Function at 0x5b2780
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xb4]
sub esp, 0xb4
push 0xffffffffffffffff
push 0x658454
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x7496c8]
xor eax, ebp
mov dword [ebp + 0xb0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x34], esi
mov eax, dword [ebp + 0xc4]
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x928], ebx
je 0x5b27f1
push ebx
push ebx
mov ecx, dword [esi + 0x4e0]
push ecx
lea ecx, [esi + 0x20]
call fcn.005c5310
mov dword [esi + 0x928], ebx
cmp dword [esi + 0xac4], ebx
je 0x5b2803
mov dword [esi + 0xab4], 0x7540
cmp dword [esi + 0xab4], 0x7573
jne 0x5b2828
push 3
mov ecx, esi
call fcn.005aaf10
lea ecx, [esi + 0x514]
call fcn.00560790
jmp 0x5b2ef8
cmp dword [esi + 4], ebx
jne 0x5b2835
push ebx
mov ecx, esi
call fcn.005aaf10
cmp dword [esi + 0xac4], ebx
je 0x5b2878
push ebx
mov ecx, esi
call fcn.005aaf10
push 1
mov edx, dword [esi + 0x4e0]
push edx
mov eax, dword [0x74f9fc]
push eax
mov ecx, dword [esi + 0xab4]
push ecx
lea ecx, [esi + 0x20]
call fcn.005bf430
push str.Cancel_by_user._n
lea ecx, [esi + 0x514]
call fcn.005603a0
jmp 0x5b2ef8
mov ecx, dword [esi + 0xab4]
cmp ecx, 0x7540
jne 0x5b28a4
push str.Cancel_by_user._n
lea ecx, [esi + 0x514]
call fcn.005603a0
push 2
mov ecx, esi
call fcn.005aaf10
jmp 0x5b2ef8
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x23], 1
mov eax, ecx
cmp eax, 0x753b
jg 0x5b2948
je case.0x5b2959.30040
cmp eax, 0x80090304
je case.0x5b2959.30018
cmp eax, 0x17
je case.0x5b2959.30040
cmp eax, 0x70
je case.0x5b2959.30040
cmp byte [esi + 0x34a], bl
jne case.0x5b2959.30040
cmp byte [esi + 0xae7], bl
jne 0x5b2ac9
cmp byte [0x74f565], bl
je 0x5b2ac1
cmp dword [esi + 4], ebx
jne 0x5b2ac1
test dword [esi + 0x174], 0x80000
je 0x5b2ac1
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00402500
mov byte [ebp - 4], 2
cmp byte [esi + 0xaa0], 0
je 0x5b2960
mov eax, dword [esi + 0xa88]
push eax
mov ecx, dword [esi + 0xa84]
push ecx
jmp 0x5b2977
sub eax, 0x7542
cmp eax, 0x40
ja case.0x5b2959.30019
movzx edx, byte [eax + 0x5b4428]
jmp dword [edx*4 + 0x5b441c]
mov eax, dword [esi + 0x944]
cmp eax, ebx
jne 0x5b296f
mov eax, 0x66b96c
mov ecx, dword [esi + 0x948]
push ecx
push eax
push str._s:_ld
lea edx, [ebp - 0x14]
push edx
call fcn.00402f80
add esp, 0x10
mov byte [esi + 0xae7], 1
push esi
call fcn.004aab30
push esi
call fcn.004ae530
add esp, 8
cmp byte [esi + 0xaa0], 0
je 0x5b29b7
mov eax, dword [esi + 0xa88]
push eax
mov ecx, dword [esi + 0xa84]
push ecx
jmp 0x5b29ce
mov eax, dword [esi + 0x944]
cmp eax, ebx
jne 0x5b29c6
mov eax, 0x66b96c
mov ecx, dword [esi + 0x948]
push ecx
push eax
push str._s:_ld
lea edx, [ebp - 0x20]
push edx
call fcn.00402f80
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00614d5e
add esp, 8
test eax, eax
je 0x5b2a80
lea edi, [esi + 0x514]
push str.Try_via_the_same_proxy_as_in_browser_request._n
mov ecx, edi
call fcn.005603a0
mov edx, dword [esi + 0xab4]
mov dword [esi + 0xaec], edx
mov edi, dword [edi]
cmp edi, ebx
je 0x5b2a30
push edi
push 0x66ae98
lea eax, [esi + 0xaf0]
push eax
call fcn.00402f80
add esp, 0xc
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
je 0x5b2a55
mov eax, dword [esi + 0x4e0]
cmp eax, ebx
je 0x5b2a55
push eax
push 0x1431
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x5b2a63
mov dword [esi + 0x940], ebx
push ebx
mov ecx, esi
call fcn.005bb720
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5b2ef8
mov byte [esi + 0xae7], 0
cmp byte [esi + 0xae8], 0
je 0x5b2aa4
push str.Cannot_detect_proxy_in_browser_proxy_script_:__n
lea ecx, [esi + 0x514]
call fcn.005603a0
mov byte [ebp - 0x19], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5b2b18
mov byte [ebp - 0x23], bl
cmp byte [esi + 0xae7], bl
je 0x5b2b18
cmp ecx, 0x756f
je 0x5b2ad9
cmp ecx, 0x7559
jne 0x5b2b12
mov ecx, dword [esi + 0xaec]
mov dword [esi + 0xab4], ecx
mov edx, dword [esi + 0xaf0]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b2af0
lea ecx, [esi + 0x514]
sub eax, edi
je 0x5b2b09
push edx
call fcn.00560a60
jmp 0x5b2b0e
call fcn.00560800
mov byte [ebp - 0x19], 1
mov byte [esi + 0xae7], bl
mov byte [ebp - 0x1a], 0
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x5c], ebx
xor edx, edx
mov word [ebp + 0x58], dx
mov byte [ebp - 4], 3
mov eax, dword [esi + 0xab4]
cmp eax, 0x7532
jg 0x5b2eb6
je case.0x5b2d67.10060
cmp eax, 0x271d
jg 0x5b2d41
je 0x5b2d39
cmp eax, 0xffffffff
jg 0x5b2c49
je 0x5b2bbb
cmp eax, 0x80090304
je case.0x5b2ecb.30009
cmp eax, 0x8009030e
je case.0x5b2ecb.30009
cmp eax, 0xfffffffc
je case.0x5b2ecb.30009
mov eax, dword [esi + 0x44]
cmp eax, 4
je 0x5b3713
cmp eax, 5
je 0x5b3713
lea edx, [esi + 0x518]
push edx
lea ecx, [ebp + 0x48]
call fcn.00402180
mov byte [ebp - 4], 0x17
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jne 0x5b2bb0
lea eax, [ebp + 0x4c]
mov edx, dword [0x74f7b0]
jmp 0x5b3672
mov eax, dword [esi + 0x44]
cmp eax, 4
je case.0x5b2ecb.30009
cmp eax, 5
je case.0x5b2ecb.30009
lea eax, [esi + 0x518]
push eax
lea ecx, [ebp + 0x3c]
call fcn.00402180
mov bl, 0x15
mov byte [ebp - 4], bl
lea ecx, [esi + 0xb0c]
push ecx
lea ecx, [ebp + 0x48]
call fcn.00402180
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp + 0x48]
test ecx, ecx
jne 0x5b2bf9
lea ecx, [ebp + 0x4c]
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5b2c03
lea eax, [ebp + 0x40]
mov edx, dword [0x74eb40]
push edx
push ecx
push eax
mov eax, dword [0x74f7ac]
push eax
lea ecx, [ebp + 0x54]
call fcn.00402320
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.004011f0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x3c]
call fcn.004011f0
jmp 0x5b3728
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x74f7b8]
push edx
jmp 0x5b3720
cmp eax, 5
je 0x5b2d26
cmp eax, 0x17
je 0x5b2d14
cmp eax, 0x70
jne case.0x5b2ecb.30004
mov eax, dword [0x74eb40]
push eax
mov ecx, dword [0x74fcd4]
push ecx
lea ecx, [ebp + 0x48]
call fcn.0045aac0
mov bl, 0x11
mov byte [ebp - 4], bl
xor edi, edi
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x20], edi
xor edx, edx
mov word [ebp + 0x1c], dx
mov byte [ebp - 4], 0x12
push edi
push edi
lea eax, [ebp - 0x18]
push eax
push 0x400
push 0x70
push edi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp + 0x48]
cmp eax, edi
jne 0x5b2cb3
lea eax, [ebp + 0x4c]
push edi
mov ecx, dword [ebp - 0x18]
push ecx
push eax
push str._r_n_r_n_s_s
lea ecx, [ebp + 0x18]
call fcn.00402320
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x74eb40]
push eax
mov ecx, dword [0x74f7b8]
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov eax, dword [ebp + 0x18]
cmp eax, edi
jne 0x5b2cef
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405330
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x18]
call fcn.004011f0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
call fcn.004011f0
jmp 0x5b3728
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x75025c]
push eax
jmp 0x5b3720
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x74fdec]
push edx
jmp 0x5b3720
mov ecx, dword [0x74f7c4]
jmp 0x5b2d74
cmp eax, 0x2af9
jg 0x5b2e62
je 0x5b2e57
sub eax, 0x2726
cmp eax, 0x2b
ja case.0x5b2ecb.30004
movzx edx, byte [eax + 0x5b4498]
jmp dword [edx*4 + 0x5b446c]
mov ecx, dword [0x74f7c0]
mov eax, dword [0x74eb40]
push eax
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [esi + 0x35d], 1
jmp 0x5b3728
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0xb
mov eax, dword [0x74f7b8]
mov edx, dword [0x74fee8]
push edx
push eax
push str._s_r_n_r_n_s
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f80
add esp, 0x10
mov edx, dword [0x74eb40]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [esi + 0x35d], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5b3728
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x74f7c8]
push edx
jmp 0x5b3720
mov ecx, dword [0x74f7cc]
jmp 0x5b3719
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x74f7d0]
push eax
jmp 0x5b3720
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x74f7d8]
push edx
jmp 0x5b3720
mov ecx, dword [0x74f7dc]
jmp 0x5b3719
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x74f7e0]
push eax
jmp 0x5b3720
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x74f7e4]
push edx
jmp 0x5b3720
mov ecx, dword [0x74f7d4]
jmp 0x5b2d74
sub eax, 0x2afa
je case.0x5b2ecb.30009
sub eax, 2
jne case.0x5b2ecb.30004
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0xc
mov eax, dword [0x74f9d8]
jmp 0x5b2da0
mov eax, dword [esi + 0x174]
test al, 8
jne 0x5b2e9d
test eax, 0x100
je case.0x5b2ecb.30003
mov byte [esi + 0x35d], 1
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x74fa18]
push eax
jmp 0x5b3720
sub eax, 0x7533
cmp eax, 0x57
ja case.0x5b2ecb.30004
movzx ecx, byte [eax + 0x5b4538]
jmp dword [ecx*4 + 0x5b44c4]
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x74f7e8]
push eax
jmp 0x5b3720
push ebx
mov ecx, esi
call fcn.005aaf10
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x54]
call fcn.004011f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xb0]
xor ecx, ebp
call fcn.00613241
add ebp, 0xb4
mov esp, ebp
pop ebp
ret 0xc
push ebx
mov ecx, esi
call fcn.005aaf10
cmp dword [esi + 8], ebx
jne 0x5b3138
cmp dword [esi + 4], ebx
jne 0x5b3138
cmp byte [ebp + 0xbc], 0
je 0x5b3138
mov eax, dword [esi + 0x510]
cmp eax, ebx
je 0x5b2f71
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5b2f71
mov edx, dword [esi + 0x510]
mov eax, dword [edx + 0x20]
push eax
call fcn.005ec2b6
mov edi, eax
jmp 0x5b2f73
xor edi, edi
mov ecx, dword [esi + 0x44]
push ecx
call fcn.004940f0
add esp, 4
push eax
lea ecx, [ebp - 0x20]
call fcn.004030c0
mov byte [ebp - 4], 4
mov eax, dword [esi + 0x1d0]
lea ebx, [esi + 0x20]
push edi
push 0
push 0
push eax
mov edx, dword [ebx]
push edx
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0xec]
call fcn.004f0ca0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xec]
call fcn.005e96b1
cmp eax, 1
jne 0x5b311d
mov eax, dword [esi + 0x10]
test eax, eax
je 0x5b2fdf
push 0
push 0x1472
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x10], 0
mov ecx, dword [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0x78]
push edx
mov ecx, esi
call fcn.005ab230
mov eax, dword [esi + 0x4e0]
test eax, eax
je 0x5b308b
cmp dword [esi + 0x498], 0
jne 0x5b3014
push eax
mov ecx, ebx
call fcn.005c2b90
mov edx, dword [esi + 0x498]
test edx, edx
je 0x5b308b
mov edi, dword [ebp - 0x78]
mov eax, edi
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b3026
sub eax, ebx
inc eax
push eax
push edi
push 1
push 0
push 0x67e62c
push edx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call edi
cmp byte [esi + 0x1c0], 0
je 0x5b306c
mov dword [ebp - 0x28], 1
push 4
lea eax, [ebp - 0x28]
push eax
push 4
push 0
push str.bUNRA
mov ecx, dword [esi + 0x498]
push ecx
call edi
push 0
mov edx, dword [ebp - 0x74]
push edx
push str.EncPassword
push 0x68cf5c
mov eax, dword [esi + 0x498]
push eax
call fcn.005ae320
add esp, 0x14
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 6
mov ecx, dword [esi + 0xab4]
push ecx
mov edx, dword [0x74f7a4]
push edx
push str._r_n_s_r_ndownlResult___ldsetting_new_login_r_n
lea eax, [ebp - 0x14]
push eax
call fcn.00402f80
add esp, 0x10
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [esi + 0x514]
call fcn.005603a0
cmp byte [ebp + 0xc0], 0
je 0x5b30f1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5b30f1
mov esi, dword [esi + 0x4e0]
test esi, esi
je 0x5b30f1
push esi
push 0x1431
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x14]
call fcn.00402570
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xec]
call fcn.004b1d30
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.00402570
jmp 0x5b2eec
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xec]
call fcn.004b1d30
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.00402570
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x74f7a4]
push eax
jmp 0x5b3720
push 0x66b96c
lea ecx, [esi + 0x3ac]
call fcn.00545860
cmp dword [esi + 8], ebx
jne 0x5b32ff
cmp dword [esi + 4], ebx
jne 0x5b32ff
cmp byte [ebp + 0xbc], 0
je 0x5b32ff
push ebx
mov ecx, esi
call fcn.005aaf10
mov eax, dword [esi + 0x510]
cmp eax, ebx
je 0x5b31ac
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5b31ac
mov edx, dword [esi + 0x510]
mov eax, dword [edx + 0x20]
push eax
call fcn.005ec2b6
mov ebx, eax
jmp 0x5b31ae
xor ebx, ebx
mov ecx, dword [esi + 0x44]
push ecx
call fcn.004940f0
add esp, 4
push eax
lea ecx, [ebp - 0x18]
call fcn.004030c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.00402500
mov byte [ebp - 4], 8
cmp byte [esi + 0xa7a], 0
jne 0x5b3213
cmp dword [0x74f55c], 2
jne 0x5b31ee
test byte [0x74f570], 0x10
jne 0x5b3213
lea edi, [esi + 0x944]
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
test eax, eax
je 0x5b3205
push eax
call fcn.00545860
jmp 0x5b3248
lea edx, [esi + 0xa84]
push edx
call fcn.00405920
jmp 0x5b3248
lea edi, [esi + 0x944]
mov eax, dword [edi]
lea edx, [ebp - 0x20]
test eax, eax
je 0x5b322c
mov ecx, dword [esi + 0x948]
push ecx
push eax
jmp 0x5b323a
mov eax, dword [esi + 0xa88]
push eax
mov ecx, dword [esi + 0xa84]
push ecx
push str._s:_ld
push edx
call fcn.00402f80
add esp, 0x10
mov eax, dword [esi + 0xa64]
push ebx
movzx ecx, byte [esi + 0xa7a]
push ecx
push 1
push eax
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xec]
call fcn.004f0ca0
mov bl, 9
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xec]
call fcn.005e96b1
cmp eax, 1
jne 0x5b32d8
mov byte [esi + 0xa7d], al
mov eax, dword [esi + 0x10]
test eax, eax
je 0x5b32a2
push 0
push 0x1472
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x10], 0
mov byte [ebp - 0x24], 1
cmp dword [edi], 0
je 0x5b3321
mov ecx, dword [ebp - 0x78]
push ecx
mov ecx, edi
call fcn.004af2a0
test eax, eax
jne 0x5b32d4
mov edx, dword [ebp - 0x74]
push edx
mov ecx, edi
call fcn.004af310
test eax, eax
je 0x5b3355
mov byte [ebp - 0x24], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xec]
call fcn.004b1d30
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00402570
cmp byte [esi + 0xa7a], 0
mov eax, 0x750418
jne 0x5b3312
mov eax, 0x74f7a8
mov eax, dword [eax]
mov ecx, dword [0x74eb40]
push ecx
push eax
jmp 0x5b3720
mov byte [esi + 0xaa1], 1
mov eax, dword [ebp - 0x78]
push eax
push 0x66ae98
lea ecx, [esi + 0xa8c]
push ecx
call fcn.00402f80
mov edx, dword [ebp - 0x74]
push edx
push 0x66ae98
lea eax, [esi + 0xa90]
push eax
call fcn.00402f80
add esp, 0x18
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0xa
cmp byte [esi + 0xa7a], 0
mov eax, dword [0x750418]
jne 0x5b3374
mov eax, dword [0x74f7a8]
mov ecx, dword [esi + 0xab4]
push ecx
push eax
push str._r_n_s_r_ndownlResult___ldsetting_new_login_r_n
lea edx, [ebp - 0x14]
push edx
call fcn.00402f80
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [esi + 0x514]
call fcn.005603a0
cmp byte [ebp + 0xc0], 0
je 0x5b33c8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5b33c8
mov esi, dword [esi + 0x4e0]
test esi, esi
je 0x5b33c8
push esi
push 0x1431
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00402570
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xec]
call fcn.004b1d30
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.00402570
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00402570
jmp 0x5b2eec
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x74f7bc]
push eax
jmp 0x5b3720
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x74f9f0]
push edx
jmp 0x5b3720
mov ecx, dword [0x74f7b4]
jmp 0x5b3719
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x74f850]
push eax
jmp 0x5b3720
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x74f854]
push edx
jmp 0x5b3720
mov ecx, dword [0x74f858]
jmp 0x5b3719
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x74f7a0]
push eax
jmp 0x5b3720
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x74f9bc]
push edx
jmp 0x5b3720
mov ecx, dword [0x74fa04]
jmp 0x5b3719
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x74fa54]
push eax
jmp 0x5b3720
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x74fa0c]
push edx
jmp 0x5b3720
mov ecx, dword [0x74fa9c]
jmp 0x5b3719
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x74fa14]
push eax
jmp 0x5b3720
lea ecx, [ebp + 0xa0]
push ecx
mov edx, dword [esi + 0x4f4]
push edx
mov eax, dword [esi + 0x4f0]
push eax
mov ecx, esi
call fcn.005ab890
mov dword [ebp], ebx
mov dword [ebp + 8], ebx
xor ecx, ecx
mov word [ebp + 4], cx
mov byte [ebp - 4], 0xd
lea edx, [ebp]
push edx
mov ecx, esi
call fcn.005acc20
lea eax, [ebp + 0xa0]
push eax
lea ecx, [ebp + 0x3c]
call fcn.00406fc0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
call fcn.00402500
mov byte [ebp - 4], 0xf
mov ecx, dword [esi + 0x4f4]
push ecx
mov edx, dword [esi + 0x4f0]
push edx
push str._I64d
lea eax, [ebp - 0x18]
push eax
call fcn.00402f80
add esp, 0x10
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp + 0x48]
call fcn.00406fc0
mov byte [ebp - 4], 0x10
push str._I64d
mov edx, dword [0x74f9dc]
push edx
call fcn.006148e0
add esp, 8
test eax, eax
je 0x5b357a
push 0x66ae98
push str._I64d
jmp 0x5b359b
push 0x66b5ec
mov eax, dword [0x74f9dc]
push eax
call fcn.006148e0
add esp, 8
test eax, eax
je 0x5b35a5
push 0x66ae98
push 0x66b5ec
mov ecx, 0x74f9dc
call fcn.00402c10
cmp dword [esi + 0x54], ebx
je 0x5b35af
mov edi, dword [esi + 0x54]
jmp 0x5b35b2
lea edi, [esi + 0x58]
mov edx, dword [ebp + 0x48]
cmp edx, ebx
jne 0x5b35bc
lea edx, [ebp + 0x4c]
mov ecx, dword [ebp + 0x3c]
cmp ecx, ebx
jne 0x5b35c6
lea ecx, [ebp + 0x40]
mov eax, dword [ebp]
cmp eax, ebx
jne 0x5b35d0
lea eax, [ebp + 4]
mov ebx, dword [0x74eb40]
push ebx
push edi
push edx
push ecx
push eax
mov ecx, dword [0x74f9dc]
push ecx
lea ecx, [ebp + 0x54]
call fcn.0043b410
mov byte [ebp - 4], 0xf
lea ecx, [ebp + 0x48]
call fcn.004011f0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
call fcn.00402570
mov byte [ebp - 4], 0xd
lea ecx, [ebp + 0x3c]
call fcn.004011f0
mov byte [ebp - 4], 3
lea ecx, [ebp]
call fcn.004011f0
jmp 0x5b3728
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x74f890]
push edx
jmp 0x5b3720
mov ecx, dword [0x750200]
jmp 0x5b3719
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x7502ac]
push eax
jmp 0x5b3720
lea eax, [esi + 0x518]
push eax
lea ecx, [ebp + 0x48]
call fcn.00402180
mov byte [ebp - 4], 0x13
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jne 0x5b366c
lea eax, [ebp + 0x4c]
mov edx, dword [0x74fef4]
mov ecx, dword [0x74eb40]
push ecx
push eax
push edx
lea ecx, [ebp + 0x54]
call fcn.004021b0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
call fcn.004011f0
jmp 0x5b3728
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 0x14
mov eax, dword [0x7503c8]
push eax
push 0x66ae98
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f80
push 0x66d294
mov edx, dword [ebp - 0x14]
push edx
call fcn.006159a0
add esp, 0x14
cmp eax, ebx
je 0x5b36cc
mov byte [eax], 0
mov eax, dword [0x74eb40]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00402570
jmp 0x5b3728
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x750568]
push eax
jmp 0x5b3720
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x75056c]
push edx
jmp 0x5b3720
mov ecx, dword [0x750570]
jmp 0x5b3719
mov ecx, dword [0x74f7b8]
mov eax, dword [0x74eb40]
push eax
push ecx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5b3747
mov edx, dword [esi + 0x4e0]
push edx
push 0x13c7
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0xab4]
add eax, 0xffff8abe
cmp eax, 0x38
ja case.0x5b3762.30019
movzx eax, byte [eax + 0x5b459c]
jmp dword [eax*4 + 0x5b4590]
mov ecx, dword [esi + 0x150]
or ecx, dword [esi + 0x154]
je case.0x5b3762.30019
push 0x66b968
lea ecx, [ebp + 0x54]
call fcn.00405330
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x7502ac]
push eax
lea ecx, [ebp + 0x48]
call fcn.0045aac0
mov byte [ebp - 4], 0x18
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x5b37ab
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405330
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
call fcn.004011f0
mov cl, byte [esi + 0x195]
test cl, cl
jne 0x5b3936
mov eax, dword [esi + 0x158]
test eax, eax
jle 0x5b37e9
mov edx, dword [esi + 0x15c]
sub edx, eax
cmp edx, 0x3c
jl 0x5b3921
cmp byte [0x74f0a7], 0
jne 0x5b38db
mov eax, dword [esi + 0x108]
cmp eax, dword [esi + 0x150]
jne 0x5b38db
mov ecx, dword [esi + 0x10c]
cmp ecx, dword [esi + 0x154]
jne 0x5b38db
cmp dword [esi + 0xdc], 0
je 0x5b38db
mov ebx, dword [esi + 0x134]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b3832
sub eax, edx
je 0x5b38db
mov edi, dword [esi + 0x104]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b3850
sub eax, edx
je 0x5b38db
mov edx, ebx
mov eax, edi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x5b3883
test cl, cl
je 0x5b387f
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x5b3883
add eax, 2
add edx, 2
test cl, cl
jne 0x5b3863
xor eax, eax
jmp 0x5b3888
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x5b38db
mov ecx, ebx
mov eax, dword [esi + 0xdc]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5b38b4
test dl, dl
je 0x5b38b0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5b38b4
add eax, 2
add ecx, 2
test dl, dl
jne 0x5b3894
xor eax, eax
jmp 0x5b38b9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x5b38db
mov byte [ebp - 0x21], 1
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x7501a8]
push eax
lea ecx, [ebp + 0x54]
call fcn.00401980
jmp case.0x5b3762.30019
push str._r_n_r_n
lea ecx, [ebp + 0x54]
call fcn.00405330
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x7502cc]
push edx
lea ecx, [ebp + 0x48]
call fcn.0045aac0
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x5b390c
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405330
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x48]
jmp 0x5b3a97
test cl, cl
jne 0x5b3936
push 1
mov eax, dword [esi + 0x4e0]
push eax
lea ecx, [esi + 0x20]
call fcn.005c50e0
cmp dword [esi + 0x4f4], 0
jl 0x5b3965
jg 0x5b394a
cmp dword [esi + 0x4f0], 0
jbe 0x5b3965
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x7502d0]
push edx
lea ecx, [ebp + 0x54]
call fcn.00401980
jmp case.0x5b3762.30019
xor bl, bl
test byte [esi + 0x174], 0x70
je 0x5b3972
mov bl, 1
xor edi, edi
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x14], edi
xor eax, eax
mov word [ebp + 0x10], ax
mov byte [ebp - 4], 0x19
lea ecx, [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.005acc20
test bl, bl
je 0x5b3a59
mov edx, dword [esi + 0xe8]
mov eax, edx
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b39a2
mov ecx, 0x74f718
sub eax, ebx
je 0x5b39ba
push edx
call fcn.0053c510
jmp 0x5b39c3
mov edx, dword [esi + 0x20]
push edx
call fcn.0053c3f0
cmp dword [esi + 0x11c], edi
je 0x5b39d3
mov eax, dword [esi + 0x11c]
jmp 0x5b39d9
lea eax, [esi + 0x120]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x5b39e0
sub eax, edx
sar eax, 1
je 0x5b3a09
cmp dword [esi + 0x11c], edi
je 0x5b3a01
mov eax, dword [esi + 0x11c]
jmp 0x5b3a13
lea eax, [esi + 0x120]
jmp 0x5b3a13
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x5b3a13
lea eax, [ebp + 0x10]
mov ecx, dword [0x74eb40]
push ecx
push eax
mov edx, dword [0x7501ac]
push edx
lea ecx, [ebp + 0x54]
call fcn.004021b0
test dword [esi + 0x174], 0x100
jne 0x5b3a90
mov eax, dword [esi + 0x158]
cmp eax, edi
jle 0x5b3a90
mov ecx, dword [esi + 0x15c]
sub ecx, eax
cmp ecx, 0x3c
jge 0x5b3a90
cmp byte [ebp - 0x19], 0
jne 0x5b3a90
mov byte [ebp - 0x1a], 1
jmp 0x5b3a90
cmp byte [esi + 0x193], 0
je 0x5b3a7a
cmp byte [0x74f0a7], 0
jne 0x5b3a7a
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x7501a8]
push eax
jmp 0x5b3a88
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x7502d0]
push edx
lea ecx, [ebp + 0x54]
call fcn.00401980
mov byte [ebp - 4], 3
lea ecx, [ebp + 0xc]
call fcn.004011f0
cmp dword [esi + 0xab4], 0x7582
je 0x5b3b5a
cmp dword [esi + 0x514], 0
je 0x5b3b5a
push str._r_n_r_n
lea ecx, [ebp + 0x54]
call fcn.00405330
xor edi, edi
mov dword [ebp + 0xa4], edi
mov dword [ebp + 0xac], edi
xor eax, eax
mov word [ebp + 0xa8], ax
mov bl, 0x1b
mov byte [ebp - 4], bl
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x74fcd4]
push edx
lea ecx, [ebp + 0xa4]
call fcn.00401980
mov eax, dword [ebp + 0xa4]
cmp eax, edi
jne 0x5b3b0b
lea eax, [ebp + 0xa8]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405330
mov eax, dword [0x74eb40]
push eax
mov ecx, dword [esi + 0x514]
push ecx
lea ecx, [ebp + 0x48]
call fcn.0045aac0
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp + 0x48]
cmp eax, edi
jne 0x5b3b37
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405330
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.004011f0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0xa4]
call fcn.004011f0
cmp byte [ebp - 0x19], 0
je 0x5b3c88
push str._r_n_r_n
lea ecx, [ebp + 0x54]
call fcn.00405330
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x75053c]
push eax
lea ecx, [ebp + 0x3c]
call fcn.0045aac0
mov bl, 0x1d
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5b3b95
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405330
mov byte [ebp - 0x22], 0
mov edx, dword [esi + 0x148]
mov eax, edx
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b3bb0
sub eax, edi
je 0x5b3c7c
push 0x5c
push edx
call fcn.006159e0
add esp, 8
mov edi, eax
test edi, edi
je 0x5b3bd3
inc edi
jmp 0x5b3bd9
mov edi, dword [esi + 0x148]
push 0xa
push str.chromeexe
push edi
call fcn.00617c6f
add esp, 0xc
test eax, eax
je 0x5b3c33
push str.idmbrbtn.dll
push edi
call fcn.00614d5e
add esp, 8
test eax, eax
jne 0x5b3c7c
mov eax, dword [esi + 0x1ac]
push str.Chrome
push eax
call fcn.006148e0
add esp, 8
test eax, eax
je 0x5b3c7c
mov eax, dword [esi + 0x1ac]
push str.Firefox
push eax
call fcn.006148e0
add esp, 8
test eax, eax
jne 0x5b3c7c
mov byte [ebp - 0x22], 1
push 0x677af8
lea ecx, [ebp + 0x54]
call fcn.00405330
mov ecx, dword [0x74eb40]
push ecx
mov edx, dword [0x750540]
push edx
lea ecx, [ebp + 0x48]
call fcn.0045aac0
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp + 0x48]
test eax, eax
jne 0x5b3c68
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405330
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.004011f0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x3c]
call fcn.004011f0
mov eax, dword [ebp + 0x54]
xor ebx, ebx
cmp eax, ebx
jne 0x5b3c94
lea eax, [ebp + 0x58]
mov ecx, dword [0x74eb40]
push ecx
push eax
lea edx, [ebp - 0x2c]
push edx
call fcn.00402a70
add esp, 0xc
mov byte [ebp - 4], 0x1f
lea ecx, [esi + 0x20]
push ebx
mov eax, dword [esi + 0x4e0]
push eax
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [esi + 0xab4]
push eax
call fcn.005bf430
lea edi, [esi + 0x514]
mov ecx, dword [ebp - 0x2c]
push ecx
mov ecx, edi
call fcn.005603a0
mov edx, dword [esi + 0xab4]
push edx
push str._r_ndownlResult___ld_r_n
lea eax, [ebp + 0x60]
push eax
call fcn.0061611b
add esp, 0xc
lea ecx, [ebp + 0x60]
push ecx
mov ecx, edi
call fcn.005603a0
mov eax, dword [esi + 0xab4]
add eax, 0xffff8abe
cmp eax, 0x38
ja case.0x5b3d16.30019
movzx edx, byte [eax + 0x5b45e4]
jmp dword [edx*4 + 0x5b45d8]
mov eax, dword [esi + 0x150]
or eax, dword [esi + 0x154]
je case.0x5b3d16.30019
cmp dword [esi + 8], ebx
jne case.0x5b3d16.30019
cmp dword [esi + 4], ebx
jne case.0x5b3d16.30019
cmp byte [ebp + 0xbc], 0
je case.0x5b3d16.30019
cmp dword [esi + 0x14], ebx
je case.0x5b3d16.30019
cmp dword [esi + 0x4e0], ebx
je case.0x5b3d16.30019
cmp byte [esi + 0x195], 0
jne case.0x5b3d16.30019
cmp byte [ebp - 0x21], 0
jne case.0x5b3d16.30019
push ebx
mov ecx, esi
call fcn.005aaf10
mov ecx, dword [esi + 0x4e0]
push ecx
push 0x1463
push 0x111
mov edx, dword [esi + 0x14]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [esi + 0x35d], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00402570
jmp 0x5b2eec
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x2c], ebx
xor eax, eax
mov word [ebp + 0x28], ax
mov byte [ebp - 4], 0x20
lea ecx, [ebp + 0x24]
push ecx
mov ecx, esi
call fcn.005acc20
cmp dword [esi + 8], ebx
jne 0x5b4262
cmp dword [esi + 4], ebx
jne 0x5b4262
cmp byte [ebp + 0xbc], 0
je 0x5b4262
cmp dword [esi + 0x4e0], ebx
je 0x5b4262
cmp dword [esi + 0x50c], ebx
jne 0x5b4262
mov eax, dword [esi + 0xab4]
cmp eax, 0x7540
je 0x5b4262
cmp eax, 0x7553
jne 0x5b3e56
mov eax, dword [ebp + 0x24]
cmp eax, ebx
mov ecx, eax
jne 0x5b3e0b
lea ecx, [ebp + 0x28]
mov eax, dword [ebp + 0x54]
cmp eax, ebx
jne 0x5b3e15
lea eax, [ebp + 0x58]
push 0x10024
push ecx
push eax
push ebx
call fcn.0046dfd0
add esp, 0x10
cmp eax, 6
jne 0x5b4262
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x5b4262
mov edx, dword [esi + 0x4e0]
push edx
push 0x13bb
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x5b4262
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x38], ebx
xor eax, eax
mov word [ebp + 0x34], ax
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x5b3e7f
mov ecx, dword [0x74eb40]
push ecx
push eax
lea ecx, [ebp + 0x30]
call fcn.00401980
jmp 0x5b3e92
mov eax, dword [ebp + 0x24]
cmp eax, ebx
jne 0x5b3e89
lea eax, [ebp + 0x28]
push eax
lea ecx, [ebp + 0x30]
call fcn.004017f0
cmp dword [esi + 0xab4], 0x80090326
jne 0x5b3f50
cmp dword [0x74e9dc], ebx
jne 0x5b3f50
xor edi, edi
mov dword [ebp + 0x3c], edi
mov dword [ebp + 0x44], edi
xor edx, edx
mov word [ebp + 0x40], dx
mov bl, 0x22
mov byte [ebp - 4], bl
mov eax, dword [0x74eb40]
push eax
mov ecx, dword [0x7504d0]
push ecx
lea ecx, [ebp + 0x48]
call fcn.0045aac0
mov byte [ebp - 4], 0x23
mov eax, dword [ebp + 0x48]
cmp eax, edi
mov ecx, eax
jne 0x5b3ee6
lea ecx, [ebp + 0x4c]
mov eax, dword [ebp + 0x54]
cmp eax, edi
jne 0x5b3ef0
lea eax, [ebp + 0x58]
push edi
push ecx
push eax
push str._s_r_n_r_n_r_n_s
lea ecx, [ebp + 0x3c]
call fcn.00402320
mov eax, dword [ebp + 0x30]
cmp eax, edi
mov ecx, eax
jne 0x5b3f0c
lea ecx, [ebp + 0x34]
mov eax, dword [ebp + 0x3c]
cmp eax, edi
jne 0x5b3f16
lea eax, [ebp + 0x40]
push 0x50034
push ecx
push eax
push edi
call fcn.0046dfd0
add esp, 0x10
cmp eax, 6
jne 0x5b3f39
push str.https:__www.internetdownloadmanager.com_support_xp_https_problems.html
push edi
call fcn.004ac020
add esp, 8
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x48]
call fcn.004011f0
mov byte [ebp - 4], 0x21
lea ecx, [ebp + 0x3c]
jmp 0x5b424f
cmp byte [esi + 0x35d], 0
je 0x5b4091
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x50], ebx
xor edx, edx
mov word [ebp + 0x4c], dx
mov byte [ebp - 4], 0x24
mov eax, dword [0x74eb40]
push eax
mov ecx, dword [0x75042c]
push ecx
lea ecx, [ebp + 0x3c]
call fcn.0045aac0
mov byte [ebp - 4], 0x25
mov eax, dword [ebp + 0x3c]
cmp eax, ebx
mov ecx, eax
jne 0x5b3f92
lea ecx, [ebp + 0x40]
mov eax, dword [ebp + 0x54]
cmp eax, ebx
jne 0x5b3f9c
lea eax, [ebp + 0x58]
push ebx
push ecx
push eax
push str._s_r_n_r_n_r_n_s
lea ecx, [ebp + 0x48]
call fcn.00402320
mov eax, dword [ebp + 0x30]
cmp eax, ebx
mov ecx, eax
jne 0x5b3fb8
lea ecx, [ebp + 0x34]
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jne 0x5b3fc2
lea eax, [ebp + 0x4c]
push 0x50034
push ecx
push eax
push ebx
call fcn.0046dfd0
add esp, 0x10
cmp eax, 6
jne 0x5b4080
lea ecx, [ebp - 0x14]
call fcn.00402500
mov bl, 0x26
mov byte [ebp - 4], bl
push 0
lea edx, [ebp - 0x14]
push edx
lea edi, [esi + 0x20]
mov ecx, edi
call fcn.00587240
lea ecx, [ebp - 0x18]
call fcn.00402500
mov byte [ebp - 4], 0x27
mov eax, dword [edi]
test eax, eax
mov ecx, eax
jne 0x5b4011
mov ecx, 0x66b96c
cmp byte [esi + 0xaa0], 0
jne 0x5b4027
cmp dword [esi + 0x944], 0
jne 0x5b4027
xor eax, eax
jmp 0x5b402c
mov eax, 1
push ecx
push eax
xor eax, eax
cmp byte [esi + 0x19b], al
setne al
push eax
mov ecx, dword [esi + 0x1cc]
push ecx
mov edx, dword [esi + 0xab4]
push edx
push str.https:__www.internetdownloadmanager.com_register_new_faq_How_to_configure_Firewalls_for_IDM.html
push str._s_err_ldocr_ldv6_ldproxy_ldsrv_s
lea eax, [ebp - 0x18]
push eax
call fcn.00402f80
mov ecx, dword [ebp - 0x18]
push ecx
push 0
call fcn.004ac020
add esp, 0x28
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.00402570
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x14]
call fcn.00402570
mov byte [ebp - 4], 0x24
lea ecx, [ebp + 0x3c]
call fcn.004011f0
jmp 0x5b4248
mov eax, dword [ebp + 0x54]
cmp eax, ebx
jne 0x5b409b
lea eax, [ebp + 0x58]
push eax
lea ecx, [ebp + 0x48]
call fcn.00402180
mov bl, 0x28
mov byte [ebp - 4], bl
cmp byte [ebp - 0x1a], 0
je 0x5b41a8
cmp byte [ebp - 0x21], 0
je 0x5b40c2
mov byte [ebp - 0x1a], 0
jmp 0x5b41a8
mov dword [ebp - 0x30], 1
test dword [esi + 0x174], 0x100000
jne 0x5b41a8
mov edx, dword [esi + 0x148]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b40e4
sub eax, edi
je 0x5b41a8
push 0x5c
push edx
call fcn.006159e0
add esp, 8
mov edi, eax
test edi, edi
je 0x5b4107
inc edi
jmp 0x5b410d
mov edi, dword [esi + 0x148]
push 0xb
push str.firefox.exe
push edi
call fcn.0061a99c
add esp, 0xc
test eax, eax
je 0x5b415d
push 0xa
push str.chrome.exe
push edi
call fcn.00617c6f
add esp, 0xc
test eax, eax
je 0x5b415d
push 0xa
push str.msedge.exe
push edi
call fcn.00617c6f
add esp, 0xc
test eax, eax
je 0x5b415d
push 0x13
push str.MicrosoftEdgeCP.exe
push edi
call fcn.00617c6f
add esp, 0xc
test eax, eax
jne 0x5b41a8
mov dword [ebp - 0x30], 0
mov edx, dword [0x74eb40]
push edx
mov eax, dword [0x750534]
push eax
lea ecx, [ebp + 0x3c]
call fcn.0045aac0
mov byte [ebp - 4], 0x29
push str._r_n_r_n
lea ecx, [ebp + 0x48]
call fcn.00405330
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x5b4194
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x48]
call fcn.00405330
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x3c]
call fcn.004011f0
mov eax, dword [esi + 0xab4]
cmp eax, 0xffffffff
je 0x5b41bf
cmp eax, 0x753b
mov eax, 0x30
jne 0x5b41c4
mov eax, 0x10
mov edx, dword [ebp + 0x30]
test edx, edx
jne 0x5b41ce
lea edx, [ebp + 0x34]
mov ecx, dword [ebp + 0x48]
test ecx, ecx
jne 0x5b41d8
lea ecx, [ebp + 0x4c]
or eax, 0x50000
push eax
push edx
push ecx
push 0
call fcn.0046dfd0
add esp, 0x10
cmp byte [ebp - 0x1a], 0
je 0x5b4234
cmp byte [esi + 0x36b], 0
je 0x5b4219
cmp dword [esi + 0x498], 0
jne 0x5b4211
mov ecx, dword [esi + 0x4e0]
push ecx
lea ecx, [esi + 0x20]
call fcn.005c2b90
lea ecx, [esi + 0x20]
call fcn.005c5d30
mov edx, dword [esi + 0x4e0]
push edx
push 0x14cd
push 0x111
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [esi + 0xab4], 0x757a
jne 0x5b4248
lea ecx, [esi + 0x20]
call fcn.005c1200
mov byte [ebp - 4], 0x21
lea ecx, [ebp + 0x48]
call fcn.004011f0
mov byte [ebp - 4], 0x20
lea ecx, [ebp + 0x30]
call fcn.004011f0
xor ebx, ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x5b43c4
cmp eax, 3
jne 0x5b4282
cmp dword [esi + 0xab4], 0x756e
je 0x5b432a
cmp byte [ebp + 0xbc], 0
je 0x5b432a
cmp dword [esi + 0xab4], 0xffffffff
jne 0x5b42bf
push 0x50010
push 0x66ad78
mov ecx, dword [0x74fa00]
push ecx
push ebx
call fcn.0046db70
add esp, 0x10
push ebx
mov ecx, esi
call fcn.005aaf10
jmp 0x5b43cb
push 0x66ad78
lea ecx, [ebp + 0x48]
call fcn.00406fc0
mov byte [ebp - 4], 0x2a
mov eax, dword [esi + 0xab4]
cmp eax, 0xffffffff
je 0x5b42e7
cmp eax, 0x753b
mov eax, 0x30
jne 0x5b42ec
mov eax, 0x10
mov edx, dword [ebp + 0x48]
cmp edx, ebx
jne 0x5b42f6
lea edx, [ebp + 0x4c]
mov ecx, dword [ebp + 0x54]
cmp ecx, ebx
jne 0x5b4300
lea ecx, [ebp + 0x58]
or eax, 0x50000
push eax
push edx
push ecx
push ebx
call fcn.0046dfd0
add esp, 0x10
mov byte [ebp - 4], 0x20
lea ecx, [ebp + 0x48]
call fcn.004011f0
push ebx
mov ecx, esi
call fcn.005aaf10
jmp 0x5b43cb
cmp eax, 4
jne 0x5b43ba
cmp byte [esi + 0x35d], 0
je 0x5b43ba
mov byte [esi + 0x35d], 0
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push str.bHDIShwd
mov ecx, dword [0x74ea0c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x5b43ba
mov dword [ebp - 0x18], 1
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push ebx
push str.bHDIShwd
mov eax, dword [0x74ea0c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.004114e0
push eax
lea ecx, [ebp - 0xc8]
call fcn.00523290
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xc8]
call fcn.005e96b1
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xc8]
call fcn.00523310
push ebx
mov ecx, esi
call fcn.005aaf10
jmp 0x5b43cb
mov byte [esi + 0x35d], 0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp + 0x24]
call fcn.004011f0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00402570
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x54]
call fcn.004011f0
mov dword [ebp - 4], 0xffffffff
jmp 0x5b2ef8