Function at 0x4c2770
Capabilities:
Contain obfuscated stackstrings
Create thread
Get graphical window text

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f2f93
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3e0
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x38c], edi
push str.Smart_Uninstaller
lea ecx, [edi + 0x1448]
mov byte [ebp - 0x38d], 0
call fcn.005dc510
lea esi, [edi + 0x1460]
mov dword [ebp - 0x384], edi
push esi
lea ecx, [ebp - 0x37c]
mov byte [ebp - 0x380], 0
call fcn.005dc5b0
mov dword [ebp - 0x370], 0xffffffff
mov dword [ebp - 0x36c], 0xffffffff
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.005dc400
lea ecx, [ebp - 0x37c]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x4c2835
mov byte [ebp - 0x38d], 0xf
jmp 0x4c3ad6
push 0
push 0x20019
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x70], 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x70]
call fcn.005d6a80
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.005d6280
mov dword [ebp - 0x3bc], eax
test eax, eax
jne 0x4c2879
mov byte [ebp - 0x38d], 0xf
jmp 0x4c3ace
push 1
push str.Uninstall_Remnants
mov ecx, edi
call fcn.0045f680
mov ecx, edi
mov dword [ebp - 0x3d8], eax
call fcn.0043e530
test al, al
jne 0x4c28a3
mov byte [ebp - 0x38d], al
jmp 0x4c3ace
mov esi, dword [edi + 0x14e4]
lea eax, [ebp - 0x350]
push 0x270
push 0
push eax
mov dword [ebp - 0x39c], esi
call fcn.00420090
add esp, 0xc
lea eax, [edi + 0x14a8]
lea ecx, [ebp - 0x350]
push eax
call fcn.005c6300
push 0xffffffffffffffff
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 2
call fcn.005c4720
push 1
push str.https:__www.carifred.com_uvk_help_smart_uninstaller.php
lea ecx, [edi + 0x119c]
call fcn.005dc260
push str.Uninstall_remnants_scan._Please_cancel_shutdown.
mov ecx, edi
call fcn.0043dbb0
push 0xffffffffffffffff
mov ecx, esi
call fcn.005c44b0
push 0
call fcn.005c44a0
push 0xfffffffffffffffe
push 0x5f
push 0xa0
push 0xb
push 0x78
push 0x75
mov ecx, edi
call fcn.0043ccb0
push 0x400
mov ecx, esi
call fcn.005c4340
movsd xmm1, qword [0x6edb20]
push 0
push str.Arial
push 1
push 0x320
call fcn.005c42b0
push 0x37
push 0x5a
push 3
push 0xa
mov ecx, edi
call fcn.0045fec0
push 0xffffffffffffffff
push 0x10000001
push 0x2d
push 0x64
push 0x3c
push 5
push str.Uninstall_remnants
mov ecx, esi
call fcn.005c0890
push dword [edi + 0x1438]
mov ecx, esi
push 0xffffffffffffffff
call fcn.005bec70
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0
lea ecx, [ebp - 0x6c]
movq qword [ebp - 0x6c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x74], 0
lea ecx, [ebp - 0x7c]
movq qword [ebp - 0x7c], xmm0
call fcn.005dc5e0
push 0
push str.Arial
mov byte [ebp - 4], 4
push 1
movsd xmm1, qword [0x6edb08]
mov ecx, esi
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0x82
push 0x19
push 0x82
push str.Scan_progress_info:
mov ecx, esi
call fcn.005c0890
sub esp, 0xc
lea ecx, [ebp - 0x6c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Uninstall_entries:
push dword [ebp - 0x3bc]
call fcn.005db290
mov ecx, eax
call fcn.005da510
push 0xfeffff
mov ecx, esi
call fcn.005c44b0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x91
push 0x37
push 0x82
lea ecx, [ebp - 0x6c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x91
push 0x4b
push 0x82
push str.Remnants_found:_0.
