Function at 0x4be8f0
Capabilities:
Check if file exists
Encode data using base64
Get common file path
Get session user name

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f2eb2
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x230
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], ecx
mov edx, dword [ebx + 8]
mov dword [ebp - 0x218], edx
call fcn.0043e530
test al, al
jne 0x4be950
xor eax, eax
jmp 0x4c2731
mov eax, dword [ecx + 0x14e4]
xorps xmm0, xmm0
mov dword [ebp - 0x1a4], eax
lea ecx, [ebp - 0x2c]
lea eax, [edx + 8]
movq qword [ebp - 0x2c], xmm0
push eax
mov dword [ebp - 0x24], 0
call fcn.005dc5b0
push 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push 0x20019
mov dword [ebp - 0x18], 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a80
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
call fcn.005d6aa0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.005d6a00
test eax, eax
jne 0x4be9c3
xor edi, edi
jmp 0x4c2717
xorps xmm0, xmm0
mov dword [ebp - 0x1cc], 0
lea ecx, [ebp - 0x1d4]
movq qword [ebp - 0x1d4], xmm0
call fcn.005d6ac0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.005d6280
mov esi, eax
mov dword [ebp - 0x23c], esi
test esi, esi
jne 0x4bea02
xor edi, edi
jmp 0x4c270c
call fcn.005e17a0
mov byte [ebp - 0x221], al
mov ecx, 0xc
mov eax, esi
mov dword [ebp - 0x1bc], esi
mul ecx
mov edi, 0xffffffff
cmovb eax, edi
add eax, 4
cmovb eax, edi
push eax
call fcn.0041e7cf
add esp, 4
mov dword [ebp - 0x1c4], eax
push fcn.005dc430
push fcn.005dc5e0
push esi
mov byte [ebp - 4], 4
mov dword [eax], esi
add eax, 4
push 0xc
push eax
mov dword [ebp - 0x228], eax
call fcn.0041e804
xorps xmm0, xmm0
mov dword [ebp - 0x124], 0
lea ecx, [ebp - 0x12c]
movq qword [ebp - 0x12c], xmm0
call fcn.005dc5e0
mov ecx, 0xc
mov byte [ebp - 4], 5
mov eax, esi
mov dword [ebp - 0x1bc], esi
mul ecx
cmovb eax, edi
add eax, 4
cmovb eax, edi
push eax
call fcn.0041e7cf
add esp, 4
mov dword [ebp - 0x1c4], eax
push fcn.005dc430
push fcn.005dc5e0
push esi
mov byte [ebp - 4], 6
mov dword [eax], esi
add eax, 4
push 0xc
push eax
mov dword [ebp - 0x22c], eax
call fcn.0041e804
xorps xmm0, xmm0
mov dword [ebp - 0x10c], 0
lea ecx, [ebp - 0x114]
movq qword [ebp - 0x114], xmm0
call fcn.005dc5e0
mov ecx, 4
mov byte [ebp - 4], 7
mov eax, esi
mul ecx
cmovb eax, edi
push eax
call fcn.0041e7cf
mov edi, eax
mov ecx, 4
add esp, 4
mov dword [ebp - 0x21c], edi
mov eax, esi
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0041e7cf
add esp, 4
mov dword [ebp - 0x230], eax
shl esi, 2
push esi
push 0
push edi
call fcn.00420090
add esp, 0xc
push esi
mov esi, dword [ebp - 0x230]
push 0
push esi
call fcn.00420090
mov eax, dword [ebp - 0x228]
xorps xmm0, xmm0
movlpd qword [ebp - 0x180], xmm0
add esp, 0xc
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0x22c]
movlpd qword [ebp - 0x188], xmm0
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], 0
movlpd qword [ebp - 0x190], xmm0
mov dword [ebp - 0x190], edi
mov dword [ebp - 0x18c], 0
movlpd qword [ebp - 0x198], xmm0
mov dword [ebp - 0x198], esi
mov dword [ebp - 0x194], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
call fcn.005d6aa0
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], 0
call fcn.005d6aa0
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xa8], 0
call fcn.005d6aa0
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x1a4]
push dword [eax + 0x14]
call fcn.005c5730
push 1
push dword [ebp - 0x23c]
mov esi, eax
push 0x21
push 0x12
push 0x12
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
push eax
push 0
push 0x1109
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
mov dword [ebp - 0x234], edi
cmp dword [ebp - 0x23c], edi
jbe 0x4bedf6
mov ecx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x228]
mov esi, dword [ebp - 0x21c]
sub eax, ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x1bc], eax
lea eax, [ebp - 0x1d4]
push eax
push edi
lea ecx, [ebp - 0x18]
call fcn.005d6380
test al, al
je 0x4bedf0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x2c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x114]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0x114]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1c]
call fcn.005d6a30
mov eax, dword [ebp - 0x1bc]
lea ecx, [ebp - 0x1c]
add eax, dword [ebp - 0x238]
push eax
push str.InstallLocation
call fcn.005d6740
push dword [ebp - 0x238]
lea ecx, [ebp - 0x1c]
push 0x62dfc8
call fcn.005d6740
mov ecx, dword [ebp - 0x238]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__0_
call fcn.005dc190
push eax
lea ecx, [ebp - 0x12c]
call fcn.005dc200
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x12c]
push dword [eax + 0x14]
push 0xffffffffffffffff
push 0
push 0
call fcn.005dc190
mov ecx, dword [ebp - 0x1a4]
push eax
call fcn.005ba280
mov dword [esi + edi*4], eax
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x1c8]
xorps xmm0, xmm0
push eax
push str.hicon
movlpd qword [ebp - 0x1c8], xmm0
call fcn.005d6620
test al, al
je 0x4beda8
mov ecx, dword [ebp - 0x1c8]
mov eax, ecx
or eax, dword [ebp - 0x1c4]
je 0x4beda8
mov eax, dword [ebp - 0x218]
push ecx
push ecx
push dword [esi + edi*4]
mov ecx, dword [ebp - 0x1a4]
push dword [eax + 0x14]
call fcn.005b9cb0
push dword [ebp - 0x1c8]
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x4beddc
mov ecx, dword [ebp - 0x220]
sub esp, 8
push 0
push 0x14
push 0x14
push 0xa7
call fcn.00436420
mov ecx, dword [ebp - 0x1a4]
add esp, 4
push eax
mov eax, dword [ebp - 0x218]
push dword [esi + edi*4]
push dword [eax + 0x14]
call fcn.005b9a90
add dword [ebp - 0x238], 0xc
inc edi
cmp edi, dword [ebp - 0x23c]
jb 0x4bec65
mov dword [ebp - 0x234], edi
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x74]
movq qword [ebp - 0x74], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x9c], 0
lea ecx, [ebp - 0xa4]
movq qword [ebp - 0xa4], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xac], 0
lea ecx, [ebp - 0xb4]
movq qword [ebp - 0xb4], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xb8], 0
lea ecx, [ebp - 0xc0]
movq qword [ebp - 0xc0], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x118], 0
lea ecx, [ebp - 0x120]
movq qword [ebp - 0x120], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x38]
movq qword [ebp - 0x38], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x4c]
movq qword [ebp - 0x4c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xd4], 0
lea ecx, [ebp - 0xdc]
movq qword [ebp - 0xdc], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x58]
movq qword [ebp - 0x58], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ec]
xorps xmm0, xmm0
mov dword [ebp - 0x1e4], 0
movq qword [ebp - 0x1ec], xmm0
call fcn.005d6ac0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x1e0]
xorps xmm0, xmm0
mov dword [ebp - 0x1d8], 0
movq qword [ebp - 0x1e0], xmm0
call fcn.005d6ac0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1f8]
xorps xmm0, xmm0
mov dword [ebp - 0x1f0], 0
movq qword [ebp - 0x1f8], xmm0
call fcn.005d6ac0
mov ecx, dword [ebp - 0x220]
push str.Searching_for_uninstall_leftovers...
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x20], 0
push 0xffffffffffffffff
lea ecx, [ecx + 0x14f0]
call fcn.005b66e0
xor ecx, ecx
mov esi, str.HKCRCLSID
mov dword [ebp - 0x23c], ecx
nop
cmp ecx, 1
jne 0x4befa3
mov dl, byte [ebp - 0x221]
test dl, dl
je 0x4bf1e6
cmp ecx, 1
mov eax, str.HKCRWow6432NodeCLSID
lea ecx, [ebp - 0x2c]
cmovne eax, esi
push eax
call fcn.005dc510
push ecx
push 0x20019
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
test al, al
je 0x4bf1ca
mov esi, dword [ebp - 0x218]
mov eax, 1
mov dword [ebp - 0x1b4], eax
cmp byte [esi + 4], 0
jne 0x4bf1c5
lea ecx, [ebp - 0x1d4]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6380
test al, al
je 0x4bf1c5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x2c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x74]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1c]
call fcn.005d6a30
lea ecx, [ebp - 0x1c]
call fcn.005d6280
mov dword [ebp - 0x1bc], eax
test eax, eax
je 0x4bf1ae
lea eax, [ebp - 0x1ec]
mov dword [ebp - 0x1ac], 0
push eax
push 0
lea ecx, [ebp - 0x1c]
call fcn.005d6380
test al, al
je 0x4bf1ae
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0x74]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0xa4]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0xa4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005d6a30
lea eax, [ebp - 0x38]
push eax
push 0x62439c
lea ecx, [ebp - 0x3c]
call fcn.005d6740
test al, al
je 0x4bf189
lea ecx, [ebp - 0x38]
call fcn.005dbeb0
test al, al
jne 0x4bf189
call fcn.005d4600
test al, al
jne 0x4bf189
push 0
lea ecx, [ebp - 0x38]
call fcn.005dbc20
xor eax, eax
mov dword [ebp - 0x1a8], eax
test edi, edi
je 0x4bf189
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x21c]
mov dword [ebp - 0x1a4], ecx
cmp dword [esi + eax*4], 0
je 0x4bf16f
call fcn.005dc3a0
mov ecx, dword [ebp - 0x1a4]
test eax, eax
je 0x4bf169
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005daa70
test eax, eax
jne 0x4bf44d
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a8]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], ecx
cmp eax, edi
jb 0x4bf130
mov esi, dword [ebp - 0x218]
mov eax, dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1ec]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1ac], eax
call fcn.005d6380
test al, al
jne 0x4bf087
mov eax, dword [ebp - 0x1b4]
inc eax
cmp byte [esi + 4], 0
mov dword [ebp - 0x1b4], eax
je 0x4beff1
mov esi, str.HKCRCLSID
mov ecx, dword [ebp - 0x23c]
inc ecx
mov dword [ebp - 0x23c], ecx
cmp ecx, 2
jb 0x4bef90
mov dl, byte [ebp - 0x221]
mov eax, dword [ebp - 0x218]
cmp byte [eax + 4], 0
jne 0x4c25d4
xor esi, esi
mov ecx, str.HKCR
mov dword [ebp - 0x1b0], esi
cmp esi, 1
jne 0x4bf210
test dl, dl
je 0x4bfb6f
cmp byte [eax + 4], 0
jne 0x4c25d4
cmp esi, 1
mov eax, str.HKCRWow6432Node
cmovne eax, ecx
lea ecx, [ebp - 0x2c]
push eax
call fcn.005dc510
push ecx
push 0x20019
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
test al, al
mov eax, dword [ebp - 0x218]
je 0x4bfb54
xor ecx, ecx
mov dword [ebp - 0x1b4], ecx
cmp byte [eax + 4], cl
jne 0x4bfb54
lea eax, [ebp - 0x1d4]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.005d6380
test al, al
je 0x4bfb4e
mov eax, dword [ebp - 0x1d4]
cmp word [eax], 0x2e
je 0x4bfb29
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0x624284
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xa4]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0xa4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1c]
call fcn.005d6a30
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Shell
lea ecx, [ebp - 0xa4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xb4]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005d6a30
test al, al
je 0x4bf6d3
lea eax, [ebp - 0x1e0]
mov dword [ebp - 0x1c4], 0
push eax
push 0
lea ecx, [ebp - 0x3c]
call fcn.005d6380
test al, al
je 0x4bf6d3
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0xb4]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0xc0]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0xc0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x68]
call fcn.005d6a30
test al, al
je 0x4bf52c
lea eax, [ebp - 0x38]
push eax
push str.Icon
lea ecx, [ebp - 0x68]
call fcn.005d6740
test al, al
je 0x4bf52c
lea ecx, [ebp - 0x38]
call fcn.005dc3a0
cmp eax, 4
jle 0x4bf52c
push esi
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x38]
call fcn.005d4680
mov esi, dword [ebp - 0x21c]
xor eax, eax
mov dword [ebp - 0x1a8], eax
test edi, edi
je 0x4bf532
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x1a4], ecx
cmp dword [esi + eax*4], 0
je 0x4bf434
call fcn.005dc3a0
mov ecx, dword [ebp - 0x1a4]
test eax, eax
je 0x4bf42e
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x58]
call fcn.005daa70
test eax, eax
jne 0x4bf4ca
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a8]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], ecx
cmp eax, edi
jb 0x4bf3f5
jmp 0x4bf532
cmp dword [ebp - 0x1bc], 1
lea ecx, [ebp - 0xa4]
ja 0x4bf45f
lea ecx, [ebp - 0x74]
call fcn.005dc190
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x1c4], eax
call fcn.005dc190
push eax
push 0x68fb68
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
mov esi, dword [ebp - 0x218]
push eax
push esi
call fcn.004bdc10
jmp 0x4bf189
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.005dc190
push eax
push str.___Icon___
lea ecx, [ebp - 0xc0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
jmp 0x4bf532
mov esi, dword [ebp - 0x21c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627384
lea ecx, [ebp - 0xc0]
call fcn.005da780
push ecx
push 0x20019
lea ecx, [ebp - 0xc0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x68]
call fcn.005d6a30
lea eax, [ebp - 0x38]
push eax
push 0x62439c
lea ecx, [ebp - 0x68]
call fcn.005d6740
test al, al
je 0x4bf6a8
lea ecx, [ebp - 0x38]
call fcn.005dc3a0
cmp eax, 3
jle 0x4bf6a8
push 3
push 1
push 1
push 1
push 0x624e08
lea ecx, [ebp - 0x38]
call fcn.005daa70
cmp eax, 1
je 0x4bf6a8
cmp eax, 2
je 0x4bf6a8
push dword [ebp - 0x1b0]
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x38]
call fcn.005d4680
xor eax, eax
mov dword [ebp - 0x1a8], eax
test edi, edi
je 0x4bf6a8
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x1a4], ecx
cmp dword [esi + eax*4], 0
je 0x4bf62b
call fcn.005dc3a0
mov ecx, dword [ebp - 0x1a4]
test eax, eax
je 0x4bf625
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x58]
call fcn.005daa70
test eax, eax
jne 0x4bf641
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a8]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], ecx
cmp eax, edi
jb 0x4bf5f0
jmp 0x4bf6a8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.005dc190
push eax
push 0x68fb68
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0xb4]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
mov esi, dword [ebp - 0x1c4]
lea eax, [ebp - 0x1e0]
inc esi
lea ecx, [ebp - 0x3c]
push eax
push esi
mov dword [ebp - 0x1c4], esi
call fcn.005d6380
mov esi, dword [ebp - 0x1b0]
test al, al
jne 0x4bf347
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.DefaultIcon
lea ecx, [ebp - 0xa4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xb4]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005d6a30
lea eax, [ebp - 0x38]
push eax
push 0x62439c
lea ecx, [ebp - 0x3c]
call fcn.005d6740
test al, al
je 0x4bf877
lea ecx, [ebp - 0x38]
call fcn.005dc3a0
cmp eax, 3
jle 0x4bf877
lea ecx, [ebp - 0x38]
call fcn.005dc3a0
test eax, eax
je 0x4bf767
push 1
lea ecx, [ebp - 0x38]
call fcn.005dc440
cmp word [eax], 0x7b
je 0x4bf877
push 4
push 1
push 1
push 1
push 0x624e08
lea ecx, [ebp - 0x38]
call fcn.005daa70
cmp eax, 1
je 0x4bf877
cmp eax, 2
je 0x4bf877
push esi
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x38]
call fcn.005d4680
xor eax, eax
mov dword [ebp - 0x1a8], eax
test edi, edi
je 0x4bf877
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x21c]
mov dword [ebp - 0x1a4], ecx
nop dword [eax]
cmp dword [esi + eax*4], 0
je 0x4bf7fb
call fcn.005dc3a0
mov ecx, dword [ebp - 0x1a4]
test eax, eax
je 0x4bf7f5
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x58]
call fcn.005daa70
test eax, eax
jne 0x4bf811
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a8]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], ecx
cmp eax, edi
jb 0x4bf7c0
jmp 0x4bf871
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.005dc190
push eax
push 0x68fb68
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
mov esi, dword [ebp - 0x1b0]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.OpenWithList
lea ecx, [ebp - 0xa4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xb4]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0xb4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005d6a30
test al, al
je 0x4bfb29
lea eax, [ebp - 0x1e0]
mov dword [ebp - 0x1ac], 0
push eax
push 0
lea ecx, [ebp - 0x3c]
call fcn.005d6380
test al, al
je 0x4bfb29
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Shell
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0xb4]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0xc0]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0xc0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x68]
call fcn.005d6a30
test al, al
je 0x4bfafe
lea eax, [ebp - 0x1f8]
mov dword [ebp - 0x1c4], 0
push eax
push 0
lea ecx, [ebp - 0x68]
call fcn.005d6380
test al, al
je 0x4bfafe
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.command
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0xc0]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x120]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0x120]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xa8]
call fcn.005d6a30
test al, al
je 0x4bfad3
lea eax, [ebp - 0x38]
push eax
push 0x62439c
lea ecx, [ebp - 0xa8]
call fcn.005d6740
test al, al
je 0x4bfad3
lea ecx, [ebp - 0x38]
call fcn.005dc3a0
cmp eax, 4
jl 0x4bfad3
push esi
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x38]
call fcn.005d4680
xor esi, esi
test edi, edi
je 0x4bfad3
mov ecx, dword [ebp - 0x228]
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x1a4], ecx
cmp dword [eax + esi*4], 0
je 0x4bfa5c
call fcn.005dc3a0
mov ecx, dword [ebp - 0x1a4]
test eax, eax
je 0x4bfa56
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x58]
call fcn.005daa70
test eax, eax
jne 0x4bfa6c
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x21c]
inc esi
add ecx, 0xc
mov dword [ebp - 0x1a4], ecx
cmp esi, edi
jb 0x4bfa21
jmp 0x4bfad3
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.005dc190
push eax
push 0x68fb68
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0xc0]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp - 0x230]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x21c]
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
mov eax, dword [ebp - 0x1c4]
lea ecx, [ebp - 0x1f8]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x1c4], eax
call fcn.005d6380
mov esi, dword [ebp - 0x1b0]
test al, al
jne 0x4bf970
mov eax, dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1e0]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x1ac], eax
call fcn.005d6380
mov esi, dword [ebp - 0x1b0]
test al, al
jne 0x4bf8f0
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x1b4]
mov esi, dword [ebp - 0x1b0]
inc ecx
mov dword [ebp - 0x1b4], ecx
cmp byte [eax + 4], 0
je 0x4bf264
jmp 0x4bfb54
mov eax, dword [ebp - 0x218]
mov dl, byte [ebp - 0x221]
inc esi
mov dword [ebp - 0x1b0], esi
mov ecx, str.HKCR
cmp esi, 2
jb 0x4bf203
cmp byte [eax + 4], 0
jne 0x4c25d4
push str.HKLMSYSTEMCurrentControlSet_services
lea ecx, [ebp - 0x2c]
call fcn.005dc510
push ecx
push 0x20019
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
test al, al
mov eax, dword [ebp - 0x218]
je 0x4bfeb3
xor ecx, ecx
mov dword [ebp - 0x1c4], ecx
cmp byte [eax + 4], cl
jne 0x4bfeb3
nop dword [eax]
lea eax, [ebp - 0x1d4]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.005d6380
test al, al
je 0x4bfead
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x2c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x74]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1c]
call fcn.005d6a30
test al, al
je 0x4bfd37
lea eax, [ebp - 0x38]
push eax
push str.ImagePath
lea ecx, [ebp - 0x1c]
call fcn.005d6740
test al, al
je 0x4bfd37
lea ecx, [ebp - 0x38]
call fcn.005dc3a0
cmp eax, 3
jle 0x4bfd37
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x38]
movzx eax, byte [eax + 0x11]
push eax
call fcn.005d4680
mov esi, dword [ebp - 0x21c]
xor eax, eax
mov dword [ebp - 0x1a8], eax
test edi, edi
je 0x4bfd3d
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x1a4], ecx
cmp dword [esi + eax*4], 0
je 0x4bfcc2
call fcn.005dc3a0
mov ecx, dword [ebp - 0x1a4]
test eax, eax
je 0x4bfcbc
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x58]
call fcn.005daa70
test eax, eax
jne 0x4bfcd8
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a8]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], ecx
cmp eax, edi
jb 0x4bfc87
jmp 0x4bfd3d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.005dc190
push eax
push 0x68fb68
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
jmp 0x4bfd3d
mov esi, dword [ebp - 0x21c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Parameters
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xa4]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0xa4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1c]
call fcn.005d6a30
test al, al
je 0x4bfe8e
lea eax, [ebp - 0x38]
push eax
push str.ServiceDll
lea ecx, [ebp - 0x1c]
call fcn.005d6740
test al, al
je 0x4bfe8e
lea ecx, [ebp - 0x38]
call fcn.005dc3a0
cmp eax, 3
jle 0x4bfe8e
push 0
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x38]
call fcn.005d4680
xor eax, eax
mov dword [ebp - 0x1a8], eax
test edi, edi
je 0x4bfe8e
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x1a4], ecx
nop
cmp dword [esi + eax*4], 0
je 0x4bfe1b
call fcn.005dc3a0
mov ecx, dword [ebp - 0x1a4]
test eax, eax
je 0x4bfe15
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x58]
call fcn.005daa70
test eax, eax
jne 0x4bfe31
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a8]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], ecx
cmp eax, edi
jb 0x4bfde0
jmp 0x4bfe8e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.005dc190
push eax
push 0x68fb68
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x1c4]
inc ecx
mov dword [ebp - 0x1c4], ecx
cmp byte [eax + 4], 0
je 0x4bfbc0
jmp 0x4bfeb3
mov eax, dword [ebp - 0x218]
cmp byte [eax + 4], 0
jne 0x4c25d4
xor esi, esi
mov ecx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
mov dword [ebp - 0x1ac], esi
nop word [eax + eax]
cmp esi, 1
jne 0x4bfee2
cmp byte [ebp - 0x221], 0
je 0x4c00df
cmp byte [eax + 4], 0
jne 0x4c25d4
cmp esi, 1
mov eax, str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionApp_Paths
cmovne eax, ecx
lea ecx, [ebp - 0x2c]
push eax
call fcn.005dc510
push ecx
push 0x20019
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
test al, al
mov eax, dword [ebp - 0x218]
je 0x4c00ca
xor ecx, ecx
mov dword [ebp - 0x1c4], ecx
cmp byte [eax + 4], cl
jne 0x4c00ca
lea eax, [ebp - 0x1d4]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.005d6380
test al, al
je 0x4c00be
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x2c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x74]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1c]
call fcn.005d6a30
test al, al
je 0x4c009f
lea eax, [ebp - 0x38]
push eax
push 0x62439c
lea ecx, [ebp - 0x1c]
call fcn.005d6740
test al, al
je 0x4c009f
lea ecx, [ebp - 0x38]
call fcn.005dc3a0
cmp eax, 3
jle 0x4c009f
push 0
lea ecx, [ebp - 0x38]
call fcn.005dbc20
xor eax, eax
mov dword [ebp - 0x1a8], eax
test edi, edi
je 0x4c009f
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x21c]
mov dword [ebp - 0x1a4], ecx
cmp dword [esi + eax*4], 0
je 0x4c002c
call fcn.005dc3a0
mov ecx, dword [ebp - 0x1a4]
test eax, eax
je 0x4c0026
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005daa70
test eax, eax
jne 0x4c0042
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a8]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], ecx
cmp eax, edi
jb 0x4bfff1
jmp 0x4c009f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
push 0x68fb68
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x1c4]
inc ecx
mov dword [ebp - 0x1c4], ecx
cmp byte [eax + 4], 0
je 0x4bff36
jmp 0x4c00c4
mov eax, dword [ebp - 0x218]
mov esi, dword [ebp - 0x1ac]
inc esi
mov ecx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
mov dword [ebp - 0x1ac], esi
cmp esi, 2
jb 0x4bfed0
cmp byte [eax + 4], 0
jne 0x4c25d4
call fcn.005d8790
push ecx
push 0x20019
push str.HKLMSYSTEM
lea ecx, [ebp - 0x1c]
movsd qword [ebp - 0xe8], xmm0
call fcn.005d6a30
test al, al
mov eax, dword [ebp - 0x218]
je 0x4c05a6
xor ecx, ecx
mov dword [ebp - 0x1b4], ecx
cmp byte [eax + 4], cl
jne 0x4c05a6
lea eax, [ebp - 0x1d4]
push eax
push ecx
lea ecx, [ebp - 0x1c]
call fcn.005d6380
test al, al
je 0x4c05a0
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x2c]
call fcn.005dc510
push 0
push 1
push 1
push 0
push str.ControlSet
lea ecx, [ebp - 0x2c]
call fcn.005daa70
cmp eax, 1
jne 0x4c0581
sub esp, 0xc
lea ecx, [ebp - 0x2c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.HKLMSYSTEM_
call fcn.005da510
movsd xmm0, qword [ebp - 0xe8]
comisd xmm0, xmmword [0x6edab8]
jb 0x4c03b1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._servicesSharedAccessParametersFirewallPolicyFirewallRules
lea ecx, [ebp - 0x2c]
call fcn.005da780
push ecx
push 0x20019
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
test al, al
mov eax, dword [ebp - 0x218]
je 0x4c0587
xor ecx, ecx
mov dword [ebp - 0x1c4], ecx
cmp byte [eax + 4], cl
jne 0x4c0587
nop dword [eax + eax]
lea eax, [ebp - 0x1d4]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.005d62e0
test al, al
je 0x4c0581
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x18]
call fcn.005d6740
test al, al
je 0x4c038f
lea ecx, [ebp - 0x38]
call fcn.005dc3a0
cmp eax, 0x19
jl 0x4c038f
push 0
push 1
push 1
push 0
push str.App
lea ecx, [ebp - 0x38]
call fcn.005daa70
test eax, eax
je 0x4c038f
add eax, 4
lea ecx, [ebp - 0x38]
push eax
call fcn.005dad50
push 0
push 1
push 1
push 0
push 0x627800
lea ecx, [ebp - 0x38]
call fcn.005daa70
test eax, eax
je 0x4c028e
push eax
lea ecx, [ebp - 0x38]
call fcn.005dae00
push 0
push 1
push 0xffffffffffffffff
push 1
push 0x62794c
lea ecx, [ebp - 0x38]
call fcn.005daa70
test eax, eax
je 0x4c038f
dec eax
lea ecx, [ebp - 0x38]
push eax
call fcn.005dae00
push 0
lea ecx, [ebp - 0x38]
call fcn.005dbc20
xor eax, eax
mov dword [ebp - 0x1a8], eax
test edi, edi
je 0x4c038f
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x21c]
mov dword [ebp - 0x1a4], ecx
cmp dword [esi + eax*4], 0
je 0x4c031c
call fcn.005dc3a0
mov ecx, dword [ebp - 0x1a4]
test eax, eax
je 0x4c0316
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005daa70
test eax, eax
jne 0x4c0332
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a8]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], ecx
cmp eax, edi
jb 0x4c02e1
jmp 0x4c038f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.____Remaining_firewall_rule
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x2c]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x1c4]
inc ecx
mov dword [ebp - 0x1c4], ecx
cmp byte [eax + 4], 0
je 0x4c0200
jmp 0x4c0587
mov eax, dword [ebp - 0x218]
xor esi, esi
mov dword [ebp - 0x1ac], esi
nop
cmp byte [eax + 4], 0
jne 0x4c0587
test esi, esi
jne 0x4c03df
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.ServicesSharedAccessParametersFirewallPolicyDomainProfileAuthorizedApplicationsList
jmp 0x4c03fd
cmp esi, 1
jne 0x4c040e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.ServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x74]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
test al, al
mov eax, dword [ebp - 0x218]
je 0x4c056f
xor ecx, ecx
mov dword [ebp - 0x1c4], ecx
cmp byte [eax + 4], cl
jne 0x4c056f
lea eax, [ebp - 0x1d4]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.005d62e0
test al, al
je 0x4c0563
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x38]
call fcn.005dc510
push 0
lea ecx, [ebp - 0x38]
call fcn.005dbc20
xor eax, eax
mov dword [ebp - 0x1a8], eax
test edi, edi
je 0x4c0544
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x21c]
mov dword [ebp - 0x1a4], ecx
cmp dword [esi + eax*4], 0
je 0x4c04d1
call fcn.005dc3a0
mov ecx, dword [ebp - 0x1a4]
test eax, eax
je 0x4c04cb
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005daa70
test eax, eax
jne 0x4c04e7
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a8]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], ecx
cmp eax, edi
jb 0x4c0496
jmp 0x4c0544
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.____Orphan_firewall_rule
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x2c]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x1c4]
inc ecx
mov dword [ebp - 0x1c4], ecx
cmp byte [eax + 4], 0
je 0x4c0444
jmp 0x4c0569
mov eax, dword [ebp - 0x218]
mov esi, dword [ebp - 0x1ac]
inc esi
mov dword [ebp - 0x1ac], esi
cmp esi, 2
jb 0x4c03c0
jmp 0x4c0587
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x1b4]
inc ecx
cmp byte [eax + 4], 0
mov dword [ebp - 0x1b4], ecx
je 0x4c0128
jmp 0x4c05a6
mov eax, dword [ebp - 0x218]
cmp byte [eax + 4], 0
jne 0x4c25d4
push 0
lea eax, [ebp - 0x1c4]
mov dword [ebp - 0x238], 0
push eax
lea edx, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x1c4], 0
call fcn.0059d390
mov ecx, dword [ebp - 0x238]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1a0], xmm0
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1a0], ecx
mov dword [ebp - 0x19c], 0
mov edx, dword [ebp - 0x23c]
movlpd qword [ebp - 0x178], xmm0
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x174], 0
mov edx, dword [ebp - 0x1c4]
movlpd qword [ebp - 0xe8], xmm0
mov dword [ebp - 0xe8], edx
mov dword [ebp - 0xe4], 0
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x1b8], 0
test eax, eax
je 0x4c0890
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x40], ecx
nop word [eax + eax]
cmp byte [eax + 4], 0
jne 0x4c0890
xor esi, esi
mov dword [ebp - 0x1b4], esi
cmp byte [eax + 4], 0
jne 0x4c0871
test esi, esi
jne 0x4c06a0
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
jmp 0x4c06da
cmp esi, 1
jne 0x4c06be
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
jmp 0x4c06da
cmp esi, 3
jne 0x4c06ed
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerStartPageNewShortcuts
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x2c]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
test al, al
mov eax, dword [ebp - 0x218]
je 0x4c085e
xor ecx, ecx
mov dword [ebp - 0x1ac], ecx
cmp byte [eax + 4], cl
jne 0x4c085e
lea eax, [ebp - 0x1d4]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.005d62e0
test al, al
je 0x4c0852
mov ecx, dword [ebp - 0x1d4]
call fcn.005d8c40
cmp eax, 3
jl 0x4c0833
cmp word [ecx + 2], 0x3a
jne 0x4c0833
push ecx
lea ecx, [ebp - 0x58]
call fcn.005dc510
xor eax, eax
mov dword [ebp - 0x1a8], eax
test edi, edi
je 0x4c0833
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x21c]
mov dword [ebp - 0x1a4], ecx
cmp dword [esi + eax*4], 0
je 0x4c07c0
call fcn.005dc3a0
mov ecx, dword [ebp - 0x1a4]
test eax, eax
je 0x4c07ba
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x58]
call fcn.005daa70
test eax, eax
jne 0x4c07d6
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a8]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], ecx
cmp eax, edi
jb 0x4c0785
jmp 0x4c0833
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._____Remaining_application_path
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x2c]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x1ac]
inc ecx
mov dword [ebp - 0x1ac], ecx
cmp byte [eax + 4], 0
je 0x4c0723
jmp 0x4c0858
mov eax, dword [ebp - 0x218]
mov esi, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x40]
inc esi
mov dword [ebp - 0x1b4], esi
cmp esi, 3
jb 0x4c0682
mov edx, dword [ebp - 0x1b8]
add ecx, 0xc
inc edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x1b8], edx
cmp edx, dword [ebp - 0x1b0]
jb 0x4c0670
mov edx, dword [ebp - 0x218]
cmp byte [edx + 4], 0
jne 0x4c252d
xor esi, esi
mov dword [ebp - 0x1b4], esi
nop dword [eax + eax]
cmp byte [edx + 4], 0
jne 0x4c252d
test esi, esi
jne 0x4c08c5
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
jmp 0x4c08e7
cmp esi, 1
jne 0x4c08d1
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
jmp 0x4c08e7
cmp esi, 2
jne 0x4c08dd
push str.HKLMSOFTWAREMicrosoftFTHState
jmp 0x4c08e7
cmp esi, 3
jne 0x4c08ef
push str.HKLMSOFTWAREWow6432NodeMicrosoftFTHState
lea ecx, [ebp - 0x2c]
call fcn.005dc510
push ecx
push 0x20019
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
mov edx, dword [ebp - 0x218]
test al, al
je 0x4c0a60
xor eax, eax
mov dword [ebp - 0x1ac], eax
cmp byte [edx + 4], al
jne 0x4c0a60
lea ecx, [ebp - 0x1d4]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.005d62e0
test al, al
je 0x4c0a54
mov ecx, dword [ebp - 0x1d4]
call fcn.005d8c40
cmp eax, 3
jl 0x4c0a35
cmp word [ecx + 2], 0x3a
jne 0x4c0a35
push ecx
lea ecx, [ebp - 0x58]
call fcn.005dc510
xor eax, eax
mov dword [ebp - 0x1a8], eax
test edi, edi
je 0x4c0a35
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x21c]
mov dword [ebp - 0x1a4], ecx
cmp dword [esi + eax*4], 0
je 0x4c09c2
call fcn.005dc3a0
mov ecx, dword [ebp - 0x1a4]
test eax, eax
je 0x4c09bc
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x58]
call fcn.005daa70
test eax, eax
jne 0x4c09d8
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a8]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], ecx
cmp eax, edi
jb 0x4c0987
jmp 0x4c0a35
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._____Remaining_application_path
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x2c]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp byte [edx + 4], 0
je 0x4c0925
jmp 0x4c0a5a
mov edx, dword [ebp - 0x218]
mov esi, dword [ebp - 0x1b4]
inc esi
mov dword [ebp - 0x1b4], esi
cmp esi, 3
jb 0x4c08b0
cmp byte [edx + 4], 0
jne 0x4c252d
xor esi, esi
mov dword [ebp - 0x1b4], esi
cmp byte [edx + 4], 0
jne 0x4c252d
test esi, esi
jne 0x4c0a99
push 1
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerFolders
jmp 0x4c0aa4
cmp esi, 1
jne 0x4c0aac
push esi
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionInstallerFolders
lea ecx, [ebp - 0x2c]
call fcn.005dc260
push ecx
push 0x20019
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
mov edx, dword [ebp - 0x218]
test al, al
je 0x4c0c09
xor eax, eax
mov dword [ebp - 0x1ac], eax
cmp byte [edx + 4], al
jne 0x4c0c09
lea ecx, [ebp - 0x1d4]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.005d62e0
test al, al
je 0x4c0bfd
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x58]
call fcn.005dc510
xor eax, eax
mov dword [ebp - 0x1a8], eax
test edi, edi
je 0x4c0bde
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x21c]
mov dword [ebp - 0x1a4], ecx
nop word [eax + eax]
cmp dword [esi + eax*4], 0
je 0x4c0b6b
call fcn.005dc3a0
mov ecx, dword [ebp - 0x1a4]
test eax, eax
je 0x4c0b65
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x58]
call fcn.005daa70
test eax, eax
jne 0x4c0b81
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a8]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], ecx
cmp eax, edi
jb 0x4c0b30
jmp 0x4c0bde
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._____Remaining_Installer_folder
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x2c]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp byte [edx + 4], 0
je 0x4c0ae2
jmp 0x4c0c03
mov edx, dword [ebp - 0x218]
mov esi, dword [ebp - 0x1b4]
inc esi
mov dword [ebp - 0x1b4], esi
cmp esi, 2
jb 0x4c0a82
cmp byte [edx + 4], 0
jne 0x4c252d
mov eax, dword [ebp - 0x1b0]
xor esi, esi
mov dword [ebp - 0x40], esi
add eax, 2
je 0x4c112a
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x240], ecx
cmp byte [edx + 4], 0
jne 0x4c252d
mov eax, dword [ebp - 0x1b0]
cmp esi, eax
jne 0x4c0c66
push str.HKLMSOFTWARE
lea ecx, [ebp - 0x2c]
call fcn.005dc510
jmp 0x4c0cb1
inc eax
cmp esi, eax
jne 0x4c0c87
cmp byte [ebp - 0x221], 0
je 0x4c112a
push str.HKLMSOFTWAREWow6432Node
lea ecx, [ebp - 0x2c]
call fcn.005dc510
jmp 0x4c0cb1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Software
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x2c]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
mov edx, dword [ebp - 0x218]
test al, al
je 0x4c1100
xor eax, eax
mov dword [ebp - 0x1b8], eax
cmp byte [edx + 4], al
jne 0x4c1100
lea ecx, [ebp - 0x1d4]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6380
test al, al
je 0x4c10fa
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0xdc]
call fcn.005dc510
push 0x624a04
lea ecx, [ebp - 0xdc]
call fcn.005dc4c0
test al, al
jne 0x4c10d8
push str.Classes
lea ecx, [ebp - 0xdc]
call fcn.005dc4c0
test al, al
jne 0x4c10d8
cmp esi, dword [ebp - 0x1b0]
jne 0x4c0d60
push str.Wow6432Node
lea ecx, [ebp - 0xdc]
call fcn.005dc4c0
test al, al
jne 0x4c10d8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x2c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x74]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1c]
call fcn.005d6a30
test al, al
je 0x4c0ee9
lea eax, [ebp - 0x1ec]
mov dword [ebp - 0x1ac], 0
push eax
push 0
lea ecx, [ebp - 0x1c]
call fcn.005d62e0
test al, al
je 0x4c0ee9
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0x1c]
call fcn.005d6740
test al, al
je 0x4c0ec4
push 0
lea ecx, [ebp - 0x38]
call fcn.005dbc20
xor eax, eax
mov dword [ebp - 0x1a8], eax
test edi, edi
je 0x4c0ec4
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x21c]
mov dword [ebp - 0x1a4], ecx
cmp dword [esi + eax*4], 0
je 0x4c0e51
call fcn.005dc3a0
mov ecx, dword [ebp - 0x1a4]
test eax, eax
je 0x4c0e4b
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005daa70
test eax, eax
jne 0x4c0e67
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a8]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], ecx
cmp eax, edi
jb 0x4c0e16
jmp 0x4c0ec4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
push 0x68fb68
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
mov eax, dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1ec]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1ac], eax
call fcn.005d62e0
test al, al
jne 0x4c0dd0
lea ecx, [ebp - 0x1c]
call fcn.005d6a00
test eax, eax
je 0x4c10d8
lea eax, [ebp - 0x1ec]
xor esi, esi
push eax
push esi
mov dword [ebp - 0x1b4], esi
call fcn.005d6380
test al, al
je 0x4c10d8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0x74]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0xa4]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0xa4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005d6a30
test al, al
je 0x4c10b9
lea eax, [ebp - 0x1e0]
mov dword [ebp - 0x1ac], 0
push eax
push 0
lea ecx, [ebp - 0x3c]
call fcn.005d62e0
test al, al
je 0x4c10b9
nop dword [eax]
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x3c]
call fcn.005d6740
test al, al
je 0x4c108e
push 0
lea ecx, [ebp - 0x38]
call fcn.005dbc20
xor eax, eax
mov dword [ebp - 0x1a8], eax
test edi, edi
je 0x4c108e
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x21c]
mov dword [ebp - 0x1a4], ecx
cmp dword [esi + eax*4], 0
je 0x4c1011
call fcn.005dc3a0
mov ecx, dword [ebp - 0x1a4]
test eax, eax
je 0x4c100b
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005daa70
test eax, eax
jne 0x4c1027
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a8]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], ecx
cmp eax, edi
jb 0x4c0fd6
jmp 0x4c108e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
push 0x68fb68
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0xa4]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
mov eax, dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1e0]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x1ac], eax
call fcn.005d62e0
test al, al
jne 0x4c0f90
mov esi, dword [ebp - 0x1b4]
lea eax, [ebp - 0x1ec]
inc esi
push eax
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1b4], esi
call fcn.005d6380
test al, al
jne 0x4c0f16
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x1b8]
mov esi, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x1b8], eax
cmp byte [edx + 4], 0
je 0x4c0ce7
jmp 0x4c1100
mov edx, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x240]
inc esi
mov eax, dword [ebp - 0x1b0]
add ecx, 0xc
mov edi, dword [ebp - 0x234]
add eax, 2
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x240], ecx
cmp esi, eax
jb 0x4c0c43
cmp byte [edx + 4], 0
jne 0x4c252d
mov eax, dword [ebp - 0x228]
mov esi, dword [ebp - 0x21c]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x200], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x208], edi
mov edi, dword [ebp - 0x220]
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x204], esi
mov dword [ebp - 0x1fc], eax
mov dword [ebp - 0x1b8], 0
nop dword [eax]
cmp byte [edx + 4], 0
jne 0x4c1249
push 0
push 0
push 0x104
lea ecx, [ebp - 0x2c]
call fcn.005db9a0
mov eax, dword [ebp - 0x1b8]
test eax, eax
jne 0x4c11c6
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
push 0
push 0
push 0x19
jmp 0x4c11f0
cmp eax, 1
jne 0x4c11dc
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
push 0
push 0
push 0x1f
jmp 0x4c11f0
cmp eax, 2
jne 0x4c11fc
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
push 0
push 0
push 0x16
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4c1229
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004bdd70
mov edx, dword [ebp - 0x218]
mov cl, al
test cl, cl
sete al
mov byte [edx + 4], al
test cl, cl
je 0x4c1245
jmp 0x4c122f
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp eax, 3
jb 0x4c1190
cmp byte [edx + 4], 0
mov edi, dword [ebp - 0x234]
jne 0x4c252d
mov eax, dword [ebp - 0x1b0]
test eax, eax
je 0x4c17c1
xorps xmm0, xmm0
mov dword [ebp - 0x164], 0
lea ecx, [ebp - 0x16c]
movq qword [ebp - 0x16c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x154], 0
lea ecx, [ebp - 0x15c]
movq qword [ebp - 0x15c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x144], 0
lea ecx, [ebp - 0x14c]
movq qword [ebp - 0x14c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x5c], 0
lea ecx, [ebp - 0x64]
movq qword [ebp - 0x64], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xc4], 0
lea ecx, [ebp - 0xcc]
movq qword [ebp - 0xcc], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x134], 0
lea ecx, [ebp - 0x13c]
movq qword [ebp - 0x13c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xec], 0
lea ecx, [ebp - 0xf4]
movq qword [ebp - 0xf4], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xfc], 0
lea ecx, [ebp - 0x104]
movq qword [ebp - 0x104], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
lea ecx, [ebp - 0x98]
movq qword [ebp - 0x98], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x84], 0
lea ecx, [ebp - 0x8c]
movq qword [ebp - 0x8c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x78], 0
lea ecx, [ebp - 0x80]
movq qword [ebp - 0x80], xmm0
call fcn.005dc5e0
lea eax, [ebp - 0x1bc]
mov byte [ebp - 4], 0x28
push eax
push 0
push 0
push 0x80
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x1bc], 0x80
call fcn.005db9a0
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0xcc]
call fcn.005dc190
lea edx, [ebp - 0x13c]
mov ecx, eax
call fcn.0059d880
push 0
push 0
push 0x104
lea ecx, [ebp - 0xf4]
call fcn.005db9a0
push eax
push 0
push 0
push 0xb
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x64]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0xf4]
call fcn.005dad50
push 0
push 0
push 0x104
lea ecx, [ebp - 0x104]
call fcn.005db9a0
push eax
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x64]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x104]
call fcn.005dad50
push 0
push 0
push 0x104
lea ecx, [ebp - 0x98]
call fcn.005db9a0
push eax
push 0
push 0
push 8
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x64]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x98]
call fcn.005dad50
push 0
push 0
push 0x104
lea ecx, [ebp - 0x8c]
call fcn.005db9a0
push eax
push 0
push 0
push 6
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x64]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x8c]
call fcn.005dad50
push 0
push 0
push 0x104
lea ecx, [ebp - 0x80]
call fcn.005db9a0
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x64]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x80]
call fcn.005dad50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MicrosoftInternet_ExplorerQuick_Launch
lea ecx, [ebp - 0x80]
call fcn.005da780
cmp dword [ebp - 0x1b0], 0
mov dword [ebp - 0x1ac], 0
jbe 0x4c173e
mov edi, dword [ebp - 0x23c]
mov esi, dword [ebp - 0x218]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc200
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc190
mov ecx, dword [ebp - 0x220]
push eax
call fcn.004bdd70
mov cl, al
test cl, cl
sete al
mov byte [esi + 4], al
test cl, cl
je 0x4c1732
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x104]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc200
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc190
mov ecx, dword [ebp - 0x220]
push eax
call fcn.004bdd70
mov cl, al
test cl, cl
sete al
mov byte [esi + 4], al
test cl, cl
je 0x4c1732
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x98]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc200
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc190
mov ecx, dword [ebp - 0x220]
push eax
call fcn.004bdd70
mov cl, al
test cl, cl
sete al
mov byte [esi + 4], al
test cl, cl
je 0x4c1732
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x8c]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc200
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc190
mov ecx, dword [ebp - 0x220]
push eax
call fcn.004bdd70
mov cl, al
test cl, cl
sete al
mov byte [esi + 4], al
test cl, cl
je 0x4c1732
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x80]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc200
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x64]
call fcn.005dc190
mov ecx, dword [ebp - 0x220]
push eax
call fcn.004bdd70
mov cl, al
test cl, cl
sete al
mov byte [esi + 4], al
test cl, cl
je 0x4c1732
mov eax, dword [ebp - 0x1ac]
add edi, 0xc
inc eax
mov dword [ebp - 0x1ac], eax
cmp eax, dword [ebp - 0x1b0]
jb 0x4c1550
mov edi, dword [ebp - 0x234]
mov esi, dword [ebp - 0x21c]
lea ecx, [ebp - 0x80]
call fcn.005dc430
lea ecx, [ebp - 0x8c]
call fcn.005dc430
lea ecx, [ebp - 0x98]
call fcn.005dc430
lea ecx, [ebp - 0x104]
call fcn.005dc430
lea ecx, [ebp - 0xf4]
call fcn.005dc430
lea ecx, [ebp - 0x13c]
call fcn.005dc430
lea ecx, [ebp - 0xcc]
call fcn.005dc430
lea ecx, [ebp - 0x64]
call fcn.005dc430
lea ecx, [ebp - 0x14c]
call fcn.005dc430
lea ecx, [ebp - 0x15c]
call fcn.005dc430
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x1d
call fcn.005dc430
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x1b0]
cmp byte [edx + 4], 0
jne 0x4c252d
xor ecx, ecx
mov dword [ebp - 0xcc], 0x6484e0
mov dword [ebp - 0xc8], str.RunOnce
mov dword [ebp - 0xc4], str.RunOnceEx
mov dword [ebp - 0x40], ecx
add eax, 2
je 0x4c1a9b
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x1b8], eax
cmp byte [edx + 4], 0
jne 0x4c252d
mov eax, dword [ebp - 0x1b0]
inc eax
cmp ecx, eax
jne 0x4c1825
cmp byte [ebp - 0x221], 0
je 0x4c1a9b
xor eax, eax
mov dword [ebp - 0x1b4], eax
nop dword [eax]
cmp byte [edx + 4], 0
jne 0x4c1a79
cmp ecx, dword [ebp - 0x1b0]
jae 0x4c1871
mov ecx, dword [ebp - 0x1b8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + eax*4 - 0xcc]
push str.SoftwareMicrosoftWindowsCurrentVersion_
call fcn.005dc190
push eax
push str.HKU_
jmp 0x4c18c6
jne 0x4c1895
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + eax*4 - 0xcc]
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersion_
jmp 0x4c18c6
mov edx, dword [ebp - 0x1b0]
mov esi, dword [ebp - 0x21c]
inc edx
cmp ecx, edx
jne 0x4c18ce
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + eax*4 - 0xcc]
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersion_
lea ecx, [ebp - 0x2c]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
test al, al
je 0x4c1a5a
lea eax, [ebp - 0x1d4]
mov dword [ebp - 0x1ac], 0
push eax
push 0
lea ecx, [ebp - 0x18]
call fcn.005d62e0
test al, al
je 0x4c1a5a
mov eax, dword [ebp - 0x1d0]
cmp eax, 1
je 0x4c1924
cmp eax, 2
jne 0x4c1a35
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x18]
call fcn.005d6740
test al, al
je 0x4c1a35
lea ecx, [ebp - 0x58]
call fcn.005dbeb0
test al, al
jne 0x4c1a35
cmp dword [ebp - 0x1d0], 2
jne 0x4c195e
push 0
call fcn.005dbc20
xor eax, eax
mov dword [ebp - 0x1a4], eax
test edi, edi
je 0x4c1a35
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x234], ecx
nop word [eax + eax]
cmp dword [esi + eax*4], 0
je 0x4c19bb
call fcn.005dc3a0
mov ecx, dword [ebp - 0x234]
test eax, eax
je 0x4c19b5
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x58]
call fcn.005daa70
test eax, eax
jne 0x4c19d1
mov ecx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x1a4]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x234], ecx
cmp eax, edi
jb 0x4c1980
jmp 0x4c1a35
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.005dc190
push eax
push 0x68fb68
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x2c]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a4]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
mov eax, dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1d4]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1ac], eax
call fcn.005d62e0
test al, al
jne 0x4c1910
mov eax, dword [ebp - 0x1b4]
mov edx, dword [ebp - 0x218]
inc eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x1b4], eax
cmp eax, 3
jb 0x4c1830
mov eax, dword [ebp - 0x1b0]
inc ecx
add dword [ebp - 0x1b8], 0xc
add eax, 2
mov esi, dword [ebp - 0x21c]
mov dword [ebp - 0x40], ecx
cmp ecx, eax
jb 0x4c1803
cmp byte [edx + 4], 0
jne 0x4c252d
mov eax, dword [ebp - 0x1b0]
test eax, eax
je 0x4c1ca6
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x40], ecx
cmp byte [edx + 4], 0
jne 0x4c252d
xor eax, eax
mov dword [ebp - 0x1b4], eax
nop dword [eax + eax]
cmp byte [edx + 4], 0
jne 0x4c1c87
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
cmp eax, 1
jne 0x4c1b08
push str.SoftwareMicrosoftWindowsShellNoRoamMUICache
jmp 0x4c1b0d
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x2c]
call fcn.005dc200
push ecx
push 0x20019
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
mov edx, dword [ebp - 0x218]
test al, al
je 0x4c1c6e
xor eax, eax
mov dword [ebp - 0x1ac], eax
cmp byte [edx + 4], al
jne 0x4c1c6e
lea ecx, [ebp - 0x1d4]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.005d62e0
test al, al
je 0x4c1c68
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x38]
call fcn.005dc510
xor eax, eax
mov dword [ebp - 0x1a4], eax
test edi, edi
je 0x4c1c49
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x234], ecx
cmp dword [esi + eax*4], 0
je 0x4c1bd3
call fcn.005dc3a0
mov ecx, dword [ebp - 0x234]
test eax, eax
je 0x4c1bcd
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x38]
call fcn.005daa70
test eax, eax
jne 0x4c1be9
mov ecx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x1a4]
inc eax
add ecx, 0xc
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x234], ecx
cmp eax, edi
jb 0x4c1b98
jmp 0x4c1c49
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.____Uninstalled_file
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
push 0x62bd28
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1a4]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp byte [edx + 4], 0
je 0x4c1b56
jmp 0x4c1c6e
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x1b4], eax
cmp eax, 2
jb 0x4c1ae0
mov eax, dword [ebp - 0x1b8]
add ecx, 0xc
inc eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x1b8], eax
cmp eax, dword [ebp - 0x1b0]
jb 0x4c1ac6
cmp byte [edx + 4], 0
jne 0x4c252d
xorps xmm0, xmm0
mov dword [ebp - 0x84], 0
lea ecx, [ebp - 0x8c]
movq qword [ebp - 0x8c], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x29
call fcn.005d8790
movsd xmm1, qword [0x6edab8]
lea ecx, [ebp - 0x8c]
comisd xmm1, xmm0
push 0x104
push 0
push 0
push 0x104
jbe 0x4c210d
call fcn.005db9a0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Tasks_
lea ecx, [ebp - 0x8c]
call fcn.005da780
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
lea ecx, [ebp - 0x98]
movq qword [ebp - 0x98], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x5c], 0
lea ecx, [ebp - 0x64]
movq qword [ebp - 0x64], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x78], 0
lea ecx, [ebp - 0x80]
movq qword [ebp - 0x80], xmm0
call fcn.005dc5e0
mov dword [ebp - 0x1b0], 0
lea eax, [ebp - 0x1b0]
push eax
push 0x6ed834
push 1
push 0
push 0x6ed7c0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x4c1db1
mov byte [ebp - 4], 0x2e
jmp 0x4c20d3
mov dword [ebp - 0x1a4], 0
mov byte [ebp - 4], 0x2f
lea edx, [ebp - 0x1a4]
mov eax, dword [ebp - 0x1b0]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
test eax, eax
jns 0x4c1df3
mov byte [ebp - 4], 0x30
mov eax, dword [ebp - 0x1a4]
test eax, eax
je 0x4c1dea
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x31
jmp 0x4c20d3
mov eax, dword [ebp - 0x1a4]
lea edx, [ebp - 0x40]
push edx
lea edx, [ebp - 0x1b8]
mov dword [ebp - 0x40], 0
push edx
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x4c20bb
nop dword [eax + eax]
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4c20bb
xor esi, esi
mov dword [ebp - 0x1bc], esi
test eax, eax
je 0x4c208e
nop dword [eax + eax]
mov eax, dword [ebp - 0x218]
cmp byte [eax + 4], 0
jne 0x4c208e
mov eax, dword [ebp - 0x1b8]
lea ecx, [ebp - 0x98]
push dword [eax + esi*4]
call fcn.005dc510
mov eax, dword [ebp - 0x1b8]
push dword [eax + esi*4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x1a8], 0
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x98]
mov eax, dword [ebp - 0x1b0]
mov esi, dword [eax]
lea eax, [ebp - 0x1a8]
push eax
push 0x6ed8fc
call fcn.005dc190
push eax
push dword [ebp - 0x1b0]
call dword [esi + 0x18]
test eax, eax
jns 0x4c1eb7
mov byte [ebp - 4], 0x33
jmp 0x4c2064
mov eax, dword [ebp - 0x1a8]
lea edx, [ebp - 0x1b4]
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1ac], 0
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x84]
mov eax, dword [ebp - 0x1a8]
lea edx, [ebp - 0x1ac]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x8c]
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0x64]
call fcn.005dc510
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x80]
call fcn.005dc510
mov eax, dword [ebp - 0x1b4]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
test eax, eax
je 0x4c1f26
push eax
call esi
mov eax, dword [ebp - 0x1ac]
test eax, eax
je 0x4c1f33
push eax
call esi
lea ecx, [ebp - 0x80]
call fcn.005dc3a0
test eax, eax
je 0x4c1f69
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x80]
call fcn.005dc190
push eax
push 0x62438c
lea ecx, [ebp - 0x64]
call fcn.005da780
push 0
lea ecx, [ebp - 0x64]
call fcn.005dbc20
push 4
lea ecx, [ebp - 0x98]
call fcn.005dadc0
xor eax, eax
mov dword [ebp - 0x240], eax
test edi, edi
je 0x4c2060
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x21c]
mov dword [ebp - 0x234], ecx
cmp dword [esi + eax*4], 0
je 0x4c1fdd
call fcn.005dc3a0
mov ecx, dword [ebp - 0x234]
test eax, eax
je 0x4c1fd7
push 0
push 1
push 1
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005daa70
test eax, eax
jne 0x4c1ff6
mov ecx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x240]
inc eax
add ecx, 0xc
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x234], ecx
cmp eax, edi
jb 0x4c1fa2
jmp 0x4c2060
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x64]
call fcn.005dc190
push eax
push 0x68fb68
lea ecx, [ebp - 0x98]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x240]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push esi
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x218]
call fcn.004bdc10
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0x1a8]
test eax, eax
je 0x4c2074
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2f
mov esi, dword [ebp - 0x1bc]
inc esi
mov dword [ebp - 0x1bc], esi
cmp esi, dword [ebp - 0x40]
jb 0x4c1e40
push dword [ebp - 0x1b8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x1a4]
lea edx, [ebp - 0x40]
push edx
lea edx, [ebp - 0x1b8]
push edx
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0xc]
test eax, eax
jns 0x4c1e20
mov byte [ebp - 4], 0x35
mov eax, dword [ebp - 0x1a4]
test eax, eax
je 0x4c20cf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x36
mov eax, dword [ebp - 0x1b0]
test eax, eax
je 0x4c20e3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x80]
call fcn.005dc430
lea ecx, [ebp - 0x64]
call fcn.005dc430
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x29
call fcn.005dc430
mov esi, dword [ebp - 0x218]
jmp 0x4c23f7
call fcn.005db9a0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Tasks
lea ecx, [ebp - 0x8c]
call fcn.005da780
mov dword [ebp - 0x1b0], 0
lea eax, [ebp - 0x1b0]
push eax
push 0x61e720
push 1
push 0
push 0x61e730
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x4c2187
mov byte [ebp - 4], 0x38
mov eax, dword [ebp - 0x1b0]
test eax, eax
je 0x4c217c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [ebp - 0x218]
jmp 0x4c23f3
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x140]
push eax
call esi
movups xmm0, xmmword [ebp - 0x140]
lea eax, [ebp - 0x150]
push eax
movups xmmword [ebp - 0xd0], xmm0
call esi
movups xmm0, xmmword [ebp - 0x150]
lea eax, [ebp - 0x160]
push eax
movups xmmword [ebp - 0xf8], xmm0
call esi
movups xmm0, xmmword [ebp - 0x160]
lea eax, [ebp - 0x170]
push eax
movups xmmword [ebp - 0x108], xmm0
call esi
mov byte [ebp - 4], 0x3c
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xd0]
mov eax, dword [ebp - 0x1b0]
mov ecx, esp
sub esp, 0x10
mov edx, dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xf8]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x108]
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [ebp - 0x170]
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x28]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
shr eax, 0x1f
mov dword [ebp - 0x1bc], eax
lea eax, [ebp - 0x170]
push eax
call esi
lea eax, [ebp - 0x160]
push eax
call esi
lea eax, [ebp - 0x150]
push eax
call esi
lea eax, [ebp - 0x140]
push eax
call esi
cmp byte [ebp - 0x1bc], 0
je 0x4c2286
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x1b0]
test eax, eax
je 0x4c217c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [ebp - 0x218]
jmp 0x4c23f3
mov dword [ebp - 0x1b8], 0
push 0xc
mov byte [ebp - 4], 0x3e
call fcn.0041e3d6
mov esi, eax
add esp, 4
mov dword [ebp - 0x1bc], esi
mov byte [ebp - 4], 0x3f
test esi, esi
je 0x4c22e1
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
push 0x624284
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x4c2751
jmp 0x4c22e3
xor esi, esi
mov byte [ebp - 4], 0x3e
mov dword [ebp - 0x1bc], esi
test esi, esi
je 0x4c275b
mov byte [ebp - 4], 0x40
lea edx, [ebp - 0x1b8]
mov eax, dword [ebp - 0x1b0]
push edx
push dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
shr eax, 0x1f
or ecx, 0xffffffff
mov dword [ebp - 0x1bc], eax
mov byte [ebp - 4], 0x3e
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x4c2361
mov eax, dword [esi]
test eax, eax
je 0x4c2339
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4c2350
push eax
call fcn.0041e1c3
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0041e7c1
mov eax, dword [ebp - 0x1bc]
add esp, 8
test al, al
je 0x4c2399
mov byte [ebp - 4], 0x41
mov eax, dword [ebp - 0x1b8]
test eax, eax
je 0x4c2379
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x42
mov eax, dword [ebp - 0x1b0]
test eax, eax
je 0x4c217c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [ebp - 0x218]
jmp 0x4c23f3
lea ecx, [ebp - 0x8c]
call fcn.005dc190
mov ecx, dword [ebp - 0x220]
push eax
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x1b8]
call fcn.004be1f0
mov esi, dword [ebp - 0x218]
test al, al
sete al
mov byte [esi + 4], al
mov byte [ebp - 4], 0x43
mov eax, dword [ebp - 0x1b8]
test eax, eax
je 0x4c23df
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x44
mov eax, dword [ebp - 0x1b0]
test eax, eax
je 0x4c23f3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x29
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp byte [esi + 4], 0
je 0x4c2416
lea ecx, [ebp - 0x8c]
or edi, 0xffffffff
call fcn.005dc430
jmp 0x4c2530
mov dword [ebp - 0x1ac], 0
test edi, edi
je 0x4c2509
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x1a4], eax
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x4c24e5
mov ecx, dword [ebp - 0x1a4]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c24e5
push ecx
mov ecx, dword [ebp - 0x1a4]
push 0
call fcn.005dc190
mov ecx, eax
call fcn.005e53c0
push edx
push eax
lea ecx, [ebp - 0xdc]
call fcn.005daea0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627930
lea ecx, [ebp - 0xdc]
call fcn.005dc190
mov ecx, dword [ebp - 0x1a4]
push eax
push str.____Remnant_folder__
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1ac]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x230]
push dword [ebp - 0x21c]
push dword [ebp - 0x22c]
push eax
push esi
call fcn.004bdc10
mov ecx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x1a4]
inc ecx
add eax, 0xc
mov dword [ebp - 0x1ac], ecx
mov dword [ebp - 0x1a4], eax
cmp ecx, edi
jb 0x4c2434
xor eax, eax
lea ecx, [ebp - 0x8c]
cmp byte [esi + 4], al
sete al
lea eax, [eax*2 - 1]
mov dword [ebp - 0x1bc], eax
mov edi, eax
call fcn.005dc430
jmp 0x4c2530
or edi, 0xffffffff
mov eax, dword [ebp - 0x1c4]
test eax, eax
je 0x4c2566
push fcn.005dc430
lea esi, [eax - 4]
mov byte [ebp - 4], 0x45
push dword [esi]
push 0xc
push eax
call fcn.0041e45b
mov eax, dword [esi]
lea eax, [eax + eax*2]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.0041e1c8
add esp, 8
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x4c259c
push fcn.005dc430
lea esi, [eax - 4]
mov byte [ebp - 4], 0x46
push dword [esi]
push 0xc
push eax
call fcn.0041e45b
mov eax, dword [esi]
lea eax, [eax + eax*2]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.0041e1c8
add esp, 8
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x4c25d7
push fcn.005dc430
lea esi, [eax - 4]
mov byte [ebp - 4], 0x47
push dword [esi]
push 0xc
push eax
call fcn.0041e45b
mov eax, dword [esi]
lea eax, [eax + eax*2]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.0041e1c8
add esp, 8
jmp 0x4c25d7
or edi, 0xffffffff
lea ecx, [ebp - 0x1f8]
call fcn.005d6ab0
lea ecx, [ebp - 0x1e0]
call fcn.005d6ab0
lea ecx, [ebp - 0x1ec]
call fcn.005d6ab0
lea ecx, [ebp - 0x58]
call fcn.005dc430
lea ecx, [ebp - 0xdc]
call fcn.005dc430
lea ecx, [ebp - 0x4c]
call fcn.005dc430
lea ecx, [ebp - 0x38]
call fcn.005dc430
lea ecx, [ebp - 0x120]
call fcn.005dc430
lea ecx, [ebp - 0xc0]
call fcn.005dc430
lea ecx, [ebp - 0xb4]
call fcn.005dc430
lea ecx, [ebp - 0xa4]
call fcn.005dc430
lea ecx, [ebp - 0x74]
call fcn.005dc430
lea ecx, [ebp - 0xa8]
call fcn.005d69e0
lea ecx, [ebp - 0x68]
call fcn.005d69e0
lea ecx, [ebp - 0x3c]
call fcn.005d69e0
push dword [ebp - 0x230]
call fcn.0041e1c3
add esp, 4
push dword [ebp - 0x21c]
call fcn.0041e1c3
mov eax, dword [ebp - 0x22c]
add esp, 4
test eax, eax
je 0x4c26bc
push fcn.005dc430
lea esi, [eax - 4]
mov byte [ebp - 4], 0x48
push dword [esi]
push 0xc
push eax
call fcn.0041e45b
mov eax, dword [esi]
lea eax, [eax + eax*2]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.0041e1c8
add esp, 8
mov eax, dword [ebp - 0x228]
mov byte [ebp - 4], 7
test eax, eax
je 0x4c26f6
push fcn.005dc430
lea esi, [eax - 4]
mov byte [ebp - 4], 0x49
push dword [esi]
push 0xc
push eax
call fcn.0041e45b
mov eax, dword [esi]
lea eax, [eax + eax*2]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.0041e1c8
add esp, 8
lea ecx, [ebp - 0x114]
call fcn.005dc430
lea ecx, [ebp - 0x12c]
call fcn.005dc430
lea ecx, [ebp - 0x1d4]
call fcn.005d6ab0
lea ecx, [ebp - 0x1c]
call fcn.005d69e0
lea ecx, [ebp - 0x18]
call fcn.005d69e0
lea ecx, [ebp - 0x2c]
call fcn.005dc430
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
push 0x8007000e
call fcn.0041de50
push 0x8007000e
call fcn.0041de50
int3