Function at 0x48e9b0
Capabilities:
Check os version
Get common file path
Get memory capacity
Persist via appinit_dlls registry key
Read .ini file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2844
call fcn.004d9280
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
movzx ecx, byte [0x4ebdd6]
push esi
mov byte [ebp - 0x2822], cl
mov ecx, dword [str.R1__]
push edi
mov dword [ebp - 0x2c], ecx
movzx ecx, byte [0x4ebef8]
mov byte [ebp - 0x18], cl
mov ecx, 0xf
mov esi, str.SoftwareMicrosoftInternet_ExplorerMain_Default_Page_URL_
lea edi, [ebp - 0xa58]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movzx eax, word [0x4ebdd4]
movsb byte es:[edi], byte [esi]
mov edx, dword [str.R0__]
mov ecx, 0xe
mov esi, str.SoftwareMicrosoftInternet_ExplorerMain_Start_Page_
lea edi, [ebp - 0x9dc]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xe
mov esi, str.SoftwareMicrosoftInternet_ExplorerMain_Window_Title_
lea edi, [ebp - 0xa18]
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x2824], ax
movzx eax, word [0x4ef564]
mov dword [ebp - 0x34], edx
mov dx, word [0x4ef56c]
mov word [ebp - 0x30], ax
mov eax, dword [str.HKCU]
movsw word es:[edi], word [esi]
mov word [ebp - 0x28], dx
mov edx, dword [str.HKLM]
mov dword [ebp - 0x1c], eax
mov al, byte [0x4ebeac]
push 0x7f02
push 0
mov dword [ebp - 0x2844], ebx
mov dword [ebp - 0x24], edx
mov byte [ebp - 0x20], al
movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x2834], esi
test esi, esi
je 0x49340b
lea ecx, [ebp - 0x950]
push ecx
mov ecx, 3
call fcn.0047c870
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 4
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x950]
push eax
push 0x5016f0
lea ecx, [ebp - 0x550]
push str._s_installed__running__s_s
push ecx
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x14
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call edi
push eax
lea ecx, [ebp - 0x550]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x80
push str.RegNumber
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x950]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea edx, [ebp - 0x950]
push edx
call edi
cmp eax, 8
jle 0x48eb84
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x950]
push ecx
lea edx, [ebp - 0x550]
push 0x4ef644
push edx
call ebx
add esp, 0x10
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call edi
push eax
lea edx, [ebp - 0x550]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x1368]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp word [ebp - 0x1360], 0xc
jbe 0x48ebb5
mov ecx, 0xfff4
add word [ebp - 0x1360], cx
push 0x4ebdf8
lea edx, [ebp - 0x150]
push edx
jmp 0x48ebc1
push 0x4ebdfc
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
movzx edx, word [ebp - 0x135c]
movzx eax, word [ebp - 0x135e]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [ebp - 0x150]
push ecx
movzx ecx, word [ebp - 0x1360]
push edx
push eax
push ecx
lea edx, [ebp - 0x960]
push str._2d:_02d:_02d__s
push edx
call ebx
movzx eax, word [ebp - 0x1368]
movzx ecx, word [ebp - 0x1362]
movzx edx, word [ebp - 0x1366]
push eax
push ecx
push edx
lea eax, [ebp - 0x150]
push str._2d__02d__4d
push eax
call ebx
add esp, 0x2c
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x150]
push edx
lea eax, [ebp - 0x960]
push eax
lea ecx, [ebp - 0x550]
push str.Scan_saved_at__s__on__s_s
push ecx
call ebx
add esp, 0x14
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call edi
push eax
lea ecx, [ebp - 0x550]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ebx, [ebp - 0x950]
call fcn.004cde50
lea edx, [ebp - 0x2824]
push edx
mov eax, ebx
push eax
lea ecx, [ebp - 0x550]
push str.Platform:__s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call edi
push eax
lea ecx, [ebp - 0x550]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x94
lea edx, [ebp - 0x1420]
push 0
push edx
call fcn.004d29c0
add esp, 0xc
lea eax, [ebp - 0x1420]
push eax
mov dword [ebp - 0x1420], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x506e0c], 0
je 0x48ed23
mov eax, dword [ebp - 0x1410]
lea ecx, [ebp - 0x2824]
push ecx
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x140c]
push edx
mov edx, dword [ebp - 0x1418]
push eax
mov eax, dword [ebp - 0x141c]
push ecx
push edx
push eax
push str.Windows_x64_Version__d._d_Build__d___d__s_s
lea ecx, [ebp - 0x550]
push ecx
jmp 0x48ed59
mov ecx, dword [ebp - 0x1410]
lea edx, [ebp - 0x2824]
push edx
mov edx, dword [ebp - 0x1414]
lea eax, [ebp - 0x140c]
push eax
mov eax, dword [ebp - 0x1418]
push ecx
mov ecx, dword [ebp - 0x141c]
push edx
push eax
push ecx
push str.Windows__x86__Version__d._d_Build__d___d__s_s
lea edx, [ebp - 0x550]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea edx, [ebp - 0x550]
push edx
push esi
call ebx
cmp dword [0x506e0c], 0
je 0x48edb9
mov eax, dword [0x4f8b78]
mov ecx, dword [0x4f8b7c]
mov dword [ebp - 0x283c], eax
mov dword [ebp - 0x2840], ecx
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0x20106
push 0x1400
lea edx, [ebp - 0x2820]
push 0
push edx
call fcn.004d29c0
lea eax, [ebp - 0x140]
add esp, 0xc
push eax
call fcn.0047bd50
add esp, 4
lea ecx, [ebp - 0x140]
call fcn.0047af20
test eax, eax
je 0x48ee50
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x2820]
call fcn.004c0890
add esp, 4
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x2420]
push eax
lea ecx, [ebp - 0x1c20]
push ecx
lea edx, [ebp - 0x2820]
push edx
lea eax, [ebp - 0x550]
push str.Browser:__s____s_version__s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call edi
push eax
lea eax, [ebp - 0x550]
push eax
push esi
call ebx
push 0x80
lea edx, [ebp - 0x7d0]
mov ecx, 0xc
call fcn.004ca1e0
add esp, 4
push 0x104
lea ecx, [ebp - 0x7d0]
push 0x4e2d04
push ecx
lea ecx, [ebp - 0x140]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea ebx, [ebp - 0x140]
lea edx, [ebp - 0x140]
dec ebx
push edx
mov dword [ebp - 0x2838], ebx
call edi
cmp byte [eax + ebx], 0x3b
jne 0x48eeb5
lea eax, [ebp - 0x140]
push eax
call edi
mov byte [eax + ebx], 0
cmp dword [0x506e0c], 0
je 0x48eed6
mov ecx, dword [ebp - 0x283c]
mov edx, dword [ebp - 0x2840]
mov dword [0x4f8b78], ecx
mov dword [0x4f8b7c], edx
push 0x4ec204
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x140]
call fcn.0047af20
test eax, eax
je 0x48ef68
push 0x1400
lea ecx, [ebp - 0x2820]
push 0
push ecx
call fcn.004d29c0
lea edx, [ebp - 0x140]
add esp, 0xc
push edx
lea ecx, [ebp - 0x2820]
call fcn.004c0890
add esp, 4
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x2420]
push ecx
lea edx, [ebp - 0x1c20]
push edx
lea eax, [ebp - 0x550]
push str.MSIE:__s___s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call edi
push eax
lea eax, [ebp - 0x550]
push eax
jmp 0x48ef9e
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x550]
push str.MSIE:_Internet_Explorer_Not_found._s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call edi
push eax
lea edx, [ebp - 0x550]
push edx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call ebx
push 0x43
mov byte [ebp - 0x550], 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, 0
je 0x48eff9
dec eax
je 0x48efe4
dec eax
je 0x48efcf
lea eax, [ebp - 0x2824]
push eax
push str.Boot_mode:_Unknown_s
jmp 0x48f005
lea edx, [ebp - 0x2824]
push edx
push str.Boot_mode:_Safe_with_Network_s
lea eax, [ebp - 0x550]
push eax
jmp 0x48f00c
lea ecx, [ebp - 0x2824]
push ecx
push str.Boot_mode:_Safe_s
lea edx, [ebp - 0x550]
push edx
jmp 0x48f00c
lea eax, [ebp - 0x2824]
push eax
push str.Boot_mode:_Normal_s
lea ecx, [ebp - 0x550]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call edi
push eax
lea ecx, [ebp - 0x550]
push ecx
push esi
call ebx
push 0x4ebdd4
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x14]
push ecx
call edi
push eax
lea edx, [ebp - 0x14]
push edx
push esi
call ebx
push 0x200
lea edx, [ebp - 0x550]
mov ecx, 0x332
call fcn.004ca1e0
add esp, 4
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x550]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call edi
push eax
lea ecx, [ebp - 0x550]
push ecx
push esi
call ebx
call fcn.00486ab0
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], 0
test eax, eax
jle 0x48f178
jmp 0x48f0c0
mov ebx, dword [ebp - 0x2828]
lea edi, [ebp - 0x550]
call fcn.004c22f0
lea edi, [ebp - 0x140]
call fcn.004c22f0
mov edi, ebx
push edi
lea ebx, [ebp - 0x750]
call fcn.004c2260
add esp, 4
push 0x1400
lea edx, [ebp - 0x2820]
push 0
push edx
call fcn.004d29c0
lea eax, [ebp - 0x140]
add esp, 0xc
push eax
lea ecx, [ebp - 0x2820]
call fcn.004c0890
add esp, 4
lea ecx, [ebp - 0x140]
push ecx
lea edx, [ebp - 0x550]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x550]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0x550]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc edi
mov dword [ebp - 0x2828], edi
cmp edi, dword [ebp - 0x2830]
jl 0x48f0c0
push 0x4ebdd4
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x14]
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea edx, [ebp - 0x14]
push edx
push esi
call ebx
push 0x80
lea edx, [ebp - 0x7d0]
mov ecx, 0x26f
call fcn.004ca1e0
add esp, 4
push 0x100
lea eax, [ebp - 0x7d0]
push str.Default_Page_URL
push eax
lea ecx, [ebp - 0xb58]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x48f236
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0xb58]
push edx
lea eax, [ebp - 0xa58]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x550]
push str._s_s_s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call edi
push eax
lea eax, [ebp - 0x550]
push eax
push esi
call ebx
push 0x100
lea ecx, [ebp - 0x7d0]
push str.Start_Page
push ecx
lea ecx, [ebp - 0xb58]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x48f2ad
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0xb58]
push eax
lea ecx, [ebp - 0x9dc]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x550]
push str._s_s_s_s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call edi
push eax
lea ecx, [ebp - 0x550]
push ecx
push esi
call ebx
cmp dword [0x506e0c], 0
je 0x48f2e1
mov edx, dword [0x4f8b78]
mov eax, dword [0x4f8b7c]
mov dword [ebp - 0x283c], edx
mov dword [ebp - 0x2840], eax
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0x20106
push 0x100
lea ecx, [ebp - 0x7d0]
push str.Default_Page_URL
push ecx
lea ecx, [ebp - 0xb58]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x48f358
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0xb58]
push eax
lea ecx, [ebp - 0xa58]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x550]
push str._s_s_s_s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call edi
push eax
lea ecx, [ebp - 0x550]
push ecx
push esi
call ebx
push 0x100
lea edx, [ebp - 0x7d0]
push str.Start_Page
push edx
lea ecx, [ebp - 0xb58]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x48f3cf
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0xb58]
push ecx
lea edx, [ebp - 0x9dc]
push edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x550]
push str._s_s_s_s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call edi
push eax
lea edx, [ebp - 0x550]
push edx
push esi
call ebx
push 0x100
lea eax, [ebp - 0x7d0]
push str.Window_Title
push eax
lea ecx, [ebp - 0xb58]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x48f446
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0xb58]
push edx
lea eax, [ebp - 0xa18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x550]
push str._s_s_s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call edi
push eax
lea eax, [ebp - 0x550]
push eax
push esi
call ebx
push 0x100
lea ecx, [ebp - 0x7d0]
push str.Window_Title
push ecx
lea ecx, [ebp - 0xb58]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x48f4bd
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0xb58]
push eax
lea ecx, [ebp - 0xa18]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x550]
push str._s_s_s_s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call edi
push eax
lea ecx, [ebp - 0x550]
push ecx
push esi
call ebx
cmp dword [0x506e0c], 0
je 0x48f4dd
mov edx, dword [ebp - 0x283c]
mov eax, dword [ebp - 0x2840]
mov dword [0x4f8b78], edx
mov dword [0x4f8b7c], eax
push 0x104
lea ecx, [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._system.ini
lea edx, [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x140]
push eax
push 0x200
lea ecx, [ebp - 0x750]
push ecx
push 0x4e27f8
push str.Shell
push str.Boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x48f582
push str.Explorer.exe
lea edx, [ebp - 0x750]
push edx
call fcn.00483650
test eax, eax
je 0x48f582
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x750]
push ecx
lea edx, [ebp - 0x550]
push str.F0___system.ini:_Shell_s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call edi
push eax
lea edx, [ebp - 0x550]
push edx
push esi
call ebx
push 0x200
lea eax, [ebp - 0x750]
push eax
push 0x4e27f8
push 0x4ee760
push str.Windows
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
test eax, eax
je 0x48f5e7
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x750]
push edx
lea eax, [ebp - 0x550]
push str.F1___win.ini:_run_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call edi
push eax
lea eax, [ebp - 0x550]
push eax
push esi
call ebx
push 0x200
lea ecx, [ebp - 0x750]
push ecx
push 0x4e27f8
push str.load
push str.Windows
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
test eax, eax
je 0x48f64c
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x750]
push eax
lea ecx, [ebp - 0x550]
push str.F1___win.ini:_load_s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call edi
push eax
lea ecx, [ebp - 0x550]
push ecx
push esi
call ebx
push 0x104
lea edx, [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._system.ini
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x140]
push ecx
push 0x200
lea edx, [ebp - 0x750]
push edx
push 0x4e27f8
push str.UserInit
push str.Boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x48f6dc
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x750]
push ecx
lea edx, [ebp - 0x550]
push str.F2___REG:_system.ini:_UserInit_s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call edi
push eax
lea edx, [ebp - 0x550]
push edx
push esi
call ebx
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
lea eax, [ebp - 0x7d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x400
lea ecx, [ebp - 0x7d0]
push str.Load
push ecx
lea ecx, [ebp - 0x1158]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
lea edx, [ebp - 0x1158]
push edx
call edi
test eax, eax
jle 0x48f75f
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x1158]
push ecx
lea edx, [ebp - 0x550]
push str.F3___HKCU_Load_s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call edi
push eax
lea edx, [ebp - 0x550]
push edx
push esi
call ebx
push 0x400
lea eax, [ebp - 0x7d0]
push 0x4ebeb0
push eax
lea ecx, [ebp - 0x1158]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
lea ecx, [ebp - 0x1158]
push ecx
call edi
test eax, eax
jle 0x48f7d0
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x1158]
push eax
lea ecx, [ebp - 0x550]
push str.F3___HKCU_Run_s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call edi
push eax
lea ecx, [ebp - 0x550]
push ecx
push esi
call ebx
lea esi, [ebp - 0x550]
call fcn.0047dd80
mov edx, esi
push 0
push edx
lea ecx, [ebp - 0x2830]
mov dword [ebp - 0x2830], 0x9f5ec
call fcn.0047d6e0
add esp, 8
mov dword [0x506c4c], eax
test eax, eax
je 0x48f9dc
mov eax, dword [ebp - 0x2830]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [0x506c4c]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push ecx
mov dword [0x506c48], eax
call esi
mov edx, dword [0x506c48]
push edx
mov dword [ebp - 0xc], eax
call esi
xor ebx, ebx
xor edi, edi
mov esi, eax
cmp dword [ebp - 0x2830], ebx
jle 0x48f915
mov eax, dword [ebp - 0xc]
mov al, byte [eax + ebx]
cmp al, 0xa
jne 0x48f900
mov word [edi + esi], 0xa0d
mov byte [edi + esi + 2], 0
cmp byte [esi], 0x23
je 0x48f8fc
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
cmp eax, 0x1f4
jge 0x48f8fc
push esi
call edi
cmp eax, 4
jle 0x48f8fc
push esi
lea ecx, [ebp - 0x550]
push str.O1___Hosts:__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edx, str.127.0.0.1
lea ecx, [ebp - 0x550]
call fcn.0047bb80
test eax, eax
jne 0x48f8fc
mov edx, 0x4ef8d0
lea ecx, [ebp - 0x550]
call fcn.0047bb80
test eax, eax
jne 0x48f8fc
mov edx, str.0.0.0
lea ecx, [ebp - 0x550]
call fcn.0047bb80
test eax, eax
jne 0x48f8fc
push eax
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call edi
mov edx, dword [ebp - 0x2834]
push eax
lea ecx, [ebp - 0x550]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edi, edi
jmp 0x48f908
cmp al, 0x1f
jbe 0x48f908
mov byte [edi + esi], al
inc edi
inc ebx
cmp ebx, dword [ebp - 0x2830]
jl 0x48f846
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call ebx
cmp eax, 4
jle 0x48f9ad
mov word [edi + esi], 0xa0d
mov byte [edi + esi + 2], 0
cmp byte [esi], 0x23
je 0x48f9ad
push esi
call ebx
cmp eax, 0x1f4
jge 0x48f9ad
push esi
call ebx
cmp eax, 4
jle 0x48f9ad
push esi
lea eax, [ebp - 0x550]
push str.O1___Hosts:__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edx, str.127.0.0.1
lea ecx, [ebp - 0x550]
call fcn.0047bb80
test eax, eax
jne 0x48f9ad
mov edx, 0x4ef8d0
lea ecx, [ebp - 0x550]
call fcn.0047bb80
test eax, eax
jne 0x48f9ad
push eax
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call ebx
mov ecx, dword [ebp - 0x2834]
push eax
lea eax, [ebp - 0x550]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x506c4c]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edx
call esi
mov eax, dword [0x506c4c]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
call edi
mov ecx, dword [0x506c48]
push ecx
call esi
mov edx, dword [0x506c48]
push edx
call edi
call fcn.00493700
xor ebx, ebx
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], ebx
test eax, eax
jle 0x48fc22
jmp 0x48fa06
mov ebx, dword [ebp - 0x2828]
mov eax, dword [ebx*4 + 0x501878]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x48fa26
mov ecx, dword [ebx*4 + 0x501878]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea edi, [ebp - 0x140]
call fcn.004c22f0
mov edx, dword [ebx*4 + 0x501878]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x48faed
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call ebx
lea ecx, [ebp - 0x750]
test eax, eax
mov edx, 0x80
mov eax, ecx
jne 0x48fa9b
mov edi, str.Title_Not_Found
sub edi, ecx
lea ebx, [ebx]
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x48fa8f
mov cl, byte [edi + eax]
test cl, cl
je 0x48fa8f
mov byte [eax], cl
inc eax
dec edx
jne 0x48fa70
dec eax
push str.Title_Not_Found
jmp 0x48fabf
test edx, edx
jne 0x48fa94
dec eax
push str.Title_Not_Found
jmp 0x48fabf
mov edi, esi
sub edi, ecx
nop
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x48fab9
mov cl, byte [eax + edi]
test cl, cl
je 0x48fab9
mov byte [eax], cl
inc eax
dec edx
jne 0x48faa0
jmp 0x48fabd
test edx, edx
jne 0x48fabe
dec eax
push esi
mov byte [eax], 0
call ebx
push str.Title
lea esi, [ebp - 0x750]
call fcn.0047da70
mov ebx, dword [ebp - 0x2828]
mov edx, dword [ebx*4 + 0x501878]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x48faf3
mov ebx, dword [ebp - 0x2828]
mov eax, dword [ebx*4 + 0x501878]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x48fbb3
lea esi, [eax + 0x184]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x8d0]
test eax, eax
mov edx, 0x104
mov eax, ecx
jne 0x48fb68
mov esi, str.No_path_available
sub esi, ecx
mov edi, edi
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x48fb49
mov cl, byte [eax + esi]
test cl, cl
je 0x48fb49
mov byte [eax], cl
inc eax
dec edx
jne 0x48fb30
jmp 0x48fb4d
test edx, edx
jne 0x48fb4e
dec eax
push str.No_path_available
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.GetRunStructNull
mov esi, str.No_Path_available
jmp 0x48fb9d
mov edi, esi
sub edi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x48fb89
mov cl, byte [eax + edi]
test cl, cl
je 0x48fb89
mov byte [eax], cl
inc eax
dec edx
jne 0x48fb70
jmp 0x48fb8d
test edx, edx
jne 0x48fb8e
dec eax
push esi
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.GetRunStruct
call fcn.0047da70
mov edx, dword [ebx*4 + 0x501878]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x140]
push ecx
lea edx, [ebp - 0x8d0]
push edx
lea eax, [ebp - 0x750]
push eax
lea ecx, [ebp - 0x550]
push str.O2___BHO:__s____s____s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x2834]
push eax
lea ecx, [ebp - 0x550]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc ebx
mov dword [ebp - 0x2828], ebx
cmp ebx, dword [ebp - 0x2830]
jl 0x48fa00
mov ecx, dword [0x505890]
xor ebx, ebx
cmp ecx, ebx
je 0x48fc51
xor edi, edi
cmp ecx, ebx
jle 0x48fc51
mov eax, dword [edi*4 + 0x501878]
cmp eax, ebx
je 0x48fc4c
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [0x505890]
inc edi
cmp edi, ecx
jl 0x48fc34
mov dword [0x505890], ebx
call fcn.00493900
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], ebx
cmp eax, ebx
jle 0x48fe92
jmp 0x48fc78
mov ebx, dword [ebp - 0x2828]
mov eax, dword [ebx*4 + 0x501878]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x48fc98
mov ecx, dword [ebx*4 + 0x501878]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea edi, [ebp - 0x140]
call fcn.004c22f0
mov edx, dword [ebx*4 + 0x501878]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x48fd5d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call ebx
lea ecx, [ebp - 0x750]
test eax, eax
mov edx, 0x80
mov eax, ecx
jne 0x48fd0b
mov edi, str.Title_Not_Found
sub edi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x48fcff
mov cl, byte [edi + eax]
test cl, cl
je 0x48fcff
mov byte [eax], cl
inc eax
dec edx
jne 0x48fce0
dec eax
push str.Title_Not_Found
jmp 0x48fd2f
test edx, edx
jne 0x48fd04
dec eax
push str.Title_Not_Found
jmp 0x48fd2f
mov edi, esi
sub edi, ecx
nop
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x48fd29
mov cl, byte [eax + edi]
test cl, cl
je 0x48fd29
mov byte [eax], cl
inc eax
dec edx
jne 0x48fd10
jmp 0x48fd2d
test edx, edx
jne 0x48fd2e
dec eax
push esi
mov byte [eax], 0
call ebx
push str.Title
lea esi, [ebp - 0x750]
call fcn.0047da70
mov ebx, dword [ebp - 0x2828]
mov edx, dword [ebx*4 + 0x501878]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x48fd63
mov ebx, dword [ebp - 0x2828]
mov eax, dword [ebx*4 + 0x501878]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x48fe23
lea esi, [eax + 0x184]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x8d0]
test eax, eax
mov edx, 0x104
mov eax, ecx
jne 0x48fdd8
mov esi, str.No_path_available
sub esi, ecx
mov edi, edi
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x48fdb9
mov cl, byte [eax + esi]
test cl, cl
je 0x48fdb9
mov byte [eax], cl
inc eax
dec edx
jne 0x48fda0
jmp 0x48fdbd
test edx, edx
jne 0x48fdbe
dec eax
push str.No_path_available
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.GetRunStructNull
mov esi, str.No_Path_available
jmp 0x48fe0d
mov edi, esi
sub edi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x48fdf9
mov cl, byte [eax + edi]
test cl, cl
je 0x48fdf9
mov byte [eax], cl
inc eax
dec edx
jne 0x48fde0
jmp 0x48fdfd
test edx, edx
jne 0x48fdfe
dec eax
push esi
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.GetRunStruct
call fcn.0047da70
mov edx, dword [ebx*4 + 0x501878]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x140]
push ecx
lea edx, [ebp - 0x8d0]
push edx
lea eax, [ebp - 0x750]
push eax
lea ecx, [ebp - 0x550]
push str.O3___Toolbar:__s____s____s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x2834]
push eax
lea ecx, [ebp - 0x550]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc ebx
mov dword [ebp - 0x2828], ebx
cmp ebx, dword [ebp - 0x2830]
jl 0x48fc72
mov ecx, dword [0x505890]
test ecx, ecx
je 0x48fec9
xor esi, esi
test ecx, ecx
jle 0x48febf
mov eax, dword [esi*4 + 0x501878]
test eax, eax
je 0x48feba
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [0x505890]
inc esi
cmp esi, ecx
jl 0x48fea2
mov dword [0x505890], 0
call fcn.00488a50
xor esi, esi
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], esi
test eax, eax
jle 0x49029f
mov eax, dword [esi*4 + 0x501878]
push eax
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x48ff14
mov edx, dword [esi*4 + 0x501878]
mov ecx, dword [eax + 0x288]
push edx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea edi, [ebp - 0x140]
mov ebx, esi
call fcn.004c22f0
mov eax, dword [esi*4 + 0x501878]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x48ffe1
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
call esi
lea ecx, [ebp - 0x750]
test eax, eax
mov edx, 0x80
mov eax, ecx
jne 0x48ff8b
mov edi, str.Title_Not_Found
sub edi, ecx
lea ebx, [ebx]
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x48ff7f
mov cl, byte [edi + eax]
test cl, cl
je 0x48ff7f
mov byte [eax], cl
inc eax
dec edx
jne 0x48ff60
dec eax
push str.Title_Not_Found
jmp 0x48ffaf
test edx, edx
jne 0x48ff84
dec eax
push str.Title_Not_Found
jmp 0x48ffaf
mov edi, ebx
sub edi, ecx
nop
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x48ffa9
mov cl, byte [eax + edi]
test cl, cl
je 0x48ffa9
mov byte [eax], cl
inc eax
dec edx
jne 0x48ff90
jmp 0x48ffad
test edx, edx
jne 0x48ffae
dec eax
push ebx
mov byte [eax], 0
call esi
push str.Title
lea esi, [ebp - 0x750]
call fcn.0047da70
mov edx, dword [ebp - 0x2828]
mov eax, dword [edx*4 + 0x501878]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [ebp - 0x2828]
mov ecx, dword [ebp - 0xc]
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
dec ecx
cmp ecx, 0x19
ja case.0x48fff3.8
jmp dword [ecx*4 + 0x49368c]
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKLM..Run:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKLM..RunOnce:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKLM..RunOnceEx:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKLM..RunServices:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKLM..RunServicesOnce:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKLM..PoliciesExplorerRun:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKLM..RunOnceSetup:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKCU..Run:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKCU..RunOnce:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKCU..RunOnceEx:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKCU..RunServices:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKCU..RunServicesOnce:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKCU..RunOnceSetup:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKU..Run:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKU..RunOnce:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKU..RunOnceEx:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKU..RunService:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKU..RunServicesOnce:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___HKU..RunOnceSetup:___s__s_s
jmp 0x490255
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x750]
push ecx
push str.O4___Other_Run:___s__s_s
lea edx, [ebp - 0x550]
push edx
call eax
add esp, 0x14
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp - 0x2834]
lea edx, [ebp - 0x550]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc esi
mov dword [ebp - 0x2828], esi
cmp esi, dword [ebp - 0x2830]
jl 0x48fee4
mov ecx, dword [0x505890]
test ecx, ecx
je 0x4902d8
xor esi, esi
test ecx, ecx
jle 0x4902ce
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esi*4 + 0x501878]
test eax, eax
je 0x4902c9
push eax
call edi
mov ecx, dword [0x505890]
inc esi
cmp esi, ecx
jl 0x4902b5
mov dword [0x505890], 0
call fcn.00489050
mov eax, dword [0x505890]
xor esi, esi
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], esi
test eax, eax
jle 0x49052b
lea eax, [ebp - 0x750]
lea ecx, [ebp - 0x1260]
sub eax, ecx
mov dword [ebp - 0xc], eax
lea esp, [esp]
lea edi, [ebp - 0x140]
mov ebx, esi
call fcn.004c22f0
mov edx, dword [esi*4 + 0x501878]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4903ef
lea esi, [eax + 0x184]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x750]
test eax, eax
mov edx, 0x104
mov eax, ecx
jne 0x490398
mov esi, str.No_path_available
sub esi, ecx
jmp 0x490360
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x490379
mov cl, byte [eax + esi]
test cl, cl
je 0x490379
mov byte [eax], cl
inc eax
dec edx
jne 0x490360
jmp 0x49037d
test edx, edx
jne 0x49037e
dec eax
push str.No_path_available
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.GetRunStructNull
mov esi, str.No_Path_available
jmp 0x4903cd
mov edi, esi
sub edi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x4903b9
mov cl, byte [eax + edi]
test cl, cl
je 0x4903b9
mov byte [eax], cl
inc eax
dec edx
jne 0x4903a0
jmp 0x4903bd
test edx, edx
jne 0x4903be
dec eax
push esi
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.GetRunStruct
call fcn.0047da70
mov edx, dword [ebp - 0x2828]
mov eax, dword [edx*4 + 0x501878]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [ebp - 0x2828]
mov edi, dword [ebp - 0xc]
mov edx, 0x104
lea eax, [ebp - 0x1260]
lea ecx, [ecx]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x490419
mov cl, byte [eax + edi]
test cl, cl
je 0x490419
mov byte [eax], cl
inc eax
dec edx
jne 0x490400
jmp 0x49041d
test edx, edx
jne 0x49041e
dec eax
lea edx, [ebp - 0x1260]
push edx
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x490442
cmp byte [ebp + eax - 0x1260], 0x5c
je 0x490441
dec eax
jne 0x490432
jmp 0x490442
inc eax
movzx eax, ax
movzx ebx, ax
mov eax, dword [esi*4 + 0x501878]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x4904c2
push str.GetRunHWND
mov esi, 0x4f30f0
call fcn.0047da70
mov ecx, dword [ebp - 0x2828]
mov edx, dword [ecx*4 + 0x501878]
mov edi, dword [edi + 0x28c]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test edi, edi
je 0x4904bc
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x140]
push ecx
lea edx, [ebp + ebx - 0x750]
push edx
lea eax, [ebp - 0x550]
push str.O4___Startup:__s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [ebp - 0x2828]
jmp 0x4904ea
mov esi, dword [ebp - 0x2828]
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp + ebx - 0x750]
push eax
lea ecx, [ebp - 0x550]
push str.O4___Global_Startup:__s_s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x2834]
push eax
lea ecx, [ebp - 0x550]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc esi
mov dword [ebp - 0x2828], esi
cmp esi, dword [ebp - 0x2830]
jl 0x490310
push 0x200
push str.inetcpl.cpl
push str.Control_Paneldont_load
lea ecx, [ebp - 0x750]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
mov edx, 0x4e6ee4
lea ecx, [ebp - 0x750]
call fcn.0047bb80
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
test eax, eax
je 0x4905b5
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x750]
push ecx
lea edx, [ebp - 0x550]
push str.O5___control.ini:_inetcpl.cpl_s_s
push edx
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x10
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
mov edi, dword [ebp - 0x2834]
push eax
lea edx, [ebp - 0x550]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4905c1
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp - 0x2834]
push 0x200
push 0x4e27f8
push str.SoftwarePoliciesMicrosoftInternet_ExplorerRestrictions
lea ecx, [ebp - 0x750]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x490620
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x550]
push str.O6___HKCUSoftwarePoliciesMicrosoftInternet_ExplorerRestrictions_present_s
push ecx
call ebx
add esp, 0xc
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call esi
push eax
lea ecx, [ebp - 0x550]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x200
push 0x4e27f8
push str.SoftwarePoliciesMicrosoftInternet_ExplorerControl_Panel
lea ecx, [ebp - 0x750]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x49067f
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x550]
push str.O6___HKCUSoftwarePoliciesMicrosoftInternet_ExplorerControl_Panel_present_s
push eax
call ebx
add esp, 0xc
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call esi
push eax
lea eax, [ebp - 0x550]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x200
push str.DisableRegistryTools
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
lea ecx, [ebp - 0x750]
mov edx, 0x80000001
call fcn.004bff10
mov al, byte [ebp - 0x750]
add esp, 0xc
test al, al
jle 0x4906e8
movsx edx, al
lea ecx, [ebp - 0x2824]
push ecx
push edx
lea eax, [ebp - 0x550]
push str.O7___HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__DisableRegistryTools__d_s
push eax
call ebx
add esp, 0x10
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call esi
push eax
lea eax, [ebp - 0x550]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x200
push str.DisableRegEdit
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
lea ecx, [ebp - 0x750]
mov edx, 0x80000001
call fcn.004bff10
mov al, byte [ebp - 0x750]
add esp, 0xc
test al, al
jle 0x490751
movsx edx, al
lea ecx, [ebp - 0x2824]
push ecx
push edx
lea eax, [ebp - 0x550]
push str.O7___HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__DisableRegEdit_d_s
push eax
call ebx
add esp, 0x10
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call esi
push eax
lea eax, [ebp - 0x550]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x200
push str.DisableTaskMgr
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
lea ecx, [ebp - 0x750]
mov edx, 0x80000001
call fcn.004bff10
mov al, byte [ebp - 0x750]
add esp, 0xc
test al, al
jle 0x4907ba
movsx edx, al
lea ecx, [ebp - 0x2824]
push ecx
push edx
lea eax, [ebp - 0x550]
push str.O7___HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__DisableTaskMgr__d_s
push eax
call ebx
add esp, 0x10
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call esi
push eax
lea eax, [ebp - 0x550]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.00493a70
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], 0
test eax, eax
jle 0x490910
jmp 0x4907e0
mov ebx, dword [ebp - 0x2828]
lea edi, [ebp - 0x140]
call fcn.004c22f0
mov ecx, ebx
mov edx, dword [ecx*4 + 0x501878]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x4908a6
push ebx
call esi
lea ecx, [ebp - 0x750]
test eax, eax
mov edx, 0x80
mov eax, ecx
jne 0x490851
mov edi, str.Title_Not_Found
sub edi, ecx
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x490845
mov cl, byte [edi + eax]
test cl, cl
je 0x490845
mov byte [eax], cl
inc eax
dec edx
jne 0x490826
dec eax
push str.Title_Not_Found
jmp 0x490874
test edx, edx
jne 0x49084a
dec eax
push str.Title_Not_Found
jmp 0x490874
mov edi, ebx
sub edi, ecx
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x49086e
mov cl, byte [eax + edi]
test cl, cl
je 0x49086e
mov byte [eax], cl
inc eax
dec edx
jne 0x490855
jmp 0x490872
test edx, edx
jne 0x490873
dec eax
push ebx
mov byte [eax], 0
call esi
push str.Title
lea esi, [ebp - 0x750]
call fcn.0047da70
mov edx, dword [ebp - 0x2828]
mov eax, dword [edx*4 + 0x501878]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x750]
push eax
lea ecx, [ebp - 0x550]
push str.O8___Extra_context_menu_item:__s____s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call esi
mov edx, dword [ebp - 0x2834]
push eax
lea ecx, [ebp - 0x550]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x2828]
inc eax
mov dword [ebp - 0x2828], eax
cmp eax, dword [ebp - 0x2830]
jl 0x4907e0
call fcn.00493bf0
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], 0
test eax, eax
jle 0x490b7b
lea ecx, [ecx]
mov ebx, dword [ebp - 0x2828]
lea edi, [ebp - 0x140]
call fcn.004c22f0
mov eax, ebx
mov ecx, dword [eax*4 + 0x501878]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x4909f6
push ebx
call esi
lea ecx, [ebp - 0x750]
test eax, eax
mov edx, 0x80
mov eax, ecx
jne 0x4909a1
mov edi, str.Title_Not_Found
sub edi, ecx
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x490995
mov cl, byte [edi + eax]
test cl, cl
je 0x490995
mov byte [eax], cl
inc eax
dec edx
jne 0x490976
dec eax
push str.Title_Not_Found
jmp 0x4909c4
test edx, edx
jne 0x49099a
dec eax
push str.Title_Not_Found
jmp 0x4909c4
mov edi, ebx
sub edi, ecx
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x4909be
mov cl, byte [eax + edi]
test cl, cl
je 0x4909be
mov byte [eax], cl
inc eax
dec edx
jne 0x4909a5
jmp 0x4909c2
test edx, edx
jne 0x4909c3
dec eax
push ebx
mov byte [eax], 0
call esi
push str.Title
lea esi, [ebp - 0x750]
call fcn.0047da70
mov edx, dword [ebp - 0x2828]
mov eax, dword [edx*4 + 0x501878]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [ebp - 0x2828]
mov ecx, dword [ebx*4 + 0x501878]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x490abb
lea edi, [eax + 0x184]
push edi
call esi
lea ecx, [ebp - 0x8d0]
test eax, eax
mov edx, 0x104
mov eax, ecx
jne 0x490a6b
mov esi, str.No_path_available
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x490a4c
mov cl, byte [eax + esi]
test cl, cl
je 0x490a4c
mov byte [eax], cl
inc eax
dec edx
jne 0x490a33
jmp 0x490a50
test edx, edx
jne 0x490a51
dec eax
push str.No_path_available
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.GetRunStructNull
mov esi, str.No_Path_available
jmp 0x490a9f
mov esi, edi
sub esi, ecx
nop
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x490a89
mov cl, byte [eax + esi]
test cl, cl
je 0x490a89
mov byte [eax], cl
inc eax
dec edx
jne 0x490a70
jmp 0x490a8d
test edx, edx
jne 0x490a8e
dec eax
push edi
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.GetRunStruct
mov esi, edi
call fcn.0047da70
mov edx, dword [ebx*4 + 0x501878]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov eax, dword [ebx*4 + 0x501878]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x490b10
mov ecx, dword [ebx*4 + 0x501878]
mov edi, dword [eax + 0x288]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp edi, 1
jne 0x490b10
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x8d0]
push ecx
lea edx, [ebp - 0x750]
push edx
push str.O9___Extra_button:__s____s____s_s
lea eax, [ebp - 0x550]
push eax
jmp 0x490b38
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x8d0]
push eax
lea ecx, [ebp - 0x750]
push ecx
push str.O9___Extra_Tools_menuitem:__s____s____s_s
lea edx, [ebp - 0x550]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
mov eax, dword [ebp - 0x2834]
lea edx, [ebp - 0x550]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc ebx
mov dword [ebp - 0x2828], ebx
cmp ebx, dword [ebp - 0x2830]
jl 0x490930
call fcn.004944b0
xor edi, edi
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], edi
test eax, eax
jle 0x490d8e
jmp 0x490ba0
mov ecx, dword [edi*4 + 0x501878]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x490c59
push ebx
call esi
lea ecx, [ebp - 0x750]
test eax, eax
mov edx, 0x80
mov eax, ecx
jne 0x490bfe
mov edi, str.Title_Not_Found
sub edi, ecx
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x490bf2
mov cl, byte [edi + eax]
test cl, cl
je 0x490bf2
mov byte [eax], cl
inc eax
dec edx
jne 0x490bd3
dec eax
push str.Title_Not_Found
jmp 0x490c21
test edx, edx
jne 0x490bf7
dec eax
push str.Title_Not_Found
jmp 0x490c21
mov edi, ebx
sub edi, ecx
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x490c1b
mov cl, byte [eax + edi]
test cl, cl
je 0x490c1b
mov byte [eax], cl
inc eax
dec edx
jne 0x490c02
jmp 0x490c1f
test edx, edx
jne 0x490c20
dec eax
push ebx
mov byte [eax], 0
call esi
push str.Title
lea esi, [ebp - 0x750]
call fcn.0047da70
mov edx, dword [ebp - 0x2828]
mov eax, dword [edx*4 + 0x501878]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp - 0x2828]
mov ecx, dword [edi*4 + 0x501878]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x490d27
lea edi, [eax + 0x184]
push edi
call esi
lea ecx, [ebp - 0x8d0]
test eax, eax
mov edx, 0x104
mov eax, ecx
jne 0x490cc8
mov esi, str.No_path_available
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x490ca9
mov cl, byte [eax + esi]
test cl, cl
je 0x490ca9
mov byte [eax], cl
inc eax
dec edx
jne 0x490c90
jmp 0x490cad
test edx, edx
jne 0x490cae
dec eax
push str.No_path_available
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.GetRunStructNull
mov esi, str.No_Path_available
jmp 0x490cff
mov esi, edi
sub esi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x490ce9
mov cl, byte [esi + eax]
test cl, cl
je 0x490ce9
mov byte [eax], cl
inc eax
dec edx
jne 0x490cd0
jmp 0x490ced
test edx, edx
jne 0x490cee
dec eax
push edi
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.GetRunStruct
mov esi, edi
call fcn.0047da70
mov edx, dword [ebp - 0x2828]
mov eax, dword [edx*4 + 0x501878]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp - 0x2828]
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x8d0]
push edx
lea eax, [ebp - 0x750]
push eax
mov ecx, eax
push ecx
lea edx, [ebp - 0x550]
push str.O11___Options_group:___s___s____s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
mov eax, dword [ebp - 0x2834]
lea edx, [ebp - 0x550]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc edi
mov dword [ebp - 0x2828], edi
cmp edi, dword [ebp - 0x2830]
jl 0x490ba0
call fcn.00493e80
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], 0
test eax, eax
jle 0x490f9f
jmp 0x490db0
mov ebx, dword [ebp - 0x2828]
lea edi, [ebp - 0x140]
call fcn.004c22f0
mov ecx, ebx
mov edx, dword [ecx*4 + 0x501878]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x490e76
push ebx
call esi
lea ecx, [ebp - 0x750]
test eax, eax
mov edx, 0x80
mov eax, ecx
jne 0x490e21
mov edi, str.Title_Not_Found
sub edi, ecx
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x490e15
mov cl, byte [edi + eax]
test cl, cl
je 0x490e15
mov byte [eax], cl
inc eax
dec edx
jne 0x490df6
dec eax
push str.Title_Not_Found
jmp 0x490e44
test edx, edx
jne 0x490e1a
dec eax
push str.Title_Not_Found
jmp 0x490e44
mov edi, ebx
sub edi, ecx
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x490e3e
mov cl, byte [edi + eax]
test cl, cl
je 0x490e3e
mov byte [eax], cl
inc eax
dec edx
jne 0x490e25
jmp 0x490e42
test edx, edx
jne 0x490e43
dec eax
push ebx
mov byte [eax], 0
call esi
push str.Title
lea esi, [ebp - 0x750]
call fcn.0047da70
mov edx, dword [ebp - 0x2828]
mov eax, dword [edx*4 + 0x501878]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [ebp - 0x2828]
mov ecx, dword [ebx*4 + 0x501878]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x490f3b
lea edi, [eax + 0x184]
push edi
call esi
lea ecx, [ebp - 0x8d0]
test eax, eax
mov edx, 0x104
mov eax, ecx
jne 0x490eeb
mov esi, str.No_path_available
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x490ecc
mov cl, byte [eax + esi]
test cl, cl
je 0x490ecc
mov byte [eax], cl
inc eax
dec edx
jne 0x490eb3
jmp 0x490ed0
test edx, edx
jne 0x490ed1
dec eax
push str.No_path_available
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.GetRunStructNull
mov esi, str.No_Path_available
jmp 0x490f1f
mov esi, edi
sub esi, ecx
nop
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x490f09
mov cl, byte [esi + eax]
test cl, cl
je 0x490f09
mov byte [eax], cl
inc eax
dec edx
jne 0x490ef0
jmp 0x490f0d
test edx, edx
jne 0x490f0e
dec eax
push edi
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.GetRunStruct
mov esi, edi
call fcn.0047da70
mov edx, dword [ebx*4 + 0x501878]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x140]
push ecx
lea edx, [ebp - 0x750]
push edx
lea eax, [ebp - 0x550]
push str.O12___Plugin_for__s:__s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call esi
mov ecx, dword [ebp - 0x2834]
push eax
lea eax, [ebp - 0x550]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc ebx
mov dword [ebp - 0x2828], ebx
cmp ebx, dword [ebp - 0x2830]
jl 0x490db0
cmp dword [0x506e0c], 0
je 0x490fd3
mov edx, dword [0x4f8b78]
mov eax, dword [0x4f8b7c]
mov dword [ebp - 0x283c], edx
mov dword [ebp - 0x2840], eax
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0x20106
push 0x200
push 0x4e27f8
push str.SOFTWAREMicrosoftWindowsCurrentVersionURLDefaultPrefix
lea ecx, [ebp - 0x750]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea ecx, [ebp - 0x750]
push ecx
call esi
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
cmp eax, 7
jle 0x491051
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x750]
push eax
lea ecx, [ebp - 0x550]
push str.O13___DefaultPrefix:__s_s
push ecx
call ebx
add esp, 0x10
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call esi
mov edi, dword [ebp - 0x2834]
push eax
lea ecx, [ebp - 0x550]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x491057
mov edi, dword [ebp - 0x2834]
push 0x200
push 0x4f0014
push str.SOFTWAREMicrosoftWindowsCurrentVersionURLPrefixes
lea ecx, [ebp - 0x750]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea edx, [ebp - 0x750]
push edx
call esi
cmp eax, 7
jle 0x4910c7
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x750]
push ecx
lea edx, [ebp - 0x550]
push str.O13___WWW_Prefix:__s_s
push edx
call ebx
add esp, 0x10
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
lea edx, [ebp - 0x550]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x200
push str.www.
push str.SOFTWAREMicrosoftWindowsCurrentVersionURLPrefixes
lea ecx, [ebp - 0x750]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea eax, [ebp - 0x750]
push eax
call esi
cmp eax, 7
jle 0x491137
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x750]
push edx
lea eax, [ebp - 0x550]
push str.O13____WWW._Prefix:__s_s
push eax
call ebx
add esp, 0x10
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call esi
push eax
lea eax, [ebp - 0x550]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [0x506e0c], 0
je 0x491158
mov ecx, dword [ebp - 0x283c]
mov edx, dword [ebp - 0x2840]
mov dword [0x4f8b78], ecx
mov dword [0x4f8b7c], edx
push 0x104
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.infiereset.inf
lea ecx, [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x140]
push edx
push 0x200
lea eax, [ebp - 0x750]
push eax
push 0x4e27f8
push str.START_PAGE_URL
push str.Strings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4911e8
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x750]
push edx
lea eax, [ebp - 0x550]
push str.O14___IERESET.INF:_START_PAGE_URL___s_s
push eax
call ebx
add esp, 0x10
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call esi
push eax
lea eax, [ebp - 0x550]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x140]
push ecx
push 0x200
lea edx, [ebp - 0x750]
push edx
push 0x4e27f8
push str.SEARCH_PAGE_URL
push str.Strings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x491254
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x750]
push ecx
lea edx, [ebp - 0x550]
push str.O14___IERESET.INF:_SEARCH_PAGE_URL___s_s
push edx
call ebx
add esp, 0x10
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
lea edx, [ebp - 0x550]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 1
push str.C:WINDOWSinfiereset.inf
lea ecx, [ebp - 0x2830]
mov dword [ebp - 0x2830], 0x4000
call fcn.0047d6e0
add esp, 8
mov dword [0x506c4c], eax
test eax, eax
je 0x491421
mov edi, dword [ebp - 0x2830]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [0x506c48], eax
mov eax, dword [0x506c4c]
push eax
call ebx
mov ecx, dword [0x506c48]
push ecx
mov dword [ebp - 0xc], eax
call ebx
xor edx, edx
xor ecx, ecx
mov ebx, eax
mov dword [ebp - 0x2828], edx
test edi, edi
jle 0x4913f2
mov eax, dword [ebp - 0xc]
mov al, byte [eax + edx]
cmp al, 0xa
jne 0x4913db
mov byte [ecx + ebx], 0
mov dword [ebp - 0x14], 0
jmp 0x4912e0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x4f85b0]
mov ecx, ebx
call fcn.0047bb80
test eax, eax
je 0x4913b9
push ebx
call esi
mov edi, eax
test edi, edi
jle 0x4913b9
cmp byte [edi + ebx], 0x2c
je 0x491315
dec edi
test edi, edi
jg 0x491305
jmp 0x4913b9
mov edx, str.HKLM
mov ecx, ebx
mov byte [ebp - 0x1378], 0
call fcn.0047bb80
test eax, eax
je 0x49133e
push 0x4f013c
lea edx, [ebp - 0x1378]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, str.HKCU
mov ecx, ebx
call fcn.0047bb80
test eax, eax
je 0x491360
push 0x4f0144
lea eax, [ebp - 0x1378]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x2824]
push ecx
mov ecx, dword [eax + 0x4f85c0]
lea edx, [edi + ebx + 1]
push edx
push ecx
lea edx, [ebp - 0x1378]
push edx
lea eax, [ebp - 0x550]
push str.O14___IERESET.INF:_s__s___s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call esi
mov ecx, dword [ebp - 0x2834]
push eax
lea eax, [ebp - 0x550]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
cmp eax, 0x10
jl 0x4912e0
mov edx, dword [ebp - 0x2828]
mov edi, dword [ebp - 0x2830]
xor ecx, ecx
jmp 0x4913e3
cmp al, 0x1f
jbe 0x4913e3
mov byte [ecx + ebx], al
inc ecx
inc edx
mov dword [ebp - 0x2828], edx
cmp edx, edi
jl 0x4912c2
mov edx, dword [0x506c4c]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edx
call edi
mov eax, dword [0x506c4c]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
call ebx
mov ecx, dword [0x506c48]
push ecx
call edi
mov edx, dword [0x506c48]
push edx
call ebx
call fcn.004946d0
xor edi, edi
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], edi
test eax, eax
jle 0x491556
lea esp, [esp]
mov eax, dword [edi*4 + 0x501878]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x4914f9
push ebx
call esi
lea ecx, [ebp - 0x750]
test eax, eax
mov edx, 0x80
mov eax, ecx
jne 0x49149e
mov edi, str.Title_Not_Found
sub edi, ecx
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x491492
mov cl, byte [edi + eax]
test cl, cl
je 0x491492
mov byte [eax], cl
inc eax
dec edx
jne 0x491473
dec eax
push str.Title_Not_Found
jmp 0x4914c1
test edx, edx
jne 0x491497
dec eax
push str.Title_Not_Found
jmp 0x4914c1
mov edi, ebx
sub edi, ecx
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x4914bb
mov cl, byte [eax + edi]
test cl, cl
je 0x4914bb
mov byte [eax], cl
inc eax
dec edx
jne 0x4914a2
jmp 0x4914bf
test edx, edx
jne 0x4914c0
dec eax
push ebx
mov byte [eax], 0
call esi
push str.Title
lea esi, [ebp - 0x750]
call fcn.0047da70
mov edx, dword [ebp - 0x2828]
mov eax, dword [edx*4 + 0x501878]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp - 0x2828]
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x750]
push edx
lea eax, [ebp - 0x550]
push str.O15___Trusted_Zone:__s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call esi
mov ecx, dword [ebp - 0x2834]
push eax
lea eax, [ebp - 0x550]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc edi
mov dword [ebp - 0x2828], edi
cmp edi, dword [ebp - 0x2830]
jl 0x491440
call fcn.00494010
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], 0
test eax, eax
jle 0x491847
mov ebx, dword [ebp - 0x2828]
lea edi, [ebp - 0x140]
call fcn.004c22f0
mov edx, ebx
mov eax, dword [edx*4 + 0x501878]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x491641
push ebx
call esi
lea ecx, [ebp - 0x750]
test eax, eax
mov edx, 0x80
mov eax, ecx
jne 0x4915eb
mov edi, str.Title_Not_Found
sub edi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x4915df
mov cl, byte [edi + eax]
test cl, cl
je 0x4915df
mov byte [eax], cl
inc eax
dec edx
jne 0x4915c0
dec eax
push str.Title_Not_Found
jmp 0x49160f
test edx, edx
jne 0x4915e4
dec eax
push str.Title_Not_Found
jmp 0x49160f
mov edi, ebx
sub edi, ecx
nop
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x491609
mov cl, byte [eax + edi]
test cl, cl
je 0x491609
mov byte [eax], cl
inc eax
dec edx
jne 0x4915f0
jmp 0x49160d
test edx, edx
jne 0x49160e
dec eax
push ebx
mov byte [eax], 0
call esi
push str.Title
lea esi, [ebp - 0x750]
call fcn.0047da70
mov edx, dword [ebp - 0x2828]
mov eax, dword [edx*4 + 0x501878]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [ebp - 0x2828]
mov ecx, dword [ebx*4 + 0x501878]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x49170b
lea edi, [eax + 0x184]
push edi
call esi
lea ecx, [ebp - 0x8d0]
test eax, eax
mov edx, 0x104
mov eax, ecx
jne 0x4916b8
mov esi, str.No_path_available
sub esi, ecx
mov edi, edi
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x491699
mov cl, byte [eax + esi]
test cl, cl
je 0x491699
mov byte [eax], cl
inc eax
dec edx
jne 0x491680
jmp 0x49169d
test edx, edx
jne 0x49169e
dec eax
push str.No_path_available
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.GetRunStructNull
mov esi, str.No_Path_available
jmp 0x4916ef
mov esi, edi
sub esi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x4916d9
mov cl, byte [eax + esi]
test cl, cl
je 0x4916d9
mov byte [eax], cl
inc eax
dec edx
jne 0x4916c0
jmp 0x4916dd
test edx, edx
jne 0x4916de
dec eax
push edi
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.GetRunStruct
mov esi, edi
call fcn.0047da70
mov edx, dword [ebx*4 + 0x501878]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov eax, dword [ebx*4 + 0x501878]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4917dc
lea edi, [eax + 0x290]
push edi
call esi
test eax, eax
jne 0x49177f
push str.GetRunDesc
mov esi, str.No_Description_Available
call fcn.0047da70
lea eax, [ebp - 0xd58]
mov edx, str.No_Description_Available
mov ecx, eax
add esp, 4
mov esi, 0x200
sub edx, ecx
lea ecx, [esi + 0x7ffffdfe]
test ecx, ecx
je 0x491773
mov cl, byte [eax + edx]
test cl, cl
je 0x491773
mov byte [eax], cl
inc eax
dec esi
jne 0x491754
dec eax
push str.No_Description_Available
jmp 0x4917bf
test esi, esi
jne 0x491778
dec eax
push str.No_Description_Available
jmp 0x4917bf
push str.GetDesription
mov esi, edi
call fcn.0047da70
lea eax, [ebp - 0xd58]
mov edx, edi
mov ecx, eax
add esp, 4
mov esi, 0x200
sub edx, ecx
nop
lea ecx, [esi + 0x7ffffdfe]
test ecx, ecx
je 0x4917b9
mov cl, byte [eax + edx]
test cl, cl
je 0x4917b9
mov byte [eax], cl
inc eax
dec esi
jne 0x4917a0
jmp 0x4917bd
test esi, esi
jne 0x4917be
dec eax
push edi
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebx*4 + 0x501878]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x140]
push ecx
lea edx, [ebp - 0x750]
push edx
lea eax, [ebp - 0xd58]
push eax
lea ecx, [ebp - 0x550]
push str.O16___DPF:__s___s_____s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call esi
mov edx, dword [ebp - 0x2834]
push eax
lea ecx, [ebp - 0x550]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc ebx
mov dword [ebp - 0x2828], ebx
cmp ebx, dword [ebp - 0x2830]
jl 0x491573
cmp dword [0x506e0c], 0
je 0x49187b
mov eax, dword [0x4f8b78]
mov ecx, dword [0x4f8b7c]
mov dword [ebp - 0x283c], eax
mov dword [ebp - 0x2840], ecx
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0x20106
mov ebx, dword [ebp - 0x2834]
xor edi, edi
jmp 0x491890
mov edx, dword [edi + 0x4f8574]
push 0x200
push str.SearchList
push edx
lea ecx, [ebp - 0x750]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea eax, [ebp - 0x750]
push eax
call esi
test eax, eax
jle 0x49190c
mov eax, dword [edi + 0x4f859c]
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x750]
push edx
push eax
lea ecx, [ebp - 0x550]
push str.O17___HKLM_s:_SearchList___s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call esi
push eax
lea ecx, [ebp - 0x550]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, 4
cmp edi, 0x10
jl 0x491890
xor edi, edi
lea ebx, [ebx]
mov edx, dword [edi + 0x4f8574]
push 0x200
push str.NameServer
push edx
lea ecx, [ebp - 0x750]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea eax, [ebp - 0x750]
push eax
call esi
test eax, eax
jle 0x49199c
mov eax, dword [edi + 0x4f859c]
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x750]
push edx
push eax
lea ecx, [ebp - 0x550]
push str.O17___HKLM_s:_NameServer___s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call esi
push eax
lea ecx, [ebp - 0x550]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, 4
cmp edi, 0x10
jl 0x491920
xor edi, edi
lea ebx, [ebx]
mov edx, dword [edi + 0x4f8588]
push edx
lea eax, [ebp - 0x7d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.ServicesVxDMSTCP
lea ecx, [ebp - 0x7d0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x400
lea edx, [ebp - 0x7d0]
push str.Domain
push edx
lea ecx, [ebp - 0x1158]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea eax, [ebp - 0x1158]
push eax
call esi
test eax, eax
jle 0x491a52
mov eax, dword [edi + 0x4f859c]
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x1158]
push edx
push eax
lea ecx, [ebp - 0x550]
push str.O17___HKLMSystem_sServicesVxDMSTCP:_Domain___s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call esi
push eax
lea ecx, [ebp - 0x550]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, 4
cmp edi, 0x10
jl 0x4919b0
xor edi, edi
mov edx, dword [edi + 0x4f8588]
push edx
lea eax, [ebp - 0x7d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.ServicesTcpipParameters
lea ecx, [ebp - 0x7d0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x400
lea edx, [ebp - 0x7d0]
push str.Domain
push edx
lea ecx, [ebp - 0x1158]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea eax, [ebp - 0x1158]
push eax
call esi
test eax, eax
jle 0x491b02
mov eax, dword [edi + 0x4f859c]
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x1158]
push edx
push eax
lea ecx, [ebp - 0x550]
push str.O17___HKLMSystem_sServicesTcpipParameters:_Domain___s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call esi
push eax
lea ecx, [ebp - 0x550]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, 4
cmp edi, 0x10
jl 0x491a60
cmp dword [0x506e0c], 0
je 0x491b2e
mov edx, dword [ebp - 0x283c]
mov eax, dword [ebp - 0x2840]
mov dword [0x4f8b78], edx
mov dword [0x4f8b7c], eax
push 0x200
push str.User_Stylesheet
push str.SoftwareMicrosoftInternet_ExplorerStyles
lea ecx, [ebp - 0x750]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
lea ecx, [ebp - 0x750]
push ecx
call esi
test eax, eax
jle 0x491ba5
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x750]
push eax
lea ecx, [ebp - 0x550]
push str.O19____User_style_sheet:__s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea ecx, [ebp - 0x550]
push ecx
push ebx
call edi
jmp 0x491bab
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x200
push str.AppInit_DLLs
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
lea ecx, [ebp - 0x750]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea edx, [ebp - 0x750]
push edx
call esi
test eax, eax
jle 0x491c4d
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x750]
push ecx
lea edx, [ebp - 0x550]
push str.O20___AppInit_DLLs:__s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
lea edx, [ebp - 0x550]
push edx
push ebx
call edi
push 0x4ebdd4
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call esi
push eax
lea eax, [ebp - 0x550]
push eax
push ebx
call edi
call fcn.004941d0
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], 0
test eax, eax
jle 0x491df6
lea ebx, [ebx]
mov ebx, dword [ebp - 0x2828]
lea edi, [ebp - 0x140]
call fcn.004c22f0
mov edi, ebx
push edi
lea ebx, [ebp - 0x750]
call fcn.004c2260
add esp, 4
push edi
lea ebx, [ebp - 0x8d0]
call fcn.004c23e0
mov ecx, dword [edi*4 + 0x501878]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x491d67
lea edi, [eax + 0x290]
push edi
call esi
test eax, eax
jne 0x491d21
push str.GetRunDesc
mov esi, str.No_Description_Available
call fcn.0047da70
lea eax, [ebp - 0xd58]
mov edx, str.No_Description_Available
mov ecx, eax
add esp, 4
mov esi, 0x200
sub edx, ecx
mov edi, edi
lea ecx, [esi + 0x7ffffdfe]
test ecx, ecx
je 0x491d12
mov cl, byte [eax + edx]
test cl, cl
je 0x491d12
mov byte [eax], cl
inc eax
dec esi
jne 0x491cf0
dec eax
mov byte [eax], 0
push str.No_Description_Available
jmp 0x491d47
test esi, esi
jne 0x491d17
dec eax
mov byte [eax], 0
push str.No_Description_Available
jmp 0x491d47
push str.GetDesription
mov esi, edi
call fcn.0047da70
add esp, 4
push edi
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0xd58]
call fcn.004010b0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x2828]
mov eax, dword [edx*4 + 0x501878]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x8d0]
push ecx
call fcn.00494850
add esp, 4
test eax, eax
jne 0x491ddd
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x8d0]
push ecx
lea edx, [ebp - 0x750]
push edx
lea eax, [ebp - 0xd58]
push eax
lea ecx, [ebp - 0x550]
push str.O21____s____s____s____s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call esi
mov edx, dword [ebp - 0x2834]
push eax
lea ecx, [ebp - 0x550]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x2828]
inc eax
mov dword [ebp - 0x2828], eax
cmp eax, dword [ebp - 0x2830]
jl 0x491c70
call fcn.00494340
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], 0
test eax, eax
jle 0x491f91
mov ebx, dword [ebp - 0x2828]
lea edi, [ebp - 0x140]
call fcn.004c22f0
mov edi, ebx
push edi
lea ebx, [ebp - 0x750]
call fcn.004c2260
add esp, 4
push edi
lea ebx, [ebp - 0x8d0]
call fcn.004c23e0
mov eax, dword [edi*4 + 0x501878]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x491f08
lea edi, [eax + 0x290]
push edi
call esi
test eax, eax
jne 0x491ec2
push str.GetRunDesc
mov esi, str.No_Description_Available
call fcn.0047da70
lea eax, [ebp - 0xd58]
mov edx, str.No_Description_Available
mov ecx, eax
add esp, 4
mov esi, 0x200
sub edx, ecx
lea ecx, [esi + 0x7ffffdfe]
test ecx, ecx
je 0x491eb3
mov cl, byte [eax + edx]
test cl, cl
je 0x491eb3
mov byte [eax], cl
inc eax
dec esi
jne 0x491e91
dec eax
mov byte [eax], 0
push str.No_Description_Available
jmp 0x491ee8
test esi, esi
jne 0x491eb8
dec eax
mov byte [eax], 0
push str.No_Description_Available
jmp 0x491ee8
push str.GetDesription
mov esi, edi
call fcn.0047da70
add esp, 4
push edi
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0xd58]
call fcn.004010b0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x2828]
mov eax, dword [edx*4 + 0x501878]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, str.browseui.dll
lea ecx, [ebp - 0x140]
call fcn.0047bb80
test eax, eax
jne 0x491f78
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x8d0]
push eax
lea ecx, [ebp - 0x750]
push ecx
lea edx, [ebp - 0x550]
push str.O22___SharedTaskScheduler:___s_____s____s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
mov eax, dword [ebp - 0x2834]
lea edx, [ebp - 0x550]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x2828]
inc eax
mov dword [ebp - 0x2828], eax
cmp eax, dword [ebp - 0x2830]
jl 0x491e13
cmp dword [0x505890], 0
je 0x491f9f
call fcn.004c2580
mov ecx, dword [0x506df0]
mov dword [ebp - 0xc], ecx
call fcn.0048a730
cmp dword [0x505890], 0
mov dword [ebp - 0x2828], 0
jle 0x492106
mov ebx, dword [ebp - 0x2828]
lea edi, [ebp - 0x140]
call fcn.004c22f0
mov edx, ebx
push edx
lea ebx, [ebp - 0x750]
call fcn.004c2260
add esp, 4
lea edi, [ebp - 0x550]
mov ecx, ebx
call fcn.004c5880
push 0x1400
lea eax, [ebp - 0x2820]
push 0
push eax
call fcn.004d29c0
lea ecx, [ebp - 0x140]
add esp, 0xc
push ecx
lea ecx, [ebp - 0x2820]
call fcn.004c0890
mov edx, dword [ebp - 0x2828]
mov eax, dword [edx*4 + 0x501878]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x49204a
mov ecx, dword [ebp - 0x2828]
mov edx, dword [ecx*4 + 0x501878]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push str.O23___Service:
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x750]
push ecx
lea edx, [ebp - 0x550]
push edx
call edi
push 0x4ec29c
lea eax, [ebp - 0x550]
push eax
call edi
lea ecx, [ebp - 0x2020]
push ecx
lea edx, [ebp - 0x550]
push edx
call edi
push 0x4ec29c
lea eax, [ebp - 0x550]
push eax
call edi
lea ecx, [ebp - 0x140]
push ecx
lea edx, [ebp - 0x550]
push edx
call edi
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x550]
push ecx
call edi
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call esi
mov edx, dword [ebp - 0x2834]
push eax
lea ecx, [ebp - 0x550]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
mov dword [0x506df0], eax
mov eax, dword [ebp - 0x2828]
inc eax
mov dword [ebp - 0x2828], eax
cmp eax, dword [0x505890]
jl 0x491fc4
mov edi, dword [ebp - 0x2834]
xor ebx, ebx
mov edi, edi
push ebx
lea ecx, [ebp - 0x550]
push str.SoftwareMicrosoftInternet_ExplorerDesktopComponents_1d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x200
lea edx, [ebp - 0x550]
push str.FriendlyName
push edx
lea ecx, [ebp - 0x750]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
lea eax, [ebp - 0x750]
push eax
call esi
test eax, eax
jle 0x4921e5
mov edx, str.Current_Home_Page
lea ecx, [ebp - 0x750]
call fcn.0047bb80
test eax, eax
jne 0x4921ea
push 0x400
lea ecx, [ebp - 0x550]
push str.Source
push ecx
lea ecx, [ebp - 0x1158]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x1158]
push eax
lea ecx, [ebp - 0x750]
push ecx
push ebx
lea edx, [ebp - 0x550]
push str.O24____Desktop_Component__d:__s____s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
lea edx, [ebp - 0x550]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4921ea
mov ebx, 0xa
inc ebx
cmp ebx, 9
jl 0x492110
push 0x4ebdd4
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x14]
push edx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call ebx
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x550]
push str._____Additional_WinPatrol_Info______s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
lea edx, [ebp - 0x550]
push edx
push edi
call ebx
push 0x1400
lea eax, [ebp - 0x2820]
push 0
push eax
call fcn.004d29c0
lea ecx, [ebp - 0x140]
add esp, 0xc
push ecx
call fcn.0047bd50
add esp, 4
lea ecx, [ebp - 0x140]
call fcn.0047af20
test eax, eax
je 0x4922f3
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x2820]
call fcn.004c0890
add esp, 4
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x2420]
push ecx
lea edx, [ebp - 0x1c20]
push edx
lea eax, [ebp - 0x2820]
push eax
lea ecx, [ebp - 0x550]
push str.Default_Browser:__s____s_version__s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call esi
push eax
lea ecx, [ebp - 0x550]
push ecx
jmp 0x492329
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x550]
