Function at 0x5132f0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Encode data using base64
Enumerate process modules
Get common file path
Get file attributes
Parse pe header
Persist via appinit_dlls registry key
Persist via run registry key
Persist via winlogon helper dll registry key
Query environment variable
Reference google public dns server
Reference http user-agent string
Schedule task via itaskscheduler
Schedule task via itaskservice
Set file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f794b
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x70e0
call fcn.0041ead0
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x6f7c], eax
mov dword [ebp - 0x6fe4], 0
lea ecx, [ebp - 0x27dc]
mov byte [eax + 0x19c], 0
call fcn.005d04b0
mov ecx, dword [ebp - 0x6f7c]
lea ecx, [ecx + 0x11c]
call fcn.005dc400
xor ecx, ecx
call fcn.005d3930
test eax, eax
je 0x51337e
push eax
call fcn.0041e1c3
add esp, 4
mov ecx, dword [ebp - 0x6f7c]
push 0
call fcn.0053a660
mov eax, dword [ebp - 0x6f7c]
push 1
mov eax, dword [eax + 8]
push dword [eax + 0x34]
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005b9910
mov eax, dword [ebp - 0x6f7c]
push 0
push str.Preparing_to_scan...
mov eax, dword [eax + 8]
push dword [eax + 0x38]
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005bcd30
push 0xc
lea ecx, [ebp - 0x1f8c]
call fcn.00401d40
lea ecx, [ebp - 0x1f8c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2154]
mov dword [ebp - 4], 0
call fcn.00401d40
lea ecx, [ebp - 0x2154]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2114]
mov byte [ebp - 4], 1
call fcn.00401d40
lea ecx, [ebp - 0x2114]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2874]
mov byte [ebp - 4], 2
call fcn.00401d40
lea ecx, [ebp - 0x2874]
call fcn.005dc5e0
mov byte [ebp - 4], 3
mov esi, 0xa0
mov eax, dword [ebp - 0x6f7c]
push 0
push 0
push 0x1009
mov eax, dword [eax + 8]
push dword [esi + eax]
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005befd0
add esi, 4
cmp esi, 0xb8
jb 0x513440
push 0
push 0
push 0x80
lea ecx, [ebp - 0x2114]
call fcn.005db9a0
push eax
push 0
push 0
push 0x104
lea ecx, [ebp - 0x2154]
call fcn.005db9a0
push 0
push 0
push 0x80
lea ecx, [ebp - 0x2874]
mov esi, eax
call fcn.005db9a0
mov edx, esi
mov ecx, eax
call fcn.0059cf00
mov edi, dword [ebp - 0x6f7c]
push 4
mov byte [ebp - 0x6f81], 1
mov dword [edi + 0x38], eax
mov eax, edi
mov eax, dword [eax + 8]
push dword [eax + 0x28]
mov eax, edi
mov ecx, dword [eax + 4]
call fcn.005bc500
mov dword [ebp - 0x6f78], eax
test eax, eax
je 0x513512
mov eax, edi
push 1
lea ecx, [eax + 0x114]
push ecx
lea edx, [eax + 0x10c]
lea ecx, [eax + 0x104]
call fcn.0059d390
test eax, eax
mov dword [edi + 0x30], eax
setne cl
test eax, eax
jne 0x513592
jmp 0x513518
mov cl, byte [ebp - 0x6f81]
mov eax, dword [ebp - 0x6f7c]
cmp dword [eax + 0x38], 0
je 0x51358a
lea ecx, [ebp - 0x2114]
mov dword [eax + 0x30], 1
push ecx
push 1
lea ecx, [eax + 0x104]
call fcn.00403af0
mov ecx, eax
call fcn.005dc4e0
mov ecx, dword [ebp - 0x6f7c]
lea eax, [ebp - 0x2154]
push eax
push 1
lea ecx, [ecx + 0x10c]
call fcn.00403af0
mov ecx, eax
call fcn.005dc4e0
mov ecx, dword [ebp - 0x6f7c]
lea eax, [ebp - 0x2874]
push eax
push 1
lea ecx, [ecx + 0x114]
call fcn.00403af0
mov ecx, eax
call fcn.005dc4e0
jmp 0x513592
test cl, cl
je 0x5138f8
push 8
lea ecx, [ebp - 0x288c]
call fcn.00401f90
mov eax, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x288c]
add eax, 0x114
push eax
mov dword [ebp - 0x6fcc], eax
call fcn.00403c50
push 8
lea ecx, [ebp - 0x2884]
mov byte [ebp - 4], 4
call fcn.00401f90
mov esi, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x2884]
add esi, 0x10c
push esi
mov dword [ebp - 0x6fb4], esi
call fcn.00403c50
push 8
lea ecx, [ebp - 0x287c]
mov byte [ebp - 4], 5
call fcn.00401f90
mov edi, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x287c]
add edi, 0x104
push edi
mov dword [ebp - 0x6f8c], edi
call fcn.00403c50
mov eax, dword [ebp - 0x6f7c]
mov ecx, edi
mov byte [ebp - 4], 6
mov eax, dword [eax + 0x30]
add eax, 2
push eax
call fcn.00403af0
mov edi, dword [ebp - 0x6f7c]
mov ecx, esi
mov eax, dword [edi + 0x30]
add eax, 2
push eax
call fcn.00403af0
mov eax, dword [edi + 0x30]
mov edi, dword [ebp - 0x6fcc]
add eax, 2
push eax
mov ecx, edi
call fcn.00403af0
mov eax, dword [ebp - 0x6f7c]
xor esi, esi
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x5136ef
nop dword [eax]
push esi
lea ecx, [ebp - 0x287c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc3e0
mov ecx, dword [ebp - 0x6f8c]
push eax
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc1c0
push esi
lea ecx, [ebp - 0x2884]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc3e0
mov ecx, dword [ebp - 0x6fb4]
push eax
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc1c0
push esi
lea ecx, [ebp - 0x288c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc3e0
push eax
push esi
mov ecx, edi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc1c0
mov eax, dword [ebp - 0x6f7c]
inc esi
mov ecx, dword [eax + 0x30]
cmp esi, ecx
jb 0x513670
push 0
push str.S_1_5_18
push 0x104
push ecx
lea ecx, [eax + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005db9a0
mov ecx, eax
call fcn.0059c550
mov eax, dword [ebp - 0x6f7c]
push str.S_1_5_18
push dword [eax + 0x30]
lea ecx, [eax + 0x104]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc510
mov edi, dword [ebp - 0x6f7c]
mov ecx, edi
push str.DefaultUser
mov eax, dword [edi + 0x30]
lea ecx, [ecx + 0x104]
inc eax
push eax
mov dword [edi + 0x30], eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc510
mov eax, edi
push str.DefaultUser
push dword [eax + 0x30]
lea ecx, [eax + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc510
lea eax, [ebp - 0x6db8]
mov dword [ebp - 0x6db8], 0x400
push eax
push 0
mov eax, edi
push 0
push 0x400
push dword [eax + 0x30]
lea ecx, [eax + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005db9a0
push eax
call dword [sym.imp.USERENV.dll_GetDefaultUserProfileDirectoryW]
mov edx, str.DefaultUser
mov ecx, SHDefExtractIconW
call fcn.005d4630
test al, al
jne 0x51385d
push 0xc
lea ecx, [ebp - 0x29dc]
call fcn.00401d40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, edi
push 0
push str.NTUSER.DAT
push dword [eax + 0x30]
lea ecx, [eax + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x29dc]
call fcn.005dc520
lea ecx, [ebp - 0x29dc]
mov byte [ebp - 4], 7
call fcn.005dc190
push eax
mov eax, edi
push dword [eax + 0x30]
lea ecx, [eax + 0x104]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push SHDefExtractIconW
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
jne 0x513850
mov eax, edi
mov eax, dword [eax + 0x30]
inc eax
mov dword [edi + 0x30], eax
lea ecx, [ebp - 0x29dc]
call fcn.005dc430
jmp 0x513866
mov eax, edi
mov eax, dword [eax + 0x30]
inc eax
mov dword [edi + 0x30], eax
lea ecx, [ebp - 0x287c]
call fcn.00403be0
lea ecx, [ebp - 0x2884]
call fcn.00403be0
lea ecx, [ebp - 0x288c]
mov byte [ebp - 4], 3
call fcn.00403be0
mov esi, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x27dc]
add esi, 0x140
call fcn.005d0510
push edx
push eax
mov ecx, esi
call fcn.005db3f0
mov ecx, dword [ebp - 0x6f7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Temp
lea ecx, [ecx + 0x134]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005da510
mov ecx, esi
call fcn.005dc190
or edx, 0xffffffff
mov ecx, eax
call fcn.005e0f30
test al, al
jne 0x513908
mov eax, dword [ebp - 0x6f7c]
push 1
mov ecx, eax
call fcn.0053a660
mov esi, eax
jmp 0x52df86
mov ecx, esi
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or eax, 2
mov ecx, esi
push eax
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0xc
lea ecx, [ebp - 0x226c]
call fcn.00401d40
lea ecx, [ebp - 0x226c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2160]
mov byte [ebp - 4], 8
call fcn.00401d40
lea ecx, [ebp - 0x2160]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2a00]
mov byte [ebp - 4], 9
call fcn.00401d40
lea ecx, [ebp - 0x2a00]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x25bc]
mov byte [ebp - 4], 0xa
call fcn.00401d40
lea ecx, [ebp - 0x25bc]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2978]
mov byte [ebp - 4], 0xb
call fcn.00401d40
lea ecx, [ebp - 0x2978]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x250c]
mov byte [ebp - 4], 0xc
call fcn.00401d40
lea ecx, [ebp - 0x250c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2720]
mov byte [ebp - 4], 0xd
call fcn.00401d40
lea ecx, [ebp - 0x2720]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2900]
mov byte [ebp - 4], 0xe
call fcn.00401d40
lea ecx, [ebp - 0x2900]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2930]
mov byte [ebp - 4], 0xf
call fcn.00401d40
lea ecx, [ebp - 0x2930]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x25b0]
mov byte [ebp - 4], 0x10
call fcn.00401d40
lea ecx, [ebp - 0x25b0]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2818]
mov byte [ebp - 4], 0x11
call fcn.00401d40
lea ecx, [ebp - 0x2818]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x293c]
mov byte [ebp - 4], 0x12
call fcn.00401d40
lea ecx, [ebp - 0x293c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2708]
mov byte [ebp - 4], 0x13
call fcn.00401d40
lea ecx, [ebp - 0x2708]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x26fc]
mov byte [ebp - 4], 0x14
call fcn.00401d40
lea ecx, [ebp - 0x26fc]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x26f0]
mov byte [ebp - 4], 0x15
call fcn.00401d40
lea ecx, [ebp - 0x26f0]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x280c]
mov byte [ebp - 4], 0x16
call fcn.00401d40
lea ecx, [ebp - 0x280c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2948]
mov byte [ebp - 4], 0x17
call fcn.00401d40
lea ecx, [ebp - 0x2948]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2954]
mov byte [ebp - 4], 0x18
call fcn.00401d40
lea ecx, [ebp - 0x2954]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2640]
mov byte [ebp - 4], 0x19
call fcn.00401d40
lea ecx, [ebp - 0x2640]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x264c]
mov byte [ebp - 4], 0x1a
call fcn.00401d40
lea ecx, [ebp - 0x264c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x296c]
mov byte [ebp - 4], 0x1b
call fcn.00401d40
lea ecx, [ebp - 0x296c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x25ec]
mov byte [ebp - 4], 0x1c
call fcn.00401d40
lea ecx, [ebp - 0x25ec]
call fcn.005dc5e0
mov byte [ebp - 4], 0x1d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.005e17c0
mov edi, eax
mov ecx, str.HKLM
test edi, edi
mov dword [ebp - 0x6fdc], edi
mov eax, str.HKLM64
setne byte [ebp - 0x6f81]
test edi, edi
push 1
cmove eax, ecx
mov ecx, 0x62439c
mov dword [ebp - 0x6fc4], eax
mov eax, str.HKLM32
cmove eax, ecx
lea ecx, [ebp - 0x226c]
mov dword [ebp - 0x6fe0], eax
mov eax, dword [ebp - 0x6f7c]
push dword [eax + 0x38]
push 0x1a
call fcn.005dbbc0
mov eax, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x2160]
push 1
push dword [eax + 0x38]
push 0x1c
call fcn.005dbbc0
mov eax, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x25bc]
push 1
push dword [eax + 0x38]
push 2
call fcn.005dbbc0
mov eax, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x250c]
push 1
push dword [eax + 0x38]
push 0x10
call fcn.005dbbc0
mov eax, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x26f0]
push 1
push dword [eax + 0x38]
push 0x23
call fcn.005dbbc0
mov eax, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x2900]
push 1
push dword [eax + 0x38]
push 7
call fcn.005dbbc0
mov eax, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x2930]
push 1
push dword [eax + 0x38]
push 5
call fcn.005dbbc0
push 0x400
push 0
push 0
push 0x400
lea ecx, [ebp - 0x2720]
call fcn.005db9a0
push eax
mov eax, dword [ebp - 0x6f7c]
push str._TEMP_
push dword [eax + 0x38]
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserW]
push 0x400
lea ecx, [ebp - 0x2720]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2720]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0x104
push 0
push 0
push 0x104
lea ecx, [ebp - 0x25b0]
call fcn.005db9a0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test edi, edi
je 0x513d5d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SysNative
lea ecx, [ebp - 0x25b0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2818]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6674a0
lea ecx, [ebp - 0x25b0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x293c]
call fcn.005dc200
jmp 0x513d8f
push 0x104
push 0
push 0
push 0x104
lea ecx, [ebp - 0x2818]
call fcn.005db9a0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x2818]
push eax
lea ecx, [ebp - 0x293c]
call fcn.005dc4e0
push edi
lea edx, [ebp - 0x26fc]
lea ecx, [ebp - 0x2708]
call fcn.005dddf0
push 0
push 0
push 0x2b
lea ecx, [ebp - 0x280c]
call fcn.005dbbc0
push 0
push 0
push 0x17
lea ecx, [ebp - 0x2640]
call fcn.005dbbc0
push 0
push 0
push 0x19
lea ecx, [ebp - 0x264c]
call fcn.005dbbc0
push 0
push 0
push 0x18
lea ecx, [ebp - 0x2948]
call fcn.005dbbc0
push 1
push 0
push 0x28
lea ecx, [ebp - 0x25ec]
call fcn.005dbbc0
lea ecx, [ebp - 0x25ec]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x226c]
call fcn.005dad50
lea ecx, [ebp - 0x25ec]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x2160]
call fcn.005dad50
push 1
push str.AppDataLocalLow
lea ecx, [ebp - 0x2a00]
call fcn.005dc260
lea ecx, [ebp - 0x25ec]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x25bc]
call fcn.005dad50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MicrosoftInternet_ExplorerQuick_Launch
lea ecx, [ebp - 0x226c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2978]
call fcn.005dc200
lea ecx, [ebp - 0x25ec]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x250c]
call fcn.005dad50
lea ecx, [ebp - 0x25ec]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x2720]
call fcn.005dad50
lea ecx, [ebp - 0x25ec]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x2900]
call fcn.005dad50
lea ecx, [ebp - 0x25ec]
call fcn.005dc3a0
push eax
lea ecx, [ebp - 0x2930]
call fcn.005dad50
push 2
push 1
lea ecx, [ebp - 0x25b0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x296c]
call fcn.005d9d20
push 1
lea ecx, [ebp - 0x280c]
call fcn.005dbf40
lea eax, [ebp - 0x280c]
push eax
lea ecx, [ebp - 0x2954]
call fcn.005dc4e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624284
lea ecx, [ebp - 0x2708]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x280c]
call fcn.005da510
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624284
lea ecx, [ebp - 0x26fc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2954]
call fcn.005da510
mov eax, dword [ebp - 0x6f7c]
cmp byte [eax + 0x40], 0
je 0x513f86
xor esi, esi
jmp 0x52de94
mov eax, dword [eax + 8]
push 3
push dword [eax + 0x34]
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005b9910
mov eax, dword [ebp - 0x6f7c]
push 0
push str.Updating_definitions...
mov eax, dword [eax + 8]
push dword [eax + 0x38]
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005bcd30
mov eax, dword [ebp - 0x6f7c]
cmp dword [eax + 0x10], 0
jne 0x513fd6
mov ecx, eax
call fcn.00510420
mov eax, dword [ebp - 0x6f7c]
cmp dword [eax + 0x10], 1
jne 0x514001
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, eax
call fcn.0050db30
test al, al
jne 0x514091
push 0x64
call esi
mov eax, dword [ebp - 0x6f7c]
cmp dword [eax + 0x10], 1
je 0x513fe2
mov eax, dword [eax + 8]
push 6
push dword [eax + 0x34]
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005b9910
mov eax, dword [ebp - 0x6f7c]
push 0
push str.Loading_definitions...
mov eax, dword [eax + 8]
push dword [eax + 0x38]
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005bcd30
mov esi, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x27dc]
add esi, 0x33c
call fcn.005d0510
push edx
push eax
mov ecx, esi
call fcn.005db3f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAK_DB
mov ecx, esi
call fcn.005da510
mov ecx, esi
call fcn.005dc190
mov ecx, dword [ebp - 0x6f7c]
push eax
call fcn.00510220
test eax, eax
jne 0x51409b
mov esi, 3
jmp 0x52de94
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.HKLM_
mov ecx, esi
call fcn.005da510
push 4
lea ecx, [ebp - 0x1f74]
call fcn.00401d80
lea ecx, [ebp - 0x1f74]
call fcn.005d6aa0
push 4
lea ecx, [ebp - 0x2570]
mov byte [ebp - 4], 0x1e
call fcn.00401d80
push 0
push 0x20019
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2570]
call fcn.005d6a80
push 0xc
lea ecx, [ebp - 0x6cec]
mov byte [ebp - 4], 0x1f
call fcn.00401d40
lea ecx, [ebp - 0x6cec]
call fcn.005d6ac0
push 0xc
lea ecx, [ebp - 0x2a18]
mov byte [ebp - 4], 0x20
call fcn.00401d40
lea ecx, [ebp - 0x2a18]
call fcn.005d6ac0
push 0x10
lea ecx, [ebp - 0x2a64]
mov byte [ebp - 4], 0x21
call fcn.00401e10
lea ecx, [ebp - 0x2a64]
call fcn.005d6b10
push 0xc
lea ecx, [ebp - 0x2780]
mov byte [ebp - 4], 0x22
call fcn.00401d40
lea ecx, [ebp - 0x2780]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2960]
mov byte [ebp - 4], 0x23
call fcn.00401d40
lea ecx, [ebp - 0x2960]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x1f80]
mov byte [ebp - 4], 0x24
call fcn.00401d40
lea ecx, [ebp - 0x1f80]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x25e0]
mov byte [ebp - 4], 0x25
call fcn.00401d40
lea ecx, [ebp - 0x25e0]
call fcn.005dc5e0
lea ecx, [ebp - 0x27dc]
mov byte [ebp - 4], 0x26
call fcn.005d0510
mov ecx, edx
mov dword [ebp - 0x7038], eax
push ecx
mov dword [ebp - 0x702c], ecx
lea ecx, [ebp - 0x2960]
push eax
call fcn.005db3f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6674ec
lea ecx, [ebp - 0x2960]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f7c]
push eax
push str.uakScan
lea ecx, [ecx + 0x134]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f7c]
push eax
lea ecx, [ecx + 0x11c]
call fcn.005dc200
push 0x20
lea ecx, [ebp - 0x1fc8]
call fcn.00401e40
lea ecx, [ebp - 0x1fc8]
call fcn.005e47e0
mov ecx, dword [ebp - 0x6f7c]
push 0
push 0x22
mov byte [ebp - 4], 0x27
lea ecx, [ecx + 0x11c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e4120
test eax, eax
je 0x514487
push 0
mov esi, dword [ebp - 0x6f7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.scan_report__r_n_r_n
push 0
push 1
push 1
push 0
add esi, 0x354
push str.threat
mov ecx, esi
call fcn.005daa70
test eax, eax
mov edx, str.s_threat
mov ecx, 0x66ca88
cmove ecx, edx
push ecx
mov ecx, esi
call fcn.005dc190
push eax
push 0x66754c
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push str.bits_._r_n
push 0x627dcc
push 0x62d7ec
push str.10.9.4.0
push str._version:
mov ecx, esi
call fcn.005dc190
push eax
push 0x629bbc
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x25e0]
push 0
push dword [eax + 0xc]
call fcn.005db3f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x25e0]
call fcn.005dc190
push eax
push str._definitions_database_number:
mov ecx, esi
call fcn.005dc190
push eax
push 0x629bbc
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push edi
mov ecx, dword [ebp - 0x6f7c]
lea eax, [ebp - 0x1f80]
push eax
call fcn.00512030
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
cmp dword [ebp - 0x6f78], 0
mov ecx, str.Unchecked
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
mov eax, str.Checked
cmove eax, ecx
lea ecx, [ebp - 0x2874]
push eax
push str._tOption__Scan_all_users_:
push 0x667ad8
call fcn.005dc190
push eax
push str._r_n_tScan_started_by_user:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea edx, [ebp - 0x1f80]
lea ecx, [ebp - 0x27dc]
call fcn.005d0520
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.._r_n_r_n
lea ecx, [ebp - 0x1f80]
call fcn.005dc190
push eax
push str._tScan_start_time:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push str.Note:_Registry_paths_may_contain_prefixes_for_easier_identification_of_the_corresponding_registry_key:_r_n_r_n_tHKLM32:_The_32_bit_portion_of_the_HKEY_LOCAL_MACHINE_key__in_64_bit_Windows_versions._r_n_tHKLM64:_The_64_bit_portion_of_the_HKEY_LOCAL_MACHINE_key__in_64_bit_Windows_versions._r_n_t__User_name_:_A_users_registry_key__HKEY_USERS_User_sid__._r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
lea ecx, [ebp - 0x296c]
call fcn.005dc190
lea ecx, [ebp - 0x25b0]
mov dword [ebp - 0x6fd8], eax
call fcn.005dc190
lea ecx, [ebp - 0x2818]
mov dword [ebp - 0x6fd4], eax
call fcn.005dc190
mov dword [ebp - 0x6fd0], eax
mov al, byte [ebp - 0x6f81]
mov byte [ebp - 0x6fcc], al
mov eax, dword [ebp - 0x6f7c]
movups xmm0, xmmword [ebp - 0x6fd8]
lea ecx, [eax + 0x2f8]
movups xmmword [eax + 0x1a8], xmm0
call fcn.0050b370
mov esi, dword [ebp - 0x6f7c]
add esi, 0x248
mov ecx, esi
call fcn.005ad750
mov ecx, dword [ebp - 0x6f7c]
push 0
lea ecx, [ecx + 0x230]
call fcn.005ae7a0
push str.HKLM64SOFTWARECarifredVirusTotal_reports
mov ecx, esi
call fcn.005ae3f0
push 1
mov ecx, esi
call fcn.005ac9a0
mov eax, dword [ebp - 0x6f7c]
xor ecx, ecx
test edi, edi
push 4
setne cl
inc ecx
add ecx, dword [eax + 0x30]
mov dword [ebp - 0x6fac], ecx
lea ecx, [ebp - 0x6d4c]
call fcn.00401d80
push 8
push str._HKUHKEY_USERS__S_1_5.___
lea ecx, [ebp - 0x6d4c]
call fcn.00401400
push 8
lea ecx, [ebp - 0x6dfc]
mov byte [ebp - 4], 0x28
call fcn.00401f90
mov edi, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x6dfc]
mov eax, dword [edi + 0x30]
add eax, 2
push eax
call fcn.00403c80
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x2984]
mov edi, dword [ebp - 0x6dfc]
push 0xc
mov dword [ebp - 0x6fa8], edi
call fcn.00401d40
push 1
push 0x62794c
lea ecx, [ebp - 0x2984]
call fcn.005dc570
mov eax, dword [ebp - 0x6f7c]
xor esi, esi
mov byte [ebp - 4], 0x2a
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x514604
add eax, 0x114
mov dword [ebp - 0x6fcc], eax
nop dword [eax]
push esi
mov ecx, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005dc510
mov eax, dword [ebp - 0x6f7c]
inc esi
add edi, 0xc
mov ecx, dword [eax + 0x30]
mov eax, dword [ebp - 0x6fcc]
cmp esi, ecx
jb 0x5145d0
mov edi, dword [ebp - 0x6fa8]
lea eax, [ecx + ecx*2]
push str._All_users_
lea ecx, [edi + eax*4]
call fcn.005dc510
cmp dword [ebp - 0x6fdc], 0
je 0x514637
mov eax, dword [ebp - 0x6f7c]
push str._All_users_
mov eax, dword [eax + 0x30]
inc eax
lea eax, [eax + eax*2]
lea ecx, [edi + eax*4]
call fcn.005dc510
push 4
lea ecx, [ebp - 0x2574]
call fcn.00401d80
lea ecx, [ebp - 0x2574]
call fcn.005b0be0
push 0x38
lea ecx, [ebp - 0x21e0]
mov byte [ebp - 4], 0x2b
call fcn.00401e60
lea ecx, [ebp - 0x21e0]
call fcn.005dd740
mov ecx, dword [ebp - 0x6f7c]
mov byte [ebp - 4], 0x2c
call fcn.0050db30
test al, al
jne 0x51709b
mov eax, dword [ebp - 0x6f7c]
test dword [eax + 0x34], 0x400
jne 0x51709b
push 0
push str._r_n_r_n__Programs_scan:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [ebp - 0x6f7c]
push 0
push str.Scanning_programs...
mov eax, dword [eax + 8]
push dword [eax + 0x38]
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005bcd30
push 8
lea ecx, [ebp - 0x6d54]
call fcn.00401f90
push dword [ebp - 0x6fac]
lea ecx, [ebp - 0x6d54]
call fcn.00403c80
mov eax, dword [ebp - 0x6f7c]
xor esi, esi
mov byte [ebp - 4], 0x2d
mov edi, dword [ebp - 0x6d54]
mov dword [ebp - 0x6fa0], edi
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x514760
add eax, 0x104
mov dword [ebp - 0x6fcc], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push esi
mov ecx, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str.HKU_
mov ecx, edi
call fcn.005dc200
mov eax, dword [ebp - 0x6f7c]
inc esi
add edi, 0xc
mov ecx, dword [eax + 0x30]
mov eax, dword [ebp - 0x6fcc]
cmp esi, ecx
jb 0x514710
mov edi, dword [ebp - 0x6fa0]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push dword [ebp - 0x6fc4]
lea eax, [ecx + ecx*2]
lea ecx, [edi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x5147c7
mov eax, dword [ebp - 0x6f7c]
push 0
push 0
push 0
mov eax, dword [eax + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [edi + eax*4]
call fcn.005dc200
push 4
lea ecx, [ebp - 0x2230]
call fcn.00401d80
lea ecx, [ebp - 0x2230]
call fcn.005d6aa0
push 4
lea ecx, [ebp - 0x1fe8]
mov byte [ebp - 4], 0x2e
call fcn.00401d80
lea ecx, [ebp - 0x1fe8]
call fcn.005d6aa0
push 0xc
lea ecx, [ebp - 0x23d0]
mov byte [ebp - 4], 0x2f
call fcn.00401d40
lea ecx, [ebp - 0x23d0]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2120]
mov byte [ebp - 4], 0x30
call fcn.00401d40
lea ecx, [ebp - 0x2120]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x1f98]
mov byte [ebp - 4], 0x31
call fcn.00401d40
lea ecx, [ebp - 0x1f98]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2068]
mov byte [ebp - 4], 0x32
call fcn.00401d40
lea ecx, [ebp - 0x2068]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x23dc]
mov byte [ebp - 4], 0x33
call fcn.00401d40
lea ecx, [ebp - 0x23dc]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x22dc]
mov byte [ebp - 4], 0x34
call fcn.00401d40
lea ecx, [ebp - 0x22dc]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2148]
mov byte [ebp - 4], 0x35
call fcn.00401d40
lea ecx, [ebp - 0x2148]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2108]
mov byte [ebp - 4], 0x36
call fcn.00401d40
lea ecx, [ebp - 0x2108]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x231c]
mov byte [ebp - 4], 0x37
call fcn.00401d40
lea ecx, [ebp - 0x231c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x28e8]
mov byte [ebp - 4], 0x38
call fcn.00401d40
lea ecx, [ebp - 0x28e8]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x27a4]
mov byte [ebp - 4], 0x39
call fcn.00401d40
lea ecx, [ebp - 0x27a4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x28dc]
mov byte [ebp - 4], 0x3a
call fcn.00401d40
lea ecx, [ebp - 0x28dc]
call fcn.005dc5e0
mov ecx, dword [ebp - 0x6f7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov byte [ebp - 4], 0x3b
lea ecx, [ecx + 0x140]
push str.Programs
mov dword [ebp - 0x2350], 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2780]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x2780]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e0]
call fcn.005dd360
push 1
lea ecx, [ebp - 0x21e0]
call fcn.005dd5c0
mov esi, dword [ebp - 0x2364]
xor edi, edi
mov dword [ebp - 0x6f9c], edi
mov dword [ebp - 0x6fa4], esi
cmp dword [ebp - 0x6fac], edi
jbe 0x515b35
mov eax, dword [ebp - 0x6f7c]
lea ecx, [eax + 0x33c]
mov dword [ebp - 0x6f8c], ecx
lea ecx, [eax + 0x10c]
mov dword [ebp - 0x6f78], ecx
jmp 0x514a06
mov eax, dword [ebp - 0x6f7c]
mov ecx, eax
call fcn.0050db30
test al, al
jne 0x515b35
movd xmm1, edi
mov eax, edi
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x6ede90]
mov eax, dword [ebp - 0x6fac]
mulsd xmm1, qword [0x6edb08]
movd xmm0, eax
shr eax, 0x1f
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x6ede90]
divsd xmm1, xmm0
addsd xmm1, qword [0x6edab8]
cvttsd2si eax, xmm1
push eax
mov eax, dword [ebp - 0x6f7c]
mov eax, dword [eax + 8]
push dword [eax + 0x34]
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005b9910
lea eax, [edi + edi*2]
shl eax, 2
mov dword [ebp - 0x6fb4], eax
add eax, dword [ebp - 0x6fa0]
push 0
push 0x20019
mov ecx, eax
mov dword [ebp - 0x6fcc], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2230]
call fcn.005d6a30
test al, al
je 0x515b22
mov ecx, dword [ebp - 0x6f7c]
xor esi, esi
mov dword [ebp - 0x6fa4], esi
call fcn.0050db30
test al, al
jne 0x515b22
nop dword [eax]
lea eax, [ebp - 0x6cec]
push eax
push esi
lea ecx, [ebp - 0x2230]
call fcn.005d6380
test al, al
je 0x515b1c
mov ecx, dword [ebp - 0x6fcc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x23d0]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x23d0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fe8]
call fcn.005d6a30
test al, al
je 0x515b08
lea eax, [ebp - 0x2120]
push eax
push str.DisplayName
lea ecx, [ebp - 0x1fe8]
call fcn.005d6740
test al, al
je 0x515b08
lea eax, [ebp - 0x6d04]
push eax
push str.SystemComponent
lea ecx, [ebp - 0x1fe8]
call fcn.005d66b0
test al, al
je 0x514b8c
cmp dword [ebp - 0x6d04], 1
je 0x515b08
lea eax, [ebp - 0x23dc]
push eax
push str.ParentKeyName
lea ecx, [ebp - 0x1fe8]
call fcn.005d6740
test al, al
je 0x514bba
lea ecx, [ebp - 0x23dc]
call fcn.005dc3a0
test eax, eax
jne 0x515b08
lea eax, [ebp - 0x23dc]
push eax
push str.ReleaseType
lea ecx, [ebp - 0x1fe8]
call fcn.005d6740
test al, al
je 0x514c35
push 0x66cfb0
lea ecx, [ebp - 0x23dc]
call fcn.005dc4c0
test al, al
jne 0x515b08
push str.Hotfix
lea ecx, [ebp - 0x23dc]
call fcn.005dc4c0
test al, al
jne 0x515b08
push str._HOTFIX_
lea ecx, [ebp - 0x23dc]
call fcn.005dc4c0
test al, al
jne 0x515b08
push str.Security_update
lea ecx, [ebp - 0x23dc]
call fcn.005dc4c0
test al, al
jne 0x515b08
lea eax, [ebp - 0x1f98]
push eax
push str.InstallLocation
lea ecx, [ebp - 0x1fe8]
call fcn.005d6740
lea eax, [ebp - 0x22dc]
push eax
push str.UninstallString
lea ecx, [ebp - 0x1fe8]
call fcn.005d6740
test al, al
jne 0x514c7a
lea ecx, [ebp - 0x1f98]
call fcn.005dc3a0
test eax, eax
je 0x515b08
lea eax, [ebp - 0x2148]
push eax
push str.Publisher
lea ecx, [ebp - 0x1fe8]
call fcn.005d6740
test al, al
je 0x514ca4
lea ecx, [ebp - 0x2148]
call fcn.005dc3a0
test eax, eax
jne 0x514cb4
push str._Not_set_
lea ecx, [ebp - 0x2148]
call fcn.005dc510
lea eax, [ebp - 0x2120]
push eax
lea ecx, [ebp - 0x2108]
call fcn.005dc4e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627904
lea ecx, [ebp - 0x2108]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.Adware_
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
mov byte [ebp - 0x6f81], al
test al, al
jne 0x514e15
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2108]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.Adware_
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
mov byte [ebp - 0x6f81], al
test al, al
jne 0x514e15
push 0
push 1
push 0xffffffffffffffff
push 1
push 0x62438c
lea ecx, [ebp - 0x2108]
call fcn.005daa70
cmp eax, 4
jl 0x514f22
dec eax
lea ecx, [ebp - 0x2108]
push eax
call fcn.005dae00
cmp byte [eax + 8], 0
je 0x514f15
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2108]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.Adware_
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
mov byte [ebp - 0x6f81], al
test al, al
je 0x514d81
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62794c
lea ecx, [ebp - 0x2108]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2984]
call fcn.005da780
cmp byte [ebp - 0x6f81], 0
jne 0x514eaa
lea eax, [ebp - 0x2350]
push eax
lea eax, [ebp - 0x27a4]
push eax
lea ecx, [ebp - 0x23d0]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f7c]
push eax
call fcn.0050fb50
test al, al
je 0x515b08
push 0
lea ecx, [ebp - 0x23d0]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f7c]
push eax
lea eax, [ebp - 0x27a4]
push eax
call fcn.00511450
test al, al
je 0x515b08
mov byte [ebp - 0x6f81], 2
push 0
push 0x62e530
lea ecx, [ebp - 0x2120]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f7c]
push eax
call fcn.00511ee0
test al, al
jne 0x515b08
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x514fc4
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dbc20
push 0
push 0
push 0x62439c
push 0x624388
lea ecx, [ebp - 0x1f98]
call fcn.005da270
jmp 0x51559d
cmp byte [ebp - 0x6f81], 0
jne 0x514e15
lea ecx, [ebp - 0x2108]
call fcn.005dc400
lea ecx, [ebp - 0x2120]
call fcn.005dc3a0
push 0
push 1
push 1
push 0
push str._Toolbar
lea ecx, [ebp - 0x2120]
call fcn.005daa70
test eax, eax
jne 0x514fa6
push eax
push 1
push 1
push eax
push str._Chrome_Extension
lea ecx, [ebp - 0x2120]
call fcn.005daa70
test eax, eax
jne 0x514fa6
push eax
push 1
push 1
push eax
push str._Firefox_Plugin
lea ecx, [ebp - 0x2120]
call fcn.005daa70
test eax, eax
jne 0x514fa6
push eax
push 1
push 1
push eax
push str._Firefox_Extension
lea ecx, [ebp - 0x2120]
call fcn.005daa70
test eax, eax
je 0x514e4e
lea eax, [ebp - 0x2120]
mov byte [ebp - 0x6f81], 2
push eax
lea ecx, [ebp - 0x2108]
call fcn.005dc4e0
jmp 0x514eaa
cmp dword [ebp - 0x2350], 0
je 0x515086
lea eax, [ebp - 0x6d04]
mov dword [ebp - 0x6d04], 0x400
push eax
push 0
push 0
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
push eax
push str.InstallLocation
push dword [ebp - 0x6cec]
call dword [sym.imp.msi.dll_MsiGetPropertyW]
push 0
push 1
push 1
push 0
push 0x624518
lea ecx, [ebp - 0x1f98]
call fcn.005daa70
test eax, eax
jne 0x515086
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.InstallProperties
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x23dc]
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Products_
push dword [ebp - 0x6fc4]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x23dc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x515086
lea eax, [ebp - 0x1f98]
push eax
push str.InstallLocation
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
lea ecx, [ebp - 0x1f98]
call fcn.005dc3a0
cmp eax, 0xa
jle 0x5150a3
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dbc20
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x51559d
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x624384
lea ecx, [ebp - 0x2120]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x2708]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
test al, al
jne 0x51559d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624384
lea ecx, [ebp - 0x2120]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x26fc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
test al, al
jne 0x51559d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624384
lea ecx, [ebp - 0x2120]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x26f0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
test al, al
jne 0x51559d
lea ecx, [ebp - 0x2148]
call fcn.005dc3a0
cmp eax, 4
jle 0x5152b3
push 0
push 1
push 1
push 0
push 0x66d19c
lea ecx, [ebp - 0x2148]
call fcn.005daa70
cmp eax, 1
je 0x5152b3
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624384
lea ecx, [ebp - 0x2120]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x2148]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x26f0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
test al, al
jne 0x51559d
mov eax, dword [ebp - 0x6f7c]
cmp edi, dword [eax + 0x30]
jae 0x515515
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624384
lea ecx, [ebp - 0x2120]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x226c]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push edi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
test al, al
jne 0x51559d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624384
lea ecx, [ebp - 0x2120]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x2160]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push edi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
test al, al
jne 0x51559d
lea ecx, [ebp - 0x2148]
call fcn.005dc3a0
cmp eax, 4
jle 0x515515
push 0
push 1
push 1
push 0
push 0x66d19c
lea ecx, [ebp - 0x2148]
call fcn.005daa70
cmp eax, 1
je 0x515515
push 0
push 0
push 0
push 0
push 0
push 0x624384
lea ecx, [ebp - 0x2120]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x2148]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x226c]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push edi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
test al, al
jne 0x51559d
push 0
push 0
push 0
push 0
push 0
push 0x624384
lea ecx, [ebp - 0x2120]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x2148]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x2160]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push edi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
test al, al
jne 0x51559d
lea ecx, [ebp - 0x22dc]
call fcn.005dc3a0
lea ecx, [ebp - 0x1f98]
cmp eax, 0xa
jle 0x515598
lea eax, [ebp - 0x22dc]
push eax
call fcn.005dc4e0
push 0
push 0
push 0x62439c
push 0x624388
lea ecx, [ebp - 0x1f98]
call fcn.005da270
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dbc20
push 0
push 1
push 0xffffffffffffffff
push 1
push 0x624518
lea ecx, [ebp - 0x1f98]
call fcn.005daa70
cmp eax, 2
jle 0x515589
add eax, 0xfffffffe
lea ecx, [ebp - 0x1f98]
push eax
call fcn.005dad50
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dbed0
jmp 0x51559d
call fcn.005dc400
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
mov ecx, eax
call fcn.005e71d0
test al, al
je 0x5155be
lea ecx, [ebp - 0x1f98]
call fcn.005dc400
lea eax, [ebp - 0x2068]
mov dword [ebp - 0x6fa4], 0
push eax
push str.DisplayIcon
lea ecx, [ebp - 0x1fe8]
call fcn.005d6740
test al, al
je 0x51561b
push 0
lea ecx, [ebp - 0x2068]
call fcn.005dc190
push eax
push 0x104
lea ecx, [ebp - 0x2068]
call fcn.005db9a0
lea ecx, [ebp - 0x2068]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathParseIconLocationW]
mov dword [ebp - 0x6fa4], eax
jmp 0x515671
cmp dword [ebp - 0x2350], 0
je 0x51567e
lea eax, [ebp - 0x6d64]
mov dword [ebp - 0x6d64], 0x400
push eax
push 0
push 0
push 0x400
lea ecx, [ebp - 0x2068]
call fcn.005db9a0
push eax
push str.ProductIcon
push dword [ebp - 0x6cec]
call dword [sym.imp.msi.dll_MsiGetPropertyW]
push dword [ebp - 0x6d64]
lea ecx, [ebp - 0x2068]
call fcn.005dc440
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp - 0x2350], 0
jne 0x5157c8
lea ecx, [ebp - 0x2068]
call fcn.005dc3a0
test eax, eax
jne 0x5157c8
push eax
lea ecx, [ebp - 0x22dc]
call fcn.005dc190
push eax
push 0x800
lea ecx, [ebp - 0x2068]
call fcn.005db9a0
push 0x800
lea ecx, [ebp - 0x2068]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x22dc]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x2068]
call fcn.005dc3a0
test eax, eax
je 0x5157c8
push 0
push 1
push 0xffffffffffffffff
push 0
push 0x6243cc
lea ecx, [ebp - 0x2068]
call fcn.005daa70
test eax, eax
je 0x51570f
add eax, 3
lea ecx, [ebp - 0x2068]
push eax
call fcn.005dae00
lea ecx, [ebp - 0x2068]
call fcn.005dc190
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
jne 0x5157c8
push eax
push 1
push 0xffffffffffffffff
push 1
push 0x624518
lea ecx, [ebp - 0x2068]
call fcn.005daa70
cmp eax, 2
jle 0x515756
add eax, 0xfffffffe
lea ecx, [ebp - 0x2068]
push eax
call fcn.005dad50
lea ecx, [ebp - 0x2068]
call fcn.005dc190
push eax
call edi
test eax, eax
jne 0x5157c8
push eax
push 1
push 0xffffffffffffffff
push 1
push 0x624388
lea ecx, [ebp - 0x2068]
call fcn.005daa70
test eax, eax
je 0x51578f
push eax
lea ecx, [ebp - 0x2068]
call fcn.005dad50
lea ecx, [ebp - 0x2068]
call fcn.005dc190
push eax
call edi
test eax, eax
jne 0x5157c8
push eax
push 1
push 0xffffffffffffffff
push 1
push 0x62438c
lea ecx, [ebp - 0x2068]
call fcn.005daa70
test eax, eax
je 0x5157c8
push eax
lea ecx, [ebp - 0x2068]
call fcn.005dad50
push 0x5c
lea ecx, [ebp - 0x1f98]
call fcn.005da0a0
mov eax, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x2120]
push 0
mov eax, dword [eax + 8]
push dword [eax + 0xa0]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
call fcn.005dc190
push eax
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005bbb80
mov edi, eax
cmp edi, 0xffffffff
je 0x515b02
push 1
lea ecx, [ebp - 0x2148]
call fcn.005dc190
push eax
mov eax, dword [ebp - 0x6f7c]
push edi
mov ecx, dword [eax + 8]
push dword [ecx + 0xa0]
mov ecx, dword [eax + 4]
call fcn.005ba4f0
lea ecx, [ebp - 0x2068]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x515883
push 0
push 0x10
push dword [ebp - 0x6fa4]
lea ecx, [ebp - 0x2068]
call fcn.005dc190
push eax
mov eax, dword [ebp - 0x6f7c]
push edi
mov eax, dword [eax + 8]
push dword [eax + 0xa0]
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005baf80
mov ecx, dword [ebp - 0x6fa8]
add ecx, dword [ebp - 0x6fb4]
push 2
call fcn.005dc190
push eax
mov eax, dword [ebp - 0x6f7c]
push edi
mov eax, dword [eax + 8]
push dword [eax + 0xa0]
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005ba4f0
mov eax, dword [ebp - 0x6f7c]
push edi
push edi
mov eax, dword [eax + 8]
push dword [eax + 0xa0]
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005bb160
lea ecx, [ebp - 0x2108]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f7c]
push eax
mov eax, dword [ebp - 0x6f7c]
push edi
mov eax, dword [eax + 8]
push dword [eax + 0xa0]
call fcn.00512640
test eax, eax
jne 0x51591b
cmp byte [ebp - 0x6f81], 1
mov ecx, 2
movzx eax, byte [ebp - 0x6f81]
cmove eax, ecx
mov byte [ebp - 0x6f81], al
push edi
lea ecx, [ebp - 0x231c]
call fcn.005db320
lea ecx, [ebp - 0x23d0]
call fcn.005dc190
push eax
push str.Registry_Key
lea ecx, [ebp - 0x231c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e0]
call fcn.005dd0c0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push str.Path
lea ecx, [ebp - 0x231c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e0]
call fcn.005dd0c0
lea ecx, [ebp - 0x2108]
call fcn.005dc3a0
test eax, eax
je 0x5159cf
lea ecx, [ebp - 0x2108]
call fcn.005dc190
push eax
push str.DBName
lea ecx, [ebp - 0x231c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e0]
call fcn.005dd0c0
push 0x62a118
lea ecx, [ebp - 0x2108]
call fcn.005dc190
push eax
push str._UAK_PRODUCTS_FOUND_
lea ecx, [ebp - 0x21e0]
call fcn.005dd0c0
lea ecx, [ebp - 0x22dc]
call fcn.005dc3a0
test eax, eax
je 0x515a06
lea ecx, [ebp - 0x22dc]
call fcn.005dc190
push eax
push str.Uninstall_String
lea ecx, [ebp - 0x231c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e0]
call fcn.005dd0c0
mov ecx, dword [ebp - 0x6fa8]
add ecx, dword [ebp - 0x6fb4]
call fcn.005dc190
push eax
push str.User_name
lea ecx, [ebp - 0x231c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e0]
call fcn.005dd0c0
cmp dword [ebp - 0x2350], 0
je 0x515a5f
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x231c]
push str.MSI_Product
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e0]
call fcn.005dd0c0
mov eax, dword [ebp - 0x6f7c]
mov ecx, str.Unchecked_r_n
mov edi, dword [ebp - 0x6f7c]
push 0
push 0
inc dword [eax + 0x24]
xor eax, eax
cmp byte [ebp - 0x6f81], 1
sete al
add dword [edi + 0x28], eax
mov eax, str.Checked_r_n
cmp byte [ebp - 0x6f81], 1
cmovne eax, ecx
mov ecx, dword [ebp - 0x6fa8]
add ecx, dword [ebp - 0x6fb4]
push eax
push str._r_n_t_tItem_state:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name_:
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push str._r_n_t_tFolder_path:
lea ecx, [ebp - 0x23d0]
call fcn.005dc190
push eax
push str._r_n_t_tUninstall_key:
lea ecx, [ebp - 0x2120]
call fcn.005dc190
push eax
push str._r_n_tDetected_program:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov edi, dword [ebp - 0x6f9c]
mov ecx, dword [ebp - 0x6f7c]
inc esi
call fcn.0050db30
test al, al
je 0x514ad0
mov dword [ebp - 0x6fa4], esi
inc edi
mov dword [ebp - 0x6f9c], edi
cmp edi, dword [ebp - 0x6fac]
jb 0x514a00
mov ecx, dword [ebp - 0x6f7c]
call fcn.0050db30
test al, al
je 0x515bf6
lea ecx, [ebp - 0x28dc]
call fcn.005dc430
lea ecx, [ebp - 0x27a4]
call fcn.005dc430
lea ecx, [ebp - 0x28e8]
call fcn.005dc430
lea ecx, [ebp - 0x231c]
call fcn.005dc430
lea ecx, [ebp - 0x2108]
call fcn.005dc430
lea ecx, [ebp - 0x2148]
call fcn.005dc430
lea ecx, [ebp - 0x22dc]
call fcn.005dc430
lea ecx, [ebp - 0x23dc]
call fcn.005dc430
lea ecx, [ebp - 0x2068]
call fcn.005dc430
lea ecx, [ebp - 0x1f98]
call fcn.005dc430
lea ecx, [ebp - 0x2120]
call fcn.005dc430
lea ecx, [ebp - 0x23d0]
call fcn.005dc430
lea ecx, [ebp - 0x1fe8]
call fcn.005d69e0
lea ecx, [ebp - 0x2230]
call fcn.005d69e0
lea ecx, [ebp - 0x6d54]
mov byte [ebp - 4], 0x2c
call fcn.00403be0
jmp 0x5170a7
mov eax, dword [ebp - 0x6f7c]
cmp dword [eax + 0x230], 0
je 0x515c24
mov ecx, dword [ebp - 0x6f7c]
add eax, 0x230
push 0
push eax
lea ecx, [ecx + 0x248]
call fcn.005abdd0
mov eax, dword [ebp - 0x6f7c]
mov ecx, eax
call fcn.0050db30
test al, al
jne 0x515b48
push 0xc
lea ecx, [ebp - 0x2a0c]
call fcn.00401d40
lea ecx, [ebp - 0x2a0c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2714]
mov byte [ebp - 4], 0x3c
call fcn.00401d40
lea ecx, [ebp - 0x2714]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x26e4]
mov byte [ebp - 4], 0x3d
call fcn.00401d40
lea ecx, [ebp - 0x26e4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x27e8]
mov byte [ebp - 4], 0x3e
call fcn.00401d40
lea ecx, [ebp - 0x27e8]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2798]
mov byte [ebp - 4], 0x3f
call fcn.00401d40
lea ecx, [ebp - 0x2798]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x278c]
mov byte [ebp - 4], 0x40
call fcn.00401d40
lea ecx, [ebp - 0x278c]
call fcn.005dc5e0
mov eax, dword [ebp - 0x6f7c]
mov edi, 1
mov byte [ebp - 4], 0x41
lea ecx, [eax + 0x334]
mov dword [ebp - 0x6f8c], edi
mov dword [ebp - 0x6fcc], ecx
cmp dword [ecx], edi
jbe 0x516a1a
mov esi, dword [ebp - 0x6fcc]
lea ecx, [eax + 0x33c]
mov dword [ebp - 0x6fb4], ecx
mov ecx, eax
call fcn.0050db30
test al, al
jne 0x516a0e
lea eax, [edi + edi*4]
xor edx, edx
add eax, eax
div dword [esi]
add eax, 0x10
movd xmm0, eax
shr eax, 0x1f
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x6ede90]
cvttsd2si eax, xmm0
push eax
mov eax, dword [ebp - 0x6f7c]
mov eax, dword [eax + 8]
push dword [eax + 0x34]
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005b9910
mov ecx, dword [ebp - 0x6f7c]
push edi
call fcn.00511240
test al, al
je 0x5169f9
mov ecx, dword [ebp - 0x6f7c]
push edi
lea ecx, [ecx + 0x310]
call fcn.00404410
push eax
lea ecx, [ebp - 0x23d0]
call fcn.005dc4e0
push 0
push 0x20019
lea ecx, [ebp - 0x23d0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fe8]
call fcn.005d6a30
test al, al
je 0x5169f9
lea eax, [ebp - 0x2120]
push eax
push str.DisplayName
lea ecx, [ebp - 0x1fe8]
call fcn.005d6740
test al, al
je 0x5169f9
lea eax, [ebp - 0x1f98]
push eax
push str.InstallLocation
lea ecx, [ebp - 0x1fe8]
call fcn.005d6740
lea eax, [ebp - 0x22dc]
push eax
push str.UninstallString
lea ecx, [ebp - 0x1fe8]
call fcn.005d6740
test al, al
jne 0x515e1c
lea ecx, [ebp - 0x1f98]
call fcn.005dc3a0
test eax, eax
je 0x5169f9
lea eax, [ebp - 0x2148]
push eax
push str.Publisher
lea ecx, [ebp - 0x1fe8]
call fcn.005d6740
test al, al
je 0x515e46
lea ecx, [ebp - 0x2148]
call fcn.005dc3a0
test eax, eax
jne 0x515e56
push str._Not_set_
lea ecx, [ebp - 0x2148]
call fcn.005dc510
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x637f9c
lea ecx, [ebp - 0x2120]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2798]
call fcn.005da780
push 0
push 1
push 1
push 0
push str.msiexec
lea ecx, [ebp - 0x22dc]
call fcn.005daa70
test eax, eax
setne byte [ebp - 0x6f78]
test eax, eax
jne 0x515ee4
lea eax, [ebp - 0x6d04]
push eax
push str.WindowsInstaller
lea ecx, [ebp - 0x1fe8]
call fcn.005d66b0
test al, al
je 0x515ee4
mov eax, dword [ebp - 0x6f78]
mov ecx, 1
cmp dword [ebp - 0x6d04], 1
movzx eax, al
cmove eax, ecx
mov dword [ebp - 0x6f78], eax
lea eax, [ebp - 0x2120]
push eax
lea ecx, [ebp - 0x2108]
call fcn.005dc4e0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x515f37
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dbc20
push 0
push 0
push 0x62439c
push 0x624388
lea ecx, [ebp - 0x1f98]
call fcn.005da270
jmp 0x516563
cmp byte [ebp - 0x6f78], 0
je 0x515ff9
lea eax, [ebp - 0x6d04]
mov dword [ebp - 0x6d04], 0x400
push eax
push 0
push 0
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
push eax
push str.InstallLocation
push dword [ebp - 0x6cec]
call dword [sym.imp.msi.dll_MsiGetPropertyW]
push 0
push 1
push 1
push 0
push 0x624518
lea ecx, [ebp - 0x1f98]
call fcn.005daa70
test eax, eax
jne 0x515ff9
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.InstallProperties
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x23dc]
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Products_
push dword [ebp - 0x6fc4]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x23dc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x515ff9
lea eax, [ebp - 0x1f98]
push eax
push str.InstallLocation
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
lea ecx, [ebp - 0x1f98]
call fcn.005dc3a0
cmp eax, 0xa
jle 0x516016
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dbc20
push 0
push 1
push 1
push 0
push 0x624518
lea ecx, [ebp - 0x1f98]
call fcn.005daa70
test eax, eax
jne 0x516563
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x624384
lea ecx, [ebp - 0x2108]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x2708]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
test al, al
jne 0x516563
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624384
lea ecx, [ebp - 0x2108]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x26fc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
test al, al
jne 0x516563
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624384
lea ecx, [ebp - 0x2108]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x26f0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
test al, al
jne 0x516563
lea ecx, [ebp - 0x2148]
call fcn.005dc3a0
cmp eax, 4
jle 0x51622c
push 0
push 1
push 1
push 0
push 0x66d19c
lea ecx, [ebp - 0x2148]
call fcn.005daa70
cmp eax, 1
je 0x51622c
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624384
lea ecx, [ebp - 0x2108]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x2148]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x26f0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
test al, al
jne 0x516563
push 1
push 0x627830
push dword [ebp - 0x6d4c]
lea ecx, [ebp - 0x23d0]
push 1
call fcn.005dc190
push eax
lea ecx, [ebp - 0x27e8]
call fcn.005dc260
mov ecx, eax
call fcn.005d9500
test eax, eax
je 0x5164ce
lea ecx, [ebp - 0x27e8]
call fcn.005dc190
lea edx, [ebp - 0x2714]
mov ecx, eax
call fcn.0059c490
test al, al
je 0x5164ce
lea ecx, [ebp - 0x27e8]
call fcn.005dc190
lea edx, [ebp - 0x26e4]
mov ecx, eax
call fcn.0059cca0
test al, al
je 0x5164ce
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624384
lea ecx, [ebp - 0x2108]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x226c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x26e4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
test al, al
jne 0x5164de
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624384
lea ecx, [ebp - 0x2108]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x2160]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x26e4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
test al, al
jne 0x5164de
lea ecx, [ebp - 0x2148]
call fcn.005dc3a0
cmp eax, 4
jle 0x5164de
push 0
push 1
push 1
push 0
push 0x66d19c
lea ecx, [ebp - 0x2148]
call fcn.005daa70
cmp eax, 1
je 0x5164de
push 0
push 0
push 0
push 0
push 0
push 0x624384
lea ecx, [ebp - 0x2108]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x2148]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x226c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x26e4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
test al, al
jne 0x5164de
push 0
push 0
push 0
push 0
push 0
push 0x624384
lea ecx, [ebp - 0x2108]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x2148]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x2160]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x26e4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push 0x400
lea ecx, [ebp - 0x1f98]
call fcn.005db9a0
mov edx, 0x400
mov ecx, eax
call fcn.005e1410
jmp 0x5164de
push str._All_users_
lea ecx, [ebp - 0x2714]
call fcn.005dc510
lea ecx, [ebp - 0x22dc]
call fcn.005dc3a0
cmp eax, 0xa
jle 0x516563
lea eax, [ebp - 0x22dc]
push eax
lea ecx, [ebp - 0x1f98]
call fcn.005dc4e0
push 0
push 0
push 0x62439c
push 0x624388
lea ecx, [ebp - 0x1f98]
call fcn.005da270
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dbc20
push 0
push 1
push 0xffffffffffffffff
push 1
push 0x624518
lea ecx, [ebp - 0x1f98]
call fcn.005daa70
cmp eax, 2
jle 0x516556
add eax, 0xfffffffe
lea ecx, [ebp - 0x1f98]
push eax
call fcn.005dad50
push 0
lea ecx, [ebp - 0x1f98]
call fcn.005dbed0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
mov ecx, eax
call fcn.005e71d0
test al, al
je 0x516584
lea ecx, [ebp - 0x1f98]
call fcn.005dc400
lea eax, [ebp - 0x2068]
xor edi, edi
push eax
push str.DisplayIcon
lea ecx, [ebp - 0x1fe8]
call fcn.005d6740
test al, al
je 0x516a70
push edi
lea ecx, [ebp - 0x2068]
call fcn.005dc190
push eax
push 0x104
lea ecx, [ebp - 0x2068]
call fcn.005db9a0
lea ecx, [ebp - 0x2068]
call fcn.005dc190
ret
pop ebx
or al, 0
push eax
call dword [sym.imp.SHLWAPI.dll_PathParseIconLocationW]
cmp byte [ebp - 0x6f78], 0
mov edi, eax
jne 0x516733
lea ecx, [ebp - 0x2068]
call fcn.005dc3a0
test eax, eax
jne 0x516733
push eax
lea ecx, [ebp - 0x22dc]
call fcn.005dc190
push eax
push 0x800
lea ecx, [ebp - 0x2068]
call fcn.005db9a0
push 0x800
lea ecx, [ebp - 0x2068]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x22dc]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x2068]
call fcn.005dc3a0
test eax, eax
je 0x516733
push 0
push 1
push 0xffffffffffffffff
push 0
push 0x6243cc
lea ecx, [ebp - 0x2068]
call fcn.005daa70
test eax, eax
je 0x516674
add eax, 3
lea ecx, [ebp - 0x2068]
push eax
call fcn.005dae00
lea ecx, [ebp - 0x2068]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x516733
push eax
push 1
push 0xffffffffffffffff
push 1
push 0x624518
lea ecx, [ebp - 0x2068]
call fcn.005daa70
cmp eax, 2
jle 0x5166b9
add eax, 0xfffffffe
lea ecx, [ebp - 0x2068]
push eax
call fcn.005dad50
lea ecx, [ebp - 0x2068]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x516733
push eax
push 1
push 0xffffffffffffffff
push 1
push 0x624388
lea ecx, [ebp - 0x2068]
call fcn.005daa70
test eax, eax
je 0x5166f6
push eax
lea ecx, [ebp - 0x2068]
call fcn.005dad50
lea ecx, [ebp - 0x2068]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x516733
push eax
push 1
push 0xffffffffffffffff
push 1
push 0x62438c
lea ecx, [ebp - 0x2068]
call fcn.005daa70
test eax, eax
je 0x516733
push eax
lea ecx, [ebp - 0x2068]
call fcn.005dad50
push 0x5c
lea ecx, [ebp - 0x1f98]
call fcn.005da0a0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2108]
mov byte [ebp - 0x6f9c], 1
call fcn.005dc190
mov ecx, dword [ebp - 0x6fb4]
push eax
push str.Adware_
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
lea eax, [ebp - 0x6d04]
push eax
push str._check_state_
lea ecx, [ebp - 0x1f74]
call fcn.005d66b0
test al, al
je 0x5167d8
mov eax, dword [ebp - 0x6f9c]
mov ecx, 2
cmp dword [ebp - 0x6d04], 0
movzx eax, al
cmove eax, ecx
mov dword [ebp - 0x6f9c], eax
push edi
lea ecx, [ebp - 0x2068]
call fcn.005dc190
push eax
xor eax, eax
lea ecx, [ebp - 0x2714]
cmp byte [ebp - 0x6f9c], 1
push 0
sete al
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2148]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2120]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f7c]
push eax
mov eax, dword [ebp - 0x6f7c]
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [eax + 8]
push dword [eax + 0xa0]
call fcn.0053ab00
push eax
lea ecx, [ebp - 0x231c]
call fcn.005db320
lea ecx, [ebp - 0x23d0]
call fcn.005dc190
push eax
push str.Registry_Key
lea ecx, [ebp - 0x231c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e0]
call fcn.005dd0c0
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push str.Path
lea ecx, [ebp - 0x231c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e0]
call fcn.005dd0c0
lea ecx, [ebp - 0x2108]
call fcn.005dc3a0
test eax, eax
je 0x5168ea
lea ecx, [ebp - 0x2108]
call fcn.005dc190
push eax
push str.DBName
lea ecx, [ebp - 0x231c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e0]
call fcn.005dd0c0
push 0x62a118
lea ecx, [ebp - 0x2108]
call fcn.005dc190
push eax
push str._UAK_PRODUCTS_FOUND_
lea ecx, [ebp - 0x21e0]
call fcn.005dd0c0
lea ecx, [ebp - 0x22dc]
call fcn.005dc3a0
test eax, eax
je 0x516921
lea ecx, [ebp - 0x22dc]
call fcn.005dc190
push eax
push str.Uninstall_String
lea ecx, [ebp - 0x231c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e0]
call fcn.005dd0c0
lea ecx, [ebp - 0x2714]
call fcn.005dc190
push eax
push str.User_name
lea ecx, [ebp - 0x231c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e0]
call fcn.005dd0c0
cmp byte [ebp - 0x6f78], 0
je 0x516974
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x231c]
push str.MSI_Product
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e0]
call fcn.005dd0c0
cmp byte [ebp - 0x6f9c], 1
mov ecx, str.Unchecked_r_n
push 0
push 0
mov eax, str.Checked_r_n
cmovne eax, ecx
lea ecx, [ebp - 0x2714]
push eax
push str._r_n_t_tItem_state:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name_:
lea ecx, [ebp - 0x1f98]
call fcn.005dc190
push eax
push str._r_n_t_tFolder_path:
lea ecx, [ebp - 0x23d0]
call fcn.005dc190
push eax
push str._r_n_t_tUninstall_key:
lea ecx, [ebp - 0x2120]
call fcn.005dc190
push eax
push str._r_n_tDetected_program:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov edi, dword [ebp - 0x6f8c]
mov eax, dword [ebp - 0x6f7c]
inc edi
mov dword [ebp - 0x6f8c], edi
cmp edi, dword [esi]
jb 0x515d12
mov eax, dword [ebp - 0x6f7c]
mov esi, dword [ebp - 0x6fa4]
mov ecx, eax
call fcn.0050db30
test al, al
je 0x516acf
lea ecx, [ebp - 0x278c]
call fcn.005dc430
lea ecx, [ebp - 0x2798]
call fcn.005dc430
lea ecx, [ebp - 0x27e8]
call fcn.005dc430
lea ecx, [ebp - 0x26e4]
call fcn.005dc430
lea ecx, [ebp - 0x2714]
call fcn.005dc430
lea ecx, [ebp - 0x2a0c]
call fcn.005dc430
jmp 0x515b48
cmp byte [ebp - 0x6f78], 0
je 0x5165e3
lea eax, [ebp - 0x6d68]
mov dword [ebp - 0x6d68], 0x400
push eax
push 0
push 0
push 0x400
lea ecx, [ebp - 0x2068]
call fcn.005db9a0
push eax
push str.ProductIcon
push dword [ebp - 0x6cec]
call dword [sym.imp.msi.dll_MsiGetPropertyW]
push dword [ebp - 0x6d68]
lea ecx, [ebp - 0x2068]
call fcn.005dc440
xor ecx, ecx
mov word [eax], cx
jmp 0x516733
lea ecx, [ebp - 0x2798]
call fcn.005dc3a0
cmp eax, 6
jle 0x516b8c
push 0x2000
lea eax, [ebp - 0x6dbc]
mov dword [ebp - 0x6dbc], 0x1000
push eax
push 0
push 0
push 0x1000
lea ecx, [ebp - 0x278c]
call fcn.005db9a0
push eax
lea ecx, [ebp - 0x2798]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_UrlEscapeW]
test eax, eax
je 0x516b36
lea eax, [ebp - 0x2798]
push eax
lea ecx, [ebp - 0x278c]
call fcn.005dc4e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.https:__www.carifred.com_ultra_adware_killer_pup_report.php_ps
lea ecx, [ebp - 0x278c]
call fcn.005da510
push 0
push 0
push str.https:__www.google.com
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_124.0.0.0_Safari_537.36
push 6
lea ecx, [ebp - 0x278c]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005b40e0
push eax
lea ecx, [ebp - 0x2574]
call fcn.005b0b90
mov eax, dword [ebp - 0x6f7c]
push 0x1e
mov eax, dword [eax + 8]
push dword [eax + 0x34]
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005b9910
mov eax, dword [ebp - 0x6f7c]
push 0
push str.Scanning_file_objects...
mov eax, dword [eax + 8]
push dword [eax + 0x38]
mov eax, dword [ebp - 0x6f7c]
mov ecx, dword [eax + 4]
call fcn.005bcd30
push 0xc
lea ecx, [ebp - 0x23b8]
call fcn.00401d40
lea ecx, [ebp - 0x23b8]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2500]
mov byte [ebp - 4], 0x42
call fcn.00401d40
lea ecx, [ebp - 0x2500]
call fcn.005dc5e0
mov ecx, dword [ebp - 0x6f7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Adware
lea ecx, [ecx + 0x33c]
mov byte [ebp - 4], 0x43
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 4
lea ecx, [ebp - 0x2364]
call fcn.00401d80
lea ecx, [ebp - 0x2364]
call fcn.005d6aa0
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
mov byte [ebp - 4], 0x44
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x517075
lea eax, [ebp - 0x6cec]
mov dword [ebp - 0x6fb4], 0
push eax
push 0
lea ecx, [ebp - 0x1f74]
call fcn.005d6380
test al, al
je 0x517075
mov eax, dword [ebp - 0x6f7c]
lea ecx, [eax + 0x10c]
mov dword [ebp - 0x6f8c], ecx
jmp 0x516cb9
mov eax, dword [ebp - 0x6f7c]
mov ecx, eax
call fcn.0050db30
test al, al
jne 0x517075
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62794c
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x2500]
push 0x62794c
call fcn.005dc200
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x2500]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2984]
call fcn.005daa70
test eax, eax
jne 0x51704d
mov ecx, dword [ebp - 0x6f7c]
push eax
push 0x62e530
push dword [ebp - 0x6cec]
call fcn.00511ee0
test al, al
jne 0x51704d
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x2500]
xor edi, edi
call fcn.005dc510
push 0x66d3c4
lea ecx, [ebp - 0x2500]
call fcn.005dc480
test al, al
je 0x516d7d
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x624384
lea ecx, [ebp - 0x2500]
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2500]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x2708]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x23b8]
call fcn.005dc200
lea ecx, [ebp - 0x23b8]
call fcn.005e1550
test al, al
je 0x516df4
push esi
lea eax, [ebp - 0x21e0]
push eax
lea eax, [ebp - 0x1fc8]
push eax
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x23b8]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f7c]
push eax
call fcn.00512740
mov edi, eax
cmp dword [ebp - 0x6fdc], 0
je 0x516e78
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2500]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x26fc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x23b8]
call fcn.005dc200
lea ecx, [ebp - 0x23b8]
call fcn.005e1550
test al, al
je 0x516e78
push esi
lea eax, [ebp - 0x21e0]
push eax
lea eax, [ebp - 0x1fc8]
push eax
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x23b8]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f7c]
push eax
call fcn.00512740
add edi, eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2500]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x26f0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x23b8]
call fcn.005dc200
lea ecx, [ebp - 0x23b8]
call fcn.005e1550
test al, al
je 0x516eef
push esi
lea eax, [ebp - 0x21e0]
push eax
lea eax, [ebp - 0x1fc8]
push eax
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x23b8]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f7c]
push eax
call fcn.00512740
add edi, eax
mov eax, dword [ebp - 0x6f7c]
xor esi, esi
mov dword [ebp - 0x6fa4], esi
cmp dword [eax + 0x30], esi
jbe 0x51702e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2500]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x226c]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x23b8]
call fcn.005dc200
lea ecx, [ebp - 0x23b8]
call fcn.005e1550
test al, al
je 0x516f8f
push esi
lea eax, [ebp - 0x21e0]
push eax
lea eax, [ebp - 0x1fc8]
push eax
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x23b8]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f7c]
push eax
call fcn.00512740
add edi, eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2500]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x2160]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x23b8]
call fcn.005dc200
lea ecx, [ebp - 0x23b8]
call fcn.005e1550
test al, al
je 0x517018
push esi
lea eax, [ebp - 0x21e0]
push eax
lea eax, [ebp - 0x1fc8]
push eax
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x23b8]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f7c]
push eax
call fcn.00512740
add edi, eax
mov eax, dword [ebp - 0x6f7c]
inc esi
cmp esi, dword [eax + 0x30]
jb 0x516f06
mov dword [ebp - 0x6fa4], esi
test edi, edi
jle 0x51704d
push 0x62a118
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x21e0]
push str._UAK_PRODUCTS_FOUND_
call fcn.005dd0c0
mov eax, dword [ebp - 0x6fb4]
lea ecx, [ebp - 0x6cec]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x1f74]
mov dword [ebp - 0x6fb4], eax
call fcn.005d6380
test al, al
jne 0x516cb3
lea ecx, [ebp - 0x2364]
call fcn.005d69e0
lea ecx, [ebp - 0x2500]
call fcn.005dc430
lea ecx, [ebp - 0x23b8]
call fcn.005dc430
jmp 0x516a29
mov eax, dword [ebp - 0x2364]
mov dword [ebp - 0x6fa4], eax
push 8
lea ecx, [ebp - 0x6e04]
call fcn.00401f90
mov edi, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x6e04]
mov eax, dword [edi + 0x30]
add eax, 2
push eax
call fcn.00403c80
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x213c]
mov esi, dword [ebp - 0x6e04]
push 0xc
mov dword [ebp - 0x6fa0], esi
call fcn.00401d40
lea ecx, [ebp - 0x213c]
call fcn.005dc5e0
mov ecx, edi
mov byte [ebp - 4], 0x46
call fcn.0050db30
test al, al
mov eax, edi
jne 0x51986e
test dword [eax + 0x34], 0x400
jne 0x51986e
push 0
push str._r_n_r_n__Autostart_scan:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push str.Scanning_Autostart...
push dword [eax + 0x38]
call fcn.005bcd30
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x23
push dword [eax + 0x34]
call fcn.005b9910
mov eax, edi
xor esi, esi
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x5171ba
mov edi, dword [ebp - 0x6fa0]
add eax, 0x104
mov dword [ebp - 0x6fcc], eax
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push esi
mov ecx, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str.HKU_
mov ecx, edi
call fcn.005dc200
mov eax, dword [ebp - 0x6f7c]
inc esi
add edi, 0xc
mov ecx, dword [eax + 0x30]
mov eax, dword [ebp - 0x6fcc]
cmp esi, ecx
jb 0x517170
mov esi, dword [ebp - 0x6fa0]
lea eax, [ecx + ecx*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
mov edi, dword [ebp - 0x6f7c]
je 0x517227
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
push 0xc
lea ecx, [ebp - 0x2084]
call fcn.00401d40
lea ecx, [ebp - 0x2084]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2418]
mov byte [ebp - 4], 0x47
call fcn.00401d40
lea ecx, [ebp - 0x2418]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2824]
mov byte [ebp - 4], 0x48
call fcn.00401d40
lea ecx, [ebp - 0x2824]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x219c]
mov byte [ebp - 4], 0x49
call fcn.00401d40
lea ecx, [ebp - 0x219c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x234c]
mov byte [ebp - 4], 0x4a
call fcn.00401d40
lea ecx, [ebp - 0x234c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x258c]
mov byte [ebp - 4], 0x4b
call fcn.00401d40
lea ecx, [ebp - 0x258c]
call fcn.005dc5e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.AutoStart
push 0x624284
lea ecx, [edi + 0x140]
mov byte [ebp - 4], 0x4c
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2780]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x2780]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e0]
call fcn.005dd360
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa4]
call fcn.005bb910
push 0
push str._r_n_tRegistry_autostart_entries:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
cmp dword [ebp - 0x6fac], 0
mov dword [ebp - 0x6f8c], 0
jbe 0x5176e8
mov eax, dword [ebp - 0x6f7c]
mov esi, dword [ebp - 0x6fa8]
mov dword [ebp - 0x6f78], esi
lea ecx, [eax + 0x10c]
mov dword [ebp - 0x6fcc], ecx
mov ecx, dword [ebp - 0x6fa0]
sub ecx, esi
mov dword [ebp - 0x6f80], ecx
jmp 0x517396
mov eax, dword [ebp - 0x6f7c]
mov ecx, eax
call fcn.0050db30
test al, al
jne 0x5176e2
mov eax, dword [ebp - 0x6f7c]
mov edi, dword [ebp - 0x6f8c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
cmp edi, dword [eax + 0x30]
jae 0x5173e6
lea ecx, [ebp - 0x2720]
call fcn.005dc190
mov ecx, dword [ebp - 0x6fcc]
push eax
push edi
call fcn.00403bc0
mov ecx, eax
jmp 0x5173f1
push str._temp
lea ecx, [ebp - 0x25b0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2418]
call fcn.005dc200
mov eax, dword [ebp - 0x6f80]
add eax, esi
push 0
push 0x20019
mov ecx, eax
mov dword [ebp - 0x6fb4], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x5176da
lea eax, [ebp - 0x6cec]
xor esi, esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
mov dword [ebp - 0x6fa4], esi
call fcn.005d62e0
mov edi, dword [ebp - 0x6f7c]
test al, al
je 0x5176b0
nop dword [eax + eax]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5176aa
mov eax, dword [ebp - 0x6cec]
cmp word [eax], 0
je 0x51768e
push 0
push str.Registry_autostart_entries
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51768e
lea eax, [ebp - 0x2084]
push eax
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x51768e
push 3
lea edx, [edi + 0x1a8]
mov dword [ebp - 0x6f9c], 0
lea ecx, [ebp - 0x2084]
call fcn.005e88c0
test al, al
je 0x517566
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x2418]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2084]
call fcn.005daa70
mov ecx, dword [ebp - 0x6fb4]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
mov dword [ebp - 0x6f9c], eax
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x213c]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x213c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x2084]
mov ecx, edi
push eax
call fcn.00511450
test al, al
mov ecx, 1
mov eax, dword [ebp - 0x6f9c]
cmovne eax, ecx
mov dword [ebp - 0x6f9c], eax
push 0
lea ecx, [ebp - 0x2084]
call fcn.005dc190
push eax
push 0
push dword [ebp - 0x6f9c]
lea ecx, [ebp - 0x2084]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
push dword [ebp - 0x6cec]
mov eax, dword [edi + 8]
mov ecx, edi
push 0xffffffffffffffff
push 0xb
push dword [eax + 0xa4]
call fcn.0053ab00
mov dword [ebp - 0x6fa4], eax
cmp eax, 0xffffffff
je 0x51768e
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2084]
call fcn.005dc190
mov ecx, dword [ebp - 0x6fb4]
push eax
call fcn.005dc190
push eax
push 0xb
push dword [ebp - 0x6fa4]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
lea eax, [ebp - 0x2084]
push eax
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
cmp dword [ebp - 0x6f9c], 0
mov ecx, str.Un_checked
push 0
push 0
push 0
push 0x62781c
mov eax, str.Checked
cmove eax, ecx
lea ecx, [ebp - 0x2084]
push eax
push str._r_n_t_tItem_state:
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push str._r_n_t_tCommand:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f80]
push str._r_n_t_tName:
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x6cec]
inc esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
call fcn.005d62e0
test al, al
jne 0x517460
mov dword [ebp - 0x6fa4], esi
mov esi, dword [ebp - 0x6f78]
mov eax, dword [ebp - 0x6f8c]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f8c], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x517390
jmp 0x5176e8
mov edi, dword [ebp - 0x6f7c]
jmp 0x5176b6
mov edi, dword [ebp - 0x6f7c]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x519822
mov eax, dword [ebp - 0x6f7c]
xor esi, esi
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x517763
mov edi, dword [ebp - 0x6fa0]
add eax, 0x10c
mov dword [ebp - 0x6f80], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2900]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f80]
push eax
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005dc200
mov eax, dword [ebp - 0x6f7c]
inc esi
add edi, 0xc
mov ecx, dword [eax + 0x30]
cmp esi, ecx
jb 0x517717
lea eax, [ebp - 0x2948]
push eax
lea eax, [ecx + ecx*2]
mov ecx, dword [ebp - 0x6fa0]
lea ecx, [ecx + eax*4]
call fcn.005dc4e0
push 0
push str._r_n_tStartup_folder_items:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
push 0x4c
lea ecx, [ebp - 0x2ba8]
call fcn.00401e50
lea ecx, [ebp - 0x2ba8]
call fcn.005e9520
mov eax, dword [ebp - 0x6f7c]
xor edi, edi
mov edx, dword [ebp - 0x6fa8]
mov esi, edx
mov byte [ebp - 4], 0x4d
mov dword [ebp - 0x6fb4], edi
lea ecx, [eax + 0x10c]
mov dword [ebp - 0x6f78], edx
mov dword [ebp - 0x6fcc], ecx
mov ecx, dword [ebp - 0x6fa0]
sub ecx, edx
mov dword [ebp - 0x6f80], ecx
nop
mov ecx, eax
call fcn.0050db30
test al, al
jne 0x517c60
mov eax, dword [ebp - 0x6f80]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
add eax, esi
push 0
push str..
mov ecx, eax
mov dword [ebp - 0x6f8c], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2084]
call fcn.005dc200
push 0x260
lea ecx, [ebp - 0x37b0]
call fcn.00401d60
push 3
lea ecx, [ebp - 0x2084]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x37b0]
call fcn.00401130
mov eax, dword [ebp - 0x6f7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov byte [ebp - 4], 0x4e
push 0
push 0
cmp edi, dword [eax + 0x30]
jae 0x517891
lea ecx, [ebp - 0x2720]
call fcn.005dc190
mov ecx, dword [ebp - 0x6fcc]
push eax
push edi
call fcn.00403bc0
mov ecx, eax
jmp 0x51789c
push str._temp
lea ecx, [ebp - 0x25b0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2418]
call fcn.005dc200
lea ecx, [ebp - 0x37b0]
call fcn.00401270
test al, al
je 0x517c30
mov edi, dword [ebp - 0x6f7c]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x517c2a
push 1
lea ecx, [ebp - 0x37b0]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x219c]
call fcn.005dc510
push str.desktop.ini
lea ecx, [ebp - 0x219c]
call fcn.005dc4c0
test al, al
jne 0x517c17
push 0
push str.Startup_folder_items
lea ecx, [ebp - 0x219c]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x517c17
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x37b0]
call fcn.004012d0
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x258c]
call fcn.005dc200
lea eax, [ebp - 0x258c]
push eax
lea ecx, [ebp - 0x234c]
call fcn.005dc4e0
push 0
push 0
lea ecx, [ebp - 0x37b0]
call fcn.004012e0
mov edx, 0x66c890
mov ecx, eax
call fcn.005d8ad0
test eax, eax
jne 0x517a5f
push eax
lea ecx, [ebp - 0x258c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2ba8]
call fcn.005e93e0
test al, al
je 0x517a5f
push 0
lea ecx, [ebp - 0x2ba8]
call fcn.005e9390
push eax
lea ecx, [ebp - 0x234c]
call fcn.005dc510
lea ecx, [ebp - 0x2ba8]
call fcn.005e9340
mov ecx, eax
call fcn.005d8c40
test eax, eax
je 0x517a18
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2ba8]
call fcn.005e9340
push eax
push 0x62438c
lea ecx, [ebp - 0x234c]
call fcn.005da780
push 3
push 1
lea ecx, [ebp - 0x234c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2084]
call fcn.005dc260
lea edx, [edi + 0x1a8]
mov ecx, eax
call fcn.005e88c0
test al, al
jne 0x517a71
push 0
lea ecx, [ebp - 0x2ba8]
call fcn.005e9390
push eax
lea ecx, [ebp - 0x2084]
call fcn.005dc510
jmp 0x517a71
lea eax, [ebp - 0x258c]
push eax
lea ecx, [ebp - 0x2084]
call fcn.005dc4e0
push 0
push 0
push 0x62439c
push 0x624388
lea ecx, [ebp - 0x2084]
call fcn.005da270
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x2418]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2084]
call fcn.005daa70
push 0
lea ecx, [ebp - 0x258c]
mov esi, eax
call fcn.005dc190
push eax
lea eax, [ebp - 0x2084]
mov ecx, edi
push eax
call fcn.00511450
test al, al
lea ecx, [ebp - 0x2084]
mov eax, 1
push 0
cmovne esi, eax
call fcn.005dc190
push eax
push 0
push esi
lea ecx, [ebp - 0x2084]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x219c]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 0xffffffffffffffff
push 0xc
push dword [eax + 0xa4]
call fcn.0053ab00
mov dword [ebp - 0x6f9c], eax
cmp eax, 0xffffffff
je 0x517c11
push 0
push 0
push 0
test esi, esi
mov eax, str.Un_checked
push 0x62781c
mov ecx, str.Checked
cmove ecx, eax
push ecx
push str._r_n_t_tItem_state:
lea ecx, [ebp - 0x2084]
call fcn.005dc190
mov esi, dword [ebp - 0x6f78]
mov ecx, esi
push eax
push str._r_n_t_tPath:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x219c]
call fcn.005dc190
push eax
push str._r_n_t_tName:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x37b0]
call fcn.004012d0
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2084]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2084]
call fcn.005dc190
push eax
push 0
push 0xc
push dword [ebp - 0x6f9c]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
jmp 0x517c17
mov esi, dword [ebp - 0x6f78]
lea ecx, [ebp - 0x37b0]
call fcn.00401230
test al, al
jne 0x5178c6
mov edi, dword [ebp - 0x6fb4]
lea ecx, [ebp - 0x37b0]
mov byte [ebp - 4], 0x4d
call fcn.00401180
mov eax, dword [ebp - 0x6f7c]
inc edi
add esi, 0xc
mov dword [ebp - 0x6fb4], edi
mov dword [ebp - 0x6f78], esi
cmp edi, dword [eax + 0x30]
jbe 0x5177e0
jmp 0x517c66
mov eax, dword [ebp - 0x6f7c]
mov ecx, eax
call fcn.0050db30
test al, al
jne 0x519817
push 0
push str._r_n_tScheduled_tasks_scan__root_folder_only_:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
push 0xc
lea ecx, [ebp - 0x2490]
call fcn.00401d40
lea ecx, [ebp - 0x2490]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x21a8]
mov byte [ebp - 4], 0x4f
call fcn.00401d40
lea ecx, [ebp - 0x21a8]
call fcn.005dc5e0
push 4
lea ecx, [ebp - 0x6d10]
mov byte [ebp - 4], 0x50
call fcn.00401d80
lea ecx, [ebp - 0x6d10]
call fcn.004013f0
push 4
lea ecx, [ebp - 0x6d0c]
mov byte [ebp - 4], 0x51
call fcn.00401d80
lea ecx, [ebp - 0x6d0c]
call fcn.004013f0
lea eax, [ebp - 0x6d0c]
mov byte [ebp - 4], 0x52
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
push eax
push 0x61e720
push 1
push 0
push 0x61e730
call esi
test eax, eax
js 0x518973
lea ecx, [ebp - 0x70a0]
call fcn.00401ca0
movups xmm0, xmmword [eax]
lea ecx, [ebp - 0x70d0]
movups xmmword [ebp - 0x6fd8], xmm0
call fcn.00401ca0
movups xmm0, xmmword [eax]
lea ecx, [ebp - 0x70c0]
movups xmmword [ebp - 0x6f98], xmm0
call fcn.00401ca0
movups xmm0, xmmword [eax]
lea ecx, [ebp - 0x70e0]
movups xmmword [ebp - 0x6fc0], xmm0
call fcn.00401ca0
mov edi, eax
mov byte [ebp - 4], 0x56
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x6fd8]
mov ecx, dword [ebp - 0x6d0c]
mov edx, esp
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov esi, dword [ecx]
movups xmmword [edx], xmm0
movups xmm0, xmmword [ebp - 0x6f98]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x6fc0]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [edi]
push ecx
movups xmmword [eax], xmm0
mov eax, dword [esi + 0x28]
call eax
shr eax, 0x1f
lea ecx, [ebp - 0x70e0]
mov dword [ebp - 0x6f80], eax
call fcn.00401d30
lea ecx, [ebp - 0x70c0]
call fcn.00401d30
lea ecx, [ebp - 0x70d0]
call fcn.00401d30
lea ecx, [ebp - 0x70a0]
mov byte [ebp - 4], 0x52
call fcn.00401d30
cmp byte [ebp - 0x6f80], 0
jne 0x517ec0
push 4
lea ecx, [ebp - 0x6d14]
call fcn.00401d80
lea ecx, [ebp - 0x6d14]
call fcn.004013f0
push 0x624284
lea ecx, [ebp - 0x7034]
mov byte [ebp - 4], 0x57
call fcn.00401a90
mov byte [ebp - 4], 0x58
mov ecx, dword [ebp - 0x6d0c]
mov esi, dword [ecx]
lea ecx, [ebp - 0x6d14]
push ecx
mov ecx, eax
call fcn.00401b50
push eax
push dword [ebp - 0x6d0c]
mov eax, dword [esi + 0x1c]
call eax
shr eax, 0x1f
lea ecx, [ebp - 0x7034]
mov dword [ebp - 0x6f80], eax
mov byte [ebp - 4], 0x57
call fcn.00401b40
cmp byte [ebp - 0x6f80], 0
jne 0x517eb1
push 4
lea ecx, [ebp - 0x6d30]
call fcn.00401d80
lea ecx, [ebp - 0x6d30]
call fcn.004013f0
mov byte [ebp - 4], 0x59
lea edx, [ebp - 0x6d30]
mov eax, dword [ebp - 0x6d14]
push edx
push 1
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x38]
call eax
test eax, eax
jns 0x51835c
lea ecx, [ebp - 0x6d30]
call fcn.00402e10
lea ecx, [ebp - 0x6d14]
mov byte [ebp - 4], 0x52
call fcn.00402e10
mov edi, dword [ebp - 0x6f7c]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5197eb
push 0x18
lea ecx, [ebp - 0x28a4]
call fcn.00401e00
lea ecx, [ebp - 0x28a4]
call fcn.005d9320
push 0
push str._r_n_tAppInit_DLLs_scan:_r_n
lea ecx, [ebp - 0x1fc8]
mov byte [ebp - 4], 0x62
call fcn.005e37e0
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x517f6a
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
nop
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x517f20
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x517fd1
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fac], 0
mov dword [ebp - 0x6fb4], 0
jbe 0x518e86
mov esi, dword [ebp - 0x6fa8]
mov eax, dword [ebp - 0x6fa0]
sub eax, esi
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f80], eax
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x518e86
mov eax, dword [ebp - 0x6f80]
add eax, esi
push 0
push 0x20019
mov ecx, eax
mov dword [ebp - 0x6f8c], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x518e64
lea eax, [ebp - 0x2418]
push eax
push str.AppInit_DLLs
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x518e64
lea ecx, [ebp - 0x2418]
call fcn.005dc3a0
cmp eax, 2
jl 0x518e64
push 0x18
lea ecx, [ebp - 0x29f4]
call fcn.00401e00
push 0
push 0x627824
lea ecx, [ebp - 0x2418]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x29f4]
call fcn.005d92a0
xor esi, esi
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x29f4]
mov dword [ebp - 0x6fa4], esi
call fcn.005d9210
test eax, eax
je 0x518e4f
nop
push esi
lea ecx, [ebp - 0x29f4]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x219c]
call fcn.005dc510
push 0
push str.Appinit_DLLs
lea ecx, [ebp - 0x219c]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x518e35
push esi
lea ecx, [ebp - 0x29f4]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x2084]
call fcn.005dc510
lea ecx, [ebp - 0x2084]
call fcn.005dbeb0
test al, al
jne 0x518e35
push 0
push 1
push 0xffffffffffffffff
push 0
push str..dll
lea ecx, [ebp - 0x2084]
call fcn.005daa70
lea ecx, [ebp - 0x2084]
mov esi, eax
call fcn.005dc3a0
sub eax, 3
cmp esi, eax
je 0x518177
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..dll
lea ecx, [ebp - 0x2084]
call fcn.005da780
push 3
lea edx, [edi + 0x1a8]
lea ecx, [ebp - 0x2084]
call fcn.005e88c0
lea ecx, [ebp - 0x2084]
call fcn.005dc190
push eax
push 0
call dword [sym.imp.sfc.dll_SfcIsFileProtected]
test eax, eax
jne 0x518e2f
push eax
push 1
push 1
push eax
push str._temp_
lea ecx, [ebp - 0x2084]
call fcn.005daa70
mov esi, dword [ebp - 0x6fa4]
xor ecx, ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test eax, eax
push 0
setg cl
push 0
mov dword [ebp - 0x6f9c], ecx
lea ecx, [ebp - 0x29f4]
push esi
call fcn.005d9220
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.___Appinit_DLLs__
call fcn.005dc190
push eax
lea ecx, [ebp - 0x213c]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x213c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x2084]
mov ecx, edi
push eax
call fcn.00511450
test al, al
mov ecx, 1
mov eax, dword [ebp - 0x6f9c]
cmovne eax, ecx
lea ecx, [ebp - 0x2084]
push 0
mov dword [ebp - 0x6f9c], eax
call fcn.005dc190
push eax
push 0
push dword [ebp - 0x6f9c]
lea ecx, [ebp - 0x2084]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x219c]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 0xffffffffffffffff
push 0xe
push dword [eax + 0xa4]
call fcn.0053ab00
mov dword [ebp - 0x6fcc], eax
cmp eax, 0xffffffff
je 0x518e35
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push str.AppInit_DLLs
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2084]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
call fcn.005dc190
push eax
push 0xe
push dword [ebp - 0x6fcc]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
cmp dword [ebp - 0x6f9c], 0
mov ecx, str.Un_checked
push 0
push 0
push 0
push 0x62781c
mov eax, str.Checked
cmove eax, ecx
lea ecx, [ebp - 0x2084]
push eax
push str._r_n_t_tItem_state:
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push str._r_n_t_tPath:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x219c]
call fcn.005dc190
push eax
push str._r_n_t_tName:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
jmp 0x518e35
mov eax, dword [ebp - 0x6d30]
lea edx, [ebp - 0x2590]
mov dword [ebp - 0x2590], 0
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x1c]
call eax
mov eax, dword [ebp - 0x2590]
mov edi, dword [ebp - 0x6f7c]
test eax, eax
je 0x518954
mov esi, 1
mov dword [ebp - 0x6f8c], esi
cmp eax, esi
jl 0x518954
lea eax, [edi + 0x1a8]
mov dword [ebp - 0x6fcc], eax
nop
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x518954
push 4
lea ecx, [ebp - 0x6cf4]
call fcn.00401d80
lea ecx, [ebp - 0x6cf4]
call fcn.004013f0
push 3
push esi
lea ecx, [ebp - 0x7090]
mov byte [ebp - 4], 0x5a
call fcn.00401cb0
mov esi, eax
mov byte [ebp - 4], 0x5b
lea edx, [ebp - 0x6cf4]
mov ecx, dword [ebp - 0x6d30]
movups xmm0, xmmword [esi]
push edx
sub esp, 0x10
mov eax, dword [ecx]
mov edx, esp
push ecx
mov eax, dword [eax + 0x20]
movups xmmword [edx], xmm0
call eax
shr eax, 0x1f
lea ecx, [ebp - 0x7090]
mov dword [ebp - 0x6f80], eax
mov byte [ebp - 4], 0x5a
call fcn.00401d30
cmp byte [ebp - 0x6f80], 0
jne 0x51892c
mov eax, dword [ebp - 0x6cf4]
lea edx, [ebp - 0x6d48]
mov dword [ebp - 0x6d48], 0
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x1c]
call eax
test eax, eax
js 0x51892c
mov eax, dword [ebp - 0x6d48]
test eax, eax
je 0x51892c
push eax
lea ecx, [ebp - 0x219c]
call fcn.005dc510
push dword [ebp - 0x6d48]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0
push str.Scheduled_tasks
lea ecx, [ebp - 0x219c]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51892c
push 4
lea ecx, [ebp - 0x6d00]
call fcn.00401d80
lea ecx, [ebp - 0x6d00]
call fcn.004013f0
mov byte [ebp - 4], 0x5c
lea edx, [ebp - 0x6d00]
mov eax, dword [ebp - 0x6cf4]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x4c]
call eax
test eax, eax
js 0x518921
push 4
lea ecx, [ebp - 0x6d08]
call fcn.00401d80
lea ecx, [ebp - 0x6d08]
call fcn.004013f0
mov byte [ebp - 4], 0x5d
lea edx, [ebp - 0x6d08]
mov eax, dword [ebp - 0x6d00]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x44]
call eax
test eax, eax
js 0x518916
mov eax, dword [ebp - 0x6d08]
lea edx, [ebp - 0x2484]
mov dword [ebp - 0x2484], 0
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x1c]
call eax
cmp dword [ebp - 0x2484], 0
je 0x518916
lea ecx, [ebp - 0x21a8]
call fcn.005dc400
mov esi, 1
cmp dword [ebp - 0x2484], esi
jl 0x518731
mov edi, dword [ebp - 0x6fcc]
push 4
lea ecx, [ebp - 0x6cf8]
call fcn.00401d80
lea ecx, [ebp - 0x6cf8]
call fcn.004013f0
mov byte [ebp - 4], 0x5e
lea edx, [ebp - 0x6cf8]
mov eax, dword [ebp - 0x6d08]
push edx
push esi
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x20]
call eax
test eax, eax
js 0x51870f
mov eax, dword [ebp - 0x6cf8]
lea edx, [ebp - 0x28a8]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
js 0x51870f
cmp dword [ebp - 0x28a8], 0
jne 0x51870f
push 4
lea ecx, [ebp - 0x6d1c]
call fcn.00401d80
lea ecx, [ebp - 0x6d1c]
call fcn.004013f0
mov byte [ebp - 4], 0x5f
lea edx, [ebp - 0x6d1c]
mov eax, dword [ebp - 0x6cf8]
push edx
push 0x61e760
push eax
mov ecx, dword [eax]
mov eax, dword [ecx]
call eax
test eax, eax
js 0x518704
mov eax, dword [ebp - 0x6d1c]
lea edx, [ebp - 0x6d38]
mov dword [ebp - 0x6d38], 0
mov dword [ebp - 0x6d3c], 0
push edx
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [ebp - 0x6d38]
test eax, eax
je 0x518704
push eax
lea ecx, [ebp - 0x234c]
call fcn.005dc510
mov eax, dword [ebp - 0x6d1c]
lea edx, [ebp - 0x6d3c]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x30]
call eax
mov ecx, dword [ebp - 0x6d3c]
call fcn.005d8c40
test eax, eax
je 0x5186bd
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6d3c]
lea ecx, [ebp - 0x234c]
push 0x62438c
call fcn.005da780
push 3
push 1
lea ecx, [ebp - 0x234c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21a8]
call fcn.005dc260
mov edx, edi
mov ecx, eax
call fcn.005e88c0
test al, al
jne 0x5186ce
push dword [ebp - 0x6d38]
lea ecx, [ebp - 0x21a8]
call fcn.005dc510
push 0
push 1
push 0x62439c
push 0x624388
lea ecx, [ebp - 0x21a8]
call fcn.005da270
push dword [ebp - 0x6d38]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x6d3c]
test eax, eax
je 0x518704
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x6d1c]
call fcn.00402e10
lea ecx, [ebp - 0x6cf8]
mov byte [ebp - 4], 0x5d
call fcn.00402e10
inc esi
cmp esi, dword [ebp - 0x2484]
jle 0x518563
mov edi, dword [ebp - 0x6f7c]
lea ecx, [ebp - 0x21a8]
call fcn.005dbeb0
test al, al
jne 0x518916
mov eax, dword [ebp - 0x6d14]
lea edx, [ebp - 0x6dc0]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x20]
call eax
test eax, eax
js 0x5187df
movsd xmm0, qword [edi + 0x390]
comisd xmm0, xmmword [0x6edab0]
jbe 0x51877b
mov eax, dword [edi + 0x1b0]
jmp 0x518781
mov eax, dword [edi + 0x1ac]
push eax
lea ecx, [ebp - 0x2490]
call fcn.005dc510
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x219c]
call fcn.005dc190
push eax
push 0x624284
push dword [ebp - 0x6dc0]
lea ecx, [ebp - 0x2490]
push str.Tasks
call fcn.005da780
push 1
push 0
push 0x624284
push 0x624b44
lea ecx, [ebp - 0x2490]
call fcn.005da270
jmp 0x5187ea
lea ecx, [ebp - 0x2490]
call fcn.005dc400
push 0
push 1
push 1
push 0
push str._temp_
lea ecx, [ebp - 0x21a8]
call fcn.005daa70
push 0
lea ecx, [ebp - 0x2490]
mov esi, eax
call fcn.005dc190
push eax
lea eax, [ebp - 0x21a8]
mov ecx, edi
push eax
call fcn.00511450
test al, al
lea ecx, [ebp - 0x21a8]
mov eax, 1
push 0
cmovne esi, eax
call fcn.005dc190
push eax
push 0
push esi
lea ecx, [ebp - 0x21a8]
call fcn.005dc190
push eax
push str._All_users_
lea ecx, [ebp - 0x219c]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 0xffffffffffffffff
push 0xd
push dword [eax + 0xa4]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x518916
push 0
push 0
push 0
push 0
push 0
push 0
push str._All_users_
lea ecx, [ebp - 0x21a8]
call fcn.005dc190
push eax
push 0
push 0xd
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
test esi, esi
mov ecx, str.Un_checked
push 0x62781c
mov eax, str.Checked
cmove eax, ecx
lea ecx, [ebp - 0x234c]
push eax
push str._r_n_t_tItem_state:
call fcn.005dc190
push eax
push str._r_n_t_tCommand:
push str._r_n_t_tUser_name:__All_users_
lea ecx, [ebp - 0x219c]
call fcn.005dc190
push eax
push str._r_n_t_tTask_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea ecx, [ebp - 0x6d08]
call fcn.00402e10
lea ecx, [ebp - 0x6d00]
call fcn.00402e10
lea ecx, [ebp - 0x6cf4]
mov byte [ebp - 4], 0x59
call fcn.00402e10
mov esi, dword [ebp - 0x6f8c]
inc esi
mov dword [ebp - 0x6f8c], esi
cmp esi, dword [ebp - 0x2590]
jle 0x5183b0
lea ecx, [ebp - 0x6d30]
call fcn.00402e10
lea ecx, [ebp - 0x6d14]
mov byte [ebp - 4], 0x52
call fcn.00402e10
jmp 0x517ec6
lea eax, [ebp - 0x6d10]
push eax
push 0x6ed834
push 1
push 0
push 0x6ed7c0
call esi
test eax, eax
js 0x517ec0
push 4
lea ecx, [ebp - 0x6d34]
call fcn.00401d80
lea ecx, [ebp - 0x6d34]
call fcn.004013f0
mov byte [ebp - 4], 0x60
lea edx, [ebp - 0x6d34]
mov eax, dword [ebp - 0x6d10]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x14]
call eax
test eax, eax
jns 0x5189db
lea ecx, [ebp - 0x6d34]
mov byte [ebp - 4], 0x52
call fcn.00402e10
jmp 0x517ec0
mov eax, dword [ebp - 0x6d34]
lea edx, [ebp - 0x2494]
push edx
mov dword [ebp - 0x2494], 0
lea edx, [ebp - 0x6d40]
push edx
mov ecx, dword [eax]
push 5
push eax
mov eax, dword [ecx + 0xc]
call eax
mov edi, dword [ebp - 0x6f7c]
test eax, eax
js 0x518e1b
mov eax, dword [ebp - 0x2494]
test eax, eax
je 0x518e1b
xor esi, esi
mov dword [ebp - 0x6f8c], esi
test eax, eax
je 0x518de9
nop
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x518de9
mov eax, dword [ebp - 0x6d40]
lea ecx, [ebp - 0x219c]
push dword [eax + esi*4]
call fcn.005dc510
mov eax, dword [ebp - 0x6d40]
push dword [eax + esi*4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0
push str.Scheduled_tasks
lea ecx, [ebp - 0x219c]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x518dce
push 4
lea ecx, [ebp - 0x6cfc]
call fcn.00401d80
lea ecx, [ebp - 0x6cfc]
call fcn.004013f0
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x219c]
mov eax, dword [ebp - 0x6d10]
mov esi, dword [eax]
lea eax, [ebp - 0x6cfc]
push eax
push 0x6ed8fc
call fcn.005dc190
push eax
push dword [ebp - 0x6d10]
mov eax, dword [esi + 0x18]
call eax
test eax, eax
js 0x518dbf
mov eax, dword [ebp - 0x6cfc]
lea edx, [ebp - 0x6d2c]
mov dword [ebp - 0x6d2c], 0
mov dword [ebp - 0x6d44], 0
push edx
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x84]
call eax
cmp dword [ebp - 0x6d2c], 0
je 0x518dbf
mov eax, dword [ebp - 0x6cfc]
lea edx, [ebp - 0x6d44]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x8c]
call eax
push dword [ebp - 0x6d2c]
lea ecx, [ebp - 0x234c]
call fcn.005dc510
mov ecx, dword [ebp - 0x6d44]
call fcn.005d8c40
test eax, eax
je 0x518b9a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6d44]
lea ecx, [ebp - 0x234c]
push 0x62438c
call fcn.005da780
push 3
push 1
lea ecx, [ebp - 0x234c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21a8]
call fcn.005dc260
lea edx, [edi + 0x1a8]
mov ecx, eax
call fcn.005e88c0
test al, al
jne 0x518bab
push dword [ebp - 0x6d2c]
lea ecx, [ebp - 0x21a8]
call fcn.005dc510
push 0
push 1
push 0x62439c
push 0x624388
lea ecx, [ebp - 0x21a8]
call fcn.005da270
push dword [ebp - 0x6d2c]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
call esi
mov eax, dword [ebp - 0x6d44]
test eax, eax
je 0x518bdf
push eax
call esi
lea ecx, [ebp - 0x21a8]
call fcn.005dbeb0
test al, al
jne 0x518dbf
push 0
push 1
push 1
push 0
push str._temp_
lea ecx, [ebp - 0x21a8]
call fcn.005daa70
xor ecx, ecx
test eax, eax
lea eax, [ebp - 0x219c]
setg cl
mov dword [ebp - 0x6f80], ecx
lea ecx, [ebp - 0x2490]
push eax
call fcn.005dc4e0
push 0
push 1
push 0xffffffffffffffff
push 0
push str..job
lea ecx, [ebp - 0x2490]
call fcn.005daa70
test eax, eax
jne 0x518c60
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str..job
lea ecx, [ebp - 0x2490]
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Tasks_
push dword [edi + 0x1ac]
lea ecx, [ebp - 0x2490]
call fcn.005da510
push 0
lea ecx, [ebp - 0x2490]
call fcn.005dc190
push eax
lea eax, [ebp - 0x21a8]
mov ecx, edi
push eax
call fcn.00511450
test al, al
je 0x518cb1
mov esi, 1
jmp 0x518cd3
lea ecx, [ebp - 0x21a8]
call fcn.005dc190
push eax
push 0
call dword [sym.imp.sfc.dll_SfcIsFileProtected]
test eax, eax
jne 0x518dbf
mov esi, dword [ebp - 0x6f80]
push 0
lea ecx, [ebp - 0x21a8]
call fcn.005dc190
push eax
push 0
push esi
lea ecx, [ebp - 0x21a8]
call fcn.005dc190
push eax
push str._All_users_
lea ecx, [ebp - 0x219c]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 0xffffffffffffffff
push 0xd
push dword [eax + 0xa4]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x518dbf
push 0
push 0
push 0
push 0
push 0
push 0
push str._All_users_
lea ecx, [ebp - 0x21a8]
call fcn.005dc190
push eax
push 0
push 0xd
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
test esi, esi
mov ecx, str.Un_checked
push 0x62781c
mov eax, str.Checked
cmove eax, ecx
lea ecx, [ebp - 0x234c]
push eax
push str._r_n_t_tItem_state:
call fcn.005dc190
push eax
push str._r_n_t_tCommand:
push str._r_n_t_tUser_name:__All_users_
lea ecx, [ebp - 0x219c]
call fcn.005dc190
push eax
push str._r_n_t_tTask_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea ecx, [ebp - 0x6cfc]
mov byte [ebp - 4], 0x60
call fcn.00402e10
mov eax, dword [ebp - 0x6f8c]
inc eax
mov esi, eax
mov dword [ebp - 0x6f8c], eax
cmp eax, dword [ebp - 0x2494]
jb 0x518a30
push dword [ebp - 0x6d40]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x6d34]
lea edx, [ebp - 0x2494]
push edx
lea edx, [ebp - 0x6d40]
push edx
mov ecx, dword [eax]
push 5
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jns 0x518a11
lea ecx, [ebp - 0x6d34]
mov byte [ebp - 4], 0x52
call fcn.00402e10
jmp 0x517ec6
mov esi, dword [ebp - 0x6fa4]
inc esi
lea ecx, [ebp - 0x29f4]
mov dword [ebp - 0x6fa4], esi
call fcn.005d9210
cmp esi, eax
jb 0x5180c0
lea ecx, [ebp - 0x29f4]
mov byte [ebp - 4], 0x62
call fcn.005d9280
mov esi, dword [ebp - 0x6f78]
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x518002
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5197e0
push 0
push str._r_n_tDNS_hijackers_scan:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
push 4
lea ecx, [ebp - 0x2304]
mov dword [ebp - 0x6fd0], str.HKLMSYSTEMCurrentControlSetServicesTcpipParametersInterfaces
mov dword [ebp - 0x6fcc], str.HKLMSYSTEMCurrentControlSetServicesTcpip6ParametersInterfaces
call fcn.00401d80
lea ecx, [ebp - 0x2304]
call fcn.005d6aa0
push 4
lea ecx, [ebp - 0x2434]
mov byte [ebp - 4], 0x64
call fcn.00401d80
lea ecx, [ebp - 0x2434]
call fcn.005d6aa0
push 0xc
lea ecx, [ebp - 0x20cc]
mov byte [ebp - 4], 0x65
call fcn.00401d40
lea ecx, [ebp - 0x20cc]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x272c]
mov byte [ebp - 4], 0x66
call fcn.00401d40
lea ecx, [ebp - 0x272c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x27b0]
mov byte [ebp - 4], 0x67
call fcn.00401d40
lea ecx, [ebp - 0x27b0]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x6db4]
mov byte [ebp - 4], 0x68
call fcn.00401d40
lea ecx, [ebp - 0x6db4]
call fcn.005d6ac0
xor ecx, ecx
mov byte [ebp - 4], 0x69
mov dword [ebp - 0x6f9c], ecx
nop dword [eax + eax]
push 0
push 0x20019
push dword [ebp + ecx*4 - 0x6fd0]
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x519775
lea eax, [ebp - 0x6cec]
xor esi, esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
mov dword [ebp - 0x6fa4], esi
call fcn.005d6380
test al, al
je 0x519775
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [ebp - 0x6f9c]
lea ecx, [ebp - 0x2114]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
push 0x624284
push dword [ebp + eax*4 - 0x6fd0]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x2114]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2304]
call fcn.005d6a30
test al, al
je 0x519753
lea eax, [ebp - 0x6db4]
mov dword [ebp - 0x6f8c], 0
push eax
push 0
lea ecx, [ebp - 0x2304]
call fcn.005d6380
test al, al
je 0x519401
mov eax, dword [ebp - 0x6f9c]
lea ecx, [ebp - 0x27b0]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6db4]
push 0x624284
push dword [ebp - 0x6cec]
push 0x624284
push dword [ebp + eax*4 - 0x6fd0]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x27b0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2434]
call fcn.005d6a30
test al, al
je 0x5193d3
lea eax, [ebp - 0x20cc]
push eax
push str.NameServer
lea ecx, [ebp - 0x2434]
call fcn.005d6740
test al, al
je 0x5193d3
lea ecx, [ebp - 0x20cc]
call fcn.005dbeb0
test al, al
jne 0x5193d3
push 0
push str.DNS_hijackers
lea ecx, [ebp - 0x20cc]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x5193d3
push 0
push 1
push 1
push 0
push str.8.8.8.8
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
je 0x519133
push 0
push 1
push 1
push 0
push str.8.8.4.4
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
jne 0x5193d3
push 0
push 1
push 1
push 0
push str.2001:4860:4860::8888
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
je 0x51916f
push 0
push 1
push 1
push 0
push str.2001:4860:4860::8844
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
jne 0x5193d3
push 0
push 1
push 1
push 0
push str.2001:4860:4860:0:0:0:0:8888
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
je 0x5191ab
push 0
push 1
push 1
push 0
push str.2001:4860:4860:0:0:0:0:8844
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
jne 0x5193d3
push 0
push 1
push 1
push 0
push str.2001:4860:4860::6464
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
je 0x5191e7
push 0
push 1
push 1
push 0
push str.2001:4860:4860::64
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
jne 0x5193d3
push 0
push 1
push 1
push 0
push str.2001:4860:4860:0:0:0:0:6464
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
je 0x519223
push 0
push 1
push 1
push 0
push str.2001:4860:4860:0:0:0:0:64
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
jne 0x5193d3
push 0
push 0x66dad8
lea ecx, [ebp - 0x20cc]
mov dword [ebp - 0x6f80], 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x28a4]
call fcn.005d9070
lea ecx, [ebp - 0x28a4]
xor esi, esi
call fcn.005d9210
test eax, eax
je 0x51a4ea
push 1
push esi
lea ecx, [ebp - 0x28a4]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x272c]
call fcn.005dc260
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x5192d1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Adware_
lea ecx, [edi + 0x33c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x272c]
call fcn.005da510
lea ecx, [ebp - 0x272c]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x51a4e0
lea ecx, [ebp - 0x28a4]
inc esi
call fcn.005d9210
cmp esi, eax
jb 0x519260
mov esi, dword [ebp - 0x6f80]
push 0
push 0
push 0
push esi
lea ecx, [ebp - 0x27b0]
call fcn.005dc190
push eax
push str._All_users_
lea ecx, [ebp - 0x20cc]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 0xffffffffffffffff
push 0xf
push dword [eax + 0xa4]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x5193d3
push 0
push 0
push 0
push 0
push 0
push str.NameServer
push str._All_users_
push 0
lea ecx, [ebp - 0x27b0]
call fcn.005dc190
push eax
push 0xf
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0x62781c
test esi, esi
mov ecx, str.Un_checked
mov eax, str.Checked
cmove eax, ecx
lea ecx, [ebp - 0x27b0]
push eax
push str._r_n_t_tItem_state:
push str._r_n_t_tValue_name:_NameServer
call fcn.005dc190
push eax
push str._r_n_t_tRegistry_key:
push str._r_n_t_tUser_name:__All_users_
lea ecx, [ebp - 0x20cc]
call fcn.005dc190
push eax
push str._r_n_t_tName:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6f8c]
lea ecx, [ebp - 0x6db4]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x2304]
mov dword [ebp - 0x6f8c], eax
call fcn.005d6380
test al, al
jne 0x519041
mov esi, dword [ebp - 0x6fa4]
lea eax, [ebp - 0x20cc]
push eax
push str.NameServer
lea ecx, [ebp - 0x2304]
call fcn.005d6740
test al, al
je 0x519753
lea ecx, [ebp - 0x20cc]
call fcn.005dbeb0
test al, al
jne 0x519753
push 0
push str.DNS_hijackers
lea ecx, [ebp - 0x20cc]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x519753
push 0
push 1
push 1
push 0
push str.8.8.8.8
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
je 0x519491
push 0
push 1
push 1
push 0
push str.8.8.4.4
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
jne 0x519753
push 0
push 1
push 1
push 0
push str.2001:4860:4860::8888
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
je 0x5194cd
push 0
push 1
push 1
push 0
push str.2001:4860:4860::8844
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
jne 0x519753
push 0
push 1
push 1
push 0
push str.2001:4860:4860:0:0:0:0:8888
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
je 0x519509
push 0
push 1
push 1
push 0
push str.2001:4860:4860:0:0:0:0:8844
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
jne 0x519753
push 0
push 1
push 1
push 0
push str.2001:4860:4860::6464
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
je 0x519545
push 0
push 1
push 1
push 0
push str.2001:4860:4860::64
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
jne 0x519753
push 0
push 1
push 1
push 0
push str.2001:4860:4860:0:0:0:0:6464
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
je 0x519581
push 0
push 1
push 1
push 0
push str.2001:4860:4860:0:0:0:0:64
lea ecx, [ebp - 0x20cc]
call fcn.005daa70
test eax, eax
jne 0x519753
push 0
push 0x66dad8
lea ecx, [ebp - 0x20cc]
mov dword [ebp - 0x6f8c], 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x28a4]
call fcn.005d9070
lea ecx, [ebp - 0x28a4]
mov dword [ebp - 0x6f78], 0
call fcn.005d9210
test eax, eax
je 0x51a501
mov ecx, dword [ebp - 0x6f78]
nop dword [eax]
push 1
push ecx
lea ecx, [ebp - 0x28a4]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x272c]
call fcn.005dc260
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x519641
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Adware_
lea ecx, [edi + 0x33c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x272c]
call fcn.005da510
lea ecx, [ebp - 0x272c]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x51a4f1
inc dword [ebp - 0x6f78]
lea ecx, [ebp - 0x28a4]
call fcn.005d9210
mov ecx, dword [ebp - 0x6f78]
cmp ecx, eax
jb 0x5195d0
mov eax, dword [ebp - 0x6f8c]
push 0
push 0
push 0
push eax
lea ecx, [ebp - 0x2114]
call fcn.005dc190
push eax
push str._All_users_
lea ecx, [ebp - 0x20cc]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 0xffffffffffffffff
push 0xf
push dword [eax + 0xa4]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x519753
push 0
push 0
push 0
push 0
push 0
push str.NameServer
push str._All_users_
push 0
lea ecx, [ebp - 0x2114]
call fcn.005dc190
push eax
push 0xf
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
cmp dword [ebp - 0x6f8c], 0
mov ecx, str.Un_checked
push 0
push 0
push 0
push 0x62781c
mov eax, str.Checked
cmove eax, ecx
lea ecx, [ebp - 0x2114]
push eax
push str._r_n_t_tItem_state:
push str._r_n_t_tValue_name:_NameServer
call fcn.005dc190
push eax
push str._r_n_t_tRegistry_key:
push str._r_n_t_tUser_name:__All_users_
lea ecx, [ebp - 0x20cc]
call fcn.005dc190
push eax
push str._r_n_t_tName:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x6cec]
inc esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
mov dword [ebp - 0x6fa4], esi
call fcn.005d6380
test al, al
jne 0x518fc0
mov ecx, dword [ebp - 0x6f9c]
inc ecx
mov dword [ebp - 0x6f9c], ecx
cmp ecx, 2
jb 0x518f70
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa4]
call fcn.005bb910
lea ecx, [ebp - 0x6db4]
call fcn.005d6ab0
lea ecx, [ebp - 0x27b0]
call fcn.005dc430
lea ecx, [ebp - 0x272c]
call fcn.005dc430
lea ecx, [ebp - 0x20cc]
call fcn.005dc430
lea ecx, [ebp - 0x2434]
call fcn.005d69e0
lea ecx, [ebp - 0x2304]
call fcn.005d69e0
lea ecx, [ebp - 0x28a4]
call fcn.005d9280
lea ecx, [ebp - 0x6d0c]
call fcn.00402e10
lea ecx, [ebp - 0x6d10]
call fcn.00402e10
lea ecx, [ebp - 0x21a8]
call fcn.005dc430
lea ecx, [ebp - 0x2490]
call fcn.005dc430
lea ecx, [ebp - 0x2ba8]
call fcn.005e9080
lea ecx, [ebp - 0x258c]
call fcn.005dc430
lea ecx, [ebp - 0x234c]
call fcn.005dc430
lea ecx, [ebp - 0x219c]
call fcn.005dc430
lea ecx, [ebp - 0x2824]
call fcn.005dc430
lea ecx, [ebp - 0x2418]
call fcn.005dc430
lea ecx, [ebp - 0x2084]
mov byte [ebp - 4], 0x46
call fcn.005dc430
mov eax, dword [ebp - 0x6f7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667fb0
push 0x624284
lea ecx, [eax + 0x140]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2780]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x2780]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x21e0]
call fcn.005dd360
mov edi, dword [ebp - 0x6f7c]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51a62e
test dword [edi + 0x34], 0x1000
jne 0x51a62e
movsd xmm0, qword [edi + 0x390]
ucomisd xmm0, qword [0x6edb08]
lahf
test ah, 0x44
jp 0x51a62e
push 0
push str._r_n_r_n__Microsoft_Edge__UWP__scan:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push str.Scanning_Microsoft_Edge...
push dword [eax + 0x38]
call fcn.005bcd30
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x26
push dword [eax + 0x34]
call fcn.005b9910
push 0xc
lea ecx, [ebp - 0x221c]
call fcn.00401d40
lea ecx, [ebp - 0x221c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x28f4]
mov byte [ebp - 4], 0x6a
call fcn.00401d40
lea ecx, [ebp - 0x28f4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2580]
mov byte [ebp - 4], 0x6b
call fcn.00401d40
lea ecx, [ebp - 0x2580]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x261c]
mov byte [ebp - 4], 0x6c
call fcn.00401d40
lea ecx, [ebp - 0x261c]
call fcn.005dc5e0
push 0
push str._r_n_tMicrosoft_Edge_extensions:_r_n
lea ecx, [ebp - 0x1fc8]
mov byte [ebp - 4], 0x6d
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa8]
call fcn.005bb910
xor esi, esi
mov dword [ebp - 0x6f78], esi
cmp dword [edi + 0x30], esi
jbe 0x519c30
lea ecx, [edi + 0x104]
nop dword [eax]
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x519c1a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.AppContainerStoragemicrosoft.microsoftedge_8wekyb3d8bbweMicrosoftEdgeExtensions
push 0x66dca8
push esi
lea ecx, [edi + 0x104]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x221c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x221c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x519c1a
xor esi, esi
nop dword [eax + eax]
lea eax, [ebp - 0x6cec]
push eax
push esi
lea ecx, [ebp - 0x1f74]
call fcn.005d6380
test al, al
je 0x519c0e
push 8
push 0
push 0x627830
push str..___.___.
push 1
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x261c]
call fcn.005dc260
mov ecx, eax
call fcn.005d9660
push 0
push str.Microsoft_Edge_extensions
lea ecx, [ebp - 0x261c]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x519c04
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x221c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2580]
call fcn.005dc200
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2580]
call fcn.005dc190
push eax
push dword [ebp - 0x6f78]
lea ecx, [edi + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x261c]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 4
push 0x18
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x519c04
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6f78]
lea ecx, [edi + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x2580]
call fcn.005dc190
push eax
push 0x18
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Un_checked_r_n
push dword [ebp - 0x6cec]
lea ecx, [edi + 0x114]
push str._r_n_t_tFull_extension_name:
push dword [ebp - 0x6f78]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x261c]
call fcn.005dc190
push eax
push str._r_n_t_tExtension_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
inc esi
cmp esi, 2
jb 0x519a60
mov dword [ebp - 0x6fa4], esi
mov esi, dword [ebp - 0x6f78]
inc esi
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f78], esi
cmp esi, dword [edi + 0x30]
jb 0x5199e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51a5fe
push 0
push str._r_n_tMicrosoft_Edge__UWP__reset_options:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
xor esi, esi
cmp dword [edi + 0x30], esi
jbe 0x519f5b
lea ecx, [edi + 0x104]
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x519f4b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.AppContainerStoragemicrosoft.microsoftedge_8wekyb3d8bbweMicrosoftEdgeExtensions
push 0x66dca8
push esi
lea ecx, [edi + 0x104]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x221c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x221c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
lea eax, [ebp - 0x6cec]
push eax
push 0
lea ecx, [ebp - 0x1f74]
call fcn.005d6380
test al, al
je 0x519df0
push 0
push str.Microsoft_Edge_reset_options
push str.Reset_Edge_extensions
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x519f4b
push 0
push 0
push 0
push 0
push str.This_option_allows_you_to_remove_all_MS_Edges_extensions_at_once__for_this_user
push esi
lea ecx, [edi + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Edge_extensions
push 4
push 0x1a
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x519f4b
push 0
push 0
push 0
push 0
push 0
push 0
push esi
lea ecx, [edi + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x221c]
call fcn.005dc190
push eax
push 0x1a
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Un_checked_r_n
push str.This_option_allows_you_to_remove_all_MS_Edges_extensions_at_once__for_this_user
push str._r_n_t_tInfo:
push esi
lea ecx, [edi + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_Edge_extensions
push str._r_n_t_tReset_option:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.AppContainerStoragemicrosoft.microsoftedge_8wekyb3d8bbweMicrosoftEdgeMain
push 0x66dca8
push esi
lea ecx, [edi + 0x104]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x221c]
call fcn.005dc200
lea ecx, [ebp - 0x221c]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
je 0x519f4b
push 0
push str.Microsoft_Edge_reset_options
push str.Reset_Edge_Main_settings
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x519f4b
push 0
push 0
push 0
push 0
push str.This_option_allows_you_to_reset_MS_Edges_main_settings__for_this_user
push esi
lea ecx, [edi + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Edge_Main_settings
push 4
push 0x1a
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x519f4b
push 0
push 0
push 0
push 0
push 0
push 0
push esi
lea ecx, [edi + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x221c]
call fcn.005dc190
push eax
push 0x1a
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Un_checked_r_n
push str.This_option_allows_you_to_reset_MS_Edges_main_settings__for_this_user
push str._r_n_t_tInfo:
push esi
lea ecx, [edi + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_Edge_Main_settings
push str._r_n_t_tReset_option:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
inc esi
lea ecx, [edi + 0x104]
cmp esi, dword [edi + 0x30]
jb 0x519c62
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51a5fe
xor eax, eax
mov dword [ebp - 0x6fb8], str.ProtectedHomepages
mov dword [ebp - 0x6fb4], str.ProtectedSearchScopes
mov dword [ebp - 0x6fd0], str.Reset_Edge_Start_Pages
mov dword [ebp - 0x6fcc], str.Reset_Edge_Search_Providers
mov dword [ebp - 0x6f90], str.Check_this_item_if_you_want_to_reset_Microsoft_Edges_Start_pages.
mov dword [ebp - 0x6f8c], str.Check_this_item_if_you_want_to_reset_Microsoft_Edges_Search_providers
mov dword [ebp - 0x6f78], eax
cmp dword [edi + 0x30], eax
jbe 0x51a19b
lea edx, [edi + 0x104]
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Protected___It_is_a_violation_of_Windows_Policy_to_modify._See_aka.ms_browserpolicy
push str.AppContainerStoragemicrosoft.microsoftedge_8wekyb3d8bbweMicrosoftEdge_
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersion_
push eax
mov ecx, edx
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x221c]
call fcn.005dc200
lea ecx, [ebp - 0x221c]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
je 0x51a17f
xor esi, esi
nop dword [eax + eax]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51a179
lea ecx, [ebp - 0x221c]
call fcn.005dc190
mov edx, dword [ebp + esi*4 - 0x6fb8]
mov ecx, eax
call fcn.005d3780
test al, al
je 0x51a16f
push 0
push str.Microsoft_Edge_reset_options
push dword [ebp + esi*4 - 0x6fd0]
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51a16f
push 0
push 0
push 0
push 0
push dword [ebp + esi*4 - 0x6f90]
lea ecx, [edi + 0x114]
push dword [ebp - 0x6f78]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push dword [ebp + esi*4 - 0x6fd0]
mov eax, dword [edi + 8]
mov ecx, edi
push 4
push 0x1a
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51a16f
push 0
push 0
push 0
push 0
push 0
push dword [ebp + esi*4 - 0x6fb8]
lea ecx, [edi + 0x114]
push dword [ebp - 0x6f78]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x221c]
call fcn.005dc190
push eax
push 0x1a
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Un_checked_r_n
push dword [ebp + esi*4 - 0x6f90]
lea ecx, [edi + 0x114]
push str._r_n_t_tInfo:
push dword [ebp - 0x6f78]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push dword [ebp + esi*4 - 0x6fd0]
lea ecx, [ebp - 0x1f80]
push str._r_n_t_tReset_option:
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
inc esi
cmp esi, 2
jb 0x51a020
mov dword [ebp - 0x6fa4], esi
mov eax, dword [ebp - 0x6f78]
lea edx, [edi + 0x104]
inc eax
mov dword [ebp - 0x6f78], eax
cmp eax, dword [edi + 0x30]
jb 0x519fc0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51a5fe
mov dword [ebp - 0x6fb8], str.Settings.xbf
xor esi, esi
mov dword [ebp - 0x6fb4], str.ExpertSettings.xbf
mov dword [ebp - 0x6fd0], str.Reset_Edges_Settings
mov dword [ebp - 0x6fcc], str.Reset_Edges_Expert_Settings
mov dword [ebp - 0x6f90], str.Check_this_item_if_you_want_to_reset_Microsoft_Edges_main_settings
mov dword [ebp - 0x6f8c], str.Check_this_item_if_you_want_to_reset_Microsoft_Edges_expert_settings
nop dword [eax + eax]
push 0
push str.Microsoft_Edge_reset_options
push dword [ebp + esi*4 - 0x6fd0]
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51a31a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + esi*4 - 0x6fb8]
lea ecx, [ebp - 0x25b0]
push str.SystemAppsMicrosoft.MicrosoftEdge_8wekyb3d8bbwe_
call fcn.005dc190
push eax
lea ecx, [ebp - 0x221c]
call fcn.005dc200
lea ecx, [ebp - 0x221c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x51a31a
mov eax, dword [edi + 8]
mov ecx, edi
push 0
push 0
push 0
push 0
push dword [ebp + esi*4 - 0x6f90]
push str._All_users_
push dword [ebp + esi*4 - 0x6fd0]
push 4
push 0x1a
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51a31a
push 0
push 0
push 0
push 0
push 0
push 0
push str._All_users_
lea ecx, [ebp - 0x221c]
call fcn.005dc190
push eax
push 0
push 0x1a
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Un_checked_r_n
push dword [ebp + esi*4 - 0x6f90]
lea ecx, [ebp - 0x1f80]
push str._r_n_t_tInfo:
push str._r_n_t_tUser_name:__All_users_
push dword [ebp + esi*4 - 0x6fd0]
push str._r_n_t_tReset_option:
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
inc esi
cmp esi, 2
jb 0x51a1f0
push 4
lea ecx, [ebp - 0x2360]
mov dword [ebp - 0x6fa4], esi
call fcn.00401d80
lea ecx, [ebp - 0x2360]
call fcn.005d6aa0
push 4
lea ecx, [ebp - 0x2444]
mov byte [ebp - 4], 0x6e
call fcn.00401d80
lea ecx, [ebp - 0x2444]
call fcn.005d6aa0
xor eax, eax
mov byte [ebp - 4], 0x6f
mov dword [ebp - 0x6f78], eax
cmp dword [edi + 0x30], eax
jbe 0x51a5c4
lea edx, [edi + 0x104]
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.AppContainerStoragemicrosoft.microsoftedge_8wekyb3d8bbweChildren
push str.Local_SettingsSoftwareMicrosoftWindowsCurrentVersion_
push str.SoftwareClasses
push eax
mov ecx, edx
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x221c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x221c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2360]
call fcn.005d6a30
test al, al
je 0x51a5a8
lea eax, [ebp - 0x6cec]
xor esi, esi
push eax
push esi
lea ecx, [ebp - 0x2360]
mov dword [ebp - 0x6fa4], esi
call fcn.005d6380
test al, al
je 0x51a5a8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Internet_ExplorerDOMStorage
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x221c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2580]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x2580]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2444]
call fcn.005d6a30
test al, al
je 0x51a4b9
lea ecx, [ebp - 0x2444]
call fcn.005d6280
cmp eax, 2
jb 0x51a4b9
push 0
push 0
push 0
push 0
push str.Check_this_item_if_you_want_to_reset_Microsoft_Edges_DOM_Storage
push dword [ebp - 0x6f78]
lea ecx, [edi + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Edges_DOM_Storage
push 4
push 0x1a
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
jne 0x51a508
lea eax, [ebp - 0x6cec]
inc esi
push eax
push esi
lea ecx, [ebp - 0x2360]
mov dword [ebp - 0x6fa4], esi
call fcn.005d6380
test al, al
jne 0x51a406
jmp 0x51a5a8
mov esi, 1
jmp 0x5192eb
xor esi, esi
jmp 0x5192eb
mov eax, 1
mov dword [ebp - 0x6f8c], eax
jmp 0x519666
xor eax, eax
jmp 0x519666
mov esi, dword [ebp - 0x6f78]
lea ecx, [edi + 0x114]
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x2580]
call fcn.005dc190
push eax
push 0x1a
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Un_checked_r_n
push str.Check_this_item_if_you_want_to_reset_Microsoft_Edges_DOM_Storage
push str._r_n_t_tInfo:
push esi
lea ecx, [edi + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str._r_n_t_tReset_option:_Reset_Edges_DOM_Storage
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6f78]
lea edx, [edi + 0x104]
inc eax
mov dword [ebp - 0x6f78], eax
cmp eax, dword [edi + 0x30]
jb 0x51a380
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa8]
call fcn.005bb910
push 1
push 0
push 0
lea ecx, [ebp - 0x21e0]
call fcn.005dca80
lea ecx, [ebp - 0x2444]
call fcn.005d69e0
lea ecx, [ebp - 0x2360]
call fcn.005d69e0
lea ecx, [ebp - 0x261c]
call fcn.005dc430
lea ecx, [ebp - 0x2580]
call fcn.005dc430
lea ecx, [ebp - 0x28f4]
call fcn.005dc430
lea ecx, [ebp - 0x221c]
mov byte [ebp - 4], 0x46
call fcn.005dc430
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51cdf2
test dword [edi + 0x34], 0x1000
jne 0x51cdf2
push 0
push str._r_n_r_n__Microsoft_Edge_scan:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push str.Scanning_Microsoft_Edge...
push dword [eax + 0x38]
call fcn.005bcd30
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x26
push dword [eax + 0x34]
call fcn.005b9910
push 0xc
lea ecx, [ebp - 0x20c0]
call fcn.00401d40
lea ecx, [ebp - 0x20c0]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x201c]
mov byte [ebp - 4], 0x70
call fcn.00401d40
lea ecx, [ebp - 0x201c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2400]
mov byte [ebp - 4], 0x71
call fcn.00401d40
lea ecx, [ebp - 0x2400]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x1ff4]
mov byte [ebp - 4], 0x72
call fcn.00401d40
lea ecx, [ebp - 0x1ff4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x22d0]
mov byte [ebp - 4], 0x73
call fcn.00401d40
lea ecx, [ebp - 0x22d0]
call fcn.005dc5e0
push 0x24
lea ecx, [ebp - 0x2548]
mov byte [ebp - 4], 0x74
call fcn.004020b0
lea ecx, [ebp - 0x2548]
call fcn.005b5fe0
mov byte [ebp - 4], 0x75
xor esi, esi
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
mov dword [ebp - 0x6f8c], esi
push dword [eax + 0xa8]
call fcn.005bb910
push esi
push str._r_n_tMS_Edges_startup_and_home_pages:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov dword [ebp - 0x6f78], esi
cmp dword [edi + 0x30], esi
jbe 0x51ad3c
mov esi, dword [ebp - 0x6fa8]
mov dword [ebp - 0x6fb4], esi
lea ecx, [ebp - 0x22d0]
call fcn.005dbeb0
test al, al
je 0x51a7bc
lea eax, [ebp - 0x22d0]
push eax
push 1
lea ecx, [ebp - 0x2160]
call fcn.005dc190
push dword [ebp - 0x6f78]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0058f340
mov esi, dword [ebp - 0x6fb4]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51ad36
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MicrosoftEdgeUser_Dataf
lea ecx, [ebp - 0x2160]
call fcn.005dc190
push eax
push dword [ebp - 0x6f78]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20c0]
call fcn.005dc200
push 0x260
lea ecx, [ebp - 0x4d10]
call fcn.00401d60
push 1
lea ecx, [ebp - 0x20c0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4d10]
call fcn.00401130
push 3
lea ecx, [ebp - 0x20c0]
mov byte [ebp - 4], 0x76
call fcn.005dadc0
lea ecx, [ebp - 0x4d10]
call fcn.00401270
test al, al
je 0x51ad08
nop
push 1
lea ecx, [ebp - 0x4d10]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc510
push str.Default
lea ecx, [ebp - 0x201c]
call fcn.005dc480
test al, al
je 0x51a8ae
push 0
push 1
push 1
push 0
push str.Profile
lea ecx, [ebp - 0x201c]
call fcn.005daa70
cmp eax, 1
jne 0x51acf5
inc dword [ebp - 0x6f8c]
lea ecx, [ebp - 0x4d10]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Secure_Preferences
push 1
call fcn.004012d0
push eax
lea ecx, [ebp - 0x20c0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc200
push 0x100
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2548]
call fcn.005b5da0
test al, al
je 0x51acf5
lea eax, [ebp - 0x1ff4]
push eax
push 0x629fdc
push str.homepage
lea ecx, [ebp - 0x2548]
call fcn.005b5530
test eax, eax
je 0x51aac7
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51aac7
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51aac7
push str.about:blank
lea ecx, [ebp - 0x1ff4]
call fcn.005dc4c0
test al, al
jne 0x51aac7
push 0
push 1
push 1
push 0
push str.:__www.yahoo.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51aac7
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51aac7
push eax
push str.Microsoft_Edge_startup_pages
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51aac7
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Home_page
push 0
push 0x6f
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51aac7
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
push str.homepage
push 0x6f
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
push str._r_n_t_tHomepage:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x2b04]
mov dword [ebp - 0x6f50], 0
push eax
push 0x629fdc
xorps xmm0, xmm0
lea ecx, [ebp - 0x2548]
push str.session__startup_urls
movups xmmword [ebp - 0x6f60], xmm0
call fcn.005b5630
test al, al
je 0x51acf5
lea eax, [ebp - 0x2b04]
push eax
lea eax, [ebp - 0x6f60]
push eax
lea ecx, [ebp - 0x2548]
call fcn.005b4c80
test al, al
je 0x51acf5
lea eax, [ebp - 0x1ff4]
push eax
lea eax, [ebp - 0x6f60]
push eax
lea ecx, [ebp - 0x2548]
call fcn.005b4f90
test eax, eax
je 0x51acd4
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51acf5
push eax
push 1
push 1
push eax
push str.google:baseURL
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51acf5
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51acf5
push eax
push 1
push 1
push eax
push str.search.yahoo.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51acf5
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51acf5
push eax
push str.MS_Ege_startup_pages
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51acd4
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Startup_page
push 0
push 0x6f
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51acd4
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
push str.session__startup_urls
push 0x6f
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
push str._r_n_t_tStartup_page:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x2b04]
push eax
lea eax, [ebp - 0x6f60]
push eax
lea ecx, [ebp - 0x2548]
call fcn.005b4c80
test al, al
jne 0x51ab20
lea ecx, [ebp - 0x4d10]
call fcn.00401230
test al, al
jne 0x51a860
lea ecx, [ebp - 0x4d10]
mov byte [ebp - 4], 0x75
call fcn.00401180
mov eax, dword [ebp - 0x6f78]
add esi, 0xc
inc eax
mov dword [ebp - 0x6fb4], esi
mov dword [ebp - 0x6f78], eax
cmp eax, dword [edi + 0x30]
jb 0x51a770
mov esi, dword [ebp - 0x6f8c]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51cdac
test esi, esi
jne 0x51ad74
lea ecx, [ebp - 0x22d0]
call fcn.005dbeb0
test al, al
je 0x51ad74
push esi
push str._r_n_tNo_Edge_profiles_have_been_found:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
jmp 0x51cdac
push 0
push str._r_n_tMS_Edge_search_providers:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
cmp dword [edi + 0x30], 0
mov dword [ebp - 0x6f8c], 0
jbe 0x51b0ff
mov esi, dword [ebp - 0x6fa8]
mov dword [ebp - 0x6f78], esi
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51b0ff
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MicrosoftEdgeUser_Dataf
lea ecx, [ebp - 0x2160]
call fcn.005dc190
push eax
push dword [ebp - 0x6f8c]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20c0]
call fcn.005dc200
push 0x260
lea ecx, [ebp - 0x51d0]
call fcn.00401d60
push 1
lea ecx, [ebp - 0x20c0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x51d0]
call fcn.00401130
push 3
lea ecx, [ebp - 0x20c0]
mov byte [ebp - 4], 0x77
call fcn.005dadc0
lea ecx, [ebp - 0x51d0]
call fcn.00401270
test al, al
je 0x51b0d1
nop dword [eax]
push 1
lea ecx, [ebp - 0x51d0]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc510
push str.Default
lea ecx, [ebp - 0x201c]
call fcn.005dc480
test al, al
je 0x51ae9e
push 0
push 1
push 1
push 0
push str.Profile
lea ecx, [ebp - 0x201c]
call fcn.005daa70
cmp eax, 1
jne 0x51b0be
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Secure_Preferences
push 1
lea ecx, [ebp - 0x51d0]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x20c0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc200
push 0x100
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2548]
call fcn.005b5da0
test al, al
je 0x51b0be
lea eax, [ebp - 0x1ff4]
push eax
push 0x629fdc
push str.default_search_provider_data__template_url_data__url
lea ecx, [ebp - 0x2548]
call fcn.005b5530
test eax, eax
je 0x51b0be
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51b0be
push eax
push 1
push 1
push eax
push str.google:baseURL
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51b0be
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51b0be
push eax
push 1
push 1
push eax
push str.search.yahoo.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51b0be
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51b0be
push eax
push str.Microsoft_Edge_search_providers
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51b0be
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Default_search_provider
push 0
push 0x70
push dword [eax + 0xa8]
call fcn.0053ab00
mov esi, eax
cmp esi, 0xffffffff
je 0x51b0b8
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
push str.default_search_provider_data__template_url_data
push 0x70
push esi
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x201c]
call fcn.005dc190
mov esi, dword [ebp - 0x6f78]
mov ecx, esi
push eax
push str._r_n_t_tInfo:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
push str._r_n_t_tDefault_search_provider_URL:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
jmp 0x51b0be
mov esi, dword [ebp - 0x6f78]
lea ecx, [ebp - 0x51d0]
call fcn.00401230
test al, al
jne 0x51ae50
lea ecx, [ebp - 0x51d0]
mov byte [ebp - 4], 0x75
call fcn.00401180
mov eax, dword [ebp - 0x6f8c]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f8c], eax
cmp eax, dword [edi + 0x30]
jb 0x51ada6
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51cdac
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.WhiteListMicrosoft_Edge_Extensions
lea ecx, [edi + 0x33c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push str._r_n_tMS_Edge_extensions:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
cmp dword [edi + 0x30], 0
mov dword [ebp - 0x6f8c], 0
jbe 0x51b710
mov esi, dword [ebp - 0x6fa8]
mov dword [ebp - 0x6f78], esi
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51b710
push 0xc
lea ecx, [ebp - 0x2744]
call fcn.00401d40
lea ecx, [ebp - 0x2744]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x27bc]
mov byte [ebp - 4], 0x78
call fcn.00401d40
lea ecx, [ebp - 0x27bc]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2738]
mov byte [ebp - 4], 0x79
call fcn.00401d40
lea ecx, [ebp - 0x2738]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x26d0]
mov byte [ebp - 4], 0x7a
call fcn.00401d40
lea ecx, [ebp - 0x26d0]
call fcn.005dc5e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MicrosoftEdgeUser_Dataf
lea ecx, [ebp - 0x2160]
mov byte [ebp - 4], 0x7b
call fcn.005dc190
push eax
push dword [ebp - 0x6f8c]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20c0]
call fcn.005dc200
push 0x260
lea ecx, [ebp - 0x3a10]
call fcn.00401d60
push 1
lea ecx, [ebp - 0x20c0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3a10]
call fcn.00401130
push 3
lea ecx, [ebp - 0x20c0]
mov byte [ebp - 4], 0x7c
call fcn.005dadc0
lea ecx, [ebp - 0x3a10]
call fcn.00401270
test al, al
je 0x51b6b6
push 1
lea ecx, [ebp - 0x3a10]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc510
push str.Default
lea ecx, [ebp - 0x201c]
call fcn.005dc480
test al, al
je 0x51b2d1
push 0
push 1
push 1
push 0
push str.Profile
lea ecx, [ebp - 0x201c]
call fcn.005daa70
cmp eax, 1
jne 0x51b6a3
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Secure_Preferences
push 1
lea ecx, [ebp - 0x3a10]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x20c0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc200
push 0x100
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2548]
call fcn.005b5da0
test al, al
je 0x51b6a3
lea eax, [ebp - 0x2af0]
mov dword [ebp - 0x6f64], 0
push eax
push 0x629fdc
xorps xmm0, xmm0
lea ecx, [ebp - 0x2548]
push str.extensions__settings
movups xmmword [ebp - 0x6f74], xmm0
call fcn.005b5630
test al, al
je 0x51b6a3
lea eax, [ebp - 0x2af0]
push eax
lea eax, [ebp - 0x6f74]
push eax
lea ecx, [ebp - 0x2548]
call fcn.005b5050
test al, al
je 0x51b6a3
nop word [eax + eax]
lea eax, [ebp - 0x2744]
push eax
lea eax, [ebp - 0x6f74]
push eax
lea ecx, [ebp - 0x2548]
call fcn.005b55f0
test al, al
je 0x51b682
lea ecx, [ebp - 0x2744]
call fcn.005dc190
lea ecx, [ebp - 0x1f8c]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x51b67c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__manifest__name
lea ecx, [ebp - 0x2744]
call fcn.005dc190
push eax
push str.extensions__settings__
lea ecx, [ebp - 0x2738]
call fcn.005dc200
lea eax, [ebp - 0x27bc]
push eax
push 0x629fdc
lea ecx, [ebp - 0x2738]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2548]
call fcn.005b5530
test eax, eax
je 0x51b67c
lea ecx, [ebp - 0x27bc]
call fcn.005dc190
lea ecx, [ebp - 0x1f8c]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x51b67c
push 0
push str.Microsoft_Edge_extensions
lea ecx, [ebp - 0x27bc]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51b67c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__path
lea ecx, [ebp - 0x2744]
call fcn.005dc190
push eax
push str.extensions__settings__
lea ecx, [ebp - 0x2738]
call fcn.005dc200
lea eax, [ebp - 0x26d0]
push eax
push 0x629fdc
lea ecx, [ebp - 0x2738]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2548]
call fcn.005b5530
test eax, eax
je 0x51b52c
push 0
push 1
push 1
push 5
push 0x624518
lea ecx, [ebp - 0x26d0]
call fcn.005daa70
test eax, eax
jne 0x51b52c
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.Extensions_
push 1
lea ecx, [ebp - 0x3a10]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x20c0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x26d0]
call fcn.005da510
lea ecx, [ebp - 0x26d0]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x51b67c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2744]
call fcn.005dc190
push eax
push str.extensions__settings__
lea ecx, [ebp - 0x2738]
call fcn.005dc200
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x26d0]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x27bc]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 0
push 0x71
push dword [eax + 0xa8]
call fcn.0053ab00
mov esi, eax
cmp esi, 0xffffffff
je 0x51b67c
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x26d0]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2738]
call fcn.005dc190
push eax
push 0x71
push esi
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x26d0]
call fcn.005dc190
mov esi, dword [ebp - 0x6f78]
mov ecx, esi
push eax
push str._r_n_t_tPath:
call fcn.005dc190
push eax
push str.__r_n_t_tUser_name:
lea ecx, [ebp - 0x2744]
call fcn.005dc190
push eax
push 0x62d7ec
lea ecx, [ebp - 0x27bc]
call fcn.005dc190
push eax
push str._r_n_t_tExtension_found:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
jmp 0x51b682
mov esi, dword [ebp - 0x6f78]
lea eax, [ebp - 0x2af0]
push eax
lea eax, [ebp - 0x6f74]
push eax
lea ecx, [ebp - 0x2548]
call fcn.005b5050
test al, al
jne 0x51b390
lea ecx, [ebp - 0x3a10]
call fcn.00401230
test al, al
jne 0x51b283
lea ecx, [ebp - 0x3a10]
call fcn.00401180
lea ecx, [ebp - 0x26d0]
call fcn.005dc430
lea ecx, [ebp - 0x2738]
call fcn.005dc430
lea ecx, [ebp - 0x27bc]
call fcn.005dc430
lea ecx, [ebp - 0x2744]
mov byte [ebp - 4], 0x75
call fcn.005dc430
mov eax, dword [ebp - 0x6f8c]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f8c], eax
cmp eax, dword [edi + 0x30]
jb 0x51b170
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51cdac
push 0
push str._r_n_tMS_Edges_non_standard_shortcuts:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
lea ecx, [ebp - 0x6df4]
call fcn.00402740
mov byte [ebp - 4], 0x7d
lea ecx, [ebp - 0x6dcc]
mov eax, dword [edi + 8]
push str.Microsoft_Edge
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x6df4], eax
lea eax, [ebp - 0x21e0]
mov dword [ebp - 0x6ddc], eax
lea eax, [edi + 0x164]
mov dword [ebp - 0x6dd8], eax
lea eax, [ebp - 0x1fc8]
mov dword [ebp - 0x6df0], 0x72
mov dword [ebp - 0x6dd4], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x6dd0], eax
call fcn.005dc510
push 0xc
lea ecx, [ebp - 0x2284]
call fcn.00401d40
lea ecx, [ebp - 0x2284]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2248]
mov byte [ebp - 4], 0x7e
call fcn.00401d40
lea ecx, [ebp - 0x2248]
call fcn.005dc5e0
mov ecx, edi
mov byte [ebp - 4], 0x7f
call fcn.0050db30
test al, al
jne 0x51cd8b
xor esi, esi
mov dword [ebp - 0x6f78], esi
cmp dword [edi + 0x30], esi
jbe 0x51b987
nop
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51b987
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc3a0
cmp eax, 3
jl 0x51b977
lea eax, [ebp - 0x6dec]
push eax
push 1
lea ecx, [ebp - 0x2160]
call fcn.005dc190
push dword [ebp - 0x6f78]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0058f340
mov esi, dword [ebp - 0x6f78]
test al, al
je 0x51b977
push esi
lea ecx, [edi + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x250c]
mov dword [ebp - 0x6de0], eax
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2284]
call fcn.005dc200
lea ecx, [ebp - 0x2284]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x51b977
lea ecx, [ebp - 0x2284]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6df4]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51b987
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x25bc]
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2284]
call fcn.005dc200
lea ecx, [ebp - 0x2284]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x51b977
push 0
lea ecx, [ebp - 0x2284]
call fcn.005dbed0
lea ecx, [ebp - 0x2284]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6df4]
mov ecx, edi
push eax
call fcn.0052e3e0
inc esi
mov dword [ebp - 0x6f78], esi
cmp esi, dword [edi + 0x30]
jb 0x51b7f0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51cd8b
lea ecx, [ebp - 0x264c]
mov dword [ebp - 0x6de0], str._All_users_
call fcn.005dc190
push eax
lea eax, [ebp - 0x6df4]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51cd8b
lea eax, [ebp - 0x2640]
push eax
lea ecx, [ebp - 0x2284]
call fcn.005dc4e0
push 0
lea ecx, [ebp - 0x2284]
call fcn.005dbed0
lea ecx, [ebp - 0x2284]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6df4]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51cd8b
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x51ba7a
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareClientsStartMenuInternetMicrosoft_Edge_shellopencommand
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x51ba30
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREClientsStartMenuInternetMicrosoft_Edge_shellopencommand
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x51bae1
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREClientsStartMenuInternetMicrosoft_Edge_shellopencommand
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fac], 0
mov dword [ebp - 0x6f8c], 0
jbe 0x51bcdb
mov eax, dword [ebp - 0x6fa0]
mov esi, dword [ebp - 0x6fa8]
sub eax, esi
mov dword [ebp - 0x6fb4], eax
nop dword [eax]
push 0
push 0x20019
lea ecx, [esi + eax]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x51bcb9
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51bcdb
lea eax, [ebp - 0x2248]
push eax
push 0x62439c
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x51bcb9
push 0
push 1
push 1
push 0
push str.msedge.exe
lea ecx, [ebp - 0x2248]
call fcn.005daa70
lea ecx, [ebp - 0x2248]
mov dword [ebp - 0x6f80], eax
call fcn.005dc3a0
mov edx, dword [ebp - 0x6f80]
lea ecx, [edx + 0xa]
cmp eax, ecx
jle 0x51bcb9
lea eax, [edx + 0xb]
push eax
lea ecx, [ebp - 0x2248]
call fcn.005dad50
push 3
lea ecx, [ebp - 0x2248]
call fcn.005da0f0
lea ecx, [ebp - 0x2248]
call fcn.005dbeb0
test al, al
jne 0x51bcb9
push 0
push str.Microsoft_Edge_shortcuts
lea ecx, [ebp - 0x2248]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51bcb9
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2248]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Start_Menu_Internet_shortcut
push 0
push 0x72
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51bcb9
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
mov ecx, dword [ebp - 0x6fb4]
push eax
push 0
lea ecx, [esi + ecx]
call fcn.005dc190
push eax
push 0x72
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2248]
call fcn.005dc190
push eax
push str._r_n_t_tStart_Menu_Internet_shortcut_argument:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6f8c]
add esi, 0xc
inc eax
cmp eax, dword [ebp - 0x6fac]
mov dword [ebp - 0x6f8c], eax
mov eax, dword [ebp - 0x6fb4]
jb 0x51bb10
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51cd8b
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x51bd5a
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwarePoliciesMicrosoftEdge
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x51bd10
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftEdge
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x51bdc1
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREPoliciesMicrosoftEdge
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
push 0
push str._r_n_tMS_Edges_Group_Policies:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov esi, dword [ebp - 0x6fac]
mov dword [ebp - 0x6fb4], 0
test esi, esi
je 0x51c00e
mov eax, dword [ebp - 0x6fa0]
mov esi, dword [ebp - 0x6fa8]
sub eax, esi
mov dword [ebp - 0x6f8c], eax
nop
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51c008
mov ecx, dword [ebp - 0x6f8c]
push 0
push 0x20019
lea ecx, [esi + ecx]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
lea eax, [ebp - 0x1ff4]
push eax
push str.HomepageLocation
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x51bfec
lea eax, [ebp - 0x2184]
mov dword [ebp - 0x2184], 0
push eax
push str.HomepageIsNewTabPage
lea ecx, [ebp - 0x1f74]
call fcn.005d66b0
test al, al
je 0x51be81
cmp dword [ebp - 0x2184], 0
jne 0x51bfec
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51bfec
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51bfec
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51bfec
push eax
push 1
push 1
push eax
push str.:__www.yahoo.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51bfec
push eax
push str.Microsoft_Edge_group_policies
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51bfec
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.HomepageLocation
push 0
push 0x74
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51bfec
push 0
push 0
push 0
push 0
push 0
push str.HomepageLocation
mov ecx, esi
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
lea ecx, [esi + ecx]
call fcn.005dc190
push eax
push 0x74
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
push str._r_n_t_tMS_Edges_Default_Homepage_policy:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x51be00
mov esi, dword [ebp - 0x6fac]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51cd8b
push 0xc
lea ecx, [ebp - 0x26c4]
call fcn.00401d40
lea ecx, [ebp - 0x26c4]
call fcn.005dc5e0
mov byte [ebp - 4], 0x80
mov dword [ebp - 0x6fb4], 0
test esi, esi
je 0x51c2d7
mov eax, dword [ebp - 0x6fa0]
mov esi, dword [ebp - 0x6fa8]
sub eax, esi
mov dword [ebp - 0x6f8c], eax
nop
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51c2d1
mov ecx, dword [ebp - 0x6f8c]
push 0
push 0x20019
lea ecx, [esi + ecx]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
lea eax, [ebp - 0x1ff4]
push eax
push str.DefaultSearchProviderSearchURL
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x51c2b5
lea eax, [ebp - 0x2184]
mov dword [ebp - 0x2184], 0
push eax
push str.DefaultSearchProviderEnabled
lea ecx, [ebp - 0x1f74]
call fcn.005d66b0
test al, al
je 0x51c0e1
cmp dword [ebp - 0x2184], 0
je 0x51c2b5
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51c2b5
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51c2b5
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51c2b5
push eax
push 1
push 1
push eax
push str.:__www.yahoo.
lea ecx, [ebp - 0x1ff4]
call fcn.005daa70
test eax, eax
jne 0x51c2b5
push eax
push str.Microsoft_Edge_group_policies
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51c2b5
lea eax, [ebp - 0x26c4]
push eax
push str.DefaultSearchProviderName
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x51c2b5
lea ecx, [ebp - 0x26c4]
call fcn.005dbeb0
test al, al
jne 0x51c2b5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__search_provider_
lea ecx, [ebp - 0x26c4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2248]
call fcn.005dc200
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2248]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 0
push 0x74
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51c2b5
push 0
push 0
push 0
push 0
push 0
push str.DefaultSearchProviderSearchURL
mov ecx, esi
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
lea ecx, [esi + ecx]
call fcn.005dc190
push eax
push 0x74
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
push str._r_n_t_tMS_Edges_Default_Search_Provider_policy:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x51c060
mov esi, dword [ebp - 0x6fac]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51cd80
mov dword [ebp - 0x6fb4], 0
test esi, esi
je 0x51c557
mov esi, dword [ebp - 0x6fa8]
mov eax, dword [ebp - 0x6fa0]
sub eax, esi
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f80], eax
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51c557
mov eax, dword [ebp - 0x6f80]
add eax, esi
push 0
push 0x20019
mov ecx, eax
mov dword [ebp - 0x6f8c], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x51c535
lea eax, [ebp - 0x2184]
mov dword [ebp - 0x2184], 0
push eax
push str.RestoreOnStartup
lea ecx, [ebp - 0x1f74]
call fcn.005d66b0
test al, al
je 0x51c535
cmp dword [ebp - 0x2184], 4
jne 0x51c535
mov ecx, dword [ebp - 0x6f8c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RestoreOnStartupURLs
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x51c535
lea eax, [ebp - 0x6cec]
xor esi, esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
mov dword [ebp - 0x6fa4], esi
call fcn.005d62e0
test al, al
je 0x51c52f
lea eax, [ebp - 0x1ff4]
push eax
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x51c50d
lea ecx, [ebp - 0x1ff4]
call fcn.005dbeb0
test al, al
jne 0x51c50d
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 0x669320
push 0
push 0x74
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6fcc], eax
cmp eax, 0xffffffff
je 0x51c50d
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
call fcn.005dc190
push eax
push 0x74
push dword [ebp - 0x6fcc]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x1ff4]
call fcn.005dc190
push eax
push str._r_n_t_tMS_Edges_Startup_Page_policy:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x6cec]
inc esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
call fcn.005d62e0
test al, al
jne 0x51c400
mov dword [ebp - 0x6fa4], esi
mov esi, dword [ebp - 0x6f78]
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x51c312
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51cd80
push 0
push str._r_n_tMS_Edge_reset_options:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
cmp dword [edi + 0x30], 0
mov dword [ebp - 0x6f8c], 0
jbe 0x51c94b
mov esi, dword [ebp - 0x6fa8]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51c94b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MicrosoftEdgeUser_Dataf
lea ecx, [ebp - 0x2160]
call fcn.005dc190
push eax
push dword [ebp - 0x6f8c]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20c0]
call fcn.005dc200
push 0x260
lea ecx, [ebp - 0x3c70]
call fcn.00401d60
push 1
lea ecx, [ebp - 0x20c0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c70]
call fcn.00401130
push 3
lea ecx, [ebp - 0x20c0]
mov byte [ebp - 4], 0x81
call fcn.005dadc0
lea ecx, [ebp - 0x3c70]
call fcn.00401270
test al, al
je 0x51c923
nop word [eax + eax]
push 1
lea ecx, [ebp - 0x3c70]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc510
push str.Default
lea ecx, [ebp - 0x201c]
call fcn.005dc480
test al, al
je 0x51c68e
push 0
push 1
push 1
push 0
push str.Profile
lea ecx, [ebp - 0x201c]
call fcn.005daa70
cmp eax, 1
jne 0x51c910
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Secure_Preferences
push 1
lea ecx, [ebp - 0x3c70]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x20c0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc200
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x51c7cf
push 0
push str.Microsoft_Edge_reset_options
push str.Reset_Secure_Preferences
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51c7cf
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Secure_Preferences
push 0
push 0x73
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51c910
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
push 0
push 0x73
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_Secure_Preferences
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push str.Microsoft_Edge_reset_options
push str.Reset_Preferences
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51c910
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Preferences
push 1
lea ecx, [ebp - 0x3c70]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x20c0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc200
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x51c910
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Preferences
push 0
push 0x73
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51c910
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
push 0
push 0x73
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_Preferences
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea ecx, [ebp - 0x3c70]
call fcn.00401230
test al, al
jne 0x51c640
lea ecx, [ebp - 0x3c70]
mov byte [ebp - 4], 0x80
call fcn.00401180
mov eax, dword [ebp - 0x6f8c]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f8c], eax
cmp eax, dword [edi + 0x30]
jb 0x51c592
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51cd80
lea eax, [ebp - 0x22d0]
push eax
lea ecx, [ebp - 0x201c]
call fcn.005dc4e0
push 1
lea ecx, [ebp - 0x201c]
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.master_preferences
lea ecx, [ebp - 0x201c]
call fcn.005da780
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x51cb31
push 0
push str.Microsoft_Edge_reset_options
push str.Reset_Default_Preferences
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51cb31
push 0
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2548]
call fcn.005b5da0
test al, al
je 0x51cb31
lea eax, [ebp - 0x2a2c]
push eax
push 0x629fdc
push str.homepage
lea ecx, [ebp - 0x2548]
call fcn.005b5630
test al, al
jne 0x51ca79
lea eax, [ebp - 0x2a2c]
push eax
push 0x629fdc
push str.session__startup_urls
lea ecx, [ebp - 0x2548]
call fcn.005b5630
test al, al
jne 0x51ca79
lea eax, [ebp - 0x2a2c]
push eax
push 0x629fdc
push str.default_search_provider_data
lea ecx, [ebp - 0x2548]
call fcn.005b5630
test al, al
jne 0x51ca79
lea eax, [ebp - 0x2a2c]
push eax
push 0x629fdc
push str.extensions__settings
lea ecx, [ebp - 0x2548]
call fcn.005b5630
test al, al
je 0x51cb31
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str._All_users_
push str.Reset_Default_Preferences
push 0
push 0x73
push dword [eax + 0xa8]
call fcn.0053ab00
mov esi, eax
cmp esi, 0xffffffff
je 0x51cb31
push 0
push 0
push 0
push 0
push 0
push 0
push str._All_users_
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
push 0
push 0x73
push esi
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x201c]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
push str._r_n_t_tUser_name:__All_users_
push str._r_n_t_tOption_name:_Reset_Default_Preferences
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push str.Microsoft_Edge_reset_options
push str.Reset_MS_Edge_Policies
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51cd80
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x51cbb1
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwarePoliciesMicrosoftEdge
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x51cb67
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwarePoliciesMicrosoftEdge
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x51cc18
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SoftwarePoliciesMicrosoftEdge
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fac], 0
mov dword [ebp - 0x6fb4], 0
jbe 0x51cd5c
mov eax, dword [ebp - 0x6fa8]
sub eax, esi
mov dword [ebp - 0x6f8c], eax
nop dword [eax]
mov ecx, esi
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
je 0x51cd40
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51cd5c
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
lea ecx, [ecx + esi]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_MS_Edge_Policies
push 0
push 0x73
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51cd40
mov ecx, dword [ebp - 0x6f8c]
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ecx + esi]
call fcn.005dc190
push eax
push 0
mov ecx, esi
call fcn.005dc190
push eax
push 0x73
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
mov ecx, esi
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str._r_n_t_tInfo:
lea ecx, [ecx + esi]
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_MS_Edge_Policies
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x51cc40
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa8]
call fcn.005bb910
push 1
push 0
push 0
lea ecx, [ebp - 0x21e0]
call fcn.005dca80
lea ecx, [ebp - 0x26c4]
call fcn.005dc430
lea ecx, [ebp - 0x2248]
call fcn.005dc430
lea ecx, [ebp - 0x2284]
call fcn.005dc430
lea ecx, [ebp - 0x6df4]
call fcn.00402770
lea ecx, [ebp - 0x2548]
call fcn.00401e70
lea ecx, [ebp - 0x22d0]
call fcn.005dc430
lea ecx, [ebp - 0x1ff4]
call fcn.005dc430
lea ecx, [ebp - 0x2400]
call fcn.005dc430
lea ecx, [ebp - 0x201c]
call fcn.005dc430
lea ecx, [ebp - 0x20c0]
mov byte [ebp - 4], 0x46
call fcn.005dc430
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52015d
test dword [edi + 0x34], 0x1000
jne 0x52015d
push 0
push str._r_n_r_n__Internet_Explorer_scan:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push str.Scanning_Internet_Explorer...
push dword [eax + 0x38]
call fcn.005bcd30
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x28
push dword [eax + 0x34]
call fcn.005b9910
mov eax, dword [edi + 0x30]
xor esi, esi
mov dword [ebp - 0x7020], str.google.
mov dword [ebp - 0x701c], str.yahoo.
mov dword [ebp - 0x7018], str.microsoft.
mov dword [ebp - 0x7014], str..msn.com
mov dword [ebp - 0x7010], str..bing.com
mov dword [ebp - 0x700c], str.about:Tabs
mov dword [ebp - 0x7008], str.about:blank
mov dword [ebp - 0x7004], str.duckduckgo.
mov dword [ebp - 0x6ffc], str.Default_Page_URL
mov dword [ebp - 0x6ff8], str.Default_Search_URL
mov dword [ebp - 0x6ff4], str.Search_Page
mov dword [ebp - 0x6ff0], str.Start_Page
mov dword [ebp - 0x6fec], str.Start_Page_Redirect_Cache
mov dword [ebp - 0x6fe8], str.Default_Secondary_Page_URL
test eax, eax
je 0x51cf3a
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x51cef0
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x51cfa1
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
push 0xc
lea ecx, [ebp - 0x2004]
call fcn.00401d40
lea ecx, [ebp - 0x2004]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x23f4]
mov byte [ebp - 4], 0x82
call fcn.00401d40
lea ecx, [ebp - 0x23f4]
call fcn.005dc5e0
mov byte [ebp - 4], 0x83
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa8]
call fcn.005bb910
push 0
push str._r_n_tInternet_Explorer_home_and_search_pages:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov esi, dword [ebp - 0x6fac]
mov dword [ebp - 0x6fb4], 0
test esi, esi
je 0x51d233
mov esi, dword [ebp - 0x6fa8]
mov eax, dword [ebp - 0x6fa0]
sub eax, esi
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f80], eax
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51d22d
mov eax, dword [ebp - 0x6f80]
add eax, esi
push 0
push 0x20019
mov ecx, eax
mov dword [ebp - 0x6fcc], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x51d20b
xor esi, esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + esi*4 - 0x6ffc]
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x51d1f5
lea ecx, [ebp - 0x2004]
call fcn.005dbeb0
test al, al
jne 0x51d1f5
push 0
push str.IE_startup_pages
lea ecx, [ebp - 0x2004]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51d1f5
xor eax, eax
mov dword [ebp - 0x6f8c], eax
nop
push 0
push 1
push 1
push 0
push dword [ebp + eax*4 - 0x7020]
lea ecx, [ebp - 0x2004]
call fcn.005daa70
dec eax
cmp eax, 0x10
jbe 0x51d1f5
mov eax, dword [ebp - 0x6f8c]
inc eax
mov dword [ebp - 0x6f8c], eax
cmp eax, 8
jb 0x51d0d0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
push dword [ebp + esi*4 - 0x6ffc]
mov eax, dword [edi + 8]
mov ecx, edi
push 1
push 0x1f
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f8c], eax
cmp eax, 0xffffffff
je 0x51d1f5
push 0
push 0
push 0
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push 0
push dword [ebp + esi*4 - 0x6ffc]
call fcn.005dc190
mov ecx, dword [ebp - 0x6fcc]
push eax
push 0
call fcn.005dc190
push eax
push 0x1f
push dword [ebp - 0x6f8c]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push str._r_n_t_tURL:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push dword [ebp + esi*4 - 0x6ffc]
lea ecx, [ebp - 0x1f80]
push str._r_n_t_tName:
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
inc esi
cmp esi, 6
jb 0x51d071
mov dword [ebp - 0x6fa4], esi
mov esi, dword [ebp - 0x6f78]
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x51d030
mov esi, dword [ebp - 0x6fac]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x520143
push 0x18
lea ecx, [ebp - 0x2694]
call fcn.00401e00
lea ecx, [ebp - 0x2694]
call fcn.005d9320
mov byte [ebp - 4], 0x84
mov dword [ebp - 0x6fb4], 0
test esi, esi
je 0x51d526
mov esi, dword [ebp - 0x6fa8]
mov eax, dword [ebp - 0x6fa0]
sub eax, esi
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f80], eax
nop word [eax + eax]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51d526
mov eax, dword [ebp - 0x6f80]
add eax, esi
push 0
push 0x20019
mov ecx, eax
mov dword [ebp - 0x6fcc], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
lea ecx, [ebp - 0x1f74]
call fcn.005d6a00
test eax, eax
je 0x51d504
lea eax, [ebp - 0x2004]
push eax
push str.Secondary_Start_Pages
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x51d504
push 1
push 0x627824
lea ecx, [ebp - 0x2004]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2694]
call fcn.005d9070
xor esi, esi
lea ecx, [ebp - 0x2694]
mov dword [ebp - 0x6fa4], esi
call fcn.005d9210
test eax, eax
je 0x51d4fe
push esi
lea ecx, [ebp - 0x2694]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x2004]
call fcn.005dc510
lea ecx, [ebp - 0x2004]
call fcn.005dbeb0
test al, al
jne 0x51d4e4
xor eax, eax
mov dl, 1
mov dword [ebp - 0x6f8c], eax
push 0
push 1
push 1
push 0
push dword [ebp + eax*4 - 0x7020]
lea ecx, [ebp - 0x2004]
mov byte [ebp - 0x6f81], dl
call fcn.005daa70
dec eax
lea ecx, [ebp - 0x2004]
cmp eax, 0x10
jbe 0x51d4d0
push 0
push str.IE_startup_pages
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
movzx ecx, byte [ebp - 0x6f81]
xor edx, edx
test al, al
cmove edx, ecx
test dl, dl
je 0x51d4e4
mov eax, dword [ebp - 0x6f8c]
inc eax
mov dword [ebp - 0x6f8c], eax
cmp eax, 7
jb 0x51d367
test dl, dl
je 0x51d4e4
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Secondary_Start_Pages
push 1
push 0x1f
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f8c], eax
cmp eax, 0xffffffff
je 0x51d4e4
push 0
push 0
lea ecx, [ebp - 0x2004]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push 0
push str.Secondary_Start_Pages
call fcn.005dc190
mov ecx, dword [ebp - 0x6fcc]
push eax
push 0
call fcn.005dc190
push eax
push 0x1f
push dword [ebp - 0x6f8c]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push str._r_n_t_tURL:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Secondary_Start_Pages
push str._r_n_t_tName:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
jmp 0x51d4e4
call fcn.005dc190
push 0
push str.IE_startup_pages
push eax
mov ecx, edi
call fcn.00511ee0
lea ecx, [ebp - 0x2694]
inc esi
call fcn.005d9210
cmp esi, eax
jb 0x51d332
mov dword [ebp - 0x6fa4], esi
mov esi, dword [ebp - 0x6f78]
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x51d290
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x520138
push 4
lea ecx, [ebp - 0x1fd8]
call fcn.00401d80
lea ecx, [ebp - 0x1fd8]
call fcn.005d6aa0
push 4
lea ecx, [ebp - 0x2078]
mov byte [ebp - 4], 0x85
call fcn.00401d80
lea ecx, [ebp - 0x2078]
call fcn.005d6aa0
mov byte [ebp - 4], 0x86
xor esi, esi
mov eax, dword [edi + 0x30]
test eax, eax
je 0x51d5d2
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64e328
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x51d588
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerSearchScopes
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x51d639
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerSearchScopes
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
push 0xc
lea ecx, [ebp - 0x20fc]
call fcn.00401d40
lea ecx, [ebp - 0x20fc]
call fcn.005dc5e0
push 0
push str._r_n_tInternet_Explorer_search_providers:_r_n
lea ecx, [ebp - 0x1fc8]
mov byte [ebp - 4], 0x87
call fcn.005e37e0
cmp dword [ebp - 0x6fac], 0
mov dword [ebp - 0x6fb4], 0
jbe 0x51d9a4
mov esi, dword [ebp - 0x6fa8]
mov eax, dword [ebp - 0x6fa0]
sub eax, esi
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f80], eax
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51d9a4
mov eax, dword [ebp - 0x6f80]
add eax, esi
push 0
push 0x20019
mov ecx, eax
mov dword [ebp - 0x6fcc], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x51d982
lea eax, [ebp - 0x6cec]
xor esi, esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
mov dword [ebp - 0x6fa4], esi
call fcn.005d6380
test al, al
je 0x51d97c
nop word [eax + eax]
mov ecx, dword [ebp - 0x6fcc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005d6a30
test al, al
je 0x51d95a
lea eax, [ebp - 0x20fc]
push eax
push str.DisplayName
lea ecx, [ebp - 0x1fd8]
call fcn.005d6740
push 0
lea ecx, [ebp - 0x20fc]
call fcn.005dc440
cmp word [eax], 0x40
jne 0x51d7c7
push 0
lea ecx, [ebp - 0x20fc]
call fcn.005dc190
push eax
push 0x80
lea ecx, [ebp - 0x20fc]
call fcn.005db9a0
push 0
push 0x80
lea ecx, [ebp - 0x20fc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20fc]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_SHLoadIndirectString]
lea eax, [ebp - 0x2004]
push eax
push 0x65fd7c
lea ecx, [ebp - 0x1fd8]
call fcn.005d6740
lea ecx, [ebp - 0x20fc]
call fcn.005dbeb0
test al, al
je 0x51d800
lea ecx, [ebp - 0x2004]
call fcn.005dbeb0
test al, al
jne 0x51d95a
push 0
push str.IE_search_providers
lea ecx, [ebp - 0x2004]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51d95a
xor eax, eax
mov dword [ebp - 0x6f8c], eax
nop word [eax + eax]
push 0
push 1
push 1
push 0
push dword [ebp + eax*4 - 0x7020]
lea ecx, [ebp - 0x2004]
call fcn.005daa70
dec eax
cmp eax, 0x10
jbe 0x51d95a
mov eax, dword [ebp - 0x6f8c]
inc eax
mov dword [ebp - 0x6f8c], eax
cmp eax, 7
jb 0x51d830
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20fc]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 1
push 0x20
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f8c], eax
cmp eax, 0xffffffff
je 0x51d95a
push 0
push 0
push 0
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push 0
push 0
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
push 0x20
push dword [ebp - 0x6f8c]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push str._r_n_t_tURL:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x20fc]
call fcn.005dc190
push eax
push str._r_n_t_tName:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x6cec]
inc esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
call fcn.005d6380
test al, al
jne 0x51d700
mov dword [ebp - 0x6fa4], esi
mov esi, dword [ebp - 0x6f78]
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x51d698
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x520117
push 0
push str._r_n_tInternet_Explorer_ad_ons:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
push 0xc
lea ecx, [ebp - 0x20a8]
call fcn.00401d40
lea ecx, [ebp - 0x20a8]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x23a0]
mov byte [ebp - 4], 0x88
call fcn.00401d40
lea ecx, [ebp - 0x23a0]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x20d8]
mov byte [ebp - 4], 0x89
call fcn.00401d40
lea ecx, [ebp - 0x20d8]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2210]
mov byte [ebp - 4], 0x8a
call fcn.00401d40
lea ecx, [ebp - 0x2210]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x23ac]
mov byte [ebp - 4], 0x8b
call fcn.00401d40
lea ecx, [ebp - 0x23ac]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x20b4]
mov byte [ebp - 4], 0x8c
call fcn.00401d40
lea ecx, [ebp - 0x20b4]
call fcn.005dc5e0
push 0xfc8
lea ecx, [ebp - 0x68b8]
mov byte [ebp - 4], 0x8d
call fcn.00401dc0
lea ecx, [ebp - 0x68b8]
call fcn.005e9a70
mov byte [ebp - 4], 0x8e
xor esi, esi
mov eax, dword [edi + 0x30]
test eax, eax
je 0x51daf1
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerToolbar
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x51daa7
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerToolbar
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x51db58
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerToolbar
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fac], 0
mov dword [ebp - 0x6f8c], 0
jbe 0x51e070
mov esi, dword [ebp - 0x6fa8]
mov eax, dword [ebp - 0x6fa0]
sub eax, esi
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f80], eax
nop dword [eax]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51e070
mov ecx, dword [ebp - 0x6f80]
push 1
lea ecx, [esi + ecx]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc260
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x51e04e
lea eax, [ebp - 0x6cec]
xor esi, esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
mov dword [ebp - 0x6fa4], esi
call fcn.005d62e0
test al, al
je 0x51e048
mov ecx, dword [ebp - 0x6cec]
call fcn.005d45b0
test al, al
je 0x51e026
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
lea ecx, [edi + 0x33c]
push str.IEWhiteL_
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20b4]
call fcn.005dc200
lea ecx, [ebp - 0x20b4]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x51e026
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20b4]
call fcn.005dc200
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x20b4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x23a0]
call fcn.005daa70
test eax, eax
jne 0x51e026
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x20b4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x23a0]
call fcn.005da780
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x23ac]
call fcn.005dc510
lea eax, [ebp - 0x20a8]
mov ecx, edi
push eax
lea eax, [ebp - 0x20d8]
push eax
lea eax, [ebp - 0x23ac]
push eax
call fcn.00512e90
lea ecx, [ebp - 0x20d8]
call fcn.005dbeb0
test al, al
je 0x51dd2e
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x20d8]
call fcn.005dc510
push 0
push str.IE_ad_ons
lea ecx, [ebp - 0x20d8]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51e026
push 0
push 1
push 1
push 0
push str.Java_Plug_in
lea ecx, [ebp - 0x20d8]
call fcn.005daa70
cmp eax, 1
je 0x51e026
push 0
push 1
push 1
push 0
push str.Microsoft_Office
lea ecx, [ebp - 0x20d8]
call fcn.005daa70
cmp eax, 1
je 0x51e026
push 0
push 1
push 1
push 0
push 0x62439c
lea ecx, [ebp - 0x20d8]
call fcn.005daa70
cmp eax, 1
je 0x51e026
lea ecx, [ebp - 0x20a8]
call fcn.005dbeb0
lea ecx, [ebp - 0x20a8]
test al, al
je 0x51ddd4
push str.The_CLSID_key_for_this_Ad_on_does_not_exist.
call fcn.005dc510
jmp 0x51ddf4
push 0
push 0
push 0x62439c
push 0x624388
call fcn.005da270
push 0
lea ecx, [ebp - 0x20a8]
call fcn.005dbc20
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f8c]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x213c]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x213c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x20a8]
mov ecx, edi
push eax
call fcn.00511450
lea ecx, [ebp - 0x20a8]
call fcn.005dc190
push eax
push 0
call dword [sym.imp.sfc.dll_SfcIsFileProtected]
test eax, eax
jne 0x51e026
lea ecx, [ebp - 0x20a8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x68b8]
call fcn.005e9660
test al, al
je 0x51df24
push 0x62439c
push 0x624804
lea ecx, [ebp - 0x68b8]
call fcn.005e98f0
push eax
lea ecx, [ebp - 0x2210]
call fcn.005dc510
push 0
push 1
push 1
push 0
push 0x624a04
lea ecx, [ebp - 0x2210]
call fcn.005daa70
cmp eax, 1
je 0x51e026
push 0
push 1
push 1
push 0
push str.Adobe_Systems
lea ecx, [ebp - 0x2210]
call fcn.005daa70
cmp eax, 1
je 0x51e026
push 0
push 1
push 1
push 0
push str.Oracle_Corporation
lea ecx, [ebp - 0x2210]
call fcn.005daa70
cmp eax, 1
je 0x51e026
push 0
push 1
push 1
push 0
push 0x660330
lea ecx, [ebp - 0x2210]
call fcn.005daa70
cmp eax, 1
je 0x51e026
push 0
lea ecx, [ebp - 0x20a8]
call fcn.005dc190
push eax
push 0
push 1
lea ecx, [ebp - 0x20a8]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20d8]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 1
push 0x21
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6fcc], eax
cmp eax, 0xffffffff
je 0x51e026
mov ecx, dword [ebp - 0x6f78]
push 0
push dword [ebp - 0x6cec]
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20a8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
push 0x21
push dword [ebp - 0x6fcc]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x20a8]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push str._r_n_t_tFile:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x20d8]
call fcn.005dc190
push eax
push str._r_n_t_tName:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x6cec]
inc esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
call fcn.005d62e0
test al, al
jne 0x51dc04
mov dword [ebp - 0x6fa4], esi
mov esi, dword [ebp - 0x6f78]
mov eax, dword [ebp - 0x6f8c]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f8c], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x51db90
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5200ca
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x51e0ea
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
nop word [eax + eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion_
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x51e0a0
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x51e151
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fac], 0
mov dword [ebp - 0x6ff8], str.ExplorerBrowser_Helper_Objects
mov dword [ebp - 0x6ff4], str.ExtPreApproved
mov dword [ebp - 0x6ff0], str.ExtApproved
mov dword [ebp - 0x6fec], str.ExtSettings
mov dword [ebp - 0x6fe8], str.ExtStats
mov dword [ebp - 0x6fb4], 0
jbe 0x51e753
mov ecx, dword [ebp - 0x6fa8]
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x6f78], ecx
mov dword [ebp - 0x6f80], eax
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51e753
xor esi, esi
mov dword [ebp - 0x6fa4], esi
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51e733
mov ecx, dword [ebp - 0x6f80]
add ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + esi*4 - 0x6ff8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x51e723
lea eax, [ebp - 0x6cec]
mov dword [ebp - 0x6f8c], 0
push eax
push 0
lea ecx, [ebp - 0x1f74]
call fcn.005d6380
test al, al
je 0x51e723
mov esi, dword [ebp - 0x6f78]
mov ecx, dword [ebp - 0x6cec]
call fcn.005d45b0
test al, al
je 0x51e6f5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
lea ecx, [edi + 0x33c]
push str.IEWhiteL_
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20b4]
call fcn.005dc200
lea ecx, [ebp - 0x20b4]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x51e6f5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20b4]
call fcn.005dc200
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x20b4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x23a0]
call fcn.005daa70
test eax, eax
jne 0x51e6f5
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x20b4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x23a0]
call fcn.005da780
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x23ac]
call fcn.005dc510
lea eax, [ebp - 0x20a8]
mov ecx, edi
push eax
lea eax, [ebp - 0x20d8]
push eax
lea eax, [ebp - 0x23ac]
push eax
call fcn.00512e90
lea ecx, [ebp - 0x20d8]
call fcn.005dbeb0
lea ecx, [ebp - 0x20d8]
test al, al
je 0x51e38b
push dword [ebp - 0x6cec]
call fcn.005dc510
jmp 0x51e44b
push 0
push 1
push 1
push 0
push str.Java_Plug_in
call fcn.005daa70
cmp eax, 1
je 0x51e6f5
push 0
push 1
push 1
push 0
push str.Microsoft_Office
lea ecx, [ebp - 0x20d8]
call fcn.005daa70
cmp eax, 1
je 0x51e6f5
push 0
push 1
push 1
push 0
push str.HTML_Document
lea ecx, [ebp - 0x20d8]
call fcn.005daa70
cmp eax, 1
je 0x51e6f5
push 0
push 1
push 1
push 0
push str.F12_Developer_Tools
lea ecx, [ebp - 0x20d8]
call fcn.005daa70
cmp eax, 1
je 0x51e6f5
push 0
push 1
push 1
push 0
push str.Windows_Live_ID
lea ecx, [ebp - 0x20d8]
call fcn.005daa70
cmp eax, 1
je 0x51e6f5
push 0
push 1
push 1
push 0
push str.Shockwave_Flash_Object
lea ecx, [ebp - 0x20d8]
call fcn.005daa70
cmp eax, 1
je 0x51e6f5
push 0
push str.IE_ad_ons
lea ecx, [ebp - 0x20d8]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51e6f5
lea ecx, [ebp - 0x20a8]
call fcn.005dbeb0
lea ecx, [ebp - 0x20a8]
test al, al
je 0x51e48e
push str.The_CLSID_key_for_this_Ad_on_does_not_exist.
call fcn.005dc510
jmp 0x51e4ae
push 0
push 0
push 0x62439c
push 0x624388
call fcn.005da270
push 0
lea ecx, [ebp - 0x20a8]
call fcn.005dbc20
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f8c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x213c]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x213c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x20a8]
mov ecx, edi
push eax
call fcn.00511450
lea ecx, [ebp - 0x20a8]
call fcn.005dc190
push eax
push 0
call dword [sym.imp.sfc.dll_SfcIsFileProtected]
test eax, eax
jne 0x51e6f5
lea ecx, [ebp - 0x20a8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x68b8]
call fcn.005e9660
test al, al
je 0x51e5ff
push 0x62439c
push 0x624804
lea ecx, [ebp - 0x68b8]
call fcn.005e98f0
push eax
lea ecx, [ebp - 0x2210]
call fcn.005dc510
push 0
push 1
push 1
push 0
push 0x624a04
lea ecx, [ebp - 0x2210]
call fcn.005daa70
cmp eax, 1
je 0x51e6f5
push 0
push 1
push 1
push 0
push str.Adobe_Systems
lea ecx, [ebp - 0x2210]
call fcn.005daa70
cmp eax, 1
je 0x51e6f5
push 0
push 1
push 1
push 0
push str.Oracle_Corporation
lea ecx, [ebp - 0x2210]
call fcn.005daa70
cmp eax, 1
je 0x51e6f5
push 0
push 1
push 1
push 0
push str.Evernote_Corp
lea ecx, [ebp - 0x2210]
call fcn.005daa70
cmp eax, 1
je 0x51e6f5
push 0
push 1
push 1
push 0
push 0x660330
lea ecx, [ebp - 0x2210]
call fcn.005daa70
cmp eax, 1
je 0x51e6f5
push 0
lea ecx, [ebp - 0x20a8]
call fcn.005dc190
push eax
push 0
push 1
lea ecx, [ebp - 0x20a8]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20d8]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 1
push 0x21
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6fcc], eax
cmp eax, 0xffffffff
je 0x51e6f5
push 0
push dword [ebp - 0x6cec]
mov ecx, esi
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20a8]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20b4]
call fcn.005dc190
push eax
push 0x21
push dword [ebp - 0x6fcc]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x20a8]
call fcn.005dc190
push eax
push str._r_n_t_tFile:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x20d8]
call fcn.005dc190
push eax
push str._r_n_t_tName:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6f8c]
lea ecx, [ebp - 0x6cec]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x1f74]
mov dword [ebp - 0x6f8c], eax
call fcn.005d6380
test al, al
jne 0x51e260
mov esi, dword [ebp - 0x6fa4]
inc esi
mov dword [ebp - 0x6fa4], esi
cmp esi, 5
jb 0x51e1c7
mov esi, dword [ebp - 0x6fb4]
add dword [ebp - 0x6f78], 0xc
inc esi
mov dword [ebp - 0x6fb4], esi
cmp esi, dword [ebp - 0x6fac]
jb 0x51e1b0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5200ca
push 0
push str._r_n_tInternet_Explorer_shortcuts:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
lea ecx, [ebp - 0x6e6c]
call fcn.00402740
mov byte [ebp - 4], 0x8f
lea ecx, [ebp - 0x6e64]
mov eax, dword [edi + 8]
push 0x64abcc
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x6e6c], eax
mov dword [ebp - 0x6e68], 0x23
call fcn.005dc510
lea eax, [ebp - 0x21e0]
mov dword [ebp - 0x6e54], eax
lea ecx, [ebp - 0x6e44]
lea eax, [edi + 0x164]
mov dword [ebp - 0x6e50], eax
lea eax, [ebp - 0x1fc8]
mov dword [ebp - 0x6e4c], eax
mov eax, dword [edi + 4]
push str.Internet_Explorer
mov dword [ebp - 0x6e48], eax
call fcn.005dc510
push 0xc
lea ecx, [ebp - 0x22c0]
call fcn.00401d40
lea ecx, [ebp - 0x22c0]
call fcn.005dc5e0
xor esi, esi
mov byte [ebp - 4], 0x90
cmp dword [edi + 0x30], esi
jbe 0x51e95c
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51e95c
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc3a0
cmp eax, 3
jl 0x51e952
push esi
lea ecx, [edi + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x250c]
mov dword [ebp - 0x6e58], eax
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x22c0]
call fcn.005dc200
lea ecx, [ebp - 0x22c0]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x51e952
lea ecx, [ebp - 0x22c0]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6e6c]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51e95c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x25bc]
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x22c0]
call fcn.005dc200
lea ecx, [ebp - 0x22c0]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x51e952
push 0
lea ecx, [ebp - 0x22c0]
call fcn.005dbed0
lea ecx, [ebp - 0x22c0]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6e6c]
mov ecx, edi
push eax
call fcn.0052e3e0
inc esi
cmp esi, dword [edi + 0x30]
jb 0x51e810
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5200b4
lea ecx, [ebp - 0x264c]
mov dword [ebp - 0x6e58], str._All_users_
call fcn.005dc190
push eax
lea eax, [ebp - 0x6e6c]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
lea ecx, [ebp - 0x22c0]
test al, al
jne 0x5200ba
lea eax, [ebp - 0x2640]
push eax
call fcn.005dc4e0
push 0
lea ecx, [ebp - 0x22c0]
call fcn.005dbed0
lea ecx, [ebp - 0x22c0]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6e6c]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5200b4
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x51ea4b
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareClientsStartMenuInternetIEXPLORE.EXE_shellopencommand
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x51ea01
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREClientsStartMenuInternetIEXPLORE.EXE_shellopencommand
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x51eab2
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREClientsStartMenuInternetIEXPLORE.EXE_shellopencommand
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
mov edx, dword [ebp - 0x6fac]
test edx, edx
je 0x51ec90
mov eax, dword [ebp - 0x6fa0]
mov esi, dword [ebp - 0x6fa8]
sub eax, esi
mov dword [ebp - 0x6fb4], eax
mov dword [ebp - 0x6f8c], edx
nop word [eax + eax]
push 0
lea ecx, [esi + eax]
push 0x20019
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x51ec7a
lea eax, [ebp - 0x20b4]
push eax
push 0x62439c
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x51ec7a
push 0
push 1
push 1
push 0
push str.iexplore.exe
lea ecx, [ebp - 0x20b4]
call fcn.005daa70
lea ecx, [ebp - 0x20b4]
mov dword [ebp - 0x6f80], eax
call fcn.005dc3a0
mov edx, dword [ebp - 0x6f80]
lea ecx, [edx + 0xc]
cmp eax, ecx
jle 0x51ec7a
lea eax, [edx + 0xd]
push eax
lea ecx, [ebp - 0x20b4]
call fcn.005dad50
push 3
lea ecx, [ebp - 0x20b4]
call fcn.005da0f0
lea ecx, [ebp - 0x20b4]
call fcn.005dbeb0
test al, al
jne 0x51ec7a
push 0
push str.IE_shortcuts
lea ecx, [ebp - 0x20b4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51ec7a
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x20b4]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Start_Menu_Internet_shortcut
push 1
push 0x23
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51ec7a
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
mov ecx, dword [ebp - 0x6fb4]
push eax
push 0
lea ecx, [esi + ecx]
call fcn.005dc190
push eax
push 0x23
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x20b4]
call fcn.005dc190
push eax
push str._r_n_t_tStart_Menu_Internet_shortcut_argument:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
sub dword [ebp - 0x6f8c], 1
jne 0x51eae0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5200b4
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x51ed0a
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
nop word [eax + eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwarePoliciesMicrosoftInternet_Explorer_
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x51ecc0
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftInternet_Explorer_
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x51ed71
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREPoliciesMicrosoftInternet_Explorer_
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
push 0
push str._r_n_tInternet_Explorers_Group_Policies:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov esi, dword [ebp - 0x6fac]
mov dword [ebp - 0x6f8c], 0
test esi, esi
je 0x51f25f
mov esi, dword [ebp - 0x6fa8]
mov eax, dword [ebp - 0x6fa0]
sub eax, esi
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6fb4], eax
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51f259
mov eax, dword [edi + 0x30]
cmp eax, 2
jbe 0x51eddb
add eax, 0xfffffffe
cmp dword [ebp - 0x6f8c], eax
je 0x51f237
mov ecx, dword [ebp - 0x6fb4]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
add ecx, esi
push str.Control_Panel
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x51f237
lea eax, [ebp - 0x26d8]
mov dword [ebp - 0x26d8], 0
push eax
push str.HomePage
lea ecx, [ebp - 0x1f74]
call fcn.005d66b0
test al, al
je 0x51f237
cmp dword [ebp - 0x26d8], 0
je 0x51f237
mov ecx, dword [ebp - 0x6fb4]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Main
lea ecx, [esi + ecx]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x51f237
lea eax, [ebp - 0x2004]
push eax
push str.Start_Page
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x51f02a
lea ecx, [ebp - 0x2004]
call fcn.005dbeb0
test al, al
jne 0x51f02a
push 0
push str.IE_group_policies
lea ecx, [ebp - 0x2004]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51f02a
xor esi, esi
push 0
push 1
push 1
push 0
push dword [ebp + esi*4 - 0x7020]
lea ecx, [ebp - 0x2004]
call fcn.005daa70
dec eax
cmp eax, 0x10
jbe 0x51f024
inc esi
cmp esi, 7
jb 0x51ef18
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov esi, dword [ebp - 0x6f78]
mov ecx, esi
push eax
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Start_Page
push 1
push 0x25
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51f02a
push 0
push 0
push 0
lea ecx, [ebp - 0x2004]
call fcn.005dc190
push eax
push 0
push str.Start_Page
mov ecx, esi
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
push 0x25
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2004]
call fcn.005dc190
push eax
push str._r_n_t_tURL:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str._r_n_t_tName:_Start_Page
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
jmp 0x51f02a
mov esi, dword [ebp - 0x6f78]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51f259
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64df70
lea ecx, [ebp - 0x1f8c]
call fcn.005da780
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x51f237
lea eax, [ebp - 0x6cec]
xor esi, esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
mov dword [ebp - 0x6fa4], esi
call fcn.005d62e0
test al, al
je 0x51f231
nop dword [eax + eax]
mov eax, dword [ebp - 0x6cec]
cmp word [eax], 0
je 0x51f20f
push eax
lea ecx, [ebp - 0x2004]
call fcn.005dc510
push 0
push str.IE_group_policies
lea ecx, [ebp - 0x2004]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51f22b
xor eax, eax
mov dword [ebp - 0x6f9c], eax
push 0
push 1
push 1
push 0
push dword [ebp + eax*4 - 0x7020]
lea ecx, [ebp - 0x2004]
call fcn.005daa70
dec eax
cmp eax, 0x10
jbe 0x51f20f
mov eax, dword [ebp - 0x6f9c]
inc eax
mov dword [ebp - 0x6f9c], eax
cmp eax, 7
jb 0x51f0f6
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.SecondaryStartPages
push 1
push 0x25
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51f20f
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
push 0x25
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push str._r_n_t_tURL:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str._r_n_t_tName:_SecondaryStartPages
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x6cec]
inc esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
call fcn.005d62e0
test al, al
jne 0x51f0b0
mov dword [ebp - 0x6fa4], esi
mov esi, dword [ebp - 0x6f78]
mov eax, dword [ebp - 0x6f8c]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f8c], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x51edb5
mov esi, dword [ebp - 0x6fac]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5200b4
mov dword [ebp - 0x6f8c], 0
test esi, esi
je 0x51f6a4
mov esi, dword [ebp - 0x6fa8]
mov eax, dword [ebp - 0x6fa0]
sub eax, esi
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f80], eax
nop word [eax + eax]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51f6a4
mov eax, dword [edi + 0x30]
cmp eax, 2
jbe 0x51f2c6
add eax, 0xfffffffe
cmp dword [ebp - 0x6f8c], eax
je 0x51f682
mov eax, dword [ebp - 0x6f80]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
add eax, esi
push 0
push str.InfodeliveryRestrictions
mov ecx, eax
mov dword [ebp - 0x6fb4], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x51f682
lea eax, [ebp - 0x26d4]
mov dword [ebp - 0x26d4], 0
push eax
push str.UsePolicySearchProvidersOnly
lea ecx, [ebp - 0x1f74]
call fcn.005d66b0
test al, al
je 0x51f682
cmp dword [ebp - 0x26d4], 0
je 0x51f682
mov ecx, dword [ebp - 0x6fb4]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SearchScopes
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x51f682
lea eax, [ebp - 0x6cec]
xor esi, esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
mov dword [ebp - 0x6fa4], esi
call fcn.005d6380
test al, al
je 0x51f67c
mov ecx, dword [ebp - 0x6fb4]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
push 0x66fce8
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005d6a30
test al, al
je 0x51f65a
lea eax, [ebp - 0x20fc]
push eax
push str.DisplayName
lea ecx, [ebp - 0x1fd8]
call fcn.005d6740
push 0
lea ecx, [ebp - 0x20fc]
call fcn.005dc440
cmp word [eax], 0x40
jne 0x51f49c
push 0
lea ecx, [ebp - 0x20fc]
call fcn.005dc190
push eax
push 0x80
lea ecx, [ebp - 0x20fc]
call fcn.005db9a0
push 0
push 0x80
lea ecx, [ebp - 0x20fc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20fc]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_SHLoadIndirectString]
lea eax, [ebp - 0x2004]
push eax
push 0x65fd7c
lea ecx, [ebp - 0x1fd8]
call fcn.005d6740
lea ecx, [ebp - 0x20fc]
call fcn.005dbeb0
test al, al
je 0x51f4d5
lea ecx, [ebp - 0x2004]
call fcn.005dbeb0
test al, al
jne 0x51f65a
push 0
push str.IE_group_policies
lea ecx, [ebp - 0x2004]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51f676
xor eax, eax
mov dword [ebp - 0x6f9c], eax
nop
push 0
push 1
push 1
push 0
push dword [ebp + eax*4 - 0x7020]
lea ecx, [ebp - 0x2004]
call fcn.005daa70
dec eax
cmp eax, 0x10
jbe 0x51f65a
mov eax, dword [ebp - 0x6f9c]
inc eax
mov dword [ebp - 0x6f9c], eax
cmp eax, 7
jb 0x51f500
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__search_provider_
lea ecx, [ebp - 0x20fc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20b4]
call fcn.005dc200
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20b4]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 1
push 0x25
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6fcc], eax
cmp eax, 0xffffffff
je 0x51f65a
push 0
push 0
push 0
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push 0
push 0
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
push 0x25
push dword [ebp - 0x6fcc]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2004]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push str._r_n_t_tURL:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x20fc]
call fcn.005dc190
push eax
push str._r_n_t_tSearch_provider_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x6cec]
inc esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
call fcn.005d6380
test al, al
jne 0x51f3d5
mov dword [ebp - 0x6fa4], esi
mov esi, dword [ebp - 0x6f78]
mov eax, dword [ebp - 0x6f8c]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f8c], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x51f2a0
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x51f70d
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoft_
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x51f6c3
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoft_
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x51f774
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREMicrosoft_
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
push 0xc
lea ecx, [ebp - 0x26b8]
call fcn.00401d40
lea ecx, [ebp - 0x26b8]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x25c8]
mov byte [ebp - 4], 0x91
call fcn.00401d40
lea ecx, [ebp - 0x25c8]
call fcn.005dc5e0
push 0
push str._r_n_tInternet_Explorer_and_Shell_reset_options:_r_n
lea ecx, [ebp - 0x1fc8]
mov byte [ebp - 4], 0x92
call fcn.005e37e0
cmp dword [ebp - 0x6fac], 0
mov dword [ebp - 0x6f8c], 0
jbe 0x51fb73
mov esi, dword [ebp - 0x6fa8]
mov eax, dword [ebp - 0x6fa0]
sub eax, esi
mov dword [ebp - 0x6fb4], esi
mov dword [ebp - 0x6f78], eax
nop
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51fb73
mov eax, dword [edi + 0x30]
cmp eax, 2
jbe 0x51f816
add eax, 0xfffffffe
cmp dword [ebp - 0x6f8c], eax
je 0x51fb51
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.WindowsCurrentVersionInternet_Settings
lea ecx, [esi + ecx]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x51f99a
push 0
push str.IE_reset_options
push str.Reset_Proxy
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51f99a
lea eax, [ebp - 0x26b8]
push eax
push str.ProxyServer
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
lea eax, [ebp - 0x28ac]
push eax
push str.ProxyEnable
lea ecx, [ebp - 0x1f74]
call fcn.005d66b0
lea ecx, [ebp - 0x26b8]
call fcn.005dbeb0
test al, al
jne 0x51f99a
cmp dword [ebp - 0x28ac], 0
je 0x51f99a
push 0
push 0
push 0
push 0
push str.This_option_is_present_because_a_proxy_was_found_for_this_user.
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Proxy
push 1
push 0x24
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51f99a
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
push 0x24
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Un_checked_r_n
push str.This_option_is_present_because_a_proxy_was_found_for_this_user.
push str._r_n_t_tInfo:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_Proxy
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push str.IE_reset_options
push str.Reset_Shell
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x51fb51
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Windows_NTCurrentVersionWinlogon
lea ecx, [esi + ecx]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x51fb51
lea eax, [ebp - 0x25c8]
push eax
push 0x6417fc
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x51fb51
lea ecx, [ebp - 0x26b8]
call fcn.005dbeb0
test al, al
jne 0x51fb51
push 0
push 0
push 0x62439c
push 0x624514
lea ecx, [ebp - 0x25c8]
call fcn.005da270
push 0
push 1
push 1
push 0
push str.Explorer.exe
lea ecx, [ebp - 0x25c8]
call fcn.005daa70
lea ecx, [ebp - 0x25c8]
mov esi, eax
call fcn.005dc3a0
sub eax, 0xb
cmp esi, eax
mov esi, dword [ebp - 0x6fb4]
je 0x51fb51
push 0
push 0
push 0
push 0
push str.This_option_is_present_because_a_Shell_hijack_was_found_for_this_user.
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Shell
push 1
push 0x24
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51fb51
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
push 0x24
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Un_checked_r_n
push str.This_option_is_present_because_a_Shell_hijack_was_found_for_this_user.
push str._r_n_t_tInfo:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_Shell
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6f8c]
add esi, 0xc
inc eax
mov dword [ebp - 0x6fb4], esi
mov dword [ebp - 0x6f8c], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x51f7f0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52009e
push 0
push str.IE_reset_options
push str.Reset_Internet_Explorer_Policies
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x52009e
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x51fc0a
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwarePoliciesMicrosoftInternet_Explorer
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x51fbc0
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwarePoliciesMicrosoftInternet_Explorer
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x51fc71
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SoftwarePoliciesMicrosoftInternet_Explorer
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fac], 0
mov dword [ebp - 0x6fb4], 0
jbe 0x51fe3a
mov eax, dword [ebp - 0x6fa8]
sub eax, esi
mov dword [ebp - 0x6f8c], eax
mov ecx, esi
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
je 0x51fe1e
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x51fe3a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x66a220
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2114]
call fcn.005dc200
lea ecx, [ebp - 0x2114]
call fcn.005dc190
mov edx, str.HomePage
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x51fd4c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x65f434
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2114]
call fcn.005dc200
lea ecx, [ebp - 0x2114]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
je 0x51fe1e
mov ecx, dword [ebp - 0x6f8c]
push 0
push 0
push 0
push 0
add ecx, esi
push str.This_option_is_listed_because_a_possibly_hijacked_policy_was_found_for_this_user.
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Internet_Explorer_Policies
push 1
push 0x24
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x51fe1e
mov ecx, dword [ebp - 0x6f8c]
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ecx + esi]
call fcn.005dc190
push eax
push 0
mov ecx, esi
call fcn.005dc190
push eax
push 0x24
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
mov ecx, dword [ebp - 0x6f8c]
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Un_checked_r_n
push str.This_option_is_listed_because_a_possibly_hijacked_policy_was_found_for_this_user.
push str._r_n_t_tInfo:
lea ecx, [ecx + esi]
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_Internet_Explorer_Policies
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x51fc96
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52009e
push 0
push str.IE_reset_options
push str.Reset_IEs_DOM_Storage
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x52009e
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x51fecd
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerDomStorage
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x51fe83
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerDomStorage
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x51ff34
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerDomStorage
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
mov edx, dword [ebp - 0x6fac]
test edx, edx
je 0x52006f
mov eax, dword [ebp - 0x6fa0]
mov esi, dword [ebp - 0x6fa8]
sub eax, esi
mov dword [ebp - 0x6fb4], eax
mov dword [ebp - 0x6f8c], edx
nop dword [eax]
push 0
lea ecx, [esi + eax]
push 0x20019
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd8]
call fcn.005d6a30
test al, al
je 0x520059
lea ecx, [ebp - 0x1fd8]
call fcn.005d6280
cmp eax, 1
jbe 0x520059
push 0
push 0
push 0
push 0
push str.Check_this_item_if_you_want_to_reset_IEs_DOM_Storage
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_IEs_DOM_Storage
push 1
push 0x24
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x520059
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
mov ecx, dword [ebp - 0x6fb4]
push eax
push 0
lea ecx, [ecx + esi]
call fcn.005dc190
push eax
push 0x24
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Un_checked_r_n
push str.Check_this_item_if_you_want_to_reset_IEs_DOM_Storage
push str._r_n_t_tInfo:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str._r_n_t_tReset_option:_Reset_IEs_DOM_Storage
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
sub dword [ebp - 0x6f8c], 1
jne 0x51ff60
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa8]
call fcn.005bb910
mov ecx, edi
call fcn.00511b80
test al, al
je 0x52009e
push 1
push 0
push 0
lea ecx, [ebp - 0x21e0]
call fcn.005dca80
lea ecx, [ebp - 0x25c8]
call fcn.005dc430
lea ecx, [ebp - 0x26b8]
call fcn.005dc430
lea ecx, [ebp - 0x22c0]
call fcn.005dc430
lea ecx, [ebp - 0x6e6c]
call fcn.00402770
lea ecx, [ebp - 0x68b8]
call fcn.00401d90
lea ecx, [ebp - 0x20b4]
call fcn.005dc430
lea ecx, [ebp - 0x23ac]
call fcn.005dc430
lea ecx, [ebp - 0x2210]
call fcn.005dc430
lea ecx, [ebp - 0x20d8]
call fcn.005dc430
lea ecx, [ebp - 0x23a0]
call fcn.005dc430
lea ecx, [ebp - 0x20a8]
call fcn.005dc430
lea ecx, [ebp - 0x20fc]
call fcn.005dc430
lea ecx, [ebp - 0x2078]
call fcn.005d69e0
lea ecx, [ebp - 0x1fd8]
call fcn.005d69e0
lea ecx, [ebp - 0x2694]
call fcn.005d9280
lea ecx, [ebp - 0x23f4]
call fcn.005dc430
lea ecx, [ebp - 0x2004]
mov byte [ebp - 4], 0x46
call fcn.005dc430
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5229a8
test dword [edi + 0x34], 0x1000
jne 0x5229a8
push 0
push str._r_n_r_n__Google_Chrome_scan:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push str.Scanning_Google_Chrome...
push dword [eax + 0x38]
call fcn.005bcd30
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x2d
push dword [eax + 0x34]
call fcn.005b9910
push 0xc
lea ecx, [ebp - 0x20e4]
call fcn.00401d40
lea ecx, [ebp - 0x20e4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2028]
mov byte [ebp - 4], 0x93
call fcn.00401d40
lea ecx, [ebp - 0x2028]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x23e8]
mov byte [ebp - 4], 0x94
call fcn.00401d40
lea ecx, [ebp - 0x23e8]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x1fe4]
mov byte [ebp - 4], 0x95
call fcn.00401d40
lea ecx, [ebp - 0x1fe4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x22e8]
mov byte [ebp - 4], 0x96
call fcn.00401d40
lea ecx, [ebp - 0x22e8]
call fcn.005dc5e0
mov byte [ebp - 4], 0x97
lea ecx, [ebp - 0x256c]
xor esi, esi
push 0x24
mov dword [ebp - 0x6f8c], esi
call fcn.004020b0
lea ecx, [ebp - 0x256c]
call fcn.005b5fe0
mov byte [ebp - 4], 0x98
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa8]
call fcn.005bb910
push esi
push str._r_n_tChromes_startup_and_home_pages:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov dword [ebp - 0x6f78], esi
cmp dword [edi + 0x30], esi
jbe 0x5208ac
mov esi, dword [ebp - 0x6fa8]
mov dword [ebp - 0x6fb4], esi
nop
lea ecx, [ebp - 0x22e8]
call fcn.005dbeb0
test al, al
je 0x5202ec
lea eax, [ebp - 0x22e8]
push eax
push 0
lea ecx, [ebp - 0x2160]
call fcn.005dc190
push dword [ebp - 0x6f78]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0058f340
mov esi, dword [ebp - 0x6fb4]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5208a6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.GoogleChromeUser_Dataf
lea ecx, [ebp - 0x2160]
call fcn.005dc190
push eax
push dword [ebp - 0x6f78]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20e4]
call fcn.005dc200
push 0x260
lea ecx, [ebp - 0x5430]
call fcn.00401d60
push 1
lea ecx, [ebp - 0x20e4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x5430]
call fcn.00401130
push 3
lea ecx, [ebp - 0x20e4]
mov byte [ebp - 4], 0x99
call fcn.005dadc0
lea ecx, [ebp - 0x5430]
call fcn.00401270
test al, al
je 0x520878
nop
push 1
lea ecx, [ebp - 0x5430]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc510
push str.Default
lea ecx, [ebp - 0x2028]
call fcn.005dc480
test al, al
je 0x5203de
push 0
push 1
push 1
push 0
push str.Profile
lea ecx, [ebp - 0x2028]
call fcn.005daa70
cmp eax, 1
jne 0x520865
inc dword [ebp - 0x6f8c]
lea ecx, [ebp - 0x5430]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Secure_Preferences
push 1
call fcn.004012d0
push eax
lea ecx, [ebp - 0x20e4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc200
push 0x100
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x256c]
call fcn.005b5da0
test al, al
je 0x520865
lea eax, [ebp - 0x1fe4]
push eax
push 0x629fdc
push str.homepage
lea ecx, [ebp - 0x256c]
call fcn.005b5530
test eax, eax
je 0x520619
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x520619
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x520619
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x520619
push str.about:blank
lea ecx, [ebp - 0x1fe4]
call fcn.005dc4c0
test al, al
jne 0x520619
push 0
push 1
push 1
push 0
push str.:__www.yahoo.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x520619
push eax
push str.Chrome_startup_pages
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x520619
push 0
push str.Crome_startup_pages
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x520619
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Home_page
push 2
push 0x2a
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x520619
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
push str.homepage
push 0x2a
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
push str._r_n_t_tHomepage:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x2adc]
mov dword [ebp - 0x6f14], 0
push eax
push 0x629fdc
xorps xmm0, xmm0
lea ecx, [ebp - 0x256c]
push str.session__startup_urls
movups xmmword [ebp - 0x6f24], xmm0
call fcn.005b5630
test al, al
je 0x520865
lea eax, [ebp - 0x2adc]
push eax
lea eax, [ebp - 0x6f24]
push eax
lea ecx, [ebp - 0x256c]
call fcn.005b4c80
test al, al
je 0x520865
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x6f24]
push eax
lea ecx, [ebp - 0x256c]
call fcn.005b4f90
test eax, eax
je 0x520844
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x520844
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x520844
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x520844
push str.about:blank
lea ecx, [ebp - 0x1fe4]
call fcn.005dc4c0
test al, al
jne 0x520844
push 0
push 1
push 1
push 0
push str.:__www.yahoo.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x520844
push eax
push str.Chrome_startup_pages
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x520844
push 0
push str.Crome_startup_pages
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x520844
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Startup_page
push 2
push 0x2a
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x520844
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
push str.session__startup_urls
push 0x2a
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
push str._r_n_t_tStartup_page:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x2adc]
push eax
lea eax, [ebp - 0x6f24]
push eax
lea ecx, [ebp - 0x256c]
call fcn.005b4c80
test al, al
jne 0x520672
lea ecx, [ebp - 0x5430]
call fcn.00401230
test al, al
jne 0x520390
lea ecx, [ebp - 0x5430]
mov byte [ebp - 4], 0x98
call fcn.00401180
mov eax, dword [ebp - 0x6f78]
add esi, 0xc
inc eax
mov dword [ebp - 0x6fb4], esi
mov dword [ebp - 0x6f78], eax
cmp eax, dword [edi + 0x30]
jb 0x5202a0
mov esi, dword [ebp - 0x6f8c]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x522962
test esi, esi
jne 0x5208e4
lea ecx, [ebp - 0x22e8]
call fcn.005dbeb0
test al, al
je 0x5208e4
push esi
push str._r_n_tNo_Chrome_profiles_have_been_found:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
jmp 0x522962
push 0
push str._r_n_tChromes_search_providers:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
cmp dword [edi + 0x30], 0
mov dword [ebp - 0x6f8c], 0
jbe 0x520c91
mov esi, dword [ebp - 0x6fa8]
mov dword [ebp - 0x6f78], esi
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x520c91
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.GoogleChromeUser_Dataf
lea ecx, [ebp - 0x2160]
call fcn.005dc190
push eax
push dword [ebp - 0x6f8c]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20e4]
call fcn.005dc200
push 0x260
lea ecx, [ebp - 0x4f70]
call fcn.00401d60
push 1
lea ecx, [ebp - 0x20e4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4f70]
call fcn.00401130
push 3
lea ecx, [ebp - 0x20e4]
mov byte [ebp - 4], 0x9a
call fcn.005dadc0
lea ecx, [ebp - 0x4f70]
call fcn.00401270
test al, al
je 0x520c63
nop dword [eax]
push 1
lea ecx, [ebp - 0x4f70]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc510
push str.Default
lea ecx, [ebp - 0x2028]
call fcn.005dc480
test al, al
je 0x520a0e
push 0
push 1
push 1
push 0
push str.Profile
lea ecx, [ebp - 0x2028]
call fcn.005daa70
cmp eax, 1
jne 0x520c50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Secure_Preferences
push 1
lea ecx, [ebp - 0x4f70]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x20e4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc200
push 0x100
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x256c]
call fcn.005b5da0
test al, al
je 0x520c50
lea eax, [ebp - 0x1fe4]
push eax
push 0x629fdc
push str.default_search_provider_data__template_url_data__url
lea ecx, [ebp - 0x256c]
call fcn.005b5530
test eax, eax
je 0x520c50
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x520c50
push eax
push 1
push 1
push eax
push str.google:baseURL
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x520c50
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x520c50
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x520c50
push eax
push 1
push 1
push eax
push str.search.yahoo.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x520c50
push eax
push str.Chrome_search_providers
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x520c50
push 0
push str.Crome_search_providers
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x520c50
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Default_search_provider
push 2
push 0x2b
push dword [eax + 0xa8]
call fcn.0053ab00
mov esi, eax
cmp esi, 0xffffffff
je 0x520c4a
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
push str.default_search_provider_data__template_url_data
push 0x2b
push esi
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2028]
call fcn.005dc190
mov esi, dword [ebp - 0x6f78]
mov ecx, esi
push eax
push str._r_n_t_tInfo:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
push str._r_n_t_tDefault_search_provider_URL:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
jmp 0x520c50
mov esi, dword [ebp - 0x6f78]
lea ecx, [ebp - 0x4f70]
call fcn.00401230
test al, al
jne 0x5209c0
lea ecx, [ebp - 0x4f70]
mov byte [ebp - 4], 0x98
call fcn.00401180
mov eax, dword [ebp - 0x6f8c]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f8c], eax
cmp eax, dword [edi + 0x30]
jb 0x520916
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x522962
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.WhiteListChrome_Extensions
lea ecx, [edi + 0x33c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push str._r_n_tChrome_extensions:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
cmp dword [edi + 0x30], 0
mov dword [ebp - 0x6f8c], 0
jbe 0x5212b0
mov esi, dword [ebp - 0x6fa8]
mov dword [ebp - 0x6f78], esi
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5212b0
push 0xc
lea ecx, [ebp - 0x275c]
call fcn.00401d40
lea ecx, [ebp - 0x275c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x27c8]
mov byte [ebp - 4], 0x9b
call fcn.00401d40
lea ecx, [ebp - 0x27c8]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2750]
mov byte [ebp - 4], 0x9c
call fcn.00401d40
lea ecx, [ebp - 0x2750]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x26ac]
mov byte [ebp - 4], 0x9d
call fcn.00401d40
lea ecx, [ebp - 0x26ac]
call fcn.005dc5e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.GoogleChromeUser_Dataf
lea ecx, [ebp - 0x2160]
mov byte [ebp - 4], 0x9e
call fcn.005dc190
push eax
push dword [ebp - 0x6f8c]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20e4]
call fcn.005dc200
push 0x260
lea ecx, [ebp - 0x4ab0]
call fcn.00401d60
push 1
lea ecx, [ebp - 0x20e4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4ab0]
call fcn.00401130
push 3
lea ecx, [ebp - 0x20e4]
mov byte [ebp - 4], 0x9f
call fcn.005dadc0
lea ecx, [ebp - 0x4ab0]
call fcn.00401270
test al, al
je 0x521256
nop word [eax + eax]
push 1
lea ecx, [ebp - 0x4ab0]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc510
push str.Default
lea ecx, [ebp - 0x2028]
call fcn.005dc480
test al, al
je 0x520e6e
push 0
push 1
push 1
push 0
push str.Profile
lea ecx, [ebp - 0x2028]
call fcn.005daa70
cmp eax, 1
jne 0x521243
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Secure_Preferences
push 1
lea ecx, [ebp - 0x4ab0]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x20e4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc200
push 0x100
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x256c]
call fcn.005b5da0
test al, al
je 0x521243
lea eax, [ebp - 0x2ac8]
mov dword [ebp - 0x6f28], 0
push eax
push 0x629fdc
xorps xmm0, xmm0
lea ecx, [ebp - 0x256c]
push str.extensions__settings
movups xmmword [ebp - 0x6f38], xmm0
call fcn.005b5630
test al, al
je 0x521243
lea eax, [ebp - 0x2ac8]
push eax
lea eax, [ebp - 0x6f38]
push eax
lea ecx, [ebp - 0x256c]
call fcn.005b5050
test al, al
je 0x521243
nop word [eax + eax]
lea eax, [ebp - 0x275c]
push eax
lea eax, [ebp - 0x6f38]
push eax
lea ecx, [ebp - 0x256c]
call fcn.005b55f0
test al, al
je 0x521222
lea ecx, [ebp - 0x275c]
call fcn.005dc190
lea ecx, [ebp - 0x1f8c]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x52121c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__manifest__name
lea ecx, [ebp - 0x275c]
call fcn.005dc190
push eax
push str.extensions__settings__
lea ecx, [ebp - 0x2750]
call fcn.005dc200
lea eax, [ebp - 0x27c8]
push eax
push 0x629fdc
lea ecx, [ebp - 0x2750]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x256c]
call fcn.005b5530
test eax, eax
je 0x52121c
lea ecx, [ebp - 0x27c8]
call fcn.005dc190
lea ecx, [ebp - 0x1f8c]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x52121c
push 0
push str.Chrome_extensions
lea ecx, [ebp - 0x27c8]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x52121c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__path
lea ecx, [ebp - 0x275c]
call fcn.005dc190
push eax
push str.extensions__settings__
lea ecx, [ebp - 0x2750]
call fcn.005dc200
lea eax, [ebp - 0x26ac]
push eax
push 0x629fdc
lea ecx, [ebp - 0x2750]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x256c]
call fcn.005b5530
test eax, eax
je 0x5210cc
push 0
push 1
push 1
push 5
push 0x624518
lea ecx, [ebp - 0x26ac]
call fcn.005daa70
test eax, eax
jne 0x5210cc
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.Extensions_
push 1
lea ecx, [ebp - 0x4ab0]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x20e4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x26ac]
call fcn.005da510
lea ecx, [ebp - 0x26ac]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52121c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x275c]
call fcn.005dc190
push eax
push str.extensions__settings__
lea ecx, [ebp - 0x2750]
call fcn.005dc200
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x26ac]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x27c8]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 2
push 0x2c
push dword [eax + 0xa8]
call fcn.0053ab00
mov esi, eax
cmp esi, 0xffffffff
je 0x52121c
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x26ac]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2750]
call fcn.005dc190
push eax
push 0x2c
push esi
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x26ac]
call fcn.005dc190
mov esi, dword [ebp - 0x6f78]
mov ecx, esi
push eax
push str._r_n_t_tPath:
call fcn.005dc190
push eax
push str.__r_n_t_tUser_name:
lea ecx, [ebp - 0x275c]
call fcn.005dc190
push eax
push 0x62d7ec
lea ecx, [ebp - 0x27c8]
call fcn.005dc190
push eax
push str._r_n_t_tExtension_found:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
jmp 0x521222
mov esi, dword [ebp - 0x6f78]
lea eax, [ebp - 0x2ac8]
push eax
lea eax, [ebp - 0x6f38]
push eax
lea ecx, [ebp - 0x256c]
call fcn.005b5050
test al, al
jne 0x520f30
lea ecx, [ebp - 0x4ab0]
call fcn.00401230
test al, al
jne 0x520e20
lea ecx, [ebp - 0x4ab0]
call fcn.00401180
lea ecx, [ebp - 0x26ac]
call fcn.005dc430
lea ecx, [ebp - 0x2750]
call fcn.005dc430
lea ecx, [ebp - 0x27c8]
call fcn.005dc430
lea ecx, [ebp - 0x275c]
mov byte [ebp - 4], 0x98
call fcn.005dc430
mov eax, dword [ebp - 0x6f8c]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f8c], eax
cmp eax, dword [edi + 0x30]
jb 0x520d02
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x522962
push 0
push str._r_n_tChromes_non_standard_shortcuts:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
lea ecx, [ebp - 0x6da8]
call fcn.00402740
mov byte [ebp - 4], 0xa0
lea ecx, [ebp - 0x6da0]
mov eax, dword [edi + 8]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x6da8], eax
mov dword [ebp - 0x6da4], 0x2d
call fcn.005dc400
lea eax, [ebp - 0x21e0]
mov dword [ebp - 0x6d90], eax
lea ecx, [ebp - 0x6d80]
lea eax, [edi + 0x164]
mov dword [ebp - 0x6d8c], eax
lea eax, [ebp - 0x1fc8]
mov dword [ebp - 0x6d88], eax
mov eax, dword [edi + 4]
push str.Google_Chrome
mov dword [ebp - 0x6d84], eax
call fcn.005dc510
push 0xc
lea ecx, [ebp - 0x2278]
call fcn.00401d40
lea ecx, [ebp - 0x2278]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2260]
mov byte [ebp - 4], 0xa1
call fcn.00401d40
lea ecx, [ebp - 0x2260]
call fcn.005dc5e0
mov ecx, edi
mov byte [ebp - 4], 0xa2
call fcn.0050db30
test al, al
jne 0x522941
xor esi, esi
mov dword [ebp - 0x6f78], esi
cmp dword [edi + 0x30], esi
jbe 0x521537
nop dword [eax]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x521537
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc3a0
cmp eax, 3
jl 0x521527
lea eax, [ebp - 0x6da0]
push eax
push 0
lea ecx, [ebp - 0x2160]
call fcn.005dc190
push dword [ebp - 0x6f78]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0058f340
mov esi, dword [ebp - 0x6f78]
test al, al
je 0x521527
push esi
lea ecx, [edi + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x250c]
mov dword [ebp - 0x6d94], eax
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2278]
call fcn.005dc200
lea ecx, [ebp - 0x2278]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x521527
lea ecx, [ebp - 0x2278]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6da8]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x521537
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x25bc]
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2278]
call fcn.005dc200
lea ecx, [ebp - 0x2278]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x521527
push 0
lea ecx, [ebp - 0x2278]
call fcn.005dbed0
lea ecx, [ebp - 0x2278]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6da8]
mov ecx, edi
push eax
call fcn.0052e3e0
inc esi
mov dword [ebp - 0x6f78], esi
cmp esi, dword [edi + 0x30]
jb 0x5213a0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x522941
lea ecx, [ebp - 0x264c]
mov dword [ebp - 0x6d94], str._All_users_
call fcn.005dc190
push eax
lea eax, [ebp - 0x6da8]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x522941
lea eax, [ebp - 0x2640]
push eax
lea ecx, [ebp - 0x2278]
call fcn.005dc4e0
push 0
lea ecx, [ebp - 0x2278]
call fcn.005dbed0
lea ecx, [ebp - 0x2278]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6da8]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x522941
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x52162a
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareClientsStartMenuInternetGoogle_Chrome_shellopencommand
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x5215e0
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREClientsStartMenuInternetGoogle_Chrome_shellopencommand
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x521691
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREClientsStartMenuInternetGoogle_Chrome_shellopencommand
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fac], 0
mov dword [ebp - 0x6f8c], 0
jbe 0x52188b
mov eax, dword [ebp - 0x6fa0]
mov esi, dword [ebp - 0x6fa8]
sub eax, esi
mov dword [ebp - 0x6fb4], eax
nop dword [eax]
push 0
push 0x20019
lea ecx, [eax + esi]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x521869
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52188b
lea eax, [ebp - 0x2260]
push eax
push 0x62439c
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x521869
push 0
push 1
push 1
push 0
push str.chrome.exe
lea ecx, [ebp - 0x2260]
call fcn.005daa70
lea ecx, [ebp - 0x2260]
mov dword [ebp - 0x6f80], eax
call fcn.005dc3a0
mov edx, dword [ebp - 0x6f80]
lea ecx, [edx + 0xa]
cmp eax, ecx
jle 0x521869
lea eax, [edx + 0xb]
push eax
lea ecx, [ebp - 0x2260]
call fcn.005dad50
push 3
lea ecx, [ebp - 0x2260]
call fcn.005da0f0
lea ecx, [ebp - 0x2260]
call fcn.005dbeb0
test al, al
jne 0x521869
push 0
push str.Chrome_shortcuts
lea ecx, [ebp - 0x2260]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x521869
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2260]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Start_Menu_Internet_shortcut
push 2
push 0x2d
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x521869
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
mov ecx, dword [ebp - 0x6fb4]
push eax
push 0
lea ecx, [ecx + esi]
call fcn.005dc190
push eax
push 0x2d
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2260]
call fcn.005dc190
push eax
push str._r_n_t_tStart_Menu_Internet_shortcut_argument:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6f8c]
add esi, 0xc
inc eax
cmp eax, dword [ebp - 0x6fac]
mov dword [ebp - 0x6f8c], eax
mov eax, dword [ebp - 0x6fb4]
jb 0x5216c0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x522941
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x52190a
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwarePoliciesGoogleChrome
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x5218c0
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREPoliciesGoogleChrome
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x521971
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREPoliciesGoogleChrome
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
push 0
push str._r_n_tChromes_Group_Policies:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov esi, dword [ebp - 0x6fac]
mov dword [ebp - 0x6fb4], 0
test esi, esi
je 0x521bbe
mov eax, dword [ebp - 0x6fa0]
mov esi, dword [ebp - 0x6fa8]
sub eax, esi
mov dword [ebp - 0x6f8c], eax
nop
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x521bb8
mov ecx, dword [ebp - 0x6f8c]
push 0
push 0x20019
lea ecx, [ecx + esi]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
lea eax, [ebp - 0x1fe4]
push eax
push str.HomepageLocation
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x521b9c
lea eax, [ebp - 0x2180]
mov dword [ebp - 0x2180], 0
push eax
push str.HomepageIsNewTabPage
lea ecx, [ebp - 0x1f74]
call fcn.005d66b0
test al, al
je 0x521a31
cmp dword [ebp - 0x2180], 0
jne 0x521b9c
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x521b9c
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x521b9c
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x521b9c
push eax
push 1
push 1
push eax
push str.:__www.yahoo.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x521b9c
push eax
push str.Chrome_group_policies
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x521b9c
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.HomepageLocation
push 2
push 0x2f
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x521b9c
push 0
push 0
push 0
push 0
push 0
push str.HomepageLocation
mov ecx, esi
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
lea ecx, [ecx + esi]
call fcn.005dc190
push eax
push 0x2f
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
push str._r_n_t_tChromes_Default_Homepage_policy:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x5219b0
mov esi, dword [ebp - 0x6fac]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x522941
push 0xc
lea ecx, [ebp - 0x26a0]
call fcn.00401d40
lea ecx, [ebp - 0x26a0]
call fcn.005dc5e0
mov byte [ebp - 4], 0xa3
mov dword [ebp - 0x6fb4], 0
test esi, esi
je 0x521e87
mov eax, dword [ebp - 0x6fa0]
mov esi, dword [ebp - 0x6fa8]
sub eax, esi
mov dword [ebp - 0x6f8c], eax
nop
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x521e81
mov ecx, dword [ebp - 0x6f8c]
push 0
push 0x20019
lea ecx, [ecx + esi]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
lea eax, [ebp - 0x1fe4]
push eax
push str.DefaultSearchProviderSearchURL
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x521e65
lea eax, [ebp - 0x2180]
mov dword [ebp - 0x2180], 0
push eax
push str.DefaultSearchProviderEnabled
lea ecx, [ebp - 0x1f74]
call fcn.005d66b0
test al, al
je 0x521c91
cmp dword [ebp - 0x2180], 0
je 0x521e65
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x521e65
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x521e65
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x521e65
push eax
push 1
push 1
push eax
push str.:__www.yahoo.
lea ecx, [ebp - 0x1fe4]
call fcn.005daa70
test eax, eax
jne 0x521e65
push eax
push str.Chrome_group_policies
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x521e65
lea eax, [ebp - 0x26a0]
push eax
push str.DefaultSearchProviderName
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x521e65
lea ecx, [ebp - 0x26a0]
call fcn.005dbeb0
test al, al
jne 0x521e65
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__search_provider_
lea ecx, [ebp - 0x26a0]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2260]
call fcn.005dc200
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2260]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 2
push 0x2f
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x521e65
push 0
push 0
push 0
push 0
push 0
push str.DefaultSearchProviderSearchURL
mov ecx, esi
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
lea ecx, [ecx + esi]
call fcn.005dc190
push eax
push 0x2f
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
push str._r_n_t_tChromes_Default_Search_Provider_policy:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x521c10
mov esi, dword [ebp - 0x6fac]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x522936
mov dword [ebp - 0x6fb4], 0
test esi, esi
je 0x522107
mov esi, dword [ebp - 0x6fa8]
mov eax, dword [ebp - 0x6fa0]
sub eax, esi
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f80], eax
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x522107
mov eax, dword [ebp - 0x6f80]
add eax, esi
push 0
push 0x20019
mov ecx, eax
mov dword [ebp - 0x6f8c], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x5220e5
lea eax, [ebp - 0x2180]
mov dword [ebp - 0x2180], 0
push eax
push str.RestoreOnStartup
lea ecx, [ebp - 0x1f74]
call fcn.005d66b0
test al, al
je 0x5220e5
cmp dword [ebp - 0x2180], 4
jne 0x5220e5
mov ecx, dword [ebp - 0x6f8c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RestoreOnStartupURLs
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x5220e5
lea eax, [ebp - 0x6cec]
xor esi, esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
mov dword [ebp - 0x6fa4], esi
call fcn.005d62e0
test al, al
je 0x5220df
lea eax, [ebp - 0x1fe4]
push eax
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x5220bd
lea ecx, [ebp - 0x1fe4]
call fcn.005dbeb0
test al, al
jne 0x5220bd
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 0x669320
push 2
push 0x2f
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6fcc], eax
cmp eax, 0xffffffff
je 0x5220bd
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
call fcn.005dc190
push eax
push 0x2f
push dword [ebp - 0x6fcc]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x1fe4]
call fcn.005dc190
push eax
push str._r_n_t_tChromes_Startup_Page_policy:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x6cec]
inc esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
call fcn.005d62e0
test al, al
jne 0x521fb0
mov dword [ebp - 0x6fa4], esi
mov esi, dword [ebp - 0x6f78]
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x521ec2
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x522936
push 0
push str._r_n_tChrome_reset_options:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
cmp dword [edi + 0x30], 0
mov dword [ebp - 0x6f8c], 0
jbe 0x5224fb
mov esi, dword [ebp - 0x6fa8]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5224fb
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.GoogleChromeUser_Dataf
lea ecx, [ebp - 0x2160]
call fcn.005dc190
push eax
push dword [ebp - 0x6f8c]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20e4]
call fcn.005dc200
push 0x260
lea ecx, [ebp - 0x4850]
call fcn.00401d60
push 1
lea ecx, [ebp - 0x20e4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4850]
call fcn.00401130
push 3
lea ecx, [ebp - 0x20e4]
mov byte [ebp - 4], 0xa4
call fcn.005dadc0
lea ecx, [ebp - 0x4850]
call fcn.00401270
test al, al
je 0x5224d3
nop word [eax + eax]
push 1
lea ecx, [ebp - 0x4850]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc510
push str.Default
lea ecx, [ebp - 0x2028]
call fcn.005dc480
test al, al
je 0x52223e
push 0
push 1
push 1
push 0
push str.Profile
lea ecx, [ebp - 0x2028]
call fcn.005daa70
cmp eax, 1
jne 0x5224c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Secure_Preferences
push 1
lea ecx, [ebp - 0x4850]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x20e4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc200
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52237f
push 0
push str.Chrome_reset_options
push str.Reset_Secure_Preferences
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x52237f
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Secure_Preferences
push 2
push 0x2e
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x5224c0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
push 0
push 0x2e
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_Secure_Preferences
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push str.Chrome_reset_options
push str.Reset_Preferences
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x5224c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Preferences
push 1
lea ecx, [ebp - 0x4850]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x20e4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc200
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5224c0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Preferences
push 2
push 0x2e
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x5224c0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
push 0
push 0x2e
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_Preferences
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea ecx, [ebp - 0x4850]
call fcn.00401230
test al, al
jne 0x5221f0
lea ecx, [ebp - 0x4850]
mov byte [ebp - 4], 0xa3
call fcn.00401180
mov eax, dword [ebp - 0x6f8c]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f8c], eax
cmp eax, dword [edi + 0x30]
jb 0x522142
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x522936
lea eax, [ebp - 0x22e8]
push eax
lea ecx, [ebp - 0x2028]
call fcn.005dc4e0
push 1
lea ecx, [ebp - 0x2028]
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.master_preferences
lea ecx, [ebp - 0x2028]
call fcn.005da780
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5226e5
push 0
push str.Chrome_reset_options
push str.Reset_Default_Preferences
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x5226e5
push 0
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x256c]
call fcn.005b5da0
test al, al
je 0x5226e5
lea eax, [ebp - 0x2a40]
push eax
push 0x629fdc
push str.homepage
lea ecx, [ebp - 0x256c]
call fcn.005b5630
test al, al
jne 0x52262d
lea eax, [ebp - 0x2a40]
push eax
push 0x629fdc
push str.session__startup_urls
lea ecx, [ebp - 0x256c]
call fcn.005b5630
test al, al
jne 0x52262d
lea eax, [ebp - 0x2a40]
push eax
push 0x629fdc
push str.default_search_provider_data
lea ecx, [ebp - 0x256c]
call fcn.005b5630
test al, al
jne 0x52262d
lea eax, [ebp - 0x2a40]
push eax
push 0x629fdc
push str.extensions__settings
lea ecx, [ebp - 0x256c]
call fcn.005b5630
test al, al
je 0x5226e5
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str._All_users_
push str.Reset_Default_Preferences
push 2
push 0x2e
push dword [eax + 0xa8]
call fcn.0053ab00
mov esi, eax
cmp esi, 0xffffffff
je 0x5226e5
push 0
push 0
push 0
push 0
push 0
push 0
push str._All_users_
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
push 0
push 0x2e
push esi
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2028]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
push str._r_n_t_tUser_name:__All_users_
push str._r_n_t_tOption_name:_Reset_Default_Preferences
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push str.Chrome_reset_options
push str.Reset_Chrome_Policies
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x522936
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x52276a
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
nop dword [eax + eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwarePoliciesGoogleChrome
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x522720
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwarePoliciesGoogleChrome
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x5227d1
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SoftwarePoliciesGoogleChrome
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fac], 0
mov dword [ebp - 0x6fb4], 0
jbe 0x522912
mov eax, dword [ebp - 0x6fa8]
sub eax, esi
mov dword [ebp - 0x6f8c], eax
mov ecx, esi
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005d3780
test al, al
je 0x5228f6
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x522912
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
lea ecx, [ecx + esi]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Chrome_Policies
push 2
push 0x2e
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x5228f6
mov ecx, dword [ebp - 0x6f8c]
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ecx + esi]
call fcn.005dc190
push eax
push 0
mov ecx, esi
call fcn.005dc190
push eax
push 0x2e
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
mov ecx, esi
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str._r_n_t_tInfo:
lea ecx, [ecx + esi]
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_Chrome_Policies
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x5227f6
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa8]
call fcn.005bb910
push 1
push 0
push 0
lea ecx, [ebp - 0x21e0]
call fcn.005dca80
lea ecx, [ebp - 0x26a0]
call fcn.005dc430
lea ecx, [ebp - 0x2260]
call fcn.005dc430
lea ecx, [ebp - 0x2278]
call fcn.005dc430
lea ecx, [ebp - 0x6da8]
call fcn.00402770
lea ecx, [ebp - 0x256c]
call fcn.00401e70
lea ecx, [ebp - 0x22e8]
call fcn.005dc430
lea ecx, [ebp - 0x1fe4]
call fcn.005dc430
lea ecx, [ebp - 0x23e8]
call fcn.005dc430
lea ecx, [ebp - 0x2028]
call fcn.005dc430
lea ecx, [ebp - 0x20e4]
mov byte [ebp - 4], 0x46
call fcn.005dc430
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x524b5c
test dword [edi + 0x34], 0x1000
jne 0x524b5c
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push str.Scanning_Firefox...
push dword [eax + 0x38]
call fcn.005bcd30
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x2f
push dword [eax + 0x34]
call fcn.005b9910
push 0xc
lea ecx, [ebp - 0x216c]
call fcn.00401d40
lea ecx, [ebp - 0x216c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2040]
mov byte [ebp - 4], 0xa5
call fcn.00401d40
lea ecx, [ebp - 0x2040]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x24b8]
mov byte [ebp - 4], 0xa6
call fcn.00401d40
lea ecx, [ebp - 0x24b8]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2178]
mov byte [ebp - 4], 0xa7
call fcn.00401d40
lea ecx, [ebp - 0x2178]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2394]
mov byte [ebp - 4], 0xa8
call fcn.00401d40
lea ecx, [ebp - 0x2394]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x229c]
mov byte [ebp - 4], 0xa9
call fcn.00401d40
lea ecx, [ebp - 0x229c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2340]
mov byte [ebp - 4], 0xaa
call fcn.00401d40
lea ecx, [ebp - 0x2340]
call fcn.005dc5e0
mov byte [ebp - 4], 0xab
lea ecx, [ebp - 0x28cc]
xor esi, esi
push 0x20
mov dword [ebp - 0x6fb4], esi
call fcn.00401e40
lea ecx, [ebp - 0x28cc]
call fcn.005e47e0
mov byte [ebp - 4], 0xac
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa8]
call fcn.005bb910
push esi
push str._r_n_r_n__Mozilla_Firefox_scan:_r_n_r_n_tFirefox_startup_pages:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov dword [ebp - 0x6f9c], esi
cmp dword [edi + 0x30], esi
jbe 0x522ee9
mov eax, dword [ebp - 0x6fa8]
lea esi, [edi + 0x10c]
mov dword [ebp - 0x6f78], eax
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x522ee3
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MozillaFirefox_
lea ecx, [ebp - 0x226c]
call fcn.005dc190
push eax
push dword [ebp - 0x6f9c]
mov ecx, esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2394]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.profiles.ini
lea ecx, [ebp - 0x2394]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x229c]
call fcn.005dc200
lea ecx, [ebp - 0x229c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x522ec6
lea ecx, [ebp - 0x2340]
call fcn.005dbeb0
test al, al
je 0x522bf6
lea eax, [ebp - 0x2340]
push eax
lea ecx, [ebp - 0x226c]
call fcn.005dc190
push dword [ebp - 0x6f9c]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0058f140
lea eax, [ebp - 0x216c]
xor esi, esi
push eax
lea ecx, [ebp - 0x229c]
mov dword [ebp - 0x6f8c], esi
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.0058ef60
test al, al
je 0x522ec0
lea ecx, [ebp - 0x216c]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x522e96
inc dword [ebp - 0x6fb4]
lea ecx, [ebp - 0x2480]
push 0xc
call fcn.00401d40
lea ecx, [ebp - 0x2480]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x267c]
mov byte [ebp - 4], 0xad
call fcn.00401d40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64ebf8
lea ecx, [ebp - 0x216c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x267c]
call fcn.005dc520
lea eax, [ebp - 0x2480]
mov byte [ebp - 4], 0xae
push eax
lea ecx, [ebp - 0x267c]
call fcn.005dc190
mov edx, str.browser.startup.homepage
mov ecx, eax
call fcn.0058ecd0
test al, al
je 0x522e7c
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x2480]
call fcn.005daa70
test eax, eax
jne 0x522e7c
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x2480]
call fcn.005daa70
test eax, eax
jne 0x522e7c
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x2480]
call fcn.005daa70
test eax, eax
jne 0x522e7c
push eax
push 1
push 1
push eax
push str.:__www.yahoo.
lea ecx, [ebp - 0x2480]
call fcn.005daa70
test eax, eax
jne 0x522e7c
push eax
push str.Firefox_startup_pages
lea ecx, [ebp - 0x2480]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x522e7c
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2480]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Startup_homepage
push 3
push 0x33
push dword [eax + 0xa8]
call fcn.0053ab00
mov esi, eax
cmp esi, 0xffffffff
jne 0x522dc4
lea ecx, [ebp - 0x267c]
call fcn.005dc430
lea ecx, [ebp - 0x2480]
mov byte [ebp - 4], 0xac
call fcn.005dc430
mov esi, dword [ebp - 0x6f8c]
jmp 0x522e96
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x267c]
call fcn.005dc190
push eax
push 0
push 0x33
push esi
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x267c]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push str._r_n_t_tPath:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2480]
call fcn.005dc190
push eax
push str._r_n_t_tStartup_homepage:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea ecx, [ebp - 0x267c]
call fcn.005dc430
lea ecx, [ebp - 0x2480]
mov byte [ebp - 4], 0xac
call fcn.005dc430
mov esi, dword [ebp - 0x6f8c]
jmp 0x522e96
lea ecx, [ebp - 0x267c]
call fcn.005dc430
lea ecx, [ebp - 0x2480]
mov byte [ebp - 4], 0xac
call fcn.005dc430
lea eax, [ebp - 0x216c]
inc esi
push eax
lea ecx, [ebp - 0x229c]
mov dword [ebp - 0x6f8c], esi
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0058ef60
test al, al
jne 0x522c21
lea esi, [edi + 0x10c]
mov eax, dword [ebp - 0x6f9c]
add dword [ebp - 0x6f78], 0xc
inc eax
mov dword [ebp - 0x6f9c], eax
cmp eax, dword [edi + 0x30]
jb 0x522b16
mov esi, dword [ebp - 0x6fb4]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x524b00
test esi, esi
jne 0x522f21
lea ecx, [ebp - 0x2340]
call fcn.005dbeb0
test al, al
je 0x522f21
push esi
push str._r_n_tNo_Firefox_profiles_have_been_found:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
jmp 0x524b00
push fcn.005dc430
push fcn.005dc5e0
push 2
push 0xc
lea eax, [ebp - 0x2c]
push eax
call fcn.0041e804
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Mozilla_Firefox_browser_searchplugins
lea ecx, [ebp - 0x2708]
mov byte [ebp - 4], 0xaf
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Mozilla_Firefox_browser_searchplugins
lea ecx, [ebp - 0x26fc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
push 0xc
lea ecx, [ebp - 0x24e8]
call fcn.00401d40
push 1
push str.amazondotcom.xmlbing.xmleBay.xmlgoogle.xmltwitter.xmlwikipedia.xmlyahoo.xmlduckduckgo.xml
lea ecx, [ebp - 0x24e8]
call fcn.005dc570
push 0
push str._r_n_tFirefox_search_plug_ins:_r_n
lea ecx, [ebp - 0x1fc8]
mov byte [ebp - 4], 0xb0
call fcn.005e37e0
xor esi, esi
mov dword [ebp - 0x6fb4], esi
cmp dword [edi + 0x30], esi
jbe 0x52334d
mov eax, dword [ebp - 0x6fa8]
mov dword [ebp - 0x6f78], eax
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52334d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MozillaFirefox_
lea ecx, [ebp - 0x226c]
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2394]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.profiles.ini
lea ecx, [ebp - 0x2394]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x229c]
call fcn.005dc200
lea ecx, [ebp - 0x229c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x523336
lea eax, [ebp - 0x216c]
xor esi, esi
push eax
lea ecx, [ebp - 0x229c]
mov dword [ebp - 0x6f8c], esi
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.0058ef60
test al, al
je 0x523330
nop
lea ecx, [ebp - 0x216c]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x523306
push 0xc
lea ecx, [ebp - 0x2474]
call fcn.00401d40
lea ecx, [ebp - 0x2474]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2634]
mov byte [ebp - 4], 0xb1
call fcn.00401d40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64ebf8
lea ecx, [ebp - 0x216c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2634]
call fcn.005dc520
lea eax, [ebp - 0x2474]
mov byte [ebp - 4], 0xb2
push eax
lea ecx, [ebp - 0x2634]
call fcn.005dc190
mov edx, str.browser.search.defaultenginename
mov ecx, eax
call fcn.0058ecd0
test al, al
je 0x5232ec
push 0x660330
lea ecx, [ebp - 0x2474]
call fcn.005dc4c0
test al, al
jne 0x5232ec
push str.Bing
lea ecx, [ebp - 0x2474]
call fcn.005dc4c0
test al, al
jne 0x5232ec
push str.Yahoo
lea ecx, [ebp - 0x2474]
call fcn.005dc4c0
test al, al
jne 0x5232ec
push str.DuckDuckGo
lea ecx, [ebp - 0x2474]
call fcn.005dc4c0
test al, al
jne 0x5232ec
push 0
push str.Firefox_search_providers
lea ecx, [ebp - 0x2474]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x5232ec
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2474]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Firefox_default_search_provider
push 3
push 0x34
push dword [eax + 0xa8]
call fcn.0053ab00
mov esi, eax
cmp esi, 0xffffffff
jne 0x523234
lea ecx, [ebp - 0x2634]
call fcn.005dc430
lea ecx, [ebp - 0x2474]
mov byte [ebp - 4], 0xb0
call fcn.005dc430
mov esi, dword [ebp - 0x6f8c]
jmp 0x523306
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2634]
call fcn.005dc190
push eax
push 0
push 0x34
push esi
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2634]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push str._r_n_t_tPath:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2474]
call fcn.005dc190
push eax
push str._r_n_t_tSearch_provider:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea ecx, [ebp - 0x2634]
call fcn.005dc430
lea ecx, [ebp - 0x2474]
mov byte [ebp - 4], 0xb0
call fcn.005dc430
mov esi, dword [ebp - 0x6f8c]
jmp 0x523306
lea ecx, [ebp - 0x2634]
call fcn.005dc430
lea ecx, [ebp - 0x2474]
mov byte [ebp - 4], 0xb0
call fcn.005dc430
lea eax, [ebp - 0x216c]
inc esi
push eax
lea ecx, [ebp - 0x229c]
mov dword [ebp - 0x6f8c], esi
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0058ef60
test al, al
jne 0x5230b0
mov esi, dword [ebp - 0x6fb4]
add dword [ebp - 0x6f78], 0xc
inc esi
mov dword [ebp - 0x6fb4], esi
cmp esi, dword [edi + 0x30]
jb 0x522fe8
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x524adf
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x6fb4], 0
mov dword [ebp - 0x6f8c], esi
nop
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5236ab
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..xml
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc200
push 0x260
lea ecx, [ebp - 0x45f0]
call fcn.00401d60
push 1
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x45f0]
call fcn.00401130
push 1
lea ecx, [ebp - 0x2040]
mov byte [ebp - 4], 0xb3
call fcn.005dc190
push eax
lea ecx, [ebp - 0x45f0]
call fcn.00401280
test al, al
je 0x52367d
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62794c
push 1
lea ecx, [ebp - 0x45f0]
call fcn.004012d0
push eax
push 0x62794c
lea ecx, [ebp - 0x2178]
call fcn.005dc200
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x2178]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24e8]
call fcn.005daa70
test eax, eax
jne 0x523664
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 1
lea ecx, [ebp - 0x45f0]
call fcn.004012d0
push eax
push 0x624284
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc200
lea ecx, [ebp - 0x2178]
call fcn.005dc400
push 0
push 0x80
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x28cc]
call fcn.005e4120
test eax, eax
je 0x523532
push 0
lea eax, [ebp - 0x2178]
push eax
lea ecx, [ebp - 0x28cc]
call fcn.005e3f60
test eax, eax
je 0x523532
push 0
push 1
push 1
push 0
push str._ShortName_
lea ecx, [ebp - 0x2178]
call fcn.005daa70
mov esi, eax
push 0
lea ecx, [esi + 0xa]
push ecx
push 1
push 0
push str.__ShortName_
lea ecx, [ebp - 0x2178]
call fcn.005daa70
test esi, esi
je 0x523527
test eax, eax
je 0x523527
sub eax, esi
lea ecx, [ebp - 0x2178]
sub eax, 0xb
push eax
lea eax, [esi + 0xb]
push eax
call fcn.005dad10
jmp 0x523532
lea ecx, [ebp - 0x2178]
call fcn.005dc400
lea ecx, [ebp - 0x2178]
call fcn.005dbeb0
test al, al
je 0x523569
push 1
lea ecx, [ebp - 0x45f0]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x2178]
call fcn.005dc510
push 0
lea ecx, [ebp - 0x2178]
call fcn.005dbf40
jmp 0x523576
push 3
lea ecx, [ebp - 0x2178]
call fcn.005da0f0
push 0
push str.Firefox_search_providers
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x523664
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
push str._All_users_
lea ecx, [ebp - 0x2178]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 3
push 0x34
push dword [eax + 0xa8]
call fcn.0053ab00
mov esi, eax
cmp esi, 0xffffffff
je 0x523664
push 0
push 0
push 0
push 0
push 0
push 0
push str._All_users_
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
push 0
push 0x34
push esi
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
push str._r_n_t_tPath:
push str._All_users_
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2178]
call fcn.005dc190
push eax
push str._r_n_t_tPlugin_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea ecx, [ebp - 0x45f0]
call fcn.00401230
mov esi, dword [ebp - 0x6f8c]
test al, al
jne 0x523400
lea ecx, [ebp - 0x45f0]
mov byte [ebp - 4], 0xb0
call fcn.00401180
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f8c], esi
mov dword [ebp - 0x6fb4], eax
cmp eax, 2
jb 0x523370
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x524adf
push 0x24
lea ecx, [ebp - 0x2868]
call fcn.004020b0
lea ecx, [ebp - 0x2868]
call fcn.005b5fe0
push 0xc
lea ecx, [ebp - 0x2290]
mov byte [ebp - 4], 0xb4
call fcn.00401d40
lea ecx, [ebp - 0x2290]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x245c]
mov byte [ebp - 4], 0xb5
call fcn.00401d40
lea ecx, [ebp - 0x245c]
call fcn.005dc5e0
push 0
push str._r_n_tFirefox_extensions:_r_n
lea ecx, [ebp - 0x1fc8]
mov byte [ebp - 4], 0xb6
call fcn.005e37e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.WhiteListFirefox_Extensions
lea ecx, [edi + 0x33c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
cmp dword [edi + 0x30], 0
mov dword [ebp - 0x6fb4], 0
jbe 0x523ba0
mov esi, dword [ebp - 0x6fa8]
mov dword [ebp - 0x6f9c], esi
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x523ba0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MozillaFirefoxProfiles.ini
lea ecx, [ebp - 0x226c]
call fcn.005dc190
push eax
push dword [ebp - 0x6fb4]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x216c]
call fcn.005dc200
lea eax, [ebp - 0x2040]
xor edx, edx
push eax
lea ecx, [ebp - 0x216c]
mov dword [ebp - 0x6f8c], edx
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.0058ef60
test al, al
je 0x523b81
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.extensions.json
lea ecx, [ebp - 0x2040]
call fcn.005da780
push 0x100
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2868]
call fcn.005b5da0
test al, al
je 0x523b54
push 0
lea eax, [ebp - 0x2a78]
mov dword [ebp - 0x6eec], 0
push eax
xorps xmm0, xmm0
lea ecx, [ebp - 0x2868]
push str.addons
movups xmmword [ebp - 0x6efc], xmm0
call fcn.005b5760
test al, al
je 0x523b54
lea eax, [ebp - 0x2a78]
push eax
lea eax, [ebp - 0x6efc]
push eax
lea ecx, [ebp - 0x2868]
call fcn.005b4c80
test al, al
je 0x523b54
lea eax, [ebp - 0x2290]
push eax
push 0x66b31c
lea eax, [ebp - 0x6efc]
push eax
lea ecx, [ebp - 0x2868]
call fcn.005b54e0
test eax, eax
je 0x523b33
push 0
push 1
push 1
push 0
push str._search.mozilla.org
lea ecx, [ebp - 0x2290]
call fcn.005daa70
lea ecx, [ebp - 0x2290]
mov esi, eax
call fcn.005dc3a0
sub eax, 0x12
cmp esi, eax
je 0x523b2d
push 0
push 1
push 1
push 0
push str._mozilla.com
lea ecx, [ebp - 0x2290]
call fcn.005daa70
lea ecx, [ebp - 0x2290]
mov esi, eax
call fcn.005dc3a0
sub eax, 0xb
cmp esi, eax
je 0x523b2d
push 0
push 1
push 1
push 0
push str._mozilla.org
lea ecx, [ebp - 0x2290]
call fcn.005daa70
lea ecx, [ebp - 0x2290]
mov esi, eax
call fcn.005dc3a0
sub eax, 0xb
cmp esi, eax
je 0x523b2d
lea eax, [ebp - 0x6efc]
push eax
lea eax, [ebp - 0x2bbc]
push eax
push str.defaultLocale
lea ecx, [ebp - 0x2868]
call fcn.005b5760
test al, al
je 0x523b2d
lea eax, [ebp - 0x2290]
push eax
push str.name
lea eax, [ebp - 0x2bbc]
push eax
lea ecx, [ebp - 0x2868]
call fcn.005b54e0
test eax, eax
je 0x523b2d
push str.Default
lea ecx, [ebp - 0x2290]
call fcn.005dc4c0
test al, al
jne 0x523b2d
lea eax, [ebp - 0x245c]
push eax
push str.descriptor
lea eax, [ebp - 0x6efc]
push eax
lea ecx, [ebp - 0x2868]
call fcn.005b54e0
test eax, eax
jne 0x5239f3
lea eax, [ebp - 0x245c]
push eax
push str.path
lea eax, [ebp - 0x6efc]
push eax
lea ecx, [ebp - 0x2868]
call fcn.005b54e0
test eax, eax
je 0x523b2d
lea ecx, [ebp - 0x2290]
call fcn.005dc190
lea ecx, [ebp - 0x1f8c]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x523b2d
push 0
push str.Firefox_extensions
lea ecx, [ebp - 0x2290]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x523b2d
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x245c]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f9c]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2290]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 3
push 0x35
push dword [eax + 0xa8]
call fcn.0053ab00
mov esi, eax
cmp esi, 0xffffffff
je 0x523b2d
lea ecx, [ebp - 0x2040]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f9c]
push eax
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x245c]
call fcn.005dc190
push eax
push 0
push 0x35
push esi
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x245c]
call fcn.005dc190
mov esi, dword [ebp - 0x6f9c]
mov ecx, esi
push eax
push str._r_n_t_tPath:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2290]
call fcn.005dc190
push eax
push str._r_n_t_tExtension_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
jmp 0x523b33
mov esi, dword [ebp - 0x6f9c]
lea eax, [ebp - 0x2a78]
push eax
lea eax, [ebp - 0x6efc]
push eax
lea ecx, [ebp - 0x2868]
call fcn.005b4c80
test al, al
jne 0x523891
inc dword [ebp - 0x6f8c]
lea eax, [ebp - 0x2040]
push eax
lea ecx, [ebp - 0x216c]
call fcn.005dc190
mov edx, dword [ebp - 0x6f8c]
mov ecx, eax
call fcn.0058ef60
test al, al
jne 0x5237f1
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f9c], esi
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [edi + 0x30]
jb 0x523770
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x524abe
push 0
push str._r_n_tFirefox_shortcuts:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
lea ecx, [ebp - 0x6ea0]
call fcn.00402740
mov byte [ebp - 4], 0xb7
lea ecx, [ebp - 0x6e98]
mov eax, dword [edi + 8]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x6ea0], eax
mov dword [ebp - 0x6e9c], 0x37
call fcn.005dc400
lea eax, [ebp - 0x21e0]
mov dword [ebp - 0x6e88], eax
lea ecx, [ebp - 0x6e78]
lea eax, [edi + 0x164]
mov dword [ebp - 0x6e84], eax
lea eax, [ebp - 0x1fc8]
mov dword [ebp - 0x6e80], eax
mov eax, dword [edi + 4]
push str.Mozilla_Firefox
mov dword [ebp - 0x6e7c], eax
call fcn.005dc510
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x524ab3
push 0xc
lea ecx, [ebp - 0x23c4]
call fcn.00401d40
lea ecx, [ebp - 0x23c4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2430]
mov byte [ebp - 4], 0xb8
call fcn.00401d40
lea ecx, [ebp - 0x2430]
call fcn.005dc5e0
xor esi, esi
mov byte [ebp - 4], 0xb9
mov dword [ebp - 0x6f78], esi
cmp dword [edi + 0x30], esi
jbe 0x523e25
nop dword [eax]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x523e25
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc3a0
cmp eax, 3
jl 0x523e15
lea eax, [ebp - 0x6e98]
push eax
lea ecx, [ebp - 0x226c]
call fcn.005dc190
push dword [ebp - 0x6f78]
lea ecx, [edi + 0x10c]
mov esi, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0058f140
mov esi, dword [ebp - 0x6f78]
test al, al
je 0x523e15
push esi
lea ecx, [edi + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x250c]
mov dword [ebp - 0x6e8c], eax
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x23c4]
call fcn.005dc200
lea ecx, [ebp - 0x23c4]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x523e15
lea ecx, [ebp - 0x23c4]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6ea0]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x523e25
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x25bc]
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x23c4]
call fcn.005dc200
lea ecx, [ebp - 0x23c4]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x523e15
push 0
lea ecx, [ebp - 0x23c4]
call fcn.005dbed0
lea ecx, [ebp - 0x23c4]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6ea0]
mov ecx, edi
push eax
call fcn.0052e3e0
inc esi
mov dword [ebp - 0x6f78], esi
cmp esi, dword [edi + 0x30]
jb 0x523c90
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x524a9d
lea ecx, [ebp - 0x264c]
mov dword [ebp - 0x6e8c], str._All_users_
call fcn.005dc190
push eax
lea eax, [ebp - 0x6ea0]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x524a9d
push 0
push 1
lea ecx, [ebp - 0x2640]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x23c4]
call fcn.005dc260
mov ecx, eax
call fcn.005dbed0
lea ecx, [ebp - 0x23c4]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6ea0]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x524a9d
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x523f1b
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareClientsStartMenuInternet
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x523ed1
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREClientsStartMenuInternet
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x523f82
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREClientsStartMenuInternet
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
push 4
lea ecx, [ebp - 0x22c4]
call fcn.00401d80
lea ecx, [ebp - 0x22c4]
call fcn.005d6aa0
cmp dword [ebp - 0x6fac], 0
mov byte [ebp - 4], 0xba
mov dword [ebp - 0x6fb4], 0
jbe 0x5242b7
mov eax, dword [ebp - 0x6fa8]
mov ecx, esi
sub ecx, eax
mov dword [ebp - 0x6f78], eax
mov dword [ebp - 0x6fcc], ecx
nop dword [eax + eax]
add eax, ecx
push 0
push 0x20019
mov ecx, eax
mov dword [ebp - 0x6f8c], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x22c4]
call fcn.005d6a30
test al, al
je 0x524289
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5242b7
xor esi, esi
mov ecx, edi
mov dword [ebp - 0x6fa4], esi
call fcn.0050db30
test al, al
jne 0x524289
lea eax, [ebp - 0x6cec]
push eax
push esi
lea ecx, [ebp - 0x22c4]
call fcn.005d6380
test al, al
je 0x524283
mov ecx, dword [ebp - 0x6f8c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._shellopencommand
push dword [ebp - 0x6cec]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
mov ecx, dword [ebp - 0x6f8c]
push 0
call fcn.005dc3a0
push eax
push 1
push 0
push 0x670e58
lea ecx, [ebp - 0x1f8c]
call fcn.005daa70
test eax, eax
je 0x524273
lea eax, [ebp - 0x2430]
push eax
push 0x62439c
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d65d0
test al, al
je 0x524273
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x2340]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2430]
call fcn.005daa70
mov dword [ebp - 0x6f80], eax
test eax, eax
je 0x524273
lea ecx, [ebp - 0x2340]
call fcn.005dc3a0
add eax, dword [ebp - 0x6f80]
lea ecx, [ebp - 0x2430]
push eax
call fcn.005dad50
push 3
push 0
push 0
push 0x62439c
push 0x624388
lea ecx, [ebp - 0x2430]
call fcn.005da270
mov ecx, eax
call fcn.005da0f0
lea ecx, [ebp - 0x2430]
call fcn.005dc3a0
cmp eax, 3
jl 0x524273
push 0
push str.Firefox_shortcuts
lea ecx, [ebp - 0x2430]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x524273
mov ecx, dword [ebp - 0x6f8c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2430]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Start_Menu_Internet_shortcut
push 3
push 0x37
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x524273
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
push 0x37
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2430]
call fcn.005dc190
push eax
push str._r_n_t_tStart_Menu_Internet_shortcut_argument:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov ecx, edi
inc esi
call fcn.0050db30
test al, al
je 0x524020
mov dword [ebp - 0x6fa4], esi
mov ecx, dword [ebp - 0x6fb4]
mov eax, dword [ebp - 0x6f78]
inc ecx
add eax, 0xc
mov dword [ebp - 0x6fb4], ecx
cmp ecx, dword [ebp - 0x6fac]
mov ecx, dword [ebp - 0x6fcc]
mov dword [ebp - 0x6f78], eax
jb 0x523fd0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x524a92
push 0
push str._r_n_tFirefox_reset_options:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
push 0xc
lea ecx, [ebp - 0x24f4]
call fcn.00401d40
lea ecx, [ebp - 0x24f4]
call fcn.005dc5e0
mov byte [ebp - 4], 0xbb
cmp dword [edi + 0x30], 0
mov dword [ebp - 0x6fb4], 0
jbe 0x524a58
mov esi, dword [ebp - 0x6fa8]
nop
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x524a58
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MozillaFirefoxProfiles.ini
lea ecx, [ebp - 0x226c]
call fcn.005dc190
push eax
push dword [ebp - 0x6fb4]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x216c]
call fcn.005dc200
lea eax, [ebp - 0x24f4]
xor edx, edx
push eax
lea ecx, [ebp - 0x216c]
mov dword [ebp - 0x6f8c], edx
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.0058ef60
test al, al
je 0x524a3f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._addons.json
lea ecx, [ebp - 0x24f4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc200
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5244c6
push 0
push str.Firefox_reset_options
push str.Reset_Firefox_Ad_ons
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x5244c6
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Firefox_Ad_ons
push 3
push 0x38
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x5244c6
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
push 0
push 0x38
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
push str._r_n_t_tPath:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_Firefox_Ad_ons
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64ebc4
lea ecx, [ebp - 0x24f4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc200
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x524532
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.extensions.json
lea ecx, [ebp - 0x24f4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc200
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x524637
push 0
push str.Firefox_reset_options
push str.Reset_Firefox_Extensions
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x524637
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Firefox_Extensions
push 3
push 0x38
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x524637
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
push 0
push 0x38
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
push str._r_n_t_tPath:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_Firefox_Extensions
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._search.json
lea ecx, [ebp - 0x24f4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc200
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5246a3
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str._searchplugins
lea ecx, [ebp - 0x24f4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc200
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5247a8
push 0
push str.Firefox_reset_options
push str.Reset_Firefox_User_Search_Providers
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x5247a8
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Firefox_User_Search_Providers
push 3
push 0x38
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x5247a8
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
push 0
push 0x38
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
push str._r_n_t_tPath:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_Firefox_User_Search_Providers
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64ebf8
lea ecx, [ebp - 0x24f4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc200
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5248dd
push 0
push str.Firefox_reset_options
push str.Reset_Firefox_Settings
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x5248dd
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Firefox_Settings
push 3
push 0x38
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x5248dd
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
push 0
push 0x38
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
push str._r_n_t_tPath:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_Firefox_Settings
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.user.js
lea ecx, [ebp - 0x24f4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc200
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x524a12
push 0
push str.Firefox_reset_options
push str.Reset_Firefox_User_Preferences
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x524a12
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Reset_Firefox_User_Preferences
push 3
push 0x38
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x524a12
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
push 0
push 0x38
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x2040]
call fcn.005dc190
push eax
push str._r_n_t_tPath:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
push str.Reset_Firefox_User_Preferences
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
inc dword [ebp - 0x6f8c]
lea eax, [ebp - 0x24f4]
push eax
lea ecx, [ebp - 0x216c]
call fcn.005dc190
mov edx, dword [ebp - 0x6f8c]
mov ecx, eax
call fcn.0058ef60
test al, al
jne 0x524391
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [edi + 0x30]
jb 0x524310
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa8]
call fcn.005bb910
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x524a87
push 1
push 0
push 0
lea ecx, [ebp - 0x21e0]
call fcn.005dca80
lea ecx, [ebp - 0x24f4]
call fcn.005dc430
lea ecx, [ebp - 0x22c4]
call fcn.005d69e0
lea ecx, [ebp - 0x2430]
call fcn.005dc430
lea ecx, [ebp - 0x23c4]
call fcn.005dc430
lea ecx, [ebp - 0x6ea0]
call fcn.00402770
lea ecx, [ebp - 0x245c]
call fcn.005dc430
lea ecx, [ebp - 0x2290]
call fcn.005dc430
lea ecx, [ebp - 0x2868]
call fcn.00401e70
lea ecx, [ebp - 0x24e8]
call fcn.005dc430
push fcn.005dc430
push 2
push 0xc
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0xac
push eax
call fcn.0041e45b
lea ecx, [ebp - 0x28cc]
call fcn.00401e20
lea ecx, [ebp - 0x2340]
call fcn.005dc430
lea ecx, [ebp - 0x229c]
call fcn.005dc430
lea ecx, [ebp - 0x2394]
call fcn.005dc430
lea ecx, [ebp - 0x2178]
call fcn.005dc430
lea ecx, [ebp - 0x24b8]
call fcn.005dc430
lea ecx, [ebp - 0x2040]
call fcn.005dc430
lea ecx, [ebp - 0x216c]
mov byte [ebp - 4], 0x46
call fcn.005dc430
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52854b
test dword [edi + 0x34], 0x1000
jne 0x52854b
push 0
push str._r_n_r_n__Other_Chromium_browsers_scan:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push str.Other_Chromium_browsers...
push dword [eax + 0x38]
call fcn.005bcd30
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x32
push dword [eax + 0x34]
call fcn.005b9910
push 0xc
lea ecx, [ebp - 0x205c]
call fcn.00401d40
lea ecx, [ebp - 0x205c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x1fd4]
mov byte [ebp - 4], 0xbc
call fcn.00401d40
lea ecx, [ebp - 0x1fd4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2524]
mov byte [ebp - 4], 0xbd
call fcn.00401d40
lea ecx, [ebp - 0x2524]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2010]
mov byte [ebp - 4], 0xbe
call fcn.00401d40
lea ecx, [ebp - 0x2010]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2090]
mov byte [ebp - 4], 0xbf
call fcn.00401d40
lea ecx, [ebp - 0x2090]
call fcn.005dc5e0
push 0x24
lea ecx, [ebp - 0x2610]
mov byte [ebp - 4], 0xc0
call fcn.004020b0
lea ecx, [ebp - 0x2610]
call fcn.005b5fe0
push 0x260
lea ecx, [ebp - 0x2e30]
mov byte [ebp - 4], 0xc1
call fcn.00401d60
lea ecx, [ebp - 0x2e30]
call fcn.00401100
push 0x260
lea ecx, [ebp - 0x32f0]
mov byte [ebp - 4], 0xc2
call fcn.00401d60
lea ecx, [ebp - 0x32f0]
call fcn.00401100
push 0xc
lea ecx, [ebp - 0x21f8]
mov byte [ebp - 4], 0xc3
call fcn.00401d40
lea ecx, [ebp - 0x21f8]
call fcn.004041f0
push 0xc
lea ecx, [ebp - 0x235c]
mov byte [ebp - 4], 0xc4
call fcn.00401d40
push 0xc
push 0
lea ecx, [ebp - 0x235c]
call fcn.004044a0
push 0xc
lea ecx, [ebp - 0x204c]
mov byte [ebp - 4], 0xc5
call fcn.00401d40
push 0xc
push 0
lea ecx, [ebp - 0x204c]
call fcn.004044a0
push 0xc
lea ecx, [ebp - 0x2228]
mov byte [ebp - 4], 0xc6
call fcn.00401d40
lea ecx, [ebp - 0x2228]
call fcn.004041f0
push 0xc
lea ecx, [ebp - 0x2254]
mov byte [ebp - 4], 0xc7
call fcn.00401d40
push 0xc
push 0
lea ecx, [ebp - 0x2254]
call fcn.00403750
xor esi, esi
mov byte [ebp - 4], 0xc8
push 0x20
lea ecx, [ebp - 0x2844]
mov dword [ebp - 0x6f9c], esi
call fcn.00401e40
lea ecx, [ebp - 0x2844]
call fcn.005e47e0
mov byte [ebp - 4], 0xc9
mov ecx, dword [edi + 0x30]
mov dword [ebp - 0x6f8c], esi
test ecx, ecx
je 0x525415
lea eax, [edi + 0x10c]
mov dword [ebp - 0x6fb4], eax
nop
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6249f8
lea ecx, [ebp - 0x2160]
call fcn.005dc190
push eax
push dword [ebp - 0x6f8c]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc200
push 5
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2e30]
call fcn.00401280
test al, al
je 0x5253fd
mov edi, dword [ebp - 0x6f8c]
nop
push 1
push 1
lea ecx, [ebp - 0x2e30]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x2090]
call fcn.005dc260
push 0x660330
lea ecx, [ebp - 0x2090]
call fcn.005dc4c0
test al, al
jne 0x5253de
push 0x624a04
lea ecx, [ebp - 0x2090]
call fcn.005dc4c0
test al, al
jne 0x5253de
push 0x670fb4
lea ecx, [ebp - 0x2090]
call fcn.005dc4c0
test al, al
jne 0x5253de
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.User_DataGrShaderCache
push 1
lea ecx, [ebp - 0x2e30]
call fcn.004012d0
push eax
push 0x624284
lea ecx, [ebp - 0x2160]
call fcn.005dc190
mov ecx, dword [ebp - 0x6fb4]
push eax
push edi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc200
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test al, al
jne 0x525236
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.User_DataCertificateRevocation
push 1
lea ecx, [ebp - 0x2e30]
call fcn.004012d0
push eax
push 0x624284
lea ecx, [ebp - 0x2160]
call fcn.005dc190
mov ecx, dword [ebp - 0x6fb4]
push eax
push edi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc200
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test al, al
jne 0x525236
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6249f8
push 1
lea ecx, [ebp - 0x2e30]
call fcn.004012d0
push eax
push 0x624284
lea ecx, [ebp - 0x2160]
call fcn.005dc190
mov ecx, dword [ebp - 0x6fb4]
push eax
push edi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc200
push 5
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x32f0]
call fcn.00401280
test al, al
je 0x5253de
push 2
lea ecx, [ebp - 0x1fd4]
call fcn.005dadc0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.User_DataGrShaderCache
push 1
lea ecx, [ebp - 0x32f0]
call fcn.004012d0
push eax
push 0x624284
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc200
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x525042
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.User_DataCertificateRevocation
push 1
lea ecx, [ebp - 0x32f0]
call fcn.004012d0
push eax
push 0x624284
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc200
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52521e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.User_Data
lea eax, [esi + 1]
push 1
lea ecx, [ebp - 0x32f0]
mov dword [ebp - 0x6f78], eax
call fcn.004012d0
push eax
push 0x624284
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
push esi
push 2
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x21f8]
call fcn.004042a0
mov ecx, eax
call fcn.00404410
mov ecx, eax
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x32f0]
call fcn.004012d0
push eax
push 0x624284
push 1
lea ecx, [ebp - 0x2e30]
call fcn.004012d0
push eax
push esi
push 2
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x235c]
call fcn.004042a0
mov ecx, eax
call fcn.00404410
mov ecx, eax
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x32f0]
call fcn.004012d0
push eax
push 0x62438c
push 1
lea ecx, [ebp - 0x2e30]
call fcn.004012d0
push eax
push esi
push 2
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x204c]
call fcn.004042a0
mov ecx, eax
call fcn.00404410
mov ecx, eax
call fcn.005dc200
push esi
push 2
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x2254]
call fcn.00403660
mov ecx, eax
call fcn.00403730
push 2
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x2228]
mov dword [eax], edi
call fcn.004042a0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Last_Browser
push esi
lea ecx, [ebp - 0x21f8]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc200
lea ecx, [ebp - 0x205c]
call fcn.005dc190
mov dl, 1
mov ecx, eax
call fcn.005e3540
push 0
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2844]
call fcn.005e4120
test eax, eax
je 0x525218
push 0
push esi
lea ecx, [ebp - 0x2228]
call fcn.00404410
push eax
lea ecx, [ebp - 0x2844]
call fcn.005e3f60
test eax, eax
je 0x525218
push 3
push esi
lea ecx, [ebp - 0x2228]
call fcn.00404410
mov ecx, eax
call fcn.005da0f0
mov esi, dword [ebp - 0x6f78]
lea ecx, [ebp - 0x32f0]
call fcn.00401230
test al, al
jne 0x524f98
jmp 0x5253de
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.User_Data
lea eax, [esi + 1]
push 1
lea ecx, [ebp - 0x2e30]
mov dword [ebp - 0x6f78], eax
call fcn.004012d0
push eax
push 0x624284
lea ecx, [ebp - 0x2160]
call fcn.005dc190
mov ecx, dword [ebp - 0x6fb4]
push eax
push edi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push esi
push 2
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x21f8]
call fcn.004042a0
mov ecx, eax
call fcn.00404410
mov ecx, eax
call fcn.005dc200
push 1
push 1
lea ecx, [ebp - 0x2e30]
call fcn.004012d0
push eax
push esi
push 2
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x235c]
call fcn.004042a0
mov ecx, eax
call fcn.00404410
mov ecx, eax
call fcn.005dc260
push 1
push 1
lea ecx, [ebp - 0x2e30]
call fcn.004012d0
push eax
push esi
push 2
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x204c]
call fcn.004042a0
mov ecx, eax
call fcn.00404410
mov ecx, eax
call fcn.005dc260
push esi
push 2
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x2254]
call fcn.00403660
mov ecx, eax
call fcn.00403730
push 2
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x2228]
mov dword [eax], edi
call fcn.004042a0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Last_Browser
push esi
lea ecx, [ebp - 0x21f8]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc200
lea ecx, [ebp - 0x205c]
call fcn.005dc190
mov dl, 1
mov ecx, eax
call fcn.005e3540
push 0
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2844]
call fcn.005e4120
test eax, eax
je 0x5253d8
push 0
push esi
lea ecx, [ebp - 0x2228]
call fcn.00404410
push eax
lea ecx, [ebp - 0x2844]
call fcn.005e3f60
test eax, eax
je 0x5253d8
push 3
push esi
lea ecx, [ebp - 0x2228]
call fcn.00404410
mov ecx, eax
call fcn.005da0f0
mov esi, dword [ebp - 0x6f78]
lea ecx, [ebp - 0x2e30]
call fcn.00401230
test al, al
jne 0x524de0
mov edi, dword [ebp - 0x6f7c]
mov dword [ebp - 0x6f9c], esi
mov eax, dword [ebp - 0x6f8c]
mov ecx, dword [edi + 0x30]
inc eax
mov dword [ebp - 0x6f8c], eax
cmp eax, ecx
jb 0x524d70
mov dword [ebp - 0x6f78], 0
test ecx, ecx
je 0x52562f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Opera_SoftwareOpera_StableGrShaderCache
lea ecx, [ebp - 0x226c]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push ecx
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc200
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5254e1
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.Opera_SoftwareOpera_StableCertificateRevocation
lea ecx, [ebp - 0x226c]
call fcn.005dc190
push eax
push dword [ebp - 0x6f78]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc200
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x525619
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Opera_Software
lea ecx, [ebp - 0x226c]
inc esi
call fcn.005dc190
push eax
push dword [ebp - 0x6f78]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push dword [ebp - 0x6f9c]
lea ecx, [ebp - 0x21f8]
push 2
push esi
call fcn.004042a0
mov ecx, eax
call fcn.00404410
mov ecx, eax
call fcn.005dc200
push 1
push str.Opera_SoftwareOpera_Stable
push dword [ebp - 0x6f9c]
lea ecx, [ebp - 0x235c]
push 2
push esi
call fcn.004042a0
mov ecx, eax
call fcn.00404410
mov ecx, eax
call fcn.005dc260
push 1
push str.Opera_Browser
push dword [ebp - 0x6f9c]
lea ecx, [ebp - 0x204c]
push 2
push esi
call fcn.004042a0
mov ecx, eax
call fcn.00404410
mov ecx, eax
call fcn.005dc260
push dword [ebp - 0x6f9c]
lea ecx, [ebp - 0x2254]
push 2
push esi
call fcn.00403660
mov ecx, eax
call fcn.00403730
mov ecx, dword [ebp - 0x6f78]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [eax], ecx
lea ecx, [ebp - 0x2160]
push str.ProgramsOperalauncher.exe
call fcn.005dc190
push eax
push dword [ebp - 0x6f78]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push dword [ebp - 0x6f9c]
push 2
push esi
lea ecx, [ebp - 0x2228]
call fcn.004042a0
mov ecx, eax
call fcn.00404410
mov ecx, eax
call fcn.005dc200
mov dword [ebp - 0x6f9c], esi
mov eax, dword [ebp - 0x6f78]
inc eax
mov dword [ebp - 0x6f78], eax
cmp eax, dword [edi + 0x30]
jb 0x525427
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5284ad
lea ecx, [ebp - 0x1fc8]
push 0
test esi, esi
jne 0x525659
push str._r_n_tNo_other_Chromium_based_browser_profiles_have_been_found:_r_n
call fcn.005e37e0
jmp 0x5284ad
push str._r_n_tOther_Chromium_browsers_startup_and_home_pages:_r_n
call fcn.005e37e0
mov dword [ebp - 0x6f78], 0
test esi, esi
je 0x525d4b
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x525d4b
push str.Opera_Browser
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc4c0
mov byte [ebp - 0x6f81], al
lea ecx, [ebp - 0x21f8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test al, al
je 0x5256cc
push str.Op
jmp 0x5256d1
push 0x6712e8
push dword [ebp - 0x6f78]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc200
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x2254]
call fcn.00403730
push 0x260
lea ecx, [ebp - 0x5690]
mov eax, dword [eax]
mov dword [ebp - 0x6fb4], eax
call fcn.00401d60
push 1
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x5690]
call fcn.00401130
push 3
lea ecx, [ebp - 0x205c]
mov byte [ebp - 4], 0xca
call fcn.005dadc0
lea ecx, [ebp - 0x5690]
call fcn.00401270
test al, al
je 0x525d27
mov esi, dword [ebp - 0x6f78]
nop dword [eax + eax]
push 1
lea ecx, [ebp - 0x5690]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc510
cmp byte [ebp - 0x6f81], 0
jne 0x5257b7
push str.Default
lea ecx, [ebp - 0x1fd4]
call fcn.005dc480
test al, al
je 0x5257b7
push 0
push 1
push 1
push 0
push str.Profile
lea ecx, [ebp - 0x1fd4]
call fcn.005daa70
cmp eax, 1
jne 0x525d0e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Secure_Preferences
push 1
lea ecx, [ebp - 0x5690]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc200
push 0x100
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2610]
call fcn.005b5da0
test al, al
je 0x525d0e
lea eax, [ebp - 0x2010]
push eax
push 0x629fdc
push str.homepage
lea ecx, [ebp - 0x2610]
call fcn.005b5530
test eax, eax
je 0x525a57
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x525a57
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x525a57
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x525a57
push str.about:blank
lea ecx, [ebp - 0x2010]
call fcn.005dc4c0
test al, al
jne 0x525a57
push 0
push 1
push 1
push 0
push str.:__www.yahoo.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x525a57
push eax
push str.Other_Chromium_browsers_startup_pages
lea ecx, [ebp - 0x2010]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x525a57
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627930
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str.Home_page__
lea ecx, [ebp - 0x25e0]
call fcn.005dc200
mov eax, dword [ebp - 0x6fb4]
mov ecx, dword [ebp - 0x6fa8]
push 0
push 0
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
push 0
push 1
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x6f8c], eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x25e0]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x3e
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x525a57
push 0
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
push str.homepage
push 0x3e
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str._r_n_t_tBrowser:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2010]
call fcn.005dc190
push eax
push str._r_n_t_tHomepage:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x2ab4]
mov dword [ebp - 0x6f3c], 0
push eax
push 0x629fdc
xorps xmm0, xmm0
lea ecx, [ebp - 0x2610]
push str.session__startup_urls
movups xmmword [ebp - 0x6f4c], xmm0
call fcn.005b5630
test al, al
je 0x525d0e
lea eax, [ebp - 0x2ab4]
push eax
lea eax, [ebp - 0x6f4c]
push eax
lea ecx, [ebp - 0x2610]
call fcn.005b4c80
test al, al
je 0x525d0e
lea eax, [ebp - 0x2010]
push eax
lea eax, [ebp - 0x6f4c]
push eax
lea ecx, [ebp - 0x2610]
call fcn.005b4f90
test eax, eax
je 0x525ced
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x525ced
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x525ced
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x525ced
push str.about:blank
lea ecx, [ebp - 0x2010]
call fcn.005dc4c0
test al, al
jne 0x525ced
push 0
push 1
push 1
push 0
push str.:__www.yahoo.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x525ced
push eax
push str.Other_Chromium_browsers_startup_pages
lea ecx, [ebp - 0x2010]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x525ced
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627930
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str.Startup_page__
lea ecx, [ebp - 0x25e0]
call fcn.005dc200
mov eax, dword [ebp - 0x6fb4]
mov ecx, dword [ebp - 0x6fa8]
push 0
push 0
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
push 0
push 1
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x6f8c], eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x25e0]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x3e
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x525ced
push 0
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
push str.session__startup_urls
push 0x3e
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str._r_n_t_tBrowser:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2010]
call fcn.005dc190
push eax
push str._r_n_t_tStartup_page_:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x2ab4]
push eax
lea eax, [ebp - 0x6f4c]
push eax
lea ecx, [ebp - 0x2610]
call fcn.005b4c80
test al, al
jne 0x525ab0
lea ecx, [ebp - 0x5690]
call fcn.00401230
test al, al
jne 0x525760
mov esi, dword [ebp - 0x6f9c]
lea ecx, [ebp - 0x5690]
mov byte [ebp - 4], 0xc9
call fcn.00401180
mov eax, dword [ebp - 0x6f78]
inc eax
mov dword [ebp - 0x6f78], eax
cmp eax, esi
jb 0x525675
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5284ad
push 0
push str._r_n_tOther_Chromium_bowsers_search_providers:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov dword [ebp - 0x6f78], 0
test esi, esi
je 0x5261a8
nop
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5261a8
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x2254]
call fcn.00403730
push str.Opera_Browser
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x204c]
mov eax, dword [eax]
mov dword [ebp - 0x6f80], eax
call fcn.00404410
mov ecx, eax
call fcn.005dc4c0
mov byte [ebp - 0x6f81], al
lea ecx, [ebp - 0x21f8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test al, al
je 0x525df0
push str.Op
jmp 0x525df5
push 0x6712e8
push dword [ebp - 0x6f78]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc200
push 0x260
lea ecx, [ebp - 0x58f0]
call fcn.00401d60
push 1
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x58f0]
call fcn.00401130
push 3
lea ecx, [ebp - 0x205c]
mov byte [ebp - 4], 0xcb
call fcn.005dadc0
lea ecx, [ebp - 0x58f0]
call fcn.00401270
test al, al
je 0x526184
mov esi, dword [ebp - 0x6f78]
nop word [eax + eax]
push 1
lea ecx, [ebp - 0x58f0]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc510
cmp byte [ebp - 0x6f81], 0
jne 0x525ec7
push str.Default
lea ecx, [ebp - 0x1fd4]
call fcn.005dc480
test al, al
je 0x525ec7
push 0
push 1
push 1
push 0
push str.Profile
lea ecx, [ebp - 0x1fd4]
call fcn.005daa70
cmp eax, 1
jne 0x52616b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Secure_Preferences
push 1
lea ecx, [ebp - 0x58f0]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc200
push 0x100
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2610]
call fcn.005b5da0
test al, al
je 0x52616b
lea eax, [ebp - 0x2010]
push eax
push 0x629fdc
push str.default_search_provider_data__template_url_data__url
lea ecx, [ebp - 0x2610]
call fcn.005b5530
test eax, eax
je 0x52616b
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x52616b
push eax
push 1
push 1
push eax
push str.google:baseURL
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x52616b
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x52616b
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x52616b
push eax
push 1
push 1
push eax
push str.search.yahoo.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x52616b
push eax
push str.Other_Chromium_browsers_search_providers
lea ecx, [ebp - 0x2010]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x52616b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627930
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str.Default_search_provider__
lea ecx, [ebp - 0x25e0]
call fcn.005dc200
mov eax, dword [ebp - 0x6f80]
mov ecx, dword [ebp - 0x6fa8]
push 0
push 0
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
push 0
push 1
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x6f8c], eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x25e0]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x3f
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6fcc], eax
cmp eax, 0xffffffff
je 0x52616b
push 0
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
push str.default_search_provider_data__template_url_data
push 0x3f
push dword [ebp - 0x6fcc]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str._r_n_t_tBrowser:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2010]
call fcn.005dc190
push eax
push str._r_n_t_tDefault_search_provider_URL_:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea ecx, [ebp - 0x58f0]
call fcn.00401230
test al, al
jne 0x525e70
mov esi, dword [ebp - 0x6f9c]
lea ecx, [ebp - 0x58f0]
mov byte [ebp - 4], 0xc9
call fcn.00401180
mov eax, dword [ebp - 0x6f78]
inc eax
mov dword [ebp - 0x6f78], eax
cmp eax, esi
jb 0x525d80
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5284ad
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.WhiteListOCB_Extensions
lea ecx, [edi + 0x33c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push str._r_n_tOther_Chromium_browsers_extensions:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov dword [ebp - 0x6f78], 0
test esi, esi
je 0x52680b
nop dword [eax + eax]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52680b
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x2254]
call fcn.00403730
push 0xc
lea ecx, [ebp - 0x2774]
mov eax, dword [eax]
mov dword [ebp - 0x6f80], eax
call fcn.00401d40
lea ecx, [ebp - 0x2774]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2768]
mov byte [ebp - 4], 0xcc
call fcn.00401d40
lea ecx, [ebp - 0x2768]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2670]
mov byte [ebp - 4], 0xcd
call fcn.00401d40
lea ecx, [ebp - 0x2670]
call fcn.005dc5e0
push str.Opera_Browser
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x204c]
mov byte [ebp - 4], 0xce
call fcn.00404410
mov ecx, eax
call fcn.005dc4c0
mov byte [ebp - 0x6f81], al
lea ecx, [ebp - 0x21f8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test al, al
je 0x5262d4
push str.Op
jmp 0x5262d9
push 0x6712e8
push dword [ebp - 0x6f78]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc200
push 0x260
lea ecx, [ebp - 0x4390]
call fcn.00401d60
push 1
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4390]
call fcn.00401130
push 3
lea ecx, [ebp - 0x205c]
mov byte [ebp - 4], 0xcf
call fcn.005dadc0
lea ecx, [ebp - 0x4390]
call fcn.00401270
test al, al
je 0x5267c6
nop dword [eax]
nop dword [eax + eax]
push 1
lea ecx, [ebp - 0x4390]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc510
cmp byte [ebp - 0x6f81], 0
jne 0x5263a7
push str.Default
lea ecx, [ebp - 0x1fd4]
call fcn.005dc480
test al, al
je 0x5263a7
push 0
push 1
push 1
push 0
push str.Profile
lea ecx, [ebp - 0x1fd4]
call fcn.005daa70
cmp eax, 1
jne 0x5267ad
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Secure_Preferences
push 1
lea ecx, [ebp - 0x4390]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc200
push 0x100
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2610]
call fcn.005b5da0
test al, al
je 0x5267ad
lea eax, [ebp - 0x2aa0]
mov dword [ebp - 0x6f00], 0
push eax
push 0x629fdc
xorps xmm0, xmm0
lea ecx, [ebp - 0x2610]
push str.extensions__settings
movups xmmword [ebp - 0x6f10], xmm0
call fcn.005b5630
test al, al
je 0x5267ad
lea eax, [ebp - 0x2aa0]
push eax
lea eax, [ebp - 0x6f10]
push eax
lea ecx, [ebp - 0x2610]
call fcn.005b5050
test al, al
je 0x5267ad
lea eax, [ebp - 0x2774]
push eax
lea eax, [ebp - 0x6f10]
push eax
lea ecx, [ebp - 0x2610]
call fcn.005b55f0
test al, al
je 0x52678c
lea ecx, [ebp - 0x2774]
call fcn.005dc190
lea ecx, [ebp - 0x1f8c]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x52678c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__manifest__name
lea ecx, [ebp - 0x2774]
call fcn.005dc190
push eax
push str.extensions__settings__
lea ecx, [ebp - 0x2768]
call fcn.005dc200
lea eax, [ebp - 0x2090]
push eax
push 0x629fdc
lea ecx, [ebp - 0x2768]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2610]
call fcn.005b5530
test eax, eax
je 0x52678c
lea ecx, [ebp - 0x2090]
call fcn.005dc190
lea ecx, [ebp - 0x1f8c]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x52678c
push 0
push str.Other_Chromium_browsers_extensions
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x52678c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__path
lea ecx, [ebp - 0x2774]
call fcn.005dc190
push eax
push str.extensions__settings__
lea ecx, [ebp - 0x2768]
call fcn.005dc200
lea eax, [ebp - 0x2670]
push eax
push 0x629fdc
lea ecx, [ebp - 0x2768]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2610]
call fcn.005b5530
test eax, eax
je 0x526600
push 0
push 1
push 1
push 5
push 0x624518
lea ecx, [ebp - 0x2670]
call fcn.005daa70
test eax, eax
jne 0x526600
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.Extensions_
push 1
lea ecx, [ebp - 0x4390]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2670]
call fcn.005da510
lea ecx, [ebp - 0x2670]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52678c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2774]
call fcn.005dc190
push eax
push str.extensions__settings__
lea ecx, [ebp - 0x2768]
call fcn.005dc200
mov eax, dword [ebp - 0x6f80]
mov ecx, dword [ebp - 0x6fa8]
push 0
push 0
lea eax, [eax + eax*2]
push 0
lea esi, [ecx + eax*4]
push 1
lea ecx, [ebp - 0x2670]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x40
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6fcc], eax
cmp eax, 0xffffffff
je 0x52678c
push 0
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push 0
push 0
lea ecx, [ebp - 0x2670]
call fcn.005dc190
push eax
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2768]
call fcn.005dc190
push eax
push 0x40
push dword [ebp - 0x6fcc]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2670]
call fcn.005dc190
push eax
push str._r_n_t_tPath:
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str._r_n_t_tBrowser:
mov ecx, esi
call fcn.005dc190
push eax
push str.__r_n_t_tUser_name:
lea ecx, [ebp - 0x2774]
call fcn.005dc190
push eax
push 0x62d7ec
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
push str._r_n_t_tExtension_found_:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x2aa0]
push eax
lea eax, [ebp - 0x6f10]
push eax
lea ecx, [ebp - 0x2610]
call fcn.005b5050
test al, al
jne 0x526460
lea ecx, [ebp - 0x4390]
call fcn.00401230
test al, al
jne 0x526350
mov esi, dword [ebp - 0x6f9c]
lea ecx, [ebp - 0x4390]
call fcn.00401180
lea ecx, [ebp - 0x2670]
call fcn.005dc430
lea ecx, [ebp - 0x2768]
call fcn.005dc430
lea ecx, [ebp - 0x2774]
mov byte [ebp - 4], 0xc9
call fcn.005dc430
mov eax, dword [ebp - 0x6f78]
inc eax
mov dword [ebp - 0x6f78], eax
cmp eax, esi
jb 0x526210
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x5284ad
push 0
push str._r_n_tOther_Chromium_browsers_non_standard_shortcuts:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
lea ecx, [ebp - 0x6e38]
call fcn.00402740
mov byte [ebp - 4], 0xd0
lea ecx, [ebp - 0x6e30]
mov eax, dword [edi + 8]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x6e38], eax
mov dword [ebp - 0x6e34], 0x41
call fcn.005dc400
lea eax, [ebp - 0x21e0]
mov dword [ebp - 0x6e20], eax
lea ecx, [ebp - 0x6e10]
lea eax, [edi + 0x164]
mov dword [ebp - 0x6e1c], eax
lea eax, [ebp - 0x1fc8]
mov dword [ebp - 0x6e18], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x6e14], eax
call fcn.005dc400
push 0xc
lea ecx, [ebp - 0x237c]
call fcn.00401d40
lea ecx, [ebp - 0x237c]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2310]
mov byte [ebp - 4], 0xd1
call fcn.00401d40
lea ecx, [ebp - 0x2310]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2388]
mov byte [ebp - 4], 0xd2
call fcn.00401d40
lea ecx, [ebp - 0x2388]
call fcn.005dc5e0
mov ecx, edi
mov byte [ebp - 4], 0xd3
call fcn.0050db30
test al, al
jne 0x528481
mov dword [ebp - 0x6f78], 0
test esi, esi
je 0x526ba0
nop dword [eax]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x526ba0
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x2228]
call fcn.00404410
mov ecx, eax
call fcn.005dc3a0
cmp eax, 5
jl 0x526b83
mov esi, dword [ebp - 0x6f78]
lea ecx, [ebp - 0x2228]
push esi
call fcn.00404410
push eax
lea ecx, [ebp - 0x6e30]
call fcn.005dc4e0
push esi
lea ecx, [ebp - 0x2254]
call fcn.00403730
mov ecx, dword [ebp - 0x6fa8]
mov eax, dword [eax]
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*4]
call fcn.005dc190
push esi
lea ecx, [ebp - 0x204c]
mov dword [ebp - 0x6e24], eax
call fcn.00404410
push eax
lea ecx, [ebp - 0x6e10]
call fcn.005dc4e0
push esi
lea ecx, [ebp - 0x2254]
call fcn.00403730
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x250c]
mov esi, eax
call fcn.005dc190
push eax
push dword [esi]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x237c]
call fcn.005dc200
lea ecx, [ebp - 0x237c]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x526b7d
lea ecx, [ebp - 0x237c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6e38]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x526b9a
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x2254]
call fcn.00403730
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x25bc]
mov esi, eax
call fcn.005dc190
push eax
push dword [esi]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x237c]
call fcn.005dc200
lea ecx, [ebp - 0x237c]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x526b7d
push 0
lea ecx, [ebp - 0x237c]
call fcn.005dbed0
lea ecx, [ebp - 0x237c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6e38]
mov ecx, edi
push eax
call fcn.0052e3e0
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x6e30]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2388]
call fcn.005daa70
test eax, eax
jne 0x526b7d
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x62794c
lea ecx, [ebp - 0x6e30]
call fcn.005dc190
push eax
push 0x62794c
lea ecx, [ebp - 0x2388]
call fcn.005da780
lea ecx, [ebp - 0x264c]
mov dword [ebp - 0x6e24], str._All_users_
call fcn.005dc190
push eax
lea eax, [ebp - 0x6e38]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x526b9a
lea eax, [ebp - 0x2640]
push eax
lea ecx, [ebp - 0x237c]
call fcn.005dc4e0
push 0
lea ecx, [ebp - 0x237c]
call fcn.005dbed0
lea ecx, [ebp - 0x237c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6e38]
mov ecx, edi
push eax
call fcn.0052e3e0
mov esi, dword [ebp - 0x6f9c]
mov eax, dword [ebp - 0x6f78]
inc eax
mov dword [ebp - 0x6f78], eax
cmp eax, esi
jb 0x526910
jmp 0x526ba0
mov esi, dword [ebp - 0x6f9c]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x528481
push 4
lea ecx, [ebp - 0x2130]
call fcn.00401d80
lea ecx, [ebp - 0x2130]
call fcn.005d6aa0
xor eax, eax
mov byte [ebp - 4], 0xd4
mov dword [ebp - 0x6fb4], eax
test esi, esi
je 0x526fe0
nop dword [eax + eax]
xor esi, esi
mov dword [ebp - 0x6fa4], esi
nop dword [eax + eax]
push eax
lea ecx, [ebp - 0x2254]
call fcn.00403730
mov eax, dword [eax]
mov dword [ebp - 0x6f78], eax
test esi, esi
jne 0x526c60
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.SoftwareClientsStartMenuInternet
push eax
lea ecx, [edi + 0x104]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
mov eax, dword [ebp - 0x6f78]
mov ecx, dword [ebp - 0x6fa8]
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*4]
call fcn.005dc190
mov dword [ebp - 0x6f8c], eax
jmp 0x526cbf
cmp esi, 1
jne 0x526c86
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareClientsStartMenuInternet
push dword [ebp - 0x6fc4]
jmp 0x526caa
cmp esi, 2
jne 0x526cb5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareClientsStartMenuInternet
push dword [ebp - 0x6fe0]
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
mov dword [ebp - 0x6f8c], str._All_users_
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2130]
call fcn.005d6a30
test al, al
je 0x526fb7
lea eax, [ebp - 0x6cec]
mov dword [ebp - 0x6fcc], 0
push eax
push 0
lea ecx, [ebp - 0x2130]
call fcn.005d6380
test al, al
je 0x526fb7
mov esi, dword [ebp - 0x6fb4]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._shellopencommand
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f8c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x526f89
lea eax, [ebp - 0x2310]
push eax
push 0x62439c
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x526f89
lea ecx, [ebp - 0x2310]
call fcn.005dbeb0
test al, al
jne 0x526f89
push dword [ebp - 0x6f78]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2310]
call fcn.005dbc20
push 0
push 1
push 1
push 0
push esi
lea ecx, [ebp - 0x2228]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2310]
call fcn.005daa70
test eax, eax
je 0x526f89
push esi
lea ecx, [ebp - 0x2228]
call fcn.00404410
mov ecx, eax
call fcn.005dc3a0
inc eax
lea ecx, [ebp - 0x2310]
push eax
call fcn.005dad50
push 0
push 0
push 0x62439c
push 0x624388
push 3
lea ecx, [ebp - 0x2310]
call fcn.005da0f0
mov ecx, eax
call fcn.005da270
lea ecx, [ebp - 0x2310]
call fcn.005dbeb0
test al, al
jne 0x526f89
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f8c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc200
push 0
push str.Other_Chromium_browsers_shortcuts
lea ecx, [ebp - 0x2310]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x526f89
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2310]
call fcn.005dc190
push eax
push dword [ebp - 0x6f8c]
mov eax, dword [edi + 8]
mov ecx, edi
push str.Start_Menu_Internet_shortcut
push 5
push 0x41
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x526f89
push 0
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push 0
push 0
push 0
push 0
push dword [ebp - 0x6f8c]
lea ecx, [ebp - 0x1fd4]
push 0
call fcn.005dc190
push eax
push 0x41
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str._r_n_t_tBrowser:
push dword [ebp - 0x6f8c]
lea ecx, [ebp - 0x2310]
push str._r_n_t_tUser_name:
call fcn.005dc190
push eax
push str._r_n_t_tStart_Menu_Internet_shortcut_argument:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6fcc]
lea ecx, [ebp - 0x6cec]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x2130]
mov dword [ebp - 0x6fcc], eax
call fcn.005d6380
test al, al
jne 0x526d11
mov esi, dword [ebp - 0x6fa4]
mov eax, dword [ebp - 0x6fb4]
inc esi
mov dword [ebp - 0x6fa4], esi
cmp esi, 3
jb 0x526bf0
inc eax
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [ebp - 0x6f9c]
jb 0x526be0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x528476
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x52705a
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
nop
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwarePolicies
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x527010
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREPolicies
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x5270c1
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREPolicies
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
push 0
push str._r_n_tOther_Chromium_browsers_Group_Policies:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
lea ecx, [ebp - 0x2388]
call fcn.005dc400
cmp dword [ebp - 0x6fac], 0
jbe 0x52789f
mov ecx, dword [ebp - 0x6fa8]
mov eax, esi
mov edx, dword [ebp - 0x6fac]
sub eax, ecx
mov dword [ebp - 0x6f80], eax
mov eax, dword [ebp - 0x6f9c]
mov dword [ebp - 0x6f78], ecx
mov dword [ebp - 0x6f8c], edx
xor esi, esi
mov dword [ebp - 0x6fa4], esi
test eax, eax
je 0x527887
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52786f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
lea ecx, [ebp - 0x235c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f80]
add ecx, dword [ebp - 0x6f78]
push eax
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2114]
call fcn.005dc200
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x2114]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2388]
call fcn.005daa70
test eax, eax
jne 0x52785e
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x62794c
lea ecx, [ebp - 0x2114]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2388]
call fcn.005da780
push 0
push 0x20019
lea ecx, [ebp - 0x2114]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x5273d9
lea eax, [ebp - 0x2010]
push eax
push str.HomepageLocation
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x5273d9
lea eax, [ebp - 0x217c]
mov dword [ebp - 0x217c], 0
push eax
push str.HomepageIsNewTabPage
lea ecx, [ebp - 0x1f74]
call fcn.005d66b0
test al, al
je 0x52723e
cmp dword [ebp - 0x217c], 0
jne 0x5273d9
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x5273d9
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x5273d9
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x5273d9
push eax
push 1
push 1
push eax
push str.:__www.yahoo.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x5273d9
push eax
push str.Other_Chromium_browsers_group_policies
lea ecx, [ebp - 0x2010]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x5273d9
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2010]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.HomepageLocation
push 5
push 0x43
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6fcc], eax
cmp eax, 0xffffffff
je 0x5273d9
push 0
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push 0
push 0
push 0
push str.HomepageLocation
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x2114]
call fcn.005dc190
push eax
push 0x43
push dword [ebp - 0x6fcc]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push str._r_n_t_tBrowser:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2010]
call fcn.005dc190
push eax
push str._r_n_t_tDefault_Homepage_policy_:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x2010]
push eax
push str.DefaultSearchProviderSearchURL
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x52762e
lea eax, [ebp - 0x217c]
mov dword [ebp - 0x217c], 0
push eax
push str.DefaultSearchProviderEnabled
lea ecx, [ebp - 0x1f74]
call fcn.005d66b0
test al, al
je 0x52742a
cmp dword [ebp - 0x217c], 0
je 0x52762e
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x52762e
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x52762e
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x52762e
push eax
push 1
push 1
push eax
push str.:__www.yahoo.
lea ecx, [ebp - 0x2010]
call fcn.005daa70
test eax, eax
jne 0x52762e
push eax
push str.Other_Chromium_browsers_group_policies
lea ecx, [ebp - 0x2010]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x52762e
lea eax, [ebp - 0x2090]
push eax
push str.DefaultSearchProviderName
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x52762e
lea ecx, [ebp - 0x2090]
call fcn.005dbeb0
test al, al
jne 0x52762e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__search_provider_
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2310]
call fcn.005dc200
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2010]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2310]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x43
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6fcc], eax
cmp eax, 0xffffffff
je 0x52762e
push 0
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push 0
push 0
push 0
push str.DefaultSearchProviderSearchURL
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x2114]
call fcn.005dc190
push eax
push 0x43
push dword [ebp - 0x6fcc]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push str._r_n_t_tBrowser:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2010]
call fcn.005dc190
push eax
push str._r_n_t_tDefault_Search_Provider_policy:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x217c]
mov dword [ebp - 0x217c], 0
push eax
push str.RestoreOnStartup
lea ecx, [ebp - 0x1f74]
call fcn.005d66b0
test al, al
je 0x52785e
cmp dword [ebp - 0x217c], 4
jne 0x52785e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RestoreOnStartupURLs
lea ecx, [ebp - 0x2114]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2130]
call fcn.005d6a30
test al, al
je 0x52785e
lea eax, [ebp - 0x6cec]
mov dword [ebp - 0x6fcc], 0
push eax
push 0
lea ecx, [ebp - 0x1f74]
call fcn.005d62e0
test al, al
je 0x52785e
lea eax, [ebp - 0x2010]
push eax
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x527836
lea ecx, [ebp - 0x2010]
call fcn.005dbeb0
test al, al
jne 0x527836
push 0
push str.Other_Chromium_browsers_group_policies
lea ecx, [ebp - 0x2010]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x527836
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x2010]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 0x669320
push 5
push 0x43
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6fb4], eax
cmp eax, 0xffffffff
je 0x527836
push 0
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push 0
push 0
push 0
push dword [ebp - 0x6cec]
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
push 0x43
push dword [ebp - 0x6fb4]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push str._r_n_t_tBrowser:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2010]
call fcn.005dc190
push eax
push str._r_n_t_tStartup_Page_policy:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6fcc]
lea ecx, [ebp - 0x6cec]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x1f74]
mov dword [ebp - 0x6fcc], eax
call fcn.005d62e0
test al, al
jne 0x5276e0
mov eax, dword [ebp - 0x6f9c]
inc esi
cmp esi, eax
jb 0x527123
jmp 0x527875
mov eax, dword [ebp - 0x6f9c]
mov ecx, dword [ebp - 0x6f78]
mov edx, dword [ebp - 0x6f8c]
mov dword [ebp - 0x6fa4], esi
add ecx, 0xc
sub edx, 1
mov dword [ebp - 0x6f78], ecx
mov dword [ebp - 0x6f8c], edx
jne 0x527113
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x528476
push 0
push str._r_n_tOther_Chromium_browsers_reset_options:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov esi, dword [ebp - 0x6f9c]
mov dword [ebp - 0x6f78], 0
test esi, esi
je 0x527e47
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x527e47
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x2254]
call fcn.00403730
push str.Opera_Browser
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x204c]
mov eax, dword [eax]
mov dword [ebp - 0x6fcc], eax
call fcn.00404410
mov ecx, eax
call fcn.005dc4c0
mov byte [ebp - 0x6f81], al
lea ecx, [ebp - 0x21f8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test al, al
je 0x527948
push str.Op
jmp 0x52794d
push 0x6712e8
push dword [ebp - 0x6f78]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc200
push 0x260
lea ecx, [ebp - 0x3ed0]
call fcn.00401d60
push 1
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3ed0]
call fcn.00401130
push 3
lea ecx, [ebp - 0x205c]
mov byte [ebp - 4], 0xd5
call fcn.005dadc0
lea ecx, [ebp - 0x3ed0]
call fcn.00401270
test al, al
je 0x527e23
mov esi, dword [ebp - 0x6f78]
nop
push 1
lea ecx, [ebp - 0x3ed0]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc510
cmp byte [ebp - 0x6f81], 0
jne 0x527a17
push str.Default
lea ecx, [ebp - 0x1fd4]
call fcn.005dc480
test al, al
je 0x527a17
push 0
push 1
push 1
push 0
push str.Profile
lea ecx, [ebp - 0x1fd4]
call fcn.005daa70
cmp eax, 1
jne 0x527e0a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Secure_Preferences
push 1
lea ecx, [ebp - 0x3ed0]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._Secure_Preferences
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str.Reset
lea ecx, [ebp - 0x2090]
call fcn.005dc200
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x527c2e
push 0
push str.Other_Chromium_browsers_reset_options
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x527c2e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._Secure_Preferences
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str.Reset
lea ecx, [ebp - 0x2090]
call fcn.005dc200
mov eax, dword [ebp - 0x6fcc]
mov ecx, dword [ebp - 0x6fa8]
push 0
push 0
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
push 0
push 0
lea ecx, [ebp - 0x1fd4]
mov dword [ebp - 0x6f8c], eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x42
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x527e0a
push 0
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
push 0
push 0x42
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str._r_n_t_tBrowser:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._Preferences
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str.Reset
lea ecx, [ebp - 0x2090]
call fcn.005dc200
push 0
push str.Other_Chromium_browsers_reset_options
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x527e0a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Preferences
push 1
lea ecx, [ebp - 0x3ed0]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x205c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc200
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x527e0a
mov eax, dword [ebp - 0x6fcc]
mov ecx, dword [ebp - 0x6fa8]
push 0
push 0
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
push 0
push 0
lea ecx, [ebp - 0x1fd4]
mov dword [ebp - 0x6f8c], eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x42
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x527e0a
push 0
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
push 0
push 0x42
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str._r_n_t_tBrowser:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea ecx, [ebp - 0x3ed0]
call fcn.00401230
test al, al
jne 0x5279c0
mov esi, dword [ebp - 0x6f9c]
lea ecx, [ebp - 0x3ed0]
mov byte [ebp - 4], 0xd4
call fcn.00401180
mov eax, dword [ebp - 0x6f78]
inc eax
mov dword [ebp - 0x6f78], eax
cmp eax, esi
jb 0x5278d8
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x528476
mov dword [ebp - 0x6f78], 0
test esi, esi
je 0x528159
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x528159
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x2228]
call fcn.00404410
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.005dc4e0
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2388]
call fcn.005daa70
test eax, eax
jne 0x528144
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x62794c
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
push 0x62794c
lea ecx, [ebp - 0x2388]
call fcn.005da780
push 1
lea ecx, [ebp - 0x1fd4]
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.master_preferences
lea ecx, [ebp - 0x1fd4]
call fcn.005da780
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x528144
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._Default_Preferences
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str.Reset
lea ecx, [ebp - 0x2090]
call fcn.005dc200
push 0
push str.Other_Chromium_browsers_reset_options
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x528144
push 0
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2610]
call fcn.005b5da0
test al, al
je 0x528144
lea eax, [ebp - 0x2a54]
push eax
push 0x629fdc
push str.homepage
lea ecx, [ebp - 0x2610]
call fcn.005b5630
test al, al
jne 0x528041
lea eax, [ebp - 0x2a54]
push eax
push 0x629fdc
push str.session__startup_urls
lea ecx, [ebp - 0x2610]
call fcn.005b5630
test al, al
jne 0x528041
lea eax, [ebp - 0x2a54]
push eax
push 0x629fdc
push str.default_search_provider_data
lea ecx, [ebp - 0x2610]
call fcn.005b5630
test al, al
jne 0x528041
lea eax, [ebp - 0x2a54]
push eax
push 0x629fdc
push str.extensions__settings
lea ecx, [ebp - 0x2610]
call fcn.005b5630
test al, al
je 0x528144
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
push str._All_users_
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x42
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x528144
push 0
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push 0
push 0
push 0
push 0
push str._All_users_
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
push 0
push 0x42
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x1fd4]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str._r_n_t_tBrowser:
push str._r_n_t_tUser_name:__All_users_
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6f78]
inc eax
mov dword [ebp - 0x6f78], eax
cmp eax, esi
jb 0x527e68
lea ecx, [ebp - 0x2388]
call fcn.005dc400
mov esi, dword [ebp - 0x6fac]
test esi, esi
je 0x528452
mov ecx, dword [ebp - 0x6fa8]
mov edx, esi
mov eax, dword [ebp - 0x6fa0]
sub eax, ecx
mov dword [ebp - 0x6f78], ecx
mov dword [ebp - 0x6f80], eax
mov eax, dword [ebp - 0x6f9c]
mov dword [ebp - 0x6fcc], edx
nop word [eax + eax]
xor esi, esi
mov dword [ebp - 0x6fa4], esi
test eax, eax
je 0x52843a
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x528422
push 0
push 1
push 1
push 0
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2388]
call fcn.005daa70
test eax, eax
jne 0x528411
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x62794c
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push 0x62794c
lea ecx, [ebp - 0x2388]
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
lea ecx, [ebp - 0x235c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f80]
add ecx, dword [ebp - 0x6f78]
push eax
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2114]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x2114]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x528411
xor dl, dl
lea ecx, [ebp - 0x1f74]
call fcn.005d4010
test al, al
jne 0x528411
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._Policies
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str.Reset
lea ecx, [ebp - 0x2090]
call fcn.005dc200
push 0
push str.Other_Chromium_browsers_reset_options
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x528411
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2114]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x42
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f8c], eax
cmp eax, 0xffffffff
je 0x528411
push 0
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x2114]
call fcn.005dc190
push eax
push 0x42
push dword [ebp - 0x6f8c]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x2114]
call fcn.005dc190
push eax
push str._r_n_t_tInfo:
push esi
lea ecx, [ebp - 0x204c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f78]
push eax
push str._r_n_t_tBrowser:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2090]
call fcn.005dc190
push eax
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6f9c]
inc esi
cmp esi, eax
jb 0x5281b0
jmp 0x528428
mov eax, dword [ebp - 0x6f9c]
mov ecx, dword [ebp - 0x6f78]
mov edx, dword [ebp - 0x6fcc]
mov dword [ebp - 0x6fa4], esi
add ecx, 0xc
sub edx, 1
mov dword [ebp - 0x6f78], ecx
mov dword [ebp - 0x6fcc], edx
jne 0x5281a0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa8]
call fcn.005bb910
push 1
push 0
push 0
lea ecx, [ebp - 0x21e0]
call fcn.005dca80
lea ecx, [ebp - 0x2130]
call fcn.005d69e0
lea ecx, [ebp - 0x2388]
call fcn.005dc430
lea ecx, [ebp - 0x2310]
call fcn.005dc430
lea ecx, [ebp - 0x237c]
call fcn.005dc430
lea ecx, [ebp - 0x6e38]
call fcn.00402770
lea ecx, [ebp - 0x2844]
call fcn.00401e20
lea ecx, [ebp - 0x2254]
call fcn.00403500
lea ecx, [ebp - 0x2228]
call fcn.00404430
lea ecx, [ebp - 0x204c]
call fcn.00404430
lea ecx, [ebp - 0x235c]
call fcn.00404430
lea ecx, [ebp - 0x21f8]
call fcn.00404430
lea ecx, [ebp - 0x32f0]
call fcn.00401180
lea ecx, [ebp - 0x2e30]
call fcn.00401180
lea ecx, [ebp - 0x2610]
call fcn.00401e70
lea ecx, [ebp - 0x2090]
call fcn.005dc430
lea ecx, [ebp - 0x2010]
call fcn.005dc430
lea ecx, [ebp - 0x2524]
call fcn.005dc430
lea ecx, [ebp - 0x1fd4]
call fcn.005dc430
lea ecx, [ebp - 0x205c]
mov byte [ebp - 4], 0x46
call fcn.005dc430
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52b0b1
test dword [edi + 0x34], 0x1000
jne 0x52b0b1
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push str.Other_Firefox_browsers...
push dword [eax + 0x38]
call fcn.005bcd30
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x34
push dword [eax + 0x34]
call fcn.005b9910
push 0xc
lea ecx, [ebp - 0x2300]
call fcn.00401d40
push 0xa
push 0
lea ecx, [ebp - 0x2300]
call fcn.004044a0
push 0xc
lea ecx, [ebp - 0x223c]
mov byte [ebp - 4], 0xd6
call fcn.00401d40
push 0xa
push 0
lea ecx, [ebp - 0x223c]
call fcn.004044a0
push 0xc
lea ecx, [ebp - 0x2370]
mov byte [ebp - 4], 0xd7
call fcn.00401d40
push 0xa
push 0
lea ecx, [ebp - 0x2370]
call fcn.004044a0
push 0xc
lea ecx, [ebp - 0x209c]
mov byte [ebp - 4], 0xd8
call fcn.00401d40
lea ecx, [ebp - 0x209c]
call fcn.004041f0
push 0xc
lea ecx, [ebp - 0x22a8]
mov byte [ebp - 4], 0xd9
call fcn.00401d40
push 0xa
push 0
lea ecx, [ebp - 0x22a8]
call fcn.00403750
push 0x260
lea ecx, [ebp - 0x3090]
mov byte [ebp - 4], 0xda
call fcn.00401d60
lea ecx, [ebp - 0x3090]
call fcn.00401100
push 0x260
lea ecx, [ebp - 0x3550]
mov byte [ebp - 4], 0xdb
call fcn.00401d60
lea ecx, [ebp - 0x3550]
call fcn.00401100
push 0xc
lea ecx, [ebp - 0x2074]
mov byte [ebp - 4], 0xdc
call fcn.00401d40
lea ecx, [ebp - 0x2074]
call fcn.005dc5e0
xor esi, esi
mov byte [ebp - 4], 0xdd
cmp dword [edi + 0x30], esi
jbe 0x528a62
lea eax, [edi + 0x10c]
mov dword [ebp - 0x6f80], eax
nop dword [eax]
push 1
push 1
lea ecx, [ebp - 0x3090]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x2074]
call fcn.005dc260
push 0x660330
lea ecx, [ebp - 0x2074]
call fcn.005dc4c0
test al, al
jne 0x528a58
push 0x624a04
lea ecx, [ebp - 0x2074]
call fcn.005dc4c0
test al, al
jne 0x528a58
push 0x670fb4
lea ecx, [ebp - 0x2074]
call fcn.005dc4c0
test al, al
jne 0x528a58
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6249f8
lea ecx, [ebp - 0x226c]
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2154]
call fcn.005dc200
push 5
lea ecx, [ebp - 0x2154]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3090]
call fcn.00401280
test al, al
je 0x5289c1
mov edi, dword [ebp - 0x6f80]
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Profiles
push 1
lea ecx, [ebp - 0x3090]
call fcn.004012d0
push eax
push 0x624284
lea ecx, [ebp - 0x226c]
call fcn.005dc190
push eax
push esi
mov ecx, edi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2154]
call fcn.005dc200
lea ecx, [ebp - 0x2154]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x5289a8
push 1
lea ecx, [ebp - 0x3090]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x2074]
call fcn.005dc510
push eax
lea eax, [ebp - 0x209c]
push eax
push esi
lea eax, [ebp - 0x22a8]
push eax
lea eax, [ebp - 0x2370]
push eax
lea eax, [ebp - 0x223c]
push eax
push 0
lea ecx, [ebp - 0x2154]
call fcn.005dbed0
lea edx, [ebp - 0x2300]
mov ecx, eax
call fcn.0058e660
test al, al
jne 0x5289a8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6249f8
lea ecx, [ebp - 0x2154]
call fcn.005da780
push 5
lea ecx, [ebp - 0x2154]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3550]
call fcn.00401280
test al, al
je 0x5289a8
nop word [eax + eax]
push 0
push 1
lea ecx, [ebp - 0x3550]
call fcn.004012d0
mov edx, str.Firefox
mov ecx, eax
call fcn.005d8ad0
test eax, eax
je 0x528995
push 0
push 0
push 0
push 0
push 0
push str.Profiles
push 1
lea ecx, [ebp - 0x3550]
call fcn.004012d0
push eax
push 0x624284
push 1
lea ecx, [ebp - 0x3090]
call fcn.004012d0
push eax
push 0x624284
lea ecx, [ebp - 0x226c]
call fcn.005dc190
push eax
push esi
mov ecx, edi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2154]
call fcn.005dc200
lea ecx, [ebp - 0x2154]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x528995
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x3550]
call fcn.004012d0
push eax
push 0x62438c
push 1
lea ecx, [ebp - 0x3090]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x2074]
call fcn.005dc200
lea eax, [ebp - 0x2074]
push eax
lea eax, [ebp - 0x209c]
push eax
push esi
lea eax, [ebp - 0x22a8]
push eax
lea eax, [ebp - 0x2370]
push eax
lea eax, [ebp - 0x223c]
push eax
push 0
lea ecx, [ebp - 0x2154]
call fcn.005dbed0
lea edx, [ebp - 0x2300]
mov ecx, eax
call fcn.0058e660
lea ecx, [ebp - 0x3550]
call fcn.00401230
test al, al
jne 0x528880
lea ecx, [ebp - 0x3090]
call fcn.00401230
test al, al
jne 0x528770
mov edi, dword [ebp - 0x6f7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Tor_BrowserBrowserTorBrowserDataBrowser
lea ecx, [ebp - 0x250c]
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2154]
call fcn.005dc200
lea ecx, [ebp - 0x2154]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x528a58
push str.Tor_Browser
lea ecx, [ebp - 0x2074]
call fcn.005dc510
push eax
lea eax, [ebp - 0x209c]
push eax
push esi
lea eax, [ebp - 0x22a8]
push eax
lea eax, [ebp - 0x2370]
push eax
lea eax, [ebp - 0x223c]
push eax
lea edx, [ebp - 0x2300]
lea ecx, [ebp - 0x2154]
call fcn.0058e660
inc esi
cmp esi, dword [edi + 0x30]
jb 0x5286a0
lea ecx, [ebp - 0x2300]
call fcn.00404250
mov esi, eax
mov ecx, edi
mov dword [ebp - 0x6f9c], esi
call fcn.0050db30
test al, al
jne 0x52b055
test esi, esi
jne 0x528a9e
push esi
push str._r_n_tNo_other_Firefox_based_browser_profiles_have_been_found:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
jmp 0x52b055
push 0xc
lea ecx, [ebp - 0x2204]
call fcn.00401d40
lea ecx, [ebp - 0x2204]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2034]
mov byte [ebp - 4], 0xde
call fcn.00401d40
lea ecx, [ebp - 0x2034]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x25a4]
mov byte [ebp - 4], 0xdf
call fcn.00401d40
lea ecx, [ebp - 0x25a4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x21ec]
mov byte [ebp - 4], 0xe0
call fcn.00401d40
lea ecx, [ebp - 0x21ec]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2440]
mov byte [ebp - 4], 0xe1
call fcn.00401d40
lea ecx, [ebp - 0x2440]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2334]
mov byte [ebp - 4], 0xe2
call fcn.00401d40
lea ecx, [ebp - 0x2334]
call fcn.005dc5e0
push 0x20
lea ecx, [ebp - 0x29b0]
mov byte [ebp - 4], 0xe3
call fcn.00401e40
lea ecx, [ebp - 0x29b0]
call fcn.005e47e0
mov byte [ebp - 4], 0xe4
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa8]
call fcn.005bb910
push 0
push str._r_n_r_n__Other_Firefox_browsers_scan:_r_n_r_n_tStartup_pages:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
xor esi, esi
mov dword [ebp - 0x6f78], esi
cmp dword [ebp - 0x6f9c], esi
jbe 0x528f8f
nop dword [eax + eax]
push esi
lea ecx, [ebp - 0x22a8]
call fcn.00403730
push 0
push 0
push 0
mov eax, dword [eax]
lea ecx, [ebp - 0x2300]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624284
push esi
mov dword [ebp - 0x6f80], eax
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2440]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.profiles.ini
lea ecx, [ebp - 0x2440]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2334]
call fcn.005dc200
lea ecx, [ebp - 0x2334]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x528f7c
lea eax, [ebp - 0x2204]
xor edx, edx
push eax
lea ecx, [ebp - 0x2334]
mov dword [ebp - 0x6f8c], edx
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.0058ef60
test al, al
je 0x528f7c
lea ecx, [ebp - 0x2204]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x528f4f
push 0xc
lea ecx, [ebp - 0x2450]
call fcn.00401d40
lea ecx, [ebp - 0x2450]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2628]
mov byte [ebp - 4], 0xe5
call fcn.00401d40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64ebf8
lea ecx, [ebp - 0x2204]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2628]
call fcn.005dc520
lea eax, [ebp - 0x2450]
mov byte [ebp - 4], 0xe6
push eax
lea ecx, [ebp - 0x2628]
call fcn.005dc190
mov edx, str.browser.startup.homepage
mov ecx, eax
call fcn.0058ecd0
test al, al
je 0x528f35
push 0
push 1
push 1
push 0
push str.:__www.google.
lea ecx, [ebp - 0x2450]
call fcn.005daa70
test eax, eax
jne 0x528f35
push eax
push 1
push 1
push eax
push str.:__www.bing.
lea ecx, [ebp - 0x2450]
call fcn.005daa70
test eax, eax
jne 0x528f35
push eax
push 1
push 1
push eax
push str.duckduckgo.
lea ecx, [ebp - 0x2450]
call fcn.005daa70
test eax, eax
jne 0x528f35
push eax
push 1
push 1
push eax
push str.:__www.yahoo.
lea ecx, [ebp - 0x2450]
call fcn.005daa70
test eax, eax
jne 0x528f35
push eax
push str.Other_Firefox_browsers_startup_pages
lea ecx, [ebp - 0x2450]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x528f35
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._startup_homepage
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2074]
call fcn.005dc200
mov eax, dword [ebp - 0x6f80]
mov ecx, dword [ebp - 0x6fa8]
push 0
push 0
lea eax, [eax + eax*2]
push 0
lea esi, [ecx + eax*4]
push 1
lea ecx, [ebp - 0x2450]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x47
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6fcc], eax
cmp eax, 0xffffffff
jne 0x528e4f
lea ecx, [ebp - 0x2628]
call fcn.005dc430
lea ecx, [ebp - 0x2450]
mov byte [ebp - 4], 0xe4
call fcn.005dc430
mov esi, dword [ebp - 0x6f78]
jmp 0x528f4f
push 0
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2628]
call fcn.005dc190
push eax
push 0
push 0x47
push dword [ebp - 0x6fcc]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2628]
call fcn.005dc190
push eax
push str._r_n_t_tPath:
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str._r_n_t_tBrowser:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2450]
call fcn.005dc190
push eax
push str._r_n_t_tStartup_homepage:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea ecx, [ebp - 0x2628]
call fcn.005dc430
lea ecx, [ebp - 0x2450]
mov byte [ebp - 4], 0xe4
call fcn.005dc430
mov esi, dword [ebp - 0x6f78]
jmp 0x528f4f
lea ecx, [ebp - 0x2628]
call fcn.005dc430
lea ecx, [ebp - 0x2450]
mov byte [ebp - 4], 0xe4
call fcn.005dc430
inc dword [ebp - 0x6f8c]
lea eax, [ebp - 0x2204]
push eax
lea ecx, [ebp - 0x2334]
call fcn.005dc190
mov edx, dword [ebp - 0x6f8c]
mov ecx, eax
call fcn.0058ef60
test al, al
jne 0x528c61
inc esi
mov dword [ebp - 0x6f78], esi
cmp esi, dword [ebp - 0x6f9c]
jb 0x528ba0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52b008
push 0xc
lea ecx, [ebp - 0x25d4]
call fcn.00401d40
push 1
push str.amazondotcom.xmlbing.xmleBay.xmlgoogle.xmltwitter.xmlwikipedia.xmlyahoo.xmlduckduckgo.xml
lea ecx, [ebp - 0x25d4]
call fcn.005dc570
push 0
push str._r_n_tOther_Firefox_browsers_search_plug_ins:_r_n
lea ecx, [ebp - 0x1fc8]
mov byte [ebp - 4], 0xe7
call fcn.005e37e0
xor esi, esi
mov dword [ebp - 0x6f78], esi
cmp dword [ebp - 0x6f9c], esi
jbe 0x5293c6
nop word [eax + eax]
push esi
lea ecx, [ebp - 0x22a8]
call fcn.00403730
push 0
push 0
push 0
mov eax, dword [eax]
lea ecx, [ebp - 0x2300]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624284
push esi
mov dword [ebp - 0x6f80], eax
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2440]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.profiles.ini
lea ecx, [ebp - 0x2440]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2334]
call fcn.005dc200
lea ecx, [ebp - 0x2334]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5293b3
lea eax, [ebp - 0x2204]
xor edx, edx
push eax
lea ecx, [ebp - 0x2334]
mov dword [ebp - 0x6f8c], edx
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.0058ef60
test al, al
je 0x5293b3
lea ecx, [ebp - 0x2204]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x529386
push 0xc
lea ecx, [ebp - 0x24a0]
call fcn.00401d40
lea ecx, [ebp - 0x24a0]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2664]
mov byte [ebp - 4], 0xe8
call fcn.00401d40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64ebf8
lea ecx, [ebp - 0x2204]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2664]
call fcn.005dc520
lea eax, [ebp - 0x24a0]
mov byte [ebp - 4], 0xe9
push eax
lea ecx, [ebp - 0x2664]
call fcn.005dc190
mov edx, str.browser.search.defaultenginename
mov ecx, eax
call fcn.0058ecd0
test al, al
je 0x52936c
push 0x660330
lea ecx, [ebp - 0x24a0]
call fcn.005dc4c0
test al, al
jne 0x52936c
push str.Bing
lea ecx, [ebp - 0x24a0]
call fcn.005dc4c0
test al, al
jne 0x52936c
push str.Yahoo
lea ecx, [ebp - 0x24a0]
call fcn.005dc4c0
test al, al
jne 0x52936c
push str.DuckDuckGo
lea ecx, [ebp - 0x24a0]
call fcn.005dc4c0
test al, al
jne 0x52936c
push 0
push str.Other_Firefox_browsers_search_providers
lea ecx, [ebp - 0x24a0]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x52936c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._default_search_provider
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2074]
call fcn.005dc200
mov eax, dword [ebp - 0x6f80]
mov ecx, dword [ebp - 0x6fa8]
push 0
push 0
lea eax, [eax + eax*2]
push 0
lea esi, [ecx + eax*4]
push 1
lea ecx, [ebp - 0x24a0]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x48
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6fcc], eax
cmp eax, 0xffffffff
jne 0x529286
lea ecx, [ebp - 0x2664]
call fcn.005dc430
lea ecx, [ebp - 0x24a0]
mov byte [ebp - 4], 0xe7
call fcn.005dc430
mov esi, dword [ebp - 0x6f78]
jmp 0x529386
push 0
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2664]
call fcn.005dc190
push eax
push 0
push 0x48
push dword [ebp - 0x6fcc]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2664]
call fcn.005dc190
push eax
push str._r_n_t_tPath:
push dword [ebp - 0x6f78]
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str._r_n_t_tBrowser:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x24a0]
call fcn.005dc190
push eax
push str._r_n_t_tSearch_provider:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea ecx, [ebp - 0x2664]
call fcn.005dc430
lea ecx, [ebp - 0x24a0]
mov byte [ebp - 4], 0xe7
call fcn.005dc430
mov esi, dword [ebp - 0x6f78]
jmp 0x529386
lea ecx, [ebp - 0x2664]
call fcn.005dc430
lea ecx, [ebp - 0x24a0]
mov byte [ebp - 4], 0xe7
call fcn.005dc430
inc dword [ebp - 0x6f8c]
lea eax, [ebp - 0x2204]
push eax
lea ecx, [ebp - 0x2334]
call fcn.005dc190
mov edx, dword [ebp - 0x6f8c]
mov ecx, eax
call fcn.0058ef60
test al, al
jne 0x5290b1
inc esi
mov dword [ebp - 0x6f78], esi
cmp esi, dword [ebp - 0x6f9c]
jb 0x528ff0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52affd
push 0xc
lea ecx, [ebp - 0x2468]
call fcn.00401d40
lea ecx, [ebp - 0x2468]
call fcn.005dc5e0
xor esi, esi
mov byte [ebp - 4], 0xea
mov dword [ebp - 0x6f8c], esi
cmp dword [ebp - 0x6f9c], esi
jbe 0x5297df
push 0
push 1
push 1
push 0
push esi
lea ecx, [ebp - 0x223c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2468]
call fcn.005daa70
test eax, eax
jne 0x5297cc
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x627824
push esi
lea ecx, [ebp - 0x223c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2468]
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..xml
push esi
lea ecx, [ebp - 0x223c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc200
push 0x260
lea ecx, [ebp - 0x4130]
call fcn.00401d60
push 1
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4130]
call fcn.00401130
push 1
lea ecx, [ebp - 0x2034]
mov byte [ebp - 4], 0xeb
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4130]
call fcn.00401280
test al, al
je 0x5297bd
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62794c
push 1
lea ecx, [ebp - 0x4130]
call fcn.004012d0
push eax
push 0x62794c
lea ecx, [ebp - 0x21ec]
call fcn.005dc200
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x21ec]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x25d4]
call fcn.005daa70
test eax, eax
jne 0x5297aa
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 1
lea ecx, [ebp - 0x4130]
call fcn.004012d0
push eax
push 0x624284
push esi
lea ecx, [ebp - 0x223c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc200
lea ecx, [ebp - 0x21ec]
call fcn.005dc400
push 0
push 0x80
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x29b0]
call fcn.005e4120
test eax, eax
je 0x529630
push 0
lea eax, [ebp - 0x21ec]
push eax
lea ecx, [ebp - 0x29b0]
call fcn.005e3f60
test eax, eax
je 0x529630
push 0
push 1
push 1
push 0
push str._ShortName_
lea ecx, [ebp - 0x21ec]
call fcn.005daa70
mov esi, eax
push 0
lea ecx, [esi + 0xa]
push ecx
push 1
push 0
push str.__ShortName_
lea ecx, [ebp - 0x21ec]
call fcn.005daa70
test esi, esi
je 0x52961f
test eax, eax
je 0x52961f
sub eax, esi
lea ecx, [ebp - 0x21ec]
sub eax, 0xb
push eax
lea eax, [esi + 0xb]
push eax
call fcn.005dad10
jmp 0x52962a
lea ecx, [ebp - 0x21ec]
call fcn.005dc400
mov esi, dword [ebp - 0x6f8c]
lea ecx, [ebp - 0x21ec]
call fcn.005dbeb0
test al, al
je 0x529667
push 1
lea ecx, [ebp - 0x4130]
call fcn.004012d0
push eax
lea ecx, [ebp - 0x21ec]
call fcn.005dc510
push 0
lea ecx, [ebp - 0x21ec]
call fcn.005dbf40
jmp 0x529674
push 3
lea ecx, [ebp - 0x21ec]
call fcn.005da0f0
push str.firefox.VisualElementsManifest
lea ecx, [ebp - 0x21ec]
call fcn.005dc4c0
test al, al
jne 0x5297aa
push 0
push str.Other_Firefox_browsers_search_providers
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x5297aa
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
push str._All_users_
lea ecx, [ebp - 0x21ec]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x48
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x5297aa
push 0
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push 0
push 0
push 0
push 0
push str._All_users_
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
push 0
push 0x48
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
push str._r_n_t_tPath:
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str._r_n_t_tBrowser:
push str._All_users_
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x21ec]
call fcn.005dc190
push eax
push str._r_n_t_tPlugin_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea ecx, [ebp - 0x4130]
call fcn.00401230
test al, al
jne 0x5294e8
lea ecx, [ebp - 0x4130]
mov byte [ebp - 4], 0xea
call fcn.00401180
inc esi
mov dword [ebp - 0x6f8c], esi
cmp esi, dword [ebp - 0x6f9c]
jb 0x529405
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52aff2
push 0x24
lea ecx, [ebp - 0x2924]
call fcn.004020b0
lea ecx, [ebp - 0x2924]
call fcn.005b5fe0
push 0xc
lea ecx, [ebp - 0x22b4]
mov byte [ebp - 4], 0xec
call fcn.00401d40
lea ecx, [ebp - 0x22b4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x24c4]
mov byte [ebp - 4], 0xed
call fcn.00401d40
lea ecx, [ebp - 0x24c4]
call fcn.005dc5e0
push 0
push str._r_n_tOther_Firefox_browsers_extensions:_r_n
lea ecx, [ebp - 0x1fc8]
mov byte [ebp - 4], 0xee
call fcn.005e37e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.WhiteListOFB_Extensions
lea ecx, [edi + 0x33c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
xor esi, esi
mov dword [ebp - 0x6f8c], esi
cmp dword [ebp - 0x6f9c], esi
jbe 0x529d42
nop dword [eax + eax]
push esi
lea ecx, [ebp - 0x22a8]
call fcn.00403730
mov ecx, edi
mov eax, dword [eax]
mov dword [ebp - 0x6f80], eax
call fcn.0050db30
test al, al
jne 0x529d42
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Profiles.ini
push esi
lea ecx, [ebp - 0x2300]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2204]
call fcn.005dc200
lea eax, [ebp - 0x2034]
mov dword [ebp - 0x6fb4], 0
push eax
lea ecx, [ebp - 0x2204]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.0058ef60
test al, al
je 0x529d2f
mov esi, dword [ebp - 0x6fb4]
nop
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.extensions.json
lea ecx, [ebp - 0x2034]
call fcn.005da780
push 0x100
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2924]
call fcn.005b5da0
test al, al
je 0x529cff
push 0
lea eax, [ebp - 0x2a8c]
mov dword [ebp - 0x6ed8], 0
push eax
xorps xmm0, xmm0
lea ecx, [ebp - 0x2924]
push str.addons
movups xmmword [ebp - 0x6ee8], xmm0
call fcn.005b5760
test al, al
je 0x529cff
lea eax, [ebp - 0x2a8c]
push eax
lea eax, [ebp - 0x6ee8]
push eax
lea ecx, [ebp - 0x2924]
call fcn.005b4c80
test al, al
je 0x529cff
lea eax, [ebp - 0x22b4]
push eax
push 0x66b31c
lea eax, [ebp - 0x6ee8]
push eax
lea ecx, [ebp - 0x2924]
call fcn.005b54e0
test eax, eax
je 0x529cd8
push 0
push 1
push 1
push 0
push str._search.mozilla.org
lea ecx, [ebp - 0x22b4]
call fcn.005daa70
lea ecx, [ebp - 0x22b4]
mov esi, eax
call fcn.005dc3a0
sub eax, 0x12
cmp esi, eax
je 0x529cd8
push 0
push 1
push 1
push 0
push str._mozilla.com
lea ecx, [ebp - 0x22b4]
call fcn.005daa70
lea ecx, [ebp - 0x22b4]
mov esi, eax
call fcn.005dc3a0
sub eax, 0xb
cmp esi, eax
je 0x529cd8
push 0
push 1
push 1
push 0
push str._mozilla.org
lea ecx, [ebp - 0x22b4]
call fcn.005daa70
lea ecx, [ebp - 0x22b4]
mov esi, eax
call fcn.005dc3a0
sub eax, 0xb
cmp esi, eax
je 0x529cd8
lea eax, [ebp - 0x6ee8]
push eax
lea eax, [ebp - 0x2bd0]
push eax
push str.defaultLocale
lea ecx, [ebp - 0x2924]
call fcn.005b5760
test al, al
je 0x529cd8
lea eax, [ebp - 0x22b4]
push eax
push str.name
lea eax, [ebp - 0x2bd0]
push eax
lea ecx, [ebp - 0x2924]
call fcn.005b54e0
test eax, eax
je 0x529cd8
push str.Default
lea ecx, [ebp - 0x22b4]
call fcn.005dc4c0
test al, al
jne 0x529cd8
push str.FileLink_for_WeTransfer
lea ecx, [ebp - 0x22b4]
call fcn.005dc4c0
test al, al
jne 0x529cd8
lea eax, [ebp - 0x24c4]
push eax
push str.descriptor
lea eax, [ebp - 0x6ee8]
push eax
lea ecx, [ebp - 0x2924]
call fcn.005b54e0
test eax, eax
jne 0x529b4a
lea eax, [ebp - 0x24c4]
push eax
push str.path
lea eax, [ebp - 0x6ee8]
push eax
lea ecx, [ebp - 0x2924]
call fcn.005b54e0
test eax, eax
je 0x529cd8
push str.null
lea ecx, [ebp - 0x24c4]
call fcn.005dc4c0
test al, al
jne 0x529cd8
lea ecx, [ebp - 0x22b4]
call fcn.005dc190
lea ecx, [ebp - 0x1f8c]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005d3780
test al, al
jne 0x529cd8
push 0
push str.Other_Firefox_browsers_extensions
lea ecx, [ebp - 0x22b4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x529cd8
mov eax, dword [ebp - 0x6f80]
mov ecx, dword [ebp - 0x6fa8]
push 0
push 0
lea eax, [eax + eax*2]
push 0
lea esi, [ecx + eax*4]
push 1
lea ecx, [ebp - 0x24c4]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x22b4]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x49
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6fcc], eax
cmp eax, 0xffffffff
je 0x529cd8
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
push dword [ebp - 0x6f8c]
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24c4]
call fcn.005dc190
push eax
push 0
push 0x49
push dword [ebp - 0x6fcc]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x24c4]
call fcn.005dc190
push eax
push str._r_n_t_tPath:
push dword [ebp - 0x6f8c]
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str._r_n_t_tBrowser:
mov ecx, esi
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x22b4]
call fcn.005dc190
push eax
push str._r_n_t_tExtension_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
lea eax, [ebp - 0x2a8c]
push eax
lea eax, [ebp - 0x6ee8]
push eax
lea ecx, [ebp - 0x2924]
call fcn.005b4c80
test al, al
jne 0x5299d0
mov esi, dword [ebp - 0x6fb4]
lea eax, [ebp - 0x2034]
inc esi
push eax
lea ecx, [ebp - 0x2204]
mov dword [ebp - 0x6fb4], esi
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0058ef60
test al, al
jne 0x529930
mov esi, dword [ebp - 0x6f8c]
inc esi
mov dword [ebp - 0x6f8c], esi
cmp esi, dword [ebp - 0x6f9c]
jb 0x5298a0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52afd1
push 0
push str._r_n_tOther_Firefox_browsers_shortcuts:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
lea ecx, [ebp - 0x6ed4]
call fcn.00402740
mov byte [ebp - 4], 0xef
lea ecx, [ebp - 0x6ecc]
mov eax, dword [edi + 8]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x6ed4], eax
mov dword [ebp - 0x6ed0], 0x4b
call fcn.005dc400
lea eax, [ebp - 0x21e0]
mov dword [ebp - 0x6ebc], eax
lea ecx, [ebp - 0x6eac]
lea eax, [edi + 0x164]
mov dword [ebp - 0x6eb8], eax
lea eax, [ebp - 0x1fc8]
mov dword [ebp - 0x6eb4], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x6eb0], eax
call fcn.005dc400
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52afc6
push 0xc
lea ecx, [ebp - 0x24ac]
call fcn.00401d40
lea ecx, [ebp - 0x24ac]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2424]
mov byte [ebp - 4], 0xf0
call fcn.00401d40
lea ecx, [ebp - 0x2424]
call fcn.005dc5e0
lea ecx, [ebp - 0x2468]
mov byte [ebp - 4], 0xf1
call fcn.005dc400
xor esi, esi
cmp dword [ebp - 0x6f9c], esi
jbe 0x52a0c3
nop
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52a0c3
push 0
push 1
push 1
push 0
push esi
lea ecx, [ebp - 0x223c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2468]
call fcn.005daa70
test eax, eax
jne 0x52a0b6
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x627824
push esi
lea ecx, [ebp - 0x223c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2468]
call fcn.005da780
push esi
lea ecx, [ebp - 0x22a8]
call fcn.00403730
push 0
push 0
push 0
mov eax, dword [eax]
lea ecx, [ebp - 0x2370]
push 0
push 0
push 0
push 0
push 0
push 0
push esi
mov dword [ebp - 0x6f8c], eax
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push 0x624284
push esi
lea ecx, [ebp - 0x223c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x6ecc]
call fcn.005dc200
push dword [ebp - 0x6f8c]
lea ecx, [edi + 0x114]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push esi
lea ecx, [ebp - 0x209c]
mov dword [ebp - 0x6ec0], eax
call fcn.00404410
push eax
lea ecx, [ebp - 0x6eac]
call fcn.005dc4e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x250c]
call fcn.005dc190
push eax
push dword [ebp - 0x6f8c]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24ac]
call fcn.005dc200
lea ecx, [ebp - 0x24ac]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x52a0b6
lea ecx, [ebp - 0x24ac]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6ed4]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52a0c3
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x25bc]
call fcn.005dc190
push eax
push dword [ebp - 0x6f8c]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24ac]
call fcn.005dc200
lea ecx, [ebp - 0x24ac]
call fcn.005dc190
mov ecx, eax
call fcn.005e1200
test al, al
je 0x52a0b6
push 0
lea ecx, [ebp - 0x24ac]
call fcn.005dbed0
lea ecx, [ebp - 0x24ac]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6ed4]
mov ecx, edi
push eax
call fcn.0052e3e0
lea ecx, [ebp - 0x264c]
mov dword [ebp - 0x6ec0], str._All_users_
call fcn.005dc190
push eax
lea eax, [ebp - 0x6ed4]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52a0c3
push 0
push 1
lea ecx, [ebp - 0x2640]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24ac]
call fcn.005dc260
mov ecx, eax
call fcn.005dbed0
lea ecx, [ebp - 0x24ac]
call fcn.005dc190
push eax
lea eax, [ebp - 0x6ed4]
mov ecx, edi
push eax
call fcn.0052e3e0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52a0c3
inc esi
cmp esi, dword [ebp - 0x6f9c]
jb 0x529e30
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52afb0
lea ecx, [ebp - 0x2468]
call fcn.005dc400
push 4
lea ecx, [ebp - 0x222c]
call fcn.00401d80
lea ecx, [ebp - 0x222c]
call fcn.005d6aa0
xor eax, eax
mov byte [ebp - 4], 0xf2
mov dword [ebp - 0x6f8c], eax
cmp dword [ebp - 0x6f9c], eax
jbe 0x52a53b
nop dword [eax]
xor esi, esi
mov dword [ebp - 0x6fa4], esi
nop dword [eax + eax]
push eax
lea ecx, [ebp - 0x22a8]
call fcn.00403730
mov eax, dword [eax]
mov dword [ebp - 0x6fcc], eax
test esi, esi
jne 0x52a161
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.SoftwareClientsStartMenuInternet
push eax
lea ecx, [edi + 0x104]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push str.HKU_
jmp 0x52a1ab
cmp esi, 1
jne 0x52a187
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareClientsStartMenuInternet
push dword [ebp - 0x6fc4]
jmp 0x52a1ab
cmp esi, 2
jne 0x52a1b6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareClientsStartMenuInternet
push dword [ebp - 0x6fe0]
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x222c]
call fcn.005d6a30
test al, al
je 0x52a512
lea eax, [ebp - 0x6cec]
mov dword [ebp - 0x6f78], 0
push eax
push 0
lea ecx, [ebp - 0x222c]
call fcn.005d6380
test al, al
je 0x52a512
mov esi, dword [ebp - 0x6f8c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._shellopencommand
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f8c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x52a4e4
lea eax, [ebp - 0x2424]
push eax
push 0x62439c
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x52a4e4
lea ecx, [ebp - 0x2424]
call fcn.005dbeb0
test al, al
jne 0x52a4e4
push dword [ebp - 0x6fcc]
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2424]
call fcn.005dbc20
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
lea ecx, [ebp - 0x2370]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push 0x624284
push esi
lea ecx, [ebp - 0x223c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2074]
call fcn.005dc200
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2424]
call fcn.005daa70
test eax, eax
je 0x52a4e4
lea ecx, [ebp - 0x2074]
call fcn.005dc3a0
inc eax
lea ecx, [ebp - 0x2424]
push eax
call fcn.005dad50
push 0
push 0
push 0x62439c
push 0x624388
push 3
lea ecx, [ebp - 0x2424]
call fcn.005da0f0
mov ecx, eax
call fcn.005da270
lea ecx, [ebp - 0x2424]
call fcn.005dbeb0
test al, al
jne 0x52a4e4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f8c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc200
push 0
push str.Other_Firefox_browsers_shortcuts
lea ecx, [ebp - 0x2424]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x52a4e4
mov eax, dword [ebp - 0x6fcc]
mov ecx, dword [ebp - 0x6fa8]
push 0
push 0
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
push 0
push 1
lea ecx, [ebp - 0x2424]
mov dword [ebp - 0x6fb4], eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6fb4]
push eax
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push str.Start_Menu_Internet_shortcut
push 5
push 0x4b
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x52a4e4
push 0
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6fb4]
push eax
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
push 0
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
push 0x4b
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6fb4]
push eax
push str._r_n_t_tBrowser:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2424]
call fcn.005dc190
push eax
push str._r_n_t_tStart_Menu_Internet_shortcut_argument:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov eax, dword [ebp - 0x6f78]
lea ecx, [ebp - 0x6cec]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x222c]
mov dword [ebp - 0x6f78], eax
call fcn.005d6380
test al, al
jne 0x52a208
mov esi, dword [ebp - 0x6fa4]
mov eax, dword [ebp - 0x6f8c]
inc esi
mov dword [ebp - 0x6fa4], esi
cmp esi, 3
jb 0x52a120
inc eax
mov dword [ebp - 0x6f8c], eax
cmp eax, dword [ebp - 0x6f9c]
jb 0x52a110
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52afa5
push 0
push str._r_n_tOther_Firefox_browsers_reset_options:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
push 0xc
lea ecx, [ebp - 0x2518]
call fcn.00401d40
lea ecx, [ebp - 0x2518]
call fcn.005dc5e0
xor esi, esi
mov byte [ebp - 4], 0xf3
cmp dword [ebp - 0x6f9c], esi
jbe 0x52af6f
nop word [eax + eax]
push esi
lea ecx, [ebp - 0x22a8]
call fcn.00403730
mov ecx, edi
mov eax, dword [eax]
mov dword [ebp - 0x6f78], eax
call fcn.0050db30
test al, al
jne 0x52af6f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Profiles.ini
push esi
lea ecx, [ebp - 0x2300]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2204]
call fcn.005dc200
lea eax, [ebp - 0x2518]
xor edx, edx
push eax
lea ecx, [ebp - 0x2204]
mov dword [ebp - 0x6fb4], edx
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.0058ef60
test al, al
je 0x52af62
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._Ad_ons
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str.Reset
lea ecx, [ebp - 0x2074]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._addons.json
lea ecx, [ebp - 0x2518]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc200
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52a7d1
push 0
push str.Other_Firefox_browsers_reset_options
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x52a7d1
mov eax, dword [ebp - 0x6f78]
mov ecx, dword [ebp - 0x6fa8]
push 0
push 0
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
push 0
push 0
lea ecx, [ebp - 0x2034]
mov dword [ebp - 0x6f8c], eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x4c
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x52a7d1
push 0
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
push 0
push 0x4c
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x2034]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str._r_n_t_tPath:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._Extensions
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str.Reset
lea ecx, [ebp - 0x2074]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64ebc4
lea ecx, [ebp - 0x2518]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc200
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x52a878
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.extensions.json
lea ecx, [ebp - 0x2518]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc200
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52a9c8
push 0
push str.Other_Firefox_browsers_reset_options
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x52a9c8
mov eax, dword [ebp - 0x6f78]
mov ecx, dword [ebp - 0x6fa8]
push 0
push 0
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
push 0
push 0
lea ecx, [ebp - 0x2034]
mov dword [ebp - 0x6f8c], eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x4c
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x52a9c8
push 0
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
push 0
push 0x4c
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x2034]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str._r_n_t_tPath:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._User_Search_Providers
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str.Reset
lea ecx, [ebp - 0x2074]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._search.json
lea ecx, [ebp - 0x2518]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc200
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x52aa6f
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str._searchplugins
lea ecx, [ebp - 0x2518]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc200
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52abbf
push 0
push str.Other_Firefox_browsers_reset_options
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x52abbf
mov eax, dword [ebp - 0x6f78]
mov ecx, dword [ebp - 0x6fa8]
push 0
push 0
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
push 0
push 0
lea ecx, [ebp - 0x2034]
mov dword [ebp - 0x6f8c], eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x4c
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x52abbf
push 0
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
push 0
push 0x4c
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x2034]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str._r_n_t_tPath:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._Settings
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str.Reset
lea ecx, [ebp - 0x2074]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64ebf8
lea ecx, [ebp - 0x2518]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc200
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52ad7a
push 0
push str.Other_Firefox_browsers_reset_options
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x52ad7a
mov eax, dword [ebp - 0x6f78]
mov ecx, dword [ebp - 0x6fa8]
push 0
push 0
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
push 0
push 0
lea ecx, [ebp - 0x2034]
mov dword [ebp - 0x6f8c], eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x4c
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x52ad7a
push 0
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
push 0
push 0x4c
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x2034]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str._r_n_t_tPath:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._User_Preferences
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
push str.Reset
lea ecx, [ebp - 0x2074]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.user.js
lea ecx, [ebp - 0x2518]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc200
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52af35
push 0
push str.Other_Firefox_browsers_reset_options
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00511ee0
test al, al
jne 0x52af35
mov eax, dword [ebp - 0x6f78]
mov ecx, dword [ebp - 0x6fa8]
push 0
push 0
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
push 0
push 0
lea ecx, [ebp - 0x2034]
mov dword [ebp - 0x6f8c], eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
mov eax, dword [edi + 8]
mov ecx, edi
push 5
push 0x4c
push dword [eax + 0xa8]
call fcn.0053ab00
mov dword [ebp - 0x6f80], eax
cmp eax, 0xffffffff
je 0x52af35
push 0
push esi
lea ecx, [ebp - 0x209c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2034]
call fcn.005dc190
push eax
push 0
push 0x4c
push dword [ebp - 0x6f80]
lea eax, [ebp - 0x21e0]
mov ecx, edi
push eax
call fcn.0053a900
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x2034]
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str._r_n_t_tPath:
call fcn.005dc190
push eax
push str._r_n_t_tUser_name:
lea ecx, [ebp - 0x2074]
call fcn.005dc190
push eax
push str._r_n_t_tOption_name:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
inc dword [ebp - 0x6fb4]
lea eax, [ebp - 0x2518]
push eax
lea ecx, [ebp - 0x2204]
call fcn.005dc190
mov edx, dword [ebp - 0x6fb4]
mov ecx, eax
call fcn.0058ef60
test al, al
jne 0x52a616
inc esi
cmp esi, dword [ebp - 0x6f9c]
jb 0x52a590
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push dword [eax + 0xa8]
call fcn.005bb910
push 1
push 0
push 0
lea ecx, [ebp - 0x21e0]
call fcn.005dca80
mov ecx, edi
call fcn.0050db30
lea ecx, [ebp - 0x2518]
call fcn.005dc430
lea ecx, [ebp - 0x222c]
call fcn.005d69e0
lea ecx, [ebp - 0x2424]
call fcn.005dc430
lea ecx, [ebp - 0x24ac]
call fcn.005dc430
lea ecx, [ebp - 0x6ed4]
call fcn.00402770
lea ecx, [ebp - 0x24c4]
call fcn.005dc430
lea ecx, [ebp - 0x22b4]
call fcn.005dc430
lea ecx, [ebp - 0x2924]
call fcn.00401e70
lea ecx, [ebp - 0x2468]
call fcn.005dc430
lea ecx, [ebp - 0x25d4]
call fcn.005dc430
lea ecx, [ebp - 0x29b0]
call fcn.00401e20
lea ecx, [ebp - 0x2334]
call fcn.005dc430
lea ecx, [ebp - 0x2440]
call fcn.005dc430
lea ecx, [ebp - 0x21ec]
call fcn.005dc430
lea ecx, [ebp - 0x25a4]
call fcn.005dc430
lea ecx, [ebp - 0x2034]
call fcn.005dc430
lea ecx, [ebp - 0x2204]
call fcn.005dc430
lea ecx, [ebp - 0x2074]
call fcn.005dc430
lea ecx, [ebp - 0x3550]
call fcn.00401180
lea ecx, [ebp - 0x3090]
call fcn.00401180
lea ecx, [ebp - 0x22a8]
call fcn.00403500
lea ecx, [ebp - 0x209c]
call fcn.00404430
lea ecx, [ebp - 0x2370]
call fcn.00404430
lea ecx, [ebp - 0x223c]
call fcn.00404430
lea ecx, [ebp - 0x2300]
mov byte [ebp - 4], 0x46
call fcn.00404430
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d39b
test dword [edi + 0x34], 0x40
jne 0x52d39b
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push str.Anti_Malware_scan...
push dword [eax + 0x38]
call fcn.005bcd30
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x37
push dword [eax + 0x34]
call fcn.005b9910
mov eax, dword [edi + 0x30]
xor esi, esi
test eax, eax
je 0x52b15b
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion_
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x52b111
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x52b1c2
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
push 0xc
lea ecx, [ebp - 0x1fa4]
mov dword [ebp - 0x6ffc], str.RunOnce
mov dword [ebp - 0x6ff8], str.RunOnceEx
mov dword [ebp - 0x6ff4], str.RunServicesOnce
mov dword [ebp - 0x6ff0], str.RunServices
mov dword [ebp - 0x6fec], str.RunHidden
mov dword [ebp - 0x6fe8], str.PoliciesExplorerRun
call fcn.00401d40
lea ecx, [ebp - 0x1fa4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x22f4]
mov byte [ebp - 4], 0xf4
call fcn.00401d40
lea ecx, [ebp - 0x22f4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2190]
mov byte [ebp - 4], 0xf5
call fcn.00401d40
lea ecx, [ebp - 0x2190]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2328]
mov byte [ebp - 4], 0xf6
call fcn.00401d40
lea ecx, [ebp - 0x2328]
call fcn.005dc5e0
cmp dword [ebp - 0x6fac], 0
mov byte [ebp - 4], 0xf7
mov dword [ebp - 0x6fcc], 0
jbe 0x52b42f
mov dword [ebp - 0x6f8c], esi
nop dword [eax + eax]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52b42f
xor esi, esi
mov dword [ebp - 0x6fa4], esi
nop word [eax + eax]
mov ecx, dword [ebp - 0x6f8c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + esi*4 - 0x6ffc]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x52b3ff
lea eax, [ebp - 0x6cec]
mov dword [ebp - 0x6f80], 0
push eax
push 0
lea ecx, [ebp - 0x1f74]
call fcn.005d62e0
test al, al
je 0x52b3ff
mov esi, dword [ebp - 0x6f80]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52b3f9
lea eax, [ebp - 0x1fa4]
push eax
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x52b3dd
lea ecx, [ebp - 0x1fa4]
call fcn.005dbeb0
test al, al
jne 0x52b3dd
push 3
lea edx, [edi + 0x1a8]
lea ecx, [ebp - 0x1fa4]
call fcn.005e88c0
test al, al
je 0x52b3dd
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f8c]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x213c]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x213c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x1fa4]
mov ecx, edi
push eax
call fcn.00511450
lea eax, [ebp - 0x6cec]
inc esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
call fcn.005d62e0
test al, al
jne 0x52b334
mov esi, dword [ebp - 0x6fa4]
inc esi
mov dword [ebp - 0x6fa4], esi
cmp esi, 6
jb 0x52b2b0
mov esi, dword [ebp - 0x6fcc]
add dword [ebp - 0x6f8c], 0xc
inc esi
mov dword [ebp - 0x6fcc], esi
cmp esi, dword [ebp - 0x6fac]
jb 0x52b290
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x39
push dword [eax + 0x34]
call fcn.005b9910
push 4
lea ecx, [ebp - 0x6cf0]
call fcn.00401d80
lea ecx, [ebp - 0x6cf0]
call fcn.004013f0
lea eax, [ebp - 0x6cf0]
mov byte [ebp - 4], 0xf8
push eax
push 0x61e720
push 1
push 0
push 0x61e730
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x52b736
lea ecx, [ebp - 0x70f0]
call fcn.00401ca0
movups xmm0, xmmword [eax]
lea ecx, [ebp - 0x7060]
movups xmmword [ebp - 0x6fd8], xmm0
call fcn.00401ca0
movups xmm0, xmmword [eax]
lea ecx, [ebp - 0x7070]
movups xmmword [ebp - 0x6f98], xmm0
call fcn.00401ca0
movups xmm0, xmmword [eax]
lea ecx, [ebp - 0x7080]
movups xmmword [ebp - 0x6fc0], xmm0
call fcn.00401ca0
mov edi, eax
mov byte [ebp - 4], 0xfc
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x6fd8]
mov ecx, dword [ebp - 0x6cf0]
mov edx, esp
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov esi, dword [ecx]
movups xmmword [edx], xmm0
movups xmm0, xmmword [ebp - 0x6f98]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x6fc0]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [edi]
push ecx
movups xmmword [eax], xmm0
mov eax, dword [esi + 0x28]
call eax
shr eax, 0x1f
lea ecx, [ebp - 0x7080]
mov dword [ebp - 0x6f80], eax
call fcn.00401d30
lea ecx, [ebp - 0x7070]
call fcn.00401d30
lea ecx, [ebp - 0x7060]
call fcn.00401d30
lea ecx, [ebp - 0x70f0]
mov byte [ebp - 4], 0xf8
call fcn.00401d30
cmp byte [ebp - 0x6f80], 0
jne 0x52b730
push 4
lea ecx, [ebp - 0x6d18]
call fcn.00401d80
lea ecx, [ebp - 0x6d18]
call fcn.004013f0
push 0x624284
lea ecx, [ebp - 0x7030]
mov byte [ebp - 4], 0xfd
call fcn.00401a90
mov byte [ebp - 4], 0xfe
mov ecx, dword [ebp - 0x6cf0]
mov esi, dword [ecx]
lea ecx, [ebp - 0x6d18]
push ecx
mov ecx, eax
call fcn.00401b50
push eax
push dword [ebp - 0x6cf0]
mov eax, dword [esi + 0x1c]
call eax
shr eax, 0x1f
lea ecx, [ebp - 0x7030]
mov dword [ebp - 0x6f80], eax
mov byte [ebp - 4], 0xfd
call fcn.00401b40
cmp byte [ebp - 0x6f80], 0
jne 0x52b721
push 4
lea ecx, [ebp - 0x6d24]
call fcn.00401d80
lea ecx, [ebp - 0x6d24]
call fcn.004013f0
mov byte [ebp - 4], 0xff
lea edx, [ebp - 0x6d24]
mov eax, dword [ebp - 0x6d18]
push edx
push 0
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x28]
call eax
test eax, eax
js 0x52b716
mov eax, dword [ebp - 0x6d24]
lea edx, [ebp - 0x2594]
mov dword [ebp - 0x2594], 0
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x1c]
call eax
mov eax, dword [ebp - 0x2594]
test eax, eax
je 0x52b716
mov esi, 1
mov dword [ebp - 0x6fcc], esi
cmp eax, esi
jl 0x52b716
mov edi, dword [ebp - 0x6f7c]
push 4
lea ecx, [ebp - 0x6d28]
call fcn.00401d80
lea ecx, [ebp - 0x6d28]
call fcn.004013f0
push 3
push esi
lea ecx, [ebp - 0x70b0]
mov dword [ebp - 4], 0x100
call fcn.00401cb0
mov esi, eax
mov byte [ebp - 4], 1
lea edx, [ebp - 0x6d28]
mov ecx, dword [ebp - 0x6d24]
movups xmm0, xmmword [esi]
push edx
sub esp, 0x10
mov eax, dword [ecx]
mov edx, esp
push ecx
mov eax, dword [eax + 0x20]
movups xmmword [edx], xmm0
call eax
shr eax, 0x1f
lea ecx, [ebp - 0x70b0]
mov dword [ebp - 0x6f80], eax
mov byte [ebp - 4], 0
call fcn.00401d30
cmp byte [ebp - 0x6f80], 0
jne 0x52b6d7
push dword [ebp - 0x6d28]
mov ecx, edi
call fcn.0050f070
test al, al
je 0x52b704
lea ecx, [ebp - 0x6d28]
mov dword [ebp - 4], 0xff
call fcn.00402e10
mov esi, dword [ebp - 0x6fcc]
inc esi
mov dword [ebp - 0x6fcc], esi
cmp esi, dword [ebp - 0x2594]
jle 0x52b652
jmp 0x52b716
lea ecx, [ebp - 0x6d28]
mov dword [ebp - 4], 0xff
call fcn.00402e10
lea ecx, [ebp - 0x6d24]
call fcn.00402e10
lea ecx, [ebp - 0x6d18]
mov byte [ebp - 4], 0xf8
call fcn.00402e10
mov edi, dword [ebp - 0x6f7c]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d360
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x3c
push dword [eax + 0x34]
call fcn.005b9910
push 0x18
lea ecx, [ebp - 0x24dc]
call fcn.00401e00
lea ecx, [ebp - 0x24dc]
call fcn.005d9320
mov dword [ebp - 4], 0x102
xor esi, esi
mov eax, dword [edi + 0x30]
test eax, eax
je 0x52b7dd
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x52b793
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x52b844
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
inc eax
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fac], 0
mov dword [ebp - 0x7000], 0x6417fc
mov dword [ebp - 0x6ffc], str.Userinit
mov dword [ebp - 0x6ff8], str.System
mov dword [ebp - 0x6ff4], str.Load
mov dword [ebp - 0x6ff0], 0x6484e0
mov dword [ebp - 0x6fec], str.UIHost
mov dword [ebp - 0x6fe8], str.AppInit_DLLs
mov dword [ebp - 0x6fcc], 0
jbe 0x52ba48
mov dword [ebp - 0x6f8c], esi
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52ba48
xor esi, esi
mov dword [ebp - 0x6fa4], esi
nop
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52ba28
mov eax, dword [ebp + esi*4 - 0x7000]
lea ecx, [ebp - 0x1fa4]
push ecx
mov ecx, dword [ebp - 0x6f8c]
push eax
mov dword [ebp - 0x6fb4], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d65d0
test al, al
je 0x52ba28
push 0
push 0x628818
lea ecx, [ebp - 0x1fa4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24dc]
call fcn.005d9070
lea ecx, [ebp - 0x24dc]
mov dword [ebp - 0x6f80], 0
call fcn.005d9210
test eax, eax
je 0x52ba18
mov esi, dword [ebp - 0x6f80]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52ba12
push 3
push 1
push esi
lea ecx, [ebp - 0x24dc]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005dc260
mov ecx, eax
call fcn.005da0f0
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x52b9fe
push 3
lea edx, [edi + 0x1a8]
lea ecx, [ebp - 0x1fa4]
call fcn.005e88c0
test al, al
je 0x52b9fe
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
lea ecx, [ebp - 0x24dc]
call fcn.005d9220
mov ecx, dword [ebp - 0x6f8c]
push eax
push 0x62bd28
push dword [ebp - 0x6fb4]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x213c]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x213c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x1fa4]
mov ecx, edi
push eax
call fcn.00511450
lea ecx, [ebp - 0x24dc]
inc esi
call fcn.005d9210
cmp esi, eax
jb 0x52b944
mov esi, dword [ebp - 0x6fa4]
inc esi
mov dword [ebp - 0x6fa4], esi
cmp esi, 7
jb 0x52b8c0
mov esi, dword [ebp - 0x6fcc]
add dword [ebp - 0x6f8c], 0xc
inc esi
mov dword [ebp - 0x6fcc], esi
cmp esi, dword [ebp - 0x6fac]
jb 0x52b8a7
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d34e
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x3e
push dword [eax + 0x34]
call fcn.005b9910
push 0xc
lea ecx, [ebp - 0x20f0]
call fcn.00401d40
lea ecx, [ebp - 0x20f0]
call fcn.005dc5e0
mov esi, dword [ebp - 0x6fa4]
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x6fcc], eax
test eax, eax
jne 0x52ba9c
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
jmp 0x52bab3
cmp esi, 1
jne 0x52babe
cmp byte [edi + 0x1b4], 0
je 0x52bbec
push str.HKLMSOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
lea ecx, [ebp - 0x1f8c]
call fcn.005dc510
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x52bbd6
lea eax, [ebp - 0x6cec]
xor esi, esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
call fcn.005d6380
test al, al
je 0x52bbd6
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52bbd6
lea eax, [ebp - 0x1fa4]
push eax
lea eax, [ebp - 0x2190]
push eax
push 1
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x20f0]
call fcn.005dc260
push eax
mov ecx, edi
call fcn.00512e90
test al, al
je 0x52bbba
push 0
lea ecx, [ebp - 0x20f0]
call fcn.005dc190
push eax
lea eax, [ebp - 0x1fa4]
mov ecx, edi
push eax
call fcn.00511450
test al, al
je 0x52bbba
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f8c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x213c]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x213c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005dc400
push eax
mov ecx, edi
call fcn.00511450
lea eax, [ebp - 0x6cec]
inc esi
push eax
push esi
lea ecx, [ebp - 0x1f74]
call fcn.005d6380
test al, al
jne 0x52bb01
mov eax, dword [ebp - 0x6fcc]
inc eax
mov dword [ebp - 0x6fcc], eax
cmp eax, 2
jb 0x52ba91
mov ecx, edi
call fcn.00511b80
test al, al
je 0x52d343
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x41
push dword [eax + 0x34]
call fcn.005b9910
push 4
lea ecx, [ebp - 0x1fa8]
call fcn.00401d80
lea ecx, [ebp - 0x1fa8]
call fcn.005d6aa0
push 4
lea ecx, [ebp - 0x2050]
mov byte [ebp - 4], 4
call fcn.00401d80
lea ecx, [ebp - 0x2050]
call fcn.005d6aa0
push 4
lea ecx, [ebp - 0x1ff8]
mov byte [ebp - 4], 5
call fcn.00401d80
lea ecx, [ebp - 0x1ff8]
call fcn.005d6aa0
mov byte [ebp - 4], 6
lea esi, [ebp - 0x7028]
mov dword [ebp - 0x7028], str.HKCRShell
mov dword [ebp - 0x7024], str.HKCRShellExContextMenuHandlers
mov dword [ebp - 0x7020], str.HKCRAllFilesystemObjectsShell
mov dword [ebp - 0x701c], str.HKCRAllFilesystemObjectsShellExContextMenuHandlers
mov dword [ebp - 0x7018], str.HKCRFolderShell
mov dword [ebp - 0x7014], str.HKCRFolderShellExContextMenuHandlers
mov dword [ebp - 0x7010], str.HKCRDirectoryShell
mov dword [ebp - 0x700c], str.HKCRDirectoryShellExContextMenuHandlers
mov dword [ebp - 0x7008], str.HKCRDirectoryBackgroundShell
mov dword [ebp - 0x7004], str.HKCRDirectoryBackgroundShellExContextMenuHandlers
mov dword [ebp - 0x6f8c], 0
mov dword [ebp - 0x6f78], esi
nop dword [eax]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52bfba
push 0
push 0x20019
push dword [esi]
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x52bf9b
mov ecx, edi
xor esi, esi
call fcn.0050db30
test al, al
jne 0x52bf95
nop dword [eax]
lea eax, [ebp - 0x6cec]
push eax
push esi
lea ecx, [ebp - 0x1f74]
call fcn.005d6380
test al, al
je 0x52bf95
lea ecx, [ebp - 0x1fa4]
call fcn.005dc400
lea ecx, [ebp - 0x213c]
call fcn.005dc400
lea ecx, [ebp - 0x20f0]
call fcn.005dc400
test dword [ebp - 0x6f8c], 1
jne 0x52be46
mov eax, dword [ebp - 0x6f78]
lea ecx, [ebp - 0x1f8c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627384
push dword [ebp - 0x6cec]
push 0x624284
push dword [eax]
call fcn.005dc200
lea eax, [ebp - 0x1fa4]
push eax
push 0x62439c
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa8]
call fcn.005d65d0
test al, al
je 0x52bdfb
lea ecx, [ebp - 0x1fa4]
call fcn.005dc3a0
test eax, eax
je 0x52bdfb
push 3
lea edx, [edi + 0x1a8]
lea ecx, [ebp - 0x1fa4]
call fcn.005e88c0
test al, al
jne 0x52bf0c
lea ecx, [ebp - 0x1fa4]
jmp 0x52bf07
lea eax, [ebp - 0x20f0]
push eax
push str.DelegateExecute
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa8]
call fcn.005d65d0
test al, al
je 0x52be35
lea ecx, [ebp - 0x20f0]
call fcn.005dc3a0
test eax, eax
jne 0x52bee1
lea eax, [ebp - 0x20f0]
push eax
push 0x6723dc
jmp 0x52beb7
mov ecx, dword [ebp - 0x6cec]
call fcn.005d45b0
test al, al
je 0x52be7b
lea eax, [ebp - 0x1fa4]
push eax
lea eax, [ebp - 0x2190]
push eax
push 1
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x20f0]
call fcn.005dc260
jmp 0x52bef5
mov eax, dword [ebp - 0x6f78]
lea ecx, [ebp - 0x1f8c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
push 0x624284
push dword [eax]
call fcn.005dc200
lea eax, [ebp - 0x20f0]
push eax
push 0x62439c
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa8]
call fcn.005d65d0
test al, al
je 0x52bf0c
lea ecx, [ebp - 0x20f0]
call fcn.005dc3a0
test eax, eax
je 0x52bf0c
lea eax, [ebp - 0x1fa4]
push eax
lea eax, [ebp - 0x2190]
push eax
lea eax, [ebp - 0x20f0]
push eax
mov ecx, edi
call fcn.00512e90
test al, al
jne 0x52bf0c
lea ecx, [ebp - 0x20f0]
call fcn.005dc400
push 0
lea ecx, [ebp - 0x20f0]
call fcn.005dc190
push eax
lea eax, [ebp - 0x1fa4]
mov ecx, edi
push eax
call fcn.00511450
test al, al
je 0x52bf85
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1f8c]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x213c]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x213c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005dc400
push eax
mov ecx, edi
call fcn.00511450
mov ecx, edi
inc esi
call fcn.0050db30
test al, al
je 0x52bd20
mov esi, dword [ebp - 0x6f78]
mov eax, dword [ebp - 0x6f8c]
add esi, 4
inc eax
mov dword [ebp - 0x6f78], esi
mov dword [ebp - 0x6f8c], eax
cmp eax, 0xa
jb 0x52bce0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d322
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x46
push dword [eax + 0x34]
call fcn.005b9910
xor esi, esi
mov dword [ebp - 0x7028], str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov dword [ebp - 0x7024], str.HKLMSOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov dword [ebp - 0x6f8c], esi
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52c106
push 0
push 0x20019
push dword [ebp + esi*4 - 0x7028]
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x52c0f6
mov ecx, edi
xor esi, esi
call fcn.0050db30
test al, al
jne 0x52c0f0
lea eax, [ebp - 0x6cec]
push eax
push esi
lea ecx, [ebp - 0x1f74]
call fcn.005d6380
test al, al
je 0x52c0f0
mov eax, dword [ebp - 0x6f8c]
lea ecx, [ebp - 0x213c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
push 0x624284
push dword [ebp + eax*4 - 0x7028]
call fcn.005dc200
lea eax, [ebp - 0x1fa4]
push eax
push str.Debugger
lea ecx, [ebp - 0x213c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa8]
call fcn.005d65d0
test al, al
je 0x52c0e0
push 3
lea edx, [edi + 0x1a8]
lea ecx, [ebp - 0x1fa4]
call fcn.005e88c0
test al, al
je 0x52c0e0
push 0
lea ecx, [ebp - 0x213c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x1fa4]
mov ecx, edi
push eax
call fcn.00511450
mov ecx, edi
inc esi
call fcn.0050db30
test al, al
je 0x52c036
mov esi, dword [ebp - 0x6f8c]
inc esi
mov dword [ebp - 0x6f8c], esi
cmp esi, 2
jb 0x52bff5
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d322
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x48
push dword [eax + 0x34]
call fcn.005b9910
push str.HKLMSYSTEMCurrentControlSetControlSecurityProviders
lea ecx, [ebp - 0x2114]
mov dword [ebp - 0x7028], str.SecurityProviders
mov dword [ebp - 0x7024], str.Authentication_Packages
mov dword [ebp - 0x7020], str.Notification_Packages
mov dword [ebp - 0x701c], str.Security_Packages
call fcn.005dc510
push 0xc
lea ecx, [ebp - 0x240c]
call fcn.00401d40
push 1
push 0x624514
lea ecx, [ebp - 0x240c]
call fcn.005dc570
push 0
push 0x20019
lea ecx, [ebp - 0x2114]
mov byte [ebp - 4], 7
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x52c3cd
xor esi, esi
mov dword [ebp - 0x6f8c], esi
nop
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52c3cd
cmp esi, 1
jne 0x52c20a
push str.HKLMSYSTEMCurrentControlSetControlLsa
lea ecx, [ebp - 0x2114]
call fcn.005dc510
push 0
push 0x20019
lea ecx, [ebp - 0x2114]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x52c3cd
push 0x627824
lea ecx, [ebp - 0x240c]
call fcn.005dc510
lea eax, [ebp - 0x1fa4]
push eax
push dword [ebp + esi*4 - 0x7028]
lea ecx, [ebp - 0x1f74]
call fcn.005d6740
test al, al
je 0x52c3bd
lea ecx, [ebp - 0x1fa4]
call fcn.005dbeb0
test al, al
jne 0x52c3bd
push 0x628ffc
lea ecx, [ebp - 0x1fa4]
call fcn.005dc4c0
test al, al
jne 0x52c3bd
push 1
lea ecx, [ebp - 0x240c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24dc]
call fcn.005d9070
lea ecx, [ebp - 0x24dc]
xor esi, esi
call fcn.005d9210
test eax, eax
je 0x52c3b7
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52c3b7
push 3
push 1
push esi
lea ecx, [ebp - 0x24dc]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005dc260
mov ecx, eax
call fcn.005da0f0
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x52c3a3
lea ecx, [ebp - 0x1fa4]
call fcn.005dc3a0
cmp eax, 5
jl 0x52c2fd
push 0
push 1
push 1
push 0
push 0x624288
lea ecx, [ebp - 0x1fa4]
call fcn.005daa70
test eax, eax
jne 0x52c323
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..dll
lea ecx, [ebp - 0x1fa4]
call fcn.005da780
push 3
lea edx, [edi + 0x1a8]
lea ecx, [ebp - 0x1fa4]
call fcn.005e88c0
test al, al
je 0x52c3a3
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
lea ecx, [ebp - 0x24dc]
call fcn.005d9220
push eax
mov eax, dword [ebp - 0x6f8c]
lea ecx, [ebp - 0x2114]
push 0x62bd28
push dword [ebp + eax*4 - 0x7028]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x213c]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x213c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x1fa4]
mov ecx, edi
push eax
call fcn.00511450
lea ecx, [ebp - 0x24dc]
inc esi
call fcn.005d9210
cmp esi, eax
jb 0x52c290
mov esi, dword [ebp - 0x6f8c]
inc esi
mov dword [ebp - 0x6f8c], esi
cmp esi, 4
jb 0x52c1b0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d317
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x4b
push dword [eax + 0x34]
call fcn.005b9910
movsd xmm0, qword [0x6edab8]
mov eax, str.SOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
comisd xmm0, xmmword [edi + 0x390]
mov ecx, str.SOFTWAREMicrosoftWindowsShellNoRoamMUICache
cmovbe ecx, eax
mov eax, dword [edi + 0x30]
xor esi, esi
mov dword [ebp - 0x6fb4], ecx
test eax, eax
je 0x52c47e
mov eax, dword [ebp - 0x6fa0]
lea edx, [edi + 0x104]
mov dword [ebp - 0x6f8c], eax
nop
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push esi
mov ecx, edx
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x6f8c]
push eax
push str.HKU_
call fcn.005dc200
add dword [ebp - 0x6f8c], 0xc
lea edx, [edi + 0x104]
mov eax, dword [edi + 0x30]
inc esi
mov ecx, dword [ebp - 0x6fb4]
cmp esi, eax
jb 0x52c430
mov esi, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push dword [ebp - 0x6fc4]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fdc], 0
je 0x52c4e2
mov eax, dword [edi + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6fb4]
inc eax
push dword [ebp - 0x6fe0]
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
call fcn.005dc200
cmp dword [ebp - 0x6fac], 0
mov dword [ebp - 0x6fb4], 0
jbe 0x52c6cb
mov dword [ebp - 0x6f8c], esi
nop
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52c6cb
push 0
push 0x20019
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d6a30
test al, al
je 0x52c6a9
lea eax, [ebp - 0x6cec]
mov dword [ebp - 0x6fcc], 0
push eax
push 0
lea ecx, [ebp - 0x1f74]
call fcn.005d62e0
test al, al
je 0x52c6a9
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52c6a3
push dword [ebp - 0x6cec]
lea ecx, [ebp - 0x1fa4]
call fcn.005dc510
lea ecx, [ebp - 0x1fa4]
call fcn.005dc3a0
mov esi, eax
cmp esi, 3
jl 0x52c67b
push 1
lea ecx, [ebp - 0x1fa4]
call fcn.005dc440
cmp word [eax], 0x3a
jne 0x52c67b
push 2
lea ecx, [ebp - 0x1fa4]
call fcn.005dc440
cmp word [eax], 0x5c
jne 0x52c67b
movsd xmm0, qword [edi + 0x390]
comisd xmm0, xmmword [0x6edac0]
jbe 0x52c62b
cmp esi, 0x14
jle 0x52c62b
push 0
push 1
push 0xffffffffffffffff
push 0
push str..FriendlyAppName
lea ecx, [ebp - 0x1fa4]
call fcn.005daa70
mov edx, eax
lea ecx, [esi - 0xf]
cmp edx, ecx
jge 0x52c615
push 0
push 1
push 0xffffffffffffffff
push 0
push str..ApplicationCompany
lea ecx, [ebp - 0x1fa4]
call fcn.005daa70
mov edx, eax
lea eax, [esi - 0x13]
cmp edx, eax
jle 0x52c62b
lea eax, [edx - 1]
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005dae00
mov ecx, dword [ebp - 0x6f8c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6cec]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x213c]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x213c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x1fa4]
mov ecx, edi
push eax
call fcn.00511450
mov esi, dword [ebp - 0x6fcc]
lea eax, [ebp - 0x6cec]
inc esi
lea ecx, [ebp - 0x1f74]
push eax
push esi
mov dword [ebp - 0x6fcc], esi
call fcn.005d62e0
test al, al
jne 0x52c557
mov esi, dword [ebp - 0x6f8c]
mov eax, dword [ebp - 0x6fb4]
add esi, 0xc
inc eax
mov dword [ebp - 0x6f8c], esi
mov dword [ebp - 0x6fb4], eax
cmp eax, dword [ebp - 0x6fac]
jb 0x52c500
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d317
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x50
push dword [eax + 0x34]
call fcn.005b9910
push 0xc
lea ecx, [ebp - 0x212c]
call fcn.00401d40
push 0xbb8
push 0
lea ecx, [ebp - 0x212c]
call fcn.004044a0
mov byte [ebp - 4], 8
xor esi, esi
mov eax, dword [edi + 0x30]
test eax, eax
je 0x52c778
mov eax, dword [ebp - 0x6fa0]
lea ecx, [edi + 0x10c]
mov dword [ebp - 0x6f8c], eax
nop dword [eax]
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push dword [ebp - 0x6f8c]
lea ecx, [edi + 0x104]
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, str.Start_Menu
mov ecx, eax
call fcn.0059c9b0
add dword [ebp - 0x6f8c], 0xc
lea ecx, [edi + 0x10c]
mov eax, dword [edi + 0x30]
inc esi
cmp esi, eax
jb 0x52c730
mov ecx, dword [ebp - 0x6fa0]
lea eax, [eax + eax*2]
push 0
push 0
push 0x16
lea ecx, [ecx + eax*4]
call fcn.005dbbc0
mov eax, dword [ebp - 0x6fa0]
xor esi, esi
mov dword [ebp - 0x6f8c], eax
nop dword [eax]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52c7d8
mov ecx, dword [ebp - 0x6f8c]
lea eax, [ebp - 0x212c]
push 1
push eax
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0050ed50
test al, al
je 0x52c7d8
add dword [ebp - 0x6f8c], 0xc
inc esi
cmp esi, dword [edi + 0x30]
jbe 0x52c7a0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d30c
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x51
push dword [eax + 0x34]
call fcn.005b9910
xor esi, esi
cmp dword [edi + 0x30], esi
jbe 0x52c88e
lea eax, [edi + 0x10c]
push esi
mov ecx, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x52c87e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2978]
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005dc200
push 1
lea eax, [ebp - 0x212c]
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0050ed50
test al, al
je 0x52c88e
inc esi
lea eax, [edi + 0x10c]
cmp esi, dword [edi + 0x30]
jb 0x52c808
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d30c
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x52
push dword [eax + 0x34]
call fcn.005b9910
xor esi, esi
cmp dword [edi + 0x30], esi
jbe 0x52c949
lea eax, [edi + 0x10c]
nop
push esi
mov ecx, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x52c939
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MicrosoftWindowsSendTo
lea ecx, [ebp - 0x226c]
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005dc200
push 1
lea eax, [ebp - 0x212c]
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0050ed50
test al, al
je 0x52c949
inc esi
lea eax, [edi + 0x10c]
cmp esi, dword [edi + 0x30]
jb 0x52c8c0
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d30c
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x53
push dword [eax + 0x34]
call fcn.005b9910
xor esi, esi
cmp dword [edi + 0x30], esi
jbe 0x52ca06
lea eax, [edi + 0x10c]
nop dword [eax]
push esi
mov ecx, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x52c9f6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x250c]
call fcn.005dc190
push eax
push esi
lea ecx, [edi + 0x10c]
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005dc200
push 0
lea eax, [ebp - 0x212c]
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0050ed50
test al, al
je 0x52ca06
inc esi
lea eax, [edi + 0x10c]
cmp esi, dword [edi + 0x30]
jb 0x52c980
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d30c
xor esi, esi
cmp dword [edi + 0x30], esi
jbe 0x52ca7a
mov ecx, dword [ebp - 0x6fa0]
lea eax, [edi + 0x10c]
mov dword [ebp - 0x6f8c], ecx
push esi
mov ecx, eax
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
push eax
push dword [ebp - 0x6f8c]
lea ecx, [edi + 0x104]
push esi
call fcn.00403bc0
mov ecx, eax
call fcn.005dc190
mov edx, str.374DE290_123F_4565_9164_39C4925E467B
mov ecx, eax
call fcn.0059c9b0
add dword [ebp - 0x6f8c], 0xc
lea eax, [edi + 0x10c]
inc esi
cmp esi, dword [edi + 0x30]
jb 0x52ca32
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x54
push dword [eax + 0x34]
call fcn.005b9910
mov eax, dword [edi + 0x30]
mov ecx, dword [ebp - 0x6fa0]
push 0
push 0
lea eax, [eax + eax*2]
push 0x19
lea ecx, [ecx + eax*4]
call fcn.005dbbc0
xor esi, esi
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52cade
mov ecx, dword [ebp - 0x6fa0]
lea eax, [ebp - 0x212c]
push 0
push eax
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0050ed50
test al, al
je 0x52cade
add dword [ebp - 0x6fa0], 0xc
inc esi
cmp esi, dword [edi + 0x30]
jbe 0x52caa6
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d30c
push 0xc
lea ecx, [ebp - 0x27d4]
call fcn.00401d40
lea ecx, [ebp - 0x27d4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2658]
mov byte [ebp - 4], 9
call fcn.00401d40
lea ecx, [ebp - 0x2658]
call fcn.005dc5e0
push 0x4c
lea ecx, [ebp - 0x2b58]
mov byte [ebp - 4], 0xa
call fcn.00401e50
lea ecx, [ebp - 0x2b58]
call fcn.005e9520
lea ecx, [ebp - 0x212c]
mov byte [ebp - 4], 0xb
call fcn.00404250
xor esi, esi
mov dword [ebp - 0x6f80], eax
test eax, eax
je 0x52cce1
nop dword [eax]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52cce1
push 0x630518
push 1
push 1
push esi
lea ecx, [ebp - 0x212c]
call fcn.00404410
mov ecx, eax
call fcn.005dc0b0
push eax
lea ecx, [ebp - 0x27d4]
call fcn.005dc260
mov ecx, eax
call fcn.005dc4c0
test al, al
je 0x52cca7
push 0
push esi
lea ecx, [ebp - 0x212c]
call fcn.00404410
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2b58]
call fcn.005e93e0
test al, al
je 0x52cca7
push esi
lea ecx, [ebp - 0x212c]
call fcn.00404410
push eax
lea ecx, [ebp - 0x2658]
call fcn.005dc4e0
push 1
push 0
lea ecx, [ebp - 0x2b58]
call fcn.005e9390
push eax
push esi
lea ecx, [ebp - 0x212c]
call fcn.00404410
mov ecx, eax
call fcn.005dc260
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x52ccd4
lea ecx, [ebp - 0x2b58]
call fcn.005e9340
mov ecx, eax
call fcn.005d8c40
push 0
push 0
test eax, eax
je 0x52cc88
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2b58]
call fcn.005e9340
push eax
push 0x62438c
push esi
lea ecx, [ebp - 0x212c]
call fcn.00404410
mov ecx, eax
call fcn.005da780
push 3
push esi
lea ecx, [ebp - 0x212c]
call fcn.00404410
lea edx, [edi + 0x1a8]
mov ecx, eax
call fcn.005e88c0
test al, al
je 0x52ccd4
jmp 0x52ccb2
push 0x62439c
push 0x624388
push esi
lea ecx, [ebp - 0x212c]
call fcn.00404410
mov ecx, eax
call fcn.005da270
jmp 0x52ccb2
lea ecx, [ebp - 0x2658]
call fcn.005dc400
push 0
lea ecx, [ebp - 0x2658]
call fcn.005dc190
push eax
push esi
lea ecx, [ebp - 0x212c]
call fcn.00404410
push eax
mov ecx, edi
call fcn.00511450
inc esi
cmp esi, dword [ebp - 0x6f80]
jb 0x52cb60
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d2eb
mov ecx, edi
call fcn.00511b80
test al, al
je 0x52d2eb
push 0
push 0
lea ecx, [ebp - 0x212c]
call fcn.004042f0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x55
push dword [eax + 0x34]
call fcn.005b9910
push 0xc
lea ecx, [ebp - 0x6d60]
call fcn.00401d40
lea ecx, [ebp - 0x6d60]
call fcn.005d6ac0
push 0xc
lea ecx, [ebp - 0x6d74]
mov byte [ebp - 4], 0xc
call fcn.00401d40
lea ecx, [ebp - 0x6d74]
call fcn.005d6ac0
push 0
push 0x20019
push str.HKLMSYSTEM
lea ecx, [ebp - 0x1fa8]
mov byte [ebp - 4], 0xd
call fcn.005d6a30
test al, al
je 0x52d0fa
lea eax, [ebp - 0x6d60]
mov dword [ebp - 0x6fcc], 0
push eax
push 0
lea ecx, [ebp - 0x1fa8]
call fcn.005d6380
test al, al
je 0x52d0fa
nop dword [eax + eax]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d0fa
push dword [ebp - 0x6d60]
lea ecx, [ebp - 0x2190]
call fcn.005dc510
push str.CurrentControlSet
lea ecx, [ebp - 0x2190]
call fcn.005dc480
test al, al
je 0x52cdf4
push 0xa
push 1
push 1
push 0
push str.ControlSet
lea ecx, [ebp - 0x2190]
call fcn.005daa70
test eax, eax
je 0x52d0d2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6726ac
push dword [ebp - 0x6d60]
lea ecx, [ebp - 0x1f8c]
push str.HKLMSYSTEM_
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2050]
call fcn.005d6a30
test al, al
je 0x52d0d2
mov ecx, edi
xor esi, esi
call fcn.0050db30
test al, al
jne 0x52d0d2
lea eax, [ebp - 0x6d74]
push eax
push esi
lea ecx, [ebp - 0x2050]
call fcn.005d6380
test al, al
je 0x52d0d2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6d74]
lea ecx, [ebp - 0x1f8c]
push str.Services_
push dword [ebp - 0x6d60]
push str.HKLMSYSTEM_
call fcn.005dc200
push 0
push 0x20019
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1ff8]
call fcn.005d6a30
test al, al
je 0x52d0c2
lea eax, [ebp - 0x28d0]
push eax
push str.Type
lea ecx, [ebp - 0x1ff8]
call fcn.005d66b0
test al, al
je 0x52d0c2
cmp dword [ebp - 0x28d0], 0xb
jne 0x52cf41
lea eax, [ebp - 0x1fa4]
push eax
push str.ImagePath
lea ecx, [ebp - 0x1ff8]
call fcn.005d6740
test al, al
je 0x52d0c2
push 0
lea ecx, [ebp - 0x1fa4]
call fcn.005dc190
push eax
push 0x1000
lea ecx, [ebp - 0x1fa4]
call fcn.005db9a0
lea edx, [edi + 0x1a8]
mov ecx, eax
call fcn.005e7560
jmp 0x52cffb
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Parameters
lea ecx, [ebp - 0x1f8c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x22f4]
call fcn.005dc200
lea eax, [ebp - 0x1fa4]
push eax
push str.ServiceDll
lea ecx, [ebp - 0x22f4]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1f74]
call fcn.005d65d0
test al, al
je 0x52cfa7
lea ecx, [ebp - 0x1fa4]
call fcn.005dbeb0
test al, al
je 0x52cfe8
lea eax, [ebp - 0x1fa4]
push eax
push str.ServiceDll
lea ecx, [ebp - 0x1ff8]
call fcn.005d6740
test al, al
je 0x52cfd1
lea ecx, [ebp - 0x1fa4]
call fcn.005dbeb0
test al, al
je 0x52cfe8
lea eax, [ebp - 0x1fa4]
push eax
push str.ImagePath
lea ecx, [ebp - 0x1ff8]
call fcn.005d6740
push 3
lea edx, [edi + 0x1a8]
lea ecx, [ebp - 0x1fa4]
call fcn.005e88c0
test al, al
je 0x52d0c2
lea ecx, [ebp - 0x1fa4]
call fcn.005dc190
push eax
push 0
call dword [sym.imp.sfc.dll_SfcIsFileProtected]
test eax, eax
je 0x52d037
push 1
push 0
lea ecx, [ebp - 0x7050]
call fcn.005dc570
mov byte [ebp - 4], 0xe
or dword [ebp - 0x6fe4], 1
jmp 0x52d057
lea eax, [ebp - 0x1f8c]
push eax
lea ecx, [ebp - 0x7044]
call fcn.005dc5b0
mov dword [ebp - 4], 0x10f
or dword [ebp - 0x6fe4], 2
push eax
lea ecx, [ebp - 0x213c]
call fcn.005dc4e0
mov eax, dword [ebp - 0x6fe4]
test al, 2
je 0x52d087
and eax, 0xfffffffd
lea ecx, [ebp - 0x7044]
mov dword [ebp - 0x6fe4], eax
call fcn.005dc430
mov eax, dword [ebp - 0x6fe4]
mov dword [ebp - 4], 0x10d
test al, 1
je 0x52d0a6
and eax, 0xfffffffe
lea ecx, [ebp - 0x7050]
mov dword [ebp - 0x6fe4], eax
call fcn.005dc430
push 0
lea ecx, [ebp - 0x213c]
call fcn.005dc190
push eax
lea eax, [ebp - 0x1fa4]
mov ecx, edi
push eax
call fcn.00511450
mov ecx, edi
inc esi
call fcn.0050db30
test al, al
je 0x52ce58
mov eax, dword [ebp - 0x6fcc]
lea ecx, [ebp - 0x6d60]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x1fa8]
mov dword [ebp - 0x6fcc], eax
call fcn.005d6380
test al, al
jne 0x52cda0
mov ecx, edi
call fcn.00511b80
test al, al
je 0x52d2d5
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x58
push dword [eax + 0x34]
call fcn.005b9910
push 4
lea ecx, [ebp - 0x6d20]
call fcn.00401d80
lea ecx, [ebp - 0x6d20]
call fcn.00401040
lea eax, [ebp - 0x2598]
mov byte [ebp - 4], 0x10
push eax
push 0x1f40
lea eax, [ebp - 0x1f70]
mov dword [ebp - 0x6ce0], 0x428
push eax
mov dword [ebp - 0x2598], 0
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x52d22c
xor esi, esi
test dword [ebp - 0x2598], 0xfffffffc
jbe 0x52d22c
nop dword [eax]
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d22c
push dword [ebp + esi*4 - 0x1f70]
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push eax
lea ecx, [ebp - 0x6d20]
call fcn.00401070
lea ecx, [ebp - 0x6d20]
call fcn.004010a0
test al, al
jne 0x52d21a
lea eax, [ebp - 0x6ce0]
push eax
push dword [ebp - 0x6d20]
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x52d20f
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d20f
lea eax, [ebp - 0x6ac0]
mov ecx, edi
push eax
lea eax, [ebp - 0x212c]
push eax
call fcn.0050ecd0
test al, al
je 0x52d20f
lea eax, [ebp - 0x6ce0]
push eax
push dword [ebp - 0x6d20]
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x52d1d4
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d22c
mov eax, dword [ebp - 0x2598]
inc esi
shr eax, 2
cmp esi, eax
jb 0x52d180
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d2ca
lea ecx, [ebp - 0x212c]
call fcn.00404250
mov ecx, dword [edi + 8]
push 0x5a
mov dword [ebp - 0x6fb4], eax
push dword [ecx + 0x34]
mov ecx, dword [edi + 4]
call fcn.005b9910
xor esi, esi
cmp dword [ebp - 0x6fb4], esi
jbe 0x52d2c3
mov dword [ebp - 0x6f8c], esi
mov ecx, edi
call fcn.0050db30
test al, al
jne 0x52d2c3
mov eax, dword [ebp - 0x6f8c]
xor edx, edx
div dword [ebp - 0x6fb4]
mov ecx, dword [edi + 4]
add eax, 0x5a
push eax
mov eax, dword [edi + 8]
push dword [eax + 0x34]
call fcn.005b9910
push 0
push 0
push esi
lea ecx, [ebp - 0x212c]
call fcn.00404410
push eax
mov ecx, edi
call fcn.00511450
add dword [ebp - 0x6f8c], 0xa
inc esi
cmp esi, dword [ebp - 0x6fb4]
jb 0x52d270
mov ecx, edi
call fcn.00511b80
lea ecx, [ebp - 0x6d20]
call fcn.00401050
lea ecx, [ebp - 0x6d74]
call fcn.005d6ab0
lea ecx, [ebp - 0x6d60]
call fcn.005d6ab0
lea ecx, [ebp - 0x2b58]
call fcn.005e9080
lea ecx, [ebp - 0x2658]
call fcn.005dc430
lea ecx, [ebp - 0x27d4]
call fcn.005dc430
lea ecx, [ebp - 0x212c]
call fcn.00404430
lea ecx, [ebp - 0x240c]
call fcn.005dc430
lea ecx, [ebp - 0x1ff8]
call fcn.005d69e0
lea ecx, [ebp - 0x2050]
call fcn.005d69e0
lea ecx, [ebp - 0x1fa8]
call fcn.005d69e0
lea ecx, [ebp - 0x20f0]
call fcn.005dc430
lea ecx, [ebp - 0x24dc]
mov dword [ebp - 4], 0xf8
call fcn.005d9280
lea ecx, [ebp - 0x6cf0]
call fcn.00402e10
lea ecx, [ebp - 0x2328]
call fcn.005dc430
lea ecx, [ebp - 0x2190]
call fcn.005dc430
lea ecx, [ebp - 0x22f4]
call fcn.005dc430
lea ecx, [ebp - 0x1fa4]
mov byte [ebp - 4], 0x46
call fcn.005dc430
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push 0
push 0x1004
push dword [eax + 0xb8]
call fcn.005befd0
push 0xc
lea ecx, [ebp - 0x2800]
mov dword [ebp - 0x6f8c], eax
call fcn.00401d40
lea ecx, [ebp - 0x2800]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x27f4]
mov dword [ebp - 4], 0x111
call fcn.00401d40
lea ecx, [ebp - 0x27f4]
call fcn.005dc5e0
push 0xc
lea ecx, [ebp - 0x2990]
mov byte [ebp - 4], 0x12
call fcn.00401d40
lea ecx, [ebp - 0x2990]
call fcn.005dc5e0
push 0
push str._r_n_r_n__Anti_Malware_scan:_r_n_r_n_tInfected_file_objects:_r_n
lea ecx, [ebp - 0x1fc8]
mov byte [ebp - 4], 0x13
call fcn.005e37e0
xor esi, esi
cmp dword [ebp - 0x6f8c], esi
jbe 0x52d546
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push esi
push dword [eax + 0xb8]
call fcn.005bb5c0
cmp eax, 0x51
jne 0x52d539
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push esi
push dword [eax + 0xb8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x2154]
call fcn.005dc1c0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push esi
push dword [eax + 0xb8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x2800]
call fcn.005dc1c0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 2
push esi
push dword [eax + 0xb8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x27f4]
call fcn.005dc1c0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 3
push esi
push dword [eax + 0xb8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x2990]
call fcn.005dc1c0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x2990]
call fcn.005dc190
push eax
push str._r_n_t_tModified_in:
lea ecx, [ebp - 0x27f4]
call fcn.005dc190
push eax
push str._r_n_t_tMalware_type:
lea ecx, [ebp - 0x2800]
call fcn.005dc190
push eax
push str._r_n_t_tThreat_level:
lea ecx, [ebp - 0x2154]
call fcn.005dc190
push eax
push str._r_n_t_tPath:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
inc esi
cmp esi, dword [ebp - 0x6f8c]
jb 0x52d432
push 0
push str._r_n_tInfected_registry_keys:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
push 0x18
lea ecx, [ebp - 0x29c8]
call fcn.00401e00
lea ecx, [ebp - 0x29c8]
call fcn.005d9320
xor esi, esi
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x6f8c], esi
jbe 0x52d730
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push esi
push dword [eax + 0xb8]
call fcn.005bb5c0
cmp eax, 0x52
jne 0x52d723
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push esi
push dword [eax + 0xb8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x2154]
call fcn.005dc1c0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 1
push esi
push dword [eax + 0xb8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x2800]
call fcn.005dc1c0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 2
push esi
push dword [eax + 0xb8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x27f4]
call fcn.005dc1c0
push 1
push 0x62bd28
lea ecx, [ebp - 0x2154]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x29c8]
call fcn.005d9070
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x29c8]
call fcn.005d9220
push eax
push str._r_n_t_tKey:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea ecx, [ebp - 0x29c8]
call fcn.005d9210
cmp eax, 1
jbe 0x52d68f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x29c8]
call fcn.005d9220
push eax
push str._r_n_t_tValue:
lea ecx, [ebp - 0x1f80]
call fcn.005da780
lea ecx, [ebp - 0x29c8]
call fcn.005d9210
cmp eax, 2
jbe 0x52d6d1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 2
lea ecx, [ebp - 0x29c8]
call fcn.005d9220
push eax
push str._r_n_t_tData:
lea ecx, [ebp - 0x1f80]
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0x27f4]
call fcn.005dc190
push eax
push str._r_n_t_tMalware_type:
lea ecx, [ebp - 0x2800]
call fcn.005dc190
push eax
push str._r_n_t_tThreat_level:
lea ecx, [ebp - 0x1f80]
call fcn.005da780
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
inc esi
cmp esi, dword [ebp - 0x6f8c]
jb 0x52d582
push 0
push str._r_n_tMalware_related_optional_fixes:_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
push str.Empty_temporary_folders
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Empty_temporary_folders_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
push str.Run_an_SFC_scan
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Run_an_SFC_scan_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
movsd xmm0, qword [edi + 0x390]
comisd xmm0, xmmword [0x6edac0]
jbe 0x52d7d8
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
push str.Repair_Windows_with_DISM
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Repair_Windows_with_DISM_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
push str.Reset_the_DNS_settings
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Reset_the_DNS_settings_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
push str.Reset_the_hosts_file
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Reset_the_hosts_file_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
push str.Reset_IP__Winsock_and_proxy
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Reset_IP__Winsock_and_proxy_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
push str.Reset_and_fix_the_Windows_firewall
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Reset_and_fix_the_Windows_firewall_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
push str.Reset_the_SubSystems_registry_key
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Reset_the_SubSystems_registry_key_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
mov ecx, dword [edi + 4]
push str.Reset_Windows_services_start_types
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Reset_Windows_services_start_types_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
push str.Reset_the_group_policies
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Reset_the_group_policies_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
push str.Reset_registry_and_file_permissions
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Reset_registry_and_file_permissions_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
push str.Reset_all_print_jobs
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Reset_all_print_jobs_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
push str.Fix_the_WMI__the_System_restore
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Fix_the_WMI__the_System_restore_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
push str.Fix_and_enable_Windows_update
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Fix_and_enable_Windows_update_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
mov ecx, dword [edi + 4]
push 0x53
push 0xffffffffffffffff
push 0
push str.Fix_Applications_not_responding
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Fix_Applications_not_responding_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
push str.Fix_the_Windows_store_and_Metro_apps
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Fix_the_Windows_store_and_Metro_apps_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
push dword [eax + 0xb8]
push 0xffffffffffffffff
push 0x53
push 0xffffffffffffffff
push 0
push str.Fix_corrupted_user_profiles
call fcn.005bbb80
push 0
push str._r_n_t_tOption_name:_Fix_corrupted_user_profiles_r_n_t_tItem_state:_Unchecked_r_n
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
movsd xmm0, qword [edi + 0x390]
lea ecx, [ebp - 0x1fc8]
xor eax, eax
comisd xmm0, xmmword [0x6edac0]
seta al
add eax, 8
add dword [edi + 0x24], eax
call fcn.005e4670
test eax, eax
je 0x52dc53
lea ecx, [ebp - 0x29d0]
call fcn.005d04b0
lea ecx, [ebp - 0x29d0]
call fcn.005d0510
mov edi, eax
lea ecx, [ebp - 0x29d0]
sub edi, dword [ebp - 0x7038]
mov esi, edx
lea edx, [ebp - 0x1f80]
sbb esi, dword [ebp - 0x702c]
call fcn.005d0520
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x1f80]
call fcn.005dc190
push eax
push str._r_n_r_n__End_of_scans_r_n_r_n_tScan_end_time:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push esi
push edi
xor edx, edx
lea ecx, [ebp - 0x1f80]
call fcn.005cfb90
mov ecx, dword [ebp - 0x6f7c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.._r_n_r_n
call fcn.0050db30
test al, al
mov edx, str.The_scan_completed_successfully
mov ecx, str.The_scan_was_cancelled_by_the_user
cmove ecx, edx
push ecx
push str.._r_n_r_n_t
lea ecx, [ebp - 0x1f80]
call fcn.005dc190
push eax
push str._tScan_duration:
lea ecx, [ebp - 0x1f80]
call fcn.005dc200
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
push 0
push str._r_n_End_of_report
lea ecx, [ebp - 0x1fc8]
call fcn.005e37e0
lea ecx, [ebp - 0x1fc8]
call fcn.005e4680
mov edi, eax
lea ecx, [ebp - 0x1f80]
add edi, 0x26
mov esi, edx
adc esi, 0
push esi
push edi
call fcn.005db580
lea ecx, [ebp - 0x1f80]
call fcn.005dc3a0
add eax, eax
add edi, eax
adc esi, 0
push esi
push edi
lea ecx, [ebp - 0x1f80]
call fcn.005db580
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x67346c
lea ecx, [ebp - 0x1f80]
call fcn.005da780
lea eax, [ebp - 0x1f80]
push eax
lea ecx, [ebp - 0x1fc8]
call fcn.005e3a10
mov edi, dword [ebp - 0x6f7c]
jmp 0x52dc5e
lea ecx, [edi + 0x11c]
call fcn.005dc400
lea ecx, [ebp - 0x1f74]
call fcn.005d5440
lea ecx, [ebp - 0x2570]
call fcn.005d5440
push 5
lea ecx, [edi + 0x33c]
call fcn.005dad50
lea ecx, [edi + 0x33c]
call fcn.005dc190
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0x64
push dword [eax + 0x34]
call fcn.005b9910
push 0
mov ecx, edi
call fcn.0050db30
test al, al
mov edx, str.Scan_complete.
mov eax, dword [edi + 8]
mov ecx, str.Scan_aborted.
cmove ecx, edx
push ecx
mov ecx, dword [edi + 4]
push dword [eax + 0x38]
call fcn.005bcd30
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..LOG
lea ecx, [edi + 0x134]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2154]
call fcn.005dc200
lea ecx, [ebp - 0x2154]
call fcn.005dc190
mov esi, 2
mov ecx, eax
mov edx, esi
call fcn.005e4c40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..blf
lea ecx, [edi + 0x134]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2154]
call fcn.005dc200
lea ecx, [ebp - 0x2154]
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005e4c40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..regtrans_ms
lea ecx, [edi + 0x134]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2154]
call fcn.005dc200
lea ecx, [ebp - 0x2154]
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005e4c40
lea ecx, [edi + 0x248]
call fcn.005ad750
lea ecx, [ebp - 0x29c8]
xor esi, esi
call fcn.005d9280
lea ecx, [ebp - 0x2990]
call fcn.005dc430
lea ecx, [ebp - 0x27f4]
call fcn.005dc430
lea ecx, [ebp - 0x2800]
call fcn.005dc430
lea ecx, [ebp - 0x213c]
call fcn.005dc430
lea ecx, [ebp - 0x6e04]
call fcn.00403be0
lea ecx, [ebp - 0x21e0]
call fcn.005dd5d0
lea ecx, [ebp - 0x2574]
call fcn.005b0bc0
lea ecx, [ebp - 0x2984]
call fcn.005dc430
lea ecx, [ebp - 0x6dfc]
call fcn.00403be0
lea ecx, [ebp - 0x6d4c]
call fcn.00401510
lea ecx, [ebp - 0x1fc8]
call fcn.00401e20
lea ecx, [ebp - 0x25e0]
call fcn.005dc430
lea ecx, [ebp - 0x1f80]
call fcn.005dc430
lea ecx, [ebp - 0x2960]
call fcn.005dc430
lea ecx, [ebp - 0x2780]
call fcn.005dc430
lea ecx, [ebp - 0x2a64]
call fcn.005d6b00
lea ecx, [ebp - 0x2a18]
call fcn.005d6ab0
lea ecx, [ebp - 0x6cec]
call fcn.005d6ab0
lea ecx, [ebp - 0x2570]
call fcn.005d69e0
lea ecx, [ebp - 0x1f74]
call fcn.005d69e0
lea ecx, [ebp - 0x25ec]
call fcn.005dc430
lea ecx, [ebp - 0x296c]
call fcn.005dc430
lea ecx, [ebp - 0x264c]
call fcn.005dc430
lea ecx, [ebp - 0x2640]
call fcn.005dc430
lea ecx, [ebp - 0x2954]
call fcn.005dc430
lea ecx, [ebp - 0x2948]
call fcn.005dc430
lea ecx, [ebp - 0x280c]
call fcn.005dc430
lea ecx, [ebp - 0x26f0]
call fcn.005dc430
lea ecx, [ebp - 0x26fc]
call fcn.005dc430
lea ecx, [ebp - 0x2708]
call fcn.005dc430
lea ecx, [ebp - 0x293c]
call fcn.005dc430
lea ecx, [ebp - 0x2818]
call fcn.005dc430
lea ecx, [ebp - 0x25b0]
call fcn.005dc430
lea ecx, [ebp - 0x2930]
call fcn.005dc430
lea ecx, [ebp - 0x2900]
call fcn.005dc430
lea ecx, [ebp - 0x2720]
call fcn.005dc430
lea ecx, [ebp - 0x250c]
call fcn.005dc430
lea ecx, [ebp - 0x2978]
call fcn.005dc430
lea ecx, [ebp - 0x25bc]
call fcn.005dc430
lea ecx, [ebp - 0x2a00]
call fcn.005dc430
lea ecx, [ebp - 0x2160]
call fcn.005dc430
lea ecx, [ebp - 0x226c]
call fcn.005dc430
lea ecx, [ebp - 0x2874]
call fcn.005dc430
lea ecx, [ebp - 0x2114]
call fcn.005dc430
lea ecx, [ebp - 0x2154]
call fcn.005dc430
lea ecx, [ebp - 0x1f8c]
call fcn.005dc430
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret