Function at 0x545790
Capabilities:
Check if file exists
Check os version
Create process on windows
Inspect load icon resource
Persist via lnk shortcut
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push 0x25c
mov eax, 0x6a3759
call fcn.0056e23b
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov esi, dword [ebp + 8]
inc ecx
or dword [ebp - 0x200], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x224], ecx
lea ecx, [ebp - 0x64]
push eax
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
call fcn.0041d41a
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x64]
push 0x6fb258
call fcn.0042dea6
push 0x8003
mov dword [0x796104], esi
mov dword [0x7967a4], ebx
mov dword [0x7e7288], ebx
mov dword [0x7e728c], ebx
mov dword [0x7e7290], ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor esi, esi
inc esi
push esi
push 0x111
call fcn.00545284
push esi
push 0x233
call fcn.00545284
push esi
push 0x4a
call fcn.00545284
push esi
push 0x49
call fcn.00545284
push esi
push 0x219
call fcn.00545284
add esp, 0x28
lea eax, [ebp - 0x60]
cmp dword [ebp - 0x4c], 8
mov esi, 0x7967a8
mov ecx, esi
cmovae eax, dword [ebp - 0x60]
push eax
call fcn.0052a90d
push 0x6fb25c
mov ecx, esi
call fcn.0052a7a7
test eax, eax
je 0x54587d
call fcn.004a530c
or esi, 0xffffffff
jmp 0x54706a
push str.Debug3
mov ecx, esi
call fcn.0052a7a7
mov edi, 0x77b084
test eax, eax
je 0x54589e
mov dword [0x7960fc], 3
jmp 0x5458d2
push str.Debug2
mov ecx, esi
call fcn.0052a7a7
test eax, eax
je 0x5458ba
mov dword [0x7960fc], 2
jmp 0x5458d2
push str.Debug
mov ecx, esi
call fcn.0052a7a7
test eax, eax
je 0x545924
xor eax, eax
inc eax
mov dword [0x7960fc], eax
mov ecx, edi
call fcn.0042e554
push str._Start_
mov ecx, edi
call fcn.0042e683
cmp dword [0x7960fc], 0
jle 0x54592a
lea ecx, [ebp - 0xd4]
call fcn.004173bc
xor eax, eax
inc eax
mov byte [ebp - 4], al
lea eax, [ebp - 0xd4]
push eax
call fcn.00544d84
pop ecx
push eax
mov ecx, edi
call fcn.0042e683
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xd4]
call fcn.0041786a
jmp 0x54592a
mov dword [0x7960fc], ebx
push 0x7960f8
call fcn.005448d4
mov ebx, 0x796274
pop ecx
test eax, eax
je 0x546e94
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
je 0x54596f
cmp dword [0x7960fc], esi
jle 0x546eb3
push eax
push str.OleInitialize_Failed__Error_Code__0x_XL
push edi
call fcn.0042e634
add esp, 0xc
jmp 0x546e94
cmp dword [0x7960fc], esi
jle 0x545983
push str.OleInitialize_Success_
mov ecx, edi
call fcn.0042e683
call fcn.00541047
test eax, eax
jne 0x5459bc
push 0x30
push 0x6fb52c
push str.Failed_to_initialize_algorithms_library__n
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [0x7960fc], esi
jle 0x546eb3
push str.Failed_to_initialize_algorithms_library_
mov ecx, edi
call fcn.0042e683
jmp 0x546e94
cmp dword [0x7960fc], esi
jle 0x5459d0
push str.Step_0001
mov ecx, edi
call fcn.0042e683
push esi
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x214]
push eax
call sub.gdiplus.dll_GdiplusStartup
test eax, eax
je 0x545a00
push 0x30
push 0x6fb5d4
push str.Failed_to_initialize_GDIPlus_library__n
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x546e94
cmp dword [0x7960fc], esi
jle 0x545a14
push str.Step_0002
mov ecx, edi
call fcn.0042e683
call fcn.0045635a
cmp dword [0x7962dc], 8
mov eax, 0x7962c8
mov esi, 0x796a74
cmovae eax, dword [0x7962c8]
mov ecx, esi
push eax
call fcn.004c1a01
push 0x795e68
push 0x795e28
push 0x795de8
push 0x795d68
push 0x795da8
push 0x795d28
mov ecx, esi
call fcn.00586ab3
push eax
mov ecx, 0x796ad8
call fcn.004c52d6
mov esi, 0x7967a8
push str.CheckMutex
mov ecx, esi
call fcn.0052a7a7
test eax, eax
je 0x545d46
xor eax, eax
push 0x6fb708
mov dword [ebp - 0x204], eax
mov ebx, eax
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x1fc], eax
call fcn.0052dd63
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x1f4], eax
pop ecx
test eax, eax
je 0x545afa
push str.Privacy_Eraser___Empty_Recycle_Bin
push ebx
push ebx
call edi
push ebx
push 0x4d5
push 0x111
push dword [ebp - 0x1f4]
mov dword [ebp - 0x204], eax
call esi
push ebx
push 0x2704
push 0x111
push dword [ebp - 0x1f4]
call esi
push str.Privacy_Eraser_File_Shredder
call fcn.0052dd63
mov dword [ebp - 0x1f4], eax
pop ecx
test eax, eax
je 0x545b66
push str.Privacy_Eraser___File_Shredder_Loop_Begin
push 0
push 0
call edi
push str.Privacy_Eraser___File_Shredder_Begin
push 0
push 0
mov ebx, eax
call edi
push str.Privacy_Eraser___File_Shredder
push 0
push 0
mov dword [ebp - 0x208], eax
call edi
push 0
push 0x4d5
push 0x111
push dword [ebp - 0x1f4]
mov dword [ebp - 0x20c], eax
call esi
push 0
push 0x2704
push 0x111
push dword [ebp - 0x1f4]
call esi
push 0x6fb74c
call fcn.0052dd63
mov dword [ebp - 0x1f4], eax
pop ecx
test eax, eax
je 0x545bcc
push 0x6fb8cc
push 0
push 0
call edi
push str.Privacy_Eraser_UI
push 0
push 0
mov dword [ebp - 0x210], eax
call edi
mov edi, dword [ebp - 0x1f4]
push 0
push 0x2704
push 0x111
push edi
mov dword [ebp - 0x1fc], eax
call esi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x4d5
push 0x111
push edi
call esi
xor eax, eax
xor edx, edx
cmp dword [ebp - 0x204], eax
mov dword [ebp - 0x200], edx
setne al
test ebx, ebx
lea ecx, [eax + 1]
cmove ecx, eax
cmp dword [ebp - 0x208], edx
lea eax, [ecx + 1]
cmove eax, ecx
cmp dword [ebp - 0x20c], edx
lea ecx, [eax + 1]
cmove ecx, eax
cmp dword [ebp - 0x210], edx
lea eax, [ecx + 1]
cmove eax, ecx
cmp dword [ebp - 0x1fc], edx
lea ecx, [eax + 1]
cmove ecx, eax
mov dword [ebp - 0x1f4], ecx
test ecx, ecx
je 0x546e94
mov esi, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov byte [ebp - 4], 2
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0054570b
mov eax, dword [ebp - 0x204]
mov edi, dword [ebp - 0x1c]
test eax, eax
je 0x545c51
mov dword [edi], eax
xor eax, eax
lea esi, [eax + 1]
test ebx, ebx
je 0x545c59
mov dword [edi + esi*4], ebx
inc esi
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x545c67
mov dword [edi + esi*4], eax
inc esi
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x545c75
mov dword [edi + esi*4], eax
inc esi
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x545c83
mov dword [edi + esi*4], eax
inc esi
mov eax, dword [ebp - 0x1fc]
test eax, eax
je 0x545c90
mov dword [edi + esi*4], eax
mov ecx, 0x7967a8
mov esi, 0x7530
call fcn.00672b08
xor ecx, ecx
inc ecx
cmp eax, ecx
jbe 0x545cc1
push ecx
mov ecx, 0x7967a8
call fcn.0052a7d7
push eax
call fcn.00649635
pop ecx
xor ecx, ecx
imul esi, eax, 0x3e8
inc ecx
push esi
push ecx
push edi
push dword [ebp - 0x1f4]
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, dword [ebp - 0x200]
cmp eax, 0x102
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
cmove ecx, eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x200], ecx
test eax, eax
je 0x545cfa
push eax
call esi
test ebx, ebx
je 0x545d01
push ebx
call esi
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x545d0e
push eax
call esi
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x545d1b
push eax
call esi
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x545d28
push eax
call esi
mov eax, dword [ebp - 0x1fc]
test eax, eax
je 0x545d35
push eax
call esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0058226f
jmp 0x546e94
push 0x6fb8ec
mov ecx, esi
call fcn.0052a7a7
test eax, eax
je 0x5460e2
call fcn.00552336
call fcn.00564e5d
test eax, eax
jne 0x545d70
inc eax
push eax
call fcn.00429064
pop ecx
call fcn.004a8701
push 0
push 0
push 0x796784
push 0x796114
push 0x796118
call fcn.0052e95c
add esp, 0x14
test eax, eax
je 0x546e94
call fcn.005451e7
test eax, eax
je 0x546e94
mov esi, 0x11c
lea eax, [ebp - 0x1f0]
push esi
push 0
push eax
call fcn.00644240
add esp, 0xc
mov dword [ebp - 0x1f0], esi
lea eax, [ebp - 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x1ec], 0xa
jb 0x545e98
call fcn.0052e3fd
test eax, eax
je 0x545e98
mov esi, 0x7967e0
mov ecx, esi
call fcn.005688e3
test eax, eax
je 0x545e98
push str.CreateShortcut
mov ecx, esi
call fcn.0056881c
mov edi, eax
test edi, edi
je 0x545e98
lea ecx, [ebp - 0xd4]
call fcn.004173bc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 4
lea eax, [ebp - 0xd4]
push 0x6fb90c
push eax
push str.ProgramData
call fcn.004555ca
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x48]
push str._sMicrosoftWindowsStart_MenuProgramsPrivacy_Eraser_s.lnk
push eax
call fcn.0041ccda
add esp, 0x10
lea esi, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
cmovae esi, dword [ebp - 0x44]
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.0042810e
pop ecx
pop ecx
push eax
push esi
call edi
add esp, 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x48]
call fcn.0041786a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xd4]
call fcn.0041786a
lea ecx, [ebp - 0x2c]
call fcn.004173bc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x80]
call fcn.004173bc
mov byte [ebp - 4], 6
lea eax, [ebp - 0x7c]
push eax
call fcn.00428617
push 0
call fcn.004a971e
xor eax, eax
inc eax
push eax
call fcn.004a971e
add esp, 0xc
call fcn.004a6b5c
push str.RBAddOpen
mov ecx, 0x7967a8
xor esi, esi
call fcn.0052a7a7
mov edi, 0x796c94
test eax, eax
je 0x545f35
cmp dword [ebp - 0x68], 8
lea esi, [ebp - 0x7c]
push 0xc9
cmovae esi, dword [ebp - 0x7c]
mov ecx, edi
call fcn.00417bfd
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x545f0d
mov eax, dword [eax]
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0041ccda
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0
push eax
call fcn.004a99aa
add esp, 0x18
xor eax, eax
lea esi, [eax + 1]
push str.RBAddErase
mov ecx, 0x7967a8
call fcn.0052a7a7
test eax, eax
je 0x545f95
cmp dword [ebp - 0x68], 8
lea esi, [ebp - 0x7c]
push 0xca
cmovae esi, dword [ebp - 0x7c]
mov ecx, edi
call fcn.00417bfd
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x545f6a
mov eax, dword [eax]
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0041ccda
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 1
cmovae eax, dword [ebp - 0x28]
push 0x6fb9f0
push eax
call fcn.004a99aa
add esp, 0x18
xor eax, eax
lea esi, [eax + 1]
push str.WEAddErase
mov ecx, 0x7967a8
call fcn.0052a7a7
test eax, eax
je 0x545fee
cmp dword [ebp - 0x68], 8
lea esi, [ebp - 0x7c]
push 0xca
cmovae esi, dword [ebp - 0x7c]
mov ecx, edi
call fcn.00417bfd
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x545fca
mov eax, dword [eax]
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0041ccda
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004a6c5a
add esp, 0x10
xor eax, eax
lea esi, [eax + 1]
push 0x6fba20
mov ecx, 0x7967a8
call fcn.0052a7a7
test eax, eax
je 0x54601e
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x80]
call fcn.0041786a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0041786a
jmp 0x54690e
test esi, esi
je 0x54603f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x80]
call fcn.0041786a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0041786a
jmp 0x546e94
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x80]
call fcn.0041786a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0041786a
mov edi, 0x77b084
mov esi, 0x7967a8
push 0
call fcn.0052dc9d
pop ecx
test eax, eax
jne 0x546692
cmp dword [0x7960fc], eax
jle 0x546085
push str.Step_0003
mov ecx, edi
call fcn.0042e683
mov ecx, esi
call fcn.00672b08
test eax, eax
je 0x546671
cmp dword [0x7960fc], 0
jle 0x5460a9
push str.Step_0004
mov ecx, edi
call fcn.0042e683
push 0x6fbb7c
mov ecx, esi
call fcn.0052a7a7
test eax, eax
jne 0x5464c8
push 0x6fbb90
mov ecx, esi
call fcn.0052a7a7
test eax, eax
jne 0x5464c8
push 0x30
push 0x6fbc2c
push str.Privacy_Eraser_is_currently_running__please_close_all_instances_of_it_and_try_again.
jmp 0x546a5c
push str.Uninstall
mov ecx, esi
call fcn.0052a7a7
test eax, eax
je 0x54624a
call fcn.00552336
call fcn.00564e5d
test eax, eax
je 0x54610b
call fcn.004b5cf2
jmp 0x546110
call fcn.0051387e
xor ebx, ebx
push ebx
push ebx
push 0x796784
push 0x796114
push 0x796118
call fcn.0052e95c
add esp, 0x14
test eax, eax
je 0x546e94
call fcn.005451e7
test eax, eax
je 0x546e94
lea ecx, [ebp - 0x2c]
call fcn.004173bc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd4]
call fcn.004173bc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xb8]
call fcn.004173bc
mov byte [ebp - 4], 9
lea eax, [ebp - 0xb4]
push eax
call fcn.00428617
cmp dword [ebp - 0xa0], 8
lea esi, [ebp - 0xb4]
pop ecx
cmovae esi, dword [ebp - 0xb4]
mov edi, 0x796c94
push 0xc9
mov ecx, edi
call fcn.00417bfd
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x5461a7
mov eax, dword [eax]
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0041ccda
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004a9846
add esp, 0x10
lea esi, [ebp - 0xb4]
cmp dword [ebp - 0xa0], 8
mov ecx, edi
cmovae esi, dword [ebp - 0xb4]
push 0xca
call fcn.00417bfd
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x5461f1
mov eax, dword [eax]
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0041ccda
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004a9846
push ebx
call fcn.004a971e
xor eax, eax
inc eax
push eax
call fcn.004a971e
add esp, 0x18
call fcn.004a6b5c
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xb8]
call fcn.0041786a
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd4]
call fcn.0041786a
mov byte [ebp - 4], bl
jmp 0x546032
push 0x6fba54
mov ecx, esi
call fcn.0052a7a7
test eax, eax
je 0x546489
call fcn.005652d3
test eax, eax
je 0x546061
push 0
push 0
push 0x796784
push 0x796114
push 0x796118
call fcn.0052e95c
add esp, 0x14
test eax, eax
je 0x546061
lea ecx, [ebp - 0x9c]
call fcn.004173bc
mov byte [ebp - 4], 0xa
mov ecx, esi
push str.Export
call fcn.0052a858
mov esi, eax
cmp esi, 0xffffffff
je 0x54647a
inc esi
mov edi, 0x7967a8
push esi
mov ecx, edi
call fcn.0052a888
cmp eax, 1
jne 0x5462e3
lea eax, [ebp - 0x98]
mov ecx, edi
push eax
push esi
call fcn.0052a800
test eax, eax
je 0x5462e3
cmp dword [ebp - 0x88], 0
jne 0x5462ff
cmp dword [0x796288], 8
lea ecx, [ebp - 0x9c]
mov eax, ebx
cmovae eax, dword [0x796274]
push eax
call fcn.004179fb
and dword [ebp - 0x1fc], 0
lea eax, [ebp - 0x1fc]
push eax
push str.Plug_ins.xml
push 0x796118
call fcn.00568f5e
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x5463c3
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x98]
cmp dword [ebp - 0x84], 8
cmovae eax, dword [ebp - 0x98]
push eax
lea eax, [ebp - 0x48]
push str._sPlug_ins.xml
push eax
call fcn.0041ccda
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
xor ecx, ecx
push ecx
push 0x80
push 2
push ecx
push ecx
push 0x40000000
push eax
call fcn.005654e9
mov edi, eax
add esp, 0x28
cmp edi, 0xffffffff
je 0x5463ab
and dword [ebp - 0x1f4], 0
lea eax, [ebp - 0x1f4]
push 0
push eax
push dword [ebp - 0x1fc]
push esi
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
push eax
push esi
call fcn.0056df27
pop ecx
pop ecx
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x48]
call fcn.0041786a
lea eax, [ebp - 0x1fc]
push eax
push str.Plug_ins2.xml
push 0x796118
call fcn.00568f5e
mov esi, eax
add esp, 0xc
test esi, esi
je 0x54647a
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x98]
cmp dword [ebp - 0x84], 8
cmovae eax, dword [ebp - 0x98]
push eax
lea eax, [ebp - 0x48]
push str._sPlug_ins2.xml
push eax
call fcn.0041ccda
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
xor ecx, ecx
push ecx
push 0x80
push 2
push ecx
push ecx
push 0x40000000
push eax
call fcn.005654e9
mov edi, eax
add esp, 0x28
cmp edi, 0xffffffff
je 0x546462
and dword [ebp - 0x1f4], 0
lea eax, [ebp - 0x1f4]
push 0
push eax
push dword [ebp - 0x1fc]
push esi
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
push eax
push esi
call fcn.0056df27
pop ecx
pop ecx
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x48]
call fcn.0041786a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9c]
jmp 0x546035
push 0x6fbaf0
mov ecx, esi
call fcn.0052a7a7
test eax, eax
je 0x546061
call fcn.004a929b
test eax, eax
jne 0x546e94
call fcn.0052db7d
test eax, eax
jne 0x546692
push eax
push str.Privacy_Eraser_Recycle_Bin_Eraser
call fcn.00556d93
pop ecx
jmp 0x546e93
lea ecx, [ebp - 0x264]
call fcn.0056606c
mov byte [ebp - 4], 0xd
xorps xmm0, xmm0
push ecx
push ecx
lea ecx, [ebp - 0x264]
movsd qword [esp], xmm0
call fcn.005660f2
call fcn.0052dc79
xor ebx, ebx
jmp 0x54653f
push ebx
lea ecx, [ebp - 0x264]
call fcn.00566268
movsd xmm0, qword [0x6fc8d8]
fstp qword [ebp - 0x1f8]
comisd xmm0, xmmword [ebp - 0x1f8]
jbe 0x54665e
push 0x6fbbb4
call fcn.0052dd63
mov dword [ebp - 0x1f4], eax
pop ecx
test eax, eax
jne 0x546548
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0052dc79
test eax, eax
jne 0x5464f5
jmp 0x54665e
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 0xe
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x6fbbe8
lea eax, [ebp - 0x48]
push 0x6fbc08
push eax
call fcn.0041ccda
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.004173bc
mov byte [ebp - 4], 0xf
mov edi, 0x7967a8
mov ecx, edi
mov esi, ebx
call fcn.00672b08
test eax, eax
je 0x5465c6
push 0x6fbc24
lea ecx, [ebp - 0x2c]
call fcn.00419c79
push esi
mov ecx, edi
call fcn.0052a7d7
push eax
lea ecx, [ebp - 0x2c]
call fcn.00419c79
push 0x6fbc28
lea ecx, [ebp - 0x2c]
call fcn.00419c79
mov ecx, edi
inc esi
call fcn.00672b08
cmp esi, eax
jb 0x54658f
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x30], 8
lea edi, [eax*2 + 2]
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
push edi
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x546644
xor eax, eax
push eax
push eax
push eax
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp dword [ebp - 0x14], 8
mov esi, eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push edi
push esi
call fcn.00651eba
add esp, 0xc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4db
push 0x111
push dword [ebp - 0x1f4]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.0041786a
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x48]
call fcn.0041786a
xor ebx, ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x264]
call fcn.005660ab
jmp 0x546e94
cmp dword [0x7960fc], 0
jle 0x546686
push str.Step_0005
mov ecx, edi
call fcn.0042e683
push 0
push 0x6fbcfc
jmp 0x5464bd
cmp dword [0x7960fc], 0
jle 0x5466a7
push str.Step_0006
mov ecx, edi
call fcn.0042e683
call fcn.00564e00
test eax, eax
je 0x546811
cmp dword [0x7960fc], 0
jle 0x5466c9
push str.Step_0007
mov ecx, edi
call fcn.0042e683
lea ecx, [ebp - 0x2c]
call fcn.004173bc
mov byte [ebp - 4], 0x10
mov eax, ebx
cmp dword [0x796288], 8
push str.PrivacyEraser64.exe
cmovae eax, dword [0x796274]
push eax
lea eax, [ebp - 0x2c]
push 0x6fbd88
push eax
call fcn.0041ccda
add esp, 0x10
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x546805
cmp dword [0x7960fc], 0
jle 0x546740
push str.Step_0008
mov ecx, edi
call fcn.0042e683
cmp dword [0x7960fc], 0
jle 0x546740
push str.Step_0010
mov ecx, edi
call fcn.0042e683
call fcn.0052dbc7
push 0x38
xor ebx, ebx
lea eax, [ebp - 0x25c]
push ebx
push eax
call fcn.00644240
add esp, 0xc
mov dword [ebp - 0x260], 0x3c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x25c], 0x40
cmovae eax, dword [ebp - 0x28]
cmp dword [ebp - 0x4c], 8
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x60]
cmovae eax, dword [ebp - 0x60]
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x260]
push eax
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], 5
mov dword [ebp - 0x240], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x5467df
cmp dword [0x7960fc], ebx
jle 0x546242
push str.ShellExecuteEx_Success_
mov ecx, edi
call fcn.0042e683
jmp 0x546242
cmp dword [0x7960fc], ebx
jle 0x546242
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ShellExecuteEx_Failed__Error_Code___u
push edi
call fcn.0042e634
add esp, 0xc
jmp 0x546242
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0041786a
cmp dword [0x7960fc], 0
jle 0x546826
push str.Step_0011
mov ecx, edi
call fcn.0042e683
push 0
call fcn.005650c3
pop ecx
test eax, eax
je 0x54687a
cmp dword [0x7960fc], 0
jle 0x546847
push str.Step_0012
mov ecx, edi
call fcn.0042e683
call fcn.005652d3
test eax, eax
jne 0x54687a
cmp dword [0x7960fc], eax
jle 0x546864
push str.Step_0013
mov ecx, edi
call fcn.0042e683
cmp dword [ebp - 0x4c], 8
lea eax, [ebp - 0x60]
cmovae eax, dword [ebp - 0x60]
push eax
call fcn.005452cc
jmp 0x546e8d
cmp dword [0x7960fc], 0
jle 0x54688f
push str.Step_0013A
mov ecx, edi
call fcn.0042e683
call fcn.00552336
cmp dword [0x7960fc], 0
jle 0x5468a9
push str.Load_config.xml_successfully_
mov ecx, edi
call fcn.0042e683
push 0
push 0
push 0x796784
push 0x796114
push 0x796118
call fcn.0052e95c
add esp, 0x14
test eax, eax
jne 0x5468dc
cmp dword [0x7960fc], eax
jle 0x5468f1
push str.Failed_to_initialize_application_resource_file_
mov ecx, edi
call fcn.0042e683
cmp dword [0x7960fc], 0
jle 0x5468f1
push str.Load_resources_successfully_
mov ecx, edi
call fcn.0042e683
call fcn.005451e7
test eax, eax
jne 0x54690e
cmp dword [0x7960fc], eax
jle 0x54692a
push str.Failed_to_load_language_data_
mov ecx, edi
call fcn.0042e683
cmp dword [0x7960fc], 0
mov esi, 0x77b084
jle 0x54692f
push str.Step_0014
mov ecx, esi
call fcn.0042e683
jmp 0x54692f
mov esi, 0x77b084
push 0x6fbfd0
mov edi, 0x796118
mov ecx, 0x7b6dd0
push edi
push 0x6fbfec
call fcn.004a6221
test eax, eax
je 0x54698d
push 0x6fc008
push edi
push 0x6fc024
mov ecx, 0x7d6ea8
call fcn.004a6221
test eax, eax
je 0x54698d
push 0x6fc040
push edi
push str.Default.skin
mov ecx, 0x7c6e3c
call fcn.004a6221
test eax, eax
je 0x54698d
mov ecx, 0x7b6dc8
call fcn.004eafa2
test eax, eax
jne 0x5469a2
cmp dword [0x7960fc], 0
jle 0x5469b7
push 0x6fc078
mov ecx, esi
call fcn.0042e683
cmp dword [0x7960fc], 0
jle 0x5469b7
push str.Step_0015
mov ecx, esi
call fcn.0042e683
push 0x796c98
call fcn.0052d56d
pop ecx
test eax, eax
jne 0x5469da
cmp dword [0x7960fc], eax
jle 0x546a04
push str.Failed_to_initialize_Skin_library_
mov ecx, esi
call fcn.0042e683
cmp dword [0x7960fc], 0
jle 0x546a04
push str.Step_0016
mov ecx, esi
call fcn.0042e683
cmp dword [0x7960fc], 0
jle 0x546a04
push str.Step_0017
mov ecx, esi
call fcn.0042e683
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6c
push 0
call esi
mov edi, dword [sym.imp.USER32.dll_LoadIconW]
push eax
call edi
push eax
push 0x6b
push 0
call esi
push eax
call edi
push eax
push 0xb
push 0
push 0x6fc150
call fcn.00582d3d
add esp, 0x14
test eax, eax
jne 0x546a63
cmp dword [0x7960fc], eax
jle 0x546a50
push str.Failed_to_register_Registration_Reminder_window_
mov ecx, 0x77b084
call fcn.0042e683
push 0x30
push 0x6fc16c
push str.Failed_to_register_Registration_Reminder_window__n
push 0
jmp 0x5459f5
cmp dword [0x7960fc], 0
jle 0x546a7b
push str.Step_0018
mov ecx, 0x77b084
call fcn.0042e683
xor eax, eax
push eax
push eax
push 0x400b
push eax
push 0x6fc264
call fcn.00582d3d
add esp, 0x14
test eax, eax
jne 0x546abb
cmp dword [0x7960fc], eax
jle 0x546aad
push str.Failed_to_register_dialog_window_
mov ecx, 0x77b084
call fcn.0042e683
push 0x30
push 0x6fc1dc
push str.Failed_to_register_dialog_window__n
jmp 0x546a5c
cmp dword [0x7960fc], 0
jle 0x546ad3
push str.Step_0019
mov ecx, 0x77b084
call fcn.0042e683
push 0x6c
push 0
call esi
push eax
call edi
push eax
push 0x6b
push 0
call esi
push eax
call edi
push eax
push 0xb
push 0
push 0x6fc338
call fcn.00582d3d
add esp, 0x14
test eax, eax
jne 0x546b24
cmp dword [0x7960fc], eax
jle 0x546b13
push str.Failed_to_register_message_dialog_window_
mov ecx, 0x77b084
call fcn.0042e683
push 0x30
push 0x6fc27c
push str.Failed_to_register_message_dialog_window__n
jmp 0x546a5c
cmp dword [0x7960fc], 0
mov edi, 0x77b084
jle 0x546b3e
push str.Step_0020
mov ecx, edi
call fcn.0042e683
xor eax, eax
push eax
push eax
push 0xb
push eax
push 0x6fc438
call fcn.00582d3d
add esp, 0x14
test eax, eax
jne 0x546b7b
cmp dword [0x7960fc], eax
jle 0x546b6a
push str.Failed_to_register_menu_window_
mov ecx, edi
call fcn.0042e683
push 0x30
push str.Error
push str.Failed_to_register_menu_window__n
jmp 0x546a5c
cmp dword [0x7960fc], 0
jle 0x546b90
push str.Step_0021
mov ecx, edi
call fcn.0042e683
mov esi, 0x7967a8
push 0x6fc4ec
mov ecx, esi
call fcn.0052a7a7
test eax, eax
je 0x546bb5
call fcn.004a9236
mov dword [ebp - 0x200], eax
jmp 0x546e94
push str.Install
mov ecx, esi
call fcn.0052a7a7
test eax, eax
je 0x546dee
push str.AutoKeepCookies
mov ecx, esi
call fcn.0052a7a7
test eax, eax
je 0x546dee
call fcn.00552336
mov ecx, 0x77ca00
call fcn.0046b9ad
mov edi, 0xff8
push edi
call fcn.0056def4
pop ecx
mov dword [ebp - 0x1f4], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x546c13
mov ecx, eax
call fcn.00436660
mov esi, eax
xor ebx, ebx
jmp 0x546c17
xor ebx, ebx
mov esi, ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x546c32
call fcn.00551b25
mov ecx, esi
call fcn.004396c5
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push 0xfc0
call fcn.0056def4
pop ecx
mov dword [ebp - 0x1f4], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x546c56
mov ecx, eax
call fcn.0042eed8
mov esi, eax
jmp 0x546c58
mov esi, ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x546c73
call fcn.00551b25
mov ecx, esi
call fcn.004396c5
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push edi
call fcn.0056def4
pop ecx
mov dword [ebp - 0x1f4], eax
mov byte [ebp - 4], 0x13
test eax, eax
je 0x546c93
mov ecx, eax
call fcn.0042ed00
mov esi, eax
jmp 0x546c95
mov esi, ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x546cb0
call fcn.00551b25
mov ecx, esi
call fcn.004396c5
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push edi
call fcn.0056def4
pop ecx
mov dword [ebp - 0x1f4], eax
mov byte [ebp - 4], 0x14
test eax, eax
je 0x546cd0
mov ecx, eax
call fcn.00437725
mov esi, eax
jmp 0x546cd2
mov esi, ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x546ced
call fcn.00551b25
mov ecx, esi
call fcn.004396c5
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push 0xfc0
call fcn.0056def4
pop ecx
mov dword [ebp - 0x1f4], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x546d11
mov ecx, eax
call fcn.0043791e
mov esi, eax
jmp 0x546d13
mov esi, ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x546d2e
call fcn.00551b25
mov ecx, esi
call fcn.004396c5
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push edi
call fcn.0056def4
pop ecx
mov dword [ebp - 0x1f4], eax
mov byte [ebp - 4], 0x16
test eax, eax
je 0x546d4e
mov ecx, eax
call fcn.00434eef
mov esi, eax
jmp 0x546d50
mov esi, ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x546d6b
call fcn.00551b25
mov ecx, esi
call fcn.004396c5
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push edi
call fcn.0056def4
pop ecx
mov dword [ebp - 0x1f4], eax
mov byte [ebp - 4], 0x17
test eax, eax
je 0x546d8b
mov ecx, eax
call fcn.0042ebca
mov esi, eax
jmp 0x546d8d
mov esi, ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x546da8
call fcn.00551b25
mov ecx, esi
call fcn.004396c5
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push edi
call fcn.0056def4
pop ecx
mov dword [ebp - 0x1f4], eax
mov byte [ebp - 4], 0x18
test eax, eax
je 0x546dc8
mov ecx, eax
call fcn.0042ea94
mov esi, eax
jmp 0x546dca
mov esi, ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x546e94
call fcn.00551b25
mov ecx, esi
call fcn.004396c5
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
jmp 0x546e94
cmp dword [0x7960fc], 0
jle 0x546e03
push str.Step_0022
mov ecx, edi
call fcn.0042e683
cmp dword [ebp - 0x4c], 8
lea ecx, [ebp - 0x200]
lea eax, [ebp - 0x60]
cmovae eax, dword [ebp - 0x60]
push ecx
push eax
call fcn.0052a49b
pop ecx
pop ecx
test eax, eax
je 0x546e38
cmp dword [0x7960fc], 0
jle 0x546eb3
push str.Step_0022A
jmp 0x5459b0
mov eax, dword [0x7960fc]
test eax, eax
jle 0x546e52
push str.Step_0023
mov ecx, edi
call fcn.0042e683
mov eax, dword [0x7960fc]
cmp dword [0x7e7288], 0
jne 0x546e69
test eax, eax
jle 0x546eb3
push str.hMutex__NULL
jmp 0x5459b0
test eax, eax
jle 0x546e79
push str.Step_0024
mov ecx, edi
call fcn.0042e683
mov ecx, 0x77ca00
call fcn.0046b9ad
push 0x7960f8
call fcn.005453ba
mov dword [ebp - 0x200], eax
pop ecx
cmp dword [0x7960fc], 0
mov edi, 0x77b084
jle 0x546eae
push str.Ready_to_exit
mov ecx, edi
call fcn.0042e683
mov ebx, 0x796274
call fcn.00456441
call fcn.0052dbc7
push 0
push str.cbfxREMINDER
call fcn.00582e78
push 0
push str.cbfxDialog
call fcn.00582e78
push 0
push 0x6fc5e8
call fcn.00582e78
push 0
push 0x6fc608
call fcn.00582e78
add esp, 0x20
call fcn.0052d329
call fcn.00541024
call dword [sym.imp.ole32.dll_OleUninitialize]
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [0x7960fc], 0
jle 0x546f1d
push str._Exit_
mov ecx, edi
call fcn.0042e683
mov ecx, edi
call fcn.0042e53c
mov edi, 0x795c58
mov ecx, edi
call fcn.00419fcc
test eax, eax
je 0x546f82
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.0042810e
cmp dword [ebp - 0x30], 8
lea esi, [ebp - 0x44]
pop ecx
cmovae esi, dword [ebp - 0x44]
pop ecx
mov ecx, edi
call fcn.0041ae1e
push eax
mov ecx, edi
call fcn.00419fcc
push eax
mov ecx, edi
call fcn.00419fbb
push eax
push esi
call fcn.004d2050
add esp, 0x10
mov byte [ebp - 4], 0
jmp 0x547034
mov ecx, edi
call fcn.0041ae1e
test eax, eax
je 0x54703c
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x48]
cmp dword [0x796288], 8
push 0x6fc654
cmovae ebx, dword [0x796274]
push ebx
push 0x6fc678
push eax
call fcn.0041ccda
push 0x10
xor ebx, ebx
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.00644240
push 0x44
pop esi
push esi
lea eax, [ebp - 0x268]
push ebx
push eax
call fcn.00644240
add esp, 0x28
mov dword [ebp - 0x268], esi
lea ecx, [ebp - 0x20]
xor eax, eax
inc eax
cmp dword [ebp - 0x30], 8
mov word [ebp - 0x238], ax
push ecx
lea ecx, [ebp - 0x268]
mov dword [ebp - 0x23c], eax
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x547031
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x48]
call fcn.0041786a
mov eax, dword [0x7967a4]
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x547051
push 0x80040001
push 0x12
jmp 0x54705d
cmp eax, 2
jne 0x547064
push 0x80040001
push 0x18
call fcn.00564fd6
pop ecx
pop ecx
mov esi, dword [ebp - 0x200]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.0041786a
mov eax, esi
call fcn.0056e1e5
ret 0x10