push str.Browser:_Unable_to_find_default_browser._s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call esi
push eax
lea eax, [ebp - 0x550]
push eax
push edi
call ebx
push 0x80
lea edx, [ebp - 0x7d0]
mov ecx, 0xc
call fcn.004ca1e0
add esp, 4
push 0x104
lea ecx, [ebp - 0x7d0]
push 0x4e2d04
push ecx
lea ecx, [ebp - 0x140]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea edx, [ebp - 0x140]
push edx
call esi
mov ecx, dword [ebp - 0x2838]
cmp byte [eax + ecx], 0x3b
jne 0x492390
lea edx, [ebp - 0x140]
push edx
call esi
mov ecx, dword [ebp - 0x2838]
mov byte [eax + ecx], 0
push 0x4ec204
lea edx, [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x140]
call fcn.0047af20
test eax, eax
je 0x492429
push 0x1400
lea eax, [ebp - 0x2820]
push 0
push eax
call fcn.004d29c0
lea ecx, [ebp - 0x140]
add esp, 0xc
push ecx
lea ecx, [ebp - 0x2820]
call fcn.004c0890
add esp, 4
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x2420]
push eax
lea ecx, [ebp - 0x1c20]
push ecx
lea edx, [ebp - 0x550]
push str.MSIE:__s___s__s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
lea edx, [ebp - 0x550]
push edx
jmp 0x49245f
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x550]
push str.MSIE:_Internet_Explorer_Not_found._s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call esi
push eax
lea ecx, [ebp - 0x550]
push ecx
push edi
call ebx
lea edx, [ebp - 0x950]
push edx
lea ecx, [ebp - 0x140]
mov ebx, str.AOL.EXE
call fcn.004c1070
add esp, 4
test eax, eax
je 0x4924cf
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x140]
push ecx
lea edx, [ebp - 0x950]
push edx
lea eax, [ebp - 0x550]
push str.America_Online_version__s_running__s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call esi
push eax
lea eax, [ebp - 0x550]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x950]
push ecx
lea ecx, [ebp - 0x140]
mov ebx, str.firefox.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x49253c
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x950]
push ecx
lea edx, [ebp - 0x550]
push str.Firefox__s_installed_in__s._s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
lea edx, [ebp - 0x550]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x950]
push eax
lea ecx, [ebp - 0x140]
mov ebx, str.Mozilla.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x4925a9
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x950]
push eax
lea ecx, [ebp - 0x550]
push str.Mozilla__s_installed_in__s._s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call esi
push eax
lea ecx, [ebp - 0x550]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [ebp - 0x950]
push edx
lea ecx, [ebp - 0x140]
mov ebx, str.Netscp.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x492616
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x140]
push ecx
lea edx, [ebp - 0x950]
push edx
lea eax, [ebp - 0x550]
push str.Netscape__s_installed_in__s._s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call esi
push eax
lea eax, [ebp - 0x550]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x950]
push ecx
lea ecx, [ebp - 0x140]
mov ebx, str.palemoon.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x492683
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x950]
push ecx
lea edx, [ebp - 0x550]
push str.Pale_Moon__s_installed_in__s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
lea edx, [ebp - 0x550]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ebx, [ebp - 0x140]
call fcn.00404570
test eax, eax
je 0x492727
cmp dword [0x505890], 0
je 0x4926a4
call fcn.004c2580
lea ebx, [ebp - 0x1358]
mov dword [0x505890], 0
mov dword [0x5060a8], 2
call fcn.00404570
test eax, eax
je 0x4926dd
push 1
push 0
push 0
mov eax, ebx
push 0x486eb0
push eax
call fcn.00486cb0
add esp, 0x14
mov eax, dword [0x505890]
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
push eax
lea ecx, [ebp - 0x550]
push str._d_IE_Cookies_in_Folder:__s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call esi
push eax
lea ecx, [ebp - 0x550]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x140]
call fcn.00403b00
test eax, eax
je 0x492789
push 0
call fcn.004034d0
add esp, 4
lea edx, [ebp - 0x2824]
push edx
lea ecx, [ebp - 0x140]
push ecx
push eax
lea edx, [ebp - 0x550]
push str._d_Mozilla_Cookies_in_Folder:__s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
lea edx, [ebp - 0x550]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x4ebdd4
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea ecx, [ebp - 0x2838]
push ecx
lea edx, [ebp - 0xc]
push edx
call esi
push eax
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [0x506e0c], 0
je 0x4927e8
mov ecx, dword [0x4f8b78]
mov edx, dword [0x4f8b7c]
mov dword [ebp - 0x283c], ecx
mov dword [ebp - 0x2840], edx
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0x20106
xor ebx, ebx
mov dword [ebp - 0x2830], ebx
mov eax, dword [ebx + 0x4f8588]
push eax
lea ecx, [ebp - 0x7d0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.ControlSession_Manager_
lea edx, [ebp - 0x7d0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x400
lea eax, [ebp - 0x7d0]
push str.BootExecute
push eax
lea ecx, [ebp - 0x1158]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea ecx, [ebp - 0x1158]
push ecx
call esi
test eax, eax
jle 0x49289c
mov ecx, dword [ebx + 0x4f859c]
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x1158]
push eax
push ecx
lea edx, [ebp - 0x550]
push str.WP00___HKLM_s:_BootExecute___s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
lea edx, [ebp - 0x550]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc dword [ebp - 0x2830]
add ebx, 4
cmp ebx, 0x10
jl 0x4927f0
xor ebx, ebx
lea ebx, [ebx]
mov eax, dword [ebx + 0x4f8588]
push eax
lea ecx, [ebp - 0x7d0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.ControlSession_Manager_
lea edx, [ebp - 0x7d0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x400
lea eax, [ebp - 0x7d0]
push str.PendingFileRenameOperations
push eax
lea ecx, [ebp - 0x1158]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea ecx, [ebp - 0x1158]
push ecx
call esi
test eax, eax
jle 0x49295c
mov ecx, dword [ebx + 0x4f859c]
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x1158]
push eax
push ecx
lea edx, [ebp - 0x550]
push str.WP01___HKLM_s:_PendingFileRenameOperations___s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
lea edx, [ebp - 0x550]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc dword [ebp - 0x2830]
add ebx, 4
cmp ebx, 0x10
jl 0x4928b0
mov eax, dword [str.SYSTEMCurrentControlSet]
push eax
lea ecx, [ebp - 0x7d0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.ControlSession_ManagerEnvironment
lea edx, [ebp - 0x7d0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x400
lea eax, [ebp - 0x7d0]
push str.ComSpec
push eax
lea ecx, [ebp - 0x1158]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea ecx, [ebp - 0x1158]
push ecx
call esi
test eax, eax
jle 0x492a17
mov ecx, dword [0x4f85a0]
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x1158]
push eax
push ecx
lea edx, [ebp - 0x550]
push str.WP02___HKLM_s:_Command___s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea edx, [ebp - 0x550]
push edx
push edi
call ebx
inc dword [ebp - 0x2830]
jmp 0x492a1d
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x2830], 0
je 0x492a4c
push 0x4ebdd4
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea ecx, [ebp - 0x2838]
push ecx
lea edx, [ebp - 0xc]
push edx
call esi
push eax
lea eax, [ebp - 0xc]
push eax
push edi
call ebx
cmp dword [0x506e0c], 0
jne 0x492b61
mov edx, dword [0x4f8b78]
lea ecx, [ebp - 0xc]
push ecx
push edx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto_Update
push CreateStatusWindowA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x492b58
lea eax, [ebp - 0x2838]
push eax
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x2830]
push edx
push 0
push str.AUOptions
push eax
mov dword [ebp - 0x2838], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x492abe
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x492b58
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
jbe 0x492b58
mov ecx, dword [ebp - 0x14]
push 0x400
add ecx, 0x41a
lea edx, [ebp - 0x1158]
call fcn.004ca1e0
mov edx, dword [ebp - 0x14]
add esp, 4
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x1158]
push ecx
push edx
lea eax, [ebp - 0x550]
push str.WP03___Windows_Automatic_Update___d:_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call esi
push eax
lea eax, [ebp - 0x550]
push eax
push edi
call ebx
push 0x4ebdd4
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea edx, [ebp - 0x2838]
push edx
lea eax, [ebp - 0xc]
push eax
call esi
push eax
lea ecx, [ebp - 0xc]
push ecx
push edi
call ebx
cmp dword [0x506e0c], 0
je 0x492b78
mov edx, dword [ebp - 0x283c]
mov eax, dword [ebp - 0x2840]
mov dword [0x4f8b78], edx
mov dword [0x4f8b7c], eax
call fcn.00488120
xor esi, esi
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], esi
test eax, eax
jle 0x492d02
lea edi, [ebp - 0x140]
mov ebx, esi
call fcn.004c22f0
push esi
lea ebx, [ebp - 0x750]
call fcn.004c2260
mov ecx, dword [esi*4 + 0x501878]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
add esp, 4
push ecx
xor ebx, ebx
call edi
test eax, eax
je 0x492bd9
mov edx, dword [esi*4 + 0x501878]
mov ebx, dword [eax + 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esi*4 + 0x501878]
push eax
call edi
mov edi, eax
test edi, edi
je 0x492c9a
push str.GetRunHWND
mov esi, 0x4f30f0
call fcn.0047da70
mov ecx, dword [ebp - 0x2828]
mov edx, dword [ecx*4 + 0x501878]
mov edi, dword [edi + 0x28c]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test edi, edi
jns 0x492c94
push 0x100
cmp ebx, 9
jle 0x492c39
lea eax, [ebp - 0x140]
push eax
mov edx, CreateStatusWindowA
jmp 0x492c45
lea ecx, [ebp - 0x140]
push ecx
mov edx, 0x80000001
push str.SoftwareBillP_StudiosWinPatrolDelayApplet
lea ecx, [ebp - 0x1260]
call fcn.004bff10
add esp, 0xc
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x1260]
push ecx
lea edx, [ebp - 0x750]
push edx
lea eax, [ebp - 0x550]
push str.WP06___Delayed_Start:___s__s__s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [ebp - 0x2828]
add esp, 0x18
jmp 0x492cc4
mov esi, dword [ebp - 0x2828]
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x750]
push eax
lea ecx, [ebp - 0x550]
push str.WP06___Delayed_Start:___s__s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x2834]
push eax
lea ecx, [ebp - 0x550]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc esi
mov dword [ebp - 0x2828], esi
cmp esi, dword [ebp - 0x2830]
jl 0x492b93
push 0x4ebdd4
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
lea ecx, [ebp - 0x2838]
push ecx
lea edx, [ebp - 0xc]
push edx
call esi
mov edi, dword [ebp - 0x2834]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
call ebx
cmp dword [0x506e0c], 0
je 0x492d6f
mov ecx, dword [0x4f8b78]
mov edx, dword [0x4f8b7c]
mov dword [ebp - 0x283c], ecx
mov dword [ebp - 0x2840], edx
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0x20106
push 0x400
push 0x4e27f8
push str.SOFTWAREMicrosoftWindowsCurrentVersionURLDefaultPrefix
lea ecx, [ebp - 0x1158]
mov edx, CreateStatusWindowA
mov dword [ebp - 0x2830], 0
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x492df2
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x1158]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionURLDefaultPrefix
lea edx, [ebp - 0x550]
push str.WP08___HKLM_s:_Default___s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
lea edx, [ebp - 0x550]
push edx
push edi
call ebx
mov dword [ebp - 0x2830], 1
push 0x400
push 0x4f0014
push str.SOFTWAREMicrosoftWindowsCurrentVersionURLPrefixes
lea ecx, [ebp - 0x1158]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x492e6c
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x1158]
push ecx
push 0x4f0014
push str.SOFTWAREMicrosoftWindowsCurrentVersionURLPrefixes
lea edx, [ebp - 0x550]
push str.WP08___HKLM_s:__s___s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call esi
push eax
lea edx, [ebp - 0x550]
push edx
push edi
call ebx
inc dword [ebp - 0x2830]
cmp dword [0x506e0c], 0
je 0x492e8c
mov eax, dword [ebp - 0x283c]
mov ecx, dword [ebp - 0x2840]
mov dword [0x4f8b78], eax
mov dword [0x4f8b7c], ecx
cmp dword [ebp - 0x2830], 0
je 0x492ebb
push 0x4ebdd4
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea eax, [ebp - 0x2838]
push eax
lea ecx, [ebp - 0xc]
push ecx
call esi
push eax
lea edx, [ebp - 0xc]
push edx
push edi
call ebx
call fcn.004c4c00
xor esi, esi
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], esi
test eax, eax
jle 0x49301c
jmp 0x492ee0
lea edi, [ebp - 0x140]
mov ebx, esi
call fcn.004c22f0
push esi
lea ebx, [ebp - 0x750]
call fcn.004c2260
add esp, 4
push esi
lea ebx, [ebp - 0x8d0]
call fcn.004c23e0
mov eax, dword [esi*4 + 0x501878]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x492fa1
lea esi, [eax + 0x290]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x492f5d
push str.GetRunDesc
mov esi, str.No_Description_Available
call fcn.0047da70
add esp, 4
push esi
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0xd58]
call fcn.004010b0
push esi
jmp 0x492f81
push str.GetDesription
call fcn.0047da70
add esp, 4
push esi
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0xd58]
call fcn.004010b0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x2828]
mov edx, dword [ecx*4 + 0x501878]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [ebp - 0x2828]
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0xd58]
push ecx
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x750]
push eax
lea ecx, [ebp - 0x550]
push str.WP31___Scheduled_Tasks:___s__s__s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x2834]
push eax
lea ecx, [ebp - 0x550]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc esi
mov dword [ebp - 0x2828], esi
cmp esi, dword [ebp - 0x2830]
jl 0x492ee0
mov edi, dword [ebp - 0x2834]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x4ebdd4
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea ecx, [ebp - 0x2838]
push ecx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
call ebx
call fcn.004026a0
xor esi, esi
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], esi
test eax, eax
jle 0x4931b2
lea edi, [ebp - 0x140]
mov ebx, esi
call fcn.004c22f0
push esi
lea ebx, [ebp - 0x750]
call fcn.004c2260
add esp, 4
push esi
lea ebx, [ebp - 0x8d0]
call fcn.004c23e0
mov ecx, dword [esi*4 + 0x501878]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x493122
lea esi, [eax + 0x290]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x4930de
push str.GetRunDesc
mov esi, str.No_Description_Available
call fcn.0047da70
add esp, 4
push esi
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0xd58]
call fcn.004010b0
push esi
jmp 0x493102
push str.GetDesription
call fcn.0047da70
add esp, 4
push esi
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0xd58]
call fcn.004010b0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x2828]
mov eax, dword [edx*4 + 0x501878]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [ebp - 0x2828]
lea ecx, [ebp - 0x8d0]
push ecx
call fcn.00402d90
add esp, 4
test eax, 0x400
jne 0x49319f
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0xd58]
push eax
lea ecx, [ebp - 0x140]
push ecx
lea edx, [ebp - 0x750]
push edx
lea eax, [ebp - 0x8d0]
push eax
lea ecx, [ebp - 0x550]
push str.WP16___ActiveX:__s___s___s__s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x2834]
push eax
lea ecx, [ebp - 0x550]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc esi
mov dword [ebp - 0x2828], esi
cmp esi, dword [ebp - 0x2830]
jl 0x493061
push 0x4ebdd4
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea ecx, [ebp - 0x2838]
push ecx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x2834]
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.00487bc0
mov esi, eax
xor ebx, ebx
test esi, esi
jle 0x49325a
cmp ebx, 0x28
jg 0x49325a
lea edi, [ebp - 0x140]
call fcn.004c22f0
lea edx, [ebp - 0x2824]
push edx
mov eax, edi
push eax
lea ecx, [ebp - 0x550]
push str.WP32___Hidden_File:__s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x2834]
push eax
lea ecx, [ebp - 0x550]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc ebx
cmp ebx, esi
jl 0x4931f7
push 0x4ebdd4
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea ecx, [ebp - 0x2838]
push ecx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x2834]
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.00484500
xor esi, esi
mov dword [ebp - 0x2830], eax
mov dword [ebp - 0x2828], esi
test eax, eax
jle 0x4933d1
lea esp, [esp]
lea edi, [ebp - 0x140]
mov ebx, esi
call fcn.004c22f0
push esi
lea ebx, [ebp - 0x750]
call fcn.004c2260
mov edx, dword [esi*4 + 0x501878]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x493362
lea esi, [eax + 0x290]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x49331e
push str.GetRunDesc
mov esi, str.No_Description_Available
call fcn.0047da70
add esp, 4
push esi
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0xd58]
call fcn.004010b0
push esi
jmp 0x493342
push str.GetDesription
call fcn.0047da70
add esp, 4
push esi
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0xd58]
call fcn.004010b0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov eax, dword [ebp - 0x2828]
mov ecx, dword [eax*4 + 0x501878]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [ebp - 0x2828]
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x750]
push ecx
lea edx, [ebp - 0xd58]
push edx
lea eax, [ebp - 0x550]
push str.WP33___File_Type__s:___s__s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x2834]
push eax
lea eax, [ebp - 0x550]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc esi
mov dword [ebp - 0x2828], esi
cmp esi, dword [ebp - 0x2830]
jl 0x4932b0
push 0x4ebdd4
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea eax, [ebp - 0x2838]
push eax
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp - 0x2834]
lea edx, [ebp - 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [ebp - 0x2834]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x1388]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edx, dword [ebp - 0x1384]
push edx
push 0x40
lea ecx, [ebp - 0x9a0]
call fcn.0047ff80
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x9a0]
push ecx
lea edx, [ebp - 0x550]
push str.Memory_currently_in_use:__s___s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call ebx
push eax
lea edx, [ebp - 0x550]
push edx
push esi
call edi
mov eax, dword [ebp - 0x137c]
shr eax, 0xa
push eax
push 0x40
lea ecx, [ebp - 0x9a0]
call fcn.0047ff80
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x9a0]
push edx
lea eax, [ebp - 0x550]
push str.Physical_Memory_Free:__s_KB_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call ebx
push eax
lea eax, [ebp - 0x550]
push eax
push esi
call edi
mov ecx, dword [ebp - 0x1374]
shr ecx, 0xa
push ecx
push 0x40
lea ecx, [ebp - 0x9a0]
call fcn.0047ff80
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x9a0]
push eax
lea ecx, [ebp - 0x550]
push str.Paging_File_Free:__s_KB_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea edx, [ebp - 0x282c]
push edx
lea eax, [ebp - 0x550]
push eax
call ebx
push eax
lea ecx, [ebp - 0x550]
push ecx
push esi
call edi
mov edx, dword [ebp - 0x136c]
shr edx, 0xa
push edx
push 0x40
lea ecx, [ebp - 0x9a0]
call fcn.0047ff80
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x9a0]
push ecx
lea edx, [ebp - 0x550]
push str.Virtual_Memory_Free:__s_KB_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call ebx
push eax
lea edx, [ebp - 0x550]
push edx
push esi
call edi
push 0x4ebdd4
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea ecx, [ebp - 0x2838]
push ecx
lea edx, [ebp - 0xc]
push edx
call ebx
push eax
lea eax, [ebp - 0xc]
push eax
push esi
call edi
push 0x4ebdd4
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea edx, [ebp - 0x2838]
push edx
lea eax, [ebp - 0x14]
push eax
call ebx
push eax
lea ecx, [ebp - 0x14]
push ecx
push esi
call edi
lea edx, [ebp - 0x2824]
push edx
lea eax, [ebp - 0x550]
push 0x4f08a4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea ecx, [ebp - 0x282c]
push ecx
lea edx, [ebp - 0x550]
push edx
call ebx
push eax
lea eax, [ebp - 0x550]
push eax
push esi
call edi
lea ecx, [ebp - 0x2824]
push ecx
lea edx, [ebp - 0x550]
push str.End_of_file_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x550]
push ecx
call ebx
push eax
lea edx, [ebp - 0x550]
push edx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp - 0x2844]
mov ecx, dword [0x4fbdcc]
push 1
push 0
push 0
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret