Function at 0x5011b0
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f59d9
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x180
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x104], esi
push 0
push str.Scan_and_Create_Log
call fcn.0045f680
mov ecx, esi
mov dword [ebp - 0x188], eax
call fcn.0043e530
test al, al
je 0x50274d
push 1
push str.https:__www.carifred.com_uvk_help_createlog.php
lea ecx, [esi + 0x119c]
call fcn.005dc260
mov edi, dword [esi + 0x14e4]
lea ecx, [esi + 0x1448]
push str.Scan_and_create_log
mov dword [ebp - 0x118], edi
call fcn.005dc510
mov ecx, dword [esi + 0x100]
call fcn.005d2f10
push ecx
push 4
push dword [esi + 0x50]
mov edx, 5
mov dword [ebp - 0x108], eax
push dword [esi + 0x4c]
mov ecx, eax
push 0x1f4
push 0x20d
push 0x2d
call fcn.005d22b0
push ecx
mov ecx, dword [ebp - 0x108]
mov edx, 0x20f
push 4
push dword [esi + 0x50]
push dword [esi + 0x4c]
push 0xe4
push 0xda
push 0x64
call fcn.005d22b0
push ecx
mov ecx, dword [ebp - 0x108]
mov edx, 0x20f
push 4
push dword [esi + 0x50]
push dword [esi + 0x4c]
push 0xdc
push 0xda
push 0x145
call fcn.005d22b0
push ecx
mov ecx, dword [ebp - 0x108]
mov edx, 0x16d
push 4
push dword [esi + 0x50]
push dword [esi + 0x4c]
push 0x3c
push 0x8c
push 0x55
call fcn.005d22b0
push 0
push 0
push dword [ebp - 0x108]
mov ecx, edi
call fcn.005c44c0
mov ecx, dword [ebp - 0x108]
test ecx, ecx
je 0x50130a
mov eax, dword [ecx]
push 1
call dword [eax]
movsd xmm1, qword [0x6edb48]
mov ecx, edi
push 0
push str.Arial
push 1
push 0x320
call fcn.005c42b0
push 0xffffffffffffffff
push 0x10000101
push 0x20
push 0x1fe
push 5
push 0xa
push str.Scan_and_create_log
mov ecx, edi
call fcn.005c0890
push dword [esi + 0x1438]
mov ecx, edi
push 0xffffffffffffffff
call fcn.005bec70
push 0x5a
push 0xc8
push 5
push 0x21c
mov ecx, esi
call fcn.0045fec0
movsd xmm1, qword [0x6edb08]
mov ecx, edi
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0
mov ecx, edi
call fcn.005c44a0
push 0xffffffffffffffff
push 0x10020101
push 0x11
push 0x3c
push 0x5f
push 0x195
push str.Select:
call fcn.005c0890
push ecx
push 0xffffffffffffffff
push ecx
push 0
push str.Select_all__CtrlA_
push 1
push ecx
push 0x32
push 0x73
push 0x181
push str._All
mov ecx, esi
call fcn.0045fbe0
push ecx
push 0xffffffffffffffff
push ecx
push 0
push str.Select_none__CtrlN_
push 0
push ecx
push 0x32
push 0x73
push 0x1b8
push str._None
mov ecx, esi
mov dword [ebp - 0x110], eax
call fcn.0045fbe0
movsd xmm1, qword [0x6edaf8]
mov ecx, edi
push 0
push str.Arial
push 1
push 0x190
mov dword [ebp - 0x108], eax
call fcn.005c42b0
push 0xffffffffffffffff
push 0x10020100
push 0x12
push 0x186
push 0x37
push 0x46
push str.Choose_the_areas_you_want_to_scan_below:
mov ecx, edi
call fcn.005c0890
push dword [esi + 0x1438]
mov ecx, edi
push 0xffffffffffffffff
call fcn.005bec70
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_show_the_running_processes_and_memory_modules_in_the_report.
push 1
push ecx
push 0x10e
push 0x55
push 0x28
push str._Running_processes_and_memory_modules
mov ecx, esi
call fcn.0045fc60
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_show_the_winlogon_and_startup_entries_in_the_report.
push 1
push ecx
push 0xc8
push 0x6e
push 0x28
push str._Winlogon_and_Startup_entries
mov ecx, esi
mov dword [ebp - 0x170], eax
call fcn.0045fc60
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_show_the_Internet_explorer_toolbars__browser_r_nhelper_objects_and_shell_execute_hooks_in_the_report.
push 1
push ecx
push 0x118
push 0x87
push 0x28
push str._IE_Toolbars__BHO_and_Shell_execute_hooks
mov ecx, esi
mov dword [ebp - 0x16c], eax
call fcn.0045fc60
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_show_the_image_hijacks_and_file_or_folder_global_context_menus_in_the_report.
push 1
push ecx
push 0x10e
push 0xa0
push 0x28
push str._Image_Hijacks_and_Global_context_menus
mov ecx, esi
mov dword [ebp - 0x168], eax
call fcn.0045fc60
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_show_the_services__drivers_and_scheduled_tasks_in_the_report.
push 1
push ecx
push 0x10e
push 0xb9
push 0x28
push str._Services__Drivers_and_Scheduled_tasks
mov ecx, esi
mov dword [ebp - 0x164], eax
call fcn.0045fc60
mov dword [ebp - 0x160], eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_show_the_uninstall_list_and_the_most_recently_accessed_programs_in_the_report.
push 1
push ecx
push 0xfa
push 0xd2
push 0x28
push str._Uninstall_list_and_Shell_MUI_cache
mov ecx, esi
call fcn.0045fc60
xorps xmm0, xmm0
mov dword [ebp - 0x15c], eax
lea ecx, [ebp - 0x40]
movq qword [ebp - 0x40], xmm0
mov dword [ebp - 0x38], 0
call fcn.005dc5e0
sub esp, 8
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x4c]
movq qword [ebp - 0x4c], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__Application_data_and_Program_files
push dword [esi + 0x1c]
push str._Contents_of
call fcn.005dc520
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_show_the_contents_of_these_folders_in_the_report.
push 1
push ecx
push 0x12c
push 0xeb
push 0x28
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0045fc60
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_show_the_security_providers_and_the_hosts_file_blocked_domains_in_the_report.
push 1
push ecx
push 0xfa
push 0x104
push 0x28
push str._LSA_providers_and_Blocked_hosts
mov ecx, esi
mov dword [ebp - 0x158], eax
call fcn.0045fc60
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_search_for_unsafe_ADS_and_add_them_to_the_report.
push 1
push ecx
push 0xfa
push 0x11d
push 0x28
mov dword [ebp - 0x154], eax
mov ecx, esi
push str._Unsafe_alternate_data_streams
call fcn.0045fc60
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_search_for_recent_files_based_on_the_given_criteria_and_show_them_in_the_report.
push 1
push ecx
push 0x5f
push 0x136
push 0x28
push str._Recent_files
mov ecx, esi
mov dword [ebp - 0x150], eax
call fcn.0045fc60
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x10
push 0x23
push 0x137
push 0x87
push str.Max:
mov ecx, edi
mov dword [ebp - 0x14c], eax
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x32
push 0x135
push 0xa5
push 0x679058
mov ecx, edi
call fcn.005c0a40
push 0
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x130], eax
call fcn.0043db50
sub esp, 8
mov ecx, edi
push 0x2da
push 1
push dword [ebp - 0x130]
call fcn.005bf960
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x10
push 0x46
push 0x137
push 0xdc
push str.days.___Exts:
mov ecx, edi
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0xe1
push 0x135
push 0x122
push str..exe.dll.com.vbs.cmd.bat.reg.sys.vbe.scr
mov ecx, edi
call fcn.005c0a40
push 0
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x17c], eax
call fcn.0043db50
push 0
push str.Enter_the_file_extensions_to_search_for__including_the_dot___sepatated_by___.
push 0xffffffffffffffff
mov ecx, esi
call fcn.0045b370
push 0x403
push 0xffffffffffffffff
mov ecx, edi
call fcn.005bda80
ret
or eax, dword [eax]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_run_the_custom_scans_listed_in_the_text_box_below._r_nValid_modes_are:__Reg____Dir____File__and__VTReport_.
push 1
push ecx
push 0x50
push 0x14f
push 0x28
push str._Custom:
mov ecx, esi
call fcn.0045fc60
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x82
push 0x1ef
push 0x163
push 0x14
push 0
mov ecx, edi
mov dword [ebp - 0x148], eax
call fcn.005c0c90
push 0x833
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x11c], eax
call fcn.005bda80
push 0
push str.Enter_commands_for_custom_scans_here._Valid_modes_are:_r_n_Reg____Dir____File__and__VtReport___for__VirusTotal_report__r_nIn_the_lines_below_the_mode_keyword__enter_the_path_of_the_items_to_scan.
push 0xffffffffffffffff
mov ecx, edi
call fcn.005bcd30
movsd xmm0, qword [0x6edaf8]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push 0
push ecx
push 0x190
push 0xffffffffffffffff
mov ecx, edi
call fcn.005beb10
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x10
push 0x12c
push 0x1ed
push 0x41
push str.Choose_where_you_want_the_report_to_be_saved:
mov ecx, edi
call fcn.005c0890
push dword [esi + 0x1438]
mov ecx, edi
push 0xffffffffffffffff
call fcn.005bec70
add esi, 0x1460
lea ecx, [ebp - 0x40]
push esi
call fcn.005dc4e0
mov ecx, esi
call fcn.005dc400
lea ecx, [ebp - 0x40]
call fcn.005dbeb0
mov esi, dword [ebp - 0x104]
test al, al
je 0x501857
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._log.txt
lea ecx, [esi + 0x143c]
call fcn.005dc190
push eax
push 0x624284
push 0
lea ecx, [esi + 0x1290]
call fcn.0057bb00
push eax
lea ecx, [ebp - 0x40]
call fcn.005dc200
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14
push 0x16d
push 0x1ff
push 0x23
lea ecx, [ebp - 0x40]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005c0a40
push 0
push 0xffffffffffffffff
mov ecx, esi
mov dword [ebp - 0x138], eax
call fcn.0043db50
push 0x423
push 0xffffffffffffffff
mov ecx, edi
call fcn.005bda80
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Choose_the_path_and_file_name_for_the_report_file.
push 0x1a
push 0x64
push 0x1fc
push 0x19a
push 0x78
push str.Browse
call fcn.0045fd50
push 0x422
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x184], eax
call fcn.005bda80
push 0xffffffffffffffff
push 0x10000101
push 0x11
push 0xd2
push 0x6e
push 0x212
push str.Scan_options:
mov ecx, edi
call fcn.005c0890
movsd xmm0, qword [0x6edaf8]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push 0
push ecx
push 0x190
push 0xffffffffffffffff
mov ecx, edi
call fcn.005beb10
push dword [esi + 0x1438]
mov ecx, edi
push 0xffffffffffffffff
call fcn.005bec70
push 0
mov ecx, edi
call fcn.005c44a0
mov eax, dword [esi + 0x1f70]
push ecx
push 0xffffffffffffffff
push ecx
push 0
push str.Not_to_show_system_protected_files_in_the_report.
push 0
push ecx
push 0xb8
push 0x82
push 0x226
push str._Hide_system_protected_files
mov ecx, esi
mov dword [ebp - 0x114], eax
mov dword [esi + 0x1f70], 0
call fcn.0045fbe0
test byte [ebp - 0x114], 2
mov dword [ebp - 0x13c], eax
je 0x50198b
push 4
push 0xffffffffffffffff
mov ecx, edi
call fcn.005bd3f0
push ecx
push 0xffffffffffffffff
push ecx
push 0
push str.Not_to_show_Microsoft_files_in_the_report.
push 1
push ecx
push 0x731
push 0x9b
push 0x226
push str._Hide_all_Microsoft_files
mov ecx, esi
call fcn.0045fbe0
test byte [ebp - 0x114], 8
mov dword [ebp - 0x140], eax
je 0x5019ce
push 8
push 0xffffffffffffffff
mov ecx, edi
call fcn.005bd3f0
push ecx
push 0xffffffffffffffff
push ecx
push 0
push str.Not_to_show_digitally_signed_files_in_the_report.
push 0
push ecx
push 0xb8
push 0xb4
push 0x226
push str._Hide_all_digitally_signed_files
mov ecx, esi
call fcn.0045fbe0
test byte [ebp - 0x114], 4
mov dword [ebp - 0x128], eax
je 0x501a11
push 4
push 0xffffffffffffffff
mov ecx, edi
call fcn.005bd3f0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_verify_the_digital_signatures_of_the_scanned_files.This_increases_the_time_to_create_the_log__but_makes_it_much_easier_to_analyze.
push 1
push ecx
push 0xb8
push 0xdc
push 0x226
push str._Verify_file_signatures
mov ecx, esi
call fcn.0045fc60
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_calculate_the_MD5_hash_for_all_the_scanned_files_and_show_it_in_the_report.
push 1
push ecx
push 0xb8
push 0xf5
push 0x226
push str._Show_file_MD5_hash
mov ecx, esi
mov dword [ebp - 0x144], eax
call fcn.0045fc60
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_log_recent_folders_when_searching_for_recent_files.
push 1
push ecx
push 0xb8
push 0x10e
push 0x226
push str._Include_recent_folders
mov ecx, esi
mov dword [ebp - 0x18c], eax
call fcn.0045fc60
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push str.Whether_to_scan_all_users._If_this_option_is_not_selected__only_the_current_user_will_be_scanned.
push 1
push ecx
push 0xb8
push 0x127
push 0x226
push str._Scan_all_users
mov ecx, esi
mov dword [ebp - 0x174], eax
call fcn.0045fc60
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Start_the_scan__Ctrl__Enter_
push 0x5a
push 0x55
push 0x156
push 0x224
push 0x99
push str.Start_scan
mov dword [ebp - 0x178], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.If_the_log_has_already_been_created__this_will_open_it_with_the_Log_Analyzer.Otherwise__it_will_just_run_the_Log_Analyzer.
push 0x5a
push 0x55
push 0x156
push 0x27e
push 0x69
push str.Analyze_log
mov dword [ebp - 0x124], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Show_online_help__F1_.
push 0x5a
push 0x55
push 0x1b5
push 0x224
push 0x7d
push str.Help
mov dword [ebp - 0x180], eax
call fcn.0045fdf0
push 0
push ecx
mov dword [esp], 0x41500000
mov ecx, esi
push str.Go_back_to_the_Home_page__Esc_.
push 0x5a
push 0x55
push 0x1b5
push 0x27e
push 0xb3
push str.Home
mov dword [esi + 0x11bc], eax
call fcn.0045fdf0
mov ecx, eax
mov byte [ebp - 0x34], 9
mov eax, 0x41
mov dword [esi + 0x11c0], ecx
mov word [ebp - 0x32], ax
mov eax, dword [ebp - 0x110]
mov word [ebp - 0x30], ax
mov eax, 0x4e
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x108]
mov word [ebp - 0x2a], ax
mov eax, 0xd
mov word [ebp - 0x26], ax
mov eax, dword [ebp - 0x124]
mov word [ebp - 0x24], ax
mov eax, 0x70
mov word [ebp - 0x20], ax
mov ax, word [esi + 0x11bc]
mov word [ebp - 0x1e], ax
mov eax, 0x1b
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x34]
push 5
mov word [ebp - 0x18], cx
mov ecx, edi
push eax
mov byte [ebp - 0x2e], 9
mov byte [ebp - 0x28], 9
mov byte [ebp - 0x22], 1
mov byte [ebp - 0x1c], 1
call fcn.005c47a0
mov ecx, esi
mov byte [ebp - 0xfd], 0
mov dword [ebp - 0x134], 0
call fcn.0045f300
mov edx, dword [ebp - 0x114]
lea ecx, [esi + 0x14d8]
mov edi, dword [ebp - 0x118]
lea eax, [esi + 0x14a8]
and edx, 1
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x120], ecx
nop dword [eax + eax]
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x12c], eax
test edx, edx
je 0x501c82
mov edx, dword [ebp - 0x120]
mov dword [edx], edi
mov edx, dword [ebp - 0x124]
mov dword [eax], edx
jmp 0x501c9f
push 0
mov ecx, esi
call fcn.004771c0
test eax, eax
je 0x502723
mov ecx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
cmp eax, 0xfffffffa
je 0x502723
mov dword [ebp - 0x120], ecx
cmp dword [ecx], edi
jne 0x5026cf
cmp eax, dword [ebp - 0x124]
jne 0x50224a
xor eax, eax
xor esi, esi
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0xdc], eax
push 4
push dword [ebp + esi*4 - 0x170]
mov ecx, edi
call fcn.005bc500
test eax, eax
je 0x501cfa
mov edx, esi
call fcn.00404890
call fcn.005e9c20
or dword [ebp - 0x10c], eax
inc esi
cmp esi, 0xb
jb 0x501cd4
push 4
push dword [ebp - 0x13c]
mov ecx, edi
call fcn.005bc500
test eax, eax
je 0x501d20
mov esi, 1
mov dword [ebp - 0xdc], esi
jmp 0x501d60
push 4
push dword [ebp - 0x140]
mov ecx, edi
call fcn.005bc500
test eax, eax
je 0x501d40
mov esi, 2
mov dword [ebp - 0xdc], esi
jmp 0x501d60
push 4
push dword [ebp - 0x128]
mov ecx, edi
call fcn.005bc500
test eax, eax
je 0x501d5a
mov esi, 4
jmp 0x501d73
mov esi, dword [ebp - 0xdc]
push 4
push dword [ebp - 0x144]
mov ecx, edi
call fcn.005bc500
test eax, eax
je 0x501d7c
or esi, 8
mov dword [ebp - 0xdc], esi
push 4
push dword [ebp - 0x18c]
mov ecx, edi
call fcn.005bc500
or esi, 0x10
mov ecx, edi
push 4
push dword [ebp - 0x174]
test eax, eax
cmove esi, dword [ebp - 0xdc]
call fcn.005bc500
mov ecx, dword [ebp - 0x118]
mov edi, esi
or edi, 0x20
test eax, eax
push 4
push dword [ebp - 0x178]
cmove edi, esi
call fcn.005bc500
push dword [ebp - 0x138]
mov esi, edi
or esi, 0x40
test eax, eax
cmove esi, edi
mov edi, dword [ebp - 0x118]
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x40]
call fcn.005dc1c0
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x74]
movq qword [ebp - 0x74], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x68]
movq qword [ebp - 0x68], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
lea ecx, [ebp - 0x5c]
movq qword [ebp - 0x5c], xmm0
call fcn.005dc5e0
push dword [ebp - 0x130]
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.005bc230
push eax
lea ecx, [ebp - 0x74]
call fcn.005dc1c0
push dword [ebp - 0x17c]
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x68]
call fcn.005dc1c0
push dword [ebp - 0x11c]
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc1c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x679c18
lea ecx, [ebp - 0x5c]
call fcn.005da780
mov eax, dword [ebp - 0x104]
lea ecx, [ebp - 0xd8]
push 0xd
xorps xmm0, xmm0
movups xmmword [ebp - 0xd8], xmm0
push dword [eax + 0x11bc]
movups xmmword [ebp - 0xc8], xmm0
push dword [eax + 0x11c0]
push dword [ebp - 0x110]
push edi
call fcn.005b8800
mov ecx, dword [ebp - 0x104]
sub esp, 8
mov byte [ebp - 4], 5
push 0x50
push 0x1c2
push 0
push str.Preparing_to_scan...
call fcn.0043da60
mov ecx, dword [ebp - 0x104]
push 1
push str.Cancel_scan
lea ecx, [ecx + 0x14f0]
call fcn.005b64a0
mov eax, dword [ebp - 0x104]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0xfc], eax
mov byte [ebp - 0xf8], 0
call fcn.005dc190
lea ecx, [ebp - 0x68]
mov dword [ebp - 0xf4], eax
call fcn.005dc190
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0xf0], eax
call fcn.005dc190
mov dword [ebp - 0xec], eax
lea ecx, [ebp - 0x74]
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], esi
call fcn.005dafe0
push 0
push 0
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0xfc]
push eax
push 0x469bc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0xdc], esi
mov byte [ebp - 4], 6
xor edx, edx
mov ecx, esi
mov dword [ebp - 0x50], 0
call fcn.005cca30
test al, al
je 0x501feb
mov edi, dword [ebp - 0x104]
nop dword [eax]
push 0
push 0
mov ecx, edi
call fcn.0043d720
test eax, eax
je 0x501fd8
mov al, byte [ebp - 0xf8]
movzx ecx, al
test al, al
mov eax, 1
cmove ecx, eax
mov byte [ebp - 0xf8], cl
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x501fb0
mov edi, dword [ebp - 0x118]
lea eax, [ebp - 0x50]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, dword [ebp - 0x104]
push 2
lea ecx, [ecx + 0x14f0]
call fcn.005b6250
cmp dword [ebp - 0x50], 0
je 0x5021e9
lea ecx, [ebp - 0x4c]
call fcn.005cf7a0
cmp dword [ebp - 0x50], 1
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x10c], str._r_n____The_scan_competed_successfully_at
je 0x502038
mov dword [ebp - 0x10c], str._r_n____The_scan_was_cancelled_at
call fcn.005dc190
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
push eax
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x4c]
call fcn.005dc200
xorps xmm0, xmm0
lea ecx, [ebp - 0x40]
push 0
push 0x21
movups xmmword [ebp - 0xb8], xmm0
movups xmmword [ebp - 0xa8], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0xb8]
call fcn.005e4770
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0xb8]
call fcn.005e3a10
mov ecx, dword [ebp - 0x104]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._Scan_Log_File._
lea ecx, [ecx + 0x143c]
call fcn.005dc190
push eax
push str._r_n_____End_of
lea ecx, [ebp - 0x4c]
call fcn.005dc200
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xb8]
call fcn.005e3a10
push ecx
lea ecx, [ebp - 0xb8]
call fcn.005e36a0
mov ecx, dword [ebp - 0x104]
mov eax, dword [ecx + 0x1f68]
and eax, 3
cmp al, 3
je 0x5021c8
sub esp, 8
mov dword [ebp - 0x78], 0
xorps xmm0, xmm0
lea ecx, [ecx + 0x150]
movq qword [ebp - 0x80], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x679d74
call fcn.005dc190
push eax
lea ecx, [ebp - 0x80]
call fcn.005dc520
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 8
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x502186
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624388
lea ecx, [ebp - 0x40]
call fcn.005dc190
push eax
push 0x62e4a8
lea ecx, [ebp - 0x80]
call fcn.005da780
mov eax, dword [ebp - 0x104]
test dword [eax + 0x1f68], 3
jne 0x5021c0
push 0
push 5
lea ecx, [eax + 0x150]
call fcn.005dc190
lea ecx, [ebp - 0x80]
mov edi, eax
call fcn.005dc190
mov edx, edi
mov ecx, eax
call fcn.005e2c60
mov edi, dword [ebp - 0x118]
lea ecx, [ebp - 0x80]
call fcn.005dc430
lea ecx, [ebp - 0xb0]
call fcn.005d9280
mov eax, dword [ebp - 0xb8]
cmp eax, 0xffffffff
je 0x5021e9
test eax, eax
je 0x5021e9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x114], 0
jne 0x5026e6
cmp esi, 0xffffffff
je 0x502206
test esi, esi
je 0x502206
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xd8]
call fcn.005b8790
lea ecx, [ebp - 0x5c]
call fcn.005dc430
lea ecx, [ebp - 0x68]
call fcn.005dc430
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.005dc430
mov esi, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x114]
jmp 0x501c55
cmp eax, dword [ebp - 0x180]
jne 0x502332
sub esp, 8
mov dword [ebp - 0x84], 0
xorps xmm0, xmm0
lea ecx, [esi + 0x150]
movq qword [ebp - 0x8c], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x679d74
call fcn.005dc190
push eax
lea ecx, [ebp - 0x8c]
call fcn.005dc520
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 9
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5022e1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624388
lea ecx, [ebp - 0x40]
call fcn.005dc190
push eax
push 0x62e4a8
lea ecx, [ebp - 0x8c]
call fcn.005da780
push 0
push 5
lea ecx, [esi + 0x150]
call fcn.005dc190
lea ecx, [ebp - 0x8c]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005e2c60
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 1
call fcn.005dc430
mov esi, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x114]
jmp 0x501c55
cmp eax, dword [esi + 0x11c0]
je 0x50276b
cmp eax, dword [ebp - 0x170]
je 0x502655
cmp eax, dword [ebp - 0x16c]
je 0x502655
cmp eax, dword [ebp - 0x168]
je 0x502655
cmp eax, dword [ebp - 0x164]
je 0x502655
cmp eax, dword [ebp - 0x160]
je 0x502655
cmp eax, dword [ebp - 0x15c]
je 0x502655
mov eax, dword [esi + 0x14a8]
cmp eax, dword [ebp - 0x158]
je 0x502655
cmp eax, dword [ebp - 0x154]
je 0x502655
cmp eax, dword [ebp - 0x150]
je 0x502655
cmp eax, dword [ebp - 0x14c]
je 0x502655
cmp dword [ebp - 0x134], 0
jne 0x502443
cmp eax, dword [ebp - 0x148]
je 0x5023e0
cmp eax, 0xffffffb3
jne 0x502443
mov ecx, dword [ebp - 0x11c]
cmp dword [esi + 0x14b4], ecx
jne 0x502443
push 0
push 0
push dword [ebp - 0x11c]
mov ecx, edi
mov dword [ebp - 0x134], 1
call fcn.005bcd30
movsd xmm0, qword [0x6edaf8]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push str.Courier_new
push ecx
push 0x190
push dword [ebp - 0x11c]
mov ecx, edi
call fcn.005beb10
push 0x80
push dword [ebp - 0x11c]
mov ecx, edi
call fcn.005bd3f0
push 4
push dword [ebp - 0x148]
jmp 0x5026c8
cmp eax, dword [ebp - 0x184]
jne 0x50254f
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc4e0
sub esp, 8
mov dword [ebp - 0x90], 0
xorps xmm0, xmm0
lea ecx, [esi + 0x143c]
movq qword [ebp - 0x98], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._log
call fcn.005dc190
push eax
lea ecx, [ebp - 0x98]
call fcn.005dc520
push dword [ebp - 0x188]
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0xa
push 0x679da4
call fcn.005dc190
push eax
push 8
push str.Text_files__.txt__.log_
push ecx
lea ecx, [esi + 0x1290]
call fcn.0057baa0
push eax
mov edx, str.Choose_log_path
lea ecx, [ebp - 0x4c]
call fcn.005e1e60
test al, al
jne 0x502505
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.005dc430
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x114]
jmp 0x501c60
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x40]
call fcn.005dc4e0
push 0
lea ecx, [ebp - 0x40]
call fcn.005dc190
push eax
push dword [ebp - 0x138]
mov ecx, edi
call fcn.005bcd30
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.005dc430
mov ecx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x114]
jmp 0x501c55
cmp eax, dword [ebp - 0x13c]
je 0x502633
cmp eax, dword [ebp - 0x140]
je 0x502633
cmp eax, dword [ebp - 0x128]
je 0x502633
cmp eax, dword [ebp - 0x110]
jne 0x5025d3
push 8
push dword [ebp - 0x108]
mov ecx, edi
call fcn.005bd3f0
push 4
push dword [ebp - 0x110]
mov ecx, edi
call fcn.005bd3f0
xor esi, esi
nop dword [eax + eax]
push 4
push dword [ebp + esi*4 - 0x170]
mov ecx, edi
call fcn.005bd3f0
inc esi
cmp esi, 0xa
jl 0x5025a0
mov esi, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x114]
jmp 0x501c55
mov ecx, dword [ebp - 0x108]
cmp eax, ecx
jne 0x5026cf
push 4
push ecx
mov ecx, edi
call fcn.005bd3f0
push 8
push dword [ebp - 0x110]
mov ecx, edi
call fcn.005bd3f0
xor esi, esi
nop dword [eax]
push 8
push dword [ebp + esi*4 - 0x170]
mov ecx, edi
call fcn.005bd3f0
inc esi
cmp esi, 0xa
jl 0x502600
mov esi, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x114]
jmp 0x501c55
push 4
push dword [ebp - 0x128]
mov ecx, edi
call fcn.005bc500
neg eax
sbb eax, eax
and eax, 0x24
add eax, 0x20
push eax
push dword [ebp - 0x144]
jmp 0x5026c8
mov dword [ebp - 0x10c], 0
xor esi, esi
push 4
push dword [ebp + esi*4 - 0x170]
mov ecx, edi
call fcn.005bc500
mov ecx, dword [ebp - 0x10c]
neg eax
sbb eax, eax
inc esi
neg eax
add ecx, eax
mov dword [ebp - 0x10c], ecx
cmp esi, 0xa
jl 0x502661
mov esi, dword [ebp - 0x104]
test ecx, ecx
jne 0x5026a8
push 8
push dword [ebp - 0x110]
mov ecx, edi
call fcn.005bd3f0
push 4
jmp 0x5026c2
cmp ecx, 0xa
mov ecx, edi
jne 0x5026b3
push 4
jmp 0x5026b5
push 8
push dword [ebp - 0x110]
call fcn.005bd3f0
push 8
push dword [ebp - 0x108]
mov ecx, edi
call fcn.005bd3f0
mov ecx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x114]
jmp 0x501c55
cmp esi, 0xffffffff
je 0x5026f6
test esi, esi
je 0x5026f6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xd8]
call fcn.005b8790
lea ecx, [ebp - 0x5c]
call fcn.005dc430
lea ecx, [ebp - 0x68]
call fcn.005dc430
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.005dc430
mov esi, dword [ebp - 0x104]
mov dl, byte [ebp - 0xfd]
xor dl, 1
mov ecx, esi
movzx edx, dl
push edx
call fcn.0045f260
lea ecx, [ebp - 0x4c]
call fcn.005dc430
lea ecx, [ebp - 0x40]
call fcn.005dc430
mov al, byte [ebp - 0xfd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
mov dl, 1
mov byte [ebp - 0xfd], dl
jmp 0x502729