mov ecx, esi
mov dword [ebp - 0x3dc], eax
call fcn.005c0890
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x3c0], eax
mov dword [ebp - 0x36c], eax
call fcn.005c44b0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Delete_all_the_checked_entries._This_option_is_only_available_to_registered_users.
push 0x5f
push 0x96
push 0xa
push 0x11d
push 0x72
push str.Delete_selected_items_r_n_r_n
call fcn.0045fdf0
push eax
mov ecx, esi
mov dword [ebp - 0x3b4], eax
call fcn.005c5730
push eax
lea ecx, [ebp - 0x350]
call fcn.005c5fe0
push 0xfffffffffffffffe
lea ecx, [ebp - 0x350]
call fcn.005c44b0
push 0xfffffffffffffffe
push 0xffffffffffffffff
push dword [edi + 0x1438]
mov eax, ecx
push eax
push str.Whether_to_create_a_system_restore_point_before_deleting_the_checked_entries.
push 0
push ecx
push 0x8c
push 0x49
push 5
push str._Create_restore_point
mov ecx, edi
call fcn.0045fc60
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Show_information_about_the_selected_uninstall_leftover.
push 0x5f
push 0x50
push 0xa
push 0x1b8
push 0x8b
push str.Item_properties
mov dword [ebp - 0x3f0], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Go_back_to_the_Smart_uninstaller__CtrlEsc_
push 0x5f
push 0x46
push 0xa
push 0x20d
push 0x6b
push str.Uninstall_list
mov dword [ebp - 0x3e4], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Show_online_help__F1_
push 0x5f
push 0x46
push 0xa
push 0x258
push 0x7d
push str.Help
mov dword [ebp - 0x3cc], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, edi
push str.Go_back_to_the_Home_page__Esc_
push 0x5f
push 0x46
push 0xa
push 0x2a3
push 0xb3
push str.Home
mov dword [edi + 0x11bc], eax
call fcn.0045fdf0
movsd xmm1, qword [0x6edaf8]
mov ecx, esi
push 0
push str.Arial
push 1
push 0x190
mov dword [edi + 0x11c0], eax
call fcn.005c42b0
push 0x833
mov ecx, esi
call fcn.005c4340
push ecx
push 0x10001137
push 0x1b3
push 0x2ee
push 0x73
push ecx
call fcn.005bfa50
mov edi, eax
push ecx
push edi
mov ecx, esi
mov dword [ebp - 0x394], edi
mov dword [ebp - 0x370], edi
call fcn.005b9fe0
push edi
mov ecx, esi
call fcn.005c5730
push 0
push 0x16
push 0x111b
push eax
mov dword [ebp - 0x3b0], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 2
push 0x21
push 0x12
push 0x12
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
sub esp, 8
mov edx, 1
mov edi, eax
mov dword [ebp - 0x3ac], edi
push 0xff005f00
lea ecx, [edx + 0x11]
call fcn.005d28c0
push eax
lea ecx, [ebp - 0x3bc]
call fcn.005c6510
sub esp, 8
xor edx, edx
push 0xff005f00
lea ecx, [edx + 0x12]
call fcn.005d28c0
push eax
lea ecx, [ebp - 0x3d4]
call fcn.005c6510
mov byte [ebp - 4], 6
mov esi, dword [ebp - 0x3d4]
push 0
push esi
push edi
mov edi, dword [sym.imp.COMCTL32.dll_ImageList_Add]
call edi
push 0
push esi
mov esi, dword [ebp - 0x3ac]
push esi
call edi
push 0
push dword [ebp - 0x3bc]
push esi
call edi
push esi
push 2
push 0x1109
push dword [ebp - 0x3b0]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [ebp - 0x38c]
lea ecx, [ebp - 0x9c]
mov edi, dword [ebp - 0x39c]
xorps xmm0, xmm0
push 0xd
push 0
push dword [esi + 0x11c0]
movups xmmword [ebp - 0x9c], xmm0
push dword [ebp - 0x3b4]
movups xmmword [ebp - 0x8c], xmm0
push edi
call fcn.005b8800
push 0
mov byte [ebp - 4], 7
mov ecx, esi
push str.Smart_UninstallerRemnants_scan
call fcn.0045f4d0
mov ecx, esi
call fcn.0045f300
sub esp, 8
mov ecx, esi
push 0x46
push 0x1c2
push edi
push str.Preparing_to_scan__please_wait...
