ecx, [ebp - 0x280]
call fcn.005dc5e0
mov byte [ebp - 4], 0x25
test esi, esi
je 0x530863
lea eax, [esi - 1]
mov dword [ebp - 0x8d8], eax
test eax, eax
js 0x530863
mov edi, eax
lea eax, [ebp - 0x44]
push eax
push edi
lea ecx, [ebp - 0x20]
call fcn.005d6380
test al, al
je 0x530854
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x118]
push 0x624284
push str.HKLMSYSTEMCurrentControlSet_services
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x118]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1c]
call fcn.005d6a30
lea eax, [ebp - 0x280]
push eax
push str.ImagePath
lea ecx, [ebp - 0x1c]
call fcn.005d6740
test al, al
je 0x530679
lea ecx, [ebp - 0x280]
call fcn.005dc3a0
cmp eax, 4
jge 0x5306ea
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Parameters
lea ecx, [ebp - 0x118]
call fcn.005da780
push 0
push 0x20019
lea ecx, [ebp - 0x118]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1c]
call fcn.005d6a30
lea eax, [ebp - 0x280]
push eax
push str.ServiceDll
lea ecx, [ebp - 0x1c]
call fcn.005d6740
test al, al
je 0x530854
lea ecx, [ebp - 0x280]
call fcn.005dc3a0
cmp eax, 4
jl 0x530854
push 0
lea ecx, [ebp - 0x280]
call fcn.005dbc20
lea ecx, [ebp - 0x280]
call fcn.005dc3a0
cmp eax, 4
jl 0x530854
push 0
lea ecx, [ebp - 0xbc]
mov esi, 1
call fcn.00404240
cmp dword [eax], esi
jl 0x530854
nop word [eax + eax]
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dbeb0
test al, al
jne 0x530778
push 0
push 1
push 1
push 0
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x280]
call fcn.005daa70
test eax, eax
jne 0x5307fa
push 0
lea ecx, [ebp - 0xbc]
inc esi
call fcn.00404240
cmp esi, dword [eax]
jle 0x530730
jmp 0x530854
mov esi, dword [ebp - 0x8d4]
lea ecx, [ebp - 0x118]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x44]
push 0x624284
push dword [ebp + esi - 0x1b0]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x118]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d55d0
test al, al
jne 0x530551
push 0
lea ecx, [ebp - 0x118]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d55d0
jmp 0x530551
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x118]
push 0x624284
push str.HKLMSYSTEMCurrentControlSet_services
call fcn.005dc200
push 0
lea ecx, [ebp - 0x118]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1c]
call fcn.005d55d0
test al, al
jne 0x530854
push 0
lea ecx, [ebp - 0x118]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1c]
call fcn.005d55d0
sub edi, 1
jns 0x5305f3
mov edi, dword [ebp - 0x8e8]
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x23
call fcn.005dc430
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x28
push dword [eax + 0x44]
call fcn.005b9910
call fcn.005d8790
cmp dword [ebp - 0x8d0], 0
je 0x531392
movsd xmm1, qword [0x6edab8]
comisd xmm1, xmm0
jbe 0x530c93
push 0xc
lea ecx, [ebp - 0x310]
call fcn.00401d40
lea ecx, [ebp - 0x310]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 0x26
call fcn.00401d40
lea ecx, [ebp - 0x22c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x34c]
mov byte [ebp - 4], 0x27
call fcn.00401d40
lea ecx, [ebp - 0x34c]
call fcn.005dc5e0
push 4
lea ecx, [ebp - 0x834]
mov byte [ebp - 4], 0x28
call fcn.00401d80
lea ecx, [ebp - 0x834]
call fcn.004013f0
lea eax, [ebp - 0x834]
mov byte [ebp - 4], 0x29
push eax
push 0x6ed834
push 1
push 0
push 0x6ed7c0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x530c5e
push 4
lea ecx, [ebp - 0x854]
call fcn.00401d80
lea ecx, [ebp - 0x854]
call fcn.004013f0
mov byte [ebp - 4], 0x2a
lea edx, [ebp - 0x854]
mov eax, dword [ebp - 0x834]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x14]
call eax
test eax, eax
js 0x530c53
mov eax, dword [ebp - 0x854]
lea edx, [ebp - 0x16c]
push edx
mov dword [ebp - 0x16c], 0
lea edx, [ebp - 0x858]
push edx
mov ecx, dword [eax]
push 5
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
js 0x530c53
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [eax + eax]
mov eax, dword [ebp - 0x16c]
test eax, eax
je 0x530c4d
xor edi, edi
test eax, eax
je 0x530c1f
xor ecx, ecx
mov dword [ebp - 0x8dc], ecx
mov dword [ebp - 0x8d8], ecx
nop word [eax + eax]
mov eax, dword [ebp - 0x858]
push dword [eax + ecx]
lea ecx, [ebp - 0x310]
call fcn.005dc510
mov eax, dword [ebp - 0x858]
mov ecx, dword [ebp - 0x8d8]
push dword [eax + ecx]
call esi
push 4
lea ecx, [ebp - 0x844]
call fcn.00401d80
lea ecx, [ebp - 0x844]
call fcn.004013f0
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x310]
mov eax, dword [ebp - 0x834]
mov esi, dword [eax]
lea eax, [ebp - 0x844]
push eax
push 0x6ed8fc
call fcn.005dc190
push eax
push dword [ebp - 0x834]
mov eax, dword [esi + 0x18]
call eax
test eax, eax
js 0x530be7
mov eax, dword [ebp - 0x844]
lea edx, [ebp - 0x85c]
mov dword [ebp - 0x85c], 0
mov dword [ebp - 0x860], 0
push edx
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x84]
call eax
mov eax, dword [ebp - 0x844]
lea edx, [ebp - 0x860]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x8c]
call eax
push dword [ebp - 0x85c]
lea ecx, [ebp - 0x22c]
call fcn.005dc510
push dword [ebp - 0x860]
lea ecx, [ebp - 0x34c]
call fcn.005dc510
mov eax, dword [ebp - 0x85c]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
test eax, eax
je 0x530acd
push eax
call esi
mov eax, dword [ebp - 0x860]
test eax, eax
je 0x530ada
push eax
call esi
lea ecx, [ebp - 0x34c]
call fcn.005dc3a0
test eax, eax
je 0x530b19
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x34c]
call fcn.005dc190
push eax
push 0x62438c
lea ecx, [ebp - 0x22c]
call fcn.005da780
push 0
lea ecx, [ebp - 0x22c]
call fcn.005dbc20
push 0
push 0
push 0x62439c
push 0x624388
lea ecx, [ebp - 0x22c]
call fcn.005da270
lea ecx, [ebp - 0x22c]
call fcn.005dc3a0
cmp eax, 4
jl 0x530be7
push 0
lea ecx, [ebp - 0xbc]
mov esi, 1
call fcn.00404240
cmp dword [eax], esi
jl 0x530be7
nop dword [eax]
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dbeb0
test al, al
jne 0x530bb4
push 0
push 1
push 1
push 0
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x22c]
call fcn.005daa70
test eax, eax
jne 0x530bc8
push 0
lea ecx, [ebp - 0xbc]
inc esi
call fcn.00404240
cmp esi, dword [eax]
jle 0x530b70
jmp 0x530be7
mov eax, dword [ebp - 0x834]
lea ecx, [ebp - 0x310]
mov esi, dword [eax]
call fcn.005dc190
push eax
push dword [ebp - 0x834]
mov eax, dword [esi + 0x1c]
call eax
lea ecx, [ebp - 0x844]
mov byte [ebp - 4], 0x2a
call fcn.00402e10
mov ecx, dword [ebp - 0x8dc]
inc edi
add dword [ebp - 0x8d8], 4
add ecx, 4
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x8dc], ecx
cmp edi, dword [ebp - 0x16c]
jb 0x5309e0
push dword [ebp - 0x858]
call esi
mov eax, dword [ebp - 0x854]
lea edx, [ebp - 0x16c]
push edx
lea edx, [ebp - 0x858]
push edx
mov ecx, dword [eax]
push 5
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jns 0x5309b0
mov edi, dword [ebp - 0x8e8]
lea ecx, [ebp - 0x854]
call fcn.00402e10
lea ecx, [ebp - 0x834]
call fcn.00402e10
lea ecx, [ebp - 0x34c]
call fcn.005dc430
lea ecx, [ebp - 0x22c]
call fcn.005dc430
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 0x23
call fcn.005dc430
jmp 0x531392
push 4
lea ecx, [ebp - 0x82c]
call fcn.00401d80
lea ecx, [ebp - 0x82c]
call fcn.004013f0
lea eax, [ebp - 0x82c]
push eax
push 0x61e720
push 1
push 0
push 0x61e730
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x530cde
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], 0x23
call fcn.00402e10
jmp 0x531392
lea ecx, [ebp - 0x960]
call fcn.00401ca0
movups xmm0, xmmword [eax]
lea ecx, [ebp - 0x950]
movups xmmword [ebp - 0x1b8], xmm0
call fcn.00401ca0
movups xmm0, xmmword [eax]
lea ecx, [ebp - 0x940]
movups xmmword [ebp - 0x910], xmm0
call fcn.00401ca0
movups xmm0, xmmword [eax]
lea ecx, [ebp - 0x930]
movups xmmword [ebp - 0x920], xmm0
call fcn.00401ca0
mov edi, eax
mov byte [ebp - 4], 0x30
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x1b8]
mov ecx, dword [ebp - 0x82c]
mov edx, esp
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov esi, dword [ecx]
movups xmmword [edx], xmm0
movups xmm0, xmmword [ebp - 0x910]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x920]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [edi]
push ecx
movups xmmword [eax], xmm0
mov eax, dword [esi + 0x28]
call eax
shr eax, 0x1f
lea ecx, [ebp - 0x930]
mov dword [ebp - 0x8d8], eax
call fcn.00401d30
lea ecx, [ebp - 0x940]
call fcn.00401d30
lea ecx, [ebp - 0x950]
call fcn.00401d30
lea ecx, [ebp - 0x960]
mov byte [ebp - 4], 0x2c
call fcn.00401d30
cmp byte [ebp - 0x8d8], 0
jne 0x53137d
push 4
lea ecx, [ebp - 0x83c]
call fcn.00401d80
lea ecx, [ebp - 0x83c]
call fcn.004013f0
push 0x624284
lea ecx, [ebp - 0x8fc]
mov byte [ebp - 4], 0x31
call fcn.00401a90
mov byte [ebp - 4], 0x32
mov ecx, dword [ebp - 0x82c]
mov esi, dword [ecx]
lea ecx, [ebp - 0x83c]
push ecx
mov ecx, eax
call fcn.00401b50
push eax
push dword [ebp - 0x82c]
mov eax, dword [esi + 0x1c]
call eax
shr eax, 0x1f
lea ecx, [ebp - 0x8fc]
mov dword [ebp - 0x8d8], eax
mov byte [ebp - 4], 0x31
call fcn.00401b40
cmp byte [ebp - 0x8d8], 0
jne 0x531372
push 4
lea ecx, [ebp - 0x848]
call fcn.00401d80
lea ecx, [ebp - 0x848]
call fcn.004013f0
mov byte [ebp - 4], 0x33
lea edx, [ebp - 0x848]
mov eax, dword [ebp - 0x83c]
push edx
push 1
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x38]
call eax
test eax, eax
js 0x531367
mov eax, dword [ebp - 0x848]
lea edx, [ebp - 0x214]
mov dword [ebp - 0x214], 0
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x1c]
call eax
push 0xc
lea ecx, [ebp - 0x598]
call fcn.00401d40
lea ecx, [ebp - 0x598]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x304]
mov byte [ebp - 4], 0x34
call fcn.00401d40
lea ecx, [ebp - 0x304]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x58c]
mov byte [ebp - 4], 0x35
call fcn.00401d40
lea ecx, [ebp - 0x58c]
call fcn.005dc5e0
mov esi, 1
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x8d8], esi
cmp dword [ebp - 0x214], esi
jl 0x531346
push 4
lea ecx, [ebp - 0x838]
mov dword [ebp - 0x86c], 0
call fcn.00401d80
lea ecx, [ebp - 0x838]
call fcn.004013f0
push 3
push esi
lea ecx, [ebp - 0x970]
mov byte [ebp - 4], 0x37
call fcn.00401cb0
mov esi, eax
mov byte [ebp - 4], 0x38
lea edx, [ebp - 0x838]
mov ecx, dword [ebp - 0x848]
movups xmm0, xmmword [esi]
push edx
sub esp, 0x10
mov eax, dword [ecx]
mov edx, esp
push ecx
mov eax, dword [eax + 0x20]
movups xmmword [edx], xmm0
call eax
shr eax, 0x1f
lea ecx, [ebp - 0x970]
mov dword [ebp - 0x8dc], eax
mov byte [ebp - 4], 0x37
call fcn.00401d30
cmp byte [ebp - 0x8dc], 0
jne 0x53131e
mov eax, dword [ebp - 0x838]
lea edx, [ebp - 0x86c]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x1c]
call eax
test eax, eax
js 0x53131e
push dword [ebp - 0x86c]
lea ecx, [ebp - 0x598]
call fcn.005dc510
push dword [ebp - 0x86c]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push 4
lea ecx, [ebp - 0x84c]
call fcn.00401d80
lea ecx, [ebp - 0x84c]
call fcn.004013f0
mov byte [ebp - 4], 0x39
lea edx, [ebp - 0x84c]
mov eax, dword [ebp - 0x838]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x4c]
call eax
test eax, eax
js 0x531313
push 4
lea ecx, [ebp - 0x850]
call fcn.00401d80
lea ecx, [ebp - 0x850]
call fcn.004013f0
mov byte [ebp - 4], 0x3a
lea edx, [ebp - 0x850]
mov eax, dword [ebp - 0x84c]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x44]
call eax
test eax, eax
js 0x531308
mov eax, dword [ebp - 0x850]
lea edx, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x1c]
call eax
mov edi, 1
cmp dword [ebp - 0x210], edi
jl 0x531308
push 4
lea ecx, [ebp - 0x830]
call fcn.00401d80
lea ecx, [ebp - 0x830]
call fcn.004013f0
mov byte [ebp - 4], 0x3b
lea edx, [ebp - 0x830]
mov eax, dword [ebp - 0x850]
push edx
push edi
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x20]
call eax
test eax, eax
jns 0x53109d
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], 0x3a
call fcn.00402e10
jmp 0x5312fb
mov eax, dword [ebp - 0x830]
lea edx, [ebp - 0x4b4]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
jns 0x5310ca
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], 0x3a
call fcn.00402e10
jmp 0x5312fb
cmp dword [ebp - 0x4b4], 0
je 0x5310e7
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], 0x3a
call fcn.00402e10
jmp 0x5312fb
push 4
lea ecx, [ebp - 0x840]
call fcn.00401d80
lea ecx, [ebp - 0x840]
call fcn.004013f0
mov byte [ebp - 4], 0x3c
lea edx, [ebp - 0x840]
mov eax, dword [ebp - 0x830]
push edx
push 0x61e760
push eax
mov ecx, dword [eax]
mov eax, dword [ecx]
call eax
test eax, eax
jns 0x53113f
lea ecx, [ebp - 0x840]
call fcn.00402e10
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], 0x3a
call fcn.00402e10
jmp 0x5312fb
mov eax, dword [ebp - 0x840]
lea edx, [ebp - 0x864]
mov dword [ebp - 0x864], 0
mov dword [ebp - 0x868], 0
push edx
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [ebp - 0x840]
lea edx, [ebp - 0x868]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x30]
call eax
push dword [ebp - 0x864]
lea ecx, [ebp - 0x304]
call fcn.005dc510
push dword [ebp - 0x868]
lea ecx, [ebp - 0x58c]
call fcn.005dc510
mov eax, dword [ebp - 0x864]
test eax, eax
je 0x5311ac
push eax
call esi
mov eax, dword [ebp - 0x868]
test eax, eax
je 0x5311b9
push eax
call esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x58c]
call fcn.005dc190
push eax
push 0x62438c
lea ecx, [ebp - 0x304]
call fcn.005da780
push 0
lea ecx, [ebp - 0x304]
call fcn.005dbc20
lea ecx, [ebp - 0x304]
call fcn.005dc3a0
cmp eax, 4
jge 0x531225
lea ecx, [ebp - 0x840]
call fcn.00402e10
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], 0x3a
call fcn.00402e10
jmp 0x5312fb
push 0
lea ecx, [ebp - 0xbc]
mov esi, 1
call fcn.00404240
cmp dword [eax], esi
jl 0x5312db
nop
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dbeb0
test al, al
jne 0x531284
push 0
push 1
push 1
push 0
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x304]
call fcn.005daa70
test eax, eax
jne 0x531298
push 0
lea ecx, [ebp - 0xbc]
inc esi
call fcn.00404240
cmp esi, dword [eax]
jle 0x531240
jmp 0x5312db
lea ecx, [ebp - 0x598]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x8f8]
call fcn.00401a90
mov byte [ebp - 4], 0x3d
mov ecx, dword [ebp - 0x83c]
push 0
mov esi, dword [ecx]
mov ecx, eax
call fcn.00401b50
push eax
push dword [ebp - 0x83c]
mov eax, dword [esi + 0x3c]
call eax
lea ecx, [ebp - 0x8f8]
call fcn.00401b40
lea ecx, [ebp - 0x840]
call fcn.00402e10
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], 0x3a
call fcn.00402e10
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
inc edi
cmp edi, dword [ebp - 0x210]
jle 0x531053
lea ecx, [ebp - 0x850]
call fcn.00402e10
lea ecx, [ebp - 0x84c]
call fcn.00402e10
lea ecx, [ebp - 0x838]
mov byte [ebp - 4], 0x36
call fcn.00402e10
mov esi, dword [ebp - 0x8d8]
inc esi
mov dword [ebp - 0x8d8], esi
cmp esi, dword [ebp - 0x214]
jle 0x530ef6
lea ecx, [ebp - 0x58c]
call fcn.005dc430
lea ecx, [ebp - 0x304]
call fcn.005dc430
lea ecx, [ebp - 0x598]
call fcn.005dc430
lea ecx, [ebp - 0x848]
call fcn.00402e10
lea ecx, [ebp - 0x83c]
call fcn.00402e10
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], 0x23
call fcn.00402e10
mov edi, dword [ebp - 0x8e8]
xor eax, eax
mov ecx, 0xc
cmp dword [ebp - 0x128], eax
setne al
inc eax
add eax, dword [edi + 0x30]
mov dword [ebp - 0x8ec], eax
mov dword [ebp - 0x8d8], eax
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
add eax, 4
cmovb eax, ecx
push eax
call fcn.0041e7cf
add esp, 4
mov dword [ebp - 0x8d4], eax
mov ecx, dword [ebp - 0x8ec]
push fcn.005dc430
push fcn.005dc5e0
push ecx
mov byte [ebp - 4], 0x3e
mov dword [eax], ecx
add eax, 4
push 0xc
push eax
mov dword [ebp - 0x8dc], eax
call fcn.0041e804
mov byte [ebp - 4], 0x23
xor esi, esi
mov eax, dword [edi + 0x30]
test eax, eax
je 0x531462
mov eax, dword [ebp - 0x8dc]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x8d8], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion_
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x8d8]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x8d8], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x531418
mov esi, dword [ebp - 0x8dc]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push dword [ebp - 0x8e4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x128], 0
je 0x5314c9
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push dword [ebp - 0x8f0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
push 8
lea ecx, [ebp - 0x5ac]
call fcn.00401f90
push 0
push esi
lea ecx, [ebp - 0x5ac]
call fcn.00403d20
mov byte [ebp - 4], 0x3f
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x32
push dword [eax + 0x44]
call fcn.005b9910
cmp dword [ebp - 0x8d0], 0
je 0x53170a
push 0xc
lea ecx, [ebp - 0x3c4]
mov dword [ebp - 0x1b4], 0x6484e0
mov dword [ebp - 0x1b0], str.RunOnce
mov dword [ebp - 0x1ac], str.RunOnceEx
call fcn.00401d40
lea ecx, [ebp - 0x3c4]
call fcn.005dc5e0
cmp dword [ebp - 0x8ec], 0
mov byte [ebp - 4], 0x40
jbe 0x5316fb
nop dword [eax]
xor eax, eax
mov dword [ebp - 0x8d8], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + eax*4 - 0x1b4]
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x118]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x118]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d6a30
test al, al
je 0x5316c9
lea ecx, [ebp - 0x20]
call fcn.005d6220
test eax, eax
je 0x5316c9
lea edi, [eax - 1]
test edi, edi
js 0x5316c9
lea eax, [ebp - 0x44]
push eax
push edi
lea ecx, [ebp - 0x20]
call fcn.005d62e0
test al, al
je 0x5316ba
lea eax, [ebp - 0x3c4]
push eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0x20]
call fcn.005d6740
lea ecx, [ebp - 0x3c4]
call fcn.005dc3a0
cmp eax, 4
jl 0x5316ba
push 0
lea ecx, [ebp - 0x3c4]
call fcn.005dbc20
push 0
lea ecx, [ebp - 0xbc]
mov esi, 1
call fcn.00404240
cmp dword [eax], esi
jl 0x5316ba
nop word [eax + eax]
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dbeb0
test al, al
jne 0x531674
push 0
push 1
push 1
push 0
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c4]
call fcn.005daa70
test eax, eax
jne 0x531688
push 0
lea ecx, [ebp - 0xbc]
inc esi
call fcn.00404240
cmp esi, dword [eax]
jle 0x531630
jmp 0x5316ba
push dword [ebp - 0x44]
lea ecx, [ebp - 0x118]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1c]
call fcn.005d55d0
test al, al
jne 0x5316ba
push dword [ebp - 0x44]
lea ecx, [ebp - 0x118]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1c]
call fcn.005d55d0
sub edi, 1
jns 0x5315c4
mov esi, dword [ebp - 0x8dc]
mov eax, dword [ebp - 0x8d8]
inc eax
mov dword [ebp - 0x8d8], eax
cmp eax, 3
jb 0x531558
add esi, 0xc
sub dword [ebp - 0x8ec], 1
mov dword [ebp - 0x8dc], esi
jne 0x531550
mov edi, dword [ebp - 0x8e8]
lea ecx, [ebp - 0x3c4]
mov byte [ebp - 4], 0x3f
call fcn.005dc430
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x3c
push dword [eax + 0x44]
call fcn.005b9910
cmp dword [ebp - 0x8d0], 0
je 0x531871
xor esi, esi
cmp dword [edi + 0x30], esi
jbe 0x531871
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x498]
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x118]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xbc]
call fcn.00404240
lea ecx, [ebp - 0x118]
push dword [eax]
push dword [ebp - 0x828]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0052dfe0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x20c]
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x118]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xbc]
call fcn.00404240
lea ecx, [ebp - 0x118]
push dword [eax]
push dword [ebp - 0x828]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0052dfe0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x580]
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x118]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xbc]
call fcn.00404240
lea ecx, [ebp - 0x118]
push dword [eax]
push dword [ebp - 0x828]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0052dfe0
inc esi
cmp esi, dword [edi + 0x30]
jb 0x531732
push 0
lea ecx, [ebp - 0xbc]
call fcn.00404240
lea ecx, [ebp - 0x520]
push dword [eax]
push dword [ebp - 0x828]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0052dfe0
push 0
lea ecx, [ebp - 0xbc]
call fcn.00404240
lea ecx, [ebp - 0x40c]
push dword [eax]
push dword [ebp - 0x828]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0052dfe0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x41
push dword [eax + 0x44]
call fcn.005b9910
cmp dword [ebp - 0x8d0], 0
je 0x531d2d
xor edi, edi
mov esi, str.HKCR
mov dword [ebp - 0x8dc], edi
nop dword [eax + eax]
cmp edi, 1
jne 0x531902
cmp dword [ebp - 0x128], 0
je 0x531d27
push 0xc
lea ecx, [ebp - 0x2e0]
call fcn.00401d40
lea ecx, [ebp - 0x2e0]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x3ac]
mov byte [ebp - 4], 0x41
call fcn.00401d40
lea ecx, [ebp - 0x3ac]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 0x42
call fcn.00401d40
lea ecx, [ebp - 0x3b8]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x5a4]
mov byte [ebp - 4], 0x43
call fcn.00401d40
cmp edi, 1
lea ecx, [ebp - 0x5a4]
mov eax, str.HKCRWow6432Node
push 1
cmovne eax, esi
push eax
call fcn.005dc570
push 4
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 0x44
call fcn.00401d80
lea ecx, [ebp - 0x14c]
call fcn.005d6aa0
push 4
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 0x45
call fcn.00401d80
lea ecx, [ebp - 0x174]
call fcn.005d6aa0
push 4
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 0x46
call fcn.00401d80
lea ecx, [ebp - 0x148]
call fcn.005d6aa0
push 0xc
lea ecx, [ebp - 0x8bc]
mov byte [ebp - 4], 0x47
call fcn.00401d40
lea ecx, [ebp - 0x8bc]
call fcn.005d6ac0
push 0xc
lea ecx, [ebp - 0x8c8]
mov byte [ebp - 4], 0x48
call fcn.00401d40
lea ecx, [ebp - 0x8c8]
call fcn.005d6ac0
push 0
push 0x20019
lea ecx, [ebp - 0x5a4]
mov byte [ebp - 4], 0x49
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14c]
call fcn.005d6a30
test al, al
je 0x531cb0
lea eax, [ebp - 0x8bc]
xor esi, esi
push eax
push esi
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x8d8], esi
call fcn.005d6380
test al, al
je 0x531cab
mov eax, dword [ebp - 0x8bc]
test eax, eax
je 0x531a69
cmp word [eax], 0x2e
je 0x531c83
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Shell
push eax
push 0x624284
lea ecx, [ebp - 0x5a4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3ac]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x3ac]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x174]
call fcn.005d6a30
test al, al
je 0x531c83
lea ecx, [ebp - 0x174]
call fcn.005d6280
test eax, eax
je 0x531c83
lea edi, [eax - 1]
test edi, edi
js 0x531c83
nop
lea eax, [ebp - 0x8c8]
push eax
push edi
lea ecx, [ebp - 0x14c]
call fcn.005d6380
test al, al
je 0x531c74
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627384
push dword [ebp - 0x8c8]
lea ecx, [ebp - 0x3ac]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2e0]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x2e0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x148]
call fcn.005d6a30
test al, al
je 0x531c74
lea eax, [ebp - 0x3b8]
push eax
push 0x62439c
lea ecx, [ebp - 0x148]
call fcn.005d6740
test al, al
je 0x531c74
push 0
lea ecx, [ebp - 0x3b8]
call fcn.005dbc20
lea ecx, [ebp - 0x3b8]
call fcn.005dc3a0
cmp eax, 4
jl 0x531c74
push 0
lea ecx, [ebp - 0xbc]
mov esi, 1
call fcn.00404240
cmp dword [eax], esi
jl 0x531c74
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dbeb0
test al, al
jne 0x531bf6
push 0
push 1
push 1
push 0
push esi
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3b8]
call fcn.005daa70
test eax, eax
jne 0x531c0a
push 0
lea ecx, [ebp - 0xbc]
inc esi
call fcn.00404240
cmp esi, dword [eax]
jle 0x531bb2
jmp 0x531c74
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x8c8]
lea ecx, [ebp - 0x3ac]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2e0]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x2e0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x148]
call fcn.005d55d0
test al, al
jne 0x531c74
push 0
lea ecx, [ebp - 0x2e0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x148]
call fcn.005d55d0
sub edi, 1
jns 0x531ae0
mov esi, dword [ebp - 0x8d8]
lea eax, [ebp - 0x8bc]
inc esi
push eax
push esi
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x8d8], esi
call fcn.005d6380
test al, al
jne 0x531a55
mov edi, dword [ebp - 0x8dc]
mov esi, str.HKCR
lea ecx, [ebp - 0x8c8]
call fcn.005d6ab0
lea ecx, [ebp - 0x8bc]
call fcn.005d6ab0
lea ecx, [ebp - 0x148]
call fcn.005d69e0
lea ecx, [ebp - 0x174]
call fcn.005d69e0
lea ecx, [ebp - 0x14c]
call fcn.005d69e0
lea ecx, [ebp - 0x5a4]
call fcn.005dc430
lea ecx, [ebp - 0x3b8]
call fcn.005dc430
lea ecx, [ebp - 0x3ac]
call fcn.005dc430
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0x3f
call fcn.005dc430
inc edi
mov dword [ebp - 0x8dc], edi
cmp edi, 2
jl 0x5318f0
mov edi, dword [ebp - 0x8e8]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x46
push dword [eax + 0x44]
call fcn.005b9910
push 0
lea ecx, [ebp - 0xbc]
call fcn.00404240
mov eax, dword [eax]
mov dword [ebp - 0x8dc], eax
test eax, eax
jle 0x531f0b
imul esi, eax, 0x58
nop dword [eax]
mov ecx, dword [ebp - 0x828]
add ecx, 4
add ecx, esi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x531db0
mov ecx, dword [ebp - 0x828]
add ecx, 4
add ecx, esi
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005cc160
mov ecx, dword [ebp - 0x828]
add ecx, 4
add ecx, esi
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005e4c40
mov eax, dword [ebp - 0xbc]
xorps xmm0, xmm0
mov ecx, dword [ebp - 0x8dc]
push 0
movq qword [ebp - 0x4a4], xmm0
mov dword [ebp - 0x49c], 0
push 0
push dword [eax + ecx*4]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push dword [eax + 0xa0]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x4a4]
call fcn.005dc570
mov byte [ebp - 4], 0x4a
mov ecx, dword [ebp - 0x828]
add ecx, 4
add ecx, esi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [ebp - 0x4a4]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test eax, eax
je 0x531e3a
or dword [ebp - 0x8e0], 2
push str.:_Some_files_were_scheduled_for_removal_on_reboot._r_n
jmp 0x531e3f
push str.:_Successfully_removed._r_n
call fcn.005dc190
push eax
push 0x629bbc
lea ecx, [ebp - 0x70]
call fcn.005dc200
mov ecx, dword [ebp - 0x828]
add ecx, 0x10
add ecx, esi
call fcn.005dc3a0
cmp eax, 0x28
jle 0x531eaa
mov ecx, dword [ebp - 0x828]
add ecx, 0x10
push 0
add ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
test al, al
jne 0x531eaa
push 0
push dword [ebp - 0x8dc]
lea ecx, [ebp - 0x828]
call fcn.00402fe0
lea ecx, [eax + 0x10]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x8dc]
push 0
push dword [eax + ecx*4]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push dword [eax + 0xa0]
call fcn.005bb970
inc dword [edi + 0x28]
lea ecx, [ebp - 0x4a4]
inc dword [edi + 0x2c]
mov byte [ebp - 4], 0x3f
call fcn.005dc430
mov eax, dword [ebp - 0x8dc]
sub esi, 0x58
dec eax
mov dword [ebp - 0x8dc], eax
test eax, eax
jg 0x531d60
push 0
push 0x62781c
lea ecx, [ebp - 0xe8]
call fcn.005e37e0
ret
sbb byte [ebx], cl
add byte [ebx - 0x5ab73], cl
invalid
test ecx, ecx
je 0x531f2e
push 3
call fcn.00401e90
lea ecx, [ebp - 0x118]
call fcn.005dc430
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x828]
test ecx, ecx
je 0x531f62
push 3
call fcn.004045b0
jmp 0x531f62
push 0
push str._tNo_items_selected_in_this_group._r_n_r_n
lea ecx, [ebp - 0xe8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa0]
call fcn.005ba360
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x20
push dword [eax + 0xa0]
call fcn.005bd3f0
push 0
push str._r_n__Begin_repair_of_the_selected_Autostart_items..._r_n_r_n
lea ecx, [ebp - 0xe8]
call fcn.005e37e0
mov eax, dword [edi + 8]
xorps xmm0, xmm0
mov ecx, dword [edi + 4]
movlpd qword [ebp - 0x1b0], xmm0
push dword [eax + 0xa4]
call fcn.005bb7f0
mov esi, eax
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1b0], esi
mov byte [ebp - 4], 0x4b
mov ecx, dword [edi + 8]
push 0x4b
push dword [ecx + 0x44]
mov ecx, dword [edi + 4]
call fcn.005b9910
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x664994
push 0x624284
lea ecx, [edi + 0x140]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x28c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x28c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd360
cmp dword [esi], 0
push 0
je 0x53284c
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push dword [eax + 0xa4]
call fcn.005ba360
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x40
push dword [eax + 0xa4]
call fcn.005bd3f0
push str.Fixing_selected_Autostart_items...
push 0xffffffffffffffff
lea ecx, [edi + 0x940]
call fcn.005b66e0
xorps xmm0, xmm0
mov dword [ebp - 0x230], 0
lea ecx, [ebp - 0x238]
movq qword [ebp - 0x238], xmm0
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 0x4c
call fcn.00401d40
lea ecx, [ebp - 0x3d0]
call fcn.005dc5e0
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x15c]
xorps xmm0, xmm0
mov dword [ebp - 0x154], 0
movq qword [ebp - 0x15c], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x168]
xorps xmm0, xmm0
mov dword [ebp - 0x160], 0
movq qword [ebp - 0x168], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x1f4]
xorps xmm0, xmm0
mov dword [ebp - 0x1ec], 0
movq qword [ebp - 0x1f4], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x50
mov eax, dword [esi]
mov dword [ebp - 0x8dc], eax
test eax, eax
jle 0x532383
lea ecx, [eax*4]
mov dword [ebp - 0x8d8], ecx
jmp 0x53213a
mov esi, dword [ebp - 0x1b0]
mov eax, dword [edi + 8]
push dword [ecx + esi]
mov ecx, dword [edi + 4]
mov byte [ebp - 0x8c9], 0
push dword [eax + 0xa4]
call fcn.005bb5c0
mov ecx, dword [ebp - 0x1b0]
mov esi, eax
mov eax, dword [ebp - 0x8dc]
push dword [ecx + eax*4]
mov ecx, dword [edi + 8]
push dword [ecx + 0xa4]
mov ecx, dword [edi + 4]
call fcn.005bb110
test eax, eax
je 0x53235f
mov eax, dword [eax]
lea ecx, [ebp - 0x10c]
cdq
push edx
push eax
call fcn.005db580
push 0x62439c
push str.Registry_Key
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd2c0
push eax
lea ecx, [ebp - 0x238]
call fcn.005dc510
push 0x62439c
push str.User_name
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd2c0
push eax
lea ecx, [ebp - 0x168]
call fcn.005dc510
push 0x62439c
push str.Value_name
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd2c0
push eax
lea ecx, [ebp - 0x1f4]
call fcn.005dc510
push 0x62439c
push str.Path
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd2c0
push eax
lea ecx, [ebp - 0x3d0]
call fcn.005dc510
mov eax, dword [ebp - 0x8dc]
mov ecx, dword [ebp - 0x1b0]
push 0
push dword [ecx + eax*4]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push dword [eax + 0xa4]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x15c]
call fcn.005dc1c0
lea ecx, [ebp - 0x70]
call fcn.005dc400
cmp esi, 0xb
jne 0x532457
lea ecx, [ebp - 0x238]
call fcn.005dc3a0
test eax, eax
je 0x532302
lea ecx, [ebp - 0x1f4]
call fcn.005dc190
lea ecx, [ebp - 0x238]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x5323d5
mov byte [ebp - 0x8c9], 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x168]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x1f4]
call fcn.005dc190
push eax
push str._tSuccessfully_removed_autostart_registry_value__
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
mov cl, byte [ebp - 0x8c9]
test cl, cl
je 0x532346
mov eax, dword [ebp - 0x8dc]
mov ecx, dword [ebp - 0x1b0]
push 0
push dword [ecx + eax*4]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push dword [eax + 0xa4]
call fcn.005bb970
mov cl, byte [ebp - 0x8c9]
cmp cl, 2
jne 0x532352
or dword [ebp - 0x8e0], 2
xor eax, eax
test cl, cl
setne al
add dword [edi + 0x2c], eax
inc dword [edi + 0x28]
mov eax, dword [ebp - 0x8dc]
mov ecx, dword [ebp - 0x8d8]
dec eax
add ecx, 0xfffffffc
mov dword [ebp - 0x8dc], eax
mov dword [ebp - 0x8d8], ecx
test eax, eax
jg 0x532134
push 0
push 0x62781c
lea ecx, [ebp - 0xe8]
call fcn.005e37e0
lea ecx, [ebp - 0x1f4]
call fcn.005dc430
lea ecx, [ebp - 0x168]
call fcn.005dc430
lea ecx, [ebp - 0x15c]
call fcn.005dc430
lea ecx, [ebp - 0x3d0]
call fcn.005dc430
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x4b
call fcn.005dc430
jmp 0x53285c
lea ecx, [ebp - 0x1f4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x238]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
mov byte [ebp - 0x8c9], al
test al, al
jne 0x5322c5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x168]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x1f4]
call fcn.005dc190
push eax
push str._tFailed_to_remove_autostart_registry_value__
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
jmp 0x532340
cmp esi, 0xc
jne 0x53253b
lea ecx, [ebp - 0x3d0]
call fcn.005dc3a0
test eax, eax
je 0x532302
lea ecx, [ebp - 0x3d0]
call fcn.005dc190
lea edx, [esi - 0xa]
mov ecx, eax
call fcn.005e4c40
mov byte [ebp - 0x8c9], al
cmp al, 1
je 0x5324ad
lea ecx, [ebp - 0x3d0]
call fcn.005dc190
lea edx, [esi - 0xa]
mov ecx, eax
call fcn.005e4c40
mov byte [ebp - 0x8c9], al
lea ecx, [ebp - 0x168]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test al, al
jne 0x5324eb
push 0x667ad8
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x15c]
call fcn.005dc190
push eax
push str._tFailed_to_remove_Startup_folder_item__
jmp 0x532438
cmp al, 2
jne 0x532515
push str._on_next_reboot._r_n
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x15c]
call fcn.005dc190
push eax
push str._tScheduled_removal_of_Startup_folder_item__
jmp 0x53282d
push 0x667ad8
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x15c]
call fcn.005dc190
push eax
push str._tSuccessfully_removed_Startup_folder_item__
jmp 0x53282d
cmp esi, 0xd
jne 0x5325ec
lea ecx, [ebp - 0x15c]
call fcn.005dc190
mov dl, 1
mov ecx, eax
call fcn.005916c0
mov byte [ebp - 0x8c9], al
lea ecx, [ebp - 0x168]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test al, al
jne 0x53259c
push 0x667ad8
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x15c]
call fcn.005dc190
push eax
push str._tFailed_to_remove_scheduled_task__
jmp 0x532438
cmp al, 2
jne 0x5325c6
push str._on_next_reboot._r_n
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x15c]
call fcn.005dc190
push eax
push str._tScheduled_removal_of_scheduled_task__
jmp 0x53282d
push 0x667ad8
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x15c]
call fcn.005dc190
push eax
push str._tSuccessfully_removed_autostart_scheduled_task__
jmp 0x53282d
cmp esi, 0xe
jne 0x53279b
push 0xc
lea ecx, [ebp - 0x274]
mov byte [ebp - 0x8c9], 0
call fcn.00401d40
lea ecx, [ebp - 0x274]
call fcn.005dc5e0
push 0
push 0x20019
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x51
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d6a30
test al, al
je 0x53274a
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x1f4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d6740
test al, al
je 0x53274a
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x15c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x274]
call fcn.005daa70
test eax, eax
je 0x53274a
push 0
push 0
push 0x62439c
lea ecx, [ebp - 0x15c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x274]
call fcn.005da270
push 0
push 0
push 0x627824
push 0x667ddc
lea ecx, [ebp - 0x274]
call fcn.005da270
lea ecx, [ebp - 0x274]
call fcn.005dc3a0
cmp eax, 3
jge 0x5326d9
lea ecx, [ebp - 0x274]
call fcn.005dc400
push 0
lea ecx, [ebp - 0x274]
call fcn.005dc190
push eax
push 7
lea ecx, [ebp - 0x1f4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x238]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d5be0
mov byte [ebp - 0x8c9], al
test al, al
je 0x53274a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x168]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x15c]
call fcn.005dc190
push eax
push str._tSuccessfully_removed_AppInit_DLLs_entry__
jmp 0x53277f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x168]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x15c]
call fcn.005dc190
push eax
push str._tFailed_to_remove_AppInit_DLLs_entry__
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 0x50
call fcn.005dc430
jmp 0x532302
cmp esi, 0xf
jne 0x532302
push 0
push 0x62439c
push 1
lea ecx, [ebp - 0x1f4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x238]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d5be0
mov byte [ebp - 0x8c9], al
lea ecx, [ebp - 0x168]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
jne 0x532811
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x15c]
call fcn.005dc190
push eax
push str._tFailed_to_remove_DNS_hijacker__
jmp 0x532438
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x15c]
call fcn.005dc190
push eax
push str._tSuccessfully_removed_DNS_hijacker__
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
jmp 0x53231e
push str._tNo_items_selected_in_this_group._r_n_r_n
lea ecx, [ebp - 0xe8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa4]
call fcn.005ba360
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x20
push dword [eax + 0xa4]
call fcn.005bd3f0
push 0
push str._r_n__Begin_repair_of_the_selected_Internet_Browser_items..._r_n_r_n
lea ecx, [ebp - 0xe8]
call fcn.005e37e0
xorps xmm0, xmm0
movlpd qword [ebp - 0xa8], xmm0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push dword [eax + 0xa8]
call fcn.005bb7f0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], 0
mov byte [ebp - 4], 0x52
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x50
push dword [eax + 0x44]
call fcn.005b9910
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667fb0
push 0x624284
lea ecx, [edi + 0x140]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x28c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x28c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd360
mov eax, dword [ebp - 0xa8]
cmp dword [eax], 0
je 0x539160
mov ecx, str.MicrosoftEdge.exe
call fcn.005cc330
mov ecx, 0x64abcc
call fcn.005cc330
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xa8]
call fcn.005ba360
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x40
push dword [eax + 0xa8]
call fcn.005bd3f0
push str.Fixing_selected_Microsoft_Edge_items...
push 0xffffffffffffffff
lea ecx, [edi + 0x940]
call fcn.005b66e0
xorps xmm0, xmm0
mov dword [ebp - 0x98], 0
lea ecx, [ebp - 0xa0]
movq qword [ebp - 0xa0], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x88]
xorps xmm0, xmm0
mov dword [ebp - 0x80], 0
movq qword [ebp - 0x88], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x94]
xorps xmm0, xmm0
mov dword [ebp - 0x8c], 0
movq qword [ebp - 0x94], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x7c]
xorps xmm0, xmm0
mov dword [ebp - 0x74], 0
movq qword [ebp - 0x7c], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x2a4]
xorps xmm0, xmm0
mov dword [ebp - 0x29c], 0
movq qword [ebp - 0x2a4], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x124]
xorps xmm0, xmm0
mov dword [ebp - 0x11c], 0
movq qword [ebp - 0x124], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0xb4]
xorps xmm0, xmm0
mov dword [ebp - 0xac], 0
movq qword [ebp - 0xb4], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x59
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ecx]
mov dword [ebp - 0x8d4], eax
test eax, eax
jle 0x5390fe
push dword [ecx + eax*4]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
mov byte [ebp - 0x8d0], 0
push dword [eax + 0xa8]
call fcn.005bb5c0
mov ecx, dword [ebp - 0xa8]
mov esi, eax
mov eax, dword [ebp - 0x8d4]
push dword [ecx + eax*4]
mov ecx, dword [edi + 8]
push dword [ecx + 0xa8]
mov ecx, dword [edi + 4]
call fcn.005bb110
test eax, eax
je 0x5390e2
mov eax, dword [eax]
lea ecx, [ebp - 0x10c]
cdq
push edx
push eax
call fcn.005db580
push 0
push str.Registry_Key
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd2c0
push eax
lea ecx, [ebp - 0xa0]
call fcn.005dc510
push 0
push str.User_name
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd2c0
push eax
lea ecx, [ebp - 0x7c]
call fcn.005dc510
push 0
push str.Value_name
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd2c0
push eax
lea ecx, [ebp - 0x2a4]
call fcn.005dc510
push 0
push str.Path
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd2c0
push eax
lea ecx, [ebp - 0x88]
call fcn.005dc510
push 0
push 0x6451c0
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x450]
call fcn.005dd2c0
push eax
lea ecx, [ebp - 0xb4]
call fcn.005dc510
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x8d4]
push 0
push dword [eax + ecx*4]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push dword [eax + 0xa8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x94]
call fcn.005dc1c0
lea ecx, [ebp - 0x70]
call fcn.005dc400
cmp esi, 0x18
jne 0x532e50
push 1
push 1
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x94]
call fcn.005dc260
mov ecx, eax
call fcn.005dbf40
xorps xmm0, xmm0
mov dword [ebp - 0x260], 0
push 1
lea ecx, [ebp - 0xa0]
movq qword [ebp - 0x268], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x268]
call fcn.005dc570
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x244]
xorps xmm0, xmm0
mov dword [ebp - 0x23c], 0
movq qword [ebp - 0x244], xmm0
call fcn.005dc5e0
push 0
push 0
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0x5b
call fcn.005dbed0
mov ecx, eax
call fcn.005dbed0
lea ecx, [ebp - 0x94]
call fcn.005dbeb0
test al, al
jne 0x532e31
lea ecx, [ebp - 0x268]
call fcn.005dbeb0
test al, al
jne 0x532e31
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str.ExtensionsStoredatastoreConfig_
lea ecx, [ebp - 0x268]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x244]
call fcn.005dc200
lea ecx, [ebp - 0x244]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d5740
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str.ExtensionsStorekeyvaluestorekeyvaluestore_
lea ecx, [ebp - 0x268]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x244]
call fcn.005dc200
lea ecx, [ebp - 0x244]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d5740
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.See_aka.ms_browserpolicyExtensions
push str.Protected___It_is_a_violation_of_Windows_Policy_to_modify.
lea ecx, [ebp - 0x268]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x244]
call fcn.005dc200
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x244]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d5da0
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d5740
lea ecx, [ebp - 0xa0]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
mov byte [ebp - 0x8c9], al
lea ecx, [ebp - 0x94]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62781c
test al, al
je 0x532deb
call fcn.005dc190
push eax
push str._tFailed_to_remove_MS_Edge__UWP__extension:
lea ecx, [ebp - 0x70]
call fcn.005dc200
jmp 0x532e20
call fcn.005dc190
push eax
push str._tSuccessfully_removed__MS_Edge__UWP__extension:
lea ecx, [ebp - 0x70]
call fcn.005dc200
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x8d4]
push 0
push dword [eax + ecx*4]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push dword [eax + 0xa8]
call fcn.005bb970
xor eax, eax
cmp byte [ebp - 0x8c9], al
sete al
add dword [edi + 0x2c], eax
inc dword [edi + 0x28]
lea ecx, [ebp - 0x244]
call fcn.005dc430
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0x59
call fcn.005dc430
jmp 0x5390e2
cmp esi, 0x1a
jne 0x5337d7
push str.Reset_Edge_extensions
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x532ff6
lea ecx, [ebp - 0xa0]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x532ea4
mov byte [ebp - 0x8d0], 1
push 1
push str._tSuccessfully_reset_Microsoft_Edge__UWP__extensions._r_n
lea ecx, [ebp - 0x70]
call fcn.005dc260
jmp 0x533784
push 0xc
lea ecx, [ebp - 0x25c]
call fcn.00401d40
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x25c]
call fcn.005dc5b0
push 0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x5c
call fcn.005dbed0
lea ecx, [ebp - 0x25c]
call fcn.005dc190
mov edx, 1
mov ecx, eax
call fcn.005d34f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
shr eax, 0x1f
lea ecx, [ebp - 0xa0]
push 0
xor al, 1
push str.ExtensionsStoredatastoreConfig
mov dword [ebp - 0x8d0], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x25c]
call fcn.005dc200
lea ecx, [ebp - 0x25c]
call fcn.005dc190
mov edx, 1
mov ecx, eax
call fcn.005d34f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.ExtensionsStorekeyvaluestorekeyvaluestore
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x25c]
call fcn.005dc200
lea ecx, [ebp - 0x25c]
call fcn.005dc190
mov edx, 1
mov ecx, eax
call fcn.005d34f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.See_aka.ms_browserpolicyExtensions
push str.Protected___It_is_a_violation_of_Windows_Policy_to_modify.
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x25c]
call fcn.005dc200
lea ecx, [ebp - 0x25c]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005d34f0
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 0x59
call fcn.005dc430
cmp byte [ebp - 0x8d0], 0
jne 0x532e90
push 1
push str._tFailed_to_reset_Microsoft_Edge__UWP__extensions._r_n
jmp 0x533335
push str.Reset_Edge_Main_settings
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x53321e
lea ecx, [ebp - 0xa0]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x533041
mov byte [ebp - 0x8d0], 1
push 1
push str._tSuccessfully_reset_Microsoft_Edge__UWP__Main_settings._r_n
lea ecx, [ebp - 0x70]
call fcn.005dc260
jmp 0x533784
push 0xc
lea ecx, [ebp - 0x198]
call fcn.00401d40
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x198]
call fcn.005dc5b0
push 0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x5d
call fcn.005dbed0
lea ecx, [ebp - 0x198]
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005d34f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
shr eax, 0x1f
lea ecx, [ebp - 0xa0]
push 0
xor al, 1
push str.New_WindowsAllowInPrivate
mov byte [ebp - 0x8d0], al
call fcn.005dc190
push eax
lea ecx, [ebp - 0x198]
call fcn.005dc200
lea ecx, [ebp - 0x198]
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005d34f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.ReadingMode
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x198]
call fcn.005dc200
lea ecx, [ebp - 0x198]
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005d34f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.ServiceUI
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x198]
call fcn.005dc200
lea ecx, [ebp - 0x198]
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005d34f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UserStateMigration
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x198]
call fcn.005dc200
lea ecx, [ebp - 0x198]
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005d34f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Zoom
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x198]
call fcn.005dc200
lea ecx, [ebp - 0x198]
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005d34f0
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0x59
call fcn.005dc430
cmp byte [ebp - 0x8d0], 0
jne 0x53302d
push 1
push str._tFailed_to_reset_Microsoft_Edge__UWP__Main_settings._r_n
jmp 0x533335
push str.Reset_Edge_Start_Pages
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x5332ac
lea ecx, [ebp - 0x2a4]
call fcn.005dc190
lea ecx, [ebp - 0xa0]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x533276
mov byte [ebp - 0x8d0], 1
push 1
push str._tSuccessfully_reset_Microsoft_Edge__UWP__Start_Pages._r_n
lea ecx, [ebp - 0x70]
call fcn.005dc260
jmp 0x533784
lea ecx, [ebp - 0x2a4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x533262
push 1
push str._tFailed_to_reset_Microsoft_Edge__UWP__Start_Pages._r_n
jmp 0x533335
push str.Reset_Edge_Search_Providers
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x533365
lea ecx, [ebp - 0x2a4]
call fcn.005dc190
lea ecx, [ebp - 0xa0]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x533304
mov byte [ebp - 0x8d0], 1
push 1
push str._tSuccessfully_reset_Microsoft_Edge__UWP__Search_Providers._r_n
lea ecx, [ebp - 0x70]
call fcn.005dc260
jmp 0x533784
lea ecx, [ebp - 0x2a4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x5332f0
push 1
push str._tFailed_to_reset_Microsoft_Edge__UWP__Search_Providers._r_n
lea ecx, [ebp - 0x70]
call fcn.005dc260
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
xor eax, eax
cmp byte [ebp - 0x8d0], al
setne al
add dword [edi + 0x2c], eax
inc dword [edi + 0x28]
jmp 0x5390e2
push str.Reset_Edges_Settings
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
jne 0x53360c
push str.Reset_Edges_Expert_Settings
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
jne 0x53360c
push str.Reset_Edges_DOM_Storage
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x533784
push 4
lea ecx, [ebp - 0x150]
call fcn.00401d80
lea ecx, [ebp - 0x150]
call fcn.005d6aa0
push 0xc
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 0x60
call fcn.00401d40
push 1
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x340]
call fcn.005dc570
push 0xc
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 0x61
call fcn.00401d40
lea ecx, [ebp - 0x2d4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0x62
call fcn.00401d40
lea ecx, [ebp - 0x878]
call fcn.005d6ac0
xor esi, esi
mov byte [ebp - 4], 0x63
push esi
push 1
push 0xd
push 1
push 0x624284
lea ecx, [ebp - 0x340]
call fcn.005daa70
cmp eax, 0xa
jge 0x5334a1
lea ecx, [ebp - 0x878]
call fcn.005d6ab0
lea ecx, [ebp - 0x2d4]
call fcn.005dc430
lea ecx, [ebp - 0x340]
call fcn.005dc430
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0x59
call fcn.005d69e0
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
xor eax, eax
cmp byte [ebp - 0x8d0], al
setne al
add dword [edi + 0x2c], eax
inc dword [edi + 0x28]
jmp 0x5390e2
push 0
push 0x20019
dec eax
lea ecx, [ebp - 0x340]
push eax
call fcn.005dae00
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x150]
call fcn.005d6a30
test al, al
je 0x5335b2
lea eax, [ebp - 0x878]
push eax
push 0
lea ecx, [ebp - 0x150]
call fcn.005d6380
test al, al
je 0x5335b2
mov edi, esi
nop
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Internet_ExplorerEdpDomStorage
push dword [ebp - 0x878]
lea ecx, [ebp - 0x340]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2d4]
call fcn.005dc200
lea ecx, [ebp - 0x2d4]
call fcn.005dc190
mov edx, 1
mov ecx, eax
call fcn.005d34f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Internet_ExplorerDomStorage
push dword [ebp - 0x878]
lea ecx, [ebp - 0x340]
add esi, eax
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2d4]
call fcn.005dc200
lea ecx, [ebp - 0x2d4]
call fcn.005dc190
mov edx, 1
mov ecx, eax
call fcn.005d34f0
add esi, eax
lea ecx, [ebp - 0x150]
lea eax, [ebp - 0x878]
inc edi
push eax
push edi
call fcn.005d6380
test al, al
jne 0x5334f0
mov edi, dword [ebp - 0x8e8]
test esi, esi
lea ecx, [ebp - 0x70]
push 1
setg al
mov byte [ebp - 0x8d0], al
test esi, esi
jg 0x5335cd
push str._tFailed_to_reset_Microsoft_Edge__UWP__DOM_Storage._r_n
jmp 0x5335d2
push str._tSuccessfully_reset_Microsoft_Edge__UWP__DOM_Storage._r_n
call fcn.005dc260
lea ecx, [ebp - 0x878]
call fcn.005d6ab0
lea ecx, [ebp - 0x2d4]
call fcn.005dc430
lea ecx, [ebp - 0x340]
call fcn.005dc430
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0x59
call fcn.005d69e0
jmp 0x533784
push 0xc
lea ecx, [ebp - 0x4c0]
call fcn.00401d40
lea ecx, [ebp - 0x4c0]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0x5e
call fcn.00401d40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..tmp
lea ecx, [ebp - 0x88]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x574]
call fcn.005dc520
push 1
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0x5f
call fcn.005dc190
push eax
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call esi
test eax, eax
je 0x533720
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624388
lea ecx, [ebp - 0x88]
call fcn.005dc190
push eax
push str._sfc.exe__ScanFile_
lea ecx, [ebp - 0x3f4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c0]
call fcn.005dc200
push 1
push 0
lea ecx, [ebp - 0x4c0]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005e2c60
lea ecx, [ebp - 0x88]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x533720
push 0
lea ecx, [ebp - 0x88]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x574]
call fcn.005dc190
push eax
call esi
push str.Reset_Edges_Settings
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
lea ecx, [ebp - 0x70]
push 1
test al, al
je 0x533750
cmp byte [ebp - 0x8d0], 0
jne 0x533749
push str._tFailed_to_reset_Microsoft_Edges_Settings._r_n
jmp 0x533765
push str._tSuccessfully_reset_Microsoft_Edges_Settings._r_n
jmp 0x533765
cmp byte [ebp - 0x8d0], 0
jne 0x533760
push str._tFailed_to_reset_Microsoft_Edges_Expert_Settings._r_n
jmp 0x533765
push str._tSuccessfully_reset_Microsoft_Edges_Expert_Settings._r_n
call fcn.005dc260
lea ecx, [ebp - 0x574]
call fcn.005dc430
lea ecx, [ebp - 0x4c0]
mov byte [ebp - 4], 0x59
call fcn.005dc430
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
cmp byte [ebp - 0x8d0], 0
je 0x5337c1
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x8d4]
push 0
push dword [eax + ecx*4]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push dword [eax + 0xa8]
call fcn.005bb970
xor eax, eax
cmp byte [ebp - 0x8d0], al
setne al
add dword [edi + 0x2c], eax
inc dword [edi + 0x28]
jmp 0x5390e2
cmp esi, 0x6f
jne 0x533876
push 0x629fdc
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x88]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0053a7d0
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
je 0x53384d
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully_fixed_MS_Edges__
lea ecx, [ebp - 0x70]
call fcn.005dc200
push dword [ebp - 0x8d4]
jmp 0x538bb6
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to_fix_MS_Edges__
lea ecx, [ebp - 0x70]
call fcn.005dc200
jmp 0x538bd9
cmp esi, 0x70
jne 0x53392d
push 0x629fdc
push str.default_search_provider_data
lea ecx, [ebp - 0x88]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0053a7d0
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
je 0x5338fb
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_fixed_MS_Edges_default_search_provider
lea ecx, [ebp - 0x70]
call fcn.005dc200
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
inc dword [edi + 0x2c]
jmp 0x533913
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_fix_MS_Edges_default_search_provider
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
inc dword [edi + 0x28]
jmp 0x5390e2
cmp esi, 0x71
jne 0x533a20
push 0
push str.Extension_path
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x88]
call fcn.005db160
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x5339e1
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x6f]
mov ecx, eax
call fcn.005e4c40
test al, al
jne 0x53399c
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x6f]
mov ecx, eax
call fcn.005e4c40
test al, al
je 0x5339e1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully_removed_MS_Edges_extension__
lea ecx, [ebp - 0x70]
call fcn.005dc200
push dword [ebp - 0x8d4]
jmp 0x538bb6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to_remove_MS_Edges_extension__
lea ecx, [ebp - 0x70]
call fcn.005dc200
jmp 0x538bd9
cmp esi, 0x72
jne 0x533ce2
push str.Start_Menu_Internet_shortcut
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x533bd2
push 4
lea ecx, [ebp - 0x178]
call fcn.00401d80
push 0
push 0x2001f
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x178]
call fcn.005d6a80
push 0xc
lea ecx, [ebp - 0x3a0]
mov byte [ebp - 4], 0x64
call fcn.00401d40
lea ecx, [ebp - 0x3a0]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x5f4]
mov byte [ebp - 4], 0x65
call fcn.00401d40
mov esi, dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
push esi
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push 2
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x5f4]
call fcn.005dc570
lea eax, [ebp - 0x3a0]
mov byte [ebp - 4], 0x66
push eax
push 0x62439c
lea ecx, [ebp - 0x178]
call fcn.005d6740
mov byte [ebp - 0x8c9], al
test al, al
je 0x533b78
push 0
push 0
push 0x62439c
lea ecx, [ebp - 0x5f4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3a0]
call fcn.005da270
push 3
lea ecx, [ebp - 0x3a0]
call fcn.005da0f0
push 0
lea ecx, [ebp - 0x3a0]
call fcn.005dc190
push eax
push 1
push 0x62439c
lea ecx, [ebp - 0x178]
call fcn.005d5f20
mov byte [ebp - 0x8c9], al
test al, al
je 0x533b78
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_fixed_MS_Edge_Start_Menu_Internet_shortcut
jmp 0x533ba0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_fix_MS_Edge_Start_Menu_Internet_shortcut
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x5f4]
call fcn.005dc430
lea ecx, [ebp - 0x3a0]
call fcn.005dc430
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0x59
call fcn.005d69e0
jmp 0x538bac
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
push 0x4c
lea ecx, [ebp - 0x6e0]
call fcn.00401e50
lea ecx, [ebp - 0x6e0]
call fcn.005e9520
push 2
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x67
call fcn.005dc190
push eax
lea ecx, [ebp - 0x6e0]
call fcn.005e93e0
mov byte [ebp - 0x8c9], al
test al, al
je 0x533c9d
push 0x62439c
lea ecx, [ebp - 0x6e0]
call fcn.005e9250
mov byte [ebp - 0x8c9], al
test al, al
je 0x533c9d
lea ecx, [ebp - 0x6e0]
call fcn.005e9140
mov byte [ebp - 0x8c9], al
test al, al
je 0x533c9d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully_fixed_MS_Edge_shortcut__
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x6e0]
jmp 0x538b9d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to_fix_MS_Edge_shortcut__
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x6e0]
jmp 0x538b9d
cmp esi, 0x74
jne 0x533fe9
push 0xc
lea ecx, [ebp - 0x394]
call fcn.00401d40
lea ecx, [ebp - 0x394]
call fcn.005dc5e0
lea ecx, [ebp - 0x394]
mov byte [ebp - 4], 0x68
call fcn.005dc190
lea ecx, [ebp - 0xa0]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
sete byte [ebp - 0x8c9]
test al, al
je 0x533d5b
lea ecx, [ebp - 0x394]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
mov byte [ebp - 0x8c9], al
push str.HomepageLocation
lea ecx, [ebp - 0x394]
call fcn.005dc4c0
test al, al
je 0x533dd2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x7c]
push 0x667ad8
call fcn.005dc190
cmp byte [ebp - 0x8c9], 0
lea ecx, [ebp - 0x70]
push eax
je 0x533dc3
push str._tSuccessfully_removed_MS_Edges_Default_Homepage_policy_for
call fcn.005dc200
push str.HomepageIsNewTabPage
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
jmp 0x533f97
push str._tFailed_to_remove_MS_Edges_Default_Homepage_policy_for
call fcn.005dc200
jmp 0x533fc0
push str.DefaultSearchProviderSearchURL
lea ecx, [ebp - 0x394]
call fcn.005dc4c0
test al, al
je 0x533eba
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x7c]
push 0x667ad8
call fcn.005dc190
cmp byte [ebp - 0x8c9], 0
lea ecx, [ebp - 0x70]
push eax
je 0x533eab
push str._tSuccessfully_removed_MS_Edges_Default_Search_Provider_policy_for
call fcn.005dc200
push str.DefaultSearchProviderName
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.DefaultSearchProviderEnabled
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.DefaultSearchProviderKeyword
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.DefaultSearchProviderSuggestURL
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.DefaultSearchProviderInstantURL
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.DefaultSearchProviderIconURL
jmp 0x533daa
push str._tFailed_to_remove_MS_Edges_Default_Search_Provider_policy_for
call fcn.005dc200
jmp 0x533fc0
push 0x669320
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x533f8e
push 0xc
lea ecx, [ebp - 0x4cc]
call fcn.00401d40
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push 2
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x4cc]
call fcn.005dc570
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x69
call fcn.005dc190
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
push eax
lea ecx, [ebp - 0x4cc]
push str.__for
call fcn.005dc190
cmp byte [ebp - 0x8c9], 0
lea ecx, [ebp - 0x70]
push eax
je 0x533f75
push str._tSuccessfully_removed_MS_Edges_Startup_Page_policy__
call fcn.005dc200
push str.DefaultSearchProviderName
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
jmp 0x533f7f
push str._tFailed_to_remove_MS_Edges_Startup_Page_policy__
call fcn.005dc200
lea ecx, [ebp - 0x4cc]
mov byte [ebp - 4], 0x68
call fcn.005dc430
cmp byte [ebp - 0x8c9], 0
je 0x533fc0
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
inc dword [edi + 0x2c]
inc dword [edi + 0x28]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call fcn.0053a600
lea ecx, [ebp - 0x394]
mov byte [ebp - 4], 0x59
call fcn.005dc430
jmp 0x5390e2
cmp esi, 0x73
jne 0x5343d6
push str.Reset_Secure_Preferences
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x5340b6
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x71]
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x534089
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x70]
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x534089
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_reset_MS_Edges_Secure_Preferences
jmp 0x5343ac
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_reset_MS_Edges_Secure_Preferences
jmp 0x534241
push str.Reset_Preferences
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x53417e
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x534151
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x534151
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_reset_MS_Edges_Preferences
jmp 0x5343ac
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_reset_MS_Edges_Preferences
jmp 0x534241
push str.Reset_Default_Preferences
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x534260
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x534219
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x534219
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_reset_MS_Edges_Default_Preferences
jmp 0x5343ac
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_reset_MS_Edges_Default_Preferences
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
jmp 0x5342f6
push str.Reset_MS_Edge_Policies
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x5342db
lea ecx, [ebp - 0xa0]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
lea ecx, [ebp - 0xa0]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x53433c
mov byte [ebp - 0x8d0], 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_reset_MS_Edges_Policies
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
cmp byte [ebp - 0x8d0], 0
je 0x53432c
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
cmp byte [ebp - 0x8d0], 2
jne 0x53432c
or dword [ebp - 0x8e0], 2
inc dword [edi + 0x28]
xor eax, eax
cmp byte [ebp - 0x8d0], al
jmp 0x5390dc
push 0
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x5342ab
push 0
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x5342ab
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_reset_MS_Edges_Policies
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
inc dword [edi + 0x28]
xor eax, eax
cmp byte [ebp - 0x8d0], al
jmp 0x5390dc
cmp esi, 0x1f
jne 0x5347da
lea ecx, [ebp - 0xa0]
call fcn.005dbeb0
test al, al
jne 0x5390e2
push 0xc
lea ecx, [ebp - 0x3dc]
call fcn.00401d40
mov esi, dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
push esi
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push 2
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x3dc]
call fcn.005dc570
push str.Start_Page
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x6a
call fcn.005dc4c0
test al, al
jne 0x5345fc
push str.Default_Page_URL
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
jne 0x5345fc
push str.Search_Page
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
jne 0x5345fc
push str.Default_Search_URL
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x53449e
push str.https:__www.google.com_search_qsearchTerms
jmp 0x534601
push str.Start_Page_Redirect_Cache
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x5344bc
push str.https:__www.msn.com_fr_fr__ocidiehp
jmp 0x534601
push str.Default_Secondary_Page_URL
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x5344e0
lea ecx, [ebp - 0x124]
call fcn.005dc400
jmp 0x53460c
push str.Secondary_Start_Pages
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x534550
push 4
lea ecx, [ebp - 0x17c]
call fcn.00401d80
push 0
push 0x20019
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x17c]
call fcn.005d6a80
lea eax, [ebp - 0x124]
mov byte [ebp - 4], 0x6b
push eax
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x17c]
call fcn.005d6740
test al, al
jne 0x534564
lea ecx, [ebp - 0x17c]
call fcn.005d69e0
lea ecx, [ebp - 0x3dc]
mov byte [ebp - 4], 0x59
call fcn.005dc430
jmp 0x5390e2
push 0
push 0
push 0x62439c
lea ecx, [ebp - 0x3dc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x124]
call fcn.005da270
push 0
push 0
push 0x627824
push 0x667ddc
lea ecx, [ebp - 0x124]
call fcn.005da270
lea ecx, [ebp - 0x124]
call fcn.005dc3a0
dec eax
lea ecx, [ebp - 0x124]
push eax
call fcn.005dc440
cmp word [eax], 0xa
jne 0x5345eb
nop dword [eax + eax]
push 1
lea ecx, [ebp - 0x124]
call fcn.005dadc0
lea ecx, [ebp - 0x124]
call fcn.005dc3a0
dec eax
lea ecx, [ebp - 0x124]
push eax
call fcn.005dc440
cmp word [eax], 0xa
je 0x5345c0
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 0x6a
call fcn.005d69e0
jmp 0x53460c
push str.https:__www.google.com
lea ecx, [ebp - 0x124]
call fcn.005dc510
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
test al, al
jne 0x53467c
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
push str.__to__
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to_change__
lea ecx, [ebp - 0x70]
call fcn.005dc200
jmp 0x5347b1
lea ecx, [ebp - 0x124]
call fcn.005dc3a0
test eax, eax
je 0x53470f
push str.Secondary_Start_Pages
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x53470f
push 0
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
push 7
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d5f20
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str.__from_the_IEs
lea ecx, [ebp - 0x3dc]
call fcn.005dc190
push eax
push str._tSuccessfully_removed__
jmp 0x534785
lea ecx, [ebp - 0x124]
call fcn.005dc3a0
test eax, eax
je 0x53478d
push 0
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
push 1
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d5f20
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
push str.__to__
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully_changed__
lea ecx, [ebp - 0x70]
call fcn.005dc200
push esi
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
inc dword [edi + 0x2c]
inc dword [edi + 0x28]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call fcn.0053a600
lea ecx, [ebp - 0x3dc]
mov byte [ebp - 4], 0x59
call fcn.005dc430
jmp 0x5390e2
cmp esi, 0x20
jne 0x5349c5
lea ecx, [ebp - 0xa0]
call fcn.005dbeb0
test al, al
jne 0x5390e2
push 0
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
jne 0x53484c
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to_delete_IE_search_provider__
lea ecx, [ebp - 0x70]
call fcn.005dc200
jmp 0x534899
call fcn.005dc190
push eax
push str._for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully_deleted_IE_search_provider
lea ecx, [ebp - 0x70]
call fcn.005dc200
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
inc dword [edi + 0x2c]
inc dword [edi + 0x28]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call fcn.0053a600
push 0
lea ecx, [ebp - 0xa0]
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.3CB12E97_BDDF_4488_8C61_217335DD319F
lea ecx, [ebp - 0xa0]
call fcn.005da780
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d6a30
test al, al
je 0x5390e2
push 0
push 0x660330
push 1
push str.DisplayName
lea ecx, [ebp - 0x20]
call fcn.005d5f20
push 0
push str.https:__www.google.com_favicon.ico
push 1
push str.FaviconURL
lea ecx, [ebp - 0x20]
call fcn.005d5f20
push 0
push str.https:__www.iegallery.com_en_us_AddOns_DownloadAddOn_resourceId813
push 1
push str.OSDFileURL
lea ecx, [ebp - 0x20]
call fcn.005d5f20
push 0
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0x4a8], 1
push eax
push 4
push str.ShowSearchSuggestions
lea ecx, [ebp - 0x20]
call fcn.005d5f20
push 0
push str.https:__clients5.google.com_complete_search_qsearchTermsclientie8mwie:maxWidthshie:sectionHeightrhie:rowHeightinputencodinginputEncodingoutputencodingoutputEncoding
push 1
push str.SuggestionsURL
lea ecx, [ebp - 0x20]
call fcn.005d5f20
push 0
push str.https:__www.google.com_search_qsearchTermssourceidie7rlscom.microsoft:language:referrer:sourceieinputEncoding_oeoutputEncoding_
push 1
push 0x65fd7c
lea ecx, [ebp - 0x20]
call fcn.005d5f20
push 0
lea ecx, [ebp - 0xa0]
call fcn.005dbed0
push 0
push 0x65fb78
push 1
push str.DefaultScope
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d5e20
jmp 0x5390e2
cmp esi, 0x21
jne 0x53504b
lea ecx, [ebp - 0xb4]
call fcn.005dbeb0
test al, al
jne 0x5390e2
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0052eab0
mov ecx, eax
test ecx, ecx
js 0x5390e2
mov eax, dword [edi + 0x30]
mov dword [ebp - 0x8d8], eax
cmp ecx, eax
jl 0x534a15
cmp eax, 1
je 0x534a1f
mov esi, dword [edi + 0x104]
jmp 0x534a2d
mov dword [ebp - 0x8d8], 1
push ecx
lea ecx, [edi + 0x104]
call fcn.00403bc0
mov esi, eax
push 0xc
lea ecx, [ebp - 0xf4]
call fcn.00401d40
lea ecx, [ebp - 0xf4]
call fcn.005dc5e0
mov byte [ebp - 4], 0x6c
mov eax, dword [ebp - 0x8d8]
test eax, eax
jle 0x534c52
mov edi, eax
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExtPreApproved_
mov ecx, esi
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0xf4]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExtApproved_
mov ecx, esi
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0xf4]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettings_
mov ecx, esi
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0xf4]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExtStats_
mov ecx, esi
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0xf4]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_
mov ecx, esi
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0xf4]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerToolbar
mov ecx, esi
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0xf4]
call fcn.005dc200
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
add esi, 0xc
sub edi, 1
jne 0x534a60
mov edi, dword [ebp - 0x8e8]
mov eax, dword [ebp - 0x8d8]
cmp eax, dword [edi + 0x30]
jl 0x534e05
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.005dc190
mov esi, dword [ebp - 0x8e4]
lea ecx, [ebp - 0xf4]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved_
push esi
call fcn.005dc200
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExtApproved_
push esi
lea ecx, [ebp - 0xf4]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExtSettings_
push esi
lea ecx, [ebp - 0xf4]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExtStats_
push esi
lea ecx, [ebp - 0xf4]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_
push esi
lea ecx, [ebp - 0xf4]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerToolbar
push esi
lea ecx, [ebp - 0xf4]
call fcn.005dc200
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
mov eax, dword [ebp - 0x8d8]
cmp dword [ebp - 0x128], 0
je 0x534fbf
cmp eax, dword [edi + 0x30]
jl 0x534fbf
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.005dc190
mov esi, dword [ebp - 0x8f0]
lea ecx, [ebp - 0xf4]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved_
push esi
call fcn.005dc200
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExtApproved_
push esi
lea ecx, [ebp - 0xf4]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExtSettings_
push esi
lea ecx, [ebp - 0xf4]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExtStats_
push esi
lea ecx, [ebp - 0xf4]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_
push esi
lea ecx, [ebp - 0xf4]
call fcn.005dc200
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerToolbar
push esi
lea ecx, [ebp - 0xf4]
call fcn.005dc200
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully_deleted_IE_Ad_on__
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
inc dword [edi + 0x2c]
lea ecx, [ebp - 0xf4]
inc dword [edi + 0x28]
mov byte [ebp - 4], 0x59
call fcn.005dc430
jmp 0x5390e2
cmp esi, 0x23
jne 0x535332
push str.Start_Menu_Internet_shortcut
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x5351fd
push 4
lea ecx, [ebp - 0x184]
call fcn.00401d80
push 0
push 0x2001f
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x184]
call fcn.005d6a80
push 0xc
lea ecx, [ebp - 0x388]
mov byte [ebp - 4], 0x6d
call fcn.00401d40
lea ecx, [ebp - 0x388]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 0x6e
call fcn.00401d40
mov esi, dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
push esi
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push 2
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x5dc]
call fcn.005dc570
lea eax, [ebp - 0x388]
mov byte [ebp - 4], 0x6f
push eax
push 0x62439c
lea ecx, [ebp - 0x184]
call fcn.005d6740
mov byte [ebp - 0x8c9], al
test al, al
je 0x5351a3
push 0
push 0
push 0x62439c
lea ecx, [ebp - 0x5dc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x388]
call fcn.005da270
push 3
lea ecx, [ebp - 0x388]
call fcn.005da0f0
push 0
lea ecx, [ebp - 0x388]
call fcn.005dc190
push eax
push 1
push 0x62439c
lea ecx, [ebp - 0x184]
call fcn.005d5f20
mov byte [ebp - 0x8c9], al
test al, al
je 0x5351a3
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_fixed_IE_Start_Menu_Internet_shortcut
jmp 0x5351cb
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_fix_IE_Start_Menu_Internet_shortcut
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x5dc]
call fcn.005dc430
lea ecx, [ebp - 0x388]
call fcn.005dc430
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 0x59
call fcn.005d69e0
jmp 0x538bac
push 0
push str.Path
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x88]
call fcn.005db160
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
push 0x4c
lea ecx, [ebp - 0x730]
call fcn.00401e50
lea ecx, [ebp - 0x730]
call fcn.005e9520
push 2
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x70
call fcn.005dc190
push eax
lea ecx, [ebp - 0x730]
call fcn.005e93e0
mov byte [ebp - 0x8c9], al
test al, al
je 0x5352ed
push 0x62439c
lea ecx, [ebp - 0x730]
call fcn.005e9250
mov byte [ebp - 0x8c9], al
test al, al
je 0x5352ed
lea ecx, [ebp - 0x730]
call fcn.005e9140
mov byte [ebp - 0x8c9], al
test al, al
je 0x5352ed
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully_fixed_IE_shortcut__
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x730]
jmp 0x538b9d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to_fix_IE_shortcut__
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x730]
jmp 0x538b9d
cmp esi, 0x25
jne 0x535758
push 0xc
lea ecx, [ebp - 0x45c]
call fcn.00401d40
lea ecx, [ebp - 0x45c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x37c]
mov byte [ebp - 4], 0x71
call fcn.00401d40
mov esi, dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
push esi
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push 2
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x37c]
call fcn.005dc570
push 0
push str.Value_name
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x72
call fcn.005dc190
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x45c]
call fcn.005db160
lea ecx, [ebp - 0x45c]
call fcn.005dc3a0
test eax, eax
je 0x5353de
lea ecx, [ebp - 0x45c]
call fcn.005dc190
jmp 0x5353e0
xor eax, eax
push eax
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0xc
lea ecx, [ebp - 0x144]
mov byte [ebp - 0x8c9], al
call fcn.00401d40
lea ecx, [ebp - 0x144]
call fcn.005dc5e0
push str.Start_Page
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x73
call fcn.005dc4c0
test al, al
je 0x53552e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x7c]
push 0x667ad8
call fcn.005dc190
push eax
lea ecx, [ebp - 0x37c]
push str.__for
call fcn.005dc190
cmp byte [ebp - 0x8c9], 0
lea ecx, [ebp - 0x70]
push eax
je 0x535524
push str._tSuccessfully_removed_IEs_GP_Start_Page__
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64df70
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x144]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x144]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d6a30
test al, al
je 0x5354d5
lea ecx, [ebp - 0x20]
call fcn.005d6220
test eax, eax
jne 0x5356e9
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x144]
call fcn.005dc4e0
push 0
lea ecx, [ebp - 0x144]
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x66a220
lea ecx, [ebp - 0x144]
call fcn.005da780
push str.HomePage
jmp 0x5356d5
push str._tFailed_to_remove_IEs_GP_Start_Page__
jmp 0x535714
push str.SecondaryStartPages
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
je 0x53561b
call fcn.005dc190
push eax
lea ecx, [ebp - 0x37c]
push str.__for
call fcn.005dc190
cmp byte [ebp - 0x8c9], 0
lea ecx, [ebp - 0x70]
push eax
je 0x535524
push str._tSuccessfully_removed_IEs_GP_Start_Page__
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005d6220
test eax, eax
jne 0x5356e9
push 1
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x144]
call fcn.005dc260
push 0
lea ecx, [ebp - 0x144]
call fcn.005dbed0
lea ecx, [ebp - 0x144]
call fcn.005dc190
mov edx, str.Start_Page
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x5356e9
push 0
lea ecx, [ebp - 0x144]
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x66a220
lea ecx, [ebp - 0x144]
call fcn.005da780
push str.HomePage
jmp 0x5356d5
call fcn.005dc190
push eax
lea ecx, [ebp - 0x94]
push str.__for
call fcn.005dc190
cmp byte [ebp - 0x8c9], 0
lea ecx, [ebp - 0x70]
push eax
je 0x53570f
push str._tSuccessfully_removed_IEs_GP__
call fcn.005dc200
push 1
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x144]
call fcn.005dc260
push 0
lea ecx, [ebp - 0x144]
call fcn.005dbed0
push 0
push 0x20019
lea ecx, [ebp - 0x144]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d6a30
test al, al
je 0x53569d
lea ecx, [ebp - 0x20]
call fcn.005d6280
test eax, eax
jne 0x5356e9
push 0
lea ecx, [ebp - 0x144]
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64e2b0
lea ecx, [ebp - 0x144]
call fcn.005da780
push str.UsePolicySearchProvidersOnly
lea ecx, [ebp - 0x144]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push esi
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
inc dword [edi + 0x2c]
jmp 0x535719
push str._tFailed_to_remove_IEs_GP__
call fcn.005dc200
inc dword [edi + 0x28]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call fcn.0053a600
lea ecx, [ebp - 0x144]
call fcn.005dc430
lea ecx, [ebp - 0x37c]
call fcn.005dc430
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 0x59
call fcn.005dc430
jmp 0x5390e2
cmp esi, 0x24
jne 0x535b50
push str.Reset_Proxy
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x535843
lea ecx, [ebp - 0xa0]
call fcn.005dbeb0
test al, al
jne 0x5390e2
push str.ProxyServer
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.ProxyEnable
lea ecx, [ebp - 0xa0]
mov byte [ebp - 0x8c9], al
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
add byte [ebp - 0x8c9], al
lea ecx, [ebp - 0xa0]
push str.ProxyOveride
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
add al, byte [ebp - 0x8c9]
je 0x535826
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_deleted_Proxy_entries
lea ecx, [ebp - 0x70]
call fcn.005dc200
push dword [ebp - 0x8d4]
jmp 0x538bb6
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_delete_Proxy_entries
lea ecx, [ebp - 0x70]
call fcn.005dc200
jmp 0x538bd9
push str.Reset_Shell
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x535912
lea ecx, [ebp - 0xa0]
call fcn.005dbeb0
test al, al
jne 0x5390e2
push str._All_users_
lea ecx, [ebp - 0x7c]
call fcn.005dc4c0
lea ecx, [ebp - 0xa0]
test al, al
je 0x5358a3
push 0
push str.Explorer.exe
push 1
push 0x6417fc
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d5e20
jmp 0x5358b6
push 0x6417fc
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
je 0x5358f5
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_deleted_Shell_hijack
lea ecx, [ebp - 0x70]
call fcn.005dc200
push dword [ebp - 0x8d4]
jmp 0x538bb6
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_delete_Shell_hijack
lea ecx, [ebp - 0x70]
call fcn.005dc200
jmp 0x538bd9
push str.Reset_Internet_Explorer_Policies
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x535a5a
lea ecx, [ebp - 0xa0]
call fcn.005dbeb0
test al, al
jne 0x5390e2
push 0xc
lea ecx, [ebp - 0x468]
call fcn.00401d40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x66a220
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x468]
call fcn.005dc520
push str.HomePage
lea ecx, [ebp - 0x468]
mov byte [ebp - 4], 0x74
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x65f434
lea ecx, [ebp - 0xa0]
mov byte [ebp - 0x8c9], al
call fcn.005dc190
push eax
lea ecx, [ebp - 0x468]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x468]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
add al, byte [ebp - 0x8c9]
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov byte [ebp - 0x8c9], al
push 0x667ad8
je 0x535a1b
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_reset_IE_policies
jmp 0x535a2b
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_reset_IE_policies
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x468]
mov byte [ebp - 4], 0x59
call fcn.005dc430
cmp byte [ebp - 0x8c9], 0
je 0x538bd9
push dword [ebp - 0x8d4]
jmp 0x538bb6
push str.Reset_IEs_DOM_Storage
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x5390e2
lea ecx, [ebp - 0xa0]
call fcn.005dbeb0
test al, al
jne 0x5390e2
lea ecx, [ebp - 0xa0]
call fcn.005dc190
mov edx, 1
mov ecx, eax
call fcn.005d34f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test eax, eax
lea ecx, [ebp - 0xa0]
push str.EdpDomStorage
push 0
setg byte [ebp - 0x8c9]
call fcn.005dbed0
mov ecx, eax
call fcn.005da780
lea ecx, [ebp - 0xa0]
call fcn.005dc190
mov edx, 1
mov ecx, eax
call fcn.005d34f0
push 0
push 0
push 0
push 0
push 0
push 0
test eax, eax
lea ecx, [ebp - 0x7c]
push 0
setg al
push 0
push 0x667ad8
add al, byte [ebp - 0x8c9]
je 0x535b33
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_reset_IEs_DOM_Storage
lea ecx, [ebp - 0x70]
call fcn.005dc200
push dword [ebp - 0x8d4]
jmp 0x538bb6
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_reset_IEs_DOM_Storage
lea ecx, [ebp - 0x70]
call fcn.005dc200
jmp 0x538bd9
cmp esi, 0x2a
jne 0x535bef
push 0x629fdc
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x88]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0053a7d0
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
je 0x535bc6
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully_fixed_Chromes__
lea ecx, [ebp - 0x70]
call fcn.005dc200
push dword [ebp - 0x8d4]
jmp 0x538bb6
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to_fix_Chromes__
lea ecx, [ebp - 0x70]
call fcn.005dc200
jmp 0x538bd9
cmp esi, 0x2b
jne 0x535c71
push 0x629fdc
push str.default_search_provider_data
lea ecx, [ebp - 0x88]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0053a7d0
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
je 0x535c54
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_fixed_Chromes_default_search_provider
lea ecx, [ebp - 0x70]
call fcn.005dc200
push dword [ebp - 0x8d4]
jmp 0x538bb6
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_fix_Chromes_default_search_provider
lea ecx, [ebp - 0x70]
call fcn.005dc200
jmp 0x538bd9
cmp esi, 0x2c
jne 0x535d64
push 0
push str.Extension_path
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x88]
call fcn.005db160
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x535d25
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x2a]
mov ecx, eax
call fcn.005e4c40
test al, al
jne 0x535ce0
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x2a]
mov ecx, eax
call fcn.005e4c40
test al, al
je 0x535d25
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully_removed_Chromes_extension__
lea ecx, [ebp - 0x70]
call fcn.005dc200
push dword [ebp - 0x8d4]
jmp 0x538bb6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to_remove_Chromes_extension__
lea ecx, [ebp - 0x70]
call fcn.005dc200
jmp 0x538bd9
cmp esi, 0x2d
jne 0x536026
push str.Start_Menu_Internet_shortcut
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x535f16
push 4
lea ecx, [ebp - 0x188]
call fcn.00401d80
push 0
push 0x2001f
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x188]
call fcn.005d6a80
push 0xc
lea ecx, [ebp - 0x370]
mov byte [ebp - 4], 0x75
call fcn.00401d40
lea ecx, [ebp - 0x370]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x5b8]
mov byte [ebp - 4], 0x76
call fcn.00401d40
mov esi, dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
push esi
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push 2
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x5b8]
call fcn.005dc570
lea eax, [ebp - 0x370]
mov byte [ebp - 4], 0x77
push eax
push 0x62439c
lea ecx, [ebp - 0x188]
call fcn.005d6740
mov byte [ebp - 0x8c9], al
test al, al
je 0x535ebc
push 0
push 0
push 0x62439c
lea ecx, [ebp - 0x5b8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x370]
call fcn.005da270
push 3
lea ecx, [ebp - 0x370]
call fcn.005da0f0
push 0
lea ecx, [ebp - 0x370]
call fcn.005dc190
push eax
push 1
push 0x62439c
lea ecx, [ebp - 0x188]
call fcn.005d5f20
mov byte [ebp - 0x8c9], al
test al, al
je 0x535ebc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_fixed_Chrome_Start_Menu_Internet_shortcut
jmp 0x535ee4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_fix_Chrome_Start_Menu_Internet_shortcut
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x5b8]
call fcn.005dc430
lea ecx, [ebp - 0x370]
call fcn.005dc430
lea ecx, [ebp - 0x188]
mov byte [ebp - 4], 0x59
call fcn.005d69e0
jmp 0x538bac
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
push 0x4c
lea ecx, [ebp - 0x780]
call fcn.00401e50
lea ecx, [ebp - 0x780]
call fcn.005e9520
push 2
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x78
call fcn.005dc190
push eax
lea ecx, [ebp - 0x780]
call fcn.005e93e0
mov byte [ebp - 0x8c9], al
test al, al
je 0x535fe1
push 0x62439c
lea ecx, [ebp - 0x780]
call fcn.005e9250
mov byte [ebp - 0x8c9], al
test al, al
je 0x535fe1
lea ecx, [ebp - 0x780]
call fcn.005e9140
mov byte [ebp - 0x8c9], al
test al, al
je 0x535fe1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully_fixed_Chrome_shortcut__
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x780]
jmp 0x538b9d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to_fix_Chrome_shortcut__
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x780]
jmp 0x538b9d
cmp esi, 0x2f
jne 0x536352
push 0xc
lea ecx, [ebp - 0x2ec]
call fcn.00401d40
lea ecx, [ebp - 0x2ec]
call fcn.005dc5e0
push 0
push str.Value_name
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x79
call fcn.005dc190
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x2ec]
call fcn.005db160
lea ecx, [ebp - 0x2ec]
call fcn.005dc190
lea ecx, [ebp - 0xa0]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
sete byte [ebp - 0x8c9]
test al, al
je 0x5360c4
lea ecx, [ebp - 0x2ec]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
mov byte [ebp - 0x8c9], al
push str.HomepageLocation
lea ecx, [ebp - 0x2ec]
call fcn.005dc4c0
test al, al
je 0x53613b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x7c]
push 0x667ad8
call fcn.005dc190
cmp byte [ebp - 0x8c9], 0
lea ecx, [ebp - 0x70]
push eax
je 0x53612c
push str._tSuccessfully_removed_Chromes_Default_Homepage_policy_for
call fcn.005dc200
push str.HomepageIsNewTabPage
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
jmp 0x536300
push str._tFailed_to_remove_Chromes_Default_Homepage_policy_for
call fcn.005dc200
jmp 0x536329
push str.DefaultSearchProviderSearchURL
lea ecx, [ebp - 0x2ec]
call fcn.005dc4c0
test al, al
je 0x536223
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x7c]
push 0x667ad8
call fcn.005dc190
cmp byte [ebp - 0x8c9], 0
lea ecx, [ebp - 0x70]
push eax
je 0x536214
push str._tSuccessfully_removed_Chromes_Default_Search_Provider_policy_for
call fcn.005dc200
push str.DefaultSearchProviderName
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.DefaultSearchProviderEnabled
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.DefaultSearchProviderKeyword
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.DefaultSearchProviderSuggestURL
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.DefaultSearchProviderInstantURL
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.DefaultSearchProviderIconURL
jmp 0x536113
push str._tFailed_to_remove_Chromes_Default_Search_Provider_policy_for
call fcn.005dc200
jmp 0x536329
push 0x669320
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x5362f7
push 0xc
lea ecx, [ebp - 0x4d8]
call fcn.00401d40
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push 2
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x4d8]
call fcn.005dc570
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x7a
call fcn.005dc190
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
push eax
lea ecx, [ebp - 0x4d8]
push str.__for
call fcn.005dc190
cmp byte [ebp - 0x8c9], 0
lea ecx, [ebp - 0x70]
push eax
je 0x5362de
push str._tSuccessfully_removed_Chromes_Startup_Page_policy__
call fcn.005dc200
push str.DefaultSearchProviderName
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
jmp 0x5362e8
push str._tFailed_to_remove_Chromes_Startup_Page_policy__
call fcn.005dc200
lea ecx, [ebp - 0x4d8]
mov byte [ebp - 4], 0x79
call fcn.005dc430
cmp byte [ebp - 0x8c9], 0
je 0x536329
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
inc dword [edi + 0x2c]
inc dword [edi + 0x28]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call fcn.0053a600
lea ecx, [ebp - 0x2ec]
mov byte [ebp - 4], 0x59
call fcn.005dc430
jmp 0x5390e2
cmp esi, 0x2e
jne 0x536694
push str.Reset_Secure_Preferences
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x53641f
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x2c]
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x5363f2
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x2b]
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x5363f2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_reset_Chromes_Secure_Preferences
jmp 0x5343ac
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_reset_Chromes_Secure_Preferences
jmp 0x534241
push str.Reset_Preferences
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x5364e7
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x5364ba
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x5364ba
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_reset_Chromes_Preferences
jmp 0x5343ac
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_reset_Chromes_Preferences
jmp 0x534241
push str.Reset_Default_Preferences
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x5365af
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x536582
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x536582
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_reset_Chromes_Default_Preferences
jmp 0x5343ac
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_reset_Chromes_Default_Preferences
jmp 0x534241
push str.Reset_Chrome_Policies
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x5342db
lea ecx, [ebp - 0xa0]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
lea ecx, [ebp - 0xa0]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x536627
mov byte [ebp - 0x8d0], 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_reset_Chromes_Policies
jmp 0x5342d3
push 0
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x5365fa
push 0
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x5365fa
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_reset_Chromes_Policies
jmp 0x5343ac
cmp esi, 0x33
jne 0x53679b
push str.Startup_homepage
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x536704
push 0
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, str.browser.startup.homepage
mov ecx, eax
call fcn.0058ea20
mov dword [ebp - 0x8d0], eax
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
je 0x536755
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_reset_Firefox_Home_page
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
cmp byte [ebp - 0x8d0], 1
jne 0x53676a
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
inc dword [edi + 0x28]
xor eax, eax
cmp byte [ebp - 0x8d0], al
jmp 0x5390dc
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_reset_Firefox_Default_Home_page
jmp 0x5343ac
mov al, byte [ebp - 0x8d0]
mov byte [ebp - 0x8d0], al
cmp al, 2
jne 0x53432c
or dword [ebp - 0x8e0], 2
inc dword [edi + 0x28]
mov byte [ebp - 0x8d0], al
xor eax, eax
cmp byte [ebp - 0x8d0], al
jmp 0x5390dc
cmp esi, 0x34
jne 0x5369ef
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
push str.Firefox_default_search_provider
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
lea ecx, [ebp - 0x88]
test al, al
je 0x53689b
push 0
call fcn.005dc190
mov edx, str.browser.search.defaultenginename
mov ecx, eax
call fcn.0058ea20
push 0
lea ecx, [ebp - 0x88]
mov byte [ebp - 0x8c9], al
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._search_metadata.json
lea ecx, [ebp - 0x88]
call fcn.005da780
push 0x6299d4
push str._global_
lea ecx, [ebp - 0x88]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0053a7d0
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
je 0x53687a
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully_removed_Firefox_Default_Search_Provider__
jmp 0x536969
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to_remove_Firefox_Default_Search_Provider__
jmp 0x536969
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
mov byte [ebp - 0x8c9], al
test al, al
jne 0x536937
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005e4c40
mov byte [ebp - 0x8c9], al
test al, al
jne 0x536937
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to_remove_Firefox_Search_Provider__
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
inc dword [edi + 0x28]
xor eax, eax
cmp byte [ebp - 0x8c9], al
jmp 0x5390dc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully_removed_Firefox_Search_Provider__
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
cmp byte [ebp - 0x8c9], 1
jne 0x5369c2
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
inc dword [edi + 0x28]
xor eax, eax
cmp byte [ebp - 0x8c9], al
jmp 0x5390dc
mov al, byte [ebp - 0x8c9]
mov byte [ebp - 0x8c9], al
cmp al, 2
jne 0x5369df
or dword [ebp - 0x8e0], 2
mov byte [ebp - 0x8c9], al
inc dword [edi + 0x28]
xor eax, eax
cmp byte [ebp - 0x8c9], al
jmp 0x5390dc
cmp esi, 0x35
jne 0x536e3b
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x32]
mov ecx, eax
call fcn.005e4c40
xorps xmm0, xmm0
mov byte [ebp - 0x8c9], al
push 0xc
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x87c], 0
movups xmmword [ebp - 0x88c], xmm0
call fcn.00401d40
lea ecx, [ebp - 0x328]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 0x7b
call fcn.00401d40
lea ecx, [ebp - 0x4e4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x1dc]
mov byte [ebp - 4], 0x7c
call fcn.00401d40
lea ecx, [ebp - 0x1dc]
call fcn.005dc5e0
push 0
push str.JSONPath
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x7d
call fcn.005dc190
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x1dc]
call fcn.005db160
lea ecx, [edi + 0x62c]
call fcn.005d8090
push 0
push 1
lea ecx, [ebp - 0x1dc]
call fcn.005dc190
push eax
lea ecx, [edi + 0x62c]
call fcn.005d7cc0
push 0
push 0
lea ecx, [ebp - 0x1dc]
mov byte [ebp - 0x8ca], al
call fcn.005dc190
lea edx, [esi - 0x34]
mov ecx, eax
call fcn.005d7570
push 0x100
lea ecx, [ebp - 0x1dc]
lea esi, [edi + 0x630]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005b5da0
push 0
lea eax, [ebp - 0x614]
mov ecx, esi
push eax
push str.addons
call fcn.005b5760
test al, al
je 0x536bf7
lea eax, [ebp - 0x614]
mov ecx, esi
push eax
lea eax, [ebp - 0x88c]
push eax
call fcn.005b4c80
test al, al
je 0x536bf7
lea eax, [ebp - 0x328]
mov ecx, esi
push eax
push str.descriptor
lea eax, [ebp - 0x88c]
push eax
call fcn.005b54e0
test eax, eax
jne 0x536b8d
lea eax, [ebp - 0x328]
mov ecx, esi
push eax
push str.path
lea eax, [ebp - 0x88c]
push eax
call fcn.005b54e0
test eax, eax
je 0x536bda
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x328]
call fcn.005dc450
test al, al
jne 0x536bda
lea eax, [ebp - 0x4e4]
mov ecx, esi
push eax
push 0x66b31c
lea eax, [ebp - 0x88c]
push eax
call fcn.005b54e0
lea eax, [ebp - 0x88c]
mov ecx, esi
push eax
call fcn.005b4a50
test al, al
je 0x536bda
push 0
push 2
mov ecx, esi
call fcn.005b5cb0
lea eax, [ebp - 0x614]
mov ecx, esi
push eax
lea eax, [ebp - 0x88c]
push eax
call fcn.005b4c80
test al, al
jne 0x536b51
cmp byte [ebp - 0x8ca], 0
je 0x536c21
push dword [edi + 0x654]
lea ecx, [ebp - 0x1dc]
push 0
push 1
call fcn.005dc190
push eax
lea ecx, [edi + 0x62c]
call fcn.005d7810
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._addons.json
push 0
lea ecx, [ebp - 0x1dc]
call fcn.005dbed0
mov ecx, eax
call fcn.005da780
lea ecx, [edi + 0x62c]
call fcn.005d8090
push 0
push 1
lea ecx, [ebp - 0x1dc]
call fcn.005dc190
push eax
lea ecx, [edi + 0x62c]
call fcn.005d7cc0
push 0
push 0
lea ecx, [ebp - 0x1dc]
mov byte [ebp - 0x8ca], al
call fcn.005dc190
mov edx, 1
mov ecx, eax
call fcn.005d7570
push 0x100
lea ecx, [ebp - 0x1dc]
lea esi, [edi + 0x630]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005b5da0
push 0
lea eax, [ebp - 0x614]
mov ecx, esi
push eax
push str.addons
call fcn.005b5760
test al, al
je 0x536d5a
lea eax, [ebp - 0x614]
mov ecx, esi
push eax
lea eax, [ebp - 0x88c]
push eax
call fcn.005b4c80
test al, al
je 0x536d5a
nop
lea eax, [ebp - 0x328]
mov ecx, esi
push eax
push 0x66b31c
lea eax, [ebp - 0x88c]
push eax
call fcn.005b54e0
test eax, eax
je 0x536d41
lea eax, [ebp - 0x4e4]
push eax
lea ecx, [ebp - 0x328]
call fcn.005dc450
test al, al
jne 0x536d41
lea eax, [ebp - 0x88c]
mov ecx, esi
push eax
call fcn.005b4a50
test al, al
je 0x536d41
push 0
push 2
mov ecx, esi
call fcn.005b5cb0
lea eax, [ebp - 0x614]
mov ecx, esi
push eax
lea eax, [ebp - 0x88c]
push eax
call fcn.005b4c80
test al, al
jne 0x536cf0
cmp byte [ebp - 0x8ca], 0
je 0x536d84
push dword [edi + 0x654]
lea ecx, [ebp - 0x1dc]
push 0
push 1
call fcn.005dc190
push eax
lea ecx, [edi + 0x62c]
call fcn.005d7810
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x7c]
push 0x667ad8
call fcn.005dc190
push eax
lea ecx, [ebp - 0x94]
push str.__for
call fcn.005dc190
cmp byte [ebp - 0x8c9], 0
lea ecx, [ebp - 0x70]
push eax
je 0x536df2
push str._tSuccessfully_deleted_Firefox_Extension__
call fcn.005dc200
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
inc dword [edi + 0x2c]
jmp 0x536dfc
push str._tFailed_to_delete_Firefox_Extension__
call fcn.005dc200
inc dword [edi + 0x28]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call fcn.0053a600
lea ecx, [ebp - 0x1dc]
call fcn.005dc430
lea ecx, [ebp - 0x4e4]
call fcn.005dc430
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x59
call fcn.005dc430
jmp 0x5390e2
cmp esi, 0x37
jne 0x5370e1
push str.Start_Menu_Internet_shortcut
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x536fd1
push 4
lea ecx, [ebp - 0x18c]
call fcn.00401d80
push 0
push 0x2001f
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18c]
call fcn.005d6a80
push 0xc
lea ecx, [ebp - 0x364]
mov byte [ebp - 4], 0x7e
call fcn.00401d40
lea ecx, [ebp - 0x364]
call fcn.005dc5e0
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0xa8]
mov esi, dword [ebp - 0x8d4]
push esi
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push 2
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x124]
call fcn.005dc260
lea eax, [ebp - 0x364]
push eax
push 0x62439c
lea ecx, [ebp - 0x18c]
call fcn.005d6740
mov byte [ebp - 0x8c9], al
test al, al
je 0x536f82
push 0
push 0
push 0x62439c
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x364]
call fcn.005da270
push 3
lea ecx, [ebp - 0x364]
call fcn.005da0f0
push 0
lea ecx, [ebp - 0x364]
call fcn.005dc190
push eax
push 1
push 0x62439c
lea ecx, [ebp - 0x18c]
call fcn.005d5f20
mov byte [ebp - 0x8c9], al
test al, al
je 0x536f82
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tSuccessfully_fixed_Firefox_Start_Menu_Internet_shortcut
jmp 0x536faa
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._tFailed_to_fix_Firefox_Start_Menu_Internet_shortcut
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x364]
call fcn.005dc430
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x59
call fcn.005d69e0
jmp 0x538bac
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
push 0x4c
lea ecx, [ebp - 0x7d0]
call fcn.00401e50
lea ecx, [ebp - 0x7d0]
call fcn.005e9520
push 2
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x80
call fcn.005dc190
push eax
lea ecx, [ebp - 0x7d0]
call fcn.005e93e0
mov byte [ebp - 0x8c9], al
test al, al
je 0x53709c
push 0x62439c
lea ecx, [ebp - 0x7d0]
call fcn.005e9250
mov byte [ebp - 0x8c9], al
test al, al
je 0x53709c
lea ecx, [ebp - 0x7d0]
call fcn.005e9140
mov byte [ebp - 0x8c9], al
test al, al
je 0x53709c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully_fixed_Firefox_shortcut__
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x7d0]
jmp 0x538b9d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to_fix_Firefox_shortcut__
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x7d0]
jmp 0x538b9d
cmp esi, 0x38
jne 0x5375cf
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
push str.Reset_Firefox_User_Search_Providers
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x537252
push 0xc
lea ecx, [ebp - 0x634]
call fcn.00401d40
lea ecx, [ebp - 0x634]
call fcn.005dc5e0
push 0
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x81
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._search.json
lea ecx, [ebp - 0x88]
call fcn.005da780
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x36]
mov ecx, eax
call fcn.005e4c40
push 0
lea ecx, [ebp - 0x88]
mov byte [ebp - 0x8ca], al
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._searchplugins
lea ecx, [ebp - 0x88]
call fcn.005da780
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x36]
mov ecx, eax
call fcn.005e4c40
movzx ecx, byte [ebp - 0x8ca]
movzx eax, al
imul eax, ecx
lea ecx, [ebp - 0x88]
push 0
mov dword [ebp - 0x8d8], eax
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._search_metadata.json
lea ecx, [ebp - 0x88]
call fcn.005da780
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x36]
mov ecx, eax
call fcn.005e4c40
mov edx, dword [ebp - 0x8d8]
movzx ecx, dl
movzx eax, al
imul eax, ecx
lea ecx, [ebp - 0x634]
mov byte [ebp - 4], 0x59
mov dword [ebp - 0x8ec], eax
call fcn.005dc430
mov eax, dword [ebp - 0x8ec]
jmp 0x5374ef
push str.Reset_Firefox_Ad_ons
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x5373a7
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
push 0xc
lea ecx, [ebp - 0x2bc]
mov byte [ebp - 0x8ec], al
call fcn.00401d40
lea ecx, [ebp - 0x2bc]
call fcn.005dc5e0
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x82
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0052eab0
test eax, eax
js 0x53730d
cmp eax, dword [edi + 0x30]
jge 0x53730d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMozillaPlugins
push eax
lea ecx, [edi + 0x104]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x2bc]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x2bc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d55d0
ret
loop 0x537315
invalid
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMozillaPlugins
push dword [ebp - 0x8f0]
lea ecx, [ebp - 0x2bc]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x2bc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMozillaPlugins
push dword [ebp - 0x8e4]
lea ecx, [ebp - 0x2bc]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x2bc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d55d0
lea ecx, [ebp - 0x2bc]
mov byte [ebp - 4], 0x59
call fcn.005dc430
mov eax, dword [ebp - 0x8ec]
jmp 0x5374ef
push str.Reset_Firefox_Extensions
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x5374ba
push 0
lea ecx, [ebp - 0x88]
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64ebc4
lea ecx, [ebp - 0x88]
call fcn.005da780
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x66b644
lea ecx, [ebp - 0x88]
mov byte [ebp - 0x8ca], al
call fcn.005da780
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
movzx ecx, byte [ebp - 0x8ca]
movzx eax, al
imul eax, ecx
lea ecx, [ebp - 0x88]
push 0
mov dword [ebp - 0x8d8], eax
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.extensions.json
lea ecx, [ebp - 0x88]
call fcn.005da780
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
mov edx, dword [ebp - 0x8d8]
movzx ecx, dl
movzx eax, al
imul eax, ecx
jmp 0x5374e9
push str.Reset_Firefox_Settings
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x5390e2
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8ec], eax
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
je 0x537589
call fcn.005dc190
push eax
push str._for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
test byte [ebp - 0x8ec], 2
je 0x5375bf
or dword [ebp - 0x8e0], 2
xor eax, eax
inc dword [edi + 0x28]
cmp byte [ebp - 0x8ec], al
jmp 0x5390dc
call fcn.005dc190
push eax
push str._for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
inc dword [edi + 0x28]
xor eax, eax
cmp byte [ebp - 0x8ec], al
jmp 0x5390dc
cmp esi, 0x3e
jne 0x53766e
push 0x629fdc
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x88]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0053a7d0
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
je 0x537645
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully_fixed__
lea ecx, [ebp - 0x70]
call fcn.005dc200
push dword [ebp - 0x8d4]
jmp 0x538bb6
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to_fix__
lea ecx, [ebp - 0x70]
call fcn.005dc200
jmp 0x538bd9
cmp esi, 0x3f
jne 0x53770e
push 0x629fdc
push str.default_search_provider_data
lea ecx, [ebp - 0x88]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0053a7d0
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
je 0x5376e0
call fcn.005dc190
push eax
push str._for
push str.s_default_search_provider
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tSuccessfully_fixed
lea ecx, [ebp - 0x70]
call fcn.005dc200
push dword [ebp - 0x8d4]
jmp 0x538bb6
call fcn.005dc190
push eax
push str._for
push str.s_default_search_provider
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tFailed_to_fix
lea ecx, [ebp - 0x70]
call fcn.005dc200
jmp 0x538bd9
cmp esi, 0x40
jne 0x53781b
push 0
push str.Extension_path
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x88]
call fcn.005db160
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x5377cf
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x3e]
mov ecx, eax
call fcn.005e4c40
test al, al
jne 0x53777d
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x3e]
mov ecx, eax
call fcn.005e4c40
test al, al
je 0x5377cf
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str.s_extension__
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tSuccessfully_removed
lea ecx, [ebp - 0x70]
call fcn.005dc200
push dword [ebp - 0x8d4]
jmp 0x538bb6
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str.s_extension__
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tFailed_to_remove
lea ecx, [ebp - 0x70]
call fcn.005dc200
jmp 0x538bd9
cmp esi, 0x41
jne 0x537b11
push str.Start_Menu_Internet_shortcut
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x5379e7
push 4
lea ecx, [ebp - 0x170]
call fcn.00401d80
push 0
push 0x2001f
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x170]
call fcn.005d6a80
push 0xc
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 0x83
call fcn.00401d40
lea ecx, [ebp - 0x358]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x5c4]
mov byte [ebp - 4], 0x84
call fcn.00401d40
mov esi, dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
push esi
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push 2
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x5c4]
call fcn.005dc570
lea eax, [ebp - 0x358]
mov byte [ebp - 4], 0x85
push eax
push 0x62439c
lea ecx, [ebp - 0x170]
call fcn.005d6740
mov byte [ebp - 0x8c9], al
test al, al
je 0x537980
push 0
push 0
push 0x62439c
lea ecx, [ebp - 0x5c4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x358]
call fcn.005da270
push 3
lea ecx, [ebp - 0x358]
call fcn.005da0f0
push 0
lea ecx, [ebp - 0x358]
call fcn.005dc190
push eax
push 1
push 0x62439c
lea ecx, [ebp - 0x170]
call fcn.005d5f20
mov byte [ebp - 0x8c9], al
test al, al
je 0x537980
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str.s_Start_Menu_Internet_shortcut
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tSuccessfully_fixed
jmp 0x5379b5
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str._Start_Menu_Internet_shortcut
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tFailed_to_fix
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x5c4]
call fcn.005dc430
lea ecx, [ebp - 0x358]
call fcn.005dc430
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x59
call fcn.005d69e0
jmp 0x538bac
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
push 0x4c
lea ecx, [ebp - 0x820]
call fcn.00401e50
lea ecx, [ebp - 0x820]
call fcn.005e9520
push 2
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x86
call fcn.005dc190
push eax
lea ecx, [ebp - 0x820]
call fcn.005e93e0
mov byte [ebp - 0x8c9], al
test al, al
je 0x537abf
push 0x62439c
lea ecx, [ebp - 0x820]
call fcn.005e9250
mov byte [ebp - 0x8c9], al
test al, al
je 0x537abf
lea ecx, [ebp - 0x820]
call fcn.005e9140
mov byte [ebp - 0x8c9], al
test al, al
je 0x537abf
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._shortcut__
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tSuccessfully_fixed
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x820]
jmp 0x538b9d
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._shortcut__
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tFailed_to_fix
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x820]
jmp 0x538b9d
cmp esi, 0x43
jne 0x537e51
push 0xc
lea ecx, [ebp - 0x31c]
call fcn.00401d40
lea ecx, [ebp - 0x31c]
call fcn.005dc5e0
push 0
push str.Value_name
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x87
call fcn.005dc190
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x31c]
call fcn.005db160
lea ecx, [ebp - 0x31c]
call fcn.005dc190
lea ecx, [ebp - 0xa0]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
sete byte [ebp - 0x8c9]
test al, al
je 0x537baf
lea ecx, [ebp - 0x31c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
mov byte [ebp - 0x8c9], al
push str.HomepageLocation
lea ecx, [ebp - 0x31c]
call fcn.005dc4c0
test al, al
je 0x537c33
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x7c]
push 0x667ad8
call fcn.005dc190
push eax
lea ecx, [ebp - 0xb4]
push str.s_Default_Homepage_policy_for
call fcn.005dc190
cmp byte [ebp - 0x8c9], 0
lea ecx, [ebp - 0x70]
push eax
je 0x537c24
push str._tSuccessfully_removed
call fcn.005dc200
push str.HomepageIsNewTabPage
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
jmp 0x537dff
push str._tFailed_to_remove
call fcn.005dc200
jmp 0x537e28
push str.DefaultSearchProviderSearchURL
lea ecx, [ebp - 0x31c]
call fcn.005dc4c0
test al, al
je 0x537d15
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x7c]
push 0x667ad8
call fcn.005dc190
push eax
lea ecx, [ebp - 0xb4]
push str.s_Default_Search_Provider_policy_for
call fcn.005dc190
cmp byte [ebp - 0x8c9], 0
lea ecx, [ebp - 0x70]
push eax
je 0x537c24
push str._tSuccessfully_removed
call fcn.005dc200
push str.DefaultSearchProviderName
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.DefaultSearchProviderEnabled
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.DefaultSearchProviderKeyword
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.DefaultSearchProviderSuggestURL
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.DefaultSearchProviderInstantURL
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
push str.DefaultSearchProviderIconURL
jmp 0x537c0b
push 0x669320
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x537df6
push 0xc
lea ecx, [ebp - 0x4f0]
call fcn.00401d40
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push 2
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x4f0]
call fcn.005dc570
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x88
call fcn.005dc190
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
push eax
lea ecx, [ebp - 0x4f0]
push str.__for
call fcn.005dc190
push eax
lea ecx, [ebp - 0xb4]
push str.s_Startup_Page_policy__
call fcn.005dc190
cmp byte [ebp - 0x8c9], 0
lea ecx, [ebp - 0x70]
push eax
je 0x537ddd
push str._tSuccessfully_removed
call fcn.005dc200
push str.DefaultSearchProviderName
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
jmp 0x537de7
push str._tFailed_to_remove
call fcn.005dc200
lea ecx, [ebp - 0x4f0]
mov byte [ebp - 4], 0x87
call fcn.005dc430
cmp byte [ebp - 0x8c9], 0
je 0x537e28
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
inc dword [edi + 0x2c]
inc dword [edi + 0x28]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call fcn.0053a600
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 0x59
call fcn.005dc430
jmp 0x5390e2
cmp esi, 0x42
jne 0x5381f3
push 0
push 8
push str.Reset_._Secure_Preferences_
lea ecx, [ebp - 0x94]
call fcn.005d9930
test al, al
je 0x537f36
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x40]
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x537eff
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x3f]
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x537eff
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.s_Secure_Preferences_for
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tFailed_to_reset
jmp 0x5343ac
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.s_Secure_Preferences_for
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tSuccessfully_reset
jmp 0x534241
push 0
push 8
push str.Reset_._Default_Preferences_
lea ecx, [ebp - 0x94]
call fcn.005d9930
test al, al
je 0x538016
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x537fdf
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x537fdf
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.s_Default_Preferences_for
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tFailed_to_reset
jmp 0x5343ac
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.s_Default_Preferences_for
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tSuccessfully_reset
jmp 0x534241
push 0
push 8
push str.Reset_._Preferences_
lea ecx, [ebp - 0x94]
call fcn.005d9930
test al, al
je 0x5380f6
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x5380bf
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x5380bf
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.s_Preferences_for
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tFailed_to_reset
jmp 0x5343ac
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.s_Preferences_for
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tSuccessfully_reset
jmp 0x534241
push 0
push 8
push str.Reset_._Policies_
lea ecx, [ebp - 0x94]
call fcn.005d9930
test al, al
je 0x5342db
lea ecx, [ebp - 0xa0]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
lea ecx, [ebp - 0xa0]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x53817c
mov byte [ebp - 0x8d0], 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully
jmp 0x5342d3
push 0
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x538145
push 0
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
mov dword [ebp - 0x8d0], eax
test al, al
jne 0x538145
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to
jmp 0x5343ac
cmp esi, 0x47
jne 0x53829b
push 0
push 8
push str.._startup_homepage_
lea ecx, [ebp - 0x94]
call fcn.005d9930
test al, al
je 0x536704
push 0
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, str.browser.startup.homepage
mov ecx, eax
call fcn.0058ea20
mov dword [ebp - 0x8d0], eax
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
je 0x538275
call fcn.005dc190
push eax
push str._for
push str._Home_page
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tSuccessfully_reset
jmp 0x5366fc
call fcn.005dc190
push eax
push str._for
push str._Default_Home_page
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tFailed_to_reset
jmp 0x5343ac
cmp esi, 0x48
jne 0x538481
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
push 0
push 8
push str.._default_search_provider_
lea ecx, [ebp - 0x94]
call fcn.005d9930
lea ecx, [ebp - 0x88]
test al, al
je 0x5383bd
push 0
call fcn.005dc190
mov edx, str.browser.search.defaultenginename
mov ecx, eax
call fcn.0058ea20
push 0
lea ecx, [ebp - 0x88]
mov byte [ebp - 0x8c9], al
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._search_metadata.json
lea ecx, [ebp - 0x88]
call fcn.005da780
push 0x6299d4
push str._global_
lea ecx, [ebp - 0x88]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0053a7d0
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
je 0x53838b
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._Default_Search_Provider__
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tSuccessfully_removed
jmp 0x536969
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._Default_Search_Provider__
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tFailed_to_remove
jmp 0x536969
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
mov byte [ebp - 0x8c9], al
test al, al
jne 0x53843d
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005e4c40
mov byte [ebp - 0x8c9], al
test al, al
jne 0x53843d
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._Search_Provider__
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tFailed_to_remove
jmp 0x53690d
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._Search_Provider__
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tSuccessfully_removed
jmp 0x536969
cmp esi, 0x49
jne 0x5388d9
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x46]
mov ecx, eax
call fcn.005e4c40
xorps xmm0, xmm0
mov byte [ebp - 0x8c9], al
push 0xc
lea ecx, [ebp - 0x2f8]
mov dword [ebp - 0x890], 0
movups xmmword [ebp - 0x8a0], xmm0
call fcn.00401d40
lea ecx, [ebp - 0x2f8]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x4fc]
mov byte [ebp - 4], 0x89
call fcn.00401d40
lea ecx, [ebp - 0x4fc]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], 0x8a
call fcn.00401d40
lea ecx, [ebp - 0x1e8]
call fcn.005dc5e0
push 0
push str.JSONPath
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x8b
call fcn.005dc190
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x1e8]
call fcn.005db160
lea ecx, [edi + 0x62c]
call fcn.005d8090
push 0
push 1
lea ecx, [ebp - 0x1e8]
call fcn.005dc190
push eax
lea ecx, [edi + 0x62c]
call fcn.005d7cc0
push 0
push 0
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 0x8ca], al
call fcn.005dc190
lea edx, [esi - 0x48]
mov ecx, eax
call fcn.005d7570
push 0x100
lea ecx, [ebp - 0x1e8]
lea esi, [edi + 0x630]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005b5da0
push 0
lea eax, [ebp - 0x628]
mov ecx, esi
push eax
push str.addons
call fcn.005b5760
test al, al
je 0x538689
lea eax, [ebp - 0x628]
mov ecx, esi
push eax
lea eax, [ebp - 0x8a0]
push eax
call fcn.005b4c80
test al, al
je 0x538689
lea eax, [ebp - 0x2f8]
mov ecx, esi
push eax
push str.descriptor
lea eax, [ebp - 0x8a0]
push eax
call fcn.005b54e0
test eax, eax
jne 0x53861f
lea eax, [ebp - 0x2f8]
mov ecx, esi
push eax
push str.path
lea eax, [ebp - 0x8a0]
push eax
call fcn.005b54e0
test eax, eax
je 0x53866c
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x2f8]
call fcn.005dc450
test al, al
jne 0x53866c
lea eax, [ebp - 0x4fc]
mov ecx, esi
push eax
push 0x66b31c
lea eax, [ebp - 0x8a0]
push eax
call fcn.005b54e0
lea eax, [ebp - 0x8a0]
mov ecx, esi
push eax
call fcn.005b4a50
test al, al
je 0x53866c
push 0
push 2
mov ecx, esi
call fcn.005b5cb0
lea eax, [ebp - 0x628]
mov ecx, esi
push eax
lea eax, [ebp - 0x8a0]
push eax
call fcn.005b4c80
test al, al
jne 0x5385e3
cmp byte [ebp - 0x8ca], 0
je 0x5386b3
push dword [edi + 0x654]
lea ecx, [ebp - 0x1e8]
push 0
push 1
call fcn.005dc190
push eax
lea ecx, [edi + 0x62c]
call fcn.005d7810
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._addons.json
push 0
lea ecx, [ebp - 0x1e8]
call fcn.005dbed0
mov ecx, eax
call fcn.005da780
lea ecx, [edi + 0x62c]
call fcn.005d8090
push 0
push 1
lea ecx, [ebp - 0x1e8]
call fcn.005dc190
push eax
lea ecx, [edi + 0x62c]
call fcn.005d7cc0
push 0
push 0
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 0x8ca], al
call fcn.005dc190
mov edx, 1
mov ecx, eax
call fcn.005d7570
push 0x100
lea ecx, [ebp - 0x1e8]
lea esi, [edi + 0x630]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005b5da0
push 0
lea eax, [ebp - 0x628]
mov ecx, esi
push eax
push str.addons
call fcn.005b5760
test al, al
je 0x5387eb
lea eax, [ebp - 0x628]
mov ecx, esi
push eax
lea eax, [ebp - 0x8a0]
push eax
call fcn.005b4c80
test al, al
je 0x5387eb
lea eax, [ebp - 0x2f8]
mov ecx, esi
push eax
push 0x66b31c
lea eax, [ebp - 0x8a0]
push eax
call fcn.005b54e0
test eax, eax
je 0x5387d2
lea eax, [ebp - 0x4fc]
push eax
lea ecx, [ebp - 0x2f8]
call fcn.005dc450
test al, al
jne 0x5387d2
lea eax, [ebp - 0x8a0]
mov ecx, esi
push eax
call fcn.005b4a50
test al, al
je 0x5387d2
push 0
push 2
mov ecx, esi
call fcn.005b5cb0
lea eax, [ebp - 0x628]
mov ecx, esi
push eax
lea eax, [ebp - 0x8a0]
push eax
call fcn.005b4c80
test al, al
jne 0x538781
cmp byte [ebp - 0x8ca], 0
je 0x538815
push dword [edi + 0x654]
lea ecx, [ebp - 0x1e8]
push 0
push 1
call fcn.005dc190
push eax
lea ecx, [edi + 0x62c]
call fcn.005d7810
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x7c]
push 0x667ad8
call fcn.005dc190
push eax
lea ecx, [ebp - 0x94]
push str.__for
call fcn.005dc190
push eax
lea ecx, [ebp - 0xb4]
push str._Extension__
call fcn.005dc190
cmp byte [ebp - 0x8c9], 0
lea ecx, [ebp - 0x70]
push eax
je 0x538890
push str._tSuccessfully_deleted
call fcn.005dc200
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
inc dword [edi + 0x2c]
jmp 0x53889a
push str._tFailed_to_delete
call fcn.005dc200
inc dword [edi + 0x28]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call fcn.0053a600
lea ecx, [ebp - 0x1e8]
call fcn.005dc430
lea ecx, [ebp - 0x4fc]
call fcn.005dc430
lea ecx, [ebp - 0x2f8]
mov byte [ebp - 4], 0x59
call fcn.005dc430
jmp 0x5390e2
cmp esi, 0x4b
jne 0x538bf3
push str.Start_Menu_Internet_shortcut
lea ecx, [ebp - 0x94]
call fcn.005dc4c0
test al, al
je 0x538a89
push 4
lea ecx, [ebp - 0x180]
call fcn.00401d80
push 0
push 0x2001f
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x180]
call fcn.005d6a80
push 0xc
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 0x8c
call fcn.00401d40
lea ecx, [ebp - 0x418]
call fcn.005dc5e0
mov byte [ebp - 4], 0x8d
lea ecx, [ebp - 0xa8]
mov esi, dword [ebp - 0x8d4]
push esi
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push 2
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x124]
call fcn.005dc260
lea eax, [ebp - 0x418]
push eax
push 0x62439c
lea ecx, [ebp - 0x180]
call fcn.005d6740
mov byte [ebp - 0x8c9], al
test al, al
je 0x538a2d
push 0
push 0
push 0x62439c
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x418]
call fcn.005da270
push 3
lea ecx, [ebp - 0x418]
call fcn.005da0f0
push 0
lea ecx, [ebp - 0x418]
call fcn.005dc190
push eax
push 1
push 0x62439c
lea ecx, [ebp - 0x180]
call fcn.005d5f20
mov byte [ebp - 0x8c9], al
test al, al
je 0x538a2d
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str.s_Start_Menu_Internet_shortcut
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tSuccessfully_fixed
jmp 0x538a62
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str._for
push str.s_Start_Menu_Internet_shortcut
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tFailed_to_fix
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x418]
call fcn.005dc430
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0x59
call fcn.005d69e0
jmp 0x538bac
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
push 0x4c
lea ecx, [ebp - 0x690]
call fcn.00401e50
lea ecx, [ebp - 0x690]
call fcn.005e9520
push 2
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x8e
call fcn.005dc190
push eax
lea ecx, [ebp - 0x690]
call fcn.005e93e0
mov byte [ebp - 0x8c9], al
test al, al
je 0x538b50
push 0x62439c
lea ecx, [ebp - 0x690]
call fcn.005e9250
mov byte [ebp - 0x8c9], al
test al, al
je 0x538b50
lea ecx, [ebp - 0x690]
call fcn.005e9140
mov byte [ebp - 0x8c9], al
test al, al
je 0x538b50
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._shortcut__
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tSuccessfully_fixed
jmp 0x538b8f
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push str.__for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._shortcut__
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
push str._tFailed_to_fix
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea ecx, [ebp - 0x690]
mov byte [ebp - 4], 0x59
call fcn.005e9080
mov esi, dword [ebp - 0x8d4]
cmp byte [ebp - 0x8c9], 0
je 0x538bd9
push esi
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
inc dword [edi + 0x2c]
inc dword [edi + 0x28]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call fcn.0053a600
jmp 0x5390e2
cmp esi, 0x4c
jne 0x5390e2
lea ecx, [ebp - 0x88]
call fcn.005dc3a0
cmp eax, 0xa
jl 0x5390e2
push 0
push 8
push str.Reset_._User_Search_Providers_
lea ecx, [ebp - 0x94]
call fcn.005d9930
test al, al
je 0x538d68
push 0xc
lea ecx, [ebp - 0x640]
call fcn.00401d40
lea ecx, [ebp - 0x640]
call fcn.005dc5e0
push 0
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x8f
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._search.json
lea ecx, [ebp - 0x88]
call fcn.005da780
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x4a]
mov ecx, eax
call fcn.005e4c40
push 0
lea ecx, [ebp - 0x88]
mov byte [ebp - 0x8ca], al
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._searchplugins
lea ecx, [ebp - 0x88]
call fcn.005da780
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x4a]
mov ecx, eax
call fcn.005e4c40
movzx ecx, byte [ebp - 0x8ca]
movzx eax, al
imul eax, ecx
lea ecx, [ebp - 0x88]
push 0
mov dword [ebp - 0x8d8], eax
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._search_metadata.json
lea ecx, [ebp - 0x88]
call fcn.005da780
lea ecx, [ebp - 0x88]
call fcn.005dc190
lea edx, [esi - 0x4a]
mov ecx, eax
call fcn.005e4c40
mov edx, dword [ebp - 0x8d8]
movzx ecx, dl
movzx eax, al
imul eax, ecx
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 0x59
mov dword [ebp - 0x8dc], eax
call fcn.005dc430
mov eax, dword [ebp - 0x8dc]
jmp 0x53900f
push 0
push 8
push str.Reset_._Ad_ons_
lea ecx, [ebp - 0x94]
call fcn.005d9930
test al, al
je 0x538ec1
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
push 0xc
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 0x8dc], al
call fcn.00401d40
lea ecx, [ebp - 0x2c8]
call fcn.005dc5e0
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x90
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0052eab0
test eax, eax
js 0x538e27
cmp eax, dword [edi + 0x30]
jge 0x538e27
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMozillaPlugins
push eax
lea ecx, [edi + 0x104]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x2c8]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x2c8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMozillaPlugins
push dword [ebp - 0x8f0]
lea ecx, [ebp - 0x2c8]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x2c8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d55d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMozillaPlugins
push dword [ebp - 0x8e4]
lea ecx, [ebp - 0x2c8]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x2c8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d55d0
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0x59
call fcn.005dc430
mov eax, dword [ebp - 0x8dc]
jmp 0x53900f
push 0
push 8
push str.Reset_._Extensions_
lea ecx, [ebp - 0x94]
call fcn.005d9930
push 0
test al, al
je 0x538fd8
lea ecx, [ebp - 0x88]
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64ebc4
lea ecx, [ebp - 0x88]
call fcn.005da780
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x66b644
lea ecx, [ebp - 0x88]
mov byte [ebp - 0x8ca], al
call fcn.005da780
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
movzx ecx, byte [ebp - 0x8ca]
movzx eax, al
imul eax, ecx
lea ecx, [ebp - 0x88]
push 0
mov dword [ebp - 0x8d8], eax
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.extensions.json
lea ecx, [ebp - 0x88]
call fcn.005da780
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
mov edx, dword [ebp - 0x8d8]
movzx ecx, dl
movzx eax, al
imul eax, ecx
jmp 0x539009
push 8
push str.Reset_._Settings_
lea ecx, [ebp - 0x94]
call fcn.005d9930
test al, al
je 0x5390e2
lea ecx, [ebp - 0x88]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
mov dword [ebp - 0x8dc], eax
lea ecx, [ebp - 0x7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
test al, al
je 0x53909b
call fcn.005dc190
push eax
push str._for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tSuccessfully
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0xa8]
call fcn.00404240
mov ecx, dword [edi + 4]
push 0
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 0xa8]
call fcn.005bb970
test byte [ebp - 0x8dc], 2
je 0x5390d1
or dword [ebp - 0x8e0], 2
jmp 0x5390d1
call fcn.005dc190
push eax
push str._for
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
push str._tFailed_to
lea ecx, [ebp - 0x70]
call fcn.005dc200
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
inc dword [edi + 0x28]
xor eax, eax
cmp byte [ebp - 0x8dc], al
setne al
add dword [edi + 0x2c], eax
mov eax, dword [ebp - 0x8d4]
dec eax
mov dword [ebp - 0x8d4], eax
test eax, eax
jle 0x5390fe
mov ecx, dword [ebp - 0xa8]
jmp 0x532a81
push 0
push 0x62781c
lea ecx, [ebp - 0xe8]
call fcn.005e37e0
lea ecx, [ebp - 0xb4]
call fcn.005dc430
lea ecx, [ebp - 0x124]
call fcn.005dc430
lea ecx, [ebp - 0x2a4]
call fcn.005dc430
lea ecx, [ebp - 0x7c]
call fcn.005dc430
lea ecx, [ebp - 0x94]
call fcn.005dc430
lea ecx, [ebp - 0x88]
call fcn.005dc430
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x52
call fcn.005dc430
jmp 0x539172
push 0
push str._tNo_items_selected_in_this_tab._r_n_r_n
lea ecx, [ebp - 0xe8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa8]
call fcn.005ba360
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x20
push dword [eax + 0xa8]
call fcn.005bd3f0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0x40]
call fcn.005bd3f0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x22
push dword [eax + 0x30]
call fcn.005bd3f0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x186a0
push 0
push str.Stop_the_current_removal_operation
push dword [eax + 0x30]
call fcn.005bcaf0
push 0
push str._r_n__Begin_repair_of_the_selected_Malware_items..._r_n_r_n
lea ecx, [ebp - 0xe8]
call fcn.005e37e0
mov eax, dword [edi + 8]
xorps xmm0, xmm0
mov ecx, dword [edi + 4]
movlpd qword [ebp - 0x12c], xmm0
push dword [eax + 0xb8]
call fcn.005bb7f0
mov esi, eax
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x12c], esi
mov byte [ebp - 4], 0x91
mov ecx, dword [edi + 8]
push 0x63
push dword [ecx + 0x44]
mov ecx, dword [edi + 4]
call fcn.005b9910
cmp dword [esi], 0
push 0
je 0x539e67
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push dword [eax + 0xb8]
call fcn.005ba360
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x40
push dword [eax + 0xb8]
call fcn.005bd3f0
push str.Fixing_selected_Malware_items...
push 0xffffffffffffffff
lea ecx, [edi + 0x940]
call fcn.005b66e0
xorps xmm0, xmm0
mov dword [ebp - 0xc0], 0
lea ecx, [ebp - 0xc8]
movq qword [ebp - 0xc8], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0x1a4]
xorps xmm0, xmm0
mov dword [ebp - 0x19c], 0
movq qword [ebp - 0x1a4], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x93
mov eax, dword [esi]
mov dword [ebp - 0x8e4], eax
test eax, eax
jle 0x5394f7
lea ecx, [eax*4]
mov dword [ebp - 0x8f0], ecx
nop dword [eax]
mov eax, dword [edi + 8]
push dword [esi + ecx]
mov ecx, dword [edi + 4]
mov byte [ebp - 0x8c9], 0
push dword [eax + 0xb8]
call fcn.005bb5c0
mov ecx, dword [ebp - 0x8e4]
push 0
mov dword [ebp - 0x8d8], eax
push dword [esi + ecx*4]
mov ecx, dword [edi + 8]
push dword [ecx + 0xb8]
mov ecx, dword [edi + 4]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xc8]
call fcn.005dc1c0
mov eax, dword [ebp - 0x8d8]
cmp eax, 0x51
jne 0x5395b0
lea ecx, [ebp - 0xc8]
call fcn.005dc190
push eax
push 0
call dword [sym.imp.sfc.dll_SfcIsFileProtected]
lea ecx, [ebp - 0xc8]
mov esi, eax
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005cc690
lea ecx, [ebp - 0xc8]
call fcn.005dc190
mov edx, 3
mov ecx, eax
call fcn.005e4c40
mov byte [ebp - 0x8c9], al
test esi, esi
je 0x539422
movsd xmm0, qword [edi + 0x390]
comisd xmm0, xmmword [0x6edab8]
jb 0x539411
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x500], 0
push 0x624388
lea ecx, [ebp - 0xc8]
movq qword [ebp - 0x508], xmm0
call fcn.005dc190
push eax
push str._sfc.exe__scanfile_
push dword [edi + 0x1b0]
lea ecx, [ebp - 0x508]
call fcn.005dc520
push 0
mov byte [ebp - 4], 0x94
lea ecx, [ebp - 0x508]
push dword [edi + 0x1b0]
call fcn.005dc190
mov ecx, dword [edi + 0x1c94]
push eax
call fcn.0057b4f0
lea ecx, [ebp - 0x508]
mov byte [ebp - 4], 0x93
call fcn.005dc430
mov al, byte [ebp - 0x8c9]
mov esi, dword [ebp - 0x8e0]
or esi, 4
mov dword [ebp - 0x8e0], esi
jmp 0x539428
mov esi, dword [ebp - 0x8e0]
lea ecx, [ebp - 0xc8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
cmp al, 2
jne 0x53946d
push str._for_removal_on_reboot._r_n
call fcn.005dc190
push eax
push str._tSuccessfully_scheduled
lea ecx, [ebp - 0x1a4]
call fcn.005dc200
or esi, 2
mov dword [ebp - 0x8e0], esi
jmp 0x539917
push 0x667ad8
test al, al
je 0x539491
call fcn.005dc190
push eax
push str._tSuccessfully_removed_infected_file:
lea ecx, [ebp - 0x1a4]
call fcn.005dc200
jmp 0x539917
call fcn.005dc190
push eax
push str._tFailed_to_remove_infected_file:
lea ecx, [ebp - 0x1a4]
call fcn.005dc200
mov esi, dword [ebp - 0x12c]
inc dword [edi + 0x28]
xor eax, eax
cmp byte [ebp - 0x8c9], al
mov ecx, edi
setne al
add dword [edi + 0x2c], eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
mov eax, dword [ebp - 0x8e4]
mov ecx, dword [ebp - 0x8f0]
dec eax
add ecx, 0xfffffffc
mov dword [ebp - 0x8e4], eax
mov dword [ebp - 0x8f0], ecx
test eax, eax
jg 0x5392d0
cmp dword [esi], 1
mov dword [ebp - 0x8f0], 1
jl 0x539b9c
mov ecx, 4
mov dword [ebp - 0x8d8], ecx
mov dword [ebp - 0x8e4], ecx
nop dword [eax + eax]
mov eax, dword [edi + 8]
push dword [ecx + esi]
mov ecx, dword [edi + 4]
push dword [eax + 0xb8]
call fcn.005bb5c0
mov ecx, dword [ebp - 0x8e4]
mov esi, eax
mov eax, dword [ebp - 0x12c]
push 0
push dword [eax + ecx]
mov ecx, dword [edi + 8]
push dword [ecx + 0xb8]
mov ecx, dword [edi + 4]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xc8]
call fcn.005dc1c0
cmp esi, 0x53
jne 0x539b6b
push str.Empty_temporary_folders
lea ecx, [ebp - 0xc8]
xor esi, esi
call fcn.005dc4c0
test al, al
je 0x539bbb
mov ecx, dword [edi + 0x1c94]
push 3
call fcn.00579ce0
test edx, edx
jl 0x539b14
jg 0x5395a6
test eax, eax
jb 0x539b14
mov esi, 1
jmp 0x539e07
cmp eax, 0x52
jne 0x539b06
xorps xmm0, xmm0
lea ecx, [ebp - 0xc8]
push 1
push 0x62bd28
movups xmmword [ebp - 0x1d0], xmm0
movq qword [ebp - 0x1c0], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1d0]
call fcn.005d92a0
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x95
call fcn.005d9210
cmp eax, 1
jbe 0x539673
push 4
push 1
push 1
push 0
push str.HKLM
lea ecx, [ebp - 0xc8]
call fcn.005daa70
test eax, eax
je 0x539673
push 0
push 1
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon___Shell
lea ecx, [ebp - 0xc8]
call fcn.005daa70
test eax, eax
je 0x539673
push 0
push str.Explorer.exe
push 1
push 1
lea ecx, [ebp - 0x1d0]
call fcn.005d9220
push eax
push 0
lea ecx, [ebp - 0x1d0]
call fcn.005d9220
ret
sti
or dword [eax], eax
push eax
lea ecx, [ebp - 0x20]
call fcn.005d5be0
mov cl, al
mov byte [ebp - 0x8c9], cl
jmp 0x539ac3
lea ecx, [ebp - 0x1d0]
call fcn.005d9210
cmp eax, 1
jbe 0x539758
push 4
push 1
push 1
push 0
push str.HKLM
lea ecx, [ebp - 0xc8]
call fcn.005daa70
test eax, eax
je 0x539758
push 0
push 1
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon___Userinit
lea ecx, [ebp - 0xc8]
call fcn.005daa70
test eax, eax
je 0x539758
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x50c], 0
push str.userinit.exe_
movq qword [ebp - 0x514], xmm0
lea ecx, [ebp - 0x514]
push dword [edi + 0x1b0]
call fcn.005dc520
push 0
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 0x96
call fcn.005dc190
push eax
push 1
push 1
lea ecx, [ebp - 0x1d0]
call fcn.005d9220
push eax
push 0
lea ecx, [ebp - 0x1d0]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x20]
call fcn.005d5be0
lea ecx, [ebp - 0x514]
mov byte [ebp - 0x8c9], al
mov byte [ebp - 4], 0x95
call fcn.005dc430
jmp 0x539abd
lea ecx, [ebp - 0x1d0]
call fcn.005d9210
lea ecx, [ebp - 0x1d0]
cmp eax, 1
jne 0x539792
push 0
call fcn.005d9220
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x53978e
mov byte [ebp - 0x8c9], 1
jmp 0x539acb
push 0
jmp 0x5397df
call fcn.005d9210
lea ecx, [ebp - 0x1d0]
cmp eax, 2
jne 0x539802
push 1
call fcn.005d9220
push 0
lea ecx, [ebp - 0x1d0]
mov esi, eax
call fcn.005d9220
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x5397d1
mov byte [ebp - 0x8c9], 1
jmp 0x539acb
push 1
lea ecx, [ebp - 0x1d0]
call fcn.005d9220
push eax
push 0
lea ecx, [ebp - 0x1d0]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x20]
call fcn.005d55d0
mov cl, al
mov byte [ebp - 0x8c9], cl
jmp 0x539ac3
call fcn.005d9210
lea ecx, [ebp - 0x1d0]
cmp eax, 2
jbe 0x539af8
push 1
call fcn.005d9220
push 0
lea ecx, [ebp - 0x1d0]
mov esi, eax
call fcn.005d9220
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x539845
mov byte [ebp - 0x8c9], 1
jmp 0x539acb
xorps xmm0, xmm0
lea ecx, [ebp - 0x8b0]
movups xmmword [ebp - 0x8b0], xmm0
call fcn.005d6b10
lea eax, [ebp - 0x8b0]
mov byte [ebp - 4], 0x97
push eax
push 1
lea ecx, [ebp - 0x1d0]
call fcn.005d9220
push eax
push 0
lea ecx, [ebp - 0x1d0]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x20]
call fcn.005d6880
mov eax, dword [ebp - 0x8a8]
cmp eax, 1
je 0x53993e
cmp eax, 7
je 0x53993e
lea ecx, [ebp - 0x8b0]
mov byte [ebp - 4], 0x95
call fcn.005d6b00
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0xc8]
call fcn.005dc190
push eax
push str._tFailed_to_repair_infected_registry_entry:
lea ecx, [ebp - 0x1a4]
call fcn.005dc200
mov al, byte [ebp - 0x8c9]
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x93
mov byte [ebp - 0x8c9], al
call fcn.005d9280
cmp byte [ebp - 0x8c9], 0
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x8e0], eax
je 0x5394a7
mov eax, dword [ebp - 0x8e4]
mov esi, dword [ebp - 0x12c]
mov ecx, dword [edi + 4]
push 0
push dword [esi + eax*4]
mov eax, dword [edi + 8]
push dword [eax + 0xb8]
call fcn.005bb970
jmp 0x5394ad
push 1
push dword [ebp - 0x8b0]
xorps xmm0, xmm0
mov dword [ebp - 0x46c], 0
lea ecx, [ebp - 0x474]
movq qword [ebp - 0x474], xmm0
call fcn.005dc570
push 1
mov byte [ebp - 4], 0x98
lea ecx, [ebp - 0x1d0]
xorps xmm0, xmm0
mov dword [ebp - 0x1f8], 0
push 2
movq qword [ebp - 0x200], xmm0
call fcn.005d9220
push eax
lea ecx, [ebp - 0x200]
call fcn.005dc570
push 1
lea edx, [ebp - 0x200]
mov byte [ebp - 4], 0x99
lea ecx, [ebp - 0x8f4]
call fcn.005d8c60
mov eax, dword [ebp - 0x8f4]
test eax, eax
je 0x5399c4
push eax
call fcn.00418a90
add esp, 4
cmp dword [ebp - 0x8a8], 1
lea ecx, [ebp - 0x200]
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x8f4], 0
push 0
jne 0x539a0e
push 0x65ca04
call fcn.005dc190
push eax
push 0x65ca10
lea ecx, [ebp - 0x200]
call fcn.005dc190
push eax
push 0x65ca04
jmp 0x539a2f
push 0x65ca18
call fcn.005dc190
push eax
push 0x62794c
lea ecx, [ebp - 0x200]
call fcn.005dc190
push eax
push 0x65ca18
lea ecx, [ebp - 0x200]
call fcn.005dc200
push 8
push 0
push 0x62439c
lea ecx, [ebp - 0x200]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x474]
call fcn.005d9660
push 0
lea ecx, [ebp - 0x474]
call fcn.005dc190
push eax
push dword [ebp - 0x8a8]
lea ecx, [ebp - 0x1d0]
push 1
call fcn.005d9220
push eax
push 0
lea ecx, [ebp - 0x1d0]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x20]
call fcn.005d5be0
lea ecx, [ebp - 0x200]
mov byte [ebp - 0x8c9], al
call fcn.005dc430
lea ecx, [ebp - 0x474]
call fcn.005dc430
lea ecx, [ebp - 0x8b0]
mov byte [ebp - 4], 0x95
call fcn.005d6b00
mov cl, byte [ebp - 0x8c9]
test cl, cl
je 0x5398b0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0xc8]
call fcn.005dc190
push eax
push str._tSuccessfully_repaired_infected_registry_entry:
jmp 0x5398d8
mov byte [ebp - 4], 0x93
call fcn.005d9280
jmp 0x5394d3
cmp eax, 0x53
je 0x5394d3
jmp 0x5394ad
xor esi, esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0xc8]
call fcn.005dc190
push eax
push str._tFailed_to_execute_repair_action:
lea ecx, [ebp - 0x1a4]
call fcn.005dc200
xor eax, eax
mov ecx, edi
test esi, esi
setg al
add dword [edi + 0x2c], eax
lea eax, [ebp - 0x1a4]
inc dword [edi + 0x28]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0053a600
mov eax, dword [ebp - 0x8f0]
mov esi, dword [ebp - 0x12c]
inc eax
mov ecx, dword [ebp - 0x8d8]
add dword [ebp - 0x8e4], 4
add ecx, 4
mov dword [ebp - 0x8f0], eax
mov dword [ebp - 0x8d8], ecx
cmp eax, dword [esi]
jle 0x539520
lea ecx, [ebp - 0x1a4]
call fcn.005dc430
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x91
call fcn.005dc430
jmp 0x539e77
push str.Run_an_SFC_scan
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539be1
mov ecx, dword [edi + 0x1c94]
push 1
call fcn.00546c60
jmp 0x539e01
push str.Repair_Windows_with_DISM
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539c05
mov ecx, dword [edi + 0x1c94]
call fcn.0056b200
jmp 0x539e01
push str.Reset_the_DNS_settings
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539c2b
mov ecx, dword [edi + 0x1c94]
push 2
call fcn.00544e80
jmp 0x539e01
push str.Reset_the_hosts_file
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539c51
mov ecx, dword [edi + 0x1c94]
push 1
call fcn.00544e80
jmp 0x539e01
push str.Reset_IP__Winsock_and_proxy
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539c75
mov ecx, dword [edi + 0x1c94]
call fcn.00540490
jmp 0x539e01
push str.Reset_and_fix_the_Windows_firewall
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539c99
mov ecx, dword [edi + 0x1c94]
call fcn.005657c0
jmp 0x539e01
push str.Reset_the_SubSystems_registry_key
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539cbd
mov ecx, dword [edi + 0x1c94]
call fcn.005677f0
jmp 0x539e01
push str.Reset_Windows_services_start_types
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539ce3
mov ecx, dword [edi + 0x1c94]
push 5
call fcn.00545180
jmp 0x539e01
push str.Reset_the_group_policies
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539d09
mov ecx, dword [edi + 0x1c94]
push 0
call fcn.005407f0
jmp 0x539e01
push str.Reset_registry_and_file_permissions
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539d2d
mov ecx, dword [edi + 0x1c94]
call fcn.00541630
jmp 0x539e01
push str.Reset_all_print_jobs
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539d53
mov ecx, dword [edi + 0x1c94]
push 1
call fcn.005761e0
jmp 0x539e01
push str.Reset_the_Windows_Store
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539d77
mov ecx, dword [edi + 0x1c94]
call fcn.00560010
jmp 0x539e01
push str.Fix_the_WMI__the_System_restore
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539d9a
mov ecx, dword [edi + 0x1c94]
push 3
call fcn.00567d30
jmp 0x539e01
push str.Fix_and_enable_Windows_update
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539dbd
mov ecx, dword [edi + 0x1c94]
push 0
call fcn.00569d90
jmp 0x539e01
push str.Fix_Applications_not_responding
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539dde
mov ecx, dword [edi + 0x1c94]
call fcn.00567400
jmp 0x539e01
push str.Fix_corrupted_user_profiles
lea ecx, [ebp - 0xc8]
call fcn.005dc4c0
test al, al
je 0x539b16
mov ecx, dword [edi + 0x1c94]
call fcn.00567100
mov esi, eax
test esi, esi
jle 0x539e34
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0xc8]
call fcn.005dc190
push eax
push str._tSuccessfully_executed_repair_action:
jmp 0x539b3e
je 0x539b16
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._was_cancelled_by_the_user._r_n
lea ecx, [ebp - 0xc8]
call fcn.005dc190
push eax
push str._tThe_repair_action:
jmp 0x539b3e
push str._tNo_items_selected_in_this_group._r_n_r_n
lea ecx, [ebp - 0xe8]
call fcn.005e37e0
mov eax, dword [edi + 0x28]
mov ecx, dword [ebp - 0x8e0]
or ecx, 1
cmp dword [edi + 0x2c], eax
mov eax, dword [edi + 8]
cmovae ecx, dword [ebp - 0x8e0]
push 1
mov dword [ebp - 0x8e4], ecx
push dword [eax + 0xb8]
mov ecx, dword [edi + 4]
call fcn.005ba360
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x20
push dword [eax + 0xb8]
call fcn.005bd3f0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 2
push dword [eax + 0x40]
call fcn.005bd3f0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0x30]
call fcn.005bd3f0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x186a0
push 0
push str.Stop_the_current_scan
push dword [eax + 0x30]
call fcn.005bcaf0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x64
push dword [eax + 0x44]
call fcn.005b9910
lea ecx, [ebp - 0x4b0]
call fcn.005d04b0
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x4b0]
call fcn.005d0520
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n__End_of_the_removal_process._Time:
lea ecx, [ebp - 0x70]
call fcn.005da510
push 0
lea ecx, [ebp - 0x70]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xe8]
call fcn.005e37e0
push 0
push str._r_n_r_n_End_of_the_removal_report
lea ecx, [ebp - 0xe8]
call fcn.005e37e0
mov ecx, 0x66c71c
call fcn.005d8c20
cdq
lea ecx, [ebp - 0xe8]
mov esi, eax
mov edi, edx
call fcn.005e4680
add eax, esi
lea ecx, [ebp - 0x70]
adc edx, edi
push edx
push eax
call fcn.005db580
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x66c72c
lea ecx, [ebp - 0x70]
call fcn.005da780
push 0
lea ecx, [ebp - 0x70]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xe8]
call fcn.005e37e0
push 0
lea ecx, [ebp - 0xe8]
call fcn.005e36a0
mov ecx, dword [ebp - 0x8e8]
push str.Cleanup_complete
push 0x64
add ecx, 0x940
call fcn.005b66e0
mov eax, dword [ebp - 0x12c]
push eax
call fcn.0041e1c3
mov eax, dword [ebp - 0xa8]
add esp, 4
test eax, eax
je 0x53a00f
push eax
call fcn.0041e1c3
add esp, 4
push dword [ebp - 0x1b0]
call fcn.0041e1c3
add esp, 4
lea ecx, [ebp - 0xe0]
call fcn.005d9280
lea ecx, [ebp - 0xe8]
call fcn.00401050
mov eax, dword [ebp - 0xbc]
test eax, eax
je 0x53a046
push eax
call fcn.0041e1c3
add esp, 4
lea ecx, [ebp - 0x450]
call fcn.005dd5d0
lea ecx, [ebp - 0x70]
call fcn.005dc430
lea ecx, [ebp - 0x10c]
call fcn.005dc430
lea ecx, [ebp - 0x28c]
call fcn.005dc430
push fcn.005d6b00
push 2
push 0x10
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 0x17
push eax
call fcn.0041e45b
push fcn.005d6ab0
push 3
push 0xc
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x16
push eax
call fcn.0041e45b
push fcn.005d69e0
push 3
push 4
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 0x15
push eax
call fcn.0041e45b
lea ecx, [ebp - 0x220]
call fcn.005dc430
lea ecx, [ebp - 0x520]
call fcn.005dc430
lea ecx, [ebp - 0x40c]
call fcn.005dc430
lea ecx, [ebp - 0x52c]
call fcn.005dc430
lea ecx, [ebp - 0x5d0]
call fcn.005dc430
lea ecx, [ebp - 0x400]
call fcn.005dc430
lea ecx, [ebp - 0x480]
call fcn.005dc430
lea ecx, [ebp - 0x538]
call fcn.005dc430
lea ecx, [ebp - 0x544]
call fcn.005dc430
lea ecx, [ebp - 0x550]
call fcn.005dc430
lea ecx, [ebp - 0x3f4]
call fcn.005dc430
lea ecx, [ebp - 0x48c]
call fcn.005dc430
lea ecx, [ebp - 0x55c]
call fcn.005dc430
lea ecx, [ebp - 0x568]
call fcn.005dc430
lea ecx, [ebp - 0x3e8]
call fcn.005dc430
lea ecx, [ebp - 0x498]
call fcn.005dc430
lea ecx, [ebp - 0x580]
call fcn.005dc430
lea ecx, [ebp - 0x20c]
call fcn.005dc430
lea ecx, [ebp - 0x334]
call fcn.005dc430
lea ecx, [ebp - 0x298]
call fcn.005dc430
lea ecx, [ebp - 0x250]
call fcn.005dc430
mov eax, dword [ebp - 0x8e4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret