Function at 0x47f410
Capabilities:
Create process on windows
Hide graphical window
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x53f4a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebx + 4]
push edi
push ecx
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0x44], eax
call fcn.004bc940
mov eax, dword [ebp - 0x1c]
add esp, 8
cmp dword [ebp - 8], 8
jae 0x47f44e
lea eax, [ebp - 0x1c]
push eax
push str.HYPERLINK_CLICK:__S_n
call fcn.004d9d00
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x1c]
add esp, 8
mov eax, edi
cmp esi, 8
jae 0x47f46c
lea eax, [ebp - 0x1c]
mov ecx, str.main_close
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47f497
test dx, dx
je 0x47f493
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47f497
add eax, 4
add ecx, 4
test dx, dx
jne 0x47f471
xor eax, eax
jmp 0x47f49c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47f4bf
mov eax, dword [ebp - 0x40]
mov eax, dword [eax + 0xa0]
test eax, eax
je 0x47f4bf
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x480551
mov eax, edi
cmp esi, 8
jae 0x47f4c9
lea eax, [ebp - 0x1c]
mov ecx, str.main_min
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47f4f6
test dx, dx
je 0x47f4f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47f4f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x47f4d0
xor eax, eax
jmp 0x47f4fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47f524
mov ecx, dword [ebp - 0x40]
mov eax, dword [ecx + 0xa0]
test eax, eax
je 0x47f524
push 0
push 0xf020
push 0x112
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x480551
mov eax, edi
cmp esi, 8
jae 0x47f52e
lea eax, [ebp - 0x1c]
mov ecx, str.main_update_now
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47f559
test dx, dx
je 0x47f555
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47f559
add eax, 4
add ecx, 4
test dx, dx
jne 0x47f533
xor eax, eax
jmp 0x47f55e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47f579
mov edx, dword [ebp - 0x40]
cmp dword [edx + 0xa0], eax
je 0x47f579
mov ecx, edx
call fcn.0046de50
jmp 0x480551
mov eax, edi
cmp esi, 8
jae 0x47f583
lea eax, [ebp - 0x1c]
mov ecx, str.web_hyperlind
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47f5ae
test dx, dx
je 0x47f5aa
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47f5ae
add eax, 4
add ecx, 4
test dx, dx
jne 0x47f588
xor eax, eax
jmp 0x47f5b3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47f64e
mov edi, dword [ebp - 0x44]
push edi
call dword [sym.imp.htmlayout.dll_HTMLayout_UseElement]
mov esi, eax
neg esi
sbb esi, esi
lea eax, [ebp - 0x44]
push eax
not esi
push str.href
and esi, edi
xor ebx, ebx
push esi
mov dword [ebp - 0x44], ebx
call dword [sym.imp.htmlayout.dll_HTMLayoutGetAttributeByName]
mov ecx, dword [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.00402c90
push 1
sub esp, 0x1c
mov ecx, esp
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x3c]
mov edi, 7
xor edx, edx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00402df0
mov ecx, dword [ebp - 0x40]
call fcn.00471160
cmp dword [ebp - 0x24], 8
jb 0x47f62e
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004ea481
add esp, 4
xor edx, edx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ebx
mov word [ebp - 0x38], dx
cmp esi, ebx
je 0x480551
push esi
call dword [sym.imp.htmlayout.dll_HTMLayout_UnuseElement]
jmp 0x480551
mov eax, edi
cmp esi, 8
jae 0x47f658
lea eax, [ebp - 0x1c]
push 6
push str.button
push eax
call fcn.004eb575
add esp, 0xc
test eax, eax
jne 0x47f6b7
push 1
push 6
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], eax
mov word [ebp - 0x38], ax
call fcn.00402df0
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x47f696
lea eax, [ebp - 0x38]
push eax
call fcn.004eb0b4
add esp, 4
lea ecx, [ebp - 0x3c]
mov esi, eax
call fcn.00402d10
mov ecx, dword [ebp - 0x40]
push esi
call fcn.0047bd20
jmp 0x480551
mov eax, dword [ebp - 0x1c]
mov esi, 8
cmp dword [ebp - 8], esi
jae 0x47f6c7
lea eax, [ebp - 0x1c]
push 0xb
push str.left_button
push eax
call fcn.004eb575
add esp, 0xc
test eax, eax
jne 0x47f719
push 1
push 0xb
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x20]
call fcn.0046e4a0
cmp dword [eax + 0x18], esi
jb 0x47f6f5
mov eax, dword [eax + 4]
jmp 0x47f6f8
add eax, 4
push eax
call fcn.004eb0b4
add esp, 4
lea ecx, [ebp - 0x3c]
mov esi, eax
call fcn.00402d10
mov ecx, dword [ebp - 0x40]
push esi
call fcn.0047a810
jmp 0x480551
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], esi
jae 0x47f724
lea eax, [ebp - 0x1c]
push 0xb
push str.main_check_mobile
push eax
call fcn.004eb575
add esp, 0xc
test eax, eax
jne 0x47f750
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x48]
test ecx, ecx
je 0x480551
call fcn.004b8cb0
jmp 0x480551
mov edi, dword [ebp - 0x40]
mov eax, dword [edi + 0x80]
test eax, eax
jne 0x47f996
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
cmp esi, 8
jae 0x47f771
lea eax, [ebp - 0x1c]
mov ecx, str.main_scan
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47f79c
test dx, dx
je 0x47f798
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47f79c
add eax, 4
add ecx, 4
test dx, dx
jne 0x47f776
xor eax, eax
jmp 0x47f7a1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47f7b7
mov ecx, edi
mov byte [edi + 0xa6], al
call fcn.004790c0
jmp 0x480551
mov eax, ebx
cmp esi, 8
jae 0x47f7c1
lea eax, [ebp - 0x1c]
mov ecx, str.main_stop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47f7ec
test dx, dx
je 0x47f7e8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47f7ec
add eax, 4
add ecx, 4
test dx, dx
jne 0x47f7c6
xor eax, eax
jmp 0x47f7f1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47f801
mov byte [edi + 0x215], 1
jmp 0x480551
mov eax, ebx
cmp esi, 8
jae 0x47f80b
lea eax, [ebp - 0x1c]
mov ecx, str.main_mfsz
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47f836
test dx, dx
je 0x47f832
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47f836
add eax, 4
add ecx, 4
test dx, dx
jne 0x47f810
xor eax, eax
jmp 0x47f83b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47f87d
push str.srms.exe
add edi, 0x33c
lea ecx, [ebp - 0x44]
push edi
push ecx
call fcn.0046d520
mov edx, dword [ebp - 0x44]
add esp, 0xc
push 5
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
sub esp, 0x1c
mov ecx, esp
push 0x510824
jmp 0x47fa1c
mov eax, ebx
cmp esi, 8
jae 0x47f887
lea eax, [ebp - 0x1c]
mov ecx, str.main_srie
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47f8b6
test dx, dx
je 0x47f8b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47f8b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x47f890
xor eax, eax
jmp 0x47f8bb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47f8db
push eax
sub esp, 0x1c
mov ecx, esp
push 0x52a4dc
call fcn.00402c90
mov ecx, edi
call fcn.00471160
jmp 0x480551
mov eax, ebx
cmp esi, 8
jae 0x47f8e5
lea eax, [ebp - 0x1c]
mov ecx, str.main_root
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47f916
test dx, dx
je 0x47f912
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47f916
add eax, 4
add ecx, 4
test dx, dx
jne 0x47f8f0
xor eax, eax
jmp 0x47f91b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47f92b
mov ecx, edi
call fcn.00471590
jmp 0x480551
mov eax, ebx
cmp esi, 8
jae 0x47f935
lea eax, [ebp - 0x1c]
mov ecx, str.main_wmzm
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47f966
test dx, dx
je 0x47f962
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47f966
add eax, 4
add ecx, 4
test dx, dx
jne 0x47f940
xor eax, eax
jmp 0x47f96b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47f97b
mov ecx, edi
call fcn.00471700
jmp 0x480551
mov eax, ebx
cmp esi, 8
jae 0x47f985
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x44]
push ecx
push eax
mov ecx, edi
call fcn.0047d000
jmp 0x480551
cmp eax, 2
jne 0x47fa38
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], esi
jae 0x47f9aa
lea eax, [ebp - 0x1c]
mov ecx, str.main_wjaqzs
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47f9d6
test dx, dx
je 0x47f9d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47f9d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x47f9b0
xor eax, eax
jmp 0x47f9db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x480551
push str.safeedit.exe
add edi, 0x33c
lea edx, [ebp - 0x44]
push edi
push edx
call fcn.0046d520
mov eax, dword [ebp - 0x44]
add esp, 0xc
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
sub esp, 0x1c
mov ecx, esp
push 0x5107b0
call fcn.004013e0
mov ecx, 0x542730
call fcn.004bd020
lea ecx, [ebp - 0x44]
call fcn.00492ef0
jmp 0x480551
mov edi, 1
cmp eax, edi
jne 0x480551
mov esi, dword [ebp - 0x40]
mov eax, dword [esi + 0x8c]
test eax, eax
jne 0x47fc11
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x47fa62
lea eax, [ebp - 0x1c]
push 8
push str.checkbox
push eax
call fcn.004eb575
add esp, 0xc
test eax, eax
jne 0x47fa86
mov ecx, dword [ebx + 4]
push ecx
mov ecx, esi
call fcn.0046e310
jmp 0x480551
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
cmp edi, 8
jae 0x47fa96
lea eax, [ebp - 0x1c]
mov ecx, str.clean_scan
jmp 0x47faa0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47fac6
test dx, dx
je 0x47fac2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47fac6
add eax, 4
add ecx, 4
test dx, dx
jne 0x47faa0
xor eax, eax
jmp 0x47facb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47faf4
mov ecx, esi
call fcn.004667a0
sub esp, 0x1c
mov ecx, esp
push 0x510780
call fcn.004013e0
mov ecx, 0x542730
call fcn.004bd020
jmp 0x480551
mov eax, ebx
cmp edi, 8
jae 0x47fafe
lea eax, [ebp - 0x1c]
mov ecx, str.clean_recom
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47fb29
test dx, dx
je 0x47fb25
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47fb29
add eax, 4
add ecx, 4
test dx, dx
jne 0x47fb03
xor eax, eax
jmp 0x47fb2e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47fb52
mov ecx, esi
mov byte [esi + 0x214], 1
mov byte [esi + 0x213], 1
mov byte [esi + 0x212], al
call fcn.0046df40
jmp 0x480551
mov eax, ebx
cmp edi, 8
jae 0x47fb5c
lea eax, [ebp - 0x1c]
mov ecx, str.clean_all
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47fb87
test dx, dx
je 0x47fb83
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47fb87
add eax, 4
add ecx, 4
test dx, dx
jne 0x47fb61
xor eax, eax
jmp 0x47fb8c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47fbb1
mov ecx, esi
mov byte [esi + 0x214], 1
mov byte [esi + 0x213], 1
mov byte [esi + 0x212], 1
call fcn.0046df40
jmp 0x480551
mov eax, ebx
cmp edi, 8
jae 0x47fbbb
lea eax, [ebp - 0x1c]
mov ecx, str.clean_none
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47fbe6
test dx, dx
je 0x47fbe2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47fbe6
add eax, 4
add ecx, 4
test dx, dx
jne 0x47fbc0
xor eax, eax
jmp 0x47fbeb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x480551
mov ecx, esi
mov byte [ecx + 0x214], al
mov byte [ecx + 0x213], al
mov byte [ecx + 0x212], al
call fcn.0046df40
jmp 0x480551
cmp eax, 2
jne 0x47ff6d
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x47fc26
lea eax, [ebp - 0x1c]
mov ecx, str.clean_reg_pre
jmp 0x47fc30
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47fc56
test dx, dx
je 0x47fc52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47fc56
add eax, 4
add ecx, 4
test dx, dx
jne 0x47fc30
xor eax, eax
jmp 0x47fc5b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x480551
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0x1c]
mov eax, esi
cmp ebx, 8
jae 0x47fc73
lea eax, [ebp - 0x1c]
mov ecx, str.clean_scan_reg
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47fc9e
test dx, dx
je 0x47fc9a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47fc9e
add eax, 4
add ecx, 4
test dx, dx
jne 0x47fc78
xor eax, eax
jmp 0x47fca3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47fd3a
mov ebx, dword [ebp - 0x40]
cmp dword [ebx + 0xf0], eax
lea esi, [ebx + 0xf0]
je 0x47fcd2
mov edx, dword [ebx + 0x158]
push eax
mov eax, dword [ebx + 0x15c]
push edx
push eax
mov ecx, esi
call fcn.00461df0
cmp dword [ebx + 0x30], 0
mov dword [ebx + 0x1f0], 0
je 0x480551
push 0x50f430
mov ecx, esi
call fcn.004650f0
push eax
lea ecx, [ebp - 0x44]
call fcn.004605c0
cmp dword [ebp - 0x44], 0
je 0x47fd0e
push 0x52a4dc
lea ecx, [ebp - 0x44]
call fcn.00460700
mov esi, ebx
mov ecx, dword [esi + 0x30]
mov edx, dword [ecx + 4]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x30]
call fcn.004ac6c0
lea ecx, [ebp - 0x44]
mov dword [esi + 0x1f0], edi
call fcn.004605f0
jmp 0x480551
mov eax, esi
cmp ebx, 8
jae 0x47fd44
lea eax, [ebp - 0x1c]
mov ecx, str.clean_reg_all
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47fd76
test dx, dx
je 0x47fd72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47fd76
add eax, 4
add ecx, 4
test dx, dx
jne 0x47fd50
xor eax, eax
jmp 0x47fd7b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47fd97
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x480551
call fcn.004aea30
jmp 0x480551
mov eax, esi
cmp ebx, 8
jae 0x47fda1
lea eax, [ebp - 0x1c]
mov ecx, str.clean_reg_none
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47fdcc
test dx, dx
je 0x47fdc8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47fdcc
add eax, 4
add ecx, 4
test dx, dx
jne 0x47fda6
xor eax, eax
jmp 0x47fdd1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47fde0
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx + 0x30]
jmp 0x480548
mov eax, esi
cmp ebx, 8
jae 0x47fdea
lea eax, [ebp - 0x1c]
mov ecx, str.clean_reg_clean
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47fe16
test dx, dx
je 0x47fe12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47fe16
add eax, 4
add ecx, 4
test dx, dx
jne 0x47fdf0
xor eax, eax
jmp 0x47fe1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47fefe
mov edx, dword [ebp - 0x40]
cmp dword [edx + 0x30], eax
je 0x480551
mov esi, edx
mov ecx, esi
call fcn.00462870
mov ecx, dword [esi + 0x30]
call fcn.004aec30
push 0x50f430
lea ecx, [esi + 0xf0]
call fcn.004650f0
push eax
lea ecx, [ebp - 0x44]
call fcn.004605c0
cmp dword [ebp - 0x44], 0
je 0x47fed8
push edi
push 2
lea ecx, [ebp - 0xc4]
call fcn.00474950
mov ecx, dword [esi + 0x30]
push 0x541a7c
push 0
call fcn.0049f4b0
push eax
lea eax, [ebp - 0xc4]
push 0x541a44
push eax
call fcn.00475000
add esp, 8
mov ecx, eax
call fcn.00474520
push eax
call fcn.00475000
add esp, 8
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0xc0]
call fcn.0046ed90
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x47febc
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x44]
call fcn.00460700
lea ecx, [ebp - 0x3c]
call fcn.00402d10
lea ecx, [ebp - 0xc4]
call fcn.00467b70
sub esp, 0x1c
mov ecx, esp
push 0x5106a0
call fcn.004013e0
mov ecx, 0x542730
call fcn.004bd020
lea ecx, [ebp - 0x44]
call fcn.004605f0
jmp 0x480551
mov eax, esi
cmp ebx, 8
jae 0x47ff08
lea eax, [ebp - 0x1c]
mov ecx, str.clean_reg_stop
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47ff36
test dx, dx
je 0x47ff32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47ff36
add eax, 4
add ecx, 4
test dx, dx
jne 0x47ff10
xor eax, eax
jmp 0x47ff3b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x480551
mov edx, dword [ebp - 0x40]
mov ecx, dword [edx + 0x30]
test ecx, ecx
je 0x480551
call fcn.0049f500
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x1f0], 2
call fcn.00466270
jmp 0x480551
cmp eax, 3
jne 0x4801c4
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0x1c]
mov eax, esi
cmp ebx, 8
jae 0x47ff86
lea eax, [ebp - 0x1c]
mov ecx, str.clean_helper_scan
jmp 0x47ff90
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47ffb6
test dx, dx
je 0x47ffb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47ffb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x47ff90
xor eax, eax
jmp 0x47ffbb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x480015
mov eax, dword [ebp - 0x40]
cmp dword [eax + 0x38], 0
je 0x480551
mov esi, eax
push 0x50f430
lea ecx, [esi + 0xf0]
call fcn.004650f0
push eax
lea ecx, [ebp - 0x44]
call fcn.004605c0
cmp dword [ebp - 0x44], 0
je 0x47fffa
push 0x52a4dc
lea ecx, [ebp - 0x44]
call fcn.00460700
mov ecx, dword [esi + 0x38]
mov dword [esi + 0x1f4], edi
call fcn.004ac6c0
lea ecx, [ebp - 0x44]
call fcn.004605f0
jmp 0x480551
mov eax, esi
cmp ebx, 8
jae 0x48001f
lea eax, [ebp - 0x1c]
mov ecx, 0x510634
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x48004a
test dx, dx
je 0x480046
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x48004a
add eax, 4
add ecx, 4
test dx, dx
jne 0x480024
xor eax, eax
jmp 0x48004f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x48011c
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx + 0x38]
test ecx, ecx
je 0x480551
call fcn.0049f500
mov esi, dword [ebp - 0x40]
mov ecx, dword [esi + 0x38]
call fcn.004aec30
push 0x50f430
lea ecx, [esi + 0xf0]
call fcn.004650f0
push eax
lea ecx, [ebp - 0x44]
call fcn.004605c0
cmp dword [ebp - 0x44], 0
je 0x48010d
push edi
push 2
lea ecx, [ebp - 0xc4]
call fcn.00474950
mov ecx, dword [esi + 0x38]
push 0x541a98
push 2
call fcn.0049f4b0
push eax
lea edx, [ebp - 0xc4]
push 0x541a44
push edx
call fcn.00475000
add esp, 8
mov ecx, eax
call fcn.00474520
push eax
call fcn.00475000
add esp, 8
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0xc0]
call fcn.0046ed90
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x4800f1
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x44]
call fcn.00460700
lea ecx, [ebp - 0x3c]
call fcn.00402d10
lea ecx, [ebp - 0xc4]
call fcn.00467b70
sub esp, 0x1c
mov ecx, esp
push 0x510630
jmp 0x47fee2
mov eax, esi
cmp ebx, 8
jae 0x480126
lea eax, [ebp - 0x1c]
mov ecx, str.clean_helper_all
jmp 0x480130
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x480156
test dx, dx
je 0x480152
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x480156
add eax, 4
add ecx, 4
test dx, dx
jne 0x480130
xor eax, eax
jmp 0x48015b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x480177
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx + 0x38]
test ecx, ecx
je 0x480551
call fcn.004aea30
jmp 0x480551
mov eax, esi
cmp ebx, 8
jae 0x480181
lea eax, [ebp - 0x1c]
mov ecx, str.clean_helper_none
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4801ac
test dx, dx
je 0x4801a8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4801ac
add eax, 4
add ecx, 4
test dx, dx
jne 0x480186
xor eax, eax
jmp 0x4801b1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x480551
mov edx, dword [ebp - 0x40]
mov ecx, dword [edx + 0x38]
jmp 0x480548
cmp eax, edi
jne 0x480551
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x1c]
mov eax, edi
cmp esi, 8
jae 0x4801dc
lea eax, [ebp - 0x1c]
mov ecx, str.clean_scan_file
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x480207
test dx, dx
je 0x480203
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x480207
add eax, 4
add ecx, 4
test dx, dx
jne 0x4801e1
xor eax, eax
jmp 0x48020c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x480236
mov ecx, dword [ebp - 0x40]
call fcn.00472d70
sub esp, 0x1c
mov ecx, esp
push 0x5105c4
call fcn.004013e0
mov ecx, 0x542730
call fcn.004bd020
jmp 0x480551
mov eax, edi
cmp esi, 8
jae 0x480240
lea eax, [ebp - 0x1c]
mov ecx, str.clean_file_pre
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x48026b
test dx, dx
je 0x480267
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x48026b
add eax, 4
add ecx, 4
test dx, dx
jne 0x480245
xor eax, eax
jmp 0x480270
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4802d8
mov eax, dword [ebp - 0x40]
cmp dword [eax + 0xf0], 0
lea ecx, [eax + 0xf0]
je 0x48029b
mov edx, dword [eax + 0x168]
mov eax, dword [eax + 0x16c]
push 0
push edx
push eax
call fcn.00461df0
mov edi, dword [ebp - 0x40]
mov eax, dword [edi + 0x34]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x4802b3
mov ecx, dword [eax + 4]
push 0
push ecx
call esi
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x4802c2
mov edx, dword [eax + 4]
push 5
push edx
call esi
mov ecx, edi
mov dword [edi + 0x1f8], 0
call fcn.00478820
jmp 0x480551
mov eax, edi
cmp esi, 8
jae 0x4802e2
lea eax, [ebp - 0x1c]
mov ecx, str.clean_file_stop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x48030d
test dx, dx
je 0x480309
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x48030d
add eax, 4
add ecx, 4
test dx, dx
jne 0x4802e7
xor eax, eax
jmp 0x480312
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x48032e
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x34]
test ecx, ecx
je 0x480551
call fcn.0049f500
jmp 0x480551
mov eax, edi
cmp esi, 8
jae 0x480338
lea eax, [ebp - 0x1c]
mov ecx, str.clean_file_reset_cfg
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x480366
test dx, dx
je 0x480362
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x480366
add eax, 4
add ecx, 4
test dx, dx
jne 0x480340
xor eax, eax
jmp 0x48036b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x48039c
mov esi, dword [ebp - 0x40]
lea ecx, [esi + 0x204]
push ecx
sub esp, 0x1c
mov ecx, esp
push 0x5418b8
call fcn.00402ce0
call fcn.00470860
add esp, 0x20
mov ecx, esi
call fcn.00478820
jmp 0x480551
mov eax, edi
cmp esi, 8
jae 0x4803a6
lea eax, [ebp - 0x1c]
mov ecx, str.add_file_exp
jmp 0x4803b0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4803d6
test dx, dx
je 0x4803d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4803d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4803b0
xor eax, eax
jmp 0x4803db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4803ec
mov ecx, dword [ebp - 0x40]
call fcn.0047a310
jmp 0x480551
mov eax, edi
cmp esi, 8
jae 0x4803f6
lea eax, [ebp - 0x1c]
push 6
push 0x51052c
push eax
call fcn.004eb575
add esp, 0xc
test eax, eax
jne 0x480447
push 0xffffffffffffffff
push 6
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x20]
call fcn.0046e4a0
cmp dword [eax + 0x18], 8
jb 0x480425
mov eax, dword [eax + 4]
jmp 0x480428
add eax, 4
push eax
call fcn.004eb0b4
mov ecx, dword [ebp - 0x40]
add esp, 4
push eax
call fcn.0047a470
lea ecx, [ebp - 0x3c]
call fcn.00402d10
jmp 0x480551
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x1c]
mov eax, edi
cmp esi, 8
jae 0x480457
lea eax, [ebp - 0x1c]
mov ecx, str.clean_file_clean
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x480486
test dx, dx
je 0x480482
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x480486
add eax, 4
add ecx, 4
test dx, dx
jne 0x480460
xor eax, eax
jmp 0x48048b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4804b5
mov ecx, dword [ebp - 0x40]
call fcn.00478ed0
sub esp, 0x1c
mov ecx, esp
push 0x510504
call fcn.004013e0
mov ecx, 0x542730
call fcn.004bd020
jmp 0x480551
mov eax, edi
cmp esi, 8
jae 0x4804bf
lea eax, [ebp - 0x1c]
mov ecx, str.clean_file_all
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4804ea
test dx, dx
je 0x4804e6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4804ea
add eax, 4
add ecx, 4
test dx, dx
jne 0x4804c4
xor eax, eax
jmp 0x4804ef
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x480504
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x34]
test ecx, ecx
je 0x480551
call fcn.004aea30
jmp 0x480551
mov eax, edi
cmp esi, 8
jae 0x48050e
lea eax, [ebp - 0x1c]
mov ecx, str.clean_file_none
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x480539
test dx, dx
je 0x480535
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x480539
add eax, 4
add ecx, 4
test dx, dx
jne 0x480513
xor eax, eax
jmp 0x48053e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x480551
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx + 0x34]
test ecx, ecx
je 0x480551
call fcn.004aeb30
cmp dword [ebp - 8], 8
jb 0x480563
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004ea481
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ea5a8
mov esp, ebp
pop ebp
ret 8