call fcn.0043da60
mov ecx, edi
call fcn.005c6c50
push 1
push str.Cancel_scan
push 0
lea eax, [esi + 0x14f0]
push 0xffffffffffffffb0
push ecx
mov ecx, eax
mov dword [ebp - 0x3ac], eax
call fcn.005b66a0
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b64a0
push 0
push 0
lea eax, [ebp - 0x384]
push eax
push 0x4bbc70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x388], esi
xor edx, edx
mov byte [ebp - 4], 8
mov ecx, esi
call fcn.005cca30
test al, al
je 0x4c2e20
mov edi, dword [ebp - 0x38c]
nop dword [eax]
push 0
push 0
mov ecx, edi
call fcn.0043d720
test eax, eax
je 0x4c2e0d
cmp byte [ebp - 0x380], 0
jne 0x4c2e0d
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push 0
push 0
push 1
push str.Are_you_sure_you_want_to_cancel_the_scan_
call fcn.0043e2e0
test eax, eax
jne 0x4c2e06
push 1
mov ecx, edi
call fcn.0043d8e0
jmp 0x4c2e0d
mov byte [ebp - 0x380], 1
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x4c2dc0
mov edi, dword [ebp - 0x39c]
mov ecx, dword [ebp - 0x3ac]
push 2
call fcn.005b6250
push 0x400
mov ecx, edi
call fcn.005c4340
push 0
push 0x10800080
push 0x19
push 0xb9
push 0x23
push 0x2f3
push str.Find_a_remnant__CtrlF_
call fcn.005c0a40
push 0x7f7f7f
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x3a4], eax
call fcn.005bec70
movsd xmm0, qword [0x6edb08]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push 0
push ecx
push 0x190
push 0xffffffffffffffff
mov ecx, edi
call fcn.005beb10
push 0
push ecx
mov ecx, dword [ebp - 0x38c]
mov dword [esp], 0x41500000
push str.List_menu
push 0x28
push 0x5a
push 0x41
push 0x2f3
push 0x86
push str.List_menu
call fcn.0045fd50
push 0
push ecx
mov ecx, dword [ebp - 0x38c]
mov dword [esp], 0x41500000
push str.Find_next__F3_
push 0x28
push 0x5a
push 0x41
push 0x352
push 0x99
push str.Find_next
mov dword [ebp - 0x3e0], eax
call fcn.0045fd50
push dword [ebp - 0x3c0]
mov ecx, edi
mov dword [ebp - 0x3b8], eax
call fcn.005bc230
push eax
lea ecx, [ebp - 0x7c]
call fcn.005dc1c0
push dword [ebp - 0x3dc]
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x6c]
call fcn.005dc1c0
sub esp, 0xc
mov ecx, str.complete.
cmp byte [ebp - 0x380], 0
mov eax, str.cancelled.
cmove eax, ecx
lea ecx, [ebp - 0x6c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push str.Remnants_scan
call fcn.005da510
push 0
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
push 0x6972d0
lea ecx, [ebp - 0x6c]
call fcn.005dc190
mov ecx, dword [ebp - 0x38c]
push eax
call fcn.0045a700
push 0x48
call dword [sym.imp.USER32.dll_GetSystemMetrics]
movsd xmm0, qword [0x6edab8]
mov edx, eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x3a0], edx
comisd xmm0, xmmword [eax + 8]
jb 0x4c2fbe
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp - 0x3a0]
mov ecx, eax
mov eax, dword [ebp - 0x38c]
or ecx, 0xff000000
jmp 0x4c2fc0
xor ecx, ecx
push ecx
push edx
push edx
mov dword [ebp - 0x398], ecx
mov ecx, eax
push 0x8b
call fcn.00436420
push eax
lea ecx, [ebp - 0x358]
call fcn.005c6520
mov byte [ebp - 4], 9
mov ecx, edi
push dword [ebp - 0x358]
push str.Uninstall_remnant_properties_tCtrlEnter
push dword [ebp - 0x394]
call fcn.005c1450
push 0
push eax
push dword [ebp - 0x394]
mov ecx, edi
mov dword [ebp - 0x3a8], eax
call fcn.005c56e0
push eax
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
push dword [ebp - 0x398]
mov eax, dword [ebp - 0x3a0]
mov ecx, dword [ebp - 0x38c]
push eax
push eax
push 0x72
call fcn.00436420
push eax
lea ecx, [ebp - 0x360]
call fcn.005c6520
push 0
mov byte [ebp - 4], 0xa
mov ecx, edi
push dword [ebp - 0x360]
push 0
push 0x32
push str.Delete_selected_remnants_tCtrlDel
push dword [ebp - 0x3a8]
call fcn.005c0400
push dword [ebp - 0x398]
mov ecx, dword [ebp - 0x38c]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3a0]
push eax
push eax
push 0xac
call fcn.00436420
push eax
lea ecx, [ebp - 0x364]
call fcn.005c6520
push 0
mov byte [ebp - 4], 0xb
mov ecx, edi
push dword [ebp - 0x364]
push 0
push 0x32
push str.Open_remnants_location_tCtrlO
push dword [ebp - 0x3a8]
call fcn.005c0400
push dword [ebp - 0x398]
mov ecx, dword [ebp - 0x38c]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3a0]
push eax
push eax
push 0x7c
call fcn.00436420
push eax
lea ecx, [ebp - 0x368]
call fcn.005c6520
push 0
mov byte [ebp - 4], 0xc
push dword [ebp - 0x368]
push 0
push 0x32
push str.Google_selected_item_tCtrlG
push dword [ebp - 0x3a8]
mov ecx, edi
call fcn.005c0400
push 0
push 0
push 8
push 0x32
push 0
push dword [ebp - 0x3a8]
mov ecx, edi
mov dword [ebp - 0x3c4], eax
call fcn.005c0400
push dword [ebp - 0x398]
mov eax, dword [ebp - 0x3a0]
mov ecx, dword [ebp - 0x38c]
push eax
push eax
push 0x99
call fcn.00436420
push eax
lea ecx, [ebp - 0x35c]
call fcn.005c6520
push 0
mov byte [ebp - 4], 0xd
mov ecx, edi
push dword [ebp - 0x35c]
push 0
push 0x32
push str.Start_a_new_scan_tCtrlS
push dword [ebp - 0x3a8]
call fcn.005c0400
push dword [ebp - 0x398]
mov ecx, dword [ebp - 0x38c]
mov edi, eax
mov eax, dword [ebp - 0x3a0]
push eax
push eax
push 0x98
call fcn.00436420
push eax
lea ecx, [ebp - 0x354]
call fcn.005c6520
mov ecx, dword [ebp - 0x39c]
push 0
mov byte [ebp - 4], 0xe
push dword [ebp - 0x354]
push 0
push 0x32
push str.Export_to_text_file_tCtrlE
push dword [ebp - 0x3a8]
call fcn.005c0400
mov ecx, dword [ebp - 0x38c]
push 0
mov dword [ebp - 0x3a0], eax
call fcn.0045f170
mov ecx, 0x1b
mov byte [ebp - 0x60], 9
mov edx, eax
mov word [ebp - 0x5e], cx
mov eax, dword [ebp - 0x3cc]
mov word [ebp - 0x58], cx
mov ecx, dword [ebp - 0x38c]
mov word [ebp - 0x5c], ax
mov dword [ebp - 0x3d0], edx
mov byte [ebp - 0x5a], 1
movzx eax, word [ecx + 0x11c0]
mov word [ebp - 0x56], ax
mov eax, 0x70
mov word [ebp - 0x52], ax
movzx eax, word [ecx + 0x11bc]
mov word [ebp - 0x50], ax
mov eax, 0x72
mov word [ebp - 0x4c], ax
mov eax, dword [ebp - 0x3b8]
mov byte [ebp - 0x54], 1
mov byte [ebp - 0x4e], 1
mov word [ebp - 0x4a], ax
lea ecx, [ebp - 0x9c]
mov eax, 0x46
mov byte [ebp - 0x48], 9
mov word [ebp - 0x46], ax
mov eax, 0xd
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x3a8]
mov word [ebp - 0x3e], ax
mov eax, 0x2e
mov word [ebp - 0x3a], ax
mov eax, dword [ebp - 0x3ac]
mov word [ebp - 0x38], ax
mov eax, 0x4f
mov word [ebp - 0x34], ax
mov eax, dword [ebp - 0x3c8]
mov word [ebp - 0x32], ax
mov eax, 0x47
mov word [ebp - 0x2e], ax
mov eax, dword [ebp - 0x3c4]
mov word [ebp - 0x2c], ax
mov eax, 0x53
mov word [ebp - 0x28], ax
mov eax, 0x45
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x3a0]
mov word [ebp - 0x44], dx
mov byte [ebp - 0x42], 9
mov byte [ebp - 0x3c], 9
mov byte [ebp - 0x36], 9
mov byte [ebp - 0x30], 9
mov byte [ebp - 0x2a], 9
mov word [ebp - 0x26], di
mov byte [ebp - 0x24], 9
mov word [ebp - 0x20], ax
call fcn.005b8600
mov edi, dword [ebp - 0x39c]
lea eax, [ebp - 0x60]
push 0xb
push eax
mov ecx, edi
call fcn.005c47a0
push dword [ebp - 0x3b8]
mov ecx, edi
mov dword [ebp - 0x398], 0
call fcn.005c4370
mov eax, dword [ebp - 0x38c]
test dword [eax + 0x1f70], 0x100
jne 0x4c39ef
nop dword [eax]
push 0
mov ecx, eax
call fcn.004771c0
mov eax, dword [ebp - 0x38c]
lea edx, [ebp - 0x350]
mov ecx, dword [eax + 0x14d8]
cmp ecx, edx
lea edx, [eax + 0x14a8]
jne 0x4c335a
cmp dword [edx], 0xfffffff5
jne 0x4c335a
mov ecx, dword [ebp - 0x3b4]
mov dword [edx], ecx
mov ecx, edi
mov dword [eax + 0x14d8], edi
mov edx, dword [edx]
cmp edx, 0xfffffffa
je 0x4c39ef
cmp ecx, edi
jne 0x4c39c6
mov ecx, dword [ebp - 0x394]
cmp edx, 0xffffffea
jne 0x4c3380
cmp dword [eax + 0x14b4], ecx
je 0x4c338c
cmp edx, dword [ebp - 0x3e0]
jne 0x4c341e
push 0
push 9
push ecx
mov ecx, edi
call fcn.005ba020
test eax, eax
je 0x4c33ae
push eax
push 3
push dword [ebp - 0x394]
mov ecx, edi
call fcn.005ba020
jmp 0x4c33b0
xor eax, eax
mov ecx, dword [ebp - 0x39c]
test eax, eax
mov eax, 0x20
mov edi, 0x40
cmovne edi, eax
push edi
push dword [ebp - 0x3a8]
call fcn.005bd3f0
mov ecx, dword [ebp - 0x39c]
push edi
push dword [ebp - 0x3c8]
call fcn.005bd3f0
push edi
push dword [ebp - 0x3c4]
mov edi, dword [ebp - 0x39c]
mov ecx, edi
call fcn.005bd3f0
push 0x20
push dword [ebp - 0x3a0]
mov ecx, edi
call fcn.005bd3f0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push dword [ebp - 0x394]
mov ecx, edi
call fcn.005bbfd0
jmp 0x4c39c0
cmp edx, 0xffffffb3
mov edx, dword [ebp - 0x3a4]
jne 0x4c3431
cmp dword [eax + 0x14b4], edx
je 0x4c3449
mov edi, dword [ebp - 0x3d0]
cmp dword [eax + 0x14a8], edi
mov edi, dword [ebp - 0x39c]
jne 0x4c34ed
mov ecx, eax
call fcn.0046c220
push 0x80
push dword [ebp - 0x3a4]
mov ecx, edi
call fcn.005bd3f0
push dword [ebp - 0x3a4]
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x6c]
call fcn.005dc1c0
push str.Find_a_remnant__CtrlF_
lea ecx, [ebp - 0x6c]
call fcn.005dc4c0
mov ecx, edi
test al, al
je 0x4c34d4
push 0
push 0
push dword [ebp - 0x3a4]
call fcn.005bcd30
push 0
push dword [ebp - 0x3a4]
mov ecx, edi
call fcn.005bec70
movsd xmm0, qword [0x6edb20]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push 0
push ecx
push 0x190
push dword [ebp - 0x3a4]
mov ecx, edi
call fcn.005beb10
jmp 0x4c39c0
push 0xffffffffffffffff
push 0
push 0xb1
push dword [ebp - 0x3a4]
call fcn.005befd0
jmp 0x4c39c0
cmp dword [eax + 0x14a8], 0xffffffb4
jne 0x4c35ab
cmp dword [eax + 0x14b4], edx
jne 0x4c35ab
push edx
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x6c]
call fcn.005dc1c0
lea ecx, [ebp - 0x6c]
call fcn.005dc3a0
cmp eax, 3
jl 0x4c39c0
cmp dword [ebp - 0x398], 0
jne 0x4c3546
push 0
push 9
push 0x110a
push dword [ebp - 0x3b0]
call dword [sym.imp.USER32.dll_SendMessageW]
push ecx
lea ecx, [ebp - 0x6c]
call fcn.005dc190
push eax
push 0
push dword [ebp - 0x394]
mov ecx, edi
call fcn.005ba1b0
mov ecx, eax
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x4c39c0
push ecx
push 9
push 0x110b
push dword [ebp - 0x3b0]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x398]
push 0
push 0x1114
push dword [ebp - 0x3b0]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x398], 0
jmp 0x4c39c0
mov edi, dword [ebp - 0x3b8]
cmp dword [eax + 0x14a8], edi
mov edi, dword [ebp - 0x39c]
jne 0x4c36c2
push edx
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x6c]
call fcn.005dc1c0
push str.Find_a_remnant__CtrlF_
lea ecx, [ebp - 0x6c]
call fcn.005dc4c0
test al, al
jne 0x4c36a7
lea ecx, [ebp - 0x6c]
call fcn.005dbeb0
test al, al
jne 0x4c36a7
call fcn.005dbeb0
test al, al
jne 0x4c39c0
push ecx
call fcn.005dc190
push eax
push dword [ebp - 0x398]
mov ecx, edi
push dword [ebp - 0x394]
call fcn.005ba1b0
mov dword [ebp - 0x398], eax
test eax, eax
je 0x4c366e
push eax
push 9
push 0x110b
push dword [ebp - 0x3b0]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x398]
push 0
push 0x1114
push dword [ebp - 0x3b0]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x80
push dword [ebp - 0x394]
mov ecx, edi
call fcn.005bd3f0
jmp 0x4c39c0
push 0x80
push dword [ebp - 0x3a4]
mov ecx, edi
call fcn.005bd3f0
mov ecx, dword [ebp - 0x38c]
sub esp, 8
push 0x8c
push 0x190
push 0
push edi
push 4
push str.Find_reached_the_end_of_the_list.
call fcn.0043e2e0
jmp 0x4c39c0
push 0
push 0
push 0x201
push dword [ebp - 0x3d0]
mov ecx, edi
call fcn.005befd0
jmp 0x4c39c0
cmp dword [eax + 0x14a8], 0xffffffeb
jne 0x4c36e1
cmp dword [eax + 0x14b4], ecx
jne 0x4c36e1
push edx
push ecx
mov ecx, eax
call fcn.0043e280
jmp 0x4c39c0
mov edx, dword [eax + 0x1f70]
test dl, dl
js 0x4c3907
mov edx, dword [eax + 0x14a8]
cmp edx, dword [ebp - 0x3b4]
je 0x4c3919
cmp edx, dword [ebp - 0x3ac]
je 0x4c3919
cmp edx, dword [ebp - 0x3e4]
je 0x4c38a6
cmp edx, dword [ebp - 0x3a8]
je 0x4c38a6
cmp edx, 0xfffffff2
jne 0x4c3736
cmp dword [eax + 0x14b4], ecx
je 0x4c38a6
cmp edx, dword [ebp - 0x3cc]
je 0x4c39e1
cmp edx, dword [eax + 0x11c0]
je 0x4c39d8
cmp edx, dword [ebp - 0x3c8]
jne 0x4c37e2
push 0
push 9
push ecx
mov ecx, edi
call fcn.005ba020
mov dword [ebp - 0x3e8], eax
test eax, eax
je 0x4c39c0
push eax
push 3
push dword [ebp - 0x394]
mov ecx, edi
call fcn.005ba020
test eax, eax
je 0x4c39c0
push dword [ebp - 0x3e8]
mov ecx, edi
push dword [ebp - 0x394]
call fcn.005ba070
push eax
lea ecx, [ebp - 0x6c]
call fcn.005dc1c0
push 0
push 1
push 0xffffffffffffffff
push 1
push 0x68fb68
lea ecx, [ebp - 0x6c]
call fcn.005daa70
cmp eax, 3
jl 0x4c39c0
dec eax
lea ecx, [ebp - 0x6c]
push eax
call fcn.005dae00
mov ecx, eax
call fcn.005dc190
push eax
call fcn.0043bf00
jmp 0x4c39c0
cmp edx, dword [ebp - 0x3c4]
jne 0x4c386f
push 0
push 9
push ecx
mov ecx, edi
call fcn.005ba020
test eax, eax
je 0x4c39c0
push eax
push 3
push dword [ebp - 0x394]
mov ecx, edi
call fcn.005ba020
test eax, eax
je 0x4c39c0
push 0
push 1
push 0xffffffffffffffff
push 1
push 0x68fb68
lea ecx, [ebp - 0x6c]
call fcn.005daa70
dec eax
lea ecx, [ebp - 0x6c]
push eax
call fcn.005dae00
push 0
push 1
push 4
push 1
push 0x624518
lea ecx, [ebp - 0x6c]
call fcn.005daa70
neg eax
lea ecx, [ebp - 0x6c]
sbb eax, eax
and eax, 2
push eax
call fcn.005dc190
mov ecx, dword [ebp - 0x38c]
push eax
call fcn.0045ee00
jmp 0x4c39c0
cmp edx, dword [ebp - 0x3a0]
jne 0x4c39c6
push dword [ebp - 0x380]
push dword [ebp - 0x3dc]
push dword [ebp - 0x3c0]
push ecx
mov ecx, eax
call fcn.004bc8f0
push dword [ebp - 0x3d8]
call dword [sym.imp.USER32.dll_BringWindowToTop]
jmp 0x4c39c0
push 0x1d
push dword [eax + 0x11bc]
xorps xmm0, xmm0
lea ecx, [ebp - 0xdc]
push dword [ebp - 0x3b8]
movups xmmword [ebp - 0xdc], xmm0
push dword [ebp - 0x3b4]
movups xmmword [ebp - 0xcc], xmm0
push edi
call fcn.005b8800
push dword [ebp - 0x394]
mov ecx, dword [ebp - 0x38c]
mov byte [ebp - 4], 0x10
call fcn.004bd520
push dword [ebp - 0x3d8]
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xdc]
jmp 0x4c39bb
and edx, 0xffffff7f
or edx, 0x100
mov dword [eax + 0x1f70], edx
push 0
push ecx
mov ecx, eax
call fcn.00477170
test al, al
je 0x4c39c0
push 4
push dword [ebp - 0x3f0]
lea ecx, [ebp - 0x350]
call fcn.005bc500
test eax, eax
lea ecx, [ebp - 0xbc]
mov eax, dword [ebp - 0x38c]
xorps xmm0, xmm0
push 0x1d
setne byte [ebp - 0x3ec]
movups xmmword [ebp - 0xbc], xmm0
push dword [eax + 0x11bc]
movups xmmword [ebp - 0xac], xmm0
push dword [ebp - 0x3b8]
push dword [ebp - 0x3b4]
push edi
call fcn.005b8800
push dword [ebp - 0x3ec]
mov ecx, dword [ebp - 0x38c]
push dword [ebp - 0x3c0]
mov byte [ebp - 4], 0xf
push dword [ebp - 0x394]
call fcn.004bcd30
mov eax, dword [ebp - 0x38c]
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0xe
test dword [eax + 0x1f70], 0x100
jne 0x4c39ea
call fcn.005b8790
mov eax, dword [ebp - 0x38c]
test dword [eax + 0x1f70], 0x100
je 0x4c3320
jmp 0x4c39ef
mov byte [ebp - 0x38d], 1
jmp 0x4c39ef
mov byte [ebp - 0x38d], 0xf
jmp 0x4c39ef
call fcn.005b8790
mov edi, dword [ebp - 0x38c]
mov ecx, edi
push 0
push 1
call fcn.0043d720
push 0
mov ecx, edi
call fcn.0043dbb0
lea ecx, [ebp - 0x37c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x70]
call fcn.005d5740
push 0
push str.Smart_UninstallerRemnants_scan
mov ecx, edi
call fcn.0045f380
cmp byte [ebp - 0x38d], 0
mov ecx, edi
sete al
movzx eax, al
push eax
call fcn.0045f260
lea ecx, [ebp - 0x354]
call fcn.005c6500
lea ecx, [ebp - 0x35c]
call fcn.005c6500
lea ecx, [ebp - 0x368]
call fcn.005c6500
lea ecx, [ebp - 0x364]
call fcn.005c6500
lea ecx, [ebp - 0x360]
call fcn.005c6500
lea ecx, [ebp - 0x358]
call fcn.005c6500
cmp esi, 0xffffffff
je 0x4c3a92
test esi, esi
je 0x4c3a92
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x9c]
call fcn.005b8790
lea ecx, [ebp - 0x3d4]
call fcn.005c6500
lea ecx, [ebp - 0x3bc]
call fcn.005c6500
lea ecx, [ebp - 0x7c]
call fcn.005dc430
lea ecx, [ebp - 0x6c]
call fcn.005dc430
lea ecx, [ebp - 0x350]
call fcn.005c1c60
lea ecx, [ebp - 0x70]
call fcn.005d69e0
lea ecx, [ebp - 0x37c]
call fcn.005dc430
mov al, byte [ebp - 0x38d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx